@frontmcp/sdk 0.4.0 → 0.5.0

package/src/auth/flows/oauth.callback.flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.callback.flow.js","sourceRoot":"","sources":["../../../../src/auth/flows/oauth.callback.flow.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAEH,yCAUsB;AACtB,6BAAwB;AAExB,mCAAgD;AAChD,8BAAmC;AAEnC,MAAM,WAAW,GAAG,wBAAe,CAAC;AAEpC,MAAM,WAAW,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3B,oBAAoB;IACpB,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,oCAAoC;IACpC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY;IACZ,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,wCAAwC;IACxC,aAAa,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,uBAAuB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9C,kBAAkB;IAClB,WAAW,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,iBAAiB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjD,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,UAAU;IACV,cAAc,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,OAAC,CAAC,KAAK,CAAC,CAAC,2BAAkB,EAAE,uBAAc,CAAC,CAAC,CAAC;AAEnE,MAAM,IAAI,GAAG;IACX,GAAG,EAAE,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAC1C,OAAO,EAAE,CAAC,uBAAuB,EAAE,yBAAyB,EAAE,kBAAkB,CAAC;CAC9C,CAAC;AActC,MAAM,IAAI,GAAG,gBAAyB,CAAC;AACvC,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AAajB,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,iBAAqB;IAC1D,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAGxD,AAAN,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAElC,4CAA4C;QAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAuB,CAAC;QAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAuB,CAAC;QAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAuB,CAAC;QAEzD,mDAAmD;QACnD,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,MAAM,CAAC;QAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAuB,CAAC;QAElE,6BAA6B;QAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,MAAM,CAAC;QAC1D,kEAAkE;QAClE,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,iBAAuC,CAAC;QAC5C,IAAI,cAAc,EAAE,CAAC;YACnB,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QACxF,CAAC;QAED,+CAA+C;QAC/C,kEAAkE;QAClE,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,aAAmC,CAAC;QACxC,IAAI,UAAU,EAAE,CAAC;YACf,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YACb,aAAa;YACb,KAAK;YACL,IAAI;YACJ,aAAa;YACb,WAAW;YACX,WAAW;YACX,iBAAiB;YACjB,aAAa;SACd,CAAC,CAAC;QAEH,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,WAAW,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,iBAAiB,EAAE,MAAM,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACzG,CAAC;QAED,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,aAAa,CAAC,MAAM,iBAAiB,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAGK,AAAN,KAAK,CAAC,mBAAmB;QACvB,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAE1G,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACxD,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAClH,OAAO;QACT,CAAC;QAED,2EAA2E;QAC3E,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QAED,qCAAqC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAwB,CAAC;QACtD,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAAC;QAE9F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,aAAa,EAAE,CAAC,CAAC;YACjF,IAAI,CAAC,OAAO,CACV,oBAAW,CAAC,IAAI,CACd,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,sDAAsD,CAAC,EAC/F,GAAG,CACJ,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,uFAAuF;QACvF,yEAAyE;QACzE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhE,mDAAmD;QACnD,IAAI,gBAAsC,CAAC;QAC3C,IAAI,WAAW,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;YAC9C,MAAM,YAAY,GAAG,WAAW,CAAC,cAAc,CAAC,WAAW,CAAC;YAC5D,MAAM,QAAQ,GAAG,iBAAiB,IAAI,EAAE,CAAC;YACzC,gBAAgB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;QAED,oBAAoB;QACpB,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC;QAC7D,2FAA2F;QAC3F,MAAM,kBAAkB,GAAG,cAAc,IAAI,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,gBAAgB,CAAC;QAEnH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YACb,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,aAAa,EAAE,WAAW,CAAC,IAAI,CAAC,SAAS;YACzC,aAAa,EAAE,WAAW,CAAC,KAAK;YAChC,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,OAAO;YACP,4DAA4D;YAC5D,aAAa,EAAE,WAAW,CAAC,aAAa,IAAI,aAAa;YACzD,WAAW,EAAE,WAAW,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW;YAC9D,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,iBAAiB,EAAE,WAAW,CAAC,iBAAiB;YAChD,uBAAuB,EAAE,WAAW,CAAC,uBAAuB;YAC5D,kBAAkB;YAClB,WAAW,EAAE,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,cAAc;YACxD,iBAAiB,EAAE,iBAAiB;YACpC,gBAAgB,EAAE,gBAAgB;YAClC,UAAU;YACV,cAAc;YACd,aAAa,EAAE,kBAAkB;SAClC,CAAC,CAAC;QAEH,qCAAqC;QACrC,MAAM,SAAS,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC;IAC/E,CAAC;IAED;;;;OAIG;IAEG,AAAN,KAAK,CAAC,qBAAqB;QACzB,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,uBAAuB,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAExF,+BAA+B;QAC/B,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW,EAAE,CAAC;YACnC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,WAAW,EAAE,CAAC,CAAC;QAEjF,oCAAoC;QACpC,iDAAiD;QACjD,uEAAuE;QACvE,2DAA2D;QAE3D,4EAA4E;QAC5E,6DAA6D;QAE7D,yDAAyD;QACzD,sEAAsE;QACtE