@frontmcp/sdk 1.8.2 → 1.8.3

package/auth/instances/instance.local-primary-auth.d.ts

@@ -1,4 +1,4 @@
-import { DcrClientRegistry, SessionCredentialVault, type AuthorizationStore, type ConsentStore, type DcrRegistryConfig, type FederatedAuthSessionStore, type SecureStoreBackend, type OrchestratedTokenStore as TokenStore, type VerifyResult } from '@frontmcp/auth';
+import { DcrClientRegistry, SessionCredentialVault, type AuthorizationStore, type ConsentStore, type DcrRegistryConfig, type FederatedAuthSessionStore, type JSONWebKeySet, type SecureStoreBackend, type OrchestratedTokenStore as TokenStore, type VerifyResult } from '@frontmcp/auth';
 import { FrontMcpAuth, type FrontMcpLogger, type JWK, type ScopeEntry, type ServerRequest } from '../../common';
 import { type LocalAuthOptions, type PublicAuthOptions, type RemoteAuthOptions, type StaticAuthOptions } from '../../common/types/options/auth';
 import type ProviderRegistry from '../../provider/provider.registry';
@@ -78,6 +78,8 @@ export interface UpstreamProviderConfig {
     userInfoEndpoint?: string;
     /** JWKS URI for ID token validation (optional) */
     jwksUri?: string;
+    /** Inline JWKS for ID token validation (optional; wins over `jwksUri`). */
+    jwks?: JSONWebKeySet;
     /** Client ID */
     clientId: string;
     /** Client secret (for confidential clients) */
@@ -96,9 +98,15 @@ export interface UpstreamProviderConfig {
      *   MUST NOT be reused with a different authorization server (SEP-2352).
      *
      * Optional because a provider may be configured by raw endpoints alone; when
-     * absent the `iss` check is skipped (the parameter is only SHOULD-sent).
+     * absent the `iss` check is skipped (the parameter is only SHOULD-sent), and
+     * the provider's `id_token` is not used for identity (its `iss` can't be
+     * checked), unless `verifyIssuer` is explicitly `false`.
      */
     issuer?: string;
+    /** Other issuer values this provider legitimately uses (`providerConfig.additionalIssuers`). */
+    additionalIssuers?: string[];
+    /** `false` turns off the issuer checks for this provider (`providerConfig.verifyIssuer`). */
+    verifyIssuer?: boolean;
 }
 /**
  * Validate an RFC 9207 `iss` authorization-response parameter.
@@ -111,7 +119,9 @@ export interface UpstreamProviderConfig {
  * A missing `iss` is accepted — the AS is only SHOULD-required to send it, so
  * rejecting would break every AS that has not adopted RFC 9207 yet.
  */
-export declare function validateAuthorizationIssuer(received: string | undefined, expected: string | undefined): {
+export declare function validateAuthorizationIssuer(received: string | undefined, expected: string | undefined, 
+/** Other issuer values the provider is configured to use. */
+additional?: readonly string[]): {
     ok: true;
 } | {
     ok: false;
@@ -327,22 +337,39 @@ export declare class LocalPrimaryAuth extends FrontMcpAuth<LocalPrimaryAuthOptio
      * the secure store gets its own adapter).
      */
     private secureStoreSharesTokenStorage;
-    signAnonymousJwt(): Promise<string>;
+    /**
+     * Sign a token for the anonymous grant (`grant_type=anonymous`).
+     *
+     * The holder is anonymous (#270): the subject is an `anon:` id, so
+     * `this.auth.isAnonymous` is true and authorities treat it as no signed-in
+     * user, and its scopes are the configured `anonymousScopes`, never a role.
+     *
+     * @param options.audience The protected resource the token is for (`aud`, #269).
+     */
+    signAnonymousJwt(options?: {
+        audience?: string;
+    }): Promise<string>;
+    /** The scopes an anonymous caller holds: `anonymousScopes`, default `['anonymous']`. */
+    private anonymousScopes;
     /**
      * Cryptographically verify a gateway-issued access token (public/local/remote
      * "gateway" modes). Gateway tokens — both authenticated access tokens
      * ({@link signAccessToken}) and anonymous tokens ({@link signAnonymousJwt}) —
-     * are HS256-signed with `this.secret`, so this instance is the sole holder of
-     * the verification key.
+     * are HS256-signed with `this.secret`.
+     *
+     * The secret alone doesn't make a token this server's: every server started
+     * with the same JWT_SECRET holds it. So a token must also (#269):
+     * - name THIS instance as its issuer (`iss`, the boot-time issuer it signs
+     *   with, never the request-derived base URL), and
+     * - when `expectedAudience` is given, be issued for that protected resource,
+     *   or one of those resources (`aud`, compared as RFC 8707 resource URIs).
+     *   `session:verify` passes the request's resource URL, or the configured
+     *   `auth.expectedAudience` when there is one.
      *
-     * Enforces the signature and lifetime claims (`exp`/`nbf`, checked by `jose`
-     * by default). Issuer equality is intentionally NOT enforced: proxy/tunnel
-     * deployments legitimately present an `iss` that differs from the
-     * request-derived base URL (see {@link deriveIssuer}). Algorithm is pinned to
-     * HS256 to block `alg` confusion (e.g. a forged `alg: none` or asymmetric
-     * header). `expectedIssuer` is accepted for parity/logging only.
+     * Lifetime: `exp` is required (#272) and checked with `nbf` by `jose`. The
+     * algorithm is pinned to HS256 to block `alg` confusion.
      */
-    verifyGatewayToken(token: string, expectedIssuer: string): Promise<VerifyResult>;
+    verifyGatewayToken(token: string, requestBaseUrl: string, expectedAudience?: string | readonly string[]): Promise<VerifyResult>;
     /**
      * Sign an access token for an authenticated user
      */
@@ -350,14 +377,18 @@ export declare class LocalPrimaryAuth extends FrontMcpAuth<LocalPrimaryAuthOptio
     /**
      * Exchange an authorization code for tokens
      */
-    exchangeCode(code: string, clientId: string, redirectUri: string, codeVerifier: string, clientSecret?: string): Promise<TokenResponse | {
+    exchangeCode(code: string, clientId: string, redirectUri: string, codeVerifier: string, clientSecret?: string, 
+    /** The protected resource the token is for when the grant recorded none (#269). */
+    defaultAudience?: string): Promise<TokenResponse | {
         error: string;
         error_description: string;
     }>;
     /**
      * Refresh an access token using a refresh token
      */
-    refreshAccessToken(refreshToken: string, clientId: string, clientSecret?: string): Promise<TokenResponse | {
+    refreshAccessToken(refreshToken: string, clientId: string, clientSecret?: string, 
+    /** The protected resource the token is for when the grant recorded none (#269). */
+    defaultAudience?: string): Promise<TokenResponse | {
         error: string;
         error_description: string;
     }>;
@@ -468,6 +499,18 @@ export declare class LocalPrimaryAuth extends FrontMcpAuth<LocalPrimaryAuthOptio
         picture?: string;
         claims?: Record<string, unknown>;
     }>;
+    /**
+     * Verify an upstream provider's `id_token` and return its claims, or
+     * `undefined` when it doesn't verify or no keys are configured to verify it.
+     *
+     * Checks the signature against the provider's published keys (inline
+     * `jwks`, else `jwksUri`, else the provider's discovery document), the
+     * issuer (the provider, plus `additionalIssuers`, unless `verifyIssuer` is
+     * false), `exp`, and that `aud` names this client. With no issuer configured
+     * (a local-mode provider without `issuer`) the token is not used: a key set
+     * an IdP shares between tenants would vouch for every tenant's tokens.
+     */
+    private verifyProviderIdToken;
     /**
      * Refresh tokens from upstream provider
      */

