@frontmcp/sdk 1.8.3 → 1.8.5

package/auth/instances/instance.local-primary-auth.d.ts

@@ -132,7 +132,10 @@ export declare class LocalPrimaryAuth extends FrontMcpAuth<LocalPrimaryAuthOptio
     private providers;
     readonly host: string;
     readonly port: number;
+    /** The boot-time issuer: the configured one, else this server's listener address (see {@link issuerFor}). */
     readonly issuer: string;
+    /** Whether `FRONTMCP_PUBLIC_HOST` names the boot-time issuer's host, pinning it for every request. */
+    private readonly publicHostPinned;
     readonly keys: JWK[];
     readonly secret: Uint8Array;
     readonly logger: FrontMcpLogger;
@@ -255,6 +258,35 @@ export declare class LocalPrimaryAuth extends FrontMcpAuth<LocalPrimaryAuthOptio
      * supported knob for aligning the issuer with discovery.
      */
     private deriveIssuer;
+    /** The issuer the options name: `issuer` in public mode, `local.issuer` in local and remote mode. */
+    private configuredIssuer;
+    /**
+     * The issuer this server names in answer to `request`: in its discovery
+     * documents (`/.well-known/oauth-authorization-server`'s `issuer`, the
+     * protected resource metadata's `authorization_servers`), on its
+     * authorization responses (the RFC 9207 `iss`, errors included), and as the
+     * `iss` of the tokens it issues; the tokens it accepts there must name it
+     * (#269, and see {@link acceptedIssuersFor}). Every entry point asks this, so
+     * none of them can disagree, on the Node server and under a Web fetch
+     * handler alike (#629). In order:
+     *
+     * 1. a configured issuer (`issuer` / `local.issuer`);
+     * 2. with `FRONTMCP_PUBLIC_URL` pinned, that URL plus this scope's path;
+     * 3. with `FRONTMCP_PUBLIC_HOST` set, the boot-time issuer it names the host
+     *    of (`http://<host>:<http.port><path>`);
+     * 4. the request's own origin plus this scope's path;
+     * 5. without a request, the boot-time issuer.
+     */
+    issuerFor(request?: ServerRequest): string;
+    /**
+     * The issuers a token presented with `request` may name: {@link issuerFor}
+     * the request. When the issuer follows the request (nothing pins it) and
+     * local or remote mode lists `expectedAudience`, a token for any listed
+     * address was issued under that address's issuer, so each listed address's
+     * issuer is accepted too, and so is the boot-time issuer that 1.8.4 named on
+     * those tokens. The token's `aud` must still name a listed resource.
+     */
+    acceptedIssuersFor(request?: ServerRequest): string | string[];
     /**
      * Read the `tokenStorage` selection off the auth options. Only
      * local/remote/orchestrated modes declare it; public mode does not, in which
@@ -345,9 +377,11 @@ export declare class LocalPrimaryAuth extends FrontMcpAuth<LocalPrimaryAuthOptio
      * user, and its scopes are the configured `anonymousScopes`, never a role.
      *
      * @param options.audience The protected resource the token is for (`aud`, #269).
+     * @param options.issuer   The issuer to name (`iss`): {@link issuerFor} the request. Default: the boot-time issuer.
      */
     signAnonymousJwt(options?: {
         audience?: string;
+        issuer?: string;
     }): Promise<string>;
     /** The scopes an anonymous caller holds: `anonymousScopes`, default `['anonymous']`. */
     private anonymousScopes;
@@ -359,8 +393,10 @@ export declare class LocalPrimaryAuth extends FrontMcpAuth<LocalPrimaryAuthOptio
      *
      * The secret alone doesn't make a token this server's: every server started
      * with the same JWT_SECRET holds it. So a token must also (#269):
-     * - name THIS instance as its issuer (`iss`, the boot-time issuer it signs
-     *   with, never the request-derived base URL), and
+     * - name THIS instance as its issuer (`iss`): `expectedIssuer` (one issuer or
+     *   several), which callers take from {@link acceptedIssuersFor} the request,
+     *   matching what the token endpoint names when it signs ({@link issuerFor});
+     *   the boot-time issuer when not given. Never the token's own claim; and
      * - when `expectedAudience` is given, be issued for that protected resource,
      *   or one of those resources (`aud`, compared as RFC 8707 resource URIs).
      *   `session:verify` passes the request's resource URL, or the configured
@@ -369,17 +405,21 @@ export declare class LocalPrimaryAuth extends FrontMcpAuth<LocalPrimaryAuthOptio
      * Lifetime: `exp` is required (#272) and checked with `nbf` by `jose`. The
      * algorithm is pinned to HS256 to block `alg` confusion.
      */
-    verifyGatewayToken(token: string, requestBaseUrl: string, expectedAudience?: string | readonly string[]): Promise<VerifyResult>;
+    verifyGatewayToken(token: string, requestBaseUrl: string, expectedAudience?: string | readonly string[], expectedIssuer?: string | readonly string[]): Promise<VerifyResult>;
     /**
      * Sign an access token for an authenticated user
      */
-    signAccessToken(user: UserInfo, scopes: string[], audience?: string, consentMetadata?: ConsentMetadata): Promise<string>;
+    signAccessToken(user: UserInfo, scopes: string[], audience?: string, consentMetadata?: ConsentMetadata, 
+    /** The issuer to name (`iss`): {@link issuerFor} the request. Default: the boot-time issuer. */
+    issuer?: string): Promise<string>;
     /**
      * Exchange an authorization code for tokens
      */
     exchangeCode(code: string, clientId: string, redirectUri: string, codeVerifier: string, clientSecret?: string, 
     /** The protected resource the token is for when the grant recorded none (#269). */
-    defaultAudience?: string): Promise<TokenResponse | {
+    defaultAudience?: string, 
+    /** The issuer the access token names: {@link issuerFor} the token request. */
+    issuer?: string): Promise<TokenResponse | {
         error: string;
         error_description: string;
     }>;
@@ -388,7 +428,9 @@ export declare class LocalPrimaryAuth extends FrontMcpAuth<LocalPrimaryAuthOptio
      */
     refreshAccessToken(refreshToken: string, clientId: string, clientSecret?: string, 
     /** The protected resource the token is for when the grant recorded none (#269). */
-    defaultAudience?: string): Promise<TokenResponse | {
+    defaultAudience?: string, 
+    /** The issuer the access token names: {@link issuerFor} the token request. */
+    issuer?: string): Promise<TokenResponse | {
         error: string;
         error_description: string;
     }>;

