@frontmcp/sdk 1.4.1 → 1.5.0-rc.1

package/esm/index.mjs

@@ -1,5 +1,5 @@
 import { createRequire as __frontmcpCreateRequire } from 'module';
-const require = __frontmcpCreateRequire(import.meta.url);
+const require = __frontmcpCreateRequire(import.meta.url || 'file:///');
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -11,11 +11,20 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name41 in all)
@@ -667,7 +676,10 @@ var init_server_tokens = __esm({
       intent: tokenFactory.meta("intent"),
       auth: tokenFactory.meta("auth"),
       sessionId: tokenFactory.meta("sessionId"),
-      reinitialize: tokenFactory.meta("reinitialize")
+      reinitialize: tokenFactory.meta("reinitialize"),
+      webRequest: tokenFactory.meta("webRequest"),
+      webCtx: tokenFactory.meta("webCtx"),
+      webTransport: tokenFactory.meta("webTransport")
     };
   }
 });
@@ -1374,7 +1386,7 @@ import {
   JSONRPCResponseSchema
 } from "@frontmcp/protocol";
 import { randomUUID } from "@frontmcp/utils";
-var JSON_RPC, REDIRECTS, NO_BODY_STATUSES, zNumUnion, HttpStatus, HttpRedirectStatus, HttpEmptyStatus, HttpHeaders, HttpCookieSchema, HttpCookies, HttpMeta, statusAllowsBody, HttpRedirectSchema, HttpJsonSchema, HttpNextSchema, HttpConsumedSchema, HttpTextSchema, HttpHtmlSchema, HttpBinarySchema, HttpImageSchema, isHttpReadableLike, HttpStreamSchema, HttpSseSchema, HttpJsonRpcSchema, HttpProblemSchema, HttpEmptySchema, httpOutputSchema, httpRespond;
+var JSON_RPC, REDIRECTS, NO_BODY_STATUSES, zNumUnion, HttpStatus, HttpRedirectStatus, HttpEmptyStatus, HttpHeaders, HttpCookieSchema, HttpCookies, HttpMeta, statusAllowsBody, HttpRedirectSchema, HttpJsonSchema, HttpNextSchema, HttpConsumedSchema, HttpWebResponseSchema, HttpTextSchema, HttpHtmlSchema, HttpBinarySchema, HttpImageSchema, isHttpReadableLike, HttpStreamSchema, HttpSseSchema, HttpJsonRpcSchema, HttpProblemSchema, HttpEmptySchema, httpOutputSchema, httpRespond;
 var init_http_output_schema = __esm({
   "libs/sdk/src/common/schemas/http-output.schema.ts"() {
     "use strict";
@@ -1426,6 +1438,13 @@ var init_http_output_schema = __esm({
       kind: z2.literal("next")
     }).passthrough();
     HttpConsumedSchema = z2.object({ kind: z2.literal("consumed") });
+    HttpWebResponseSchema = z2.object({
+      kind: z2.literal("web-response"),
+      response: z2.custom(
+        (v) => typeof Response !== "undefined" && v instanceof Response,
+        "must be a Web Response"
+      )
+    });
     HttpTextSchema = z2.object({
       kind: z2.literal("text"),
       status: HttpStatus.refine((s) => statusAllowsBody(s) && !REDIRECTS.includes(s), {
@@ -1518,7 +1537,8 @@ var init_http_output_schema = __esm({
       HttpProblemSchema,
       HttpEmptySchema,
       HttpNextSchema,
-      HttpConsumedSchema
+      HttpConsumedSchema,
+      HttpWebResponseSchema
     ]);
     httpRespond = {
       json: (body, extra = {}) => {
@@ -1618,6 +1638,9 @@ var init_http_output_schema = __esm({
       consumed() {
         return { kind: "consumed" };
       },
+      webResponse(response) {
+        return { kind: "web-response", response };
+      },
       empty(status = 204, headers) {
         return { kind: "empty", status, headers };
       },
@@ -2174,6 +2197,18 @@ var init_sqlite = __esm({
 });
 
 // libs/sdk/src/common/types/options/transport/schema.ts
+var schema_exports = {};
+__export(schema_exports, {
+  PROTOCOL_PRESETS: () => PROTOCOL_PRESETS,
+  eventStoreConfigSchema: () => eventStoreConfigSchema,
+  expandProtocolConfig: () => expandProtocolConfig,
+  expandTransportConfig: () => expandTransportConfig,
+  isDistributedMode: () => isDistributedMode,
+  persistenceConfigSchema: () => persistenceConfigSchema,
+  shouldCacheProviders: () => shouldCacheProviders,
+  toLegacyProtocolFlags: () => toLegacyProtocolFlags,
+  transportOptionsSchema: () => transportOptionsSchema
+});
 import { z as z12 } from "@frontmcp/lazy-zod";
 import { isServerless } from "@frontmcp/utils";
 function expandProtocolConfig(protocol) {
@@ -2493,7 +2528,8 @@ var init_schema10 = __esm({
       sep2640InInstructions: z15.boolean().optional().default(false),
       cache: skillsConfigCacheOptionsSchema.optional(),
       audit: skillsConfigAuditOptionsSchema.optional(),
-      injectInstructions: z15.enum(["off", "append", "prepend", "replace"]).optional().default("append")
+      injectInstructions: z15.enum(["off", "append", "prepend", "replace"]).optional().default("append"),
+      scoring: z15.enum(["cosine", "bm25"]).optional()
     });
   }
 });
@@ -4714,6 +4750,12 @@ var init_elicitation_error = __esm({
         this.toolInput = toolInput;
         this.ttl = ttl;
       }
+      elicitId;
+      elicitMessage;
+      schema;
+      toolName;
+      toolInput;
+      ttl;
       getPublicMessage() {
         return this.elicitMessage;
       }
@@ -6194,30 +6236,30 @@ var require_dist = __commonJS({
       sqliteStorageOptionsSchema: () => sqliteStorageOptionsSchema
     });
     module.exports = __toCommonJS2(index_exports);
-    var import_utils101 = __require("@frontmcp/utils");
+    var import_utils103 = __require("@frontmcp/utils");
     var HKDF_SALT = new TextEncoder().encode("frontmcp-sqlite-storage-v1");
     var HKDF_INFO = new TextEncoder().encode("aes-256-gcm-value-encryption");
     var KEY_LENGTH = 32;
     function deriveEncryptionKey(secret) {
       const ikm = new TextEncoder().encode(secret);
-      return (0, import_utils101.hkdfSha256)(ikm, HKDF_SALT, HKDF_INFO, KEY_LENGTH);
+      return (0, import_utils103.hkdfSha256)(ikm, HKDF_SALT, HKDF_INFO, KEY_LENGTH);
     }
     var SEPARATOR = ":";
     function encryptValue(key, plaintext) {
-      const iv = (0, import_utils101.randomBytes)(12);
+      const iv = (0, import_utils103.randomBytes)(12);
       const plaintextBytes = new TextEncoder().encode(plaintext);
-      const { ciphertext, tag } = (0, import_utils101.encryptAesGcm)(key, plaintextBytes, iv);
-      return [(0, import_utils101.base64urlEncode)(iv), (0, import_utils101.base64urlEncode)(tag), (0, import_utils101.base64urlEncode)(ciphertext)].join(SEPARATOR);
+      const { ciphertext, tag } = (0, import_utils103.encryptAesGcm)(key, plaintextBytes, iv);
+      return [(0, import_utils103.base64urlEncode)(iv), (0, import_utils103.base64urlEncode)(tag), (0, import_utils103.base64urlEncode)(ciphertext)].join(SEPARATOR);
     }
     function decryptValue(key, encrypted) {
       const parts = encrypted.split(SEPARATOR);
       if (parts.length !== 3) {
         throw new Error("Invalid encrypted value format");
       }
-      const iv = (0, import_utils101.base64urlDecode)(parts[0]);
-      const tag = (0, import_utils101.base64urlDecode)(parts[1]);
-      const ciphertext = (0, import_utils101.base64urlDecode)(parts[2]);
-      const plaintext = (0, import_utils101.decryptAesGcm)(key, ciphertext, iv, tag);
+      const iv = (0, import_utils103.base64urlDecode)(parts[0]);
+      const tag = (0, import_utils103.base64urlDecode)(parts[1]);
+      const ciphertext = (0, import_utils103.base64urlDecode)(parts[2]);
+      const plaintext = (0, import_utils103.decryptAesGcm)(key, ciphertext, iv, tag);
