@frontmcp/plugin-skilled-openapi 1.8.7 → 1.9.0

package/README.md

@@ -20,7 +20,7 @@ npm install @enclave-vm/core @enclave-vm/ast
 
 ## Usage
 
-Register the plugin with `SkilledOpenApiPlugin.init(...)` and point it at a bundle source. The `dev: true` flag bypasses signature verification and allows `http://` upstreams for local iteration — see [Security](https://docs.agentfront.dev/frontmcp/plugins/skilled-openapi/security) before going to production.
+Register the plugin with `SkilledOpenApiPlugin.init(...)` and point it at a bundle source. The `dev: true` flag bypasses signature verification (unless `requireSignature` is set explicitly) and allows `http://` upstreams for local iteration — see [Security](https://docs.agentfront.dev/frontmcp/plugins/skilled-openapi/security) before going to production.
 
 ```typescript
 import * as path from 'node:path';
@@ -94,18 +94,18 @@ OpenAPI spec  --(analyzer + optional signing)-->  bundle (spec + overlay)
 
 All options are validated by a strict Zod schema (`skilledOpenApiPluginOptionsSchema`).
 
-| Option                            | Type                                       | Default         | Description                                                                                                                                               |
-| --------------------------------- | ------------------------------------------ | --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `source`                          | `static \| npm \| saas \| inline`          | — (required)    | Where bundles come from. `{ type: 'static', path, watch? }`, `{ type: 'npm', package }`, `{ type: 'saas', endpoint, ... }`, or `{ type: 'inline', ... }`. |
-| `requireSignature`                | `boolean`                                  | `true`          | Require a valid bundle signature (RS256/Ed25519 JWT-of-hashes). Opt out only with `dev: true`.                                                            |
-| `trustedKeys`                     | `SignatureKey[]`                           | `[]`            | Public keys trusted to sign bundles.                                                                                                                      |
-| `dev`                             | `boolean`                                  | `false`         | Local-dev escape hatch: bypasses signing and widens `outbound` to allow `http://`. **Never enable in production.**                                        |
-| `outbound`                        | `OutboundOptions`                          | see below       | SSRF / egress controls.                                                                                                                                   |
-| `unprotectedOps`                  | `'allow' \| 'deny'`                        | `'allow'`       | Default-deny policy for operations that declare no required authorities.                                                                                  |
-| `sourceConflictPolicy`            | `'static-wins' \| 'last-wins' \| 'reject'` | `'static-wins'` | How to resolve two sources registering the same skill id.                                                                                                 |
-| `bundleCacheDir`                  | `string`                                   | —               | Last-good cache directory (only for `source.type === 'saas'`).                                                                                            |
-| `credentials`                     | `Record<vaultRef, secret>`                 | —               | In-memory credential map for dev / single-tenant. In production resolve via `@frontmcp/auth`'s vault.                                                     |
-| `exposeOperationsAsInternalTools` | `boolean`                                  | `true`          | Keep operations reachable via `callTool` inside workflows.                                                                                                |
+| Option                            | Type                                       | Default                           | Description                                                                                                                                                              |
+| --------------------------------- | ------------------------------------------ | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `source`                          | `static \| npm \| saas \| inline`          | — (required)                      | Where bundles come from. `{ type: 'static', path, watch? }`, `{ type: 'npm', package }`, `{ type: 'saas', endpoint, ... }`, or `{ type: 'inline', ... }`.                |
+| `requireSignature`                | `boolean`                                  | `true` (`false` with `dev: true`) | Require a valid bundle signature (RS256/Ed25519 JWT-of-hashes). Opt out with `dev: true` or `requireSignature: false`; an explicit value wins over `dev`.                |
+| `trustedKeys`                     | `SignatureKey[]`                           | `[]`                              | Public keys trusted to sign bundles.                                                                                                                                     |
+| `dev`                             | `boolean`                                  | `false`                           | Local-dev escape hatch: turns the signature requirement off (unless `requireSignature` is set) and widens `outbound` to allow `http://`. **Never enable in production.** |
+| `outbound`                        | `OutboundOptions`                          | see below                         | SSRF / egress controls.                                                                                                                                                  |
+| `unprotectedOps`                  | `'allow' \| 'deny'`                        | `'allow'`                         | Default-deny policy for operations that declare no required authorities.                                                                                                 |
+| `sourceConflictPolicy`            | `'static-wins' \| 'last-wins' \| 'reject'` | `'static-wins'`                   | How to resolve two sources registering the same skill id.                                                                                                                |
+| `bundleCacheDir`                  | `string`                                   | —                                 | Last-good cache directory (only for `source.type === 'saas'`).                                                                                                           |
+| `credentials`                     | `Record<vaultRef, secret>`                 | —                                 | In-memory credential map for dev / single-tenant. In production resolve via `@frontmcp/auth`'s vault.                                                                    |
+| `exposeOperationsAsInternalTools` | `boolean`                                  | `true`                            | Register each operation as an internal tool, callable in-process as `this.callTool('<bundleId>.<operationId>', input)` (hidden from `tools/list`).                       |
 
 `outbound` (SSRF + egress):
 

package/esm/index.mjs

@@ -392,19 +392,20 @@ var skilledOpenApiPluginOptionsObjectSchema = z.object({
   /** Bundle source — static, npm, or saas. */
   source: bundleSourceSchema,
   /**
-   * Require a valid bundle signature. Defaults to true. Setting `dev: true`
-   * disables the requirement and emits a startup warning. Never set false
-   * (unsigned mode) silently in production.
+   * Require a valid bundle signature. Defaults to true, or to false with
+   * `dev: true`; an explicit value always wins. Never set false (unsigned mode)
+   * in production.
    */
-  requireSignature: z.boolean().default(true),
+  requireSignature: z.boolean().optional(),
   /**
    * Trusted public keys for bundle signature verification. At least one must
    * match the bundle's signed `kid` for the bundle to load.
    */
   trustedKeys: z.array(signatureKeySchema).default([]),
   /**
-   * Development mode: bypass signature verification and relax some defaults
-   * (e.g. allow http:). Loud startup warning. Never true in production.
