@truefoundry/trueforge 0.2.0-rc.3 → 0.2.0-rc.4

package/dist/main.js

@@ -11,6 +11,7 @@ var __export = (target, all) => {
 // src/config.ts
 var config_exports = {};
 __export(config_exports, {
+  STANDALONE_TRUEFORGE_API_KEY: () => STANDALONE_TRUEFORGE_API_KEY,
   TrueForgeAuthMode: () => TrueForgeAuthMode,
   default: () => config_default,
   getPublicBaseUrl: () => getPublicBaseUrl,
@@ -281,7 +282,7 @@ function getPublicUiBasePath(config = configuration) {
   const path7 = new URL(publicBaseUrl).pathname;
   return path7 === "/" ? "/" : `${path7}/`;
 }
-var DEFAULT_PORT, DEFAULT_HOST, DEFAULT_MAX_REQUEST_BODY_BYTES, PACKAGE_ROOT, LOCAL_EXECUTOR_ID, ENV_PATHS_APP_NAME, DEFAULT_POSTGRES_USER, DEFAULT_POSTGRES_PASSWORD, DEFAULT_POSTGRES_DB, DEFAULT_POSTGRES_HOST, DEFAULT_POSTGRES_PORT, DEFAULT_REDIS_URL, DEFAULT_OIDC_USER_REFERENCE_CLAIM, DEFAULT_OIDC_USER_DISPLAY_NAME_CLAIM, DEFAULT_OIDC_USER_ROLE_CLAIM, DEFAULT_OIDC_ADMIN_ROLE_VALUE, DEFAULT_OIDC_SCOPES, serverExecutionTimeoutSeconds, standalone, appDataDirSuffix, appDataDir, port, host, shared, configuration, TrueForgeAuthMode, config_default;
+var DEFAULT_PORT, DEFAULT_HOST, DEFAULT_MAX_REQUEST_BODY_BYTES, PACKAGE_ROOT, LOCAL_EXECUTOR_ID, ENV_PATHS_APP_NAME, DEFAULT_POSTGRES_USER, DEFAULT_POSTGRES_PASSWORD, DEFAULT_POSTGRES_DB, DEFAULT_POSTGRES_HOST, DEFAULT_POSTGRES_PORT, DEFAULT_REDIS_URL, STANDALONE_TRUEFORGE_API_KEY, DEFAULT_OIDC_USER_REFERENCE_CLAIM, DEFAULT_OIDC_USER_DISPLAY_NAME_CLAIM, DEFAULT_OIDC_USER_ROLE_CLAIM, DEFAULT_OIDC_ADMIN_ROLE_VALUE, DEFAULT_OIDC_SCOPES, serverExecutionTimeoutSeconds, standalone, appDataDirSuffix, appDataDir, port, host, shared, configuration, TrueForgeAuthMode, config_default;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
@@ -297,6 +298,7 @@ var init_config = __esm({
     DEFAULT_POSTGRES_HOST = "localhost";
     DEFAULT_POSTGRES_PORT = 5432;
     DEFAULT_REDIS_URL = "redis://localhost:6379";
+    STANDALONE_TRUEFORGE_API_KEY = "trueforge-standalone";
     DEFAULT_OIDC_USER_REFERENCE_CLAIM = "sub";
     DEFAULT_OIDC_USER_DISPLAY_NAME_CLAIM = "name";
     DEFAULT_OIDC_USER_ROLE_CLAIM = "groups";
@@ -392,6 +394,7 @@ var init_config = __esm({
       }),
       PUBLIC_BASE_URL: parsePublicBaseUrl(getEnv("PUBLIC_BASE_URL", { defaultValue: "" })),
       SERVER_URL: getEnv("SERVER_URL", { defaultValue: `http://localhost:${String(port)}` }) ?? `http://localhost:${String(port)}`,
+      TRUEFORGE_API_KEY: standalone ? getEnv("TRUEFORGE_API_KEY", { defaultValue: STANDALONE_TRUEFORGE_API_KEY }) ?? STANDALONE_TRUEFORGE_API_KEY : getEnv("TRUEFORGE_API_KEY", { required: true }) ?? "",
       TRUEFORGE_MTLS_ENABLED: parseBoolean({
         envKey: "TRUEFORGE_MTLS_ENABLED",
         raw: getEnv("TRUEFORGE_MTLS_ENABLED"),
@@ -499,6 +502,9 @@ var init_config = __esm({
         }
       }
     }
+    if (!configuration.STANDALONE && configuration.TRUEFORGE_API_KEY.trim() === "") {
+      throw new Error("TRUEFORGE_API_KEY must not be empty when STANDALONE=false.");
+    }
     config_default = configuration;
   }
 });
@@ -3860,7 +3866,7 @@ var init_mcpServerStore = __esm({
 // src/schemas/schedule.ts
 import { z as z24 } from "@hono/zod-openapi";
 import { CreatedBySubjectSchema as CreatedBySubjectSchema4, TokenPaginationSchema } from "@truefoundry/trueforge-core/agent-session";
-var SCHEDULE_MIN_INTERVAL_SECONDS, CRON_FIELD, InvalidCronError, CronExpressionSchema, TimezoneSchema, IsoTimestamp, NullableIsoTimestamp, ScheduleTaskSchema, ScheduleStatusSchema, ScheduleManifestObjectSchema, ScheduleManifestSchema, ScheduleSchema, CreateScheduleRequestSchema, UpdateScheduleRequestSchema, GetScheduleResponseSchema, ListSchedulesResponseSchema, DeleteScheduleResponseSchema, ScheduleRunStatusSchema, ScheduleRunSchema, ListScheduleRunsResponseSchema, CreateScheduleRunRequestSchema, CreateScheduleRunResponseSchema;
+var SCHEDULE_MIN_INTERVAL_SECONDS, CRON_FIELD, InvalidCronError, CronExpressionSchema, TimezoneSchema, IsoTimestamp, NullableIsoTimestamp, ScheduleTaskSchema, ScheduleStatusSchema, ScheduleManifestObjectSchema, ScheduleManifestSchema, ScheduleSchema, CreateScheduleRequestSchema, UpdateScheduleRequestSchema, GetScheduleResponseSchema, ListSchedulesResponseSchema, DeleteScheduleResponseSchema, ScheduleRunStatusSchema, ScheduleRunSchema, ListScheduleRunsResponseSchema, CreateScheduleRunRequestSchema, CreateScheduleRunResponseSchema, ExecuteScheduleRunRequestSchema;
 var init_schedule = __esm({
   "src/schemas/schedule.ts"() {
     "use strict";
@@ -3941,6 +3947,9 @@ var init_schedule = __esm({
       schedule_id: z24.string().min(1).max(64).describe("Immutable schedule identifier.")
     }).strict().describe("Trigger an immediate run for the given schedule. The task is taken from the schedule manifest.").openapi("CreateScheduleRunRequest");
     CreateScheduleRunResponseSchema = z24.object({ data: ScheduleRunSchema }).openapi("CreateScheduleRunResponse");
+    ExecuteScheduleRunRequestSchema = z24.object({
+      schedule_run_id: z24.string().min(1).max(64).describe("Immutable schedule run identifier.")
+    }).strict().openapi("ExecuteScheduleRunRequest");
   }
 });
 
