@frontmcp/adapters 1.1.2 → 1.2.1

package/skills/security/bundle-signature.d.ts

@@ -0,0 +1,44 @@
+import type { BundleIntegrity, ResolvedBundle } from '../bundle/bundle.types';
+import type { SignatureKey } from '../source-options';
+export type SignatureVerifyResult = {
+    ok: true;
+    keyId: string;
+    alg: BundleIntegrity['alg'];
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Minimal telemetry surface for signature verification failures. Structurally
+ * compatible with `@frontmcp/observability`'s `TelemetryAccessor` so callers
+ * can pass that directly, while keeping this module dependency-free.
+ */
+export interface SignatureVerifyCounter {
+    inc(by?: number, attributes?: Record<string, string>): void;
+}
+export interface SignatureVerifyTelemetry {
+    createCounter(name: string, description?: string): SignatureVerifyCounter;
+}
+/**
+ * Stable JSON canonicalization for signing: sorted object keys, no whitespace.
+ * Matches RFC 8785 (JCS) for our subset (no floats with weird precision).
+ */
+export declare function canonicalize(value: unknown): string;
+/** sha256 hex digest of the canonical bytes of an object (minus integrity). */
+export declare function bundleDigest(bundle: ResolvedBundle): string;
+/**
+ * Verify an integrity envelope against a set of trusted keys.
+ *
+ * Verification flow:
+ *   1. Re-compute the canonical digest of the bundle (excluding `integrity`).
+ *   2. Reject if the computed digest does not match the envelope's `digest`.
+ *   3. Look up the trusted key by `keyId`. Reject if unknown.
+ *   4. Reject if the key's `alg` does not match the envelope's `alg`.
+ *   5. Verify the signature over the canonical bytes (NOT the digest hex)
+ *      using the public key.
+ *
+ * Returns a structured ok/reason envelope. Callers MUST refuse to apply the
+ * bundle on `ok: false`.
+ */
+export declare function verifyBundleSignature(bundle: ResolvedBundle, trustedKeys: SignatureKey[], telemetry?: SignatureVerifyTelemetry): SignatureVerifyResult;
+//# sourceMappingURL=bundle-signature.d.ts.map

package/skills/security/bundle-signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-signature.d.ts","sourceRoot":"","sources":["../../../src/skills/security/bundle-signature.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,eAAe,CAAC,KAAK,CAAC,CAAA;CAAE,GACxD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CAC7D;AACD,MAAM,WAAW,wBAAwB;IACvC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,sBAAsB,CAAC;CAC3E;AAmBD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUnD;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAI3D;AAeD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,cAAc,EACtB,WAAW,EAAE,YAAY,EAAE,EAC3B,SAAS,CAAC,EAAE,wBAAwB,GACnC,qBAAqB,CAoEvB"}

package/skills/security/jwt-verifier.d.ts

@@ -0,0 +1,38 @@
+import { JwksService } from '@frontmcp/auth';
+import type { FrontMcpLogger } from '@frontmcp/sdk';
+export interface BundlePushJwtVerifierOptions {
+    /** SaaS issuer URL (matched against `iss`). */
+    expectedIssuer: string;
+    /** Audience the token must encode (RFC 8707 `aud` claim). */
+    expectedAudience: string;
+    /**
+     * RFC 8707 resource indicator the token must encode (matches the FrontMCP
+     * server's canonical URL). MCP spec 2026-03-15 mandates this on every JWT.
+     */
+    expectedResource: string;
+    /** JWKS endpoint URL of the SaaS issuer. */
+    jwksUri: string;
+    /** Required role claim values; the token must contain at least one. */
+    requiredRoles?: string[];
+    /** Required scope claim values; the token must contain at least one. */
+    requiredScopes?: string[];
+}
+export interface PushJwtVerifyResult {
+    ok: boolean;
+    reason?: string;
+    payload?: Record<string, unknown>;
+}
+export declare class BundlePushJwtVerifier {
+    private readonly options;
+    private readonly logger;
+    private readonly providerRef;
+    private readonly jwks;
+    constructor(options: BundlePushJwtVerifierOptions, logger: FrontMcpLogger, jwks?: JwksService);
+    /**
+     * Verify a SaaS-issued bearer token. Returns ok=true only if signature,
+     * issuer, audience, RFC 8707 resource indicator, and role claims all check.
+     */
+    verify(token: string): Promise<PushJwtVerifyResult>;
+    private matchesAny;
+}
+//# sourceMappingURL=jwt-verifier.d.ts.map

