@frontmcp/sdk 1.7.0 → 1.7.2

package/job/execution/job-execution.manager.d.ts

@@ -8,6 +8,13 @@ export interface ExecuteJobOptions {
     sessionId?: string;
     authInfo?: Partial<Record<string, unknown>>;
     contextProviders?: unknown;
+    /**
+     * The scope's authorities context builder, when one is configured. Passed
+     * through so the permission guard resolves roles/claims using the server's
+     * own `claimsMapping` rather than a second, divergent notion of where roles
+     * live.
+     */
+    authoritiesContextBuilder?: import('@frontmcp/auth').AuthoritiesContextBuilder;
 }
 export interface ExecuteWorkflowOptions extends ExecuteJobOptions {
     workflowInput?: Record<string, unknown>;
@@ -39,6 +46,14 @@ export declare class JobExecutionManager {
      * Execute a workflow inline or in background.
      */
     executeWorkflow(workflow: WorkflowEntry, jobRegistry: JobRegistryInterface, opts?: ExecuteWorkflowOptions): Promise<InlineJobResult | BackgroundJobResult>;
+    /**
+     * Throw unless the caller may execute the entry.
+     *
+     * Uses the same error for "not authorized" as the tools use for "not found",
+     * so a caller cannot enumerate which restricted jobs exist by comparing
+     * responses.
+     */
+    private assertMayExecute;
     /**
      * Get execution status.
      */

package/job/execution/job-execution.manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-execution.manager.d.ts","sourceRoot":"","sources":["../../../src/job/execution/job-execution.manager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACvB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,iBAAiB,CAAC;IACzB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;CAClB;AAED;;;GAGG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAmD;gBAG3E,UAAU,EAAE,aAAa,EACzB,MAAM,EAAE,cAAc,EACtB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC;IAO7D;;OAEG;IACG,UAAU,CACd,GAAG,EAAE,QAAQ,EACb,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,eAAe,GAAG,mBAAmB,CAAC;IA0CjD;;OAEG;IACG,eAAe,CACnB,QAAQ,EAAE,aAAa,EACvB,WAAW,EAAE,oBAAoB,EACjC,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,eAAe,GAAG,mBAAmB,CAAC;IAwCjD;;OAEG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,iBAAiB,GAAG,IAAI,CAAC;IAIhF;;OAEG;IACG,QAAQ,CAAC,IAAI,CAAC,EAAE;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,iBAAiB,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,CAAC,YAAY,GAAG,iBAAiB,CAAC,EAAE,CAAC;YAMnC,gBAAgB;YA+DhB,oBAAoB;YAapB,qBAAqB;YA2CrB,yBAAyB;YAezB,WAAW;YAIX,MAAM;CASrB"}
+{"version":3,"file":"job-execution.manager.d.ts","sourceRoot":"","sources":["../../../src/job/execution/job-execution.manager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAM/E,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACvB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,OAAO,gBAAgB,EAAE,yBAAyB,CAAC;CAChF;AAED,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,iBAAiB,CAAC;IACzB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;CAClB;AAED;;;GAGG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAmD;gBAG3E,UAAU,EAAE,aAAa,EACzB,MAAM,EAAE,cAAc,EACtB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC;IAO7D;;OAEG;IACG,UAAU,CACd,GAAG,EAAE,QAAQ,EACb,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,eAAe,GAAG,mBAAmB,CAAC;IAkDjD;;OAEG;IACG,eAAe,CACnB,QAAQ,EAAE,aAAa,EACvB,WAAW,EAAE,oBAAoB,EACjC,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,eAAe,GAAG,mBAAmB,CAAC;IA2CjD;;;;;;OAMG;YACW,gBAAgB;IAiB9B;;OAEG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,iBAAiB,GAAG,IAAI,CAAC;IAIhF;;OAEG;IACG,QAAQ,CAAC,IAAI,CAAC,EAAE;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,iBAAiB,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,CAAC,YAAY,GAAG,iBAAiB,CAAC,EAAE,CAAC;YAMnC,gBAAgB;YA+DhB,oBAAoB;YAapB,qBAAqB;YA2CrB,yBAAyB;YAezB,WAAW;YAIX,MAAM;CASrB"}

package/job/job-permission.guard.d.ts

@@ -1,14 +1,33 @@
+import type { AuthoritiesContextBuilder } from '@frontmcp/auth';
 import { type JobPermission, type JobPermissionAction } from '../common/metadata/job.metadata';
 /**
  * Permission guard for jobs and workflows.
- * Checks JobPermission[] against authInfo for each action.
+ *
+ * Evaluates the `permissions` declared by `@Job` / `@Workflow` against the
+ * caller. The contract is deliberately permissive at the edges and strict in the
+ * middle:
+ *
+ *  - no `permissions` at all, or none matching the action → ALLOW. This is the
+ *    documented behaviour ("when no permissions are defined, the job is
+ *    accessible to all authenticated users") and changing it would break every
+ *    existing server.
+ *  - one or more rules match the action → ALL of them must pass, and within a
+ *    rule the roles/scopes lists are ANY-of.
+ *
+ * Claims are resolved through {@link resolvePrincipal}, so a server that
+ * configured `authorities.claimsMapping` gets its own mapping honoured here
+ * rather than a second, divergent notion of where roles live.
  */
 export declare class JobPermissionGuard {
     /**
-     * Check if the given auth info is allowed to perform the action.
-     * Returns true if no permissions are defined (permissive by default).
+     * Check whether the caller may perform `action`.
+     *
+     * @param permissions - the entry's declared rules (undefined = unrestricted).
+     * @param action - the action being attempted.
+     * @param authInfo - the request's AuthInfo.
+     * @param contextBuilder - the scope's authorities context builder, when configured.
      */
-    static check(permissions: JobPermission[] | undefined, action: JobPermissionAction, authInfo: Partial<Record<string, unknown>>): Promise<boolean>;
+    static check(permissions: JobPermission[] | undefined, action: JobPermissionAction, authInfo: Partial<Record<string, unknown>> | undefined, contextBuilder?: AuthoritiesContextBuilder): Promise<boolean>;
     private static checkSingle;
 }
 //# sourceMappingURL=job-permission.guard.d.ts.map

