@dainprotocol/service-sdk 2.0.94 → 2.1.0

package/dist/service/server.js

@@ -98,18 +98,151 @@ async function safeParseBody(c) {
         return {};
     }
 }
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+const DAIN_RUNTIME_CONTEXT_KEYS = new Set([
+    "dainAccountId",
+    "dainGroupId",
+    "smartAccountPDA",
+    "account",
+    "group",
+    "auth",
+    "grants",
+    "dataPermissions",
+    "registryPolicy",
+]);
+function stripRuntimeContextFields(value) {
+    return Object.fromEntries(Object.entries(value).filter(([key]) => !DAIN_RUNTIME_CONTEXT_KEYS.has(key)));
+}
+function getStringClaim(payload, ...keys) {
+    if (!payload)
+        return undefined;
+    for (const key of keys) {
+        const value = payload[key];
+        if (typeof value === "string" && value.length > 0) {
+            return value;
+        }
+    }
+    return undefined;
+}
+function getObjectClaim(payload, key) {
+    if (!payload)
+        return undefined;
+    const value = payload[key];
+    return isRecord(value) ? value : undefined;
+}
+function getArrayClaim(payload, key) {
+    if (!payload)
+        return undefined;
+    const value = payload[key];
+    return Array.isArray(value) ? value : undefined;
+}
+function getRuntimeContextFromJwtPayload(payload, options = {}) {
+    const account = getObjectClaim(payload, "account_context");
+    const group = getObjectClaim(payload, "group_context");
+    const auth = getObjectClaim(payload, "auth_context");
+    const dainAccountId = getStringClaim(payload, "dain_account_id", "account_id") ?? account?.id;
+    const dainGroupId = getStringClaim(payload, "dain_group_id", "group_id") ?? group?.id;
+    const smartAccountPDA = getStringClaim(payload, "smart_account_pda") ??
+        options.fallbackSmartAccountPDA;
+    if (account?.id && dainAccountId && account.id !== dainAccountId) {
+        throw new http_exception_1.HTTPException(401, {
+            message: "JWT DAIN context mismatch: dain_account_id does not match account_context.id",
+        });
+    }
+    if (group?.id && dainGroupId && group.id !== dainGroupId) {
+        throw new http_exception_1.HTTPException(401, {
+            message: "JWT DAIN context mismatch: dain_group_id does not match group_context.id",
+        });
+    }
+    if (account?.smartAccount?.pda &&
+        smartAccountPDA &&
+        account.smartAccount.pda !== smartAccountPDA) {
+        throw new http_exception_1.HTTPException(401, {
+            message: "JWT DAIN context mismatch: smart_account_pda does not match account_context.smartAccount.pda",
+        });
+    }
+    const grants = getArrayClaim(payload, "action_grants");
+    const dataPermissions = getArrayClaim(payload, "data_permissions");
+    const registryPolicy = getObjectClaim(payload, "registry_policy");
+    const subject = getStringClaim(payload, "sub") ??
+        options.smartAccountId ??
+        dainAccountId ??
+        dainGroupId ??
+        smartAccountPDA;
+    return {
+        ...(dainAccountId ? { dainAccountId } : {}),
+        ...(dainGroupId ? { dainGroupId } : {}),
+        ...(smartAccountPDA ? { smartAccountPDA } : {}),
+        ...(account ? { account } : {}),
+        ...(group ? { group } : {}),
+        auth: auth ?? {
+            subject: subject ?? "unknown",
+            issuer: getStringClaim(payload, "iss"),
+            scopes: options.scopes,
+            source: "dain_id",
+        },
+        ...(grants ? { grants } : {}),
+        ...(dataPermissions ? { dataPermissions } : {}),
+        ...(registryPolicy ? { registryPolicy } : {}),
+    };
+}
+function getRuntimeContextFromAgentInfo(agentInfo) {
+    return {
+        ...(agentInfo.dainAccountId
+            ? { dainAccountId: agentInfo.dainAccountId }
+            : {}),
+        ...(agentInfo.dainGroupId ? { dainGroupId: agentInfo.dainGroupId } : {}),
+        ...(agentInfo.smartAccountPDA
+            ? { smartAccountPDA: agentInfo.smartAccountPDA }
+            : {}),
+        ...(agentInfo.account ? { account: agentInfo.account } : {}),
+        ...(agentInfo.group ? { group: agentInfo.group } : {}),
+        ...(agentInfo.auth ? { auth: agentInfo.auth } : {}),
+        ...(agentInfo.grants ? { grants: agentInfo.grants } : {}),
+        ...(agentInfo.dataPermissions
+            ? { dataPermissions: agentInfo.dataPermissions }
+            : {}),
+        ...(agentInfo.registryPolicy
+            ? { registryPolicy: agentInfo.registryPolicy }
+            : {}),
+    };
+}
+function getRequestExtraData(request) {
+    if (!isRecord(request))
+        return {};
+    return isRecord(request.DAIN_EXTRA_DATA)
+        ? stripRuntimeContextFields(request.DAIN_EXTRA_DATA)
+        : {};
+}
+function buildServiceExtraData(agentInfo, options = {}) {
+    const requestExtra = getRequestExtraData(options.request);
+    const runtimeContext = getRuntimeContextFromAgentInfo(agentInfo);
+    return {
+        ...requestExtra,
+        ...(options.extra ?? {}),
+        ...runtimeContext,
+        ...(options.plugins ? { plugins: options.plugins } : {}),
+        ...(Object.prototype.hasOwnProperty.call(options, "oauth2Client")
+            ? { oauth2Client: options.oauth2Client }
+            : {}),
+    };
+}
 /**
  * Middleware factory to require specific OAuth scopes.
  * Defense-in-depth: Validates scopes even though JWT middleware already checked them.
  */
 function requireScope(requiredScope) {
     return async (c, next) => {
-        const scopes = c.get('scope') || [];
-        const requiredScopes = Array.isArray(requiredScope) ? requiredScope : [requiredScope];
-        const hasRequiredScope = requiredScopes.some(scope => (0, auth_2.hasScope)(scopes, scope));
+        const scopes = c.get("scope") || [];
+        const requiredScopes = Array.isArray(requiredScope)
+            ? requiredScope
+            : [requiredScope];
+        const hasRequiredScope = requiredScopes.some((scope) => (0, auth_2.hasScope)(scopes, scope));
         if (!hasRequiredScope) {
             throw new http_exception_1.HTTPException(403, {
-                message: `Insufficient scope. Required: ${requiredScopes.join(' OR ')}, Have: ${scopes.join(', ')}`
+                message: `Insufficient scope. Required: ${requiredScopes.join(" OR ")}, Have: ${scopes.join(", ")}`,
             });
         }
         await next();
@@ -120,6 +253,17 @@ function signedStreamSSE(c, privateKey, config, handler) {
     return (0, streaming_1.streamSSE)(c, async (stream) => {
         const requestSignal = c.req.raw?.signal;
         const isAborted = () => stream.aborted || stream.closed || requestSignal?.aborted === true;
+        const abortStream = () => {
+            if (!stream.closed) {
+                stream.abort();
+            }
+        };
+        if (requestSignal?.aborted) {
+            abortStream();
+        }
+        else {
+            requestSignal?.addEventListener("abort", abortStream, { once: true });
+        }
         const signedStream = {
             writeSSE: async (event) => {
                 if (isAborted())
@@ -128,29 +272,46 @@ function signedStreamSSE(c, privateKey, config, handler) {
                 const messageHash = (0, sseSignature_1.hashEventMessage)(event.data, timestamp);
                 const signature = (0, utils_js_1.bytesToHex)(sseSignature_1.ed25519.sign(messageHash, privateKey));
                 // Fast path for non-critical events (progress/UI updates)
-                const isCriticalEvent = event.event === 'result' ||
-                    event.event === 'process-created' ||
-                    event.event === 'datasource-update';
+                const isCriticalEvent = event.event === "result" ||
+                    event.event === "process-created" ||
+                    event.event === "datasource-update";
                 const dataWithSignature = isCriticalEvent
                     ? JSON.stringify({
                         data: JSON.parse(event.data),
-                        _signature: { signature, timestamp, agentId: config.identity.agentId, orgId: config.identity.orgId, address: config.identity.publicKey }
+                        _signature: {
+                            signature,
+                            timestamp,
+                            agentId: config.identity.agentId,
+                            orgId: config.identity.orgId,
+                            address: config.identity.publicKey,
+                        },
                     })
                     : `{"data":${event.data},"_signature":{"signature":"${signature}","timestamp":"${timestamp}","agentId":"${config.identity.agentId}","orgId":"${config.identity.orgId}","address":"${config.identity.publicKey}"}}`;
-                await stream.writeSSE({ event: event.event, data: dataWithSignature, id: event.id });
+                await stream.writeSSE({
+                    event: event.event,
+                    data: dataWithSignature,
+                    id: event.id,
+                });
             },
             isAborted,
+            onAbort: (listener) => stream.onAbort(listener),
         };
-        await handler(signedStream);
+        try {
+            await handler(signedStream);
+        }
+        finally {
+            requestSignal?.removeEventListener("abort", abortStream);
+        }
     });
 }
 function setupHttpServer(config, tools, services, toolboxes, metadata, privateKey, contexts, widgets, datasources = [], agents = []) {
     const app = new hono_1.Hono();
+    const datasourceStreamAbortControllers = new Map();
     const processHandler = new processes_1.ProcessHandler({
         serviceId: "service_" + config.identity.orgId + "_" + config.identity.agentId,
         privateKey,
         store: config.processStore,
-        onHumanActionResponse: config.onHumanActionResponse
+        onHumanActionResponse: config.onHumanActionResponse,
     });
     app.processes = processHandler;
     // CORS middleware - apply to all routes