package/skills/security/jwt-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-verifier.d.ts","sourceRoot":"","sources":["../../../src/skills/security/jwt-verifier.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,WAAW,EAA6C,MAAM,gBAAgB,CAAC;AACxF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,4BAA4B;IAC3C,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAID,qBAAa,qBAAqB;IAK9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoB;IAChD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAc;gBAGhB,OAAO,EAAE,4BAA4B,EACrC,MAAM,EAAE,cAAc,EACvC,IAAI,CAAC,EAAE,WAAW;IAUpB;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAsDzD,OAAO,CAAC,UAAU;CAQnB"}

package/skills/security/webhook-replay-guard.d.ts

@@ -0,0 +1,52 @@
+export interface ReplayCheckResult {
+    ok: boolean;
+    reason?: string;
+}
+/**
+ * Minimal telemetry surface for replay rejects. Structurally compatible
+ * with `@frontmcp/observability`'s `TelemetryAccessor` so callers can pass
+ * that directly while keeping this module dependency-free.
+ */
+export interface ReplayGuardCounter {
+    inc(by?: number, attributes?: Record<string, string>): void;
+}
+export interface ReplayGuardTelemetry {
+    createCounter(name: string, description?: string): ReplayGuardCounter;
+}
+export interface WebhookReplayGuardOptions {
+    /** Allowed clock skew window in ms (default 300_000 = 5min). */
+    windowMs?: number;
+    /** Max nonces tracked simultaneously (default 5_000). */
+    capacity?: number;
+    /**
+     * Optional telemetry hook. When provided, every `check()` rejection is
+     * recorded against `frontmcp_skills_replay_rejects_total` with a low-cardinality
+     * `{ reason }` attribute. When omitted, the guard emits no telemetry.
+     */
+    telemetry?: ReplayGuardTelemetry;
+}
+export declare class WebhookReplayGuard {
+    private readonly windowMs;
+    private readonly capacity;
+    private readonly seen;
+    private now;
+    private readonly rejectsCounter;
+    private readonly checksCounter;
+    constructor(options?: WebhookReplayGuardOptions);
+    /** For tests: override the time source. */
+    setNowProvider(fn: () => number): void;
+    /**
+     * Check that a (timestamp, nonce) pair is fresh and unseen. Returns ok=false
+     * if the timestamp is outside the freshness window or the nonce has already
+     * been observed within that window.
+     */
+    check(args: {
+        timestampMs: number;
+        nonce: string;
+    }): ReplayCheckResult;
+    /** Test/maintenance helper: drop expired entries proactively. */
+    prune(): number;
+    /** Inspect: number of nonces currently tracked. */
+    get size(): number;
+}
+//# sourceMappingURL=webhook-replay-guard.d.ts.map

package/skills/security/webhook-replay-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-replay-guard.d.ts","sourceRoot":"","sources":["../../../src/skills/security/webhook-replay-guard.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CAC7D;AACD,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAAC;CACvE;AAED,MAAM,WAAW,yBAAyB;IACxC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAgBD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAClD,OAAO,CAAC,GAAG,CAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiC;IAChE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;gBAEnD,OAAO,GAAE,yBAA8B;IAyBnD,2CAA2C;IAC3C,cAAc,CAAC,EAAE,EAAE,MAAM,MAAM,GAAG,IAAI;IAItC;;;;OAIG;IACH,KAAK,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,iBAAiB;IA0DtE,iEAAiE;IACjE,KAAK,IAAI,MAAM;IAYf,mDAAmD;IACnD,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}

