@frontmcp/adapters 1.4.1 → 1.5.0

package/skills/index.js

@@ -36,6 +36,7 @@ __export(skills_exports, {
   ClassificationRegistry: () => ClassificationRegistry,
   FilesystemSkillsSource: () => FilesystemSkillsSource,
   Hs256AuditSigner: () => Hs256AuditSigner,
+  InlineSource: () => InlineSource,
   MemoryAuditStore: () => MemoryAuditStore,
   NpmSource: () => NpmSource,
   OverlayParseError: () => OverlayParseError,
@@ -55,6 +56,7 @@ __export(skills_exports, {
   WebhookReplayGuard: () => WebhookReplayGuard,
   applyClassificationOverrides: () => applyClassificationOverrides,
   applyEnvironmentOverlay: () => applyEnvironmentOverlay,
+  buildFrontMcpConfigFromManifest: () => buildFrontMcpConfigFromManifest,
   buildKnownOps: () => buildKnownOps,
   buildResourceChangeNotification: () => buildResourceChangeNotification,
   bundleDigest: () => bundleDigest,
@@ -64,6 +66,7 @@ __export(skills_exports, {
   canonicalizeRecordForSigning: () => canonicalizeRecordForSigning,
   classifyOne: () => classifyOne,
   classifyOperations: () => classifyOperations,
+  compileSkilledBundleFromOpenApi: () => compileSkilledBundleFromOpenApi,
   createBundleSource: () => createBundleSource,
   crossValidate: () => crossValidate,
   crossValidateManifest: () => crossValidateManifest,
@@ -168,6 +171,9 @@ var operationDescriptorSchema = import_lazy_zod.z.object({
   mapper: import_lazy_zod.z.array(parameterMapperSchema).max(256),
   authBindingRef: import_lazy_zod.z.string().min(1).max(128),
   requiredAuthorities: authoritiesPolicySchema.optional(),
+  // Explicit opt-in that a policy-less op is intentionally public — consulted
+  // only when the deployment runs the executor with `unprotectedOps: 'deny'`.
+  public: import_lazy_zod.z.boolean().optional(),
   maxResponseBytes: import_lazy_zod.z.number().int().positive().max(64 * 1024 * 1024).optional(),
   timeoutMs: import_lazy_zod.z.number().int().positive().max(6e5).optional(),
   summary: import_lazy_zod.z.string().max(512).optional(),
@@ -248,6 +254,7 @@ var OverlayParseError = class extends Error {
     this.errors = errors;
     this.name = "OverlayParseError";
   }
+  errors;
 };
 function parseRaw(input) {
   switch (input.kind) {
@@ -305,7 +312,7 @@ function parseOverlay(input) {
 }
 
 // libs/adapters/src/skills/bundle/bundle-diff.ts
-var opEqual = (a, b) => a.operationId === b.operationId && a.serviceId === b.serviceId && a.httpMethod === b.httpMethod && a.pathTemplate === b.pathTemplate && a.authBindingRef === b.authBindingRef && JSON.stringify(a.mapper ?? null) === JSON.stringify(b.mapper ?? null) && JSON.stringify(a.inputSchema) === JSON.stringify(b.inputSchema) && JSON.stringify(a.outputSchema) === JSON.stringify(b.outputSchema) && JSON.stringify(a.requiredAuthorities ?? null) === JSON.stringify(b.requiredAuthorities ?? null) && a.maxResponseBytes === b.maxResponseBytes && a.timeoutMs === b.timeoutMs;
+var opEqual = (a, b) => a.operationId === b.operationId && a.serviceId === b.serviceId && a.httpMethod === b.httpMethod && a.pathTemplate === b.pathTemplate && a.authBindingRef === b.authBindingRef && JSON.stringify(a.mapper ?? null) === JSON.stringify(b.mapper ?? null) && JSON.stringify(a.inputSchema) === JSON.stringify(b.inputSchema) && JSON.stringify(a.outputSchema) === JSON.stringify(b.outputSchema) && JSON.stringify(a.requiredAuthorities ?? null) === JSON.stringify(b.requiredAuthorities ?? null) && (a.public ?? false) === (b.public ?? false) && a.maxResponseBytes === b.maxResponseBytes && a.timeoutMs === b.timeoutMs;
 var skillEqual = (a, b) => a.id === b.id && a.name === b.name && a.description === b.description && a.instructions === b.instructions && JSON.stringify(a.tags ?? []) === JSON.stringify(b.tags ?? []) && JSON.stringify(a.operationIds) === JSON.stringify(b.operationIds) && JSON.stringify(a.requiredAuthorities ?? null) === JSON.stringify(b.requiredAuthorities ?? null);
 function diffBundles(oldBundle, newBundle) {
   const oldSkills = new Map((oldBundle?.skills ?? []).map((s) => [s.id, s]));
@@ -546,6 +553,7 @@ var BundlePinnedError = class extends Error {
     this.pinnedVersion = pinnedVersion;
     this.name = "BundlePinnedError";
   }
+  pinnedVersion;
 };
 
