@frontmcp/sdk 1.7.1 → 1.8.0

package/common/utils/principal.utils.d.ts

@@ -0,0 +1,29 @@
+import type { AuthoritiesContextBuilder } from '@frontmcp/auth';
+/**
+ * The caller identity a permission check evaluates against.
+ *
+ * Deliberately flat: every consumer needs the same four things, and resolving
+ * them in one place stops each call site from inventing its own claim lookup.
+ */
+export interface ResolvedPrincipal {
+    /** Subject identifier, or '' when the caller is anonymous. */
+    sub: string;
+    roles: string[];
+    permissions: string[];
+    scopes: string[];
+    claims: Record<string, unknown>;
+}
+/**
+ * Resolve the caller's roles, permissions, scopes and claims from AuthInfo.
+ *
+ * When the scope has an authorities engine configured, its `claimsMapping` /
+ * `claimsResolver` is authoritative — a server that told FrontMCP where its
+ * roles live must not have a permission check quietly look somewhere else.
+ * Without one, the same fallback chain the authorities builder uses applies, so
+ * both paths agree on what "has the admin role" means.
+ *
+ * Scopes are read from AuthInfo directly (the verified token's scope set) and,
+ * as a fallback, from a `scope`/`scopes` claim.
+ */
+export declare function resolvePrincipal(authInfo: Partial<Record<string, unknown>> | undefined, contextBuilder?: AuthoritiesContextBuilder): ResolvedPrincipal;
+//# sourceMappingURL=principal.utils.d.ts.map

package/common/utils/principal.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.utils.d.ts","sourceRoot":"","sources":["../../../src/common/utils/principal.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AA0BD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,EACtD,cAAc,CAAC,EAAE,yBAAyB,GACzC,iBAAiB,CA8CnB"}

package/context/frontmcp-context-storage.d.ts

@@ -46,7 +46,9 @@ export declare class FrontMcpContextStorage {
      * @param fn - Async function to run
      * @returns Result of the callback
      */
-    runFromHeaders<T>(headers: Record<string, unknown>, args: Omit<FrontMcpContextArgs, 'traceContext' | 'metadata'>, fn: () => T | Promise<T>): T | Promise<T>;
+    runFromHeaders<T>(headers: Record<string, unknown>, args: Omit<FrontMcpContextArgs, 'traceContext' | 'metadata'> & {
+        peerAddress?: string;
+    }, fn: () => T | Promise<T>): T | Promise<T>;
     /**
      * Run with an existing FrontMcpContext.
      *

package/context/frontmcp-context-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontmcp-context-storage.d.ts","sourceRoot":"","sources":["../../src/context/frontmcp-context-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAMnD,OAAO,EAAE,eAAe,EAAE,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAY/E;;;;;;GAMG;AACH,qBAKa,sBAAsB;IACjC;;;;;;OAMG;IACH,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAK3E;;;;;;;;;;OAUG;IACH,cAAc,CAAC,CAAC,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,cAAc,GAAG,UAAU,CAAC,EAC5D,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GACvB,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAWjB;;;;;;;;OAQG;IACH,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAIrF;;;;OAIG;IACH,QAAQ,IAAI,eAAe,GAAG,SAAS;IAIvC;;;;OAIG;IACH,eAAe,IAAI,eAAe;IAUlC;;;;OAIG;IACH,UAAU,IAAI,OAAO;IAIrB;;;;;;;;;OASG;IACH,cAAc,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAKzF"}
+{"version":3,"file":"frontmcp-context-storage.d.ts","sourceRoot":"","sources":["../../src/context/frontmcp-context-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAMnD,OAAO,EAAE,eAAe,EAAE,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAY/E;;;;;;GAMG;AACH,qBAKa,sBAAsB;IACjC;;;;;;OAMG;IACH,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAK3E;;;;;;;;;;OAUG;IACH,cAAc,CAAC,CAAC,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,cAAc,GAAG,UAAU,CAAC,GAAG;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EACvF,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GACvB,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAcjB;;;;;;;;OAQG;IACH,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAIrF;;;;OAIG;IACH,QAAQ,IAAI,eAAe,GAAG,SAAS;IAIvC;;;;OAIG;IACH,eAAe,IAAI,eAAe;IAUlC;;;;OAIG;IACH,UAAU,IAAI,OAAO;IAIrB;;;;;;;;;OASG;IACH,cAAc,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAKzF"}