+   * Development mode: bypass signature verification (unless `requireSignature`
+   * is set explicitly) and allow http: upstreams. Loud startup warning. Never
+   * true in production.
    */
   dev: z.boolean().default(false),
   /** Outbound HTTP / SSRF defenses for the executor. */
@@ -473,6 +474,9 @@ var skilledOpenApiPluginOptionsSchema = skilledOpenApiPluginOptionsObjectSchema.
   }
   return {
     ...opts,
+    // `dev: true` turns the signature requirement off, as it advertises; an explicit
+    // `requireSignature` (either way) is kept.
+    requireSignature: opts.requireSignature ?? !opts.dev,
     outbound,
     bundleCacheDir: opts.bundleCacheDir ?? ".frontmcp/skilled-openapi/"
   };
@@ -907,6 +911,63 @@ import {
   ToolKind
 } from "@frontmcp/sdk";
 
+// plugins/plugin-skilled-openapi/src/executor/caller-token.ts
+import { decodeJwtPayloadSafe } from "@frontmcp/auth";
+import { trimTrailing } from "@frontmcp/utils";
+function callerTokenOf(authInfo) {
+  if (typeof authInfo !== "object" || authInfo === null) return void 0;
+  const token = authInfo.token;
+  return typeof token === "string" && token.length > 0 ? token : void 0;
+}
+function callerTokenRefusal(token, url) {
+  const claims = decodeJwtPayloadSafe(token);
+  if (!claims) {
+    return "the caller token is not a JWT, so the API it was issued for cannot be checked";
+  }
+  let target;
+  try {
+    target = new URL(url);
+  } catch {
+    return `the caller token was not issued for ${url} (it is not a URL)`;
+  }
+  const destination = `${target.origin}${target.pathname}`;
+  const issuedFor = [...claimValues(claims["resource"]), ...claimValues(claims["aud"])];
+  if (!issuedFor.some((resource) => resourceCovers(resource, target))) {
+    return `the caller token was not issued for ${destination} (no resource or aud claim names it)`;
+  }
+  if (hasDecodedDotDotSegment(target.pathname)) {
+    return `the request path ${target.pathname} has a ".." segment once percent-decoded, which could take the caller token outside the API it was issued for`;
+  }
+  return void 0;
+}
+function claimValues(claim) {
+  if (typeof claim === "string") return [claim];
+  if (Array.isArray(claim)) return claim.filter((value) => typeof value === "string");
+  return [];
+}
+function resourceCovers(resource, target) {
+  let issued;
+  try {
+    issued = new URL(resource);
+  } catch {
+    return false;
+  }
+  if (issued.search || issued.hash || issued.origin !== target.origin) return false;
+  const issuedPath = trimTrailing(issued.pathname, "/");
+  const targetPath = trimTrailing(target.pathname, "/");
+  return issuedPath === "" || targetPath === issuedPath || targetPath.startsWith(`${issuedPath}/`);
+}
+var DOT_SEGMENT_ESCAPE = /%(?:2e|2f|5c|3b|25)/gi;
+function hasDecodedDotDotSegment(pathname) {
+  let decoded = pathname;
+  let previous;
+  do {
+    previous = decoded;
+    decoded = previous.replace(DOT_SEGMENT_ESCAPE, (escape) => String.fromCharCode(parseInt(escape.slice(1), 16)));
+  } while (decoded !== previous);
+  return decoded.split(/[/\\]/).some((segment) => segment.split(";")[0] === "..");
+}
+
 // plugins/plugin-skilled-openapi/src/executor/openapi-runtime.ts
 import {
   buildRequest,
@@ -1027,35 +1088,30 @@ async function checkOutboundUrl(target, allowedHosts, outbound) {
 
 // plugins/plugin-skilled-openapi/src/executor/openapi-runtime.ts
 async function buildSecurityContext(args) {
-  const { binding, bundleId, resolver, callerToken } = args;
-  const ctx = {};
+  const { binding, bundleId, resolver, serviceBaseUrl, callerToken } = args;
   switch (binding.kind) {
     case "none":
-      return ctx;
+      return { context: {} };
     case "bearer": {
-      let token;
       if (binding.passthroughCallerToken) {
-        token = callerToken;
-        if (!token) throw new Error("passthrough caller token requested but not supplied");
-      } else {
-        token = await resolver.resolve(binding.vaultRef, { bundleId });
-        if (!token) throw new Error(`bearer vaultRef "${binding.vaultRef}" did not resolve`);
+        if (!callerToken) throw new Error("passthrough caller token requested but the caller presented none");
+        const refusal = callerTokenRefusal(callerToken, serviceBaseUrl);
+        if (refusal) throw new Error(`passthrough caller token refused: ${refusal}`);
+        return { context: { jwt: callerToken }, forwardedCallerToken: callerToken };
       }
-      ctx.jwt = token;
-      return ctx;
+      const token = await resolver.resolve(binding.vaultRef, { bundleId });
+      if (!token) throw new Error(`bearer vaultRef "${binding.vaultRef}" did not resolve`);
+      return { context: { jwt: token } };
     }
     case "apiKey": {
       const value = await resolver.resolve(binding.vaultRef, { bundleId });
       if (!value) throw new Error(`apiKey vaultRef "${binding.vaultRef}" did not resolve`);
-      ctx.apiKeys = { [binding.name]: value };
-      ctx.apiKey = value;
-      return ctx;
+      return { context: { apiKeys: { [binding.name]: value }, apiKey: value } };
     }
     case "oauth2": {
       const token = await resolver.resolve(binding.vaultRef, { bundleId });
       if (!token) throw new Error(`oauth2 vaultRef "${binding.vaultRef}" did not resolve`);
-      ctx.oauth2Token = token;
-      return ctx;
+      return { context: { oauth2Token: token } };
     }
   }
 }
@@ -1118,12 +1174,13 @@ async function executeOperation(args) {
   } catch (e) {
     return failure(0, `tool projection failed: ${e.message}`);
   }
-  let securityContext;
+  let auth;
   try {
-    securityContext = await buildSecurityContext({
+    auth = await buildSecurityContext({
       binding: entry.authBinding,
       bundleId,
       resolver,
+      serviceBaseUrl: entry.service.baseUrl,
       callerToken
     });
   } catch (e) {