package/skills/source-options.d.ts

@@ -0,0 +1,55 @@
+import { z } from '@frontmcp/lazy-zod';
+export declare const staticSourceSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    type: import("@frontmcp/lazy-zod").ZodLiteral<"static">;
+    path: import("@frontmcp/lazy-zod").ZodString;
+    watch: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+}, import("zod/v4/core").$strip>;
+export declare const npmSourceSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    type: import("@frontmcp/lazy-zod").ZodLiteral<"npm">;
+    packageName: import("@frontmcp/lazy-zod").ZodString;
+    exportName: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    verifyProvenance: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+}, import("zod/v4/core").$strip>;
+export declare const saasSourceSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    type: import("@frontmcp/lazy-zod").ZodLiteral<"saas">;
+    endpoint: import("@frontmcp/lazy-zod").ZodString;
+    authToken: import("@frontmcp/lazy-zod").ZodString;
+    expectedAudience: import("@frontmcp/lazy-zod").ZodString;
+    pollIntervalMs: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodNumber>;
+    enableWebhook: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+    jwksUrl: import("@frontmcp/lazy-zod").ZodString;
+    expectedIssuer: import("@frontmcp/lazy-zod").ZodString;
+}, import("zod/v4/core").$strip>;
+export declare const bundleSourceSchema: import("@frontmcp/lazy-zod").ZodDiscriminatedUnion<[import("@frontmcp/lazy-zod").ZodObject<{
+    type: import("@frontmcp/lazy-zod").ZodLiteral<"static">;
+    path: import("@frontmcp/lazy-zod").ZodString;
+    watch: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+}, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
+    type: import("@frontmcp/lazy-zod").ZodLiteral<"npm">;
+    packageName: import("@frontmcp/lazy-zod").ZodString;
+    exportName: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    verifyProvenance: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+}, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
+    type: import("@frontmcp/lazy-zod").ZodLiteral<"saas">;
+    endpoint: import("@frontmcp/lazy-zod").ZodString;
+    authToken: import("@frontmcp/lazy-zod").ZodString;
+    expectedAudience: import("@frontmcp/lazy-zod").ZodString;
+    pollIntervalMs: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodNumber>;
+    enableWebhook: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+    jwksUrl: import("@frontmcp/lazy-zod").ZodString;
+    expectedIssuer: import("@frontmcp/lazy-zod").ZodString;
+}, import("zod/v4/core").$strip>], "type">;
+export type StaticSourceOptions = z.infer<typeof staticSourceSchema>;
+export type NpmSourceOptions = z.infer<typeof npmSourceSchema>;
+export type SaasSourceOptions = z.infer<typeof saasSourceSchema>;
+export type BundleSourceOptions = z.infer<typeof bundleSourceSchema>;
+export declare const signatureKeySchema: import("@frontmcp/lazy-zod").ZodObject<{
+    keyId: import("@frontmcp/lazy-zod").ZodString;
+    alg: import("@frontmcp/lazy-zod").ZodEnum<{
+        RS256: "RS256";
+        EdDSA: "EdDSA";
+    }>;
+    publicKeyPem: import("@frontmcp/lazy-zod").ZodString;
+}, import("zod/v4/core").$strip>;
+export type SignatureKey = z.infer<typeof signatureKeySchema>;
+//# sourceMappingURL=source-options.d.ts.map

package/skills/source-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-options.d.ts","sourceRoot":"","sources":["../../src/skills/source-options.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAkBvC,eAAO,MAAM,kBAAkB;;;;gCAM7B,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;gCAW1B,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;gCAsB3B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;0CAAwF,CAAC;AAExH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACrE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AACjE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIrE,eAAO,MAAM,kBAAkB;;;;;;;gCAO7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/skills/sources/filesystem-skills.source.d.ts

