@frontmcp/sdk 1.3.0 → 1.4.1

package/auth/auth-ui/auth-ui.registry.d.ts

@@ -0,0 +1,151 @@
+/**
+ * Auth-UI Registry (#469 — slot→file map + name→handler map).
+ *
+ * Built per OAuth scope from the scope's resolved auth options:
+ *  - `auth.ui` — a {@link AuthSlot} → relative `.tsx`/`.jsx` PATH map, and
+ *  - `auth.extras` — an extra-name → server HANDLER function map.
+ *
+ * It resolves each slot's file against the scope's captured source directory
+ * (the `@FrontMcp`/`@App` `__sourceDir`; absolute paths pass through) and owns
+ * the cross-cutting SERVER-side concerns the client contract delegates to the
+ * server:
+ *  - CSRF minting + verifying (per pending-auth id),
+ *  - the per-(pending-auth, extra) ACCUMULATOR that backs `useAddedItems(name)`,
+ *  - the per-slot {@link AuthUiFileSource} the page builder transpiles.
+ *
+ * The auth pages render ENTIRELY in the browser from a server-side single-file
+ * TRANSFORM routed through `@frontmcp/uipack`'s pluggable `renderComponent`: the
+ * slot's `.tsx` is transpiled with esbuild `transformSync` (deps stay external)
+ * and inlined as a `<script type="module">`, with react / react-dom /
+ * `@frontmcp/ui/auth` loaded from esm.sh via an import-map. The server NEVER
+ * imports, bundles, or evaluates the component — no IIFE bundle, no served `.js`.
+ *
+ * When NO file is registered for a slot, the flows fall back to the built-in
+ * HTML pages unchanged (the no-config default). No PII is stored — the
+ * accumulator holds whatever items the developer's extra handler accepted
+ * (their responsibility), keyed by opaque pending-auth id.
+ *
+ * @packageDocumentation
+ */
+import { type AuthExtraHandler } from '@frontmcp/auth';
+import { type FrontMcpLogger } from '../../common';
+import { type AuthSlot, type AuthUiFileSource } from './auth-ui.contract';
+/**
+ * The JSON returned to the client from an extra submit. Mirrors the client
+ * `AuthExtraResult` shape — `addedItems` here is the FULL accumulator MAP keyed
+ * by extra name (not the handler's per-call new-items list).
+ */
+export interface AuthExtraRunResult {
+    ok: boolean;
+    error?: string;
+    addedItems?: Record<string, unknown[]>;
+    sideEffects?: Record<string, unknown>;
+}
+/**
+ * Registry of custom auth-UI slot files + extra handlers for a scope.
+ */
+export declare class AuthUiRegistry {
+    private readonly slots;
+    private readonly extras;
+    private readonly pending;
+    private readonly logger?;
+    /**
+     * Optional per-specifier resolver overrides applied when building the page's
+     * import-map (e.g. mapping `@frontmcp/ui/auth` to a locally-served ESM URL in
+     * dev / offline, where it isn't on esm.sh).
+     */
+    private resolverOverrides?;
+    constructor(logger?: FrontMcpLogger);
+    /**
+     * Register the `auth.ui` slot→file map. Each relative path is resolved against
+     * `sourceDir` (the declaring `@FrontMcp`/`@App` directory); absolute paths pass
+     * through. Later registrations for the same slot win (so a scope can override a
+     * server-level default).
+     */
+    registerAuthUiMap(map: Partial<Record<AuthSlot, string>> | undefined, sourceDir: string): void;
+    /**
+     * Register the `auth.extras` name→handler map. Each value must be a function
+     * `(input, ctx) => AuthExtraResult | Promise<AuthExtraResult>`.
+     */
+    registerAuthExtrasMap(map: Record<string, AuthExtraHandler> | undefined): void;
+    /**
+     * Set per-specifier import-map overrides for the page builder. Use in dev /
+     * offline to point `@frontmcp/ui/auth` (not on esm.sh in a monorepo) at a
+     * locally-served ESM URL.
+     */
+    setResolverOverrides(overrides: Record<string, string> | undefined): void;
+    /** The configured import-map overrides (undefined when none). */
+    getResolverOverrides(): Record<string, string> | undefined;
+    /** Whether any custom slot file is registered. */
+    hasAny(): boolean;
+    /** Whether a custom file is registered for `slot`. */
+    hasSlot(slot: AuthSlot): boolean;
+    /** Whether any extra handler is registered. */
+    hasExtras(): boolean;
+    /**
+     * The file-based source for a slot, or `undefined` when the slot is
+     * unregistered or previously failed to build (error cached). Used by the page
+     * builder to transpile the `.tsx` server-side.
+     */
+    getSlotSource(slot: AuthSlot): AuthUiFileSource | undefined;
+    /**
+     * Whether a slot can be rendered — i.e. a file is registered for it (and it
+     * hasn't recorded a build error). Used by the page assembler to decide between
+     * the custom page and the built-in fallback.
+     */
+    canRenderSlot(slot: AuthSlot): boolean;
+    /**
+     * Record a transform/build error for a slot so a broken file isn't
+     * re-transpiled on every request (the slot then falls back to the built-in
+     * page). Called by the page builder when the transform throws.
+     */
+    recordSlotError(slot: AuthSlot, message: string): void;
+    /**
+     * Mint (or reuse) the CSRF token for a pending-auth id and return it. The
+     * token is stored server-side and echoed into {@link AuthFlowState.csrfToken}.
+     */
+    mintCsrf(pendingAuthId: string): string;
+    /**
+     * Look up a pending-ui entry, enforcing the TTL at read time: an expired entry
+     * is deleted and treated as absent. This guarantees a stale token can never
+     * validate even if no prune-triggering write happened after it expired.
+     */
+    private getActivePending;
+    /**
+     * Verify a submitted CSRF token against the minted one for this pending-auth.
+     * Returns false on any mismatch / unknown / expired pending id (caller rejects 400).
+     */
+    verifyCsrf(pendingAuthId: string | undefined, submitted: string | undefined): boolean;
+    /**
+     * Current accumulators for a pending-auth id (empty when none yet). Returns a
+     * DEEP copy — each array is cloned — so callers (e.g. an extra handler reading
+     * `ctx.current`) can never mutate the internal accumulator by reference.
+     */
+    getAddedItems(pendingAuthId: string | undefined): Record<string, unknown[]>;
+    /** Append accepted items to an extra's accumulator and return the full map. */
+    appendItems(pendingAuthId: string, extraName: string, items: unknown[]): Record<string, unknown[]>;
+    private ensurePending;
+    private pruneExpired;
+    /** Whether a handler is registered for `name`. */
+    hasExtra(name: string): boolean;
+    /**
+     * Route an extra submission to its registered handler. Persists accepted items
+     * into the per-pending-auth accumulator and returns the full result including
+     * the updated `addedItems` map (so the client refreshes without a reload).
+     * Returns `{ ok:false }` when no handler is registered for `name`.
+     *
+     * Note: the returned `addedItems` is the FULL accumulator MAP (keyed by extra
+     * name) — the client `AuthExtraResult` shape — not the handler's per-call
+     * `addedItems` (which is the list of NEW items).
+     */
+    runExtra(name: string, pendingAuthId: string | undefined, input: Record<string, unknown>): Promise<AuthExtraRunResult>;
+    /**
+     * Validate every registered slot's source at startup (mirroring tool-ui's
+     * `compileUIWidgets`): a missing / non-`.tsx` file is caught lazily at first
+     * render and cached as an error so the slot falls back to the built-in page
+     * instead of failing the request. This is just a cheap preflight log; it never
+     * throws — a broken component must not take the server down.
+     */
+    warmup(): Promise<void>;
+}
+//# sourceMappingURL=auth-ui.registry.d.ts.map