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,sCAAsC,WAAW,oBAAoB,uBAAuB,IAAI,MAAM,EAAE,CACzG,CAAC;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,uBAAuB;QAC3B,MAAM,EACJ,QAAQ,EACR,WAAW,EACX,MAAM,EACN,aAAa,EACb,aAAa,EACb,QAAQ,EACR,KAAK,EACL,IAAI,EACJ,OAAO;QACP,8BAA8B;QAC9B,cAAc,EACd,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,gBAAgB,GACjB,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAExB,8DAA8D;QAC9D,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5D,MAAM,aAAa,GAAG;gBACpB,CAAC,QAAQ,IAAI,UAAU;gBACvB,CAAC,WAAW,IAAI,aAAa;gBAC7B,CAAC,aAAa,IAAI,eAAe;gBACjC,CAAC,OAAO,IAAI,SAAS;aACtB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjG,IAAI,CAAC,OAAO,CACV,oBAAW,CAAC,IAAI,CACd,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,wDAAwD,CAAC,EAC9F,GAAG,CACJ,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAwB,CAAC;QAEtD,4DAA4D;QAC5D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,uBAAuB,CAAC;YACnD,QAAQ;YACR,WAAW;YACX,MAAM,EAAE,MAAM,IAAI,EAAE;YACpB,aAAa;YACb,OAAO;YACP,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,aAAa;YACpB,QAAQ;YACR,mCAAmC;YACnC,eAAe,EAAE,aAAa;YAC9B,mBAAmB,EAAE,iBAAiB;YACtC,kBAAkB,EAAE,gBAAgB;YACpC,cAAc,EAAE,cAAc;YAC9B,kBAAkB,EAAE,WAAW;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wCAAwC,OAAO,GAC7C,cAAc,CAAC,CAAC,CAAC,SAAS,aAAa,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAC1E,GAAG,WAAW,CAAC,CAAC,CAAC,oBAAoB,iBAAiB,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CACxF,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAGK,AAAN,KAAK,CAAC,gBAAgB;QACpB,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAE1G,wCAAwC;QACxC,IAAI,CAAC,WAAW,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC3E,IAAI,CAAC,OAAO,CACV,oBAAW,CAAC,IAAI,CACd,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,qDAAqD,CAAC,EAC3F,GAAG,CACJ,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,qDAAqD;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAChD,IAAI,aAAa,EAAE,CAAC;YAClB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC/C,CAAC;QAED,2DAA2D;QAC3D,+DAA+D;QAC/D,IAAI,aAAa,IAAI,WAAW,EAAE,CAAC;YACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,0BAA0B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,GACjD,aAAa,CAAC,CAAC,CAAC,0BAA0B,WAAW,GAAG,CAAC,CAAC,CAAC,EAC7D,EAAE,CACH,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC;IAED;;;OAGG;IACK,eAAe,CAAC,KAAa;QACnC,+DAA+D;QAC/D,kDAAkD;QAClD,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,iBAAiB;QACjB,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;IACtH,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,KAAa,EAAE,WAAmB;QACxD,sDAAsD;QACtD,MAAM,SAAS,GAAG,IAAA,eAAU,EAAC,KAAK,CAAC,CAAC;QACpC,MAAM,eAAe,GAAG,IAAA,eAAU,EAAC,WAAW,CAAC,CAAC;QAEhD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAyCuB,SAAS;SAClC,eAAe;;;;QAIhB,CAAC;IACP,CAAC;CACF,CAAA;AA7UO;IADL,KAAK,CAAC,YAAY,CAAC;;;;mDAoDnB;AAGK;IADL,KAAK,CAAC,qBAAqB,CAAC;;;;4DA0E5B;AAQK;IADL,KAAK,CAAC,uBAAuB,CAAC;;;;8DAwB9B;AAGK;IADL,KAAK,CAAC,yBAAyB,CAAC;;;;gEAiEhC;AAGK;IADL,KAAK,CAAC,kBAAkB,CAAC;;;;yDAoCzB;AA3QkB,iBAAiB;IAXrC,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,IAAI;QACJ,WAAW;QACX,YAAY;QACZ,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE;YACV,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,iBAAiB;SACxB;KACF,CAAC;GACmB,iBAAiB,CAiVrC;kBAjVoB,iBAAiB","sourcesContent":["/**\n * OAuth Callback Endpoint — GET /oauth/callback\n *\n * Who calls: Browser after user completes login form\n *\n * When: After the user submits the login form from /oauth/authorize\n *\n * Purpose: Creates an authorization code and redirects back to the client's redirect_uri\n *\n * Notes: This is a simple \"demo\" login callback. In production, this would integrate\n * with a real identity provider or user database.\n */\n\nimport {\n  Flow,\n  FlowBase,\n  FlowPlan,\n  FlowRunOptions,\n  httpInputSchema,\n  HttpRedirectSchema,\n  httpRespond,\n  HttpHtmlSchema,\n  StageHookOf,\n} from '../../common';\nimport { z } from 'zod';\nimport { LocalPrimaryAuth } from '../instances/instance.local-primary-auth';\nimport { randomUUID, createHash } from 'crypto';\nimport { escapeHtml } from '../ui';\n\nconst inputSchema = httpInputSchema;\n\nconst stateSchema = z.object({\n  // From query params\n  pendingAuthId: z.string().optional(),\n  email: z.string().optional(),\n  name: z.string().optional(),\n  // From pending authorization record\n  clientId: z.string().optional(),\n  redirectUri: z.string().optional(),\n  scopes: z.array(z.string()).optional(),\n  codeChallenge: z.string().optional(),\n  originalState: z.string().optional(),\n  resource: z.string().optional(),\n  // Generated\n  authorizationCode: z.string().optional(),\n  userSub: z.string().optional(),\n  // Progressive/Incremental Authorization\n  isIncremental: z.boolean().default(false),\n  targetAppId: z.string().optional(),\n  targetToolId: z.string().optional(),\n  existingSessionId: z.string().optional(),\n  existingAuthorizationId: z.string().optional(),\n  // Federated Login\n  isFederated: z.boolean().default(false),\n  selectedProviders: z.array(z.string()).optional(),\n  skippedProviders: z.array(z.string()).optional(),\n  // Consent\n  consentEnabled: z.boolean().default(false),\n  