package/job/job-permission.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-permission.guard.d.ts","sourceRoot":"","sources":["../../src/job/job-permission.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAE/F;;;GAGG;AACH,qBAAa,kBAAkB;IAC7B;;;OAGG;WACU,KAAK,CAChB,WAAW,EAAE,aAAa,EAAE,GAAG,SAAS,EACxC,MAAM,EAAE,mBAAmB,EAC3B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACzC,OAAO,CAAC,OAAO,CAAC;mBAoBE,WAAW;CA0BjC"}
+{"version":3,"file":"job-permission.guard.d.ts","sourceRoot":"","sources":["../../src/job/job-permission.guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAG/F;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,kBAAkB;IAC7B;;;;;;;OAOG;WACU,KAAK,CAChB,WAAW,EAAE,aAAa,EAAE,GAAG,SAAS,EACxC,MAAM,EAAE,mBAAmB,EAC3B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,EACtD,cAAc,CAAC,EAAE,yBAAyB,GACzC,OAAO,CAAC,OAAO,CAAC;mBAsBE,WAAW;CAuBjC"}

package/job/job-scope.helper.d.ts

@@ -10,6 +10,18 @@ import { type JobDefinitionStore } from './store/job-definition.interface';
 import { type JobStateStore } from './store/job-state.interface';
 export interface JobsConfig {
     enabled: boolean;
+    /**
+     * Allow `register_job` / `register_workflow` — which take a raw script string
+     * and register it as an executable job — to be called at runtime.
+     *
+     * Off by default (GHSA-58v2-gpcc-jmqv): combined with an unguarded
+     * `execute_job` this was register-and-run-arbitrary-JS for any caller who
+     * could reach the tool list. Turn it on only when an agent is genuinely meant
+     * to author jobs, and pair it with `permissions` on the surrounding surface.
+     *
+     * @default false
+     */
+    allowDynamicRegistration?: boolean;
     store?: {
         redis?: {
             provider: string;

package/job/job-scope.helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-scope.helper.d.ts","sourceRoot":"","sources":["../../src/job/job-scope.helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,KAAK,gBAAgB,MAAM,+BAA+B,CAAC;AAMlE,OAAyB,EAAE,KAAK,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAE3E,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAQjE,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,KAAK,CAAC,EAAE;YACN,QAAQ,EAAE,MAAM,CAAC;YACjB,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,GAAG,CAAC,EAAE,MAAM,CAAC;YACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;SACxB,CAAC;QACF,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,oBAAoB,CAAC;IAClC,gBAAgB,EAAE,yBAAyB,CAAC;IAC5C,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,UAAU,EAAE,aAAa,CAAC;IAC1B,eAAe,EAAE,kBAAkB,CAAC;IACpC,eAAe,EAAE,GAAG,EAAE,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAsE/G"}
+{"version":3,"file":"job-scope.helper.d.ts","sourceRoot":"","sources":["../../src/job/job-scope.helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,KAAK,gBAAgB,MAAM,+BAA+B,CAAC;AAMlE,OAAyB,EAAE,KAAK,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAE3E,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAQjE,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;OAUG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,KAAK,CAAC,EAAE;QACN,KAAK,CAAC,EAAE;YACN,QAAQ,EAAE,MAAM,CAAC;YACjB,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,GAAG,CAAC,EAAE,MAAM,CAAC;YACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;SACxB,CAAC;QACF,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,oBAAoB,CAAC;IAClC,gBAAgB,EAAE,yBAAyB,CAAC;IAC5C,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,UAAU,EAAE,aAAa,CAAC;IAC1B,eAAe,EAAE,kBAAkB,CAAC;IACpC,eAAe,EAAE,GAAG,EAAE,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA8E/G"}

package/job/store/job-state.interface.d.ts

@@ -4,6 +4,12 @@ export interface JobRunRecord {
     jobId: string;
     jobName: string;
     sessionId?: string;
+    /**
+     * Subject that started the run. Run status carries the job's inputs and
+     * results, so reads are scoped to the owner rather than to whoever guesses a
+     * runId (GHSA-58v2-gpcc-jmqv).
+     */
+    ownerSub?: string;
     state: JobExecutionState;
     input: unknown;
     result?: unknown;

