@frontmcp/sdk 1.2.1 → 1.4.0

package/job/index.d.ts

@@ -8,4 +8,5 @@ export * from './job-scope.helper';
 export * from './store';
 export * from './execution';
 export * from './enclave';
+export * from './tools';
 //# sourceMappingURL=index.d.ts.map

package/job/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/job/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACxD,YAAY,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/job/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACxD,YAAY,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAI1B,cAAc,SAAS,CAAC"}

package/metrics/index.d.ts

@@ -0,0 +1,4 @@
+export { MetricsService, createProcessStatsCollectorIfEnabled, type MetricsResponse, type MetricsServiceOptions, } from './metrics.service';
+export { registerMetricsRoutes, type MetricsRouteServer, type MetricsResponseLike } from './metrics.routes';
+export { MetricsPathConflictError, MetricsTokenNotConfiguredError } from './metrics.errors';
+//# sourceMappingURL=index.d.ts.map

package/metrics/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/metrics/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,cAAc,EACd,oCAAoC,EACpC,KAAK,eAAe,EACpB,KAAK,qBAAqB,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC"}

package/metrics/metrics.errors.d.ts

@@ -0,0 +1,18 @@
+import { InternalMcpError } from '../errors/mcp.error';
+/**
+ * Raised when `metrics.path` collides with an MCP transport route prefix
+ * (`/mcp`, `/sse`, `/messages`).
+ */
+export declare class MetricsPathConflictError extends InternalMcpError {
+    readonly conflictingPath: string;
+    constructor(conflictingPath: string);
+}
+/**
+ * Raised when `metrics.auth === 'token'` is configured but the env var
+ * named by `metrics.tokenEnv` is unset.
+ */
+export declare class MetricsTokenNotConfiguredError extends InternalMcpError {
+    readonly tokenEnv: string;
+    constructor(tokenEnv: string);
+}
+//# sourceMappingURL=metrics.errors.d.ts.map

package/metrics/metrics.errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.errors.d.ts","sourceRoot":"","sources":["../../src/metrics/metrics.errors.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,gBAAgB;IAC5D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;gBAErB,eAAe,EAAE,MAAM;CAOpC;AAED;;;GAGG;AACH,qBAAa,8BAA+B,SAAQ,gBAAgB;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAEd,QAAQ,EAAE,MAAM;CAO7B"}

package/metrics/metrics.routes.d.ts

@@ -0,0 +1,30 @@
+/**
+ * @file metrics.routes.ts
+ * @description HTTP route registration for the `/metrics` endpoint (issue #397).
+ */
+import type { MetricsOptionsInterface } from '../common';
+import type { MetricsService } from './metrics.service';
+/**
+ * Minimal server interface for route registration. Mirrors `HealthRouteServer`
+ * to avoid importing the full `FrontMcpServerInstance` (circular dependencies).
+ */
+export interface MetricsRouteServer {
+    registerRoute(method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'OPTIONS' | 'HEAD', path: string, handler: (req: {
+        headers?: Record<string, string | string[] | undefined>;
+    }, res: MetricsResponseLike) => Promise<void> | void): void;
+}
+/** Subset of the Express-style response object the route uses. */
+export interface MetricsResponseLike {
+    status(code: number): MetricsResponseLike;
+    setHeader?(name: string, value: string): MetricsResponseLike | void;
+    type?(contentType: string): MetricsResponseLike;
+    send?(body: string): MetricsResponseLike | void;
+    json(payload: unknown): void;
+}
+/**
+ * Register the `GET <path>` metrics endpoint. No-op when the config has
+ * `enabled !== true` — callers should already have gated this call but the
+ * extra guard keeps `prepare()` simple.
+ */
+export declare function registerMetricsRoutes(server: MetricsRouteServer, service: MetricsService, config: MetricsOptionsInterface): void;
+//# sourceMappingURL=metrics.routes.d.ts.map

package/metrics/metrics.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.routes.d.ts","sourceRoot":"","sources":["../../src/metrics/metrics.routes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,aAAa,CACX,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,EACxE,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,CACP,GAAG,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAA;KAAE,EAChE,GAAG,EAAE,mBAAmB,KACrB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GACxB,IAAI,CAAC;CACT;AAED,kEAAkE;AAClE,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAAC;IAC1C,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAAC;IACpE,IAAI,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAAC;IAChD,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9B;AAWD;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,uBAAuB,GAC9B,IAAI,CAkDN"}

package/metrics/metrics.service.d.ts

@@ -0,0 +1,66 @@
+/**
+ * @file metrics.service.ts
+ * @description Core service backing the `/metrics` endpoint (issue #397).
+ */
+import type { MetricsOptionsInterface } from '../common';
+interface CounterSnapshotEntry {
+    name: string;
+    count: number;
+    attributes: Record<string, string>;
+}
+interface GaugeSnapshotEntry {
+    name: string;
+    value: number;
+    attributes?: Record<string, string>;
+    help?: string;
+}
+interface ProcessStatsCollector {
+    collect(): GaugeSnapshotEntry[];
+}
+/**
+ * Lazily build a `ProcessStatsCollector` when the metrics config selects the
+ * `process` category (or omits `include` entirely, which means "every
+ * category"). Returns `undefined` when process metrics are filtered out so
+ * the per-scrape `process.cpuUsage()` / `monitorEventLoopDelay()` calls don't
+ * run for nothing.
+ *
+ * Uses the same lazy `require('@frontmcp/observability')` as the snapshot
+ * source so the SDK ↔ observability import cycle stays broken at module
+ * init.
+ */
+export declare function createProcessStatsCollectorIfEnabled(config: MetricsOptionsInterface): ProcessStatsCollector | undefined;
+/**
+ * Resolved metrics body + content type, returned by `getMetrics()`.
+ */
+export interface MetricsResponse {
+    contentType: string;
+    body: string;
+}
+/**
+ * Test-injection seam for the counter snapshot source — production callers
+ * never set this.
+ */
+export interface MetricsServiceOptions {
+    snapshotSource?: () => CounterSnapshotEntry[];
+}
+export declare class MetricsService {
+    private readonly config;
+    private readonly processCollector?;
+    private readonly snapshotSource;
+    private readonly resolvedToken?;
+    constructor(config: MetricsOptionsInterface, processCollector?: ProcessStatsCollector, options?: MetricsServiceOptions);
+    /**
+     * Render the current metrics scrape in the configured format.
+     */
+    getMetrics(): MetricsResponse;
+    /**
+     * Check the supplied `Authorization` header against the configured auth
+     * policy. Returns the HTTP status the route should respond with:
+     *   - 200 — the request is allowed to read metrics
+     *   - 401 — missing credentials when token auth is configured
+     *   - 403 — wrong credentials
+     */
+    authorize(authorizationHeader: string | undefined): 200 | 401 | 403;
+}
+export {};
+//# sourceMappingURL=metrics.service.d.ts.map