selectedTools: z.array(z.string()).optional(),\n});\n\nconst outputSchema = z.union([HttpRedirectSchema, HttpHtmlSchema]);\n\nconst plan = {\n  pre: ['parseInput', 'validatePendingAuth'],\n  execute: ['handleIncrementalAuth', 'createAuthorizationCode', 'redirectToClient'],\n} as const satisfies FlowPlan<string>;\n\ndeclare global {\n  interface ExtendFlows {\n    'oauth:callback': FlowRunOptions<\n      OauthCallbackFlow,\n      typeof plan,\n      typeof inputSchema,\n      typeof outputSchema,\n      typeof stateSchema\n    >;\n  }\n}\n\nconst name = 'oauth:callback' as const;\nconst Stage = StageHookOf(name);\n\n@Flow({\n  name,\n  plan,\n  inputSchema,\n  outputSchema,\n  access: 'public',\n  middleware: {\n    method: 'GET',\n    path: '/oauth/callback',\n  },\n})\nexport default class OauthCallbackFlow extends FlowBase<typeof name> {\n  private logger = this.scope.logger.child('OauthCallbackFlow');\n\n  @Stage('parseInput')\n  async parseInput() {\n    const { request } = this.rawInput;\n\n    // Extract login form data from query params\n    const pendingAuthId = request.query['pending_auth_id'] as string | undefined;\n    const email = request.query['email'] as string | undefined;\n    const name = request.query['name'] as string | undefined;\n\n    // Progressive/Incremental Authorization Parameters\n    const isIncremental = request.query['incremental'] === 'true';\n    const targetAppId = request.query['app_id'] as string | undefined;\n\n    // Federated Login Parameters\n    const isFederated = request.query['federated'] === 'true';\n    // providers can be array (multiple checkboxes) or string (single)\n    const providersParam = request.query['providers'];\n    let selectedProviders: string[] | undefined;\n    if (providersParam) {\n      selectedProviders = Array.isArray(providersParam) ? providersParam : [providersParam];\n    }\n\n    // Consent Parameters (from POST body or query)\n    // Note: For consent, we might use POST, but GET is also supported\n    const toolsParam = request.query['tools'];\n    let selectedTools: string[] | undefined;\n    if (toolsParam) {\n      selectedTools = Array.isArray(toolsParam) ? toolsParam : [toolsParam];\n    }\n\n    this.state.set({\n      pendingAuthId,\n      email,\n      name,\n      isIncremental,\n      targetAppId,\n      isFederated,\n      selectedProviders,\n      selectedTools,\n    });\n\n    if (isIncremental) {\n      this.logger.info(`Incremental auth callback for app: ${targetAppId}`);\n    }\n\n    if (isFederated) {\n      this.logger.info(`Federated login callback with ${selectedProviders?.length || 0} selected providers`);\n    }\n\n    if (selectedTools && selectedTools.length > 0) {\n      this.logger.info(`Consent callback with ${selectedTools.length} selected tools`);\n    }\n  }\n\n  @Stage('validatePendingAuth')\n  async validatePendingAuth() {\n    const { pendingAuthId, email, isIncremental, isFederated, selectedProviders, selectedTools } = this.state;\n\n    if (!pendingAuthId) {\n      this.logger.warn('Missing pending_auth_id in callback');\n      this.respond(httpRespond.html(this.renderErrorPage('invalid_request', 'Missing pending_auth_id parameter'), 400));\n      return;\n    }\n\n    // For incremental auth, email is not required (user already authenticated)\n    if (!isIncremental && !email) {\n      this.logger.warn('Missing email in callback');\n      this.respond(httpRespond.html(this.renderErrorPage('invalid_request', 'Email is required'), 400));\n      return;\n    }\n\n    // Retrieve the pending authorization\n    const localAuth = this.scope.auth as LocalPrimaryAuth;\n    const pendingAuth = await localAuth.authorizationStore.getPendingAuthorization(pendingAuthId);\n\n    if (!pendingAuth) {\n      this.logger.warn(`Pending authorization not found or expired: ${pendingAuthId}`);\n      this.respond(\n        httpRespond.html(\n          this.renderErrorPage('invalid_request', 'Authorization request has expired. Please try again.'),\n          400,\n        ),\n      );\n      return;\n    }\n\n    // Generate a user sub from email (in production, this would come from a user database)\n    // For incremental auth, we might need to use existing session's user sub\n    const userSub = email ? this.generateUserSub(email) : undefined;\n\n    // Calculate skipped providers from federated login\n    let skippedProviders: string[] | undefined;\n    if (isFederated && pendingAuth.federatedLogin) {\n      const allProviders = pendingAuth.federatedLogin.providerIds;\n      const selected = selectedProviders || [];\n      skippedProviders = allProviders.filter((id) => !selected.includes(id));\n    }\n\n    // Get consent state\n    const consentEnabled = pendingAuth.consent?.enabled ?? false;\n    // If consent was enabled and user submitted selection, use it; otherwise use all available\n    const finalSelectedTools = consentEnabled && selectedTools ? selectedTools : pendingAuth.consent?.availableToolIds;\n\n    this.state.set({\n      clientId: pendingAuth.clientId,\n      redirectUri: pendingAuth.redirectUri,\n      scopes: pendingAuth.scopes,\n      codeChallenge: