@miragon/mcp-toolkit-core 2.5.0 → 2.6.0

package/README.md

@@ -9,7 +9,7 @@ Published to the public npm registry under the `@miragon` scope — no `.npmrc`
 or token needed.
 
 ```sh
-pnpm add @miragon/mcp-toolkit-core mcp-use@2.7.1 zod@4.5.4
+pnpm add @miragon/mcp-toolkit-core mcp-use@2.7.3 zod@4.5.4
 ```
 
 Peer versions are pinned exactly — install the versions above.

package/dist/auth/caller.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Caller identity — the ONE place the toolkit reads who is calling.
+ *
+ * mcp-use 2 hands out two `ctx.auth` shapes, and every auth consumer in the
+ * toolkit (role filter, org gate, dashboard scoping, the render-view /
+ * refresh-view pipeline context, the builder catalogue) has to read both:
+ *
+ * - **MCP middleware** (`server.use("mcp:…")`) receives the SDK `AuthInfo`.
+ *   The provider-mapped `{ user, payload, permissions }` sit under
+ *   `ctx.auth.extra` — there is no `ctx.auth.user`.
+ * - **Tool / resource / prompt callbacks** receive the flattened
+ *   `ctx.auth = { user, payload, accessToken, scopes, … }`.
+ *
+ * The built-in providers (Keycloak, Auth0, WorkOS, Clerk, Supabase, Scalekit,
+ * …) map the user as `{ id, organizationId?, roles? }`; 1.x-era custom
+ * providers used `userId` / `organization_id`. Both spellings resolve here.
+ *
+ * Browser-safe on purpose (no mcp-use import): the shapes are read
+ * structurally, so the helper works on any `ctx` — including hosts that omit
+ * auth entirely.
+ */
+/** The caller identity the toolkit's auth consumers act on. */
+export interface Caller {
+    /**
+     * Stable subject id: `user.id`, else `user.userId`, else the verified
+     * token's `payload.sub`. `undefined` when the provider maps none — an
+     * authenticated caller WITHOUT an id is not anonymous; consumers that
+     * scope data per user must refuse it rather than fall back to global scope.
+     */
+    userId?: string;
+    /** `user.organizationId`, else `user.organization_id`. */
+    organizationId?: string;
+    /** String entries of `user.roles`; empty when the provider maps none. */
+    roles: string[];
+}
+/**
+ * Resolve the caller from a middleware or tool/resource/prompt `ctx`.
+ *
+ * Returns `undefined` when the request carries no auth at all (a server
+ * without OAuth, or a signed-out call to a `noauth` tool) — that is the only
+ * case where global, owner-less scope is legitimate. Any `ctx.auth` yields a
+ * {@link Caller}, even when no id can be resolved from it.
+ *
+ * @example
+ * ```ts
+ * server.tool({ name: "whoami", description: "…" }, (_args, ctx) => {
+ *   const caller = resolveCaller(ctx)
+ *   return textResult(caller?.userId ?? "anonymous")
+ * })
+ * ```
+ */
+export declare function resolveCaller(ctx: unknown): Caller | undefined;
+/** Convenience for `resolveCaller(ctx)?.userId`. */
+export declare function resolveCallerId(ctx: unknown): string | undefined;
+//# sourceMappingURL=caller.d.ts.map

package/dist/auth/caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller.d.ts","sourceRoot":"","sources":["../../src/auth/caller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,+DAA+D;AAC/D,MAAM,WAAW,MAAM;IACrB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,0DAA0D;IAC1D,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,yEAAyE;IACzE,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AA8BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAa9D;AAED,oDAAoD;AACpD,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEhE"}