@@ -160,6 +321,8 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         allowHeaders: [
             "X-DAIN-SIGNATURE",
             "X-DAIN-SMART-ACCOUNT-PDA",
+            "X-DAIN-ACCOUNT-ID",
+            "X-DAIN-GROUP-ID",
             "X-DAIN-AGENT-ID",
             "X-DAIN-ORG-ID",
             "X-DAIN-ADDRESS",
@@ -177,7 +340,7 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         return c.text("Enabling CORS Pre-Flight", 200, {
             "Access-Control-Allow-Origin": "*",
             "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-            "Access-Control-Allow-Headers": "X-DAIN-SIGNATURE, X-DAIN-SMART-ACCOUNT-PDA, X-DAIN-AGENT-ID, X-DAIN-ORG-ID, X-DAIN-ADDRESS, X-DAIN-TIMESTAMP, Content-Type, Authorization, Accept, Origin, X-Requested-With",
+            "Access-Control-Allow-Headers": "X-DAIN-SIGNATURE, X-DAIN-SMART-ACCOUNT-PDA, X-DAIN-ACCOUNT-ID, X-DAIN-GROUP-ID, X-DAIN-AGENT-ID, X-DAIN-ORG-ID, X-DAIN-ADDRESS, X-DAIN-TIMESTAMP, Content-Type, Authorization, Accept, Origin, X-Requested-With",
             "Access-Control-Max-Age": "86400",
         });
     });
@@ -197,7 +360,8 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         const isStreaming = acceptHeader.includes("text/event-stream");
         await next();
         // Skip signature for streaming responses
-        if (isStreaming || c.res.headers.get("content-type")?.includes("text/event-stream")) {
+        if (isStreaming ||
+            c.res.headers.get("content-type")?.includes("text/event-stream")) {
             return;
         }
         const body = await c.res.clone().text();
@@ -210,12 +374,14 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
     });
     // Get all webhook paths for auth bypass
     const webhookPaths = config.webhookTriggers?.getWebhookPaths() || [];
-    const hitlPath = config.hitl?.enabled ? (config.hitl.webhookPath || '/actions') : null;
+    const hitlPath = config.hitl?.enabled
+        ? config.hitl.webhookPath || "/actions"
+        : null;
     // Dual Authentication: JWT (users) or API Key (services)
     app.use("*", async (c, next) => {
         debugLog(`[Auth Middleware] Path: ${c.req.path}, Method: ${c.req.method}`);
         // Check if path is a webhook path (auth bypass)
-        const isWebhookPath = webhookPaths.some(path => c.req.path === path);
+        const isWebhookPath = webhookPaths.some((path) => c.req.path === path);
         const isHITLPath = hitlPath && c.req.path === hitlPath;
         if (c.req.path.startsWith("/oauth2/callback/") ||
             c.req.path.startsWith("/addons") ||
@@ -237,16 +403,20 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
             const host = getFirstForwardedValue(c.req.header("x-forwarded-host")) ||
                 getFirstForwardedValue(c.req.header("host"));
             if (!host) {
-                throw new http_exception_1.HTTPException(400, { message: "Unable to determine service URL. Host header is required." });
+                throw new http_exception_1.HTTPException(400, {
+                    message: "Unable to determine service URL. Host header is required.",
+                });
             }
             // Validate host format to prevent obvious attacks
-            if (host.includes(' ') || host.includes('\n') || host.includes('\r')) {
+            if (host.includes(" ") || host.includes("\n") || host.includes("\r")) {
                 throw new http_exception_1.HTTPException(400, { message: "Invalid Host header format" });
             }
             const xForwardedProto = getFirstForwardedValue(c.req.header("x-forwarded-proto"));
             const protocol = xForwardedProto === "http" || xForwardedProto === "https"
                 ? xForwardedProto
-                : (host.includes("localhost") || host.startsWith("127.") ? "http" : "https");
+                : host.includes("localhost") || host.startsWith("127.")
+                    ? "http"
+                    : "https";
             const forwardedPrefix = normalizeForwardedPrefix(getFirstForwardedValue(c.req.header("x-forwarded-prefix")));
             const jwtAudiences = [`${protocol}://${host}`];
             if (forwardedPrefix) {
@@ -259,7 +429,9 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                 audience: jwtAudiences,
             });
             if (!result.valid) {
-                throw new http_exception_1.HTTPException(401, { message: `JWT verification failed: ${result.error}` });
+                throw new http_exception_1.HTTPException(401, {
+                    message: `JWT verification failed: ${result.error}`,
+                });
             }
             // Defense in depth: double-check audience claim
             const tokenAudiences = Array.isArray(result.payload?.aud)
@@ -269,15 +441,21 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
             const audienceMatched = tokenAudiences.some((aud) => aud && expectedAudienceSet.has(aud));
             if (!audienceMatched) {
                 throw new http_exception_1.HTTPException(403, {
-                    message: `JWT audience mismatch. Expected one of: ${jwtAudiences.join(", ")}, Got: ${tokenAudiences.filter(Boolean).join(", ")}`
+                    message: `JWT audience mismatch. Expected one of: ${jwtAudiences.join(", ")}, Got: ${tokenAudiences.filter(Boolean).join(", ")}`,
                 });
             }
-            c.set('authMethod', 'jwt');
-            c.set('smartAccountId', result.smartAccountId);
-            c.set('address', result.smartAccountId); // Use smartAccountId as address for JWT auth
-            c.set('scope', result.scope);
-            c.set('jwtPayload', result.payload);
-            c.set('smartAccountPDA', c.req.header("X-DAIN-SMART-ACCOUNT-PDA"));
+            c.set("authMethod", "jwt");
+            c.set("smartAccountId", result.smartAccountId);
+            c.set("address", result.smartAccountId); // Use smartAccountId as address for JWT auth
+            c.set("scope", result.scope);
+            c.set("jwtPayload", result.payload);
+            const jwtRuntimeContext = getRuntimeContextFromJwtPayload(result.payload, {
+                scopes: result.scope,
+                smartAccountId: result.smartAccountId,
+                fallbackSmartAccountPDA: c.req.header("X-DAIN-SMART-ACCOUNT-PDA"),
+            });
+            c.set("dainRuntimeContext", jwtRuntimeContext);
+            c.set("smartAccountPDA", jwtRuntimeContext.smartAccountPDA);
             debugLog(`[Auth Middleware] JWT auth SUCCESS - smartAccountId: ${result.smartAccountId}`);
         }
         else if (apiKey) {
@@ -295,11 +473,22 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                     throw new http_exception_1.HTTPException(401, { message: "Invalid API key" });
                 }
             }
-            c.set('authMethod', 'apiKey');
-            c.set('agentId', parsed.agentId);
-            c.set('orgId', parsed.orgId);
-            c.set('address', parsed.agentId); // Use agentId as address for API key auth
-            c.set('smartAccountPDA', c.req.header("X-DAIN-SMART-ACCOUNT-PDA"));
+            c.set("authMethod", "apiKey");
+            c.set("agentId", parsed.agentId);
+            c.set("orgId", parsed.orgId);
+            c.set("address", parsed.agentId); // Use agentId as address for API key auth
+            c.set("smartAccountPDA", c.req.header("X-DAIN-SMART-ACCOUNT-PDA"));
+            c.set("dainRuntimeContext", {
+                ...(c.req.header("X-DAIN-ACCOUNT-ID")
+                    ? { dainAccountId: c.req.header("X-DAIN-ACCOUNT-ID") }
+                    : {}),
+                ...(c.req.header("X-DAIN-GROUP-ID")
+                    ? { dainGroupId: c.req.header("X-DAIN-GROUP-ID") }
+                    : {}),
+                ...(c.req.header("X-DAIN-SMART-ACCOUNT-PDA")
+                    ? { smartAccountPDA: c.req.header("X-DAIN-SMART-ACCOUNT-PDA") }
+                    : {}),
+            });
             debugLog(`[Auth Middleware] API Key auth SUCCESS - agentId: ${parsed.agentId}, orgId: ${parsed.orgId}`);
         }
         else {
@@ -310,32 +499,58 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
     });
     async function getAgentInfo(c) {
         debugLog("[getAgentInfo] START");
-        debugLog("[getAgentInfo] Auth method:", c.get('authMethod'));
-        const smartAccountPDA = c.get('smartAccountPDA') || c.req.header("X-DAIN-SMART-ACCOUNT-PDA");
+        debugLog("[getAgentInfo] Auth method:", c.get("authMethod"));
+        const runtimeContext = (c.get("dainRuntimeContext") ||
+            {});
+        const smartAccountPDA = runtimeContext.smartAccountPDA ||
+            c.get("smartAccountPDA") ||
+            c.req.header("X-DAIN-SMART-ACCOUNT-PDA");
         const webhookUrl = c.req.header("X-DAIN-WEBHOOK-URL");
         debugLog("[getAgentInfo] smartAccountPDA:", smartAccountPDA);
         debugLog("[getAgentInfo] webhookUrl:", webhookUrl);
-        if (c.get('authMethod') === 'jwt') {
-            const smartAccountId = c.get('smartAccountId');
+        if (c.get("authMethod") === "jwt") {
+            const smartAccountId = c.get("smartAccountId");
             debugLog("[getAgentInfo] JWT auth - smartAccountId:", smartAccountId);
             const agentInfo = {
                 agentId: smartAccountId,
                 address: smartAccountId,
                 smartAccountPDA,
-                id: smartAccountPDA ? `dain_id_${smartAccountPDA}` : `smart_account_${smartAccountId}`,
+                dainAccountId: runtimeContext.dainAccountId,
+                dainGroupId: runtimeContext.dainGroupId,
+                account: runtimeContext.account,
+                group: runtimeContext.group,
+                auth: runtimeContext.auth,
+                grants: runtimeContext.grants,
+                dataPermissions: runtimeContext.dataPermissions,
+                registryPolicy: runtimeContext.registryPolicy,
+                id: runtimeContext.dainAccountId ??
+                    runtimeContext.dainGroupId ??