@@ -1131,7 +1188,7 @@ async function executeOperation(args) {
   }
   let security;
   try {
-    security = await resolveSecurity(mcpTool, securityContext);
+    security = await resolveSecurity(mcpTool, auth.context);
   } catch (e) {
     return failure(0, `security resolve failed: ${e.message}`);
   }
@@ -1141,10 +1198,23 @@ async function executeOperation(args) {
   } catch (e) {
     return failure(0, `request build failed: ${e.message}`);
   }
+  if (auth.forwardedCallerToken) {
+    const refusal = callerTokenRefusal(auth.forwardedCallerToken, req.url);
+    if (refusal) return failure(0, `auth resolution failed: passthrough caller token refused: ${refusal}`);
+  }
   const ssrf = await checkOutboundUrl(req.url, allowedHosts, outbound);
   if (!ssrf.ok) {
     return failure(0, `ssrf check rejected request: ${ssrf.reason}`);
   }
+  let body;
+  try {
+    body = req.body !== void 0 ? JSON.stringify(req.body) : void 0;
+  } catch (e) {
+    return failure(0, `request body serialization failed: ${e.message}`);
+  }
+  if (body !== void 0 && !req.headers.has("content-type")) {
+    req.headers.set("content-type", "application/json");
+  }
   const timeoutMs = entry.op.timeoutMs ?? outbound.defaultTimeoutMs;
   const maxBytes = entry.op.maxResponseBytes ?? outbound.defaultMaxResponseBytes;
   const host = (() => {
@@ -1162,7 +1232,7 @@ async function executeOperation(args) {
       const response = await fetchImpl(req.url, {
         method: entry.op.httpMethod,
         headers: req.headers,
-        body: req.body !== void 0 ? JSON.stringify(req.body) : void 0,
+        body,
         signal: ac.signal,
         // SECURITY: never auto-follow redirects. `fetch` defaults to
         // `redirect: 'follow'`, which re-sends the request — INCLUDING the
@@ -1431,6 +1501,8 @@ var OperationToolFactory = class {
         entry,
         bundleId: entry.bundleId,
         input: inputParse.data,
+        // For a bearer binding with `passthroughCallerToken: true`.
+        callerToken: callerTokenOf(ctx.authInfo),
         deps
       });
       return {
@@ -1510,6 +1582,8 @@ async function executeSkillAction(args) {
       entry,
       bundleId: entry.bundleId,
       input: inputParse.data,
+      // For a bearer binding with `passthroughCallerToken: true`.
+      callerToken: callerTokenOf(authInfo),
       deps: runtimeDeps
     });
   } catch (e) {
@@ -1784,6 +1858,18 @@ function resolveRuntimeDeps(scope) {
     return void 0;
   }
 }
+function lazyScopeRegistry(scope, name) {
+  return new Proxy({}, {
+    get(_target, prop) {
+      const registry = scope[name];
+      if (!registry) {
+        throw new Error(`[skilled-openapi] scope.${name} not available when accessing "${String(prop)}"`);
+      }
+      const value = registry[prop];
+      return typeof value === "function" ? value.bind(registry) : value;
+    }
+  });
+}
 function resolveBundleTelemetry(scope) {
   const providers = scope?.providers;
   if (!providers || typeof providers.get !== "function") return void 0;
@@ -1881,9 +1967,8 @@ ${catalog}` : searchSkillDescription;
   }
   warnIfInsecureConfig() {
     if (this.options.dev) {
-      console.warn(
-        "[skilled-openapi] dev=true: signature verification BYPASSED and http:// URLs allowed. NEVER use this in production."
-      );
+      const signing = this.options.requireSignature ? "signature verification kept (requireSignature=true)" : "signature verification BYPASSED";
+      console.warn(`[skilled-openapi] dev=true: ${signing} and http:// URLs allowed. NEVER use this in production.`);
     }
     if (!this.options.requireSignature && !this.options.dev) {
       console.warn(
@@ -1936,39 +2021,17 @@ ${catalog}` : searchSkillDescription;
         inject: () => [ScopeEntry3, HiddenOpRegistry, BundleStore3],
         useFactory: async (scope, hiddenOps, bundleStore) => {
           const logger = scope.logger.child("skilled-openapi:sync");
-          const lazySkillRegistry = new Proxy({}, {
-            get(_t, prop) {
-              const reg = scope.skills;
-              if (!reg) {
-                throw new Error(`[skilled-openapi] scope.skills not available when accessing "${String(prop)}"`);
-              }
-              const v = reg[prop];
-              return typeof v === "function" ? v.bind(reg) : v;
-            }
-          });
+          const lazySkillRegistry = lazyScopeRegistry(scope, "skills");
           let opToolFactory;
           if (parsed.exposeOperationsAsInternalTools) {
-            try {
-              const toolRegistry = scope.tools;
-              if (toolRegistry) {
-                opToolFactory = new OperationToolFactory({
-                  toolRegistry,
-                  // ScopeEntry exposes a ProviderRegistryInterface; the factory
-                  // needs the concrete ProviderRegistry to construct ToolInstance.
-                  // The runtime is the same class — the cast is safe by construction.
-                  providers: scope.providers,
-                  logger: logger.child("op-tool")
-                });
-              } else {
-                logger.warn(
-                  "exposeOperationsAsInternalTools=true but scope.tools is unavailable; per-op internal tools disabled"
-                );
-              }
-            } catch (e) {
-              logger.warn(
-                `failed to build OperationToolFactory: ${e.message}; per-op internal tools disabled`
-              );
-            }
+            opToolFactory = new OperationToolFactory({
+              toolRegistry: lazyScopeRegistry(scope, "tools"),
+              // ScopeEntry exposes a ProviderRegistryInterface; the factory
+              // needs the concrete ProviderRegistry to construct ToolInstance.
+              // The runtime is the same class — the cast is safe by construction.
