@frontmcp/sdk 1.8.2 → 1.8.4

package/auth/flows/signin-binding.utils.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The HTTP side of the sign-in binding (see `createSigninBinding` in
+ * `@frontmcp/auth`): the cookie `/oauth/authorize` sets, and the check the
+ * callbacks run before resuming a sign-in.
+ */
+import { type SigninBinding } from '@frontmcp/auth';
+import { type HttpCookie, type ServerRequest } from '../../common';
+/**
+ * Path of the binding cookie: `/oauth`, where the OAuth endpoints live, unless
+ * the server's issuer or scope carries a path prefix, which the provider
+ * callback URL (`<issuer>/oauth/provider/<id>/callback`) and the federated
+ * consent form include. Then `/`, so the cookie still reaches them.
+ */
+export declare function signinCookiePath(issuer: string, scopePath: string): string;
+/**
+ * Whether the browser reached this request over https. The binding cookie is then a `__Host-`
+ * cookie (`Secure`, `Path=/`, no `Domain`), which no other host can set in the browser.
+ */
+export declare function signinOverHttps(request: ServerRequest): boolean;
+/**
+ * The binding for a new sign-in started by `request`: named `__Host-…` when the browser came over
+ * https (see {@link signinOverHttps}).
+ */
+export declare function createRequestSigninBinding(request: ServerRequest, pendingAuthId: string): SigninBinding;
+/**
+ * The cookie that gives the browser its binding: HttpOnly and SameSite=Lax. Over https it is the
+ * `__Host-` cookie, so `Secure` with `Path=/` (the prefix requires both); otherwise it is scoped to `path`.
+ */
+export declare function signinBindingCookie(request: ServerRequest, binding: SigninBinding, path: string): HttpCookie;
+/** A `Set-Cookie` that removes the binding cookie of `pendingAuthId` once its sign-in is over. */
+export declare function clearedSigninBindingCookie(request: ServerRequest, pendingAuthId: string, path: string): HttpCookie;
+/**
+ * Whether `request` comes from the browser that started the sign-in `pendingAuthId` (its binding hash
+ * is `hash`). Over https only the `__Host-` cookie counts: a same-named cookie without the prefix may
+ * have been planted by a sibling host.
+ */
+export declare function requestHoldsSigninBinding(request: ServerRequest, pendingAuthId: string, hash: string | undefined): boolean;
+/** `output` with `cookie` added to the cookies it sets. */
+export declare function withCookie<T extends {
+    cookies?: HttpCookie[];
+}>(output: T, cookie: HttpCookie): T;
+/** The error text for a sign-in resumed without its binding cookie. */
+export declare const SIGNIN_BINDING_REFUSED = "This sign-in was started in another browser, or at another address. Start it again from the app.";
+//# sourceMappingURL=signin-binding.utils.d.ts.map

package/auth/flows/signin-binding.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signin-binding.utils.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/signin-binding.utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAA0C,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAE3G;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAQ1E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAK/D;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,GAAG,aAAa,CAEvG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAa5G;AAED,kGAAkG;AAClG,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAWlH;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,aAAa,EACtB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAIT;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,CAAC,SAAS;IAAE,OAAO,CAAC,EAAE,UAAU,EAAE,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,GAAG,CAAC,CAEjG;AAED,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,qGACiE,CAAC"}

package/auth/flows/well-known.oauth-authorization-server.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"well-known.oauth-authorization-server.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/well-known.oauth-authorization-server.flow.ts"],"names":[],"mappings":"AACA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAGvC,OAAO,EAGL,QAAQ,EAWR,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AAoBtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAgCpC,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAA0E,CAAC;AAEpG,eAAO,MAAM,sBAAsB;;;;;;;;;;;;gCAgBjC,CAAC;AAEH,QAAA,MAAM,eAAe;;;CAGgB,CAAC;AAEtC,KAAK,eAAe,GAAG,OAAO,eAAe,CAAC;AAC9C,KAAK,sBAAsB,GAAG,cAAc,CAC1C,eAAe,EACf,eAAe,EACf,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,sBAAsB,CAC9B,CAAC;AAEF,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,uCAAuC,EAAE,sBAAsB,CAAC;KACjE;CACF;AAED,QAAA,MAAM,IAAI,EAAG,uCAAgD,CAAC;AAa9D,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAChE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU;IAKtD,aAAa;IAKb,UAAU;IA+BV,WAAW;CAoDlB"}
+{"version":3,"file":"well-known.oauth-authorization-server.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/well-known.oauth-authorization-server.flow.ts"],"names":[],"mappings":"AACA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAGvC,OAAO,EAGL,QAAQ,EAWR,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AAoBtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAgCpC,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAA0E,CAAC;AAEpG,eAAO,MAAM,sBAAsB;;;;;;;;;;;;gCAgBjC,CAAC;AAEH,QAAA,MAAM,eAAe;;;CAGgB,CAAC;AAEtC,KAAK,eAAe,GAAG,OAAO,eAAe,CAAC;AAC9C,KAAK,sBAAsB,GAAG,cAAc,CAC1C,eAAe,EACf,eAAe,EACf,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,sBAAsB,CAC9B,CAAC;AAEF,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,uCAAuC,EAAE,sBAAsB,CAAC;KACjE;CACF;AAED,QAAA,MAAM,IAAI,EAAG,uCAAgD,CAAC;AAa9D,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IAChE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU;IAKtD,aAAa;IAKb,UAAU;IAkCV,WAAW;CAoDlB"}

package/auth/flows/well-known.prm.flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"well-known.prm.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/well-known.prm.flow.ts"],"names":[],"mappings":"AACA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAIL,QAAQ,EAOR,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AAGtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;gCAKf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;gCAShB,CAAC;AAEH,QAAA,MAAM,IAAI;;;;CAI2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,qCAAqC,EAAE,cAAc,CACnD,gBAAgB,EAChB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,qCAA8C,CAAC;AAa5D,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IACjE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU;IAKtD,aAAa;IAKb,UAAU;IAiBY,WAAW;CAwCxC"}
+{"version":3,"file":"well-known.prm.flow.d.ts","sourceRoot":"","sources":["../../../src/auth/flows/well-known.prm.flow.ts"],"names":[],"mappings":"AACA,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAIL,QAAQ,EAQR,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AAGtB,QAAA,MAAM,WAAW;;;;gCAAkB,CAAC;AAEpC,QAAA,MAAM,WAAW;;;;;gCAKf,CAAC;AAEH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;gCAShB,CAAC;AAEH,QAAA,MAAM,IAAI;;;;CAI2B,CAAC;AAEtC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,WAAW;QACnB,qCAAqC,EAAE,cAAc,CACnD,gBAAgB,EAChB,OAAO,IAAI,EACX,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,OAAO,WAAW,CACnB,CAAC;KACH;CACF;AAED,QAAA,MAAM,IAAI,EAAG,qCAA8C,CAAC;AAa5D,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,QAAQ,CAAC,OAAO,IAAI,CAAC;IACjE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU;IAKtD,aAAa;IAKb,UAAU;IAsBY,WAAW;CAwCxC"}