package/dist/auth/caller.js

@@ -0,0 +1,81 @@
+/**
+ * Caller identity — the ONE place the toolkit reads who is calling.
+ *
+ * mcp-use 2 hands out two `ctx.auth` shapes, and every auth consumer in the
+ * toolkit (role filter, org gate, dashboard scoping, the render-view /
+ * refresh-view pipeline context, the builder catalogue) has to read both:
+ *
+ * - **MCP middleware** (`server.use("mcp:…")`) receives the SDK `AuthInfo`.
+ *   The provider-mapped `{ user, payload, permissions }` sit under
+ *   `ctx.auth.extra` — there is no `ctx.auth.user`.
+ * - **Tool / resource / prompt callbacks** receive the flattened
+ *   `ctx.auth = { user, payload, accessToken, scopes, … }`.
+ *
+ * The built-in providers (Keycloak, Auth0, WorkOS, Clerk, Supabase, Scalekit,
+ * …) map the user as `{ id, organizationId?, roles? }`; 1.x-era custom
+ * providers used `userId` / `organization_id`. Both spellings resolve here.
+ *
+ * Browser-safe on purpose (no mcp-use import): the shapes are read
+ * structurally, so the helper works on any `ctx` — including hosts that omit
+ * auth entirely.
+ */
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function firstString(...candidates) {
+    for (const candidate of candidates) {
+        if (typeof candidate === "string" && candidate.length > 0)
+            return candidate;
+    }
+    return undefined;
+}
+/**
+ * Locate the provider-mapped `{ user, payload }` pair in either mcp-use 2
+ * shape. The flattened callback shape wins when both are present.
+ */
+function identitySource(auth) {
+    const extra = isRecord(auth.extra) ? auth.extra : undefined;
+    const user = isRecord(auth.user) ? auth.user : isRecord(extra?.user) ? extra.user : undefined;
+    const payload = isRecord(auth.payload)
+        ? auth.payload
+        : isRecord(extra?.payload)
+            ? extra.payload
+            : undefined;
+    return { user, payload };
+}
+/**
+ * Resolve the caller from a middleware or tool/resource/prompt `ctx`.
+ *
+ * Returns `undefined` when the request carries no auth at all (a server
+ * without OAuth, or a signed-out call to a `noauth` tool) — that is the only
+ * case where global, owner-less scope is legitimate. Any `ctx.auth` yields a
+ * {@link Caller}, even when no id can be resolved from it.
+ *
+ * @example
+ * ```ts
+ * server.tool({ name: "whoami", description: "…" }, (_args, ctx) => {
+ *   const caller = resolveCaller(ctx)
+ *   return textResult(caller?.userId ?? "anonymous")
+ * })
+ * ```
+ */
+export function resolveCaller(ctx) {
+    if (!isRecord(ctx) || !isRecord(ctx.auth))
+        return undefined;
+    const { user, payload } = identitySource(ctx.auth);
+    const userId = firstString(user?.id, user?.userId, payload?.sub);
+    const organizationId = firstString(user?.organizationId, user?.organization_id);
+    const roles = Array.isArray(user?.roles)
+        ? user.roles.filter((role) => typeof role === "string")
+        : [];
+    return {
+        ...(userId === undefined ? {} : { userId }),
+        ...(organizationId === undefined ? {} : { organizationId }),
+        roles,
+    };
+}
+/** Convenience for `resolveCaller(ctx)?.userId`. */
+export function resolveCallerId(ctx) {
+    return resolveCaller(ctx)?.userId;
+}
+//# sourceMappingURL=caller.js.map

package/dist/auth/caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller.js","sourceRoot":"","sources":["../../src/auth/caller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAmBH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAA;AACpD,CAAC;AAED,SAAS,WAAW,CAAC,GAAG,UAAqB;IAC3C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,SAAS,CAAA;IAC7E,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,IAAmB;IACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7F,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QACpC,CAAC,CAAC,IAAI,CAAC,OAAO;QACd,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;YACxB,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,SAAS,CAAA;IACf,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAClD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;IAChE,MAAM,cAAc,GAAG,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,CAAC,CAAA;IAC/E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;QACtC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QACvE,CAAC,CAAC,EAAE,CAAA;IACN,OAAO;QACL,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3D,KAAK;KACN,CAAA;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,OAAO,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;AACnC,CAAC"}

package/dist/engine/pipeline-executor.d.ts

@@ -2,14 +2,42 @@ import type { PipelineContext } from "../types/context.js";
 import type { PipelineConfig } from "../types/pipeline.js";
 import type { StepRegistry } from "../registry/step-registry.js";
 /**
- * Per-request context threaded into steps. Currently only carries the
- * calling user's id, which the executor uses to pre-bind a user-scoped
- * `callTool` closure on the step's `appConfig` so step code stays
- * synchronous and userId-free.
+ * Per-request context threaded into steps: who is calling. The executor hands
+ * it to a user-scoped `callTool` closure on the step's `appConfig` (as its
+ * hidden third argument) so step code stays synchronous and userId-free.
+ * Build it from a tool handler's `ctx` with {@link resolvePipelineContext}.
  */
 export interface PipelineExecutionContext {
+    /**
+     * The caller's id ({@link resolveCaller}). `undefined` for a request without
+     * auth — and for an authenticated caller whose provider maps no id; tell the
+     * two apart with {@link PipelineExecutionContext.authenticated}.
+     */
     userId?: string;
+    /**
+     * `true` when the request carried auth, even if no `userId` resolved from
+     * it. An authenticated caller WITHOUT a `userId` is not anonymous: a closure
+     * that scopes data per user must refuse it rather than fall back to its
+     * global / anonymous scope. Absent for a request without auth (a server
+     * without OAuth).
+     */
+    authenticated?: boolean;
 }
+/**
+ * The {@link PipelineExecutionContext} for a tool / resource / prompt `ctx`,
+ * read through {@link resolveCaller} (both mcp-use 2 `ctx.auth` shapes) — what
+ * render-view, refresh-view and the builder catalogue hand their pipeline.
+ * Use it too when calling `renderView` / `getBuilderCatalogue` from your own
+ * tool, instead of reading `ctx.auth` yourself.
+ *
+ * @example
+ * ```ts
+ * server.tool({ name: "my-view", … }, (args, ctx) =>
+ *   renderView({ input: args, stepRegistry, ctx: resolvePipelineContext(ctx) }),
+ * )
+ * ```
+ */
+export declare function resolvePipelineContext(ctx: unknown): PipelineExecutionContext;
 export interface ExecutePipelineOptions {
     config: PipelineConfig;
     initialKeys: Record<string, unknown>;