+              providers: scope.providers,
+              logger: logger.child("op-tool")
+            });
           }
           const sync = new BundleSyncService(
             lazySkillRegistry,

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-skilled-openapi",
-  "version": "1.8.7",
+  "version": "1.9.0",
   "description": "FrontMCP plugin: serve a customer's OpenAPI spec as skill bundles (signed, OpenAPI-Overlay-based) with hidden per-operation tools mediated by three meta-tools (search_skill / load_skill / run_workflow — the last runs an enclave-sandboxed AgentScript that orchestrates the loaded skills' operations).",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -48,15 +48,15 @@
     }
   },
   "dependencies": {
-    "@frontmcp/adapters": "1.8.7",
-    "@frontmcp/auth": "1.8.7",
-    "@frontmcp/sdk": "1.8.7",
-    "@frontmcp/utils": "1.8.7"
+    "@frontmcp/adapters": "1.9.0",
+    "@frontmcp/auth": "1.9.0",
+    "@frontmcp/sdk": "1.9.0",
+    "@frontmcp/utils": "1.9.0"
   },
   "peerDependencies": {
     "@enclave-vm/ast": "*",
     "@enclave-vm/core": "*",
-    "@frontmcp/lazy-zod": "1.8.7"
+    "@frontmcp/lazy-zod": "1.9.0"
   },
   "peerDependenciesMeta": {
     "@enclave-vm/ast": {

package/executor/caller-token.d.ts

@@ -0,0 +1,15 @@
+/** The bearer token the MCP client presented to this server (`authInfo.token`), when it presented one. */
+export declare function callerTokenOf(authInfo: unknown): string | undefined;
+/**
+ * Why the caller's token may not be sent to `url`, or `undefined` when it may. It may when it is a
+ * JWT whose `resource` claim (RFC 8707) or `aud` claim (where RFC 8707 / RFC 9068 put the resource
+ * indicator) names the API `url` belongs to: that URL, or a URL above it on the same origin.
+ *
+ * `url` is checked as `fetch` sends it, after URL parsing resolves `.` / `..` segments (`%2e`
+ * spellings and `\` separators included), so pass the URL a request actually goes to, not only the
+ * service's base URL: `/v1/{id}/me` with an `id` of `..` is `/me`, outside a token issued for `/v1`.
+ * A path that has a `..` segment once percent-decoded (`..%2F`, `%252e%252e`, `..;`) is refused too:
+ * URL parsing keeps it inside the API, but an upstream that decodes its path before resolving it does not.
+ */
+export declare function callerTokenRefusal(token: string, url: string): string | undefined;
+//# sourceMappingURL=caller-token.d.ts.map

package/executor/caller-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-token.d.ts","sourceRoot":"","sources":["../../src/executor/caller-token.ts"],"names":[],"mappings":"AAWA,0GAA0G;AAC1G,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAInE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAoBjF"}

package/executor/execute-skill-action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute-skill-action.d.ts","sourceRoot":"","sources":["../../src/executor/execute-skill-action.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC7F,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG9E,8FAA8F;AAC9F,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE;QACN,QAAQ,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACzC,wEAAwE;QACxE,cAAc,EAAE,oBAAoB,CAAC;KACtC,CAAC;IACF,QAAQ,EAAE;QAAE,OAAO,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,CAAA;KAAE,CAAC;IACjE,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,cAAc,CAAC;IACvB,uEAAuE;IACvE,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACvD;AAWD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;CACvB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAsH7B"}
+{"version":3,"file":"execute-skill-action.d.ts","sourceRoot":"","sources":["../../src/executor/execute-skill-action.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAE7F,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG9E,8FAA8F;AAC9F,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE;QACN,QAAQ,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACzC,wEAAwE;QACxE,cAAc,EAAE,oBAAoB,CAAC;KACtC,CAAC;IACF,QAAQ,EAAE;QAAE,OAAO,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,CAAA;KAAE,CAAC;IACjE,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,cAAc,CAAC;IACvB,uEAAuE;IACvE,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACvD;AAWD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;CACvB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwH7B"}

package/executor/openapi-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi-runtime.d.ts","sourceRoot":"","sources":["../../src/executor/openapi-runtime.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAIhE,kEAAkE;AAClE,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB;AA2HD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,cAAc,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,GAAG,OAAO,CAAC,eAAe,CAAC,CA+H3B"}
+{"version":3,"file":"openapi-runtime.d.ts","sourceRoot":"","sources":["../../src/executor/openapi-runtime.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAIhE,kEAAkE;AAClE,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB;AAiID,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,cAAc,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,GAAG,OAAO,CAAC,eAAe,CAAC,CAqJ3B"}

package/index.js

@@ -407,19 +407,20 @@ var skilledOpenApiPluginOptionsObjectSchema = import_lazy_zod.z.object({
   /** Bundle source — static, npm, or saas. */
   source: import_skills.bundleSourceSchema,
   /**
-   * Require a valid bundle signature. Defaults to true. Setting `dev: true`
-   * disables the requirement and emits a startup warning. Never set false
-   * (unsigned mode) silently in production.
+   * Require a valid bundle signature. Defaults to true, or to false with
+   * `dev: true`; an explicit value always wins. Never set false (unsigned mode)
+   * in production.
    */
-  requireSignature: import_lazy_zod.z.boolean().default(true),
+  requireSignature: import_lazy_zod.z.boolean().optional(),
   /**
    * Trusted public keys for bundle signature verification. At least one must
    * match the bundle's signed `kid` for the bundle to load.
    */
   trustedKeys: import_lazy_zod.z.array(import_skills.signatureKeySchema).default([]),
   /**
-   * Development mode: bypass signature verification and relax some defaults
-   * (e.g. allow http:). Loud startup warning. Never true in production.
+   * Development mode: bypass signature verification (unless `requireSignature`
+   * is set explicitly) and allow http: upstreams. Loud startup warning. Never
+   * true in production.
    */
   dev: import_lazy_zod.z.boolean().default(false),
   /** Outbound HTTP / SSRF defenses for the executor. */
@@ -488,6 +489,9 @@ var skilledOpenApiPluginOptionsSchema = skilledOpenApiPluginOptionsObjectSchema.