package/auth/instances/instance.local-primary-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instance.local-primary-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/instances/instance.local-primary-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,iBAAiB,EASjB,sBAAsB,EAMtB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EAGvB,KAAK,sBAAsB,IAAI,UAAU,EACzC,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAaxB,OAAO,EACL,YAAY,EAEZ,KAAK,cAAc,EACnB,KAAK,GAAG,EACR,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAML,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAC;AAmBrE;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAiBnH;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAwBD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,kBAAkB;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAYD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAW9C;AAWD,qBAAa,gBAAiB,SAAQ,YAAY,CAAC,uBAAuB,CAAC;IAmKvE,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,SAAS;IAnKnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAM;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,WAAW,CAA0B;IAE7C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAE9D,gEAAgE;IAChE,OAAO,CAAC,sBAAsB,CAAqB;IAEnD,6DAA6D;IAC7D,OAAO,CAAC,yBAAyB,CAA4B;IAE7D,gDAAgD;IAChD,OAAO,CAAC,0BAA0B,CAAa;IAE/C,4EAA4E;IAC5E,OAAO,CAAC,gBAAgB,CAAe;IAEvC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAoB;IAE1D,yEAAyE;IACzE,OAAO,CAAC,cAAc,CAAC,CAAiB;IAExC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAA0B;IAEtD;;;;OAIG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAAyB;IAErD,0EAA0E;IAC1E,IAAI,eAAe,IAAI,sBAAsB,GAAG,SAAS,CAExD;IAED;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAAC,CAAqB;IAEpD,uDAAuD;IACvD,IAAI,kBAAkB,IAAI,kBAAkB,GAAG,SAAS,CAEvD;IAED,gEAAgE;IAChE,IAAI,kBAAkB,IAAI,kBAAkB,CAE3C;IAED,6DAA6D;IAC7D,IAAI,qBAAqB,IAAI,yBAAyB,CAErD;IAED,gDAAgD;IAChD,IAAI,sBAAsB,IAAI,UAAU,CAEvC;IAED;;;;OAIG;IACH,IAAI,YAAY,IAAI,YAAY,CAE/B;IAED;;;;OAIG;IACH,IAAI,iBAAiB,IAAI,iBAAiB,CAEzC;IAED;;;OAGG;IACH,YAAY,IAAI,iBAAiB,GAAG,SAAS;IAO7C;;;;OAIG;IACH,YAAY,IAAI,OAAO;IAQvB,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6C;IAE7E;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB,CAAC,CAAS;IAEtC,iFAAiF;IACjF,IAAI,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAQ;IAC9C,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;gBAG/C,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,gBAAgB,EACnC,OAAO,EAAE,uBAAuB;IA+ElC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,YAAY;IAmBpB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;OAQG;YACW,gBAAgB;IA8B9B;;;;;;;;;;OAUG;IACH;;;;OAIG;IACH,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;;;;;;;;;;OAaG;IACG,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAuC1E,OAAO,CAAC,sBAAsB;IAkB9B,yEAAyE;IACzE,OAAO,CAAC,8BAA8B;YAUxB,yBAAyB;IAgDvC;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAO7B;;;;;;;;;;;;;;;;OAgBG;YACW,qBAAqB;IA0CnC;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IAO/B,gBAAgB;IAUtB;;;;;;;;;;;;;OAaG;IACY,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAkB/F;;OAEG;IACG,eAAe,CACnB,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,MAAM,CAAC;IAgElB;;OAEG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAyJxE;;OAEG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAiFxE;;OAEG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAElB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAE7B,aAAa,CAAC,EAAE,MAAM,CAAC;QAGvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAE5B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACxC,GAAG,OAAO,CAAC,MAAM,CAAC;cA+BH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsDlC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAItE,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;YAI1C,iBAAiB;IAuB/B;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI;IAyBtD;;;;;;OAMG;YACW,0BAA0B;IA4BxC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,2BAA2B;IAyCnC;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAQ9B;;OAEG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS;IAIzE;;OAEG;IACG,yBAAyB,CAC7B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GACA,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwBzB;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA4EhF;;OAEG;IACG,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IA+E9G;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;CA8CjF"}