package/auth/instances/instance.local-primary-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instance.local-primary-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/instances/instance.local-primary-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,iBAAiB,EASjB,sBAAsB,EAMtB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,aAAa,EAClB,KAAK,kBAAkB,EAGvB,KAAK,sBAAsB,IAAI,UAAU,EACzC,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAYxB,OAAO,EACL,YAAY,EAGZ,KAAK,cAAc,EACnB,KAAK,GAAG,EACR,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAML,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAC;AAmBrE;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAiBnH;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAwBD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,kBAAkB;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gGAAgG;IAChG,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,6FAA6F;IAC7F,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAYD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS;AAC5B,6DAA6D;AAC7D,UAAU,GAAE,SAAS,MAAM,EAAO,GACjC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAY9C;AAyBD,qBAAa,gBAAiB,SAAQ,YAAY,CAAC,uBAAuB,CAAC;IAmKvE,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,SAAS;IAnKnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAM;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,WAAW,CAA0B;IAE7C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAE9D,gEAAgE;IAChE,OAAO,CAAC,sBAAsB,CAAqB;IAEnD,6DAA6D;IAC7D,OAAO,CAAC,yBAAyB,CAA4B;IAE7D,gDAAgD;IAChD,OAAO,CAAC,0BAA0B,CAAa;IAE/C,4EAA4E;IAC5E,OAAO,CAAC,gBAAgB,CAAe;IAEvC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAoB;IAE1D,yEAAyE;IACzE,OAAO,CAAC,cAAc,CAAC,CAAiB;IAExC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAA0B;IAEtD;;;;OAIG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAAyB;IAErD,0EAA0E;IAC1E,IAAI,eAAe,IAAI,sBAAsB,GAAG,SAAS,CAExD;IAED;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAAC,CAAqB;IAEpD,uDAAuD;IACvD,IAAI,kBAAkB,IAAI,kBAAkB,GAAG,SAAS,CAEvD;IAED,gEAAgE;IAChE,IAAI,kBAAkB,IAAI,kBAAkB,CAE3C;IAED,6DAA6D;IAC7D,IAAI,qBAAqB,IAAI,yBAAyB,CAErD;IAED,gDAAgD;IAChD,IAAI,sBAAsB,IAAI,UAAU,CAEvC;IAED;;;;OAIG;IACH,IAAI,YAAY,IAAI,YAAY,CAE/B;IAED;;;;OAIG;IACH,IAAI,iBAAiB,IAAI,iBAAiB,CAEzC;IAED;;;OAGG;IACH,YAAY,IAAI,iBAAiB,GAAG,SAAS;IAO7C;;;;OAIG;IACH,YAAY,IAAI,OAAO;IAQvB,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6C;IAE7E;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB,CAAC,CAAS;IAEtC,iFAAiF;IACjF,IAAI,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAQ;IAC9C,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;gBAG/C,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,gBAAgB,EACnC,OAAO,EAAE,uBAAuB;IA+ElC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,YAAY;IAmBpB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;OAQG;YACW,gBAAgB;IA8B9B;;;;;;;;;;OAUG;IACH;;;;OAIG;IACH,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;;;;;;;;;;OAaG;IACG,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAuC1E,OAAO,CAAC,sBAAsB;IAkB9B,yEAAyE;IACzE,OAAO,CAAC,8BAA8B;YAUxB,yBAAyB;IAgDvC;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAO7B;;;;;;;;;;;;;;;;OAgBG;YACW,qBAAqB;IA0CnC;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IAOrC;;;;;;;;OAQG;IACG,gBAAgB,CAAC,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO;IAW1D,wFAAwF;IACxF,OAAO,CAAC,eAAe;IAKvB;;;;;;;;;;;;;;;;;OAiBG;IACY,kBAAkB,CAC/B,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,MAAM,EACtB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAC5C,OAAO,CAAC,YAAY,CAAC;IAuBxB;;OAEG;IACG,eAAe,CACnB,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,MAAM,CAAC;IAgElB;;OAEG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM;IACrB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA4JxE;;OAEG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,MAAM;IACrB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAmFxE;;OAEG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAElB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAE7B,aAAa,CAAC,EAAE,MAAM,CAAC;QAGvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAE5B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACxC,GAAG,OAAO,CAAC,MAAM,CAAC;cA+BH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsDlC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAItE,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;YAI1C,iBAAiB;IAuB/B;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI;IAyBtD;;;;;;OAMG;YACW,0BAA0B;IA4BxC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,2BAA2B;IA2CnC;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sBAAsB;IA2C9B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAQ9B;;OAEG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS;IAIzE;;OAEG;IACG,yBAAyB,CAC7B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GACA,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwBzB;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA4EhF;;OAEG;IACG,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAiE9G;;;;;;;;;;OAUG;YACW,qBAAqB;IAgCnC;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;CA8CjF"}
+{"version":3,"file":"instance.local-primary-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/instances/instance.local-primary-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,iBAAiB,EASjB,sBAAsB,EAMtB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,aAAa,EAClB,KAAK,kBAAkB,EAGvB,KAAK,sBAAsB,IAAI,UAAU,EACzC,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAYxB,OAAO,EAEL,YAAY,EAIZ,KAAK,cAAc,EACnB,KAAK,GAAG,EACR,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAKL,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAC;AAmBrE;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAiBnH;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAwBD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,kBAAkB;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gGAAgG;IAChG,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,6FAA6F;IAC7F,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAYD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS;AAC5B,6DAA6D;AAC7D,UAAU,GAAE,SAAS,MAAM,EAAO,GACjC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAY9C;AAmCD,qBAAa,gBAAiB,SAAQ,YAAY,CAAC,uBAAuB,CAAC;IAsKvE,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,SAAS;IAtKnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6GAA6G;IAC7G,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sGAAsG;IACtG,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAC3C,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAM;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,WAAW,CAA0B;IAE7C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAE9D,gEAAgE;IAChE,OAAO,CAAC,sBAAsB,CAAqB;IAEnD,6DAA6D;IAC7D,OAAO,CAAC,yBAAyB,CAA4B;IAE7D,gDAAgD;IAChD,OAAO,CAAC,0BAA0B,CAAa;IAE/C,4EAA4E;IAC5E,OAAO,CAAC,gBAAgB,CAAe;IAEvC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAoB;IAE1D,yEAAyE;IACzE,OAAO,CAAC,cAAc,CAAC,CAAiB;IAExC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAA0B;IAEtD;;;;OAIG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAAyB;IAErD,0EAA0E;IAC1E,IAAI,eAAe,IAAI,sBAAsB,GAAG,SAAS,CAExD;IAED;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAAC,CAAqB;IAEpD,uDAAuD;IACvD,IAAI,kBAAkB,IAAI,kBAAkB,GAAG,SAAS,CAEvD;IAED,gEAAgE;IAChE,IAAI,kBAAkB,IAAI,kBAAkB,CAE3C;IAED,6DAA6D;IAC7D,IAAI,qBAAqB,IAAI,yBAAyB,CAErD;IAED,gDAAgD;IAChD,IAAI,sBAAsB,IAAI,UAAU,CAEvC;IAED;;;;OAIG;IACH,IAAI,YAAY,IAAI,YAAY,CAE/B;IAED;;;;OAIG;IACH,IAAI,iBAAiB,IAAI,iBAAiB,CAEzC;IAED;;;OAGG;IACH,YAAY,IAAI,iBAAiB,GAAG,SAAS;IAO7C;;;;OAIG;IACH,YAAY,IAAI,OAAO;IAQvB,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6C;IAE7E;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB,CAAC,CAAS;IAEtC,iFAAiF;IACjF,IAAI,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAQ;IAC9C,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAkB;gBAG/C,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,gBAAgB,EACnC,OAAO,EAAE,uBAAuB;IAgFlC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,YAAY;IAIpB,qGAAqG;IACrG,OAAO,CAAC,gBAAgB;IAMxB;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM;IAa1C;;;;;;;OAOG;IACH,kBAAkB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,MAAM,EAAE;IAkB9D;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;OAQG;YACW,gBAAgB;IA8B9B;;;;;;;;;;OAUG;IACH;;;;OAIG;IACH,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;;;;;;;;;;OAaG;IACG,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAuC1E,OAAO,CAAC,sBAAsB;IAkB9B,yEAAyE;IACzE,OAAO,CAAC,8BAA8B;YAUxB,yBAAyB;IAgDvC;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAO7B;;;;;;;;;;;;;;;;OAgBG;YACW,qBAAqB;IA0CnC;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IAOrC;;;;;;;;;OASG;IACG,gBAAgB,CAAC,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAW3E,wFAAwF;IACxF,OAAO,CAAC,eAAe;IAKvB;;;;;;;;;;;;;;;;;;;OAmBG;IACY,kBAAkB,CAC/B,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,MAAM,EACtB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EAC7C,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAC1C,OAAO,CAAC,YAAY,CAAC;IAwBxB;;OAEG;IACG,eAAe,CACnB,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,eAAe;IACjC,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC;IAgElB;;OAEG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM;IACrB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM;IACxB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA4JxE;;OAEG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,MAAM;IACrB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM;IACxB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAmFxE;;OAEG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAElB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAE7B,aAAa,CAAC,EAAE,MAAM,CAAC;QAGvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAE5B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACxC,GAAG,OAAO,CAAC,MAAM,CAAC;cA+BH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsDlC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAItE,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;YAI1C,iBAAiB;IAuB/B;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI;IAyBtD;;;;;;OAMG;YACW,0BAA0B;IA4BxC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,2BAA2B;IA2CnC;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sBAAsB;IA2C9B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAQ9B;;OAEG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS;IAIzE;;OAEG;IACG,yBAAyB,CAC7B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GACA,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwBzB;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA4EhF;;OAEG;IACG,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAiE9G;;;;;;;;;;OAUG;YACW,qBAAqB;IAgCnC;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;CA8CjF"}

package/auth/secure-store/secure-store.providers.d.ts

@@ -4,8 +4,8 @@
  * Registers the per-request {@link SecureStoreAccessor} (`this.secureStore`).
  * The backend is a GLOBAL singleton owned by LocalPrimaryAuth; the accessor is
  * CONTEXT-scoped because it must resolve the CURRENT request's namespace (the
- * authenticated `sub` for `user` scope, the transport `sessionId` for `session`
- * scope) before calling the backend.
+ * authenticated `sub` for `user` scope, the verified session, else the signed-in
+ * caller, for `session` scope) before calling the backend.
  */
 import { type SecureStoreBackend, type SecureStoreScope } from '@frontmcp/auth';
 import { type Token } from '@frontmcp/di';
@@ -17,10 +17,13 @@ import { type FrontMcpContext } from '../../context/frontmcp-context';
  */
 export declare const SECURE_STORE_BACKEND: Token<SecureStoreBackend>;
 /**
- * Resolve the transport session id for the current request, or undefined when
- * there is no session. Used for `session`-scoped secrets.
+ * The identity `session`-scoped secrets of the current request belong to: the session the server
+ * verified, else the signed-in caller (see {@link sessionScopeIdentity}).
+ *
+ * @throws SessionIdentityRequiredError for an anonymous caller without a verified session, which no
+ *   later request could be matched to
  */
-export declare function resolveRequestSessionId(ctx: FrontMcpContext): string | undefined;
+export declare function resolveRequestSessionId(ctx: FrontMcpContext): string;
 /**
  * Build the DI providers that back `this.secureStore`.
  *

