@lenne.tech/nest-server 11.41.9 → 11.42.0

package/.claude/rules/configurable-features.md

@@ -320,7 +320,7 @@ This pattern is currently applied to:
 | Response Model Interceptor | `security.responseModelInterceptor` | Boolean Shorthand | `true` (enabled), `debug: false` |
 | Translate Response Interceptor | `security.translateResponseInterceptor` | Boolean Shorthand | `true` (enabled) |
 | Secret Fields Removal | `security.secretFields` | Array | `['password', 'verificationToken', ...]` |
-| Multi-Tenancy | `multiTenancy` | Presence Implies Enabled | **`excludeSchemas` is an OFF SWITCH for isolation, per model** — a listed schema gets no tenant filter at all; since 11.35.0 the plugin WARNS once per model when the excluded schema declares `tenantId` (i.e. was built for isolation). The framework's own docs recommended `['User', 'Session']` until then; that is withdrawn — it is only right for the global-user model. Since 11.35.0 GraphQL operations over the WEBSOCKET also run inside a `RequestContext` (`CoreModule` installs a context-aware `execute`/`subscribe` pair inside `subscriptions`, where `ApolloDriver` forwards it): the tenant comes from the handshake header validated against an active membership, else from the subscriber's memberships, and an unresolvable tenant leaves the safety net to refuse the read rather than returning everything. `headerName: 'x-tenant-id'`, `membershipModel: 'TenantMember'`, `adminBypass: true`, `excludeSchemas: []`, `roleHierarchy: { member: 1, manager: 2, owner: 3 }`, `cacheTtlMs: 30000` (0 disables, process-local). System roles (`S_EVERYONE`, `S_USER`, `S_VERIFIED`) are checked as OR alternatives before real roles; method-level system roles take precedence; membership validated for context when system role grants access + header present. Hierarchy roles use level comparison, normal roles use exact match. Use `DefaultHR` or `createHierarchyRoles()` for type-safe role constants. Bypass: `RequestContext.runWithBypassTenantGuard()`. Cache invalidation: `invalidateUser(userId)` / `invalidateAll()` are **instance** methods on the singleton `CoreTenantGuard` — inject it and call `this.tenantGuard?.invalidateUser(userId)`, never `CoreTenantGuard.invalidateUser(...)` (there is no static). With `redis` configured, both additionally BROADCAST the invalidation to every replica (`<keyPrefix>:tenant-cache:invalidate` pub/sub); without Redis they clear the local process only, so other replicas stay stale until `cacheTtlMs`. A received broadcast clears locally without re-publishing |
+| Multi-Tenancy | `multiTenancy` | Presence Implies Enabled | **`excludeSchemas` is an OFF SWITCH for isolation, per model** — a listed schema gets no tenant filter at all; since 11.35.0 the plugin WARNS once per model when the excluded schema declares `tenantId` (i.e. was built for isolation). The framework's own docs recommended `['User', 'Session']` until then; that is withdrawn — it is only right for the global-user model. Since 11.35.0 GraphQL operations over the WEBSOCKET also run inside a `RequestContext` (`CoreModule` installs a context-aware `execute`/`subscribe` pair inside `subscriptions`, where `ApolloDriver` forwards it): the tenant comes from the handshake header validated against an active membership, else from the subscriber's memberships, and an unresolvable tenant leaves the safety net to refuse the read rather than returning everything. `headerName: 'x-tenant-id'`, `membershipModel: 'TenantMember'`, `adminBypass: true`, `excludeSchemas: []`, `roleHierarchy: { member: 1, manager: 2, owner: 3 }`, `cacheTtlMs: 30000` (0 disables, process-local). System roles (`S_EVERYONE`, `S_USER`, `S_VERIFIED`) are checked as OR alternatives before real roles; method-level system roles take precedence; membership validated for context when system role grants access + header present. Hierarchy roles use level comparison, normal roles use exact match. Use `DefaultHR` or `createHierarchyRoles()` for type-safe role constants. Bypass: `RequestContext.runWithBypassTenantGuard()`. Cache invalidation: `invalidateUser(userId)` / `invalidateAll()` are **instance** methods on the singleton `CoreTenantGuard` — inject it and call `this.tenantGuard?.invalidateUser(userId)`, never `CoreTenantGuard.invalidateUser(...)` (there is no static). With `redis` configured, both additionally BROADCAST the invalidation to every replica (`<keyPrefix>:tenant-cache:invalidate` pub/sub); without Redis they clear the local process only, so other replicas stay stale until `cacheTtlMs`. A received broadcast clears locally without re-publishing. **`isTenantActive` (11.42.0)**: optional hook `(tenantId, { connection }) => boolean \| Promise<boolean>`, absent = every tenant active (no change). Asked AFTER the membership check on every path that establishes a tenant: 403 on header paths and for tenant API tokens, no enrichment on `S_EVERYONE`, dropped from the header-less tenant list, no tenant for a NEW WebSocket subscription (an open one keeps its tenant until it reconnects — known limit, shared with removed memberships); an admin under `adminBypass` is exempt (someone must be able to switch it back on). Only `false` deactivates. Cached for `cacheTtlMs`; `invalidateTenant(tenantId)` clears and broadcasts (`{ scope: 'tenant' }`). A function, so `config.env.ts` only — not reachable through `NSC__*`. **`adminBypass: false` (11.42.0)** additionally withholds two things that went around it: `CoreUserService.update()` refuses changing another account's e-mail or password (`assertCredentialChangeAllowed()`, administrator targets included — promote-then-change — system work without a current user exempt), and the AI tool registry grants no ADMIN bypass |
 | API Tokens | `apiTokens` | Boolean Shorthand + Presence Implies Enabled — absent = off | `prefix: 'ltt'`, `scopes: []` (vocabulary; empty = no token creatable, boot warning), `manageRole`: highest hierarchy role, `maxAssertionLifetimeSeconds: 900` (invalid → default, never unbounded — Family C), `rateLimit: { max: 600, windowSeconds: 60 }` per token (**on by default**, `false` disables; Redis-shared when configured), `userTokens: true`, `tenantTokens: true` (effective only with `multiTenancy`), `encryptionKey` → `SECRETS_ENCRYPTION_KEY` → dev default (boot FAILS in production/staging). Top-level, NOT under `multiTenancy`: user tokens must work without it. **Deny by default**: every guard refuses a token on a route without `@ApiTokenScopes()`, public routes included, via ONE shared function (`enforceApiTokenRoute`) called BEFORE each guard's public-route shortcut. USER tokens act as their user with global roles REMOVED (no admin bypass); TENANT tokens act with the lowest hierarchy role in their own tenant, and a route guarded ONLY by `S_SELF` / `S_CREATOR` refuses them (a tenant token is nobody's self — skipping those roles would grant for any target). A tenant token depends on no member, so it outlives an off-boarded or deleted tenant until the project calls `deleteAllForTenant()`. The boot refuses a hierarchy in which that lowest role reaches `manageRole`. A prefixed credential that fails answers 401 on every route (not anonymous); `CoreBetterAuthMiddleware` skips prefixed credentials entirely, cookie fallback included. A password reset that ends the user's sessions ends their USER tokens too (legacy reset always; IAM reset while `betterAuth.emailAndPassword.revokeSessionsOnPasswordReset` is on), wired through `core-api-token.registry.ts` so neither reset path imports the optional module. Implementation: `src/core/modules/api-token/` |
 | BetterAuth Tenant Skip | `betterAuth.skipTenantCheck` | Explicit Boolean | `true` (default). When `true` and no `X-Tenant-Id` header is sent, IAM endpoints (controller + resolver) skip `CoreTenantGuard` tenant validation. When header IS present, normal membership validation runs regardless. Set `false` for tenant-aware auth scenarios (subdomain-based, invite links, SSO per tenant) |
 | Debug Process Input | `debugProcessInput` | Explicit Boolean | `false` (default). When `true`, logs a debug message when `prepareInput()` changes the input type during `process()`. Has performance cost due to `JSON.stringify` on every `process()` call — enable only for debugging |
@@ -335,9 +335,10 @@ This pattern is currently applied to:
