@frontmcp/sdk 1.7.0 → 1.7.2

package/agent/flows/call-agent.flow.d.ts

@@ -123,14 +123,10 @@ declare const stateSchema: import("@frontmcp/lazy-zod").ZodObject<{
         arguments: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>>;
     }, import("zod/v4/core").$loose>;
     authInfo: z.ZodType<AuthInfo>;
-    agent: import("zod").ZodCustom<AgentEntry<Readonly<{
-        [k: string]: import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;
-    }>, import("../../common").ToolOutputType, unknown, unknown>, AgentEntry<Readonly<{
+    agent: import("zod").ZodInstanceOf<AgentEntry<Readonly<{
         [k: string]: import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;
     }>, import("../../common").ToolOutputType, unknown, unknown>>;
-    agentContext: import("zod").ZodCustom<AgentContext<Readonly<{
-        [k: string]: import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;
-    }>, import("../../common").ToolOutputType, unknown, unknown>, AgentContext<Readonly<{
+    agentContext: import("zod").ZodInstanceOf<AgentContext<Readonly<{
         [k: string]: import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>;
     }>, import("../../common").ToolOutputType, unknown, unknown>>;
     rawOutput: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodAny>;

package/agent/flows/call-agent.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"call-agent.flow.d.ts","sourceRoot":"","sources":["../../../src/agent/flows/call-agent.flow.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AACvC,OAAO,EAA+C,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEhG,OAAO,EACL,YAAY,EACZ,UAAU,EAEV,QAAQ,EAGR,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAetB,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;gCAIf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAAuB,CAAC;AAE1C,QAAA,MAAM,WAAW;;;;;cAKiB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA4BnD,CAAC;AAMH,QAAA,MAAM,IAAI;;;;CAY2B,CAAC;AAMtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,mBAAmB,EAAE,cAAc,CACjC,aAAa,EACb,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,mBAA4B,CAAC;AAc1C,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAC9D,MAAM,wCAA2C;IAEjD;;OAEG;IAEG,UAAU;IAmDhB;;OAEG;IAEG,SAAS;IA0Cf;;;;OAIG;IAEG,qBAAqB;IAsD3B;;OAEG;IAEG,uBAAuB;IAuC7B;;OAEG;IAEG,kBAAkB;IAqDxB;;OAEG;IAEG,YAAY;IAoClB;;OAEG;IAEG,gBAAgB;IAqCtB;;OAEG;IAEG,aAAa;IAsBnB;;OAEG;IAEG,OAAO;IA6Cb;;OAEG;IAEG,cAAc;IAcpB;;OAEG;IAEG,gBAAgB;IAetB;;OAEG;IAEG,YAAY;IAOlB;;;;;;;;;OASG;IAEG,QAAQ;CAsEf"}
+{"version":3,"file":"call-agent.flow.d.ts","sourceRoot":"","sources":["../../../src/agent/flows/call-agent.flow.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AACvC,OAAO,EAA+C,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEhG,OAAO,EACL,YAAY,EACZ,UAAU,EAEV,QAAQ,EAGR,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAetB,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;gCAIf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAAuB,CAAC;AAE1C,QAAA,MAAM,WAAW;;;;;cAKiB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA4BnD,CAAC;AAMH,QAAA,MAAM,IAAI;;;;CAY2B,CAAC;AAMtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,mBAAmB,EAAE,cAAc,CACjC,aAAa,EACb,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,mBAA4B,CAAC;AAc1C,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAC9D,MAAM,wCAA2C;IAEjD;;OAEG;IAEG,UAAU;IAmDhB;;OAEG;IAEG,SAAS;IA0Cf;;;;OAIG;IAEG,qBAAqB;IAsD3B;;OAEG;IAEG,uBAAuB;IAuC7B;;OAEG;IAEG,kBAAkB;IAqDxB;;OAEG;IAEG,YAAY;IAoClB;;OAEG;IAEG,gBAAgB;IAqCtB;;OAEG;IAEG,aAAa;IAsBnB;;OAEG;IAEG,OAAO;IA6Cb;;OAEG;IAEG,cAAc;IAcpB;;OAEG;IAEG,gBAAgB;IAetB;;OAEG;IAEG,YAAY;IAOlB;;;;;;;;;OASG;IAEG,QAAQ;CAsEf"}

