@frontmcp/sdk 1.3.0 → 1.4.0

package/README.md

@@ -1,46 +1,45 @@
+<div align="center">
+
 # @frontmcp/sdk
 
-The core FrontMCP framework for building MCP servers and clients in TypeScript.
+**Build production-grade [MCP](https://modelcontextprotocol.io) servers in TypeScript — decorators, DI, and Streamable HTTP, batteries included.**
+
+[![npm](https://img.shields.io/npm/v/@frontmcp/sdk.svg)](https://www.npmjs.com/package/@frontmcp/sdk)
+[![node](https://img.shields.io/badge/node-%3E%3D24-339933?logo=node.js&logoColor=white)](https://nodejs.org)
+[![license](https://img.shields.io/npm/l/@frontmcp/sdk.svg)](https://github.com/agentfront/frontmcp/blob/main/LICENSE)
+
+[Docs][docs-home] &bull; [Quickstart][docs-quickstart] &bull; [SDK Reference][docs-sdk-ref]
 
-[![NPM](https://img.shields.io/npm/v/@frontmcp/sdk.svg)](https://www.npmjs.com/package/@frontmcp/sdk)
+</div>
+
+---
+
+FrontMCP turns the Model Context Protocol into a typed, declarative framework. You
+write `@Tool`, `@Resource`, and `@App` classes; the SDK handles the protocol,
+transport, sessions, auth, dependency injection, and execution flow — so the same
+server runs on your laptop and ships to production unchanged.
 
 ## Install
 
 ```bash
+npx frontmcp create my-app      # scaffold a new project (recommended)
+# …or add to an existing one:
 npm install @frontmcp/sdk
 ```
 
-> Most users should scaffold with `npx frontmcp create my-app` instead of installing manually. See [Installation][docs-install].
-
-## Features
-
-- **`@FrontMcp` server** — single decorator configures info, apps, HTTP, logging, session, auth ([docs][docs-server])
-- **`@App`** — group tools, resources, prompts into isolated domains ([docs][docs-apps])
-- **`@Tool`** — typed actions with Zod input schemas, class or function style ([docs][docs-tools])
-- **`@Resource`** — read-only data with static and template URIs ([docs][docs-resources])
-- **`@Prompt`** — reusable message templates returning `GetPromptResult` ([docs][docs-prompts])
-- **`@Agent`** — orchestrated multi-step tool chains ([docs][docs-agents])
-- **Elicitation** — request structured user input mid-flow ([docs][docs-elicitation])
-- **Skills** — HTTP-discoverable tool manifests for agent marketplaces ([docs][docs-skills])
-- **5 context classes** — `ToolContext`, `ResourceContext`, `PromptContext`, `AgentContext`, `HookContext`
-- **Direct client** — `create()`, `connect()`, `connectOpenAI()`, `connectClaude()`, `connectLangChain()`, `connectVercelAI()` ([docs][docs-direct])
-- **Authentication** — Remote OAuth, Local OAuth, JWKS, DCR, per-app auth surfaces ([docs][docs-auth])
-- **Sessions** — stateful / stateless modes, JWT or UUID transport IDs
-- **Hooks** — tool, list-tools, HTTP, resource, prompt hook families ([docs][docs-hooks])
-- **Ext-Apps** — mount external MCP servers as sub-apps ([docs][docs-ext-apps])
-- **Providers / DI** — scoped injection with GLOBAL and CONTEXT scopes ([docs][docs-providers])
-- **ConfigPlugin** — load `frontmcp.yaml` / `frontmcp.json` config files ([docs][docs-config])
-- **Transport** — Streamable HTTP + SSE ([docs][docs-transport])
-
-## Quick Example
+Requires **Node.js 24+**. Full guide → [Installation][docs-install].
+
+## Quick example
 
 ```ts
 import 'reflect-metadata';
-import { FrontMcp, App, Tool } from '@frontmcp/sdk';
+
 import { z } from 'zod';
 
+import { App, FrontMcp, Tool, ToolContext } from '@frontmcp/sdk';
+
 @Tool({ name: 'greet', inputSchema: { name: z.string() } })
-class GreetTool {
+class GreetTool extends ToolContext {
   async execute({ name }: { name: string }) {
     return `Hello, ${name}!`;
   }
@@ -53,26 +52,34 @@ class HelloApp {}
 export default class Server {}
 ```
 