pendingAuth.pkce.challenge,\n      originalState: pendingAuth.state,\n      resource: pendingAuth.resource,\n      userSub,\n      // Progressive/Incremental Authorization from pending record\n      isIncremental: pendingAuth.isIncremental || isIncremental,\n      targetAppId: pendingAuth.targetAppId || this.state.targetAppId,\n      targetToolId: pendingAuth.targetToolId,\n      existingSessionId: pendingAuth.existingSessionId,\n      existingAuthorizationId: pendingAuth.existingAuthorizationId,\n      // Federated Login\n      isFederated: isFederated || !!pendingAuth.federatedLogin,\n      selectedProviders: selectedProviders,\n      skippedProviders: skippedProviders,\n      // Consent\n      consentEnabled,\n      selectedTools: finalSelectedTools,\n    });\n\n    // Clean up the pending authorization\n    await localAuth.authorizationStore.deletePendingAuthorization(pendingAuthId);\n  }\n\n  /**\n   * Handle incremental authorization - expand existing session's token vault\n   * For incremental auth, we add the app to the existing authorization without\n   * requiring full re-authentication\n   */\n  @Stage('handleIncrementalAuth')\n  async handleIncrementalAuth() {\n    const { isIncremental, targetAppId, existingAuthorizationId, redirectUri } = this.state;\n\n    // Skip if not incremental auth\n    if (!isIncremental || !targetAppId) {\n      return;\n    }\n\n    this.logger.info(`Processing incremental authorization for app: ${targetAppId}`);\n\n    // For incremental auth, we need to:\n    // 1. Validate the existing session (if provided)\n    // 2. Generate a special incremental auth code that includes the app ID\n    // 3. The token endpoint will then expand the authorization\n\n    // For now, we pass the incremental auth info through the authorization code\n    // The token exchange will handle expanding the authorization\n\n    // Store incremental auth metadata for the token exchange\n    // This will be encoded in the authorization code or stored separately\n    this.logger.info(\n      `Incremental auth prepared for app: ${targetAppId}, existing auth: ${existingAuthorizationId || 'none'}`,\n    );\n  }\n\n  @Stage('createAuthorizationCode')\n  async createAuthorizationCode() {\n    const {\n      clientId,\n      redirectUri,\n      scopes,\n      codeChallenge,\n      originalState,\n      resource,\n      email,\n      name,\n      userSub,\n      // Consent and Federated Login\n      consentEnabled,\n      selectedTools,\n      isFederated,\n      selectedProviders,\n      skippedProviders,\n    } = this.state.required;\n\n    // Validate required fields before creating authorization code\n    if (!clientId || !redirectUri || !codeChallenge || !userSub) {\n      const missingFields = [\n        !clientId && 'clientId',\n        !redirectUri && 'redirectUri',\n        !codeChallenge && 'codeChallenge',\n        !userSub && 'userSub',\n      ].filter(Boolean);\n      this.logger.error(`Missing required fields for authorization code: ${missingFields.join(', ')}`);\n      this.respond(\n        httpRespond.html(\n          this.renderErrorPage('server_error', 'Authorization request is incomplete. Please try again.'),\n          500,\n        ),\n      );\n      return;\n    }\n\n    const localAuth = this.scope.auth as LocalPrimaryAuth;\n\n    // Create the authorization code with consent/federated data\n    const code = await localAuth.createAuthorizationCode({\n      clientId,\n      redirectUri,\n      scopes: scopes ?? [],\n      codeChallenge,\n      userSub,\n      userEmail: email,\n      userName: name,\n      state: originalState,\n      resource,\n      // Consent and Federated Login Data\n      selectedToolIds: selectedTools,\n      selectedProviderIds: selectedProviders,\n      skippedProviderIds: skippedProviders,\n      consentEnabled: consentEnabled,\n      federatedLoginUsed: isFederated,\n    });\n\n    this.logger.info(\n      `Authorization code created for user: ${userSub}${\n        consentEnabled ? ` with ${selectedTools?.length || 0} selected tools` : ''\n      }${isFederated ? ` (federated with ${selectedProviders?.length || 0} providers)` : ''}`,\n    );\n    this.state.set('authorizationCode', code);\n  }\n\n  @Stage('redirectToClient')\n  async redirectToClient() {\n    const { redirectUri, authorizationCode, originalState, isIncremental, targetAppId } = this.state.required;\n\n    // Validate required fields for redirect\n    if (!redirectUri || !authorizationCode) {\n      this.logger.error('Missing redirectUri or authorizationCode for redirect');\n      this.respond(\n        httpRespond.html(\n          this.renderErrorPage('server_error', 'Failed to complete authorization. Please try again.'),\n          500,\n        ),\n      );\n      return;\n    }\n\n    // Build the redirect URL with the authorization code\n    const url = new URL(redirectUri);\n    url.searchParams.set('code', authorizationCode);\n    if (originalState) {\n      url.searchParams.set('state', originalState);\n    }\n\n    // For incremental auth, include the app ID in the redirect\n    // This allows the client to know which app was just authorized\n    if (isIncremental && targetAppId) {\n      url.searchParams.set('incremental', 'true');\n      url.searchParams.set('app_id', targetAppId);\n    }\n\n    this.logger.info(\n      `Redirecting to client: ${url.origin}${url.pathname}${\n        isIncremental ? ` (incremental for app: ${targetAppId})` : ''\n      }`,\n    );\n    this.respond(httpRespond.redirect(url.toString()));\n  }\n\n  /**\n   * Generate a stable user sub from email\n   * In production, this would be the user's ID from the database\n   */\n  private generateUserSub(email: string): string {\n    // Create a deterministic UUID from the email for demo purposes\n    // In production, this would be the actual user ID\n    const hash = createHash('sha256').update(email.toLowerCase()).digest('hex');\n    // Format as UUID\n    return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-${hash.slice(12, 16)}-${hash.slice(16, 20)}-${hash.slice(20, 32)}`;\n  }\n\n  /**\n   * Render an error page\n   */\n  private renderErrorPage(error: string, description: string): string {\n    // Escape user-provided content to prevent XSS attacks\n    const safeError = escapeHtml(error);\n    const safeDescription = escapeHtml(description);\n\n    return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"UTF-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n  <title>Authorization Error</title>\n  <style>\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;\n      background: #f5f5f5;\n      min-height: 100vh;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      padding: 20px;\n    }\n    .error-container {\n      background: white;\n      padding: 40px;\n      border-radius: 12px;\n      box-shadow: 0 4px 20px rgba(0,0,0,0.1);\n      max-width: 500px;\n      text-align: center;\n    }\n    .error-icon { font-size: 48px; margin-bottom: 20px; }\n    h1 { color: #e53e3e; margin-bottom: 10px; }\n    p { color: #666; line-height: 1.6; }\n    .error-code { font-family: monospace; background: #f5f5f5; padding: 4px 8px; border-radius: 4px; }\n    .retry-link {\n      display: inline-block;\n      margin-top: 20px;\n      color: #667eea;\n      text-decoration: none;\n    }\n    .retry-link:hover { text-decoration: underline; }\n  </style>\n</head>\n<body>\n  <div class=\"error-container\">\n    <div class=\"error-icon\">⚠️</div>\n    <h1>Authorization Error</h1>\n    <p><span class=\"error-code\">${safeError}</span></p>\n    <p>${safeDescription}</p>\n    <a href=\"javascript:history.back()\" class=\"retry-link\">← Go Back</a>\n  </div>\n</body>\n</html>`;\n  }\n}\n"]}

package/src/auth/flows/oauth.register.flow.d.ts

@@ -38,33 +38,16 @@ export declare const DevClientRegistry: {
     has(client_id: string): boolean;
 };
 declare const inputSchema: z.ZodObject<{
-    request: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
-    response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
-    next: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
-}, "strip", z.ZodTypeAny, {
-    request: {} & {
-        [k: string]: unknown;
-    };
-    response: {} & {
-        [k: string]: unknown;
-    };
-    next?: ((...args: unknown[]) => unknown) | undefined;
-}, {
-    request: {} & {
-        [k: string]: unknown;
-    };
-    response: {} & {
-        [k: string]: unknown;
-    };
-    next?: ((...args: unknown[]) => unknown) | undefined;
-}>;
+    request: z.ZodObject<{}, z.core.$loose>;
+    response: z.ZodObject<{}, z.core.$loose>;
+    next: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
+}, z.core.$strip>;
 declare const outputSchema: z.ZodObject<{
     kind: z.ZodLiteral<"json">;
-    status: z.ZodEffects<z.ZodNumber, number, number>;
-    body: z.ZodUnion<[z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>, z.ZodArray<z.ZodAny, "many">, z.ZodRecord<z.ZodString, z.ZodAny>]>;
+    status: z.ZodNumber;
+    body: z.ZodUnion<readonly [z.ZodObject<{}, z.core.$loose>, z.ZodArray<z.ZodAny>, z.ZodRecord<z.ZodString, z.ZodAny>]>;
     contentType: z.ZodDefault<z.ZodString>;
-} & {
-    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>]>>>>;
+    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>]>>>>;
     cookies: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
         value: z.ZodString;
@@ -72,114 +55,38 @@ declare const outputSchema: z.ZodObject<{
         domain: z.ZodOptional<z.ZodString>;
         httpOnly: z.ZodDefault<z.ZodBoolean>;
         secure: z.ZodOptional<z.ZodBoolean>;
-        sameSite: z.ZodOptional<z.ZodEnum<["lax", "strict", "none"]>>;
+        sameSite: z.ZodOptional<z.ZodEnum<{
+            lax: "lax";
+            strict: "strict";
+            none: "none";
+        }>>;
         maxAge: z.ZodOptional<z.ZodNumber>;
         expires: z.ZodOptional<z.ZodDate>;
-    }, "strip", z.ZodTypeAny, {
-        value: string;
-        path: string;
-        name: string;
-        httpOnly: boolean;
-        domain?: string | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }, {
-        value: string;
-        name: string;
-        path?: string | undefined;
-        domain?: string | undefined;
-        httpOnly?: boolean | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }>, "many">>>;
-}, "strip", z.ZodTypeAny, {
