@frontmcp/observability 1.0.4 → 1.1.0

package/esm/index.mjs

@@ -319,186 +319,142 @@ var init_otlp_sink = __esm({
 });
 
 // libs/observability/src/plugin/observability.plugin.ts
+import { trace as trace5 } from "@opentelemetry/api";
 import {
+  AgentCallHook,
   DynamicPlugin,
-  Plugin,
-  ProviderScope,
+  FlowHooksOf,
   FRONTMCP_CONTEXT,
-  ToolHook,
-  ResourceHook,
   HttpHook,
-  ListToolsHook,
   ListResourcesHook,
   ListResourceTemplatesHook,
-  AgentCallHook,
-  FlowHooksOf
+  ListToolsHook,
+  Plugin,
+  ProviderScope,
+  ResourceHook,
+  ToolHook
 } from "@frontmcp/sdk";
-import { trace as trace5 } from "@opentelemetry/api";
-
-// libs/observability/src/otel/otel.tokens.ts
-var OTEL_TRACER = /* @__PURE__ */ Symbol.for("frontmcp:observability:otel-tracer");
-var OTEL_CONFIG = /* @__PURE__ */ Symbol.for("frontmcp:observability:otel-config");
 
-// libs/observability/src/request-log/request-log.tokens.ts
-var REQUEST_LOG_COLLECTOR = /* @__PURE__ */ Symbol.for("frontmcp:observability:request-log-collector");
-
-// libs/observability/src/request-log/request-log.collector.ts
-var RequestLogCollector = class {
-  constructor(context, options) {
-    this.entries = [];
-    this.hooksTriggered = /* @__PURE__ */ new Set();
-    this.authenticated = false;
-    this.status = "ok";
-    this.finalized = false;
-    this.requestId = context.requestId;
-    this.traceId = context.traceId;
-    this.sessionIdHash = context.sessionIdHash;
-    this.scopeId = context.scopeId;
-    this.startTime = /* @__PURE__ */ new Date();
-    this.maxEntries = options?.maxEntries ?? 500;
-    this.onComplete = options?.onRequestComplete;
-  }
-  /**
-   * Add a structured log entry to this request's log.
-   * Called by StructuredLogTransport for each log record that
-   * matches this request's requestId.
-   */
-  addEntry(entry) {
-    if (this.finalized || this.entries.length >= this.maxEntries) return;
-    const logEntry = {
-      timestamp: entry.timestamp,
-      level: entry.level,
-      message: entry.message
-    };
-    if (entry.flow_name) {
-      logEntry.stage = entry.flow_name;
-    }
-    if (entry.elapsed_ms !== void 0) {
-      logEntry.elapsed_ms = entry.elapsed_ms;
-    }
-    if (entry.attributes && Object.keys(entry.attributes).length > 0) {
-      logEntry.attributes = entry.attributes;
-    }
-    this.entries.push(logEntry);
+// libs/observability/src/logging/sinks/stdout.sink.ts
+var StdoutSink = class {
+  constructor(options) {
+    this.stream = options?.stream ?? process.stdout;
+    this.pretty = options?.pretty ?? false;
   }
-  /**
-   * Record a hook stage that was triggered during this request.
-   */
-  addHook(stage) {
-    this.hooksTriggered.add(stage);
+  write(entry) {
+    const line = this.pretty ? JSON.stringify(entry, null, 2) : JSON.stringify(entry);
+    this.stream.write(line + "\n");
   }
-  /**
-   * Set HTTP request metadata.
-   */
-  setHttpInfo(method, path) {
-    this.httpMethod = method;
-    this.httpPath = path;
+};
+
+// libs/observability/src/logging/sinks/console.sink.ts
+var ConsoleSink = class {
+  write(entry) {
+    const method = levelToConsoleMethod(entry.level);
+    const formatted = formatEntry(entry);
+    method(formatted);
   }
-  /**
-   * Set the MCP JSON-RPC method being invoked.
-   */
-  setRpcMethod(method) {
-    this.rpcMethod = method;
+};
+function formatEntry(entry) {
+  const useAnsi = typeof process !== "undefined" && !!process.stdout?.isTTY;
+  const ts = entry.timestamp.slice(11, 23);
+  const level = entry.level.toUpperCase().padEnd(7);
+  const traceShort = entry.trace_id ? entry.trace_id.slice(0, 8) : "";
+  const reqShort = entry.request_id ? entry.request_id.slice(0, 8) : "";
+  const parts = [];
+  const DIM2 = useAnsi ? "\x1B[2m" : "";
+  const BOLD2 = useAnsi ? "\x1B[1m" : "";
+  const RESET2 = useAnsi ? "\x1B[0m" : "";
+  const levelColor = useAnsi ? LEVEL_COLORS[entry.level] ?? "" : "";
+  parts.push(`${DIM2}[${ts}]${RESET2}`);
+  parts.push(`${BOLD2}${levelColor}${level}${RESET2}`);
+  if (traceShort || reqShort) {
+    parts.push(`${DIM2}[${traceShort}${reqShort ? ":" + reqShort : ""}]${RESET2}`);
   }
-  /**
-   * Set the tool name being invoked.
-   */
-  setToolName(name) {
-    this.toolName = name;
+  if (entry.prefix) parts.push(`${DIM2}[${entry.prefix}]${RESET2}`);
+  parts.push(entry.message);
+  if (entry.attributes && Object.keys(entry.attributes).length > 0) {
+    const attrs = Object.entries(entry.attributes).map(([k, v]) => `${k}=${typeof v === "string" ? v : JSON.stringify(v)}`).join(" ");
+    parts.push(`${DIM2}{ ${attrs} }${RESET2}`);
   }
-  /**