package/dist/engine/pipeline-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pipeline-executor.d.ts","sourceRoot":"","sources":["../../src/engine/pipeline-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAEhE;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AA2BD,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,cAAc,CAAA;IACtB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpC,QAAQ,EAAE,YAAY,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpC,GAAG,CAAC,EAAE,wBAAwB,CAAA;CAC/B;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,CAAC,CAwD/F"}
+{"version":3,"file":"pipeline-executor.d.ts","sourceRoot":"","sources":["../../src/engine/pipeline-executor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAEhE;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,wBAAwB,CAG7E;AA4BD,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,cAAc,CAAA;IACtB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpC,QAAQ,EAAE,YAAY,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpC,GAAG,CAAC,EAAE,wBAAwB,CAAA;CAC/B;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,CAAC,CAwD/F"}

package/dist/engine/pipeline-executor.js

@@ -1,10 +1,30 @@
+import { resolveCaller } from "../auth/caller.js";
+/**
+ * The {@link PipelineExecutionContext} for a tool / resource / prompt `ctx`,
+ * read through {@link resolveCaller} (both mcp-use 2 `ctx.auth` shapes) — what
+ * render-view, refresh-view and the builder catalogue hand their pipeline.
+ * Use it too when calling `renderView` / `getBuilderCatalogue` from your own
+ * tool, instead of reading `ctx.auth` yourself.
+ *
+ * @example
+ * ```ts
+ * server.tool({ name: "my-view", … }, (args, ctx) =>
+ *   renderView({ input: args, stepRegistry, ctx: resolvePipelineContext(ctx) }),
+ * )
+ * ```
+ */
+export function resolvePipelineContext(ctx) {
+    const caller = resolveCaller(ctx);
+    return caller === undefined ? {} : { userId: caller.userId, authenticated: true };
+}
 /**
  * If the step's appConfig contains a `callTool` function (a closure the
  * plugin injects via `AppPlugin.appConfig`, e.g. a typed `callTool` bound to
  * the module's own store or client), rewrap it so the step-facing call
  * signature is `(name, args)` while the underlying closure receives the
- * current `{ userId }` via a hidden 3rd argument — steps stay synchronous
- * and userId-free while the closure can still scope data per user.
+ * current {@link PipelineExecutionContext} (`{ userId, authenticated }`) via a
+ * hidden 3rd argument — steps stay synchronous and userId-free while the
+ * closure can still scope data per user.
  * All other keys pass through untouched.
  */
 function bindAppConfig(appConfig, ctx) {

package/dist/engine/pipeline-executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"pipeline-executor.js","sourceRoot":"","sources":["../../src/engine/pipeline-executor.ts"],"names":[],"mappings":"AAcA;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,SAAkB,EAAE,GAAyC;IAClF,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACjE,MAAM,GAAG,GAAG,SAAoC,CAAA;IAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAA;IAC7B,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IACpD,MAAM,GAAG,GAAG,QAIS,CAAA;IACrB,OAAO;QACL,GAAG,GAAG;QACN,QAAQ,EAAE,CAAC,IAAY,EAAE,IAAa,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;KAChE,CAAA;AACH,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA+B;IACnE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IAClE,MAAM,OAAO,GAAoB;QAC/B,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,EAAE,GAAG,WAAW,EAAE;QACxB,MAAM,EAAE,EAAE;KACX,CAAA;IAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAEtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,QAAQ;gBAAE,SAAQ;YAC1B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,GAAG,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAA;YACpF,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QAC5E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,QAAQ;gBAAE,SAAQ;YAC1B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;gBAClB,MAAM,EAAE,GAAG,CAAC,EAAE;gBACd,MAAM,EAAE,0BAA0B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC3D,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAA;YAChE,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;YAC7C,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;YAC/C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;YACxD,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAA;YACzD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAA;YAC9B,mEAAmE;YACnE,mEAAmE;YACnE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,qEAAqE;YACrE,qCAAqC;YACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvD,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACpD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,QAAQ;gBAAE,SAAQ;YAC1B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;gBAClB,MAAM,EAAE,GAAG,CAAC,EAAE;gBACd,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"pipeline-executor.js","sourceRoot":"","sources":["../../src/engine/pipeline-executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AA4BjD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IACjC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAA;AACnF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,SAAkB,EAAE,GAAyC;IAClF,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACjE,MAAM,GAAG,GAAG,SAAoC,CAAA;IAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAA;IAC7B,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IACpD,MAAM,GAAG,GAAG,QAIS,CAAA;IACrB,OAAO;QACL,GAAG,GAAG;QACN,QAAQ,EAAE,CAAC,IAAY,EAAE,IAAa,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;KAChE,CAAA;AACH,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA+B;IACnE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IAClE,MAAM,OAAO,GAAoB;QAC/B,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,EAAE,GAAG,WAAW,EAAE;QACxB,MAAM,EAAE,EAAE;KACX,CAAA;IAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAEtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,QAAQ;gBAAE,SAAQ;YAC1B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,GAAG,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAA;YACpF,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QAC5E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,QAAQ;gBAAE,SAAQ;YAC1B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;gBAClB,MAAM,EAAE,GAAG,CAAC,EAAE;gBACd,MAAM,EAAE,0BAA0B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC3D,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAA;YAChE,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;YAC7C,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;YAC/C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;YACxD,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAA;YACzD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAA;YAC9B,mEAAmE;YACnE,mEAAmE;YACnE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,qEAAqE;YACrE,qCAAqC;YACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvD,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACpD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,QAAQ;gBAAE,SAAQ;YAC1B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;gBAClB,MAAM,EAAE,GAAG,CAAC,EAAE;gBACd,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/framework/catalogue.d.ts

