@frontmcp/adapters 1.11.0 → 1.11.1-rc.2

package/skills/security/webhook-replay-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-replay-guard.d.ts","sourceRoot":"","sources":["../../../src/skills/security/webhook-replay-guard.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CAC7D;AACD,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAAC;CACvE;AAED,MAAM,WAAW,yBAAyB;IACxC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAgBD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAClD,OAAO,CAAC,GAAG,CAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiC;IAChE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;gBAEnD,OAAO,GAAE,yBAA8B;IAyBnD,2CAA2C;IAC3C,cAAc,CAAC,EAAE,EAAE,MAAM,MAAM,GAAG,IAAI;IAItC;;;;OAIG;IACH,KAAK,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,iBAAiB;IA0DtE,iEAAiE;IACjE,KAAK,IAAI,MAAM;IAYf,mDAAmD;IACnD,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}
+{"version":3,"file":"webhook-replay-guard.d.ts","sourceRoot":"","sources":["../../../src/skills/security/webhook-replay-guard.ts"],"names":[],"mappings":"AAMA,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAErF,8FAA8F;AAC9F,MAAM,MAAM,gBAAgB,GACxB,mBAAmB,GACnB,eAAe,GACf,gBAAgB,GAChB,cAAc,GACd,mBAAmB,CAAC;AAExB,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CAC7D;AACD,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAAC;CACvE;AAED,MAAM,WAAW,yBAAyB;IACxC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;OAIG;IACH,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAID,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmB;IACzC,OAAO,CAAC,GAAG,CAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiC;IAChE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;gBAEnD,OAAO,GAAE,yBAA8B;IAwBnD,2CAA2C;IAC3C,cAAc,CAAC,EAAE,EAAE,MAAM,MAAM,GAAG,IAAI;IAItC;;;OAGG;IACG,KAAK,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAiCtF"}

package/skills/source-options.d.ts

@@ -1,4 +1,5 @@
 import { z } from '@frontmcp/lazy-zod';
+import type { StorageConfig } from '@frontmcp/utils';
 export declare const staticSourceSchema: import("@frontmcp/lazy-zod").ZodObject<{
     type: import("@frontmcp/lazy-zod").ZodLiteral<"static">;
     path: import("@frontmcp/lazy-zod").ZodString;
@@ -17,6 +18,9 @@ export declare const saasSourceSchema: import("@frontmcp/lazy-zod").ZodObject<{
     expectedAudience: import("@frontmcp/lazy-zod").ZodString;
     pollIntervalMs: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodNumber>;
     enableWebhook: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+    requirePushBodyDigest: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+    allowRollback: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+    pushReplayStorage: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodCustom<StorageConfig, StorageConfig>>;
     jwksUrl: import("@frontmcp/lazy-zod").ZodString;
     expectedIssuer: import("@frontmcp/lazy-zod").ZodString;
 }, import("zod/v4/core").$strip>;
@@ -40,6 +44,9 @@ export declare const bundleSourceSchema: import("@frontmcp/lazy-zod").ZodDiscrim
     expectedAudience: import("@frontmcp/lazy-zod").ZodString;
     pollIntervalMs: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodNumber>;
     enableWebhook: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+    requirePushBodyDigest: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+    allowRollback: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
+    pushReplayStorage: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodCustom<StorageConfig, StorageConfig>>;
     jwksUrl: import("@frontmcp/lazy-zod").ZodString;
     expectedIssuer: import("@frontmcp/lazy-zod").ZodString;
 }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{

package/skills/source-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source-options.d.ts","sourceRoot":"","sources":["../../src/skills/source-options.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAkBvC,eAAO,MAAM,kBAAkB;;;;gCAM7B,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;gCAiB1B,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;gCA0B3B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;gCAS7B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;0CAK7B,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACrE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AACjE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACrE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIrE,eAAO,MAAM,kBAAkB;;;;;;;gCAO7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}
+{"version":3,"file":"source-options.d.ts","sourceRoot":"","sources":["../../src/skills/source-options.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAe,MAAM,iBAAiB,CAAC;AA0ClE,eAAO,MAAM,kBAAkB;;;;gCAM7B,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;gCAiB1B,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;gCA4C3B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;gCAS7B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;0CAK7B,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACrE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AACjE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACrE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIrE,eAAO,MAAM,kBAAkB;;;;;;;gCAO7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/skills/sources/index.d.ts

