@frontmcp/sdk 1.7.1 → 1.8.0

package/tool/ui/ui-shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ui-shared.d.ts","sourceRoot":"","sources":["../../../src/tool/ui/ui-shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA0ChE,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,GAAG,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChE;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,iEAAiE;AACjE,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,SAAS,CAA8C;IAC/D,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,QAAQ,CAAC,CAAiB;gBAEtB,QAAQ,CAAC,EAAE,cAAc;IAIrC,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIjD,MAAM,IAAI,OAAO;IAIjB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAIlE;;;;;OAKG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI7D,YAAY,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM;IAIjC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAsC/E;;;;;OAKG;IACH,OAAO,CAAC,4BAA4B;IAU9B,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvE,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB/E,2BAA2B,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAc5F,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CAkC3G;AAMD,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAIlE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,qBAAqB,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAIrE"}
+{"version":3,"file":"ui-shared.d.ts","sourceRoot":"","sources":["../../../src/tool/ui/ui-shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA0ChE,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,GAAG,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChE;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,iEAAiE;AACjE,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,SAAS,CAA8C;IAC/D,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,QAAQ,CAAC,CAAiB;gBAEtB,QAAQ,CAAC,EAAE,cAAc;IAIrC,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIjD,MAAM,IAAI,OAAO;IAIjB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAIlE;;;;;OAKG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI7D,YAAY,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM;IAIjC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAsC/E;;;;;OAKG;IACH,OAAO,CAAC,4BAA4B;IAU9B,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvE,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB/E,2BAA2B,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAc5F,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CAkC3G;AAMD,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAeD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAIlE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,qBAAqB,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAIrE"}

package/transport/adapters/base-sse-transport.d.ts

@@ -43,6 +43,13 @@ export declare class SSEServerTransport implements Transport {
     constructor(_endpoint: string, res: ServerResponse, options?: SSEServerTransportOptions);
     /**
      * Validates request headers for DNS rebinding protection.
+     *
+     * Since v1.7.2 the primary defence is the adapter-level Host validation, which
+     * runs before routing and therefore already covers `/sse` and `/message`
+     * (GHSA-mc9g-v2cp-vfff). These per-transport options remain for a host that
+     * constructs the transport directly; they delegate to the same rules so the
+     * two can never disagree about what a valid Host looks like.
+     *
      * @returns Error message if validation fails, undefined if validation passes.
      */
     private validateRequestHeaders;

package/transport/adapters/base-sse-transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-sse-transport.d.ts","sourceRoot":"","sources":["../../../src/transport/adapters/base-sse-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAKtE,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,cAAc,EAEnB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAW5B;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;OAGG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAEvC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,YAAW,SAAS;IAchD,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,GAAG;IAdb,OAAO,CAAC,YAAY,CAAC,CAAiB;IACtC,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAA4B;IAC5C,oFAAoF;IACpF,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAExE;;OAEG;gBAEO,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,cAAc,EAC3B,OAAO,CAAC,EAAE,yBAAyB;IAMrC;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAyB9B;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAkC5B;;;;OAIG;IACG,iBAAiB,CACrB,GAAG,EAAE,eAAe,GAAG;QAAE,IAAI,CAAC,EAAE,QAAQ,CAAA;KAAE,EAC1C,GAAG,EAAE,cAAc,EACnB,UAAU,CAAC,EAAE,OAAO,GACnB,OAAO,CAAC,IAAI,CAAC;IAiDhB;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAMtB,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAUlD;;;;OAIG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;;;;OAKG;IACH,IAAI,WAAW,IAAI,MAAM,CAExB;IAED;;;;;OAKG;IACH,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAGnD"}
+{"version":3,"file":"base-sse-transport.d.ts","sourceRoot":"","sources":["../../../src/transport/adapters/base-sse-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAKtE,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,cAAc,EAEnB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAY5B;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;OAGG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAEvC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,YAAW,SAAS;IAchD,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,GAAG;IAdb,OAAO,CAAC,YAAY,CAAC,CAAiB;IACtC,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAA4B;IAC5C,oFAAoF;IACpF,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAExE;;OAEG;gBAEO,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,cAAc,EAC3B,OAAO,CAAC,EAAE,yBAAyB;IAMrC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAqB9B;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAkC5B;;;;OAIG;IACG,iBAAiB,CACrB,GAAG,EAAE,eAAe,GAAG;QAAE,IAAI,CAAC,EAAE,QAAQ,CAAA;KAAE,EAC1C,GAAG,EAAE,cAAc,EACnB,UAAU,CAAC,EAAE,OAAO,GACnB,OAAO,CAAC,IAAI,CAAC;IAiDhB;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAMtB,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAUlD;;;;OAIG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;;;;OAKG;IACH,IAAI,WAAW,IAAI,MAAM,CAExB;IAED;;;;;OAKG;IACH,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAGnD"}