+{"version":3,"file":"instance.local-primary-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/instances/instance.local-primary-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,iBAAiB,EASjB,sBAAsB,EAMtB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,aAAa,EAClB,KAAK,kBAAkB,EAGvB,KAAK,sBAAsB,IAAI,UAAU,EACzC,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAYxB,OAAO,EACL,YAAY,EAGZ,KAAK,cAAc,EACnB,KAAK,GAAG,EACR,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAML,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAC;AAmBrE;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAiBnH;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAwBD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,kBAAkB;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gGAAgG;IAChG,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,6FAA6F;IAC7F,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAYD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS;AAC5B,6DAA6D;AAC7D,UAAU,GAAE,SAAS,MAAM,EAAO,GACjC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAY9C;AAyBD,qBAAa,gBAAiB,SAAQ,YAAY,CAAC,uBAAuB,CAAC;IAmKvE,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,SAAS;IAnKnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAM;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,WAAW,CAA0B;IAE7C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAE9D,gEAAgE;IAChE,OAAO,CAAC,sBAAsB,CAAqB;IAEnD,6DAA6D;IAC7D,OAAO,CAAC,yBAAyB,CAA4B;IAE7D,gDAAgD;IAChD,OAAO,CAAC,0BAA0B,CAAa;IAE/C,4EAA4E;IAC5E,OAAO,CAAC,gBAAgB,CAAe;IAEvC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAoB;IAE1D,yEAAyE;IACzE,OAAO,CAAC,cAAc,CAAC,CAAiB;IAExC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAA0B;IAEtD;;;;OAIG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAAyB;IAErD,0EAA0E;IAC1E,IAAI,eAAe,IAAI,sBAAsB,GAAG,SAAS,CAExD;IAED;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAAC,CAAqB;IAEpD,uDAAuD;IACvD,IAAI,kBAAkB,IAAI,kBAAkB,GAAG,SAAS,CAEvD;IAED,gEAAgE;IAChE,IAAI,kBAAkB,IAAI,kBAAkB,CAE3C;IAED,6DAA6D;IAC7D,IAAI,qBAAqB,IAAI,yBAAyB,CAErD;IAED,gDAAgD;IAChD,IAAI,sBAAsB,IAAI,UAAU,CAEvC;IAED;;;;OAIG;IACH,IAAI,YAAY,IAAI,YAAY,CAE/B;IAED;;;;OAIG;IACH,IAAI,iBAAiB,IAAI,iBAAiB,CAEzC;IAED;;;OAGG;IACH,YAAY,IAAI,iBAAiB,GAAG,SAAS;IAO7C;;;;OAIG;IACH,YAAY,IAAI,OAAO;IAQvB,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6C;IAE7E;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB,CAAC,CAAS;IAEtC,iFAAiF;IACjF,IAAI,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAQ;IAC9C,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;gBAG/C,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,gBAAgB,EACnC,OAAO,EAAE,uBAAuB;IA+ElC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,YAAY;IAmBpB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;OAQG;YACW,gBAAgB;IA8B9B;;;;;;;;;;OAUG;IACH;;;;OAIG;IACH,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;;;;;;;;;;OAaG;IACG,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAuC1E,OAAO,CAAC,sBAAsB;IAkB9B,yEAAyE;IACzE,OAAO,CAAC,8BAA8B;YAUxB,yBAAyB;IAgDvC;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAO7B;;;;;;;;;;;;;;;;OAgBG;YACW,qBAAqB;IA0CnC;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IAOrC;;;;;;;;OAQG;IACG,gBAAgB,CAAC,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO;IAW1D,wFAAwF;IACxF,OAAO,CAAC,eAAe;IAKvB;;;;;;;;;;;;;;;;;OAiBG;IACY,kBAAkB,CAC/B,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,MAAM,EACtB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAC5C,OAAO,CAAC,YAAY,CAAC;IAuBxB;;OAEG;IACG,eAAe,CACnB,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,MAAM,CAAC;IAgElB;;OAEG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM;IACrB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA4JxE;;OAEG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,MAAM;IACrB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAmFxE;;OAEG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAElB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAE7B,aAAa,CAAC,EAAE,MAAM,CAAC;QAGvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAE5B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACxC,GAAG,OAAO,CAAC,MAAM,CAAC;cA+BH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsDlC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAItE,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;YAI1C,iBAAiB;IAuB/B;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI;IAyBtD;;;;;;OAMG;YACW,0BAA0B;IA4BxC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,2BAA2B;IA2CnC;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sBAAsB;IA2C9B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAQ9B;;OAEG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS;IAIzE;;OAEG;IACG,yBAAyB,CAC7B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GACA,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwBzB;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA4EhF;;OAEG;IACG,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAiE9G;;;;;;;;;;OAUG;YACW,qBAAqB;IAgCnC;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;CA8CjF"}