@@ -0,0 +1,127 @@
+/**
+ * Lightweight logger surface — kept narrow so this module can sit in a
+ * standalone adapter without dragging the SDK's full FrontMcpLogger type in.
+ */
+export interface FilesystemSkillsLogger {
+    info(message: string, meta?: Record<string, unknown>): void;
+    warn(message: string, meta?: Record<string, unknown>): void;
+    error(message: string, meta?: Record<string, unknown>): void;
+}
+/**
+ * Minimum subset of `SkillContent` produced by this source. Hosts can map it
+ * onto the SDK's full `SkillContent` (with resources, parameters, etc.) when
+ * they wire `onChange` into `registerSkillContent`. The fields here are the
+ * ones we read from SKILL.md directly.
+ */
+export interface FilesystemSkillContent {
+    id: string;
+    name: string;
+    description: string;
+    instructions: string;
+    tools: Array<{
+        name: string;
+        purpose?: string;
+        required?: boolean;
+    }>;
+    /** Bundled resource subdirs the host may also load (scripts/, references/, examples/, assets/). */
+    resources?: {
+        scripts?: string;
+        references?: string;
+        examples?: string;
+        assets?: string;
+    };
+    /** Optional license / compatibility notes parsed from frontmatter. */
+    license?: string;
+    compatibility?: string;
+}
+export type FilesystemSkillsEvent = {
+    op: 'upsert';
+    skill: FilesystemSkillContent;
+    absPath: string;
+} | {
+    op: 'delete';
+    skillId: string;
+    absPath: string;
+};
+export type FilesystemSkillsListener = (event: FilesystemSkillsEvent) => void;
+export interface FilesystemSkillsSourceOptions {
+    /** Directory holding skill subdirectories. Default: `./skills`. */
+    skillsDir?: string;
+    /**
+     * Watch for changes after the initial scan. Default: true. When false the
+     * source emits each skill once on `start()` and never re-fires.
+     */
+    watch?: boolean;
+    /** Debounce window in ms before re-reading a changed subdir. Default: 200. */
+    debounceMs?: number;
+    /**
+     * Polling interval (ms) used as a fallback when `fs.watch` is unreliable
+     * (Linux watch limits, network FS, exotic mount points). When set, the
+     * source falls back to polling the dir mtime; otherwise it surfaces the
+     * `fs.watch` failure as a warning and stops watching.
+     * Default: 2000.
+     */
+    pollIntervalMs?: number;
+}
+/**
+ * Filesystem-backed skills source with hot reload.
+ *
+ * Lifecycle:
+ *   - `start()` performs the initial scan, emitting one `upsert` per skill.
+ *     Errors loading a single subdirectory are logged and that subdirectory
+ *     is skipped — one bad skill never blocks the rest of the dir.
+ *   - When `watch: true`, fs.watch runs against `skillsDir` (recursive). On
+ *     change events we debounce, then re-load the affected subdir and emit
+ *     `upsert`. A subdir that disappeared emits `delete`.
+ *   - When `fs.watch` throws (Linux watch-count limit, certain network
+ *     filesystems), we fall back to a polling loop that compares the
+ *     directory listing on each tick.
+ *   - `stop()` halts watchers, clears timers, and drops listeners.
+ */
+export declare class FilesystemSkillsSource {
+    private readonly logger;
+    readonly id: string;
+    private readonly options;
+    private readonly listeners;
+    private readonly known;
+    private watcher;
+    private pollTimer;
+    private debounceTimers;
+    private stopped;
+    private rootResolved;
+    constructor(options: FilesystemSkillsSourceOptions, logger: FilesystemSkillsLogger);
+    onChange(listener: FilesystemSkillsListener): () => void;
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    private initialScan;
+    private listSkillSubdirs;
+    /** Reload a single skill subdir and emit upsert (or delete if vanished). */
+    private refreshSkill;
+    private emit;
+    private beginWatch;
+    private beginPolling;
+    /** Compare current dir listing to known set; emit upserts/deletes. */
+    private pollOnce;
+    /** Coarse rescan when filename is unknown (some Linux/macOS fs.watch events). */
+    private scheduleRescan;
+    private scheduleRefresh;
+}
+/**
+ * Read a single skill directory's SKILL.md and produce a `FilesystemSkillContent`.
+ * Exported for unit tests and for hosts that want to call directly.
+ */
+export declare function loadFilesystemSkill(absDir: string): Promise<FilesystemSkillContent>;
+interface ParsedFrontmatter {
+    frontmatter: Record<string, unknown>;
+    body: string;
+}
+/**
+ * Minimal YAML-ish frontmatter parser — supports the subset that SKILL.md
+ * actually uses (key/value pairs, optional quoted strings, simple lists).
+ * For full YAML the host should use `loadSkillDirectory` from the SDK; this
+ * adapter intentionally avoids pulling js-yaml as a runtime dep just for
+ * parsing skill metadata.
+ */
+export declare function parseSkillFrontmatter(raw: string): ParsedFrontmatter;
+export {};
+//# sourceMappingURL=filesystem-skills.source.d.ts.map