package/metrics/metrics.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.service.d.ts","sourceRoot":"","sources":["../../src/metrics/metrics.service.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAmB,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAQ1E,UAAU,oBAAoB;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED,UAAU,kBAAkB;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,UAAU,qBAAqB;IAC7B,OAAO,IAAI,kBAAkB,EAAE,CAAC;CACjC;AAwCD;;;;;;;;;;GAUG;AACH,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,uBAAuB,GAC9B,qBAAqB,GAAG,SAAS,CAMnC;AAgBD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,cAAc,CAAC,EAAE,MAAM,oBAAoB,EAAE,CAAC;CAC/C;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACjD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAwB;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA+B;IAC9D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAS;gBAGtC,MAAM,EAAE,uBAAuB,EAC/B,gBAAgB,CAAC,EAAE,qBAAqB,EACxC,OAAO,GAAE,qBAA0B;IAyBrC;;OAEG;IACH,UAAU,IAAI,eAAe;IAgC7B;;;;;;OAMG;IACH,SAAS,CAAC,mBAAmB,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG;CAUpE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/sdk",
-  "version": "1.2.1",
+  "version": "1.4.0",
   "description": "FrontMCP SDK",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -60,22 +60,41 @@
         "default": "./esm/transport/index.mjs"
       }
     },
+    "./job/tools": {
+      "require": {
+        "types": "./job/tools/index.d.ts",
+        "default": "./job/tools/index.js"
+      },
+      "import": {
+        "types": "./job/tools/index.d.ts",
+        "default": "./esm/job/tools/index.mjs"
+      }
+    },
+    "./workflow/tools": {
+      "require": {
+        "types": "./workflow/tools/index.d.ts",
+        "default": "./workflow/tools/index.js"
+      },
+      "import": {
+        "types": "./workflow/tools/index.d.ts",
+        "default": "./esm/workflow/tools/index.mjs"
+      }
+    },
     "./esm": null
   },
   "engines": {
     "node": ">=24.0.0"
   },
   "peerDependencies": {
-    "zod": "^4.0.0",
     "express": "^4.18.0 || ^5.0.0",
     "cors": "^2.8.5",
     "raw-body": "^3.0.0",
     "content-type": "^1.0.5",
     "@vercel/kv": "^3.0.0",
-    "@frontmcp/storage-sqlite": "1.2.1",
+    "@frontmcp/storage-sqlite": "1.4.0",
     "openai": "^4.0.0 || ^5.0.0 || ^6.0.0",
     "@anthropic-ai/sdk": "^0.30.0 || ^0.78.0",
-    "@frontmcp/observability": "1.2.1",
+    "@frontmcp/observability": "1.4.0",
     "@enclave-vm/core": "^2.13.0",
     "vectoriadb": "^2.2.0",
     "@opentelemetry/api": "^1.9.0",
@@ -112,13 +131,13 @@
   },
   "dependencies": {
     "@types/cors": "^2.8.17",
-    "@frontmcp/utils": "1.2.1",
-    "@frontmcp/guard": "1.2.1",
-    "@frontmcp/di": "1.2.1",
-    "@frontmcp/lazy-zod": "1.2.1",
-    "@frontmcp/uipack": "1.2.1",
-    "@frontmcp/auth": "1.2.1",
-    "@frontmcp/protocol": "1.2.1",
+    "@frontmcp/utils": "1.4.0",
+    "@frontmcp/guard": "1.4.0",
+    "@frontmcp/di": "1.4.0",
+    "@frontmcp/lazy-zod": "1.4.0",
+    "@frontmcp/uipack": "1.4.0",
+    "@frontmcp/auth": "1.4.0",
+    "@frontmcp/protocol": "1.4.0",
     "ioredis": "^5.8.0",
     "js-yaml": "^4.1.1",
     "jose": "^6.1.3",

package/prompt/prompt.registry.d.ts

@@ -108,6 +108,11 @@ PromptRecord, PromptType[]> {
     /**
      * Get the MCP capabilities for prompts.
      * These are reported to clients during initialization.
+     *
+     * Issue #407: we always advertise the `prompts` capability so the MCP SDK
+     * accepts the always-registered `prompts/list` handler (see
+     * `createMcpHandlers`). `listChanged` still reflects whether anything is
+     * actually registered.
      */
     getCapabilities(): Partial<ServerCapabilities>;
 }

package/prompt/prompt.registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompt.registry.d.ts","sourceRoot":"","sources":["../../src/prompt/prompt.registry.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,UAAU,EAEhB,MAAM,WAAW,CAAC;AAQnB,OAAO,KAAK,gBAAgB,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAK5E,OAAO,EAAiB,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAA8B,KAAK,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAM1G,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,gBAAgB,CAC1D,cAAc,EAAE,qCAAqC;AACrD,YAAY,EACZ,UAAU,EAAE,CACb;IACC,oDAAoD;IACpD,KAAK,EAAE,aAAa,CAAC;IAErB,8EAA8E;IAC9E,OAAO,CAAC,SAAS,CAAuB;IAExC,sFAAsF;IACtF,OAAO,CAAC,OAAO,CAA8C;IAE7D,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAA6B;IAG7C,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,MAAM,CAAsC;IACpD,OAAO,CAAC,cAAc,CAAoC;IAC1D,OAAO,CAAC,OAAO,CAAsC;IAGrD,OAAO,CAAC,OAAO,CAAK;IACpB,OAAO,CAAC,OAAO,CAAuB;gBAE1B,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,aAAa;cAY9D,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,sBAAsB,CAAC,YAAY,CAAC;IAgBrF,SAAS,CAAC,UAAU;cAkBK,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAqDpD;;;OAGG;IACH,cAAc,CAAC,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI;IAuBvE;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IA6CjC;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;OAEG;IACH,UAAU,CAAC,aAAa,UAAQ,GAAG,WAAW,EAAE;IAchD;;OAEG;IACH,gBAAgB,IAAI,WAAW,EAAE;IAIjC;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAKjD;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE;IAK1C,sEAAsE;IACtE,cAAc,IAAI,aAAa,EAAE;IAIjC,6CAA6C;IAC7C,gBAAgB,IAAI,SAAS,WAAW,EAAE;IAI1C,mEAAmE;IACnE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,WAAW,EAAE;IAMtD,OAAO,CAAC,OAAO;IA0Bf;;OAEG;IACH,mBAAmB,CAAC,IAAI,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,WAAW,CAAA;KAAE,CAAC;IA8E/F,8CAA8C;IAC9C,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,WAAW,GAAG,SAAS;IAO9E,SAAS,CACP,IAAI,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK,OAAO,CAAA;KAAE,EACnE,EAAE,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GACnC,MAAM,IAAI;IAab,OAAO,CAAC,IAAI;IAOZ,iCAAiC;IACjC,OAAO,CAAC,OAAO;IAiBf,6FAA6F;IAC7F,OAAO,CAAC,SAAS;IAmBjB,kDAAkD;IAClD,OAAO,CAAC,YAAY;IAsBpB,mEAAmE;IACnE,MAAM,IAAI,OAAO;IAIjB;;;;OAIG;IACH,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI;IA2C1D;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAmCjD;;;OAGG;IACH,eAAe,IAAI,OAAO,CAAC,kBAAkB,CAAC;CAU/C"}
+{"version":3,"file":"prompt.registry.d.ts","sourceRoot":"","sources":["../../src/prompt/prompt.registry.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,UAAU,EAEhB,MAAM,WAAW,CAAC;AAQnB,OAAO,KAAK,gBAAgB,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAK5E,OAAO,EAAiB,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAA8B,KAAK,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAM1G,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,gBAAgB,CAC1D,cAAc,EAAE,qCAAqC;AACrD,YAAY,EACZ,UAAU,EAAE,CACb;IACC,oDAAoD;IACpD,KAAK,EAAE,aAAa,CAAC;IAErB,8EAA8E;IAC9E,OAAO,CAAC,SAAS,CAAuB;IAExC,sFAAsF;IACtF,OAAO,CAAC,OAAO,CAA8C;IAE7D,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAA6B;IAG7C,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,MAAM,CAAsC;IACpD,OAAO,CAAC,cAAc,CAAoC;IAC1D,OAAO,CAAC,OAAO,CAAsC;IAGrD,OAAO,CAAC,OAAO,CAAK;IACpB,OAAO,CAAC,OAAO,CAAuB;gBAE1B,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,aAAa;cAY9D,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,sBAAsB,CAAC,YAAY,CAAC;IAgBrF,SAAS,CAAC,UAAU;cAkBK,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAqDpD;;;OAGG;IACH,cAAc,CAAC,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI;IAuBvE;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IA6CjC;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;OAEG;IACH,UAAU,CAAC,aAAa,UAAQ,GAAG,WAAW,EAAE;IAchD;;OAEG;IACH,gBAAgB,IAAI,WAAW,EAAE;IAIjC;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAKjD;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE;IAK1C,sEAAsE;IACtE,cAAc,IAAI,aAAa,EAAE;IAIjC,6CAA6C;IAC7C,gBAAgB,IAAI,SAAS,WAAW,EAAE;IAI1C,mEAAmE;IACnE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,WAAW,EAAE;IAMtD,OAAO,CAAC,OAAO;IA0Bf;;OAEG;IACH,mBAAmB,CAAC,IAAI,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,WAAW,CAAA;KAAE,CAAC;IA8E/F,8CAA8C;IAC9C,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,WAAW,GAAG,SAAS;IAO9E,SAAS,CACP,IAAI,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK,OAAO,CAAA;KAAE,EACnE,EAAE,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GACnC,MAAM,IAAI;IAab,OAAO,CAAC,IAAI;IAOZ,iCAAiC;IACjC,OAAO,CAAC,OAAO;IAiBf,6FAA6F;IAC7F,OAAO,CAAC,SAAS;IAmBjB,kDAAkD;IAClD,OAAO,CAAC,YAAY;IAsBpB,mEAAmE;IACnE,MAAM,IAAI,OAAO;IAIjB;;;;OAIG;IACH,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI;IA2C1D;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAmCjD;;;;;;;;OAQG;IACH,eAAe,IAAI,OAAO,CAAC,kBAAkB,CAAC;CAO/C"}