-> Full walkthrough: [Quickstart][docs-quickstart]
-
-## Docs
-
-| Topic                     | Link                                                                                               |
-| ------------------------- | -------------------------------------------------------------------------------------------------- |
-| Server configuration      | [The FrontMCP Server][docs-server]                                                                 |
-| Apps & isolation          | [Apps][docs-apps]                                                                                  |
-| Tools, Resources, Prompts | [Tools][docs-tools] &middot; [Resources][docs-resources] &middot; [Prompts][docs-prompts]          |
-| Agents                    | [Agents][docs-agents]                                                                              |
-| Authentication            | [Auth Overview][docs-auth] &middot; [Remote OAuth][docs-remote] &middot; [Local OAuth][docs-local] |
-| Direct client             | [Direct Client][docs-direct]                                                                       |
-| Hooks & providers         | [Hooks][docs-hooks] &middot; [Providers][docs-providers]                                           |
-| Deployment                | [Local Dev][docs-deploy] &middot; [Production][docs-production]                                    |
-| SDK reference             | [Overview][docs-sdk-ref]                                                                           |
-
-## Related Packages
-
-- [`@frontmcp/cli`](../cli) — scaffolding and dev tooling
-- [`@frontmcp/auth`](../auth) — authentication library
+Run `npm run dev` and point any MCP client at it. Full walkthrough → [Quickstart][docs-quickstart].
+
+## What you get
+
+- **Build** — `@FrontMcp` server, `@App` domains, and typed `@Tool` / `@Resource` /
+  `@Prompt` primitives with Zod schemas; `@Agent` multi-step chains and `@Provider`
+  dependency injection.
+  &nbsp;([Tools][docs-tools] · [Resources][docs-resources] · [Prompts][docs-prompts] · [Agents][docs-agents] · [Providers][docs-providers])
+- **Secure** — Remote & Local OAuth, JWKS, Dynamic Client Registration, per-app auth,
+  and stateful / stateless sessions.
+  &nbsp;([Authentication][docs-auth])
+- **Operate** — Streamable HTTP + SSE transport, capability discovery, elicitation,
+  lifecycle hooks, and HTTP-discoverable skill manifests.
+  &nbsp;([Transport][docs-transport] · [Discovery][docs-discovery] · [Elicitation][docs-elicitation] · [Hooks][docs-hooks] · [Skills][docs-skills])
+- **Extend & embed** — plugins (Cache, Remember, CodeCall, Dashboard), the OpenAPI
+  adapter, mounting external MCP servers as sub-apps, and an in-process Direct Client
+  (`connectOpenAI` / `connectClaude` / `connectLangChain`).
+  &nbsp;([Plugins][docs-plugins] · [Adapters][docs-adapters] · [Ext-Apps][docs-ext-apps] · [Direct Client][docs-direct])
+- **Ship anywhere** — one codebase deploys to Node, Vercel, AWS Lambda, Cloudflare
+  Workers, or a serverless bundle.
+  &nbsp;([Deployment][docs-deploy])
+
+→ Everything is documented at **[docs.agentfront.dev/frontmcp][docs-home]**.
+
+## Related packages
+
+- [`@frontmcp/cli`](../cli) — scaffolding and dev tooling (`frontmcp create`, `dev`, `build`)
+- [`@frontmcp/auth`](../auth) — authentication, OAuth, JWKS, credential vault
 - [`@frontmcp/adapters`](../adapters) — OpenAPI adapter
 - [`@frontmcp/plugins`](../plugins) — Cache, Remember, CodeCall, Dashboard
 - [`@frontmcp/testing`](../testing) — E2E testing framework
@@ -80,29 +87,27 @@ export default class Server {}
 
 ## License
 
-Apache-2.0 — see [LICENSE](../../LICENSE).
+[Apache-2.0](../../LICENSE)
 
 <!-- links -->
 
+[docs-home]: https://docs.agentfront.dev/frontmcp 'FrontMCP Docs'
 [docs-install]: https://docs.agentfront.dev/frontmcp/getting-started/installation
 [docs-quickstart]: https://docs.agentfront.dev/frontmcp/getting-started/quickstart
-[docs-server]: https://docs.agentfront.dev/frontmcp/servers/server
-[docs-apps]: https://docs.agentfront.dev/frontmcp/servers/apps
+[docs-sdk-ref]: https://docs.agentfront.dev/frontmcp/sdk-reference/overview
 [docs-tools]: https://docs.agentfront.dev/frontmcp/servers/tools
 [docs-resources]: https://docs.agentfront.dev/frontmcp/servers/resources
 [docs-prompts]: https://docs.agentfront.dev/frontmcp/servers/prompts
 [docs-agents]: https://docs.agentfront.dev/frontmcp/servers/agents
-[docs-elicitation]: https://docs.agentfront.dev/frontmcp/servers/elicitation
-[docs-skills]: https://docs.agentfront.dev/frontmcp/servers/skills
+[docs-providers]: https://docs.agentfront.dev/frontmcp/extensibility/providers
 [docs-auth]: https://docs.agentfront.dev/frontmcp/authentication/overview
-[docs-remote]: https://docs.agentfront.dev/frontmcp/authentication/remote
-[docs-local]: https://docs.agentfront.dev/frontmcp/authentication/local
-[docs-direct]: https://docs.agentfront.dev/frontmcp/deployment/direct-client
 [docs-transport]: https://docs.agentfront.dev/frontmcp/deployment/transport
-[docs-ext-apps]: https://docs.agentfront.dev/frontmcp/servers/ext-apps
+[docs-discovery]: https://docs.agentfront.dev/frontmcp/servers/discovery
+[docs-elicitation]: https://docs.agentfront.dev/frontmcp/servers/elicitation
 [docs-hooks]: https://docs.agentfront.dev/frontmcp/extensibility/hooks
-[docs-providers]: https://docs.agentfront.dev/frontmcp/extensibility/providers
-[docs-config]: https://docs.agentfront.dev/frontmcp/extensibility/config-yaml
+[docs-skills]: https://docs.agentfront.dev/frontmcp/servers/skills
+[docs-plugins]: https://docs.agentfront.dev/frontmcp/plugins/overview
+[docs-adapters]: https://docs.agentfront.dev/frontmcp/adapters/overview
+[docs-ext-apps]: https://docs.agentfront.dev/frontmcp/servers/ext-apps
+[docs-direct]: https://docs.agentfront.dev/frontmcp/deployment/direct-client
 [docs-deploy]: https://docs.agentfront.dev/frontmcp/deployment/local-dev-server
-[docs-production]: https://docs.agentfront.dev/frontmcp/deployment/production-build
-[docs-sdk-ref]: https://docs.agentfront.dev/frontmcp/sdk-reference/overview