package/job/store/job-state.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-state.interface.d.ts","sourceRoot":"","sources":["../../../src/job/store/job-state.interface.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,CAAC;AAE1G,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,iBAAiB,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CACjB,MAAM,EACN;QACE,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,iBAAiB,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,KAAK,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CACF,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,GAAG,iBAAiB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACxE,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,iBAAiB,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,CAAC,YAAY,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B"}
+{"version":3,"file":"job-state.interface.d.ts","sourceRoot":"","sources":["../../../src/job/store/job-state.interface.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,CAAC;AAE1G,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,iBAAiB,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CACjB,MAAM,EACN;QACE,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,iBAAiB,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,KAAK,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CACF,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,GAAG,iBAAiB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACxE,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,iBAAiB,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,CAAC,YAAY,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B"}

package/job/tools/execute-job.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute-job.tool.d.ts","sourceRoot":"","sources":["../../../src/job/tools/execute-job.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AAmBjD,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,WAAW;IAC/C,OAAO,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE;CAsB5F"}
+{"version":3,"file":"execute-job.tool.d.ts","sourceRoot":"","sources":["../../../src/job/tools/execute-job.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AAoBjD,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,WAAW;IAC/C,OAAO,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE;CA2B5F"}

package/job/tools/get-job-status.tool.d.ts

@@ -17,5 +17,17 @@ export default class GetJobStatusTool extends ToolContext {
         attempt: number;
         logs: string[];
     }>;
+    /**
+     * Match on the owning subject, falling back to the session for runs started
+     * before an owner was recorded (and for anonymous/public servers, where every
+     * caller has an empty subject and the session is the only identity there is).
+     *
+     * A record carrying NEITHER identity is refused. Such a run cannot be
+     * attributed to anyone, and its inputs and results are exactly what this check
+     * exists to protect — anyone holding the id would otherwise be able to read
+     * it. Internal callers that must read unattributed runs should go through the
+     * execution manager directly rather than this tool.
+     */
+    private ownsRun;
 }
 //# sourceMappingURL=get-job-status.tool.d.ts.map

package/job/tools/get-job-status.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-job-status.tool.d.ts","sourceRoot":"","sources":["../../../src/job/tools/get-job-status.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AA2BjD,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACjD,OAAO,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;CAyBvC"}
+{"version":3,"file":"get-job-status.tool.d.ts","sourceRoot":"","sources":["../../../src/job/tools/get-job-status.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AA4BjD,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACjD,OAAO,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;IA6BtC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,OAAO;CAMhB"}

package/job/tools/list-jobs.tool.d.ts

@@ -14,5 +14,11 @@ export default class ListJobsTool extends ToolContext {
         }[];
         count: number;
     }>;
+    /**
+     * A job is listable when the caller passes its `list` rules and is not
+     * blocked from executing it. Checking `execute` too keeps the listing honest:
+     * showing a job the caller can never run is the disclosure this closes.
+     */
+    private maySee;
 }
 //# sourceMappingURL=list-jobs.tool.d.ts.map

package/job/tools/list-jobs.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-jobs.tool.d.ts","sourceRoot":"","sources":["../../../src/job/tools/list-jobs.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AA0BjD,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,WAAW;IAC7C,OAAO,CAAC,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;CAwB1F"}
+{"version":3,"file":"list-jobs.tool.d.ts","sourceRoot":"","sources":["../../../src/job/tools/list-jobs.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AA2BjD,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,WAAW;IAC7C,OAAO,CAAC,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;IAiCzF;;;;OAIG;YACW,MAAM;CAMrB"}

package/job/tools/register-job.tool.d.ts

@@ -11,5 +11,6 @@ export default class RegisterJobTool extends ToolContext {
         success: boolean;
         jobId: string;
     }>;
+    private dynamicRegistrationEnabled;
 }
 //# sourceMappingURL=register-job.tool.d.ts.map

package/job/tools/register-job.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register-job.tool.d.ts","sourceRoot":"","sources":["../../../src/job/tools/register-job.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AAsBjD,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,WAAW;IAChD,OAAO,CAAC,KAAK,EAAE;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB;;;;CAkCF"}
+{"version":3,"file":"register-job.tool.d.ts","sourceRoot":"","sources":["../../../src/job/tools/register-job.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AAuBjD,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,WAAW;IAChD,OAAO,CAAC,KAAK,EAAE;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB;;;;IA2CD,OAAO,CAAC,0BAA0B;CAInC"}

package/job/tools/remove-job.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remove-job.tool.d.ts","sourceRoot":"","sources":["../../../src/job/tools/remove-job.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AAejD,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IAC9C,OAAO,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE;;;;CAuBtC"}
+{"version":3,"file":"remove-job.tool.d.ts","sourceRoot":"","sources":["../../../src/job/tools/remove-job.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AAiBjD,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IAC9C,OAAO,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE;;;;CAmCtC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/sdk",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "description": "FrontMCP SDK",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -90,8 +90,8 @@
   "peerDependencies": {
     "@anthropic-ai/sdk": "^0.30.0 || ^0.78.0",
     "@enclave-vm/core": "^2.15.2",
-    "@frontmcp/observability": "1.7.0",
-    "@frontmcp/storage-sqlite": "1.7.0",
+    "@frontmcp/observability": "1.7.2",
+    "@frontmcp/storage-sqlite": "1.7.2",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/sdk-trace-base": "^2.8.0",
     "@vercel/kv": "^3.0.0",
@@ -132,13 +132,13 @@
     }
   },
   "dependencies": {
-    "@frontmcp/auth": "1.7.0",
-    "@frontmcp/di": "1.7.0",
-    "@frontmcp/guard": "1.7.0",
-    "@frontmcp/lazy-zod": "1.7.0",
-    "@frontmcp/protocol": "1.7.0",
-    "@frontmcp/uipack": "1.7.0",
-    "@frontmcp/utils": "1.7.0",
+    "@frontmcp/auth": "1.7.2",
+    "@frontmcp/di": "1.7.2",
+    "@frontmcp/guard": "1.7.2",
+    "@frontmcp/lazy-zod": "1.7.2",
+    "@frontmcp/protocol": "1.7.2",
+    "@frontmcp/uipack": "1.7.2",
+    "@frontmcp/utils": "1.7.2",
     "@types/cors": "^2.8.17",
     "ioredis": "^5.8.0",
     "jose": "^6.1.3",