package/resource/resource.registry.d.ts

@@ -119,6 +119,11 @@ ResourceRecord | ResourceTemplateRecord, ResourceType[]> {
     /**
      * Get the MCP capabilities for resources.
      * These are reported to clients during initialization.
+     *
+     * Issue #407: we always advertise the `resources` capability so the MCP SDK
+     * accepts the always-registered `resources/list` and `resources/templates/list`
+     * handlers (see `createMcpHandlers`). `subscribe` and `listChanged` reflect
+     * whether anything is actually registered.
      */
     getCapabilities(): Partial<ServerCapabilities>;
     /**

package/resource/resource.registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.registry.d.ts","sourceRoot":"","sources":["../../src/resource/resource.registry.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EAElB,MAAM,WAAW,CAAC;AAInB,OAAO,KAAK,gBAAgB,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAQ5E,OAAO,EAAmB,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAgC,KAAK,eAAe,EAAE,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAQlH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,gBAAgB,CAC5D,gBAAgB,EAAE,uCAAuC;AACzD,AADkB,uCAAuC;AACzD,cAAc,GAAG,sBAAsB,EACvC,YAAY,EAAE,CACf;IACC,oDAAoD;IACpD,KAAK,EAAE,aAAa,CAAC;IAErB,gFAAgF;IAChF,OAAO,CAAC,SAAS,CAAyB;IAE1C,wFAAwF;IACxF,OAAO,CAAC,OAAO,CAAkD;IAEjE,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAA+B;IAG/C,OAAO,CAAC,aAAa,CAAsC;IAC3D,OAAO,CAAC,MAAM,CAAwC;IACtD,OAAO,CAAC,KAAK,CAAsC;IACnD,OAAO,CAAC,aAAa,CAAsC;IAC3D,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,OAAO,CAAwC;IAGvD,OAAO,CAAC,OAAO,CAAK;IACpB,OAAO,CAAC,OAAO,CAAyB;gBAE5B,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,aAAa;cAYhE,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC,cAAc,GAAG,sBAAsB,CAAC;IAkBlH,SAAS,CAAC,UAAU;cAeK,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA0DpD;;;OAGG;IACH,cAAc,CAAC,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI;IAuBzE;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IA+CnC;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAWlC;;OAEG;IACH,YAAY,CAAC,aAAa,UAAQ,GAAG,aAAa,EAAE;IAcpD;;OAEG;IACH,oBAAoB,IAAI,aAAa,EAAE;IASvC;;OAEG;IACH,kBAAkB,IAAI,aAAa,EAAE;IAIrC;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAKjD;;OAEG;IACH,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,aAAa,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,SAAS;IAaxG;;OAEG;IACH,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,aAAa,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,SAAS;IAWxG,sEAAsE;IACtE,cAAc,IAAI,eAAe,EAAE;IAInC,6CAA6C;IAC7C,gBAAgB,IAAI,SAAS,aAAa,EAAE;IAI5C,mEAAmE;IACnE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,aAAa,EAAE;IAMxD,OAAO,CAAC,OAAO;IAmCf;;OAEG;IACH,mBAAmB,CAAC,IAAI,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAA;KAAE,CAAC;IA2EnG,8CAA8C;IAC9C,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,qBAAqB,GAAG,aAAa,GAAG,SAAS;IAOlF,SAAS,CACP,IAAI,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,aAAa,KAAK,OAAO,CAAA;KAAE,EACrE,EAAE,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,IAAI,GACrC,MAAM,IAAI;IAab;;;;;OAKG;IACH,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAUvC,OAAO,CAAC,IAAI;IAOZ,mCAAmC;IACnC,OAAO,CAAC,OAAO;IAyBf,6FAA6F;IAC7F,OAAO,CAAC,SAAS;IAsBjB,kDAAkD;IAClD,OAAO,CAAC,YAAY;IAsBpB,qEAAqE;IACrE,MAAM,IAAI,OAAO;IAIjB;;;;OAIG;IACH,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI;IA0C5D;;;OAGG;IACH,eAAe,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAa9C;;;;;;;;;;;OAWG;IACH,wBAAwB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAmCvD;;;;;;;OAOG;IACH,uBAAuB,CAAC,WAAW,EAAE,YAAY,GAAG,cAAc,GAAG,sBAAsB,GAAG,IAAI;CA0DnG"}
+{"version":3,"file":"resource.registry.d.ts","sourceRoot":"","sources":["../../src/resource/resource.registry.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EAElB,MAAM,WAAW,CAAC;AAInB,OAAO,KAAK,gBAAgB,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAQ5E,OAAO,EAAmB,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAgC,KAAK,eAAe,EAAE,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAQlH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,gBAAgB,CAC5D,gBAAgB,EAAE,uCAAuC;AACzD,AADkB,uCAAuC;AACzD,cAAc,GAAG,sBAAsB,EACvC,YAAY,EAAE,CACf;IACC,oDAAoD;IACpD,KAAK,EAAE,aAAa,CAAC;IAErB,gFAAgF;IAChF,OAAO,CAAC,SAAS,CAAyB;IAE1C,wFAAwF;IACxF,OAAO,CAAC,OAAO,CAAkD;IAEjE,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAA+B;IAG/C,OAAO,CAAC,aAAa,CAAsC;IAC3D,OAAO,CAAC,MAAM,CAAwC;IACtD,OAAO,CAAC,KAAK,CAAsC;IACnD,OAAO,CAAC,aAAa,CAAsC;IAC3D,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,OAAO,CAAwC;IAGvD,OAAO,CAAC,OAAO,CAAK;IACpB,OAAO,CAAC,OAAO,CAAyB;gBAE5B,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,aAAa;cAYhE,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC,cAAc,GAAG,sBAAsB,CAAC;IAkBlH,SAAS,CAAC,UAAU;cAeK,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA0DpD;;;OAGG;IACH,cAAc,CAAC,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI;IAuBzE;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IA+CnC;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAWlC;;OAEG;IACH,YAAY,CAAC,aAAa,UAAQ,GAAG,aAAa,EAAE;IAcpD;;OAEG;IACH,oBAAoB,IAAI,aAAa,EAAE;IASvC;;OAEG;IACH,kBAAkB,IAAI,aAAa,EAAE;IAIrC;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAKjD;;OAEG;IACH,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,aAAa,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,SAAS;IAaxG;;OAEG;IACH,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,aAAa,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,SAAS;IAWxG,sEAAsE;IACtE,cAAc,IAAI,eAAe,EAAE;IAInC,6CAA6C;IAC7C,gBAAgB,IAAI,SAAS,aAAa,EAAE;IAI5C,mEAAmE;IACnE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,aAAa,EAAE;IAMxD,OAAO,CAAC,OAAO;IAmCf;;OAEG;IACH,mBAAmB,CAAC,IAAI,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAA;KAAE,CAAC;IA2EnG,8CAA8C;IAC9C,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,qBAAqB,GAAG,aAAa,GAAG,SAAS;IAOlF,SAAS,CACP,IAAI,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,aAAa,KAAK,OAAO,CAAA;KAAE,EACrE,EAAE,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,IAAI,GACrC,MAAM,IAAI;IAab;;;;;OAKG;IACH,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAUvC,OAAO,CAAC,IAAI;IAOZ,mCAAmC;IACnC,OAAO,CAAC,OAAO;IAyBf,6FAA6F;IAC7F,OAAO,CAAC,SAAS;IAsBjB,kDAAkD;IAClD,OAAO,CAAC,YAAY;IAsBpB,qEAAqE;IACrE,MAAM,IAAI,OAAO;IAIjB;;;;OAIG;IACH,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI;IA0C5D;;;;;;;;OAQG;IACH,eAAe,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAW9C;;;;;;;;;;;OAWG;IACH,wBAAwB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAmCvD;;;;;;;OAOG;IACH,uBAAuB,CAAC,WAAW,EAAE,YAAY,GAAG,cAAc,GAAG,sBAAsB,GAAG,IAAI;CA0DnG"}