@@ -94,8 +94,8 @@ export interface CatalogueOptions {
     widgetRegistry: WidgetRegistry;
     appConfigs?: Record<string, unknown>;
     /**
-     * Per-request context (currently: the calling userId). Mirrors
-     * {@link RenderViewOptions.ctx}.
+     * Per-request context — who is calling; build it with
+     * `resolvePipelineContext(ctx)`. Mirrors {@link RenderViewOptions.ctx}.
      */
     ctx?: PipelineExecutionContext;
 }

package/dist/framework/render-view.d.ts

@@ -14,10 +14,12 @@ export interface RenderViewOptions {
     stepRegistry: StepRegistry;
     appConfigs?: Record<string, Record<string, unknown>>;
     /**
-     * Per-request context (currently: the calling userId) that the pipeline
-     * executor uses to pre-bind user-scoped `callTool` closures on step
-     * `appConfig`s. Pass it through from the tool handler's
-     * `ctx.auth?.user?.userId`.
+     * Per-request context — who is calling — that the pipeline executor hands
+     * to user-scoped `callTool` closures on step `appConfig`s. Build it from the
+     * tool handler's `ctx` with `resolvePipelineContext(ctx)` (both mcp-use 2
+     * `ctx.auth` shapes; the caller id is `user.id`, then `user.userId`, then
+     * the token's `sub`). Never read `ctx.auth.user.userId` directly: no
+     * built-in mcp-use 2 provider sets it.
      */
     ctx?: PipelineExecutionContext;
     /**

package/dist/framework/render-view.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render-view.d.ts","sourceRoot":"","sources":["../../src/framework/render-view.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,wBAAwB,EAAE,MAAM,gCAAgC,CAAA;AAE/F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAErD,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,KAAK,CAAC,EAAE,eAAe,EAAE,CAAA;IACzB,MAAM,EAAE,YAAY,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACpD;;;;;OAKG;IACH,GAAG,CAAC,EAAE,wBAAwB,CAAA;IAC9B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,iBAAiB;;;;;;;;;;;;;;GA0E1D"}
+{"version":3,"file":"render-view.d.ts","sourceRoot":"","sources":["../../src/framework/render-view.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,wBAAwB,EAAE,MAAM,gCAAgC,CAAA;AAE/F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAErD,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,KAAK,CAAC,EAAE,eAAe,EAAE,CAAA;IACzB,MAAM,EAAE,YAAY,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACpD;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE,wBAAwB,CAAA;IAC9B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,iBAAiB;;;;;;;;;;;;;;GA0E1D"}