package/auth/instances/instance.local-primary-auth.d.ts

@@ -1,4 +1,4 @@
-import { DcrClientRegistry, SessionCredentialVault, type AuthorizationStore, type ConsentStore, type DcrRegistryConfig, type FederatedAuthSessionStore, type SecureStoreBackend, type OrchestratedTokenStore as TokenStore, type VerifyResult } from '@frontmcp/auth';
+import { DcrClientRegistry, SessionCredentialVault, type AuthorizationStore, type ConsentStore, type DcrRegistryConfig, type FederatedAuthSessionStore, type JSONWebKeySet, type SecureStoreBackend, type OrchestratedTokenStore as TokenStore, type VerifyResult } from '@frontmcp/auth';
 import { FrontMcpAuth, type FrontMcpLogger, type JWK, type ScopeEntry, type ServerRequest } from '../../common';
 import { type LocalAuthOptions, type PublicAuthOptions, type RemoteAuthOptions, type StaticAuthOptions } from '../../common/types/options/auth';
 import type ProviderRegistry from '../../provider/provider.registry';
@@ -78,6 +78,8 @@ export interface UpstreamProviderConfig {
     userInfoEndpoint?: string;
     /** JWKS URI for ID token validation (optional) */
     jwksUri?: string;
+    /** Inline JWKS for ID token validation (optional; wins over `jwksUri`). */
+    jwks?: JSONWebKeySet;
     /** Client ID */
     clientId: string;
     /** Client secret (for confidential clients) */
@@ -96,9 +98,15 @@ export interface UpstreamProviderConfig {
      *   MUST NOT be reused with a different authorization server (SEP-2352).
      *
      * Optional because a provider may be configured by raw endpoints alone; when
-     * absent the `iss` check is skipped (the parameter is only SHOULD-sent).
+     * absent the `iss` check is skipped (the parameter is only SHOULD-sent), and
+     * the provider's `id_token` is not used for identity (its `iss` can't be
+     * checked), unless `verifyIssuer` is explicitly `false`.
      */
     issuer?: string;
+    /** Other issuer values this provider legitimately uses (`providerConfig.additionalIssuers`). */
+    additionalIssuers?: string[];
+    /** `false` turns off the issuer checks for this provider (`providerConfig.verifyIssuer`). */
+    verifyIssuer?: boolean;
 }
 /**
  * Validate an RFC 9207 `iss` authorization-response parameter.
@@ -111,7 +119,9 @@ export interface UpstreamProviderConfig {
  * A missing `iss` is accepted — the AS is only SHOULD-required to send it, so
  * rejecting would break every AS that has not adopted RFC 9207 yet.
  */
-export declare function validateAuthorizationIssuer(received: string | undefined, expected: string | undefined): {
+export declare function validateAuthorizationIssuer(received: string | undefined, expected: string | undefined, 
+/** Other issuer values the provider is configured to use. */
+additional?: readonly string[]): {
     ok: true;
 } | {
     ok: false;
@@ -122,7 +132,10 @@ export declare class LocalPrimaryAuth extends FrontMcpAuth<LocalPrimaryAuthOptio
     private providers;
     readonly host: string;
     readonly port: number;
+    /** The boot-time issuer: the configured one, else this server's listener address (see {@link issuerFor}). */
     readonly issuer: string;
+    /** Whether the operator named the issuer (`issuer` / `local.issuer`, or its host with `FRONTMCP_PUBLIC_HOST`). */
+    private readonly issuerIsConfigured;
     readonly keys: JWK[];
     readonly secret: Uint8Array;
     readonly logger: FrontMcpLogger;
@@ -245,6 +258,24 @@ export declare class LocalPrimaryAuth extends FrontMcpAuth<LocalPrimaryAuthOptio
      * supported knob for aligning the issuer with discovery.
      */
     private deriveIssuer;
+    /** The issuer the options name: `issuer` in public mode, `local.issuer` in local and remote mode. */
+    private configuredIssuer;
+    /**
+     * The issuer (`iss`) this server names on the tokens it issues in answer to
+     * `request`, and requires on the tokens it accepts there (#269). Issuing and
+     * verifying both ask this, so they can't disagree:
+     *
+     * - a configured issuer (`issuer` / `local.issuer`) is the issuer;
+     * - with `FRONTMCP_PUBLIC_URL` pinned, the issuer is that URL plus this
+     *   scope's path, the address discovery advertises;
+     * - with `FRONTMCP_PUBLIC_HOST` or `expectedAudience` set, the boot-time
+     *   issuer, so a token serves at every address the server answers to;
+     * - a request that came through a Web fetch handler (a Worker, Deno, Bun, a
+     *   Durable Object) has no listener the boot-time issuer could describe, so
+     *   the issuer is the request's own origin plus this scope's path;
+     * - otherwise (the Node server) the boot-time issuer.
+     */
+    issuerFor(request?: ServerRequest): string;
     /**
      * Read the `tokenStorage` selection off the auth options. Only
      * local/remote/orchestrated modes declare it; public mode does not, in which
@@ -327,37 +358,68 @@ export declare class LocalPrimaryAuth extends FrontMcpAuth<LocalPrimaryAuthOptio
      * the secure store gets its own adapter).
      */
     private secureStoreSharesTokenStorage;
-    signAnonymousJwt(): Promise<string>;
+    /**
+     * Sign a token for the anonymous grant (`grant_type=anonymous`).
+     *
+     * The holder is anonymous (#270): the subject is an `anon:` id, so
+     * `this.auth.isAnonymous` is true and authorities treat it as no signed-in
+     * user, and its scopes are the configured `anonymousScopes`, never a role.
+     *
+     * @param options.audience The protected resource the token is for (`aud`, #269).
+     * @param options.issuer   The issuer to name (`iss`): {@link issuerFor} the request. Default: the boot-time issuer.
+     */
+    signAnonymousJwt(options?: {
+        audience?: string;
+        issuer?: string;
+    }): Promise<string>;
+    /** The scopes an anonymous caller holds: `anonymousScopes`, default `['anonymous']`. */
+    private anonymousScopes;
     /**
      * Cryptographically verify a gateway-issued access token (public/local/remote
      * "gateway" modes). Gateway tokens — both authenticated access tokens
      * ({@link signAccessToken}) and anonymous tokens ({@link signAnonymousJwt}) —
-     * are HS256-signed with `this.secret`, so this instance is the sole holder of
-     * the verification key.
+     * are HS256-signed with `this.secret`.
+     *
+     * The secret alone doesn't make a token this server's: every server started
+     * with the same JWT_SECRET holds it. So a token must also (#269):
+     * - name THIS instance as its issuer (`iss`): `expectedIssuer`, which callers
+     *   take from {@link issuerFor} the request, as the token endpoint does when
+     *   it signs; the boot-time issuer when not given. Never the token's own
+     *   claim; and
+     * - when `expectedAudience` is given, be issued for that protected resource,
+     *   or one of those resources (`aud`, compared as RFC 8707 resource URIs).
+     *   `session:verify` passes the request's resource URL, or the configured
+     *   `auth.expectedAudience` when there is one.
      *
-     * Enforces the signature and lifetime claims (`exp`/`nbf`, checked by `jose`
-     * by default). Issuer equality is intentionally NOT enforced: proxy/tunnel
-     * deployments legitimately present an `iss` that differs from the
-     * request-derived base URL (see {@link deriveIssuer}). Algorithm is pinned to
-     * HS256 to block `alg` confusion (e.g. a forged `alg: none` or asymmetric
-     * header). `expectedIssuer` is accepted for parity/logging only.
+     * Lifetime: `exp` is required (#272) and checked with `nbf` by `jose`. The
+     * algorithm is pinned to HS256 to block `alg` confusion.
      */
-    verifyGatewayToken(token: string, expectedIssuer: string): Promise<VerifyResult>;
+    verifyGatewayToken(token: string, requestBaseUrl: string, expectedAudience?: string | readonly string[], expectedIssuer?: string): Promise<VerifyResult>;
     /**
      * Sign an access token for an authenticated user
      */
-    signAccessToken(user: UserInfo, scopes: string[], audience?: string, consentMetadata?: ConsentMetadata): Promise<string>;
+    signAccessToken(user: UserInfo, scopes: string[], audience?: string, consentMetadata?: ConsentMetadata, 
+    /** The issuer to name (`iss`): {@link issuerFor} the request. Default: the boot-time issuer. */
+    issuer?: string): Promise<string>;
     /**
      * Exchange an authorization code for tokens
      */
-    exchangeCode(code: string, clientId: string, redirectUri: string, codeVerifier: string, clientSecret?: string): Promise<TokenResponse | {
+    exchangeCode(code: string, clientId: string, redirectUri: string, codeVerifier: string, clientSecret?: string, 
+    /** The protected resource the token is for when the grant recorded none (#269). */
+    defaultAudience?: string, 
+    /** The issuer the access token names: {@link issuerFor} the token request. */
+    issuer?: string): Promise<TokenResponse | {
         error: string;
         error_description: string;
     }>;
     /**
      * Refresh an access token using a refresh token
      */
-    refreshAccessToken(refreshToken: string, clientId: string, clientSecret?: string): Promise<TokenResponse | {
+    refreshAccessToken(refreshToken: string, clientId: string, clientSecret?: string, 
+    /** The protected resource the token is for when the grant recorded none (#269). */
+    defaultAudience?: string, 
+    /** The issuer the access token names: {@link issuerFor} the token request. */
+    issuer?: string): Promise<TokenResponse | {
         error: string;
         error_description: string;
     }>;
@@ -468,6 +530,18 @@ export declare class LocalPrimaryAuth extends FrontMcpAuth<LocalPrimaryAuthOptio
         picture?: string;
         claims?: Record<string, unknown>;
     }>;
+    /**
+     * Verify an upstream provider's `id_token` and return its claims, or
+     * `undefined` when it doesn't verify or no keys are configured to verify it.
+     *
+     * Checks the signature against the provider's published keys (inline
+     * `jwks`, else `jwksUri`, else the provider's discovery document), the
+     * issuer (the provider, plus `additionalIssuers`, unless `verifyIssuer` is
+     * false), `exp`, and that `aud` names this client. With no issuer configured
+     * (a local-mode provider without `issuer`) the token is not used: a key set
+     * an IdP shares between tenants would vouch for every tenant's tokens.
+     */
+    private verifyProviderIdToken;
     /**
      * Refresh tokens from upstream provider
      */