 | Cron Job Deduplication | per job: `distributed` in `CronJobConfig` | Explicit Boolean | **`true` when `redis` is configured, otherwise `false`** — a single-replica project that upgrades must not silently gain a `cron-locks` collection, a lease write per tick, and a new way for a tick to be skipped. A Redis-less multi-replica fleet opts in per job with `distributed: true` (MongoDB lease). Mechanism: BullMQ job scheduler when Redis + the OPTIONAL peer `bullmq` are present AND `cronTime` is a string without `utcOffset`; otherwise local timer + lease (Redis `SET NX`, else a TTL-indexed `cron-locks` document). Tick lease TTL 3600 s. **Leases fail open** — an unreachable lease store runs the tick everywhere rather than stopping all scheduled work fleet-wide. **`runOnInit` (default `true`) deduplicates over a FIXED per-job key with a 300 s TTL**, because replicas do not share a boot instant: replicas booting within 5 min run the startup tick once between them, and a replica restarting inside that window SKIPS its startup tick — set `distributed: false` on jobs whose `runOnInit` work is per-process (warming a process-local cache). No constructor change needed: `CoreModule` fills `core-cron-jobs.registry.ts` via `CoreCronJobsInitializer` and `CoreCronJobs` reads it lazily; explicit `{ connection, redisService }` in `CoreCronJobsOptions` wins. With neither source it warns once and every replica runs every tick |
 | Shutdown Delay | `shutdownDelayMs` | Numeric Sentinel — Family B (`0` = off) | `0` (default, no delay, no log). Waits N ms **in the SIGTERM/SIGINT handler, before `close()` is entered**, so a load balancer can finish deregistering while the instance is still fully healthy. NOT a lifecycle hook: `close()` runs `onModuleDestroy` → `beforeApplicationShutdown` → dispose → `onApplicationShutdown`, so a delay in `beforeApplicationShutdown` would wait with every module already torn down while the socket still accepts — worse than no delay. **Requires `installGracefulShutdown(app)` in main.ts, which REPLACES `server.enableShutdownHooks()`** — keeping both makes Nest close the app in parallel with the wait, so the delay silently never happens. At delay `0` the helper IS `enableShutdownHooks()`. **Keep the value well below the orchestrator grace period AND leave room for the drain that follows**: Compose `stop_grace_period` 10s, Kubernetes `terminationGracePeriodSeconds` 30s, and `installProcessDiagnostics()` force-exits after 30s — exceed any and the process is SIGKILLed mid-wait with no hook running. Warns above `10000`, capped at `60000`. Non-numeric / negative values behave like `0` |
 | Trust Proxy | `trustProxy` | Explicit Value (pass-through, Express default) | `false` (Express's own default — the forwarded chain is not trusted). Passed verbatim to `app.set('trust proxy', …)` by `CoreTrustProxyInitializer`, a `CoreModule` provider, so a consumer inherits it by upgrading and needs no `main.ts` edit. Accepts `false` / a hop count (`1`, `2`) / `'loopback'` / a subnet list — **not** Express's predicate function: the value must survive `NEST_SERVER_CONFIG` / `NSC__*` (JSON) and the ConfigService deep clone. **This is what makes `request.ip` correct, and every IP-keyed rate limit depends on it**: unset behind Caddy/nginx/an ingress, `req.ip` is the PROXY address for every request, so all clients share ONE bucket and `auth.rateLimit.max` throttles everybody at once — exactly fleet-wide once `redis` is configured. Trusting MORE hops than exist is the opposite failure: a client prepends its own header entry and picks a fresh bucket per request. Applied at module init (inside `app.init()`/`listen()`, i.e. AFTER `main.ts`), so a configured value wins over a hand-written `app.set()`; an UNSET value is never applied, which keeps `app.set('trust proxy', fn)` in `main.ts` available as the escape hatch for the predicate form. **Unset + an IP-keyed limiter enabled (`auth.rateLimit` / `betterAuth.rateLimit`) logs a boot warning naming the shared-bucket consequence**; `trustProxy: false` is the explicit "nothing proxies me" answer that silences it. The AI limiter keys on the user id and is unaffected |
+| Outbound URL Guard (SSRF) | `security.allowPrivateOutboundTargets` | Explicit Boolean with DERIVED default | **Opt-in helper for URLs a USER entered** (webhooks, export targets, ERP addresses) — `outboundFetch()`, `assertOutboundUrlAllowed()`, `createOutboundDispatcher()` in `common/helpers/outbound-url.helper.ts` (11.42.0). Nothing is applied globally: configured targets (AI providers, SMTP, S3, Redis, Brevo) never go through it. Refuses loopback, RFC 1918, link-local incl. `169.254.169.254`, CGNAT, `0/8`, benchmarking, multicast/reserved, IPv6 unspecified/loopback/IPv4-compatible (`::/96`), NAT64, ULA, link-local and multicast, and IPv4-mapped IPv6 in every notation (canonicalised through the URL parser). Checked TWICE: on the URL before sending (readable `OutboundUrlBlockedError`) and on every connection through an undici `Agent` with a guarded connector — the only place that sees a redirect's next hop and a DNS answer at connect time (rebinding). **Unset → derived from the environment**: allowed in `local`, `e2e`, `ci`, refused everywhere else — deliberately including `test`, a DEPLOYED stage in starter-based projects; `true`/`false` (also the strings, from `NSC__SECURITY__ALLOW_PRIVATE_OUTBOUND_TARGETS`) decide explicitly. Per call, `allowedHosts` frees single internal hosts (`'erp.local:8443'` = that port, `'erp.local'` = any port) without opening the rest — re-checked per connection, so a redirect does not inherit it. `outboundFetch()` uses undici's OWN `fetch` (runtime dependency `undici` since 11.42.0), because Node 22's built-in fetch bundles a different undici major than the agent |
 | AI Egress Allowlist (SSRF) | `ai.allowedBaseUrlHosts` | Explicit Value — **unset = permissive**, malformed = INTERPRETED or reported, never silently off | `undefined` → no restriction, so a local provider (Ollama on `localhost:11434`) works out of the box. Set → only those hosts are reachable, matched against `URL.host` (incl. port) and `URL.hostname`. **Accepts an array OR a comma-separated string, and the string form is not a convenience** — it is what the framework's own env mapping produces: `NSC__AI__ALLOWED_BASE_URL_HOSTS` becomes `{ ai: { allowedBaseUrlHosts: '<string>' } }` and lodash `merge` assigns that scalar straight over a configured array. Until 11.39.x a bare `!Array.isArray(...) -> return` read that as "not configured" and skipped the check entirely, so the canonical `NSC__` spelling silently disabled SSRF egress control with no log line at all. Entries are trimmed, lowercased and stripped of a fully-qualifying trailing dot, and the SAME normalisation is applied to the URL, so neither side wins by spelling one DNS name differently; a bare hostname entry matches any port, and an entry naming the scheme's default port (`example.com:443` on https) also matches the portless URL. A value that is neither array nor string carries no hostnames — the allowlist is then inactive and that is LOGGED as an error, because from the outside it looks exactly like "correctly unset". Enforced on **all three** outbound paths (`chat()`, the capability `probe()`, and `probeContextWindow()` — the last was unguarded before 11.39.x and is reachable from an ordinary user prompt via `detectAndPersistCapabilities()`, before the rate limit). Implementation: `openai-compatible.provider.ts` → `assertBaseUrlAllowed()` / `resolveAllowedBaseUrlHosts()` |
 | AI Run Time Limit | `ai.maxRunMs` | **Numeric Sentinel — Family A** (`0` = no limit) | `0` (omitted = unbounded, the previous behaviour). Wall-clock ceiling for ONE prompt run, checked before each agent-loop iteration; once exceeded the run stops and answers with whatever it has. **Without it a run's only bound is `maxIterations` MULTIPLIED BY the connection's per-call timeout** — 8 iterations at the 120s default is a request that can legitimately hold a socket, its message buffer and a request context for 16 minutes, and compaction can add a call per iteration on top. Guarded as `maxRunMs > 0`, never `<= 0`: a value arriving as a non-numeric string through `NSC__AI__MAX_RUN_MS` (the reader coerces only `'true'`, `'false'` and numbers) yields `NaN`, and `NaN > 0` is `false`, so a misconfiguration degrades to "no limit" rather than to an instantly-expired deadline that would break every prompt. Set it to something a client would actually wait for. Implementation: `core-ai.service.ts` -> `runDeadlineExceeded()` |