+                    (smartAccountPDA
+                        ? `dain_id_${smartAccountPDA}`
+                        : `smart_account_${smartAccountId}`),
                 webhookUrl,
             };
             debugLog("[getAgentInfo] JWT - Returning agent info:", agentInfo);
             return agentInfo;
         }
-        const agentId = c.get('agentId');
-        const address = c.get('address');
+        const agentId = c.get("agentId");
+        const address = c.get("address");
         debugLog("[getAgentInfo] API Key auth - agentId:", agentId, "address:", address);
         const agentInfo = {
             agentId,
             address,
             smartAccountPDA,
-            id: smartAccountPDA ? `dain_id_${smartAccountPDA}` : `address_${address}`,
+            dainAccountId: runtimeContext.dainAccountId,
+            dainGroupId: runtimeContext.dainGroupId,
+            account: runtimeContext.account,
+            group: runtimeContext.group,
+            auth: runtimeContext.auth,
+            grants: runtimeContext.grants,
+            dataPermissions: runtimeContext.dataPermissions,
+            registryPolicy: runtimeContext.registryPolicy,
+            id: runtimeContext.dainAccountId ??
+                runtimeContext.dainGroupId ??
+                (smartAccountPDA ? `dain_id_${smartAccountPDA}` : `address_${address}`),
             webhookUrl,
         };
         debugLog("[getAgentInfo] API Key - Returning agent info:", agentInfo);
@@ -365,7 +580,8 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
     app.get("/metadata", (c) => {
         // Compute service-level capability: does ANY tool support user actions (HITL)?
         const supportsUserActions = tools.some((tool) => tool.supportsUserActions === true);
-        const requestedContract = c.req.header("x-butterfly-contract") || c.req.header("X-Butterfly-Contract");
+        const requestedContract = c.req.header("x-butterfly-contract") ||
+            c.req.header("X-Butterfly-Contract");
         const sdkMajor = Number.parseInt(String(package_json_1.default.version).split(".")[0] || "0", 10);
         const contractVersion = Number.isFinite(sdkMajor) && sdkMajor > 0 ? `${sdkMajor}.0.0` : "0.0.0";
         const capabilities = {
@@ -378,6 +594,14 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
             datasourcePolicy: true,
             widgetPolicy: true,
             toolSafety: true,
+            dainAccount: true,
+            registryDiscovery: true,
+            dataPermissions: true,
+            actionGrants: true,
+            smartAccountTransactions: true,
+            payments: true,
+            registryPolicy: true,
+            grantPolicies: true,
         };
         const compatibility = (() => {
             if (!requestedContract)
@@ -444,38 +668,53 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         const autoContexts = app.oauth2?.getDirectProviderContexts?.() || [];
         const serviceSlug = (0, core_1.toSlug)(metadata.title);
         const skillsContext = config.skills?.getSkillsContext?.(serviceSlug);
-        const allContexts = [...contexts, ...autoContexts, ...(skillsContext ? [skillsContext] : [])];
+        const allContexts = [
+            ...contexts,
+            ...autoContexts,
+            ...(skillsContext ? [skillsContext] : []),
+        ];
         const contextInfo = allContexts.map((context) => ({
             id: context.id,
             name: context.name,
             description: context.description,
         }));
         // Process plugins for the response
-        const processedResponse = await processPluginsForResponse(contextInfo, body, { extraData: { plugins: processedPluginData.plugins } });
+        const processedResponse = await processPluginsForResponse(contextInfo, body, {
+            extraData: buildServiceExtraData(agentInfo, {
+                request: processedPluginData,
+                plugins: processedPluginData.plugins,
+            }),
+        });
         return c.json(processedResponse);
     });
     app.post("/contexts/:contextId", async (c) => {
         const autoContexts = app.oauth2?.getDirectProviderContexts?.() || [];
         const serviceSlug = (0, core_1.toSlug)(metadata.title);
         const skillsContext = config.skills?.getSkillsContext?.(serviceSlug);
-        const allContexts = [...contexts, ...autoContexts, ...(skillsContext ? [skillsContext] : [])];
+        const allContexts = [
+            ...contexts,
+            ...autoContexts,
+            ...(skillsContext ? [skillsContext] : []),
+        ];
         const context = allContexts.find((ctx) => ctx.id === c.req.param("contextId"));
         if (context) {
             const agentInfo = await getAgentInfo(c);
             const body = await safeParseBody(c);
             const processedPluginData = await processPluginsForRequest(body, agentInfo);
             const oauth2Client = app.oauth2?.getClient();
-            const contextData = await context.getContextData(agentInfo, {
+            const extraData = buildServiceExtraData(agentInfo, {
+                request: processedPluginData,
                 plugins: processedPluginData.plugins,
-                oauth2Client
+                oauth2Client,
             });
+            const contextData = await context.getContextData(agentInfo, extraData);
             const response = {
                 id: context.id,
                 name: context.name,
                 description: context.description,
-                data: contextData
+                data: contextData,
             };
-            const processedResponse = await processPluginsForResponse(response, body, { extraData: { plugins: processedPluginData.plugins } });
+            const processedResponse = await processPluginsForResponse(response, body, { extraData });
             return c.json(processedResponse);
         }
         else {
@@ -487,30 +726,42 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         const body = await safeParseBody(c);
         const processedPluginData = await processPluginsForRequest(body, agentInfo);
         const oauth2Client = app.oauth2?.getClient();
+        const extraData = buildServiceExtraData(agentInfo, {
+            request: processedPluginData,
+            plugins: processedPluginData.plugins,
+            oauth2Client,
+        });
         const autoContexts = app.oauth2?.getDirectProviderContexts?.() || [];
         const serviceSlug = (0, core_1.toSlug)(metadata.title);
         const skillsContext = config.skills?.getSkillsContext?.(serviceSlug);
-        const allContexts = [...contexts, ...autoContexts, ...(skillsContext ? [skillsContext] : [])];
+        const allContexts = [
+            ...contexts,
+            ...autoContexts,
+            ...(skillsContext ? [skillsContext] : []),
+        ];
         const contextsFull = await Promise.all(allContexts.map(async (ctx) => ({
             id: ctx.id,
             name: ctx.name,
             description: ctx.description,
-            data: await ctx.getContextData(agentInfo, {
-                plugins: processedPluginData.plugins,
-                oauth2Client
-            }),
+            data: await ctx.getContextData(agentInfo, extraData),
         })));
-        const processedResponse = await processPluginsForResponse(contextsFull, body, { extraData: { plugins: processedPluginData.plugins } });
+        const processedResponse = await processPluginsForResponse(contextsFull, body, { extraData });
         return c.json(processedResponse);
     });
     app.post("/widgets", async (c) => {
         const agentInfo = await getAgentInfo(c);
         const body = await safeParseBody(c);
         const processedPluginData = await processPluginsForRequest(body, agentInfo);
+        const extraData = buildServiceExtraData(agentInfo, {
+            request: processedPluginData,
+            plugins: processedPluginData.plugins,
+        });
         const widgetIds = config.getUserWidgets
-            ? await config.getUserWidgets(agentInfo, { plugins: processedPluginData.plugins })
-            : widgets.map(widget => widget.id);
-        const processedResponse = await processPluginsForResponse(widgetIds, body, { extraData: { plugins: processedPluginData.plugins } });
+            ? await config.getUserWidgets(agentInfo, extraData)
+            : widgets.map((widget) => widget.id);
+        const processedResponse = await processPluginsForResponse(widgetIds, body, {
+            extraData,
+        });
         return c.json(processedResponse);
     });
     app.post("/widgets/all", async (c) => {
@@ -518,18 +769,23 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         const body = await safeParseBody(c);
         const processedPluginData = await processPluginsForRequest(body, agentInfo);
         const widgetIds = config.getUserWidgets
-            ? await config.getUserWidgets(agentInfo, { plugins: processedPluginData.plugins })
-            : widgets.map(widget => widget.id);
+            ? await config.getUserWidgets(agentInfo, buildServiceExtraData(agentInfo, {
+                request: processedPluginData,
+                plugins: processedPluginData.plugins,
+            }))
+            : widgets.map((widget) => widget.id);
         const oauth2Client = app.oauth2?.getClient();
+        const extraData = buildServiceExtraData(agentInfo, {
+            request: processedPluginData,
+            plugins: processedPluginData.plugins,
+            oauth2Client,
+            app,
+        });
         const widgetsFull = await Promise.all(widgetIds.map(async (widgetId) => {
-            const widget = widgets.find(w => w.id === widgetId);
+            const widget = widgets.find((w) => w.id === widgetId);
             if (!widget)
                 return null;
-            const widgetData = await widget.getWidget(agentInfo, {
-                plugins: processedPluginData.plugins,
-                oauth2Client,
-                app
-            });
+            const widgetData = await widget.getWidget(agentInfo, extraData);
             const response = {
                 id: widget.id,
                 name: widget.name,
@@ -537,7 +793,7 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                 icon: widget.icon,
                 size: widget.size || "sm",
                 refreshIntervalMs: widget.refreshIntervalMs,
-                ...widgetData
+                ...widgetData,
             };
             if (!("freshness" in response)) {
                 response.freshness = {
@@ -551,13 +807,13 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
             }
             return response;
         }));
-        const validWidgets = widgetsFull.filter(w => w !== null);
-        const processedResponse = await processPluginsForResponse(validWidgets, body, { extraData: { plugins: processedPluginData.plugins } });
+        const validWidgets = widgetsFull.filter((w) => w !== null);
+        const processedResponse = await processPluginsForResponse(validWidgets, body, { extraData });
         return c.json(processedResponse);
     });
     app.post("/widgets/:widgetId", async (c) => {
         const widgetId = c.req.param("widgetId");
-        const widget = widgets.find(w => w.id === widgetId);
+        const widget = widgets.find((w) => w.id === widgetId);
         if (!widget) {
             throw new http_exception_1.HTTPException(404, { message: "Widget not found" });
         }
@@ -565,25 +821,34 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         const body = await safeParseBody(c);