       return new TextDecoder().decode(plaintext);
     }
     var import_utils210 = __require("@frontmcp/utils");
@@ -7338,6 +7380,8 @@ var init_task_notifier = __esm({
         this.notifications = notifications;
         this.logger = logger;
       }
+      notifications;
+      logger;
       sendStatus(record) {
         const params = {
           ...toWireShape(record)
@@ -7493,6 +7537,7 @@ var init_in_process_task_runner = __esm({
       constructor(deps) {
         this.deps = deps;
       }
+      deps;
       kind = "in-process";
       async run(record, context) {
         await this.deps.store.update(record.taskId, record.sessionId, {
@@ -7547,6 +7592,7 @@ var init_cli_task_runner = __esm({
       constructor(deps) {
         this.deps = deps;
       }
+      deps;
       kind = "cli";
       async run(record, _context) {
         const { exe, args } = this.resolveCommand();
@@ -7901,6 +7947,9 @@ var init_tasks_result_flow = __esm({
         this.taskId = taskId;
         this.name = "JsonRpcReplayError";
       }
+      code;
+      data;
+      taskId;
       toJsonRpcError() {
         const out = {
           code: this.code,
@@ -8124,6 +8173,72 @@ var init_task = __esm({
   }
 });
 
+// libs/sdk/src/transport/build-scoped-server-options.ts
+var build_scoped_server_options_exports = {};
+__export(build_scoped_server_options_exports, {
+  buildScopedServerOptions: () => buildScopedServerOptions
+});
+function buildScopedServerOptions(scope, instructions = "") {
+  const hasRemoteApps = scope.apps?.getApps().some((app) => app.isRemote) ?? false;
+  const hasPrompts = scope.prompts.hasAny() || hasRemoteApps;
+  const hasResources = scope.resources.hasAny() || hasRemoteApps;
+  const completionsCapability = hasPrompts || hasResources ? { completions: {} } : {};
+  const remoteCapabilities = hasRemoteApps ? {
+    tools: { listChanged: true },
+    resources: { subscribe: true, listChanged: true },
+    prompts: { listChanged: true }
+  } : {};
+  const skillsCapabilities = scope.skills?.getCapabilities() ?? {};
+  const toolsCapabilities = scope.tools.getCapabilities();
+  const resourcesCapabilities = scope.resources.getCapabilities();
+  const promptsCapabilities = scope.prompts.getCapabilities();
+  const agentsCapabilities = scope.agents.getCapabilities();
+  const taskCapabilities = computeTaskCapabilities(scope);
+  const fragments = [
+    remoteCapabilities,
+    toolsCapabilities,
+    resourcesCapabilities,
+    promptsCapabilities,
+    agentsCapabilities,
+    skillsCapabilities,
+    completionsCapability,
+    taskCapabilities
+  ];
+  const experimental = {};
+  const extensions = {};
+  for (const cap2 of fragments) {
+    if (cap2["experimental"] && typeof cap2["experimental"] === "object") {
+      Object.assign(experimental, cap2["experimental"]);
+    }
+    if (cap2["extensions"] && typeof cap2["extensions"] === "object") {
+      Object.assign(extensions, cap2["extensions"]);
+    }
+  }
+  const baseCapabilities = {
+    ...remoteCapabilities,
+    ...toolsCapabilities,
+    ...resourcesCapabilities,
+    ...promptsCapabilities,
+    ...agentsCapabilities,
+    ...completionsCapability,
+    ...taskCapabilities,
+    logging: {}
+  };
+  if (Object.keys(experimental).length > 0) baseCapabilities["experimental"] = experimental;
+  if (Object.keys(extensions).length > 0) baseCapabilities["extensions"] = extensions;
+  return {
+    instructions,
+    capabilities: baseCapabilities,
+    serverInfo: scope.metadata.info
+  };
+}
+var init_build_scoped_server_options = __esm({
+  "libs/sdk/src/transport/build-scoped-server-options.ts"() {
+    "use strict";
+    init_task();
+  }
+});
+
 // libs/sdk/src/transport/mcp-handlers/mcp-error.utils.ts
 import { McpError as McpError2 } from "@frontmcp/protocol";
 function toSdkMcpError(err) {
@@ -8393,6 +8508,8 @@ var init_notification_service = __esm({
         this.options = options;
         this.logger = scope.logger.child("NotificationService");
       }
+      scope;
+      options;
       logger;
       servers = /* @__PURE__ */ new Map();
       unsubscribers = [];
@@ -10808,58 +10925,7 @@ async function createInMemoryServer(scope, options) {
   const sessionId = options?.sessionId ?? `in-memory:${randomUUID4()}`;
   const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
   let currentAuthInfo = options?.authInfo ?? {};
-  const hasRemoteApps = scope.apps?.getApps().some((app) => app.isRemote) ?? false;
-  const hasPrompts = scope.prompts.hasAny() || hasRemoteApps;
-  const hasResources = scope.resources.hasAny() || hasRemoteApps;
-  const completionsCapability = hasPrompts || hasResources ? { completions: {} } : {};
-  const remoteCapabilities = hasRemoteApps ? {
-    tools: { listChanged: true },
-    resources: { subscribe: true, listChanged: true },
-    prompts: { listChanged: true }
-  } : {};
-  const skillsCapabilities = scope.skills?.getCapabilities() ?? {};
-  const toolsCapabilities = scope.tools.getCapabilities();
-  const resourcesCapabilities = scope.resources.getCapabilities();
-  const promptsCapabilities = scope.prompts.getCapabilities();
-  const agentsCapabilities = scope.agents.getCapabilities();
-  const taskCapabilities = computeTaskCapabilities(scope);
-  const fragments = [
-    remoteCapabilities,
-    toolsCapabilities,
-    resourcesCapabilities,
-    promptsCapabilities,
-    agentsCapabilities,
-    skillsCapabilities,
-    completionsCapability,
-    taskCapabilities
-  ];
-  const experimental = {};
-  const extensions = {};
-  for (const cap2 of fragments) {
-    if (cap2["experimental"] && typeof cap2["experimental"] === "object") {
-      Object.assign(experimental, cap2["experimental"]);
-    }
-    if (cap2["extensions"] && typeof cap2["extensions"] === "object") {
-      Object.assign(extensions, cap2["extensions"]);
-    }
-  }
-  const baseCapabilities = {
-    ...remoteCapabilities,
-    ...toolsCapabilities,
-    ...resourcesCapabilities,
-    ...promptsCapabilities,
-    ...agentsCapabilities,
-    ...completionsCapability,
-    ...taskCapabilities,
-    logging: {}
-  };
-  if (Object.keys(experimental).length > 0) baseCapabilities["experimental"] = experimental;
-  if (Object.keys(extensions).length > 0) baseCapabilities["extensions"] = extensions;
-  const serverOptions = {
-    instructions: "",
-    capabilities: baseCapabilities,
-    serverInfo: scope.metadata.info
-  };
+  const serverOptions = buildScopedServerOptions(scope);
   const mcpServer = new McpServer2(scope.metadata.info, serverOptions);
   const handlers = createMcpHandlers2({ scope, serverOptions });
   for (const handler of handlers) {
@@ -10892,7 +10958,7 @@ async function createInMemoryServer(scope, options) {
 var init_in_memory_server = __esm({
   "libs/sdk/src/transport/in-memory-server.ts"() {
     "use strict";
-    init_task();
+    init_build_scoped_server_options();
   }
 });
 
@@ -10906,29 +10972,29 @@ import {
 } from "@frontmcp/protocol";
 import { fileExists as fileExists2, pathResolve, randomUUID as randomUUID5 } from "@frontmcp/utils";
 function findFileFromRoot(root, relativePath) {
-  const fs2 = __require("fs");