package/dist/framework/render-view.js.map

@@ -1 +1 @@
-{"version":3,"file":"render-view.js","sourceRoot":"","sources":["../../src/framework/render-view.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAiC,MAAM,gCAAgC,CAAA;AAC/F,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAmC/D;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAA0B;IACzD,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAA;IAC1E,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAA;IACpC,MAAM,cAAc,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAA;IAE7C,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,gBAAgB,CAAC,cAAc,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;QAC3F,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,+BAA+B,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBACpE;iBACF;gBACD,uEAAuE;gBACvE,sEAAsE;gBACtE,6DAA6D;gBAC7D,OAAO,EAAE,IAAa;aACvB,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;QACpC,MAAM,EAAE,cAAc;QACtB,WAAW;QACX,QAAQ,EAAE,YAAY;QACtB,UAAU;QACV,GAAG;KACJ,CAAC,CAAA;IAEF,MAAM,WAAW,GAAG;QAClB,KAAK,CAAC,KAAK,IAAI,MAAM;QACrB,UAAU,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE;QAC3D,SAAS,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC/C,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YACvB,CAAC,CAAC,WAAW,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC/E,CAAC,CAAC,EAAE;KACP;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAA;IAEb,MAAM,iBAAiB,GAA0B;QAC/C,cAAc,EAAE;YACd,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB;QACD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE;YACP,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACnC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;gBAClD,EAAE;gBACF;oBACE,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B;aACF,CAAC,CACH;YACD,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB;QACD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,gBAAgB,EAAE,gBAAgB,IAAI,KAAK;KAC5C,CAAA;IAED,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACvD,iBAAiB;KAClB,CAAA;AACH,CAAC"}
+{"version":3,"file":"render-view.js","sourceRoot":"","sources":["../../src/framework/render-view.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAiC,MAAM,gCAAgC,CAAA;AAC/F,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAqC/D;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAA0B;IACzD,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAA;IAC1E,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAA;IACpC,MAAM,cAAc,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAA;IAE7C,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,gBAAgB,CAAC,cAAc,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;QAC3F,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,+BAA+B,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBACpE;iBACF;gBACD,uEAAuE;gBACvE,sEAAsE;gBACtE,6DAA6D;gBAC7D,OAAO,EAAE,IAAa;aACvB,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;QACpC,MAAM,EAAE,cAAc;QACtB,WAAW;QACX,QAAQ,EAAE,YAAY;QACtB,UAAU;QACV,GAAG;KACJ,CAAC,CAAA;IAEF,MAAM,WAAW,GAAG;QAClB,KAAK,CAAC,KAAK,IAAI,MAAM;QACrB,UAAU,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE;QAC3D,SAAS,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC/C,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YACvB,CAAC,CAAC,WAAW,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC/E,CAAC,CAAC,EAAE;KACP;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAA;IAEb,MAAM,iBAAiB,GAA0B;QAC/C,cAAc,EAAE;YACd,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB;QACD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE;YACP,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACnC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;gBAClD,EAAE;gBACF;oBACE,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B;aACF,CAAC,CACH;YACD,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB;QACD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,gBAAgB,EAAE,gBAAgB,IAAI,KAAK;KAC5C,CAAA;IAED,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACvD,iBAAiB;KAClB,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export { appsSdkMeta, viewResourceUri, VIEW_RESOURCE_URI_PREFIX } from "./types/
 export type { AppsSdkMetaOptions, AppResourceCsp } from "./types/index.js";
 export { createTranslator } from "./i18n/index.js";
 export type { Message, MessageCatalog, Catalogs, Translate, CreateTranslatorOptions, } from "./i18n/index.js";
-export { executePipeline } from "./engine/pipeline-executor.js";
+export { executePipeline, resolvePipelineContext } from "./engine/pipeline-executor.js";
 export type { PipelineExecutionContext, ExecutePipelineOptions, } from "./engine/pipeline-executor.js";
 export { validatePipeline } from "./engine/context-builder.js";
 export { StepRegistry } from "./registry/step-registry.js";
@@ -24,8 +24,10 @@ export type { LayoutConfig, RowDef } from "./framework/layout-types.js";
 export { layoutInputSchema, layoutSchema, rowSchema } from "./framework/layout-schemas.js";
 export { resolveActiveModules, parseActiveModules } from "./framework/active-modules.js";
 export type { ActiveModuleSelection } from "./framework/active-modules.js";
+export { resolveCaller, resolveCallerId } from "./auth/caller.js";
+export type { Caller } from "./auth/caller.js";
 export { createOrgGateMiddleware } from "./middleware/org-gate.js";
-export type { OrgGateMiddleware } from "./middleware/org-gate.js";
+export type { OrgGateMiddleware, OrgGateMiddlewareFn } from "./middleware/org-gate.js";
 export { createRoleFilterMiddleware } from "./middleware/role-filter.js";
-export type { RoleFilterMiddleware, RoleFilterMiddlewares, RoleFilterOptions, RoleFilterContext, } from "./middleware/role-filter.js";
+export type { RoleFilterMiddleware, RoleFilterMiddlewareFn, RoleFilterMiddlewares, RoleFilterOptions, RoleFilterContext, } from "./middleware/role-filter.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,UAAU,EACV,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,cAAc,EACd,eAAe,EACf,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,aAAa,GACd,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AACzF,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAO1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAClD,YAAY,EACV,OAAO,EACP,cAAc,EACd,QAAQ,EACR,SAAS,EACT,uBAAuB,GACxB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAC/D,YAAY,EACV,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AAEnD,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AACvD,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACpF,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,oBAAoB,GACrB,MAAM,8BAA8B,CAAA;AACrC,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,GACf,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,eAAe,GAChB,MAAM,0BAA0B,CAAA;AAOjC,YAAY,EACV,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,+BAA+B,GAChC,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC9D,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAA;AACvE,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAA;AAE1F,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AACxF,YAAY,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAE1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAClE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AACxE,YAAY,EACV,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,6BAA6B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,UAAU,EACV,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,cAAc,EACd,eAAe,EACf,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,aAAa,GACd,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AACzF,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAO1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAClD,YAAY,EACV,OAAO,EACP,cAAc,EACd,QAAQ,EACR,SAAS,EACT,uBAAuB,GACxB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACvF,YAAY,EACV,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AAEnD,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AACvD,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACpF,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,oBAAoB,GACrB,MAAM,8BAA8B,CAAA;AACrC,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,GACf,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,eAAe,GAChB,MAAM,0BAA0B,CAAA;AAQjC,YAAY,EACV,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,+BAA+B,GAChC,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC9D,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAA;AACvE,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAA;AAE1F,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AACxF,YAAY,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAK1E,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACjE,YAAY,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAClE,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AACxE,YAAY,EACV,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,6BAA6B,CAAA"}