package/agent/agent.scope.d.ts

@@ -112,6 +112,8 @@ export declare class AgentScope {
             userInfoEndpoint?: string | undefined;
         } | undefined;
     } | {
+        requireEmail: boolean;
+        anonymousSubject: string;
         tokenStorage: "memory" | {
             redis: {
                 host: string;
@@ -122,10 +124,69 @@ export declare class AgentScope {
                 defaultTtlMs: number;
                 password?: string | undefined;
             };
+        } | {
+            sqlite: {
+                path: string;
+                encryption?: {
+                    secret: string;
+                } | undefined;
+                ttlCleanupIntervalMs?: number | undefined;
+                walMode?: boolean | undefined;
+            };
         };
         allowDefaultPublic: boolean;
         anonymousScopes: string[];
         mode: "local";
+        login?: {
+            title?: string | undefined;
+            subtitle?: string | undefined;
+            logoUri?: string | undefined;
+            fields?: Record<string, {
+                type: "text" | "email" | "password" | "select" | "hidden";
+                label?: string | undefined;
+                required?: boolean | undefined;
+                placeholder?: string | undefined;
+                options?: {
+                    value: string;
+                    label: string;
+                }[] | undefined;
+            }> | undefined;
+            render?: ((ctx: import("libs/auth/dist/options/interfaces").LoginRenderContext) => string) | undefined;
+            subject?: {
+                fromField?: string | undefined;
+                strategy?: "per-session" | "per-account" | undefined;
+            } | undefined;
+        } | undefined;
+        authenticate?: import("libs/auth/dist/options/interfaces").AuthenticateFn | undefined;
+        providers?: {
+            id: string;
+            clientId: string;
+            name?: string | undefined;
+            authorizationEndpoint?: string | undefined;
+            authorizeUrl?: string | undefined;
+            tokenEndpoint?: string | undefined;
+            tokenUrl?: string | undefined;
+            clientSecret?: string | undefined;
+            scopes?: string[] | undefined;
+            userInfoEndpoint?: string | undefined;
+            jwksUri?: string | undefined;
+        }[] | undefined;
+        dcr?: {
+            enabled?: boolean | undefined;
+            allowedRedirectUris?: string[] | undefined;
+            allowedClientIds?: string[] | undefined;
+            initialAccessToken?: string | undefined;
+            clients?: {
+                clientId: string;
+                redirectUris: string[];
+                tokenEndpointAuthMethod: "none" | "client_secret_basic" | "client_secret_post";
+                grantTypes: ("authorization_code" | "refresh_token")[];
+                responseTypes: "code"[];
+                clientSecret?: string | undefined;
+                clientName?: string | undefined;
+                scope?: string | undefined;
+            }[] | undefined;
+        } | undefined;
         local?: {
             signKey?: Uint8Array<ArrayBuffer> | import("libs/auth/dist/common/jwt.types").JWK | undefined;
             jwks?: {
@@ -133,6 +194,49 @@ export declare class AgentScope {
             } | undefined;
             issuer?: string | undefined;
         } | undefined;
+        secureStore?: "memory" | {
+            sqlite: {
+                path: string;
+                encryption?: {
+                    secret: string;
+                } | undefined;
+                ttlCleanupIntervalMs?: number | undefined;
+                walMode?: boolean | undefined;
+            };
+            scope?: "user" | "session" | "global" | undefined;
+            ttlMs?: number | undefined;
+            encryption?: {
+                pepper?: string | undefined;
+            } | undefined;
+        } | {
+            redis: {
+                host: string;
+                port: number;
+                db: number;
+                tls: boolean;
+                keyPrefix: string;
+                defaultTtlMs: number;
+                password?: string | undefined;
+            };
+            scope?: "user" | "session" | "global" | undefined;
+            ttlMs?: number | undefined;
+            encryption?: {
+                pepper?: string | undefined;
+            } | undefined;
+        } | {
+            backend: import("libs/auth/dist/options/interfaces").SecureStoreCustomBackend;
+            scope?: "user" | "session" | "global" | undefined;
+            ttlMs?: number | undefined;
+            encryption?: {
+                pepper?: string | undefined;
+            } | undefined;
+        } | {
+            scope?: "user" | "session" | "global" | undefined;
+            ttlMs?: number | undefined;
+            encryption?: {
+                pepper?: string | undefined;
+            } | undefined;
+        } | undefined;
         publicAccess?: {
             tools: string[] | "all";
             prompts: string[] | "all";
@@ -151,6 +255,8 @@ export declare class AgentScope {
         } | undefined;
         federatedAuth?: {
             stateValidation: "format" | "strict";
+            minProviders?: number | undefined;
+            requiredProviders?: string[] | undefined;
         } | undefined;
         refresh?: {
             enabled: boolean;
@@ -194,6 +300,8 @@ export declare class AgentScope {
                 maxRedirects: number;
             } | undefined;
         } | undefined;
+        ui?: Partial<Record<"error" | "login" | "consent" | "incremental" | "federated", string>> | undefined;
+        extras?: Record<string, import("libs/auth/dist/options/interfaces").AuthExtraHandler> | undefined;
     } | {
         tokenStorage: "memory" | {
             redis: {
@@ -205,6 +313,15 @@ export declare class AgentScope {
                 defaultTtlMs: number;
                 password?: string | undefined;
             };
+        } | {
+            sqlite: {
+                path: string;
+                encryption?: {
+                    secret: string;
+                } | undefined;
+                ttlCleanupIntervalMs?: number | undefined;
+                walMode?: boolean | undefined;
+            };
         };
         allowDefaultPublic: boolean;
         anonymousScopes: string[];
@@ -217,6 +334,49 @@ export declare class AgentScope {
             } | undefined;
             issuer?: string | undefined;
         } | undefined;
+        secureStore?: "memory" | {
+            sqlite: {
+                path: string;
+                encryption?: {
+                    secret: string;
+                } | undefined;
+                ttlCleanupIntervalMs?: number | undefined;
+                walMode?: boolean | undefined;
+            };
+            scope?: "user" | "session" | "global" | undefined;
+            ttlMs?: number | undefined;
+            encryption?: {
+                pepper?: string | undefined;
+            } | undefined;
+        } | {
+            redis: {
+                host: string;
+                port: number;
+                db: number;
+                tls: boolean;
+                keyPrefix: string;
+                defaultTtlMs: number;
+                password?: string | undefined;
+            };
+            scope?: "user" | "session" | "global" | undefined;
+            ttlMs?: number | undefined;
+            encryption?: {
+                pepper?: string | undefined;
+            } | undefined;
+        } | {
+            backend: import("libs/auth/dist/options/interfaces").SecureStoreCustomBackend;
+            scope?: "user" | "session" | "global" | undefined;
+            ttlMs?: number | undefined;
+            encryption?: {
+                pepper?: string | undefined;
+            } | undefined;
+        } | {
+            scope?: "user" | "session" | "global" | undefined;
+            ttlMs?: number | undefined;
+            encryption?: {
+                pepper?: string | undefined;
+            } | undefined;
+        } | undefined;
         publicAccess?: {
             tools: string[] | "all";
             prompts: string[] | "all";
@@ -235,6 +395,8 @@ export declare class AgentScope {
         } | undefined;
         federatedAuth?: {
             stateValidation: "format" | "strict";
+            minProviders?: number | undefined;
+            requiredProviders?: string[] | undefined;
         } | undefined;
         refresh?: {
             enabled: boolean;
@@ -278,6 +440,8 @@ export declare class AgentScope {
                 maxRedirects: number;
             } | undefined;
         } | undefined;
+        ui?: Partial<Record<"error" | "login" | "consent" | "incremental" | "federated", string>> | undefined;
+        extras?: Record<string, import("libs/auth/dist/options/interfaces").AuthExtraHandler> | undefined;
         clientId?: string | undefined;
         clientSecret?: string | undefined;
         scopes?: string[] | undefined;