package/transport/adapters/transport.local.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport.local.adapter.d.ts","sourceRoot":"","sources":["../../../src/transport/adapters/transport.local.adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAGL,SAAS,EACT,KAAK,SAAS,EACd,KAAK,6BAA6B,EACnC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,EAAuB,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EAEjB,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,0BAA0B,EAAoB,MAAM,2BAA2B,CAAC;AAI9F,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,KAAK,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,KAAK,yCAAyC,EAAE,MAAM,6BAA6B,CAAC;AAmC7F;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAC1B,6BAA6B,GAC7B,kBAAkB,GAClB,yCAAyC,GACzC,8BAA8B,CAAC;AAEnC,8BAAsB,qBAAqB,CAAC,CAAC,SAAS,kBAAkB;;IAqCpE,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK;IAC/B,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY;IACpC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,IAAI;IAtC1C,SAAS,CAAC,MAAM,EAAE,cAAc,CAAC;IACjC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;IAEvB;;;OAGG;IACH,SAAS,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IAExC;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB,CAAC,CAKxB;IAEH;;;;OAIG;IACH,qBAAqB,CAAC,OAAO,EAAE,WAAW,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,GAAG,IAAI;IAKjG,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,MAAM,EAAE,SAAS,CAAC;gBAGG,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,IAAI,EACxC,GAAG,EAAE,cAAc;IAOrB,QAAQ,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,CAAC;IAExE,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,0BAA0B,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAExF;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,CAAC,SAAS,OAAO,EAC1C,gBAAgB,EAAE,SAAS,EAC3B,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,CAAC,EAClB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAElE,QAAQ,CAAC,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAE3F;;;OAGG;IACH,IAAI,aAAa,IAAI,OAAO,CAE3B;IAED;;;OAGG;IACH,iBAAiB,IAAI,IAAI;IAIzB;;;OAGG;IACH,wBAAwB,IAAI,IAAI;IAIhC;;;;OAIG;IACH,gBAAgB,IAAI,IAAI;IAMxB,aAAa;IAoGb,IAAI,YAAY,IAAI,SAAS,CAE5B;IAED;;;OAGG;IACH,IAAI,IAAI,IAAI,aAAa,CAExB;IAEK,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB7C;;;OAGG;IACG,IAAI,CAAC,SAAS,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAchD,SAAS,CAAC,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAyD7F;;;OAGG;IACH,SAAS,KAAK,WAAW,IAAI,gBAAgB,GAAG,SAAS,CAExD;IAED;;;OAGG;IACH,SAAS,CAAC,kBAAkB,IAAI,gBAAgB;IAQhD;;;;;;;;;;;OAWG;cACa,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAsBpD;;;;;;;OAOG;IACH,oBAAoB,CAAC,GAAG,EAAE,0BAA0B,GAAG,OAAO;IA+C9D;;;OAGG;YACW,uBAAuB;IAuBrC;;;OAGG;IACH,OAAO,CAAC,WAAW;IAQnB;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;IAyBlC;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;CAOhC"}
+{"version":3,"file":"transport.local.adapter.d.ts","sourceRoot":"","sources":["../../../src/transport/adapters/transport.local.adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAGL,SAAS,EACT,KAAK,SAAS,EACd,KAAK,6BAA6B,EACnC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,EAAuB,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EAEjB,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,0BAA0B,EAAoB,MAAM,2BAA2B,CAAC;AAI9F,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,KAAK,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,KAAK,yCAAyC,EAAE,MAAM,6BAA6B,CAAC;AAmC7F;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAC1B,6BAA6B,GAC7B,kBAAkB,GAClB,yCAAyC,GACzC,8BAA8B,CAAC;AAEnC,8BAAsB,qBAAqB,CAAC,CAAC,SAAS,kBAAkB;;IAqCpE,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK;IAC/B,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY;IACpC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,IAAI;IAtC1C,SAAS,CAAC,MAAM,EAAE,cAAc,CAAC;IACjC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;IAEvB;;;OAGG;IACH,SAAS,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IAExC;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB,CAAC,CAKxB;IAEH;;;;OAIG;IACH,qBAAqB,CAAC,OAAO,EAAE,WAAW,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,GAAG,IAAI;IAKjG,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,MAAM,EAAE,SAAS,CAAC;gBAGG,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,IAAI,EACxC,GAAG,EAAE,cAAc;IAOrB,QAAQ,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,CAAC;IAExE,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,0BAA0B,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAExF;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,CAAC,SAAS,OAAO,EAC1C,gBAAgB,EAAE,SAAS,EAC3B,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,CAAC,EAClB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAElE,QAAQ,CAAC,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAE3F;;;OAGG;IACH,IAAI,aAAa,IAAI,OAAO,CAE3B;IAED;;;OAGG;IACH,iBAAiB,IAAI,IAAI;IAIzB;;;OAGG;IACH,wBAAwB,IAAI,IAAI;IAIhC;;;;OAIG;IACH,gBAAgB,IAAI,IAAI;IAMxB,aAAa;IAoGb,IAAI,YAAY,IAAI,SAAS,CAE5B;IAED;;;OAGG;IACH,IAAI,IAAI,IAAI,aAAa,CAExB;IAEK,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB7C;;;OAGG;IACG,IAAI,CAAC,SAAS,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAchD,SAAS,CAAC,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAkE7F;;;OAGG;IACH,SAAS,KAAK,WAAW,IAAI,gBAAgB,GAAG,SAAS,CAExD;IAED;;;OAGG;IACH,SAAS,CAAC,kBAAkB,IAAI,gBAAgB;IAQhD;;;;;;;;;;;OAWG;cACa,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAsBpD;;;;;;;OAOG;IACH,oBAAoB,CAAC,GAAG,EAAE,0BAA0B,GAAG,OAAO;IA+C9D;;;OAGG;YACW,uBAAuB;IAuBrC;;;OAGG;IACH,OAAO,CAAC,WAAW;IAQnB;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;IAyBlC;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;CAOhC"}