-   * Set the resource URI being read.
-   */
-  setResourceUri(uri) {
-    this.resourceUri = uri;
+  if (entry.error) {
+    parts.push(`[${entry.error.type}: ${entry.error.message}]`);
   }
-  /**
-   * Set the prompt name being invoked.
-   */
-  setPromptName(name) {
-    this.promptName = name;
+  if (entry.elapsed_ms !== void 0) {
+    parts.push(`${DIM2}(${entry.elapsed_ms}ms)${RESET2}`);
   }
-  /**
-   * Set authentication info.
-   */
-  setAuthInfo(type, authenticated) {
-    this.authType = type;
-    this.authenticated = authenticated;
+  return parts.join(" ");
+}
+var LEVEL_COLORS = {
+  debug: "\x1B[34m",
+  verbose: "\x1B[90m",
+  info: "\x1B[32m",
+  warn: "\x1B[33m",
+  error: "\x1B[31m"
+};
+function levelToConsoleMethod(level) {
+  switch (level) {
+    case "debug":
+    case "verbose":
+      return console.debug;
+    case "info":
+      return console.info;
+    case "warn":
+      return console.warn;
+    case "error":
+      return console.error;
+    default:
+      return console.log;
   }
-  /**
-   * Set request status.
-   */
-  setStatus(status, statusCode) {
-    this.status = status;
-    this.statusCode = statusCode;
+}
+
+// libs/observability/src/logging/sinks/callback.sink.ts
+var CallbackSink = class {
+  constructor(fn) {
+    this.fn = fn;
   }
-  /**
-   * Set error details.
-   */
-  setError(error) {
-    this.error = error;
-    this.status = "error";
+  write(entry) {
+    this.fn(entry);
   }
-  /**
-   * Finalize and produce the complete RequestLog.
-   * Fires the onRequestComplete callback if configured.
-   */
-  async finalize() {
-    if (this.finalized) {
-      return this.finalizedLog;
+};
+
+// libs/observability/src/logging/sink.factory.ts
+function createSink(config) {
+  switch (config.type) {
+    case "stdout":
+      return new StdoutSink({ stream: config.stream, pretty: config.pretty });
+    case "console":
+      return new ConsoleSink();
+    case "winston": {
+      const { WinstonSink: WinstonSink2 } = (init_winston_sink(), __toCommonJS(winston_sink_exports));
+      return new WinstonSink2(config.logger);
     }
-    this.finalized = true;
-    const log = this.toRequestLog();
-    this.finalizedLog = log;
-    if (this.onComplete) {
-      try {
-        await this.onComplete(log);
-      } catch {
-      }
+    case "pino": {
+      const { PinoSink: PinoSink2 } = (init_pino_sink(), __toCommonJS(pino_sink_exports));
+      return new PinoSink2(config.logger);
     }
-    return log;
-  }
-  /**
-   * Build the RequestLog object from accumulated state.
-   */
-  toRequestLog() {
-    const endTime = /* @__PURE__ */ new Date();
-    return {
-      request_id: this.requestId,
-      trace_id: this.traceId,
-      session_id_hash: this.sessionIdHash,
-      scope_id: this.scopeId,
-      start_time: this.startTime.toISOString(),
-      end_time: endTime.toISOString(),
-      duration_ms: endTime.getTime() - this.startTime.getTime(),
-      http_method: this.httpMethod,
-      http_path: this.httpPath,
-      rpc_method: this.rpcMethod,
-      tool_name: this.toolName,
-      resource_uri: this.resourceUri,
-      prompt_name: this.promptName,
-      auth_type: this.authType,
-      authenticated: this.authenticated,
-      status: this.status,
-      status_code: this.statusCode,
-      error: this.error,
-      hooks_triggered: Array.from(this.hooksTriggered),
-      entries: [...this.entries]
-    };
-  }
-  /**
-   * Check if the collector has been finalized.
-   */
-  isFinalized() {
-    return this.finalized;
+    case "callback":
+      return new CallbackSink(config.fn);
+    case "otlp": {
+      const { OtlpSink: OtlpSink2 } = (init_otlp_sink(), __toCommonJS(otlp_sink_exports));
+      return new OtlpSink2({
+        endpoint: config.endpoint ?? (typeof process !== "undefined" ? process.env?.["OTEL_EXPORTER_OTLP_ENDPOINT"] : void 0) ?? "http://localhost:4318",
+        headers: config.headers,
+        batchSize: config.batchSize,
+        flushIntervalMs: config.flushIntervalMs,
+        serviceName: config.serviceName
+      });
+    }
+    default:
+      throw new Error(`Unknown sink type: ${config.type}`);
   }
-  /**
-   * Get the number of accumulated entries.
-   */
-  getEntryCount() {
-    return this.entries.length;
+}
+function createSinks(configs) {
+  if (configs && configs.length > 0) {
+    return configs.map(createSink);
   }
-};
+  return [];
+}
 
 // libs/observability/src/logging/structured-log-transport.ts
 import { LogTransportInterface, LogLevelName, LogTransport } from "@frontmcp/sdk";
@@ -642,126 +598,170 @@ StructuredLogTransport = __decorateClass([
   })
 ], StructuredLogTransport);
 