-| AI Assistant | `ai` | Presence Implies Enabled | Core: `maxIterations: 5`, `defaultMode: 'auto'` (or `'plan'`), `rateLimit` (presence implies enabled: `max: 20`, `windowSeconds: 60`), `systemPrompt`, `documentation` (injected into the system prompt), `encryptionSecret`. **DB-backed LLM connections** (`aiConnections`, admin CRUD) with AES-256-GCM-encrypted API keys (`AiCryptoService`, secret from `ai.encryptionSecret` / `NSC__AI__ENCRYPTION_SECRET` / `SECRETS_ENCRYPTION_KEY`; `apiKeyEncrypted` is a global `secretFields` entry, never returned — only `hasApiKey`); optional `defaultConnection` one-time seed. **Provider abstraction** (`ILlmProvider`, default `OpenAiCompatibleProvider` for any OpenAI-compatible endpoint via `fetch`; per-connection `supportsNativeTools`/`supportsJsonResponse` capabilities, emulated tool calling when native tools are unavailable). **Tool registry** (`AiToolRegistry`, tools self-register, role-filtered; tools may be `mutating`/`destructive` and define `authorize()` for pre-flight data-level checks). **Plan mode** (`input.mode: 'plan'`): full plan → pre-flight authorize ALL steps → all-or-nothing execution with a translated (de/en) error when any step is not permitted. **Confirmation policy**: `confirmation.mutating: { default, enforced }` + client `input.requireConfirmation` (ignored when enforced); `destructive` always confirms. **Client metadata** (`input.metadata`: URL/nav/console logs, untrusted+capped). **Multi-turn conversations** (`aiConversations`, owner-scoped). **SSE streaming** (`POST /ai/stream`). **Audit** (`audit: false` → persist to `aiInteractions`, admin-readable). **Token budgets** (`budget: { period: 'day'|'month'|'none', user: { maxTokens?, maxPrompts? }, tenant: { maxTokens?, maxPrompts? } }`, requires audit): per-user AND per-tenant limits with config defaults; admins override per user/tenant at runtime (`aiBudgetLimits`, `CoreAiBudgetService`). Resolution: override → default → unlimited (missing/0 = unlimited). Enforced before the run (HTTP 429 + translated). Each response carries a compact `budget` summary (promptTokens, usedTokens, remainingTokens, resetAt); full breakdown via `aiUsage` query / `GET /ai/usage`. **Self-optimizing prompts**: the system prompt is assembled from keyed fragments (`CoreAiPromptBuilderService` ships built-in defaults; works with zero rows). Admin-editable overrides per slot (`aiSlots`, admin CRUD, `/ai/slots`) scoped by `key`/`locale`/`capability`/`tenantId`, with tenant override/reset semantics and placeholder tokens resolved at run time via the placeholder registry. **Governed learning loop** (`promptLearning: { enabled: true, autoApply: false }`): tool errors record `suggested` hints (`aiPromptHints`, admin CRUD, `/ai/prompt-hints`) that only reach the prompt once admin-approved (or auto-approved when `autoApply`); hints only ADD guidance, never relax permissions. **Context window** (`contextWindow`, default 8192; auto-detected per connection via `ILlmProvider.detectContextWindow()` — Ollama `/api/show` probe / known-model table / Claude alias — and persisted): per-user/session history is trimmed (oldest non-system turns dropped, last truncated) and tool-results capped to `maxToolResultChars` (default 12000) so a session never overflows the model. A connection's window can be seeded via `ai.defaultConnection.contextWindow` (validated: a non-positive/non-integer value is dropped with a warning). **Capability drift check** (`capabilityDriftCheck`, default `false`): opt-in boot self-check that probes each enabled connection with an EXPLICIT `supportsNativeTools`/`supportsJsonResponse` (built with those flags cleared so the endpoint is actually re-probed) and logs a warning on mismatch — the stored value is never changed. OFF by default because it makes outbound calls to the LLM endpoints on every boot; also skipped in the ci/e2e runners. **Deferred tool schemas** (`deferToolSchemas`, default `false`): the system-prompt tool catalog then lists only tool NAMES + descriptions instead of full JSON schemas, and the model fetches a schema on demand via the built-in `search_tools` meta-tool — with a large registry the schemas alone can dominate a small context window. `deferToolSummaryChars` (default `0` = untruncated) additionally caps each description in that DEFERRED catalog: whole sentences up to the cap (always at least the first), word-boundary cut when the first sentence already exceeds it, and a `…` marker appended ON TOP of the cap. The default of `0` keeps the saving opt-in, so enabling `deferToolSchemas` alone never changes what a description says; set roughly 200–400 alongside it to actually reclaim the context. Both apply to EMULATED providers only — a connection with `supportsNativeTools: true` receives every full description + schema via `buildToolSchemas()` regardless, so truncation and the banner are skipped there rather than asserting a cut the tool payload contradicts. The omitted tail is where preconditions and role restrictions usually live — the catalog banner tells the model to fetch the full text via `search_tools` first, but this is model GUIDANCE only: authorization is enforced server-side by the registry's role filter (`forUser()`), the execution-time re-check, and the `mutating`/`destructive` flags read by the confirmation gate — never by what the catalog shows. (`AiTool.authorize()` runs in PLAN MODE only; in auto mode and over MCP, data-level checks must live inside `execute()`.) **MCP server** (`mcp: false` → `/ai/mcp` Streamable HTTP, Bearer auth, lazy `@modelcontextprotocol/sdk`; `mcp: { oauth: true, oauthSecret }` adds OAuth 2.1 — HMAC tokens + PKCE S256 + dynamic registration via `mountAiMcpOAuth(app)` in main.ts). Overrides via `CoreModule.forRoot(env, { ai: { budgetService, connectionResolver, connectionService, controller, conversationService, interactionService, mcpClientService, modeService, placeholderRegistry, preferenceService, promptBuilder, promptHintService, promptService, resolver, service, slotService, toolGrantService, toolPolicyService } })` |
+| AI Assistant | `ai` | Presence Implies Enabled | Core: `maxIterations: 5`, `defaultMode: 'auto'` (or `'plan'`), `rateLimit` (presence implies enabled: `max: 20`, `windowSeconds: 60`), `systemPrompt`, `documentation` (injected into the system prompt), `encryptionSecret`. **DB-backed LLM connections** (`aiConnections`, admin CRUD) with AES-256-GCM-encrypted API keys (`AiCryptoService`, secret from `ai.encryptionSecret` / `NSC__AI__ENCRYPTION_SECRET` / `SECRETS_ENCRYPTION_KEY`; `apiKeyEncrypted` is a global `secretFields` entry, never returned — only `hasApiKey`); optional `defaultConnection` one-time seed. **Provider abstraction** (`ILlmProvider`, default `OpenAiCompatibleProvider` for any OpenAI-compatible endpoint via `fetch`; per-connection `supportsNativeTools`/`supportsJsonResponse` capabilities, emulated tool calling when native tools are unavailable). **Tool registry** (`AiToolRegistry`, tools self-register, role-filtered — under multi-tenancy (11.42.0+) a tool's roles resolve like `@Roles()` in `CoreTenantGuard`: global roles against `user.roles`, tenant roles against the request's membership role, ADMIN bypass only where `adminBypass` grants it, so chat and MCP never exceed the user's own rights; an MCP session reads the user per request, so a revoked role stops working without a reconnect; tools may be `mutating`/`destructive` and define `authorize()` for pre-flight data-level checks). **Plan mode** (`input.mode: 'plan'`): full plan → pre-flight authorize ALL steps → all-or-nothing execution with a translated (de/en) error when any step is not permitted. **Confirmation policy**: `confirmation.mutating: { default, enforced }` + client `input.requireConfirmation` (ignored when enforced); `destructive` always confirms. **Client metadata** (`input.metadata`: URL/nav/console logs, untrusted+capped). **Multi-turn conversations** (`aiConversations`, owner-scoped). **SSE streaming** (`POST /ai/stream`). **Audit** (`audit: false` → persist to `aiInteractions`, admin-readable). **Token budgets** (`budget: { period: 'day'|'month'|'none', user: { maxTokens?, maxPrompts? }, tenant: { maxTokens?, maxPrompts? } }`, requires audit): per-user AND per-tenant limits with config defaults; admins override per user/tenant at runtime (`aiBudgetLimits`, `CoreAiBudgetService`). Resolution: override → default → unlimited (missing/0 = unlimited). Enforced before the run (HTTP 429 + translated). Each response carries a compact `budget` summary (promptTokens, usedTokens, remainingTokens, resetAt); full breakdown via `aiUsage` query / `GET /ai/usage`. **Self-optimizing prompts**: the system prompt