         const processedPluginData = await processPluginsForRequest(body, agentInfo);
         if (config.getUserWidgets) {
+            const accessExtraData = buildServiceExtraData(agentInfo, {
+                request: processedPluginData,
+                plugins: processedPluginData.plugins,
+            });
             const userWidgetIds = await config.getUserWidgets(agentInfo, {
-                plugins: processedPluginData.plugins
+                ...accessExtraData,
             });
             let homeUIWidgetId = null;
             if (config.homeUI) {
-                homeUIWidgetId = typeof config.homeUI === 'string'
-                    ? config.homeUI
-                    : await config.homeUI(agentInfo, { plugins: processedPluginData.plugins });
+                homeUIWidgetId =
+                    typeof config.homeUI === "string"
+                        ? config.homeUI
+                        : await config.homeUI(agentInfo, accessExtraData);
             }
             if (!userWidgetIds.includes(widgetId) && widgetId !== homeUIWidgetId) {
-                throw new http_exception_1.HTTPException(403, { message: "Access denied to this widget" });
+                throw new http_exception_1.HTTPException(403, {
+                    message: "Access denied to this widget",
+                });
             }
         }
         const oauth2Client = app.oauth2?.getClient();
-        const widgetData = await widget.getWidget(agentInfo, {
+        const extraData = buildServiceExtraData(agentInfo, {
+            request: processedPluginData,
             plugins: processedPluginData.plugins,
             oauth2Client,
-            app
+            app,
         });
+        const widgetData = await widget.getWidget(agentInfo, extraData);
         const response = {
             id: widget.id,
             name: widget.name,
@@ -591,7 +856,7 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
             icon: widget.icon,
             size: widget.size || "sm",
             refreshIntervalMs: widget.refreshIntervalMs,
-            ...widgetData
+            ...widgetData,
         };
         if (!("freshness" in response)) {
             response.freshness = {
@@ -603,7 +868,9 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                 scope: "account",
             };
         }
-        const processedResponse = await processPluginsForResponse(response, body, { extraData: { plugins: processedPluginData.plugins } });
+        const processedResponse = await processPluginsForResponse(response, body, {
+            extraData,
+        });
         return c.json(processedResponse);
     });
     app.post("/homeUI", async (c) => {
@@ -613,17 +880,21 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         const agentInfo = await getAgentInfo(c);
         const body = await safeParseBody(c);
         const processedPluginData = await processPluginsForRequest(body, agentInfo);
-        const homeUIWidgetId = typeof config.homeUI === 'string'
+        const extraData = buildServiceExtraData(agentInfo, {
+            request: processedPluginData,
+            plugins: processedPluginData.plugins,
+        });
+        const homeUIWidgetId = typeof config.homeUI === "string"
             ? config.homeUI
-            : await config.homeUI(agentInfo, { plugins: processedPluginData.plugins });
+            : await config.homeUI(agentInfo, extraData);
         if (!homeUIWidgetId) {
             return c.json({ widgetId: null });
         }
-        const widget = widgets.find(w => w.id === homeUIWidgetId);
+        const widget = widgets.find((w) => w.id === homeUIWidgetId);
         if (!widget) {
             return c.json({ widgetId: null });
         }
-        const processedResponse = await processPluginsForResponse({ widgetId: homeUIWidgetId }, body, { extraData: { plugins: processedPluginData.plugins } });
+        const processedResponse = await processPluginsForResponse({ widgetId: homeUIWidgetId }, body, { extraData });
         return c.json(processedResponse);
     });
     function mapDatasourceInfo(datasource) {
@@ -648,14 +919,24 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         const agentInfo = await getAgentInfo(c);
         const body = await safeParseBody(c);
         const processedPluginData = await processPluginsForRequest(body, agentInfo);
-        const processedResponse = await processPluginsForResponse(datasources.map(mapDatasourceInfo), body, { extraData: { plugins: processedPluginData.plugins } });
+        const processedResponse = await processPluginsForResponse(datasources.map(mapDatasourceInfo), body, {
+            extraData: buildServiceExtraData(agentInfo, {
+                request: processedPluginData,
+                plugins: processedPluginData.plugins,
+            }),
+        });
         return c.json(processedResponse);
     });
     app.post("/datasources/all", async (c) => {
         const agentInfo = await getAgentInfo(c);
         const body = await safeParseBody(c);
         const processedPluginData = await processPluginsForRequest(body, agentInfo);
-        const processedResponse = await processPluginsForResponse(datasources.map(mapDatasourceInfo), body, { extraData: { plugins: processedPluginData.plugins } });
+        const processedResponse = await processPluginsForResponse(datasources.map(mapDatasourceInfo), body, {
+            extraData: buildServiceExtraData(agentInfo, {
+                request: processedPluginData,
+                plugins: processedPluginData.plugins,
+            }),
+        });
         return c.json(processedResponse);
     });
     app.post("/datasources/:datasourceId", async (c) => {
@@ -671,10 +952,12 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         try {
             const parsedParams = datasource.input.parse(params);
             const oauth2Client = app.oauth2?.getClient();
-            const data = await datasource.getDatasource(agentInfo, parsedParams, {
+            const extraData = buildServiceExtraData(agentInfo, {
+                request: params,
                 plugins: pluginsData,
-                oauth2Client
+                oauth2Client,
             });
+            const data = await datasource.getDatasource(agentInfo, parsedParams, extraData);
             const requestedPolicy = {
                 refreshIntervalMs: datasource.refreshIntervalMs,
                 maxStalenessMs: datasource.maxStalenessMs,
@@ -702,7 +985,7 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                     scope: datasource.scope,
                 },
             };
-            const processedResponse = await processPluginsForResponse(response, { plugins: pluginsData }, { extraData: { plugins: pluginsData } });
+            const processedResponse = await processPluginsForResponse(response, { plugins: pluginsData }, { extraData });
             return c.json(processedResponse);
         }
         catch (error) {
@@ -712,12 +995,23 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                     .join(", ");
                 return c.json({
                     error: `Missing or invalid parameters: ${missingParams}`,
-                    code: "INVALID_PARAMS"
+                    code: "INVALID_PARAMS",
                 }, 400);
             }
             throw error;
         }
     });
+    app.delete("/datasources/:datasourceId/stream/:streamId", async (c) => {
+        const datasourceId = c.req.param("datasourceId");
+        const streamId = c.req.param("streamId");
+        const streamKey = `${datasourceId}:${streamId}`;
+        const abortController = datasourceStreamAbortControllers.get(streamKey);
+        if (abortController) {
+            abortController.abort();
+            datasourceStreamAbortControllers.delete(streamKey);
+        }
+        return c.json({ success: true });
+    });
     // Stream datasource updates over SSE. This is primarily used for "fresh" UIs
     // (positions/orders) where clients want stream-first updates with a poll fallback.
     //
@@ -734,12 +1028,23 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
             typeof rawBody === "object" &&
             !Array.isArray(rawBody) &&
             "params" in rawBody;
-        const requestedIntervalMsRaw = hasWrappedParams ? rawBody.intervalMs : undefined;
-        const requestParamsRaw = hasWrappedParams ? rawBody.params : rawBody;
-        let params = await processPluginsForRequest(requestParamsRaw && typeof requestParamsRaw === "object" ? requestParamsRaw : {}, agentInfo);
-        const pluginsData = (params.plugins && typeof params.plugins === "object"
-            ? params.plugins
-            : {});
+        const requestedIntervalMsRaw = hasWrappedParams
+            ? rawBody.intervalMs
+            : undefined;
+        const requestedStreamIdRaw = hasWrappedParams
+            ? rawBody.streamId
+            : undefined;
+        const streamId = typeof requestedStreamIdRaw === "string" &&
+            /^[A-Za-z0-9._:-]{1,128}$/.test(requestedStreamIdRaw)
+            ? requestedStreamIdRaw
+            : null;
+        const requestParamsRaw = hasWrappedParams
+            ? rawBody.params
+            : rawBody;
+        let params = await processPluginsForRequest(requestParamsRaw && typeof requestParamsRaw === "object"
+            ? requestParamsRaw
+            : {}, agentInfo);
+        const pluginsData = (params.plugins && typeof params.plugins === "object" ? params.plugins : {});
         delete params.plugins;
         let parsedParams;
         try {
@@ -752,24 +1057,31 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                     .join(", ");
                 return c.json({
                     error: `Missing or invalid parameters: ${missingParams}`,
-                    code: "INVALID_PARAMS"
+                    code: "INVALID_PARAMS",
                 }, 400);
             }
             throw error;
         }
+        const oauth2Client = app.oauth2?.getClient();
+        const extraData = buildServiceExtraData(agentInfo, {
+            request: params,
+            plugins: pluginsData,
+            oauth2Client,
+        });
         const pluginRequestContext = hasWrappedParams
             ? {
                 params: parsedParams,
                 intervalMs: requestedIntervalMsRaw,
                 plugins: pluginsData,
+                DAIN_EXTRA_DATA: extraData,
             }
             : {
                 ...(typeof parsedParams === "object" && parsedParams !== null
                     ? parsedParams
                     : {}),
                 plugins: pluginsData,
+                DAIN_EXTRA_DATA: extraData,
             };
-        const oauth2Client = app.oauth2?.getClient();
         const requestedPolicy = {
             refreshIntervalMs: datasource.refreshIntervalMs,
             maxStalenessMs: datasource.maxStalenessMs,
@@ -778,23 +1090,35 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
             scope: datasource.scope,
             dataClass: datasource.dataClass,
         };
-        const requestedIntervalMs = typeof requestedIntervalMsRaw === "number" && Number.isFinite(requestedIntervalMsRaw) && requestedIntervalMsRaw > 0
+        const requestedIntervalMs = typeof requestedIntervalMsRaw === "number" &&
+            Number.isFinite(requestedIntervalMsRaw) &&
+            requestedIntervalMsRaw > 0
             ? requestedIntervalMsRaw
             : null;
         const baseIntervalMs = requestedIntervalMs ??