package/agent/agent.scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.scope.d.ts","sourceRoot":"","sources":["../../src/agent/agent.scope.ts"],"names":[],"mappings":"AAEA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAiB,KAAK,KAAK,EAAE,KAAK,IAAI,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EACL,cAAc,EACd,UAAU,EACV,KAAK,aAAa,EAElB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,QAAQ,EACd,MAAM,WAAW,CAAC;AAGnB,OAAO,YAAY,MAAM,wBAAwB,CAAC;AAClD,OAAO,cAAc,MAAM,2BAA2B,CAAC;AACvD,OAAO,cAAc,MAAM,2BAA2B,CAAC;AACvD,OAAO,gBAAgB,MAAM,+BAA+B,CAAC;AAC7D,OAAO,gBAAgB,MAAM,+BAA+B,CAAC;AAI7D,OAAO,YAAY,MAAM,uBAAuB,CAAC;AAEjD,OAAO,aAAa,MAAM,kBAAkB,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBAAa,UAAU;IAyBnB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAxB3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAa;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAG3C,OAAO,CAAC,cAAc,CAAoB;IAC1C,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,aAAa,CAAmB;IACxC,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,cAAc,CAAoB;IAC1C,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,WAAW,CAAiB;IACpC,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,UAAU,CAAgB;gBAGhC,WAAW,EAAE,UAAU,EACvB,OAAO,EAAE,MAAM,EACE,QAAQ,EAAE,aAAa,EACxC,UAAU,EAAE,KAAK;YAkBL,UAAU;IAsGxB,IAAI,KAAK,IAAI,YAAY,CAExB;IAED,IAAI,KAAK,IAAI,YAAY,CAExB;IAED,IAAI,SAAS,IAAI,gBAAgB,CAEhC;IAED,IAAI,OAAO,IAAI,cAAc,CAE5B;IAED,IAAI,QAAQ,IAAI,eAAe,CAE9B;IAED,IAAI,SAAS,IAAI,gBAAgB,CAEhC;IAED,IAAI,OAAO,IAAI,cAAc,CAE5B;IAED,IAAI,MAAM,IAAI,aAAa,CAE1B;IAMD,IAAI,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAEP;IAED,IAAI,aAAa,iDAEhB;IAED,IAAI,IAAI,0CAEP;IAED,IAAI,aAAa,kDAEhB;IAED,IAAI,MAAM,oDAET;IAED,IAAI,MAAM,mDAET;IAED,IAAI,aAAa,sCAEhB;IAMK,aAAa,CAAC,GAAG,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,OAAO,CAAC,IAAI,SAAS,QAAQ,EAC3B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EACxB,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GACtB,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAIpC,gBAAgB,CAAC,IAAI,SAAS,QAAQ,EAC1C,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EACxB,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GACtB,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;CAO/B"}
+{"version":3,"file":"agent.scope.d.ts","sourceRoot":"","sources":["../../src/agent/agent.scope.ts"],"names":[],"mappings":"AAEA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAiB,KAAK,KAAK,EAAE,KAAK,IAAI,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EACL,cAAc,EACd,UAAU,EACV,KAAK,aAAa,EAElB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,QAAQ,EACd,MAAM,WAAW,CAAC;AAGnB,OAAO,YAAY,MAAM,wBAAwB,CAAC;AAClD,OAAO,cAAc,MAAM,2BAA2B,CAAC;AACvD,OAAO,cAAc,MAAM,2BAA2B,CAAC;AACvD,OAAO,gBAAgB,MAAM,+BAA+B,CAAC;AAC7D,OAAO,gBAAgB,MAAM,+BAA+B,CAAC;AAI7D,OAAO,YAAY,MAAM,uBAAuB,CAAC;AAEjD,OAAO,aAAa,MAAM,kBAAkB,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBAAa,UAAU;IAyBnB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAxB3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAa;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAG3C,OAAO,CAAC,cAAc,CAAoB;IAC1C,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,aAAa,CAAmB;IACxC,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,cAAc,CAAoB;IAC1C,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,WAAW,CAAiB;IACpC,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,UAAU,CAAgB;gBAGhC,WAAW,EAAE,UAAU,EACvB,OAAO,EAAE,MAAM,EACE,QAAQ,EAAE,aAAa,EACxC,UAAU,EAAE,KAAK;YAkBL,UAAU;IAsGxB,IAAI,KAAK,IAAI,YAAY,CAExB;IAED,IAAI,KAAK,IAAI,YAAY,CAExB;IAED,IAAI,SAAS,IAAI,gBAAgB,CAEhC;IAED,IAAI,OAAO,IAAI,cAAc,CAE5B;IAED,IAAI,QAAQ,IAAI,eAAe,CAE9B;IAED,IAAI,SAAS,IAAI,gBAAgB,CAEhC;IAED,IAAI,OAAO,IAAI,cAAc,CAE5B;IAED,IAAI,MAAM,IAAI,aAAa,CAE1B;IAMD,IAAI,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAEP;IAED,IAAI,aAAa,iDAEhB;IAED,IAAI,IAAI,0CAEP;IAED,IAAI,aAAa,kDAEhB;IAED,IAAI,MAAM,oDAET;IAED,IAAI,MAAM,mDAET;IAED,IAAI,aAAa,sCAEhB;IAMK,aAAa,CAAC,GAAG,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,OAAO,CAAC,IAAI,SAAS,QAAQ,EAC3B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EACxB,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GACtB,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAIpC,gBAAgB,CAAC,IAAI,SAAS,QAAQ,EAC1C,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EACxB,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GACtB,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;CAO/B"}