 // libs/adapters/src/skills/dependency/skill-dag.ts
@@ -555,6 +563,7 @@ var SkillDependencyCycleError = class extends Error {
     this.cycle = cycle;
     this.name = "SkillDependencyCycleError";
   }
+  cycle;
 };
 var SkillDependencyMissingError = class extends Error {
   constructor(skillId, missingId) {
@@ -563,6 +572,8 @@ var SkillDependencyMissingError = class extends Error {
     this.missingId = missingId;
     this.name = "SkillDependencyMissingError";
   }
+  skillId;
+  missingId;
 };
 var SkillDependencyInvariantError = class extends Error {
   constructor(message) {
@@ -725,7 +736,22 @@ var saasSourceSchema = import_lazy_zod2.z.object({
   /** Expected issuer (`iss`) claim. */
   expectedIssuer: import_lazy_zod2.z.string().min(1)
 });
-var bundleSourceSchema = import_lazy_zod2.z.discriminatedUnion("type", [staticSourceSchema, npmSourceSchema, saasSourceSchema]);
+var inlineSourceSchema = import_lazy_zod2.z.object({
+  type: import_lazy_zod2.z.literal("inline"),
+  /**
+   * The skilled-OpenAPI bundle object, embedded directly (no filesystem, no
+   * network). The right source for V8-isolate runtimes (Cloudflare Workers),
+   * where `static` (fs) and `npm` can't run and `saas` needs an endpoint. The
+   * object is validated by the overlay parser, same as file/remote bundles.
+   */
+  content: import_lazy_zod2.z.unknown()
+});
+var bundleSourceSchema = import_lazy_zod2.z.discriminatedUnion("type", [
+  staticSourceSchema,
+  npmSourceSchema,
+  saasSourceSchema,
+  inlineSourceSchema
+]);
 var signatureKeySchema = import_lazy_zod2.z.object({
   /** Stable key id (matches `kid` claim in the bundle JWT). */
   keyId: import_lazy_zod2.z.string().min(1),
@@ -735,13 +761,50 @@ var signatureKeySchema = import_lazy_zod2.z.object({
   publicKeyPem: import_lazy_zod2.z.string().min(1)
 });
 