package/auth/secure-store/secure-store.providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secure-store.providers.d.ts","sourceRoot":"","sources":["../../../src/auth/secure-store/secure-store.providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAiB,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAItE;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAkD,KAAK,CAAC,kBAAkB,CAAC,CAAC;AAE7G;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAGhF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,YAAY,EAAE,CA6BjB"}
+{"version":3,"file":"secure-store.providers.d.ts","sourceRoot":"","sources":["../../../src/auth/secure-store/secure-store.providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAiB,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAMtE;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAkD,KAAK,CAAC,kBAAkB,CAAC,CAAC;AAE7G;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAIpE;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,YAAY,EAAE,CA6BjB"}

package/auth/session-scope-identity.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Who session-scoped storage of a request belongs to.
+ */
+import { type FrontMcpContext } from '../context/frontmcp-context';
+/**
+ * The identity that keys session-scoped storage (secure-store secrets, auth-provider credentials)
+ * for the current request: the session the server verified (`FrontMcpContext.verifiedSessionId`),
+ * else `principal:<sub>` for a signed-in caller, so its storage lasts across its requests.
+ *
+ * Never `FrontMcpContext.sessionId` itself: under MCP 2026-07-28 and on the stateless transports it
+ * is whatever `mcp-session-id` the client sent, so a caller who sent another caller's id reached
+ * that caller's storage. The `principal:` form never matches a session id the server mints
+ * (`iv.tag.data`, no `:`).
+ *
+ * @returns The identity, or undefined for an anonymous caller without a verified session
+ */
+export declare function sessionScopeIdentity(ctx: FrontMcpContext): string | undefined;
+//# sourceMappingURL=session-scope-identity.d.ts.map

package/auth/session-scope-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-scope-identity.d.ts","sourceRoot":"","sources":["../../src/auth/session-scope-identity.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAS7E"}

package/auth/vault/auth-providers.providers.d.ts

@@ -4,10 +4,8 @@
  * Defines dependency injection providers for the AuthProviders vault system.
  * These providers are registered at scope initialization when AuthProviders is enabled.
  */
-import type { Token } from '@frontmcp/di';
-import { ProviderScope } from '@frontmcp/di';
-import type { AuthorizationVault, AuthProvidersVaultOptions } from '@frontmcp/auth';
-import { LazyCredentialLoader } from '@frontmcp/auth';
+import { LazyCredentialLoader, type AuthorizationVault, type AuthProvidersVaultOptions } from '@frontmcp/auth';
+import { ProviderScope, type Token } from '@frontmcp/di';
 /**
  * Token for lazy loader (internal use)
  */

package/auth/vault/auth-providers.providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-providers.providers.d.ts","sourceRoot":"","sources":["../../../src/auth/vault/auth-providers.providers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,yBAAyB,EAA4B,MAAM,gBAAgB,CAAC;AAC9G,OAAO,EAQL,oBAAoB,EACrB,MAAM,gBAAgB,CAAC;AAMxB;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAoD,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAEnH;;;GAGG;AACH,UAAU,wBAAwB;IAChC,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,UAAU,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,SAAS,KAAK,EAAE,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,yBAAyB,EAClC,SAAS,EAAE,kBAAkB,GAC5B,wBAAwB,EAAE,CA4E5B;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAWnF"}
+{"version":3,"file":"auth-providers.providers.d.ts","sourceRoot":"","sources":["../../../src/auth/vault/auth-providers.providers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAQL,oBAAoB,EACpB,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAE/B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AASzD;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAoD,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAEnH;;;GAGG;AACH,UAAU,wBAAwB;IAChC,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,UAAU,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,SAAS,KAAK,EAAE,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,yBAAyB,EAClC,SAAS,EAAE,kBAAkB,GAC5B,wBAAwB,EAAE,CA+E5B;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAWnF"}

package/channel/channel-scope.helper.d.ts

@@ -1,9 +1,10 @@
-import { type EntryOwnerRef, type FrontMcpLogger } from '../common';
+import { type EntryOwnerRef, type FrontMcpLogger, type FrontMcpServer } from '../common';
 import { type ChannelType } from '../common/interfaces/channel.interface';
 import { type ChannelsConfigOptions } from '../common/metadata/channel.metadata';
 import type FlowRegistry from '../flows/flow.registry';
 import type { NotificationService } from '../notification/notification.service';
 import type ProviderRegistry from '../provider/provider.registry';
+import { type CheckClientIpFn } from '../server/custom-routes.helper';
 import type ToolRegistry from '../tool/tool.registry';
 import { ChannelNotificationService } from './channel-notification.service';
 import ChannelRegistry from './channel.registry';
@@ -20,6 +21,17 @@ export interface RegisterChannelCapabilitiesArgs {
     agentEmitterSubscribe?: (cb: (event: unknown) => void) => () => void;
     /** Optional job emitter subscribe function for job-completion sources */
     jobEmitterSubscribe?: (cb: (event: unknown) => void) => () => void;
+    /**
+     * Where `webhook` sources get their HTTP route: the scope's server, with the same reserved-path
+     * guard and `throttle.ipFilter` check as custom `http.routes`. Without it, webhook sources get
+     * no route.
+     */
+    http?: {
+        server: FrontMcpServer;
+        checkClientIp: CheckClientIpFn;
+        entryPath: string;
+        routeBase: string;
+    };
     logger: FrontMcpLogger;
 }
 export interface ChannelCapabilitiesResult {

package/channel/channel-scope.helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"channel-scope.helper.d.ts","sourceRoot":"","sources":["../../src/channel/channel-scope.helper.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,KAAK,YAAY,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,KAAK,gBAAgB,MAAM,+BAA+B,CAAC;AAElE,OAAO,KAAK,YAAY,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,eAAe,MAAM,oBAAoB,CAAC;AAKjD,OAAO,EAAE,eAAe,EAAsB,MAAM,4BAA4B,CAAC;AAGjF,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,aAAa,CAAC;IACrB,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,cAAc,EAAE,qBAAqB,CAAC;IACtC,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B,YAAY,EAAE,YAAY,CAAC;IAC3B,6EAA6E;IAC7E,qBAAqB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IACrE,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IACnE,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,eAAe,EAAE,eAAe,CAAC;IACjC,0BAA0B,EAAE,0BAA0B,CAAC;IACvD,eAAe,EAAE,eAAe,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,yBAAyB,CAAC,CA4KpC"}
+{"version":3,"file":"channel-scope.helper.d.ts","sourceRoot":"","sources":["../../src/channel/channel-scope.helper.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,KAAK,cAAc,EAA6B,MAAM,WAAW,CAAC;AACpH,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAGL,KAAK,qBAAqB,EAE3B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,YAAY,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,KAAK,gBAAgB,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,YAAY,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,eAAe,MAAM,oBAAoB,CAAC;AAKjD,OAAO,EAAE,eAAe,EAAsB,MAAM,4BAA4B,CAAC;AAQjF,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,aAAa,CAAC;IACrB,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,cAAc,EAAE,qBAAqB,CAAC;IACtC,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B,YAAY,EAAE,YAAY,CAAC;IAC3B,6EAA6E;IAC7E,qBAAqB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IACrE,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IACnE;;;;OAIG;IACH,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,cAAc,CAAC;QACvB,aAAa,EAAE,eAAe,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,eAAe,EAAE,eAAe,CAAC;IACjC,0BAA0B,EAAE,0BAA0B,CAAC;IACvD,eAAe,EAAE,eAAe,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,yBAAyB,CAAC,CAgMpC"}