@@ -2,10 +2,10 @@ import type { FrontMcpLogger } from '@frontmcp/sdk';
 import type { BundleSourceOptions } from '../source-options';
 import { InlineSource } from './inline.source';
 import { NpmSource } from './npm.source';
-import { SaasPullSource } from './saas-pull.source';
+import { PUSH_BODY_DIGEST_CLAIM, pushBodyDigest, SaasJwksUnavailableError, SaasPullSource, SaasPullTokenRejectedError, SaasPushRefusedError, tokenFailureOf } from './saas-pull.source';
 import type { BundleSourceDeps, SkillBundleSource } from './skill-bundle-source.interface';
 import { StaticSource } from './static.source';
-export { StaticSource, NpmSource, SaasPullSource, InlineSource };
-export type { BundleCacheStore, BundleSourceDeps, BundleSourceListener, SkillBundleSource, } from './skill-bundle-source.interface';
+export { StaticSource, NpmSource, SaasPullSource, SaasPullTokenRejectedError, SaasJwksUnavailableError, SaasPushRefusedError, tokenFailureOf, PUSH_BODY_DIGEST_CLAIM, pushBodyDigest, InlineSource, };
+export type { BundleCacheStore, BundleOrigin, BundlePullFailureListener, BundlePushReceiver, BundleSourceDeps, BundleSourceListener, BundleTokenFailure, SkillBundleSource, } from './skill-bundle-source.interface';
 export declare function createBundleSource(source: BundleSourceOptions, cacheDir: string | undefined, logger: FrontMcpLogger, deps?: BundleSourceDeps): SkillBundleSource;
 //# sourceMappingURL=index.d.ts.map

package/skills/sources/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;AACjE,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAEzC,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,mBAAmB,EAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,cAAc,EAGtB,IAAI,CAAC,EAAE,gBAAgB,GACtB,iBAAiB,CAWnB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,wBAAwB,EACxB,cAAc,EACd,0BAA0B,EAC1B,oBAAoB,EACpB,cAAc,EACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EACL,YAAY,EACZ,SAAS,EACT,cAAc,EACd,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,YAAY,GACb,CAAC;AACF,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAEzC,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,mBAAmB,EAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,cAAc,EAGtB,IAAI,CAAC,EAAE,gBAAgB,GACtB,iBAAiB,CAWnB"}

