@n24q02m/mcp-core 1.19.0 → 1.20.0-beta.1

package/README.md

@@ -33,6 +33,7 @@
 - [What you get](#what-you-get)
 - [Quick start (Python)](#quick-start-python)
 - [Quick start (TypeScript)](#quick-start-typescript)
+- [CLI](#cli)
 - [Documentation](#documentation)
 - [Development](#development)
 - [License](#license)
@@ -192,6 +193,95 @@ await http.connect()
 // Then mount http.handleRequest(req, res) on your http.Server / Express / Hono.
 ```
 
+## CLI
+
+`mcp_core.cli.build_cli` (re-exported as `from mcp_core import build_cli`) is the
+console-script builder every Python MCP server mounts as its entry point. It wraps
+a server's existing `serve(argv) -> int | None` function with subcommand dispatch,
+so every server exposes the **same** operator subcommands for free while `serve`'s
+own behaviour stays byte-for-byte unchanged. It has no TypeScript counterpart.
+
+A downstream server mounts it as its console script:
+
+```python
+# wet_mcp/cli.py
+from mcp_core import build_cli
+
+def main() -> int:
+    return build_cli("wet-mcp", serve=_serve, extra=_extras(), version=_version())(None)
+```
+
+```toml
+# pyproject.toml
+[project.scripts]
+wet-mcp = "wet_mcp.cli:main"
+```
+
+### Dispatch rules
+
+`build_cli(...)` returns `run(argv=None) -> int`, which inspects `argv[0]`:
+
+- **No args** — start the server (`serve([])`), the normal stdio launch.
+- **A flag** (`--http`, ...) — passed byte-for-byte to `serve`; existing flag
+  semantics are untouched.
+- **`-h` / `--help`** — print the subcommand list and exit without starting the
+  server (which would otherwise hang waiting on stdin in stdio mode).
+- **`--version` / `-V`** — print `<server> <version>`, but only when `version=` is
+  passed; otherwise it falls through to `serve` like any other flag.
+- **A positional name** — routed as a subcommand through argparse; an unknown name
+  exits `2`.
+
+STDOUT is the MCP protocol channel in stdio mode, so only the subcommand path prints
+to stdout: informational results (status, session details, `doctor`'s
+`[ok]`/`[warn]`/`[fail]` lines) go to stdout, while failures and prompts go to stderr
+with a non-zero exit code. Credential **values** are never printed — only names, keys,
+and status.
+
+### Built-in subcommands
+
+Every server gets three reserved subcommands without writing any code:
+
+| Subcommand | Purpose |
+|---|---|
+| `config status` | Report whether a config is stored: `configured`, `not configured`, or `corrupt` (undecryptable). |
+| `config delete [--yes]` | Delete the stored config. Prompts to confirm; `--yes` skips the prompt and is required in non-interactive mode. |
+| `relay status` | Show the active relay session (id prefix, relay URL, age) or report that none is active. |
+| `relay open` | Open the active relay URL in a browser. |
+| `relay reset` | Clear the relay session lock and the stored transport mode. |
+| `doctor` | Environment diagnostics — Python 3.13, credential-backend init, store-dir writability, config state, relay session, transport mode. Exits non-zero on any `[fail]`. |
+
+```bash
+wet-mcp doctor
+wet-mcp config status
+wet-mcp relay status
+```
+
+### Server-specific subcommands (`extra`)
+
+`build_cli(..., extra=...)` adds server-specific subcommands. Names in `extra` take
+precedence over the built-ins, so a server can replace `config` / `relay` / `doctor`
+with its own wiring. Each `extra` value is one of two shapes:
+
+```python
+ExtraHandler = Callable[[argparse.Namespace], int]
+ExtraSpec = ExtraHandler | tuple[Callable[[argparse.ArgumentParser], None], ExtraHandler]
+```
+
+- A **bare handler** — registered as an argument-less subcommand.
+- A **`(configure, handler)` tuple** — `configure` receives that subcommand's own
+  `argparse.ArgumentParser` to add positionals/flags before argv is parsed, then
+  `handler` receives the parsed `Namespace` and returns the exit code.
+
+wet-mcp, for example, registers one bare handler and two configured ones:
+
+```python
+extra = {
+    "warmup": _handle_warmup,                 # wet-mcp warmup
+    "auth": (_configure_auth, _handle_auth),  # wet-mcp auth google [--client-id ...]
+    "docs": (_configure_docs, _handle_docs),  # wet-mcp docs reindex <library>
+}
+```
+
 ## Documentation
 
 Full docs at **[mcp.n24q02m.com/servers/mcp-core/architecture/](https://mcp.n24q02m.com/servers/mcp-core/architecture/)** (Foundation library section in the MCP n24q02m unified docs site):
@@ -225,4 +315,4 @@ bun run build
 
 ## License
 
-MIT
+MIT

package/build/auth/credential-form.d.ts

@@ -16,6 +16,8 @@ export interface ConfigField {
     helpText?: string;
     helpUrl?: string;
     required?: boolean;
+    /** Regex string for client-side validation; rendered as the input's `pattern` attribute. */
+    validation?: string;
 }
 /**
  * Return true iff every required field in `schema` has a non-empty value in
@@ -32,12 +34,39 @@ export interface CapabilityInfo {
     priority?: string;
     description?: string;
 }
+/**
+ * A credential-form tab (schema-level `tabs` capability). Each tab is a
+ * mutually-exclusive credential mode; only the active tab's fields submit.
+ */
+export interface TabGroup {
+    id: string;
+    label: string;
+    fields: ConfigField[];
+}
+/**
+ * A repeatable field group (schema-level `cardGroup` capability). Renders
+ * Add/Remove cards, each cloning `fields`; submitted as a JSON array under
+ * `key` (e.g. `{ accounts: [{...}, {...}] }`).
+ */
+export interface CardGroup {
+    key: string;
+    fields: ConfigField[];
+    itemLabel?: string;
+    heading?: string;
+    addButtonLabel?: string;
+    minItems?: number;
+    titleField?: string;
+}
 export interface RelayConfigSchema {
     server: string;
     displayName?: string;
     description?: string;
-    fields: ConfigField[];
+    fields?: ConfigField[];
     capabilityInfo?: CapabilityInfo[];
+    /** Mutually-exclusive credential modes; see the tabbed render path. */
+    tabs?: TabGroup[];
+    /** One repeatable field group; see the card-group render path. */
+    cardGroup?: CardGroup;
 }
 export interface RenderOptions {
     submitUrl: string;
@@ -50,14 +79,29 @@ export interface RenderOptions {
      * keys are ignored.
      */
     prefill?: Record<string, string>;
+    /**
+     * For a `tabs` schema, the id of the tab to render active on load (defaults
+     * to the first tab). Ignored for non-tabbed schemas.
+     */
+    initialTab?: string;
+    /**
+     * Opt-in workspace-username field (multi-user stable-sub). Honoured by the
+     * `tabs` and `cardGroup` render paths.
+     */
+    includeUsernameField?: boolean;
 }
 /**
  * Wrap `bodyHtml` in the shared dark-theme HTML shell.
  *
- * The shell provides `<!DOCTYPE html>`, `<head>` (charset, viewport, escaped
- * `<title>`, embedded `FORM_SHELL_CSS`) and a `<body>` whose only child is
- * `bodyHtml`. `bodyHtml` is inserted verbatim, so callers MUST pre-escape any
- * untrusted values they interpolate.
+ * The shell provides `<!DOCTYPE html>`, `<head>` (charset, viewport, a
+ * Content-Security-Policy meta, escaped `<title>`, embedded `FORM_SHELL_CSS`)
+ * and a `<body>` whose only child is `bodyHtml`. `bodyHtml` is inserted
+ * verbatim, so callers MUST pre-escape any untrusted values they interpolate.
+ *
+ * The CSP (`default-src 'none'; style-src 'unsafe-inline'; script-src
+ * 'unsafe-inline'; connect-src 'self'`) permits the page's own inline
+ * `<style>`/`<script>` and same-origin `fetch` submits while blocking any
+ * external resource load.
  *
  * `title` is HTML-escaped before being placed in `<title>`.