package/auth/auth-ui/auth-ui.registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-ui.registry.d.ts","sourceRoot":"","sources":["../../../src/auth/auth-ui/auth-ui.registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAyB,KAAK,gBAAgB,EAAwB,MAAM,gBAAgB,CAAC;AAGpG,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAK1E;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAqBD;;GAEG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkC;IACxD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;IAC9D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IACjE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC;;;;OAIG;IACH,OAAO,CAAC,iBAAiB,CAAC,CAAyB;gBAEvC,MAAM,CAAC,EAAE,cAAc;IAInC;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAc9F;;;OAGG;IACH,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,SAAS,GAAG,IAAI;IAW9E;;;;OAIG;IACH,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAAG,IAAI;IAIzE,iEAAiE;IACjE,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS;IAI1D,kDAAkD;IAClD,MAAM,IAAI,OAAO;IAIjB,sDAAsD;IACtD,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO;IAIhC,+CAA+C;IAC/C,SAAS,IAAI,OAAO;IAQpB;;;;OAIG;IACH,aAAa,CAAC,IAAI,EAAE,QAAQ,GAAG,gBAAgB,GAAG,SAAS;IAM3D;;;;OAIG;IACH,aAAa,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO;IAItC;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAYtD;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM;IASvC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAUxB;;;OAGG;IACH,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;IAWrF;;;;OAIG;IACH,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;IAO3E,+EAA+E;IAC/E,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;IAOlG,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,YAAY;IAWpB,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI/B;;;;;;;;;OASG;IACG,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,kBAAkB,CAAC;IAqC9B;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ9B"}