-    status: number;
-    kind: "json";
-    body: any[] | z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | Record<string, any>;
-    contentType: string;
-    headers?: Record<string, string | string[]> | undefined;
-    cookies?: {
-        value: string;
-        path: string;
-        name: string;
-        httpOnly: boolean;
-        domain?: string | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }[] | undefined;
-}, {
-    status: number;
-    kind: "json";
-    body: any[] | z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | Record<string, any>;
-    headers?: Record<string, string | string[]> | undefined;
-    cookies?: {
-        value: string;
-        name: string;
-        path?: string | undefined;
-        domain?: string | undefined;
-        httpOnly?: boolean | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }[] | undefined;
-    contentType?: string | undefined;
-}>;
+    }, z.core.$strip>>>>;
+}, z.core.$strip>;
 declare const stateSchema: z.ZodObject<{
     body: z.ZodObject<{
-        redirect_uris: z.ZodArray<z.ZodString, "many">;
-        token_endpoint_auth_method: z.ZodDefault<z.ZodEnum<["none", "client_secret_basic", "client_secret_post", "private_key_jwt", "tls_client_auth"]>>;
-        grant_types: z.ZodDefault<z.ZodArray<z.ZodEnum<["authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code"]>, "many">>;
-        response_types: z.ZodDefault<z.ZodArray<z.ZodEnum<["code"]>, "many">>;
+        redirect_uris: z.ZodArray<z.ZodString>;
+        token_endpoint_auth_method: z.ZodDefault<z.ZodEnum<{
+            none: "none";
+            client_secret_basic: "client_secret_basic";
+            client_secret_post: "client_secret_post";
+            private_key_jwt: "private_key_jwt";
+            tls_client_auth: "tls_client_auth";
+        }>>;
+        grant_types: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            authorization_code: "authorization_code";
+            refresh_token: "refresh_token";
+            "urn:ietf:params:oauth:grant-type:device_code": "urn:ietf:params:oauth:grant-type:device_code";
+        }>>>;
+        response_types: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            code: "code";
+        }>>>;
         client_name: z.ZodOptional<z.ZodString>;
         scope: z.ZodOptional<z.ZodString>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        redirect_uris: z.ZodArray<z.ZodString, "many">;
-        token_endpoint_auth_method: z.ZodDefault<z.ZodEnum<["none", "client_secret_basic", "client_secret_post", "private_key_jwt", "tls_client_auth"]>>;
-        grant_types: z.ZodDefault<z.ZodArray<z.ZodEnum<["authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code"]>, "many">>;
-        response_types: z.ZodDefault<z.ZodArray<z.ZodEnum<["code"]>, "many">>;
-        client_name: z.ZodOptional<z.ZodString>;
-        scope: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        redirect_uris: z.ZodArray<z.ZodString, "many">;
-        token_endpoint_auth_method: z.ZodDefault<z.ZodEnum<["none", "client_secret_basic", "client_secret_post", "private_key_jwt", "tls_client_auth"]>>;
-        grant_types: z.ZodDefault<z.ZodArray<z.ZodEnum<["authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code"]>, "many">>;
-        response_types: z.ZodDefault<z.ZodArray<z.ZodEnum<["code"]>, "many">>;
-        client_name: z.ZodOptional<z.ZodString>;
-        scope: z.ZodOptional<z.ZodString>;
-    }, z.ZodTypeAny, "passthrough">>;
+    }, z.core.$loose>;
     isDev: z.ZodBoolean;
-}, "strip", z.ZodTypeAny, {
-    body: {
-        redirect_uris: string[];
-        token_endpoint_auth_method: "none" | "client_secret_basic" | "client_secret_post" | "private_key_jwt" | "tls_client_auth";
-        grant_types: ("authorization_code" | "refresh_token" | "urn:ietf:params:oauth:grant-type:device_code")[];
-        response_types: "code"[];
-        scope?: string | undefined;
-        client_name?: string | undefined;
-    } & {
-        [k: string]: unknown;
-    };
-    isDev: boolean;
-}, {
-    body: {
-        redirect_uris: string[];
-        scope?: string | undefined;
-        token_endpoint_auth_method?: "none" | "client_secret_basic" | "client_secret_post" | "private_key_jwt" | "tls_client_auth" | undefined;
-        grant_types?: ("authorization_code" | "refresh_token" | "urn:ietf:params:oauth:grant-type:device_code")[] | undefined;
-        response_types?: "code"[] | undefined;
-        client_name?: string | undefined;
-    } & {
-        [k: string]: unknown;
-    };
-    isDev: boolean;
-}>;
+}, z.core.$strip>;
 declare const plan: {
     readonly pre: ["parseInput", "validateInput"];
     readonly execute: ["registerClient", "respondRegistration"];

package/src/auth/flows/oauth.token.flow.d.ts

@@ -30,7 +30,7 @@
  */
 /**
  *
- * OAuth 2.0 Device Authorization Grant (“device code flow”)
+ * OAuth 2.0 Device Authorization Grant ("device code flow")
  * Who does what (at a glance)
  *
  * Device/TV/CLI (no browser)
@@ -40,122 +40,66 @@
  * Visits the given verification_uri and authenticates using your normal OAuth login (whatever you already have). No new UI required beyond two tiny endpoints.