package/auth/instances/instance.local-primary-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instance.local-primary-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/instances/instance.local-primary-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,iBAAiB,EASjB,sBAAsB,EAMtB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EAGvB,KAAK,sBAAsB,IAAI,UAAU,EACzC,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAaxB,OAAO,EACL,YAAY,EAEZ,KAAK,cAAc,EACnB,KAAK,GAAG,EACR,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAML,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAC;AAmBrE;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAiBnH;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAwBD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,kBAAkB;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAYD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAW9C;AAWD,qBAAa,gBAAiB,SAAQ,YAAY,CAAC,uBAAuB,CAAC;IAmKvE,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,SAAS;IAnKnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAM;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,WAAW,CAA0B;IAE7C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAE9D,gEAAgE;IAChE,OAAO,CAAC,sBAAsB,CAAqB;IAEnD,6DAA6D;IAC7D,OAAO,CAAC,yBAAyB,CAA4B;IAE7D,gDAAgD;IAChD,OAAO,CAAC,0BAA0B,CAAa;IAE/C,4EAA4E;IAC5E,OAAO,CAAC,gBAAgB,CAAe;IAEvC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAoB;IAE1D,yEAAyE;IACzE,OAAO,CAAC,cAAc,CAAC,CAAiB;IAExC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAA0B;IAEtD;;;;OAIG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAAyB;IAErD,0EAA0E;IAC1E,IAAI,eAAe,IAAI,sBAAsB,GAAG,SAAS,CAExD;IAED;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAAC,CAAqB;IAEpD,uDAAuD;IACvD,IAAI,kBAAkB,IAAI,kBAAkB,GAAG,SAAS,CAEvD;IAED,gEAAgE;IAChE,IAAI,kBAAkB,IAAI,kBAAkB,CAE3C;IAED,6DAA6D;IAC7D,IAAI,qBAAqB,IAAI,yBAAyB,CAErD;IAED,gDAAgD;IAChD,IAAI,sBAAsB,IAAI,UAAU,CAEvC;IAED;;;;OAIG;IACH,IAAI,YAAY,IAAI,YAAY,CAE/B;IAED;;;;OAIG;IACH,IAAI,iBAAiB,IAAI,iBAAiB,CAEzC;IAED;;;OAGG;IACH,YAAY,IAAI,iBAAiB,GAAG,SAAS;IAO7C;;;;OAIG;IACH,YAAY,IAAI,OAAO;IAQvB,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6C;IAE7E;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB,CAAC,CAAS;IAEtC,iFAAiF;IACjF,IAAI,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAQ;IAC9C,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;gBAG/C,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,gBAAgB,EACnC,OAAO,EAAE,uBAAuB;IA+ElC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,YAAY;IAmBpB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;OAQG;YACW,gBAAgB;IA8B9B;;;;;;;;;;OAUG;IACH;;;;OAIG;IACH,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;;;;;;;;;;OAaG;IACG,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAuC1E,OAAO,CAAC,sBAAsB;IAkB9B,yEAAyE;IACzE,OAAO,CAAC,8BAA8B;YAUxB,yBAAyB;IAgDvC;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAO7B;;;;;;;;;;;;;;;;OAgBG;YACW,qBAAqB;IA0CnC;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IAO/B,gBAAgB;IAUtB;;;;;;;;;;;;;OAaG;IACY,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAkB/F;;OAEG;IACG,eAAe,CACnB,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,MAAM,CAAC;IAgElB;;OAEG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAyJxE;;OAEG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAiFxE;;OAEG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAElB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAE7B,aAAa,CAAC,EAAE,MAAM,CAAC;QAGvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAE5B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACxC,GAAG,OAAO,CAAC,MAAM,CAAC;cA+BH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsDlC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAItE,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;YAI1C,iBAAiB;IAuB/B;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI;IAyBtD;;;;;;OAMG;YACW,0BAA0B;IA4BxC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,2BAA2B;IAyCnC;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAQ9B;;OAEG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS;IAIzE;;OAEG;IACG,yBAAyB,CAC7B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GACA,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwBzB;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA4EhF;;OAEG;IACG,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IA+E9G;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;CA8CjF"}
+{"version":3,"file":"instance.local-primary-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/instances/instance.local-primary-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,iBAAiB,EASjB,sBAAsB,EAMtB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,aAAa,EAClB,KAAK,kBAAkB,EAGvB,KAAK,sBAAsB,IAAI,UAAU,EACzC,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAYxB,OAAO,EAEL,YAAY,EAKZ,KAAK,cAAc,EACnB,KAAK,GAAG,EACR,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAKL,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAC;AAmBrE;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAiBnH;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAwBD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,kBAAkB;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gGAAgG;IAChG,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,6FAA6F;IAC7F,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAYD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS;AAC5B,6DAA6D;AAC7D,UAAU,GAAE,SAAS,MAAM,EAAO,GACjC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAY9C;AAyBD,qBAAa,gBAAiB,SAAQ,YAAY,CAAC,uBAAuB,CAAC;IAsKvE,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,SAAS;IAtKnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6GAA6G;IAC7G,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kHAAkH;IAClH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAU;IAC7C,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAM;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,WAAW,CAA0B;IAE7C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAE9D,gEAAgE;IAChE,OAAO,CAAC,sBAAsB,CAAqB;IAEnD,6DAA6D;IAC7D,OAAO,CAAC,yBAAyB,CAA4B;IAE7D,gDAAgD;IAChD,OAAO,CAAC,0BAA0B,CAAa;IAE/C,4EAA4E;IAC5E,OAAO,CAAC,gBAAgB,CAAe;IAEvC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAoB;IAE1D,yEAAyE;IACzE,OAAO,CAAC,cAAc,CAAC,CAAiB;IAExC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAA0B;IAEtD;;;;OAIG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAAyB;IAErD,0EAA0E;IAC1E,IAAI,eAAe,IAAI,sBAAsB,GAAG,SAAS,CAExD;IAED;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAAC,CAAqB;IAEpD,uDAAuD;IACvD,IAAI,kBAAkB,IAAI,kBAAkB,GAAG,SAAS,CAEvD;IAED,gEAAgE;IAChE,IAAI,kBAAkB,IAAI,kBAAkB,CAE3C;IAED,6DAA6D;IAC7D,IAAI,qBAAqB,IAAI,yBAAyB,CAErD;IAED,gDAAgD;IAChD,IAAI,sBAAsB,IAAI,UAAU,CAEvC;IAED;;;;OAIG;IACH,IAAI,YAAY,IAAI,YAAY,CAE/B;IAED;;;;OAIG;IACH,IAAI,iBAAiB,IAAI,iBAAiB,CAEzC;IAED;;;OAGG;IACH,YAAY,IAAI,iBAAiB,GAAG,SAAS;IAO7C;;;;OAIG;IACH,YAAY,IAAI,OAAO;IAQvB,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6C;IAE7E;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB,CAAC,CAAS;IAEtC,iFAAiF;IACjF,IAAI,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAQ;IAC9C,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;gBAG/C,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,gBAAgB,EACnC,OAAO,EAAE,uBAAuB;IAgFlC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,YAAY;IAIpB,qGAAqG;IACrG,OAAO,CAAC,gBAAgB;IAMxB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM;IAS1C;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;OAQG;YACW,gBAAgB;IA8B9B;;;;;;;;;;OAUG;IACH;;;;OAIG;IACH,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;;;;;;;;;;OAaG;IACG,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAuC1E,OAAO,CAAC,sBAAsB;IAkB9B,yEAAyE;IACzE,OAAO,CAAC,8BAA8B;YAUxB,yBAAyB;IAgDvC;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAO7B;;;;;;;;;;;;;;;;OAgBG;YACW,qBAAqB;IA0CnC;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IAOrC;;;;;;;;;OASG;IACG,gBAAgB,CAAC,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAW3E,wFAAwF;IACxF,OAAO,CAAC,eAAe;IAKvB;;;;;;;;;;;;;;;;;;;OAmBG;IACY,kBAAkB,CAC/B,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,MAAM,EACtB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EAC7C,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,YAAY,CAAC;IAuBxB;;OAEG;IACG,eAAe,CACnB,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,eAAe;IACjC,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC;IAgElB;;OAEG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM;IACrB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM;IACxB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA4JxE;;OAEG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,MAAM;IACrB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM;IACxB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAmFxE;;OAEG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAElB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAE7B,aAAa,CAAC,EAAE,MAAM,CAAC;QAGvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAE5B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACxC,GAAG,OAAO,CAAC,MAAM,CAAC;cA+BH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsDlC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAItE,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;YAI1C,iBAAiB;IAuB/B;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI;IAyBtD;;;;;;OAMG;YACW,0BAA0B;IA4BxC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,2BAA2B;IA2CnC;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sBAAsB;IA2C9B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAQ9B;;OAEG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS;IAIzE;;OAEG;IACG,yBAAyB,CAC7B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GACA,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwBzB;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA4EhF;;OAEG;IACG,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAiE9G;;;;;;;;;;OAUG;YACW,qBAAqB;IAgCnC;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;CA8CjF"}

