@frontmcp/sdk 1.8.2 → 1.8.3

package/agent/agent.instance.d.ts

@@ -1,5 +1,5 @@
 import { type CallToolRequest, type Tool } from '@frontmcp/protocol';
-import { AgentContext, AgentEntry, type AgentCallArgs, type AgentCallExtra, type AgentInputOf, type AgentLlmAdapter, type AgentOutputOf, type AgentRecord, type EntryOwnerRef, type ParsedAgentResult, type SafeTransformResult, type ScopeEntry, type ToolInputType, type ToolOutputType } from '../common';
+import { AgentContext, AgentEntry, type AgentCallArgs, type AgentCallExtra, type AgentInputOf, type AgentLlmAdapter, type AgentOutputOf, type AgentRecord, type EntryOwnerRef, type ParsedAgentResult, type SafeTransformResult, type ScopeEntry, type ToolEntry, type ToolInputType, type ToolOutputType } from '../common';
 import type HookRegistry from '../hooks/hook.registry';
 import type ProviderRegistry from '../provider/provider.registry';
 import { ToolInstance } from '../tool/tool.instance';
@@ -104,8 +104,9 @@ export declare class AgentInstance<InSchema extends ToolInputType = ToolInputTyp
     /**
      * Build ToolMetadata from AgentMetadata.
      *
-     * Includes plugin metadata extensions (cache, codecall) from agent metadata
-     * so plugins can apply to agent tools.
+     * The agent is listed and called only through this tool, so everything the agent declares
+     * that gates a tool (availability, limits, and every plugin extension such as `authorities`,
+     * `approval` or `featureFlag`) is copied onto it.
      */
     private buildAgentToolMetadata;
     /**
@@ -124,6 +125,11 @@ export declare class AgentInstance<InSchema extends ToolInputType = ToolInputTyp
      * @returns The agent's ToolInstance, or null if not created
      */
     getToolInstance(): ToolInstance | null;
+    /**
+     * The tools this agent can call: those it declares and those its plugins contribute, as its private
+     * scope holds them. Empty until the agent is initialized.
+     */
+    getAgentTools(): readonly ToolEntry[];
     getMetadata(): import("../common").AgentMetadata<Readonly<{
         [k: string]: import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;
     }>, ToolOutputType>;
@@ -173,6 +179,11 @@ export declare class AgentInstance<InSchema extends ToolInputType = ToolInputTyp
      * @returns A function that executes tools by name
      */
     private createToolExecutor;
+    /**
+     * The `checkEntryAuthorities` stage of tools:call-tool, for a tool this agent runs directly
+     * (`execution.useToolFlow: false`): the caller the agent runs for must satisfy the tool's `authorities`.
+     */
+    private assertToolAuthorized;
     /**
      * Extract the actual result from MCP CallToolResult format.
      *

package/agent/agent.instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.instance.d.ts","sourceRoot":"","sources":["../../src/agent/agent.instance.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,eAAe,EAAyC,KAAK,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAG5G,OAAO,EACL,YAAY,EACZ,UAAU,EAEV,KAAK,aAAa,EAClB,KAAK,cAAc,EAGnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,WAAW,EAEhB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EAEf,KAAK,aAAa,EAElB,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AASnB,OAAO,KAAK,YAAY,MAAM,wBAAwB,CAAC;AAEvD,OAAO,KAAK,gBAAgB,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAkBrD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBAAa,aAAa,CACxB,QAAQ,SAAS,aAAa,GAAG,aAAa,EAC9C,SAAS,SAAS,cAAc,GAAG,cAAc,EACjD,EAAE,GAAG,YAAY,CAAC;IAAE,WAAW,EAAE,QAAQ,CAAA;CAAE,CAAC,EAC5C,GAAG,GAAG,aAAa,CAAC;IAAE,YAAY,EAAE,SAAS,CAAA;CAAE,CAAC,CAChD,SAAQ,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAE7B,qCAAqC;IACrC,OAAO,CAAC,UAAU,CAAgC;IAElD,yDAAyD;IACzD,OAAO,CAAC,UAAU,CAAmB;IAErC,yEAAyE;IACzE,OAAO,CAAC,UAAU,CAA2B;IAE7C;;;;OAIG;IACH,OAAO,CAAC,iBAAiB,CAA6B;gBAE1C,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa;cA0BlE,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAc3C;;;;;;;;;;;;OAYG;YACW,oBAAoB;IAgClC;;OAEG;YACW,oBAAoB;IAgDlC;;;OAGG;IAEH,OAAO,CAAC,oBAAoB;IA+B5B;;;;;OAKG;YACW,aAAa;IA2B3B;;;OAGG;IACH,OAAO,CAAC,YAAY;IAYpB;;;;;;;;;;;;OAYG;YACW,iBAAiB;IA+B/B;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAyC9B;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IAsBrC;;;;;;;OAOG;IACH,eAAe,IAAI,YAAY,GAAG,IAAI;IAQtC,WAAW;;;IAIF,eAAe;IAIxB;;OAEG;IACH,aAAa,IAAI,eAAe,GAAG,IAAI;IAQvC;;;;;;;OAOG;IACM,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,GAAG,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC;IAqCtG;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAoB1B;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAK1B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,kBAAkB;IAsC1B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,iBAAiB;IAmChB,UAAU,CAAC,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,aAAa;IAK3D,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,iBAAiB;IAKjE,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,mBAAmB,CAAC,iBAAiB,CAAC;IAQnG;;;;;OAKG;IACM,iBAAiB,IAAI,IAAI;IA+BlC;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAanB,gBAAgB,IAAI,OAAO;IAI3B,WAAW,IAAI,OAAO;IAItB,kBAAkB,IAAI,MAAM,EAAE;CAGxC"}
+{"version":3,"file":"agent.instance.d.ts","sourceRoot":"","sources":["../../src/agent/agent.instance.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,eAAe,EAAyC,KAAK,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAG5G,OAAO,EACL,YAAY,EACZ,UAAU,EAEV,KAAK,aAAa,EAClB,KAAK,cAAc,EAGnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,WAAW,EAEhB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,aAAa,EAElB,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AAUnB,OAAO,KAAK,YAAY,MAAM,wBAAwB,CAAC;AAEvD,OAAO,KAAK,gBAAgB,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AA8CrD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBAAa,aAAa,CACxB,QAAQ,SAAS,aAAa,GAAG,aAAa,EAC9C,SAAS,SAAS,cAAc,GAAG,cAAc,EACjD,EAAE,GAAG,YAAY,CAAC;IAAE,WAAW,EAAE,QAAQ,CAAA;CAAE,CAAC,EAC5C,GAAG,GAAG,aAAa,CAAC;IAAE,YAAY,EAAE,SAAS,CAAA;CAAE,CAAC,CAChD,SAAQ,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAE7B,qCAAqC;IACrC,OAAO,CAAC,UAAU,CAAgC;IAElD,yDAAyD;IACzD,OAAO,CAAC,UAAU,CAAmB;IAErC,yEAAyE;IACzE,OAAO,CAAC,UAAU,CAA2B;IAE7C;;;;OAIG;IACH,OAAO,CAAC,iBAAiB,CAA6B;gBAE1C,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa;cA0BlE,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAc3C;;;;;;;;;;;;OAYG;YACW,oBAAoB;IAgClC;;OAEG;YACW,oBAAoB;IAgDlC;;;OAGG;IAEH,OAAO,CAAC,oBAAoB;IA+B5B;;;;;OAKG;YACW,aAAa;IA2B3B;;;OAGG;IACH,OAAO,CAAC,YAAY;IAYpB;;;;;;;;;;;;OAYG;YACW,iBAAiB;IA+B/B;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IAwC9B;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IAsBrC;;;;;;;OAOG;IACH,eAAe,IAAI,YAAY,GAAG,IAAI;IAItC;;;OAGG;IACH,aAAa,IAAI,SAAS,SAAS,EAAE;IAQrC,WAAW;;;IAIF,eAAe;IAIxB;;OAEG;IACH,aAAa,IAAI,eAAe,GAAG,IAAI;IAQvC;;;;;;;OAOG;IACM,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,GAAG,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC;IAqCtG;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAoB1B;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAK1B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,kBAAkB;IAwC1B;;;OAGG;YACW,oBAAoB;IAgClC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,iBAAiB;IAmChB,UAAU,CAAC,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,aAAa;IAK3D,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,iBAAiB;IAKjE,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,mBAAmB,CAAC,iBAAiB,CAAC;IAQnG;;;;;OAKG;IACM,iBAAiB,IAAI,IAAI;IA+BlC;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAanB,gBAAgB,IAAI,OAAO;IAI3B,WAAW,IAAI,OAAO;IAItB,kBAAkB,IAAI,MAAM,EAAE;CAGxC"}