+  const fs = __require("fs");
   const path3 = __require("path");
   const cleanRelative = relativePath.replace(/^\.\//, "");
   const searchDirs = ["src", "."];
   for (const srcDir of searchDirs) {
     const srcRoot = path3.join(root, srcDir);
-    if (!fs2.existsSync(srcRoot)) continue;
-    const found = walkForFile(srcRoot, cleanRelative, fs2, path3);
+    if (!fs.existsSync(srcRoot)) continue;
+    const found = walkForFile(srcRoot, cleanRelative, fs, path3);
     if (found) return found;
   }
   return void 0;
 }
-function walkForFile(dir, targetRelative, fs2, path3, maxDepth = 10) {
+function walkForFile(dir, targetRelative, fs, path3, maxDepth = 10) {
   const candidate = path3.join(dir, targetRelative);
-  if (fs2.existsSync(candidate)) {
+  if (fs.existsSync(candidate)) {
     return { absolute: candidate, baseDir: dir };
   }
   if (maxDepth <= 0) return void 0;
   try {
-    const entries = fs2.readdirSync(dir, { withFileTypes: true });
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory() && !entry.name.startsWith(".") && entry.name !== "node_modules" && entry.name !== "dist") {
-        const result = walkForFile(path3.join(dir, entry.name), targetRelative, fs2, path3, maxDepth - 1);
+        const result = walkForFile(path3.join(dir, entry.name), targetRelative, fs, path3, maxDepth - 1);
         if (result) return result;
       }
     }
@@ -12108,13 +12174,15 @@ var init_health2 = __esm({
 });
 
 // libs/sdk/src/logger/instances/instance.file-logger.ts
-import * as fs from "fs";
 import * as os from "os";
 import * as path2 from "path";
+function getFs() {
+  return _fs ??= __require("fs");
+}
 function stripAnsi(str) {
   return str.split(ESC).map((s) => s.replace(/\[[0-9;]*m/, "")).join("");
 }
-var LOG_LEVEL_LABELS, ESC, DEFAULT_LOGS_MAX, FileLogTransportInstance;
+var _fs, LOG_LEVEL_LABELS, ESC, DEFAULT_LOGS_MAX, FileLogTransportInstance;
 var init_instance_file_logger = __esm({
   "libs/sdk/src/logger/instances/instance.file-logger.ts"() {
     "use strict";
@@ -12145,10 +12213,10 @@ var init_instance_file_logger = __esm({
           return;
         }
         try {
-          fs.mkdirSync(this.logDir, { recursive: true });
+          getFs().mkdirSync(this.logDir, { recursive: true });
           const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/:/g, "_");
           const filePath = path2.join(this.logDir, `${this.appName}-${ts}.log`);
-          this.fd = fs.openSync(filePath, "a");
+          this.fd = getFs().openSync(filePath, "a");
           this.rotate(isNaN(logsMax) ? DEFAULT_LOGS_MAX : logsMax);
         } catch {
           this.fd = void 0;
@@ -12158,7 +12226,7 @@ var init_instance_file_logger = __esm({
       close() {
         if (this.fd !== void 0) {
           try {
-            fs.closeSync(this.fd);
+            getFs().closeSync(this.fd);
           } catch {
           }
           this.fd = void 0;
@@ -12173,7 +12241,7 @@ var init_instance_file_logger = __esm({
         const line = `[${ts}] ${level}${prefix} ${message}
 `;
         try {
-          fs.writeSync(this.fd, line);
+          getFs().writeSync(this.fd, line);
         } catch {
         }
       }
@@ -12181,12 +12249,12 @@ var init_instance_file_logger = __esm({
       rotate(maxFiles) {
         try {
           const prefix = `${this.appName}-`;
-          const files = fs.readdirSync(this.logDir).filter((f) => f.startsWith(prefix) && f.endsWith(".log")).sort();
+          const files = getFs().readdirSync(this.logDir).filter((f) => f.startsWith(prefix) && f.endsWith(".log")).sort();
           const excess = files.length - maxFiles;
           if (excess <= 0) return;
           for (let i = 0; i < excess; i++) {
             try {
-              fs.unlinkSync(path2.join(this.logDir, files[i]));
+              getFs().unlinkSync(path2.join(this.logDir, files[i]));
             } catch {
             }
           }
@@ -12344,6 +12412,8 @@ var init_instance_logger = __esm({
         this.transports = transports;
         this.consoleTransport = consoleTransport;
       }
+      config;
+      getTransports;
       level;
       prefix;
       transports;
@@ -15236,6 +15306,7 @@ var init_tool_instance = __esm({
         super(args);
         this.record = record;
       }
+      record;
       execute(input) {
         return this.record.provide(input, this);
       }
@@ -15342,6 +15413,10 @@ var init_base_adapter = __esm({
         this.raw = raw;
         this.name = "LlmAdapterError";
       }
+      provider;
+      code;
+      statusCode;
+      raw;
     };
   }
 });
@@ -16292,6 +16367,7 @@ var init_providers = __esm({
       constructor(options) {
         this.options = options;
       }
+      options;
       adapter = null;
       getAdapter() {
         if (this.adapter) {
@@ -16575,6 +16651,8 @@ var init_flow_context_providers = __esm({
         this.baseProviders = baseProviders;
         this.contextDeps = contextDeps;
       }
+      baseProviders;
+      contextDeps;
       get(token) {
         if (this.contextDeps.has(token)) {
           return this.contextDeps.get(token);
@@ -17325,6 +17403,7 @@ var init_prompt_instance = __esm({
         super(args);
         this.record = record;
       }
+      record;
       execute(args) {
         return this.record.provide(args, this);
       }
@@ -19492,6 +19571,7 @@ var init_resource_instance = __esm({
         super(args);
         this.record = record;
       }
+      record;
       execute(uri, params) {
         return this.record.provide(uri, params, this);
       }
@@ -23133,6 +23213,8 @@ var init_flow_interface = __esm({
         this.type = type;
         this.output = output;
       }
+      type;
+      output;
       static respond(output) {
         throw new _FlowControl("respond", output);
       }
@@ -23161,6 +23243,11 @@ var init_flow_interface = __esm({
         this.input = metadata.inputSchema?.parse?.(rawInput);
         this.scopeLogger = scope.logger;
       }
+      metadata;
+      rawInput;
+      scope;
+      appendContextHooks;
+      deps;
       input;
       state = FlowState.create({});
       scopeLogger;
@@ -23814,6 +23901,18 @@ async function writeHttpResponse(res, value) {
       res.status(out.status).end();
       return;
     }
+    case "web-response": {
+      const r = out.response;
+      r.headers.forEach((v, k) => res.setHeader(k, v));
+      res.status(r.status);
+      if (r.body) {
+        for await (const chunk of r.body) {
+          res.write(chunk);
+        }
+      }
+      res.end();
+      return;
+    }
   }
 }
 var init_server_validation = __esm({
@@ -24030,6 +24129,34 @@ var init_flow_instance = __esm({
         const results = await Promise.all(canActivate.map((m) => m(request, this.scope)));
         return results.every((r) => r);
       }
+      /**
+       * Express-equivalent HTTP match for runtimes that have NO middleware server
+       * (the Cloudflare Worker / web-fetch handler, where `registerMiddleware` is a
+       * no-op so flows never mount as routes). It mirrors how Express dispatches:
+       * method + `middleware.path` (mounted as a prefix) + `canActivate`.