package/auth/secure-store/secure-store.providers.d.ts

@@ -4,8 +4,8 @@
  * Registers the per-request {@link SecureStoreAccessor} (`this.secureStore`).
  * The backend is a GLOBAL singleton owned by LocalPrimaryAuth; the accessor is
  * CONTEXT-scoped because it must resolve the CURRENT request's namespace (the
- * authenticated `sub` for `user` scope, the transport `sessionId` for `session`
- * scope) before calling the backend.
+ * authenticated `sub` for `user` scope, the verified session, else the signed-in
+ * caller, for `session` scope) before calling the backend.
  */
 import { type SecureStoreBackend, type SecureStoreScope } from '@frontmcp/auth';
 import { type Token } from '@frontmcp/di';
@@ -17,10 +17,13 @@ import { type FrontMcpContext } from '../../context/frontmcp-context';
  */
 export declare const SECURE_STORE_BACKEND: Token<SecureStoreBackend>;
 /**
- * Resolve the transport session id for the current request, or undefined when
- * there is no session. Used for `session`-scoped secrets.
+ * The identity `session`-scoped secrets of the current request belong to: the session the server
+ * verified, else the signed-in caller (see {@link sessionScopeIdentity}).
+ *
+ * @throws SessionIdentityRequiredError for an anonymous caller without a verified session, which no
+ *   later request could be matched to
  */
-export declare function resolveRequestSessionId(ctx: FrontMcpContext): string | undefined;
+export declare function resolveRequestSessionId(ctx: FrontMcpContext): string;
 /**
  * Build the DI providers that back `this.secureStore`.
  *

package/auth/secure-store/secure-store.providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secure-store.providers.d.ts","sourceRoot":"","sources":["../../../src/auth/secure-store/secure-store.providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAiB,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAItE;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAkD,KAAK,CAAC,kBAAkB,CAAC,CAAC;AAE7G;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAGhF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,YAAY,EAAE,CA6BjB"}
+{"version":3,"file":"secure-store.providers.d.ts","sourceRoot":"","sources":["../../../src/auth/secure-store/secure-store.providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAiB,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAMtE;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAkD,KAAK,CAAC,kBAAkB,CAAC,CAAC;AAE7G;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAIpE;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,YAAY,EAAE,CA6BjB"}

package/auth/session-scope-identity.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Who session-scoped storage of a request belongs to.
+ */
+import { type FrontMcpContext } from '../context/frontmcp-context';
+/**
+ * The identity that keys session-scoped storage (secure-store secrets, auth-provider credentials)
+ * for the current request: the session the server verified (`FrontMcpContext.verifiedSessionId`),
+ * else `principal:<sub>` for a signed-in caller, so its storage lasts across its requests.
+ *
+ * Never `FrontMcpContext.sessionId` itself: under MCP 2026-07-28 and on the stateless transports it
+ * is whatever `mcp-session-id` the client sent, so a caller who sent another caller's id reached
+ * that caller's storage. The `principal:` form never matches a session id the server mints
+ * (`iv.tag.data`, no `:`).
+ *
+ * @returns The identity, or undefined for an anonymous caller without a verified session
+ */
+export declare function sessionScopeIdentity(ctx: FrontMcpContext): string | undefined;
+//# sourceMappingURL=session-scope-identity.d.ts.map