package/skills/sources/filesystem-skills.source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-skills.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/filesystem-skills.source.ts"],"names":[],"mappings":"AAoBA;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9D;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACrE,mGAAmG;IACnG,SAAS,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1F,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,sBAAsB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,EAAE,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,MAAM,MAAM,wBAAwB,GAAG,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;AAE9E,MAAM,WAAW,6BAA6B;IAC5C,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AASD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,sBAAsB;IAa/B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAZzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0C;IAClE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuC;IACjE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6C;IACnE,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,SAAS,CAA6B;IAC9C,OAAO,CAAC,cAAc,CAAqC;IAC3D,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,YAAY,CAAM;gBAGxB,OAAO,EAAE,6BAA6B,EACrB,MAAM,EAAE,sBAAsB;IAMjD,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,GAAG,MAAM,IAAI;IAOlD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAoBb,WAAW;YAOX,gBAAgB;IAsC9B,4EAA4E;YAC9D,YAAY;IAoC1B,OAAO,CAAC,IAAI;IAUZ,OAAO,CAAC,UAAU;IA8BlB,OAAO,CAAC,YAAY;IAgBpB,sEAAsE;YACxD,QAAQ;IAYtB,iFAAiF;IACjF,OAAO,CAAC,cAAc;IActB,OAAO,CAAC,eAAe;CAYxB;AAID;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA0CzF;AAED,UAAU,iBAAiB;IACzB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAuCpE"}

package/skills/sources/index.d.ts

@@ -0,0 +1,10 @@
+import type { FrontMcpLogger } from '@frontmcp/sdk';
+import type { BundleSourceOptions } from '../source-options';
+import { NpmSource } from './npm.source';
+import { SaasPullSource } from './saas-pull.source';
+import type { SkillBundleSource } from './skill-bundle-source.interface';
+import { StaticSource } from './static.source';
+export { StaticSource, NpmSource, SaasPullSource };
+export type { SkillBundleSource, BundleSourceListener } from './skill-bundle-source.interface';
+export declare function createBundleSource(source: BundleSourceOptions, cacheDir: string | undefined, logger: FrontMcpLogger): SkillBundleSource;
+//# sourceMappingURL=index.d.ts.map

package/skills/sources/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AACnD,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAE/F,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,mBAAmB,EAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,cAAc,GACrB,iBAAiB,CASnB"}