package/auth/flows/oauth.authorize.flow.d.ts

@@ -1,3 +1,22 @@
+/**
+ * Authorization Endpoint — GET /oauth/authorize
+ *
+ * Who calls: Browser via the Client (RP).
+ *
+ * When: Start of the flow.
+ *
+ * Purpose: Authenticate the user and obtain consent; returns an authorization code to the client's redirect URI.
+ *
+ * Notes: Must support PKCE. Implicit/Hybrid are out in OAuth 2.1.
+ */
+/**
+ * Typical parameter shapes
+ *
+ * /oauth/authorize (GET)
+ *
+ * response_type=code, client_id, redirect_uri, scope, state, code_challenge, code_challenge_method=S256, (optionally request_uri from PAR)
+ */
+import { type IncrementalAuthTicketPayload } from '@frontmcp/auth';
 import { z } from '@frontmcp/lazy-zod';
 import { FlowBase, type FlowRunOptions } from '../../common';
 /**
@@ -49,6 +68,7 @@ declare const stateSchema: import("@frontmcp/lazy-zod").ZodObject<{
     targetAppId: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
     targetToolId: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
     existingSessionId: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    incrementalTicket: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodCustom<IncrementalAuthTicketPayload, IncrementalAuthTicketPayload>>;
     priorAuthorizedAppIds: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
     requiresFederatedLogin: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
     requiresConsent: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
@@ -166,6 +186,16 @@ export default class OauthAuthorizeFlow extends FlowBase<typeof name> {
     private logger;
     parseInput(): Promise<void>;
     validateInput(): Promise<void>;
+    /**
+     * Verify a client-supplied incremental-authorization ticket.
+     *
+     * Returns the verified payload, or `undefined` when the parameter is absent,
+     * malformed, expired, or not signed by this server. Verification is
+     * side-effect free — the ticket is CLAIMED (single use) later, in
+     * {@link prepareAuthorizationRequest}, so a request that fails OAuth
+     * validation does not burn the user's ticket.
+     */
+    private verifyIncrementalTicket;
     checkIfAuthorized(): Promise<void>;
     prepareAuthorizationRequest(): Promise<void>;
     buildAuthorizeOutput(): Promise<void>;

package/auth/flows/oauth.authorize.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.authorize.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.authorize.flow.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,CAAC,EAAiB,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EAGL,QAAQ,EAWR,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAwEtB;;GAEG;AACH,QAAA,MAAM,2BAA2B;;;;;;;;;gCAS/B,CAAC;AAEH;;GAEG;AACH,QAAA,MAAM,+BAA+B;;;gCAGnC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAMxF,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAgCf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAIhB,CAAC;AAEH,QAAA,MAAM,IAAI;;;;CAQ2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,iBAAiB,EAAE,cAAc,CAC/B,kBAAkB,EAClB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,iBAA0B,CAAC;AAkCxC,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IACnE;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,MAAM,CAAiD;IAGzD,UAAU;IAmFV,aAAa;IA4Kb,iBAAiB;IAOjB,2BAA2B;IAoH3B,oBAAoB;IAiL1B;;;;;;;;;OASG;YACW,mBAAmB;IA4CjC;;;;;;;;;;;;;;;OAeG;YACW,qBAAqB;IAsE7B,cAAc;IAIpB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAkBzB;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAuBxB;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IA+BvB;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAyBjC;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA2BhC;;OAEG;IACH,OAAO,CAAC,eAAe;CAyCxB"}
+{"version":3,"file":"oauth.authorize.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.authorize.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH;;;;;;GAMG;AACH,OAAO,EAaL,KAAK,4BAA4B,EAIlC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,CAAC,EAAiB,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EAGL,QAAQ,EAWR,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAwEtB;;GAEG;AACH,QAAA,MAAM,2BAA2B;;;;;;;;;gCAS/B,CAAC;AAEH;;GAEG;AACH,QAAA,MAAM,+BAA+B;;;gCAGnC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAMxF,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAuCf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAIhB,CAAC;AAEH,QAAA,MAAM,IAAI;;;;CAQ2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,iBAAiB,EAAE,cAAc,CAC/B,kBAAkB,EAClB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,iBAA0B,CAAC;AAkCxC,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IACnE;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,MAAM,CAAiD;IAGzD,UAAU;IAwGV,aAAa;IA2KnB;;;;;;;;OAQG;IACH,OAAO,CAAC,uBAAuB;IAiBzB,iBAAiB;IASjB,2BAA2B;IA0I3B,oBAAoB;IAiL1B;;;;;;;;;OASG;YACW,mBAAmB;IA4CjC;;;;;;;;;;;;;;;OAeG;YACW,qBAAqB;IAsE7B,cAAc;IAIpB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAkBzB;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAuBxB;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IA+BvB;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAyBjC;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA2BhC;;OAEG;IACH,OAAO,CAAC,eAAe;CAyCxB"}