package/auth/session-scope-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-scope-identity.d.ts","sourceRoot":"","sources":["../../src/auth/session-scope-identity.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAS7E"}

package/auth/vault/auth-providers.providers.d.ts

@@ -4,10 +4,8 @@
  * Defines dependency injection providers for the AuthProviders vault system.
  * These providers are registered at scope initialization when AuthProviders is enabled.
  */
-import type { Token } from '@frontmcp/di';
-import { ProviderScope } from '@frontmcp/di';
-import type { AuthorizationVault, AuthProvidersVaultOptions } from '@frontmcp/auth';
-import { LazyCredentialLoader } from '@frontmcp/auth';
+import { LazyCredentialLoader, type AuthorizationVault, type AuthProvidersVaultOptions } from '@frontmcp/auth';
+import { ProviderScope, type Token } from '@frontmcp/di';
 /**
  * Token for lazy loader (internal use)
  */

package/auth/vault/auth-providers.providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-providers.providers.d.ts","sourceRoot":"","sources":["../../../src/auth/vault/auth-providers.providers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,yBAAyB,EAA4B,MAAM,gBAAgB,CAAC;AAC9G,OAAO,EAQL,oBAAoB,EACrB,MAAM,gBAAgB,CAAC;AAMxB;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAoD,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAEnH;;;GAGG;AACH,UAAU,wBAAwB;IAChC,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,UAAU,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,SAAS,KAAK,EAAE,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,yBAAyB,EAClC,SAAS,EAAE,kBAAkB,GAC5B,wBAAwB,EAAE,CA4E5B;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAWnF"}
+{"version":3,"file":"auth-providers.providers.d.ts","sourceRoot":"","sources":["../../../src/auth/vault/auth-providers.providers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAQL,oBAAoB,EACpB,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAE/B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AASzD;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAoD,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAEnH;;;GAGG;AACH,UAAU,wBAAwB;IAChC,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,UAAU,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,SAAS,KAAK,EAAE,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,yBAAyB,EAClC,SAAS,EAAE,kBAAkB,GAC5B,wBAAwB,EAAE,CA+E5B;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAWnF"}

package/channel/sources/webhook.source.d.ts

@@ -1,6 +1,6 @@
 import type { FrontMcpLogger } from '../../common';
-import type { ChannelInstance } from '../channel.instance';
 import type { ChannelWebhookSource } from '../../common/metadata/channel.metadata';
+import type { ChannelInstance } from '../channel.instance';
 /**
  * Webhook request context passed to channel handlers.
  */

package/channel/sources/webhook.source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook.source.d.ts","sourceRoot":"","sources":["../../../src/channel/sources/webhook.source.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAEnF;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,oBAAoB,EAClC,MAAM,EAAE,cAAc,GACrB,CACD,GAAG,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,EAC5F,GAAG,EAAE;IAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;KAAE,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;CAAE,KACjG,OAAO,CAAC,IAAI,CAAC,CA8BjB"}
+{"version":3,"file":"webhook.source.d.ts","sourceRoot":"","sources":["../../../src/channel/sources/webhook.source.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAEnF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,oBAAoB,EAClC,MAAM,EAAE,cAAc,GACrB,CACD,GAAG,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,EAC5F,GAAG,EAAE;IAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;KAAE,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;CAAE,KACjG,OAAO,CAAC,IAAI,CAAC,CA+BjB"}

package/common/availability/availability.utils.d.ts

@@ -16,7 +16,37 @@
  * lifetime of the process — the OS, runtime, and deployment mode don't change.
  */
 import { type EntryAvailability } from '@frontmcp/utils';
+import { EntryUnavailableError } from '../../errors/mcp.error';
 import type { FrontMcpLogger } from '../interfaces/logger.interface';
+/** Who is calling (`availableWhen.surface`): the one axis that varies per call. */
+export type CallSurface = NonNullable<EntryAvailability['surface']>[number];
+/**
+ * The surface a flow was called from, when its caller tagged one. The MCP request handlers tag
+ * every call (`'mcp'`, or `'cli'` for the in-process client of a CLI build), an agent its model's
+ * tool calls (`'agent'`), and `this.callTool()` in a job, an agent or a channel handling a webhook
+ * tags `'job'`, `'agent'` or `'http-trigger'`. A tool's own `this.callTool()` is in-process dispatch
+ * and tags none.
+ */
+export declare function callSurfaceOf(ctx: unknown): CallSurface | undefined;
+/**
+ * Whether `availableWhen.surface` offers an entry to a call from `surface`. A call without a surface
+ * is not restricted by this axis (an empty `surface` list is refused by the process-wide check).
+ */
+export declare function isOfferedOnSurface(availability: EntryAvailability | undefined, surface: CallSurface | undefined): boolean;
+/**
+ * How `availableWhen` answers a call that found an entry by name or URI.
+ *
+ * - `'not-offered'`: the call's surface is excluded. Answer as for an unknown entry, so a caller on
+ *   that surface cannot tell the entry exists (an agent-only tool over MCP, say).
+ * - `'unavailable'`: a process-wide axis (os, runtime, deployment, provider, target, env) excludes
+ *   it. Listings already leave such entries out; a call by name must not reach them either.
+ */
+export declare function availabilityForCall(availability: EntryAvailability | undefined, surface: CallSurface | undefined): 'available' | 'not-offered' | 'unavailable';
+/**
+ * The structured error for an entry a process-wide `availableWhen` axis excludes (issue #417), as
+ * `tools/call` has answered since that issue.
+ */
+export declare function entryUnavailableError(entryType: string, entryName: string, availability: EntryAvailability | undefined, surface: CallSurface | undefined): EntryUnavailableError;
 /**
  * Log availability filtering results for a set of entries at registry boot time.
  *

package/common/availability/availability.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"availability.utils.d.ts","sourceRoot":"","sources":["../../../src/common/availability/availability.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAA4D,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACnH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE;QAAE,aAAa,CAAC,EAAE,iBAAiB,CAAA;KAAE,CAAA;CAAE,EAClH,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,SAAS,CAAC,EAAE,EACrB,MAAM,EAAE,cAAc,GACrB,IAAI,CA2DN"}
+{"version":3,"file":"availability.utils.d.ts","sourceRoot":"","sources":["../../../src/common/availability/availability.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAIL,KAAK,iBAAiB,EAEvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,mFAAmF;AACnF,MAAM,MAAM,WAAW,GAAG,WAAW,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAI5E;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAGnE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,iBAAiB,GAAG,SAAS,EAC3C,OAAO,EAAE,WAAW,GAAG,SAAS,GAC/B,OAAO,CAGT;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,iBAAiB,GAAG,SAAS,EAC3C,OAAO,EAAE,WAAW,GAAG,SAAS,GAC/B,WAAW,GAAG,aAAa,GAAG,aAAa,CAG7C;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,iBAAiB,GAAG,SAAS,EAC3C,OAAO,EAAE,WAAW,GAAG,SAAS,GAC/B,qBAAqB,CAIvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE;QAAE,aAAa,CAAC,EAAE,iBAAiB,CAAA;KAAE,CAAA;CAAE,EAClH,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,SAAS,CAAC,EAAE,EACrB,MAAM,EAAE,cAAc,GACrB,IAAI,CA2DN"}