-            (typeof datasource.refreshIntervalMs === "number" && datasource.refreshIntervalMs > 0
+            (typeof datasource.refreshIntervalMs === "number" &&
+                datasource.refreshIntervalMs > 0
                 ? datasource.refreshIntervalMs
                 : 15_000);
         const intervalMs = Math.max(1_000, Math.floor(baseIntervalMs));
-        const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
         debugLog(`[SSE] Datasource ${datasource.id} stream start (${intervalMs}ms interval)`);
         return signedStreamSSE(c, privateKey, config, async (stream) => {
             let eventId = 0;
+            const signal = c.req.raw?.signal;
+            const streamAbortController = new AbortController();
+            const streamKey = streamId ? `${datasource.id}:${streamId}` : null;
+            if (streamKey) {
+                datasourceStreamAbortControllers.set(streamKey, streamAbortController);
+            }
+            const isCancelled = () => stream.isAborted() ||
+                signal?.aborted === true ||
+                streamAbortController.signal.aborted;
             const emitUpdate = async () => {
-                const data = await datasource.getDatasource(agentInfo, parsedParams, {
-                    plugins: pluginsData,
-                    oauth2Client,
-                });
+                if (isCancelled())
+                    return false;
+                const data = await datasource.getDatasource(agentInfo, parsedParams, extraData);
+                if (isCancelled())
+                    return false;
                 const response = {
                     id: datasource.id,
                     name: datasource.name,
@@ -814,51 +1138,81 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                         scope: datasource.scope,
                     },
                 };
-                const processedResponse = await processPluginsForResponse(response, pluginRequestContext, { extraData: { plugins: pluginsData } });
+                const processedResponse = await processPluginsForResponse(response, pluginRequestContext, { extraData });
+                if (isCancelled())
+                    return false;
                 await stream.writeSSE({
                     event: "datasource-update",
                     data: JSON.stringify(processedResponse),
                     id: String(eventId++),
                 });
+                return true;
             };
-            // Send initial snapshot immediately.
             try {
-                await emitUpdate();
-            }
-            catch (error) {
-                console.error(`[SSE] Datasource ${datasource.id} initial update failed:`, error);
-                if (!stream.isAborted()) {
-                    await stream.writeSSE({
-                        event: "error",
-                        data: JSON.stringify({ message: error?.message || "Datasource stream error" }),
-                    });
-                }
-                return;
-            }
-            // Continue sending updates until client disconnects.
-            // Hono exposes the underlying Request via c.req.raw, which includes an AbortSignal.
-            const signal = c.req.raw?.signal;
-            while (!stream.isAborted() && !signal?.aborted) {
-                await sleep(intervalMs);
-                if (stream.isAborted() || signal?.aborted)
-                    break;
+                // Send initial snapshot immediately.
                 try {
-                    await emitUpdate();
+                    const didEmitInitialUpdate = await emitUpdate();
+                    if (!didEmitInitialUpdate)
+                        return;
                 }
                 catch (error) {
-                    if (stream.isAborted() || signal?.aborted)
-                        break;
-                    console.error(`[SSE] Datasource ${datasource.id} update failed:`, error);
-                    // Keep the stream alive; clients should rely on poll fallback if needed.
-                    if (!stream.isAborted()) {
+                    console.error(`[SSE] Datasource ${datasource.id} initial update failed:`, error);
+                    if (!isCancelled()) {
                         await stream.writeSSE({
                             event: "error",
-                            data: JSON.stringify({ message: error?.message || "Datasource stream error" }),
+                            data: JSON.stringify({
+                                message: error?.message || "Datasource stream error",
+                            }),
                         });
                     }
+                    return;
+                }
+                // Continue sending updates until client disconnects.
+                // Hono exposes the underlying Request via c.req.raw, which includes an AbortSignal.
+                const abortPromise = new Promise((resolve) => {
+                    if (isCancelled()) {
+                        resolve();
+                        return;
+                    }
+                    stream.onAbort(() => resolve());
+                    signal?.addEventListener("abort", () => resolve(), { once: true });
+                    streamAbortController.signal.addEventListener("abort", () => resolve(), { once: true });
+                });
+                const sleepUntilNextUpdate = (ms) => Promise.race([
+                    new Promise((resolve) => setTimeout(resolve, ms)),
+                    abortPromise,
+                ]);
+                while (!isCancelled()) {
+                    await sleepUntilNextUpdate(intervalMs);
+                    if (isCancelled())
+                        break;
+                    try {
+                        const didEmitUpdate = await emitUpdate();
+                        if (!didEmitUpdate)
+                            break;
+                    }
+                    catch (error) {
+                        if (isCancelled())
+                            break;
+                        console.error(`[SSE] Datasource ${datasource.id} update failed:`, error);
+                        // Keep the stream alive; clients should rely on poll fallback if needed.
+                        if (!isCancelled()) {
+                            await stream.writeSSE({
+                                event: "error",
+                                data: JSON.stringify({
+                                    message: error?.message || "Datasource stream error",
+                                }),
+                            });
+                        }
+                    }
                 }
             }
-            debugLog(`[SSE] Datasource ${datasource.id} stream end`);
+            finally {
+                if (streamKey) {
+                    datasourceStreamAbortControllers.delete(streamKey);
+                }
+                debugLog(`[SSE] Datasource ${datasource.id} stream end`);
+            }
         });
     });
     function mapAgentInfo(agent) {
@@ -868,7 +1222,9 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
             context: agent.context,
             prompt: agent.prompt,
             resolveCondition: agent.resolveCondition,
-            serviceConnections: agent.serviceConnections || [process.env.BASE_URL || 'http://localhost:3000'],
+            serviceConnections: agent.serviceConnections || [
+                process.env.BASE_URL || "http://localhost:3000",
+            ],
             inputSchema: (0, schemaStructure_1.zodToJsonSchema)(agent.input),
             outputSchema: (0, schemaStructure_1.zodToJsonSchema)(agent.output),
         };
@@ -880,7 +1236,12 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         const agentInfo = await getAgentInfo(c);
         const body = await safeParseBody(c);
         const processedPluginData = await processPluginsForRequest(body, agentInfo);
-        const processedResponse = await processPluginsForResponse(agents.map(mapAgentInfo), body, { extraData: { plugins: processedPluginData.plugins } });
+        const processedResponse = await processPluginsForResponse(agents.map(mapAgentInfo), body, {
+            extraData: buildServiceExtraData(agentInfo, {
+                request: processedPluginData,
+                plugins: processedPluginData.plugins,
+            }),
+        });
         return c.json(processedResponse);
     });
     app.get("/agents/:agentId", (c) => {
@@ -898,18 +1259,25 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         const agentInfo = await getAgentInfo(c);
         const body = await safeParseBody(c);
         const processedPluginData = await processPluginsForRequest(body, agentInfo);
-        const processedResponse = await processPluginsForResponse(mapAgentInfo(agent), body, { extraData: { plugins: processedPluginData.plugins } });
+        const processedResponse = await processPluginsForResponse(mapAgentInfo(agent), body, {
+            extraData: buildServiceExtraData(agentInfo, {
+                request: processedPluginData,
+                plugins: processedPluginData.plugins,
+            }),
+        });
         return c.json(processedResponse);
     });
     function fixEmptySchemas(schema) {
-        if (!schema || typeof schema !== 'object')
+        if (!schema || typeof schema !== "object")
             return;
-        if (schema.properties && typeof schema.properties === 'object') {
+        if (schema.properties && typeof schema.properties === "object") {
             const props = schema.properties;
             for (const key of Object.keys(props)) {
                 const prop = props[key];
-                if (prop && typeof prop === 'object' && Object.keys(prop).length === 0) {
-                    props[key] = { type: 'object' };
+                if (prop &&
+                    typeof prop === "object" &&
+                    Object.keys(prop).length === 0) {
+                    props[key] = { type: "object" };
                 }
                 fixEmptySchemas(prop);
             }
@@ -922,10 +1290,10 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         let inputSchema = (0, schemaStructure_1.zodToJsonSchema)(tool.input);
         let outputSchema = (0, schemaStructure_1.zodToJsonSchema)(tool.output);
         if (!inputSchema.type) {
-            inputSchema = { ...inputSchema, type: 'object' };
+            inputSchema = { ...inputSchema, type: "object" };
         }
         if (!outputSchema.type) {
-            outputSchema = { ...outputSchema, type: 'object' };
+            outputSchema = { ...outputSchema, type: "object" };
         }
         fixEmptySchemas(inputSchema);
         fixEmptySchemas(outputSchema);
@@ -971,7 +1339,12 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                 reccomendedPrompts,
             }),
         };
-        const processedResponse = await processPluginsForResponse(response, body, { extraData: { plugins: processedPluginData.plugins } });
+        const processedResponse = await processPluginsForResponse(response, body, {
+            extraData: buildServiceExtraData(agentInfo, {
+                request: processedPluginData,
+                plugins: processedPluginData.plugins,
+            }),
+        });
         return c.json(processedResponse);
     });
     // Webhook triggers endpoint
@@ -987,11 +1360,9 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
     // Configure trigger forwarding (uses HITL config for automation API)
     if (config.webhookTriggers) {
         // Resolve automation API URL (priority: hitl config > env)
-        const automationApiUrl = config.hitl?.automationApiUrl ||
-            process.env.AUTOMATION_API_URL;
+        const automationApiUrl = config.hitl?.automationApiUrl || process.env.AUTOMATION_API_URL;
         // Resolve API key
-        const automationApiKey = config.hitl?.automationApiKey ||
-            process.env.AUTOMATION_API_KEY;
+        const automationApiKey = config.hitl?.automationApiKey || process.env.AUTOMATION_API_KEY;
         // Resolve service URL (priority: oauth2.baseUrl > env)
         const serviceUrl = config.oauth2?.baseUrl ||
             process.env.SERVICE_BASE_URL ||
@@ -1014,10 +1385,12 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                         try {
                             const registerUrl = `${automationApiUrl}/webhooks/register-triggers`;
                             const response = await fetch(registerUrl, {
-                                method: 'POST',
+                                method: "POST",
                                 headers: {
-                                    'Content-Type': 'application/json',
-                                    ...(automationApiKey ? { 'Authorization': `Bearer ${automationApiKey}` } : {}),
+                                    "Content-Type": "application/json",
+                                    ...(automationApiKey