package/auth/flows/oauth.callback.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.callback.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.callback.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgBH,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAGvC,OAAO,EAEL,QAAQ,EAQR,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAKtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA2Df,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAAgD,CAAC;AAEnE,QAAA,MAAM,IAAI;;;CAG2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,gBAAgB,EAAE,cAAc,CAC9B,iBAAiB,EACjB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,gBAAyB,CAAC;AAcvC,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAClE,OAAO,CAAC,MAAM,CAAgD;IAE9D;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAMf,UAAU;IA6EV,mBAAmB;IAqYzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IAEG,qBAAqB;IA2D3B;;;;;;OAMG;IAEG,mBAAmB;IAiInB,uBAAuB;IA2GvB,gBAAgB;IA8CtB;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAoB1C;IAEH;;;;;OAKG;IACH;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAYrB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,uBAAuB;IA4B/B,OAAO,CAAC,kBAAkB;IAsB1B;;;;OAIG;YACW,eAAe;IAgC7B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAQpB;;;;OAIG;YACW,iBAAiB;IAoB/B;;;;;;;OAOG;IACH,OAAO,CAAC,yBAAyB;IAYjC;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAmB5B;;;;;;;;OAQG;YACW,sBAAsB;IA0EpC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IA8D3B;;;OAGG;IACH,OAAO,CAAC,eAAe;IAQvB;;OAEG;IACH,OAAO,CAAC,eAAe;CAqDxB"}
+{"version":3,"file":"oauth.callback.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/oauth.callback.flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgBH,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAGvC,OAAO,EAEL,QAAQ,EAQR,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAKtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA2Df,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAAgD,CAAC;AAEnE,QAAA,MAAM,IAAI;;;CAG2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,gBAAgB,EAAE,cAAc,CAC9B,iBAAiB,EACjB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,gBAAyB,CAAC;AAcvC,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAClE,OAAO,CAAC,MAAM,CAAgD;IAE9D;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAMf,UAAU;IA4EV,mBAAmB;IAsZzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IAEG,qBAAqB;IA2D3B;;;;;;OAMG;IAEG,mBAAmB;IAiInB,uBAAuB;IA2GvB,gBAAgB;IA8CtB;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAqB1C;IAEH;;;;;OAKG;IACH;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAYrB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,uBAAuB;IA4B/B,OAAO,CAAC,kBAAkB;IAsB1B;;;;OAIG;YACW,eAAe;IAgC7B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAQpB;;;;OAIG;YACW,iBAAiB;IAoB/B;;;;;;;OAOG;IACH,OAAO,CAAC,yBAAyB;IAYjC;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAmB5B;;;;;;;;OAQG;YACW,sBAAsB;IA0EpC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IA8D3B;;;OAGG;IACH,OAAO,CAAC,eAAe;IAQvB;;OAEG;IACH,OAAO,CAAC,eAAe;CAqDxB"}