package/app/instances/app.esm.instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.esm.instance.d.ts","sourceRoot":"","sources":["../../../src/app/instances/app.esm.instance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EACL,QAAQ,EAER,KAAK,wBAAwB,EAC7B,KAAK,SAAS,EAGd,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EAEvB,MAAM,cAAc,CAAC;AAOtB,OAAO,EAAyB,KAAK,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAGxG,OAAO,cAAc,MAAM,8BAA8B,CAAC;AAE1D,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAC;AAErE,OAAO,gBAAgB,MAAM,kCAAkC,CAAC;AAEhE,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEzE,OAAO,YAAY,MAAM,0BAA0B,CAAC;AAiGpD;;;;;;;;;;GAUG;AACH,qBAAa,cAAe,SAAQ,QAAQ,CAAC,iBAAiB,CAAC;IAC7D,SAAkB,EAAE,EAAE,MAAM,CAAC;IAE7B,IAAa,QAAQ,IAAI,OAAO,CAE/B;IAED,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAmB;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,MAAM,CAAC,CAAgB;IAC/B,OAAO,CAAC,UAAU,CAAC,CAAgB;IACnC,OAAO,CAAC,gBAAgB,CAAS;IAGjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsB;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;gBAEjC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB;cA6C/C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA2C3C,IAAa,SAAS,IAAI,yBAAyB,CAElD;IAED,IAAa,QAAQ,IAAI,wBAAwB,CAEhD;IAED,IAAa,OAAO,IAAI,uBAAuB,CAE9C;IAED,IAAa,KAAK,IAAI,YAAY,CAEjC;IAED,IAAa,SAAS,IAAI,gBAAgB,CAEzC;IAED,IAAa,OAAO,IAAI,cAAc,CAErC;IAED,IAAa,MAAM,IAAI,sBAAsB,CAE5C;IAED;;OAEG;IACH,gBAAgB,IAAI,MAAM,GAAG,SAAS;IAItC;;OAEG;IACH,YAAY,IAAI,sBAAsB;IAItC;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAY7B;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ9B;;OAEG;YACW,oBAAoB;IAyFlC;;OAEG;YACW,mBAAmB;IA+BjC;;OAEG;IACH,OAAO,CAAC,kBAAkB;CAc3B"}
+{"version":3,"file":"app.esm.instance.d.ts","sourceRoot":"","sources":["../../../src/app/instances/app.esm.instance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EACL,QAAQ,EAER,KAAK,wBAAwB,EAC7B,KAAK,SAAS,EAGd,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EAEvB,MAAM,cAAc,CAAC;AAOtB,OAAO,EAAyB,KAAK,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAGxG,OAAO,cAAc,MAAM,8BAA8B,CAAC;AAE1D,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAC;AAErE,OAAO,gBAAgB,MAAM,kCAAkC,CAAC;AAEhE,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEzE,OAAO,YAAY,MAAM,0BAA0B,CAAC;AAuGpD;;;;;;;;;;GAUG;AACH,qBAAa,cAAe,SAAQ,QAAQ,CAAC,iBAAiB,CAAC;IAC7D,SAAkB,EAAE,EAAE,MAAM,CAAC;IAE7B,IAAa,QAAQ,IAAI,OAAO,CAE/B;IAED,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAmB;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,MAAM,CAAC,CAAgB;IAC/B,OAAO,CAAC,UAAU,CAAC,CAAgB;IACnC,OAAO,CAAC,gBAAgB,CAAS;IAGjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsB;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;gBAEjC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB;cA6C/C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA2C3C,IAAa,SAAS,IAAI,yBAAyB,CAElD;IAED,IAAa,QAAQ,IAAI,wBAAwB,CAEhD;IAED,IAAa,OAAO,IAAI,uBAAuB,CAE9C;IAED,IAAa,KAAK,IAAI,YAAY,CAEjC;IAED,IAAa,SAAS,IAAI,gBAAgB,CAEzC;IAED,IAAa,OAAO,IAAI,cAAc,CAErC;IAED,IAAa,MAAM,IAAI,sBAAsB,CAE5C;IAED;;OAEG;IACH,gBAAgB,IAAI,MAAM,GAAG,SAAS;IAItC;;OAEG;IACH,YAAY,IAAI,sBAAsB;IAItC;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAY7B;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ9B;;OAEG;YACW,oBAAoB;IAyFlC;;OAEG;YACW,mBAAmB;IA+BjC;;OAEG;IACH,OAAO,CAAC,kBAAkB;CAc3B"}