@@ -6981,6 +6990,11 @@ var init_SqliteScheduleStore = __esm({
         const row = await db.selectFrom("schedule_run").select(runColumns).where("tenant_id", "=", input.tenant_id).where("id", "=", input.id).executeTakeFirst();
         return row === void 0 ? void 0 : toRunRecord(row);
       }
+      async getRunById(input, transaction) {
+        const db = transaction ?? this.#db;
+        const row = await db.selectFrom("schedule_run").select(runColumns).where("id", "=", input.id).executeTakeFirst();
+        return row === void 0 ? void 0 : toRunRecord(row);
+      }
       async getScheduledRunFor(input, transaction) {
         const db = transaction ?? this.#db;
         const row = await db.selectFrom("schedule_run").select(runColumns).where("tenant_id", "=", input.tenant_id).where("schedule_id", "=", input.schedule_id).where("status", "=", "scheduled").executeTakeFirst();
@@ -7872,6 +7886,11 @@ var init_PostgresScheduleStore = __esm({
         const row = await db.selectFrom("schedule_run").selectAll().where("tenant_id", "=", input.tenant_id).where("id", "=", input.id).executeTakeFirst();
         return row === void 0 ? void 0 : toRunRecord2(row);
       }
+      async getRunById(input, transaction) {
+        const db = transaction ?? this.#db;
+        const row = await db.selectFrom("schedule_run").selectAll().where("id", "=", input.id).executeTakeFirst();
+        return row === void 0 ? void 0 : toRunRecord2(row);
+      }
       async getScheduledRunFor(input, transaction) {
         const db = transaction ?? this.#db;
         const row = await db.selectFrom("schedule_run").selectAll().where("tenant_id", "=", input.tenant_id).where("schedule_id", "=", input.schedule_id).where("status", "=", "scheduled").executeTakeFirst();
@@ -7967,7 +7986,7 @@ import { swaggerUI } from "@hono/swagger-ui";
 import { OpenAPIHono as OpenAPIHono18, z as z35 } from "@hono/zod-openapi";
 import { extractErrorLogFields as extractErrorLogFields8 } from "@truefoundry/trueforge-core/core";
 import { bodyLimit } from "hono/body-limit";
-import { HTTPException as HTTPException8 } from "hono/http-exception";
+import { HTTPException as HTTPException10 } from "hono/http-exception";
 
 // src/apis/agentImport.ts
 init_agentStore();
@@ -9068,6 +9087,87 @@ import { OpenAPIHono as OpenAPIHono2 } from "@hono/zod-openapi";
 
 // src/auth/identity.ts
 init_config();
+
+// src/truefoundry/accessToken.ts
+import { HTTPException as HTTPException4 } from "hono/http-exception";
+
+// src/truefoundry/errors.ts
+import { HTTPException as HTTPException3 } from "hono/http-exception";
+var AGENT_EXTERNAL_ID_REQUIRED = "Agent is missing a TrueFoundry external id";
+var TRUEFOUNDRY_MANAGED_STATUS = 424;
+var TRUEFOUNDRY_MANAGED_MESSAGE = "This resource is managed by TrueFoundry";
+function requireTrueFoundryAgentExternalId(agent) {
+  if (agent.external_id === null) {
+    throw new HTTPException3(500, { message: AGENT_EXTERNAL_ID_REQUIRED });
+  }
+  return agent.external_id;
+}
+function trueFoundryManaged() {
+  throw new HTTPException3(TRUEFOUNDRY_MANAGED_STATUS, { message: TRUEFOUNDRY_MANAGED_MESSAGE });
+}
+
+// src/truefoundry/accessToken.ts
+var accessTokenCache = /* @__PURE__ */ Symbol("truefoundryAccessTokenCache");
+function createTrueFoundryRequestContext(base) {
+  return { ...base, [accessTokenCache]: /* @__PURE__ */ new Map() };
+}
+function isTrueFoundryRequestContext(context) {
+  return accessTokenCache in context;
+}
+function asTrueFoundryRequestContext(context) {
+  if (!isTrueFoundryRequestContext(context)) {
+    throw new Error("TrueFoundry request context required for access token resolution");
+  }
+  return context;
+}
+function agentAccessToken(input) {
+  const { client, requestContext: context } = input;
+  const agentId = requireTrueFoundryAgentExternalId(input.agent);
+  let pending;
+  return () => {
+    if (pending === void 0) {
+      input.logger.info("Exchanging user context for agent access token", {
+        subject: context.subject.id,
+        agentId
+      });
+      pending = client.vendToken({ subject: context.subject, agentId, tenantName: context.tenant_id }).catch((error) => {
+        pending = void 0;
+        throw error;
+      });
+    }
+    return pending;
+  };
+}
+function callerAccessToken(context) {
+  if (context.user_credential === null) {
+    throw new HTTPException4(401, {
+      message: "Authentication token required to list or call TrueFoundry models, MCP servers, skills, and agents"
+    });
+  }
+  const token = context.user_credential;
+  return () => Promise.resolve(token);
+}
+function accessTokenForRequest(input) {
+  if (input.agent === void 0) {
+    return callerAccessToken(input.requestContext);
+  }
+  const agentId = requireTrueFoundryAgentExternalId(input.agent);
+  const cache = input.requestContext[accessTokenCache];
+  const existing = cache.get(agentId);
+  if (existing !== void 0) {
+    return existing;
+  }
+  const resolveAgentAccessToken = agentAccessToken({
+    client: input.client,
+    requestContext: input.requestContext,
+    agent: input.agent,
+    logger: input.logger
+  });
+  cache.set(agentId, resolveAgentAccessToken);
+  return resolveAgentAccessToken;
+}
+
+// src/auth/identity.ts
 var STANDALONE_ADMIN_ROLE = "admin";
 var STANDALONE_REQUEST_CONTEXT = {
   tenant_id: "default",
@@ -9100,6 +9200,22 @@ function hasAdminRole(requestContext) {
       return requestContext.roles.includes(STANDALONE_ADMIN_ROLE);
   }
 }
+function requestSubjectFromCreatedBySubject(subject) {
+  return {
+    id: subject.subject_id,
+    type: subject.subject_type,
+    display_name: subject.subject_display_name
+  };
+}
+function requestContextFromCreatedBySubject(params) {
+  const base = {
+    tenant_id: params.tenant_id,
+    subject: requestSubjectFromCreatedBySubject(params.created_by_subject),
+    roles: [],
+    user_credential: null
+  };
+  return isTrueFoundryModeEnabled(config_default) ? createTrueFoundryRequestContext(base) : base;
+}
 function createdBySubjectFromRequestContext(ctx) {
   return {
     subject_id: ctx.subject.id,
@@ -9329,7 +9445,7 @@ import {
   Sandbox,
   SkillMounter
 } from "@truefoundry/trueforge-core/core";
-import { HTTPException as HTTPException3 } from "hono/http-exception";
+import { HTTPException as HTTPException5 } from "hono/http-exception";
 import { join as join5 } from "path";
 