package/context/metadata.utils.d.ts

@@ -4,21 +4,44 @@
  * Shared utilities for extracting request metadata from HTTP headers.
  */
 import type { RequestMetadata } from './frontmcp-context';
+/** Where the client IP may legitimately come from, beyond the headers. */
+export interface ClientIpOptions {
+    /** Socket peer address, e.g. `req.socket.remoteAddress`. The only unforgeable source. */
+    peerAddress?: string;
+    /** Overrides the `FRONTMCP_TRUST_PROXY` environment default. */
+    trustProxy?: boolean;
+    /** Overrides the `FRONTMCP_TRUSTED_PROXY_DEPTH` environment default. */
+    trustedProxyDepth?: number;
+}
 /**
  * Extract request metadata from headers.
  *
  * @param headers - HTTP headers object
+ * @param options - Socket peer address and proxy-trust overrides
  * @returns Extracted metadata including user-agent, content-type, client IP, and custom headers
  */
-export declare function extractMetadata(headers: Record<string, unknown>): RequestMetadata;
+export declare function extractMetadata(headers: Record<string, unknown>, options?: ClientIpOptions): RequestMetadata;
 /**
- * Extract client IP from headers.
+ * Extract the client IP for a request (GHSA-p3qf-fcwm-35x4).
  *
- * Handles both string and array header values (some adapters pass arrays).
- * Supports x-forwarded-for (comma-separated list) and x-real-ip headers.
+ * `x-forwarded-for` and `x-real-ip` are claims made by whoever sent the request. Anything
+ * that reaches the app directly can set them, so they are honoured ONLY when a reverse proxy
+ * is declared trusted — via `FRONTMCP_TRUST_PROXY`, the same switch that already gates
+ * `x-forwarded-proto`/`x-forwarded-host` in `getRequestBaseUrl`. Otherwise the socket peer is
+ * the only honest answer.
+ *
+ * When a proxy IS trusted, the client is taken from the TRUSTED end of the chain:
+ * `x-forwarded-for` is append-only, so a caller controls the left of the list and our own
+ * proxies appended to the right. `FRONTMCP_TRUSTED_PROXY_DEPTH` (default 1) says how many
+ * hops we appended; the entry just before them is the furthest one we can still vouch for.
+ * Reading the leftmost entry, as this did, reads exactly the part the caller controls.
+ *
+ * The result is always validated as an IP, so a forged header cannot mint an arbitrary
+ * rate-limit bucket or smuggle a delimiter into a key built from it.
  *
  * @param headers - HTTP headers object
- * @returns Client IP address or undefined if not found
+ * @param options - Socket peer address and proxy-trust overrides
+ * @returns Client IP address or undefined when none can be established
  */
-export declare function extractClientIp(headers: Record<string, unknown>): string | undefined;
+export declare function extractClientIp(headers: Record<string, unknown>, options?: ClientIpOptions): string | undefined;
 //# sourceMappingURL=metadata.utils.d.ts.map

package/context/metadata.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metadata.utils.d.ts","sourceRoot":"","sources":["../../src/context/metadata.utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,CAgBjF;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAoBpF"}
+{"version":3,"file":"metadata.utils.d.ts","sourceRoot":"","sources":["../../src/context/metadata.utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wEAAwE;IACxE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AA4GD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,eAAe,CAgB5G;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAiC/G"}

package/direct/llm-platform.d.ts

@@ -3,8 +3,8 @@
  *
  * Detects LLM platform from clientInfo and formats tools/results accordingly.
  */
-import type { Tool as McpTool, CallToolResult } from '@frontmcp/protocol';
-import type { LLMPlatform, ClientInfo } from './client.types';
+import type { CallToolResult, Tool as McpTool } from '@frontmcp/protocol';
+import type { ClientInfo, LLMPlatform } from './client.types';
 /**
  * Client info presets for each LLM platform.
  * Used by LLM-specific connect helpers.