package/auth/auth-ui/auth-ui.render.d.ts

@@ -0,0 +1,49 @@
+import { AUTH_MOUNT_ID, type AuthFlowState, type AuthSlot } from './auth-ui.contract';
+import { type AuthUiRegistry } from './auth-ui.registry';
+/**
+ * The mount id the client renders into. Re-exported from the server-owned
+ * contract so the shell and (via the wire contract) the `@frontmcp/ui/auth`
+ * client mount agree on a single value.
+ */
+export { AUTH_MOUNT_ID };
+/** Path the auth extra submissions POST to (action discriminates the extra). */
+export declare function authUiExtraPath(fullPath: string): string;
+/**
+ * The Content-Security-Policy for an auth-UI page.
+ *
+ * Allows `https://esm.sh` for module scripts + connections + styles (the
+ * import-map resolves every dependency there) and `'unsafe-inline'` for scripts
+ * (only the server-controlled, JSON-escaped state `<script>` is inline; never
+ * user input). It does NOT include `'unsafe-eval'` — the TSX→JS transform is
+ * done server-side, so the browser never evals source. Framing is denied to
+ * prevent clickjacking of the login / consent form.
+ */
+export declare const AUTH_UI_CSP: string;
+/**
+ * Build the auth security headers for an auth-UI page (CSP + anti-clickjacking).
+ *
+ * @param csp - Override the CSP value (defaults to {@link AUTH_UI_CSP}).
+ */
+export declare function authUiPageHeaders(csp?: string): Record<string, string>;
+/** Convenience wrapper used by the OAuth flows. Same as `authUiPageHeaders()`. */
+export declare function authUiSecurityHeaders(): Record<string, string>;
+/**
+ * Build the complete auth-UI HTML page for a slot.
+ *
+ * Returns `undefined` when the registry has no file for the slot — the caller
+ * then renders the built-in page (defaults preserved). On a transform/read
+ * failure the error is cached on the registry (so a broken file isn't
+ * re-transpiled every request) and `undefined` is returned (fallback).
+ */
+export declare function buildAuthUiPage(options: {
+    registry: AuthUiRegistry;
+    slot: AuthSlot;
+    state: AuthFlowState;
+    fullPath: string;
+    /** Page <title> (defaults to a slot-appropriate label). */
+    title?: string;
+}): {
+    html: string;
+    headers: Record<string, string>;
+} | undefined;
+//# sourceMappingURL=auth-ui.render.d.ts.map

package/auth/auth-ui/auth-ui.render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-ui.render.d.ts","sourceRoot":"","sources":["../../../src/auth/auth-ui/auth-ui.render.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAwB,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC5G,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIxD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,QASZ,CAAC;AAEb;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOnF;AAED,kFAAkF;AAClF,wBAAgB,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9D;AAiBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE;IACvC,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,SAAS,CAwChE"}

package/auth/auth-ui/auth-ui.state.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Per-slot {@link AuthFlowState} builders (#469, stage 2).
+ *
+ * Each builder maps the values an OAuth flow ALREADY computes for its built-in
+ * page (the same inputs fed to `renderLocalLoginPage` / `buildToolConsentPage` /
+ * `buildFederatedLoginPage` / `buildIncrementalAuthPage`) into the stage-1
+ * contract shape, plus the server-owned `csrfToken`, `submitUrl`, `extraUrl`,
+ * and accumulated `addedItems`. No PII is added — identity the user types is
+ * carried by the developer's own form fields, never serialized here.
+ *
+ * @packageDocumentation
+ */
+import { type AuthFlowState, type AuthProvider, type AuthTool } from './auth-ui.contract';
+/** Common server-owned fields every interactive slot needs. */
+interface SlotCommon {
+    pendingAuthId: string;
+    /** The scope's `${fullPath}/oauth/callback` submit target. */
+    submitUrl: string;
+    /** The `${fullPath}/oauth/ui/extra` endpoint for `@AuthExtra` submits. */
+    extraUrl: string;
+    /** Minted CSRF token for this pending auth. */
+    csrfToken: string;
+    /** Server-side accumulators for this pending auth (keyed by extra name). */
+    addedItems?: Record<string, unknown[]>;
+}
+/** Build the `login` slot state. */
+export declare function buildLoginState(common: SlotCommon, data: {
+    clientId: string;
+    clientName?: string;
+    scopes: string[];
+    redirectUri: string;
+    logoUri?: string;
+}): AuthFlowState;
+/** Build the `consent` slot state. */
+export declare function buildConsentState(common: SlotCommon, data: {
+    clientId: string;
+    clientName?: string;
+    tools: AuthTool[];
+    redirectUri?: string;
+}): AuthFlowState;
+/** Build the `federated` slot state. */
+export declare function buildFederatedState(common: SlotCommon, data: {
+    clientId: string;
+    clientName?: string;
+    providers: AuthProvider[];
+    redirectUri: string;
+}): AuthFlowState;
+/** Build the `incremental` slot state. */
+export declare function buildIncrementalState(common: SlotCommon, data: {
+    appId: string;
+    appName: string;
+    appDescription?: string;
+    toolId?: string;
+    redirectUri: string;
+}): AuthFlowState;
+/** Build the `error` slot state (may have no pending auth yet). */
+export declare function buildErrorState(data: {
+    error: string;
+    pendingAuthId?: string;
+}): AuthFlowState;
+export {};
+//# sourceMappingURL=auth-ui.state.d.ts.map