package/resource/flows/resource-templates-list.flow.d.ts

@@ -53,11 +53,11 @@ declare const stateSchema: import("@frontmcp/lazy-zod").ZodObject<{
     cursor: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
     templates: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
         ownerName: import("@frontmcp/lazy-zod").ZodString;
-        template: import("zod").ZodCustom<ResourceEntry<Record<string, string>, unknown>, ResourceEntry<Record<string, string>, unknown>>;
+        template: import("zod").ZodInstanceOf<ResourceEntry<Record<string, string>, unknown>>;
     }, import("zod/v4/core").$strip>>;
     resolvedTemplates: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
         ownerName: import("@frontmcp/lazy-zod").ZodString;
-        template: import("zod").ZodCustom<ResourceEntry<Record<string, string>, unknown>, ResourceEntry<Record<string, string>, unknown>>;
+        template: import("zod").ZodInstanceOf<ResourceEntry<Record<string, string>, unknown>>;
         finalName: import("@frontmcp/lazy-zod").ZodString;
     }, import("zod/v4/core").$strip>>;
 }, import("zod/v4/core").$strip>;

package/resource/flows/resources-list.flow.d.ts

@@ -54,11 +54,11 @@ declare const stateSchema: import("@frontmcp/lazy-zod").ZodObject<{
     cursor: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
     resources: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
         ownerName: import("@frontmcp/lazy-zod").ZodString;
-        resource: import("zod").ZodCustom<ResourceEntry<Record<string, string>, unknown>, ResourceEntry<Record<string, string>, unknown>>;
+        resource: import("zod").ZodInstanceOf<ResourceEntry<Record<string, string>, unknown>>;
     }, import("zod/v4/core").$strip>>;
     resolvedResources: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
         ownerName: import("@frontmcp/lazy-zod").ZodString;
-        resource: import("zod").ZodCustom<ResourceEntry<Record<string, string>, unknown>, ResourceEntry<Record<string, string>, unknown>>;
+        resource: import("zod").ZodInstanceOf<ResourceEntry<Record<string, string>, unknown>>;
         finalName: import("@frontmcp/lazy-zod").ZodString;
     }, import("zod/v4/core").$strip>>;
 }, import("zod/v4/core").$strip>;

package/scope/scope.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope.utils.d.ts","sourceRoot":"","sources":["../../src/scope/scope.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AAGvD,OAAO,EAGL,KAAK,OAAO,EACZ,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAE7B,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AAInB;;;;;GAKG;AAEH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,sBAAsB,GAAG,wBAAwB,GAC1D,WAAW,CA2Bb;AAED,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,sBAAsB,GAAG,WAAW,CAU7G;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,GAAG,KAAK,EAAE,CAO5D"}
+{"version":3,"file":"scope.utils.d.ts","sourceRoot":"","sources":["../../src/scope/scope.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AAGvD,OAAO,EAGL,KAAK,OAAO,EACZ,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAE7B,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AAInB;;;;;GAKG;AAEH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,sBAAsB,GAAG,wBAAwB,GAC1D,WAAW,CAiCb;AAED,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,sBAAsB,GAAG,WAAW,CAU7G;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,GAAG,KAAK,EAAE,CAO5D"}