package/common/availability/availability.utils.d.ts

@@ -16,7 +16,35 @@
  * lifetime of the process — the OS, runtime, and deployment mode don't change.
  */
 import { type EntryAvailability } from '@frontmcp/utils';
+import { EntryUnavailableError } from '../../errors/mcp.error';
 import type { FrontMcpLogger } from '../interfaces/logger.interface';
+/** Who is calling (`availableWhen.surface`): the one axis that varies per call. */
+export type CallSurface = NonNullable<EntryAvailability['surface']>[number];
+/**
+ * The surface a flow was called from, when its caller tagged one. The MCP request handlers tag
+ * every call (`'mcp'`, or `'cli'` for the in-process client of a CLI build). An in-process dispatch
+ * such as `this.callTool()` tags none.
+ */
+export declare function callSurfaceOf(ctx: unknown): CallSurface | undefined;
+/**
+ * Whether `availableWhen.surface` offers an entry to a call from `surface`. A call without a surface
+ * is not restricted by this axis (an empty `surface` list is refused by the process-wide check).
+ */
+export declare function isOfferedOnSurface(availability: EntryAvailability | undefined, surface: CallSurface | undefined): boolean;
+/**
+ * How `availableWhen` answers a call that found an entry by name or URI.
+ *
+ * - `'not-offered'`: the call's surface is excluded. Answer as for an unknown entry, so a caller on
+ *   that surface cannot tell the entry exists (an agent-only tool over MCP, say).
+ * - `'unavailable'`: a process-wide axis (os, runtime, deployment, provider, target, env) excludes
+ *   it. Listings already leave such entries out; a call by name must not reach them either.
+ */
+export declare function availabilityForCall(availability: EntryAvailability | undefined, surface: CallSurface | undefined): 'available' | 'not-offered' | 'unavailable';
+/**
+ * The structured error for an entry a process-wide `availableWhen` axis excludes (issue #417), as
+ * `tools/call` has answered since that issue.
+ */
+export declare function entryUnavailableError(entryType: string, entryName: string, availability: EntryAvailability | undefined, surface: CallSurface | undefined): EntryUnavailableError;
 /**
  * Log availability filtering results for a set of entries at registry boot time.
  *

package/common/availability/availability.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"availability.utils.d.ts","sourceRoot":"","sources":["../../../src/common/availability/availability.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAA4D,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACnH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE;QAAE,aAAa,CAAC,EAAE,iBAAiB,CAAA;KAAE,CAAA;CAAE,EAClH,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,SAAS,CAAC,EAAE,EACrB,MAAM,EAAE,cAAc,GACrB,IAAI,CA2DN"}
+{"version":3,"file":"availability.utils.d.ts","sourceRoot":"","sources":["../../../src/common/availability/availability.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAIL,KAAK,iBAAiB,EAEvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,mFAAmF;AACnF,MAAM,MAAM,WAAW,GAAG,WAAW,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAI5E;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAGnE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,iBAAiB,GAAG,SAAS,EAC3C,OAAO,EAAE,WAAW,GAAG,SAAS,GAC/B,OAAO,CAGT;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,iBAAiB,GAAG,SAAS,EAC3C,OAAO,EAAE,WAAW,GAAG,SAAS,GAC/B,WAAW,GAAG,aAAa,GAAG,aAAa,CAG7C;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,iBAAiB,GAAG,SAAS,EAC3C,OAAO,EAAE,WAAW,GAAG,SAAS,GAC/B,qBAAqB,CAIvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE;QAAE,aAAa,CAAC,EAAE,iBAAiB,CAAA;KAAE,CAAA;CAAE,EAClH,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,SAAS,CAAC,EAAE,EACrB,MAAM,EAAE,cAAc,GACrB,IAAI,CA2DN"}