package/auth/auth-ui/auth-ui.state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-ui.state.d.ts","sourceRoot":"","sources":["../../../src/auth/auth-ui/auth-ui.state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAoB,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE5G,+DAA+D;AAC/D,UAAU,UAAU;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;CACxC;AAED,oCAAoC;AACpC,wBAAgB,eAAe,CAC7B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACvG,aAAa,CAcf;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACvF,aAAa,CAaf;AAED,wCAAwC;AACxC,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,YAAY,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9F,aAAa,CAef;AAED,0CAA0C;AAC1C,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACtG,aAAa,CAiBf;AAED,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAM9F"}

package/auth/auth-ui/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Custom authorization-UI wiring (#469 — slot→file map + name→handler map).
+ *
+ * For each OAuth flow slot the server TRANSFORMS the developer's registered
+ * `.tsx` ONCE (esbuild `transformSync`, single file — deps stay external) via
+ * `@frontmcp/uipack`'s pluggable `renderComponent`, inlines it as a `<script
+ * type="module">`, and loads react / react-dom / `@frontmcp/ui/auth` from esm.sh
+ * via an import-map. `@frontmcp/ui/auth`'s `mountAuthPage` renders the component
+ * client-side into the empty `#frontmcp-auth-root` mount, honoring the
+ * framework-free `@frontmcp/ui/auth` contract (the server holds a matching,
+ * server-owned write-shape in `auth-ui.contract.ts`). There is NO bundling and
+ * the server never imports or evaluates the component, nor `@frontmcp/ui`.
+ *
+ * Registration is the `auth.ui` / `auth.extras` maps on the auth config — there
+ * is no decorator and no class. See `@frontmcp/auth`'s `AuthUiMap` /
+ * `AuthExtraHandler`.
+ *
+ * @packageDocumentation
+ */
+export { AUTH_FLOW_GLOBAL_KEY, type AuthFlowState, type AuthSlot, type AuthProvider, type AuthTool, type AuthExtraResult, type AuthUiFileSource, } from './auth-ui.contract';
+export { AuthUiRegistry, type AuthExtraRunResult } from './auth-ui.registry';
+export { AUTH_MOUNT_ID, AUTH_UI_CSP, authUiExtraPath, authUiPageHeaders, authUiSecurityHeaders, buildAuthUiPage, } from './auth-ui.render';
+export { buildLoginState, buildConsentState, buildFederatedState, buildIncrementalState, buildErrorState, } from './auth-ui.state';
+//# sourceMappingURL=index.d.ts.map

package/auth/auth-ui/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/auth-ui/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EACL,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAG7E,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,GAChB,MAAM,iBAAiB,CAAC"}