package/transport/adapters/transport.streamable-http.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport.streamable-http.adapter.d.ts","sourceRoot":"","sources":["../../../src/transport/adapters/transport.streamable-http.adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE1E,OAAO,EAAE,KAAK,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAE5E,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,yCAAyC,EAAE,MAAM,6BAA6B,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,GACpC,eAAe,aAAa,EAC5B,WAAW,MAAM,KAChB,CAAC,MAAM,MAAM,CAAC,GAAG,SAEnB,CAAC;AAEF,qBAAa,8BAA+B,SAAQ,qBAAqB,CAAC,yCAAyC,CAAC;IACzG,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,yCAAyC;IAgC1G,UAAU,CAAC,GAAG,EAAE,0BAA0B,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IA2D/E,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBxF;;;;;;;;;;;;;;;;;OAiBG;IACG,iBAAiB,CAAC,CAAC,SAAS,OAAO,EACvC,gBAAgB,EAAE,SAAS,EAC3B,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,CAAC,EAClB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAkHlE,IAAa,aAAa,IAAI,OAAO,CAEpC;IAED;;;;OAIG;IACM,wBAAwB,IAAI,IAAI;IAOzC;;;;;;;OAOG;IACM,iBAAiB,IAAI,IAAI;CAOnC"}
+{"version":3,"file":"transport.streamable-http.adapter.d.ts","sourceRoot":"","sources":["../../../src/transport/adapters/transport.streamable-http.adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE1E,OAAO,EAAE,KAAK,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAG5E,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,yCAAyC,EAAE,MAAM,6BAA6B,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,GACpC,eAAe,aAAa,EAC5B,WAAW,MAAM,KAChB,CAAC,MAAM,MAAM,CAAC,GAAG,SAEnB,CAAC;AAEF,qBAAa,8BAA+B,SAAQ,qBAAqB,CAAC,yCAAyC,CAAC;IACzG,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,yCAAyC;IAsC1G,UAAU,CAAC,GAAG,EAAE,0BAA0B,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IA2D/E,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBxF;;;;;;;;;;;;;;;;;OAiBG;IACG,iBAAiB,CAAC,CAAC,SAAS,OAAO,EACvC,gBAAgB,EAAE,SAAS,EAC3B,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,CAAC,EAClB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAkHlE,IAAa,aAAa,IAAI,OAAO,CAEpC;IAED;;;;OAIG;IACM,wBAAwB,IAAI,IAAI;IAOzC;;;;;;;OAOG;IACM,iBAAiB,IAAI,IAAI;CAOnC"}