package/agent/agent.scope.d.ts

@@ -76,6 +76,12 @@ export declare class AgentScope {
     get toolUI(): import("../tool/ui").ToolUIRegistry | undefined;
     get skills(): import("@frontmcp/sdk").SkillRegistryInterface;
     get scopeMetadata(): import("../common").ScopeMetadata;
+    /** The server's authorities engine: the agent's tools answer to its rules like every other tool. */
+    get authoritiesEngine(): import("@frontmcp/auth").AuthoritiesEngine | undefined;
+    /** The server's builder for the context `authorities` rules are evaluated against (claims mapping included). */
+    get authoritiesContextBuilder(): import("@frontmcp/auth").AuthoritiesContextBuilder | undefined;
+    /** The server's mapping from authority denials to OAuth scope challenges. */
+    get authoritiesScopeMapping(): import("@frontmcp/auth").AuthoritiesScopeMapping | undefined;
     registryFlows(...flows: FlowType[]): Promise<void>;
     runFlow<Name extends FlowName>(name: Name, input: FlowInputOf<Name>, deps?: Map<Token, Type>): Promise<FlowOutputOf<Name> | undefined>;
     runFlowForOutput<Name extends FlowName>(name: Name, input: FlowInputOf<Name>, deps?: Map<Token, Type>): Promise<FlowOutputOf<Name>>;

package/agent/agent.scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.scope.d.ts","sourceRoot":"","sources":["../../src/agent/agent.scope.ts"],"names":[],"mappings":"AAEA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAiB,KAAK,KAAK,EAAE,KAAK,IAAI,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EACL,cAAc,EACd,UAAU,EACV,KAAK,aAAa,EAElB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,YAAY,EAClB,MAAM,WAAW,CAAC;AAGnB,OAAO,YAAY,MAAM,wBAAwB,CAAC;AAClD,OAAO,cAAc,MAAM,2BAA2B,CAAC;AACvD,OAAO,cAAc,MAAM,2BAA2B,CAAC;AACvD,OAAO,gBAAgB,MAAM,+BAA+B,CAAC;AAC7D,OAAO,gBAAgB,MAAM,+BAA+B,CAAC;AAI7D,OAAO,YAAY,MAAM,uBAAuB,CAAC;AAEjD,OAAO,aAAa,MAAM,kBAAkB,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBAAa,UAAU;IAyBnB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAxB3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAa;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAG3C,OAAO,CAAC,cAAc,CAAoB;IAC1C,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,aAAa,CAAmB;IACxC,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,cAAc,CAAoB;IAC1C,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,WAAW,CAAiB;IACpC,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,UAAU,CAAgB;gBAGhC,WAAW,EAAE,UAAU,EACvB,OAAO,EAAE,MAAM,EACE,QAAQ,EAAE,aAAa,EACxC,UAAU,EAAE,KAAK;YAkBL,UAAU;IAsGxB,IAAI,KAAK,IAAI,YAAY,CAExB;IAED,IAAI,KAAK,IAAI,YAAY,CAExB;IAED,IAAI,SAAS,IAAI,gBAAgB,CAEhC;IAED,IAAI,OAAO,IAAI,cAAc,CAE5B;IAED,IAAI,QAAQ,IAAI,eAAe,CAE9B;IAED,IAAI,SAAS,IAAI,gBAAgB,CAEhC;IAED,IAAI,OAAO,IAAI,cAAc,CAE5B;IAED,IAAI,MAAM,IAAI,aAAa,CAE1B;IAMD,IAAI,IAAI,IAAI,YAAY,CAEvB;IAED,IAAI,aAAa,iDAEhB;IAED,IAAI,IAAI,0CAEP;IAED,IAAI,aAAa,kDAEhB;IAED,IAAI,MAAM,oDAET;IAED,IAAI,MAAM,mDAET;IAED,IAAI,aAAa,sCAEhB;IAMK,aAAa,CAAC,GAAG,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,OAAO,CAAC,IAAI,SAAS,QAAQ,EAC3B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EACxB,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GACtB,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAIpC,gBAAgB,CAAC,IAAI,SAAS,QAAQ,EAC1C,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EACxB,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GACtB,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;CAO/B"}
+{"version":3,"file":"agent.scope.d.ts","sourceRoot":"","sources":["../../src/agent/agent.scope.ts"],"names":[],"mappings":"AAEA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAiB,KAAK,KAAK,EAAE,KAAK,IAAI,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EACL,cAAc,EACd,UAAU,EACV,KAAK,aAAa,EAElB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,YAAY,EAClB,MAAM,WAAW,CAAC;AAGnB,OAAO,YAAY,MAAM,wBAAwB,CAAC;AAClD,OAAO,cAAc,MAAM,2BAA2B,CAAC;AACvD,OAAO,cAAc,MAAM,2BAA2B,CAAC;AACvD,OAAO,gBAAgB,MAAM,+BAA+B,CAAC;AAC7D,OAAO,gBAAgB,MAAM,+BAA+B,CAAC;AAI7D,OAAO,YAAY,MAAM,uBAAuB,CAAC;AAEjD,OAAO,aAAa,MAAM,kBAAkB,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBAAa,UAAU;IAyBnB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAxB3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAa;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAG3C,OAAO,CAAC,cAAc,CAAoB;IAC1C,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,aAAa,CAAmB;IACxC,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,cAAc,CAAoB;IAC1C,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,WAAW,CAAiB;IACpC,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,UAAU,CAAgB;gBAGhC,WAAW,EAAE,UAAU,EACvB,OAAO,EAAE,MAAM,EACE,QAAQ,EAAE,aAAa,EACxC,UAAU,EAAE,KAAK;YAkBL,UAAU;IAsGxB,IAAI,KAAK,IAAI,YAAY,CAExB;IAED,IAAI,KAAK,IAAI,YAAY,CAExB;IAED,IAAI,SAAS,IAAI,gBAAgB,CAEhC;IAED,IAAI,OAAO,IAAI,cAAc,CAE5B;IAED,IAAI,QAAQ,IAAI,eAAe,CAE9B;IAED,IAAI,SAAS,IAAI,gBAAgB,CAEhC;IAED,IAAI,OAAO,IAAI,cAAc,CAE5B;IAED,IAAI,MAAM,IAAI,aAAa,CAE1B;IAMD,IAAI,IAAI,IAAI,YAAY,CAEvB;IAED,IAAI,aAAa,iDAEhB;IAED,IAAI,IAAI,0CAEP;IAED,IAAI,aAAa,kDAEhB;IAED,IAAI,MAAM,oDAET;IAED,IAAI,MAAM,mDAET;IAED,IAAI,aAAa,sCAEhB;IAED,oGAAoG;IACpG,IAAI,iBAAiB,2DAEpB;IAED,gHAAgH;IAChH,IAAI,yBAAyB,mEAE5B;IAED,6EAA6E;IAC7E,IAAI,uBAAuB,iEAE1B;IAMK,aAAa,CAAC,GAAG,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,OAAO,CAAC,IAAI,SAAS,QAAQ,EAC3B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EACxB,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GACtB,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAIpC,gBAAgB,CAAC,IAAI,SAAS,QAAQ,EAC1C,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EACxB,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GACtB,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;CAO/B"}