package/auth/instances/instance.local-primary-auth.d.ts

@@ -157,6 +157,17 @@ export declare class LocalPrimaryAuth extends FrontMcpAuth<LocalPrimaryAuthOptio
     private readonly dcrClientRegistryImpl;
     /** Storage adapter backing the persistent stores (kept for disposal). */
     private storageAdapter?;
+    /**
+     * Replay guard for incremental-authorization tickets (GHSA-2c4g-9c8x-6m8g).
+     * Shares the persistent adapter when one is configured so the guard holds
+     * across a distributed deployment; falls back to a dedicated in-memory
+     * adapter, matching how the credential vault selects its backing store.
+     *
+     * Holds the in-flight PROMISE, not the resolved adapter: two concurrent
+     * claims for the same ticket must not each build their own store, or each
+     * would write and read back its own nonce and both would win.
+     */
+    private ticketReplayStorage?;
     /**
      * Per-session encrypted credential vault (Checkpoint 3b). Backs
      * `this.credentials` in tools and persists `authenticate()` credentials.
@@ -261,6 +272,30 @@ export declare class LocalPrimaryAuth extends FrontMcpAuth<LocalPrimaryAuthOptio
      * (`this.secret`), so resume URLs are framework-signed with the same trust
      * root as the access tokens.
      */
+    /**
+     * The server HMAC signing key, as the string form the `signData`/`verifyData`
+     * helpers take. These are the exact bytes the access tokens are signed with,
+     * so framework-signed URLs share the access tokens' trust root.
+     */
+    get signingSecret(): string;
+    /**
+     * Claim an incremental-authorization ticket, exactly once.
+     *
+     * A signature check proves a ticket was minted by this server for a verified
+     * subject; it cannot prove the ticket has not already been used. The `auth_url`
+     * carrying the ticket travels through agent transcripts and server logs, so a
+     * leaked ticket must not stay usable for the rest of its TTL.
+     *
+     * The claim is race-free without a transaction: each attempt writes its OWN
+     * nonce under `ifNotExists` and reads the key back. Only the attempt whose
+     * nonce survives won, so concurrent replays all lose.
+     *
+     * @returns true when this caller claimed the ticket, false when it was already used.
+     */
+    claimIncrementalTicket(jti: string, ttlMs: number): Promise<boolean>;
+    private getTicketReplayStorage;
+    /** Replace the replay guard with a fresh in-memory adapter, memoized. */
+    private useInMemoryTicketReplayStorage;
     private initializeCredentialVault;
     /**
      * Read the `secureStore` selection off the auth options. Only