 // src/sandbox/providerUtils.ts
@@ -9515,7 +9631,7 @@ async function getModelDetails({
 }) {
   const parsed = parseModelFqn(name);
   if (parsed === void 0) {
-    throw new HTTPException3(422, {
+    throw new HTTPException5(422, {
       message: `Model name must be a fully qualified "provider/model": ${name}`
     });
   }
@@ -9525,13 +9641,13 @@ async function getModelDetails({
     model_name: parsed.modelName
   });
   if (provider === void 0) {
-    throw new HTTPException3(422, {
+    throw new HTTPException5(422, {
       message: `Unknown model "${name}" \u2014 provider not configured`
     });
   }
   const model = provider.manifest.models.find((entry) => entry.name === parsed.modelName);
   if (model === void 0) {
-    throw new HTTPException3(422, {
+    throw new HTTPException5(422, {
       message: `Unknown model "${name}" \u2014 not configured on provider`
     });
   }
@@ -9626,7 +9742,7 @@ async function validateAgentSpec({
   if (reasoningEffort !== void 0) {
     const efforts = resolved.reasoningEfforts;
     if (!efforts?.some((effort) => effort === reasoningEffort)) {
-      throw new HTTPException3(422, {
+      throw new HTTPException5(422, {
         message: efforts ? `Reasoning effort "${reasoningEffort}" is not supported by model "${spec.model.name}"` : `Model "${spec.model.name}" does not support configurable reasoning effort`
       });
     }
@@ -9642,7 +9758,7 @@ async function validateAgentSpec({
     );
     const unknown = requestedMcpServers.find((server) => !configuredNames.has(server.name));
     if (unknown !== void 0) {
-      throw new HTTPException3(422, {
+      throw new HTTPException5(422, {
         message: `Unknown MCP server "${unknown.name}" \u2014 not configured`
       });
     }
@@ -9656,7 +9772,7 @@ async function validateAgentSpec({
   if (wantsSandbox || hasSkills) {
     const record = await sandboxProviderStore.getSandboxProvider(tenant_id);
     if (record === void 0 && !isLocalSandboxFallbackEnabled()) {
-      throw new HTTPException3(422, {
+      throw new HTTPException5(422, {
         message: hasSkills ? "skills require a sandbox provider \u2014 configure via PUT /settings/sandbox-providers" : "sandbox is enabled but no sandbox provider is configured \u2014 PUT /settings/sandbox-providers"
       });
     }
@@ -10017,7 +10133,7 @@ function readAccessTokenCookie(params) {
 
 // src/auth/middleware.ts
 init_config();
-import { HTTPException as HTTPException4 } from "hono/http-exception";
+import { HTTPException as HTTPException6 } from "hono/http-exception";
 import { jwtVerify } from "jose";
 
 // src/auth/emailAllowlist.ts
@@ -10269,20 +10385,29 @@ function createAdminAuthMiddleware(authenticator) {
   return async (c, next) => {
     const requestContext = await authenticator.authenticate(c);
     if (!hasAdminRole(requestContext)) {
-      throw new HTTPException4(403, { message: "Admin access required" });
+      throw new HTTPException6(403, { message: "Admin access required" });
     }
     c.set("request_context", requestContext);
     return next();
   };
 }
+function createApiKeyAuthMiddleware(apiKey) {
+  return async (c, next) => {
+    const token = readBearerToken(c);
+    if (token === void 0 || token !== apiKey) {
+      throw new HTTPException6(401, { message: "Invalid service credential" });
+    }
+    return next();
+  };
+}
 var truefoundryAdminMiddleware = async (c, next) => {
   const token = extractRequestToken(c);
   if (config_default.STANDALONE) {
-    throw new HTTPException4(403, { message: "Service API key required" });
+    throw new HTTPException6(403, { message: "Service API key required" });
   }
   const apiKey = config_default.TRUEFOUNDRY_API_KEY;
   if (apiKey === void 0 || token === void 0 || token !== apiKey) {
-    throw new HTTPException4(403, { message: "Service API key required" });
+    throw new HTTPException6(403, { message: "Service API key required" });
   }
   c.set("request_context", {
     tenant_id: "system",
@@ -11434,7 +11559,7 @@ function createMcpOAuthRouter(deps) {
 // src/apis/mcpServers.ts
 import { OpenAPIHono as OpenAPIHono7 } from "@hono/zod-openapi";
 import { extractErrorLogFields as extractErrorLogFields5, isAuthRequired, McpConnectionError as McpConnectionError4, RemoteMCP } from "@truefoundry/trueforge-core/core";
-import { HTTPException as HTTPException5 } from "hono/http-exception";
+import { HTTPException as HTTPException7 } from "hono/http-exception";
 init_config();
 init_mcpServerStore();
 
@@ -12009,7 +12134,7 @@ function createMcpServersRouter(deps) {
       });
       return c.json(authStatus, 200);
     } catch (error) {
-      if (error instanceof HTTPException5) {
+      if (error instanceof HTTPException7) {
         throw error;
       }
       if (error instanceof McpServerNotFoundError) {
@@ -12289,10 +12414,14 @@ function createPermissionsRouter(deps) {
 
 // src/apis/schedules.ts
 import { OpenAPIHono as OpenAPIHono11 } from "@hono/zod-openapi";
-import { InvalidPageTokenError } from "@truefoundry/trueforge-core/agent-session";
+import {
+  InvalidPageTokenError
+} from "@truefoundry/trueforge-core/agent-session";
 