package/dist/index.js

@@ -5,7 +5,7 @@ export { appsSdkMeta, viewResourceUri, VIEW_RESOURCE_URI_PREFIX } from "./types/
 // `LocaleProvider`/`useLocale` (in `@miragon/mcp-toolkit-ui`) consume a
 // `Translate` from here.
 export { createTranslator } from "./i18n/index.js";
-export { executePipeline } from "./engine/pipeline-executor.js";
+export { executePipeline, resolvePipelineContext } from "./engine/pipeline-executor.js";
 export { validatePipeline } from "./engine/context-builder.js";
 export { StepRegistry } from "./registry/step-registry.js";
 export { WidgetRegistry } from "./registry/widget-registry.js";
@@ -17,6 +17,10 @@ export { getFrameworkManifest } from "./framework/manifest.js";
 export { normalizeLayout } from "./framework/layout-types.js";
 export { layoutInputSchema, layoutSchema, rowSchema } from "./framework/layout-schemas.js";
 export { resolveActiveModules, parseActiveModules } from "./framework/active-modules.js";
+// Caller identity — the one reader of both mcp-use 2 `ctx.auth` shapes
+// (middleware: SDK AuthInfo, user under `extra.user`; callbacks: flattened
+// `auth.user`). Browser-safe; every toolkit auth consumer goes through it.
+export { resolveCaller, resolveCallerId } from "./auth/caller.js";
 export { createOrgGateMiddleware } from "./middleware/org-gate.js";
 export { createRoleFilterMiddleware } from "./middleware/role-filter.js";
 // NOTE: Tool registrars (`createToolRegistrar`, `createWidgetToolRegistrar`)

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAGzF,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,wEAAwE;AACxE,yBAAyB;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AASlD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAK/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AAEnD,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AAEvD,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,oBAAoB,GACrB,MAAM,8BAA8B,CAAA;AAOrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAwB9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAE7D,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAA;AAE1F,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAGxF,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAElE,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAQxE,6EAA6E;AAC7E,gEAAgE;AAChE,qEAAqE;AACrE,4EAA4E;AAC5E,4EAA4E"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAGzF,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,wEAAwE;AACxE,yBAAyB;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AASlD,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAKvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AAEnD,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AAEvD,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,oBAAoB,GACrB,MAAM,8BAA8B,CAAA;AAOrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAyB9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAE7D,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAA;AAE1F,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAGxF,uEAAuE;AACvE,2EAA2E;AAC3E,2EAA2E;AAC3E,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAGjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAElE,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AASxE,6EAA6E;AAC7E,gEAAgE;AAChE,qEAAqE;AACrE,4EAA4E;AAC5E,4EAA4E"}

package/dist/middleware/org-gate.d.ts

@@ -1,22 +1,46 @@
 /**
  * Organisation-scope gate for mcp-use middleware.
  *
- * Built for WorkOS-style tokens that carry an `organization_id` claim on the
- * user object. If `orgId` is given, every inbound MCP RPC must come from a
- * user whose token matches — other orgs (or tokens without any org context)
- * get rejected with a thrown error.
+ * If `orgId` is given, every inbound MCP RPC must come from a user whose
+ * token carries that organization — other orgs (or tokens without any org
+ * context) get rejected with a thrown error. The organization comes from
+ * {@link resolveCaller}: the provider-mapped `user.organizationId` (WorkOS,
+ * Clerk, Scalekit, …), or the 1.x-era `user.organization_id`, read from
+ * either mcp-use 2 shape — middleware receives the SDK `AuthInfo` with the
+ * mapped user under `ctx.auth.extra.user`.
  *
  * Register on an mcp-use server with `server.use("mcp:*", createOrgGateMiddleware(ORG_ID))`.
  * Pass `undefined` to disable (returns a pass-through middleware) — handy so
  * the caller can unconditionally wire it up and let env config decide.
  */
+/**
+ * The slice of an mcp-use middleware context the gate reads. Structural (no
+ * mcp-use import), shaped so mcp-use 2's own `MiddlewareContext` is
+ * assignable to it.
+ */
 interface OrgGateContext {
     auth?: {
+        /** Callback-shaped (and 1.x-era) contexts: the provider-mapped user. */
         user?: Record<string, unknown>;
+        /** mcp-use 2 middleware: SDK `AuthInfo.extra`, holding the mapped `user`. */
+        extra?: Record<string, unknown>;
     };
 }
-type Next = () => Promise<unknown>;
-export type OrgGateMiddleware = (ctx: OrgGateContext, next: Next) => Promise<unknown>;
-export declare function createOrgGateMiddleware(orgId: string | undefined): OrgGateMiddleware;
+/**
+ * An org-gate middleware as consumers type their own wrappers and test
+ * doubles: the chain result is `unknown`. Kept non-generic on purpose — it is
+ * the published 2.x shape, and a generic alias would no longer accept a
+ * consumer function that returns a concrete type. The factory's middleware
+ * ({@link OrgGateMiddlewareFn}) is assignable to it.
+ */
+export type OrgGateMiddleware = (ctx: OrgGateContext, next: () => Promise<unknown>) => Promise<unknown>;
+/**
+ * The middleware {@link createOrgGateMiddleware} returns. Generic over the
+ * chain's result so it registers directly on `server.use("mcp:*", …)` (and on
+ * any exact `mcp:` method) without a cast. Assignable to
+ * {@link OrgGateMiddleware}.
+ */
+export type OrgGateMiddlewareFn = <TResult>(ctx: OrgGateContext, next: () => Promise<TResult>) => Promise<TResult>;
+export declare function createOrgGateMiddleware(orgId: string | undefined): OrgGateMiddlewareFn;
 export {};
 //# sourceMappingURL=org-gate.d.ts.map