  *

package/build/auth/credential-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-form.d.ts","sourceRoot":"","sources":["../../src/auth/credential-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,EACjD,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAqBT;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,cAAc,CAAC,EAAE,cAAc,EAAE,CAAA;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACjC;AAqWD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAevE;AAqED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAia9F;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,KAAK,GAAG,OAAO,CAAA;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAE7D"}
+{"version":3,"file":"credential-form.d.ts","sourceRoot":"","sources":["../../src/auth/credential-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,EACjD,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAqBT;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,WAAW,EAAE,CAAA;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,WAAW,EAAE,CAAA;IACtB,cAAc,CAAC,EAAE,cAAc,EAAE,CAAA;IACjC,uEAAuE;IACvE,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAA;IACjB,kEAAkE;IAClE,SAAS,CAAC,EAAE,SAAS,CAAA;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAwaD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAgBvE;AAw7BD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CA0a9F;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,KAAK,GAAG,OAAO,CAAA;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAE7D"}

package/build/auth/credential-form.js

@@ -388,14 +388,86 @@ const FORM_SHELL_CSS = `        *, *::before, *::after {
             font-size: 0.8125rem;
             color: #9ca3af;
         }
+
+        :root {
+            color-scheme: light dark;
+        }
+
+        @media (prefers-color-scheme: light) {
+            body {
+                background-color: #f4f5f7;
+                color: #1f2937;
+            }
+            .card {
+                background-color: #ffffff;
+                border-color: #e5e7eb;
+            }
+            .server-name {
+                color: #111827;
+            }
+            .server-id,
+            .server-description,
+            .help-text,
+            .mc-badge,
+            .form-title,
+            .capabilities-title,
+            .capability-desc {
+                color: #6b7280;
+            }
+            .field-label,
+            .capability-label {
+                color: #374151;
+            }
+            .field-input {
+                background-color: #ffffff;
+                border-color: #d1d5db;
+                color: #1f2937;
+            }
+            .field-input::placeholder {
+                color: #9ca3af;
+            }
+            .field-input:disabled {
+                background-color: #f3f4f6;
+            }
+            .optional-badge {
+                color: #6b7280;
+                background-color: #f3f4f6;
+                border-color: #d1d5db;
+            }
+            .capability-item {
+                background-color: #f9fafb;
+                border-color: #e5e7eb;
+            }
+            .model-chain {
+                background: #f9fafb;
+                border-color: #d1d5db;
+            }
+            .mc-chip {
+                background: #eef1f6;
+                border-color: #d1d5db;
+            }
+            .mc-dropdown {
+                background: #ffffff;
+                border-color: #d1d5db;
+            }
+            .mc-dropdown label:hover,
+            .mc-dropdown label:focus-within {
+                background: #eef1f6;
+            }
+        }
 `;
 /**
  * Wrap `bodyHtml` in the shared dark-theme HTML shell.
  *
- * The shell provides `<!DOCTYPE html>`, `<head>` (charset, viewport, escaped
- * `<title>`, embedded `FORM_SHELL_CSS`) and a `<body>` whose only child is
- * `bodyHtml`. `bodyHtml` is inserted verbatim, so callers MUST pre-escape any
- * untrusted values they interpolate.
+ * The shell provides `<!DOCTYPE html>`, `<head>` (charset, viewport, a
+ * Content-Security-Policy meta, escaped `<title>`, embedded `FORM_SHELL_CSS`)
+ * and a `<body>` whose only child is `bodyHtml`. `bodyHtml` is inserted
+ * verbatim, so callers MUST pre-escape any untrusted values they interpolate.
+ *
+ * The CSP (`default-src 'none'; style-src 'unsafe-inline'; script-src
+ * 'unsafe-inline'; connect-src 'self'`) permits the page's own inline
+ * `<style>`/`<script>` and same-origin `fetch` submits while blocking any
+ * external resource load.
  *
  * `title` is HTML-escaped before being placed in `<title>`.
  *
@@ -412,6 +484,7 @@ export function renderFormShell(title, bodyHtml) {
 <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'self'" />
     <title>${safeTitle}</title>
     <style>
 ${FORM_SHELL_CSS}    </style>
@@ -434,6 +507,7 @@ function renderField(field, value = '') {
         ? '<span class="required-badge" aria-hidden="true">Required</span>'
         : '<span class="optional-badge" aria-hidden="true">Optional</span>';
     const valueAttr = value ? ` value="${escapeHtml(value)}"` : '';
+    const patternAttr = field.validation ? ` pattern="${escapeHtml(field.validation)}"` : '';
     let helpHtml = '';
     let ariaDescribedby = '';
     if (helpText) {
@@ -460,7 +534,7 @@ function renderField(field, value = '') {
                 autocomplete="off"
                 autocorrect="off"
                 autocapitalize="off"
-                spellcheck="false"${valueAttr}${requiredAttr}${ariaDescribedby}
+                spellcheck="false"${valueAttr}${patternAttr}${requiredAttr}${ariaDescribedby}
             />
             ${helpHtml}
         </div>`;
@@ -480,6 +554,858 @@ function renderCapability(cap) {
                 ${descHtml}
             </li>`;
 }
+// ===========================================================================
+// Schema-level tabs + dynamic card group (W4.1)
+// ---------------------------------------------------------------------------
+// Two OPT-IN capabilities that let servers declare richer credential UIs
+// through the schema alone (no forked renderer):
+//   * `tabs`      -> mutually-exclusive credential modes (e.g. telegram
+//                    bot-token vs phone/OTP), only the active tab submits.
+//   * `cardGroup` -> a repeatable field group with Add/Remove (e.g. email
+//                    multi-account), submitted as a JSON array.
+// A schema that declares NEITHER key renders through the unchanged flat-field
+// path in `renderCredentialForm` below, byte-for-byte identical to before.
+// The feature CSS ships as a `<style>` block inside the body — only when the
+// feature is used — so the shared `FORM_SHELL_CSS` (and the flat form) stay
+// untouched. Kept in parity with core-py `credential_form.py`.
+// ===========================================================================
+// Tab CSS (scoped `.tabs`/`.tab`/`.tab-panel`); emitted in-body only for
+// tabbed forms. Palette mirrors the shared shell so tabs blend into the card.
+const TABS_CSS = `    <style>
+        .tabs {
+            display: flex;
+            gap: 0;
+            margin-bottom: 1.5rem;
+            border-bottom: 1px solid #2a2a2a;
+        }
+        .tab {
+            flex: 1;
+            padding: 0.75rem 1rem;
+            background: transparent;
+            border: none;
+            color: #9ca3af;
+            cursor: pointer;
+            font-size: 0.9rem;
+            font-weight: 500;
+            border-bottom: 2px solid transparent;
+            transition: color 0.15s ease, border-color 0.15s ease;
+            font-family: inherit;
+        }
+        .tab:not(:disabled):hover {
+            color: #ccc;
+        }
+        .tab:focus-visible {
+            outline: 2px solid #4a6fa5;
+            outline-offset: -2px;
+            border-radius: 4px;
+        }
+        .tab.active {
+            color: #fff;
+            border-bottom-color: #4a6fa5;
+        }
+        .tab:disabled {
+            cursor: not-allowed;
+            opacity: 0.5;
+        }
+        .tab-panel {
+            display: none;
+        }
+        .tab-panel.active {
+            display: block;
+        }
+        @media (prefers-color-scheme: light) {
+            .tabs {
+                border-bottom-color: #e5e7eb;
+            }
+            .tab {
+                color: #6b7280;
+            }
+            .tab:not(:disabled):hover {
+                color: #374151;
+            }
+            .tab.active {
+                color: #111827;
+            }
+        }
+    </style>
+`;
+// Card-group CSS (scoped `.card-group-*`); emitted in-body only for card
+// forms. `.card-group-item` avoids the shell's `.card` name deliberately.