   }
   return {
     ...opts,
+    // `dev: true` turns the signature requirement off, as it advertises; an explicit
+    // `requireSignature` (either way) is kept.
+    requireSignature: opts.requireSignature ?? !opts.dev,
     outbound,
     bundleCacheDir: opts.bundleCacheDir ?? ".frontmcp/skilled-openapi/"
   };
@@ -911,9 +915,66 @@ LoadSkillTool = __decorateClass([
 var import_skills5 = require("@frontmcp/adapters/skills");
 var import_sdk3 = require("@frontmcp/sdk");
 
+// plugins/plugin-skilled-openapi/src/executor/caller-token.ts
+var import_auth2 = require("@frontmcp/auth");
+var import_utils = require("@frontmcp/utils");
+function callerTokenOf(authInfo) {
+  if (typeof authInfo !== "object" || authInfo === null) return void 0;
+  const token = authInfo.token;
+  return typeof token === "string" && token.length > 0 ? token : void 0;
+}
+function callerTokenRefusal(token, url) {
+  const claims = (0, import_auth2.decodeJwtPayloadSafe)(token);
+  if (!claims) {
+    return "the caller token is not a JWT, so the API it was issued for cannot be checked";
+  }
+  let target;
+  try {
+    target = new URL(url);
+  } catch {
+    return `the caller token was not issued for ${url} (it is not a URL)`;
+  }
+  const destination = `${target.origin}${target.pathname}`;
+  const issuedFor = [...claimValues(claims["resource"]), ...claimValues(claims["aud"])];
+  if (!issuedFor.some((resource) => resourceCovers(resource, target))) {
+    return `the caller token was not issued for ${destination} (no resource or aud claim names it)`;
+  }
+  if (hasDecodedDotDotSegment(target.pathname)) {
+    return `the request path ${target.pathname} has a ".." segment once percent-decoded, which could take the caller token outside the API it was issued for`;
+  }
+  return void 0;
+}
+function claimValues(claim) {
+  if (typeof claim === "string") return [claim];
+  if (Array.isArray(claim)) return claim.filter((value) => typeof value === "string");
+  return [];
+}
+function resourceCovers(resource, target) {
+  let issued;
+  try {
+    issued = new URL(resource);
+  } catch {
+    return false;
+  }
+  if (issued.search || issued.hash || issued.origin !== target.origin) return false;
+  const issuedPath = (0, import_utils.trimTrailing)(issued.pathname, "/");
+  const targetPath = (0, import_utils.trimTrailing)(target.pathname, "/");
+  return issuedPath === "" || targetPath === issuedPath || targetPath.startsWith(`${issuedPath}/`);
+}
+var DOT_SEGMENT_ESCAPE = /%(?:2e|2f|5c|3b|25)/gi;
+function hasDecodedDotDotSegment(pathname) {
+  let decoded = pathname;
+  let previous;
+  do {
+    previous = decoded;
+    decoded = previous.replace(DOT_SEGMENT_ESCAPE, (escape) => String.fromCharCode(parseInt(escape.slice(1), 16)));
+  } while (decoded !== previous);
+  return decoded.split(/[/\\]/).some((segment) => segment.split(";")[0] === "..");
+}
+
 // plugins/plugin-skilled-openapi/src/executor/openapi-runtime.ts
 var import_openapi = require("@frontmcp/adapters/openapi");
-var import_utils2 = require("@frontmcp/utils");
+var import_utils3 = require("@frontmcp/utils");
 
 // plugins/plugin-skilled-openapi/src/executor/host-concurrency.ts
 var gates = /* @__PURE__ */ new Map();
@@ -947,7 +1008,7 @@ async function withHostConcurrency(host, limit, fn) {
 }
 
 // plugins/plugin-skilled-openapi/src/executor/ssrf-guard.ts
-var import_utils = require("@frontmcp/utils");
+var import_utils2 = require("@frontmcp/utils");
 var ALWAYS_FORBIDDEN_RANGES = /* @__PURE__ */ new Set([
   "link-local",
   "cloud-metadata",
@@ -956,7 +1017,7 @@ var ALWAYS_FORBIDDEN_RANGES = /* @__PURE__ */ new Set([
   "local-use-nat64"
 ]);
 function findAddressViolation(address, outbound) {
-  const classification = (0, import_utils.classifyIpAddress)(address);
+  const classification = (0, import_utils2.classifyIpAddress)(address);
   if (!classification) {
     return { description: `malformed IP address ${address}`, alwaysForbidden: true };
   }
@@ -980,7 +1041,7 @@ var FORBIDDEN_METADATA_HOSTS = /* @__PURE__ */ new Set([
 ]);
 function classifyHostLiteral(hostname) {
   const address = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
-  return { isIpLiteral: (0, import_utils.parseIpv4)(address) !== void 0 || address.includes(":"), address };
+  return { isIpLiteral: (0, import_utils2.parseIpv4)(address) !== void 0 || address.includes(":"), address };
 }
 async function checkOutboundUrl(target, allowedHosts, outbound) {
   let url;
@@ -1028,35 +1089,30 @@ async function checkOutboundUrl(target, allowedHosts, outbound) {
 
 // plugins/plugin-skilled-openapi/src/executor/openapi-runtime.ts
 async function buildSecurityContext(args) {
-  const { binding, bundleId, resolver, callerToken } = args;
-  const ctx = {};
+  const { binding, bundleId, resolver, serviceBaseUrl, callerToken } = args;
   switch (binding.kind) {
     case "none":
-      return ctx;
+      return { context: {} };
     case "bearer": {
-      let token;
       if (binding.passthroughCallerToken) {
-        token = callerToken;
-        if (!token) throw new Error("passthrough caller token requested but not supplied");
-      } else {
-        token = await resolver.resolve(binding.vaultRef, { bundleId });
-        if (!token) throw new Error(`bearer vaultRef "${binding.vaultRef}" did not resolve`);
+        if (!callerToken) throw new Error("passthrough caller token requested but the caller presented none");