package/agent/agent.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.utils.d.ts","sourceRoot":"","sources":["../../src/agent/agent.utils.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,KAAK,KAAK,EAAa,MAAM,cAAc,CAAC;AAErD,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,SAAS,EACf,MAAM,WAAW,CAAC;AAQnB;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAGzF;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAIlG;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,QAAQ,GAAG,aAAa,CA8BtE;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GAAG,aAAa,CAGzG;AAMD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,CA4D5D;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,GAAG,KAAK,EAAE,CAoB/D;AAMD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAgBrD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAE5E;AAMD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CAQnE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAEtE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAEjE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,EAAE,CAGpE"}
+{"version":3,"file":"agent.utils.d.ts","sourceRoot":"","sources":["../../src/agent/agent.utils.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,KAAK,KAAK,EAAa,MAAM,cAAc,CAAC;AAErD,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,SAAS,EACf,MAAM,WAAW,CAAC;AAQnB;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAGzF;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAIlG;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,QAAQ,GAAG,aAAa,CAmCtE;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GAAG,aAAa,CAGzG;AAMD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,CA4D5D;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,GAAG,KAAK,EAAE,CAoB/D;AAMD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAgBrD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAE5E;AAMD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CAQnE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAEtE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAEjE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,EAAE,CAGpE"}

package/auth/auth-ui/auth-ui.render.d.ts

@@ -8,6 +8,16 @@ import { type AuthUiRegistry } from './auth-ui.registry';
 export { AUTH_MOUNT_ID };
 /** Path the auth extra submissions POST to (action discriminates the extra). */
 export declare function authUiExtraPath(fullPath: string): string;
+/**
+ * The CSP source expression that lets a form submission end at `target`, or
+ * `undefined` when none can name it exactly:
+ * - an `http(s)` URL: its origin (`https://app.example.com:8443`);
+ * - a native app's private-use scheme (RFC 8252 §7.1, `com.example.app:/cb`),
+ *   which has no origin: that scheme;
+ * - anything else (unparseable, an IPv6 host a CSP source can't express, a
+ *   script or local scheme): nothing, so the redirect stays blocked.
+ */
+export declare function formActionSource(target: string): string | undefined;
 /**
  * The Content-Security-Policy for an auth-UI page.
  *
@@ -17,11 +27,26 @@ export declare function authUiExtraPath(fullPath: string): string;
  * user input). It does NOT include `'unsafe-eval'` — the TSX→JS transform is
  * done server-side, so the browser never evals source. Framing is denied to
  * prevent clickjacking of the login / consent form.
+ *
+ * `form-action` allows this server plus the origin of each of `formTargets`:
+ * the URLs the server may redirect a submission of the page's form to (the
+ * client's validated `redirect_uri`, an upstream provider's authorization
+ * endpoint). Browsers apply `form-action` to those redirects, so with `'self'`
+ * alone the sign-in would stop at the callback.
+ *
+ * @param formTargets - Where a submission of the page's form may be redirected
  */
+export declare function authUiCsp(formTargets?: readonly string[]): string;
+/** The auth-UI CSP for a page whose form can only reach this server (see {@link authUiCsp}). */
 export declare const AUTH_UI_CSP: string;
 /**
  * Build the auth security headers for an auth-UI page (CSP + anti-clickjacking).
  *
+ * `Referrer-Policy: same-origin`, as on the built-in pages: the page's URL
+ * stays away from esm.sh, while a POST of its form still carries its `Origin`,
+ * which `/oauth/callback` checks (`no-referrer` would send `Origin: null`, and
+ * the callback would refuse every sign-in as cross-origin).
+ *
  * @param csp - Override the CSP value (defaults to {@link AUTH_UI_CSP}).
  */
 export declare function authUiPageHeaders(csp?: string): Record<string, string>;
@@ -42,6 +67,12 @@ export declare function buildAuthUiPage(options: {
     fullPath: string;
     /** Page <title> (defaults to a slot-appropriate label). */
     title?: string;
+    /**
+     * Where the server may redirect a submission of the page's form (the
+     * validated `redirect_uri`, upstream authorization endpoints); their origins
+     * are allowed in the CSP `form-action` (see {@link authUiCsp}).
+     */
+    formTargets?: readonly string[];
 }): {
     html: string;
     headers: Record<string, string>;

package/auth/auth-ui/auth-ui.render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-ui.render.d.ts","sourceRoot":"","sources":["../../../src/auth/auth-ui/auth-ui.render.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAwB,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC5G,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIxD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,QASZ,CAAC;AAEb;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOnF;AAED,kFAAkF;AAClF,wBAAgB,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9D;AAiBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE;IACvC,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,SAAS,CAwChE"}
+{"version":3,"file":"auth-ui.render.d.ts","sourceRoot":"","sources":["../../../src/auth/auth-ui/auth-ui.render.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAwB,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC5G,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIxD;AAKD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAYnE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,SAAS,CAAC,WAAW,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,CAgBrE;AAED,gGAAgG;AAChG,eAAO,MAAM,WAAW,QAAc,CAAC;AAEvC;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQnF;AAED,kFAAkF;AAClF,wBAAgB,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9D;AAiBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE;IACvC,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,SAAS,CAwChE"}