package/auth/instances/instance.local-primary-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instance.local-primary-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/instances/instance.local-primary-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,iBAAiB,EASjB,sBAAsB,EAMtB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EAGvB,KAAK,sBAAsB,IAAI,UAAU,EACzC,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAYxB,OAAO,EACL,YAAY,EAEZ,KAAK,cAAc,EACnB,KAAK,GAAG,EACR,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAML,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAC;AAmBrE;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAc/F;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAwBD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,kBAAkB;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAYD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAW9C;AAED,qBAAa,gBAAiB,SAAQ,YAAY,CAAC,uBAAuB,CAAC;IAuJvE,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,SAAS;IAvJnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAM;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,WAAW,CAA0B;IAE7C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAE9D,gEAAgE;IAChE,OAAO,CAAC,sBAAsB,CAAqB;IAEnD,6DAA6D;IAC7D,OAAO,CAAC,yBAAyB,CAA4B;IAE7D,gDAAgD;IAChD,OAAO,CAAC,0BAA0B,CAAa;IAE/C,4EAA4E;IAC5E,OAAO,CAAC,gBAAgB,CAAe;IAEvC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAoB;IAE1D,yEAAyE;IACzE,OAAO,CAAC,cAAc,CAAC,CAAiB;IAExC;;;;OAIG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAAyB;IAErD,0EAA0E;IAC1E,IAAI,eAAe,IAAI,sBAAsB,GAAG,SAAS,CAExD;IAED;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAAC,CAAqB;IAEpD,uDAAuD;IACvD,IAAI,kBAAkB,IAAI,kBAAkB,GAAG,SAAS,CAEvD;IAED,gEAAgE;IAChE,IAAI,kBAAkB,IAAI,kBAAkB,CAE3C;IAED,6DAA6D;IAC7D,IAAI,qBAAqB,IAAI,yBAAyB,CAErD;IAED,gDAAgD;IAChD,IAAI,sBAAsB,IAAI,UAAU,CAEvC;IAED;;;;OAIG;IACH,IAAI,YAAY,IAAI,YAAY,CAE/B;IAED;;;;OAIG;IACH,IAAI,iBAAiB,IAAI,iBAAiB,CAEzC;IAED;;;OAGG;IACH,YAAY,IAAI,iBAAiB,GAAG,SAAS;IAO7C;;;;OAIG;IACH,YAAY,IAAI,OAAO;IAQvB,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6C;IAE7E;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB,CAAC,CAAS;IAEtC,iFAAiF;IACjF,IAAI,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAQ;IAC9C,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;gBAG/C,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,gBAAgB,EACnC,OAAO,EAAE,uBAAuB;IAoDlC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,YAAY;IAmBpB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;OAQG;YACW,gBAAgB;IA8B9B;;;;;;;;;;OAUG;YACW,yBAAyB;IAgDvC;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAO7B;;;;;;;;;;;;;;;;OAgBG;YACW,qBAAqB;IA0CnC;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IAO/B,gBAAgB;IAUtB;;;;;;;;;;;;;OAaG;IACY,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAkB/F;;OAEG;IACG,eAAe,CACnB,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,MAAM,CAAC;IAgElB;;OAEG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAyJxE;;OAEG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAiFxE;;OAEG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAElB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAE7B,aAAa,CAAC,EAAE,MAAM,CAAC;QAGvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAE5B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACxC,GAAG,OAAO,CAAC,MAAM,CAAC;cA+BH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsDlC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAItE,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;YAI1C,iBAAiB;IAuB/B;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI;IAyBtD;;;;;;OAMG;YACW,0BAA0B;IA4BxC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,2BAA2B;IAyCnC;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAQ9B;;OAEG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS;IAIzE;;OAEG;IACG,yBAAyB,CAC7B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GACA,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwBzB;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA4EhF;;OAEG;IACG,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IA+E9G;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;CA8CjF"}
+{"version":3,"file":"instance.local-primary-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/instances/instance.local-primary-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,iBAAiB,EASjB,sBAAsB,EAMtB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EAGvB,KAAK,sBAAsB,IAAI,UAAU,EACzC,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAaxB,OAAO,EACL,YAAY,EAEZ,KAAK,cAAc,EACnB,KAAK,GAAG,EACR,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAML,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAC;AAmBrE;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAc/F;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAwBD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,kBAAkB;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAYD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAW9C;AAWD,qBAAa,gBAAiB,SAAQ,YAAY,CAAC,uBAAuB,CAAC;IAmKvE,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,SAAS;IAnKnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAM;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,WAAW,CAA0B;IAE7C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAE9D,gEAAgE;IAChE,OAAO,CAAC,sBAAsB,CAAqB;IAEnD,6DAA6D;IAC7D,OAAO,CAAC,yBAAyB,CAA4B;IAE7D,gDAAgD;IAChD,OAAO,CAAC,0BAA0B,CAAa;IAE/C,4EAA4E;IAC5E,OAAO,CAAC,gBAAgB,CAAe;IAEvC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAoB;IAE1D,yEAAyE;IACzE,OAAO,CAAC,cAAc,CAAC,CAAiB;IAExC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAA0B;IAEtD;;;;OAIG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAAyB;IAErD,0EAA0E;IAC1E,IAAI,eAAe,IAAI,sBAAsB,GAAG,SAAS,CAExD;IAED;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAAC,CAAqB;IAEpD,uDAAuD;IACvD,IAAI,kBAAkB,IAAI,kBAAkB,GAAG,SAAS,CAEvD;IAED,gEAAgE;IAChE,IAAI,kBAAkB,IAAI,kBAAkB,CAE3C;IAED,6DAA6D;IAC7D,IAAI,qBAAqB,IAAI,yBAAyB,CAErD;IAED,gDAAgD;IAChD,IAAI,sBAAsB,IAAI,UAAU,CAEvC;IAED;;;;OAIG;IACH,IAAI,YAAY,IAAI,YAAY,CAE/B;IAED;;;;OAIG;IACH,IAAI,iBAAiB,IAAI,iBAAiB,CAEzC;IAED;;;OAGG;IACH,YAAY,IAAI,iBAAiB,GAAG,SAAS;IAO7C;;;;OAIG;IACH,YAAY,IAAI,OAAO;IAQvB,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6C;IAE7E;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB,CAAC,CAAS;IAEtC,iFAAiF;IACjF,IAAI,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAQ;IAC9C,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;gBAG/C,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,gBAAgB,EACnC,OAAO,EAAE,uBAAuB;IAoDlC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,YAAY;IAmBpB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;OAQG;YACW,gBAAgB;IA8B9B;;;;;;;;;;OAUG;IACH;;;;OAIG;IACH,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;;;;;;;;;;OAaG;IACG,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAuC1E,OAAO,CAAC,sBAAsB;IAkB9B,yEAAyE;IACzE,OAAO,CAAC,8BAA8B;YAUxB,yBAAyB;IAgDvC;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAO7B;;;;;;;;;;;;;;;;OAgBG;YACW,qBAAqB;IA0CnC;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IAO/B,gBAAgB;IAUtB;;;;;;;;;;;;;OAaG;IACY,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAkB/F;;OAEG;IACG,eAAe,CACnB,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,MAAM,CAAC;IAgElB;;OAEG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAyJxE;;OAEG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAiFxE;;OAEG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAElB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAE7B,aAAa,CAAC,EAAE,MAAM,CAAC;QAGvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAE5B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACxC,GAAG,OAAO,CAAC,MAAM,CAAC;cA+BH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsDlC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAItE,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;YAI1C,iBAAiB;IAuB/B;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI;IAyBtD;;;;;;OAMG;YACW,0BAA0B;IA4BxC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,2BAA2B;IAyCnC;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAQ9B;;OAEG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS;IAIzE;;OAEG;IACG,yBAAyB,CAC7B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GACA,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwBzB;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA4EhF;;OAEG;IACG,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IA+E9G;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;CA8CjF"}