package/transport/event-stores/index.d.ts

@@ -44,4 +44,6 @@ export { MemoryEventStore } from './memory.event-store';
 export type { MemoryEventStoreOptions } from './memory.event-store';
 export { RedisEventStore } from './redis.event-store';
 export type { RedisEventStoreOptions } from './redis.event-store';
+export { createSessionScopedEventStore } from './session-scoped.event-store';
+export type { EventStoreWithLookup } from './session-scoped.event-store';
 //# sourceMappingURL=index.d.ts.map

package/transport/event-stores/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/transport/event-stores/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/transport/event-stores/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAGlE,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,YAAY,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC"}

package/transport/event-stores/memory.event-store.d.ts

@@ -1,5 +1,4 @@
-import type { EventId, EventStore, StreamId } from '@frontmcp/protocol';
-import type { JSONRPCMessage } from '@frontmcp/protocol';
+import { type EventId, type EventStore, type JSONRPCMessage, type StreamId } from '@frontmcp/protocol';
 export interface MemoryEventStoreOptions {
     /** Maximum number of events to store before eviction. Default: 10000 */
     maxEvents?: number;
@@ -24,6 +23,14 @@ export declare class MemoryEventStore implements EventStore {
     private readonly ttlMs;
     constructor(options?: MemoryEventStoreOptions);
     storeEvent(streamId: StreamId, message: JSONRPCMessage): Promise<EventId>;
+    /**
+     * Resolve the stream an event belongs to.
+     *
+     * Optional in the upstream `EventStore` contract, and the transport's
+     * 409-conflict guard (refusing a second live stream for the same id) is dead
+     * code while no store provides it (GHSA-84j6-jc92-77jm).
+     */
+    getStreamIdForEventId(eventId: EventId): Promise<StreamId | undefined>;
     replayEventsAfter(lastEventId: EventId, { send }: {
         send: (eventId: EventId, message: JSONRPCMessage) => Promise<void>;
     }): Promise<StreamId>;

package/transport/event-stores/memory.event-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.event-store.d.ts","sourceRoot":"","sources":["../../../src/transport/event-stores/memory.event-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAQzD,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,gBAAiB,YAAW,UAAU;IACjD,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,KAAK,CAA2D;IACxE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAEnB,OAAO,GAAE,uBAA4B;IAK3C,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAmBzE,iBAAiB,CACrB,WAAW,EAAE,OAAO,EACpB,EAAE,IAAI,EAAE,EAAE;QAAE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,GAC/E,OAAO,CAAC,QAAQ,CAAC;IAuBpB;;OAEG;IACH,OAAO,CAAC,YAAY;IAYpB;;OAEG;IACH,OAAO,CAAC,WAAW;IAsBnB;;OAEG;IACH,OAAO,CAAC,YAAY;IAWpB;;OAEG;IACH,KAAK,IAAI,IAAI;IAKb;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}
+{"version":3,"file":"memory.event-store.d.ts","sourceRoot":"","sources":["../../../src/transport/event-stores/memory.event-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAQvG,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,gBAAiB,YAAW,UAAU;IACjD,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,KAAK,CAA2D;IACxE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAEnB,OAAO,GAAE,uBAA4B;IAK3C,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAmB/E;;;;;;OAMG;IACG,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAItE,iBAAiB,CACrB,WAAW,EAAE,OAAO,EACpB,EAAE,IAAI,EAAE,EAAE;QAAE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,GAC/E,OAAO,CAAC,QAAQ,CAAC;IAuBpB;;OAEG;IACH,OAAO,CAAC,YAAY;IAYpB;;OAEG;IACH,OAAO,CAAC,WAAW;IAsBnB;;OAEG;IACH,OAAO,CAAC,YAAY;IAWpB;;OAEG;IACH,KAAK,IAAI,IAAI;IAKb;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}