package/dist/middleware/org-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-gate.d.ts","sourceRoot":"","sources":["../../src/middleware/org-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,UAAU,cAAc;IACtB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAA;CAC1C;AACD,KAAK,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;AAClC,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAErF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAgBpF"}
+{"version":3,"file":"org-gate.d.ts","sourceRoot":"","sources":["../../src/middleware/org-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH;;;;GAIG;AACH,UAAU,cAAc;IACtB,IAAI,CAAC,EAAE;QACL,wEAAwE;QACxE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC9B,6EAA6E;QAC7E,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAA;CACF;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,KACzB,OAAO,CAAC,OAAO,CAAC,CAAA;AAErB;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EACxC,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,KACzB,OAAO,CAAC,OAAO,CAAC,CAAA;AAErB,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAetF"}

package/dist/middleware/org-gate.js

@@ -1,21 +1,24 @@
 /**
  * Organisation-scope gate for mcp-use middleware.
  *
- * Built for WorkOS-style tokens that carry an `organization_id` claim on the
- * user object. If `orgId` is given, every inbound MCP RPC must come from a
- * user whose token matches — other orgs (or tokens without any org context)
- * get rejected with a thrown error.
+ * If `orgId` is given, every inbound MCP RPC must come from a user whose
+ * token carries that organization — other orgs (or tokens without any org
+ * context) get rejected with a thrown error. The organization comes from
+ * {@link resolveCaller}: the provider-mapped `user.organizationId` (WorkOS,
+ * Clerk, Scalekit, …), or the 1.x-era `user.organization_id`, read from
+ * either mcp-use 2 shape — middleware receives the SDK `AuthInfo` with the
+ * mapped user under `ctx.auth.extra.user`.
  *
  * Register on an mcp-use server with `server.use("mcp:*", createOrgGateMiddleware(ORG_ID))`.
  * Pass `undefined` to disable (returns a pass-through middleware) — handy so
  * the caller can unconditionally wire it up and let env config decide.
  */
+import { resolveCaller } from "../auth/caller.js";
 export function createOrgGateMiddleware(orgId) {
     if (!orgId)
         return (_ctx, next) => next();
     return async (ctx, next) => {
-        const user = ctx.auth?.user;
-        const tokenOrgId = user?.organization_id;
+        const tokenOrgId = resolveCaller(ctx)?.organizationId;
         if (!tokenOrgId) {
             throw new Error("Access denied: no organization context in the token. Authenticate with the correct organization.");
         }

package/dist/middleware/org-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"org-gate.js","sourceRoot":"","sources":["../../src/middleware/org-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,MAAM,UAAU,uBAAuB,CAAC,KAAyB;IAC/D,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;IAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAA;QAC3B,MAAM,UAAU,GAAG,IAAI,EAAE,eAAe,CAAA;QACxC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,kGAAkG,CACnG,CAAA;QACH,CAAC;QACD,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;QAC9E,CAAC;QACD,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"org-gate.js","sourceRoot":"","sources":["../../src/middleware/org-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAuCjD,MAAM,UAAU,uBAAuB,CAAC,KAAyB;IAC/D,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;IAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,cAAc,CAAA;QACrD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,kGAAkG,CACnG,CAAA;QACH,CAAC;QACD,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;QAC9E,CAAC;QACD,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA;AACH,CAAC"}