is assembled from keyed fragments (`CoreAiPromptBuilderService` ships built-in defaults; works with zero rows). Admin-editable overrides per slot (`aiSlots`, admin CRUD, `/ai/slots`) scoped by `key`/`locale`/`capability`/`tenantId`, with tenant override/reset semantics and placeholder tokens resolved at run time via the placeholder registry. **Governed learning loop** (`promptLearning: { enabled: true, autoApply: false }`): tool errors record `suggested` hints (`aiPromptHints`, admin CRUD, `/ai/prompt-hints`) that only reach the prompt once admin-approved (or auto-approved when `autoApply`); hints only ADD guidance, never relax permissions. **Context window** (`contextWindow`, default 8192; auto-detected per connection via `ILlmProvider.detectContextWindow()` — Ollama `/api/show` probe / known-model table / Claude alias — and persisted): per-user/session history is trimmed (oldest non-system turns dropped, last truncated) and tool-results capped to `maxToolResultChars` (default 12000) so a session never overflows the model. A connection's window can be seeded via `ai.defaultConnection.contextWindow` (validated: a non-positive/non-integer value is dropped with a warning). **Capability drift check** (`capabilityDriftCheck`, default `false`): opt-in boot self-check that probes each enabled connection with an EXPLICIT `supportsNativeTools`/`supportsJsonResponse` (built with those flags cleared so the endpoint is actually re-probed) and logs a warning on mismatch — the stored value is never changed. OFF by default because it makes outbound calls to the LLM endpoints on every boot; also skipped in the ci/e2e runners. **Deferred tool schemas** (`deferToolSchemas`, default `false`): the system-prompt tool catalog then lists only tool NAMES + descriptions instead of full JSON schemas, and the model fetches a schema on demand via the built-in `search_tools` meta-tool — with a large registry the schemas alone can dominate a small context window. `deferToolSummaryChars` (default `0` = untruncated) additionally caps each description in that DEFERRED catalog: whole sentences up to the cap (always at least the first), word-boundary cut when the first sentence already exceeds it, and a `…` marker appended ON TOP of the cap. The default of `0` keeps the saving opt-in, so enabling `deferToolSchemas` alone never changes what a description says; set roughly 200–400 alongside it to actually reclaim the context. Both apply to EMULATED providers only — a connection with `supportsNativeTools: true` receives every full description + schema via `buildToolSchemas()` regardless, so truncation and the banner are skipped there rather than asserting a cut the tool payload contradicts. The omitted tail is where preconditions and role restrictions usually live — the catalog banner tells the model to fetch the full text via `search_tools` first, but this is model GUIDANCE only: authorization is enforced server-side by the registry's role filter (`forUser()`), the execution-time re-check, and the `mutating`/`destructive` flags read by the confirmation gate — never by what the catalog shows. (`AiTool.authorize()` runs in PLAN MODE only; in auto mode and over MCP, data-level checks must live inside `execute()`.) **MCP server** (`mcp: false` → `/ai/mcp` Streamable HTTP, Bearer auth, lazy `@modelcontextprotocol/sdk`; `mcp: { oauth: true, oauthSecret }` adds OAuth 2.1 — HMAC tokens + PKCE S256 + dynamic registration via `mountAiMcpOAuth(app)` in main.ts). Overrides via `CoreModule.forRoot(env, { ai: { budgetService, connectionResolver, connectionService, controller, conversationService, interactionService, mcpClientService, modeService, placeholderRegistry, preferenceService, promptBuilder, promptHintService, promptService, resolver, service, slotService, toolGrantService, toolPolicyService } })` |
 
 ## Module Override Pattern (via `ICoreModuleOverrides`)
 

package/.claude/rules/role-system.md

@@ -417,6 +417,37 @@ otherwise lets the role guard check `user.roles` — fail-closed, warned once. P
 **Configured is not registered.** When you add a guard that delegates to another one, ask whether
 the other one RUNS, not whether it is configured.
 
+## Every entry point, not just the route (11.42.0)
+
+A `@Roles()` decides who may call a ROUTE. An operation is also reached from MCP tools, AI tools,
+queue processors and other services, and on those paths the route's roles are checked by nobody.
+Three mechanisms keep those paths inside the user's rights:
+
+| Path | Mechanism |
+|------|-----------|
+| A service that must demand a tenant role whatever calls it | `assertTenantRole(roles, message?)` / `hasTenantRole(...roles)` (`core-tenant-role.helper.ts`) — decided like the guard's header path |
+| AI tools (chat and `/ai/mcp`) | `AiToolRegistry.userCanAccess()` resolves tool roles like the guard under multi-tenancy (global vs membership role, `adminBypass` honoured), with the user as of the CURRENT request — an MCP session refreshes it on every request |
+| Data | `mongooseTenantPlugin` via `RequestContext` — tools run inside the HTTP request, so the validated tenant scopes them |
+
+**System work vs. an anonymous request.** Both have no current user. `assertTenantRole()` exempts
+system work (cron, migration, seed) and refuses the anonymous caller of a public route with 401 — told
+apart by `RequestContext.fromRequest`, which `RequestContextMiddleware` and the GraphQL WebSocket
+context set. Do not reduce that to "no current user = system": that is exactly the hole the marker
+closes (mutation `tenant-role-anonymous-as-system`).
+
+**Credentials under `adminBypass: false`.** `CoreUserService.update()` refuses a change of another
+account's e-mail address or password (`assertCredentialChangeAllowed()`) — administrator targets
+included, because an administrator may write `roles` and could otherwise promote first and change
+second (mutation `tenant-credential-admin-target-exempt`). Without it, a platform administrator — or
+the account's creator, since `S_CREATOR` may update and `email` is open to every updater — takes the
+account over with an address change and a reset, which is precisely the access `adminBypass: false`
+withholds.
+
+**Deactivated tenants.** `multiTenancy.isTenantActive` is asked after the membership on every path that
+establishes a tenant (see `.claude/rules/configurable-features.md`, Multi-Tenancy row). A GraphQL
+subscription that is already open keeps its tenant until the client reconnects — a known limit it
+shares with a removed membership.
+
 ## Role Check Implementation
 
 The role system is evaluated in:

package/.claude/rules/testing.md

@@ -266,7 +266,7 @@ pnpm run check:mutations -- --id=<id>       # one mutation
 pnpm run check:mutations -- --list          # the registry, without running anything
 pnpm run check:mutations -- --allow-dirty   # when the fix and its evidence share a working tree
 pnpm run check:mutations -- --jobs=4        # N mutations at a time (default: 2, or 4 on >=12 cores)
-pnpm run check:mutations -- --no-infra      # only the 86 that need no MongoDB
+pnpm run check:mutations -- --no-infra      # only the 92 that need no MongoDB
 pnpm run check:mutations -- --since=<ref>   # only mutations touching files changed since <ref>
 ```
 
@@ -285,7 +285,7 @@ when the registry, a vitest config or a setup file changed, since those can move
 commit, and in CI alongside the publish without blocking it. The price of caching is a cache that
 has to model each spec's full dependency closure correctly, and getting that wrong produces a stale
 PASS for a test that has since gone vacuous — exactly what the gate is there to prevent. Bad trade
-at 136 mutations.
+at 145 mutations.
 
 **Decided 2026-10-03 (repo owner): keep the full run.** Measured at 128 mutations, the CI job for
 11.41.6 took **14 minutes**. The trigger to revisit is that wall time, not the mutation count —
@@ -330,9 +330,9 @@ exactly the environment where the answer matters.
 
 ### The cost is vitest's cold start, not the tests
 
-Worth knowing before optimising the wrong thing: the specs behind all 50 e2e mutations add up to
+Worth knowing before optimising the wrong thing: the specs behind all 53 e2e mutations add up to
 **~40 seconds**. The step takes ~740s. The remaining ~700s is paying vitest's startup — process
-spawn, transform, module graph, mongod connect, DB create and drop — once per mutation, 136 times.
+spawn, transform, module graph, mongod connect, DB create and drop — once per mutation, 145 times.