package/server/adapters/express.host.adapter.d.ts

@@ -14,8 +14,8 @@ export declare const DEFAULT_EXPRESS_BODY_LIMIT = "4mb";
 export interface ExpressHostAdapterOptions {
     /**
      * CORS configuration.
-     * At the adapter level, CORS is disabled by default (no middleware installed).
-     * Note: FrontMcpServerInstance provides a permissive default when `cors` is omitted.
+     * The middleware is installed only when `origin` is set to something other than `false`, so
+     * omitting `cors` — or passing `{}` / `{ origin: false }` — sends no CORS headers at all.
      */
     cors?: CorsOptions;
     /**
@@ -33,12 +33,44 @@ export interface ExpressHostAdapterOptions {
      * when omitted.
      */
     urlencodedLimit?: number | string;
+    /**
+     * Supplemental listener metadata for the default DNS-rebinding allow-list.
+     *
+     * The address and port are NOT read from here — they come from the arguments
+     * `start()` is actually called with, so the allow-list always describes the
+     * listener this process opened. `issuer` names the public host a proxy
+     * presents, which `start()` cannot know.
+     */
+    listen?: {
+        issuer?: string;
+    };
 }
 export declare class ExpressHostAdapter extends HostServerAdapter {
     private app;
     private router;
     private prepared;
+    /** Active host-validation middleware, or undefined while nothing is enforced. */
+    private hostValidation?;
+    /** Builds the derived allow-list, once this process commits to listening. */
+    private deriveHostValidation?;
     constructor(options?: ExpressHostAdapterOptions);
+    /**
+     * Install DNS-rebinding protection.
+     *
+     * ON by default since v1.7.2 (BC-035). `allowedHosts` falls back to the names
+     * this process actually answers to — the loopback aliases with and without
+     * the bound port, the bound NIC address, and the configured issuer host.
+     *
+     * Escape hatches, in precedence order: explicit
+     * `security.dnsRebindingProtection.allowedHosts`, the
+     * `FRONTMCP_ALLOWED_HOSTS` env var, or `enabled: false` to turn it off.
+     */
+    private installHostValidation;
+    /**
+     * Enable the DERIVED host allow-list. Called from `start()` only — see
+     * `installHostValidation`.
+     */
+    private enableDerivedHostValidation;
     registerRoute(method: HttpMethod, path: string, handler: ServerRequestHandler): void;
     registerMiddleware(entryPath: string, handler: ServerRequestHandler): void;
     enhancedHandler(handler: ServerRequestHandler): (req: express.Request, res: express.Response, next: express.NextFunction) => void | Promise<void>;

package/server/adapters/express.host.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"express.host.adapter.d.ts","sourceRoot":"","sources":["../../../src/server/adapters/express.host.adapter.ts"],"names":[],"mappings":"AAIA,OAAO,OAAO,MAAM,SAAS,CAAC;AAI9B,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,UAAU,EAEf,KAAK,oBAAoB,EAE1B,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAGlF,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,QAAQ,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;IAEnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;IAE3B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAE5B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACnC;AAED,qBAAa,kBAAmB,SAAQ,iBAAiB;IACvD,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,QAAQ,CAAS;gBAEb,OAAO,CAAC,EAAE,yBAAyB;IAmG/C,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB;IAI7E,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB;IAInE,eAAe,CAAC,OAAO,EAAE,oBAAoB,IACnC,KAAK,OAAO,CAAC,OAAO,EAAE,KAAK,OAAO,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,YAAY;IAQjF;;;;OAIG;IACH,OAAO,IAAI,IAAI;IAMf;;;OAGG;IACH,UAAU,IAAI,OAAO,CAAC,WAAW;IAK3B,KAAK,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;YAqCrD,kBAAkB;CASjC"}
+{"version":3,"file":"express.host.adapter.d.ts","sourceRoot":"","sources":["../../../src/server/adapters/express.host.adapter.ts"],"names":[],"mappings":"AAIA,OAAO,OAAO,MAAM,SAAS,CAAC;AAI9B,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,UAAU,EAEf,KAAK,oBAAoB,EAE1B,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAIlF,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,QAAQ,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;IAEnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;IAE3B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAE5B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAElC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE;QACP,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,qBAAa,kBAAmB,SAAQ,iBAAiB;IACvD,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,QAAQ,CAAS;IACzB,iFAAiF;IACjF,OAAO,CAAC,cAAc,CAAC,CAAoD;IAC3E,6EAA6E;IAC7E,OAAO,CAAC,oBAAoB,CAAC,CAGsC;gBAEvD,OAAO,CAAC,EAAE,yBAAyB;IAmF/C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IAoE7B;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAMnC,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB;IAI7E,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB;IAInE,eAAe,CAAC,OAAO,EAAE,oBAAoB,IACnC,KAAK,OAAO,CAAC,OAAO,EAAE,KAAK,OAAO,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,YAAY;IAQjF;;;;OAIG;IACH,OAAO,IAAI,IAAI;IAMf;;;OAGG;IACH,UAAU,IAAI,OAAO,CAAC,WAAW;IAK3B,KAAK,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;YAuCrD,kBAAkB;CASjC"}

package/server/middleware/host-validation.middleware.d.ts

@@ -1,16 +1,20 @@
 /**
  * Host Header Validation Middleware
  *
- * Validates the HTTP Host header against a whitelist of allowed values
- * to protect against DNS rebinding attacks. Only active when explicitly
- * enabled via security.dnsRebindingProtection.enabled = true.
+ * Express-side adapter over the transport-agnostic rules in
+ * `../security/host-validation`. The rules live there so the web-fetch
+ * (Worker/edge) handler applies exactly the same checks — two adapters must
+ * never diverge in behavior (.claude/rules/flow-architecture.md).
+ *
+ * Enabled by DEFAULT since v1.7.2 (BC-035, GHSA-mc9g-v2cp-vfff); the adapter
+ * decides whether to install it.
  */
 import type { ServerRequest, ServerResponse } from '../../common';
 /**
  * Configuration for host validation middleware.
  */
 export interface HostValidationOptions {
-    /** Whether host validation is enabled. @default false */
+    /** Whether host validation is enabled. */
     enabled: boolean;
     /** Allowed Host header values (e.g., ['localhost:3001', 'api.example.com']) */
     allowedHosts?: string[];