package/auth/auth-ui/auth-ui.state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-ui.state.d.ts","sourceRoot":"","sources":["../../../src/auth/auth-ui/auth-ui.state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAoB,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE5G,+DAA+D;AAC/D,UAAU,UAAU;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;CACxC;AAED,oCAAoC;AACpC,wBAAgB,eAAe,CAC7B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACvG,aAAa,CAcf;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACvF,aAAa,CAaf;AAED,wCAAwC;AACxC,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,YAAY,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9F,aAAa,CAef;AAED,0CAA0C;AAC1C,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACtG,aAAa,CAiBf;AAED,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAM9F"}
+{"version":3,"file":"auth-ui.state.d.ts","sourceRoot":"","sources":["../../../src/auth/auth-ui/auth-ui.state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,YAAY,EAEjB,KAAK,QAAQ,EACd,MAAM,oBAAoB,CAAC;AAS5B,+DAA+D;AAC/D,UAAU,UAAU;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;CACxC;AAED,oCAAoC;AACpC,wBAAgB,eAAe,CAC7B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACvG,aAAa,CAef;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACvF,aAAa,CAcf;AAED,wCAAwC;AACxC,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,YAAY,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9F,aAAa,CAgBf;AAED,0CAA0C;AAC1C,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACtG,aAAa,CAkBf;AAED,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAM9F"}

package/auth/flows/form-body.utils.d.ts

@@ -0,0 +1,9 @@
+/**
+ * A POSTed HTML form body as a record.
+ *
+ * The Node host hands the flows an already-parsed object; the fetch handler
+ * hands over the raw `application/x-www-form-urlencoded` string. Repeated keys
+ * (checkbox groups such as `tools`) become arrays.
+ */
+export declare function parseFormBody(body: unknown): Record<string, unknown>;
+//# sourceMappingURL=form-body.utils.d.ts.map

package/auth/flows/form-body.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"form-body.utils.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/form-body.utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASpE"}

package/auth/flows/oauth.authorize.flow.d.ts

@@ -18,7 +18,7 @@
  */
 import { type IncrementalAuthTicketPayload } from '@frontmcp/auth';
 import { z } from '@frontmcp/lazy-zod';
-import { FlowBase, type FlowRunOptions } from '../../common';
+import { FlowBase, type FlowOutputOf, type FlowRunOptions } from '../../common';
 /**
  * Validated OAuth authorization request for orchestrated mode
  */
@@ -184,6 +184,17 @@ export default class OauthAuthorizeFlow extends FlowBase<typeof name> {
      */
     private resolveIssuer;
     private logger;
+    /** The sign-in binding cookie, once the pending authorization exists (see `prepareAuthorizationRequest`). */
+    private signinCookie;
+    /** Its hash, kept on the pending authorization and on remote mode's federated session. */
+    private signinBindingHash;
+    /**
+     * Respond, giving the browser the sign-in binding cookie once a pending
+     * authorization was created: the sign-in page, the provider-selection and
+     * incremental pages, a custom `auth.ui` page and remote mode's redirect to the
+     * upstream provider all carry it.
+     */
+    respond(output: FlowOutputOf<typeof name>): void;
     checkIpFilter(): Promise<void>;
     parseInput(): Promise<void>;
     validateInput(): Promise<void>;
@@ -207,10 +218,15 @@ export default class OauthAuthorizeFlow extends FlowBase<typeof name> {
      * pending authorization record (so the callback can verify it across nodes),
      * builds the {@link AuthFlowState} via `buildState`, SSRs the registered
      * component, and responds with the assembled page + CSP / anti-clickjacking
-     * headers. Returns `true` when it handled the slot (caller should `return`),
-     * `false` to fall through to the built-in page (no renderer / build failed).
+     * headers. `formTargets` are where the callback may redirect a submission of
+     * the page (the validated `redirect_uri`, upstream authorization endpoints):
+     * the page's CSP `form-action` allows their origins. Returns `true` when it
+     * handled the slot (caller should `return`), `false` to fall through to the
+     * built-in page (no renderer / build failed).
      */
     private tryRenderCustomSlot;
+    /** The authorization endpoints of the upstream providers among `providerIds` (others have none). */
+    private providerAuthorizationEndpoints;
     /**
      * Remote mode (`mode: 'remote'`) auto-federation.
      *
@@ -229,6 +245,8 @@ export default class OauthAuthorizeFlow extends FlowBase<typeof name> {
      */
     private startRemoteFederation;
     validateOutput(): Promise<void>;
+    /** An HTML response with the built-in auth pages' security headers (#263). */
+    private htmlPage;
     /**
      * Enforce the local-AS DCR allowlists (#462) at authorize time. Returns a
      * human-readable rejection reason, or `undefined` when the request is allowed

package/auth/flows/oauth.authorize.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.authorize.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.authorize.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH;;;;;;GAMG;AACH,OAAO,EAaL,KAAK,4BAA4B,EAIlC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,CAAC,EAAiB,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EAIL,QAAQ,EAWR,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAwEtB;;GAEG;AACH,QAAA,MAAM,2BAA2B;;;;;;;;;gCAS/B,CAAC;AAEH;;GAEG;AACH,QAAA,MAAM,+BAA+B;;;gCAGnC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAMxF,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAuCf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAIhB,CAAC;AAEH,QAAA,MAAM,IAAI;;;;CAS2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,iBAAiB,EAAE,cAAc,CAC/B,kBAAkB,EAClB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,iBAA0B,CAAC;AAkCxC,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IACnE;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,MAAM,CAAiD;IAGzD,aAAa;IAKb,UAAU;IAwGV,aAAa;IA2KnB;;;;;;;;OAQG;IACH,OAAO,CAAC,uBAAuB;IAiBzB,iBAAiB;IASjB,2BAA2B;IAsJ3B,oBAAoB;IAiL1B;;;;;;;;;OASG;YACW,mBAAmB;IA4CjC;;;;;;;;;;;;;;;OAeG;YACW,qBAAqB;IAsE7B,cAAc;IAIpB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAkBzB;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAuBxB;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IA+BvB;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAyBjC;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA2BhC;;OAEG;IACH,OAAO,CAAC,eAAe;CAyCxB"}
+{"version":3,"file":"oauth.authorize.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.authorize.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH;;;;;;GAMG;AACH,OAAO,EAgBL,KAAK,4BAA4B,EAIlC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,CAAC,EAAiB,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EAIL,QAAQ,EAUR,KAAK,YAAY,EAEjB,KAAK,cAAc,EAEpB,MAAM,cAAc,CAAC;AAyEtB;;GAEG;AACH,QAAA,MAAM,2BAA2B;;;;;;;;;gCAS/B,CAAC;AAEH;;GAEG;AACH,QAAA,MAAM,+BAA+B;;;gCAGnC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAMxF,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAuCf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAIhB,CAAC;AAEH,QAAA,MAAM,IAAI;;;;CAS2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,iBAAiB,EAAE,cAAc,CAC/B,kBAAkB,EAClB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,iBAA0B,CAAC;AAkCxC,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IACnE;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,MAAM,CAAiD;IAE/D,6GAA6G;IAC7G,OAAO,CAAC,YAAY,CAAyB;IAC7C,0FAA0F;IAC1F,OAAO,CAAC,iBAAiB,CAAqB;IAE9C;;;;;OAKG;IACM,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,GAAG,IAAI;IAKnD,aAAa;IAKb,UAAU;IAwGV,aAAa;IAiNnB;;;;;;;;OAQG;IACH,OAAO,CAAC,uBAAuB;IAiBzB,iBAAiB;IASjB,2BAA2B;IAiK3B,oBAAoB;IAkM1B;;;;;;;;;;;;OAYG;YACW,mBAAmB;IA6CjC,oGAAoG;IACpG,OAAO,CAAC,8BAA8B;IAWtC;;;;;;;;;;;;;;;OAeG;YACW,qBAAqB;IAuE7B,cAAc;IAIpB,8EAA8E;IAC9E,OAAO,CAAC,QAAQ;IAIhB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAkBzB;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAuBxB;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IA+BvB;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAyBjC;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA2BhC;;OAEG;IACH,OAAO,CAAC,eAAe;CAyCxB"}