+        const refusal = callerTokenRefusal(callerToken, serviceBaseUrl);
+        if (refusal) throw new Error(`passthrough caller token refused: ${refusal}`);
+        return { context: { jwt: callerToken }, forwardedCallerToken: callerToken };
       }
-      ctx.jwt = token;
-      return ctx;
+      const token = await resolver.resolve(binding.vaultRef, { bundleId });
+      if (!token) throw new Error(`bearer vaultRef "${binding.vaultRef}" did not resolve`);
+      return { context: { jwt: token } };
     }
     case "apiKey": {
       const value = await resolver.resolve(binding.vaultRef, { bundleId });
       if (!value) throw new Error(`apiKey vaultRef "${binding.vaultRef}" did not resolve`);
-      ctx.apiKeys = { [binding.name]: value };
-      ctx.apiKey = value;
-      return ctx;
+      return { context: { apiKeys: { [binding.name]: value }, apiKey: value } };
     }
     case "oauth2": {
       const token = await resolver.resolve(binding.vaultRef, { bundleId });
       if (!token) throw new Error(`oauth2 vaultRef "${binding.vaultRef}" did not resolve`);
-      ctx.oauth2Token = token;
-      return ctx;
+      return { context: { oauth2Token: token } };
     }
   }
 }
@@ -1119,12 +1175,13 @@ async function executeOperation(args) {
   } catch (e) {
     return failure(0, `tool projection failed: ${e.message}`);
   }
-  let securityContext;
+  let auth;
   try {
-    securityContext = await buildSecurityContext({
+    auth = await buildSecurityContext({
       binding: entry.authBinding,
       bundleId,
       resolver,
+      serviceBaseUrl: entry.service.baseUrl,
       callerToken
     });
   } catch (e) {
@@ -1132,7 +1189,7 @@ async function executeOperation(args) {
   }
   let security;
   try {
-    security = await resolveSecurity(mcpTool, securityContext);
+    security = await resolveSecurity(mcpTool, auth.context);
   } catch (e) {
     return failure(0, `security resolve failed: ${e.message}`);
   }
@@ -1142,10 +1199,23 @@ async function executeOperation(args) {
   } catch (e) {
     return failure(0, `request build failed: ${e.message}`);
   }
+  if (auth.forwardedCallerToken) {
+    const refusal = callerTokenRefusal(auth.forwardedCallerToken, req.url);
+    if (refusal) return failure(0, `auth resolution failed: passthrough caller token refused: ${refusal}`);
+  }
   const ssrf = await checkOutboundUrl(req.url, allowedHosts, outbound);
   if (!ssrf.ok) {
     return failure(0, `ssrf check rejected request: ${ssrf.reason}`);
   }
+  let body;
+  try {
+    body = req.body !== void 0 ? JSON.stringify(req.body) : void 0;
+  } catch (e) {
+    return failure(0, `request body serialization failed: ${e.message}`);
+  }
+  if (body !== void 0 && !req.headers.has("content-type")) {
+    req.headers.set("content-type", "application/json");
+  }
   const timeoutMs = entry.op.timeoutMs ?? outbound.defaultTimeoutMs;
   const maxBytes = entry.op.maxResponseBytes ?? outbound.defaultMaxResponseBytes;
   const host = (() => {
@@ -1163,7 +1233,7 @@ async function executeOperation(args) {
       const response = await fetchImpl(req.url, {
         method: entry.op.httpMethod,
         headers: req.headers,
-        body: req.body !== void 0 ? JSON.stringify(req.body) : void 0,
+        body,
         signal: ac.signal,
         // SECURITY: never auto-follow redirects. `fetch` defaults to
         // `redirect: 'follow'`, which re-sends the request — INCLUDING the
@@ -1175,7 +1245,7 @@ async function executeOperation(args) {
         // here so we can refuse it instead of following blindly.
         redirect: "manual"
       });
-      if ((0, import_utils2.isRedirectResponse)(response)) {
+      if ((0, import_utils3.isRedirectResponse)(response)) {
         return failure(
           response.status,
           `upstream returned a redirect (${response.status}); not followed to protect injected credentials`
@@ -1432,6 +1502,8 @@ var OperationToolFactory = class {
         entry,
         bundleId: entry.bundleId,
         input: inputParse.data,
+        // For a bearer binding with `passthroughCallerToken: true`.
+        callerToken: callerTokenOf(ctx.authInfo),
         deps
       });
       return {
@@ -1511,6 +1583,8 @@ async function executeSkillAction(args) {
       entry,
       bundleId: entry.bundleId,
       input: inputParse.data,
+      // For a bearer binding with `passthroughCallerToken: true`.
+      callerToken: callerTokenOf(authInfo),
       deps: runtimeDeps
     });
   } catch (e) {
@@ -1785,6 +1859,18 @@ function resolveRuntimeDeps(scope) {
     return void 0;
   }
 }
+function lazyScopeRegistry(scope, name) {
+  return new Proxy({}, {
+    get(_target, prop) {
+      const registry = scope[name];
+      if (!registry) {
+        throw new Error(`[skilled-openapi] scope.${name} not available when accessing "${String(prop)}"`);
+      }
+      const value = registry[prop];
+      return typeof value === "function" ? value.bind(registry) : value;
+    }
+  });
+}
 function resolveBundleTelemetry(scope) {
   const providers = scope?.providers;
   if (!providers || typeof providers.get !== "function") return void 0;
@@ -1882,9 +1968,8 @@ ${catalog}` : searchSkillDescription;
   }
   warnIfInsecureConfig() {
     if (this.options.dev) {
-      console.warn(
-        "[skilled-openapi] dev=true: signature verification BYPASSED and http:// URLs allowed. NEVER use this in production."