package/dist/middleware/role-filter.d.ts

@@ -11,6 +11,10 @@
  *   `ctx.params.name`. When no name is present it fails *open* by default
  *   (allow) — pass `failClosed: true` to deny instead.
  *
+ * The caller's roles come from {@link resolveCaller}, which reads both mcp-use 2
+ * shapes — middleware receives the SDK `AuthInfo` with the provider-mapped user
+ * under `ctx.auth.extra.user`, never `ctx.auth.user`.
+ *
  * Batches need no special handling: mcp-use invokes `mcp:tools/call`
  * middleware once per call, so each entry of a JSON-RPC batch is guarded
  * individually (verified against 2.0.4 — a two-entry batch fires the guard
@@ -26,24 +30,53 @@
  * *unrestricted* access — this is deliberately opt-in so that adding a new
  * role doesn't silently revoke anyone's tools.
  */
+/**
+ * The slice of an mcp-use middleware context the role filter reads. Kept
+ * structural (no mcp-use import) so the root barrel stays host-agnostic; it is
+ * shaped so mcp-use 2's own `MiddlewareContext` is assignable to it.
+ */
 export interface RoleFilterContext {
     auth?: {
+        /** Callback-shaped (and 1.x-era) contexts: the provider-mapped user. */
         user?: {
             roles?: unknown;
         };
+        /** mcp-use 2 middleware: SDK `AuthInfo.extra`, holding the mapped `user`. */
+        extra?: Record<string, unknown>;
     };
     method?: string;
     params?: {
         name?: unknown;
+        [key: string]: unknown;
     };
 }
-type Next = () => Promise<unknown>;
-export type RoleFilterMiddleware = (ctx: RoleFilterContext, next: Next) => Promise<unknown>;
-export interface RoleFilterMiddlewares {
+/**
+ * A role-filter middleware as consumers type their own wrappers and test
+ * doubles: the chain result is `unknown`. Kept non-generic on purpose — it is
+ * the published 2.x shape, and a generic alias would no longer accept a
+ * consumer function that returns a concrete type. The factory's middlewares
+ * ({@link RoleFilterMiddlewareFn}) are assignable to it.
+ */
+export type RoleFilterMiddleware = (ctx: RoleFilterContext, next: () => Promise<unknown>) => Promise<unknown>;
+/**
+ * The middleware {@link createRoleFilterMiddleware} returns. Generic over the
+ * chain's result so it registers directly on
+ * `server.use("mcp:tools/list" | "mcp:tools/call", …)` without a cast — the
+ * result of `next()` flows back out with its type intact. Assignable to
+ * {@link RoleFilterMiddleware}.
+ */
+export type RoleFilterMiddlewareFn = <TResult>(ctx: RoleFilterContext, next: () => Promise<TResult>) => Promise<TResult>;
+/**
+ * The `tools/list` + `tools/call` pair. Without a type argument the fields are
+ * the non-generic {@link RoleFilterMiddleware} (the shape consumers build by
+ * hand); the factory returns `RoleFilterMiddlewares<RoleFilterMiddlewareFn>`,
+ * which is assignable to it.
+ */
+export interface RoleFilterMiddlewares<TMiddleware = RoleFilterMiddleware> {
     /** Register with `server.use("mcp:tools/list", ...)`. */
-    toolsList: RoleFilterMiddleware;
+    toolsList: TMiddleware;
     /** Register with `server.use("mcp:tools/call", ...)`. */
-    toolsCall: RoleFilterMiddleware;
+    toolsCall: TMiddleware;
 }
 export interface RoleFilterOptions {
     /**
@@ -58,6 +91,5 @@ export interface RoleFilterOptions {
      */
     failClosed?: boolean;
 }
-export declare function createRoleFilterMiddleware(roleToModules: Record<string, string[]>, opts?: RoleFilterOptions): RoleFilterMiddlewares;
-export {};
+export declare function createRoleFilterMiddleware(roleToModules: Record<string, string[]>, opts?: RoleFilterOptions): RoleFilterMiddlewares<RoleFilterMiddlewareFn>;
 //# sourceMappingURL=role-filter.d.ts.map

package/dist/middleware/role-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-filter.d.ts","sourceRoot":"","sources":["../../src/middleware/role-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAA;IACrC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC5B;AACD,KAAK,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;AAClC,MAAM,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAE3F,MAAM,WAAW,qBAAqB;IACpC,yDAAyD;IACzD,SAAS,EAAE,oBAAoB,CAAA;IAC/B,yDAAyD;IACzD,SAAS,EAAE,oBAAoB,CAAA;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EACvC,IAAI,GAAE,iBAAsB,GAC3B,qBAAqB,CAyDvB"}
+{"version":3,"file":"role-filter.d.ts","sourceRoot":"","sources":["../../src/middleware/role-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE;QACL,wEAAwE;QACxE,IAAI,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;QAC1B,6EAA6E;QAC7E,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAA;IACD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;CACpD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,KACzB,OAAO,CAAC,OAAO,CAAC,CAAA;AAErB;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAC3C,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,KACzB,OAAO,CAAC,OAAO,CAAC,CAAA;AAErB;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB,CAAC,WAAW,GAAG,oBAAoB;IACvE,yDAAyD;IACzD,SAAS,EAAE,WAAW,CAAA;IACtB,yDAAyD;IACzD,SAAS,EAAE,WAAW,CAAA;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAID,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EACvC,IAAI,GAAE,iBAAsB,GAC3B,qBAAqB,CAAC,sBAAsB,CAAC,CAwD/C"}