package/app/instances/app.remote.instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.remote.instance.d.ts","sourceRoot":"","sources":["../../../src/app/instances/app.remote.instance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EACL,QAAQ,EAER,KAAK,wBAAwB,EAC7B,KAAK,SAAS,EAId,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EAGvB,MAAM,cAAc,CAAC;AAEtB,OAAO,cAAc,MAAM,8BAA8B,CAAC;AAC1D,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AASpD,OAAO,gBAAgB,MAAM,kCAAkC,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,YAAY,MAAM,0BAA0B,CAAC;AAoGpD;;;;;;;;;;;;;GAaG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ,CAAC,iBAAiB,CAAC;IAChE,SAAkB,EAAE,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,IAAa,QAAQ,IAAI,OAAO,CAE/B;IAED,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAmB;IAClD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAGlD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsB;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAG7C,OAAO,CAAC,WAAW,CAAS;IAG5B,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,cAAc,CAA8B;IAGpD,OAAO,CAAC,sBAAsB,CAAC,CAAa;gBAEhC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB;cA+B/C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAoC3C;;;OAGG;IACG,wBAAwB,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB/C;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAU1C,IAAa,SAAS,IAAI,yBAAyB,CAElD;IAED,IAAa,QAAQ,IAAI,wBAAwB,CAEhD;IAED,IAAa,OAAO,IAAI,uBAAuB,CAE9C;IAED,IAAa,KAAK,IAAI,YAAY,CAEjC;IAED,IAAa,SAAS,IAAI,gBAAgB,CAEzC;IAED,IAAa,OAAO,IAAI,cAAc,CAErC;IAED,IAAa,MAAM,IAAI,sBAAsB,CAE5C;IAED;;OAEG;IACH,YAAY,IAAI,gBAAgB;IAIhC;;OAEG;IACH,cAAc,IAAI,OAAO;IAIzB;;OAEG;IACH,qBAAqB,IAAI,OAAO;IAIhC;;OAEG;IACH,aAAa,IAAI;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE;IAIxF;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAejC;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAWhC;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAkBnC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAejC;;OAEG;IACH,OAAO,CAAC,aAAa;IAOrB;;OAEG;YACW,+BAA+B;CAgF9C"}
+{"version":3,"file":"app.remote.instance.d.ts","sourceRoot":"","sources":["../../../src/app/instances/app.remote.instance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EACL,QAAQ,EAER,KAAK,wBAAwB,EAC7B,KAAK,SAAS,EAId,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EAGvB,MAAM,cAAc,CAAC;AAEtB,OAAO,cAAc,MAAM,8BAA8B,CAAC;AAC1D,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AASpD,OAAO,gBAAgB,MAAM,kCAAkC,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,YAAY,MAAM,0BAA0B,CAAC;AA0GpD;;;;;;;;;;;;;GAaG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ,CAAC,iBAAiB,CAAC;IAChE,SAAkB,EAAE,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,IAAa,QAAQ,IAAI,OAAO,CAE/B;IAED,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAmB;IAClD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAGlD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsB;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAG7C,OAAO,CAAC,WAAW,CAAS;IAG5B,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,cAAc,CAA8B;IAGpD,OAAO,CAAC,sBAAsB,CAAC,CAAa;gBAEhC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB;cA+B/C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAoC3C;;;OAGG;IACG,wBAAwB,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB/C;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAU1C,IAAa,SAAS,IAAI,yBAAyB,CAElD;IAED,IAAa,QAAQ,IAAI,wBAAwB,CAEhD;IAED,IAAa,OAAO,IAAI,uBAAuB,CAE9C;IAED,IAAa,KAAK,IAAI,YAAY,CAEjC;IAED,IAAa,SAAS,IAAI,gBAAgB,CAEzC;IAED,IAAa,OAAO,IAAI,cAAc,CAErC;IAED,IAAa,MAAM,IAAI,sBAAsB,CAE5C;IAED;;OAEG;IACH,YAAY,IAAI,gBAAgB;IAIhC;;OAEG;IACH,cAAc,IAAI,OAAO;IAIzB;;OAEG;IACH,qBAAqB,IAAI,OAAO;IAIhC;;OAEG;IACH,aAAa,IAAI;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE;IAIxF;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAejC;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAWhC;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAkBnC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAejC;;OAEG;IACH,OAAO,CAAC,aAAa;IAOrB;;OAEG;YACW,+BAA+B;CAgF9C"}