package/common/availability/index.d.ts

@@ -1,2 +1,2 @@
-export { logAvailabilityFiltering } from './availability.utils';
+export { availabilityForCall, callSurfaceOf, entryUnavailableError, isOfferedOnSurface, logAvailabilityFiltering, type CallSurface, } from './availability.utils';
 //# sourceMappingURL=index.d.ts.map

package/common/availability/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/common/availability/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/common/availability/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,KAAK,WAAW,GACjB,MAAM,sBAAsB,CAAC"}

package/common/decorators/plugin.decorator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.decorator.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/plugin.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAgC,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAGhF;;GAEG;AACH,iBAAS,cAAc,CAAC,gBAAgB,EAAE,cAAc,GAAG,cAAc,CA4BxE;AAED,OAAO,EAAE,cAAc,EAAE,cAAc,IAAI,MAAM,EAAE,CAAC"}
+{"version":3,"file":"plugin.decorator.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/plugin.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAgC,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAIhF;;GAEG;AACH,iBAAS,cAAc,CAAC,gBAAgB,EAAE,cAAc,GAAG,cAAc,CAiCxE;AAED,OAAO,EAAE,cAAc,EAAE,cAAc,IAAI,MAAM,EAAE,CAAC"}

package/common/interfaces/internal/primary-auth-provider.interface.d.ts

@@ -37,13 +37,15 @@ export declare abstract class FrontMcpAuth<Options extends AuthOptions = AuthOpt
      * with a real signature + expiration check. Transparent mode never calls this
      * — it verifies against the upstream provider's JWKS instead.
      *
-     * @param _token          The raw bearer token (already confirmed to be a JWT).
-     * @param _expectedIssuer The request-derived base URL. Provided for context /
-     *                        logging; issuer equality is intentionally NOT enforced
-     *                        (proxy/tunnel setups legitimately present `iss` ≠
-     *                        baseUrl). Signature + expiration are the security core.
+     * @param _token            The raw bearer token (already confirmed to be a JWT).
+     * @param _requestBaseUrl    The request-derived base URL, for context / logging.
+     *                           The token's `iss` must be this instance's own
+     *                           issuer, not this request-derived value.
+     * @param _expectedAudience  The protected resource(s) the token must be for
+     *                           (`aud` names at least one), when the caller is a
+     *                           resource endpoint.
      */
-    verifyGatewayToken(_token: string, _expectedIssuer: string): Promise<VerifyResult>;
+    verifyGatewayToken(_token: string, _requestBaseUrl: string, _expectedAudience?: string | readonly string[]): Promise<VerifyResult>;
 }
 export { FrontMcpAuth as Auth };
 //# sourceMappingURL=primary-auth-provider.interface.d.ts.map

package/common/interfaces/internal/primary-auth-provider.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"primary-auth-provider.interface.d.ts","sourceRoot":"","sources":["../../../../src/common/interfaces/internal/primary-auth-provider.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAezD;;;;;;;;;;;GAWG;AACH,8BAAsB,YAAY,CAAC,OAAO,SAAS,WAAW,GAAG,WAAW;IAC1E,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBAER,OAAO,EAAE,OAAO;IAK5B;;;;OAIG;IACH,OAAO,CAAC,QAAQ;IAoBhB,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAE/E,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAExD,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC;IAE9B;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;CAMnF;AAED,OAAO,EAAE,YAAY,IAAI,IAAI,EAAE,CAAC"}
+{"version":3,"file":"primary-auth-provider.interface.d.ts","sourceRoot":"","sources":["../../../../src/common/interfaces/internal/primary-auth-provider.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAezD;;;;;;;;;;;GAWG;AACH,8BAAsB,YAAY,CAAC,OAAO,SAAS,WAAW,GAAG,WAAW;IAC1E,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBAER,OAAO,EAAE,OAAO;IAK5B;;;;OAIG;IACH,OAAO,CAAC,QAAQ;IAoBhB,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAE/E,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAExD,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC;IAE9B;;;;;;;;;;;;;;;;;OAiBG;IACH,kBAAkB,CAChB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAC7C,OAAO,CAAC,YAAY,CAAC;CAMzB;AAED,OAAO,EAAE,YAAY,IAAI,IAAI,EAAE,CAAC"}