+       *
+       * Only flows with a SPECIFIC matcher qualify — a `middleware.path` (e.g.
+       * `/oauth/token`) and/or a `canActivate` (static class method or
+       * `middleware.canActivate`, e.g. the well-known PRM path set). A bare
+       * `{ method }` middleware is too broad to safely claim an arbitrary request,
+       * so it returns false. Used by the web-fetch handler to serve auth/well-known/
+       * oauth endpoints through the real flow pipeline.
+       */
+      async matchHttp(request) {
+        const mw = this.metadata.middleware;
+        if (!mw) return false;
+        const path3 = typeof mw.path === "string" ? mw.path : "";
+        const hasStaticCanActivate = typeof this.FlowClass.canActivate === "function";
+        const hasMwCanActivate = (mw.canActivate?.length ?? 0) > 0;
+        if (!path3 && !hasStaticCanActivate && !hasMwCanActivate) return false;
+        if (this.method && request.method !== this.method) return false;
+        if (path3) {
+          const reqPath = request.path;
+          const prefix = path3.endsWith("/") ? path3 : `${path3}/`;
+          if (reqPath !== path3 && !reqPath.startsWith(prefix)) return false;
+        }
+        return this.canActivate(request);
+      }
       /**
        * Get FrontMcpContextStorage from providers (with fallback).
        * Returns undefined if not available (backward compatibility).
@@ -24431,6 +24558,21 @@ var init_flow_registry = __esm({
           )
         );
       }
+      /**
+       * Find the name of the first registered flow whose HTTP matcher claims this
+       * request (method + `middleware.path` prefix + `canActivate`). For runtimes
+       * with no middleware server (the web-fetch/Worker handler), this replaces
+       * Express's route dispatch so auth/well-known/oauth flows still run. Returns
+       * `undefined` when no flow matches.
+       */
+      async findHttpFlowName(request, exclude = /* @__PURE__ */ new Set()) {
+        for (const instance of this.instances.values()) {
+          const name41 = instance.name;
+          if (exclude.has(name41)) continue;
+          if (await instance.matchHttp(request)) return name41;
+        }
+        return void 0;
+      }
       /**
        * Get FrontMcpContextStorage from providers (with fallback).
        * Returns undefined if not available (backward compatibility).
@@ -25019,12 +25161,51 @@ var init_skill_validation_error = __esm({
   }
 });
 
+// libs/sdk/src/scope/optional-dependency.util.ts
+function probeOptionalDependency(moduleName, loadError, resolve) {
+  let resolvedPath;
+  try {
+    resolvedPath = resolve(moduleName);
+  } catch {
+    resolvedPath = void 0;
+  }
+  const error = loadError instanceof Error ? loadError.message : String(loadError);
+  return resolvedPath ? { status: "load-failed", resolvedPath, error } : { status: "not-installed", error };
+}
+async function importOptionalPeer(moduleName, importer, resolve, feature) {
+  try {
+    return await importer();
+  } catch (cause) {
+    const probe = probeOptionalDependency(moduleName, cause, resolve);
+    if (probe.status === "not-installed") {
+      throw new Error(
+        `@frontmcp/sdk ${feature} needs the optional peer dependency '${moduleName}'. Install it in your project (e.g. \`npm i ${moduleName}\`).`,
+        { cause }
+      );
+    }
+    throw new Error(
+      `@frontmcp/sdk ${feature} found '${moduleName}' at ${probe.resolvedPath} but it failed to load \u2014 reinstalling will not help. This is usually an export-condition, transpile, or transitive-peer mismatch. Original error: ${probe.error}`,
+      { cause }
+    );
+  }
+}
+var init_optional_dependency_util = __esm({
+  "libs/sdk/src/scope/optional-dependency.util.ts"() {
+    "use strict";
+  }
+});
+
 // libs/sdk/src/skill/providers/memory-skill.provider.ts
-import { TFIDFVectoria } from "vectoriadb";
+import { sha256Hex as sha256Hex3 } from "@frontmcp/utils";
+function isSnapshotCapable(db) {
+  const d = db;
+  return typeof d.toSnapshot === "function" && typeof d.loadSnapshot === "function";
+}
 var STOP_WORDS, MemorySkillProvider;
 var init_memory_skill_provider = __esm({
   "libs/sdk/src/skill/providers/memory-skill.provider.ts"() {
     "use strict";
+    init_optional_dependency_util();
     STOP_WORDS = /* @__PURE__ */ new Set([
       // Articles & Determiners
       "the",
@@ -25100,19 +25281,118 @@ var init_memory_skill_provider = __esm({
     MemorySkillProvider = class {
       type = "memory";
       vectorDB;
+      vectorDBReady;
       skills = /* @__PURE__ */ new Map();
       defaultTopK;
       defaultMinScore;
       toolValidator;
       initialized = false;
+      /** Ranking mode passed to the vector DB (cosine | bm25). */
+      scoring;
+      /** Optional snapshot cache for fast cold-start (e.g. KV-backed on the edge). */
+      indexCache;
+      /**
+       * Whether the vector index reflects the current document set. Adds/removes
+       * mark it stale; the FIRST search after a mutation builds (or restores) it
+       * exactly once. This defers the expensive IDF/embedding pass off the
+       * registration hot-path — registering N skills no longer triggers N reindexes.
+       */
+      indexReady = false;
       constructor(options = {}) {
         this.defaultTopK = options.defaultTopK ?? 10;
         this.defaultMinScore = options.defaultMinScore ?? 0.1;
         this.toolValidator = options.toolValidator;
-        this.vectorDB = new TFIDFVectoria({
+        this.scoring = options.scoring ?? "cosine";
+        this.indexCache = options.indexCache;
+        this.vectorDBReady = this.initVectorDB();
+        this.vectorDBReady.catch(() => void 0);
+      }
+      async initVectorDB() {
+        const mod = await importOptionalPeer(
+          "vectoriadb",
+          () => import("vectoriadb"),
+          __require.resolve,
+          "skill storage"
+        );
+        const dbConfig = {
           defaultTopK: this.defaultTopK,
           defaultSimilarityThreshold: this.defaultMinScore
-        });
+        };
+        if (this.scoring !== "cosine") dbConfig.scoring = this.scoring;
+        this.vectorDB = new mod.TFIDFVectoria(dbConfig);
+      }
+      /**
+       * Attach (or replace) the snapshot cache after construction — useful when the
+       * cache binding only exists at request time (e.g. a Cloudflare KV namespace on
+       * `env`). Marks the index stale so the next search consults the new cache.