package/common/availability/index.d.ts

@@ -1,2 +1,2 @@
-export { logAvailabilityFiltering } from './availability.utils';
+export { availabilityForCall, callSurfaceOf, entryUnavailableError, isOfferedOnSurface, logAvailabilityFiltering, type CallSurface, } from './availability.utils';
 //# sourceMappingURL=index.d.ts.map

package/common/availability/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/common/availability/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/common/availability/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,KAAK,WAAW,GACjB,MAAM,sBAAsB,CAAC"}

package/common/decorators/hook.decorator.d.ts

@@ -10,6 +10,8 @@ import { type FlowName, type HookMetadata, type HookOptions } from '../metadata'
  * This is called by collectFlowHookMap during flow registration
  */
 export declare function resolvePendingTC39HooksForClass(ctor: Function): HookMetadata[];
+/** The pending TC39 hooks of a class, left pending for the flow registration that resolves them. */
+export declare function peekPendingTC39HooksForClass(ctor: Function): HookMetadata[];
 /**
  * Creates a typed Stage hook decorator for a specific flow
  * @example

package/common/decorators/hook.decorator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hook.decorator.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/hook.decorator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAsB,MAAM,aAAa,CAAC;AAmBrG;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,QAAQ,GAAG,YAAY,EAAE,CAE9E;AAkFD;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI,IAI1C,iCAAQ,EAAE,OAAM,WAAW,0BAAU,qBAGvD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI,IAIzC,iCAAQ,EAAE,OAAM,WAAW,0BAAU,qBAGvD;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI,IAIxC,iCAAQ,EAAE,OAAM,WAAW,0BAAU,qBAGvD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI,IAI3C,iCAAQ,EAAE,OAAM,WAAW,0BAAU,qBAGvD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI;;;;;EAO5D"}
+{"version":3,"file":"hook.decorator.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/hook.decorator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAsB,MAAM,aAAa,CAAC;AAmBrG;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,QAAQ,GAAG,YAAY,EAAE,CAE9E;AAED,oGAAoG;AACpG,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,QAAQ,GAAG,YAAY,EAAE,CAE3E;AAkFD;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI,IAI1C,iCAAQ,EAAE,OAAM,WAAW,0BAAU,qBAGvD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI,IAIzC,iCAAQ,EAAE,OAAM,WAAW,0BAAU,qBAGvD;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI,IAIxC,iCAAQ,EAAE,OAAM,WAAW,0BAAU,qBAGvD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI,IAI3C,iCAAQ,EAAE,OAAM,WAAW,0BAAU,qBAGvD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI;;;;;EAO5D"}

package/common/decorators/plugin.decorator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.decorator.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/plugin.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAgC,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAGhF;;GAEG;AACH,iBAAS,cAAc,CAAC,gBAAgB,EAAE,cAAc,GAAG,cAAc,CA4BxE;AAED,OAAO,EAAE,cAAc,EAAE,cAAc,IAAI,MAAM,EAAE,CAAC"}
+{"version":3,"file":"plugin.decorator.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/plugin.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAgC,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAIhF;;GAEG;AACH,iBAAS,cAAc,CAAC,gBAAgB,EAAE,cAAc,GAAG,cAAc,CAiCxE;AAED,OAAO,EAAE,cAAc,EAAE,cAAc,IAAI,MAAM,EAAE,CAAC"}

package/common/interfaces/agent.interface.d.ts

@@ -2,6 +2,7 @@ import { type ZodType } from '@frontmcp/lazy-zod';
 import { type ToolExecutor } from '../../agent/agent-execution-loop';
 import { type ElicitOptions, type ElicitResult } from '../../elicitation';
 import type { AIPlatformType, ClientInfo, McpLoggingLevel } from '../../notification';
+import { type CallSurface } from '../availability';
 import { type AgentInputOf, type AgentOutputOf } from '../decorators';
 import type { AgentMetadata, AgentType, ToolInputType, ToolOutputType } from '../metadata';
 import { ExecutionContextBase, type ExecutionContextBaseArgs } from './execution-context.interface';
@@ -183,6 +184,8 @@ export declare class AgentContext<InSchema extends ToolInputType = ToolInputType
      * is in `swarm.visibleAgents`.
      */
     protected invokeAgent(agentId: string, input: unknown): Promise<unknown>;
+    /** An agent calls tools on the `'agent'` surface, as its model's tool calls do. */
+    protected callToolSurface(): CallSurface;
     /**
      * Send a notification message to the current session.
      * Uses 'notifications/message' per MCP 2025-11-25 spec.
@@ -266,6 +269,11 @@ export declare class AgentContext<InSchema extends ToolInputType = ToolInputType
      * ```
      */
     protected elicit<S extends ZodType>(message: string, requestedSchema: S, options?: ElicitOptions): Promise<ElicitResult<S extends ZodType<infer O> ? O : unknown>>;
+    /**
+     * The context of the request this agent runs in. An agent is built with its own provider registry,
+     * which holds no request-scoped instances, so the context is read from the running request.
+     */
+    private runningRequestContext;
     /**
      * Respond with the final output and end execution.
      *