+const CARD_GROUP_CSS = `    <style>
+        .card-group-item {
+            border: 1px solid #2a2a2a;
+            border-radius: 10px;
+            padding: 1rem;
+            margin-bottom: 0.875rem;
+            background-color: #121212;
+        }
+        .card-group-header {
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+            margin-bottom: 0.75rem;
+        }
+        .card-group-title {
+            font-size: 0.95rem;
+            font-weight: 600;
+            color: #ddd;
+            max-width: 300px;
+            white-space: nowrap;
+            overflow: hidden;
+            text-overflow: ellipsis;
+        }
+        .card-group-remove {
+            background: transparent;
+            color: #f87171;
+            border: 1px solid rgba(248, 113, 113, 0.3);
+            border-radius: 6px;
+            padding: 0.25rem 0.6rem;
+            cursor: pointer;
+            font-size: 0.75rem;
+            font-family: inherit;
+        }
+        .card-group-remove:hover:not(:disabled) {
+            background-color: rgba(248, 113, 113, 0.08);
+        }
+        .card-group-remove:focus-visible {
+            outline: 2px solid #f87171;
+            outline-offset: 2px;
+        }
+        .card-group-add {
+            width: 100%;
+            background-color: transparent;
+            color: #6c9bd2;
+            border: 1px dashed #3a5a8a;
+            border-radius: 8px;
+            padding: 0.625rem 1rem;
+            cursor: pointer;
+            font-size: 0.875rem;
+            margin-bottom: 1rem;
+            font-family: inherit;
+            transition: background-color 0.15s ease, border-color 0.15s ease;
+        }
+        .card-group-add:hover:not(:disabled) {
+            background-color: rgba(108, 155, 210, 0.08);
+            border-color: #4a6fa5;
+        }
+        .card-group-add:focus-visible {
+            outline: 2px solid #6c9bd2;
+            outline-offset: 2px;
+        }
+        .card-group-add:disabled {
+            opacity: 0.5;
+            cursor: not-allowed;
+            border-color: #2a3a4a;
+        }
+        @media (prefers-color-scheme: light) {
+            .card-group-item {
+                background-color: #f9fafb;
+                border-color: #e5e7eb;
+            }
+            .card-group-title {
+                color: #374151;
+            }
+        }
+    </style>
+`;
+// Multi-step (OTP / 2FA) step-input UI, shared by tab forms. Mirrors the flat
+// form's `showStepInput`/`submitStep` semantics (same `/otp` POST, same
+// redirect-follow on completion) so a tabbed server's phone->OTP->2FA chain
+// behaves identically to the default form.
+const STEP_UI_JS = `
+            function showStepInput(ns) {
+                if (form && form.style.display !== "none") { form.style.display = "none"; }
+                var tabsEl = document.querySelector(".tabs");
+                if (tabsEl) { tabsEl.style.display = "none"; }
+                var container = document.getElementById("step-container");
+                var promptEl, inputEl, buttonEl, errorEl;
+                if (container) {
+                    promptEl = document.getElementById("step-prompt");
+                    inputEl = document.getElementById("step-input");
+                    buttonEl = document.getElementById("step-submit");
+                    errorEl = document.getElementById("step-error");
+                    errorEl.style.display = "none"; errorEl.textContent = "";
+                    inputEl.value = ""; inputEl.disabled = false;
+                    buttonEl.disabled = false; buttonEl.removeAttribute("aria-busy"); buttonEl.textContent = "Verify";
+                } else {
+                    var card = form.parentNode;
+                    container = document.createElement("div"); container.id = "step-container";
+                    promptEl = document.createElement("label"); promptEl.id = "step-prompt";
+                    promptEl.setAttribute("for", "step-input"); promptEl.className = "form-title";
+                    container.appendChild(promptEl);
+                    var fieldGroup = document.createElement("div"); fieldGroup.className = "field-group";
+                    inputEl = document.createElement("input"); inputEl.id = "step-input"; inputEl.className = "field-input";
+                    inputEl.setAttribute("autocomplete", "off"); inputEl.setAttribute("autocorrect", "off");
+                    inputEl.setAttribute("autocapitalize", "off"); inputEl.setAttribute("spellcheck", "false");
+                    fieldGroup.appendChild(inputEl); container.appendChild(fieldGroup);
+                    buttonEl = document.createElement("button"); buttonEl.type = "button"; buttonEl.id = "step-submit";
+                    buttonEl.className = "submit-btn"; buttonEl.textContent = "Verify"; container.appendChild(buttonEl);
+                    errorEl = document.createElement("div"); errorEl.id = "step-error"; errorEl.className = "status-box error";
+                    errorEl.setAttribute("role", "alert"); errorEl.style.display = "none"; container.appendChild(errorEl);
+                    card.appendChild(container);
+                    buttonEl.addEventListener("click", function () { submitStep(); });
+                    inputEl.addEventListener("keydown", function (evt) { if (evt.key === "Enter") { evt.preventDefault(); submitStep(); } });
+                    inputEl.addEventListener("input", function () { inputEl.removeAttribute("aria-invalid"); inputEl.removeAttribute("aria-errormessage"); errorEl.style.display = "none"; });
+                }
+                promptEl.textContent = ns.text || "";
+                inputEl.setAttribute("type", ns.input_type || "text");
+                inputEl.setAttribute("placeholder", ns.placeholder || "");
+                inputEl.dataset.field = ns.field || "value";
+                inputEl.focus();
+            }
+            function submitStep() {
+                var inputEl = document.getElementById("step-input");
+                var buttonEl = document.getElementById("step-submit");
+                var errorEl = document.getElementById("step-error");
+                var fieldName = inputEl.dataset.field || "value";
+                var value = inputEl.value;
+                inputEl.removeAttribute("aria-invalid");
+                if (value.trim() === "") {
+                    errorEl.textContent = "Please enter a value."; errorEl.style.display = "block";
+                    inputEl.setAttribute("aria-invalid", "true"); inputEl.setAttribute("aria-errormessage", "step-error");
+                    inputEl.focus(); return;
+                }
+                errorEl.style.display = "none"; errorEl.textContent = "";
+                buttonEl.disabled = true; buttonEl.textContent = "Verifying..."; buttonEl.setAttribute("aria-busy", "true");
+                inputEl.disabled = true;
+                var body = {}; body[fieldName] = value;
+                fetch(otpUrl(), { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) })
+                    .then(function (response) { return response.json().then(function (data) {
+                        if (data.ok) {
+                            if (data.next_step && (data.next_step.type === "otp_required" || data.next_step.type === "password_required")) {
+                                showStepInput(data.next_step);
+                            } else if (typeof data.redirect_url === "string" && data.redirect_url.length > 0) {
+                                var c = document.getElementById("step-container"); while (c.firstChild) { c.removeChild(c.firstChild); }
+                                var done = document.createElement("div"); done.className = "status-box success"; done.style.display = "block";
+                                done.setAttribute("role", "alert"); done.textContent = "Setup complete! Redirecting..."; c.appendChild(done);
+                                window.location.replace(data.redirect_url);
+                            } else {
+                                var c2 = document.getElementById("step-container"); while (c2.firstChild) { c2.removeChild(c2.firstChild); }
+                                var done2 = document.createElement("div"); done2.className = "status-box success"; done2.style.display = "block";
+                                done2.setAttribute("role", "alert"); done2.textContent = "Setup complete! You can close this tab."; c2.appendChild(done2);
+                            }
+                        } else {
+                            errorEl.textContent = data.error || data.error_description || "Verification failed."; errorEl.style.display = "block";
+                            inputEl.disabled = false; inputEl.setAttribute("aria-invalid", "true"); inputEl.setAttribute("aria-errormessage", "step-error");
+                            buttonEl.disabled = false; buttonEl.textContent = "Verify"; buttonEl.removeAttribute("aria-busy"); inputEl.focus();
+                        }
+                    }); })
+                    .catch(function (err) {
+                        errorEl.textContent = "Network error: " + err.message; errorEl.style.display = "block";
+                        inputEl.disabled = false; inputEl.setAttribute("aria-invalid", "true"); inputEl.setAttribute("aria-errormessage", "step-error");
+                        buttonEl.disabled = false; buttonEl.textContent = "Verify"; buttonEl.removeAttribute("aria-busy"); inputEl.focus();
+                    });
+            }
+`;
+// Tab form behaviour: tab switching (click + ARIA-tablist arrow keys), then a
+// submit that collects ONLY the active panel's fields. `__SUBMIT_URL__` and
+// `__INITIAL_TAB__` are substituted at render time; `STEP_UI_JS` is spliced in
+// for OTP/2FA support.