package/direct/llm-platform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"llm-platform.d.ts","sourceRoot":"","sources":["../../src/direct/llm-platform.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,IAAI,OAAO,EAAE,cAAc,EAA6B,MAAM,oBAAoB,CAAC;AACrG,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,CAMhE,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,UAAU,GAAG,WAAW,CAiBlE;AAMD,0CAA0C;AAC1C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;CACH;AAMD,mCAAmC;AACnC,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAMD,mCAAmC;AACnC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAMD,gCAAgC;AAChC,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,0BAA0B;AAC1B,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAMzD;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,EAAE,GAAG,UAAU,EAAE,GAAG,aAAa,EAAE,GAAG,aAAa,GAAG,OAAO,EAAE,CAAC;AAEvG;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,MAAM,GACN,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACvB,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GACrC,cAAc,GACd,cAAc,CAAC,SAAS,CAAC,GACzB;IACE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD,CAAC;AA0DN;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,GAAG,cAAc,CA+C9F;AA6GD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,GAAG,mBAAmB,CAqD1G"}
+{"version":3,"file":"llm-platform.d.ts","sourceRoot":"","sources":["../../src/direct/llm-platform.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAgB,IAAI,IAAI,OAAO,EAAe,MAAM,oBAAoB,CAAC;AAErG,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,CAMhE,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,UAAU,GAAG,WAAW,CAiBlE;AAMD,0CAA0C;AAC1C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;CACH;AAMD,mCAAmC;AACnC,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAMD,mCAAmC;AACnC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAMD,gCAAgC;AAChC,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,0BAA0B;AAC1B,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAMzD;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,EAAE,GAAG,UAAU,EAAE,GAAG,aAAa,EAAE,GAAG,aAAa,GAAG,OAAO,EAAE,CAAC;AAEvG;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,MAAM,GACN,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACvB,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GACrC,cAAc,GACd,cAAc,CAAC,SAAS,CAAC,GACzB;IACE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD,CAAC;AA0DN;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,GAAG,cAAc,CAiD9F;AA6GD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,GAAG,mBAAmB,CAqD1G"}

package/errors/auth-internal.errors.d.ts

@@ -1,2 +1,2 @@
-export { EncryptionContextNotSetError, VaultLoadError, VaultNotFoundError, TokenNotAvailableError, TokenStoreRequiredError, NoProviderIdError, TokenLeakDetectedError, SessionSecretRequiredError, CredentialProviderAlreadyRegisteredError, AuthProvidersNotConfiguredError, OrchestratedAuthNotAvailableError, EncryptionKeyNotConfiguredError, SessionIdEmptyError, ElicitationSecretRequiredError, ScopeDeniedError, InMemoryStoreRequiredError, OrchestratorJwksNotAvailableError, } from '@frontmcp/auth';
+export { EncryptionContextNotSetError, VaultLoadError, VaultNotFoundError, TokenNotAvailableError, TokenStoreRequiredError, NoProviderIdError, TokenLeakDetectedError, JwtSecretRequiredError, JwtSecretWeakError, SessionSecretRequiredError, CredentialProviderAlreadyRegisteredError, AuthProvidersNotConfiguredError, OrchestratedAuthNotAvailableError, EncryptionKeyNotConfiguredError, SessionIdEmptyError, ElicitationSecretRequiredError, ScopeDeniedError, InMemoryStoreRequiredError, OrchestratorJwksNotAvailableError, } from '@frontmcp/auth';
 //# sourceMappingURL=auth-internal.errors.d.ts.map

package/errors/auth-internal.errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-internal.errors.d.ts","sourceRoot":"","sources":["../../src/errors/auth-internal.errors.ts"],"names":[],"mappings":"AACA,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,wCAAwC,EACxC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,mBAAmB,EACnB,8BAA8B,EAC9B,gBAAgB,EAChB,0BAA0B,EAC1B,iCAAiC,GAClC,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"auth-internal.errors.d.ts","sourceRoot":"","sources":["../../src/errors/auth-internal.errors.ts"],"names":[],"mappings":"AACA,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,0BAA0B,EAC1B,wCAAwC,EACxC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,mBAAmB,EACnB,8BAA8B,EAC9B,gBAAgB,EAChB,0BAA0B,EAC1B,iCAAiC,GAClC,MAAM,gBAAgB,CAAC"}