+// libs/adapters/src/skills/sources/inline.source.ts
+var InlineSource = class {
+  constructor(options, logger) {
+    this.options = options;
+    this.logger = logger;
+  }
+  options;
+  logger;
+  id = "inline:bundle";
+  listeners = /* @__PURE__ */ new Set();
+  async start() {
+    const bundle = this.parse();
+    for (const fn of this.listeners) {
+      try {
+        fn(bundle);
+      } catch (e) {
+        this.logger.warn(`[inline-source] listener threw: ${e.message}`);
+      }
+    }
+  }
+  onChange(listener) {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+  async stop() {
+    this.listeners.clear();
+  }
+  parse() {
+    return parseOverlay({ kind: "object", content: this.options.content });
+  }
+};
+
 // libs/adapters/src/skills/sources/npm.source.ts
+var npmDynamicImport;
 var NpmSource = class {
   constructor(options, logger) {
     this.options = options;
     this.logger = logger;
     this.id = `npm:${this.options.packageName}${this.options.exportName ? `#${this.options.exportName}` : ""}`;
   }
+  options;
+  logger;
   id;
   listeners = /* @__PURE__ */ new Set();
   cached;
@@ -781,9 +844,16 @@ var NpmSource = class {
     }
     return parseOverlay({ kind: "object", content: exported });
   }
-  // Indirected so tests can stub.
+  // Indirected so tests can stub. The dynamic `import()` is wrapped in a
+  // lazily-built `new Function` so static bundlers (esbuild / `wrangler dev` /
+  // miniflare) don't try to resolve the runtime-computed package specifier at
+  // build time — installing an npm bundle is a Node-only path that never runs
+  // on a V8 isolate, but `createBundleSource` keeps NpmSource statically
+  // reachable in the worker bundle. The Function is only built when this runs
+  // (Node), so a Worker that merely bundles it never evaluates it.
   dynamicImport(specifier) {
-    return import(specifier);
+    npmDynamicImport ??= new Function("s", "return import(s)");
+    return npmDynamicImport(specifier);
   }
   notify(bundle) {
     for (const fn of this.listeners) {
@@ -801,35 +871,49 @@ var import_utils = require("@frontmcp/utils");
 var DEFAULT_CACHE_DIR = ".frontmcp/skilled-openapi";
 var DEFAULT_PULL_TIMEOUT_MS = 3e4;
 var SaasPullSource = class {
-  constructor(options, cacheDir, logger) {
+  constructor(options, cacheDir, logger, deps = {}) {
     this.options = options;
     this.cacheDir = cacheDir;
     this.logger = logger;
+    this.deps = deps;
     this.id = `saas:${this.options.endpoint}`;
   }
+  options;
+  cacheDir;
+  logger;
+  deps;
   id;
   listeners = /* @__PURE__ */ new Set();
   pollHandle;
   inFlight = false;
   stopped = false;
   async start() {
+    if (this.stopped || this.inFlight) {
+      this.schedulePoll();
+      return;
+    }
+    this.inFlight = true;
     let bundle;
     try {
-      bundle = await this.fetchOnce();
-      await this.persistCache(bundle);
-    } catch (e) {
-      this.logger.warn(
-        `[saas-source] initial pull failed (${e.message}); attempting cached bundle fallback`
-      );
-      bundle = await this.loadCache();
-      if (!bundle) {
-        throw new Error(
-          `[saas-source] initial pull failed and no cached bundle is available at ${this.cachePath()}: ${e.message}`