  *
  * Auth Server (you)
- * Stores the device transaction and, after the user authenticates, marks it as approved so the device’s /oauth/token polling succeeds.
+ * Stores the device transaction and, after the user authenticates, marks it as approved so the device's /oauth/token polling succeeds.
  *
- * Endpoints you need (only two “new” ones)
+ * Endpoints you need (only two "new" ones)
  *
  * POST /oauth/device_authorization ✅ (device calls)
  *
  * POST /oauth/token with grant urn:ietf:params:oauth:grant-type:device_code ✅ (device polls)
  *
- * GET /activate ➜ “UI handler” (user lands here from verification_uri — this just redirects into your existing /oauth/authorize)
+ * GET /activate ➜ "UI handler" (user lands here from verification_uri — this just redirects into your existing /oauth/authorize)
  *
- * GET /activate/callback ➜ “UI handler” (your existing flow returns here after the user logs in; you flip the device record to approved and show a basic “All set” page)
+ * GET /activate/callback ➜ "UI handler" (your existing flow returns here after the user logs in; you flip the device record to approved and show a basic "All set" page)
  *
- * That’s it. No pages with complex consent screens are required; reuse your normal /oauth/authorize
+ * That's it. No pages with complex consent screens are required; reuse your normal /oauth/authorize
  */
-import { FlowBase, FlowRunOptions } from "../../common";
-import { z } from "zod";
+import { FlowBase, FlowRunOptions } from '../../common';
+import { z } from 'zod';
 declare const inputSchema: z.ZodObject<{
-    request: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
-    response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
-    next: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
-}, "strip", z.ZodTypeAny, {
-    request: {} & {
-        [k: string]: unknown;
-    };
-    response: {} & {
-        [k: string]: unknown;
-    };
-    next?: ((...args: unknown[]) => unknown) | undefined;
-}, {
-    request: {} & {
-        [k: string]: unknown;
-    };
-    response: {} & {
-        [k: string]: unknown;
-    };
-    next?: ((...args: unknown[]) => unknown) | undefined;
-}>;
+    request: z.ZodObject<{}, z.core.$loose>;
+    response: z.ZodObject<{}, z.core.$loose>;
+    next: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
+}, z.core.$strip>;
 declare const stateSchema: z.ZodObject<{
-    body: z.ZodDiscriminatedUnion<"grant_type", [z.ZodObject<{
+    body: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
         grant_type: z.ZodLiteral<"anonymous">;
-        /** Public client identifier; UUID in your example */
         client_id: z.ZodString;
-        /** Target resource/audience is required for this custom flow */
-        resource: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        resource: string;
-        grant_type: "anonymous";
-        client_id: string;
-    }, {
-        resource: string;
-        grant_type: "anonymous";
-        client_id: string;
-    }>, z.ZodObject<{
+        resource: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
         grant_type: z.ZodLiteral<"authorization_code">;
-        /** Authorization code returned from the /authorize step */
         code: z.ZodString;
-        /** Must exactly match the redirect URI used when obtaining the code */
         redirect_uri: z.ZodString;
-        /** Public client identifier; UUID in your example */
         client_id: z.ZodString;
-        /** PKCE verifier bound to the code */
         code_verifier: z.ZodString;
-        /** Optional resource/audience (used by some providers like AAD v1) */
-        resource: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        code: string;
-        resource: string;
-        grant_type: "authorization_code";
-        client_id: string;
-        redirect_uri: string;
-        code_verifier: string;
-    }, {
-        code: string;
-        resource: string;
-        grant_type: "authorization_code";
-        client_id: string;
-        redirect_uri: string;
-        code_verifier: string;
-    }>]>;
+    }, z.core.$strip>, z.ZodObject<{
+        grant_type: z.ZodLiteral<"refresh_token">;
+        refresh_token: z.ZodString;
+        client_id: z.ZodString;
+    }, z.core.$strip>], "grant_type">>;
+    grantType: z.ZodOptional<z.ZodEnum<{
+        anonymous: "anonymous";
+        authorization_code: "authorization_code";
+        refresh_token: "refresh_token";
+    }>>;
     isDefaultAuthProvider: z.ZodBoolean;
-}, "strip", z.ZodTypeAny, {
-    body: {
-        resource: string;
-        grant_type: "anonymous";
-        client_id: string;
-    } | {