-// libs/observability/src/logging/sinks/stdout.sink.ts
-var StdoutSink = class {
-  constructor(options) {
-    this.stream = options?.stream ?? process.stdout;
-    this.pretty = options?.pretty ?? false;
+// libs/observability/src/otel/otel.tokens.ts
+var OTEL_TRACER = /* @__PURE__ */ Symbol.for("frontmcp:observability:otel-tracer");
+var OTEL_CONFIG = /* @__PURE__ */ Symbol.for("frontmcp:observability:otel-config");
+
+// libs/observability/src/request-log/request-log.collector.ts
+var RequestLogCollector = class {
+  constructor(context, options) {
+    this.entries = [];
+    this.hooksTriggered = /* @__PURE__ */ new Set();
+    this.authenticated = false;
+    this.status = "ok";
+    this.finalized = false;
+    this.requestId = context.requestId;
+    this.traceId = context.traceId;
+    this.sessionIdHash = context.sessionIdHash;
+    this.scopeId = context.scopeId;
+    this.startTime = /* @__PURE__ */ new Date();
+    this.maxEntries = options?.maxEntries ?? 500;
+    this.onComplete = options?.onRequestComplete;
   }
-  write(entry) {
-    const line = this.pretty ? JSON.stringify(entry, null, 2) : JSON.stringify(entry);
-    this.stream.write(line + "\n");
+  /**
+   * Add a structured log entry to this request's log.
+   * Called by StructuredLogTransport for each log record that
+   * matches this request's requestId.
+   */
+  addEntry(entry) {
+    if (this.finalized || this.entries.length >= this.maxEntries) return;
+    const logEntry = {
+      timestamp: entry.timestamp,
+      level: entry.level,
+      message: entry.message
+    };
+    if (entry.flow_name) {
+      logEntry.stage = entry.flow_name;
+    }
+    if (entry.elapsed_ms !== void 0) {
+      logEntry.elapsed_ms = entry.elapsed_ms;
+    }
+    if (entry.attributes && Object.keys(entry.attributes).length > 0) {
+      logEntry.attributes = entry.attributes;
+    }
+    this.entries.push(logEntry);
   }
-};
-
-// libs/observability/src/logging/sinks/console.sink.ts
-var ConsoleSink = class {
-  write(entry) {
-    const method = levelToConsoleMethod(entry.level);
-    const formatted = formatEntry(entry);
-    method(formatted);
+  /**
+   * Record a hook stage that was triggered during this request.
+   */
+  addHook(stage) {
+    this.hooksTriggered.add(stage);
   }
-};
-function formatEntry(entry) {
-  const useAnsi = typeof process !== "undefined" && !!process.stdout?.isTTY;
-  const ts = entry.timestamp.slice(11, 23);
-  const level = entry.level.toUpperCase().padEnd(7);
-  const traceShort = entry.trace_id ? entry.trace_id.slice(0, 8) : "";
-  const reqShort = entry.request_id ? entry.request_id.slice(0, 8) : "";
-  const parts = [];
-  const DIM2 = useAnsi ? "\x1B[2m" : "";
-  const BOLD2 = useAnsi ? "\x1B[1m" : "";
-  const RESET2 = useAnsi ? "\x1B[0m" : "";
-  const levelColor = useAnsi ? LEVEL_COLORS[entry.level] ?? "" : "";
-  parts.push(`${DIM2}[${ts}]${RESET2}`);
-  parts.push(`${BOLD2}${levelColor}${level}${RESET2}`);
-  if (traceShort || reqShort) {
-    parts.push(`${DIM2}[${traceShort}${reqShort ? ":" + reqShort : ""}]${RESET2}`);
+  /**
+   * Set HTTP request metadata.
+   */
+  setHttpInfo(method, path) {
+    this.httpMethod = method;
+    this.httpPath = path;
   }
-  if (entry.prefix) parts.push(`${DIM2}[${entry.prefix}]${RESET2}`);
-  parts.push(entry.message);
-  if (entry.attributes && Object.keys(entry.attributes).length > 0) {
-    const attrs = Object.entries(entry.attributes).map(([k, v]) => `${k}=${typeof v === "string" ? v : JSON.stringify(v)}`).join(" ");
-    parts.push(`${DIM2}{ ${attrs} }${RESET2}`);
+  /**
+   * Set the MCP JSON-RPC method being invoked.
+   */
+  setRpcMethod(method) {
+    this.rpcMethod = method;
   }
-  if (entry.error) {
-    parts.push(`[${entry.error.type}: ${entry.error.message}]`);
+  /**
+   * Set the tool name being invoked.
+   */
+  setToolName(name) {
+    this.toolName = name;
   }
-  if (entry.elapsed_ms !== void 0) {
-    parts.push(`${DIM2}(${entry.elapsed_ms}ms)${RESET2}`);
+  /**
+   * Set the resource URI being read.
+   */
+  setResourceUri(uri) {
+    this.resourceUri = uri;
   }
-  return parts.join(" ");
-}
-var LEVEL_COLORS = {
-  debug: "\x1B[34m",
-  verbose: "\x1B[90m",