package/builtin/config/providers/config-loader.d.ts

@@ -30,6 +30,11 @@ export declare function loadConfig<T extends object>(schema: z.ZodType<T>, optio
 /**
  * Deep merge two objects, with source values taking precedence.
  * Arrays are replaced, not merged.
+ *
+ * Prototype keys are skipped, matching the guard in `env-loader.ts`. The sources
+ * here are a trusted on-disk config file and already-sanitized env vars, so this
+ * is not a live vector — but a merge that walks arbitrary keys should not be the
+ * one place in the repo that omits the check.
  */
 declare function deepMerge(target: Record<string, unknown>, source: Record<string, unknown>): Record<string, unknown>;
 export { deepMerge };

package/builtin/config/providers/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../../../src/builtin/config/providers/config-loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAM5C;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sDAAsD;IACtD,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,CAAC,SAAS,MAAM,EAC/C,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,CAAC,CAAC,CAmDZ;AA2BD;;;GAGG;AACH,iBAAS,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyB5G;AAED,OAAO,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../../../src/builtin/config/providers/config-loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAM5C;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sDAAsD;IACtD,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,CAAC,SAAS,MAAM,EAC/C,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,CAAC,CAAC,CAmDZ;AA6DD;;;;;;;;GAQG;AACH,iBAAS,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2B5G;AAED,OAAO,EAAE,SAAS,EAAE,CAAC"}

package/common/metadata/agent.metadata.d.ts

@@ -413,7 +413,7 @@ export declare const frontMcpAgentMetadataSchema: import("@frontmcp/lazy-zod").Z
     name: import("@frontmcp/lazy-zod").ZodString;
     description: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
     systemInstructions: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
-    inputSchema: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodCustom<Object, Object>>;
+    inputSchema: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodInstanceOf<Object>>;
     outputSchema: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodAny>;
     llm: import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodObject<{
         provider: import("@frontmcp/lazy-zod").ZodEnum<{
@@ -440,7 +440,7 @@ export declare const frontMcpAgentMetadataSchema: import("@frontmcp/lazy-zod").Z
         temperature: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
         maxTokens: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
     }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
-        adapter: import("@frontmcp/lazy-zod").ZodUnion<readonly [import("zod").ZodCustom<Object, Object>, import("zod").ZodFunction<import("zod/v4/core").$ZodFunctionArgs, import("zod/v4/core").$ZodFunctionOut>]>;
+        adapter: import("@frontmcp/lazy-zod").ZodUnion<readonly [import("zod").ZodInstanceOf<Object>, import("zod").ZodFunction<import("zod/v4/core").$ZodFunctionArgs, import("zod/v4/core").$ZodFunctionOut>]>;
     }, import("zod/v4/core").$strip>, import("zod").ZodCustom<symbol, symbol>, import("zod").ZodCustom<AgentLlmAdapterLocal, AgentLlmAdapterLocal>]>;
     providers: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("zod").ZodCustom<Type<unknown>, Type<unknown>>>>;
     plugins: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("zod").ZodCustom<Type<unknown>, Type<unknown>>>>;