package/channel/sources/completion-events.d.ts

@@ -0,0 +1,24 @@
+import type { AgentCompletionEvent } from './agent-completion.source';
+import type { JobCompletionEvent } from './job-completion.source';
+type Listener<T> = (event: T) => void;
+/** One kind of completion event: listeners are called in order, and one that throws doesn't stop the rest. */
+declare class CompletionStream<T> {
+    private readonly listeners;
+    subscribe(listener: Listener<T>): () => void;
+    emit(event: T): void;
+}
+/**
+ * The agent and job completions of one scope, which the `agent-completion` and `job-completion`
+ * channel sources subscribe to. The `agents:call-agent` flow publishes agent runs, and the job
+ * execution manager's status notifications publish job and workflow runs.
+ */
+export declare class ScopeCompletionEvents {
+    readonly agents: CompletionStream<AgentCompletionEvent>;
+    readonly jobs: CompletionStream<JobCompletionEvent>;
+}
+/** The completion events of a scope, created on first use. */
+export declare function completionEventsOf(scope: object): ScopeCompletionEvents;
+/** A run's result as channel event text: strings as they are, anything else as JSON. */
+export declare function completionOutputText(value: unknown): string | undefined;
+export {};
+//# sourceMappingURL=completion-events.d.ts.map

package/channel/sources/completion-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completion-events.d.ts","sourceRoot":"","sources":["../../../src/channel/sources/completion-events.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAElE,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC;AAEtC,8GAA8G;AAC9G,cAAM,gBAAgB,CAAC,CAAC;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IAEpD,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI;IAO5C,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI;CASrB;AAED;;;;GAIG;AACH,qBAAa,qBAAqB;IAChC,QAAQ,CAAC,MAAM,yCAAgD;IAC/D,QAAQ,CAAC,IAAI,uCAA8C;CAC5D;AAID,8DAA8D;AAC9D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,CAOvE;AAED,wFAAwF;AACxF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAQvE"}

package/channel/sources/job-completion.source.d.ts

@@ -1,6 +1,6 @@
 import type { FrontMcpLogger } from '../../common';
-import type { ChannelInstance } from '../channel.instance';
 import type { ChannelJobCompletionSource } from '../../common/metadata/channel.metadata';
+import type { ChannelInstance } from '../channel.instance';
 /**
  * Event payload from job completion.
  */

package/channel/sources/job-completion.source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-completion.source.d.ts","sourceRoot":"","sources":["../../../src/channel/sources/job-completion.source.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AAEzF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,0BAA0B,EACxC,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,KAAK,MAAM,IAAI,EAC5E,MAAM,EAAE,cAAc,GACrB,MAAM,IAAI,CAkBZ"}
+{"version":3,"file":"job-completion.source.d.ts","sourceRoot":"","sources":["../../../src/channel/sources/job-completion.source.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACzF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,0BAA0B,EACxC,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,KAAK,MAAM,IAAI,EAC5E,MAAM,EAAE,cAAc,GACrB,MAAM,IAAI,CA0BZ"}

package/channel/sources/webhook.source.d.ts

@@ -1,6 +1,6 @@
 import type { FrontMcpLogger } from '../../common';
-import type { ChannelInstance } from '../channel.instance';
 import type { ChannelWebhookSource } from '../../common/metadata/channel.metadata';
+import type { ChannelInstance } from '../channel.instance';
 /**
  * Webhook request context passed to channel handlers.
  */

package/channel/sources/webhook.source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook.source.d.ts","sourceRoot":"","sources":["../../../src/channel/sources/webhook.source.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAEnF;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,oBAAoB,EAClC,MAAM,EAAE,cAAc,GACrB,CACD,GAAG,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,EAC5F,GAAG,EAAE;IAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;KAAE,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;CAAE,KACjG,OAAO,CAAC,IAAI,CAAC,CA8BjB"}
+{"version":3,"file":"webhook.source.d.ts","sourceRoot":"","sources":["../../../src/channel/sources/webhook.source.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAEnF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,oBAAoB,EAClC,MAAM,EAAE,cAAc,GACrB,CACD,GAAG,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,EAC5F,GAAG,EAAE;IAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;KAAE,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;CAAE,KACjG,OAAO,CAAC,IAAI,CAAC,CA+BjB"}

package/common/availability/availability.utils.d.ts

@@ -22,8 +22,10 @@ import type { FrontMcpLogger } from '../interfaces/logger.interface';
 export type CallSurface = NonNullable<EntryAvailability['surface']>[number];
 /**
  * The surface a flow was called from, when its caller tagged one. The MCP request handlers tag
- * every call (`'mcp'`, or `'cli'` for the in-process client of a CLI build). An in-process dispatch
- * such as `this.callTool()` tags none.
+ * every call (`'mcp'`, or `'cli'` for the in-process client of a CLI build), an agent its model's
+ * tool calls (`'agent'`), and `this.callTool()` in a job, an agent or a channel handling a webhook
+ * tags `'job'`, `'agent'` or `'http-trigger'`. A tool's own `this.callTool()` is in-process dispatch
+ * and tags none.
  */
 export declare function callSurfaceOf(ctx: unknown): CallSurface | undefined;
 /**

package/common/availability/availability.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"availability.utils.d.ts","sourceRoot":"","sources":["../../../src/common/availability/availability.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAIL,KAAK,iBAAiB,EAEvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,mFAAmF;AACnF,MAAM,MAAM,WAAW,GAAG,WAAW,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAI5E;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAGnE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,iBAAiB,GAAG,SAAS,EAC3C,OAAO,EAAE,WAAW,GAAG,SAAS,GAC/B,OAAO,CAGT;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,iBAAiB,GAAG,SAAS,EAC3C,OAAO,EAAE,WAAW,GAAG,SAAS,GAC/B,WAAW,GAAG,aAAa,GAAG,aAAa,CAG7C;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,iBAAiB,GAAG,SAAS,EAC3C,OAAO,EAAE,WAAW,GAAG,SAAS,GAC/B,qBAAqB,CAIvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE;QAAE,aAAa,CAAC,EAAE,iBAAiB,CAAA;KAAE,CAAA;CAAE,EAClH,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,SAAS,CAAC,EAAE,EACrB,MAAM,EAAE,cAAc,GACrB,IAAI,CA2DN"}
+{"version":3,"file":"availability.utils.d.ts","sourceRoot":"","sources":["../../../src/common/availability/availability.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAIL,KAAK,iBAAiB,EAEvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,mFAAmF;AACnF,MAAM,MAAM,WAAW,GAAG,WAAW,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAI5E;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAGnE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,iBAAiB,GAAG,SAAS,EAC3C,OAAO,EAAE,WAAW,GAAG,SAAS,GAC/B,OAAO,CAGT;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,iBAAiB,GAAG,SAAS,EAC3C,OAAO,EAAE,WAAW,GAAG,SAAS,GAC/B,WAAW,GAAG,aAAa,GAAG,aAAa,CAG7C;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,iBAAiB,GAAG,SAAS,EAC3C,OAAO,EAAE,WAAW,GAAG,SAAS,GAC/B,qBAAqB,CAIvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE;QAAE,aAAa,CAAC,EAAE,iBAAiB,CAAA;KAAE,CAAA;CAAE,EAClH,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,SAAS,CAAC,EAAE,EACrB,MAAM,EAAE,cAAc,GACrB,IAAI,CA2DN"}

package/common/decorators/hook.decorator.d.ts

@@ -10,6 +10,8 @@ import { type FlowName, type HookMetadata, type HookOptions } from '../metadata'
  * This is called by collectFlowHookMap during flow registration
  */
 export declare function resolvePendingTC39HooksForClass(ctor: Function): HookMetadata[];
+/** The pending TC39 hooks of a class, left pending for the flow registration that resolves them. */
+export declare function peekPendingTC39HooksForClass(ctor: Function): HookMetadata[];
 /**
  * Creates a typed Stage hook decorator for a specific flow
  * @example

package/common/decorators/hook.decorator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hook.decorator.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/hook.decorator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAsB,MAAM,aAAa,CAAC;AAmBrG;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,QAAQ,GAAG,YAAY,EAAE,CAE9E;AAkFD;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI,IAI1C,iCAAQ,EAAE,OAAM,WAAW,0BAAU,qBAGvD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI,IAIzC,iCAAQ,EAAE,OAAM,WAAW,0BAAU,qBAGvD;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI,IAIxC,iCAAQ,EAAE,OAAM,WAAW,0BAAU,qBAGvD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI,IAI3C,iCAAQ,EAAE,OAAM,WAAW,0BAAU,qBAGvD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI;;;;;EAO5D"}
+{"version":3,"file":"hook.decorator.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/hook.decorator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAsB,MAAM,aAAa,CAAC;AAmBrG;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,QAAQ,GAAG,YAAY,EAAE,CAE9E;AAED,oGAAoG;AACpG,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,QAAQ,GAAG,YAAY,EAAE,CAE3E;AAkFD;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI,IAI1C,iCAAQ,EAAE,OAAM,WAAW,0BAAU,qBAGvD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI,IAIzC,iCAAQ,EAAE,OAAM,WAAW,0BAAU,qBAGvD;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI,IAIxC,iCAAQ,EAAE,OAAM,WAAW,0BAAU,qBAGvD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI,IAI3C,iCAAQ,EAAE,OAAM,WAAW,0BAAU,qBAGvD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,IAAI,SAAS,QAAQ,EAAE,IAAI,EAAE,IAAI;;;;;EAO5D"}