package/transport/event-stores/redis.event-store.d.ts

@@ -1,6 +1,5 @@
-import type { EventId, EventStore, StreamId } from '@frontmcp/protocol';
-import type { JSONRPCMessage } from '@frontmcp/protocol';
-import type { RedisOptionsInput } from '../../common';
+import { type EventId, type EventStore, type JSONRPCMessage, type StreamId } from '@frontmcp/protocol';
+import { type RedisOptionsInput } from '../../common';
 export interface RedisEventStoreOptions {
     /**
      * Redis configuration.
@@ -58,6 +57,14 @@ export declare class RedisEventStore implements EventStore {
      */
     private getClient;
     storeEvent(streamId: StreamId, message: JSONRPCMessage): Promise<EventId>;
+    /**
+     * Resolve the stream an event belongs to.
+     *
+     * Optional in the upstream `EventStore` contract, and the transport's
+     * 409-conflict guard (refusing a second live stream for the same id) is dead
+     * code while no store provides it (GHSA-84j6-jc92-77jm).
+     */
+    getStreamIdForEventId(eventId: EventId): Promise<StreamId | undefined>;
     replayEventsAfter(lastEventId: EventId, { send }: {
         send: (eventId: EventId, message: JSONRPCMessage) => Promise<void>;
     }): Promise<StreamId>;
@@ -67,6 +74,20 @@ export declare class RedisEventStore implements EventStore {
      * Event IDs have format: `{streamId}:{redisStreamEntryId}`
      * Redis stream entry IDs have format: `{timestamp}-{sequence}`
      *
+     * The entry-id half is validated because it is interpolated into the `xrange`
+     * range argument (`(${redisId}`), where a malformed value is a protocol error
+     * rather than data.
+     *
+     * The stream-id half is NOT character-filtered. `xadd`/`xrange` take the key
+     * as an exact argument — Redis applies no glob matching there — and ioredis
+     * length-prefixes it, so no character is special. Filtering here would also
+     * make `storeEvent`, which accepts any `StreamId`, able to mint ids this
+     * function then refuses, silently breaking replay for that stream. Ownership
+     * is enforced by the session-scoped facade (GHSA-84j6-jc92-77jm), not by
+     * guessing at the id's characters.
+     *
+     * @returns the pair, or `undefined` when the id is malformed.
+     *
      * @example
      * 'my-stream:1234567890123-0' -> ['my-stream', '1234567890123-0']
      */

package/transport/event-stores/redis.event-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis.event-store.d.ts","sourceRoot":"","sources":["../../../src/transport/event-stores/redis.event-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGtD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,KAAK,EAAE,iBAAiB,CAAC;IAEzB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,eAAgB,YAAW,UAAU;IAChD,OAAO,CAAC,MAAM,CAAU;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoB;gBAErC,OAAO,EAAE,sBAAsB;IAO3C;;;OAGG;YACW,SAAS;IAkDjB,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAqBzE,iBAAiB,CACrB,WAAW,EAAE,OAAO,EACpB,EAAE,IAAI,EAAE,EAAE;QAAE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,GAC/E,OAAO,CAAC,QAAQ,CAAC;IAqBpB;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAYpB;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAM7B"}
+{"version":3,"file":"redis.event-store.d.ts","sourceRoot":"","sources":["../../../src/transport/event-stores/redis.event-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEvG,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGtD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,KAAK,EAAE,iBAAiB,CAAC;IAEzB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,eAAgB,YAAW,UAAU;IAChD,OAAO,CAAC,MAAM,CAAU;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoB;gBAErC,OAAO,EAAE,sBAAsB;IAO3C;;;OAGG;YACW,SAAS;IAkDjB,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAqB/E;;;;;;OAMG;IACG,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAKtE,iBAAiB,CACrB,WAAW,EAAE,OAAO,EACpB,EAAE,IAAI,EAAE,EAAE;QAAE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,GAC/E,OAAO,CAAC,QAAQ,CAAC;IA6BpB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,YAAY;IAiBpB;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAM7B"}

package/transport/event-stores/session-scoped.event-store.d.ts

@@ -0,0 +1,17 @@
+import type { EventId, EventStore, StreamId } from '@frontmcp/protocol';
+/**
+ * `EventStore` plus the optional lookup the upstream transport uses for its
+ * 409-conflict guard. No FrontMCP store implemented it, leaving that guard dead.
+ */
+export interface EventStoreWithLookup extends EventStore {
+    getStreamIdForEventId?(eventId: EventId): Promise<StreamId | undefined>;
+}
+/**
+ * Wrap a shared store so it only ever writes to, and only ever replays, the
+ * streams belonging to `sessionId`.
+ *
+ * @param store - the scope-wide store every session shares.
+ * @param sessionId - the owning session.
+ */
+export declare function createSessionScopedEventStore(store: EventStore, sessionId: string): EventStoreWithLookup;
+//# sourceMappingURL=session-scoped.event-store.d.ts.map

package/transport/event-stores/session-scoped.event-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-scoped.event-store.d.ts","sourceRoot":"","sources":["../../../src/transport/event-stores/session-scoped.event-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAkB,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAgCxF;;;GAGG;AACH,MAAM,WAAW,oBAAqB,SAAQ,UAAU;IACtD,qBAAqB,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;CACzE;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,oBAAoB,CA6DxG"}