package/auth/flows/oauth.callback.flow.d.ts

@@ -50,6 +50,7 @@ declare const stateSchema: import("@frontmcp/lazy-zod").ZodObject<{
     selectedTools: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
     consentSubmitted: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
     csrf: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    signinBinding: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
 }, import("zod/v4/core").$strip>;
 declare const outputSchema: import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodObject<{
     kind: import("@frontmcp/lazy-zod").ZodLiteral<"redirect">;
@@ -168,13 +169,14 @@ export default class OauthCallbackFlow extends FlowBase<typeof name> {
      * to the verifier as if they were login fields. Only string values are kept.
      */
     /**
-     * Defensively read a single param from a urlencoded POST body (some adapters
-     * parse the body into `request.body`). The consent form uses a GET round-trip
-     * (mirroring the federated page) so query params are the primary source; this
-     * is a fallback for adapters that route a POST body instead. Multi-valued
-     * keys keep all values so checkbox groups (`tools`) survive a POST.
+     * Read a single param from the POSTed form body. The built-in sign-in and
+     * consent forms POST here; the Node host hands the body over parsed, the fetch
+     * handler as the raw urlencoded string. Multi-valued keys keep all values so
+     * checkbox groups (`tools`, `providers`) survive.
      */
     private readBodyParam;
+    /** A single-valued param from the query (GET) or the form body (POST). */
+    private readParam;
     /**
      * Same-origin (CSRF) check for a state-changing login/consent submission.
      *
@@ -229,16 +231,31 @@ export default class OauthCallbackFlow extends FlowBase<typeof name> {
      * custom page already set on the record, so a consent re-render keeps the same
      * token), builds the consent {@link AuthFlowState} from the SAME tool
      * projection the built-in screen uses, SSRs the component, and responds with
-     * the assembled page + CSP headers. Returns `true` when handled.
+     * the assembled page + CSP headers (its `form-action` allows the client's
+     * `redirect_uri`, where the submission is redirected). Returns `true` when handled.
      */
     private tryRenderCustomConsent;
+    /**
+     * Keep the sign-in this request verified on the pending record while the
+     * consent screen is shown (#263), and give that screen a CSRF token.
+     *
+     * The consent form then needs only `pending_auth_id`, the token and the
+     * chosen tools: no login field (a password included) is written into the page
+     * or sent back through the browser. The sign-in is sealed with the server
+     * secret because it may carry `authenticate()` credentials and the record may
+     * live in a shared store. Fails closed: when the record can't be written the
+     * consent screen is not shown.
+     *
+     * @returns false when it already responded with an error.
+     */
+    private keepSignInForConsent;
     /**
      * Render the tool-consent screen.
      *
-     * The form GETs back to `/oauth/callback` carrying `pending_auth_id`,
-     * `consent_submitted=1`, the resolved identity (`email`/`name` + any custom
-     * `login.fields`), and the chosen `tools=` checkboxes — so the resubmit
-     * re-derives the SAME subject and proceeds to mint.
+     * The form POSTs back to `/oauth/callback` carrying `pending_auth_id`, the
+     * CSRF token, `consent_submitted=1` and the chosen `tools=` checkboxes. It
+     * carries no sign-in fields: {@link keepSignInForConsent} kept the verified
+     * sign-in on the pending record, and the resubmit completes it from there.
      *
      * Honors the `auth.consent` flags: `groupByApp`, `showDescriptions`,
      * `customMessage`, `allowSelectAll`, `requireSelection`, `defaultSelectedTools`
@@ -247,6 +264,8 @@ export default class OauthCallbackFlow extends FlowBase<typeof name> {
      * (used for an empty `requireSelection` submit).
      */
     private renderConsentScreen;
+    /** An HTML response with the built-in auth pages' security headers (#263). */
+    private htmlPage;
     /**
      * Generate a stable user sub from email
      * In production, this would be the user's ID from the database

package/auth/flows/oauth.callback.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.callback.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.callback.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgBH,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAGvC,OAAO,EAGL,QAAQ,EAQR,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAKtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA2Df,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAAgD,CAAC;AAEnE,QAAA,MAAM,IAAI;;;CAG2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,gBAAgB,EAAE,cAAc,CAC9B,iBAAiB,EACjB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,gBAAyB,CAAC;AAcvC,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAClE,OAAO,CAAC,MAAM,CAAgD;IAE9D;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAMf,aAAa;IAKb,UAAU;IA4EV,mBAAmB;IAsZzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IAEG,qBAAqB;IA2D3B;;;;;;OAMG;IAEG,mBAAmB;IAiInB,uBAAuB;IA2GvB,gBAAgB;IA8CtB;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAqB1C;IAEH;;;;;OAKG;IACH;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAYrB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,uBAAuB;IA4B/B,OAAO,CAAC,kBAAkB;IAsB1B;;;;OAIG;YACW,eAAe;IAgC7B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAQpB;;;;OAIG;YACW,iBAAiB;IAoB/B;;;;;;;OAOG;IACH,OAAO,CAAC,yBAAyB;IAYjC;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAmB5B;;;;;;;;OAQG;YACW,sBAAsB;IA0EpC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IA8D3B;;;OAGG;IACH,OAAO,CAAC,eAAe;IAQvB;;OAEG;IACH,OAAO,CAAC,eAAe;CAqDxB"}
+{"version":3,"file":"oauth.callback.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.callback.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAoBH,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAUvC,OAAO,EAGL,QAAQ,EAQR,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAatB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA8Df,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAAgD,CAAC;AAEnE,QAAA,MAAM,IAAI;;;CAG2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,gBAAgB,EAAE,cAAc,CAC9B,iBAAiB,EACjB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,gBAAyB,CAAC;AAevC,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAClE,OAAO,CAAC,MAAM,CAAgD;IAE9D;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAMf,aAAa;IAKb,UAAU;IA4EV,mBAAmB;IA+bzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IAEG,qBAAqB;IA2D3B;;;;;;OAMG;IAEG,mBAAmB;IAiInB,uBAAuB;IA2GvB,gBAAgB;IAyDtB;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAqB1C;IAEH;;;;;OAKG;IACH;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAUrB,0EAA0E;IAC1E,OAAO,CAAC,SAAS;IAOjB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,uBAAuB;IA4B/B,OAAO,CAAC,kBAAkB;IAqB1B;;;;OAIG;YACW,eAAe;IAgC7B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAQpB;;;;OAIG;YACW,iBAAiB;IAoB/B;;;;;;;OAOG;IACH,OAAO,CAAC,yBAAyB;IAYjC;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAmB5B;;;;;;;;;OASG;YACW,sBAAsB;IAgFpC;;;;;;;;;;;;OAYG;YACW,oBAAoB;IA4BlC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IA0C3B,8EAA8E;IAC9E,OAAO,CAAC,QAAQ;IAIhB;;;OAGG;IACH,OAAO,CAAC,eAAe;IAQvB;;OAEG;IACH,OAAO,CAAC,eAAe;CAqDxB"}