package/server/middleware/host-validation.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-validation.middleware.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/host-validation.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAElE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,yDAAyD;IACzD,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,uEAAuE;IACvE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,qBAAqB,GAC7B,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,IAAI,CAwDrE"}
+{"version":3,"file":"host-validation.middleware.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/host-validation.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGlE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,uEAAuE;IACvE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,qBAAqB,GAC7B,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,IAAI,CA2BrE"}

package/server/security/host-validation.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Host / Origin validation — the server-side half of DNS-rebinding protection
+ * (GHSA-mc9g-v2cp-vfff).
+ *
+ * A page on an attacker-controlled domain can rebind that domain to the
+ * victim's loopback address and then reach a local MCP server. The browser
+ * treats the result as same-origin, so CORS does not apply and binding to
+ * loopback does not help — loopback is the *destination* of the rebind. What
+ * does apply is that the request still names the attacker's hostname in `Host`,
+ * because that is the name the page was loaded from.
+ *
+ * This module is transport-agnostic on purpose: the Express adapter and the
+ * web-fetch (Worker/edge) handler both call it, so the two cannot drift apart
+ * (see .claude/rules/flow-architecture.md — adapters translate, they do not
+ * decide).
+ */
+export interface HostValidationRules {
+    /** Allowed `Host` values. Undefined disables host checking. */
+    allowedHosts?: string[];
+    /** Allowed `Origin` values. Undefined disables origin checking. */
+    allowedOrigins?: string[];
+}
+export interface HostValidationRejection {
+    status: 403;
+    error: 'Forbidden';
+    message: string;
+}
+/**
+ * Normalize a `Host` header for comparison.
+ *
+ * Hostnames are case-insensitive, and a default port may be present or omitted
+ * for the same host, so both forms normalize to the same key. IPv6 literals
+ * keep their brackets — `[::1]` and `::1` are different spellings of a host, and
+ * only the bracketed form is legal in a `Host` header.
+ */
+export declare function normalizeHost(value: string): string;
+/**
+ * Normalize an `Origin` header (scheme + host, default port elided).
+ *
+ * The default port is scheme-specific: only `:80` is redundant for `http` and
+ * only `:443` for `https`. Eliding both regardless of scheme would make
+ * `https://app.example.com:80` compare equal to `https://app.example.com`, and a
+ * service on an untrusted port of an allowed hostname would pass the allowlist.
+ *
+ * `URL` applies exactly that rule and canonicalizes IPv6 literals on the way, so
+ * it does the work. Anything it cannot parse falls back to a lowercase compare,
+ * which is stricter, not looser.
+ */
+export declare function normalizeOrigin(value: string): string;
+/** Precompiled rules — build once per server, not per request. */
+export interface CompiledHostValidation {
+    hosts?: Set<string>;
+    origins?: Set<string>;
+}
+export declare function compileHostValidation(rules: HostValidationRules): CompiledHostValidation;
+/**
+ * Validate a request's `Host`, `X-Forwarded-Host` and `Origin` headers.
+ *
+ * @returns `undefined` when the request is allowed, or the rejection to render.
+ */
+export declare function validateHostHeaders(headers: {
+    host?: string | undefined;
+    forwardedHost?: string | undefined;
+    origin?: string | undefined;
+}, compiled: CompiledHostValidation): HostValidationRejection | undefined;
+//# sourceMappingURL=host-validation.d.ts.map

package/server/security/host-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-validation.d.ts","sourceRoot":"","sources":["../../../src/server/security/host-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,GAAG,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAanD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOrD;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACvB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,sBAAsB,CAKxF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE;IACP,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,EACD,QAAQ,EAAE,sBAAsB,GAC/B,uBAAuB,GAAG,SAAS,CAqCrC"}

package/server/security/resolve-allowed-hosts.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Default `allowedHosts` derivation for DNS-rebinding protection
+ * (GHSA-mc9g-v2cp-vfff).
+ *
+ * Protection is on by default, which is only workable if the default allow-list
+ * is right without configuration. It is derived from what the server actually
+ * binds: the names a client can legitimately use to reach *this* process.
+ */
+export interface DeriveAllowedHostsInput {
+    /** Resolved bind address (e.g. '127.0.0.1', '0.0.0.0', '::'). */
+    bindAddress?: string;
+    /** Listening TCP port, when the server listens on one. */
+    port?: number;
+    /** Unix socket path — when set there is no TCP host to derive. */
+    socketPath?: string;
+    /** Configured issuer / public URL, so a deployed server keeps working. */
+    issuer?: string;
+    /** Extra hosts from `FRONTMCP_ALLOWED_HOSTS`. */
+    extraHosts?: string[];
+}
+/**
+ * True when the address only accepts connections from this machine.
+ *
+ * Classifying a loopback listener as routable would disable the derived
+ * DNS-rebinding allow-list on exactly the server the attack targets, so every
+ * spelling of loopback has to resolve here.
+ */
+export declare function isLoopbackAddress(address: string | undefined): boolean;
+/**
+ * True when the bind address means "reachable from the network".
+ *
+ * A wildcard bind, or a specific non-loopback NIC, is a deployed server: the
+ * names clients dial it by (a DNS name behind a proxy, a load-balancer host)
+ * are not knowable from inside the process.
+ */
+export declare function isRoutableBind(address: string | undefined): boolean;
+/**
+ * Derive the hosts a request may legitimately name.
+ *
+ * A loopback-bound server is only reachable as a loopback name, so the derived
+ * list is exact and can be enforced as-is — which is precisely the DNS-rebinding
+ * threat model (the attacker rebinds a domain to the victim's 127.0.0.1).
+ *
+ * A server bound to a routable address is reached by names this process cannot
+ * enumerate. `deriveAllowedHosts` returns what it can (the loopback aliases, the
+ * bound NIC, the issuer host); the caller decides whether that is enough to
+ * enforce — see {@link shouldEnforceDerivedHosts}.
+ */
+export declare function deriveAllowedHosts(input: DeriveAllowedHostsInput): string[];
+/**
+ * Whether a DERIVED (not operator-supplied) host list may be enforced.
+ *
+ * Enforcing a derived list on a routable bind would 403 every request that
+ * arrives under the deployment's real hostname — a proxied server upgrading a
+ * patch version would go dark. So a derived list is enforced only when the
+ * server is loopback-bound, or when the operator gave us a public name to add
+ * (an issuer URL or FRONTMCP_ALLOWED_HOSTS). Otherwise the caller should warn
+ * and leave Host checking off until `allowedHosts` is configured.
+ */
+export declare function shouldEnforceDerivedHosts(input: DeriveAllowedHostsInput): boolean;
+/** Parse the `FRONTMCP_ALLOWED_HOSTS` escape hatch (comma-separated). */
+export declare function allowedHostsFromEnv(env?: NodeJS.ProcessEnv): string[] | undefined;
+//# sourceMappingURL=resolve-allowed-hosts.d.ts.map