+       */
+      setIndexCache(cache2) {
+        this.indexCache = cache2;
+        this.indexReady = false;
+      }
+      /**
+       * Ensure the vector index reflects the current document set, building it AT
+       * MOST once per mutation batch. When a snapshot cache is configured and the
+       * vector DB supports snapshots, a content-hash hit restores the index without
+       * recomputing IDF/embeddings (the cold-start fast path); a miss rebuilds and
+       * persists the snapshot for next time. Cache failures degrade to a local
+       * rebuild — they never block search.
+       */
+      async ensureIndexed() {
+        if (this.indexReady) return;
+        const db = await this.db();
+        if (this.indexCache && isSnapshotCapable(db)) {
+          const key = await this.computeIndexKey();
+          try {
+            const snapshot = await this.indexCache.get(key);
+            if (snapshot !== void 0 && snapshot !== null) {
+              db.loadSnapshot(snapshot);
+              this.indexReady = true;
+              return;
+            }
+          } catch {
+          }
+          this.reindexNow(db);
+          this.indexReady = true;
+          try {
+            await this.indexCache.set(key, db.toSnapshot());
+          } catch {
+          }
+          return;
+        }
+        this.reindexNow(db);
+        this.indexReady = true;
+      }
+      /**
+       * Eagerly build (or restore from cache) the search index now, rather than on
+       * the first search. A host calls this after registration completes to move the
+       * one-time index build off the first request's critical path (e.g. the edge
+       * does this right after attaching the KV cache).
+       */
+      async warm() {
+        await this.ensureIndexed();
+      }
+      /** Force the vector DB to (re)compute its index now. */
+      reindexNow(db) {
+        db.reindex();
+      }
+      /**
+       * Stable content hash of the indexed skill set + scoring mode. Changing any
+       * skill's searchable text, the set of skills, or the scoring mode changes the
+       * key, so a stale snapshot is never restored.
+       */
+      async computeIndexKey() {
+        const parts = Array.from(this.skills.values()).map((s) => `${s.id}\0${this.buildSearchableText(s)}`).sort();
+        const canonical = `frontmcp-skill-index:v1|${this.scoring}|${this.skills.size}|${parts.join("
")}`;
+        return sha256Hex3(canonical);
+      }
+      /** Await the lazy vectoriadb load (throws the clear install hint if absent). */
+      async db() {
+        await this.vectorDBReady;
+        if (!this.vectorDB) {
+          throw new Error("Vector DB not initialized; await this.vectorDBReady before use.");
+        }
+        return this.vectorDB;
       }
       /**
        * Set the tool validator after construction.
@@ -25122,9 +25402,13 @@ var init_memory_skill_provider = __esm({
         this.toolValidator = validator;
       }
       async initialize() {
+        await this.vectorDBReady;
         this.initialized = true;
       }
       async search(query, options = {}) {
+        if (query.trim().length === 0) {
+          return [];
+        }
         const {
           topK = this.defaultTopK,
           tags,
@@ -25155,10 +25439,16 @@ var init_memory_skill_provider = __esm({
           }
           return true;
         };
-        let results = await this.vectorDB.search(query, {
+        const db = await this.db();
+        await this.ensureIndexed();
+        let results = await db.search(query, {
           topK,
           threshold: minScore,
-          filter
+          filter,
+          // `negativeQuery` (anti-query demotion) is honored by newer vectoriadb
+          // versions; older ones ignore the extra field.
+          ...options.negativeQuery !== void 0 ? { negativeQuery: options.negativeQuery } : {},
+          ...options.negativeWeight !== void 0 ? { negativeWeight: options.negativeWeight } : {}
         });
         if (results.length === 0 && query.trim().length > 0 && this.skills.size > 0) {
           results = this.fallbackTextSearch(query, topK, filter);
@@ -25266,29 +25556,35 @@ var init_memory_skill_provider = __esm({
       }
       async add(skill) {
         this.skills.set(skill.id, skill);
-        this.indexSkill(skill);
+        await this.indexSkill(skill);
       }
       async update(skillId, skill) {
         const normalizedSkill = skill.id !== skillId ? { ...skill, id: skillId } : skill;
-        if (this.vectorDB.hasDocument(skillId)) {
-          this.vectorDB.removeDocument(skillId);
+        const db = await this.db();
+        if (db.hasDocument(skillId)) {
+          db.removeDocument(skillId);
         }
         this.skills.set(skillId, normalizedSkill);
-        this.indexSkill(normalizedSkill);
+        await this.indexSkill(normalizedSkill);
       }
       async remove(skillId) {
         this.skills.delete(skillId);
-        if (this.vectorDB.hasDocument(skillId)) {
-          this.vectorDB.removeDocument(skillId);
+        const db = await this.db();
+        if (db.hasDocument(skillId)) {
+          db.removeDocument(skillId);
         }
+        this.indexReady = false;
       }
       async clear() {
         this.skills.clear();
-        this.vectorDB.clear();
+        const db = await this.db().catch(() => void 0);
+        db?.clear();
+        this.indexReady = false;
       }
       async dispose() {
         this.skills.clear();
-        this.vectorDB.clear();
+        const db = await this.db().catch(() => void 0);
+        db?.clear();
         this.initialized = false;
       }
       /**
@@ -25307,13 +25603,14 @@ var init_memory_skill_provider = __esm({
             }
           };
         });
-        this.vectorDB.addDocuments(documents);
-        this.vectorDB.reindex();
+        const db = await this.db();
+        db.addDocuments(documents);
+        this.indexReady = false;
       }
       /**
        * Index a single skill in the vector database.
        */
-      indexSkill(skill) {
+      async indexSkill(skill) {
         const document = {
           id: skill.id,
           text: this.buildSearchableText(skill),
@@ -25323,8 +25620,9 @@ var init_memory_skill_provider = __esm({
             skill
           }
         };
-        this.vectorDB.addDocuments([document]);
-        this.vectorDB.reindex();
+        const db = await this.db();
+        db.addDocuments([document]);
+        this.indexReady = false;
       }
       /**
        * Build searchable text for TF-IDF indexing.
@@ -26061,7 +26359,9 @@ var init_skill_registry = __esm({
         this.options = options ?? {};
         this.storageProvider = new MemorySkillProvider({
           defaultTopK: 10,
-          defaultMinScore: 0.1
+          defaultMinScore: 0.1,
+          ...this.options.scoring ? { scoring: this.options.scoring } : {},
+          ...this.options.indexCache ? { indexCache: this.options.indexCache } : {}
         });
         this.buildGraph();
         this.ready = this.initialize();
@@ -26271,6 +26571,31 @@ var init_skill_registry = __esm({
        * provider update lagged or failed) would mask the newer dynamic content.
        * Provider-only rows pass through unchanged; overlay-only rows are appended.
        */
+      /**
+       * Attach (or replace) the snapshot cache used to persist/restore the search
+       * index — for runtimes where the cache binding only exists at request time
+       * (e.g. a Cloudflare KV namespace on `env`). No-op if the storage provider
+       * doesn't support index caching. Pair with {@link warmIndex} to build/restore
+       * the index off the first request's critical path.