 That work is largely single-threaded I/O and barely scales with cores: the full registry measures
 **744s on a 12-core laptop and 777s on a 4-vCPU CI runner**.
 

package/CLAUDE.md

@@ -227,6 +227,12 @@ spelling), **`@Restricted` also applies to nested embedded subdocuments** whose
 that a WebSocket operation had none, so `mongooseTenantPlugin` read it as "system operation, no filter"
 and a tenant-scoped read on that path returned every tenant's rows.
 
+Since 11.42.0 an operation is protected on **every entry point**, not just its route: `assertTenantRole()`
+in services (MCP/AI tools call services directly), tenant-aware tool roles in the AI registry, a
+`multiTenancy.isTenantActive` hook for deactivated tenants, and no credential changes across the tenant
+boundary under `adminBypass: false`. User-entered URLs (webhooks, export targets) go through
+`outboundFetch()` (SSRF guard) — configured targets do not.
+
 See `.claude/rules/role-system.md` for complete documentation.
 
 ### Versioning

package/FRAMEWORK-API.md

@@ -1,6 +1,6 @@
 # @lenne.tech/nest-server — Framework API Reference
 
-> Auto-generated from source code as of 2026-10-03 (v11.41.9)
+> Auto-generated from source code as of 2026-10-04 (v11.42.0)
 > File: `FRAMEWORK-API.md` — compact, machine-readable API surface for Claude Code
 
 ## CoreModule.forRoot()
@@ -46,7 +46,7 @@
   - `port?`: `number | undefined` — Port number of the server
   - `redis?`: `boolean | IRedisConfig | undefined` (default: `undefined (disabled)`) — Optional central Redis connection used by all distributed features
   - `s3?`: `IS3Config | undefined` (default: `undefined (disabled)`) — Optional central S3-compatible object storage (AWS S3, MinIO, ...).
-  - `security?`: `{ checkResponseInterceptor?: boolean | { checkObjectItself?: boolean; debug?:...` — Configuration for security pipes and interceptors
+  - `security?`: `{ allowPrivateOutboundTargets?: boolean; checkResponseInterceptor?: boolean |...` — Configuration for security pipes and interceptors
   - `sha256?`: `boolean | undefined` — Whether to enable verification and automatic encryption for received passwords that are not in sha256 format
   - `shutdownDelayMs?`: `number | undefined` (default: `0 (no delay)`) — Delay in milliseconds between receiving a shutdown signal and starting the
   - `staticAssets?`: `{ options?: ServeStaticOptions; path?: string; } | undefined` — Configuration for useStaticAssets
@@ -81,6 +81,7 @@ When `passkey` is enabled, `trustedOrigins` is required (compile-time enforcemen
   - `strictMembershipRoles?`: `boolean | undefined` (default: `false`) — Refuse membership roles that are not declared anywhere (deny by default).
   - `additionalMembershipRoles?`: `string[] | undefined` (default: `[]`) — Membership roles that are valid but carry no hierarchy level (exact-match roles).
   - `cacheTtlMs?`: `number | undefined` (default: `30000 (30 seconds)`) — TTL in milliseconds for the tenant guard's in-memory membership cache.
+  - `isTenantActive?`: `((tenantId: string, context: { connection: Connection; }) => boolean | Promis...` (default: `undefined (every tenant is active)`) — Whether a tenant may be used at all — the hook that makes a DEACTIVATED tenant stop working.
 
 ### IErrorCode
 

package/dist/core/common/helpers/graphql-ws-context.helper.js

@@ -33,7 +33,7 @@ async function buildWsRequestContext(contextValue) {
         return undefined;
     }
     const user = readUser(contextValue);
-    const context = { currentUser: user };
+    const context = { currentUser: user, fromRequest: true };
     const acceptLanguage = contextValue.headers?.['accept-language'] ??
         contextValue.connectionParams?.['accept-language'] ??
         contextValue.request?.headers?.['accept-language'];

package/dist/core/common/helpers/graphql-ws-context.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"graphql-ws-context.helper.js","sourceRoot":"","sources":["../../../../src/core/common/helpers/graphql-ws-context.helper.ts"],"names":[],"mappings":";;AAyFA,sDA8BC;AAQD,0EAiBC;AAYD,4EAQC;AAGD,gFASC;AASD,0EAEC;AAED,8EAEC;AA1LD,mCAAoC;AAEpC,2FAAoF;AACpF,+DAA2D;AAC3D,iFAAsF;AAoDtF,SAAS,gBAAgB,CAAC,YAAiB;IACzC,MAAM,UAAU,GAAG,CAAC,8BAAa,CAAC,qBAAqB,EAAE,YAAY,EAAE,UAAU,IAAI,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;IAClH,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxG,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;YAC7E,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,EAAE,CAAC;gBAC3E,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAGD,SAAS,QAAQ,CAAC,YAAiB;IACjC,OAAO,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,CAAC;AACtE,CAAC;AASM,KAAK,UAAU,qBAAqB,CAAC,YAAiB;IAC3D,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,EAAE,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,OAAO,GAAoB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAGvD,MAAM,cAAc,GAClB,YAAY,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC;QACzC,YAAY,CAAC,gBAAgB,EAAE,CAAC,iBAAiB,CAAC;QAClD,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;IACrD,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,QAAQ,GAAG,cAAc,CAAC;IACpC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,uDAAwB,GAAE,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QAIb,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,SAAgB,+BAA+B,CAC7C,QAAgF,EAChF,OAAwB;IAExB,MAAM,OAAO,GAA6B;QACxC,IAAI,EAAE,CAAC,GAAG,IAAsB,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAI,IAAW,CAAC,CAAC;QACtG,CAAC,MAAM,CAAC,aAAa,CAAC;YACpB,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,GAAG,CAAC,KAAW,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,GAAG,CAAC,KAAW,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,SAAS,eAAe,CAAC,KAAU;IACjC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,UAAU,CAAC;AACnG,CAAC;AAOD,SAAgB,gCAAgC,CAAC,OAAkB;IACjE,OAAO,KAAK,EAAE,IAAiB,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC;AACJ,CAAC;AAGD,SAAgB,kCAAkC,CAAC,SAAoB;IACrE,OAAO,KAAK,EAAE,IAAiB,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,MAA4B,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACnH,CAAC,CAAC;AACJ,CAAC;AASD,SAAgB,+BAA+B;IAC7C,OAAO,gCAAgC,CAAC,OAAO,CAAC,OAAc,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,iCAAiC;IAC/C,OAAO,kCAAkC,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"graphql-ws-context.helper.js","sourceRoot":"","sources":["../../../../src/core/common/helpers/graphql-ws-context.helper.ts"],"names":[],"mappings":";;AAyFA,sDA8BC;AAQD,0EAiBC;AAYD,4EAQC;AAGD,gFASC;AASD,0EAEC;AAED,8EAEC;AA1LD,mCAAoC;AAEpC,2FAAoF;AACpF,+DAA2D;AAC3D,iFAAsF;AAoDtF,SAAS,gBAAgB,CAAC,YAAiB;IACzC,MAAM,UAAU,GAAG,CAAC,8BAAa,CAAC,qBAAqB,EAAE,YAAY,EAAE,UAAU,IAAI,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;IAClH,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxG,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;YAC7E,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,EAAE,CAAC;gBAC3E,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAGD,SAAS,QAAQ,CAAC,YAAiB;IACjC,OAAO,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,CAAC;AACtE,CAAC;AASM,KAAK,UAAU,qBAAqB,CAAC,YAAiB;IAC3D,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,EAAE,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,OAAO,GAAoB,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAG1E,MAAM,cAAc,GAClB,YAAY,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC;QACzC,YAAY,CAAC,gBAAgB,EAAE,CAAC,iBAAiB,CAAC;QAClD,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;IACrD,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,QAAQ,GAAG,cAAc,CAAC;IACpC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,uDAAwB,GAAE,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QAIb,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,SAAgB,+BAA+B,CAC7C,QAAgF,EAChF,OAAwB;IAExB,MAAM,OAAO,GAA6B;QACxC,IAAI,EAAE,CAAC,GAAG,IAAsB,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAI,IAAW,CAAC,CAAC;QACtG,CAAC,MAAM,CAAC,aAAa,CAAC;YACpB,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,GAAG,CAAC,KAAW,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,GAAG,CAAC,KAAW,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,SAAS,eAAe,CAAC,KAAU;IACjC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,UAAU,CAAC;AACnG,CAAC;AAOD,SAAgB,gCAAgC,CAAC,OAAkB;IACjE,OAAO,KAAK,EAAE,IAAiB,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC;AACJ,CAAC;AAGD,SAAgB,kCAAkC,CAAC,SAAoB;IACrE,OAAO,KAAK,EAAE,IAAiB,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,MAA4B,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACnH,CAAC,CAAC;AACJ,CAAC;AASD,SAAgB,+BAA+B;IAC7C,OAAO,gCAAgC,CAAC,OAAO,CAAC,OAAc,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,iCAAiC;IAC/C,OAAO,kCAAkC,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAC;AACtE,CAAC"}