package/common/metadata/app.metadata.d.ts

@@ -236,6 +236,8 @@ export declare const frontMcpLocalAppMetadataSchema: import("@frontmcp/lazy-zod"
             scopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
             userInfoEndpoint: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
             jwksUri: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            issuer: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            additionalIssuers: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
         }, import("zod/v4/core").$strip>>>;
         dcr: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             enabled: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
@@ -390,6 +392,7 @@ export declare const frontMcpLocalAppMetadataSchema: import("@frontmcp/lazy-zod"
             showAllAppsAtOnce: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
         }, import("zod/v4/core").$strip>>;
         requireRegisteredClients: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+        allowedScopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
         cimd: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             enabled: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
             cache: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
@@ -565,6 +568,7 @@ export declare const frontMcpLocalAppMetadataSchema: import("@frontmcp/lazy-zod"
             showAllAppsAtOnce: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
         }, import("zod/v4/core").$strip>>;
         requireRegisteredClients: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+        allowedScopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
         cimd: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             enabled: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
             cache: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
@@ -990,6 +994,8 @@ export declare const frontMcpRemoteAppMetadataSchema: import("@frontmcp/lazy-zod
             scopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
             userInfoEndpoint: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
             jwksUri: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            issuer: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            additionalIssuers: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
         }, import("zod/v4/core").$strip>>>;
         dcr: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             enabled: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
@@ -1144,6 +1150,7 @@ export declare const frontMcpRemoteAppMetadataSchema: import("@frontmcp/lazy-zod
             showAllAppsAtOnce: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
         }, import("zod/v4/core").$strip>>;
         requireRegisteredClients: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+        allowedScopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
         cimd: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             enabled: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
             cache: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
@@ -1319,6 +1326,7 @@ export declare const frontMcpRemoteAppMetadataSchema: import("@frontmcp/lazy-zod
             showAllAppsAtOnce: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
         }, import("zod/v4/core").$strip>>;
         requireRegisteredClients: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+        allowedScopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
         cimd: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             enabled: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
             cache: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{

package/common/metadata/app.metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.metadata.d.ts","sourceRoot":"","sources":["../../../src/common/metadata/app.metadata.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAGvC,OAAO,KAAK,EACV,WAAW,EACX,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,OAAO,EACP,UAAU,EACV,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,YAAY,EACb,MAAM,eAAe,CAAC;AAevB,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,UAAU,CAAC;AACnE,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAElF;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAE3B;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAEnC;;;;OAIG;IACH,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IAEvB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IAEzB;;;;OAIG;IACH,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IAEvB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;IAErB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;IAErB;;;OAGG;IACH,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IAEjB;;;OAGG;IACH,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IAEzB;;;OAGG;IACH,IAAI,CAAC,EAAE,gBAAgB,CAAC;IAExB;;;OAGG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IAEtB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC;CAY1C;AAED,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAwBD,CAAC;AAM3C;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GACxB;IACE;;;OAGG;IACH,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,uBAAuB,CAAC;CACtC,GACD;IACE;;;OAGG;IACH,IAAI,EAAE,SAAS,CAAC;IAChB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACD;IACE;;;OAGG;IACH,IAAI,EAAE,OAAO,CAAC;CACf,CAAC;AAEN;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;oFACgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;;OAMG;IACH,OAAO,EAAE,QAAQ,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;IAE1C;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAE1C;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAE9B;;;OAGG;IACH,IAAI,CAAC,EAAE,gBAAgB,CAAC;IAExB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,aAAa,CAAC,EAAE;QACd;;;WAGG;QACH,MAAM,CAAC,EAAE,aAAa,CAAC;QACvB,yDAAyD;QACzD,UAAU,CAAC,EAAE;YACX,wCAAwC;YACxC,OAAO,EAAE,OAAO,CAAC;YACjB,iEAAiE;YACjE,UAAU,CAAC,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,qEAAqE;QACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,8CAA8C;QAC9C,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACpC,CAAC;IAEF;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;IAEzB;;;;;OAKG;IACH,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC;CACzC;AAED,eAAO,MAAM,mBAAmB;;;;;gCAK9B,CAAC;AA2CH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA4BzC,CAAC;AAEJ,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAM/D;;;GAGG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,UAAU,CAAC,EAAE,OAAO,GAAG,iBAAiB,CAAC;IACzC,yDAAyD;IACzD,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,kEAAkE;IAClE,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,UAAU,CAAC,EAAE,OAAO,GAAG,iBAAiB,CAAC;IACzC,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B"}
+{"version":3,"file":"app.metadata.d.ts","sourceRoot":"","sources":["../../../src/common/metadata/app.metadata.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAGvC,OAAO,KAAK,EACV,WAAW,EACX,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,OAAO,EACP,UAAU,EACV,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,YAAY,EACb,MAAM,eAAe,CAAC;AAevB,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,UAAU,CAAC;AACnE,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAElF;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAE3B;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAEnC;;;;OAIG;IACH,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IAEvB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IAEzB;;;;OAIG;IACH,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IAEvB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;IAErB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;IAErB;;;OAGG;IACH,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IAEjB;;;OAGG;IACH,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IAEzB;;;OAGG;IACH,IAAI,CAAC,EAAE,gBAAgB,CAAC;IAExB;;;OAGG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IAEtB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC;CAY1C;AAED,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAwBD,CAAC;AAM3C;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GACxB;IACE;;;OAGG;IACH,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,uBAAuB,CAAC;CACtC,GACD;IACE;;;OAGG;IACH,IAAI,EAAE,SAAS,CAAC;IAChB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACD;IACE;;;OAGG;IACH,IAAI,EAAE,OAAO,CAAC;CACf,CAAC;AAEN;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;oFACgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;;OAMG;IACH,OAAO,EAAE,QAAQ,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;IAE1C;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAE1C;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAE9B;;;OAGG;IACH,IAAI,CAAC,EAAE,gBAAgB,CAAC;IAExB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,aAAa,CAAC,EAAE;QACd;;;WAGG;QACH,MAAM,CAAC,EAAE,aAAa,CAAC;QACvB,yDAAyD;QACzD,UAAU,CAAC,EAAE;YACX,wCAAwC;YACxC,OAAO,EAAE,OAAO,CAAC;YACjB,iEAAiE;YACjE,UAAU,CAAC,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,qEAAqE;QACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,8CAA8C;QAC9C,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACpC,CAAC;IAEF;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;IAEzB;;;;;OAKG;IACH,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC;CACzC;AAED,eAAO,MAAM,mBAAmB;;;;;gCAK9B,CAAC;AA2CH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA4BzC,CAAC;AAEJ,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAM/D;;;GAGG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,UAAU,CAAC,EAAE,OAAO,GAAG,iBAAiB,CAAC;IACzC,yDAAyD;IACzD,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,kEAAkE;IAClE,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,UAAU,CAAC,EAAE,OAAO,GAAG,iBAAiB,CAAC;IACzC,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B"}