package/scope/flows/http.request.flow.d.ts

@@ -44,11 +44,11 @@ export declare const httpRequestStateSchema: import("@frontmcp/lazy-zod").ZodObj
                     isPublic: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
                     platformType: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
                         unknown: "unknown";
+                        continue: "continue";
                         openai: "openai";
                         claude: "claude";
                         gemini: "gemini";
                         cursor: "cursor";
-                        continue: "continue";
                         cody: "cody";
                         "generic-mcp": "generic-mcp";
                         "ext-apps": "ext-apps";
@@ -92,6 +92,23 @@ export default class HttpRequestFlow extends FlowBase<typeof name> {
     traceRequest(): Promise<void>;
     acquireQuota(): Promise<void>;
     checkAuthorization(): Promise<void>;
+    /**
+     * Build a live {@link OrchestratedAuthAccessorAdapter} for the verified request
+     * and register it under {@link ORCHESTRATED_AUTH_ACCESSOR} so tools can read
+     * upstream provider tokens via `this.orchestration.getToken(id)`.
+     *
+     * `session:verify` returns a lightweight authorization (`{ token, user, … }`)
+     * rather than a full OrchestratedAuthorization, so we reconstruct one here from
+     * the verified JWT + the primary auth's encrypted token store (the same store
+     * the federated provider-callback flow wrote upstream tokens into, keyed by
+     * `deriveAuthorizationId(token)`). No-op unless the scope is in orchestrated
+     * mode with a token store and a non-empty bearer token — so public/transparent
+     * and anonymous requests are unaffected.
+     *
+     * Security: tokens stay server-side and AES-GCM-encrypted at rest; only the
+     * non-PII provider ids are read here to project the authorization.
+     */
+    private bindOrchestrationAccessor;
     router(): Promise<void>;
     handleLegacySse(): Promise<void>;
     handleSse(): Promise<void>;

package/scope/flows/http.request.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.request.flow.d.ts","sourceRoot":"","sources":["../../../src/scope/flows/http.request.flow.ts"],"names":[],"mappings":"AAIA,OAAO,EAIL,QAAQ,EAGR,eAAe,EACf,gBAAgB,EAShB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AAGtB,QAAA,MAAM,IAAI;;;;;CA8B2B,CAAC;AAEtC,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAIjC,CAAC;AAEH,QAAA,MAAM,IAAI,EAAG,cAAuB,CAAC;AAGrC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,cAAc,EAAE,cAAc,CAC5B,eAAe,EACf,OAAO,IAAI,EACX,OAAO,eAAe,EACtB,OAAO,gBAAgB,EACvB,OAAO,sBAAsB,CAC9B,CAAC;KACH;CACF;AAYD,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAChE,MAAM,wCAA8C;IACpD,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,SAAS,CAAM;IAEvB,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU;IActD,YAAY;IAkDZ,YAAY;IA8BZ,kBAAkB;IA+ClB,MAAM;IAsNN,eAAe;IAuBf,SAAS;IAuBT,oBAAoB;IAuBpB,kBAAkB;IAuBlB,mBAAmB;IAuBnB,mBAAmB;IAgDnB,QAAQ;IAcd;;;OAGG;IACH,OAAO,CAAC,QAAQ;CA8CjB"}
+{"version":3,"file":"http.request.flow.d.ts","sourceRoot":"","sources":["../../../src/scope/flows/http.request.flow.ts"],"names":[],"mappings":"AAYA,OAAO,EAIL,QAAQ,EAGR,eAAe,EACf,gBAAgB,EAShB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AAGtB,QAAA,MAAM,IAAI;;;;;CA8B2B,CAAC;AAEtC,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAIjC,CAAC;AAEH,QAAA,MAAM,IAAI,EAAG,cAAuB,CAAC;AAGrC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,cAAc,EAAE,cAAc,CAC5B,eAAe,EACf,OAAO,IAAI,EACX,OAAO,eAAe,EACtB,OAAO,gBAAgB,EACvB,OAAO,sBAAsB,CAC9B,CAAC;KACH;CACF;AAYD,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAChE,MAAM,wCAA8C;IACpD,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,SAAS,CAAM;IAEvB,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU;IActD,YAAY;IAkDZ,YAAY;IA8BZ,kBAAkB;IAmDxB;;;;;;;;;;;;;;;OAeG;YACW,yBAAyB;IAwCjC,MAAM;IAsNN,eAAe;IAuBf,SAAS;IAuBT,oBAAoB;IAuBpB,kBAAkB;IAuBlB,mBAAmB;IAuBnB,mBAAmB;IAgDnB,QAAQ;IAcd;;;OAGG;IACH,OAAO,CAAC,QAAQ;CA8CjB"}

package/scope/optional-dependency.util.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Helpers for probing optional peer dependencies that are loaded lazily via
+ * `require()` (e.g. `@frontmcp/observability`).
+ *
+ * A bare `try { require(pkg) } catch { warn("not installed") }` is misleading:
+ * `require()` throws for many reasons OTHER than the package being absent — an
+ * export-condition or transpile mismatch (a dev runtime such as tsx resolving a
+ * package's TS source entry under yarn), a missing transitive peer, or a load-time
+ * error in the module itself. In all of those the package IS installed and
+ * resolvable, yet the user is told to reinstall it, which never helps (#453).
+ */
+/**
+ * Outcome of classifying a failed `require()` of an optional dependency.
+ */
+export interface OptionalDependencyProbe {
+    /**
+     * - `not-installed` — the module is genuinely unresolvable (reinstalling helps).
+     * - `load-failed`   — the module resolves but `require()` threw (a load / export
+     *   condition / transpile / peer mismatch; reinstalling will NOT help).
+     */
+    status: 'not-installed' | 'load-failed';
+    /** Path returned by the runtime resolver, present only when `load-failed`. */
+    resolvedPath?: string;
+    /** Message from the original `require()` error. */
+    error: string;
+}
+/**
+ * Classify why `require(moduleName)` failed by re-probing with the SAME resolver
+ * the runtime uses, so the verdict matches reality instead of always blaming a
+ * missing install.
+ *
+ * @param moduleName - the specifier that failed to `require()`.
+ * @param loadError - the error thrown by the failed `require()`.
+ * @param resolve - resolver to probe existence with. Pass `require.resolve` from
+ *   the caller; kept injectable so this stays unit-testable and ESM-safe (the
+ *   helper module itself never references `require`).
+ */
+export declare function probeOptionalDependency(moduleName: string, loadError: unknown, resolve: (id: string) => string): OptionalDependencyProbe;
+//# sourceMappingURL=optional-dependency.util.d.ts.map