+      try {
+        bundle = await this.fetchOnce();
+        await this.persistCache(bundle);
+      } catch (e) {
+        this.logger.warn(
+          `[saas-source] initial pull failed (${e.message}); attempting cached bundle fallback`
         );
+        bundle = await this.loadCache();
+        if (!bundle) {
+          throw new Error(
+            `[saas-source] initial pull failed and no cached bundle is available at ${this.cachePath()}: ${e.message}`
+          );
+        }
+        this.logger.warn(`[saas-source] using cached bundle "${bundle.bundleId}@${bundle.version}"`);
       }
-      this.logger.warn(`[saas-source] using cached bundle "${bundle.bundleId}@${bundle.version}"`);
+      this.notify(bundle);
+    } finally {
+      this.inFlight = false;
     }
-    this.notify(bundle);
     this.schedulePoll();
   }
   onChange(listener) {
@@ -847,12 +931,32 @@ var SaasPullSource = class {
     this.listeners.clear();
   }
   schedulePoll() {
-    if (this.stopped) return;
+    if (this.stopped || this.deps.disablePolling) return;
+    if (this.pollHandle) clearTimeout(this.pollHandle);
     this.pollHandle = setTimeout(() => {
       void this.pollOnce();
     }, this.options.pollIntervalMs);
     this.pollHandle.unref?.();
   }
+  /**
+   * Manually pull a fresh bundle, persist it, and notify listeners. Drive this
+   * from a Cron Trigger / Durable Object alarm on runtimes without background
+   * timers (where `disablePolling` is set). Single-flight: returns `undefined`
+   * if a pull is already in flight; throws if the pull itself fails (the caller
+   * — e.g. a scheduled handler — decides how to surface it).
+   */
+  async refresh() {
+    if (this.stopped || this.inFlight) return void 0;
+    this.inFlight = true;
+    try {
+      const bundle = await this.fetchOnce();
+      await this.persistCache(bundle);
+      this.notify(bundle);
+      return bundle;
+    } finally {
+      this.inFlight = false;
+    }
+  }
   async pollOnce() {
     if (this.stopped) return;
     if (this.inFlight) {
@@ -903,6 +1007,10 @@ var SaasPullSource = class {
   }
   async persistCache(bundle) {
     try {
+      if (this.deps.cache) {
+        await this.deps.cache.write(bundle);
+        return;
+      }
       const filePath = this.cachePath();
       await (0, import_utils.ensureDir)((0, import_utils.dirname)(filePath));
       await (0, import_utils.writeFile)(filePath, JSON.stringify(bundle));
@@ -912,6 +1020,11 @@ var SaasPullSource = class {
   }
   async loadCache() {
     try {
+      if (this.deps.cache) {
+        const cached = await this.deps.cache.read();
+        if (cached === void 0 || cached === null) return void 0;
+        return parseOverlay({ kind: "object", content: cached });
+      }
       const filePath = this.cachePath();
       const raw = await (0, import_utils.readFile)(filePath, "utf8");
       return parseOverlay({ kind: "json", content: raw });
@@ -938,6 +1051,8 @@ var StaticSource = class {
     this.logger = logger;
     this.id = `static:${this.options.path}`;
   }
+  options;
+  logger;
   id;
   listeners = /* @__PURE__ */ new Set();
   watcher;
@@ -1022,17 +1137,74 @@ var StaticSource = class {
 };
 