package/transport/web-fetch-handler.d.ts

@@ -93,6 +93,7 @@ export declare function createWebFetchHandler(scope: Scope, options?: CreateWebF
  */
 export declare function runHttpRequestFlowWeb(scope: Scope, request: Request, opts?: {
     ctx?: FetchHandlerCtx;
+    env?: unknown;
     persistent?: WebStandardMcpPair;
 }): Promise<Response | undefined>;
 /**
@@ -101,6 +102,26 @@ export declare function runHttpRequestFlowWeb(scope: Scope, request: Request, op
  * Mirrors the Express host's route dispatch for runtimes with no middleware
  * server (Cloudflare Worker / web-fetch). Returns the rendered Web `Response`,
  * or `undefined` when no flow matches (caller 404s).
+ *
+ * Carries the worker `ctx` and `env` for the same reason `http:request` does:
+ * an auth or OAuth flow on a Worker reaches its bindings only through
+ * `ServerRequestTokens.webEnv`, and dropping them here would leave exactly the
+ * flows that need a KV-backed store without one.
+ */
+export declare function runMatchingHttpFlowWeb(scope: Scope, request: Request, opts?: {
+    ctx?: FetchHandlerCtx;
+    env?: unknown;
+}): Promise<Response | undefined>;
+/**
+ * Render a recognized configuration fault as a Web `Response`, or `undefined`
+ * when the error is not one.
+ *
+ * Exported because a missing secret can surface on two different paths: from
+ * inside the `http:request` flow (a `SessionSecretRequiredError` thrown during
+ * `session:verify`) or out of the lazy scope build that `createFetchHandler`
+ * memoizes, which happens BEFORE any flow exists (a `JwtSecretRequiredError`
+ * thrown while the auth instance is constructed). Both must answer the same
+ * structured body, so both go through here.
  */
-export declare function runMatchingHttpFlowWeb(scope: Scope, request: Request): Promise<Response | undefined>;
+export declare function misconfigurationResponse(error: unknown): Response | undefined;
 //# sourceMappingURL=web-fetch-handler.d.ts.map

package/transport/web-fetch-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-fetch-handler.d.ts","sourceRoot":"","sources":["../../src/transport/web-fetch-handler.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAErD,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC7C;AAED,kFAAkF;AAClF,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE5G;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,OAAO,EACZ,GAAG,CAAC,EAAE,eAAe,KAClB,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;AAEnC;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,2GAA2G;IAC3G,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;IACrC,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2GAA2G;IAC3G,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2FAA2F;IAC3F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,sEAAsE;IACtE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAqBD,MAAM,WAAW,4BAA4B;IAC3C;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC9B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,GAAE,4BAAiC,GAAG,eAAe,CA6G/G;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,eAAe,CAAC;IAAC,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAAO,GACpE,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAa/B;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAe1G"}
+{"version":3,"file":"web-fetch-handler.d.ts","sourceRoot":"","sources":["../../src/transport/web-fetch-handler.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAGrD,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC7C;AAED,kFAAkF;AAClF,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE5G;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,OAAO,EACZ,GAAG,CAAC,EAAE,eAAe,KAClB,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;AAEnC;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,2GAA2G;IAC3G,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;IACrC,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2GAA2G;IAC3G,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2FAA2F;IAC3F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,sEAAsE;IACtE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAqBD,MAAM,WAAW,4BAA4B;IAC3C;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC9B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,GAAE,4BAAiC,GAAG,eAAe,CA8I/G;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,eAAe,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAAO,GACnF,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAa/B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,eAAe,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAClD,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAe/B;AA2FD;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAO7E"}

package/workflow/engine/workflow-step.executor.d.ts

@@ -1,6 +1,17 @@
+import type { AuthoritiesContextBuilder } from '@frontmcp/auth';
 import { type FrontMcpLogger } from '../../common/interfaces/logger.interface';
 import { type WorkflowStep, type WorkflowStepResult } from '../../common/metadata/workflow.metadata';
 import { type JobRegistryInterface } from '../../job/job.registry';
+export interface WorkflowStepExecutorExtra {
+    authInfo: Partial<Record<string, unknown>>;
+    contextProviders?: unknown;
+    /**
+     * The scope's authorities context builder, so a step's permission check
+     * resolves roles through the server's own `claimsMapping` rather than a
+     * second, divergent notion of where roles live.
+     */
+    authoritiesContextBuilder?: AuthoritiesContextBuilder;
+}
 /**
  * Executes a single workflow step by resolving the job and running it.
  */
@@ -8,10 +19,7 @@ export declare class WorkflowStepExecutor {
     private readonly jobRegistry;
     private readonly logger;
     private readonly extra;
-    constructor(jobRegistry: JobRegistryInterface, logger: FrontMcpLogger, extra: {
-        authInfo: Partial<Record<string, unknown>>;
-        contextProviders?: unknown;
-    });
+    constructor(jobRegistry: JobRegistryInterface, logger: FrontMcpLogger, extra: WorkflowStepExecutorExtra);
     executeStep(step: WorkflowStep, input: Record<string, unknown>): Promise<WorkflowStepResult>;
     private executeWithTimeout;
 }