+       */
+      setIndexCache(cache2) {
+        const provider = this.storageProvider;
+        if (typeof provider.setIndexCache === "function") {
+          provider.setIndexCache(cache2);
+        }
+      }
+      /**
+       * Eagerly build (or restore from the cache) the search index now. Called by a
+       * host after registration so the one-time index build (or a KV restore) is
+       * paid here rather than inside the first `search`. No-op if unsupported.
+       */
+      async warmIndex() {
+        await this.ready;
+        const provider = this.storageProvider;
+        if (typeof provider.warm === "function") {
+          await provider.warm();
+        }
+      }
       async search(query, options) {
         const baseResults = await this.storageProvider.search(query, options);
         if (this.dynamicContents.size === 0) return baseResults;
@@ -27320,6 +27645,7 @@ var init_agent_scope = __esm({
         };
         this.ready = this.initialize();
       }
+      metadata;
       id;
       entryPath;
       routeBase;
@@ -27489,6 +27815,7 @@ var init_agent_scope = __esm({
         this.fullPath = agentScope.fullPath;
         this.logger = agentScope.logger;
       }
+      agentScope;
       id;
       entryPath;
       routeBase;
@@ -28220,6 +28547,7 @@ var init_agent_instance = __esm({
         super(args);
         this.record = record;
       }
+      record;
       async execute(input) {
         return this.record.provide(input, this);
       }
@@ -31369,7 +31697,7 @@ var init_semver_utils = __esm({
 });
 
 // libs/sdk/src/esm-loader/esm-cache.ts
-import { sha256Hex as sha256Hex3, isValidMcpUri as isValidMcpUri6 } from "@frontmcp/utils";
+import { sha256Hex as sha256Hex4, isValidMcpUri as isValidMcpUri6 } from "@frontmcp/utils";
 function isBrowserEnv() {
   return typeof window !== "undefined" || typeof globalThis !== "undefined" && typeof globalThis.document !== "undefined";
 }
@@ -31406,8 +31734,8 @@ function getDefaultCacheDir() {
     const path3 = __require("node:path");
     try {
       const nodeModulesDir = path3.join(process.cwd(), "node_modules");
-      const fs2 = __require("node:fs");
-      if (fs2.existsSync(nodeModulesDir)) {
+      const fs = __require("node:fs");
+      if (fs.existsSync(nodeModulesDir)) {
         return path3.join(nodeModulesDir, ".cache", "frontmcp-esm");
       }
     } catch {
@@ -31422,19 +31750,30 @@ function getDefaultCacheDir() {
     return "";
   }
 }
-var DEFAULT_CACHE_DIR, DEFAULT_MAX_AGE_MS, EsmCacheManager;
+var DEFAULT_CACHE_DIR, DEFAULT_MAX_AGE_MS, DEFAULT_MAX_ENTRIES, EsmCacheManager;
 var init_esm_cache = __esm({
   "libs/sdk/src/esm-loader/esm-cache.ts"() {
     "use strict";
     DEFAULT_CACHE_DIR = getDefaultCacheDir();
     DEFAULT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+    DEFAULT_MAX_ENTRIES = 100;
     EsmCacheManager = class {
       cacheDir;
       maxAgeMs;
+      maxEntries;
       memoryStore = /* @__PURE__ */ new Map();
       constructor(options) {
         this.cacheDir = options?.cacheDir ?? DEFAULT_CACHE_DIR;
         this.maxAgeMs = options?.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
+        this.maxEntries = options?.maxEntries ?? DEFAULT_MAX_ENTRIES;
+      }
+      /** Evict oldest in-memory entries (FIFO via Map insertion order) past the cap. */
+      evictIfNeeded() {
+        while (this.memoryStore.size > this.maxEntries) {
+          const oldest = this.memoryStore.keys().next().value;
+          if (oldest === void 0) break;
+          this.memoryStore.delete(oldest);
+        }
       }
       /**
        * Get a cached ESM bundle entry if it exists and is not expired.
@@ -31468,6 +31807,7 @@ var init_esm_cache = __esm({
             return void 0;
           }
           this.memoryStore.set(memKey, meta);
+          this.evictIfNeeded();
           return meta;
         } catch {
           return void 0;
@@ -31514,6 +31854,7 @@ var init_esm_cache = __esm({
           bundleContent
         };
         this.memoryStore.set(memKey, entry);
+        this.evictIfNeeded();
         return entry;
       }
       /**
@@ -31607,7 +31948,7 @@ var init_esm_cache = __esm({
        */
       getEntryDir(packageName, version) {
         const path3 = __require("node:path");
-        const hash = sha256Hex3(`${packageName}@${version}`);
+        const hash = sha256Hex4(`${packageName}@${version}`);
         return path3.join(this.cacheDir, hash);
       }
     };
@@ -31959,6 +32300,13 @@ var init_version_resolver = __esm({
 });
 
 // libs/sdk/src/esm-loader/esm-module-loader.ts
+function importComputed(specifier) {
+  return import(
+    /* webpackIgnore: true */
+    /* @vite-ignore */
+    specifier
+  );
+}
 var EsmModuleLoader;
 var init_esm_module_loader = __esm({
   "libs/sdk/src/esm-loader/esm-module-loader.ts"() {
@@ -32090,9 +32438,7 @@ var init_esm_module_loader = __esm({
        */
       async importFromPath(filePath) {
         const { pathToFileURL } = await import("node:url");
-        const fileUrl = pathToFileURL(filePath).href;
-        const bustUrl = `${fileUrl}?t=${Date.now()}`;
-        return import(bustUrl);
+        return importComputed(pathToFileURL(filePath).href);
       }
       /**
        * Import a bundle from its source text.