package/auth/auth.registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.registry.d.ts","sourceRoot":"","sources":["../../src/auth/auth.registry.ts"],"names":[],"mappings":"AACA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAyC,KAAK,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAGzG,OAAO,EAEL,YAAY,EASZ,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAGlB,KAAK,UAAU,EAChB,MAAM,WAAW,CAAC;AAGnB,OAAO,KAAK,gBAAgB,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAa5E,qBAAa,YAAa,SAAQ,gBAAgB,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;IAC3G,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAc;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IAEtC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,2BAA2B,CAAC;IAEhD;;OAEG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;gBAGtC,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,gBAAgB,EAC3B,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,KAAK,EAAE,aAAa,EACpB,YAAY,CAAC,EAAE,gBAAgB;IA6CjC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAmB1B;;OAEG;IACH,OAAO,CAAC,cAAc;IA0BtB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAiB3B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAsB7B;;OAEG;IACH,OAAO,CAAC,iBAAiB;cAwBN,QAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,sBAAsB,CAAC,kBAAkB,CAAC;IAgBjG,SAAS,CAAC,UAAU;cAqBJ,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3C,UAAU,IAAI,YAAY;IAO1B,gBAAgB,IAAI,iBAAiB,EAAE;CAGxC"}
+{"version":3,"file":"auth.registry.d.ts","sourceRoot":"","sources":["../../src/auth/auth.registry.ts"],"names":[],"mappings":"AACA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAyC,KAAK,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAGzG,OAAO,EAEL,YAAY,EASZ,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAGlB,KAAK,UAAU,EAChB,MAAM,WAAW,CAAC;AAGnB,OAAO,KAAK,gBAAgB,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAa5E,qBAAa,YAAa,SAAQ,gBAAgB,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;IAC3G,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAc;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IAEtC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,2BAA2B,CAAC;IAEhD;;OAEG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;gBAGtC,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,gBAAgB,EAC3B,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,KAAK,EAAE,aAAa,EACpB,YAAY,CAAC,EAAE,gBAAgB;IA6CjC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAmB1B;;OAEG;IACH,OAAO,CAAC,cAAc;IA0BtB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAiB3B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAsB7B;;OAEG;IACH,OAAO,CAAC,iBAAiB;cA4BN,QAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,sBAAsB,CAAC,kBAAkB,CAAC;IAgBjG,SAAS,CAAC,UAAU;cAqBJ,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3C,UAAU,IAAI,YAAY;IAO1B,gBAAgB,IAAI,iBAAiB,EAAE;CAGxC"}

package/auth/authorized-apps.utils.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Progressive/Incremental authorization support.
+ *
+ * The set of app IDs a verified token may use lives in the `authorized_apps`
+ * claim embedded by {@link LocalPrimaryAuth.signAccessToken}. That claim is ONLY
+ * present when `incrementalAuth` is enabled for the scope — its ABSENCE is
+ * meaningful: no app-level gating (the historical allow-all behavior is
+ * preserved). When present, `checkToolAuthorization` enforces that the tool's
+ * parent app is a member of the set, and an incremental authorize for a new app
+ * mints a fresh token whose claim is the UNION of the prior apps plus the newly
+ * authorized one.
+ *
+ * This mirrors the consent claim model (see `consent.utils.ts`): the grant is
+ * carried in verified JWT claims and re-minted via the OAuth code exchange, so
+ * it is genuinely enforced rather than tracked in dormant server state.
+ */
+/**
+ * Minimal `authInfo` projection this helper reads from. The HTTP request flow
+ * nests the verified user under `extra.user` (claims spread in via
+ * `deriveTypedUser`, so `authorized_apps` is present there); other transports
+ * may carry the user at the top level. The verified bearer `token` is the
+ * last-resort source — decoding it requires NO re-verification because the
+ * token already passed `session:verify` before any tool call runs.
+ */
+interface AuthorizedAppsAuthInfoLike {
+    token?: string;
+    user?: unknown;
+    extra?: unknown;
+}
+/**
+ * Extract the authorized-app-id set from a verified `authInfo`.
+ *
+ * Returns:
+ * - a `Set<string>` of authorized app ids when the token carries an
+ *   `authorized_apps` claim (the runtime enforcement set), or
+ * - `undefined` when there is NO such claim — the caller MUST treat this as
+ *   "allow" so the default (incremental-disabled) behavior is preserved.
+ *
+ * Resolution order (first hit wins): `extra.user.authorized_apps`
+ * → `extra.authorized_apps` → `user.authorized_apps` → decode `token`. All
+ * sources are equivalent (they derive from the same verified claims); the
+ * fallbacks just make enforcement transport-agnostic.
+ *
+ * Security: this reads ALREADY-VERIFIED claims. The token decode path uses a
+ * no-verify payload decode purely to recover the claim that some transports
+ * drop from the projected `authInfo`; signature trust was established upstream
+ * in `auth:verify` / `session:verify`.
+ */
+export declare function getAuthorizedAppIds(authInfo: AuthorizedAppsAuthInfoLike | undefined): Set<string> | undefined;
+export {};
+//# sourceMappingURL=authorized-apps.utils.d.ts.map