package/auth/flows/oauth.connect.flow.d.ts

@@ -68,6 +68,8 @@ export default class OauthConnectFlow extends FlowBase<typeof name> {
     private verifyToken;
     /** Resolve the single credential field to render from `login.fields` (first field), or a default. */
     private resolveConnectField;
+    /** An HTML response with the built-in auth pages' security headers (#263). */
+    private htmlPage;
     /** Render the single-field connect page (reusing the login field renderer). */
     private renderConnectPage;
     /**

package/auth/flows/oauth.connect.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.connect.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.connect.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAgBH,OAAO,EAGL,QAAQ,EAMR,KAAK,cAAc,EAEpB,MAAM,cAAc,CAAC;AAGtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;gCAOf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;gCAAiB,CAAC;AAEpC,QAAA,MAAM,IAAI;;;CAG2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,eAAe,EAAE,cAAc,CAC7B,gBAAgB,EAChB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,eAAwB,CAAC;AAiBtC,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IACjE,OAAO,CAAC,MAAM,CAA+C;IAGvD,aAAa;IAKb,UAAU;IAeV,aAAa;IAwHnB,yFAAyF;IACzF,OAAO,CAAC,WAAW;IAKnB,qGAAqG;IACrG,OAAO,CAAC,mBAAmB;IAW3B,+EAA+E;IAC/E,OAAO,CAAC,iBAAiB;IAoBzB;;;OAGG;YACW,eAAe;IA4B7B,+FAA+F;IAC/F,OAAO,CAAC,YAAY;IAQpB,oFAAoF;IACpF,OAAO,CAAC,sBAAsB;IAiB9B,4DAA4D;IAC5D,OAAO,CAAC,UAAU;IAyBlB,+FAA+F;IAC/F,OAAO,CAAC,aAAa;IAerB,2CAA2C;IAC3C,OAAO,CAAC,WAAW;CAQpB"}
+{"version":3,"file":"oauth.connect.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.connect.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAiBH,OAAO,EAGL,QAAQ,EAMR,KAAK,cAAc,EAEpB,MAAM,cAAc,CAAC;AAGtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;gCAOf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;gCAAiB,CAAC;AAEpC,QAAA,MAAM,IAAI;;;CAG2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,eAAe,EAAE,cAAc,CAC7B,gBAAgB,EAChB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,eAAwB,CAAC;AAiBtC,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IACjE,OAAO,CAAC,MAAM,CAA+C;IAGvD,aAAa;IAKb,UAAU;IAeV,aAAa;IAqHnB,yFAAyF;IACzF,OAAO,CAAC,WAAW;IAKnB,qGAAqG;IACrG,OAAO,CAAC,mBAAmB;IAW3B,8EAA8E;IAC9E,OAAO,CAAC,QAAQ;IAIhB,+EAA+E;IAC/E,OAAO,CAAC,iBAAiB;IAoBzB;;;OAGG;YACW,eAAe;IA4B7B,+FAA+F;IAC/F,OAAO,CAAC,YAAY;IAQpB,oFAAoF;IACpF,OAAO,CAAC,sBAAsB;IAiB9B,4DAA4D;IAC5D,OAAO,CAAC,UAAU;IAyBlB,+FAA+F;IAC/F,OAAO,CAAC,aAAa;IAerB,2CAA2C;IAC3C,OAAO,CAAC,WAAW;CAQpB"}

package/auth/flows/oauth.provider-callback.flow.d.ts

@@ -36,6 +36,7 @@ declare const stateSchema: import("@frontmcp/lazy-zod").ZodObject<{
     providerTokens: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnknown>;
     providerUserInfo: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnknown>;
     consentSessionId: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    consentCsrf: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
     consentSubmitted: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
     selectedTools: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
 }, import("zod/v4/core").$strip>;
@@ -105,13 +106,20 @@ export default class OauthProviderCallbackFlow extends FlowBase<typeof name> {
      *
      * Federated logins complete (mint the code) here, AFTER all providers are
      * linked. When consent mode is enabled, {@link completeFederatedAuth} first
-     * renders the consent screen, which GETs back to this endpoint with
-     * `consent_session=<sessionId>` + `tools=`. This stage loads that still alive
-     * session, applies the selection (validating + `requireSelection`), and
-     * completes the mint — short-circuiting the provider-code path entirely.
+     * renders the consent screen, which POSTs back to this endpoint with
+     * `consent_session=<sessionId>`, the screen's `csrf` token and `tools=`. This
+     * stage loads that still alive session, checks the token, applies the
+     * selection (validating + `requireSelection`), and completes the mint —
+     * short-circuiting the provider-code path entirely.
      */
     handleConsentSubmission(): Promise<void>;
     loadFederatedSession(): Promise<void>;
+    /**
+     * Whether this request comes from the browser that started the sign-in of
+     * `session` (it carries the session's binding cookie). Responds with a 400
+     * page, and returns false, when it doesn't.
+     */
+    private fromBrowserThatStarted;
     validateProviderCallback(): Promise<void>;
     exchangeProviderCode(): Promise<void>;
     storeProviderTokens(): Promise<void>;
@@ -121,8 +129,9 @@ export default class OauthProviderCallbackFlow extends FlowBase<typeof name> {
      *
      * When consent mode is enabled this runs in two passes:
      *  1. First reach (no `consent.consentSubmitted`): render the consent screen,
-     *     which GETs back to this endpoint with `consent_session` + `tools=`. The
-     *     federated session is kept ALIVE for the round-trip.
+     *     which POSTs back to this endpoint with `consent_session`, the CSRF token
+     *     kept on the session and `tools=`. The federated session is kept ALIVE
+     *     for the round-trip.
      *  2. Resubmit (`consent.consentSubmitted` true): validate the selection
      *     (honoring `requireSelection`) and mint the code with the consented set.
      *
@@ -130,20 +139,31 @@ export default class OauthProviderCallbackFlow extends FlowBase<typeof name> {
      */
     private completeFederatedAuth;
     /**
-     * Render the federated consent screen. The form GETs back to this provider
-     * callback endpoint with `consent_session=<sessionId>` + the chosen `tools=`
-     * (and `consent_submitted=1`), so {@link handleConsentSubmission} completes
-     * the mint. Honors the same `auth.consent` flags as the non-federated path.
+     * Give the federated session the consent screen's CSRF token and persist it
+     * before the screen is shown. Fails closed: when the session can't be
+     * written, no consent screen goes out (its submission could not be checked).
+     */
+    private keepConsentCsrf;
+    /**
+     * Render the federated consent screen. The form POSTs back to this provider
+     * callback endpoint with `consent_session=<sessionId>`, the session's `csrf`
+     * token and the chosen `tools=` (and `consent_submitted=1`), so
+     * {@link handleConsentSubmission} completes the mint. Honors the same
+     * `auth.consent` flags as the non-federated path.
      */
     private renderConsentScreen;
     /**
      * Generate a deterministic user sub from email
      */
     private generateUserSub;
+    /** End a federated sign-in that won't complete: drop its session and pending authorization. */
+    private abandon;
     /**
      * Render an error page
      */
     private renderErrorPage;
+    /** An HTML response with the built-in auth pages' security headers (#263). */
+    private htmlPage;
     private getStateValidation;
 }
 export {};