-  info: "\x1B[32m",
-  warn: "\x1B[33m",
-  error: "\x1B[31m"
-};
-function levelToConsoleMethod(level) {
-  switch (level) {
-    case "debug":
-    case "verbose":
-      return console.debug;
-    case "info":
-      return console.info;
-    case "warn":
-      return console.warn;
-    case "error":
-      return console.error;
-    default:
-      return console.log;
+  /**
+   * Set the prompt name being invoked.
+   */
+  setPromptName(name) {
+    this.promptName = name;
   }
-}
-
-// libs/observability/src/logging/sinks/callback.sink.ts
-var CallbackSink = class {
-  constructor(fn) {
-    this.fn = fn;
+  /**
+   * Set authentication info.
+   */
+  setAuthInfo(type, authenticated) {
+    this.authType = type;
+    this.authenticated = authenticated;
   }
-  write(entry) {
-    this.fn(entry);
+  /**
+   * Set request status.
+   */
+  setStatus(status, statusCode) {
+    this.status = status;
+    this.statusCode = statusCode;
   }
-};
-
-// libs/observability/src/logging/sink.factory.ts
-function createSink(config) {
-  switch (config.type) {
-    case "stdout":
-      return new StdoutSink({ stream: config.stream, pretty: config.pretty });
-    case "console":
-      return new ConsoleSink();
-    case "winston": {
-      const { WinstonSink: WinstonSink2 } = (init_winston_sink(), __toCommonJS(winston_sink_exports));
-      return new WinstonSink2(config.logger);
-    }
-    case "pino": {
-      const { PinoSink: PinoSink2 } = (init_pino_sink(), __toCommonJS(pino_sink_exports));
-      return new PinoSink2(config.logger);
+  /**
+   * Set error details.
+   */
+  setError(error) {
+    this.error = error;
+    this.status = "error";
+  }
+  /**
+   * Finalize and produce the complete RequestLog.
+   * Fires the onRequestComplete callback if configured.
+   */
+  async finalize() {
+    if (this.finalized) {
+      return this.finalizedLog;
     }
-    case "callback":
-      return new CallbackSink(config.fn);
-    case "otlp": {
-      const { OtlpSink: OtlpSink2 } = (init_otlp_sink(), __toCommonJS(otlp_sink_exports));
-      return new OtlpSink2({
-        endpoint: config.endpoint ?? (typeof process !== "undefined" ? process.env?.["OTEL_EXPORTER_OTLP_ENDPOINT"] : void 0) ?? "http://localhost:4318",
-        headers: config.headers,
-        batchSize: config.batchSize,
-        flushIntervalMs: config.flushIntervalMs,
-        serviceName: config.serviceName
-      });
+    this.finalized = true;
+    const log = this.toRequestLog();
+    this.finalizedLog = log;
+    if (this.onComplete) {
+      try {
+        await this.onComplete(log);
+      } catch {
+      }
     }
-    default:
-      throw new Error(`Unknown sink type: ${config.type}`);
+    return log;
+  }
+  /**
+   * Build the RequestLog object from accumulated state.
+   */
+  toRequestLog() {
+    const endTime = /* @__PURE__ */ new Date();
+    return {
+      request_id: this.requestId,
+      trace_id: this.traceId,
+      session_id_hash: this.sessionIdHash,
+      scope_id: this.scopeId,
+      start_time: this.startTime.toISOString(),
+      end_time: endTime.toISOString(),
+      duration_ms: endTime.getTime() - this.startTime.getTime(),
+      http_method: this.httpMethod,
+      http_path: this.httpPath,
+      rpc_method: this.rpcMethod,
+      tool_name: this.toolName,
+      resource_uri: this.resourceUri,
+      prompt_name: this.promptName,
+      auth_type: this.authType,
+      authenticated: this.authenticated,
+      status: this.status,
+      status_code: this.statusCode,
+      error: this.error,
+      hooks_triggered: Array.from(this.hooksTriggered),
+      entries: [...this.entries]
+    };
   }
-}
-function createSinks(configs) {
-  if (configs && configs.length > 0) {
-    return configs.map(createSink);
+  /**
+   * Check if the collector has been finalized.
+   */
+  isFinalized() {
+    return this.finalized;
   }
-  return [];
-}
+  /**
+   * Get the number of accumulated entries.
+   */
+  getEntryCount() {
+    return this.entries.length;
+  }
+};
+
+// libs/observability/src/request-log/request-log.tokens.ts
+var REQUEST_LOG_COLLECTOR = /* @__PURE__ */ Symbol.for("frontmcp:observability:request-log-collector");
 