@@ -32121,27 +32467,22 @@ var init_esm_module_loader = __esm({
           const blob = new Blob([bundleContent], { type: "text/javascript" });
           const url = URL.createObjectURL(blob);
           try {
-            return await import(
-              /* webpackIgnore: true */
-              url
-            );
+            return await importComputed(url);
           } finally {
             URL.revokeObjectURL(url);
           }
         }
-        const { mkdtemp, writeFile, rm } = await import("@frontmcp/utils");
+        const { ensureDir, fileExists: fileExists9, sha256Hex: sha256Hex9, writeFile } = await import("@frontmcp/utils");
         const nodePath = await import("node:path");
         const nodeOs = await import("node:os");
         const { pathToFileURL } = await import("node:url");
-        const tempDir = await mkdtemp(nodePath.join(nodeOs.tmpdir(), "frontmcp-esm-"));
-        const tempPath = nodePath.join(tempDir, "bundle.mjs");
-        try {
+        const dir = nodePath.join(nodeOs.tmpdir(), "frontmcp-esm-modules");
+        await ensureDir(dir);
+        const tempPath = nodePath.join(dir, `${sha256Hex9(bundleContent)}.mjs`);
+        if (!await fileExists9(tempPath)) {
           await writeFile(tempPath, bundleContent);
-          return await import(pathToFileURL(tempPath).href + `?t=${Date.now()}`);
-        } finally {
-          await rm(tempDir, { recursive: true, force: true }).catch(() => {
-          });
         }
+        return importComputed(pathToFileURL(tempPath).href);
       }
     };
   }
@@ -32920,7 +33261,7 @@ var init_auth_ui_contract = __esm({
 });
 
 // libs/sdk/src/auth/auth-ui/auth-ui.registry.ts
-import { isAbsolute as isAbsolute2, pathResolve as pathResolve5, randomBytes as randomBytes3, sha256Hex as sha256Hex4 } from "@frontmcp/utils";
+import { isAbsolute as isAbsolute2, pathResolve as pathResolve5, randomBytes as randomBytes3, sha256Hex as sha256Hex5 } from "@frontmcp/utils";
 function timingSafeEqualStr(a, b) {
   if (a.length !== b.length) return false;
   let diff = 0;
@@ -33049,7 +33390,7 @@ var init_auth_ui_registry = __esm({
       mintCsrf(pendingAuthId) {
         const existing = this.pending.get(pendingAuthId);
         if (existing) return existing.csrf;
-        const csrf = sha256Hex4(randomBytes3(32)).slice(0, 43);
+        const csrf = sha256Hex5(randomBytes3(32)).slice(0, 43);
         this.pending.set(pendingAuthId, { csrf, addedItems: {}, createdAt: Date.now() });
         this.pruneExpired();
         return csrf;
@@ -33102,7 +33443,7 @@ var init_auth_ui_registry = __esm({
       ensurePending(pendingAuthId) {
         let state = this.pending.get(pendingAuthId);
         if (!state) {
-          state = { csrf: sha256Hex4(randomBytes3(32)).slice(0, 43), addedItems: {}, createdAt: Date.now() };
+          state = { csrf: sha256Hex5(randomBytes3(32)).slice(0, 43), addedItems: {}, createdAt: Date.now() };
           this.pending.set(pendingAuthId, state);
           this.pruneExpired();
         }
@@ -33959,6 +34300,15 @@ var init_oauth_authorize_flow = __esm({
             return;
           }
         }
+        if (!isCimdClientId2) {
+          const registry = this.scope.auth.dcrClientRegistry;
+          const registered = registry?.get?.(client_id);
+          if (registered && !registered.redirect_uris.includes(redirect_uri)) {
+            this.logger.warn(`OAuth authorize: redirect_uri "${redirect_uri}" not registered for client "${client_id}"`);
+            this.respondWithError(["redirect_uri is not registered for this client"], void 0, rawState);
+            return;
+          }
+        }
       }
       async checkIfAuthorized() {
       }
@@ -34223,7 +34573,7 @@ var init_oauth_authorize_flow = __esm({
         }
         const state = buildState({
           pendingAuthId,
-          submitUrl: `${this.scope.fullPath}/oauth/callback`,
+          submitUrl: "/oauth/callback",
           extraUrl: authUiExtraPath(this.scope.fullPath),
           csrfToken,
           addedItems: authUi.getAddedItems(pendingAuthId)
@@ -34369,7 +34719,7 @@ var init_oauth_authorize_flow = __esm({
        */
       renderLoginPage(params) {
         const { pendingAuthId, clientId, clientName, scope, logoUri } = params;
-        const callbackPath = `${this.scope.fullPath}/oauth/callback`;
+        const callbackPath = "/oauth/callback";
         const auth = this.scope.metadata.auth;
         const login = auth && auth.mode === "local" ? auth.login : void 0;
         const ctx = {
@@ -34388,7 +34738,7 @@ var init_oauth_authorize_flow = __esm({
        */
       renderIncrementalAuthPage(params) {
         const { pendingAuthId, appId, appName, appDescription, toolId } = params;
-        const callbackPath = `${this.scope.fullPath}/oauth/callback`;
+        const callbackPath = "/oauth/callback";
         const app = {
           appId,
           appName,
@@ -34406,7 +34756,7 @@ var init_oauth_authorize_flow = __esm({
        */
       renderFederatedLoginPage(params) {
         const { pendingAuthId, detection, clientId } = params;
-        const callbackPath = `${this.scope.fullPath}/oauth/callback`;
+        const callbackPath = "/oauth/callback";
         const providers = [...detection.providers.values()].map((provider) => ({
           providerId: provider.id,
           providerName: provider.id,
@@ -34510,7 +34860,7 @@ import {
   startNextProvider as startNextProvider2
 } from "@frontmcp/auth";
 import { z as z65 } from "@frontmcp/lazy-zod";
-import { generateCodeVerifier as generateCodeVerifier2, randomUUID as randomUUID16, sha256Base64url as sha256Base64url2, sha256Hex as sha256Hex5 } from "@frontmcp/utils";
+import { generateCodeVerifier as generateCodeVerifier2, randomUUID as randomUUID16, sha256Base64url as sha256Base64url2, sha256Hex as sha256Hex6 } from "@frontmcp/utils";
 function timingSafeEqualStr3(a, b) {
   if (a.length !== b.length) return false;
   let diff = 0;
@@ -35236,7 +35586,7 @@ var init_oauth_callback_flow = __esm({
        * preserved on the form so the user does not have to re-enter everything.
        */
       renderLoginRetryPage(pendingAuth, login, fields, failure) {
-        const callbackPath = `${this.scope.fullPath}/oauth/callback`;
+        const callbackPath = "/oauth/callback";
         const ctx = {
           clientId: pendingAuth.clientId,
           clientName: pendingAuth.clientId,
@@ -35302,7 +35652,7 @@ var init_oauth_callback_flow = __esm({
         const state = buildConsentState(
           {
             pendingAuthId: pendingAuth.id,
-            submitUrl: `${this.scope.fullPath}/oauth/callback`,
+            submitUrl: "/oauth/callback",
             extraUrl: authUiExtraPath(this.scope.fullPath),
             csrfToken,
             addedItems: authUi.getAddedItems(pendingAuth.id)
@@ -35329,7 +35679,7 @@ var init_oauth_callback_flow = __esm({
        * (used for an empty `requireSelection` submit).