package/auth/flows/oauth.provider-callback.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.provider-callback.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.provider-callback.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAeH,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAGvC,OAAO,EAGL,QAAQ,EASR,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAKtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;gCAqBf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAAgD,CAAC;AAEnE,QAAA,MAAM,IAAI;;;CAG2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,yBAAyB,EAAE,cAAc,CACvC,yBAAyB,EACzB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,yBAAkC,CAAC;AAchD,MAAM,CAAC,OAAO,OAAO,yBAA0B,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAC1E,OAAO,CAAC,MAAM,CAAwD;IAEtE;;;OAGG;IACH,OAAO,CAAC,YAAY;IASd,aAAa;IAKb,UAAU;IAwChB;;;;;;;;;OASG;IAEG,uBAAuB;IAyCvB,oBAAoB;IA6EpB,wBAAwB;IAyExB,oBAAoB;IAwFpB,mBAAmB;IAoEnB,4BAA4B;IAkElC;;;;;;;;;;;OAWG;YACW,qBAAqB;IAsKnC;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAsC3B;;OAEG;IACH,OAAO,CAAC,eAAe;IAQvB;;OAEG;IACH,OAAO,CAAC,eAAe;IAqDvB,OAAO,CAAC,kBAAkB;CAO3B"}
+{"version":3,"file":"oauth.provider-callback.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.provider-callback.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAgBH,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAWvC,OAAO,EAGL,QAAQ,EASR,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAatB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;gCAuBf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAAgD,CAAC;AAEnE,QAAA,MAAM,IAAI;;;CAG2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,yBAAyB,EAAE,cAAc,CACvC,yBAAyB,EACzB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,yBAAkC,CAAC;AAehD,MAAM,CAAC,OAAO,OAAO,yBAA0B,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAC1E,OAAO,CAAC,MAAM,CAAwD;IAEtE;;;OAGG;IACH,OAAO,CAAC,YAAY;IASd,aAAa;IAKb,UAAU;IA2DhB;;;;;;;;;;OAUG;IAEG,uBAAuB;IAgDvB,oBAAoB;IAiF1B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAQxB,wBAAwB;IAqFxB,oBAAoB;IAwFpB,mBAAmB;IAoEnB,4BAA4B;IAkElC;;;;;;;;;;;;OAYG;YACW,qBAAqB;IAkNnC;;;;OAIG;YACW,eAAe;IAqB7B;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAsC3B;;OAEG;IACH,OAAO,CAAC,eAAe;IAKvB,+FAA+F;YACjF,OAAO;IAYrB;;OAEG;IACH,OAAO,CAAC,eAAe;IAqDvB,8EAA8E;IAC9E,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,kBAAkB;CAO3B"}

package/auth/flows/oauth.register.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.register.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.register.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAmBH,OAAO,EAGL,QAAQ,EAMR,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAGtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AACpC,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;gCAAiB,CAAC;AA6BpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;gCAIf,CAAC;AAEH,QAAA,MAAM,IAAI;;;;CAI2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,gBAAgB,EAAE,cAAc,CAC9B,iBAAiB,EACjB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,gBAAyB,CAAC;AAqDvC,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAClE,OAAO,CAAC,UAAU,CAAC,CAAmB;IAEtC,4EAA4E;IAC5E,OAAO,KAAK,SAAS,GAEpB;IAGK,aAAa;IAKb,UAAU;IAeV,aAAa;IAyIb,cAAc;IA6Cd,mBAAmB;IAiCnB,cAAc;CAGrB"}
+{"version":3,"file":"oauth.register.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.register.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAmBH,OAAO,EAGL,QAAQ,EAMR,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAGtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AACpC,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;gCAAiB,CAAC;AA6BpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;gCAIf,CAAC;AAEH,QAAA,MAAM,IAAI;;;;CAI2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,gBAAgB,EAAE,cAAc,CAC9B,iBAAiB,EACjB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,gBAAyB,CAAC;AAsBvC,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAClE,OAAO,CAAC,UAAU,CAAC,CAAmB;IAEtC,4EAA4E;IAC5E,OAAO,KAAK,SAAS,GAEpB;IAGK,aAAa;IAKb,UAAU;IAeV,aAAa;IAyIb,cAAc;IA6Cd,mBAAmB;IAiCnB,cAAc;CAGrB"}

package/auth/flows/oauth.token.flow.d.ts

@@ -112,6 +112,11 @@ export default class OauthTokenFlow extends FlowBase<typeof name> {
     handleAnonymousGrant(): Promise<void>;
     buildTokenResponse(): Promise<void>;
     validateOutput(): Promise<void>;
+    /**
+     * This server's protected-resource URI (RFC 8707), the audience of the tokens
+     * it issues when the grant named none (#269).
+     */
+    private canonicalResource;
 }
 export {};
 //# sourceMappingURL=oauth.token.flow.d.ts.map