+const TABS_SCRIPT = `    <script>
+        (function () {
+            var form = document.getElementById("credential-form");
+            var submitBtn = document.getElementById("submit-btn");
+            var statusBox = document.getElementById("status-box");
+            var submitUrl = "__SUBMIT_URL__";
+            var activeTab = "__INITIAL_TAB__";
+            var tabs = document.querySelectorAll(".tab");
+            var tabsArray = Array.prototype.slice.call(tabs);
+            var pendingRedirectUrl = null;
+
+            function showStatus(type, message) {
+                statusBox.className = "status-box " + type;
+                statusBox.textContent = message;
+                statusBox.style.display = "block";
+            }
+            function otpUrl() {
+                return submitUrl.replace(/\\/authorize.*/, "/otp");
+            }
+${STEP_UI_JS}
+            tabs.forEach(function (tab, index) {
+                tab.addEventListener("click", function () {
+                    if (tab.disabled) { return; }
+                    activeTab = tab.dataset.tab;
+                    tabs.forEach(function (t) {
+                        t.classList.remove("active");
+                        t.setAttribute("aria-selected", "false");
+                        t.setAttribute("tabindex", "-1");
+                    });
+                    tab.classList.add("active");
+                    tab.setAttribute("aria-selected", "true");
+                    tab.setAttribute("tabindex", "0");
+                    document.querySelectorAll(".tab-panel").forEach(function (p) { p.classList.remove("active"); });
+                    var panel = document.querySelector('.tab-panel[data-panel="' + activeTab + '"]');
+                    if (panel) { panel.classList.add("active"); }
+                    statusBox.style.display = "none";
+                    statusBox.textContent = "";
+                    form.querySelectorAll(".field-input").forEach(function (i) { i.removeAttribute("aria-invalid"); });
+                });
+                tab.addEventListener("keydown", function (e) {
+                    var targetIndex = -1;
+                    if (e.key === "ArrowRight") { targetIndex = index + 1; if (targetIndex >= tabsArray.length) { targetIndex = 0; } }
+                    else if (e.key === "ArrowLeft") { targetIndex = index - 1; if (targetIndex < 0) { targetIndex = tabsArray.length - 1; } }
+                    if (targetIndex !== -1) { e.preventDefault(); tabsArray[targetIndex].focus(); tabsArray[targetIndex].click(); }
+                });
+            });
+
+            form.addEventListener("input", function (event) {
+                if (event.target.classList.contains("field-input")) {
+                    event.target.removeAttribute("aria-invalid");
+                    event.target.removeAttribute("aria-errormessage");
+                    statusBox.style.display = "none";
+                }
+            });
+
+            form.addEventListener("submit", function (event) {
+                event.preventDefault();
+                var activePanel = document.querySelector(".tab-panel.active");
+                var inputs = activePanel ? activePanel.querySelectorAll(".field-input") : [];
+                var payload = {};
+                var valid = true;
+                var firstInvalid = null;
+                inputs.forEach(function (input) {
+                    if (input.hasAttribute("required") && input.value.trim() === "") {
+                        valid = false;
+                        input.setAttribute("aria-invalid", "true");
+                        input.setAttribute("aria-errormessage", "status-box");
+                        if (!firstInvalid) { firstInvalid = input; }
+                    } else {
+                        input.removeAttribute("aria-invalid");
+                        input.removeAttribute("aria-errormessage");
+                        payload[input.name] = input.value;
+                    }
+                });
+                if (!valid) {
+                    showStatus("error", "Please fill in all required fields.");
+                    if (firstInvalid) { firstInvalid.focus(); }
+                    return;
+                }
+                submitBtn.disabled = true;
+                submitBtn.textContent = "Connecting...";
+                submitBtn.setAttribute("aria-busy", "true");
+                statusBox.style.display = "none";
+                tabs.forEach(function (t) { t.disabled = true; });
+                function reenable() {
+                    submitBtn.disabled = false;
+                    submitBtn.textContent = "Connect";
+                    submitBtn.removeAttribute("aria-busy");
+                    form.querySelectorAll(".field-input").forEach(function (i) { i.disabled = false; });
+                    tabs.forEach(function (t) { t.disabled = false; });
+                }
+                function lockConnected() {
+                    form.querySelectorAll(".field-input").forEach(function (i) { i.disabled = true; });
+                    submitBtn.disabled = true;
+                    submitBtn.removeAttribute("aria-busy");
+                    submitBtn.textContent = "Connected";
+                }
+                fetch(submitUrl, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(payload) })
+                    .then(function (response) { return response.json().then(function (data) {
+                        if (data.ok) {
+                            if (typeof data.redirect_url === "string" && data.redirect_url.length > 0) { pendingRedirectUrl = data.redirect_url; }
+                            if (data.next_step && (data.next_step.type === "otp_required" || data.next_step.type === "password_required")) {
+                                statusBox.style.display = "none";
+                                showStepInput(data.next_step);
+                            } else if (data.next_step && data.next_step.type === "info") {
+                                lockConnected();
+                                showStatus("success", data.next_step.message || "Setup saved. Additional steps may be required.");
+                            } else if (pendingRedirectUrl) {
+                                lockConnected();
+                                showStatus("success", "Credentials saved. Redirecting...");
+                                window.location.replace(pendingRedirectUrl);
+                            } else {
+                                lockConnected();
+                                showStatus("success", data.message || "Connected successfully. You can close this window.");
+                            }
+                        } else {
+                            showStatus("error", data.error || data.error_description || "Request failed.");
+                            reenable();
+                        }
+                    }); })
+                    .catch(function (err) {
+                        showStatus("error", "Network error: " + err.message);
+                        reenable();
+                    });
+            });
+        })();
+    </script>`;
+// Card-group behaviour: a JS builder that clones the declared fields per card,
+// Add/Remove with focus management, and a submit that serialises every card into
+// a JSON array under `__GROUP_KEY__`. All DOM is built with
+// createElement/textContent/setAttribute (no innerHTML with user values).
+const CARD_GROUP_SCRIPT = `    <script>
+        (function () {
+            var submitUrl = "__SUBMIT_URL__";
+            var CARD_FIELDS = __CARD_FIELDS__;
+            var GROUP_KEY = "__GROUP_KEY__";
+            var TITLE_FIELD = "__TITLE_FIELD__";
+            var ITEM_LABEL = "__ITEM_LABEL__";
+            var MIN_ITEMS = __MIN_ITEMS__;
+
+            var container = document.getElementById("card-group-container");
+            var addBtn = document.getElementById("card-group-add");
+            var form = document.getElementById("credential-form");
+            var submitBtn = document.getElementById("submit-btn");
+            var statusBox = document.getElementById("status-box");
+            var formFieldset = document.getElementById("form-fieldset");
+            var uid = 0;
+            var pendingRedirectUrl = null;
+
+            function showStatus(type, message) {
+                statusBox.className = "status-box " + type;
+                statusBox.textContent = message;
+                statusBox.style.display = "block";
+            }
+            function safeRedirect(url) {
+                try {
+                    var parsed = new URL(url, window.location.origin);
+                    if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+                        window.location.replace(parsed.href);
+                        return true;
+                    }
+                } catch (e) { /* fail safe */ }
+                return false;
+            }
+
+            function buildField(spec, cardUid) {
+                var group = document.createElement("div");
+                group.className = "field-group";
+                var fid = "field-" + GROUP_KEY + "-" + spec.key + "-" + cardUid;
+
+                var label = document.createElement("label");
+                label.className = "field-label";
+                label.setAttribute("for", fid);
+                label.textContent = spec.label || "";
+                var badge = document.createElement("span");
+                badge.setAttribute("aria-hidden", "true");
+                if (spec.required) { badge.className = "required-badge"; badge.textContent = "Required"; }
+                else { badge.className = "optional-badge"; badge.textContent = "Optional"; }
+                label.appendChild(document.createTextNode(" "));
+                label.appendChild(badge);
+                group.appendChild(label);
+
+                var input = document.createElement("input");
+                input.id = fid;
+                input.className = "field-input";
+                input.setAttribute("type", spec.type || "text");
+                input.setAttribute("name", GROUP_KEY + "[" + cardUid + "]." + spec.key);
+                input.dataset.field = spec.key;
+                input.setAttribute("autocomplete", "off");
+                input.setAttribute("autocorrect", "off");
+                input.setAttribute("autocapitalize", "off");
+                input.setAttribute("spellcheck", "false");
+                if (spec.placeholder) { input.setAttribute("placeholder", spec.placeholder); }
+                if (spec.required) { input.setAttribute("required", "required"); }
+                group.appendChild(input);
+
+                if (spec.helpText) {
+                    var help = document.createElement("p");
+                    help.className = "help-text";
+                    help.id = "help-" + GROUP_KEY + "-" + spec.key + "-" + cardUid;
+                    if (spec.helpUrl) {
+                        var a = document.createElement("a");
+                        a.setAttribute("href", spec.helpUrl);
+                        a.setAttribute("target", "_blank");
+                        a.setAttribute("rel", "noopener noreferrer");
+                        a.textContent = spec.helpText;
+                        help.appendChild(a);
+                    } else {
+                        help.textContent = spec.helpText;
+                    }
+                    input.setAttribute("aria-describedby", help.id);
+                    group.appendChild(help);
+                }
+
+                input.addEventListener("input", function () {
+                    if (input.hasAttribute("aria-invalid")) { input.removeAttribute("aria-invalid"); }
+                });
+                return input;
+            }
+
+            function updateTitles() {
+                var cards = container.querySelectorAll(".card-group-item");
+                for (var i = 0; i < cards.length; i++) {
+                    var titleEl = cards[i].querySelector(".card-group-title");
+                    var titleInput = TITLE_FIELD ? cards[i].querySelector('input[data-field="' + TITLE_FIELD + '"]') : null;
+                    var titleVal = titleInput && titleInput.value ? titleInput.value.trim() : "";