package/common/entries/agent.entry.d.ts

@@ -1,5 +1,6 @@
 import type { JSONSchema } from '@frontmcp/lazy-zod';
 import type { AuthInfo, CallToolRequest, CallToolResult, Notification, Request, RequestHandlerExtra, Tool } from '@frontmcp/protocol';
+import type ProviderRegistry from '../../provider/provider.registry';
 import type { AgentInputOf, AgentOutputOf } from '../decorators';
 import type { AgentContext } from '../interfaces';
 import type { AgentMetadata, ToolInputType, ToolOutputType } from '../metadata';
@@ -54,6 +55,11 @@ export declare abstract class AgentEntry<InSchema extends ToolInputType = ToolIn
      * The unique ID of the agent.
      */
     id: string;
+    /**
+     * Get the provider registry for this agent.
+     * Used by flows to build context-aware providers for CONTEXT-scoped dependencies.
+     */
+    abstract get providers(): ProviderRegistry;
     /**
      * Input schema for the agent (Zod shape or object).
      */

package/common/entries/agent.entry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.entry.d.ts","sourceRoot":"","sources":["../../../src/common/entries/agent.entry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EACV,QAAQ,EACR,eAAe,EACf,cAAc,EACd,YAAY,EACZ,OAAO,EACP,mBAAmB,EACnB,IAAI,EACL,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7D,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD,mCAAmC;AACnC,KAAK,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;AAMxC;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC;AAEnE;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG;IACxE,QAAQ,EAAE,QAAQ,CAAC;IACnB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACjC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAM/C;;;;;;;;GAQG;AACH,8BAAsB,UAAU,CAC9B,QAAQ,SAAS,aAAa,GAAG,aAAa,EAC9C,SAAS,SAAS,cAAc,GAAG,cAAc,EACjD,EAAE,GAAG,YAAY,CAAC;IAAE,WAAW,EAAE,QAAQ,CAAA;CAAE,CAAC,EAC5C,GAAG,GAAG,aAAa,CAAC;IAAE,YAAY,EAAE,SAAS,CAAA;CAAE,CAAC,CAChD,SAAQ,SAAS,CAAC,WAAW,EAAE,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,aAAa,CAAC;IACzF;;OAEG;IACH,KAAK,EAAE,aAAa,CAAC;IAErB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IAEX;;OAEG;IACH,WAAW,CAAC,EAAE,QAAQ,CAAC;IAEvB;;OAEG;IACH,cAAc,CAAC,EAAE,UAAU,CAAC;IAE5B;;OAEG;IACH,YAAY,CAAC,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAM5B;;OAEG;IACH,cAAc,IAAI,QAAQ,GAAG,SAAS;IAItC;;OAEG;IACH,eAAe,IAAI,SAAS,GAAG,SAAS;IAQxC;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,GAAG,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC;IAEtG;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,aAAa;IAEpE;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,iBAAiB;IAE7E;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,mBAAmB,CAAC,iBAAiB,CAAC;IAEnG;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,IAAI,IAAI;IAElC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,IAAI,OAAO;IAEpC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,IAAI,OAAO;IAE/B;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,IAAI,MAAM,EAAE;CACxC"}
+{"version":3,"file":"agent.entry.d.ts","sourceRoot":"","sources":["../../../src/common/entries/agent.entry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EACV,QAAQ,EACR,eAAe,EACf,cAAc,EACd,YAAY,EACZ,OAAO,EACP,mBAAmB,EACnB,IAAI,EACL,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7D,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD,mCAAmC;AACnC,KAAK,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;AAMxC;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC;AAEnE;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG;IACxE,QAAQ,EAAE,QAAQ,CAAC;IACnB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAQjC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAM/C;;;;;;;;GAQG;AACH,8BAAsB,UAAU,CAC9B,QAAQ,SAAS,aAAa,GAAG,aAAa,EAC9C,SAAS,SAAS,cAAc,GAAG,cAAc,EACjD,EAAE,GAAG,YAAY,CAAC;IAAE,WAAW,EAAE,QAAQ,CAAA;CAAE,CAAC,EAC5C,GAAG,GAAG,aAAa,CAAC;IAAE,YAAY,EAAE,SAAS,CAAA;CAAE,CAAC,CAChD,SAAQ,SAAS,CAAC,WAAW,EAAE,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,aAAa,CAAC;IACzF;;OAEG;IACH,KAAK,EAAE,aAAa,CAAC;IAErB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IAEX;;;OAGG;IACH,QAAQ,KAAK,SAAS,IAAI,gBAAgB,CAAC;IAE3C;;OAEG;IACH,WAAW,CAAC,EAAE,QAAQ,CAAC;IAEvB;;OAEG;IACH,cAAc,CAAC,EAAE,UAAU,CAAC;IAE5B;;OAEG;IACH,YAAY,CAAC,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAM5B;;OAEG;IACH,cAAc,IAAI,QAAQ,GAAG,SAAS;IAItC;;OAEG;IACH,eAAe,IAAI,SAAS,GAAG,SAAS;IAQxC;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,GAAG,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC;IAEtG;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,aAAa;IAEpE;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,iBAAiB;IAE7E;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,mBAAmB,CAAC,iBAAiB,CAAC;IAEnG;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,IAAI,IAAI;IAElC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,IAAI,OAAO;IAEpC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,IAAI,OAAO;IAE/B;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,IAAI,MAAM,EAAE;CACxC"}

package/common/entries/scope.entry.d.ts

@@ -57,9 +57,8 @@ export declare abstract class ScopeEntry extends BaseEntry<ScopeRecord, unknown,
     abstract get authoritiesContextBuilder(): AuthoritiesContextBuilder | undefined;
     abstract get authoritiesScopeMapping(): AuthoritiesScopeMapping | undefined;
     /**
-     * Collect all supported OAuth scopes from base OIDC scopes and
-     * tool-level authProvider scope declarations.
-     * Used by PRM endpoint to populate `scopes_supported`.
+     * Collect the OAuth scopes entries declare on their `authProviders`.
+     * The PRM endpoint advertises them in `scopes_supported`.
      */
     abstract getAllSupportedScopes(): string[];
     /**