package/errors/index.d.ts

@@ -15,8 +15,9 @@ export { RegistryDefinitionNotFoundError, RegistryGraphEntryNotFoundError, Regis
 export { ProviderNotRegisteredError, ProviderScopeMismatchError, ProviderNotInstantiatedError, DependencyCycleError, ProviderConstructionError, ProviderDependencyError, ProviderScopedAccessError, ProviderNotAvailableError, PluginDependencyError, InvalidDependencyScopeError, } from './provider.errors';
 export { InvalidDecoratorMetadataError, HookTargetNotDefinedError } from './decorator.errors';
 export { MethodNotImplementedError, UnsupportedTransportTypeError, TransportBusRequiredError, InvalidTransportSessionError, TransportNotConnectedError, TransportAlreadyStartedError, UnsupportedContentTypeError, TransportServiceNotAvailableError, SessionClaimConflictError, } from './transport.errors';
-export { EncryptionContextNotSetError, VaultLoadError, VaultNotFoundError, TokenNotAvailableError, TokenStoreRequiredError, NoProviderIdError, TokenLeakDetectedError, SessionSecretRequiredError, CredentialProviderAlreadyRegisteredError, AuthProvidersNotConfiguredError, OrchestratedAuthNotAvailableError, EncryptionKeyNotConfiguredError, SessionIdEmptyError, ElicitationSecretRequiredError, ScopeDeniedError, InMemoryStoreRequiredError, OrchestratorJwksNotAvailableError, } from './auth-internal.errors';
+export { EncryptionContextNotSetError, VaultLoadError, VaultNotFoundError, TokenNotAvailableError, TokenStoreRequiredError, NoProviderIdError, TokenLeakDetectedError, JwtSecretRequiredError, JwtSecretWeakError, SessionSecretRequiredError, CredentialProviderAlreadyRegisteredError, AuthProvidersNotConfiguredError, OrchestratedAuthNotAvailableError, EncryptionKeyNotConfiguredError, SessionIdEmptyError, ElicitationSecretRequiredError, ScopeDeniedError, InMemoryStoreRequiredError, OrchestratorJwksNotAvailableError, } from './auth-internal.errors';
 export { WorkflowStepNotFoundError, WorkflowTimeoutError, WorkflowDagValidationError, WorkflowJobTimeoutError, } from './workflow.errors';
 export { EsmPackageLoadError, EsmVersionResolutionError, EsmManifestInvalidError, EsmCacheError, EsmRegistryAuthError, EsmInvalidSpecifierError, } from './esm.errors';
 export { FlowExitedWithoutOutputError, ServerNotFoundError, ConfigNotFoundError, SessionVerificationFailedError, ContextExtensionNotAvailableError, ScopeConfigurationError, HaConfigurationError, InvokeStateMissingKeyError, SkillSessionError, InvalidSkillError, SkillInstructionFetchError, InvalidInstructionSourceError, SkillContextNotImplementedError, ServerlessHandlerNotInitializedError, MissingPromptArgumentError, DynamicAdapterNameError, AgentConfigKeyNotFoundError, AgentToolExecutionError, AgentMethodNotAvailableError, VercelKvNotSupportedError, VercelKvAsyncInitRequiredError, RequiredConfigUndefinedError, RegistryNotInitializedError, EnclaveExecutionError, FlowInputMissingError, DynamicJobDirectExecutionError, } from './sdk.errors';
+export * from './job.errors';
 //# sourceMappingURL=index.d.ts.map