package/skills/sources/npm.source.d.ts

@@ -0,0 +1,30 @@
+import type { FrontMcpLogger } from '@frontmcp/sdk';
+import type { NpmSourceOptions } from '../source-options';
+import type { BundleSourceListener, SkillBundleSource } from './skill-bundle-source.interface';
+/**
+ * Loads a bundle from an npm package's default (or named) export.
+ *
+ * Refresh model: npm sources do NOT auto-refresh — the package is pinned via
+ * `package.json` and only updates after a server redeploy. This is the
+ * intentional, lower-blast-radius distribution mode.
+ *
+ * Provenance verification (GitHub artifact attestations / Sigstore) is in the
+ * v1.2 SHOULD-HAVE list but not yet implemented in OSS — when
+ * `verifyProvenance: true` (the default), this source emits a startup warning
+ * if no attestation is present so customers know what they're trading off.
+ */
+export declare class NpmSource implements SkillBundleSource {
+    private readonly options;
+    private readonly logger;
+    readonly id: string;
+    private listeners;
+    private cached?;
+    constructor(options: NpmSourceOptions, logger: FrontMcpLogger);
+    start(): Promise<void>;
+    onChange(listener: BundleSourceListener): () => void;
+    stop(): Promise<void>;
+    private loadBundleFromPackage;
+    protected dynamicImport(specifier: string): Promise<unknown>;
+    private notify;
+}
+//# sourceMappingURL=npm.source.d.ts.map

package/skills/sources/npm.source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/npm.source.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAE/F;;;;;;;;;;;GAWG;AACH,qBAAa,SAAU,YAAW,iBAAiB;IAO/C,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,MAAM,CAAC,CAAiB;gBAGb,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,cAAc;IAKnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAM5B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAe9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAIb,qBAAqB;IAqBnC,SAAS,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI5D,OAAO,CAAC,MAAM;CASf"}

package/skills/sources/saas-pull.source.d.ts

@@ -0,0 +1,47 @@
+import type { FrontMcpLogger } from '@frontmcp/sdk';
+import type { SaasSourceOptions } from '../source-options';
+import type { BundleSourceListener, SkillBundleSource } from './skill-bundle-source.interface';
+/**
+ * Pulls bundles from a configured SaaS endpoint via authenticated HTTPS.
+ *
+ * Boot semantics:
+ *   - Always attempts a fresh pull on `start()`.
+ *   - If the pull fails AND a cached bundle exists on disk, falls back to it
+ *     and emits a warning. This prevents a SaaS outage at boot from killing
+ *     the customer's MCP server.
+ *   - If both pull and cache fail, `start()` throws.
+ *
+ * Refresh: poll on `pollIntervalMs`. Single-flight per source — overlapping
+ * polls are skipped, never queued. Webhook support is gated behind
+ * `enableWebhook` and deferred to v1.2.x (route mounting requires plugin HTTP
+ * infrastructure not yet in scope).
+ *
+ * NOTE: This source ONLY parses + caches bundles. Signature verification is
+ * applied by the bundle-sync service before the bundle becomes active.
+ */
+export declare class SaasPullSource implements SkillBundleSource {
+    private readonly options;
+    private readonly cacheDir;
+    private readonly logger;
+    readonly id: string;
+    private listeners;
+    private pollHandle;
+    private inFlight;
+    private stopped;
+    constructor(options: SaasSourceOptions, cacheDir: string | undefined, logger: FrontMcpLogger);
+    start(): Promise<void>;
+    onChange(listener: BundleSourceListener): () => void;
+    stop(): Promise<void>;
+    private schedulePoll;
+    private pollOnce;
+    protected httpGet(url: string, headers: Record<string, string>): Promise<{
+        status: number;
+        body: string;
+    }>;
+    private fetchOnce;
+    private cachePath;
+    private persistCache;
+    private loadCache;
+    private notify;
+}
+//# sourceMappingURL=saas-pull.source.d.ts.map

package/skills/sources/saas-pull.source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saas-pull.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/saas-pull.source.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAK/F;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,cAAe,YAAW,iBAAiB;IASpD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAVzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,OAAO,CAAS;gBAGL,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,cAAc;IAKnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB5B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAO9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAS3B,OAAO,CAAC,YAAY;YAQN,QAAQ;cAqBN,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;YAgBlG,SAAS;IAiBvB,OAAO,CAAC,SAAS;YAKH,YAAY;YAUZ,SAAS;IAUvB,OAAO,CAAC,MAAM;CASf"}