 // src/controller/scheduleDispatch.ts
+init_config();
 init_scheduleStore();
+import { TrueForge } from "@truefoundry/trueforge-sdk";
 init_cron();
 init_schedule();
 var DISPATCH_BATCH_LIMIT = 20;
@@ -12301,6 +12430,20 @@ function scheduleRunFailureReason(error) {
 }
 var SCHEDULE_DISPATCH_INTERVAL_MS = 6e4;
 var SCHEDULE_DISPATCH_LOOP_NAME = "schedule-dispatch";
+function createHttpScheduleRunExecutor() {
+  const tls = {
+    enabled: config_default.TRUEFORGE_MTLS_ENABLED,
+    dir: config_default.TRUEFORGE_MTLS_CERTS_DIR
+  };
+  const tlsFetch = createTlsFetch(tls);
+  const client = new TrueForge({
+    baseUrl: normalizeTlsUrl({ url: config_default.SERVER_URL, enabled: tls.enabled }),
+    token: config_default.TRUEFORGE_API_KEY,
+    timeoutInSeconds: 60,
+    ...tlsFetch === void 0 ? {} : { fetch: tlsFetch }
+  });
+  return (scheduleRunId) => client.internal.schedules.executeRun({ scheduleRunId });
+}
 var ScheduleAgentNotFoundError = class extends Error {
   agent_name;
   constructor(agent_name, options) {
@@ -12309,29 +12452,23 @@ var ScheduleAgentNotFoundError = class extends Error {
     this.agent_name = agent_name;
   }
 };
-function executeScheduledRun(client) {
-  return async ({ run, schedule }) => {
-    const { data: session } = await client.internal.sessions.getOrCreateByExternalId({
-      externalId: run.id,
-      agent: { name: schedule.agent_name },
-      source: { type: "schedule", id: schedule.id, runId: run.id }
-    });
-    const turns = await client.sessions.listTurns(session.id, { limit: 1 });
-    if (turns.data.length > 0) {
-      return;
-    }
-    await client.sessions.createTurn(session.id, {
-      input: [{ type: "user.message", content: schedule.manifest.task }],
-      previousTurnId: "none"
-    });
-  };
-}
+var ScheduleRunNotFoundError = class extends Error {
+  constructor(scheduleRunId, options) {
+    super(`Schedule run not found: ${scheduleRunId}`, options);
+    this.name = "ScheduleRunNotFoundError";
+  }
+};
+var ScheduleNotFoundError = class extends Error {
+  constructor(scheduleId, options) {
+    super(`Schedule not found: ${scheduleId}`, options);
+    this.name = "ScheduleNotFoundError";
+  }
+};
 async function startScheduleRun(params) {
   const {
     item: { run, schedule },
     sessions,
-    agentStore,
-    startTurn
+    agentStore
   } = params;
   const named = await agentStore.getAgent({ tenant_id: schedule.tenant_id, name: schedule.agent_name });
   if (named === void 0) {
@@ -12346,14 +12483,27 @@ async function startScheduleRun(params) {
   });
   const { data: turns } = await session.listTurns({ limit: 1 });
   if (turns.length > 0) {
-    return;
+    return void 0;
   }
-  await startTurn({
+  return {
     session,
     input: [{ type: "user.message", content: schedule.manifest.task }],
     previous_turn_id: "none",
-    userRef: schedule.created_by_subject.subject_id
-  });
+    userRef: schedule.created_by_subject.subject_id,
+    agent: named
+  };
+}
+async function loadScheduleDispatchItem(params) {
+  const { scheduleRunId, scheduleStore } = params;
+  const run = await scheduleStore.getRunById({ id: scheduleRunId });
+  if (run === void 0) {
+    throw new ScheduleRunNotFoundError(scheduleRunId);
+  }
+  const schedule = await scheduleStore.getSchedule({ tenant_id: run.tenant_id, id: run.schedule_id });
+  if (schedule === void 0) {
+    throw new ScheduleNotFoundError(run.schedule_id);
+  }
+  return { run, schedule };
 }
 async function finishScheduledRun(params) {
   const { store, withTransaction, run, status, reason, now: now2 } = params;
@@ -12452,14 +12602,15 @@ async function dispatchScheduledRuns(params) {
   return { dispatched, failed };
 }
 function scheduleDispatchLoop(params) {
-  const { scheduleStore, client, withTransaction, logger } = params;
+  const { scheduleStore, withTransaction, logger } = params;
+  const executeRun = createHttpScheduleRunExecutor();
   return {
     name: SCHEDULE_DISPATCH_LOOP_NAME,
     intervalMs: SCHEDULE_DISPATCH_INTERVAL_MS,
     async tick(signal) {
       const result = await dispatchScheduledRuns({
         store: scheduleStore,
-        onTriggered: executeScheduledRun(client),
+        onTriggered: (item) => executeRun(item.run.id),
         logger,
         withTransaction,
         signal
@@ -12604,6 +12755,36 @@ var createScheduleRunRoute = createRoute10({
     }
   }
 });
+var executeScheduleRunRoute = createRoute10({
+  method: "post",
+  path: "/runs/execute",
+  tags: ["Internal" /* INTERNAL */],
+  summary: "Execute a schedule run",
+  description: "Execute a persisted schedule run using its saved schedule and agent.",
+  "x-fern-sdk-group-name": ["internal", "schedules"],
+  "x-fern-sdk-method-name": "execute_run",
+  request: {
+    body: {
+      content: { "application/json": { schema: ExecuteScheduleRunRequestSchema } },
+      required: true
+    }
+  },
+  responses: {
+    204: { description: "Run executed or already has a turn." },
+    401: {
+      content: { "application/json": { schema: RequestErrorResponseSchema } },
+      description: "Invalid service credential."
+    },
+    404: {
+      content: { "application/json": { schema: RequestErrorResponseSchema } },
+      description: "Run, schedule, or agent not found."
+    },
+    422: {
+      content: { "application/json": { schema: RequestErrorResponseSchema } },
+      description: "The run cannot be executed."
+    }
+  }
+});
 var createScheduleRoute = createRoute10({
   method: "post",
   path: "/",
@@ -12754,7 +12935,7 @@ import {
   SandboxError as SandboxError2,
   VercelAILLM
 } from "@truefoundry/trueforge-core/core";
-import { HTTPException as HTTPException7 } from "hono/http-exception";
+import { HTTPException as HTTPException9 } from "hono/http-exception";
 import { streamSSE } from "hono/streaming";
 
 // src/routes/turnRoutes.ts
@@ -13758,14 +13939,14 @@ var StreamGoneError = class extends Error {
 
 // src/runtime/peeringIds.ts
 init_id();
-import { HTTPException as HTTPException6 } from "hono/http-exception";
+import { HTTPException as HTTPException8 } from "hono/http-exception";
 function mintPeeredTurnId(executorId) {
   return `${newId()}.${executorId}`;
 }
 function executorFromTurnId(turnId) {
   const parts = turnId.split(".");
   if (parts.length !== 2 || !parts[0] || !parts[1]) {
-    throw new HTTPException6(400, { message: `ID ${turnId} is not a valid turn id` });
+    throw new HTTPException8(400, { message: `ID ${turnId} is not a valid turn id` });
   }
   return parts[1];
 }
@@ -13859,7 +14040,7 @@ function createTurnResolver(deps) {
         userRef
       });
       if (connection === void 0) {
-        throw new HTTPException7(422, {
+        throw new HTTPException9(422, {
           message: `Unknown MCP server "${name}" \u2014 not configured`
         });
       }
@@ -13875,7 +14056,7 @@ function createTurnResolver(deps) {
         sessionId
       });
       if (provider === void 0) {
-        throw new HTTPException7(422, {
+        throw new HTTPException9(422, {
           message: "no sandbox provider configured \u2014 PUT /settings/sandbox-providers"
         });
       }
@@ -13886,7 +14067,7 @@ function createTurnResolver(deps) {
       if (carriedSandboxId === void 0 && provider.type !== "local") {
         const status = await checkSnapshotStatus({ store: sandboxProviderStore, tenant_id, logger });
         if (status?.status !== "ready") {
-          throw new HTTPException7(422, {
+          throw new HTTPException9(422, {
             message: status?.status === "failed" ? `sandbox image build failed (${status.status_reason ?? "unknown error"})` : "sandbox image is activating \u2014 retry shortly"
           });
         }
@@ -13908,7 +14089,7 @@ function createTurnResolver(deps) {
     agent: async (agentId) => {
       const record = await agentStore.getAgent({ tenant_id, id: agentId });
       if (record === void 0) {
-        throw new HTTPException7(422, { message: `Agent not found: ${agentId}` });
+        throw new HTTPException9(422, { message: `Agent not found: ${agentId}` });
       }
       return record.manifest;
     },
@@ -14040,7 +14221,7 @@ async function startTurnInProcess(params) {
   return turn;
 }
 function getTurnExecutionError(error) {
-  if (error instanceof HTTPException7) {
+  if (error instanceof HTTPException9) {
     if (error.status === 400 || error.status === 404 || error.status === 422) {
       return { status: error.status, message: error.message };
     }
@@ -14069,7 +14250,7 @@ function resolveAfterSequenceNumber(c, bodyAfterSequenceNumber) {
   if (lastEventId) {
     const sequenceNumber = Number(lastEventId);
     if (!Number.isInteger(sequenceNumber) || sequenceNumber < 0) {
-      throw new HTTPException7(400, { message: "Invalid Last-Event-Id header" });
+      throw new HTTPException9(400, { message: "Invalid Last-Event-Id header" });
     }
     return sequenceNumber;
   }
@@ -14353,7 +14534,7 @@ function createTurnsRouter(deps) {
       await turnEventStream.assertSubscribable();
     } catch (error) {
       if (error instanceof StreamGoneError) {
-        throw new HTTPException7(412, { message: error.message, cause: error });
+        throw new HTTPException9(412, { message: error.message, cause: error });
       }
       throw error;
     }
@@ -14403,6 +14584,33 @@ function createTurnsRouter(deps) {
 }
 