 // libs/observability/src/telemetry/telemetry.accessor.ts
 import {
@@ -800,15 +800,12 @@ function createOTelContextFromTrace(tc) {
 }
 
 // libs/observability/src/plugin/observability.hooks.ts
-import { sha256Hex } from "@frontmcp/utils";
 import {
+  context as otelContext3,
   SpanKind as SpanKind11,
-  trace as trace3,
-  context as otelContext3
+  trace as trace3
 } from "@opentelemetry/api";
-
-// libs/observability/src/otel/spans/http-server.span.ts
-import { SpanKind as SpanKind2 } from "@opentelemetry/api";
+import { sha256Hex } from "@frontmcp/utils";
 
 // libs/observability/src/otel/otel.types.ts
 var McpAttributes = {
@@ -923,6 +920,9 @@ var EnduserAttributes = {
   SCOPE: "enduser.scope"
 };
 
+// libs/observability/src/otel/spans/auth.span.ts
+import { SpanKind as SpanKind2 } from "@opentelemetry/api";
+
 // libs/observability/src/otel/spans/span.utils.ts
 import {
   SpanKind,
@@ -969,7 +969,43 @@ async function withSpan(tracer, options, fn) {
   });
 }
 
+// libs/observability/src/otel/spans/auth.span.ts
+function startAuthSpan(tracer, options) {
+  return startSpan(tracer, {
+    name: `auth ${options.flowName}`,
+    kind: SpanKind2.INTERNAL,
+    attributes: {
+      [FrontMcpAttributes.FLOW_NAME]: options.flowName
+    },
+    parentContext: options.parentContext
+  });
+}
+function setAuthMode(span, mode) {
+  span.setAttribute(FrontMcpAttributes.AUTH_MODE, mode);
+}
+function setAuthResult(span, result) {
+  span.setAttribute(FrontMcpAttributes.AUTH_RESULT, result);
+}
+
+// libs/observability/src/otel/spans/fetch.span.ts
+import { SpanKind as SpanKind3 } from "@opentelemetry/api";
+function startFetchSpan(tracer, options) {
+  return startSpan(tracer, {
+    name: options.method.toUpperCase(),
+    kind: SpanKind3.CLIENT,
+    attributes: {
+      [HttpAttributes.METHOD]: options.method.toUpperCase(),
+      [HttpAttributes.URL_FULL]: options.url
+    },
+    parentContext: options.parentContext
+  });
+}
+function setFetchResponseStatus(span, statusCode) {
+  span.setAttribute(HttpAttributes.STATUS_CODE, statusCode);
+}
+
 // libs/observability/src/otel/spans/http-server.span.ts
+import { SpanKind as SpanKind4 } from "@opentelemetry/api";
 function startHttpServerSpan(tracer, options) {
   const attributes = {
     [HttpAttributes.METHOD]: options.method.toUpperCase(),
@@ -992,7 +1028,7 @@ function startHttpServerSpan(tracer, options) {
   }
   return startSpan(tracer, {
     name: `${options.method.toUpperCase()} ${options.path}`,
-    kind: SpanKind2.SERVER,
+    kind: SpanKind4.SERVER,
     attributes,
     parentContext: options.parentContext
   });
@@ -1001,8 +1037,43 @@ function setHttpResponseStatus(span, statusCode) {
   span.setAttribute(HttpAttributes.STATUS_CODE, statusCode);
 }
 
+// libs/observability/src/otel/spans/prompt.span.ts
+import { SpanKind as SpanKind5 } from "@opentelemetry/api";
+function startPromptSpan(tracer, options) {
+  return startSpan(tracer, {
+    name: `prompt ${options.name}`,
+    kind: SpanKind5.INTERNAL,
+    attributes: {
+      [FrontMcpAttributes.PROMPT_NAME]: options.name,
+      [McpAttributes.COMPONENT_TYPE]: "prompt",
+      [McpAttributes.COMPONENT_KEY]: `prompt:${options.name}`
+    },
+    parentContext: options.parentContext
+  });
+}
+
+// libs/observability/src/otel/spans/resource.span.ts
+import { SpanKind as SpanKind6 } from "@opentelemetry/api";
+function startResourceSpan(tracer, options) {
+  const attributes = {
+    [FrontMcpAttributes.RESOURCE_URI]: options.uri,
+    [McpAttributes.RESOURCE_URI]: options.uri,
+    [McpAttributes.COMPONENT_TYPE]: "resource",
+    [McpAttributes.COMPONENT_KEY]: `resource:${options.uri}`
+  };
+  if (options.name) {
+    attributes[FrontMcpAttributes.RESOURCE_NAME] = options.name;
+  }
+  return startSpan(tracer, {
+    name: `resource ${options.uri}`,
+    kind: SpanKind6.INTERNAL,
+    attributes,
+    parentContext: options.parentContext
+  });
+}
+
 // libs/observability/src/otel/spans/rpc.span.ts
-import { SpanKind as SpanKind3 } from "@opentelemetry/api";
+import { SpanKind as SpanKind7 } from "@opentelemetry/api";
 function startRpcSpan(tracer, options) {
   const attributes = {
     [RpcAttributes.SYSTEM]: "mcp",
@@ -1026,14 +1097,35 @@ function startRpcSpan(tracer, options) {
   }
   return startSpan(tracer, {
     name: options.method,
-    kind: SpanKind3.SERVER,
+    kind: SpanKind7.SERVER,
     attributes,
     parentContext: options.parentContext
   });
 }
 
+// libs/observability/src/otel/spans/startup.span.ts
+import { SpanKind as SpanKind8 } from "@opentelemetry/api";
+function emitStartupReport(tracer, data) {
+  const attributes = {
+    [FrontMcpAttributes.STARTUP_TOOLS_COUNT]: data.toolsCount,
+    [FrontMcpAttributes.STARTUP_RESOURCES_COUNT]: data.resourcesCount,
+    [FrontMcpAttributes.STARTUP_PROMPTS_COUNT]: data.promptsCount,
+    [FrontMcpAttributes.STARTUP_PLUGINS_COUNT]: data.pluginsCount,
+    [FrontMcpAttributes.STARTUP_DURATION_MS]: data.durationMs
+  };
+  if (data.scopeId) {
+    attributes[FrontMcpAttributes.SCOPE_ID] = data.scopeId;
+  }
+  const { span } = startSpan(tracer, {
+    name: "frontmcp.startup",
+    kind: SpanKind8.INTERNAL,
+    attributes
+  });
+  endSpanOk(span);
+}
+
 // libs/observability/src/otel/spans/tool.span.ts
-import { SpanKind as SpanKind4 } from "@opentelemetry/api";
+import { SpanKind as SpanKind9 } from "@opentelemetry/api";
 function startToolSpan(tracer, options) {
   const attributes = {
     [FrontMcpAttributes.TOOL_NAME]: options.name,
@@ -1051,49 +1143,14 @@ function startToolSpan(tracer, options) {
   }
   return startSpan(tracer, {
     name: `tool ${options.name}`,
-    kind: SpanKind4.INTERNAL,
-    attributes,
-    parentContext: options.parentContext
-  });
-}
-
-// libs/observability/src/otel/spans/resource.span.ts
-import { SpanKind as SpanKind5 } from "@opentelemetry/api";
-function startResourceSpan(tracer, options) {
-  const attributes = {
-    [FrontMcpAttributes.RESOURCE_URI]: options.uri,
-    [McpAttributes.RESOURCE_URI]: options.uri,
-    [McpAttributes.COMPONENT_TYPE]: "resource",
-    [McpAttributes.COMPONENT_KEY]: `resource:${options.uri}`
-  };
-  if (options.name) {
-    attributes[FrontMcpAttributes.RESOURCE_NAME] = options.name;
-  }
-  return startSpan(tracer, {
-    name: `resource ${options.uri}`,
-    kind: SpanKind5.INTERNAL,
+    kind: SpanKind9.INTERNAL,
     attributes,
     parentContext: options.parentContext
   });
 }
 
