@frontmcp/adapters 1.8.2 → 1.8.3

package/skills/sources/npm.source.d.ts

@@ -8,10 +8,15 @@ import type { BundleSourceListener, SkillBundleSource } from './skill-bundle-sou
  * `package.json` and only updates after a server redeploy. This is the
  * intentional, lower-blast-radius distribution mode.
  *
- * Provenance verification (GitHub artifact attestations / Sigstore) is in the
- * v1.2 SHOULD-HAVE list but not yet implemented in OSS — when
- * `verifyProvenance: true` (the default), this source emits a startup warning
- * if no attestation is present so customers know what they're trading off.
+ * Provenance verification (GitHub artifact attestations / Sigstore) is not
+ * implemented. `verifyProvenance: true` (the default) therefore refuses the
+ * package before it is imported: a setting that promises a supply-chain check
+ * must not load code it could not check. Set `verifyProvenance: false` to load
+ * the package without one. The package is then imported, and its code runs,
+ * before the bundle is parsed, so bundle signing (`requireSignature` +
+ * `trustedKeys`) protects the bundle's content but not the import: trust comes
+ * from the package itself (an exact pinned version installed from a lockfile
+ * with integrity hashes).
  */
 export declare class NpmSource implements SkillBundleSource {
     private readonly options;

package/skills/sources/npm.source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npm.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/npm.source.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAO/F;;;;;;;;;;;GAWG;AACH,qBAAa,SAAU,YAAW,iBAAiB;IAO/C,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,MAAM,CAAC,CAAiB;gBAGb,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,cAAc;IAKnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAM5B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAe9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAIb,qBAAqB;IA2BnC,SAAS,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK5D,OAAO,CAAC,MAAM;CASf"}
+{"version":3,"file":"npm.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/npm.source.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAO/F;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,SAAU,YAAW,iBAAiB;IAO/C,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,MAAM,CAAC,CAAiB;gBAGb,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,cAAc;IAKnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAM5B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAe9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAIb,qBAAqB;IA6BnC,SAAS,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK5D,OAAO,CAAC,MAAM;CASf"}

package/skills/sources/saas-pull.source.d.ts

@@ -2,6 +2,14 @@ import type { FrontMcpLogger } from '@frontmcp/sdk';
 import type { ResolvedBundle } from '../bundle/bundle.types';
 import type { SaasSourceOptions } from '../source-options';
 import type { BundleSourceDeps, BundleSourceListener, SkillBundleSource } from './skill-bundle-source.interface';
+/**
+ * The pinned pull token failed verification against `jwksUrl`, `expectedIssuer`
+ * or `expectedAudience`. Unlike an outage, this never falls back to a cached
+ * bundle: the configured SaaS is not the one the server was set up to trust.
+ */
+export declare class SaasPullTokenRejectedError extends Error {
+    constructor(reason: string);
+}
 /**
  * Pulls bundles from a configured SaaS endpoint via authenticated HTTPS.
  *
@@ -17,8 +25,16 @@ import type { BundleSourceDeps, BundleSourceListener, SkillBundleSource } from '
  * `enableWebhook` and deferred to v1.2.x (route mounting requires plugin HTTP
  * infrastructure not yet in scope).
  *
- * NOTE: This source ONLY parses + caches bundles. Signature verification is
- * applied by the bundle-sync service before the bundle becomes active.
+ * Before every pull the pinned `authToken` is verified: it must be a JWT signed
+ * by a key in the issuer's JWKS (`jwksUrl`), with `iss` equal to
+ * `expectedIssuer` and `aud` including `expectedAudience` (and `resource` too,
+ * when the token carries one), and not expired. A rejected token stops the pull
+ * and is never answered with the cached bundle ({@link SaasPullTokenRejectedError});
+ * an unreachable JWKS, or one with no usable signing key, is treated like any
+ * other pull failure (the cache fallback still applies).
+ *
+ * NOTE: Bundle signature verification is applied by the bundle-sync service
+ * before the bundle becomes active.
  */
 export declare class SaasPullSource implements SkillBundleSource {
     private readonly options;
@@ -30,6 +46,7 @@ export declare class SaasPullSource implements SkillBundleSource {
     private pollHandle;
     private inFlight;
     private stopped;
+    private readonly jwksService;
     constructor(options: SaasSourceOptions, cacheDir: string | undefined, logger: FrontMcpLogger, deps?: BundleSourceDeps);
     start(): Promise<void>;
     onChange(listener: BundleSourceListener): () => void;
@@ -48,6 +65,12 @@ export declare class SaasPullSource implements SkillBundleSource {
         status: number;
         body: string;
     }>;
+    /**
+     * Verify the pinned pull token against the issuer's JWKS, issuer and audience.
+     * Throws {@link SaasPullTokenRejectedError} when the token is refused, and a
+     * plain Error when the JWKS can't be fetched (an outage).
+     */
+    private verifyPullToken;
     private fetchOnce;
     private cachePath;
     private persistCache;

package/skills/sources/saas-pull.source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saas-pull.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/saas-pull.source.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAKjH;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,cAAe,YAAW,iBAAiB;IASpD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAXvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,OAAO,CAAS;gBAGL,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,cAAc,EACtB,IAAI,GAAE,gBAAqB;IAKxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAqC5B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAO9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAS3B,OAAO,CAAC,YAAY;IAcpB;;;;;;OAMG;IACG,OAAO,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;YAatC,QAAQ;cAqBN,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;YAoBlG,SAAS;IAiBvB,OAAO,CAAC,SAAS;YAKH,YAAY;YAeZ,SAAS;IAkBvB,OAAO,CAAC,MAAM;CASf"}
+{"version":3,"file":"saas-pull.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/saas-pull.source.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAMjH;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,MAAM,EAAE,MAAM;CAI3B;AA4BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,cAAe,YAAW,iBAAiB;IAUpD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAZvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;gBAGhC,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,cAAc,EACtB,IAAI,GAAE,gBAAqB;IAKxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAwC5B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAO9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAS3B,OAAO,CAAC,YAAY;IAcpB;;;;;;OAMG;IACG,OAAO,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;YAatC,QAAQ;cAyBN,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAoBhH;;;;OAIG;YACW,eAAe;YA2Cf,SAAS;IAkBvB,OAAO,CAAC,SAAS;YAKH,YAAY;YAeZ,SAAS;IAkBvB,OAAO,CAAC,MAAM;CASf"}