 // src/apis/schedules.ts
+async function startScheduleRunOnRequest(params) {
+  const { c, item, deps } = params;
+  const prepared = await startScheduleRun({
+    item,
+    sessions: deps.sessions,
+    agentStore: deps.agentStore
+  });
+  if (prepared === void 0) {
+    return;
+  }
+  await startTurnInProcess({
+    session: prepared.session,
+    input: prepared.input,
+    previous_turn_id: prepared.previous_turn_id,
+    userRef: prepared.userRef,
+    deps: {
+      activeTurns: deps.activeTurns,
+      eventSubscriptions: deps.eventSubscriptions,
+      agentStore: deps.agentStore,
+      modelProviderStore: deps.resolveModelProviderStore(c, prepared.agent),
+      mcpServerStore: deps.resolveMcpServerStore(c, prepared.agent),
+      sandboxProviderStore: deps.resolveSandboxProviderStore(c),
+      skillStore: deps.turnSkillsResolverStore,
+      logger: deps.logger
+    }
+  });
+}
 function toWireSchedule(record) {
   return {
     id: record.id,
@@ -14456,6 +14664,34 @@ var FORBIDDEN_SCHEDULE_ACCESS = "Only the schedule creator can access this sched
 function isScheduleOwner(requestContext, created_by_subject_id) {
   return requestContext.subject.id === created_by_subject_id;
 }
+function createScheduleExecutionRouter(deps) {
+  const handler = async (c) => {
+    const { schedule_run_id: scheduleRunId } = c.req.valid("json");
+    try {
+      const item = await loadScheduleDispatchItem({
+        scheduleRunId,
+        scheduleStore: deps.scheduleStore
+      });
+      c.set(
+        "request_context",
+        requestContextFromCreatedBySubject({
+          tenant_id: item.schedule.tenant_id,
+          created_by_subject: item.schedule.created_by_subject
+        })
+      );
+      await startScheduleRunOnRequest({ c, item, deps });
+    } catch (error) {
+      if (error instanceof ScheduleRunNotFoundError || error instanceof ScheduleNotFoundError || error instanceof ScheduleAgentNotFoundError) {
+        return c.json({ error: { message: error.message } }, 404);
+      }
+      throw error;
+    }
+    return c.body(null, 204);
+  };
+  const router = new OpenAPIHono11();
+  router.openapi(executeScheduleRunRoute, handler);
+  return router;
+}
 function createSchedulesRouter(deps) {
   const listHandler = async (c) => {
     const { agent_names: agentNames, limit, page_token: pageToken, created_by_me: createdByMe } = c.req.valid("query");
@@ -14563,14 +14799,7 @@ function createSchedulesRouter(deps) {
       throw error;
     }
     try {
-      await startScheduleRun({
-        item: { run, schedule },
-        sessions: deps.sessions,
-        agentStore: deps.resolveAgentStore(c),
-        startTurn: async (turnParams) => {
-          await startTurnInProcess({ ...turnParams, deps: deps.resolveTurnDeps(c, agent) });
-        }
-      });
+      await startScheduleRunOnRequest({ c, item: { run, schedule }, deps });
     } catch (error) {
       await deps.scheduleStore.updateRunStatus({
         tenant_id: requestContext.tenant_id,
@@ -14578,7 +14807,7 @@ function createSchedulesRouter(deps) {
         status: "failed",
         reason: scheduleRunFailureReason(error)
       });
-      if (error instanceof ScheduleAgentNotFoundError) {
+      if (error instanceof ScheduleRunNotFoundError || error instanceof ScheduleNotFoundError || error instanceof ScheduleAgentNotFoundError) {
         return c.json({ error: { message: error.message } }, 404);
       }
       const turnError = getTurnExecutionError(error);
@@ -15947,7 +16176,8 @@ function createAvailableSkillsRouter(deps) {
   });
   router.openapi(listSkillVersionsRoute, async (c) => {
     const { name } = c.req.valid("query");
-    return c.json({ data: await deps.resolveSkillStore(c).listSkillVersions({ name }) }, 200);
+    const skillVersions = await deps.resolveSkillStore(c).listSkillVersions({ name });
+    return c.json({ data: skillVersions }, 200);
   });
   return router;
 }
@@ -16073,7 +16303,7 @@ function createAppErrorHandler(params) {
     if (error instanceof InvalidCronError) {
       return c.json({ error: { message: error.message } }, 400);
     }
-    if (error instanceof HTTPException8) {
+    if (error instanceof HTTPException10) {
       if (error.status >= 500) {
         params.logger.error("Server API error", {
           status: error.status,
@@ -16122,7 +16352,20 @@ function createServerApp(deps) {
   const app = new OpenAPIHono18({ defaultHook: zodValidationHook });
   const authMiddleware = createAuthMiddleware(deps.authenticator);
   const adminAuthMiddleware = createAdminAuthMiddleware(deps.authenticator);
+  const scheduleExecutionAuthMiddleware = createApiKeyAuthMiddleware(config_default.TRUEFORGE_API_KEY);
   const authEnabled = getTrueForgeAuthMode() !== "standalone" /* Standalone */;
+  const scheduleTurnDeps = {
+    scheduleStore: deps.scheduleStore,
+    sessions: deps.sessions,
+    agentStore: deps.agentStore,
+    eventSubscriptions: deps.eventSubscriptions,
+    logger: deps.logger,
+    resolveModelProviderStore: deps.resolveModelProviderStore,
+    resolveMcpServerStore: deps.resolveMcpServerStore,
+    resolveSandboxProviderStore: deps.resolveSandboxProviderStore,
+    activeTurns: deps.activeTurns,
+    turnSkillsResolverStore: deps.turnSkillsResolverStore
+  };
   if (config_default.ACCESS_LOGS) {
     app.use("*", createAccessLogMiddleware(deps.logger));
   }
@@ -16222,23 +16465,16 @@ function createServerApp(deps) {
       authMiddleware
     )
   );
+  app.route(
+    "/api/internal/schedules",
+    withAuth(createScheduleExecutionRouter(scheduleTurnDeps), scheduleExecutionAuthMiddleware)
+  );
   app.route(
     "/api/v1/schedules",
     withAuth(
       createSchedulesRouter({
-        scheduleStore: deps.scheduleStore,
+        ...scheduleTurnDeps,
         resolveAgentStore: deps.resolveAgentStore,
-        sessions: deps.sessions,
-        resolveTurnDeps: (c, runAsAgent) => ({
-          activeTurns: deps.activeTurns,
-          eventSubscriptions: deps.eventSubscriptions,
-          modelProviderStore: deps.resolveModelProviderStore(c, runAsAgent),
-          mcpServerStore: deps.resolveMcpServerStore(c, runAsAgent),
-          skillStore: deps.resolveSkillStore(c),
-          agentStore: deps.resolveAgentStore(c),
-          sandboxProviderStore: deps.resolveSandboxProviderStore(c),
-          logger: deps.logger
-        }),
         withTransaction: deps.withTransaction,
         resolveRequestContext,
         authorizer: deps.authorizer
@@ -16425,87 +16661,6 @@ init_config();
 