-// libs/observability/src/otel/spans/prompt.span.ts
-import { SpanKind as SpanKind6 } from "@opentelemetry/api";
-function startPromptSpan(tracer, options) {
-  return startSpan(tracer, {
-    name: `prompt ${options.name}`,
-    kind: SpanKind6.INTERNAL,
-    attributes: {
-      [FrontMcpAttributes.PROMPT_NAME]: options.name,
-      [McpAttributes.COMPONENT_TYPE]: "prompt",
-      [McpAttributes.COMPONENT_KEY]: `prompt:${options.name}`
-    },
-    parentContext: options.parentContext
-  });
-}
-
 // libs/observability/src/otel/spans/transport.span.ts
-import { SpanKind as SpanKind7 } from "@opentelemetry/api";
+import { SpanKind as SpanKind10 } from "@opentelemetry/api";
 function startTransportSpan(tracer, options) {
   const attributes = {
     [FrontMcpAttributes.TRANSPORT_TYPE]: options.type
@@ -1106,7 +1163,7 @@ function startTransportSpan(tracer, options) {
   }
   return startSpan(tracer, {
     name: `transport ${options.type}`,
-    kind: SpanKind7.INTERNAL,
+    kind: SpanKind10.INTERNAL,
     attributes,
     parentContext: options.parentContext
   });
@@ -1115,63 +1172,6 @@ function setTransportRequestType(span, requestType) {
   span.setAttribute(FrontMcpAttributes.TRANSPORT_REQUEST_TYPE, requestType);
 }
 