+                                        ? { Authorization: `Bearer ${automationApiKey}` }
+                                        : {}),
                                 },
                                 body: JSON.stringify({
                                     serviceUrl,
@@ -1042,10 +1415,10 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         }
         else {
             if (!automationApiUrl) {
-                console.warn('[Webhook] Trigger forwarding disabled: missing automationApiUrl (set hitl.automationApiUrl or AUTOMATION_API_URL)');
+                console.warn("[Webhook] Trigger forwarding disabled: missing automationApiUrl (set hitl.automationApiUrl or AUTOMATION_API_URL)");
             }
             if (!serviceUrl) {
-                console.warn('[Webhook] Trigger forwarding disabled: missing serviceUrl (set oauth2.baseUrl or SERVICE_BASE_URL)');
+                console.warn("[Webhook] Trigger forwarding disabled: missing serviceUrl (set oauth2.baseUrl or SERVICE_BASE_URL)");
             }
         }
     }
@@ -1070,7 +1443,7 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                             success: true,
                             triggerId: result.triggerId,
                             triggerName: result.triggerName,
-                            data: result.data
+                            data: result.data,
                         });
                     }
                     else {
@@ -1078,7 +1451,7 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                         // No trigger matched - return 200 OK but with success: false
                         return c.json({
                             success: false,
-                            message: 'No trigger matched'
+                            message: "No trigger matched",
                         }, 200);
                     }
                 }
@@ -1086,22 +1459,22 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                     console.error(`[Webhook] Error processing webhook at ${path}:`, error);
                     // Return error response
                     throw new http_exception_1.HTTPException(500, {
-                        message: `Webhook processing failed: ${error.message}`
+                        message: `Webhook processing failed: ${error.message}`,
                     });
                 }
             });
         }
-        console.log(`[Webhook] Registered ${webhookPaths.length} webhook endpoint(s): ${webhookPaths.join(', ')}`);
+        console.log(`[Webhook] Registered ${webhookPaths.length} webhook endpoint(s): ${webhookPaths.join(", ")}`);
     }
     // Auto-register HITL action webhook
     if (config.hitl?.enabled) {
-        const hitlPath = config.hitl.webhookPath || '/actions';
+        const hitlPath = config.hitl.webhookPath || "/actions";
         const automationApiUrl = config.hitl.automationApiUrl ||
             process.env.AUTOMATION_API_URL ||
-            'http://localhost:3000';
+            "http://localhost:3000";
         const automationApiKey = config.hitl.automationApiKey || process.env.AUTOMATION_API_KEY;
         if (!automationApiUrl) {
-            console.warn('[HITL] Enabled but missing automationApiUrl - HITL webhook will not work correctly');
+            console.warn("[HITL] Enabled but missing automationApiUrl - HITL webhook will not work correctly");
         }
         const hitlHandler = new hitl_1.HITLHandler({
             automationApiUrl,
@@ -1112,19 +1485,19 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
             try {
                 const body = await c.req.json();
                 const { action, context } = body;
-                if (!action || typeof action !== 'string') {
+                if (!action || typeof action !== "string") {
                     throw new http_exception_1.HTTPException(400, {
                         message: 'Missing or invalid "action" field in request body',
                     });
                 }
-                if (!context || typeof context !== 'object') {
+                if (!context || typeof context !== "object") {
                     throw new http_exception_1.HTTPException(400, {
                         message: 'Missing or invalid "context" field in request body',
                     });
                 }
                 if (!hitlHandler.isValidAction(action)) {
                     throw new http_exception_1.HTTPException(400, {
-                        message: 'Invalid action format. Expected: scope:id:action[:payload]',
+                        message: "Invalid action format. Expected: scope:id:action[:payload]",
                     });
                 }
                 const result = await hitlHandler.handleAction(action, context);
@@ -1134,7 +1507,7 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                 if (error instanceof http_exception_1.HTTPException) {
                     throw error;
                 }
-                console.error('[HITL] Error processing action:', error);
+                console.error("[HITL] Error processing action:", error);
                 throw new http_exception_1.HTTPException(500, {
                     message: `Action processing failed: ${error.message}`,
                 });
@@ -1246,7 +1619,7 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                 const oauthTool = (0, core_1.createOAuth2Tool)(providerName, serviceSlug, {
                     logoUrl: providerConfig.logoUrl,
                     reason: providerConfig.reason,
-                    requiredTools: providerConfig.requiredTools
+                    requiredTools: providerConfig.requiredTools,
                 });
                 autoOAuth2Tools.push(oauthTool);
             });
@@ -1276,11 +1649,17 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
             }
             try {
                 await app.oauth2.handleCallback(code, state);
-                return c.html("<html><body><script>window.opener.postMessage({ type: 'oauth2-success', provider: '" + provider + "' }, '*');window.close();</script><h1>Authentication successful! You can close this window.</h1></body></html>");
+                return c.html("<html><body><script>window.opener.postMessage({ type: 'oauth2-success', provider: '" +
+                    provider +
+                    "' }, '*');window.close();</script><h1>Authentication successful! You can close this window.</h1></body></html>");
             }
             catch (error) {
                 console.error("OAuth callback error:", error);
-                return c.html("<html><body><script>window.opener.postMessage({ type: 'oauth2-error', provider: '" + provider + "', error: '" + error.message + "' }, '*');window.close();</script><h1>Authentication failed! You can close this window.</h1></body></html>");
+                return c.html("<html><body><script>window.opener.postMessage({ type: 'oauth2-error', provider: '" +
+                    provider +
+                    "', error: '" +
+                    error.message +
+                    "' }, '*');window.close();</script><h1>Authentication failed! You can close this window.</h1></body></html>");
             }
         });
         // Make oauth2Handler available to tools
@@ -1299,7 +1678,9 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         }
         catch (error) {
             if (error.message === "Unauthorized access to process") {
-                throw new http_exception_1.HTTPException(403, { message: "Unauthorized access to process" });
+                throw new http_exception_1.HTTPException(403, {
+                    message: "Unauthorized access to process",
+                });
             }
             throw error;
         }
@@ -1315,7 +1696,7 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         const providersWithStatus = await Promise.all(providers.map(async ({ name, config }) => ({
             name,
             config,
-            connected: await app.oauth2.hasValidTokens(name, agentInfo.id)
+            connected: await app.oauth2.hasValidTokens(name, agentInfo.id),
         })));
         return c.json(providersWithStatus);
     });
@@ -1332,7 +1713,7 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
     app.get("/oauth2/connect/:provider", async (c) => {
         debugLog("[OAuth2 Connect] Route hit - START");
         debugLog("[OAuth2 Connect] Provider param:", c.req.param("provider"));
-        debugLog("[OAuth2 Connect] Auth method:", c.get('authMethod'));
+        debugLog("[OAuth2 Connect] Auth method:", c.get("authMethod"));
         debugLog("[OAuth2 Connect] Headers:", {
             authorization: c.req.header("Authorization"),
             apiKey: c.req.header("X-DAIN-API-KEY"),
@@ -1363,7 +1744,7 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         catch (error) {
             debugLog("[OAuth2 Connect] ERROR generating auth URL:", error);
             throw new http_exception_1.HTTPException(400, {
-                message: `Invalid provider: ${provider}`
+                message: `Invalid provider: ${provider}`,
             });
         }
     });
@@ -1381,8 +1762,8 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         if (isComplete) {
             const config = await setupManager.getProviderConfig(agentInfo.id, provider);
             return c.json({
-                status: 'complete',
-                config: config ? { configuredAt: config.configuredAt } : undefined
+                status: "complete",
+                config: config ? { configuredAt: config.configuredAt } : undefined,
             });
         }
         // Check if there's a pending setup
@@ -1390,15 +1771,15 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         if (pendingSetup) {
             const expiresIn = Math.max(0, Math.floor((pendingSetup.expiresAt - Date.now()) / 1000));
             return c.json({
-                status: 'authorization_pending',
+                status: "authorization_pending",
                 expires_in: expiresIn,
-                interval: 5 // Poll every 5 seconds
+                interval: 5, // Poll every 5 seconds
             });
         }
         // No setup in progress
         return c.json({
-            status: 'not_found',
-            error: 'No setup in progress for this provider'
+            status: "not_found",
+            error: "No setup in progress for this provider",
         });
     });
     // Get all human actions for a process
@@ -1411,13 +1792,15 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         }
         if (process.agentId !== agentInfo.id) {
             debugLog("Unauthorized access to process", process.agentId, agentInfo.id);
-            throw new http_exception_1.HTTPException(403, { message: "Unauthorized access to process" });
+            throw new http_exception_1.HTTPException(403, {
+                message: "Unauthorized access to process",
+            });
         }
         return c.json(process.humanActions);
     });
     // Get specific human action
     app.get("/processes/:processId/human-actions/:stepId", async (c) => {
-        debugLog('GET human action request:', c.req.path);
+        debugLog("GET human action request:", c.req.path);
         const processId = c.req.param("processId");
         const stepId = c.req.param("stepId");
         const agentInfo = await getAgentInfo(c);
@@ -1427,7 +1810,9 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         }
         if (process.agentId !== agentInfo.id) {
             debugLog("Unauthorized access to process", process.agentId, agentInfo.id);
-            throw new http_exception_1.HTTPException(403, { message: "Unauthorized access to process" });
+            throw new http_exception_1.HTTPException(403, {
+                message: "Unauthorized access to process",
+            });
         }
         const step = await app.processes.checkHumanAction(processId, stepId);
         if (!step) {
@@ -1446,7 +1831,9 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         }
         if (process.agentId !== agentInfo.id) {
             debugLog("Unauthorized access to process", process.agentId, agentInfo.id);
-            throw new http_exception_1.HTTPException(403, { message: "Unauthorized access to process" });
+            throw new http_exception_1.HTTPException(403, {
+                message: "Unauthorized access to process",
+            });
         }
         const body = await c.req.json();
         const { actionId, responseText, data } = body;
@@ -1477,7 +1864,9 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         }
         catch (error) {
             console.error(`Error generating confirmation UI for tool ${tool.id}:`, error);
-            throw new http_exception_1.HTTPException(500, { message: "Error generating confirmation UI" });
+            throw new http_exception_1.HTTPException(500, {
+                message: "Error generating confirmation UI",