 // src/truefoundry/TrueFoundryAuthenticator.ts
 import { HTTPException as HTTPException11 } from "hono/http-exception";
-
-// src/truefoundry/accessToken.ts
-import { HTTPException as HTTPException10 } from "hono/http-exception";
-
-// src/truefoundry/errors.ts
-import { HTTPException as HTTPException9 } from "hono/http-exception";
-var AGENT_EXTERNAL_ID_REQUIRED = "Agent is missing a TrueFoundry external id";
-var TRUEFOUNDRY_MANAGED_STATUS = 424;
-var TRUEFOUNDRY_MANAGED_MESSAGE = "This resource is managed by TrueFoundry";
-function requireTrueFoundryAgentExternalId(agent) {
-  if (agent.external_id === null) {
-    throw new HTTPException9(500, { message: AGENT_EXTERNAL_ID_REQUIRED });
-  }
-  return agent.external_id;
-}
-function trueFoundryManaged() {
-  throw new HTTPException9(TRUEFOUNDRY_MANAGED_STATUS, { message: TRUEFOUNDRY_MANAGED_MESSAGE });
-}
-
-// src/truefoundry/accessToken.ts
-var accessTokenCache = /* @__PURE__ */ Symbol("truefoundryAccessTokenCache");
-function createTrueFoundryRequestContext(base) {
-  return { ...base, [accessTokenCache]: /* @__PURE__ */ new Map() };
-}
-function isTrueFoundryRequestContext(context) {
-  return accessTokenCache in context;
-}
-function asTrueFoundryRequestContext(context) {
-  if (!isTrueFoundryRequestContext(context)) {
-    throw new Error("TrueFoundry request context required for access token resolution");
-  }
-  return context;
-}
-function agentAccessToken(input) {
-  const { client, context } = input;
-  const agentId = requireTrueFoundryAgentExternalId(input.agent);
-  let pending;
-  return () => {
-    if (pending === void 0) {
-      input.logger.info("Exchanging user context for agent access token", {
-        subject: context.subject.id,
-        agentId
-      });
-      pending = client.vendToken({ subject: context.subject, agentId, tenantName: context.tenant_id }).catch((error) => {
-        pending = void 0;
-        throw error;
-      });
-    }
-    return pending;
-  };
-}
-function callerAccessToken(context) {
-  if (context.user_credential === null) {
-    throw new HTTPException10(401, {
-      message: "Authentication token required to list or call TrueFoundry models, MCP servers, skills, and agents"
-    });
-  }
-  const token = context.user_credential;
-  return () => Promise.resolve(token);
-}
-function accessTokenForRequest(input) {
-  if (input.agent === void 0) {
-    return callerAccessToken(input.context);
-  }
-  const agentId = requireTrueFoundryAgentExternalId(input.agent);
-  const cache = input.context[accessTokenCache];
-  const existing = cache.get(agentId);
-  if (existing !== void 0) {
-    return existing;
-  }
-  const resolveAgentAccessToken = agentAccessToken({
-    client: input.client,
-    context: input.context,
-    agent: input.agent,
-    logger: input.logger
-  });
-  cache.set(agentId, resolveAgentAccessToken);
-  return resolveAgentAccessToken;
-}
-
-// src/truefoundry/TrueFoundryAuthenticator.ts
 var TrueFoundryAuthenticator = class {
   #client;
   constructor(client) {
@@ -16839,9 +16994,6 @@ var SkillCatalog = class _SkillCatalog {
 // src/main.ts
 init_config();
 
-// src/controller.ts
-import { TrueForge } from "@truefoundry/trueforge-sdk";
-
 // src/controller/Controller.ts
 var CONTROLLER_STOPPED = "controller-stopped";
 var Controller = class {
@@ -16937,28 +17089,16 @@ var Controller = class {
 };
 
 // src/controller.ts
-function createScheduleApiClient(params) {
-  const baseUrl = normalizeTlsUrl({ url: params.baseUrl, enabled: params.tls.enabled });
-  const fetchImpl = createTlsFetch(params.tls);
-  return new TrueForge({
-    baseUrl,
-    auth: false,
-    ...fetchImpl !== void 0 ? { fetch: fetchImpl } : {}
-  });
-}
 function createController(params) {
-  const { scheduleStore, withTransaction, logger, baseUrl } = params;
-  const tls = params.tls ?? { enabled: false, dir: "" };
   return new Controller({
     loops: [
       scheduleDispatchLoop({
-        scheduleStore,
-        client: createScheduleApiClient({ baseUrl, tls }),
-        withTransaction,
-        logger
+        scheduleStore: params.scheduleStore,
+        withTransaction: params.withTransaction,
+        logger: params.logger
       })
     ],
-    logger
+    logger: params.logger
   });
 }
 