package/auth/auth-ui/auth-ui.contract.d.ts

@@ -0,0 +1,149 @@
+/**
+ * Server-owned Auth-UI write-shape (#469).
+ *
+ * This is the SERVER side of the auth-page JSON-serialization boundary. The
+ * authorize/callback flows BUILD an {@link AuthFlowState} here and the page
+ * builder INJECTS it as `window.__FRONTMCP_AUTH__`; the CLIENT (in the browser)
+ * reads the matching read-shape from `@frontmcp/ui/auth`.
+ *
+ * These types + constants are deliberately a LOCAL copy of the client contract
+ * (`@frontmcp/ui/auth`'s `contract.ts`) rather than an import: the SDK must NOT
+ * depend on `@frontmcp/ui` (a React package) just to share a handful of plain
+ * data shapes + two string literals. Server-owned write-shape + client-owned
+ * read-shape across a JSON boundary is intentional. The `demo-e2e-local-auth`
+ * e2e asserts the emitted `window.__FRONTMCP_AUTH__` wire shape, which guards
+ * against the two copies drifting.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Which built-in authorization page slot a component renders. Must match
+ * `AuthSlot` in `@frontmcp/ui/auth`.
+ */
+export type AuthSlot = 'login' | 'consent' | 'incremental' | 'federated' | 'error';
+/** HTTP method the auth submit/extra requests use. Matches `@frontmcp/ui/auth`. */
+export type AuthSubmitMethod = 'GET' | 'POST';
+/**
+ * A selectable authentication provider surfaced on the federated-login slot.
+ * Matches `AuthProvider` in `@frontmcp/ui/auth`. Only display + selection fields
+ * are exposed; nothing secret is ever included.
+ */
+export interface AuthProvider {
+    /** Stable provider id submitted back as a `providers` value. */
+    id: string;
+    /** Human-readable provider name for display. */
+    name: string;
+    /** Optional provider authorize URL (transparent/remote providers only). */
+    url?: string;
+    /** Auth mode label (e.g. `local`, `transparent`, `remote`). */
+    mode?: string;
+    /** App ids associated with this provider (filtered of internal sentinels). */
+    appIds?: string[];
+    /** Whether this is the primary/parent provider (pre-checked by default). */
+    primary?: boolean;
+}
+/**
+ * A selectable tool surfaced on the consent slot. Matches `AuthTool` in
+ * `@frontmcp/ui/auth`. The `id` is the effective runtime tool id.
+ */
+export interface AuthTool {
+    /** Effective runtime tool id (submitted back as a `tools` value). */
+    id: string;
+    /** Display name. */
+    name: string;
+    /** Optional description. */
+    description?: string;
+    /** Owning app id (for grouping). */
+    appId?: string;
+    /** Owning app display name (for grouping). */
+    appName?: string;
+    /** Whether the tool is pre-selected. */
+    defaultSelected?: boolean;
+}
+/**
+ * The serialized authorization-flow state the server INJECTS (write-shape).
+ * Must match `AuthFlowState` in `@frontmcp/ui/auth` (the client read-shape).
+ *
+ * NO PII is part of the contract. `clientName`/`clientId` are OAuth client
+ * identifiers (not end-user identity); identity values the user enters are
+ * carried by the developer's own form fields — never serialized here.
+ */
+export interface AuthFlowState {
+    /** Which page slot this state is for. */
+    slot: AuthSlot;
+    /** The pending authorization id (`pending_auth_id`). */
+    pendingAuthId?: string;
+    /** OAuth client display name (CIMD `client_name` or the raw client id). */
+    clientName?: string;
+    /** OAuth `client_id`. */
+    clientId?: string;
+    /** Requested OAuth scopes (split from the `scope` param). */
+    scopes?: string[];
+    /** Validated OAuth `redirect_uri`. */
+    redirectUri?: string;
+    /** RFC 8707 `resource` indicator, when supplied. */