package/common/entries/scope.entry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope.entry.d.ts","sourceRoot":"","sources":["../../../src/common/entries/scope.entry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC5G,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,OAAO,KAAK,aAAa,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,WAAW,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,YAAY,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,cAAc,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,YAAY,MAAM,0BAA0B,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,yBAAyB,EAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,8BAAsB,UAAW,SAAQ,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAEzC,IAAI,QAAQ,IAAI,MAAM,CAIrB;IAED,QAAQ,KAAK,IAAI,IAAI,YAAY,CAAC;IAElC,QAAQ,KAAK,KAAK,IAAI,YAAY,CAAC;IAEnC,QAAQ,KAAK,aAAa,IAAI,YAAY,CAAC;IAE3C,QAAQ,KAAK,SAAS,IAAI,yBAAyB,CAAC;IAEpD,QAAQ,KAAK,IAAI,IAAI,WAAW,CAAC;IAEjC,QAAQ,KAAK,KAAK,IAAI,YAAY,CAAC;IAEnC,QAAQ,KAAK,SAAS,IAAI,gBAAgB,CAAC;IAE3C,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC;IAEvC,QAAQ,KAAK,MAAM,IAAI,sBAAsB,CAAC;IAE9C,QAAQ,KAAK,aAAa,IAAI,mBAAmB,CAAC;IAElD,QAAQ,KAAK,MAAM,IAAI,aAAa,CAAC;IAErC,QAAQ,KAAK,MAAM,IAAI,cAAc,GAAG,SAAS,CAAC;IAElD;;;;OAIG;IACH,QAAQ,KAAK,MAAM,IAAI,cAAc,GAAG,SAAS,CAAC;IAElD,QAAQ,KAAK,gBAAgB,IAAI,gBAAgB,GAAG,SAAS,CAAC;IAE9D,SAAS,CAAC,EAAE,SAAS,CAAC;IAEtB,QAAQ,KAAK,gBAAgB,IAAI,YAAY,GAAG,SAAS,CAAC;IAE1D,QAAQ,KAAK,gBAAgB,IAAI,gBAAgB,GAAG,SAAS,CAAC;IAE9D,mEAAmE;IACnE,QAAQ,KAAK,SAAS,IAAI,SAAS,GAAG,SAAS,CAAC;IAEhD,4EAA4E;IAC5E,QAAQ,KAAK,KAAK,IAAI,YAAY,GAAG,SAAS,CAAC;IAE/C,QAAQ,KAAK,iBAAiB,IAAI,iBAAiB,GAAG,SAAS,CAAC;IAEhE,QAAQ,KAAK,yBAAyB,IAAI,yBAAyB,GAAG,SAAS,CAAC;IAEhF,QAAQ,KAAK,uBAAuB,IAAI,uBAAuB,GAAG,SAAS,CAAC;IAE5E;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,IAAI,MAAM,EAAE;IAE1C;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAyC;IAE5E;;;;OAIG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAc3D,QAAQ,CAAC,aAAa,CAAC,GAAG,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAE3D,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,QAAQ,EACpC,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EACxB,cAAc,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAChC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAE1C,QAAQ,CAAC,gBAAgB,CAAC,IAAI,SAAS,QAAQ,EAC7C,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EACxB,cAAc,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAChC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;CAC/B"}
+{"version":3,"file":"scope.entry.d.ts","sourceRoot":"","sources":["../../../src/common/entries/scope.entry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC5G,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,OAAO,KAAK,aAAa,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,WAAW,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,YAAY,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,cAAc,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,YAAY,MAAM,0BAA0B,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,yBAAyB,EAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,8BAAsB,UAAW,SAAQ,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAEzC,IAAI,QAAQ,IAAI,MAAM,CAIrB;IAED,QAAQ,KAAK,IAAI,IAAI,YAAY,CAAC;IAElC,QAAQ,KAAK,KAAK,IAAI,YAAY,CAAC;IAEnC,QAAQ,KAAK,aAAa,IAAI,YAAY,CAAC;IAE3C,QAAQ,KAAK,SAAS,IAAI,yBAAyB,CAAC;IAEpD,QAAQ,KAAK,IAAI,IAAI,WAAW,CAAC;IAEjC,QAAQ,KAAK,KAAK,IAAI,YAAY,CAAC;IAEnC,QAAQ,KAAK,SAAS,IAAI,gBAAgB,CAAC;IAE3C,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC;IAEvC,QAAQ,KAAK,MAAM,IAAI,sBAAsB,CAAC;IAE9C,QAAQ,KAAK,aAAa,IAAI,mBAAmB,CAAC;IAElD,QAAQ,KAAK,MAAM,IAAI,aAAa,CAAC;IAErC,QAAQ,KAAK,MAAM,IAAI,cAAc,GAAG,SAAS,CAAC;IAElD;;;;OAIG;IACH,QAAQ,KAAK,MAAM,IAAI,cAAc,GAAG,SAAS,CAAC;IAElD,QAAQ,KAAK,gBAAgB,IAAI,gBAAgB,GAAG,SAAS,CAAC;IAE9D,SAAS,CAAC,EAAE,SAAS,CAAC;IAEtB,QAAQ,KAAK,gBAAgB,IAAI,YAAY,GAAG,SAAS,CAAC;IAE1D,QAAQ,KAAK,gBAAgB,IAAI,gBAAgB,GAAG,SAAS,CAAC;IAE9D,mEAAmE;IACnE,QAAQ,KAAK,SAAS,IAAI,SAAS,GAAG,SAAS,CAAC;IAEhD,4EAA4E;IAC5E,QAAQ,KAAK,KAAK,IAAI,YAAY,GAAG,SAAS,CAAC;IAE/C,QAAQ,KAAK,iBAAiB,IAAI,iBAAiB,GAAG,SAAS,CAAC;IAEhE,QAAQ,KAAK,yBAAyB,IAAI,yBAAyB,GAAG,SAAS,CAAC;IAEhF,QAAQ,KAAK,uBAAuB,IAAI,uBAAuB,GAAG,SAAS,CAAC;IAE5E;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,IAAI,MAAM,EAAE;IAE1C;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAyC;IAE5E;;;;OAIG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAc3D,QAAQ,CAAC,aAAa,CAAC,GAAG,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAE3D,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,QAAQ,EACpC,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EACxB,cAAc,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAChC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAE1C,QAAQ,CAAC,gBAAgB,CAAC,IAAI,SAAS,QAAQ,EAC7C,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EACxB,cAAc,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAChC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;CAC/B"}

package/common/interfaces/agent.interface.d.ts

@@ -2,6 +2,7 @@ import { type ZodType } from '@frontmcp/lazy-zod';
 import { type ToolExecutor } from '../../agent/agent-execution-loop';
 import { type ElicitOptions, type ElicitResult } from '../../elicitation';
 import type { AIPlatformType, ClientInfo, McpLoggingLevel } from '../../notification';
+import { type CallSurface } from '../availability';
 import { type AgentInputOf, type AgentOutputOf } from '../decorators';
 import type { AgentMetadata, AgentType, ToolInputType, ToolOutputType } from '../metadata';
 import { ExecutionContextBase, type ExecutionContextBaseArgs } from './execution-context.interface';
@@ -183,6 +184,8 @@ export declare class AgentContext<InSchema extends ToolInputType = ToolInputType
      * is in `swarm.visibleAgents`.
      */
     protected invokeAgent(agentId: string, input: unknown): Promise<unknown>;
+    /** An agent calls tools on the `'agent'` surface, as its model's tool calls do. */
+    protected callToolSurface(): CallSurface;
     /**
      * Send a notification message to the current session.
      * Uses 'notifications/message' per MCP 2025-11-25 spec.
@@ -266,6 +269,11 @@ export declare class AgentContext<InSchema extends ToolInputType = ToolInputType
      * ```
      */
     protected elicit<S extends ZodType>(message: string, requestedSchema: S, options?: ElicitOptions): Promise<ElicitResult<S extends ZodType<infer O> ? O : unknown>>;
+    /**
+     * The context of the request this agent runs in. An agent is built with its own provider registry,
+     * which holds no request-scoped instances, so the context is read from the running request.
+     */
+    private runningRequestContext;
     /**
      * Respond with the final output and end execution.
      *