package/auth/authorized-apps.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorized-apps.utils.d.ts","sourceRoot":"","sources":["../../src/auth/authorized-apps.utils.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;GAOG;AACH,UAAU,0BAA0B;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAoBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,0BAA0B,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAW7G"}

package/auth/consent-tools.helper.d.ts

@@ -0,0 +1,26 @@
+import { type ToolCard } from '@frontmcp/auth';
+import { type ScopeEntry } from '../common';
+/**
+ * Result of projecting the scope's tools into a consent-ready shape.
+ */
+export interface ConsentToolProjection {
+    /** Tool cards for the consent screen, with `excludedTools` removed. */
+    toolCards: ToolCard[];
+    /**
+     * The offerable tool ids (effective runtime ids), with `excludedTools`
+     * removed. This is what the consent screen offers and what a submitted
+     * selection is validated against.
+     */
+    availableToolIds: string[];
+}
+/**
+ * Project the scope's tools into consent cards + available ids, applying the
+ * `excludedTools` filter (excluded tools are NEVER offered and NEVER required,
+ * because they are always available regardless of consent).
+ *
+ * Used by BOTH the authorize flow (to seed `pendingAuth.consent.availableToolIds`)
+ * and the callback flow (to render the consent screen + validate a submission),
+ * so the two surfaces can never drift.
+ */
+export declare function projectConsentTools(scope: ScopeEntry, excludedTools?: string[]): ConsentToolProjection;
+//# sourceMappingURL=consent-tools.helper.d.ts.map

package/auth/consent-tools.helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-tools.helper.d.ts","sourceRoot":"","sources":["../../src/auth/consent-tools.helper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,uEAAuE;IACvE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,qBAAqB,CA+BtG"}

package/auth/consent.utils.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Shape of the `consent` claim embedded in a FrontMCP-minted access token by
+ * {@link LocalPrimaryAuth.signAccessToken}:
+ *
+ * ```json
+ * { "consent": { "enabled": true, "selectedTools": ["app:tool", ...] } }
+ * ```
+ *
+ * Only present when consent mode was enabled for the authorization that minted
+ * the token. Its ABSENCE is meaningful: consent disabled ⇒ no enforcement.
+ */
+export interface ConsentClaim {
+    enabled?: boolean;
+    selectedTools?: string[];
+}
+/**
+ * Minimal `authInfo` projection this helper reads from. The HTTP request flow
+ * nests the verified user under `extra.user` (claims spread in via
+ * `deriveTypedUser`, so `consent` is present there); other transports may carry
+ * the user at the top level. The verified bearer `token` is the last-resort
+ * source — decoding it requires NO re-verification because the token already
+ * passed `session:verify` before any tool call runs.
+ */
+interface ConsentAuthInfoLike {
+    token?: string;
+    user?: unknown;
+    extra?: unknown;
+}
+/**
+ * Extract the consented tool-id set from a verified `authInfo`.
+ *
+ * Returns:
+ * - a `Set<string>` of selected tool ids when the token carries an ENABLED
+ *   `consent` claim (the runtime enforcement set), or
+ * - `undefined` when there is NO consent metadata — the caller MUST treat this
+ *   as "allow" so the default (consent-disabled) behavior is preserved.
+ *
+ * Resolution order (first hit wins): `extra.user.consent` → `extra.consent`
+ * → `user.consent` → decode `token`. All sources are equivalent (they derive
+ * from the same verified claims); the fallbacks just make enforcement
+ * transport-agnostic.
+ *
+ * Security: this reads ALREADY-VERIFIED claims. The token decode path uses a
+ * no-verify payload decode purely to recover the `consent` claim that some
+ * transports drop from the projected `authInfo`; signature trust was
+ * established upstream in `auth:verify` / `session:verify`.
+ */
+export declare function getConsentedToolIds(authInfo: ConsentAuthInfoLike | undefined): Set<string> | undefined;
+/**
+ * Test whether a tool id is permitted by the consent set returned from
+ * {@link getConsentedToolIds}.
+ *
+ * - `consented === undefined` (no consent metadata) ⇒ always allowed.
+ * - otherwise the tool id must be a member of the set.
+ *
+ * `toolIds` accepts the tool's candidate identifiers (e.g. `fullName` and bare
+ * `name`); the tool is allowed if ANY of them was consented, matching the
+ * available-tool ids surfaced on the consent screen.
+ */
+export declare function isToolConsented(consented: Set<string> | undefined, ...toolIds: Array<string | undefined>): boolean;
+export {};
+//# sourceMappingURL=consent.utils.d.ts.map