package/common/metadata/front-mcp.metadata.d.ts

@@ -2337,6 +2337,8 @@ declare const frontMcpMultiAppSchema: import("@frontmcp/lazy-zod").ZodObject<{
             scopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
             userInfoEndpoint: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
             jwksUri: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            issuer: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            additionalIssuers: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
         }, import("zod/v4/core").$strip>>>;
         dcr: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             enabled: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
@@ -2491,6 +2493,7 @@ declare const frontMcpMultiAppSchema: import("@frontmcp/lazy-zod").ZodObject<{
             showAllAppsAtOnce: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
         }, import("zod/v4/core").$strip>>;
         requireRegisteredClients: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+        allowedScopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
         cimd: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             enabled: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
             cache: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
@@ -2666,6 +2669,7 @@ declare const frontMcpMultiAppSchema: import("@frontmcp/lazy-zod").ZodObject<{
             showAllAppsAtOnce: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
         }, import("zod/v4/core").$strip>>;
         requireRegisteredClients: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+        allowedScopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
         cimd: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             enabled: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
             cache: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
@@ -3722,6 +3726,8 @@ declare const frontMcpSplitByAppSchema: import("@frontmcp/lazy-zod").ZodObject<{
             scopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
             userInfoEndpoint: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
             jwksUri: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            issuer: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            additionalIssuers: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
         }, import("zod/v4/core").$strip>>>;
         dcr: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             enabled: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
@@ -3876,6 +3882,7 @@ declare const frontMcpSplitByAppSchema: import("@frontmcp/lazy-zod").ZodObject<{
             showAllAppsAtOnce: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
         }, import("zod/v4/core").$strip>>;
         requireRegisteredClients: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+        allowedScopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
         cimd: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             enabled: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
             cache: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
@@ -4051,6 +4058,7 @@ declare const frontMcpSplitByAppSchema: import("@frontmcp/lazy-zod").ZodObject<{
             showAllAppsAtOnce: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
         }, import("zod/v4/core").$strip>>;
         requireRegisteredClients: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+        allowedScopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
         cimd: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             enabled: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
             cache: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
@@ -5104,6 +5112,8 @@ export declare const frontMcpMetadataSchema: import("zod").ZodPipe<import("@fron
             scopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
             userInfoEndpoint: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
             jwksUri: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            issuer: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            additionalIssuers: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
         }, import("zod/v4/core").$strip>>>;
         dcr: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             enabled: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
@@ -5258,6 +5268,7 @@ export declare const frontMcpMetadataSchema: import("zod").ZodPipe<import("@fron
             showAllAppsAtOnce: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
         }, import("zod/v4/core").$strip>>;
         requireRegisteredClients: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+        allowedScopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
         cimd: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             enabled: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
             cache: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
@@ -5433,6 +5444,7 @@ export declare const frontMcpMetadataSchema: import("zod").ZodPipe<import("@fron
             showAllAppsAtOnce: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
         }, import("zod/v4/core").$strip>>;
         requireRegisteredClients: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+        allowedScopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
         cimd: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             enabled: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
             cache: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
@@ -6484,6 +6496,8 @@ export declare const frontMcpMetadataSchema: import("zod").ZodPipe<import("@fron
             scopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
             userInfoEndpoint: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