package/skills/sources/saas-pull.source.d.ts

@@ -1,29 +1,63 @@
 import type { FrontMcpLogger } from '@frontmcp/sdk';
 import type { ResolvedBundle } from '../bundle/bundle.types';
 import type { SaasSourceOptions } from '../source-options';
-import type { BundleSourceDeps, BundleSourceListener, SkillBundleSource } from './skill-bundle-source.interface';
+import type { BundlePullFailureListener, BundlePushReceiver, BundleSourceDeps, BundleSourceListener, BundleTokenFailure, SkillBundleSource } from './skill-bundle-source.interface';
 /**
  * The pinned pull token failed verification against `jwksUrl`, `expectedIssuer`
  * or `expectedAudience`. Unlike an outage, this never falls back to a cached
  * bundle: the configured SaaS is not the one the server was set up to trust.
  */
 export declare class SaasPullTokenRejectedError extends Error {
-    constructor(reason: string);
+    readonly tokenFailure: BundleTokenFailure;
+    constructor(reason: string, tokenFailure: BundleTokenFailure);
 }
+/** The issuer's JWKS could not be read, or holds no usable signing key: no token can be checked, an outage. */
+export declare class SaasJwksUnavailableError extends Error {
+    readonly tokenFailure = "jwks_unavailable";
+    constructor(message: string, options?: ErrorOptions);
+}
+/**
+ * The token of a pushed bundle was refused: it fails the checks the pull token passes (`invalid-token`), a push
+ * already used it (`replayed`), or the replay store could not record its `jti` (`replay-unchecked`). The pushed
+ * bundle is not applied.
+ */
+export declare class SaasPushRefusedError extends Error {
+    readonly refusal: 'invalid-token' | 'replayed' | 'replay-unchecked';
+    /** The check that refused the token, when the issuer's checks did rather than the replay guard. */
+    readonly tokenFailure?: BundleTokenFailure | undefined;
+    constructor(refusal: 'invalid-token' | 'replayed' | 'replay-unchecked', reason: string, 
+    /** The check that refused the token, when the issuer's checks did rather than the replay guard. */
+    tokenFailure?: BundleTokenFailure | undefined);
+}
+/** The token check a pull or push failed on, from the error it threw; undefined for any other failure. */
+export declare function tokenFailureOf(error: unknown): BundleTokenFailure | undefined;
+/** The push token claim that binds it to the body it came with: {@link pushBodyDigest} of that body. */
+export declare const PUSH_BODY_DIGEST_CLAIM = "body_sha256";
+/** The `body_sha256` claim a push token carries for `body`: the base64url SHA-256 of its exact bytes, unpadded. */
+export declare function pushBodyDigest(body: string | Uint8Array): string;
 /**
  * Pulls bundles from a configured SaaS endpoint via authenticated HTTPS.
  *
  * Boot semantics:
  *   - Always attempts a fresh pull on `start()`.
- *   - If the pull fails AND a cached bundle exists on disk, falls back to it
- *     and emits a warning. This prevents a SaaS outage at boot from killing
- *     the customer's MCP server.
- *   - If both pull and cache fail, `start()` throws.
+ *   - If the pull fails AND a cached bundle exists on disk, falls back to it,
+ *     emits a warning, and hands it to its listeners with why the pull failed.
+ *     This prevents a SaaS outage at boot from killing the customer's MCP
+ *     server. The cache holds the last bundle the plugin applied
+ *     ({@link SaasPullSource.keepBundle}): a pulled bundle that fails its
+ *     signature or apply never replaces it, and the plugin doesn't write back
+ *     the cached bundle it serves. While no bundle serves, the plugin reads the
+ *     cache ({@link SaasPullSource.keptBundle}), and serves it in place of a
+ *     pulled bundle that is older or refused.
+ *   - If both pull and cache fail, `start()` throws. Polling still starts, so a
+ *     later pull that succeeds loads the bundle.
  *
  * Refresh: poll on `pollIntervalMs`. Single-flight per source — overlapping
- * polls are skipped, never queued. Webhook support is gated behind
- * `enableWebhook` and deferred to v1.2.x (route mounting requires plugin HTTP
- * infrastructure not yet in scope).
+ * polls are skipped, never queued. A poll that fails is logged and reported to
+ * the {@link SaasPullSource.onPullFailure} listeners. With `enableWebhook` the
+ * source also takes pushed bundles ({@link SaasPullSource.verifyPushToken}):
+ * the plugin serves them at `POST /__skilled_openapi/push`, and a push token
+ * with a `body_sha256` claim is good only for the body it was issued for.
  *
  * Before every pull the pinned `authToken` is verified: it must be a JWT signed
  * by a key in the issuer's JWKS (`jwksUrl`), with `iss` equal to
@@ -34,30 +68,64 @@ export declare class SaasPullTokenRejectedError extends Error {
  * other pull failure (the cache fallback still applies).
  *
  * NOTE: Bundle signature verification is applied by the bundle-sync service
- * before the bundle becomes active.
+ * before the bundle becomes active, and so is the version order: the source is
+ * {@link SaasPullSource.forwardOnly}, so a bundle older than the served one is refused.
  */
-export declare class SaasPullSource implements SkillBundleSource {
+export declare class SaasPullSource implements SkillBundleSource, BundlePushReceiver {