package/common/interfaces/agent.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.interface.d.ts","sourceRoot":"","sources":["../../../src/common/interfaces/agent.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EAAiB,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEzF,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEpG,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,WAAW,EAEhB,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAC;AAGjC,YAAY,EAAE,SAAS,EAAE,CAAC;AAM1B;;GAEG;AACH,KAAK,YAAY,CAAC,CAAC,IAAI;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,aAAa,CAAC,EAAE,IAAI,wBAAwB,GAAG;IACzD,QAAQ,EAAE,aAAa,CAAC;IACxB,KAAK,EAAE,EAAE,CAAC;IACV,UAAU,EAAE,eAAe,CAAC;IAC5B,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,+CAA+C;IAC/C,eAAe,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACxC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACjC,CAAC;AAMF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,qBAAa,YAAY,CACvB,QAAQ,SAAS,aAAa,GAAG,aAAa,EAC9C,SAAS,SAAS,cAAc,GAAG,cAAc,EACjD,EAAE,GAAG,YAAY,CAAC;IAAE,WAAW,EAAE,QAAQ,CAAA;CAAE,CAAC,EAC5C,GAAG,GAAG,aAAa,CAAC;IAAE,YAAY,EAAE,SAAS,CAAA;CAAE,CAAC,CAChD,SAAQ,oBAAoB,CAAC,GAAG,CAAC;IACjC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACnC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IAEjC,qCAAqC;IACrC,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IAE/C,oEAAoE;IACpE,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,yBAAyB,CAAC;IAE1D,8CAA8C;IAC9C,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAE9C,+CAA+C;IAC/C,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,mBAAmB,EAAE,CAAC;IAE1D,4DAA4D;IAC5D,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IAS/C,OAAO,CAAC,SAAS,CAAC,CAAoB;IACtC,OAAO,CAAC,MAAM,CAAC,CAAK;IAGpB,OAAO,CAAC,YAAY,CAAC,CAAqB;IAC1C,OAAO,CAAC,OAAO,CAAC,CAAM;IAGtB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;IACxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAG1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAkB;gBAEtC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;IAoBnC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAItC;;;;;;;;OAQG;cACa,YAAY,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAsGrD;;;OAGG;IACH,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM;IAc7C;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,GAAG;IAsBzD,IAAW,KAAK,IAAI,EAAE,CAErB;IAED,IAAW,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,SAAS,EAOjC;IAED,IAAW,YAAY,IAAI,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAEzD;IAED,IAAW,MAAM,IAAI,GAAG,GAAG,SAAS,CAEnC;IAED,IAAW,MAAM,CAAC,CAAC,EAAE,GAAG,GAAG,SAAS,EAGnC;IAED,IAAW,aAAa,IAAI,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAE3D;IAMD;;;;;;;;;;;;;;OAcG;cACa,UAAU,CACxB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,mBAAmB,EAAE,EAC7B,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,eAAe,CAAC;IAI3B;;;;OAIG;cACc,gBAAgB,CAC/B,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,mBAAmB,EAAE,EAC7B,OAAO,CAAC,EAAE,sBAAsB,GAC/B,cAAc,CAAC,oBAAoB,CAAC;IAUvC;;;;;;;;OAQG;cACa,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAK1F;;;;;OAKG;cACa,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAS9E;;;;;;;;;;;;;;;;;;;OAmBG;cACa,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,GAAE,eAAwB,GAAG,OAAO,CAAC,OAAO,CAAC;IAqBpH;;;;;;;;;;;;;;;;;;;;;;;OAuBG;cACa,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAe9F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;cACa,MAAM,CAAC,CAAC,SAAS,OAAO,EACtC,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,CAAC,EAClB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAgBlE;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,KAAK;IAS1B;;OAEG;IACH,IAAI,QAAQ,IAAI,cAAc,CAc7B;IAED;;OAEG;IACH,IAAI,UAAU,IAAI,UAAU,GAAG,SAAS,CAUvC;CACF"}
+{"version":3,"file":"agent.interface.d.ts","sourceRoot":"","sources":["../../../src/common/interfaces/agent.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAGzF,OAAO,EAAiB,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEzF,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEpG,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,WAAW,EAEhB,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAC;AAGjC,YAAY,EAAE,SAAS,EAAE,CAAC;AAM1B;;GAEG;AACH,KAAK,YAAY,CAAC,CAAC,IAAI;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,aAAa,CAAC,EAAE,IAAI,wBAAwB,GAAG;IACzD,QAAQ,EAAE,aAAa,CAAC;IACxB,KAAK,EAAE,EAAE,CAAC;IACV,UAAU,EAAE,eAAe,CAAC;IAC5B,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,+CAA+C;IAC/C,eAAe,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACxC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACjC,CAAC;AAMF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,qBAAa,YAAY,CACvB,QAAQ,SAAS,aAAa,GAAG,aAAa,EAC9C,SAAS,SAAS,cAAc,GAAG,cAAc,EACjD,EAAE,GAAG,YAAY,CAAC;IAAE,WAAW,EAAE,QAAQ,CAAA;CAAE,CAAC,EAC5C,GAAG,GAAG,aAAa,CAAC;IAAE,YAAY,EAAE,SAAS,CAAA;CAAE,CAAC,CAChD,SAAQ,oBAAoB,CAAC,GAAG,CAAC;IACjC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACnC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IAEjC,qCAAqC;IACrC,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IAE/C,oEAAoE;IACpE,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,yBAAyB,CAAC;IAE1D,8CAA8C;IAC9C,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAE9C,+CAA+C;IAC/C,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,mBAAmB,EAAE,CAAC;IAE1D,4DAA4D;IAC5D,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IAS/C,OAAO,CAAC,SAAS,CAAC,CAAoB;IACtC,OAAO,CAAC,MAAM,CAAC,CAAK;IAGpB,OAAO,CAAC,YAAY,CAAC,CAAqB;IAC1C,OAAO,CAAC,OAAO,CAAC,CAAM;IAGtB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;IACxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAG1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAkB;gBAEtC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;IAoBnC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAItC;;;;;;;;OAQG;cACa,YAAY,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAsGrD;;;OAGG;IACH,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM;IAc7C;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,GAAG;IAsBzD,IAAW,KAAK,IAAI,EAAE,CAErB;IAED,IAAW,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,SAAS,EAOjC;IAED,IAAW,YAAY,IAAI,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAEzD;IAED,IAAW,MAAM,IAAI,GAAG,GAAG,SAAS,CAEnC;IAED,IAAW,MAAM,CAAC,CAAC,EAAE,GAAG,GAAG,SAAS,EAGnC;IAED,IAAW,aAAa,IAAI,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAE3D;IAMD;;;;;;;;;;;;;;OAcG;cACa,UAAU,CACxB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,mBAAmB,EAAE,EAC7B,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,eAAe,CAAC;IAI3B;;;;OAIG;cACc,gBAAgB,CAC/B,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,mBAAmB,EAAE,EAC7B,OAAO,CAAC,EAAE,sBAAsB,GAC/B,cAAc,CAAC,oBAAoB,CAAC;IAUvC;;;;;;;;OAQG;cACa,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAK1F;;;;;OAKG;cACa,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAK9E,mFAAmF;cAChE,eAAe,IAAI,WAAW;IAQjD;;;;;;;;;;;;;;;;;;;OAmBG;cACa,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,GAAE,eAAwB,GAAG,OAAO,CAAC,OAAO,CAAC;IAqBpH;;;;;;;;;;;;;;;;;;;;;;;OAuBG;cACa,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAe9F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;cACa,MAAM,CAAC,CAAC,SAAS,OAAO,EACtC,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,CAAC,EAClB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAkBlE;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,KAAK;IAS1B;;OAEG;IACH,IAAI,QAAQ,IAAI,cAAc,CAc7B;IAED;;OAEG;IACH,IAAI,UAAU,IAAI,UAAU,GAAG,SAAS,CAUvC;CACF"}

package/common/interfaces/channel.interface.d.ts

@@ -1,4 +1,5 @@
 import { type FuncType, type Type } from '@frontmcp/di';
+import { type CallSurface } from '../availability';
 import { type ChannelMetadata, type ChannelNotification } from '../metadata/channel.metadata';
 import { ExecutionContextBase, type ExecutionContextBaseArgs } from './execution-context.interface';
 /**
@@ -127,5 +128,10 @@ export declare abstract class ChannelContext extends ExecutionContextBase<Channe
      * @param payload - The raw event payload to process through `onEvent()`
      */
     protected pushIncoming(payload: unknown): void;
+    /**
+     * While it handles an HTTP trigger (a webhook source's request), a channel calls tools on the
+     * `'http-trigger'` surface. Handling any other event, it dispatches in-process.
+     */
+    protected callToolSurface(): CallSurface | undefined;
 }
 //# sourceMappingURL=channel.interface.d.ts.map

package/common/interfaces/channel.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"channel.interface.d.ts","sourceRoot":"","sources":["../../../src/common/interfaces/channel.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,IAAI,EAAE,MAAM,cAAc,CAAC;AAGxD,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEpG;;;GAGG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;AAE7D;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,wBAAwB,GAAG;IACvD,QAAQ,EAAE,eAAe,CAAC;CAC3B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,8BAAsB,cAAe,SAAQ,oBAAoB,CAAC,mBAAmB,CAAC;IACpF,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;gBASvB,IAAI,EAAE,eAAe;IAWjC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAEhE;;;;;;OAMG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAS1E;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAInC;;;;;;;;OAQG;IACH,SAAS,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;CAO/C"}
+{"version":3,"file":"channel.interface.d.ts","sourceRoot":"","sources":["../../../src/common/interfaces/channel.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,IAAI,EAAE,MAAM,cAAc,CAAC;AAIxD,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEpG;;;GAGG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;AAE7D;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,wBAAwB,GAAG;IACvD,QAAQ,EAAE,eAAe,CAAC;CAC3B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,8BAAsB,cAAe,SAAQ,oBAAoB,CAAC,mBAAmB,CAAC;IACpF,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;gBASvB,IAAI,EAAE,eAAe;IAWjC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAEhE;;;;;;OAMG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAS1E;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAInC;;;;;;;;OAQG;IACH,SAAS,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAQ9C;;;OAGG;cACgB,eAAe,IAAI,WAAW,GAAG,SAAS;CAG9D"}