package/auth/flows/oauth.token.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.token.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.token.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH;;;;;;;;GAQG;AACH;;;;;;;;;;;GAWG;AAgCH,OAAO,EAKL,QAAQ,EAOR,KAAK,cAAc,EAEpB,MAAM,cAAc,CAAC;AAGtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AA2HpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAkBf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;gCAAiB,CAAC;AAEpC,QAAA,MAAM,IAAI;;;;CAI2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,aAAa,EAAE,cAAc,CAC3B,cAAc,EACd,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,aAAsB,CAAC;AAcpC,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAC/D,OAAO,CAAC,MAAM,CAA6C;IAGrD,aAAa;IAKb,UAAU;IAoDV,aAAa;IAmBb,4BAA4B;IA0D5B,uBAAuB;IA8DvB,oBAAoB;IAsDpB,kBAAkB;IAqBlB,cAAc;CAGrB"}
+{"version":3,"file":"oauth.token.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.token.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH;;;;;;;;GAQG;AACH;;;;;;;;;;;GAWG;AAgCH,OAAO,EAKL,QAAQ,EAOR,KAAK,cAAc,EAEpB,MAAM,cAAc,CAAC;AAGtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AA2HpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAkBf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;gCAAiB,CAAC;AAEpC,QAAA,MAAM,IAAI;;;;CAI2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,aAAa,EAAE,cAAc,CAC3B,cAAc,EACd,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,aAAsB,CAAC;AAcpC,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAC/D,OAAO,CAAC,MAAM,CAA6C;IAGrD,aAAa;IAKb,UAAU;IAoDV,aAAa;IAmBb,4BAA4B;IA2D5B,uBAAuB;IAmEvB,oBAAoB;IAsDpB,kBAAkB;IAqBlB,cAAc;IAIpB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;CAG1B"}

package/auth/flows/session.verify.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.verify.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/session.verify.flow.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,QAAQ,EAaR,KAAK,cAAc,EAGpB,MAAM,cAAc,CAAC;AAEtB,OAAO,kBAAkB,CAAC;AAsB1B,QAAA,MAAM,WAAW;;gCAAyB,CAAC;AAE3C,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAaf,CAAC;AAuBH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAAmE,CAAC;AAE1G,QAAA,MAAM,IAAI;;;CAU2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,gBAAgB,EAAE,cAAc,CAC9B,iBAAiB,EACjB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,yBAAyB,EAChC,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,gBAAyB,CAAC;AAgFvC,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAClE,MAAM,wCAA+C;IAErD,OAAO,CAAC,OAAO;IAMf;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IA8FxB,UAAU;IAsDhB;;;;;;;;;;;OAWG;IAOG,iBAAiB;IA8CvB;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAgB5B;;;;;;;OAOG;IAEG,gBAAgB;IAuCtB;;;OAGG;IAUG,uBAAuB;IA4BvB,+BAA+B;IAQrC;;;;;;;OAOG;IAEG,WAAW;IAsKX,UAAU;IAIhB;;;;;OAKG;IAEG,kBAAkB;IAclB,qBAAqB;CAoB5B"}
+{"version":3,"file":"session.verify.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/session.verify.flow.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,QAAQ,EAcR,KAAK,cAAc,EAGpB,MAAM,cAAc,CAAC;AAEtB,OAAO,kBAAkB,CAAC;AAsB1B,QAAA,MAAM,WAAW;;gCAAyB,CAAC;AAE3C,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAaf,CAAC;AAuBH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAAmE,CAAC;AAE1G,QAAA,MAAM,IAAI;;;CAU2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,gBAAgB,EAAE,cAAc,CAC9B,iBAAiB,EACjB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,yBAAyB,EAChC,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,gBAAyB,CAAC;AAgFvC,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAClE,MAAM,wCAA+C;IAErD,OAAO,CAAC,OAAO;IAMf;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IA8FxB,UAAU;IAsDhB;;;;;;;;;;;OAWG;IAOG,iBAAiB;IA8CvB;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAgB5B;;;;;;;OAOG;IAEG,gBAAgB;IAuCtB;;;OAGG;IAUG,uBAAuB;IA4BvB,+BAA+B;IAQrC;;;;;;;OAOG;IAEG,WAAW;IA0KX,UAAU;IAIhB;;;;;OAKG;IAEG,kBAAkB;IAclB,qBAAqB;CAoB5B"}

package/auth/flows/signin-binding.utils.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The HTTP side of the sign-in binding (see `createSigninBinding` in
+ * `@frontmcp/auth`): the cookie `/oauth/authorize` sets, and the check the
+ * callbacks run before resuming a sign-in.
+ */
+import { type SigninBinding } from '@frontmcp/auth';
+import { type HttpCookie, type ServerRequest } from '../../common';
+/**
+ * Path of the binding cookie: `/oauth`, where the OAuth endpoints live, unless
+ * the server's issuer or scope carries a path prefix, which the provider
+ * callback URL (`<issuer>/oauth/provider/<id>/callback`) and the federated
+ * consent form include. Then `/`, so the cookie still reaches them.
+ */
+export declare function signinCookiePath(issuer: string, scopePath: string): string;
+/**
+ * Whether the browser reached this request over https. The binding cookie is then a `__Host-`
+ * cookie (`Secure`, `Path=/`, no `Domain`), which no other host can set in the browser.
+ */
+export declare function signinOverHttps(request: ServerRequest): boolean;
+/**
+ * The binding for a new sign-in started by `request`: named `__Host-…` when the browser came over
+ * https (see {@link signinOverHttps}).
+ */
+export declare function createRequestSigninBinding(request: ServerRequest, pendingAuthId: string): SigninBinding;
+/**
+ * The cookie that gives the browser its binding: HttpOnly and SameSite=Lax. Over https it is the
+ * `__Host-` cookie, so `Secure` with `Path=/` (the prefix requires both); otherwise it is scoped to `path`.
+ */
+export declare function signinBindingCookie(request: ServerRequest, binding: SigninBinding, path: string): HttpCookie;
+/** A `Set-Cookie` that removes the binding cookie of `pendingAuthId` once its sign-in is over. */
+export declare function clearedSigninBindingCookie(request: ServerRequest, pendingAuthId: string, path: string): HttpCookie;
+/**
+ * Whether `request` comes from the browser that started the sign-in `pendingAuthId` (its binding hash
+ * is `hash`). Over https only the `__Host-` cookie counts: a same-named cookie without the prefix may
+ * have been planted by a sibling host.
+ */
+export declare function requestHoldsSigninBinding(request: ServerRequest, pendingAuthId: string, hash: string | undefined): boolean;
+/** `output` with `cookie` added to the cookies it sets. */
+export declare function withCookie<T extends {
+    cookies?: HttpCookie[];
+}>(output: T, cookie: HttpCookie): T;
+/** The error text for a sign-in resumed without its binding cookie. */
+export declare const SIGNIN_BINDING_REFUSED = "This sign-in was started in another browser, or at another address. Start it again from the app.";
+//# sourceMappingURL=signin-binding.utils.d.ts.map

package/auth/flows/signin-binding.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signin-binding.utils.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/signin-binding.utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAA0C,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAE3G;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAQ1E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAK/D;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,GAAG,aAAa,CAEvG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAa5G;AAED,kGAAkG;AAClG,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAWlH;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,aAAa,EACtB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAIT;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,CAAC,SAAS;IAAE,OAAO,CAAC,EAAE,UAAU,EAAE,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,GAAG,CAAC,CAEjG;AAED,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,qGACiE,CAAC"}