 // libs/adapters/src/skills/sources/index.ts
-function createBundleSource(source, cacheDir, logger) {
+function createBundleSource(source, cacheDir, logger, deps) {
   switch (source.type) {
     case "static":
       return new StaticSource(source, logger);
     case "npm":
       return new NpmSource(source, logger);
     case "saas":
-      return new SaasPullSource(source, cacheDir, logger);
+      return new SaasPullSource(source, cacheDir, logger, deps);
+    case "inline":
+      return new InlineSource(source, logger);
   }
 }
 
+// libs/adapters/src/skills/openapi/compile-skilled-bundle.ts
+var import_mcp_from_openapi = require("mcp-from-openapi");
+async function compileSkilledBundleFromOpenApi(openapi, skills, options) {
+  const serviceId = options.serviceId ?? "api";
+  const baseUrl = options.baseUrl ?? openapi.servers?.[0]?.url;
+  if (!baseUrl) {
+    throw new Error("compileSkilledBundleFromOpenApi: no baseUrl \u2014 pass options.baseUrl or declare servers[] in the OpenAPI doc.");
+  }
+  const generator = await import_mcp_from_openapi.OpenAPIToolGenerator.fromJSON(openapi);
+  const tools = await generator.generateTools();
+  const byOperationId = /* @__PURE__ */ new Map();
+  for (const tool of tools) {
+    const opId = tool.metadata.operationId;
+    if (opId) byOperationId.set(opId, tool);
+  }
+  const referenced = /* @__PURE__ */ new Set();
+  for (const skill of skills) for (const opId of skill.operationIds) referenced.add(opId);
+  const operations = {};
+  for (const opId of referenced) {
+    const tool = byOperationId.get(opId);
+    if (!tool) {
+      throw new Error(`compileSkilledBundleFromOpenApi: operationId "${opId}" is referenced by a skill but not defined in the OpenAPI document.`);
+    }
+    operations[opId] = {
+      operationId: opId,
+      serviceId,
+      httpMethod: tool.metadata.method.toUpperCase(),
+      pathTemplate: tool.metadata.path,
+      summary: tool.metadata.operationSummary ?? tool.description,
+      inputSchema: tool.inputSchema,
+      outputSchema: tool.outputSchema ?? { type: "object" },
+      mapper: tool.mapper,
+      authBindingRef: "default"
+    };
+  }
+  return {
+    schemaVersion: 1,
+    bundleId: options.bundleId,
+    version: options.version,
+    generatedAt: options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    sourceDigest: options.sourceDigest ?? "0".repeat(64),
+    services: [{ id: serviceId, baseUrl }],
+    authBindings: { default: options.authBinding ?? { kind: "none" } },
+    skills: skills.map((s) => ({
+      id: s.id,
+      name: s.name,
+      description: s.description,
+      instructions: s.instructions,
+      tags: s.tags ?? [],
+      operationIds: s.operationIds
+    })),
+    operations
+  };
+}
+
 // libs/adapters/src/skills/sources/filesystem-skills.source.ts
 var import_utils3 = require("@frontmcp/utils");
 var DEFAULT_OPTIONS = {
@@ -1047,6 +1219,7 @@ var FilesystemSkillsSource = class {
     this.options = { ...DEFAULT_OPTIONS, ...options };
     this.id = `filesystem-skills:${this.options.skillsDir}`;
   }
+  logger;
   id;
   options;
   listeners = /* @__PURE__ */ new Set();
@@ -1445,6 +1618,8 @@ var BundlePushJwtVerifier = class {
       jwksUri: options.jwksUri
     };
   }
+  options;
+  logger;
   providerRef;
   jwks;
   /**
@@ -1839,6 +2014,8 @@ var StorageAdapterAuditStore = class {
     this.adapter = adapter;
     this.options = options;
   }
+  adapter;
+  options;
   get sequenceKey() {
     return this.options.sequenceKey ?? SKILL_AUDIT_KEYS.sequence;
   }
@@ -1915,6 +2092,10 @@ var SkillAuditWriter = class {
     this.subjectHashSecret = options.subjectHashSecret ?? this.deriveDefaultSubjectSecret();
     this.maxQueueDepth = options.maxQueueDepth ?? SKILL_AUDIT_QUEUE_MAX;
   }
+  store;
+  signer;
+  logger;
+  metrics;
   /**
    * Single-flight queue: every append() chains onto this promise so the
    * read-tail-then-append-with-prevHash sequence stays atomic per process.
@@ -2529,6 +2710,63 @@ function crossValidateManifest(manifest) {
   return errors.length === 0 ? { ok: true } : { ok: false, errors };
 }
 