package/skills/sources/skill-bundle-source.interface.d.ts

@@ -0,0 +1,36 @@
+import type { ResolvedBundle } from '../bundle/bundle.types';
+/**
+ * Pluggable source of skill bundles. Static, npm-installed, and SaaS-pull
+ * implementations all conform to this interface.
+ *
+ * Lifecycle:
+ *   - `start()` is called once when the plugin is ready. The source performs
+ *     its initial fetch and begins any background polling/watching.
+ *   - `onChange()` registers a listener invoked every time a new bundle is
+ *     available (initial fetch + every refresh).
+ *   - `stop()` halts all background work and releases resources.
+ *
+ * Sources are responsible for parsing/validating their input into a
+ * ResolvedBundle (typically by calling `parseOverlay` from bundle/overlay-parser).
+ * They MUST NOT verify signatures themselves — the bundle-sync service applies
+ * the signature gate before swapping the bundle into the registry.
+ */
+export interface SkillBundleSource {
+    /** Stable id of this source (e.g. 'static:/path/to/bundle.yaml'). */
+    readonly id: string;
+    /**
+     * Begin operation. Must perform an initial fetch and notify listeners
+     * before resolving. Must throw if the initial fetch fails AND no fallback
+     * (e.g. cached bundle on disk for SaaS sources) is available.
+     */
+    start(): Promise<void>;
+    /**
+     * Subscribe to bundle updates. Returns an unsubscribe function. The first
+     * notification fires on or shortly after `start()` resolves.
+     */
+    onChange(listener: BundleSourceListener): () => void;
+    /** Halt background work; idempotent. */
+    stop(): Promise<void>;
+}
+export type BundleSourceListener = (bundle: ResolvedBundle) => void;
+//# sourceMappingURL=skill-bundle-source.interface.d.ts.map

package/skills/sources/skill-bundle-source.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-bundle-source.interface.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/skill-bundle-source.interface.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI,CAAC;IAErD,wCAAwC;IACxC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC"}

package/skills/sources/static.source.d.ts

@@ -0,0 +1,30 @@
+import type { FrontMcpLogger } from '@frontmcp/sdk';
+import type { StaticSourceOptions } from '../source-options';
+import type { BundleSourceListener, SkillBundleSource } from './skill-bundle-source.interface';
+/**
+ * Loads a bundle from a local file (YAML or JSON). Optionally watches the
+ * file for changes via `fs.watch` and re-fetches on edit.
+ *
+ * Bundle file extensions:
+ *   - `.yaml` / `.yml` — parsed as YAML
+ *   - `.json`         — parsed as JSON
+ *   - anything else   — content sniffed (starts with `{` or `[` => JSON; else YAML)
+ */
+export declare class StaticSource implements SkillBundleSource {
+    private readonly options;
+    private readonly logger;
+    readonly id: string;
+    private listeners;
+    private watcher;
+    private debounceTimer;
+    private stopped;
+    constructor(options: StaticSourceOptions, logger: FrontMcpLogger);
+    start(): Promise<void>;
+    onChange(listener: BundleSourceListener): () => void;
+    stop(): Promise<void>;
+    private fetchOnce;
+    private notify;
+    private beginWatch;
+    private scheduleRefresh;
+}
+//# sourceMappingURL=static.source.d.ts.map

package/skills/sources/static.source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/static.source.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAE/F;;;;;;;;GAQG;AACH,qBAAa,YAAa,YAAW,iBAAiB;IASlD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,aAAa,CAA6B;IAClD,OAAO,CAAC,OAAO,CAAS;gBAGL,OAAO,EAAE,mBAAmB,EAC5B,MAAM,EAAE,cAAc;IAKnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAO9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAab,SAAS;IAoBvB,OAAO,CAAC,MAAM;IAUd,OAAO,CAAC,UAAU;IAiBlB,OAAO,CAAC,eAAe;CAaxB"}