+    resource?: string;
+    /** Human-readable error text for the `error` slot (or a failed submit re-render). */
+    error?: string;
+    /** Anti-CSRF token minted at SSR time; the client echoes it back. */
+    csrfToken?: string;
+    /** Absolute or app-relative URL the finish submit posts to. */
+    submitUrl?: string;
+    /** HTTP method for the finish submit. Defaults to `GET`. */
+    submitMethod?: AuthSubmitMethod;
+    /** Optional dedicated URL for `submitExtra` (the auth-extra endpoint). */
+    extraUrl?: string;
+    /** Providers offered on the `federated` slot. */
+    providers?: AuthProvider[];
+    /** Tools offered on the `consent` slot. */
+    tools?: AuthTool[];
+    /** Server-side accumulators for multi-step inputs, keyed by extra name. */
+    addedItems?: Record<string, unknown[]>;
+    /** Free-form, slot-specific extras the server passes to the component. */
+    extras?: Record<string, unknown>;
+}
+/**
+ * Result of an auth-extra (`auth.extras[name]`) validated-field round-trip, as
+ * the server returns it. Matches `AuthExtraResult` in `@frontmcp/ui/auth`.
+ */
+export interface AuthExtraResult {
+    /** Whether the server accepted the field. */
+    ok: boolean;
+    /** Human-readable validation error when `ok` is false. */
+    error?: string;
+    /** Updated server-side accumulators (keyed by extra name) after a successful add. */
+    addedItems?: Record<string, unknown[]>;
+    /** Free-form side-effect data the server chooses to return. */
+    sideEffects?: Record<string, unknown>;
+}
+/** A file-based custom auth-UI slot source (resolved `.tsx`/`.jsx`). */
+export interface AuthUiFileSource {
+    /** Absolute path to a `.tsx` / `.jsx` component file (default export). */
+    file: string;
+}
+/**
+ * The global property name the server injects the {@link AuthFlowState} under.
+ * MUST match `AUTH_FLOW_GLOBAL_KEY` in `@frontmcp/ui/auth`.
+ */
+export declare const AUTH_FLOW_GLOBAL_KEY: "__FRONTMCP_AUTH__";
+/**
+ * The mount id the server SSRs the auth component into (and the client hydrates
+ * onto). MUST match `DEFAULT_AUTH_MOUNT_ID` in `@frontmcp/ui/auth`.
+ */
+export declare const AUTH_MOUNT_ID = "frontmcp-auth-root";
+/**
+ * Wire-field marker names the server-side {@link AuthFlowState} builders write
+ * into `extras` (federated/incremental markers + the target app id). These are
+ * the exact params `oauth.callback.flow.ts` reads. The full vocabulary lives in
+ * `@frontmcp/ui/auth`'s `AUTH_WIRE_FIELDS`; the server only needs the few keys
+ * its builders emit.
+ */
+export declare const AUTH_WIRE_FIELDS: {
+    /** Marks a federated submission. */
+    readonly federated: "federated";
+    /** Marks an incremental authorization. */
+    readonly incremental: "incremental";
+    /** Target app id for incremental authorization. */
+    readonly appId: "app_id";
+};
+//# sourceMappingURL=auth-ui.contract.d.ts.map

package/auth/auth-ui/auth-ui.contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-ui.contract.d.ts","sourceRoot":"","sources":["../../../src/auth/auth-ui/auth-ui.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,OAAO,CAAC;AAEnF,mFAAmF;AACnF,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,MAAM,CAAC;AAE9C;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,yCAAyC;IACzC,IAAI,EAAE,QAAQ,CAAC;IACf,wDAAwD;IACxD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,2CAA2C;IAC3C,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,EAAE,EAAE,OAAO,CAAC;IACZ,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AAEH,eAAO,MAAM,oBAAoB,EAAG,mBAA4B,CAAC;AAEjE;;;GAGG;AAEH,eAAO,MAAM,aAAa,uBAAuB,CAAC;AAElD;;;;;;GAMG;AAEH,eAAO,MAAM,gBAAgB;IAC3B,oCAAoC;;IAEpC,0CAA0C;;IAE1C,mDAAmD;;CAE3C,CAAC"}