+                    var titleStr = titleVal ? titleVal : (ITEM_LABEL + " " + (i + 1));
+                    if (titleEl) { titleEl.textContent = titleStr; titleEl.title = titleStr; }
+                    var removeBtn = cards[i].querySelector(".card-group-remove");
+                    if (removeBtn) {
+                        removeBtn.style.display = cards.length > MIN_ITEMS ? "" : "none";
+                        removeBtn.setAttribute("aria-label", "Remove " + titleStr);
+                    }
+                }
+            }
+
+            function createCard() {
+                var cardUid = uid++;
+                var card = document.createElement("div");
+                card.className = "card-group-item";
+                card.dataset.uid = String(cardUid);
+                card.setAttribute("role", "group");
+                var titleId = "card-group-title-" + cardUid;
+                card.setAttribute("aria-labelledby", titleId);
+
+                var header = document.createElement("div");
+                header.className = "card-group-header";
+                var title = document.createElement("h3");
+                title.id = titleId;
+                title.className = "card-group-title";
+                title.textContent = ITEM_LABEL;
+                header.appendChild(title);
+
+                var removeBtn = document.createElement("button");
+                removeBtn.type = "button";
+                removeBtn.className = "card-group-remove";
+                removeBtn.textContent = "Remove";
+                removeBtn.addEventListener("click", function () {
+                    var inputs = card.querySelectorAll("input");
+                    var hasData = false;
+                    for (var i = 0; i < inputs.length; i++) { if (inputs[i].value.trim() !== "") { hasData = true; break; } }
+                    if (hasData && !window.confirm("This " + ITEM_LABEL.toLowerCase() + " has unsaved data. Remove it?")) { return; }
+                    var prev = card.previousElementSibling;
+                    var next = card.nextElementSibling;
+                    var focusTarget = (prev && prev.classList && prev.classList.contains("card-group-item")) ? prev :
+                                      (next && next.classList && next.classList.contains("card-group-item")) ? next : null;
+                    card.remove();
+                    updateTitles();
+                    if (focusTarget) {
+                        var fi = focusTarget.querySelector("input");
+                        if (fi) { fi.focus(); return; }
+                    }
+                    if (addBtn) { addBtn.focus(); }
+                });
+                header.appendChild(removeBtn);
+                card.appendChild(header);
+
+                for (var f = 0; f < CARD_FIELDS.length; f++) {
+                    var input = buildField(CARD_FIELDS[f], cardUid);
+                    card.appendChild(input.parentNode);
+                    if (CARD_FIELDS[f].key === TITLE_FIELD) {
+                        input.addEventListener("input", updateTitles);
+                    }
+                }
+                return card;
+            }
+
+            function collectCards() {
+                var cards = container.querySelectorAll(".card-group-item");
+                var arr = [];
+                for (var i = 0; i < cards.length; i++) {
+                    var inputs = cards[i].querySelectorAll(".field-input");
+                    var obj = {};
+                    var hasAny = false;
+                    for (var j = 0; j < inputs.length; j++) {
+                        obj[inputs[j].dataset.field] = inputs[j].value;
+                        if (inputs[j].value.trim() !== "") { hasAny = true; }
+                    }
+                    if (hasAny) { arr.push(obj); }
+                }
+                return arr;
+            }
+
+            function renderOAuthDeviceCode(nextStep) {
+                statusBox.className = "status-box info";
+                statusBox.style.display = "block";
+                while (statusBox.firstChild) { statusBox.removeChild(statusBox.firstChild); }
+                var strong = document.createElement("strong");
+                strong.textContent = "Finish sign-in";
+                statusBox.appendChild(strong);
+                statusBox.appendChild(document.createElement("br"));
+                statusBox.appendChild(document.createElement("br"));
+                statusBox.appendChild(document.createTextNode("Visit:"));
+                statusBox.appendChild(document.createElement("br"));
+                var link = document.createElement("a");
+                link.setAttribute("href", nextStep.verification_url);
+                link.setAttribute("target", "_blank");
+                link.setAttribute("rel", "noopener noreferrer");
+                link.textContent = nextStep.verification_url;
+                statusBox.appendChild(link);
+                statusBox.appendChild(document.createElement("br"));
+                statusBox.appendChild(document.createElement("br"));
+                statusBox.appendChild(document.createTextNode("Enter code: "));
+                var codeEl = document.createElement("strong");
+                codeEl.style.fontSize = "1.2em";
+                codeEl.style.letterSpacing = "0.1em";
+                codeEl.textContent = nextStep.user_code;
+                statusBox.appendChild(codeEl);
+                statusBox.appendChild(document.createElement("br"));
+                statusBox.appendChild(document.createElement("br"));
+                var waiting = document.createElement("span");
+                waiting.id = "device-waiting";
+                waiting.setAttribute("role", "alert");
+                waiting.style.color = "#9ca3af";
+                waiting.textContent = "Waiting for authorization...";
+                statusBox.appendChild(waiting);
+                var statusUrl = submitUrl.replace(/\\/authorize.*/, "/setup-status");
+                var pollId = setInterval(function () {
+                    fetch(statusUrl)
+                        .then(function (r) { return r.json(); })
+                        .then(function (s) {
+                            if (s && s.outlook === "complete") {
+                                clearInterval(pollId);
+                                statusBox.className = "status-box success";
+                                while (statusBox.firstChild) { statusBox.removeChild(statusBox.firstChild); }
+                                var done = document.createElement("strong");
+                                done.textContent = "Setup complete!";
+                                statusBox.appendChild(done);
+                                submitBtn.textContent = "Connected";
+                                if (typeof pendingRedirectUrl === "string" && pendingRedirectUrl.length > 0) {
+                                    statusBox.appendChild(document.createElement("br"));
+                                    statusBox.appendChild(document.createTextNode("Redirecting..."));
+                                    safeRedirect(pendingRedirectUrl);
+                                } else {
+                                    statusBox.appendChild(document.createElement("br"));
+                                    statusBox.appendChild(document.createTextNode("You can close this tab."));
+                                }
+                            } else if (s && typeof s.outlook === "string" && s.outlook.indexOf("error:") === 0) {
+                                clearInterval(pollId);
+                                var w = document.getElementById("device-waiting");
+                                if (w) { w.style.color = "#ff453a"; w.textContent = "Authorization failed: " + s.outlook.slice(6) + ". Please retry setup."; }
+                            }
+                        })
+                        .catch(function () {});
+                }, 3000);
+            }
+
+            container.appendChild(createCard());
+            for (var s = 1; s < MIN_ITEMS; s++) { container.appendChild(createCard()); }
+            updateTitles();
+
+            addBtn.addEventListener("click", function () {
+                var newCard = createCard();
+                container.appendChild(newCard);
+                updateTitles();
+                var fi = newCard.querySelector("input");
+                if (fi) { fi.focus(); }
+            });
+
+            form.addEventListener("submit", function (evt) {
+                evt.preventDefault();
+                statusBox.style.display = "none";
+                if (!form.checkValidity()) {
+                    var firstInvalid = form.querySelector(":invalid");
+                    if (firstInvalid) {
+                        firstInvalid.setAttribute("aria-invalid", "true");
+                        firstInvalid.focus();
+                    }
+                    return;
+                }
+                var items = collectCards();
+                if (items.length === 0) {
+                    showStatus("error", "Please add at least one " + ITEM_LABEL.toLowerCase() + ".");
+                    return;
+                }
+                var payload = {};
+                payload[GROUP_KEY] = items;
+
+                formFieldset.disabled = true;
+                submitBtn.setAttribute("aria-busy", "true");
+                submitBtn.textContent = "Connecting...";
+
+                fetch(submitUrl, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(payload) })
+                    .then(function (resp) { return resp.json().then(function (data) {
+                        if (!data.ok) {
+                            showStatus("error", data.error || data.error_description || "Request failed.");
+                            formFieldset.disabled = false;
+                            submitBtn.removeAttribute("aria-busy");
+                            submitBtn.textContent = "Connect";
+                            submitBtn.focus();
+                            return;
+                        }
+                        if (typeof data.redirect_url === "string" && data.redirect_url.length > 0) { pendingRedirectUrl = data.redirect_url; }
+                        if (data.next_step && data.next_step.type === "oauth_device_code") {
+                            submitBtn.textContent = "Awaiting authorization...";
+                            submitBtn.removeAttribute("aria-busy");
+                            renderOAuthDeviceCode(data.next_step);
+                            return;
+                        }
+                        if (pendingRedirectUrl) {
+                            showStatus("success", "Credentials saved. Redirecting...");
+                            submitBtn.textContent = "Connected";
+                            submitBtn.removeAttribute("aria-busy");
+                            if (!safeRedirect(pendingRedirectUrl)) {
+                                showStatus("error", "Setup complete, but refused to redirect to unsafe URL.");
+                            }
+                            return;
+                        }
+                        showStatus("success", data.message || "Setup complete! You can close this tab.");
+                        submitBtn.textContent = "Connected";
+                        submitBtn.removeAttribute("aria-busy");
+                    }); })
+                    .catch(function (err) {
+                        showStatus("error", "Network error: " + err.message);
+                        formFieldset.disabled = false;
+                        submitBtn.removeAttribute("aria-busy");
+                        submitBtn.textContent = "Connect";
+                        submitBtn.focus();
+                    });
+            });
+        })();
+    </script>`;
+/** Escape a string for safe embedding inside a double-quoted JS literal. */
+function jsString(value) {
+    return value.replaceAll('\\', '\\\\').replaceAll('"', '\\"').replaceAll('<', '\\u003c');
+}
+/**
+ * Return the id of the tab that should render active on load. Defaults to the
+ * first tab; a valid `initialTab` hint wins, an unknown hint falls back.