package/errors/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,QAAQ,EACR,cAAc,EACd,gBAAgB,EAEhB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAElB,qBAAqB,EAErB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EAEvB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EAEpB,cAAc,EACd,kBAAkB,EAElB,iBAAiB,EAEjB,mBAAmB,EACnB,6BAA6B,EAE7B,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,+BAA+B,EAE/B,sBAAsB,EACtB,yBAAyB,EAEzB,mBAAmB,EACnB,oBAAoB,EAEpB,aAAa,EACb,UAAU,EACV,sBAAsB,EACtB,oBAAoB,EAEpB,eAAe,EACf,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAEL,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAE/B,0BAA0B,GAC3B,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,YAAY,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAGrF,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAG3D,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,iCAAiC,EACjC,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,mCAAmC,EACnC,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAG5G,OAAO,EAEL,qBAAqB,EACrB,qBAAqB,EAErB,kBAAkB,EAElB,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,EAEzB,eAAe,EACf,wBAAwB,EAExB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EAEpB,oBAAoB,EACpB,+BAA+B,EAE/B,8BAA8B,EAC9B,iCAAiC,EAEjC,wBAAwB,EACxB,uBAAuB,EAEvB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,+BAA+B,EAC/B,+BAA+B,EAC/B,oCAAoC,EACpC,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,4BAA4B,EAC5B,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAG9F,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,2BAA2B,EAC3B,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,wCAAwC,EACxC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,mBAAmB,EACnB,8BAA8B,EAC9B,gBAAgB,EAChB,0BAA0B,EAC1B,iCAAiC,GAClC,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,mBAAmB,EACnB,8BAA8B,EAC9B,iCAAiC,EACjC,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,+BAA+B,EAC/B,oCAAoC,EACpC,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,EAC5B,2BAA2B,EAC3B,qBAAqB,EACrB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,QAAQ,EACR,cAAc,EACd,gBAAgB,EAEhB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAElB,qBAAqB,EAErB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EAEvB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EAEpB,cAAc,EACd,kBAAkB,EAElB,iBAAiB,EAEjB,mBAAmB,EACnB,6BAA6B,EAE7B,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,+BAA+B,EAE/B,sBAAsB,EACtB,yBAAyB,EAEzB,mBAAmB,EACnB,oBAAoB,EAEpB,aAAa,EACb,UAAU,EACV,sBAAsB,EACtB,oBAAoB,EAEpB,eAAe,EACf,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAEL,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAE/B,0BAA0B,GAC3B,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,YAAY,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAGrF,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAG3D,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,iCAAiC,EACjC,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,mCAAmC,EACnC,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAG5G,OAAO,EAEL,qBAAqB,EACrB,qBAAqB,EAErB,kBAAkB,EAElB,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,EAEzB,eAAe,EACf,wBAAwB,EAExB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EAEpB,oBAAoB,EACpB,+BAA+B,EAE/B,8BAA8B,EAC9B,iCAAiC,EAEjC,wBAAwB,EACxB,uBAAuB,EAEvB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,+BAA+B,EAC/B,+BAA+B,EAC/B,oCAAoC,EACpC,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,4BAA4B,EAC5B,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAG9F,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,2BAA2B,EAC3B,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,0BAA0B,EAC1B,wCAAwC,EACxC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,mBAAmB,EACnB,8BAA8B,EAC9B,gBAAgB,EAChB,0BAA0B,EAC1B,iCAAiC,GAClC,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,mBAAmB,EACnB,8BAA8B,EAC9B,iCAAiC,EACjC,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,+BAA+B,EAC/B,oCAAoC,EACpC,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,EAC5B,2BAA2B,EAC3B,qBAAqB,EACrB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,cAAc,CAAC;AACtB,cAAc,cAAc,CAAC"}

package/errors/job.errors.d.ts

@@ -0,0 +1,26 @@
+import { PublicMcpError } from './mcp.error';
+/**
+ * The caller may not perform this action on the job or workflow
+ * (GHSA-58v2-gpcc-jmqv).
+ *
+ * The message deliberately does NOT distinguish "exists but you may not touch
+ * it" from "does not exist": both `execute_job` on a restricted job and
+ * `execute_job` on a typo must read the same, or the error itself becomes an
+ * enumeration oracle for the restricted job names on a server.
+ */
+export declare class JobNotAuthorizedError extends PublicMcpError {
+    /** The requested name, for internal logs only — never surfaced publicly. */
+    readonly requestedName: string;
+    constructor(requestedName: string);
+}
+/**
+ * Dynamic job/workflow registration was attempted while it is disabled.
+ *
+ * `register_job` takes a raw script string and registers it as an executable
+ * job, so it stays off unless an operator explicitly opts in with
+ * `jobs: { allowDynamicRegistration: true }`.
+ */
+export declare class DynamicJobRegistrationDisabledError extends PublicMcpError {
+    constructor(kind?: 'job' | 'workflow');
+}
+//# sourceMappingURL=job.errors.d.ts.map

package/errors/job.errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"job.errors.d.ts","sourceRoot":"","sources":["../../src/errors/job.errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;;GAQG;AACH,qBAAa,qBAAsB,SAAQ,cAAc;IACvD,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBAEnB,aAAa,EAAE,MAAM;CAIlC;AAED;;;;;;GAMG;AACH,qBAAa,mCAAoC,SAAQ,cAAc;gBACzD,IAAI,GAAE,KAAK,GAAG,UAAkB;CAO7C"}