package/workflow/engine/workflow-step.executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-step.executor.d.ts","sourceRoot":"","sources":["../../../src/workflow/engine/workflow-step.executor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAGrG,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;GAEG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6E;gBAGjG,WAAW,EAAE,oBAAoB,EACjC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAAE;IAO7E,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAwCpF,kBAAkB;CAwBjC"}
+{"version":3,"file":"workflow-step.executor.d.ts","sourceRoot":"","sources":["../../../src/workflow/engine/workflow-step.executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAGhE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAKrG,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,yBAAyB,CAAC;CACvD;AAED;;GAEG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;gBAEtC,WAAW,EAAE,oBAAoB,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,yBAAyB;IAMjG,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAwDpF,kBAAkB;CAwBjC"}

package/workflow/engine/workflow.engine.d.ts

@@ -2,6 +2,7 @@ import { type FrontMcpLogger } from '../../common/interfaces/logger.interface';
 import { type WorkflowExecutionResult } from '../../common/interfaces/workflow.interface';
 import { type WorkflowMetadata } from '../../common/metadata/workflow.metadata';
 import { type JobRegistryInterface } from '../../job/job.registry';
+import { type WorkflowStepExecutorExtra } from './workflow-step.executor';
 /**
  * DAG-based workflow execution engine.
  *
@@ -21,10 +22,7 @@ export declare class WorkflowEngine {
     private readonly stepExecutor;
     private readonly logger;
     private readonly maxConcurrency;
-    constructor(metadata: WorkflowMetadata, jobRegistry: JobRegistryInterface, logger: FrontMcpLogger, extra: {
-        authInfo: Partial<Record<string, unknown>>;
-        contextProviders?: unknown;
-    });
+    constructor(metadata: WorkflowMetadata, jobRegistry: JobRegistryInterface, logger: FrontMcpLogger, extra: WorkflowStepExecutorExtra);
     execute(workflowInput?: Record<string, unknown>): Promise<WorkflowExecutionResult>;
     /**
      * Validate the DAG: detect cycles and missing step references.

package/workflow/engine/workflow.engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.engine.d.ts","sourceRoot":"","sources":["../../../src/workflow/engine/workflow.engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAC1F,OAAO,EACL,KAAK,gBAAgB,EAItB,MAAM,yCAAyC,CAAC;AAMjD,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAGnE;;;;;;;;;;;;;GAaG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuB;IACpD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;gBAGtC,QAAQ,EAAE,gBAAgB,EAC1B,WAAW,EAAE,oBAAoB,EACjC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAAE;IAQ7E,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAoJxF;;OAEG;IACH,OAAO,CAAC,WAAW;CA2CpB"}
+{"version":3,"file":"workflow.engine.d.ts","sourceRoot":"","sources":["../../../src/workflow/engine/workflow.engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAC1F,OAAO,EACL,KAAK,gBAAgB,EAItB,MAAM,yCAAyC,CAAC;AAMjD,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAwB,KAAK,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAEhG;;;;;;;;;;;;;GAaG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuB;IACpD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;gBAGtC,QAAQ,EAAE,gBAAgB,EAC1B,WAAW,EAAE,oBAAoB,EACjC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,yBAAyB;IAQ5B,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAoJxF;;OAEG;IACH,OAAO,CAAC,WAAW;CA2CpB"}

package/workflow/tools/execute-workflow.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute-workflow.tool.d.ts","sourceRoot":"","sources":["../../../src/workflow/tools/execute-workflow.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AAmBjD,MAAM,CAAC,OAAO,OAAO,mBAAoB,SAAQ,WAAW;IACpD,OAAO,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE;CA4B5F"}
+{"version":3,"file":"execute-workflow.tool.d.ts","sourceRoot":"","sources":["../../../src/workflow/tools/execute-workflow.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AAoBjD,MAAM,CAAC,OAAO,OAAO,mBAAoB,SAAQ,WAAW;IACpD,OAAO,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE;CA6B5F"}