-// libs/observability/src/otel/spans/auth.span.ts
-import { SpanKind as SpanKind8 } from "@opentelemetry/api";
-function startAuthSpan(tracer, options) {
-  return startSpan(tracer, {
-    name: `auth ${options.flowName}`,
-    kind: SpanKind8.INTERNAL,
-    attributes: {
-      [FrontMcpAttributes.FLOW_NAME]: options.flowName
-    },
-    parentContext: options.parentContext
-  });
-}
-function setAuthMode(span, mode) {
-  span.setAttribute(FrontMcpAttributes.AUTH_MODE, mode);
-}
-function setAuthResult(span, result) {
-  span.setAttribute(FrontMcpAttributes.AUTH_RESULT, result);
-}
-
-// libs/observability/src/otel/spans/fetch.span.ts
-import { SpanKind as SpanKind9 } from "@opentelemetry/api";
-function startFetchSpan(tracer, options) {
-  return startSpan(tracer, {
-    name: options.method.toUpperCase(),
-    kind: SpanKind9.CLIENT,
-    attributes: {
-      [HttpAttributes.METHOD]: options.method.toUpperCase(),
-      [HttpAttributes.URL_FULL]: options.url
-    },
-    parentContext: options.parentContext
-  });
-}
-function setFetchResponseStatus(span, statusCode) {
-  span.setAttribute(HttpAttributes.STATUS_CODE, statusCode);
-}
-
-// libs/observability/src/otel/spans/startup.span.ts
-import { SpanKind as SpanKind10 } from "@opentelemetry/api";
-function emitStartupReport(tracer, data) {
-  const attributes = {
-    [FrontMcpAttributes.STARTUP_TOOLS_COUNT]: data.toolsCount,
-    [FrontMcpAttributes.STARTUP_RESOURCES_COUNT]: data.resourcesCount,
-    [FrontMcpAttributes.STARTUP_PROMPTS_COUNT]: data.promptsCount,
-    [FrontMcpAttributes.STARTUP_PLUGINS_COUNT]: data.pluginsCount,
-    [FrontMcpAttributes.STARTUP_DURATION_MS]: data.durationMs
-  };
-  if (data.scopeId) {
-    attributes[FrontMcpAttributes.SCOPE_ID] = data.scopeId;
-  }
-  const { span } = startSpan(tracer, {
-    name: "frontmcp.startup",
-    kind: SpanKind10.INTERNAL,
-    attributes
-  });
-  endSpanOk(span);
-}
-
 // libs/observability/src/plugin/observability.hooks.ts
 var SPAN_KEY = /* @__PURE__ */ Symbol.for("frontmcp:otel:span");
 var SPAN_CTX_KEY = /* @__PURE__ */ Symbol.for("frontmcp:otel:span-ctx");
@@ -1306,6 +1306,16 @@ function onToolWillCheckAuth(flowCtx) {
   const span = flowCtx.state?.[SPAN_KEY];
   if (span) recordStageEvent(span, "checkToolAuthorization", flowCtx.state);
 }
+function onEntryWillCheckAuthorities(flowCtx) {
+  const span = flowCtx.state?.[SPAN_KEY];
+  if (span) recordStageEvent(span, "checkEntryAuthorities", flowCtx.state);
+}
+function onEntryDidCheckAuthorities(flowCtx) {
+  const span = flowCtx.state?.[SPAN_KEY];
+  if (!span) return;
+  recordStageEvent(span, "checkEntryAuthorities.done", flowCtx.state);
+  span.setAttribute("auth.authorities.result", "granted");
+}
 function onToolWillCreateContext(flowCtx) {
   const span = flowCtx.state?.[SPAN_KEY];
   if (span) recordStageEvent(span, "createToolCallContext", flowCtx.state);
@@ -1944,6 +1954,12 @@ var ObservabilityPlugin = class extends DynamicPlugin {
   _toolWillCheckAuth(ctx) {
     if (this.tracingEnabled) onToolWillCheckAuth(ctx);
   }
+  _toolWillCheckAuthorities(ctx) {
+    if (this.tracingEnabled) onEntryWillCheckAuthorities(ctx);
+  }
+  _toolDidCheckAuthorities(ctx) {
+    if (this.tracingEnabled) onEntryDidCheckAuthorities(ctx);
+  }
   _toolWillCreateCtx(ctx) {
     if (this.tracingEnabled) onToolWillCreateContext(ctx);
   }
@@ -1971,6 +1987,12 @@ var ObservabilityPlugin = class extends DynamicPlugin {
   _resourceWillFind(ctx) {
     if (this.tracingEnabled) onResourceWillFind(ctx);
   }
+  _resourceWillCheckAuthorities(ctx) {
+    if (this.tracingEnabled) onEntryWillCheckAuthorities(ctx);
+  }
+  _resourceDidCheckAuthorities(ctx) {
+    if (this.tracingEnabled) onEntryDidCheckAuthorities(ctx);
+  }
   _resourceWillExecute(ctx) {
     if (this.tracingEnabled) onResourceWillExecute(this.tracingOpts, ctx);
   }
@@ -1986,6 +2008,12 @@ var ObservabilityPlugin = class extends DynamicPlugin {
   _promptWillFind(ctx) {
     if (this.tracingEnabled) onPromptWillFind(ctx);
   }
+  _promptWillCheckAuthorities(ctx) {
+    if (this.tracingEnabled) onEntryWillCheckAuthorities(ctx);
+  }
+  _promptDidCheckAuthorities(ctx) {
+    if (this.tracingEnabled) onEntryDidCheckAuthorities(ctx);
+  }
   _promptWillExecute(ctx) {
     if (this.tracingEnabled) onPromptWillExecute(this.tracingOpts, ctx);
   }
@@ -2001,6 +2029,12 @@ var ObservabilityPlugin = class extends DynamicPlugin {
   _agentWillFind(ctx) {
     if (this.tracingEnabled) onAgentWillFind(ctx);
   }
+  _agentWillCheckAuthorities(ctx) {
+    if (this.tracingEnabled) onEntryWillCheckAuthorities(ctx);
+  }
+  _agentDidCheckAuthorities(ctx) {
+    if (this.tracingEnabled) onEntryDidCheckAuthorities(ctx);
+  }
   _agentWillExecute(ctx) {
     if (this.tracingEnabled) onAgentWillExecute(this.tracingOpts, ctx);
   }
@@ -2016,24 +2050,36 @@ var ObservabilityPlugin = class extends DynamicPlugin {
   _listToolsDidFind(ctx) {
     if (this.tracingEnabled) onGenericFlowStage("findTools", ctx);
   }
+  _listToolsDidFilter(ctx) {
+    if (this.tracingEnabled) onGenericFlowStage("filterByAuthorities", ctx);
+  }
   _listToolsDone(ctx) {
     if (this.tracingEnabled) onGenericFlowDidFinalize(ctx);
   }
   _listResourcesWill(ctx) {