package/auth/consent.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.utils.d.ts","sourceRoot":"","sources":["../../src/auth/consent.utils.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,UAAU,mBAAmB;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IAIf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAsBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAatG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,GAAG,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAGlH"}

package/auth/credentials/credentials.context-extension.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Credentials Context Extension (Checkpoint 3b)
+ *
+ * Module augmentation + context-extension configuration that adds
+ * `this.credentials` to ExecutionContextBase, mirroring `this.authProviders`
+ * and `this.orchestration`.
+ *
+ * `this.credentials` exposes the per-session, encrypted {@link CredentialsAccessor}
+ * so tools can read credentials a local `authenticate()` verifier persisted, and
+ * ask the agent to connect a missing credential mid-session via a
+ * framework-signed resume URL.
+ */
+import { type CredentialsAccessor } from '@frontmcp/auth';
+import type { ContextExtension } from '../../common/metadata/plugin.metadata';
+declare module '../../common/interfaces/execution-context.interface' {
+    interface ExecutionContextBase {
+        /**
+         * Access per-session credentials persisted by a local `authenticate()`
+         * verifier (Checkpoint 3b). Only available in `local`/`remote` auth modes.
+         *
+         * @example
+         * ```typescript
+         * @Tool({ name: 'call_acme' })
+         * class CallAcmeTool extends ToolContext {
+         *   async execute(input: Input): Promise<Output> {
+         *     // Read a stored credential for the current session's subject
+         *     const cred = await this.credentials.get('acme');
+         *     if (!cred) {
+         *       // Ask the user to connect it mid-session via a signed resume URL
+         *       const res = await this.credentials.requireConnect({ key: 'acme' });
+         *       if (!res.connected) {
+         *         return { needsConnect: res.resumeUrl };
+         *       }
+         *     }
+         *     // use cred.secret / cred.metadata …
+         *   }
+         * }
+         * ```
+         */
+        readonly credentials: CredentialsAccessor;
+    }
+}
+/**
+ * Context extension configuration for `this.credentials`. Registers the lazy
+ * getter on ExecutionContextBase.prototype; resolves {@link CREDENTIALS_ACCESSOR}
+ * from the request scope.
+ */
+export declare const credentialsContextExtension: ContextExtension;
+/**
+ * Get the {@link CredentialsAccessor} from a context. Throws via the DI layer
+ * when not configured (see {@link credentialsContextExtension.errorMessage}).
+ */
+export declare function getCredentials(ctx: {
+    get: <T>(token: unknown) => T;
+}): CredentialsAccessor;
+/**
+ * Try to get the {@link CredentialsAccessor}; returns undefined when not
+ * available (graceful degradation).
+ */
+export declare function tryGetCredentials(ctx: {
+    tryGet: <T>(token: unknown) => T | undefined;
+}): CredentialsAccessor | undefined;
+//# sourceMappingURL=credentials.context-extension.d.ts.map

package/auth/credentials/credentials.context-extension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.context-extension.d.ts","sourceRoot":"","sources":["../../../src/auth/credentials/credentials.context-extension.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAwB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAEhF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAM9E,OAAO,QAAQ,qDAAqD,CAAC;IACnE,UAAU,oBAAoB;QAC5B;;;;;;;;;;;;;;;;;;;;;;WAsBG;QACH,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;KAC3C;CACF;AAMD;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,gBAMzC,CAAC;AAMF;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE;IAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,KAAK,CAAC,CAAA;CAAE,GAAG,mBAAmB,CAE1F;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,KAAK,CAAC,GAAG,SAAS,CAAC;CAC9C,GAAG,mBAAmB,GAAG,SAAS,CAElC"}