+// libs/adapters/src/skills/deploy/manifest-to-config.ts
+function specStem(ref) {
+  const noQuery = ref.split("?")[0].split("#")[0];
+  const base = noQuery.split("/").pop() ?? noQuery;
+  const stem = base.replace(/\.(ya?ml|json)$/i, "");
+  const safe = (stem || base).replace(/[^a-zA-Z0-9_.-]/g, "-");
+  return safe || "spec";
+}
+function normalizeSpec(source) {
+  if (typeof source === "string") {
+    const id = specStem(source);
+    return { id, spec: source, bindingName: id };
+  }
+  return {
+    id: source.id,
+    spec: source.spec,
+    baseUrl: source.baseUrl,
+    bindingName: source.bindingName ?? source.id
+  };
+}
+function buildFrontMcpConfigFromManifest(manifest) {
+  const info = {
+    name: manifest.server.info.name,
+    version: manifest.server.info.version,
+    ...manifest.server.info.title !== void 0 ? { title: manifest.server.info.title } : {}
+  };
+  const skills = {
+    source: manifest.skills.source,
+    ...manifest.skills.alwaysLoad ? { alwaysLoad: manifest.skills.alwaysLoad } : {},
+    ...manifest.skills.tags ? { tags: manifest.skills.tags } : {}
+  };
+  let specs = [];
+  let specsDir;
+  if (typeof manifest.specs === "string") {
+    specsDir = manifest.specs;
+  } else {
+    specs = manifest.specs.map(normalizeSpec);
+    const seen = /* @__PURE__ */ new Set();
+    for (const s of specs) {
+      if (seen.has(s.id)) {
+        throw new Error(
+          `manifest specs: duplicate spec id "${s.id}" (derived from the filename stem). Give the colliding spec an explicit { id } in frontmcp.deploy.yaml.`
+        );
+      }
+      seen.add(s.id);
+    }
+  }
+  return {
+    info,
+    ...manifest.server.instructions !== void 0 ? { instructions: manifest.server.instructions } : {},
+    skillsConfig: { enabled: true, injectInstructions: "append" },
+    skills,
+    specs,
+    ...specsDir !== void 0 ? { specsDir } : {}
+  };
+}
+
 // libs/adapters/src/skills/classifier/openapi-classify.ts
 function classifyOperations(specId, ops) {
   if (!specId || specId.length === 0) {
@@ -2848,6 +3086,7 @@ var ClassificationRegistry = class {
   ClassificationRegistry,
   FilesystemSkillsSource,
   Hs256AuditSigner,
+  InlineSource,
   MemoryAuditStore,
   NpmSource,
   OverlayParseError,
@@ -2867,6 +3106,7 @@ var ClassificationRegistry = class {
   WebhookReplayGuard,
   applyClassificationOverrides,
   applyEnvironmentOverlay,
+  buildFrontMcpConfigFromManifest,
   buildKnownOps,
   buildResourceChangeNotification,
   bundleDigest,
@@ -2876,6 +3116,7 @@ var ClassificationRegistry = class {
   canonicalizeRecordForSigning,
   classifyOne,
   classifyOperations,
+  compileSkilledBundleFromOpenApi,
   createBundleSource,
   crossValidate,
   crossValidateManifest,

package/skills/openapi/compile-skilled-bundle.d.ts

@@ -0,0 +1,73 @@
+/** A hand-authored skill that declares which OpenAPI operations it serves. */
+export interface SkillOpenApiRef {
+    /** Stable skill id (kebab-case). */
+    id: string;
+    /** Human-readable skill name. */
+    name: string;
+    /** One-line description (used for search ranking). */
+    description: string;
+    /** Markdown instructions for performing the skill. */
+    instructions: string;
+    /** OpenAPI `operationId`s this skill exposes. Operations not referenced by any skill are dropped. */
+    operationIds: string[];
+    /** Optional tags (search facets). */
+    tags?: string[];
+}
+export interface CompileSkilledBundleOptions {
+    /** Stable bundle id (e.g. `acme:billing`). */
+    bundleId: string;
+    /** Bundle version (e.g. `1.0.0`). */
+    version: string;
+    /** Service id the operations bind to. Default `'api'`. */
+    serviceId?: string;
+    /**
+     * Base URL for the service. Defaults to the OpenAPI doc's first `servers[].url`.
+     * Required if the document declares no servers.
+     */
+    baseUrl?: string;
+    /** ISO timestamp for `generatedAt`. Defaults to now. */
+    generatedAt?: string;
+    /** Auth binding for the service. Default `{ kind: 'none' }`. */
+    authBinding?: Record<string, unknown>;
+    /** Digest of the source inputs (provenance). Defaults to a zero digest. */
+    sourceDigest?: string;
+}
+/** A compiled skilled-OpenAPI bundle (schemaVersion 1) — validated downstream by `parseOverlay`. */
+export interface CompiledSkilledBundle {
+    schemaVersion: 1;
+    bundleId: string;
+    version: string;
+    generatedAt: string;
+    sourceDigest: string;
+    services: Array<{
+        id: string;
+        baseUrl: string;
+        description?: string;
+    }>;
+    authBindings: Record<string, Record<string, unknown>>;
+    skills: Array<{
+        id: string;
+        name: string;
+        description: string;
+        instructions: string;
+        tags: string[];
+        operationIds: string[];
+    }>;
+    operations: Record<string, {
+        operationId: string;
+        serviceId: string;
+        httpMethod: string;
+        pathTemplate: string;
+        summary?: string;
+        inputSchema: unknown;
+        outputSchema: unknown;
+        mapper: unknown[];
+        authBindingRef: string;
+    }>;
+}
+/**
+ * Compile `(openapi, skills)` → a skilled-OpenAPI bundle. Throws if a skill
+ * references an `operationId` the OpenAPI doesn't define (fail-fast on drift).
+ */
+export declare function compileSkilledBundleFromOpenApi(openapi: object, skills: SkillOpenApiRef[], options: CompileSkilledBundleOptions): Promise<CompiledSkilledBundle>;
+//# sourceMappingURL=compile-skilled-bundle.d.ts.map