package/scope/optional-dependency.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"optional-dependency.util.d.ts","sourceRoot":"","sources":["../../src/scope/optional-dependency.util.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,EAAE,eAAe,GAAG,aAAa,CAAC;IACxC,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,GAC9B,uBAAuB,CAWzB"}

package/scope/scope.instance.d.ts

@@ -3,6 +3,7 @@ import { type GuardManager } from '@frontmcp/guard';
 import { type EventStore } from '@frontmcp/protocol';
 import AgentRegistry from '../agent/agent.registry';
 import AppRegistry from '../app/app.registry';
+import { AuthUiRegistry } from '../auth/auth-ui';
 import { AuthRegistry } from '../auth/auth.registry';
 import { type ChannelNotificationService } from '../channel/channel-notification.service';
 import type ChannelRegistry from '../channel/channel.registry';
@@ -44,14 +45,19 @@ export declare class Scope extends ScopeEntry {
     notificationService: NotificationService;
     haManager?: HaManager;
     private toolUIRegistry;
+    private authUiRegistry?;
     readonly entryPath: string;
     readonly routeBase: string;
     readonly orchestrated: boolean;
     readonly server: FrontMcpServer;
     /** Lazy-initialized elicitation store for distributed elicitation support */
     private _elicitationStore?;
+    /** Backend type for the elicitation store (used by the orphan-sqlite WARN guard). */
+    private elicitationBackendType?;
     /** Task store for MCP 2025-11-25 background tasks (optional). */
     private _taskStore?;
+    /** Backend type for the task store (used by the orphan-sqlite WARN guard). */
+    private taskBackendType?;
     /** Per-process task registry (AbortControllers + capability projection). */
     private _taskRegistry?;
     /** Optional skill session manager for tool authorization enforcement */
@@ -81,11 +87,34 @@ export declare class Scope extends ScopeEntry {
     private readonly cliMode;
     constructor(rec: ScopeRecord, globalProviders: ProviderRegistry);
     protected initialize(): Promise<void>;
+    /**
+     * Resolve the top-level `sqlite` config, filling in a default `path`
+     * when the user provided the block without one (issue #401). Also
+     * ensures the parent directory exists so better-sqlite3 doesn't fail
+     * to open. Returns `undefined` if the user didn't set the block at
+     * all. The returned object is a SHALLOW COPY — never mutate the
+     * caller's metadata.
+     */
+    private resolveTopLevelSqlite;
     /**
      * Pre-compile UI widgets for tools with UI configs.
      * Extracted from initialize() for readability.
      */
     private compileUIWidgets;
+    /**
+     * Build the custom auth-UI registry (#469) PER SCOPE from this scope's resolved
+     * auth options (`auth.ui` / `auth.extras`). The parent multi-app scope reads
+     * the top-level `@FrontMcp({ auth })`, and each `splitByApp` scope reads its own
+     * `@App({ auth })` (resolved into `this.metadata.auth` by `normalizeAppScope`),
+     * so a split app gets ITS OWN auth UI.
+     *
+     * No-op (leaves {@link authUiRegistry} undefined) when neither is declared, so
+     * the OAuth flows serve the built-in HTML pages exactly as before. When custom
+     * slots ARE declared, their SSR + hydration bundles are pre-built at startup
+     * (mirroring `compileUIWidgets`); build failures are logged + cached, never
+     * thrown, so a broken component degrades to the built-in page.
+     */
+    private buildAuthUiRegistry;
     private formatScopeSummary;
     private get defaultScopeProviders();
     get auth(): FrontMcpAuth;
@@ -95,6 +124,7 @@ export declare class Scope extends ScopeEntry {
     get apps(): AppRegistry;
     get tools(): ToolRegistry;
     get toolUI(): ToolUIRegistry;
+    get authUi(): AuthUiRegistry | undefined;
     get resources(): ResourceRegistry;
     get prompts(): PromptRegistry;
     get agents(): AgentRegistry;