+ */
+function resolveActiveTab(tabs, initialTab) {
+    const ids = tabs.map((t) => String(t.id ?? ''));
+    if (initialTab !== undefined && ids.includes(initialTab)) {
+        return initialTab;
+    }
+    return ids.length > 0 ? ids[0] : '';
+}
+/**
+ * Optional workspace-username field shared by the flat + feature forms. Carries
+ * the `.field-input` class so the form collector picks it into the POST as
+ * `__sub_username`. Optional, so it never blocks submit.
+ */
+function usernameFieldHtml() {
+    return ('<div class="field-group">' +
+        '<label for="field-__sub_username" class="field-label">Workspace / username' +
+        ' <span class="optional-badge" aria-hidden="true">Optional</span></label>' +
+        '<input id="field-__sub_username" type="text" name="__sub_username"' +
+        ' class="field-input" placeholder="e.g. alice"' +
+        ' autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" />' +
+        '<p class="help-text">Leave blank for a one-off session. Set the same value on' +
+        ' every device to keep your saved data (one shared bucket per username).</p>' +
+        '</div>');
+}
+function renderCapabilitiesSection(capabilityInfo) {
+    if (capabilityInfo.length === 0) {
+        return '';
+    }
+    const itemsHtml = capabilityInfo.map(renderCapability).join('');
+    return `
+        <section class="capabilities-section" aria-labelledby="capabilities-title">
+            <h2 class="capabilities-title" id="capabilities-title">Capabilities Requested</h2>
+            <ul class="capabilities-list">${itemsHtml}
+            </ul>
+        </section>`;
+}
+/**
+ * Render a credential form whose fields are split across mutually-exclusive
+ * tabs. Only the active tab's fields are collected on submit. Multi-step
+ * (OTP / 2FA) chaining works exactly as the flat form.
+ */
+function renderTabbedCredentialForm(schema, options) {
+    const displayName = escapeHtml(schema.displayName ?? schema.server ?? 'Configuration');
+    const server = escapeHtml(schema.server ?? '');
+    const description = escapeHtml(schema.description ?? '');
+    const title = options.pageTitle !== undefined ? escapeHtml(options.pageTitle) : displayName;
+    const submitUrlEscaped = escapeHtml(options.submitUrl);
+    const prefill = options.prefill ?? {};
+    const tabs = schema.tabs ?? [];
+    const activeId = resolveActiveTab(tabs, options.initialTab);
+    const tabButtons = [];
+    const tabPanels = [];
+    for (const tab of tabs) {
+        const tid = escapeHtml(tab.id ?? '');
+        const label = escapeHtml(tab.label ?? '');
+        const isActive = (tab.id ?? '') === activeId;
+        const activeCls = isActive ? ' active' : '';
+        const ariaSelected = isActive ? 'true' : 'false';
+        const tabindex = isActive ? '0' : '-1';
+        tabButtons.push(`<button type="button" id="tab-${tid}" class="tab${activeCls}" data-tab="${tid}"` +
+            ` role="tab" aria-selected="${ariaSelected}" tabindex="${tabindex}"` +
+            ` aria-controls="panel-${tid}">${label}</button>`);
+        const panelFields = (tab.fields ?? []).map((f) => renderField(f, prefill[f.key] ?? '')).join('');
+        tabPanels.push(`<div id="panel-${tid}" class="tab-panel${activeCls}" data-panel="${tid}"` +
+            ` role="tabpanel" aria-labelledby="tab-${tid}">${panelFields}\n                </div>`);
+    }
+    const tabsHtml = tabButtons.join('\n                ');
+    const panelsHtml = tabPanels.join('\n                ');
+    const usernameHtml = options.includeUsernameField ? usernameFieldHtml() : '';
+    const capabilitiesHtml = renderCapabilitiesSection(schema.capabilityInfo ?? []);
+    const descriptionHtml = description ? `<p class="server-description" id="server-desc">${description}</p>` : '';
+    const script = TABS_SCRIPT.replaceAll('__SUBMIT_URL__', submitUrlEscaped).replaceAll('__INITIAL_TAB__', activeId);
+    const bodyHtml = `${TABS_CSS}    <div class="container">
+        <div class="card">
+            <div class="server-header">
+                <h1 class="server-name">${displayName}</h1>
+                <div class="server-id">${server}</div>
+                ${descriptionHtml}
+            </div>
+
+            <div class="tabs" role="tablist" aria-label="Credential mode">
+                ${tabsHtml}
+            </div>
+
+            <form id="credential-form" novalidate>
+                ${usernameHtml}${panelsHtml}
+
+                <button type="submit" class="submit-btn" id="submit-btn">Connect</button>
+
+                <div class="status-box" id="status-box" role="alert"></div>
+            </form>
+        </div>
+        ${capabilitiesHtml}
+    </div>
+${script}`;
+    return renderFormShell(title, bodyHtml);
+}
+/**
+ * Render a credential form built around one repeatable card group. The group's
+ * fields are cloned per card (Add/Remove) and submitted as a JSON array under
+ * the group `key`. An Outlook-style device-code follow-up is supported.
+ */
+function renderCardGroupCredentialForm(schema, options) {
+    const displayName = escapeHtml(schema.displayName ?? schema.server ?? 'Configuration');
+    const server = escapeHtml(schema.server ?? '');
+    const description = escapeHtml(schema.description ?? '');
+    const title = options.pageTitle !== undefined ? escapeHtml(options.pageTitle) : displayName;
+    const submitUrlEscaped = escapeHtml(options.submitUrl);
+    const group = schema.cardGroup;
+    const groupKey = String(group.key ?? 'items');
+    const itemLabel = String(group.itemLabel ?? 'Item');
+    const addLabel = escapeHtml(group.addButtonLabel ?? '+ Add');
+    const minItems = Number(group.minItems ?? 1);
+    const titleField = String(group.titleField ?? '');
+    const groupHeading = escapeHtml(group.heading ?? `${itemLabel}s`);
+    const fields = group.fields ?? [];
+    // `<` is escaped to `<` so the JSON cannot terminate the <script> early.
+    const fieldsJson = JSON.stringify(fields).replaceAll('<', '\\u003c');
+    const usernameHtml = options.includeUsernameField ? usernameFieldHtml() : '';
+    const capabilitiesHtml = renderCapabilitiesSection(schema.capabilityInfo ?? []);
+    const descriptionHtml = description ? `<p class="server-description" id="server-desc">${description}</p>` : '';
+    // `__CARD_FIELDS__` (the only placeholder carrying user-controlled JSON) is
+    // substituted LAST so a crafted field value cannot masquerade as another token.