package/dist/core/common/helpers/outbound-url.helper.d.ts

@@ -0,0 +1,14 @@
+import { Agent, fetch as undiciFetch } from 'undici';
+export declare class OutboundUrlBlockedError extends Error {
+    readonly host: string;
+    readonly address: string;
+    constructor(host: string, address: string);
+}
+export interface IOutboundUrlOptions {
+    allowedHosts?: string[];
+}
+export declare function privateOutboundTargetsAllowed(): boolean;
+export declare function isBlockedOutboundAddress(address: string): boolean;
+export declare function assertOutboundUrlAllowed(url: string, options?: IOutboundUrlOptions): Promise<URL>;
+export declare function createOutboundDispatcher(options?: IOutboundUrlOptions): Agent;
+export declare function outboundFetch(url: string, init?: Parameters<typeof undiciFetch>[1], options?: IOutboundUrlOptions): ReturnType<typeof undiciFetch>;

package/dist/core/common/helpers/outbound-url.helper.js

@@ -0,0 +1,234 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OutboundUrlBlockedError = void 0;
+exports.privateOutboundTargetsAllowed = privateOutboundTargetsAllowed;
+exports.isBlockedOutboundAddress = isBlockedOutboundAddress;
+exports.assertOutboundUrlAllowed = assertOutboundUrlAllowed;
+exports.createOutboundDispatcher = createOutboundDispatcher;
+exports.outboundFetch = outboundFetch;
+const node_dns_1 = require("node:dns");
+const node_net_1 = require("node:net");
+const undici_1 = require("undici");
+const config_service_1 = require("../services/config.service");
+const blocked = new node_net_1.BlockList();
+for (const [network, prefix] of [
+    ['0.0.0.0', 8],
+    ['10.0.0.0', 8],
+    ['100.64.0.0', 10],
+    ['127.0.0.0', 8],
+    ['169.254.0.0', 16],
+    ['172.16.0.0', 12],
+    ['192.0.0.0', 24],
+    ['192.168.0.0', 16],
+    ['198.18.0.0', 15],
+    ['224.0.0.0', 4],
+    ['240.0.0.0', 4],
+]) {
+    blocked.addSubnet(network, prefix, 'ipv4');
+}
+for (const [network, prefix] of [
+    ['::', 96],
+    ['64:ff9b::', 96],
+    ['fc00::', 7],
+    ['fe80::', 10],
+    ['ff00::', 8],
+]) {
+    blocked.addSubnet(network, prefix, 'ipv6');
+}
+const LOCAL_ENVIRONMENTS = new Set(['ci', 'e2e', 'local']);
+class OutboundUrlBlockedError extends Error {
+    host;
+    address;
+    constructor(host, address) {
+        super(`Outbound target not allowed: "${host}" points to the internal address ${address}. ` +
+            'Use a public address, list the host in allowedHosts, or set security.allowPrivateOutboundTargets.');
+        this.host = host;
+        this.address = address;
+        this.name = 'OutboundUrlBlockedError';
+    }
+}
+exports.OutboundUrlBlockedError = OutboundUrlBlockedError;
+function privateOutboundTargetsAllowed() {
+    const config = config_service_1.ConfigService.configFastButReadOnly;
+    const flag = config?.security?.allowPrivateOutboundTargets;
+    if (flag === true || flag === 'true') {
+        return true;
+    }
+    if (flag === false || flag === 'false') {
+        return false;
+    }
+    const env = String(config?.env ?? process.env.NODE_ENV ?? '')
+        .trim()
+        .toLowerCase();
+    return LOCAL_ENVIRONMENTS.has(env);
+}
+function isBlockedOutboundAddress(address) {
+    const plain = stripBrackets(address);
+    const family = (0, node_net_1.isIP)(plain);
+    if (family === 4) {
+        return blocked.check(plain, 'ipv4');
+    }
+    if (family === 6) {
+        const mapped = mappedIpv4(plain);
+        return mapped ? blocked.check(mapped, 'ipv4') : blocked.check(plain, 'ipv6');
+    }
+    return false;
+}
+async function assertOutboundUrlAllowed(url, options = {}) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error(`Invalid outbound URL: "${url}"`);
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new Error(`Outbound URL must use http:// or https://: "${url}"`);
+    }
+    const host = stripBrackets(parsed.hostname);
+    if (privateOutboundTargetsAllowed() || isAllowedHost(host, effectivePort(parsed.port, parsed.protocol), options)) {
+        return parsed;
+    }
+    const addresses = (0, node_net_1.isIP)(host) ? [host] : await resolveAll(host);
+    const internal = addresses.find(isBlockedOutboundAddress);
+    if (internal) {
+        throw new OutboundUrlBlockedError(host, internal);
+    }
+    return parsed;
+}
+const plainConnect = (0, undici_1.buildConnector)({});
+const guardedConnect = (0, undici_1.buildConnector)({ lookup: guardedLookup });
+function createOutboundDispatcher(options = {}) {
+    return new undici_1.Agent({
+        connect: (connectOptions, callback) => {
+            const host = stripBrackets(String(connectOptions.hostname ?? ''));
+            const port = effectivePort(connectOptions.port, connectOptions.protocol);
+            if (privateOutboundTargetsAllowed() || isAllowedHost(host, port, options)) {
+                plainConnect(connectOptions, callback);
+                return;
+            }
+            if ((0, node_net_1.isIP)(host) && isBlockedOutboundAddress(host)) {
+                callback(new OutboundUrlBlockedError(host, host), null);
+                return;
+            }
+            guardedConnect(connectOptions, callback);
+        },
+    });
+}
+let defaultDispatcher;
+const allowListDispatchers = new Map();
+const MAX_ALLOW_LIST_DISPATCHERS = 50;
+async function outboundFetch(url, init = {}, options = {}) {
+    await assertOutboundUrlAllowed(url, options);
+    return (0, undici_1.fetch)(url, { ...init, dispatcher: dispatcherFor(options) });
+}
+function dispatcherFor(options) {
+    const hosts = (options.allowedHosts ?? []).map(normalizeHost).filter(Boolean).sort();
+    if (!hosts.length) {
+        defaultDispatcher ??= createOutboundDispatcher();
+        return defaultDispatcher;
+    }
+    const key = hosts.join(',');
+    let dispatcher = allowListDispatchers.get(key);
+    if (!dispatcher) {
+        if (allowListDispatchers.size >= MAX_ALLOW_LIST_DISPATCHERS) {
+            const [oldestKey, oldest] = allowListDispatchers.entries().next().value;
+            allowListDispatchers.delete(oldestKey);
+            void oldest.close().catch(() => undefined);
+        }
+        dispatcher = createOutboundDispatcher({ allowedHosts: hosts });
+        allowListDispatchers.set(key, dispatcher);
+    }
+    return dispatcher;
+}
+function guardedLookup(hostname, options, callback) {
+    (0, node_dns_1.lookup)(hostname, { ...options, all: true }, (err, addresses) => {
+        if (err) {
+            callback(err);
+            return;
+        }
+        const list = addresses;
+        const internal = list.find((entry) => isBlockedOutboundAddress(entry.address));
+        if (internal) {
+            callback(new OutboundUrlBlockedError(hostname, internal.address));
+            return;
+        }
+        if (options.all) {
+            callback(null, list);
+            return;
+        }
+        callback(null, list[0]?.address, list[0]?.family);
+    });
+}
+function resolveAll(host) {
+    return new Promise((resolve, reject) => {
+        (0, node_dns_1.lookup)(host, { all: true }, (err, addresses) => {
+            if (err) {
+                reject(new Error(`Outbound target cannot be resolved: "${host}" (${err.message})`));