package/common/metadata/app.metadata.d.ts

@@ -147,7 +147,7 @@ export declare const frontMcpLocalAppMetadataSchema: import("@frontmcp/lazy-zod"
         jwks: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             keys: import("@frontmcp/lazy-zod").ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown>>;
         }, import("zod/v4/core").$strip>>;
-        signKey: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown>, import("zod").ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
+        signKey: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown>, import("zod").ZodInstanceOf<Uint8Array<ArrayBuffer>>]>>;
     }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
         expectedAudience: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>]>>;
         requireAudience: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
@@ -252,7 +252,7 @@ export declare const frontMcpLocalAppMetadataSchema: import("@frontmcp/lazy-zod"
             maxDynamicClients: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
         }, import("zod/v4/core").$strip>>;
         local: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
-            signKey: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown>, import("zod").ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
+            signKey: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown>, import("zod").ZodInstanceOf<Uint8Array<ArrayBuffer>>]>>;
             jwks: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
                 keys: import("@frontmcp/lazy-zod").ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown>>;
             }, import("zod/v4/core").$strip>>;
@@ -427,7 +427,7 @@ export declare const frontMcpLocalAppMetadataSchema: import("@frontmcp/lazy-zod"
         mode: import("@frontmcp/lazy-zod").ZodLiteral<"local">;
     }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
         local: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
-            signKey: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown>, import("zod").ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
+            signKey: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown>, import("zod").ZodInstanceOf<Uint8Array<ArrayBuffer>>]>>;
             jwks: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
                 keys: import("@frontmcp/lazy-zod").ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown>>;
             }, import("zod/v4/core").$strip>>;
@@ -889,7 +889,7 @@ export declare const frontMcpRemoteAppMetadataSchema: import("@frontmcp/lazy-zod
         jwks: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             keys: import("@frontmcp/lazy-zod").ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown>>;
         }, import("zod/v4/core").$strip>>;
-        signKey: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown>, import("zod").ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
+        signKey: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown>, import("zod").ZodInstanceOf<Uint8Array<ArrayBuffer>>]>>;
     }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
         expectedAudience: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>]>>;
         requireAudience: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
@@ -994,7 +994,7 @@ export declare const frontMcpRemoteAppMetadataSchema: import("@frontmcp/lazy-zod
             maxDynamicClients: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
         }, import("zod/v4/core").$strip>>;
         local: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
-            signKey: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown>, import("zod").ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
+            signKey: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown>, import("zod").ZodInstanceOf<Uint8Array<ArrayBuffer>>]>>;
             jwks: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
                 keys: import("@frontmcp/lazy-zod").ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown>>;
             }, import("zod/v4/core").$strip>>;
@@ -1169,7 +1169,7 @@ export declare const frontMcpRemoteAppMetadataSchema: import("@frontmcp/lazy-zod
         mode: import("@frontmcp/lazy-zod").ZodLiteral<"local">;
     }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
         local: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
-            signKey: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown>, import("zod").ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
+            signKey: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown>, import("zod").ZodInstanceOf<Uint8Array<ArrayBuffer>>]>>;
             jwks: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
                 keys: import("@frontmcp/lazy-zod").ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown>>;
             }, import("zod/v4/core").$strip>>;

package/common/metadata/flow.metadata.d.ts

@@ -54,11 +54,11 @@ export declare const frontMcpFlowMetadataSchema: import("@frontmcp/lazy-zod").Zo
         authorized: "authorized";
         public: "public";
     }>>>;
-    inputSchema: import("zod").ZodCustom<Object, Object>;
-    outputSchema: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodCustom<Object, Object>>;
-    plan: import("zod").ZodCustom<Object, Object>;
+    inputSchema: import("zod").ZodInstanceOf<Object>;
+    outputSchema: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodInstanceOf<Object>>;
+    plan: import("zod").ZodInstanceOf<Object>;
     dependsOn: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodUnknown>>;
-    middleware: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodCustom<Object, Object>>;
+    middleware: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodInstanceOf<Object>>;
 }, import("zod/v4/core").$loose>;
 export {};
 //# sourceMappingURL=flow.metadata.d.ts.map