+    const script = CARD_GROUP_SCRIPT.replaceAll('__SUBMIT_URL__', submitUrlEscaped)
+        .replaceAll('__GROUP_KEY__', jsString(groupKey))
+        .replaceAll('__TITLE_FIELD__', jsString(titleField))
+        .replaceAll('__ITEM_LABEL__', jsString(itemLabel))
+        .replaceAll('__MIN_ITEMS__', String(minItems))
+        .replaceAll('__CARD_FIELDS__', fieldsJson);
+    const bodyHtml = `${CARD_GROUP_CSS}    <div class="container">
+        <div class="card">
+            <div class="server-header">
+                <h1 class="server-name">${displayName}</h1>
+                <div class="server-id">${server}</div>
+                ${descriptionHtml}
+            </div>
+
+            <h2 class="form-title" id="form-title">${groupHeading}</h2>
+
+            <form id="credential-form" aria-labelledby="form-title" novalidate>
+                <fieldset id="form-fieldset" style="border: none; padding: 0; margin: 0;">
+                    ${usernameHtml}<div id="card-group-container"></div>
+
+                    <button type="button" class="card-group-add" id="card-group-add">${addLabel}</button>
+
+                    <button type="submit" class="submit-btn" id="submit-btn">Connect</button>
+                </fieldset>
+
+                <div class="status-box" id="status-box" role="alert"></div>
+            </form>
+        </div>
+        ${capabilitiesHtml}
+    </div>
+${script}`;
+    return renderFormShell(title, bodyHtml);
+}
 /**
  * Render a dark-themed HTML credential form from a RelayConfigSchema.
  *
@@ -490,6 +1416,14 @@ function renderCapability(cap) {
  * @returns Complete HTML document string, XSS-safe with all dynamic content escaped.
  */
 export function renderCredentialForm(schema, options) {
+    // Schema-level capabilities (opt-in): dispatch to the dedicated renderer.
+    // A schema declaring neither key falls through to the unchanged flat form.
+    if (schema.tabs && schema.tabs.length > 0) {
+        return renderTabbedCredentialForm(schema, options);
+    }
+    if (schema.cardGroup) {
+        return renderCardGroupCredentialForm(schema, options);
+    }
     const displayName = escapeHtml(schema.displayName ?? schema.server ?? 'Configuration');
     const server = escapeHtml(schema.server ?? '');
     const description = escapeHtml(schema.description ?? '');

package/build/auth/credential-form.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-form.js","sourceRoot":"","sources":["../../src/auth/credential-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAYH;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAiD,EACjD,MAAyB;IAEzB,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAEzB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;IAClC,IAAI,WAAW,GAAG,KAAK,CAAA;IAEvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QACvB,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC5B,WAAW,GAAG,IAAI,CAAA;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,MAAM,CAAC,eAAe,KAAK,MAAM,CAAA;AAC1C,CAAC;AA6BD,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+UtB,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,QAAgB;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;IACnC,OAAO;;;;;aAKI,SAAS;;EAEpB,cAAc;;;EAGd,QAAQ;;QAEF,CAAA;AACR,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB,EAAE,KAAK,GAAG,EAAE;IACjD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;IACvC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,CAAA;IAClD,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAExC,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAA;IAChD,MAAM,aAAa,GAAG,QAAQ;QAC5B,CAAC,CAAC,iEAAiE;QACnE,CAAC,CAAC,iEAAiE,CAAA;IAErE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IAE9D,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,eAAe,GAAG,EAAE,CAAA;IACxB,IAAI,QAAQ,EAAE,CAAC;QACb,eAAe,GAAG,2BAA2B,GAAG,GAAG,CAAA;QACnD,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,GAAG,iCAAiC,GAAG,cAAc,OAAO,+CAA+C,QAAQ,UAAU,CAAA;QACvI,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,iCAAiC,GAAG,KAAK,QAAQ,MAAM,CAAA;QACpE,CAAC;IACH,CAAC;IAED,OAAO;;gCAEuB,GAAG;kBACjB,KAAK;kBACL,aAAa;;;4BAGH,GAAG;wBACP,GAAG;wBACH,SAAS;+BACF,WAAW;;;;;oCAKN,SAAS,GAAG,YAAY,GAAG,eAAe;;cAEhE,QAAQ;eACP,CAAA;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAmB;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;IAC/C,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IAErD,MAAM,aAAa,GAAG,QAAQ,CAAC,CAAC,CAAC,YAAY,QAAQ,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAA;IAE3E,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,8BAA8B,WAAW,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IAEnF,OAAO;;;qDAG4C,KAAK;uDACH,aAAa,KAAK,QAAQ;;kBAE/D,QAAQ;kBACR,CAAA;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAyB,EAAE,OAAsB;IACpF,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,CAAA;IACtF,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IAC9C,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAA;IAC3F,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAEtD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;IAClC,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAA;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAA;IAErC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEnF,IAAI,gBAAgB,GAAG,EAAE,CAAA;IACzB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/D,gBAAgB,GAAG;;;4CAGqB,SAAS;;mBAElC,CAAA;IACjB,CAAC;IAED,MAAM,eAAe,GAAG,WAAW,CAAC,CAAC,CAAC,kDAAkD,WAAW,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9G,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,EAAE,CAAA;IAErE,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,QAAQ,GAAG;;;0CAGuB,WAAW;yCACZ,MAAM;kBAC7B,eAAe;;;;;qEAKoC,QAAQ;kBAC3D,UAAU;;;;;;;;;UASlB,gBAAgB;;;;;;;;+BAQK,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAoWjC,CAAA;IAEZ,OAAO,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;AACzC,CAAC;AAgCD,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,KAAuB;IACnD,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,CAAA;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAuB;IAClD,OAAO,KAAK,CAAC,UAAU,KAAK,IAAI,CAAA;AAClC,CAAC"}
+{"version":3,"file":"credential-form.js","sourceRoot":"","sources":["../../src/auth/credential-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAcH;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAiD,EACjD,MAAyB;IAEzB,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAEzB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;IAClC,IAAI,WAAW,GAAG,KAAK,CAAA;IAEvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QACvB,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC5B,WAAW,GAAG,IAAI,CAAA;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,MAAM,CAAC,eAAe,KAAK,MAAM,CAAA;AAC1C,CAAC;AAoED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkZtB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,QAAgB;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;IACnC,OAAO;;;;;;aAMI,SAAS;;EAEpB,cAAc;;;EAGd,QAAQ;;QAEF,CAAA;AACR,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB,EAAE,KAAK,GAAG,EAAE;IACjD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;IACvC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,CAAA;IAClD,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAExC,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAA;IAChD,MAAM,aAAa,GAAG,QAAQ;QAC5B,CAAC,CAAC,iEAAiE;QACnE,CAAC,CAAC,iEAAiE,CAAA;IAErE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IAExF,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,eAAe,GAAG,EAAE,CAAA;IACxB,IAAI,QAAQ,EAAE,CAAC;QACb,eAAe,GAAG,2BAA2B,GAAG,GAAG,CAAA;QACnD,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,GAAG,iCAAiC,GAAG,cAAc,OAAO,+CAA+C,QAAQ,UAAU,CAAA;QACvI,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,iCAAiC,GAAG,KAAK,QAAQ,MAAM,CAAA;QACpE,CAAC;IACH,CAAC;IAED,OAAO;;gCAEuB,GAAG;kBACjB,KAAK;kBACL,aAAa;;;4BAGH,GAAG;wBACP,GAAG;wBACH,SAAS;+BACF,WAAW;;;;;oCAKN,SAAS,GAAG,WAAW,GAAG,YAAY,GAAG,eAAe;;cAE9E,QAAQ;eACP,CAAA;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAmB;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;IAC/C,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IAErD,MAAM,aAAa,GAAG,QAAQ,CAAC,CAAC,CAAC,YAAY,QAAQ,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAA;IAE3E,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,8BAA8B,WAAW,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IAEnF,OAAO;;;qDAG4C,KAAK;uDACH,aAAa,KAAK,QAAQ;;kBAE/D,QAAQ;kBACR,CAAA;AAClB,CAAC;AAED,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAC9E,yEAAyE;AACzE,iDAAiD;AACjD,wEAAwE;AACxE,2EAA2E;AAC3E,0EAA0E;AAC1E,gEAAgE;AAChE,8EAA8E;AAC9E,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,+DAA+D;AAC/D,8EAA8E;AAE9E,yEAAyE;AACzE,8EAA8E;AAC9E,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyDhB,CAAA;AAED,yEAAyE;AACzE,0EAA0E;AAC1E,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4EtB,CAAA;AAED,8EAA8E;AAC9E,wEAAwE;AACxE,4EAA4E;AAC5E,2CAA2C;AAC3C