+                return;
+            }
+            resolve(addresses.map((entry) => entry.address));
+        });
+    });
+}
+function isAllowedHost(host, port, options) {
+    const wanted = host.toLowerCase();
+    return (options.allowedHosts ?? []).some((entry) => {
+        const normalized = normalizeHost(entry);
+        if (!normalized) {
+            return false;
+        }
+        const [entryHost, entryPort] = splitHostPort(normalized);
+        return entryHost === wanted && (!entryPort || entryPort === port);
+    });
+}
+function normalizeHost(entry) {
+    if (typeof entry !== 'string' || !entry.trim()) {
+        return '';
+    }
+    try {
+        const url = new URL(`http://${entry.trim()}`);
+        const host = stripBrackets(url.hostname).toLowerCase();
+        return url.port ? `${host.includes(':') ? `[${host}]` : host}:${url.port}` : host;
+    }
+    catch {
+        return '';
+    }
+}
+function splitHostPort(normalized) {
+    const v6 = /^\[(.+)\]:(\d+)$/.exec(normalized);
+    if (v6) {
+        return [v6[1], v6[2]];
+    }
+    if ((0, node_net_1.isIP)(normalized) === 6) {
+        return [normalized, ''];
+    }
+    const index = normalized.lastIndexOf(':');
+    return index === -1 ? [normalized, ''] : [normalized.slice(0, index), normalized.slice(index + 1)];
+}
+function effectivePort(port, protocol) {
+    if (port !== undefined && port !== null && String(port) !== '') {
+        return String(port);
+    }
+    return protocol === 'https:' ? '443' : '80';
+}
+function stripBrackets(value) {
+    return value.replace(/^\[|\]$/g, '');
+}
+function mappedIpv4(address) {
+    let canonical;
+    try {
+        canonical = stripBrackets(new URL(`http://[${address}]`).hostname);
+    }
+    catch {
+        return undefined;
+    }
+    const match = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(canonical);
+    if (!match) {
+        return undefined;
+    }
+    const high = parseInt(match[1], 16);
+    const low = parseInt(match[2], 16);
+    return `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`;
+}
+//# sourceMappingURL=outbound-url.helper.js.map

package/dist/core/common/helpers/outbound-url.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-url.helper.js","sourceRoot":"","sources":["../../../../src/core/common/helpers/outbound-url.helper.ts"],"names":[],"mappings":";;;AAqFA,sEAcC;AAGD,4DAWC;AAOD,4DAoBC;AAUD,4DAgBC;AAcD,sCAOC;AA3LD,uCAAmE;AACnE,uCAA2C;AAC3C,mCAAqE;AAErE,+DAA2D;AAyB3D,MAAM,OAAO,GAAG,IAAI,oBAAS,EAAE,CAAC;AAChC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,SAAS,EAAE,CAAC,CAAC;IACd,CAAC,UAAU,EAAE,CAAC,CAAC;IACf,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,WAAW,EAAE,CAAC,CAAC;IAChB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,WAAW,EAAE,CAAC,CAAC;IAChB,CAAC,WAAW,EAAE,CAAC,CAAC;CACR,EAAE,CAAC;IACX,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AACD,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,IAAI,EAAE,EAAE,CAAC;IACV,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,QAAQ,EAAE,CAAC,CAAC;IACb,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,CAAC,CAAC;CACL,EAAE,CAAC;IACX,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAMD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAG3D,MAAa,uBAAwB,SAAQ,KAAK;IAErC;IACA;IAFX,YACW,IAAY,EACZ,OAAe;QAExB,KAAK,CACH,iCAAiC,IAAI,oCAAoC,OAAO,IAAI;YAClF,mGAAmG,CACtG,CAAC;QANO,SAAI,GAAJ,IAAI,CAAQ;QACZ,YAAO,GAAP,OAAO,CAAQ;QAMxB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAXD,0DAWC;AAYD,SAAgB,6BAA6B;IAC3C,MAAM,MAAM,GAAG,8BAAa,CAAC,qBAAqB,CAAC;IAEnD,MAAM,IAAI,GAAG,MAAM,EAAE,QAAQ,EAAE,2BAAsC,CAAC;IACtE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;SAC1D,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IACjB,OAAO,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAGD,SAAgB,wBAAwB,CAAC,OAAe;IACtD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,IAAA,eAAI,EAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOM,KAAK,UAAU,wBAAwB,CAAC,GAAW,EAAE,UAA+B,EAAE;IAC3F,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,GAAG,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,6BAA6B,EAAE,IAAI,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;QACjH,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,eAAI,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,YAAY,GAAG,IAAA,uBAAc,EAAC,EAAE,CAAC,CAAC;AACxC,MAAM,cAAc,GAAG,IAAA,uBAAc,EAAC,EAAE,MAAM,EAAE,aAAsB,EAAE,CAAC,CAAC;AAO1E,SAAgB,wBAAwB,CAAC,UAA+B,EAAE;IACxE,OAAO,IAAI,cAAK,CAAC;QACf,OAAO,EAAE,CAAC,cAAc,EAAE,QAAQ,EAAE,EAAE;YACpC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;YACzE,IAAI,6BAA6B,EAAE,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC1E,YAAY,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,IAAI,IAAA,eAAI,EAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,QAAQ,CAAC,IAAI,uBAAuB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YACD,cAAc,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,IAAI,iBAAoC,CAAC;AACzC,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAiB,CAAC;AACtD,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAU/B,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,OAA0C,EAAE,EAC5C,UAA+B,EAAE;IAEjC,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,IAAA,cAAW,EAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,aAAa,CAAC,OAA4B;IACjD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACrF,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,iBAAiB,KAAK,wBAAwB,EAAE,CAAC;QACjD,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,oBAAoB,CAAC,IAAI,IAAI,0BAA0B,EAAE,CAAC;YAC5D,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,KAAwB,CAAC;YAC3F,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACvC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QACD,UAAU,GAAG,wBAAwB,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CACpB,QAAgB,EAChB,OAA2C,EAC3C,QAA0F;IAE1F,IAAA,iBAAS,EAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;QAChE,IAAI,GAAG,EAAE,CAAC;YACR,QAAQ,CAAC,GAAG,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,SAA4B,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/E,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAA,iBAAS,EAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;YAChD,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,IAAI,MAAM,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YACD,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAAY,EAAE,OAA4B;IAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACjD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QACzD,OAAO,SAAS,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC;AAGD,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,UAAkB;IACvC,MAAM,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,IAAA,eAAI,EAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,aAAa,CAAC,IAAwC,EAAE,QAAmC;IAClG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAGD,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,WAAW,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,2CAA2C,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;AAC/D,CAAC"}

package/dist/core/common/interfaces/server-options.interface.d.ts

@@ -10,6 +10,7 @@ import type { MongoosePingCheckSettings } from '@nestjs/terminus/dist/health-ind
 import type { DiskHealthIndicatorOptions } from '@nestjs/terminus/dist/health-indicator/disk/disk-health-options.type.js';
 import compression from 'compression';
 import { CollationOptions } from 'mongodb';
+import type { Connection } from 'mongoose';
 import type * as JSONTransport from 'nodemailer/lib/json-transport';
 import type * as SendmailTransport from 'nodemailer/lib/sendmail-transport';
 import type * as SESTransport from 'nodemailer/lib/ses-transport';
@@ -156,6 +157,9 @@ export interface IMultiTenancy {
     strictMembershipRoles?: boolean;
     additionalMembershipRoles?: string[];
     cacheTtlMs?: number;
+    isTenantActive?: (tenantId: string, context: {
+        connection: Connection;
+    }) => boolean | Promise<boolean>;