+            });
         }
     });
     app.get("/exampleQueries", (c) => {
@@ -1487,7 +1876,12 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         const agentInfo = await getAgentInfo(c);
         const body = await safeParseBody(c);
         const processedPluginData = await processPluginsForRequest(body, agentInfo);
-        const processedResponse = await processPluginsForResponse(config.exampleQueries || [], body, { extraData: { plugins: processedPluginData.plugins } });
+        const processedResponse = await processPluginsForResponse(config.exampleQueries || [], body, {
+            extraData: buildServiceExtraData(agentInfo, {
+                request: processedPluginData,
+                plugins: processedPluginData.plugins,
+            }),
+        });
         return c.json(processedResponse);
     });
     // Services list endpoint
@@ -1508,7 +1902,10 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
     // Toolboxes list endpoint
     app.get("/toolboxes", (c) => c.json(toolboxes));
     function normalizeRecommendationText(value) {
-        return value.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+        return value
+            .toLowerCase()
+            .replace(/[^a-z0-9]+/g, " ")
+            .trim();
     }
     function tokenizeRecommendationQuery(query) {
         const normalized = normalizeRecommendationText(query);
@@ -1527,7 +1924,9 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                     throw new Error(`Duplicate recommendation card ID "${scopedCardId}". Card IDs must be unique per tool.`);
                 }
                 const isDynamic = !!card.inputSchema;
-                const inputSchema = isDynamic ? (0, schemaStructure_1.zodToJsonSchema)(card.inputSchema) : undefined;
+                const inputSchema = isDynamic
+                    ? (0, schemaStructure_1.zodToJsonSchema)(card.inputSchema)
+                    : undefined;
                 const searchText = normalizeRecommendationText([tool.id, tool.name, card.id, ...card.tags].join(" "));
                 index.set(scopedCardId, {
                     cardId: scopedCardId,
@@ -1589,7 +1988,7 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                 details: parsed.error.format(),
             }, 400);
         }
-        const { query, limit, toolIds, includeStaticUI, } = parsed.data;
+        const { query, limit, toolIds, includeStaticUI } = parsed.data;
         const toolIdSet = toolIds?.length ? new Set(toolIds) : null;
         const filteredCards = Array.from(recommendationCardsById.values()).filter((card) => !toolIdSet || toolIdSet.has(card.toolId));
         const tokens = tokenizeRecommendationQuery(query ?? "");
@@ -1625,7 +2024,12 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
             count: cards.length,
             query,
         };
-        const processedResponse = await processPluginsForResponse(response, body, { extraData: { plugins: processedPluginData.plugins } });
+        const processedResponse = await processPluginsForResponse(response, body, {
+            extraData: buildServiceExtraData(agentInfo, {
+                request: processedPluginData,
+                plugins: processedPluginData.plugins,
+            }),
+        });
         return c.json(processedResponse);
     });
     const recommendationRenderSchema = zod_1.z.object({
@@ -1717,7 +2121,9 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                 renderErrors.push({
                     cardId: card.cardId,
                     code: "render_failed",
-                    message: error instanceof Error ? error.message : "Failed to render recommendation card",
+                    message: error instanceof Error
+                        ? error.message
+                        : "Failed to render recommendation card",
                 });
                 if (!continueOnError)
                     break;
@@ -1729,7 +2135,12 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
             renderedCount: renderedCards.length,
             requestedCount: requestedCards.length,
         };
-        const processedResponse = await processPluginsForResponse(response, body, { extraData: { plugins: processedPluginData.plugins } });
+        const processedResponse = await processPluginsForResponse(response, body, {
+            extraData: buildServiceExtraData(agentInfo, {
+                request: processedPluginData,
+                plugins: processedPluginData.plugins,
+            }),
+        });
         const statusCode = !continueOnError && renderErrors.length > 0 ? 400 : 200;
         return c.json(processedResponse, statusCode);
     });
@@ -1740,17 +2151,57 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         if (!processedRequest.plugins) {
             processedRequest.plugins = {};
         }
+        processedRequest.DAIN_EXTRA_DATA = buildServiceExtraData(agentInfo, {
+            request: processedRequest,
+            plugins: processedRequest.plugins,
+        });
         // Auto-inject smartAccountPDA into CryptoPlugin wallet context for automations
         // This allows automation wallets to work seamlessly without manual configuration
         if (agentInfo.smartAccountPDA) {
-            // Only inject if wallets aren't already provided (client can override)
-            if (!processedRequest.plugins['crypto-plugin']?.wallets) {
-                processedRequest.plugins['crypto-plugin'] = processedRequest.plugins['crypto-plugin'] || {};
-                processedRequest.plugins['crypto-plugin'].wallets = [
-                    { chain: 'sol', address: agentInfo.smartAccountPDA }
+            processedRequest.plugins["crypto-plugin"] =
+                processedRequest.plugins["crypto-plugin"] || {};
+            const cryptoData = isRecord(processedRequest.plugins["crypto-plugin"])
+                ? stripRuntimeContextFields(processedRequest.plugins["crypto-plugin"])
+                : {};
+            processedRequest.plugins["crypto-plugin"] = cryptoData;
+            const smartAccountWallet = {
+                chain: "sol",
+                address: agentInfo.smartAccountPDA,
+                accountId: agentInfo.dainAccountId ?? agentInfo.dainGroupId,
+                kind: "smart_account_vault",
+                capabilities: ["solana-smart-account"],
+            };
+            if (Array.isArray(cryptoData.wallets)) {
+                const hasSmartAccountWallet = cryptoData.wallets.some((wallet) => isRecord(wallet) &&
+                    wallet.chain === "sol" &&
+                    wallet.address === agentInfo.smartAccountPDA);
+                if (!hasSmartAccountWallet) {
+                    cryptoData.wallets = [smartAccountWallet, ...cryptoData.wallets];
+                }
+            }
+            else if (isRecord(cryptoData.wallets)) {
+                cryptoData.wallets = [
+                    smartAccountWallet,
+                    ...Object.entries(cryptoData.wallets).map(([chain, address]) => ({
+                        chain,
+                        address: String(address),
+                    })),
                 ];
             }
+            else {
+                cryptoData.wallets = [smartAccountWallet];
+            }
         }
+        if (processedRequest.plugins["crypto-plugin"]) {
+            processedRequest.plugins["crypto-plugin"] = {
+                ...stripRuntimeContextFields(processedRequest.plugins["crypto-plugin"]),
+                ...getRuntimeContextFromAgentInfo(agentInfo),
+            };
+        }
+        processedRequest.DAIN_EXTRA_DATA = buildServiceExtraData(agentInfo, {
+            request: processedRequest,
+            plugins: processedRequest.plugins,
+        });
         // Process plugins if configured
         if (!config.plugins || config.plugins.length === 0) {
             return processedRequest;
@@ -1760,6 +2211,10 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                 processedRequest = await plugin.processInputService(processedRequest);
             }
         }
+        processedRequest.DAIN_EXTRA_DATA = buildServiceExtraData(agentInfo, {
+            request: processedRequest,
+            plugins: processedRequest.plugins,
+        });
         return processedRequest;
     }
     // Process response with plugins
@@ -1769,6 +2224,11 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         }
         let processedResponse = { ...response };
         processedResponse.plugins = processedResponse.plugins || {};
+        const extraData = isRecord(context?.extraData)
+            ? context.extraData
+            : isRecord(context)
+                ? context
+                : {};
         for (const plugin of config.plugins) {
             if (plugin.processOutputService) {
                 // Provide context to the plugin
@@ -1776,8 +2236,8 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                     ...processedResponse,
                     context: {
                         request,
-                        extraData: context
-                    }
+                        extraData,
+                    },
                 });
                 if (pluginOutput) {
                     processedResponse.plugins[plugin.id] = pluginOutput;
@@ -1787,6 +2247,31 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
         return processedResponse;
     }
     // Automatically create routes for each tool
+    function buildToolContext(agentInfo, request, pluginsData, hooks = {}) {
+        const oauth2Client = app.oauth2 ? app.oauth2.getClient() : undefined;
+        const extraData = buildServiceExtraData(agentInfo, {
+            request,
+            plugins: pluginsData,
+            oauth2Client,
+            app,
+        });
+        const runtimeContext = getRuntimeContextFromAgentInfo(agentInfo);
+        return {
+            app,
+            oauth2Client,
+            extraData,
+            dainAccountId: runtimeContext.dainAccountId ?? extraData.dainAccountId,
+            dainGroupId: runtimeContext.dainGroupId ?? extraData.dainGroupId,
+            smartAccountPDA: runtimeContext.smartAccountPDA ?? extraData.smartAccountPDA,
+            account: runtimeContext.account ?? extraData.account,
+            group: runtimeContext.group ?? extraData.group,
+            auth: runtimeContext.auth ?? extraData.auth,
+            grants: runtimeContext.grants ?? extraData.grants,
+            dataPermissions: runtimeContext.dataPermissions ?? extraData.dataPermissions,
+            registryPolicy: runtimeContext.registryPolicy ?? extraData.registryPolicy,
+            ...hooks,
+        };
+    }
     tools.forEach((tool) => {
         /**
          * Shared handler for tool execution with streaming support
@@ -1800,27 +2285,25 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                 return signedStreamSSE(c, privateKey, config, async (stream) => {
                     try {
                         // Execute the tool first
-                        debugLog(`[SSE] Executing tool ${tool.id} in streaming mode${withContext ? ' with context' : ''}`);
-                        const result = await tool.handler({ ...body, DAIN_EXTRA_DATA: undefined }, agentInfo, {
-                            app,
-                            oauth2Client: app.oauth2 ? app.oauth2.getClient() : undefined,
-                            extraData: {
-                                ...body.DAIN_EXTRA_DATA,
-                                plugins: pluginsData
-                            },
+                        debugLog(`[SSE] Executing tool ${tool.id} in streaming mode${withContext ? " with context" : ""}`);
+                        const { DAIN_EXTRA_DATA: _dainExtraData, ...toolInput } = body;
+                        const result = await tool.handler(toolInput, agentInfo, buildToolContext(agentInfo, body, pluginsData, {
                             updateUI: async (update) => {
                                 try {
                                     // Check if this is a progress update
-                                    if (update.type === 'progress') {
+                                    if (update.type === "progress") {
                                         await stream.writeSSE({
-                                            event: 'progress',
-                                            data: JSON.stringify({ text: update.text, data: update.data }),
+                                            event: "progress",
+                                            data: JSON.stringify({
+                                                text: update.text,
+                                                data: update.data,
+                                            }),
                                         });
                                     }
                                     else {
                                         // Legacy UI page updates for Canvas rendering