     private readonly options;
     private readonly cacheDir;
     private readonly logger;
     private readonly deps;
     readonly id: string;
     private listeners;
+    private pullFailureListeners;
     private pollHandle;
-    private inFlight;
+    /** The pull running now, from start, a poll or a refresh; only one runs at a time. */
+    private inFlightPull;
     private stopped;
     private readonly jwksService;
+    private readonly replayGuard?;
+    private pushSigningKeys?;
+    private pushSigningKeysLoading?;
+    private warnedOfUnboundPushToken;
     constructor(options: SaasSourceOptions, cacheDir: string | undefined, logger: FrontMcpLogger, deps?: BundleSourceDeps);
+    /** The store an injected `pushReplayStore` or the `pushReplayStorage` option names; none keeps the jtis in memory. */
+    private pushReplayStore;
+    /** This source, when `enableWebhook` is on: it then takes bundles pushed to the server. */
+    get push(): BundlePushReceiver | undefined;
+    /** A pulled or pushed bundle older than the one being served is not applied, unless `allowRollback` is on. */
+    get forwardOnly(): boolean;
+    /**
+     * Check the token of a pushed bundle: by the rules the pull token passes (a key in `jwksUrl`, `iss`, `aud`,
+     * `resource`, expiry), then against `body`, the exact bytes of the request body ({@link PUSH_BODY_DIGEST_CLAIM}),
+     * then by the replay guard, so its `iat` must be within five minutes and its `jti` unused by every instance sharing
+     * the replay store. A token refused for its body leaves its `jti` unused. Throws {@link SaasPushRefusedError}, or
+     * {@link SaasJwksUnavailableError} when the JWKS can't be read.
+     */
+    verifyPushToken(token: string, body: Uint8Array): Promise<void>;
+    /** Refuse a push whose body isn't the one its token was issued for, or, with `requirePushBodyDigest`, unbound. */
+    private checkPushBody;
+    /** Keep a bundle the plugin applied, pulled or pushed, as the last good one a start falls back to. */
+    keepBundle(bundle: ResolvedBundle): Promise<void>;
+    /** The last good bundle {@link keepBundle} kept, schema-checked as a pull is; undefined when there is none. */
+    keptBundle(): Promise<ResolvedBundle | undefined>;
     start(): Promise<void>;
+    private pullAtStart;
+    /** Run `pull` as the one pull in flight, so a start, a poll and a refresh never pull at once. */
+    private exclusivePull;
     onChange(listener: BundleSourceListener): () => void;
+    /** Subscribe to the polls that fail, with why; a failed start or refresh throws to its caller instead. */
+    onPullFailure(listener: BundlePullFailureListener): () => void;
     stop(): Promise<void>;
     private schedulePoll;
     /**
-     * Manually pull a fresh bundle, persist it, and notify listeners. Drive this
+     * Manually pull a fresh bundle and notify listeners, resolving once they are
+     * done with it (the plugin applied and kept it, or refused it). Drive this
      * from a Cron Trigger / Durable Object alarm on runtimes without background
-     * timers (where `disablePolling` is set). Single-flight: returns `undefined`
-     * if a pull is already in flight; throws if the pull itself fails (the caller
-     * — e.g. a scheduled handler — decides how to surface it).
+     * timers (where `disablePolling` is set). Single-flight: while a pull is
+     * already in flight it waits for that pull to finish, applied and kept, and
+     * returns `undefined` without pulling again; throws if its own pull fails (the
+     * caller — e.g. a scheduled handler — decides how to surface it).
      */
     refresh(): Promise<ResolvedBundle | undefined>;
     private pollOnce;
@@ -66,11 +134,19 @@ export declare class SaasPullSource implements SkillBundleSource {
         body: string;
     }>;
     /**
-     * Verify the pinned pull token against the issuer's JWKS, issuer and audience.
-     * Throws {@link SaasPullTokenRejectedError} when the token is refused, and a
-     * plain Error when the JWKS can't be fetched (an outage).
+     * Verify the pinned pull token against the issuer's JWKS, issuer and audience, and log the check it fails on.
+     * Throws {@link SaasPullTokenRejectedError} when the token is refused, and {@link SaasJwksUnavailableError} when
+     * the JWKS can't be fetched (an outage).
      */
     private verifyPullToken;
+    /**
+     * The issuer's signing keys for checking a push token: fetched at most once a minute, and shared by concurrent
+     * pushes. A pull always fetches them, so a key the issuer removed stops a pull at once.
+     */
+    private signingKeysForPush;
+    private fetchSigningKeys;
+    /** Check a token the issuer signed, against its JWKS, issuer and audience. */
+    private verifyIssuedToken;
     private fetchOnce;
     /** Where the last-good bundle is kept, for messages: an injected store (a Worker's KV) has no file path. */
     private cacheLocation;
@@ -78,5 +154,6 @@ export declare class SaasPullSource implements SkillBundleSource {
     private persistCache;
     private loadCache;
     private notify;
+    private notifyPullFailure;
 }
 //# sourceMappingURL=saas-pull.source.d.ts.map