package/scope/scope.instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope.instance.d.ts","sourceRoot":"","sources":["../../src/scope/scope.instance.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD,OAAO,aAAa,MAAM,yBAAyB,CAAC;AAEpD,OAAO,WAAW,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,KAAK,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAE1F,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAI3E,OAAO,EACL,cAAc,EACd,cAAc,EAEd,UAAU,EAEV,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,KAAK,EACV,KAAK,IAAI,EACV,MAAM,WAAW,CAAC;AAOnB,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAK/E,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,YAAY,MAAM,wBAAwB,CAAC;AAIlD,OAAO,KAAK,WAAW,MAAM,qBAAqB,CAAC;AAInD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,cAAwC,MAAM,2BAA2B,CAAC;AACjF,OAAO,cAAc,MAAM,2BAA2B,CAAC;AACvD,OAAO,gBAAgB,MAAM,+BAA+B,CAAC;AAC7D,OAAO,gBAAgB,MAAM,+BAA+B,CAAC;AAG7D,OAAO,EAA2B,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,OAAO,aAAa,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAKL,YAAY,EAKZ,KAAK,SAAS,EACf,MAAM,SAAS,CAAC;AAEjB,OAAO,YAAY,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAA6C,cAAc,EAAE,MAAM,YAAY,CAAC;AAGvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,gBAAgB,MAAM,+BAA+B,CAAC;AAGlE,qBAAa,KAAM,SAAQ,UAAU;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmB;IACnD,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAEhC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAmB;IAClD,OAAO,CAAC,SAAS,CAAe;IAChC,OAAO,CAAC,UAAU,CAAe;IACjC,OAAO,CAAC,SAAS,CAAc;IAC/B,OAAO,CAAC,UAAU,CAAe;IACjC,OAAO,CAAC,UAAU,CAAe;IACjC,OAAO,CAAC,cAAc,CAAmB;IACzC,OAAO,CAAC,YAAY,CAAiB;IACrC,OAAO,CAAC,WAAW,CAAgB;IACnC,OAAO,CAAC,WAAW,CAAgB;IACnC,OAAO,CAAC,YAAY,CAAC,CAAiB;IAEtC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,mBAAmB,EAAE,mBAAmB,CAAC;IACjC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC9B,OAAO,CAAC,cAAc,CAAiB;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAS;IAEvC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAEhC,6EAA6E;IAC7E,OAAO,CAAC,iBAAiB,CAAC,CAAmB;IAE7C,iEAAiE;IACjE,OAAO,CAAC,UAAU,CAAC,CAAY;IAE/B,4EAA4E;IAC5E,OAAO,CAAC,aAAa,CAAC,CAAe;IAErC,wEAAwE;IACxE,OAAO,CAAC,aAAa,CAAC,CAAsB;IAE5C,yDAAyD;IACzD,OAAO,CAAC,WAAW,CAAC,CAAa;IAEjC,uDAAuD;IACvD,OAAO,CAAC,UAAU,CAAC,CAAc;IACjC,OAAO,CAAC,eAAe,CAAC,CAAmB;IAC3C,OAAO,CAAC,oBAAoB,CAAC,CAAsB;IACnD,OAAO,CAAC,cAAc,CAAC,CAAgB;IACvC,OAAO,CAAC,mBAAmB,CAAC,CAAqB;IAEjD,4EAA4E;IAC5E,OAAO,CAAC,iBAAiB,CAAC,CAAe;IAEzC,oEAAoE;IACpE,OAAO,CAAC,kBAAkB,CAAC,CAA6C;IACxE,OAAO,CAAC,0BAA0B,CAAC,CAAqD;IACxF,OAAO,CAAC,wBAAwB,CAAC,CAAmD;IAEpF,gCAAgC;IAChC,OAAO,CAAC,cAAc,CAAC,CAAkB;IACzC,OAAO,CAAC,2BAA2B,CAAC,CAA6B;IACjE,OAAO,CAAC,gBAAgB,CAAC,CAAkB;IAC3C,OAAO,CAAC,gBAAgB,CAAC,CAAsB;IAE/C,kEAAkE;IAClE,OAAO,CAAC,cAAc,CAAC,CAAgB;IAEvC,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;gBAEtB,GAAG,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB;cA2B/C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAonB3C;;;OAGG;YACW,gBAAgB;IAsH9B,OAAO,CAAC,kBAAkB;IAiB1B,OAAO,KAAK,qBAAqB,GA+BhC;IAED,IAAI,IAAI,IAAI,YAAY,CAEvB;IAED,IAAI,KAAK,IAAI,YAAY,CAExB;IAED,IAAI,aAAa,IAAI,YAAY,CAEhC;IAED,IAAI,SAAS,qBAEZ;IAED,IAAI,IAAI,IAAI,WAAW,CAEtB;IAED,IAAI,KAAK,IAAI,YAAY,CAExB;IAED,IAAI,MAAM,IAAI,cAAc,CAE3B;IAED,IAAI,SAAS,IAAI,gBAAgB,CAEhC;IAED,IAAI,OAAO,IAAI,cAAc,CAE5B;IAED,IAAI,MAAM,IAAI,aAAa,CAE1B;IAED,IAAI,MAAM,IAAI,aAAa,CAE1B;IAED,IAAI,IAAI,IAAI,WAAW,GAAG,SAAS,CAElC;IAED,IAAI,SAAS,IAAI,gBAAgB,GAAG,SAAS,CAE5C;IAED,IAAI,QAAQ,IAAI,eAAe,GAAG,SAAS,CAE1C;IAED,IAAI,oBAAoB,IAAI,0BAA0B,GAAG,SAAS,CAEjE;IAED,IAAI,eAAe,IAAI,eAAe,GAAG,SAAS,CAEjD;IAED;;;;;;;;;;OAUG;IACH,IAAI,YAAY,IAAI,mBAAmB,GAAG,SAAS,CAElD;IAED,IAAI,OAAO,IAAI,cAAc,GAAG,SAAS,CAExC;IAED,IAAI,aAAa,IAAI,mBAAmB,CAEvC;IAED;;;;;;;;;OASG;IACH,IAAI,gBAAgB,IAAI,gBAAgB,GAAG,SAAS,CAEnD;IAED;;;OAGG;IACH,IAAI,SAAS,IAAI,SAAS,GAAG,SAAS,CAErC;IAED;;;OAGG;IACH,IAAI,KAAK,IAAI,YAAY,GAAG,SAAS,CAEpC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,UAAU,IAAI,UAAU,GAAG,SAAS,CAEvC;IAED;;;OAGG;IACH,IAAI,gBAAgB,IAAI,YAAY,GAAG,SAAS,CAE/C;IAED;;;OAGG;IACH,IAAI,aAAa,IAAI,aAAa,GAAG,SAAS,CAE7C;IAED;;;;OAIG;IACH,IAAI,iBAAiB,IAAI,OAAO,gBAAgB,EAAE,iBAAiB,GAAG,SAAS,CAE9E;IAED;;;OAGG;IACH,IAAI,yBAAyB,IAAI,OAAO,gBAAgB,EAAE,yBAAyB,GAAG,SAAS,CAE9F;IAED;;;OAGG;IACH,IAAI,uBAAuB,IAAI,OAAO,gBAAgB,EAAE,uBAAuB,GAAG,SAAS,CAE1F;IAED;;;;OAIG;IACH,qBAAqB,IAAI,MAAM,EAAE;IAoJjC;;;OAGG;IACH,OAAO,CAAC,iCAAiC;IAkBzC;;;OAGG;IACH,IAAI,UAAU;;;;;;kBAEb;IAED,aAAa,CAAC,GAAG,KAAK,EAAE,QAAQ,EAAE;IAIlC,OAAO,CAAC,IAAI,SAAS,QAAQ,EAC3B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EACxB,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GACtB,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAIpC,gBAAgB,CAAC,IAAI,SAAS,QAAQ,EAC1C,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EACxB,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GACtB,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAQ9B;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAkB/B;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAM/B"}
+{"version":3,"file":"scope.instance.d.ts","sourceRoot":"","sources":["../../src/scope/scope.instance.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD,OAAO,aAAa,MAAM,yBAAyB,CAAC;AAEpD,OAAO,WAAW,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,KAAK,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAE1F,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAI3E,OAAO,EACL,cAAc,EACd,cAAc,EAEd,UAAU,EAEV,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,KAAK,EACV,KAAK,IAAI,EACV,MAAM,WAAW,CAAC;AAQnB,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAK/E,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,YAAY,MAAM,wBAAwB,CAAC;AAIlD,OAAO,KAAK,WAAW,MAAM,qBAAqB,CAAC;AAInD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,cAAwC,MAAM,2BAA2B,CAAC;AACjF,OAAO,cAAc,MAAM,2BAA2B,CAAC;AACvD,OAAO,gBAAgB,MAAM,+BAA+B,CAAC;AAC7D,OAAO,gBAAgB,MAAM,+BAA+B,CAAC;AAI7D,OAAO,EAA2B,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,OAAO,aAAa,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAKL,YAAY,EAKZ,KAAK,SAAS,EACf,MAAM,SAAS,CAAC;AAEjB,OAAO,YAAY,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAA6C,cAAc,EAAE,MAAM,YAAY,CAAC;AAGvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,gBAAgB,MAAM,+BAA+B,CAAC;AAIlE,qBAAa,KAAM,SAAQ,UAAU;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmB;IACnD,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAEhC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAmB;IAClD,OAAO,CAAC,SAAS,CAAe;IAChC,OAAO,CAAC,UAAU,CAAe;IACjC,OAAO,CAAC,SAAS,CAAc;IAC/B,OAAO,CAAC,UAAU,CAAe;IACjC,OAAO,CAAC,UAAU,CAAe;IACjC,OAAO,CAAC,cAAc,CAAmB;IACzC,OAAO,CAAC,YAAY,CAAiB;IACrC,OAAO,CAAC,WAAW,CAAgB;IACnC,OAAO,CAAC,WAAW,CAAgB;IACnC,OAAO,CAAC,YAAY,CAAC,CAAiB;IAEtC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,mBAAmB,EAAE,mBAAmB,CAAC;IACjC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC9B,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAS;IAEvC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAEhC,6EAA6E;IAC7E,OAAO,CAAC,iBAAiB,CAAC,CAAmB;IAC7C,qFAAqF;IACrF,OAAO,CAAC,sBAAsB,CAAC,CAAqD;IAEpF,iEAAiE;IACjE,OAAO,CAAC,UAAU,CAAC,CAAY;IAC/B,8EAA8E;IAC9E,OAAO,CAAC,eAAe,CAAC,CAAqD;IAE7E,4EAA4E;IAC5E,OAAO,CAAC,aAAa,CAAC,CAAe;IAErC,wEAAwE;IACxE,OAAO,CAAC,aAAa,CAAC,CAAsB;IAE5C,yDAAyD;IACzD,OAAO,CAAC,WAAW,CAAC,CAAa;IAEjC,uDAAuD;IACvD,OAAO,CAAC,UAAU,CAAC,CAAc;IACjC,OAAO,CAAC,eAAe,CAAC,CAAmB;IAC3C,OAAO,CAAC,oBAAoB,CAAC,CAAsB;IACnD,OAAO,CAAC,cAAc,CAAC,CAAgB;IACvC,OAAO,CAAC,mBAAmB,CAAC,CAAqB;IAEjD,4EAA4E;IAC5E,OAAO,CAAC,iBAAiB,CAAC,CAAe;IAEzC,oEAAoE;IACpE,OAAO,CAAC,kBAAkB,CAAC,CAA6C;IACxE,OAAO,CAAC,0BAA0B,CAAC,CAAqD;IACxF,OAAO,CAAC,wBAAwB,CAAC,CAAmD;IAEpF,gCAAgC;IAChC,OAAO,CAAC,cAAc,CAAC,CAAkB;IACzC,OAAO,CAAC,2BAA2B,CAAC,CAA6B;IACjE,OAAO,CAAC,gBAAgB,CAAC,CAAkB;IAC3C,OAAO,CAAC,gBAAgB,CAAC,CAAsB;IAE/C,kEAAkE;IAClE,OAAO,CAAC,cAAc,CAAC,CAAgB;IAEvC,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;gBAEtB,GAAG,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB;cAsC/C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAqvB3C;;;;;;;OAOG;YACW,qBAAqB;IAwBnC;;;OAGG;YACW,gBAAgB;IAsH9B;;;;;;;;;;;;OAYG;YACW,mBAAmB;IAkDjC,OAAO,CAAC,kBAAkB;IAiB1B,OAAO,KAAK,qBAAqB,GA+BhC;IAED,IAAI,IAAI,IAAI,YAAY,CAEvB;IAED,IAAI,KAAK,IAAI,YAAY,CAExB;IAED,IAAI,aAAa,IAAI,YAAY,CAEhC;IAED,IAAI,SAAS,qBAEZ;IAED,IAAI,IAAI,IAAI,WAAW,CAEtB;IAED,IAAI,KAAK,IAAI,YAAY,CAExB;IAED,IAAI,MAAM,IAAI,cAAc,CAE3B;IAED,IAAI,MAAM,IAAI,cAAc,GAAG,SAAS,CAEvC;IAED,IAAI,SAAS,IAAI,gBAAgB,CAEhC;IAED,IAAI,OAAO,IAAI,cAAc,CAE5B;IAED,IAAI,MAAM,IAAI,aAAa,CAE1B;IAED,IAAI,MAAM,IAAI,aAAa,CAE1B;IAED,IAAI,IAAI,IAAI,WAAW,GAAG,SAAS,CAElC;IAED,IAAI,SAAS,IAAI,gBAAgB,GAAG,SAAS,CAE5C;IAED,IAAI,QAAQ,IAAI,eAAe,GAAG,SAAS,CAE1C;IAED,IAAI,oBAAoB,IAAI,0BAA0B,GAAG,SAAS,CAEjE;IAED,IAAI,eAAe,IAAI,eAAe,GAAG,SAAS,CAEjD;IAED;;;;;;;;;;OAUG;IACH,IAAI,YAAY,IAAI,mBAAmB,GAAG,SAAS,CAElD;IAED,IAAI,OAAO,IAAI,cAAc,GAAG,SAAS,CAExC;IAED,IAAI,aAAa,IAAI,mBAAmB,CAEvC;IAED;;;;;;;;;OASG;IACH,IAAI,gBAAgB,IAAI,gBAAgB,GAAG,SAAS,CAEnD;IAED;;;OAGG;IACH,IAAI,SAAS,IAAI,SAAS,GAAG,SAAS,CAErC;IAED;;;OAGG;IACH,IAAI,KAAK,IAAI,YAAY,GAAG,SAAS,CAEpC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,UAAU,IAAI,UAAU,GAAG,SAAS,CAEvC;IAED;;;OAGG;IACH,IAAI,gBAAgB,IAAI,YAAY,GAAG,SAAS,CAE/C;IAED;;;OAGG;IACH,IAAI,aAAa,IAAI,aAAa,GAAG,SAAS,CAE7C;IAED;;;;OAIG;IACH,IAAI,iBAAiB,IAAI,OAAO,gBAAgB,EAAE,iBAAiB,GAAG,SAAS,CAE9E;IAED;;;OAGG;IACH,IAAI,yBAAyB,IAAI,OAAO,gBAAgB,EAAE,yBAAyB,GAAG,SAAS,CAE9F;IAED;;;OAGG;IACH,IAAI,uBAAuB,IAAI,OAAO,gBAAgB,EAAE,uBAAuB,GAAG,SAAS,CAE1F;IAED;;;;OAIG;IACH,qBAAqB,IAAI,MAAM,EAAE;IA6JjC;;;OAGG;IACH,OAAO,CAAC,iCAAiC;IAkBzC;;;OAGG;IACH,IAAI,UAAU;;;;;;kBAEb;IAED,aAAa,CAAC,GAAG,KAAK,EAAE,QAAQ,EAAE;IAIlC,OAAO,CAAC,IAAI,SAAS,QAAQ,EAC3B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EACxB,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GACtB,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAIpC,gBAAgB,CAAC,IAAI,SAAS,QAAQ,EAC1C,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EACxB,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GACtB,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAQ9B;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAkB/B;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAM/B"}