-      );
+      const signing = this.options.requireSignature ? "signature verification kept (requireSignature=true)" : "signature verification BYPASSED";
+      console.warn(`[skilled-openapi] dev=true: ${signing} and http:// URLs allowed. NEVER use this in production.`);
     }
     if (!this.options.requireSignature && !this.options.dev) {
       console.warn(
@@ -1937,39 +2022,17 @@ ${catalog}` : searchSkillDescription;
         inject: () => [import_sdk6.ScopeEntry, HiddenOpRegistry, import_skills8.BundleStore],
         useFactory: async (scope, hiddenOps, bundleStore) => {
           const logger = scope.logger.child("skilled-openapi:sync");
-          const lazySkillRegistry = new Proxy({}, {
-            get(_t, prop) {
-              const reg = scope.skills;
-              if (!reg) {
-                throw new Error(`[skilled-openapi] scope.skills not available when accessing "${String(prop)}"`);
-              }
-              const v = reg[prop];
-              return typeof v === "function" ? v.bind(reg) : v;
-            }
-          });
+          const lazySkillRegistry = lazyScopeRegistry(scope, "skills");
           let opToolFactory;
           if (parsed.exposeOperationsAsInternalTools) {
-            try {
-              const toolRegistry = scope.tools;
-              if (toolRegistry) {
-                opToolFactory = new OperationToolFactory({
-                  toolRegistry,
-                  // ScopeEntry exposes a ProviderRegistryInterface; the factory
-                  // needs the concrete ProviderRegistry to construct ToolInstance.
-                  // The runtime is the same class — the cast is safe by construction.
-                  providers: scope.providers,
-                  logger: logger.child("op-tool")
-                });
-              } else {
-                logger.warn(
-                  "exposeOperationsAsInternalTools=true but scope.tools is unavailable; per-op internal tools disabled"
-                );
-              }
-            } catch (e) {
-              logger.warn(
-                `failed to build OperationToolFactory: ${e.message}; per-op internal tools disabled`
-              );
-            }
+            opToolFactory = new OperationToolFactory({
+              toolRegistry: lazyScopeRegistry(scope, "tools"),
+              // ScopeEntry exposes a ProviderRegistryInterface; the factory
+              // needs the concrete ProviderRegistry to construct ToolInstance.
+              // The runtime is the same class — the cast is safe by construction.
+              providers: scope.providers,
+              logger: logger.child("op-tool")
+            });
           }
           const sync = new BundleSyncService(
             lazySkillRegistry,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-skilled-openapi",
-  "version": "1.8.7",
+  "version": "1.9.0",
   "description": "FrontMCP plugin: serve a customer's OpenAPI spec as skill bundles (signed, OpenAPI-Overlay-based) with hidden per-operation tools mediated by three meta-tools (search_skill / load_skill / run_workflow — the last runs an enclave-sandboxed AgentScript that orchestrates the loaded skills' operations).",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -48,15 +48,15 @@
     }
   },
   "dependencies": {
-    "@frontmcp/adapters": "1.8.7",
-    "@frontmcp/auth": "1.8.7",
-    "@frontmcp/sdk": "1.8.7",
-    "@frontmcp/utils": "1.8.7"
+    "@frontmcp/adapters": "1.9.0",
+    "@frontmcp/auth": "1.9.0",
+    "@frontmcp/sdk": "1.9.0",
+    "@frontmcp/utils": "1.9.0"
   },
   "peerDependencies": {
     "@enclave-vm/ast": "*",
     "@enclave-vm/core": "*",
-    "@frontmcp/lazy-zod": "1.8.7"
+    "@frontmcp/lazy-zod": "1.9.0"
   },
   "peerDependenciesMeta": {
     "@enclave-vm/ast": {

package/skilled-openapi.plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skilled-openapi.plugin.d.ts","sourceRoot":"","sources":["../src/skilled-openapi.plugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,gBAAgB,EAIrB,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,aAAa,EAOb,KAAK,SAAS,EAEd,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAOvB,OAAO,EAEL,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACtC,MAAM,yBAAyB,CAAC;AAsBjC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC,eAAsD,CAAC;AAEtG;;;;;GAKG;AACH,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;IACjE;;;;OAIG;IACH,MAAM,CAAC,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC1C;AAqDD;;;;;;;;;;;;GAYG;AAWH,MAAM,CAAC,OAAO,OAAO,oBAAqB,SAAQ,aAAa,CAC7D,2BAA2B,EAC3B,gCAAgC,CACjC;IACC,OAAO,EAAE,2BAA2B,CAAC;IACrC,OAAO,CAAC,YAAY,CAAC,CAAiB;gBAE1B,OAAO,EAAE,gCAAgC;IAMrD,OAAO,CAAC,SAAS;IAOjB;;;;;;;;;;OAUG;IAEG,gCAAgC,CAAC,OAAO,EAAE,SAAS,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAqC7F;;;;;OAKG;IAEG,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBpF,OAAO,CAAC,eAAe;IAUvB,wFAAwF;IACxF,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,oBAAoB;WAaZ,gBAAgB,CAAC,OAAO,EAAE,gCAAgC,GAAG,YAAY,EAAE;CAoK5F"}
+{"version":3,"file":"skilled-openapi.plugin.d.ts","sourceRoot":"","sources":["../src/skilled-openapi.plugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,gBAAgB,EAIrB,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,aAAa,EAOb,KAAK,SAAS,EAEd,KAAK,YAAY,EAGlB,MAAM,eAAe,CAAC;AAOvB,OAAO,EAEL,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACtC,MAAM,yBAAyB,CAAC;AAsBjC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC,eAAsD,CAAC;AAEtG;;;;;GAKG;AACH,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;IACjE;;;;OAIG;IACH,MAAM,CAAC,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC1C;AAuED;;;;;;;;;;;;GAYG;AAWH,MAAM,CAAC,OAAO,OAAO,oBAAqB,SAAQ,aAAa,CAC7D,2BAA2B,EAC3B,gCAAgC,CACjC;IACC,OAAO,EAAE,2BAA2B,CAAC;IACrC,OAAO,CAAC,YAAY,CAAC,CAAiB;gBAE1B,OAAO,EAAE,gCAAgC;IAMrD,OAAO,CAAC,SAAS;IAOjB;;;;;;;;;;OAUG;IAEG,gCAAgC,CAAC,OAAO,EAAE,SAAS,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAqC7F;;;;;OAKG;IAEG,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBpF,OAAO,CAAC,eAAe;IAUvB,wFAAwF;IACxF,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,oBAAoB;WAcZ,gBAAgB,CAAC,OAAO,EAAE,gCAAgC,GAAG,YAAY,EAAE;CA8I5F"}

package/skilled-openapi.types.d.ts