package/skills/openapi/compile-skilled-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compile-skilled-bundle.d.ts","sourceRoot":"","sources":["../../../src/skills/openapi/compile-skilled-bundle.ts"],"names":[],"mappings":"AAmBA,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,YAAY,EAAE,MAAM,CAAC;IACrB,qGAAqG;IACrG,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC1C,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAOD,oGAAoG;AACpG,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,CAAC,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,MAAM,EAAE,KAAK,CAAC;QACZ,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC,CAAC;IACH,UAAU,EAAE,MAAM,CAChB,MAAM,EACN;QACE,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,OAAO,CAAC;QACrB,YAAY,EAAE,OAAO,CAAC;QACtB,MAAM,EAAE,OAAO,EAAE,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;KACxB,CACF,CAAC;CACH;AAED;;;GAGG;AACH,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,eAAe,EAAE,EACzB,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CA2DhC"}

package/skills/source-options.d.ts

@@ -20,6 +20,10 @@ export declare const saasSourceSchema: import("@frontmcp/lazy-zod").ZodObject<{
     jwksUrl: import("@frontmcp/lazy-zod").ZodString;
     expectedIssuer: import("@frontmcp/lazy-zod").ZodString;
 }, import("zod/v4/core").$strip>;
+export declare const inlineSourceSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    type: import("@frontmcp/lazy-zod").ZodLiteral<"inline">;
+    content: import("@frontmcp/lazy-zod").ZodUnknown;
+}, import("zod/v4/core").$strip>;
 export declare const bundleSourceSchema: import("@frontmcp/lazy-zod").ZodDiscriminatedUnion<[import("@frontmcp/lazy-zod").ZodObject<{
     type: import("@frontmcp/lazy-zod").ZodLiteral<"static">;
     path: import("@frontmcp/lazy-zod").ZodString;
@@ -38,10 +42,14 @@ export declare const bundleSourceSchema: import("@frontmcp/lazy-zod").ZodDiscrim
     enableWebhook: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
     jwksUrl: import("@frontmcp/lazy-zod").ZodString;
     expectedIssuer: import("@frontmcp/lazy-zod").ZodString;
+}, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
+    type: import("@frontmcp/lazy-zod").ZodLiteral<"inline">;
+    content: import("@frontmcp/lazy-zod").ZodUnknown;
 }, import("zod/v4/core").$strip>], "type">;
 export type StaticSourceOptions = z.infer<typeof staticSourceSchema>;
 export type NpmSourceOptions = z.infer<typeof npmSourceSchema>;
 export type SaasSourceOptions = z.infer<typeof saasSourceSchema>;
+export type InlineSourceOptions = z.infer<typeof inlineSourceSchema>;
 export type BundleSourceOptions = z.infer<typeof bundleSourceSchema>;
 export declare const signatureKeySchema: import("@frontmcp/lazy-zod").ZodObject<{
     keyId: import("@frontmcp/lazy-zod").ZodString;

package/skills/source-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source-options.d.ts","sourceRoot":"","sources":["../../src/skills/source-options.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAkBvC,eAAO,MAAM,kBAAkB;;;;gCAM7B,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;gCAW1B,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;gCAsB3B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;0CAAwF,CAAC;AAExH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACrE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AACjE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIrE,eAAO,MAAM,kBAAkB;;;;;;;gCAO7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}
+{"version":3,"file":"source-options.d.ts","sourceRoot":"","sources":["../../src/skills/source-options.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAkBvC,eAAO,MAAM,kBAAkB;;;;gCAM7B,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;gCAW1B,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;gCAsB3B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;gCAS7B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;0CAK7B,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACrE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AACjE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACrE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIrE,eAAO,MAAM,kBAAkB;;;;;;;gCAO7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/skills/sources/index.d.ts