package/scope/scope.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope.utils.d.ts","sourceRoot":"","sources":["../../src/scope/scope.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AAGvD,OAAO,EAGL,KAAK,OAAO,EACZ,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAE7B,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AAInB;;;;;GAKG;AAEH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,sBAAsB,GAAG,wBAAwB,GAC1D,WAAW,CAuBb;AAED,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,sBAAsB,GAAG,WAAW,CAU7G;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,GAAG,KAAK,EAAE,CAO5D"}
+{"version":3,"file":"scope.utils.d.ts","sourceRoot":"","sources":["../../src/scope/scope.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AAGvD,OAAO,EAGL,KAAK,OAAO,EACZ,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAE7B,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AAInB;;;;;GAKG;AAEH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,sBAAsB,GAAG,wBAAwB,GAC1D,WAAW,CA2Bb;AAED,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,sBAAsB,GAAG,WAAW,CAU7G;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,GAAG,KAAK,EAAE,CAO5D"}

package/server/adapters/express.host.adapter.d.ts

@@ -2,6 +2,12 @@ import express from 'express';
 import { type CorsOptions, type HttpMethod, type ServerRequestHandler } from '../../common';
 import type { SecurityOptions } from '../../common/types/options/http/interfaces';
 import { HostServerAdapter } from './base.host.adapter';
+/**
+ * Default request body size for the Express host. Lifts body-parser's silent
+ * 100KB default, which routinely rejected base64-encoded PDFs, DOCXes, and
+ * large HTML inputs before they reached MCP tool handlers (issue #410).
+ */
+export declare const DEFAULT_EXPRESS_BODY_LIMIT = "4mb";
 /**
  * Options for ExpressHostAdapter.
  */
@@ -17,6 +23,16 @@ export interface ExpressHostAdapterOptions {
      * Includes bind address and DNS rebinding protection.
      */
     security?: SecurityOptions;
+    /**
+     * Maximum body size for `express.json()`. Accepts a number of bytes or a
+     * body-parser-compatible string ('4mb', '500kb', etc.). Defaults to '4mb'.
+     */
+    bodyLimit?: number | string;
+    /**
+     * Maximum body size for `express.urlencoded()`. Falls back to `bodyLimit`
+     * when omitted.
+     */
+    urlencodedLimit?: number | string;
 }
 export declare class ExpressHostAdapter extends HostServerAdapter {
     private app;