package/common/interfaces/execution-context.interface.d.ts

@@ -4,6 +4,7 @@ import { type AuthInfo, type CallToolResult } from '@frontmcp/protocol';
 import { type RuntimeContext } from '@frontmcp/utils';
 import { ConfigService } from '../../builtin/config/providers/config.service';
 import { type FrontMcpContext } from '../../context';
+import { type CallSurface } from '../availability';
 import { type ScopeEntry } from '../entries';
 import { type ProviderRegistryInterface } from './internal';
 import { type FrontMcpLogger } from './logger.interface';
@@ -117,6 +118,11 @@ export declare abstract class ExecutionContextBase<Out = unknown> {
      * Authority/authorization checks still run — an internal call carries the
      * same `authInfo` as the surrounding request, so ABAC/RBAC guards apply.
      *
+     * `availableWhen.surface`: the call carries {@link callToolSurface}. From a tool, resource or
+     * prompt that is none (in-process dispatch, which no surface restricts); a job's call carries
+     * `'job'`, an agent's `'agent'`, and an HTTP trigger's `'http-trigger'`, so a tool whose `surface`
+     * leaves that caller out answers as an unknown tool.
+     *
      * @param name Tool name (or fully-qualified `owner.name`).
      * @param args Tool arguments — validated by the tool's input schema.
      * @param opts Optional progress token / abort signal forwarded into `_meta`.
@@ -126,6 +132,12 @@ export declare abstract class ExecutionContextBase<Out = unknown> {
         progressToken?: string | number;
         signal?: AbortSignal;
     }): Promise<CallToolResult>;
+    /**
+     * The surface (`availableWhen.surface`) a {@link callTool} from this context calls on. None by
+     * default: a tool, resource or prompt composing with other tools is in-process dispatch. Contexts
+     * that are callers of their own (jobs, agents, HTTP triggers) name their surface.
+     */
+    protected callToolSurface(): CallSurface | undefined;
     /**
      * Fail the execution and trigger error handling.
      */

package/common/interfaces/execution-context.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-context.interface.d.ts","sourceRoot":"","sources":["../../../src/common/interfaces/execution-context.interface.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAiC,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAErF,OAAO,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAC;AAC9E,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,yBAAyB,CAAC;IACrC,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,8BAAsB,oBAAoB,CAAC,GAAG,GAAG,OAAO;IACtD,OAAO,CAAC,SAAS,CAA4B;IAE7C;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAE9C,+CAA+C;IAC/C,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACjC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAE1C,gDAAgD;IAChD,SAAS,CAAC,WAAW,SAAU;IAE/B,gCAAgC;IAChC,OAAO,CAAC,MAAM,CAAC,CAAQ;IAEvB,yDAAyD;IACzD,OAAO,CAAC,YAAY,CAAC,CAAsB;gBAE/B,IAAI,EAAE,wBAAwB;IAQ1C;;;;;;;OAOG;IACH,IAAI,OAAO,IAAI,eAAe,CAO7B;IAED;;;;;;;;;;;;;;OAcG;IACH,IAAI,IAAI,IAAI,mBAAmB,CAO9B;IAED;;;;OAIG;IACH,aAAa,IAAI,eAAe,GAAG,SAAS;IAQ5C;;;;OAIG;IACH,IAAI,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAEhC;IAED;;;;;;;;OAQG;IACH,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC;IAQhC;;;;OAIG;IACH,SAAS,KAAK,aAAa,IAAI,cAAc,CAO5C;IAED;;;OAGG;IACH,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;IAI1B;;OAEG;IACH,IAAI,KAAK,IAAI,UAAU,CAEtB;IAED;;OAEG;IACH,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,SAAS;IAUzC;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAC/D,OAAO,CAAC,cAAc,CAAC;IA8B1B;;OAEG;IACH,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,KAAK;IAKjC;;OAEG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIzB;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAS1F;;OAEG;IACH,SAAS,KAAK,KAAK,IAAI,KAAK,GAAG,SAAS,CAEvC;IAED;;;;;;;;;;;OAWG;IACH,IAAI,MAAM,IAAI,aAAa,CAG1B;IAID;;OAEG;IACH,IAAI,cAAc,IAAI,cAAc,CAEnC;IAED;;;OAGG;IACH,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,OAAO;IAIzD;;;OAGG;IACH,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,GAAG,OAAO;IAItD;;;OAGG;IACH,YAAY,CAAC,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC,GAAG,OAAO;IAI/D;;;OAGG;IACH,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,GAAG,OAAO;CAG3C"}
+{"version":3,"file":"execution-context.interface.d.ts","sourceRoot":"","sources":["../../../src/common/interfaces/execution-context.interface.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAiC,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAErF,OAAO,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAC;AAC9E,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,yBAAyB,CAAC;IACrC,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,8BAAsB,oBAAoB,CAAC,GAAG,GAAG,OAAO;IACtD,OAAO,CAAC,SAAS,CAA4B;IAE7C;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAE9C,+CAA+C;IAC/C,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACjC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAE1C,gDAAgD;IAChD,SAAS,CAAC,WAAW,SAAU;IAE/B,gCAAgC;IAChC,OAAO,CAAC,MAAM,CAAC,CAAQ;IAEvB,yDAAyD;IACzD,OAAO,CAAC,YAAY,CAAC,CAAsB;gBAE/B,IAAI,EAAE,wBAAwB;IAQ1C;;;;;;;OAOG;IACH,IAAI,OAAO,IAAI,eAAe,CAO7B;IAED;;;;;;;;;;;;;;OAcG;IACH,IAAI,IAAI,IAAI,mBAAmB,CAO9B;IAED;;;;OAIG;IACH,aAAa,IAAI,eAAe,GAAG,SAAS;IAQ5C;;;;OAIG;IACH,IAAI,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAEhC;IAED;;;;;;;;OAQG;IACH,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC;IAQhC;;;;OAIG;IACH,SAAS,KAAK,aAAa,IAAI,cAAc,CAO5C;IAED;;;OAGG;IACH,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;IAI1B;;OAEG;IACH,IAAI,KAAK,IAAI,UAAU,CAEtB;IAED;;OAEG;IACH,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,SAAS;IAUzC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAC/D,OAAO,CAAC,cAAc,CAAC;IAgC1B;;;;OAIG;IACH,SAAS,CAAC,eAAe,IAAI,WAAW,GAAG,SAAS;IAIpD;;OAEG;IACH,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,KAAK;IAKjC;;OAEG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIzB;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAS1F;;OAEG;IACH,SAAS,KAAK,KAAK,IAAI,KAAK,GAAG,SAAS,CAEvC;IAED;;;;;;;;;;;OAWG;IACH,IAAI,MAAM,IAAI,aAAa,CAG1B;IAID;;OAEG;IACH,IAAI,cAAc,IAAI,cAAc,CAEnC;IAED;;;OAGG;IACH,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,OAAO;IAIzD;;;OAGG;IACH,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,GAAG,OAAO;IAItD;;;OAGG;IACH,YAAY,CAAC,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC,GAAG,OAAO;IAI/D;;;OAGG;IACH,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,GAAG,OAAO;CAG3C"}