package/common/interfaces/agent.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.interface.d.ts","sourceRoot":"","sources":["../../../src/common/interfaces/agent.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EAAiB,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEzF,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEpG,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,WAAW,EAEhB,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAC;AAGjC,YAAY,EAAE,SAAS,EAAE,CAAC;AAM1B;;GAEG;AACH,KAAK,YAAY,CAAC,CAAC,IAAI;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,aAAa,CAAC,EAAE,IAAI,wBAAwB,GAAG;IACzD,QAAQ,EAAE,aAAa,CAAC;IACxB,KAAK,EAAE,EAAE,CAAC;IACV,UAAU,EAAE,eAAe,CAAC;IAC5B,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,+CAA+C;IAC/C,eAAe,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACxC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACjC,CAAC;AAMF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,qBAAa,YAAY,CACvB,QAAQ,SAAS,aAAa,GAAG,aAAa,EAC9C,SAAS,SAAS,cAAc,GAAG,cAAc,EACjD,EAAE,GAAG,YAAY,CAAC;IAAE,WAAW,EAAE,QAAQ,CAAA;CAAE,CAAC,EAC5C,GAAG,GAAG,aAAa,CAAC;IAAE,YAAY,EAAE,SAAS,CAAA;CAAE,CAAC,CAChD,SAAQ,oBAAoB,CAAC,GAAG,CAAC;IACjC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACnC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IAEjC,qCAAqC;IACrC,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IAE/C,oEAAoE;IACpE,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,yBAAyB,CAAC;IAE1D,8CAA8C;IAC9C,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAE9C,+CAA+C;IAC/C,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,mBAAmB,EAAE,CAAC;IAE1D,4DAA4D;IAC5D,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IAS/C,OAAO,CAAC,SAAS,CAAC,CAAoB;IACtC,OAAO,CAAC,MAAM,CAAC,CAAK;IAGpB,OAAO,CAAC,YAAY,CAAC,CAAqB;IAC1C,OAAO,CAAC,OAAO,CAAC,CAAM;IAGtB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;IACxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAG1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAkB;gBAEtC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;IAoBnC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAItC;;;;;;;;OAQG;cACa,YAAY,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAsGrD;;;OAGG;IACH,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM;IAc7C;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,GAAG;IAsBzD,IAAW,KAAK,IAAI,EAAE,CAErB;IAED,IAAW,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,SAAS,EAOjC;IAED,IAAW,YAAY,IAAI,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAEzD;IAED,IAAW,MAAM,IAAI,GAAG,GAAG,SAAS,CAEnC;IAED,IAAW,MAAM,CAAC,CAAC,EAAE,GAAG,GAAG,SAAS,EAGnC;IAED,IAAW,aAAa,IAAI,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAE3D;IAMD;;;;;;;;;;;;;;OAcG;cACa,UAAU,CACxB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,mBAAmB,EAAE,EAC7B,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,eAAe,CAAC;IAI3B;;;;OAIG;cACc,gBAAgB,CAC/B,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,mBAAmB,EAAE,EAC7B,OAAO,CAAC,EAAE,sBAAsB,GAC/B,cAAc,CAAC,oBAAoB,CAAC;IAUvC;;;;;;;;OAQG;cACa,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAK1F;;;;;OAKG;cACa,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAS9E;;;;;;;;;;;;;;;;;;;OAmBG;cACa,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,GAAE,eAAwB,GAAG,OAAO,CAAC,OAAO,CAAC;IAqBpH;;;;;;;;;;;;;;;;;;;;;;;OAuBG;cACa,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAe9F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;cACa,MAAM,CAAC,CAAC,SAAS,OAAO,EACtC,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,CAAC,EAClB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAgBlE;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,KAAK;IAS1B;;OAEG;IACH,IAAI,QAAQ,IAAI,cAAc,CAc7B;IAED;;OAEG;IACH,IAAI,UAAU,IAAI,UAAU,GAAG,SAAS,CAUvC;CACF"}
+{"version":3,"file":"agent.interface.d.ts","sourceRoot":"","sources":["../../../src/common/interfaces/agent.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAGzF,OAAO,EAAiB,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEzF,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEpG,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,WAAW,EAEhB,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAC;AAGjC,YAAY,EAAE,SAAS,EAAE,CAAC;AAM1B;;GAEG;AACH,KAAK,YAAY,CAAC,CAAC,IAAI;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,aAAa,CAAC,EAAE,IAAI,wBAAwB,GAAG;IACzD,QAAQ,EAAE,aAAa,CAAC;IACxB,KAAK,EAAE,EAAE,CAAC;IACV,UAAU,EAAE,eAAe,CAAC;IAC5B,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,+CAA+C;IAC/C,eAAe,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACxC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACjC,CAAC;AAMF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,qBAAa,YAAY,CACvB,QAAQ,SAAS,aAAa,GAAG,aAAa,EAC9C,SAAS,SAAS,cAAc,GAAG,cAAc,EACjD,EAAE,GAAG,YAAY,CAAC;IAAE,WAAW,EAAE,QAAQ,CAAA;CAAE,CAAC,EAC5C,GAAG,GAAG,aAAa,CAAC;IAAE,YAAY,EAAE,SAAS,CAAA;CAAE,CAAC,CAChD,SAAQ,oBAAoB,CAAC,GAAG,CAAC;IACjC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACnC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IAEjC,qCAAqC;IACrC,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IAE/C,oEAAoE;IACpE,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,yBAAyB,CAAC;IAE1D,8CAA8C;IAC9C,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAE9C,+CAA+C;IAC/C,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,mBAAmB,EAAE,CAAC;IAE1D,4DAA4D;IAC5D,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IAS/C,OAAO,CAAC,SAAS,CAAC,CAAoB;IACtC,OAAO,CAAC,MAAM,CAAC,CAAK;IAGpB,OAAO,CAAC,YAAY,CAAC,CAAqB;IAC1C,OAAO,CAAC,OAAO,CAAC,CAAM;IAGtB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;IACxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAG1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAkB;gBAEtC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;IAoBnC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAItC;;;;;;;;OAQG;cACa,YAAY,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAsGrD;;;OAGG;IACH,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM;IAc7C;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,GAAG;IAsBzD,IAAW,KAAK,IAAI,EAAE,CAErB;IAED,IAAW,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,SAAS,EAOjC;IAED,IAAW,YAAY,IAAI,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAEzD;IAED,IAAW,MAAM,IAAI,GAAG,GAAG,SAAS,CAEnC;IAED,IAAW,MAAM,CAAC,CAAC,EAAE,GAAG,GAAG,SAAS,EAGnC;IAED,IAAW,aAAa,IAAI,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAE3D;IAMD;;;;;;;;;;;;;;OAcG;cACa,UAAU,CACxB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,mBAAmB,EAAE,EAC7B,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,eAAe,CAAC;IAI3B;;;;OAIG;cACc,gBAAgB,CAC/B,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,mBAAmB,EAAE,EAC7B,OAAO,CAAC,EAAE,sBAAsB,GAC/B,cAAc,CAAC,oBAAoB,CAAC;IAUvC;;;;;;;;OAQG;cACa,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAK1F;;;;;OAKG;cACa,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAK9E,mFAAmF;cAChE,eAAe,IAAI,WAAW;IAQjD;;;;;;;;;;;;;;;;;;;OAmBG;cACa,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,GAAE,eAAwB,GAAG,OAAO,CAAC,OAAO,CAAC;IAqBpH;;;;;;;;;;;;;;;;;;;;;;;OAuBG;cACa,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAe9F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;cACa,MAAM,CAAC,CAAC,SAAS,OAAO,EACtC,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,CAAC,EAClB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAkBlE;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,KAAK;IAS1B;;OAEG;IACH,IAAI,QAAQ,IAAI,cAAc,CAc7B;IAED;;OAEG;IACH,IAAI,UAAU,IAAI,UAAU,GAAG,SAAS,CAUvC;CACF"}

package/common/interfaces/channel.interface.d.ts

@@ -1,4 +1,5 @@
 import { type FuncType, type Type } from '@frontmcp/di';
+import { type CallSurface } from '../availability';
 import { type ChannelMetadata, type ChannelNotification } from '../metadata/channel.metadata';
 import { ExecutionContextBase, type ExecutionContextBaseArgs } from './execution-context.interface';
 /**
@@ -127,5 +128,10 @@ export declare abstract class ChannelContext extends ExecutionContextBase<Channe
      * @param payload - The raw event payload to process through `onEvent()`
      */
     protected pushIncoming(payload: unknown): void;
+    /**
+     * While it handles an HTTP trigger (a webhook source's request), a channel calls tools on the
+     * `'http-trigger'` surface. Handling any other event, it dispatches in-process.
+     */
+    protected callToolSurface(): CallSurface | undefined;
 }
 //# sourceMappingURL=channel.interface.d.ts.map

package/common/interfaces/channel.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"channel.interface.d.ts","sourceRoot":"","sources":["../../../src/common/interfaces/channel.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,IAAI,EAAE,MAAM,cAAc,CAAC;AAGxD,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEpG;;;GAGG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;AAE7D;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,wBAAwB,GAAG;IACvD,QAAQ,EAAE,eAAe,CAAC;CAC3B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,8BAAsB,cAAe,SAAQ,oBAAoB,CAAC,mBAAmB,CAAC;IACpF,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;gBASvB,IAAI,EAAE,eAAe;IAWjC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAEhE;;;;;;OAMG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAS1E;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAInC;;;;;;;;OAQG;IACH,SAAS,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;CAO/C"}
+{"version":3,"file":"channel.interface.d.ts","sourceRoot":"","sources":["../../../src/common/interfaces/channel.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,IAAI,EAAE,MAAM,cAAc,CAAC;AAIxD,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEpG;;;GAGG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;AAE7D;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,wBAAwB,GAAG;IACvD,QAAQ,EAAE,eAAe,CAAC;CAC3B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,8BAAsB,cAAe,SAAQ,oBAAoB,CAAC,mBAAmB,CAAC;IACpF,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;gBASvB,IAAI,EAAE,eAAe;IAWjC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAEhE;;;;;;OAMG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAS1E;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAInC;;;;;;;;OAQG;IACH,SAAS,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAQ9C;;;OAGG;cACgB,eAAe,IAAI,WAAW,GAAG,SAAS;CAG9D"}

package/common/interfaces/execution-context.interface.d.ts

@@ -4,6 +4,7 @@ import { type AuthInfo, type CallToolResult } from '@frontmcp/protocol';
 import { type RuntimeContext } from '@frontmcp/utils';
 import { ConfigService } from '../../builtin/config/providers/config.service';
 import { type FrontMcpContext } from '../../context';
+import { type CallSurface } from '../availability';
 import { type ScopeEntry } from '../entries';
 import { type ProviderRegistryInterface } from './internal';
 import { type FrontMcpLogger } from './logger.interface';
@@ -117,6 +118,11 @@ export declare abstract class ExecutionContextBase<Out = unknown> {
      * Authority/authorization checks still run — an internal call carries the
      * same `authInfo` as the surrounding request, so ABAC/RBAC guards apply.
      *
+     * `availableWhen.surface`: the call carries {@link callToolSurface}. From a tool, resource or
+     * prompt that is none (in-process dispatch, which no surface restricts); a job's call carries
+     * `'job'`, an agent's `'agent'`, and an HTTP trigger's `'http-trigger'`, so a tool whose `surface`
+     * leaves that caller out answers as an unknown tool.
+     *
      * @param name Tool name (or fully-qualified `owner.name`).
      * @param args Tool arguments — validated by the tool's input schema.
      * @param opts Optional progress token / abort signal forwarded into `_meta`.
@@ -126,6 +132,12 @@ export declare abstract class ExecutionContextBase<Out = unknown> {
         progressToken?: string | number;
         signal?: AbortSignal;
     }): Promise<CallToolResult>;
+    /**
+     * The surface (`availableWhen.surface`) a {@link callTool} from this context calls on. None by
+     * default: a tool, resource or prompt composing with other tools is in-process dispatch. Contexts
+     * that are callers of their own (jobs, agents, HTTP triggers) name their surface.
+     */
+    protected callToolSurface(): CallSurface | undefined;
     /**
      * Fail the execution and trigger error handling.
      */