package/server/security/resolve-allowed-hosts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-allowed-hosts.d.ts","sourceRoot":"","sources":["../../../src/server/security/resolve-allowed-hosts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,MAAM,WAAW,uBAAuB;IACtC,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAsBD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAWtE;AAiBD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,EAAE,CAkC3E;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAiBjF;AAED,yEAAyE;AACzE,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,EAAE,GAAG,SAAS,CAQ9F"}

package/server/security/security-audit.d.ts

@@ -1,16 +1,17 @@
 /**
  * Security Audit — Production Readiness Warnings
  *
- * Logs security-relevant configuration at server startup.
- * Warn-only approach: no defaults are changed, but insecure
- * configurations are flagged in production environments.
+ * Logs security-relevant configuration at server startup so an operator can see
+ * what the transport actually exposes. The audit only reports — it never changes
+ * behaviour; the safe choices are the defaults themselves (loopback binding, no
+ * CORS headers), and this flags where a config opts out of them.
  */
 import type { CorsOptions } from '../../common';
 /**
  * Security configuration for the audit.
  */
 export interface SecurityAuditConfig {
-    /** CORS configuration (undefined = permissive default) */
+    /** CORS configuration (undefined = the default: no CORS headers, same-origin only) */
     cors?: CorsOptions | false;
     /** Security options from HttpOptionsInterface */
     security?: {
@@ -58,6 +59,8 @@ export declare function logSecurityFindings(findings: SecurityFinding[], logger:
 /**
  * Resolve the effective bind address based on configuration and deployment mode.
  *
+ * Precedence: explicit config > FRONTMCP_BIND_ADDRESS > strict mode > deployment mode > loopback.
+ *
  * @param security - Security configuration
  * @param deploymentMode - Current deployment mode
  * @returns Resolved IP address string

package/server/security/security-audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-audit.d.ts","sourceRoot":"","sources":["../../../src/server/security/security-audit.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,0DAA0D;IAC1D,IAAI,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,WAAW,CAAC,EAAE,UAAU,GAAG,KAAK,GAAG,MAAM,CAAC;QAC1C,sBAAsB,CAAC,EAAE;YACvB,OAAO,CAAC,EAAE,OAAO,CAAC;YAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;YACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;SAC3B,CAAC;KACH,CAAC;IACF,gEAAgE;IAChE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,sBAAsB;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE,OAAO,GAAG,eAAe,EAAE,CAmG3G;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EAAE,EAC3B,MAAM,EAAE;IACN,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,GACA,IAAI,CAeN;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAe9G"}
+{"version":3,"file":"security-audit.d.ts","sourceRoot":"","sources":["../../../src/server/security/security-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,IAAI,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,WAAW,CAAC,EAAE,UAAU,GAAG,KAAK,GAAG,MAAM,CAAC;QAC1C,sBAAsB,CAAC,EAAE;YACvB,OAAO,CAAC,EAAE,OAAO,CAAC;YAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;YACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;SAC3B,CAAC;KACH,CAAC;IACF,gEAAgE;IAChE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,sBAAsB;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE,OAAO,GAAG,eAAe,EAAE,CA8G3G;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EAAE,EAC3B,MAAM,EAAE;IACN,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,GACA,IAAI,CAeN;AAYD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAkC9G"}