     if (this.tracingEnabled) onGenericFlowWillStart("resources/list", this.tracingOpts, ctx);
   }
+  _listResourcesDidFilter(ctx) {
+    if (this.tracingEnabled) onGenericFlowStage("filterByAuthorities", ctx);
+  }
   _listResourcesDone(ctx) {
     if (this.tracingEnabled) onGenericFlowDidFinalize(ctx);
   }
   _listTemplatesWill(ctx) {
     if (this.tracingEnabled) onGenericFlowWillStart("resources/listTemplates", this.tracingOpts, ctx);
   }
+  _listTemplatesDidFilter(ctx) {
+    if (this.tracingEnabled) onGenericFlowStage("filterByAuthorities", ctx);
+  }
   _listTemplatesDone(ctx) {
     if (this.tracingEnabled) onGenericFlowDidFinalize(ctx);
   }
   _listPromptsWill(ctx) {
     if (this.tracingEnabled) onGenericFlowWillStart("prompts/list", this.tracingOpts, ctx);
   }
+  _listPromptsDidFilter(ctx) {
+    if (this.tracingEnabled) onGenericFlowStage("filterByAuthorities", ctx);
+  }
   _listPromptsDone(ctx) {
     if (this.tracingEnabled) onGenericFlowDidFinalize(ctx);
   }
@@ -2347,6 +2393,12 @@ __decorateClass([
 __decorateClass([
   ToolHook.Will("checkToolAuthorization", { priority: -1e3 })
 ], ObservabilityPlugin.prototype, "_toolWillCheckAuth", 1);
+__decorateClass([
+  ToolHook.Will("checkEntryAuthorities", { priority: -1e3 })
+], ObservabilityPlugin.prototype, "_toolWillCheckAuthorities", 1);
+__decorateClass([
+  ToolHook.Did("checkEntryAuthorities", { priority: 1e3 })
+], ObservabilityPlugin.prototype, "_toolDidCheckAuthorities", 1);
 __decorateClass([
   ToolHook.Will("createToolCallContext", { priority: -1e3 })
 ], ObservabilityPlugin.prototype, "_toolWillCreateCtx", 1);
@@ -2374,6 +2426,12 @@ __decorateClass([
 __decorateClass([
   ResourceHook.Will("findResource", { priority: -1e3 })
 ], ObservabilityPlugin.prototype, "_resourceWillFind", 1);
+__decorateClass([
+  ResourceHook.Will("checkEntryAuthorities", { priority: -1e3 })
+], ObservabilityPlugin.prototype, "_resourceWillCheckAuthorities", 1);
+__decorateClass([
+  ResourceHook.Did("checkEntryAuthorities", { priority: 1e3 })
+], ObservabilityPlugin.prototype, "_resourceDidCheckAuthorities", 1);
 __decorateClass([
   ResourceHook.Will("execute", { priority: -1e3 })
 ], ObservabilityPlugin.prototype, "_resourceWillExecute", 1);
@@ -2389,6 +2447,12 @@ __decorateClass([
 __decorateClass([
   PromptHook.Will("findPrompt", { priority: -1e3 })
 ], ObservabilityPlugin.prototype, "_promptWillFind", 1);
+__decorateClass([
+  PromptHook.Will("checkEntryAuthorities", { priority: -1e3 })
+], ObservabilityPlugin.prototype, "_promptWillCheckAuthorities", 1);
+__decorateClass([
+  PromptHook.Did("checkEntryAuthorities", { priority: 1e3 })
+], ObservabilityPlugin.prototype, "_promptDidCheckAuthorities", 1);
 __decorateClass([
   PromptHook.Will("execute", { priority: -1e3 })
 ], ObservabilityPlugin.prototype, "_promptWillExecute", 1);
@@ -2404,6 +2468,12 @@ __decorateClass([
 __decorateClass([
   AgentCallHook.Will("findAgent", { priority: -1e3 })
 ], ObservabilityPlugin.prototype, "_agentWillFind", 1);
+__decorateClass([
+  AgentCallHook.Will("checkEntryAuthorities", { priority: -1e3 })
+], ObservabilityPlugin.prototype, "_agentWillCheckAuthorities", 1);
+__decorateClass([
+  AgentCallHook.Did("checkEntryAuthorities", { priority: 1e3 })
+], ObservabilityPlugin.prototype, "_agentDidCheckAuthorities", 1);
 __decorateClass([
   AgentCallHook.Will("execute", { priority: -1e3 })
 ], ObservabilityPlugin.prototype, "_agentWillExecute", 1);
@@ -2419,24 +2489,36 @@ __decorateClass([
 __decorateClass([
   ListToolsHook.Did("findTools", { priority: 1e3 })
 ], ObservabilityPlugin.prototype, "_listToolsDidFind", 1);
+__decorateClass([
+  ListToolsHook.Did("filterByAuthorities", { priority: 1e3 })
+], ObservabilityPlugin.prototype, "_listToolsDidFilter", 1);
 __decorateClass([
   ListToolsHook.Did("parseTools", { priority: 1e3 })
 ], ObservabilityPlugin.prototype, "_listToolsDone", 1);
 __decorateClass([
   ListResourcesHook.Will("parseInput", { priority: -1e3 })
 ], ObservabilityPlugin.prototype, "_listResourcesWill", 1);
+__decorateClass([
+  ListResourcesHook.Did("filterByAuthorities", { priority: 1e3 })
+], ObservabilityPlugin.prototype, "_listResourcesDidFilter", 1);
 __decorateClass([
   ListResourcesHook.Did("parseResources", { priority: 1e3 })
 ], ObservabilityPlugin.prototype, "_listResourcesDone", 1);
 __decorateClass([
   ListResourceTemplatesHook.Will("parseInput", { priority: -1e3 })
 ], ObservabilityPlugin.prototype, "_listTemplatesWill", 1);
+__decorateClass([
+  ListResourceTemplatesHook.Did("filterByAuthorities", { priority: 1e3 })
+], ObservabilityPlugin.prototype, "_listTemplatesDidFilter", 1);
 __decorateClass([
   ListResourceTemplatesHook.Did("parseTemplates", { priority: 1e3 })
 ], ObservabilityPlugin.prototype, "_listTemplatesDone", 1);
 __decorateClass([
   ListPromptsHook.Will("parseInput", { priority: -1e3 })
 ], ObservabilityPlugin.prototype, "_listPromptsWill", 1);
+__decorateClass([
+  ListPromptsHook.Did("filterByAuthorities", { priority: 1e3 })
+], ObservabilityPlugin.prototype, "_listPromptsDidFilter", 1);
 __decorateClass([
   ListPromptsHook.Did("parsePrompts", { priority: 1e3 })
 ], ObservabilityPlugin.prototype, "_listPromptsDone", 1);