@@ -1,10 +1,11 @@
 import type { FrontMcpLogger } from '@frontmcp/sdk';
 import type { BundleSourceOptions } from '../source-options';
+import { InlineSource } from './inline.source';
 import { NpmSource } from './npm.source';
 import { SaasPullSource } from './saas-pull.source';
-import type { SkillBundleSource } from './skill-bundle-source.interface';
+import type { BundleSourceDeps, SkillBundleSource } from './skill-bundle-source.interface';
 import { StaticSource } from './static.source';
-export { StaticSource, NpmSource, SaasPullSource };
-export type { SkillBundleSource, BundleSourceListener } from './skill-bundle-source.interface';
-export declare function createBundleSource(source: BundleSourceOptions, cacheDir: string | undefined, logger: FrontMcpLogger): SkillBundleSource;
+export { StaticSource, NpmSource, SaasPullSource, InlineSource };
+export type { BundleCacheStore, BundleSourceDeps, BundleSourceListener, SkillBundleSource, } from './skill-bundle-source.interface';
+export declare function createBundleSource(source: BundleSourceOptions, cacheDir: string | undefined, logger: FrontMcpLogger, deps?: BundleSourceDeps): SkillBundleSource;
 //# sourceMappingURL=index.d.ts.map

package/skills/sources/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AACnD,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAE/F,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,mBAAmB,EAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,cAAc,GACrB,iBAAiB,CASnB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;AACjE,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAEzC,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,mBAAmB,EAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,cAAc,EAGtB,IAAI,CAAC,EAAE,gBAAgB,GACtB,iBAAiB,CAWnB"}

package/skills/sources/inline.source.d.ts

@@ -0,0 +1,16 @@
+import type { FrontMcpLogger } from '@frontmcp/sdk';
+import type { InlineSourceOptions } from '../source-options';
+import type { BundleSourceListener, SkillBundleSource } from './skill-bundle-source.interface';
+/** Loads a bundle from an embedded object. Static (never refreshes). */
+export declare class InlineSource implements SkillBundleSource {
+    private readonly options;
+    private readonly logger;
+    readonly id = "inline:bundle";
+    private readonly listeners;
+    constructor(options: InlineSourceOptions, logger: FrontMcpLogger);
+    start(): Promise<void>;
+    onChange(listener: BundleSourceListener): () => void;
+    stop(): Promise<void>;
+    private parse;
+}
+//# sourceMappingURL=inline.source.d.ts.map

package/skills/sources/inline.source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inline.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/inline.source.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAE/F,wEAAwE;AACxE,qBAAa,YAAa,YAAW,iBAAiB;IAMlD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANzB,QAAQ,CAAC,EAAE,mBAAmB;IAE9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmC;gBAG1C,OAAO,EAAE,mBAAmB,EAC5B,MAAM,EAAE,cAAc;IAGnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAW5B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAO9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,OAAO,CAAC,KAAK;CAGd"}

package/skills/sources/npm.source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npm.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/npm.source.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAE/F;;;;;;;;;;;GAWG;AACH,qBAAa,SAAU,YAAW,iBAAiB;IAO/C,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,MAAM,CAAC,CAAiB;gBAGb,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,cAAc;IAKnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAM5B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAe9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAIb,qBAAqB;IAqBnC,SAAS,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI5D,OAAO,CAAC,MAAM;CASf"}
+{"version":3,"file":"npm.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/npm.source.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAO/F;;;;;;;;;;;GAWG;AACH,qBAAa,SAAU,YAAW,iBAAiB;IAO/C,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,MAAM,CAAC,CAAiB;gBAGb,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,cAAc;IAKnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAM5B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAe9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAIb,qBAAqB;IA2BnC,SAAS,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK5D,OAAO,CAAC,MAAM;CASf"}