package/server/server.instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.instance.d.ts","sourceRoot":"","sources":["../../src/server/server.instance.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,cAAc,EAEd,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,oBAAoB,EAC1B,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAKtE,qBAAa,sBAAuB,SAAQ,cAAc;IACxD,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,cAAc,CAAC,CAAgB;IACvC,OAAO,CAAC,aAAa,CAAC,CAAyB;IAC/C,OAAO,CAAC,sBAAsB,CAAS;IACvC,OAAO,CAAC,eAAe,CAAC,CAAiB;IACzC,OAAO,CAAC,cAAc,CAAC,CAA0B;gBAErC,UAAU,EAAE,WAAW;IAMnC,OAAO,CAAC,aAAa;IAwBrB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB;IAInE,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB;IAIpE,eAAe,CAAC,OAAO,EAAE,oBAAoB,GAAG,oBAAoB;IAI7E;;;OAGG;IACH,gBAAgB,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,sBAAsB,GAAG,IAAI;IAK1F;;;OAGG;IACH,eAAe,CAAC,YAAY,EAAE,sBAAsB,GAAG,IAAI;IAI3D;;;OAGG;IACH,iBAAiB,CAAC,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,uBAAuB,GAAG,IAAI;IAK/F;;;;OAIG;IACH,gBAAgB,CAAC,aAAa,EAAE,uBAAuB,GAAG,IAAI;IAI9D,OAAO;IA0BP,UAAU,IAAI,OAAO;IAIf,KAAK;CAqBZ"}
+{"version":3,"file":"server.instance.d.ts","sourceRoot":"","sources":["../../src/server/server.instance.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,cAAc,EAEd,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,oBAAoB,EAC1B,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAYtE,qBAAa,sBAAuB,SAAQ,cAAc;IACxD,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,cAAc,CAAC,CAAgB;IACvC,OAAO,CAAC,aAAa,CAAC,CAAyB;IAC/C,OAAO,CAAC,sBAAsB,CAAS;IACvC,OAAO,CAAC,eAAe,CAAC,CAAiB;IACzC,OAAO,CAAC,cAAc,CAAC,CAA0B;gBAErC,UAAU,EAAE,WAAW;IAMnC,OAAO,CAAC,aAAa;IA2BrB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB;IAInE,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB;IAIpE,eAAe,CAAC,OAAO,EAAE,oBAAoB,GAAG,oBAAoB;IAI7E;;;OAGG;IACH,gBAAgB,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,sBAAsB,GAAG,IAAI;IAK1F;;;OAGG;IACH,eAAe,CAAC,YAAY,EAAE,sBAAsB,GAAG,IAAI;IAI3D;;;OAGG;IACH,iBAAiB,CAAC,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,uBAAuB,GAAG,IAAI;IAK/F;;;;OAIG;IACH,gBAAgB,CAAC,aAAa,EAAE,uBAAuB,GAAG,IAAI;IAI9D,OAAO;IA0BP,UAAU,IAAI,OAAO;IAIf,KAAK;CAqBZ"}

package/server/server.types.d.ts

@@ -1,9 +1,8 @@
-import type { AuthInfo } from '@frontmcp/protocol';
-import type { Authorization, ServerRequest, SessionIdPayload, UserClaim } from '../common';
-import type { LocalTransportAdapter } from '../transport/adapters/transport.local.adapter';
-import type { StreamableHTTPServerTransport } from '@frontmcp/protocol';
-import type { SSEServerTransport } from '../transport/adapters/base-sse-transport';
-import type { Scope } from '../scope';
+import { type AuthInfo, type StreamableHTTPServerTransport } from '@frontmcp/protocol';
+import { type Authorization, type ServerRequest, type SessionIdPayload, type UserClaim } from '../common';
+import { type Scope } from '../scope';
+import { type SSEServerTransport } from '../transport/adapters/base-sse-transport';
+import { type LocalTransportAdapter } from '../transport/adapters/transport.local.adapter';
 export interface ScopedServerRequest extends ServerRequest {
     authScope: Scope;
     auth?: AuthInfo;
@@ -22,6 +21,12 @@ declare module '@frontmcp/protocol' {
         user: UserClaim;
         sessionId: string;
         sessionIdPayload: SessionIdPayload;
+        /**
+         * Verified token claims, as resolved by the auth flow. Surfaced so
+         * permission checks can read roles/tenancy without reaching into
+         * `extra.authorization`.
+         */
+        claims?: Record<string, unknown>;
     }
 }
 //# sourceMappingURL=server.types.d.ts.map

package/server/server.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.types.d.ts","sourceRoot":"","sources":["../../src/server/server.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAEtC,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,SAAS,EAAE,KAAK,CAAC;IACjB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;AAED,MAAM,WAAW,0BAA2B,SAAQ,mBAAmB;IACrE,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,aAAa,CAAC;CAC5B;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ;IAC3C,SAAS,EAAE,qBAAqB,CAAC,6BAA6B,GAAG,kBAAkB,CAAC,CAAC;CACtF;AAED,OAAO,QAAQ,oBAAoB,CAAC;IAClC,UAAiB,QAAQ;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,SAAS,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,gBAAgB,CAAC;KACpC;CACF"}
+{"version":3,"file":"server.types.d.ts","sourceRoot":"","sources":["../../src/server/server.types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AAEvF,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AAE3F,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,SAAS,EAAE,KAAK,CAAC;IACjB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;AAED,MAAM,WAAW,0BAA2B,SAAQ,mBAAmB;IACrE,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,aAAa,CAAC;CAC5B;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ;IAC3C,SAAS,EAAE,qBAAqB,CAAC,6BAA6B,GAAG,kBAAkB,CAAC,CAAC;CACtF;AAED,OAAO,QAAQ,oBAAoB,CAAC;IAClC,UAAiB,QAAQ;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,SAAS,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,gBAAgB,CAAC;QACnC;;;;WAIG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC;CACF"}