package/skills/sources/saas-pull.source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saas-pull.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/saas-pull.source.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAMjH;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,MAAM,EAAE,MAAM;CAI3B;AA4BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,cAAe,YAAW,iBAAiB;IAUpD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAZvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;gBAGhC,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,cAAc,EACtB,IAAI,GAAE,gBAAqB;IAKxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAwC5B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAO9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAS3B,OAAO,CAAC,YAAY;IAcpB;;;;;;OAMG;IACG,OAAO,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;YAatC,QAAQ;cAyBN,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAoBhH;;;;OAIG;YACW,eAAe;YA2Cf,SAAS;IAkBvB,4GAA4G;IAC5G,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,SAAS;YAKH,YAAY;YAeZ,SAAS;IAkBvB,OAAO,CAAC,MAAM;CASf"}
+{"version":3,"file":"saas-pull.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/saas-pull.source.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAWpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAI7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAEV,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,iCAAiC,CAAC;AASzC;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IAGjD,QAAQ,CAAC,YAAY,EAAE,kBAAkB;gBADzC,MAAM,EAAE,MAAM,EACL,YAAY,EAAE,kBAAkB;CAK5C;AAED,+GAA+G;AAC/G,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,YAAY,sBAAsB;gBAE/B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAIpD;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,UAAU,GAAG,kBAAkB;IAEnE,mGAAmG;IACnG,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB;gBAHjC,OAAO,EAAE,eAAe,GAAG,UAAU,GAAG,kBAAkB,EACnE,MAAM,EAAE,MAAM;IACd,mGAAmG;IAC1F,YAAY,CAAC,EAAE,kBAAkB,YAAA;CAK7C;AAED,0GAA0G;AAC1G,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,GAAG,SAAS,CAM7E;AAMD,wGAAwG;AACxG,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD,mHAAmH;AACnH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAEhE;AA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,cAAe,YAAW,iBAAiB,EAAE,kBAAkB;IAgBxE,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAlBvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,oBAAoB,CAAwC;IACpE,OAAO,CAAC,UAAU,CAA6B;IAC/C,sFAAsF;IACtF,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAqB;IAClD,OAAO,CAAC,eAAe,CAAC,CAAyC;IACjE,OAAO,CAAC,sBAAsB,CAAC,CAAqB;IACpD,OAAO,CAAC,wBAAwB,CAAS;gBAGtB,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,cAAc,EACtB,IAAI,GAAE,gBAAqB;IAM9C,sHAAsH;IACtH,OAAO,CAAC,eAAe;IAOvB,2FAA2F;IAC3F,IAAI,IAAI,IAAI,kBAAkB,GAAG,SAAS,CAEzC;IAED,8GAA8G;IAC9G,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED;;;;;;OAMG;IACG,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBrE,kHAAkH;IAClH,OAAO,CAAC,aAAa;IA0BrB,sGAAsG;IACtG,UAAU,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,+GAA+G;IAC/G,UAAU,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAI3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAcd,WAAW;IAwBzB,iGAAiG;IACjG,OAAO,CAAC,aAAa;IAQrB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAOpD,0GAA0G;IAC1G,aAAa,CAAC,QAAQ,EAAE,yBAAyB,GAAG,MAAM,IAAI;IAOxD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAU3B,OAAO,CAAC,YAAY;IAcpB;;;;;;;;OAQG;IACG,OAAO,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;YAatC,QAAQ;cA0BN,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAoBhH;;;;OAIG;YACW,eAAe;IAW7B;;;OAGG;IACH,OAAO,CAAC,kBAAkB;YAcZ,gBAAgB;IA+B9B,8EAA8E;YAChE,iBAAiB;YAgCjB,SAAS;IAkBvB,4GAA4G;IAC5G,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,SAAS;YAKH,YAAY;YAeZ,SAAS;YAkBT,MAAM;IAUpB,OAAO,CAAC,iBAAiB;CAS1B"}