-        code: string;
-        resource: string;
-        grant_type: "authorization_code";
-        client_id: string;
-        redirect_uri: string;
-        code_verifier: string;
-    };
-    isDefaultAuthProvider: boolean;
-}, {
-    body: {
-        resource: string;
-        grant_type: "anonymous";
-        client_id: string;
-    } | {
-        code: string;
-        resource: string;
-        grant_type: "authorization_code";
-        client_id: string;
-        redirect_uri: string;
-        code_verifier: string;
-    };
-    isDefaultAuthProvider: boolean;
-}>;
+    isOrchestrated: z.ZodBoolean;
+    tokenResponse: z.ZodOptional<z.ZodObject<{
+        access_token: z.ZodString;
+        token_type: z.ZodLiteral<"Bearer">;
+        expires_in: z.ZodNumber;
+        refresh_token: z.ZodOptional<z.ZodString>;
+        scope: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    error: z.ZodOptional<z.ZodString>;
+    errorDescription: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 declare const outputSchema: z.ZodObject<{
     kind: z.ZodLiteral<"json">;
-    status: z.ZodEffects<z.ZodNumber, number, number>;
-    body: z.ZodUnion<[z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>, z.ZodArray<z.ZodAny, "many">, z.ZodRecord<z.ZodString, z.ZodAny>]>;
+    status: z.ZodNumber;
+    body: z.ZodUnion<readonly [z.ZodObject<{}, z.core.$loose>, z.ZodArray<z.ZodAny>, z.ZodRecord<z.ZodString, z.ZodAny>]>;
     contentType: z.ZodDefault<z.ZodString>;
-} & {
-    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>]>>>>;
+    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>]>>>>;
     cookies: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
         value: z.ZodString;
@@ -163,68 +107,18 @@ declare const outputSchema: z.ZodObject<{
         domain: z.ZodOptional<z.ZodString>;
         httpOnly: z.ZodDefault<z.ZodBoolean>;
         secure: z.ZodOptional<z.ZodBoolean>;
-        sameSite: z.ZodOptional<z.ZodEnum<["lax", "strict", "none"]>>;
+        sameSite: z.ZodOptional<z.ZodEnum<{
+            lax: "lax";
+            strict: "strict";
+            none: "none";
+        }>>;
         maxAge: z.ZodOptional<z.ZodNumber>;
         expires: z.ZodOptional<z.ZodDate>;
-    }, "strip", z.ZodTypeAny, {
-        value: string;
-        path: string;
-        name: string;
-        httpOnly: boolean;
-        domain?: string | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }, {
-        value: string;
-        name: string;
-        path?: string | undefined;
-        domain?: string | undefined;
-        httpOnly?: boolean | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }>, "many">>>;
-}, "strip", z.ZodTypeAny, {
-    status: number;
-    kind: "json";
-    body: any[] | z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | Record<string, any>;
-    contentType: string;
-    headers?: Record<string, string | string[]> | undefined;
-    cookies?: {
-        value: string;
-        path: string;
-        name: string;
-        httpOnly: boolean;
-        domain?: string | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }[] | undefined;
-}, {
-    status: number;
-    kind: "json";
-    body: any[] | z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | Record<string, any>;
-    headers?: Record<string, string | string[]> | undefined;
-    cookies?: {
-        value: string;
-        name: string;
-        path?: string | undefined;
-        domain?: string | undefined;
-        httpOnly?: boolean | undefined;
-        secure?: boolean | undefined;
-        sameSite?: "strict" | "lax" | "none" | undefined;
-        maxAge?: number | undefined;
-        expires?: Date | undefined;
-    }[] | undefined;
-    contentType?: string | undefined;
-}>;
+    }, z.core.$strip>>>>;
+}, z.core.$strip>;
 declare const plan: {
     readonly pre: ["parseInput", "validateInput"];
-    readonly execute: ["generateJWT", "buildAuthorizeOutput"];
+    readonly execute: ["handleAuthorizationCodeGrant", "handleRefreshTokenGrant", "handleAnonymousGrant", "buildTokenResponse"];
     readonly post: ["validateOutput"];
 };
 declare global {
@@ -234,9 +128,13 @@ declare global {
 }
 declare const name: "oauth:token";
 export default class OauthTokenFlow extends FlowBase<typeof name> {
+    private logger;
     parseInput(): Promise<void>;
     validateInput(): Promise<void>;
-    buildAuthorizeOutput(): Promise<void>;
+    handleAuthorizationCodeGrant(): Promise<void>;
+    handleRefreshTokenGrant(): Promise<void>;
+    handleAnonymousGrant(): Promise<void>;
+    buildTokenResponse(): Promise<void>;
     validateOutput(): Promise<void>;
 }
 export {};