 }
 export interface IApiTokens {
     enabled?: boolean;
@@ -354,6 +358,7 @@ export interface IServerOptions {
     redis?: boolean | IRedisConfig;
     s3?: IS3Config;
     security?: {
+        allowPrivateOutboundTargets?: boolean;
         checkResponseInterceptor?: boolean | {
             checkObjectItself?: boolean;
             debug?: boolean | number;

package/dist/core/common/middleware/request-context.middleware.js

@@ -30,6 +30,7 @@ let RequestContextMiddleware = class RequestContextMiddleware {
             get isAdminBypass() {
                 return req.isAdminBypass ?? false;
             },
+            fromRequest: true,
         };
         request_context_service_1.RequestContext.run(context, () => next());
     }

package/dist/core/common/middleware/request-context.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.middleware.js","sourceRoot":"","sources":["../../../../src/core/common/middleware/request-context.middleware.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA4D;AAG5D,iFAAsF;AAS/E,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,GAAG,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;QAClD,MAAM,OAAO,GAAoB;YAC/B,IAAI,WAAW;gBACb,OAAQ,GAAW,CAAC,IAAI,IAAI,SAAS,CAAC;YACxC,CAAC;YACD,IAAI,QAAQ;gBACV,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC;YACvD,CAAC;YACD,IAAI,QAAQ;gBAGV,OAAQ,GAAW,CAAC,QAAQ,IAAI,SAAS,CAAC;YAC5C,CAAC;YACD,IAAI,SAAS;gBACX,OAAQ,GAAW,CAAC,SAAS,IAAI,SAAS,CAAC;YAC7C,CAAC;YACD,IAAI,UAAU;gBACZ,OAAQ,GAAW,CAAC,UAAU,IAAI,SAAS,CAAC;YAC9C,CAAC;YACD,IAAI,aAAa;gBACf,OAAQ,GAAW,CAAC,aAAa,IAAI,KAAK,CAAC;YAC7C,CAAC;SACF,CAAC;QACF,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;CACF,CAAA;AA1BY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;GACA,wBAAwB,CA0BpC"}
+{"version":3,"file":"request-context.middleware.js","sourceRoot":"","sources":["../../../../src/core/common/middleware/request-context.middleware.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA4D;AAG5D,iFAAsF;AAS/E,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,GAAG,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;QAClD,MAAM,OAAO,GAAoB;YAC/B,IAAI,WAAW;gBACb,OAAQ,GAAW,CAAC,IAAI,IAAI,SAAS,CAAC;YACxC,CAAC;YACD,IAAI,QAAQ;gBACV,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC;YACvD,CAAC;YACD,IAAI,QAAQ;gBAGV,OAAQ,GAAW,CAAC,QAAQ,IAAI,SAAS,CAAC;YAC5C,CAAC;YACD,IAAI,SAAS;gBACX,OAAQ,GAAW,CAAC,SAAS,IAAI,SAAS,CAAC;YAC7C,CAAC;YACD,IAAI,UAAU;gBACZ,OAAQ,GAAW,CAAC,UAAU,IAAI,SAAS,CAAC;YAC9C,CAAC;YACD,IAAI,aAAa;gBACf,OAAQ,GAAW,CAAC,aAAa,IAAI,KAAK,CAAC;YAC7C,CAAC;YACD,WAAW,EAAE,IAAI;SAClB,CAAC;QACF,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;CACF,CAAA;AA3BY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;GACA,wBAAwB,CA2BpC"}

package/dist/core/common/services/request-context.service.d.ts

@@ -11,6 +11,7 @@ export interface IRequestContext {
     tenantIds?: string[];
     tenantRole?: string;
     isAdminBypass?: boolean;
+    fromRequest?: boolean;
     processDepth?: number;
 }
 export declare class RequestContext {

package/dist/core/common/services/request-context.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.service.js","sourceRoot":"","sources":["../../../../src/core/common/services/request-context.service.ts"],"names":[],"mappings":";;;AAAA,6CAAgD;AAmChD,MAAa,cAAc;IACjB,MAAM,CAAC,OAAO,GAAG,IAAI,+BAAiB,EAAmB,CAAC;IAElE,MAAM,CAAC,GAAG,CAAI,OAAwB,EAAE,EAAW;QACjD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,GAAG;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,cAAc;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC;IAC9C,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC;IAC3C,CAAC;IAKD,MAAM,CAAC,iBAAiB;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,eAAe,KAAK,IAAI,CAAC;IAC3D,CAAC;IAkBD,MAAM,CAAC,sBAAsB,CAAI,EAAW;QAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAE7C,IAAI,YAAY,EAAE,eAAe,EAAE,CAAC;YAClC,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAoB;YAC/B,GAAG,YAAY;YACf,eAAe,EAAE,IAAI;SACtB,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IAMD,MAAM,CAAC,eAAe;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,YAAY,IAAI,CAAC,CAAC;IACpD,CAAC;IAwBD,MAAM,CAAC,8BAA8B,CAAI,EAAW;QAClD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,YAAY,EAAE,YAAY,IAAI,CAAC,CAAC;QACrD,MAAM,OAAO,GAAoB;YAC/B,GAAG,YAAY;YACf,YAAY,EAAE,YAAY,GAAG,CAAC;SAC/B,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,mBAAmB;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC7D,CAAC;IAkBD,MAAM,CAAC,wBAAwB,CAAI,EAAW;QAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAE7C,IAAI,YAAY,EAAE,iBAAiB,EAAE,CAAC;YACpC,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAoB;YAC/B,GAAG,YAAY;YACf,iBAAiB,EAAE,IAAI;SACxB,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;;AAlIH,wCAmIC"}
+{"version":3,"file":"request-context.service.js","sourceRoot":"","sources":["../../../../src/core/common/services/request-context.service.ts"],"names":[],"mappings":";;;AAAA,6CAAgD;AA4ChD,MAAa,cAAc;IACjB,MAAM,CAAC,OAAO,GAAG,IAAI,+BAAiB,EAAmB,CAAC;IAElE,MAAM,CAAC,GAAG,CAAI,OAAwB,EAAE,EAAW;QACjD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,GAAG;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,cAAc;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC;IAC9C,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC;IAC3C,CAAC;IAKD,MAAM,CAAC,iBAAiB;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,eAAe,KAAK,IAAI,CAAC;IAC3D,CAAC;IAkBD,MAAM,CAAC,sBAAsB,CAAI,EAAW;QAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAE7C,IAAI,YAAY,EAAE,eAAe,EAAE,CAAC;YAClC,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAoB;YAC/B,GAAG,YAAY;YACf,eAAe,EAAE,IAAI;SACtB,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IAMD,MAAM,CAAC,eAAe;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,YAAY,IAAI,CAAC,CAAC;IACpD,CAAC;IAwBD,MAAM,CAAC,8BAA8B,CAAI,EAAW;QAClD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,YAAY,EAAE,YAAY,IAAI,CAAC,CAAC;QACrD,MAAM,OAAO,GAAoB;YAC/B,GAAG,YAAY;YACf,YAAY,EAAE,YAAY,GAAG,CAAC;SAC/B,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,mBAAmB;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC7D,CAAC;IAkBD,MAAM,CAAC,wBAAwB,CAAI,EAAW;QAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAE7C,IAAI,YAAY,EAAE,iBAAiB,EAAE,CAAC;YACpC,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAoB;YAC/B,GAAG,YAAY;YACf,iBAAiB,EAAE,IAAI;SACxB,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;;AAlIH,wCAmIC"}

package/dist/core/modules/ai/core-ai-mcp.controller.js

@@ -74,7 +74,8 @@ let CoreAiMcpController = CoreAiMcpController_1 = class CoreAiMcpController {
             }
             const { randomUUID } = await Promise.resolve().then(() => require('node:crypto'));
             const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => randomUUID() });
-            const server = await this.mcpService.createServer(user);
+            const created = { lastUsed: Date.now(), ownerId: user.id, transport, user };
+            const server = await this.mcpService.createServer(() => created.user);
             await server.connect(transport);
             transport.onclose = () => {
                 if (transport.sessionId) {
@@ -82,9 +83,10 @@ let CoreAiMcpController = CoreAiMcpController_1 = class CoreAiMcpController {
                     this.releaseSession(transport.sessionId);
                 }
             };
-            entry = { lastUsed: Date.now(), ownerId: user.id, transport };
+            entry = created;
         }
         entry.lastUsed = Date.now();
+        entry.user = user;
         await entry.transport.handleRequest(req, res, req.body);
         if (entry.transport.sessionId) {
             if (!this.transports.has(entry.transport.sessionId)) {
@@ -155,6 +157,7 @@ let CoreAiMcpController = CoreAiMcpController_1 = class CoreAiMcpController {
             return;
         }
         entry.lastUsed = Date.now();
+        entry.user = user;
         this.registerSession(sessionId, user.id);
         await entry.transport.handleRequest(req, res, req.body);
     }