package/skills/sources/skill-bundle-source.interface.d.ts

@@ -1,4 +1,6 @@
+import type { TokenVerifyFailure } from '@frontmcp/auth';
 import type { ResolvedBundle } from '../bundle/bundle.types';
+import type { ReplayNonceStore } from '../security/replay-nonce-store';
 /**
  * Pluggable source of skill bundles. Static, npm-installed, and SaaS-pull
  * implementations all conform to this interface.
@@ -8,12 +10,15 @@ import type { ResolvedBundle } from '../bundle/bundle.types';
  *     its initial fetch and begins any background polling/watching.
  *   - `onChange()` registers a listener invoked every time a new bundle is
  *     available (initial fetch + every refresh).
+ *   - `keepBundle()`, on a source with a last-good cache, keeps a bundle once
+ *     the plugin has applied it.
  *   - `stop()` halts all background work and releases resources.
  *
  * Sources are responsible for parsing/validating their input into a
  * ResolvedBundle (typically by calling `parseOverlay` from bundle/overlay-parser).
  * They MUST NOT verify signatures themselves — the bundle-sync service applies
- * the signature gate before swapping the bundle into the registry.
+ * the signature gate before swapping the bundle into the registry. For the same
+ * reason they never cache a bundle they fetched until they are asked to keep it.
  */
 export interface SkillBundleSource {
     /** Stable id of this source (e.g. 'static:/path/to/bundle.yaml'). */
@@ -29,20 +34,70 @@ export interface SkillBundleSource {
      * notification fires on or shortly after `start()` resolves.
      */
     onChange(listener: BundleSourceListener): () => void;
+    /**
+     * Subscribe to the pulls that fail in the background (a poll), which no caller sees: `start()` and `refresh()` throw
+     * theirs. Returns an unsubscribe function. Present on a polling source: the `saas` source.
+     */
+    onPullFailure?(listener: BundlePullFailureListener): () => void;
     /**
      * Pull a fresh bundle on demand and notify listeners — the manual,
      * externally-driven counterpart to background polling. Optional: only
      * remote/pulling sources implement it. On runtimes with no background
      * execution (Cloudflare Workers) a Cron Trigger / Durable Object alarm
      * calls this instead of relying on an internal timer. Resolves to the new
-     * bundle, or `undefined` if a pull is already in flight / the source is
-     * stopped.
+     * bundle once its listeners are done with it (the plugin has applied it, or
+     * refused it), or to `undefined` if a pull is already in flight / the source
+     * is stopped.
      */
     refresh?(): Promise<ResolvedBundle | undefined>;
+    /**
+     * Keep a bundle the plugin applied as the last good one, which a start that can't fetch falls back to. Present on
+     * a source with a last-good cache: the `saas` source.
+     */
+    keepBundle?(bundle: ResolvedBundle): Promise<void>;
+    /**
+     * The last good bundle {@link keepBundle} kept, read back from the cache; undefined when none is kept or it can't be
+     * read. While no bundle serves, the plugin compares a new bundle with it, and serves it in place of one it refuses.
+     */
+    keptBundle?(): Promise<ResolvedBundle | undefined>;
+    /** Present on a source that takes pushed bundles: the `saas` source with `enableWebhook`. */