package/server/adapters/express.host.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"express.host.adapter.d.ts","sourceRoot":"","sources":["../../../src/server/adapters/express.host.adapter.ts"],"names":[],"mappings":"AAIA,OAAO,OAAO,MAAM,SAAS,CAAC;AAI9B,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,UAAU,EAEf,KAAK,oBAAoB,EAE1B,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAElF,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;IAEnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED,qBAAa,kBAAmB,SAAQ,iBAAiB;IACvD,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,QAAQ,CAAS;gBAEb,OAAO,CAAC,EAAE,yBAAyB;IAwD/C,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB;IAI7E,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB;IAInE,eAAe,CAAC,OAAO,EAAE,oBAAoB,IACnC,KAAK,OAAO,CAAC,OAAO,EAAE,KAAK,OAAO,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,YAAY;IAQjF;;;;OAIG;IACH,OAAO,IAAI,IAAI;IAMf;;;OAGG;IACH,UAAU,IAAI,OAAO,CAAC,WAAW;IAK3B,KAAK,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;YAqCrD,kBAAkB;CASjC"}
+{"version":3,"file":"express.host.adapter.d.ts","sourceRoot":"","sources":["../../../src/server/adapters/express.host.adapter.ts"],"names":[],"mappings":"AAIA,OAAO,OAAO,MAAM,SAAS,CAAC;AAI9B,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,UAAU,EAEf,KAAK,oBAAoB,EAE1B,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAGlF,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,QAAQ,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;IAEnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;IAE3B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAE5B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACnC;AAED,qBAAa,kBAAmB,SAAQ,iBAAiB;IACvD,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,QAAQ,CAAS;gBAEb,OAAO,CAAC,EAAE,yBAAyB;IAmG/C,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB;IAI7E,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB;IAInE,eAAe,CAAC,OAAO,EAAE,oBAAoB,IACnC,KAAK,OAAO,CAAC,OAAO,EAAE,KAAK,OAAO,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,YAAY;IAQjF;;;;OAIG;IACH,OAAO,IAAI,IAAI;IAMf;;;OAGG;IACH,UAAU,IAAI,OAAO,CAAC,WAAW;IAK3B,KAAK,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;YAqCrD,kBAAkB;CASjC"}

package/server/adapters/polyfills/browser-express-host.d.ts

@@ -1,5 +1,8 @@
 export interface ExpressHostAdapterOptions {
     cors?: unknown;
+    security?: unknown;
+    bodyLimit?: number | string;
+    urlencodedLimit?: number | string;
 }
 export declare class ExpressHostAdapter {
     constructor(_options?: ExpressHostAdapterOptions);

package/server/adapters/polyfills/browser-express-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-express-host.d.ts","sourceRoot":"","sources":["../../../../src/server/adapters/polyfills/browser-express-host.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,qBAAa,kBAAkB;gBACjB,QAAQ,CAAC,EAAE,yBAAyB;CAGjD"}
+{"version":3,"file":"browser-express-host.d.ts","sourceRoot":"","sources":["../../../../src/server/adapters/polyfills/browser-express-host.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACnC;AAED,qBAAa,kBAAkB;gBACjB,QAAQ,CAAC,EAAE,yBAAyB;CAGjD"}

package/server/adapters/polyfills/node-express-host.d.ts

@@ -1,2 +1,2 @@
-export { ExpressHostAdapter, type ExpressHostAdapterOptions } from '../express.host.adapter';
+export { DEFAULT_EXPRESS_BODY_LIMIT, ExpressHostAdapter, type ExpressHostAdapterOptions, } from '../express.host.adapter';
 //# sourceMappingURL=node-express-host.d.ts.map

package/server/adapters/polyfills/node-express-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-express-host.d.ts","sourceRoot":"","sources":["../../../../src/server/adapters/polyfills/node-express-host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,KAAK,yBAAyB,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"node-express-host.d.ts","sourceRoot":"","sources":["../../../../src/server/adapters/polyfills/node-express-host.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,yBAAyB,CAAC"}

package/server/custom-routes.helper.d.ts

@@ -0,0 +1,81 @@
+import { type FrontMcpLogger, type FrontMcpServer, type HttpRouteConfig, type ServerRequest, type ServerRequestHandler } from '../common';
+/** Shape of the `session:verify` flow output we care about here. */
+export type VerifyResult = {
+    kind: 'authorized';
+    authorization: unknown;
+} | {
+    kind: 'unauthorized';
+    prmMetadataHeader: string;
+} | {
+    kind: 'forbidden';
+    prmMetadataHeader: string;
+};
+/**
+ * Dispatch the MCP `session:verify` flow for a request. The scope passes a thin
+ * closure over its generic `runFlow` so this helper stays decoupled from the
+ * scope's flow-name typing.
+ */
+export type VerifySessionFn = (request: ServerRequest) => Promise<VerifyResult | undefined>;
+export interface RegisterCustomHttpRoutesArgs {
+    /** Custom routes from `http.routes`. */
+    routes: HttpRouteConfig[] | undefined;
+    /** Active host server to register routes on. */
+    server: FrontMcpServer;
+    /** Runs `session:verify` for `auth: true` routes. */
+    verifySession: VerifySessionFn;
+    /** Resolved gateway entry path (e.g. `''` or `'/mcp'`). */
+    entryPath: string;
+    /** Per-app / per-scope route base (e.g. `''` or `'/billing'`). */
+    routeBase: string;
+    logger: FrontMcpLogger;
+}
+/**
+ * Error thrown when a custom `http.routes` path collides with a FrontMCP
+ * reserved surface. Fail-fast at startup rather than silently shadowing (or
+ * being shadowed by) the MCP endpoint / discovery / health surfaces.
+ */
+export declare class ReservedRouteCollisionError extends Error {
+    readonly method: string;
+    readonly path: string;
+    readonly reserved: string;
+    constructor(method: string, path: string, reserved: string);
+}
+/**
+ * Build the exact-match + prefix reserved-path set for the resolved MCP base.
+ *
+ * - Exact matches: the MCP base itself, `<base>/sse`, `<base>/message`,
+ *   `/health`, `/metrics`.
+ * - Prefix matches: `/oauth`, `/.well-known` (any sub-path is reserved).
+ */
+export declare function computeReservedPaths(entryPath: string, routeBase: string): {
+    exact: Set<string>;
+    prefixes: string[];
+};
+/**
+ * Throw {@link ReservedRouteCollisionError} when `path` collides with a
+ * reserved FrontMCP surface. Express path params (`:id`) and wildcards in the
+ * *custom* path are compared literally — only the static prefix matters for the
+ * reserved-surface check, so a route like `/files/:id` never collides unless it
+ * is literally under `/oauth`, `/.well-known`, etc.
+ */
+export declare function assertNotReserved(method: string, path: string, reserved: {
+    exact: Set<string>;
+    prefixes: string[];
+}): void;
+/**
+ * Wrap a user route handler in the MCP `session:verify` auth flow. On
+ * unauthorized/forbidden the request is short-circuited with a 401/403 carrying
+ * the `WWW-Authenticate` header (mirroring `http.request.flow.ts`); on success
+ * the verified authorization is attached to `req.authSession` (and the internal
+ * auth token) before the user handler runs.
+ */
+export declare function wrapWithAuth(handler: ServerRequestHandler, verifySession: VerifySessionFn, logger: FrontMcpLogger): ServerRequestHandler;
+/**
+ * Register all configured custom HTTP routes on the active server.
+ *
+ * No-op when `routes` is empty/undefined. Throws {@link ReservedRouteCollisionError}
+ * (fail-fast) on the first path that collides with a reserved surface — so a
+ * misconfiguration aborts boot instead of silently mis-mounting.
+ */
+export declare function registerCustomHttpRoutes(args: RegisterCustomHttpRoutesArgs): void;
+//# sourceMappingURL=custom-routes.helper.d.ts.map