             jwksUri: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            issuer: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            additionalIssuers: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
         }, import("zod/v4/core").$strip>>>;
         dcr: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             enabled: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
@@ -6638,6 +6652,7 @@ export declare const frontMcpMetadataSchema: import("zod").ZodPipe<import("@fron
             showAllAppsAtOnce: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
         }, import("zod/v4/core").$strip>>;
         requireRegisteredClients: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+        allowedScopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
         cimd: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             enabled: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
             cache: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
@@ -6813,6 +6828,7 @@ export declare const frontMcpMetadataSchema: import("zod").ZodPipe<import("@fron
             showAllAppsAtOnce: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
         }, import("zod/v4/core").$strip>>;
         requireRegisteredClients: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
+        allowedScopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
         cimd: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
             enabled: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
             cache: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
@@ -7495,6 +7511,8 @@ export declare const frontMcpMetadataSchema: import("zod").ZodPipe<import("@fron
             scopes?: string[] | undefined;
             userInfoEndpoint?: string | undefined;
             jwksUri?: string | undefined;
+            issuer?: string | undefined;
+            additionalIssuers?: string[] | undefined;
         }[] | undefined;
         dcr?: {
             enabled?: boolean | undefined;
@@ -7595,6 +7613,7 @@ export declare const frontMcpMetadataSchema: import("zod").ZodPipe<import("@fron
             allowSkip: boolean;
             showAllAppsAtOnce: boolean;
         } | undefined;
+        allowedScopes?: string[] | undefined;
         cimd?: {
             enabled: boolean;
             cache?: {
@@ -7736,6 +7755,7 @@ export declare const frontMcpMetadataSchema: import("zod").ZodPipe<import("@fron
             allowSkip: boolean;
             showAllAppsAtOnce: boolean;
         } | undefined;
+        allowedScopes?: string[] | undefined;
         cimd?: {
             enabled: boolean;
             cache?: {
@@ -8403,6 +8423,8 @@ export declare const frontMcpMetadataSchema: import("zod").ZodPipe<import("@fron
             scopes?: string[] | undefined;
             userInfoEndpoint?: string | undefined;
             jwksUri?: string | undefined;
+            issuer?: string | undefined;
+            additionalIssuers?: string[] | undefined;
         }[] | undefined;
         dcr?: {
             enabled?: boolean | undefined;
@@ -8503,6 +8525,7 @@ export declare const frontMcpMetadataSchema: import("zod").ZodPipe<import("@fron
             allowSkip: boolean;
             showAllAppsAtOnce: boolean;
         } | undefined;
+        allowedScopes?: string[] | undefined;
         cimd?: {
             enabled: boolean;
             cache?: {
@@ -8644,6 +8667,7 @@ export declare const frontMcpMetadataSchema: import("zod").ZodPipe<import("@fron
             allowSkip: boolean;
             showAllAppsAtOnce: boolean;
         } | undefined;
+        allowedScopes?: string[] | undefined;
         cimd?: {
             enabled: boolean;
             cache?: {
@@ -9311,6 +9335,8 @@ export declare const frontMcpMetadataSchema: import("zod").ZodPipe<import("@fron
             scopes?: string[] | undefined;
             userInfoEndpoint?: string | undefined;
             jwksUri?: string | undefined;
+            issuer?: string | undefined;
+            additionalIssuers?: string[] | undefined;
         }[] | undefined;
         dcr?: {
             enabled?: boolean | undefined;
@@ -9411,6 +9437,7 @@ export declare const frontMcpMetadataSchema: import("zod").ZodPipe<import("@fron
             allowSkip: boolean;
             showAllAppsAtOnce: boolean;
         } | undefined;
+        allowedScopes?: string[] | undefined;
         cimd?: {
             enabled: boolean;
             cache?: {
@@ -9552,6 +9579,7 @@ export declare const frontMcpMetadataSchema: import("zod").ZodPipe<import("@fron
             allowSkip: boolean;
             showAllAppsAtOnce: boolean;
         } | undefined;
+        allowedScopes?: string[] | undefined;
         cimd?: {
             enabled: boolean;
             cache?: {
@@ -10219,6 +10247,8 @@ export declare const frontMcpMetadataSchema: import("zod").ZodPipe<import("@fron
             scopes?: string[] | undefined;
             userInfoEndpoint?: string | undefined;
             jwksUri?: string | undefined;
+            issuer?: string | undefined;
+            additionalIssuers?: string[] | undefined;
         }[] | undefined;
         dcr?: {
             enabled?: boolean | undefined;
@@ -10319,6 +10349,7 @@ export declare const frontMcpMetadataSchema: import("zod").ZodPipe<import("@fron
             allowSkip: boolean;
             showAllAppsAtOnce: boolean;
         } | undefined;
+        allowedScopes?: string[] | undefined;
         cimd?: {
             enabled: boolean;
             cache?: {
@@ -10460,6 +10491,7 @@ export declare const frontMcpMetadataSchema: import("zod").ZodPipe<import("@fron
             allowSkip: boolean;
             showAllAppsAtOnce: boolean;
         } | undefined;
+        allowedScopes?: string[] | undefined;
         cimd?: {
             enabled: boolean;
             cache?: {