package/common/interfaces/execution-context.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-context.interface.d.ts","sourceRoot":"","sources":["../../../src/common/interfaces/execution-context.interface.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAiC,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAErF,OAAO,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAC;AAC9E,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,yBAAyB,CAAC;IACrC,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,8BAAsB,oBAAoB,CAAC,GAAG,GAAG,OAAO;IACtD,OAAO,CAAC,SAAS,CAA4B;IAE7C;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAE9C,+CAA+C;IAC/C,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACjC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAE1C,gDAAgD;IAChD,SAAS,CAAC,WAAW,SAAU;IAE/B,gCAAgC;IAChC,OAAO,CAAC,MAAM,CAAC,CAAQ;IAEvB,yDAAyD;IACzD,OAAO,CAAC,YAAY,CAAC,CAAsB;gBAE/B,IAAI,EAAE,wBAAwB;IAQ1C;;;;;;;OAOG;IACH,IAAI,OAAO,IAAI,eAAe,CAO7B;IAED;;;;;;;;;;;;;;OAcG;IACH,IAAI,IAAI,IAAI,mBAAmB,CAO9B;IAED;;;;OAIG;IACH,aAAa,IAAI,eAAe,GAAG,SAAS;IAQ5C;;;;OAIG;IACH,IAAI,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAEhC;IAED;;;;;;;;OAQG;IACH,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC;IAQhC;;;;OAIG;IACH,SAAS,KAAK,aAAa,IAAI,cAAc,CAO5C;IAED;;;OAGG;IACH,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;IAI1B;;OAEG;IACH,IAAI,KAAK,IAAI,UAAU,CAEtB;IAED;;OAEG;IACH,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,SAAS;IAUzC;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAC/D,OAAO,CAAC,cAAc,CAAC;IA8B1B;;OAEG;IACH,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,KAAK;IAKjC;;OAEG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIzB;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAS1F;;OAEG;IACH,SAAS,KAAK,KAAK,IAAI,KAAK,GAAG,SAAS,CAEvC;IAED;;;;;;;;;;;OAWG;IACH,IAAI,MAAM,IAAI,aAAa,CAG1B;IAID;;OAEG;IACH,IAAI,cAAc,IAAI,cAAc,CAEnC;IAED;;;OAGG;IACH,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,OAAO;IAIzD;;;OAGG;IACH,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,GAAG,OAAO;IAItD;;;OAGG;IACH,YAAY,CAAC,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC,GAAG,OAAO;IAI/D;;;OAGG;IACH,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,GAAG,OAAO;CAG3C"}
+{"version":3,"file":"execution-context.interface.d.ts","sourceRoot":"","sources":["../../../src/common/interfaces/execution-context.interface.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAiC,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAErF,OAAO,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAC;AAC9E,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,yBAAyB,CAAC;IACrC,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,8BAAsB,oBAAoB,CAAC,GAAG,GAAG,OAAO;IACtD,OAAO,CAAC,SAAS,CAA4B;IAE7C;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAE9C,+CAA+C;IAC/C,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACjC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAE1C,gDAAgD;IAChD,SAAS,CAAC,WAAW,SAAU;IAE/B,gCAAgC;IAChC,OAAO,CAAC,MAAM,CAAC,CAAQ;IAEvB,yDAAyD;IACzD,OAAO,CAAC,YAAY,CAAC,CAAsB;gBAE/B,IAAI,EAAE,wBAAwB;IAQ1C;;;;;;;OAOG;IACH,IAAI,OAAO,IAAI,eAAe,CAO7B;IAED;;;;;;;;;;;;;;OAcG;IACH,IAAI,IAAI,IAAI,mBAAmB,CAO9B;IAED;;;;OAIG;IACH,aAAa,IAAI,eAAe,GAAG,SAAS;IAQ5C;;;;OAIG;IACH,IAAI,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAEhC;IAED;;;;;;;;OAQG;IACH,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC;IAQhC;;;;OAIG;IACH,SAAS,KAAK,aAAa,IAAI,cAAc,CAO5C;IAED;;;OAGG;IACH,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;IAI1B;;OAEG;IACH,IAAI,KAAK,IAAI,UAAU,CAEtB;IAED;;OAEG;IACH,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,SAAS;IAUzC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAC/D,OAAO,CAAC,cAAc,CAAC;IAgC1B;;;;OAIG;IACH,SAAS,CAAC,eAAe,IAAI,WAAW,GAAG,SAAS;IAIpD;;OAEG;IACH,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,KAAK;IAKjC;;OAEG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIzB;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAS1F;;OAEG;IACH,SAAS,KAAK,KAAK,IAAI,KAAK,GAAG,SAAS,CAEvC;IAED;;;;;;;;;;;OAWG;IACH,IAAI,MAAM,IAAI,aAAa,CAG1B;IAID;;OAEG;IACH,IAAI,cAAc,IAAI,cAAc,CAEnC;IAED;;;OAGG;IACH,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,OAAO;IAIzD;;;OAGG;IACH,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,GAAG,OAAO;IAItD;;;OAGG;IACH,YAAY,CAAC,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC,GAAG,OAAO;IAI/D;;;OAGG;IACH,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,GAAG,OAAO;CAG3C"}

package/common/interfaces/internal/primary-auth-provider.interface.d.ts

@@ -44,8 +44,12 @@ export declare abstract class FrontMcpAuth<Options extends AuthOptions = AuthOpt
      * @param _expectedAudience  The protected resource(s) the token must be for
      *                           (`aud` names at least one), when the caller is a
      *                           resource endpoint.
+     * @param _expectedIssuer    The issuer the token must name (or one of them):
+     *                           the ones this instance accepts for the request
+     *                           (`LocalPrimaryAuth.acceptedIssuersFor`). Default:
+     *                           its boot-time issuer.
      */
-    verifyGatewayToken(_token: string, _requestBaseUrl: string, _expectedAudience?: string | readonly string[]): Promise<VerifyResult>;
+    verifyGatewayToken(_token: string, _requestBaseUrl: string, _expectedAudience?: string | readonly string[], _expectedIssuer?: string | readonly string[]): Promise<VerifyResult>;
 }
 export { FrontMcpAuth as Auth };
 //# sourceMappingURL=primary-auth-provider.interface.d.ts.map

package/common/interfaces/internal/primary-auth-provider.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"primary-auth-provider.interface.d.ts","sourceRoot":"","sources":["../../../../src/common/interfaces/internal/primary-auth-provider.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAezD;;;;;;;;;;;GAWG;AACH,8BAAsB,YAAY,CAAC,OAAO,SAAS,WAAW,GAAG,WAAW;IAC1E,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBAER,OAAO,EAAE,OAAO;IAK5B;;;;OAIG;IACH,OAAO,CAAC,QAAQ;IAoBhB,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAE/E,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAExD,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC;IAE9B;;;;;;;;;;;;;;;;;OAiBG;IACH,kBAAkB,CAChB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAC7C,OAAO,CAAC,YAAY,CAAC;CAMzB;AAED,OAAO,EAAE,YAAY,IAAI,IAAI,EAAE,CAAC"}
+{"version":3,"file":"primary-auth-provider.interface.d.ts","sourceRoot":"","sources":["../../../../src/common/interfaces/internal/primary-auth-provider.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAezD;;;;;;;;;;;GAWG;AACH,8BAAsB,YAAY,CAAC,OAAO,SAAS,WAAW,GAAG,WAAW;IAC1E,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBAER,OAAO,EAAE,OAAO;IAK5B;;;;OAIG;IACH,OAAO,CAAC,QAAQ;IAoBhB,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAE/E,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAExD,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC;IAE9B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,kBAAkB,CAChB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EAC9C,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAC3C,OAAO,CAAC,YAAY,CAAC;CAMzB;AAED,OAAO,EAAE,YAAY,IAAI,IAAI,EAAE,CAAC"}