@@ -17797,11 +17937,11 @@ var TrueFoundryMcpServerStore = class {
     this.#client = input.client;
     this.#resolveAccessToken = accessTokenForRequest({
       client: input.client,
-      context: asTrueFoundryRequestContext(input.context),
+      requestContext: asTrueFoundryRequestContext(input.requestContext),
       agent: input.agent,
       logger: input.logger
     });
-    this.#subject = input.context.subject;
+    this.#subject = input.requestContext.subject;
     this.#perServerHeaders = input.perServerHeaders ?? {};
   }
   /** Gateway Bearer (+ optional per-server overrides); SFY authorize first, else authRequired. */
@@ -17968,7 +18108,7 @@ var TrueFoundryModelProviderStore = class {
     this.#client = input.client;
     this.#resolveAccessToken = accessTokenForRequest({
       client: input.client,
-      context: asTrueFoundryRequestContext(input.context),
+      requestContext: asTrueFoundryRequestContext(input.requestContext),
       agent: input.agent,
       logger: input.logger
     });
@@ -18217,10 +18357,60 @@ function toRegistryRecord(tenant_id, skill) {
     updated_at: now2
   };
 }
-var TrueFoundrySkillStore = class {
+var TrueFoundryAdminSkillStore = class {
+  #client;
+  constructor(input) {
+    this.#client = input.client;
+  }
+  async resolveTurnSkills(input) {
+    const { skills } = input;
+    if (skills.length === 0) {
+      return [];
+    }
+    const resolved = await this.#client.resolveAgentSkillVersions({
+      accessToken: this.#client.apiKey,
+      skills: skills.map((skill) => ({
+        fqn: skill.name,
+        include_skill_md_content: skill.preload,
+        include_presigned_url: true
+      }))
+    });
+    const byFqn = new Map(resolved.map((row) => [row.fqn, row]));
+    return skills.map((skill) => {
+      const row = byFqn.get(skill.name);
+      if (row === void 0) {
+        throw new HTTPException18(422, {
+          message: `Unknown skill "${skill.name}" \u2014 not configured`
+        });
+      }
+      if (row.presigned_url === void 0) {
+        throw new HTTPException18(422, {
+          message: `Skill "${skill.name}" did not return a presigned URL`
+        });
+      }
+      const skillMdContent = skill.preload ? row.skill_md_content ?? null : null;
+      if (skill.preload && (skillMdContent === null || skillMdContent.length === 0)) {
+        throw new HTTPException18(422, {
+          message: `Skill "${skill.name}" did not return SKILL.md for preload`
+        });
+      }
+      return {
+        type: "registry",
+        name: row.name,
+        description: row.description,
+        fqn: row.fqn,
+        preload: skill.preload,
+        skillMdContent,
+        presignedUrl: row.presigned_url
+      };
+    });
+  }
+};
+var TrueFoundrySkillStore = class extends TrueFoundryAdminSkillStore {
   #client;
   #resolveAccessToken;
   constructor(input) {
+    super(input);
     this.#client = input.client;
     this.#resolveAccessToken = callerAccessToken(input.context);
   }
@@ -18299,49 +18489,6 @@ var TrueFoundrySkillStore = class {
       seenNames.add(row.name);
     }
   }
-  async resolveTurnSkills(input) {
-    const { skills } = input;
-    if (skills.length === 0) {
-      return [];
-    }
-    const resolved = await this.#client.resolveAgentSkillVersions({
-      accessToken: this.#client.apiKey,
-      skills: skills.map((skill) => ({
-        fqn: skill.name,
-        include_skill_md_content: skill.preload,
-        include_presigned_url: true
-      }))
-    });
-    const byFqn = new Map(resolved.map((row) => [row.fqn, row]));
-    return skills.map((skill) => {
-      const row = byFqn.get(skill.name);
-      if (row === void 0) {
-        throw new HTTPException18(422, {
-          message: `Unknown skill "${skill.name}" \u2014 not configured`
-        });
-      }
-      if (row.presigned_url === void 0) {
-        throw new HTTPException18(422, {
-          message: `Skill "${skill.name}" did not return a presigned URL`
-        });
-      }
-      const skillMdContent = skill.preload ? row.skill_md_content ?? null : null;
-      if (skill.preload && (skillMdContent === null || skillMdContent.length === 0)) {
-        throw new HTTPException18(422, {
-          message: `Skill "${skill.name}" did not return SKILL.md for preload`
-        });
-      }
-      return {
-        type: "registry",
-        name: row.name,
-        description: row.description,
-        fqn: row.fqn,
-        preload: skill.preload,
-        skillMdContent,
-        presignedUrl: row.presigned_url
-      };
-    });
-  }
 };
 