+    readonly push?: BundlePushReceiver;
+    /**
+     * True on a source whose bundles only move forward: the `saas` source, unless `allowRollback`. The plugin then
+     * refuses a bundle older than the one being served, as `compareBundleVersions` orders them.
+     */
+    readonly forwardOnly?: boolean;
     /** Halt background work; idempotent. */
     stop(): Promise<void>;
 }
-export type BundleSourceListener = (bundle: ResolvedBundle) => void;
+/** The check a pushed bundle's token passes before the bundle is applied. */
+export interface BundlePushReceiver {
+    /**
+     * Resolves when the push token is accepted for `body`, the exact bytes of the request body; throws when it is
+     * refused or can't be checked.
+     */
+    verifyPushToken(token: string, body: Uint8Array): Promise<void>;
+}
+/** Takes each new bundle; a pulling source waits for a promise it returns before its pull counts as done. */
+export type BundleSourceListener = (bundle: ResolvedBundle, origin?: BundleOrigin) => unknown;
+/** How a source came by a bundle it hands its listeners. */
+export interface BundleOrigin {
+    /**
+     * Set when the pull failed and the bundle is the last good one the source kept, served in its place: why it failed.
+     * The plugin doesn't keep such a bundle again, since the cache holds it.
+     */
+    pullFailure?: string;
+    /** Set when that pull failed on its token: the check that refused it, or `jwks_unavailable`. */
+    tokenFailure?: BundleTokenFailure;
+}
+/**
+ * Which check refused a pull or push token, or `jwks_unavailable` when the issuer's keys could not be read to check
+ * it; `body_mismatch` is a push token issued for another body. For the server's logs and `/readyz`: a caller learns
+ * only that its token was refused.
+ */
+export type BundleTokenFailure = TokenVerifyFailure | 'wrong_audience' | 'body_mismatch';
+/** Takes the reason a background pull failed, and the token check it failed on, if any. */
+export type BundlePullFailureListener = (reason: string, tokenFailure?: BundleTokenFailure) => void;
 /**
  * Pluggable last-good bundle cache. The default (Node) implementation writes to
  * disk; V8-isolate runtimes (Cloudflare Workers) inject a KV-backed store
@@ -59,7 +114,9 @@ export interface BundleCacheStore {
  *   - `cache` replaces the on-disk last-good cache (no filesystem on a Worker),
  *   - `disablePolling` turns off the internal `setInterval` loop (no background
  *     execution on a Worker; a Cron Trigger / DO alarm drives {@link
- *     SkillBundleSource.refresh} instead).
+ *     SkillBundleSource.refresh} instead),
+ *   - `pushReplayStore` records the pushed tokens' `jti`s where every instance
+ *     reaches them (a Durable Object on a Worker).
  */
 export interface BundleSourceDeps {
     /**
@@ -73,5 +130,10 @@ export interface BundleSourceDeps {
      * {@link SkillBundleSource.refresh} instead.
      */
     disablePolling?: boolean;
+    /**
+     * Where the push replay guard records the `jti`s it accepted, shared by every instance that serves the server.
+     * Replaces the `saas` source's `pushReplayStorage` option and its in-memory default.
+     */
+    pushReplayStore?: ReplayNonceStore;
 }
 //# sourceMappingURL=skill-bundle-source.interface.d.ts.map