package/auth/credentials/credentials.providers.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Credentials DI Providers (Checkpoint 3b)
+ *
+ * Registers the per-request {@link CredentialsAccessor} (`this.credentials`).
+ * The vault itself is a GLOBAL singleton owned by LocalPrimaryAuth; the accessor
+ * is CONTEXT-scoped because it must resolve the CURRENT request's authenticated
+ * subject (from {@link FrontMcpContext}) before reading the vault.
+ */
+import { type SessionCredentialVault } from '@frontmcp/auth';
+import { type Token } from '@frontmcp/di';
+import { type ProviderType } from '../../common';
+import { type FrontMcpContext } from '../../context/frontmcp-context';
+/**
+ * GLOBAL DI token for the per-session credential vault singleton. Provided by
+ * LocalPrimaryAuth once its storage backend is initialized.
+ */
+export declare const SESSION_CREDENTIAL_VAULT: Token<SessionCredentialVault>;
+/**
+ * Resolve the authenticated subject for the current request from the verified
+ * auth info. The HTTP request flow stores the verified JWT user under
+ * `authInfo.extra.user`; the JWT `sub` is the credential-vault key. Anonymous
+ * sessions (`sub` empty or `anon:` prefixed) yield undefined so no credentials
+ * are exposed.
+ */
+export declare function resolveRequestSub(ctx: FrontMcpContext): string | undefined;
+/**
+ * Build the DI providers that back `this.credentials`.
+ *
+ * @param vault - the GLOBAL credential vault singleton.
+ * @param signingSecret - server HMAC secret used to sign resume tokens.
+ * @param basePath - auth scope base path used to build resume URLs.
+ * @param resumeTtlMs - optional resume-token TTL override.
+ */
+export declare function createCredentialsProviders(opts: {
+    vault: SessionCredentialVault;
+    signingSecret: string;
+    basePath: string;
+    resumeTtlMs?: number;
+}): ProviderType[];
+//# sourceMappingURL=credentials.providers.d.ts.map

package/auth/credentials/credentials.providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.providers.d.ts","sourceRoot":"","sources":["../../../src/auth/credentials/credentials.providers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAiD,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC5G,OAAO,EAAiB,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAGtE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAEhC,KAAK,CAAC,sBAAsB,CAAC,CAAC;AAEnC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAO1E;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,KAAK,EAAE,sBAAsB,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,YAAY,EAAE,CA6BjB"}

package/auth/credentials/index.d.ts

@@ -0,0 +1,3 @@
+export { SESSION_CREDENTIAL_VAULT, createCredentialsProviders, resolveRequestSub } from './credentials.providers';
+export { credentialsContextExtension, getCredentials, tryGetCredentials } from './credentials.context-extension';
+//# sourceMappingURL=index.d.ts.map

package/auth/credentials/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/credentials/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAGlH,OAAO,EAAE,2BAA2B,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC"}

package/auth/flows/auth.verify.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.verify.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/auth.verify.flow.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,QAAQ,EAQR,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAiBL,KAAK,aAAa,EAMnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAKvC,QAAA,MAAM,WAAW;;gCAAyB,CAAC;AAG3C,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;gCAUf,CAAC;AA2BH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAAmE,CAAC;AAEvG,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAGtE,QAAA,MAAM,IAAI;;;CAU2B,CAAC;AAGtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,aAAa,EAAE,cAAc,CAC3B,cAAc,EACd,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,sBAAsB,EAC7B,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,aAAsB,CAAC;AAGpC;;;;;;;;;GASG;AAQH,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAC/D,OAAO,CAAC,MAAM,CAA6C;IAE3D;;OAEG;IAEG,UAAU;IA6BhB;;OAEG;IAEG,iBAAiB;IAcvB;;OAEG;IAIG,gBAAgB;IAqBtB;;;OAGG;IAQG,uBAAuB;IAsB7B;;OAEG;IAWG,0BAA0B;IAShC;;OAEG;IAIG,WAAW;IAwGjB;;OAEG;IAEG,kBAAkB;IA8FxB;;OAEG;IACH,OAAO,CAAC,QAAQ;IA0BhB;;OAEG;IACH,OAAO,CAAC,WAAW;CAMpB"}
+{"version":3,"file":"auth.verify.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/auth.verify.flow.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,QAAQ,EAQR,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAiBL,KAAK,aAAa,EAMnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAKvC,QAAA,MAAM,WAAW;;gCAAyB,CAAC;AAG3C,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;gCAUf,CAAC;AA2BH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAAmE,CAAC;AAEvG,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAGtE,QAAA,MAAM,IAAI;;;CAU2B,CAAC;AAGtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,aAAa,EAAE,cAAc,CAC3B,cAAc,EACd,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,sBAAsB,EAC7B,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,aAAsB,CAAC;AAGpC;;;;;;;;;GASG;AAQH,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAC/D,OAAO,CAAC,MAAM,CAA6C;IAE3D;;OAEG;IAEG,UAAU;IA6BhB;;OAEG;IAEG,iBAAiB;IAcvB;;OAEG;IAIG,gBAAgB;IAqBtB;;;OAGG;IAQG,uBAAuB;IAsB7B;;OAEG;IAWG,0BAA0B;IAShC;;OAEG;IAIG,WAAW;IAoHjB;;OAEG;IAEG,kBAAkB;IA8FxB;;OAEG;IACH,OAAO,CAAC,QAAQ;IA0BhB;;OAEG;IACH,OAAO,CAAC,WAAW;CAMpB"}