                                         await stream.writeSSE({
-                                            event: 'uipage-update',
+                                            event: "uipage-update",
                                             data: JSON.stringify(update),
                                         });
                                     }
@@ -1832,7 +2315,7 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                             addProcess: async (processId) => {
                                 try {
                                     await stream.writeSSE({
-                                        event: 'process-created',
+                                        event: "process-created",
                                         data: JSON.stringify({ processId }),
                                         id: Date.now().toString(),
                                     });
@@ -1840,8 +2323,8 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                                 catch (error) {
                                     console.error(`Error sending process update in ${tool.id}:`, error);
                                 }
-                            }
-                        });
+                            },
+                        }));
                         // If we need to include context data
                         let response = result;
                         if (withContext) {
@@ -1856,8 +2339,13 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                                             name: context.name,
                                             description: context.description,
                                             data: await context.getContextData(agentInfo, {
-                                                plugins: pluginsData,
-                                                oauth2Client: app.oauth2 ? app.oauth2.getClient() : undefined
+                                                ...buildServiceExtraData(agentInfo, {
+                                                    request: body,
+                                                    plugins: pluginsData,
+                                                    oauth2Client: app.oauth2
+                                                        ? app.oauth2.getClient()
+                                                        : undefined,
+                                                }),
                                             }),
                                         };
                                     }
@@ -1875,11 +2363,11 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                                 // Use Promise.allSettled to continue even if some contexts fail
                                 const settledContexts = await Promise.allSettled(contextPromises);
                                 contextsNow = settledContexts
-                                    .filter(result => result.status === 'fulfilled')
-                                    .map(result => result.value);
-                                // Log any rejected promises  
+                                    .filter((result) => result.status === "fulfilled")
+                                    .map((result) => result.value);
+                                // Log any rejected promises
                                 settledContexts
-                                    .filter(result => result.status === 'rejected')
+                                    .filter((result) => result.status === "rejected")
                                     .forEach((result, index) => {
                                     console.error(`Context at index ${index} failed:`, result.reason);
                                 });
@@ -1900,12 +2388,12 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                         const processedResult = await processPluginsForResponse(response, body, {
                             extraData: {
                                 ...body.DAIN_EXTRA_DATA,
-                                plugins: pluginsData
-                            }
+                                plugins: pluginsData,
+                            },
                         });
                         // Send the final result
                         await stream.writeSSE({
-                            event: 'result',
+                            event: "result",
                             data: JSON.stringify(processedResult),
                             id: Date.now().toString(),
                         });
@@ -1917,13 +2405,13 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                         try {
                             if (withContext) {
                                 await stream.writeSSE({
-                                    event: 'result',
+                                    event: "result",
                                     data: JSON.stringify({
                                         toolResult: {
                                             error: safeMsg,
                                             text: `Error: ${safeMsg}`,
                                             data: null,
-                                            ui: null
+                                            ui: null,
                                         },
                                         context: [],
                                     }),
@@ -1932,12 +2420,12 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                             }
                             else {
                                 await stream.writeSSE({
-                                    event: 'result',
+                                    event: "result",
                                     data: JSON.stringify({
                                         error: safeMsg,
                                         text: `Error: ${safeMsg}`,
                                         data: null,
-                                        ui: null
+                                        ui: null,
                                     }),
                                     id: Date.now().toString(),
                                 });
@@ -1957,17 +2445,15 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                     const uiUpdates = [];
                     const progressUpdates = [];
                     const processes = [];
-                    const result = await tool.handler({ ...body, DAIN_EXTRA_DATA: undefined }, agentInfo, {
-                        app,
-                        oauth2Client: app.oauth2 ? app.oauth2.getClient() : undefined,
-                        extraData: {
-                            ...body.DAIN_EXTRA_DATA,
-                            plugins: pluginsData
-                        },
+                    const { DAIN_EXTRA_DATA: _dainExtraData, ...toolInput } = body;
+                    const result = await tool.handler(toolInput, agentInfo, buildToolContext(agentInfo, body, pluginsData, {
                         updateUI: (update) => {
                             // Collect UI updates instead of streaming them (synchronous for performance)
-                            if (update.type === 'progress') {
-                                progressUpdates.push({ text: update.text, data: update.data });
+                            if (update.type === "progress") {
+                                progressUpdates.push({
+                                    text: update.text,
+                                    data: update.data,
+                                });
                             }
                             else {
                                 uiUpdates.push(update);
@@ -1978,8 +2464,8 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                             // Collect process IDs (synchronous for performance)
                             processes.push(processId);
                             return Promise.resolve();
-                        }
-                    });
+                        },
+                    }));
                     // If we need to include context data
                     let response = result;
                     if (withContext) {
@@ -1990,8 +2476,13 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                                 name: context.name,
                                 description: context.description,
                                 data: await context.getContextData(agentInfo, {
-                                    plugins: pluginsData,
-                                    oauth2Client: app.oauth2 ? app.oauth2.getClient() : undefined
+                                    ...buildServiceExtraData(agentInfo, {
+                                        request: body,
+                                        plugins: pluginsData,
+                                        oauth2Client: app.oauth2
+                                            ? app.oauth2.getClient()
+                                            : undefined,
+                                    }),
                                 }),
                             })));
                             // Create the complete response with context
@@ -2013,15 +2504,15 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                     const processedResult = await processPluginsForResponse(response, body, {
                         extraData: {
                             ...body.DAIN_EXTRA_DATA,
-                            plugins: pluginsData
-                        }
+                            plugins: pluginsData,
+                        },
                     });
                     // Add collected updates to response for non-streaming clients
                     const finalResponse = {
                         ...processedResult,
                         _updates: uiUpdates.length > 0 ? uiUpdates : undefined,
                         _progress: progressUpdates.length > 0 ? progressUpdates : undefined,
-                        _processes: processes.length > 0 ? processes : undefined
+                        _processes: processes.length > 0 ? processes : undefined,
                     };
                     return c.json(finalResponse);
                 }
@@ -2036,7 +2527,7 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                                 error: safeMsg,
                                 text: `Error: ${safeMsg}`,
                                 data: null,
-                                ui: null
+                                ui: null,
                             },
                             context: [],
                         };
@@ -2046,7 +2537,7 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                             error: safeMsg,
                             text: `Error: ${safeMsg}`,
                             data: null,
-                            ui: null
+                            ui: null,
                         };
                     }
                     // We return status 200 with error details in the body
@@ -2060,7 +2551,7 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
             debugLog(`[Tool ${tool.id}] ========== TOOL EXECUTION START ==========`);
             debugLog(`[Tool ${tool.id}] Path: ${c.req.path}`);
             debugLog(`[Tool ${tool.id}] Method: ${c.req.method}`);
-            debugLog(`[Tool ${tool.id}] Auth Method: ${c.get('authMethod')}`);
+            debugLog(`[Tool ${tool.id}] Auth Method: ${c.get("authMethod")}`);
             debugLog(`[Tool ${tool.id}] Headers:`, {
                 authorization: c.req.header("Authorization") ? "Bearer ***" : undefined,
                 apiKey: c.req.header("X-DAIN-API-KEY") ? "***" : undefined,
@@ -2097,7 +2588,7 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
             debugLog(`[Tool ${tool.id} +Context] ========== TOOL EXECUTION START (WITH CONTEXT) ==========`);
             debugLog(`[Tool ${tool.id} +Context] Path: ${c.req.path}`);
             debugLog(`[Tool ${tool.id} +Context] Method: ${c.req.method}`);
-            debugLog(`[Tool ${tool.id} +Context] Auth Method: ${c.get('authMethod')}`);
+            debugLog(`[Tool ${tool.id} +Context] Auth Method: ${c.get("authMethod")}`);
             debugLog(`[Tool ${tool.id} +Context] Headers:`, {
                 authorization: c.req.header("Authorization") ? "Bearer ***" : undefined,
                 apiKey: c.req.header("X-DAIN-API-KEY") ? "***" : undefined,
@@ -2130,7 +2621,7 @@ function setupHttpServer(config, tools, services, toolboxes, metadata, privateKe
                 console.error(`[Tool ${tool.id} +Context] Stack:`, error?.stack);
                 throw new http_exception_1.HTTPException(500, {
                     message: error?.message || "Internal server error",
-                    cause: error
+                    cause: error,
                 });
             }
         });