package/skills/sources/skill-bundle-source.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-bundle-source.interface.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/skill-bundle-source.interface.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI,CAAC;IAErD;;;;;;;;OAQG;IACH,OAAO,CAAC,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAEhD,wCAAwC;IACxC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;AAEpE;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC5C,KAAK,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B"}
+{"version":3,"file":"skill-bundle-source.interface.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/skill-bundle-source.interface.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAEvE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI,CAAC;IAErD;;;OAGG;IACH,aAAa,CAAC,CAAC,QAAQ,EAAE,yBAAyB,GAAG,MAAM,IAAI,CAAC;IAEhE;;;;;;;;;OASG;IACH,OAAO,CAAC,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAEhD;;;OAGG;IACH,UAAU,CAAC,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD;;;OAGG;IACH,UAAU,CAAC,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAEnD,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAEnC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B,wCAAwC;IACxC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAED,6GAA6G;AAC7G,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC;AAE9F,4DAA4D;AAC5D,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gGAAgG;IAChG,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,eAAe,CAAC;AAEzF,2FAA2F;AAC3F,MAAM,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,kBAAkB,KAAK,IAAI,CAAC;AAEpG;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC5C,KAAK,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,eAAe,CAAC,EAAE,gBAAgB,CAAC;CACpC"}

package/skills/sources/static.source.d.ts

@@ -3,7 +3,9 @@ import type { StaticSourceOptions } from '../source-options';
 import type { BundleSourceListener, SkillBundleSource } from './skill-bundle-source.interface';
 /**
  * Loads a bundle from a local file (YAML or JSON). Optionally watches the
- * file for changes via `fs.watch` and re-fetches on edit.
+ * file for changes via `fs.watch` and re-fetches on edit. The watch starts
+ * before the first read, so fixing a file that failed to load reloads it. A
+ * refresh that reads the same content as the last read applies nothing.
  *
  * Bundle file extensions:
  *   - `.yaml` / `.yml` — parsed as YAML
@@ -18,11 +20,13 @@ export declare class StaticSource implements SkillBundleSource {
     private watcher;
     private debounceTimer;
     private stopped;
+    private lastContent;
     constructor(options: StaticSourceOptions, logger: FrontMcpLogger);
     start(): Promise<void>;
     onChange(listener: BundleSourceListener): () => void;
     stop(): Promise<void>;
-    private fetchOnce;
+    private readBundleFile;
+    private parse;
     private notify;
     private beginWatch;
     private scheduleRefresh;

package/skills/sources/static.source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"static.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/static.source.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAE/F;;;;;;;;GAQG;AACH,qBAAa,YAAa,YAAW,iBAAiB;IASlD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,OAAO,CAAgC;IAC/C,OAAO,CAAC,aAAa,CAA6B;IAClD,OAAO,CAAC,OAAO,CAAS;gBAGL,OAAO,EAAE,mBAAmB,EAC5B,MAAM,EAAE,cAAc;IAKnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAO9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAab,SAAS;IAoBvB,OAAO,CAAC,MAAM;IAUd,OAAO,CAAC,UAAU;IAmBlB,OAAO,CAAC,eAAe;CAaxB"}
+{"version":3,"file":"static.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/static.source.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAE/F;;;;;;;;;;GAUG;AACH,qBAAa,YAAa,YAAW,iBAAiB;IAUlD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAVzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,OAAO,CAAgC;IAC/C,OAAO,CAAC,aAAa,CAA6B;IAClD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,WAAW,CAAqB;gBAGrB,OAAO,EAAE,mBAAmB,EAC5B,MAAM,EAAE,cAAc;IAKnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAS5B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAO9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAa3B,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,KAAK;IAkBb,OAAO,CAAC,MAAM;IAUd,OAAO,CAAC,UAAU;IAmBlB,OAAO,CAAC,eAAe;CAexB"}