package/workflow/tools/get-workflow-status.tool.d.ts

@@ -19,5 +19,17 @@ export default class GetWorkflowStatusTool extends ToolContext {
         startedAt: number;
         completedAt: number | undefined;
     }>;
+    /**
+     * Match on the owning subject, falling back to the session for runs started
+     * before an owner was recorded (and for anonymous/public servers, where every
+     * caller has an empty subject and the session is the only identity there is).
+     *
+     * A record carrying NEITHER identity is refused. Such a run cannot be
+     * attributed to anyone, and its inputs and results are exactly what this check
+     * exists to protect — anyone holding the id would otherwise be able to read
+     * it. Internal callers that must read unattributed runs should go through the
+     * execution manager directly rather than this tool.
+     */
+    private ownsRun;
 }
 //# sourceMappingURL=get-workflow-status.tool.d.ts.map

package/workflow/tools/get-workflow-status.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-workflow-status.tool.d.ts","sourceRoot":"","sources":["../../../src/workflow/tools/get-workflow-status.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AA2BjD,MAAM,CAAC,OAAO,OAAO,qBAAsB,SAAQ,WAAW;IACtD,OAAO,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;CAuBvC"}
+{"version":3,"file":"get-workflow-status.tool.d.ts","sourceRoot":"","sources":["../../../src/workflow/tools/get-workflow-status.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AA4BjD,MAAM,CAAC,OAAO,OAAO,qBAAsB,SAAQ,WAAW;IACtD,OAAO,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;IA0BtC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,OAAO;CAMhB"}

package/workflow/tools/list-workflows.tool.d.ts

@@ -14,5 +14,6 @@ export default class ListWorkflowsTool extends ToolContext {
         }[];
         count: number;
     }>;
+    private maySee;
 }
 //# sourceMappingURL=list-workflows.tool.d.ts.map

package/workflow/tools/list-workflows.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-workflows.tool.d.ts","sourceRoot":"","sources":["../../../src/workflow/tools/list-workflows.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AA0BjD,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,WAAW;IAClD,OAAO,CAAC,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;CAyB1F"}
+{"version":3,"file":"list-workflows.tool.d.ts","sourceRoot":"","sources":["../../../src/workflow/tools/list-workflows.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AA2BjD,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,WAAW;IAClD,OAAO,CAAC,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;YAiC3E,MAAM;CAMrB"}

package/workflow/tools/register-workflow.tool.d.ts

@@ -17,5 +17,6 @@ export default class RegisterWorkflowTool extends ToolContext {
         success: boolean;
         workflowId: string;
     }>;
+    private dynamicRegistrationEnabled;
 }
 //# sourceMappingURL=register-workflow.tool.d.ts.map

package/workflow/tools/register-workflow.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register-workflow.tool.d.ts","sourceRoot":"","sources":["../../../src/workflow/tools/register-workflow.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AA+BjD,MAAM,CAAC,OAAO,OAAO,oBAAqB,SAAQ,WAAW;IACrD,OAAO,CAAC,KAAK,EAAE;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,KAAK,CAAC;YACX,EAAE,EAAE,MAAM,CAAC;YACX,OAAO,EAAE,MAAM,CAAC;YAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;YACrB,eAAe,CAAC,EAAE,OAAO,CAAC;YAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;SAClB,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;QACzC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB;;;;CAgCF"}
+{"version":3,"file":"register-workflow.tool.d.ts","sourceRoot":"","sources":["../../../src/workflow/tools/register-workflow.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AAgCjD,MAAM,CAAC,OAAO,OAAO,oBAAqB,SAAQ,WAAW;IACrD,OAAO,CAAC,KAAK,EAAE;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,KAAK,CAAC;YACX,EAAE,EAAE,MAAM,CAAC;YACX,OAAO,EAAE,MAAM,CAAC;YAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;YACrB,eAAe,CAAC,EAAE,OAAO,CAAC;YAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;SAClB,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;QACzC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB;;;;IAyCD,OAAO,CAAC,0BAA0B;CAInC"}

package/workflow/tools/remove-workflow.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remove-workflow.tool.d.ts","sourceRoot":"","sources":["../../../src/workflow/tools/remove-workflow.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AAejD,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,WAAW;IACnD,OAAO,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE;;;;CAuBtC"}
+{"version":3,"file":"remove-workflow.tool.d.ts","sourceRoot":"","sources":["../../../src/workflow/tools/remove-workflow.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,cAAc,CAAC;AAiBjD,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,WAAW;IACnD,OAAO,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE;;;;CAiCtC"}