@@ -33,7 +33,7 @@ declare const skilledOpenApiPluginOptionsObjectSchema: import("@frontmcp/lazy-zo
         type: import("@frontmcp/lazy-zod").ZodLiteral<"inline">;
         content: import("@frontmcp/lazy-zod").ZodUnknown;
     }, import("zod/v4/core").$strip>], "type">;
-    requireSignature: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+    requireSignature: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
     trustedKeys: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
         keyId: import("@frontmcp/lazy-zod").ZodString;
         alg: import("@frontmcp/lazy-zod").ZodEnum<{
@@ -87,7 +87,7 @@ export declare const skilledOpenApiPluginOptionsSchema: import("zod").ZodPipe<im
         type: import("@frontmcp/lazy-zod").ZodLiteral<"inline">;
         content: import("@frontmcp/lazy-zod").ZodUnknown;
     }, import("zod/v4/core").$strip>], "type">;
-    requireSignature: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+    requireSignature: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
     trustedKeys: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
         keyId: import("@frontmcp/lazy-zod").ZodString;
         alg: import("@frontmcp/lazy-zod").ZodEnum<{
@@ -118,6 +118,7 @@ export declare const skilledOpenApiPluginOptionsSchema: import("zod").ZodPipe<im
     credentials: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodString>>;
     exposeOperationsAsInternalTools: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
 }, import("zod/v4/core").$strip>, import("zod").ZodTransform<{
+    requireSignature: boolean;
     outbound: {
         allowPrivateNetworks: boolean;
         maxConcurrencyPerHost: number;
@@ -149,7 +150,6 @@ export declare const skilledOpenApiPluginOptionsSchema: import("zod").ZodPipe<im
         type: "inline";
         content: unknown;
     };
-    requireSignature: boolean;
     trustedKeys: {
         keyId: string;
         alg: "RS256" | "EdDSA";
@@ -183,7 +183,6 @@ export declare const skilledOpenApiPluginOptionsSchema: import("zod").ZodPipe<im
         type: "inline";
         content: unknown;
     };
-    requireSignature: boolean;
     trustedKeys: {
         keyId: string;
         alg: "RS256" | "EdDSA";
@@ -201,6 +200,7 @@ export declare const skilledOpenApiPluginOptionsSchema: import("zod").ZodPipe<im
     unprotectedOps: "allow" | "deny";
     sourceConflictPolicy: "static-wins" | "last-wins" | "reject";
     exposeOperationsAsInternalTools: boolean;
+    requireSignature?: boolean | undefined;
     bundleCacheDir?: string | undefined;
     credentials?: Record<string, string> | undefined;
 }>>;

package/skilled-openapi.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skilled-openapi.types.d.ts","sourceRoot":"","sources":["../src/skilled-openapi.types.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAKvC,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AAInC,eAAO,MAAM,qBAAqB;;;;;;;iCAgC9B,CAAC;AAEL,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAIpE,QAAA,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA4E3C,CAAC;AAUH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiB5C,CAAC;AAEH,kEAAkE;AAClE,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,uDAAuD;AACvD,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC"}
+{"version":3,"file":"skilled-openapi.types.d.ts","sourceRoot":"","sources":["../src/skilled-openapi.types.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAKvC,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AAInC,eAAO,MAAM,qBAAqB;;;;;;;iCAgC9B,CAAC;AAEL,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAIpE,QAAA,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA6E3C,CAAC;AAUH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoB5C,CAAC;AAEH,kEAAkE;AAClE,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,uDAAuD;AACvD,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC"}

package/tools/operation-tool.factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operation-tool.factory.d.ts","sourceRoot":"","sources":["../../src/tools/operation-tool.factory.ts"],"names":[],"mappings":"AAaA,OAAO,EAAe,KAAK,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAErF,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAGrB,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAIvB,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAWpE;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAS/E;AA2BD,MAAM,WAAW,wBAAwB;IACvC,sEAAsE;IACtE,YAAY,EAAE,YAAY,CAAC;IAC3B,8DAA8D;IAC9D,SAAS,EAAE,gBAAgB,CAAC;IAC5B,8BAA8B;IAC9B,MAAM,EAAE,cAAc,CAAC;IACvB;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;CACjD;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,mEAAmE;IACnE,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAUD;;;GAGG;AACH,qBAAa,oBAAoB;IAMnB,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC,kFAAkF;IAClF,OAAO,CAAC,UAAU,CAAwC;IAC1D,2EAA2E;IAC3E,OAAO,CAAC,kBAAkB,CAAqB;gBAElB,IAAI,EAAE,wBAAwB;IAE3D;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,wBAAwB,GAAG,IAAI;IA2CpE;;;;OAIG;IACH,aAAa,IAAI,IAAI;IAqBrB,iFAAiF;IACjF,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;CA+ErB"}
+{"version":3,"file":"operation-tool.factory.d.ts","sourceRoot":"","sources":["../../src/tools/operation-tool.factory.ts"],"names":[],"mappings":"AAaA,OAAO,EAAe,KAAK,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAErF,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAGrB,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAKvB,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAWpE;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAS/E;AA2BD,MAAM,WAAW,wBAAwB;IACvC,sEAAsE;IACtE,YAAY,EAAE,YAAY,CAAC;IAC3B,8DAA8D;IAC9D,SAAS,EAAE,gBAAgB,CAAC;IAC5B,8BAA8B;IAC9B,MAAM,EAAE,cAAc,CAAC;IACvB;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;CACjD;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,mEAAmE;IACnE,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAUD;;;GAGG;AACH,qBAAa,oBAAoB;IAMnB,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC,kFAAkF;IAClF,OAAO,CAAC,UAAU,CAAwC;IAC1D,2EAA2E;IAC3E,OAAO,CAAC,kBAAkB,CAAqB;gBAElB,IAAI,EAAE,wBAAwB;IAE3D;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,wBAAwB,GAAG,IAAI;IA2CpE;;;;OAIG;IACH,aAAa,IAAI,IAAI;IAqBrB,iFAAiF;IACjF,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;CAiFrB"}