 // src/main.ts
@@ -18390,19 +18537,25 @@ function buildResolveSkillStore(options) {
   if (client === void 0) {
     return () => persistenceStore;
   }
-  return (c) => new TrueFoundrySkillStore({
+  return (requestContext) => new TrueFoundrySkillStore({
     client,
-    context: resolveRequestContext(c)
+    context: requestContext
   });
 }
+function buildTurnSkillsResolverStore(options) {
+  const { persistenceStore, client } = options;
+  if (client) {
+    return new TrueFoundryAdminSkillStore({ client });
+  }
+  return persistenceStore;
+}
 function buildResolveModelProviderStore(options) {
-  return (c, runAsAgent) => {
+  return (rc, runAsAgent) => {
     const { persistenceStore, client } = options;
     if (client) {
-      const requestContext = resolveRequestContext(c);
       return new TrueFoundryModelProviderStore({
         client,
-        context: requestContext,
+        requestContext: rc,
         agent: runAsAgent,
         logger: options.logger
       });
@@ -18411,35 +18564,33 @@ function buildResolveModelProviderStore(options) {
   };
 }
 function buildResolveMcpServerStore(options) {
-  return (c, runAsAgent) => {
-    const { persistenceStore, tokenStore, client } = options;
-    if (c && client) {
-      const requestContext = resolveRequestContext(c);
-      const rawPerServerHeaders = c.req.header(X_TFG_MCP_HEADERS);
+  const withAuthMcpPersistenceStore = new McpServerWithAuthStore({
+    store: options.persistenceStore,
+    tokenStore: options.tokenStore,
+    clientName: configuration2.MCP_DCR_OAUTH_CLIENT_NAME
+  });
+  return (rc, runAsAgent, perServerHeaders) => {
+    const { client } = options;
+    if (client) {
       return new TrueFoundryMcpServerStore({
         client,
-        context: requestContext,
+        requestContext: rc,
         agent: runAsAgent,
         logger: options.logger,
-        perServerHeaders: rawPerServerHeaders ? parsePerServerMcpHeaders(rawPerServerHeaders) : {}
+        ...perServerHeaders === void 0 ? {} : { perServerHeaders }
       });
     }
-    const withAuthMcpPersistenceStore = new McpServerWithAuthStore({
-      store: persistenceStore,
-      tokenStore,
-      clientName: configuration2.MCP_DCR_OAUTH_CLIENT_NAME
-    });
     return withAuthMcpPersistenceStore;
   };
 }
 function buildResolveAgentStore(options) {
   const { persistenceStore, client, db } = options;
-  return (c) => {
+  return (rc) => {
     if (client) {
       return new TrueFoundryAgentStore({
         inner: persistenceStore,
         client,
-        context: resolveRequestContext(c),
+        context: rc,
         db
       });
     }
@@ -18448,11 +18599,10 @@ function buildResolveAgentStore(options) {
 }
 function buildResolveSandboxProviderStore(options) {
   const { persistenceStore } = options;
-  if (!isTrueFoundryModeEnabled2(configuration2)) {
-    return () => persistenceStore;
+  if (isTrueFoundryModeEnabled2(configuration2)) {
+    return () => new TrueFoundrySandboxProviderStore();
   }
-  const trueFoundryStore = new TrueFoundrySandboxProviderStore();
-  return () => trueFoundryStore;
+  return () => persistenceStore;
 }
 async function createStandalonePersistence(options) {
   const { sqlitePath, logger } = options;
@@ -18498,20 +18648,23 @@ async function createStandalonePersistence(options) {
   const sandboxProviderStore = new SqliteSandboxProviderStore2(db);
   const skillStore = new SqliteSkillStore2(db);
   return {
+    withTransaction: (callback) => db.transaction().execute(callback),
     sessionStore: new SqliteSessionStore2(db),
     sessionMetricsStore: new SqliteSessionMetricsStore2(db),
+    mcpOAuthStore: mcpServerStore,
+    tokenStore,
+    scheduleStore: new SqliteScheduleStore2(db),
     resolveModelProviderStore: () => modelProviderStore,
     resolveMcpServerStore: () => mcpServerStore,
+    resolveSandboxProviderStore: () => sandboxProviderStore,
+    resolveSkillStore: () => skillStore,
     resolveAgentStore: () => agentStore,
     resolveImportAgentStore: () => agentStore,
-    resolveSandboxProviderStore: () => sandboxProviderStore,
-    withTransaction: (callback) => db.transaction().execute(callback),
-    tokenStore,
-    scheduleStore: new SqliteScheduleStore2(db),
+    agentStore,
+    turnSkillsResolverStore: skillStore,
     destroyDb: () => db.destroy(),
     redis: void 0,
-    serviceFoundryClient: void 0,
-    resolveSkillStore: () => skillStore
+    serviceFoundryClient: void 0
   };
 }
 async function createDistributedPersistence(options) {
@@ -18560,11 +18713,22 @@ async function createDistributedPersistence(options) {
   await migrateToLatest2(db);
   logger.info("Distributed mode: postgres");
   logger.info(`Executor id: ${executorId}`);
+  const serviceFoundryClient = createServiceFoundryServerClient(logger);
   const tokenStore = new PostgresOAuthTokenStore2(db);
-  const agentStore = new PostgresAgentStore3(db);
   const modelProviderStore = new PostgresModelProviderStore2(db);
   const mcpServerStore = new PostgresMcpServerStore2(db);
-  const serviceFoundryClient = createServiceFoundryServerClient(logger);
+  const mcpServerWithAuthStore = new McpServerWithAuthStore({
+    store: mcpServerStore,
+    tokenStore,
+    clientName: configuration3.MCP_DCR_OAUTH_CLIENT_NAME
+  });
+  const sandboxProviderStore = new PostgresSandboxProviderStore2(db);
+  const skillStore = new PostgresSkillStore2(db);
+  const agentStore = new PostgresAgentStore3(db);
+  const turnSkillsResolverStore = buildTurnSkillsResolverStore({
+    persistenceStore: skillStore,
+    client: serviceFoundryClient
+  });
   const resolveModelProviderStore = buildResolveModelProviderStore({
     persistenceStore: modelProviderStore,
     client: serviceFoundryClient,
@@ -18599,49 +18763,51 @@ async function createDistributedPersistence(options) {
     });
   };
   const resolveSandboxProviderStore = buildResolveSandboxProviderStore({
-    persistenceStore: new PostgresSandboxProviderStore2(db)
+    persistenceStore: sandboxProviderStore
+  });
+  const resolveSkillStore = buildResolveSkillStore({
+    persistenceStore: skillStore,
+    client: serviceFoundryClient
   });
-  const skillStore = new PostgresSkillStore2(db);
   return {
+    withTransaction: (callback) => db.transaction().execute(callback),
     sessionStore: new PostgresSessionStore2(db),
     sessionMetricsStore: new PostgresSessionMetricsStore2(db),
+    mcpOAuthStore: mcpServerWithAuthStore,
+    tokenStore,
+    scheduleStore: new PostgresScheduleStore2(db),
     resolveModelProviderStore,
     resolveMcpServerStore,
+    resolveSandboxProviderStore,
+    resolveSkillStore,
     resolveAgentStore,
     resolveImportAgentStore,
-    resolveSandboxProviderStore,
-    withTransaction: (callback) => db.transaction().execute(callback),
-    tokenStore,
-    scheduleStore: new PostgresScheduleStore2(db),
+    agentStore,
+    turnSkillsResolverStore,
     destroyDb: () => db.destroy(),
     redis: await connectRedis2({ url: redisUrl, logger }),
-    serviceFoundryClient,
-    resolveSkillStore: buildResolveSkillStore({
-      persistenceStore: skillStore,
-      client: serviceFoundryClient
-    })
+    serviceFoundryClient
   };
 }
 async function createServerRuntime(persistence, logger) {
   const {
+    withTransaction,
     sessionStore,
     sessionMetricsStore,
-    resolveModelProviderStore,
-    resolveMcpServerStore,
-    resolveAgentStore,
-    resolveImportAgentStore,
-    resolveSandboxProviderStore,
-    withTransaction,
     tokenStore,
     scheduleStore,
+    mcpOAuthStore,
+    resolveImportAgentStore,
+    agentStore,
+    turnSkillsResolverStore,
     destroyDb,
     redis,
-    serviceFoundryClient,
-    resolveSkillStore
+    serviceFoundryClient
   } = persistence;
   const activeTurns = new ActiveTurnRegistry();
   const requestReplyRouter = new RequestReplyRouter();
   const eventSubscriptions = new EventSubscriptionRegistry(redis);
+  const sessions = new Sessions({ sessionStore });
   const oidc = isOidcConfigured2(configuration2) ? configuration2.OIDC : void 0;
   if (oidc) {
     logger.info("Auth is enabled", { issuer: oidc.OIDC_ISSUER_URL });
@@ -18671,9 +18837,23 @@ async function createServerRuntime(persistence, logger) {
   const controller = configuration2.STANDALONE ? createController({
     scheduleStore,
     withTransaction,
-    logger,
-    baseUrl: `http://localhost:${String(configuration2.PORT)}`
+    logger
   }) : void 0;
+  const resolveModelProviderStore = (c, runAsAgent) => persistence.resolveModelProviderStore(resolveRequestContext(c), runAsAgent);
+  const resolveMcpServerStore = (c, runAsAgent) => {
+    if (c === void 0) {
+      return mcpOAuthStore;
+    }
+    const rawPerServerHeaders = c.req.header(X_TFG_MCP_HEADERS);
+    return persistence.resolveMcpServerStore(
+      resolveRequestContext(c),
+      runAsAgent,
+      rawPerServerHeaders === void 0 ? void 0 : parsePerServerMcpHeaders(rawPerServerHeaders)
+    );
+  };
+  const resolveAgentStore = (c) => persistence.resolveAgentStore(resolveRequestContext(c));
+  const resolveSandboxProviderStore = (c) => persistence.resolveSandboxProviderStore(resolveRequestContext(c));
+  const resolveSkillStore = (c) => persistence.resolveSkillStore(resolveRequestContext(c));
   const app = createServerApp({
     modelCatalog: ModelCatalog.load(),
     mcpCatalog: McpCatalog.load(),
@@ -18684,12 +18864,15 @@ async function createServerRuntime(persistence, logger) {
     resolveAgentStore,
     resolveImportAgentStore,
     resolveSandboxProviderStore,
+    resolveSkillStore,
     withTransaction,
     tokenStore,
     scheduleStore,
+    agentStore,
+    turnSkillsResolverStore,
     sessionStore,
     sessionMetricsStore,
-    sessions: new Sessions({ sessionStore }),
+    sessions,
     activeTurns,
     redis,
     requestReplyRouter,
@@ -18697,8 +18880,7 @@ async function createServerRuntime(persistence, logger) {
     logger,
     oidcClient,
     authenticator,
-    authorizer,
-    resolveSkillStore
+    authorizer
   });
   return { activeTurns, app, controller, destroyDb, redis, requestReplyRouter };
 }