,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoFlB,CAAA;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,uBAAuB;AACvB,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;EAmBlB,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA2GE,CAAA;AAEd,+EAA+E;AAC/E,iFAAiF;AACjF,4DAA4D;AAC5D,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAsTZ,CAAA;AAEd,4EAA4E;AAC5E,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;AACzF,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAgB,EAAE,UAA8B;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC/C,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACzD,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB;IACxB,OAAO,CACL,2BAA2B;QAC3B,4EAA4E;QAC5E,0EAA0E;QAC1E,oEAAoE;QACpE,+CAA+C;QAC/C,kFAAkF;QAClF,+EAA+E;QAC/E,6EAA6E;QAC7E,QAAQ,CACT,CAAA;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,cAAgC;IACjE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC/D,OAAO;;;4CAGmC,SAAS;;mBAElC,CAAA;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAS,0BAA0B,CAAC,MAAyB,EAAE,OAAsB;IACnF,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,CAAA;IACtF,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IAC9C,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAA;IAC3F,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAA;IAErC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAA;IAC9B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IAE3D,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;QACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,QAAQ,CAAA;QAC5C,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAA;QAC3C,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;QAChD,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;QACtC,UAAU,CAAC,IAAI,CACb,iCAAiC,GAAG,eAAe,SAAS,eAAe,GAAG,GAAG;YAC/E,8BAA8B,YAAY,eAAe,QAAQ,GAAG;YACpE,yBAAyB,GAAG,KAAK,KAAK,WAAW,CACpD,CAAA;QACD,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAChG,SAAS,CAAC,IAAI,CACZ,kBAAkB,GAAG,qBAAqB,SAAS,iBAAiB,GAAG,GAAG;YACxE,yCAAyC,GAAG,KAAK,WAAW,0BAA0B,CACzF,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IACtD,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IACvD,MAAM,YAAY,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5E,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAA;IAC/E,MAAM,eAAe,GAAG,WAAW,CAAC,CAAC,CAAC,kDAAkD,WAAW,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IAE9G,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,UAAU,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAA;IAEjH,MAAM,QAAQ,GAAG,GAAG,QAAQ;;;0CAGY,WAAW;yCACZ,MAAM;kBAC7B,eAAe;;;;kBAIf,QAAQ;;;;kBAIR,YAAY,GAAG,UAAU;;;;;;;UAOjC,gBAAgB;;EAExB,MAAM,EAAE,CAAA;IAER,OAAO,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,MAAyB,EAAE,OAAsB;IACtF,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,CAAA;IACtF,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IAC9C,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAA;IAC3F,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAEtD,MAAM,KAAK,GAAG,MAAM,CAAC,SAAsB,CAAA;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,CAAA;IAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,cAAc,IAAI,OAAO,CAAC,CAAA;IAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAA;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAA;IACjD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,IAAI,GAAG,SAAS,GAAG,CAAC,CAAA;IACjE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAA;IAEjC,yEAAyE;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IAEpE,MAAM,YAAY,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5E,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAA;IAC/E,MAAM,eAAe,GAAG,WAAW,CAAC,CAAC,CAAC,kDAAkD,WAAW,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IAE9G,4EAA4E;IAC5E,gFAAgF;IAChF,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;SAC5E,UAAU,CAAC,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;SAC/C,UAAU,CAAC,iBAAiB,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;SACnD,UAAU,CAAC,gBAAgB,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;SACjD,UAAU,CAAC,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;SAC7C,UAAU,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAA;IAE5C,MAAM,QAAQ,GAAG,GAAG,cAAc;;;0CAGM,WAAW;yCACZ,MAAM;kBAC7B,eAAe;;;qDAGoB,YAAY;;;;sBAI3C,YAAY;;uFAEqD,QAAQ;;;;;;;;UAQrF,gBAAgB;;EAExB,MAAM,EAAE,CAAA;IAER,OAAO,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAyB,EAAE,OAAsB;IACpF,0EAA0E;IAC1E,2EAA2E;IAC3E,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,0BAA0B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpD,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACvD,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,CAAA;IACtF,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IAC9C,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAA;IAC3F,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAEtD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;IAClC,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAA;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAA;IAErC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEnF,IAAI,gBAAgB,GAAG,EAAE,CAAA;IACzB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/D,gBAAgB,GAAG;;;4CAGqB,SAAS;;mBAElC,CAAA;IACjB,CAAC;IAED,MAAM,eAAe,GAAG,WAAW,CAAC,CAAC,CAAC,kDAAkD,WAAW,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9G,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,EAAE,CAAA;IAErE,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,QAAQ,GAAG;;;0CAGuB,WAAW;yCACZ,MAAM;kBAC7B,eAAe;;;;;qEAKoC,QAAQ;kBAC3D,UAAU;;;;;;;;;UASlB,gBAAgB;;;;;;;;+BAQK,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAoWjC,CAAA;IAEZ,OAAO,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;AACzC,CAAC;AAgCD,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,KAAuB;IACnD,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,CAAA;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAuB;IAClD,OAAO,KAAK,CAAC,UAAU,KAAK,IAAI,CAAA;AAClC,CAAC"}

package/build/schema/types.d.ts

@@ -31,6 +31,29 @@ export interface DynamicFlow {
     entryField: ConfigField;
     routes: (OAuthRoute | CredentialsRoute)[];
 }
+/**
+ * A credential-form tab (schema-level `tabs` capability). Each tab is a
+ * mutually-exclusive credential mode; only the active tab's fields submit.
+ */
+export interface TabGroup {
+    id: string;
+    label: string;
+    fields: ConfigField[];
+}
+/**
+ * A repeatable field group (schema-level `cardGroup` capability). Renders
+ * Add/Remove cards, each cloning `fields`; submitted as a JSON array under
+ * `key` (e.g. `{ accounts: [{...}, {...}] }`).
+ */
+export interface CardGroup {
+    key: string;
+    fields: ConfigField[];
+    itemLabel?: string;
+    heading?: string;
+    addButtonLabel?: string;
+    minItems?: number;
+    titleField?: string;
+}
 export interface RelayConfigSchema {
     server: string;
     displayName: string;
@@ -38,5 +61,7 @@ export interface RelayConfigSchema {
     fields?: ConfigField[];
     optional?: ConfigField[];
     dynamicFlow?: DynamicFlow;
+    tabs?: TabGroup[];
+    cardGroup?: CardGroup;
 }
 //# sourceMappingURL=types.d.ts.map

package/build/schema/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/schema/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAA;IACzE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,WAAW,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,MAAM,EAAE,oBAAoB,CAAA;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,MAAM,EAAE,aAAa,CAAA;IACrB,MAAM,EAAE,WAAW,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,WAAW,CAAA;IACvB,MAAM,EAAE,CAAC,UAAU,GAAG,gBAAgB,CAAC,EAAE,CAAA;CAC1C;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,UAAU,EAAE,CAAA;IACpB,MAAM,CAAC,EAAE,WAAW,EAAE,CAAA;IACtB,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAA;IACxB,WAAW,CAAC,EAAE,WAAW,CAAA;CAC1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/schema/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAA;IACzE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,WAAW,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,MAAM,EAAE,oBAAoB,CAAA;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,MAAM,EAAE,aAAa,CAAA;IACrB,MAAM,EAAE,WAAW,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,WAAW,CAAA;IACvB,MAAM,EAAE,CAAC,UAAU,GAAG,gBAAgB,CAAC,EAAE,CAAA;CAC1C;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,WAAW,EAAE,CAAA;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,UAAU,EAAE,CAAA;IACpB,MAAM,CAAC,EAAE,WAAW,EAAE,CAAA;IACtB,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAA;IACxB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAA;IACjB,SAAS,CAAC,EAAE,SAAS,CAAA;CACtB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@n24q02m/mcp-core",
-  "version": "1.19.0",
+  "version": "1.20.0-beta.1",
   "description": "Unified MCP Streamable HTTP 2025-11-25 transport, OAuth 2.1 AS, lifecycle, install",
   "keywords": [
     "mcp",