        */
       renderConsentScreen(pendingAuth, consentConfig, identity, error, preSelectedTools) {
-        const callbackPath = `${this.scope.fullPath}/oauth/callback`;
+        const callbackPath = "/oauth/callback";
         const { toolCards } = projectConsentTools(this.scope, consentConfig?.excludedTools);
         const hiddenFields = [];
         if (identity.email) hiddenFields.push({ name: "email", value: identity.email });
@@ -35368,7 +35718,7 @@ var init_oauth_callback_flow = __esm({
        * In production, this would be the user's ID from the database
        */
       generateUserSub(email) {
-        const hash = sha256Hex5(email.toLowerCase());
+        const hash = sha256Hex6(email.toLowerCase());
         return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-${hash.slice(12, 16)}-${hash.slice(16, 20)}-${hash.slice(20, 32)}`;
       }
       /**
@@ -36770,7 +37120,8 @@ var init_oauth_token_flow = __esm({
       async handleAuthorizationCodeGrant() {
         const { body, isDefaultAuthProvider } = this.state.required;
         if (body?.grant_type !== "authorization_code") return;
-        if (isDefaultAuthProvider && body.code === "anonymous") {
+        const authOptions = this.scope.auth?.options;
+        if (isDefaultAuthProvider && body.code === "anonymous" && !!authOptions && allowsPublicAccess(authOptions)) {
           const localAuth2 = this.scope.auth;
           const accessToken = await localAuth2.signAnonymousJwt();
           this.state.set("tokenResponse", {
@@ -36808,6 +37159,16 @@ var init_oauth_token_flow = __esm({
         const { body, isDefaultAuthProvider } = this.state.required;
         if (body?.grant_type !== "refresh_token") return;
         if (isDefaultAuthProvider) {
+          const authOptions = this.scope.auth?.options;
+          if (!authOptions || !allowsPublicAccess(authOptions)) {
+            this.respond(
+              httpRespond.json(
+                { error: "invalid_grant", error_description: "Refresh requires re-authentication on this server" },
+                { status: 400 }
+              )
+            );
+            return;
+          }
           const localAuth2 = this.scope.auth;
           const accessToken = await localAuth2.signAnonymousJwt();
           this.state.set("tokenResponse", {
@@ -36843,6 +37204,19 @@ var init_oauth_token_flow = __esm({
       }
       async handleAnonymousGrant() {
         const { body } = this.state.required;
+        const authOptions = this.scope.auth?.options;
+        if (!authOptions || !allowsPublicAccess(authOptions)) {
+          this.respond(
+            httpRespond.json(
+              {
+                error: "unsupported_grant_type",
+                error_description: "Anonymous access is not enabled on this server"
+              },
+              { status: 400 }
+            )
+          );
+          return;
+        }
         if (body?.grant_type === "anonymous" && body.resource) {
           const { request } = this.rawInput;
           const canonicalResource = computeResource(request, this.scope.entryPath, this.scope.routeBase);
@@ -37162,7 +37536,7 @@ var init_session_verify_flow = __esm({
         const token = extractBearerToken2(authorizationHeader);
         const userAgent = request.headers?.["user-agent"] ?? void 0;
         const prmMetadataPath = `/.well-known/oauth-protected-resource${entryPath}${routeBase}`;
-        const prmUrl = `${baseUrl}${prmMetadataPath}`;
+        const prmUrl = `${getRequestBaseUrl(request)}${prmMetadataPath}`;
         const prmMetadataHeader = buildUnauthorizedHeader(prmUrl);
         this.logger.verbose("parseInput", {
           hasAuthHeader: !!authorizationHeader,
@@ -37807,9 +38181,15 @@ import {
   MemoryStorageAdapter,
   randomBytes as randomBytes5,
   randomUUID as randomUUID21,
-  sha256Hex as sha256Hex6
+  sha256Hex as sha256Hex7
 } from "@frontmcp/utils";
-var DEFAULT_NO_AUTH_SECRET, RESERVED_JWT_CLAIMS, LocalPrimaryAuth;
+function getDefaultNoAuthSecret() {
+  if (!defaultNoAuthSecret) {
+    defaultNoAuthSecret = randomBytes5(32);
+  }
+  return defaultNoAuthSecret;
+}
+var defaultNoAuthSecret, RESERVED_JWT_CLAIMS, LocalPrimaryAuth;
 var init_instance_local_primary_auth = __esm({
   "libs/sdk/src/auth/instances/instance.local-primary-auth.ts"() {
     "use strict";
@@ -37833,7 +38213,6 @@ var init_instance_local_primary_auth = __esm({
     init_well_known_prm_flow();
     init_secure_store();
     init_secure_store_context_extension();
-    DEFAULT_NO_AUTH_SECRET = randomBytes5(32);
     RESERVED_JWT_CLAIMS = /* @__PURE__ */ new Set([
       "sub",
       "iss",
@@ -37865,7 +38244,7 @@ var init_instance_local_primary_auth = __esm({
           this.secret = new TextEncoder().encode(jwtSecret);
         } else {
           this.logger.warn("JWT_SECRET is not set, using default secret");
-          this.secret = DEFAULT_NO_AUTH_SECRET;
+          this.secret = getDefaultNoAuthSecret();
         }
         this.tokenStorage = this.readTokenStorage(options);
         this.authorizationStoreImpl = new InMemoryAuthorizationStore();
@@ -37882,6 +38261,8 @@ var init_instance_local_primary_auth = __esm({
         }
         this.ready = this.initialize();
       }
+      scope;
+      providers;
       host;
       port;
       issuer;
@@ -38325,7 +38706,7 @@ var init_instance_local_primary_auth = __esm({
             const pendingAuthId = `pending:${codeRecord.pendingAuthId}`;
             const parts = accessToken.split(".");
             const signature = parts[2] || accessToken;
-            const newAuthId = sha256Hex6(signature).substring(0, 16);
+            const newAuthId = sha256Hex7(signature).substring(0, 16);
             await this.orchestratedTokenStore.migrateTokens(pendingAuthId, newAuthId);
             this.logger.info(`Migrated tokens from ${pendingAuthId} to ${newAuthId}`);
           } catch (err) {
@@ -38775,6 +39156,8 @@ var init_instance_remote_primary_auth = __esm({
         this.providers = providers;
         this.ready = this.initialize();
       }
+      scope;
+      providers;
       ready;
       jwks = new JwksService4();
       fetch(input, init) {
@@ -39029,6 +39412,7 @@ var init_channel_notification_service = __esm({
         this.logger = logger.child("ChannelNotificationService");
         this.defaultMeta = defaultMeta ?? {};
       }
+      notificationService;
       logger;
       defaultMeta;
       /**
@@ -41921,6 +42305,8 @@ var init_heartbeat_service = __esm({
         this.intervalMs = config?.heartbeatIntervalMs ?? DEFAULT_HA_CONFIG.heartbeatIntervalMs;
         this.ttlMs = config?.heartbeatTtlMs ?? DEFAULT_HA_CONFIG.heartbeatTtlMs;
       }
+      redis;
+      nodeId;
       timer;
       startedAt;
       keyPrefix;
@@ -42000,6 +42386,9 @@ var init_notification_relay = __esm({
         this.keyPrefix = config?.redisKeyPrefix ?? DEFAULT_HA_CONFIG.redisKeyPrefix;
         this.channel = `${this.keyPrefix}notify:${nodeId}`;
       }
+      subscriber;
+      publisher;
+      nodeId;
       handler;
       channel;
       keyPrefix;
@@ -42109,6 +42498,8 @@ var init_ha_manager = __esm({
           this.relay = new NotificationRelay(options.pubsubSubscriber, options.pubsubPublisher, nodeId, this.config);
         }
       }
+      redis;
+      nodeId;
       heartbeat;
       relay;
       config;
@@ -43610,6 +44001,7 @@ var init_job_instance = __esm({
         super(args);
         this.record = record;
       }
+      record;
       execute(input) {
         return this.record.provide(input, this);
       }
@@ -44777,6 +45169,9 @@ var init_custom_routes_helper = __esm({
         this.reserved = reserved;
         this.name = "ReservedRouteCollisionError";
       }
+      method;
+      path;
+      reserved;
     };
   }
 });
@@ -46239,11 +46634,11 @@ var init_skill_http_auth = __esm({
        * This prevents timing attacks that could reveal information about valid API keys.
        */
       timingSafeIncludes(keys, candidate) {
-        const encoder = new TextEncoder();
-        const candidateBytes = encoder.encode(candidate);
+        const encoder2 = new TextEncoder();
+        const candidateBytes = encoder2.encode(candidate);
         let found = false;
         for (const key of keys) {
-          const keyBytes = encoder.encode(key);
+          const keyBytes = encoder2.encode(key);
           if (keyBytes.length === candidateBytes.length) {
             try {
               if (timingSafeEqual(keyBytes, candidateBytes)) {
@@ -48177,6 +48572,7 @@ var init_agent_execution_loop = __esm({
         this.maxIterations = maxIterations;
         this.name = "AgentMaxIterationsError";
       }
+      maxIterations;
     };
   }
 });
@@ -49168,7 +49564,23 @@ function normalizeScopeBase(scopeBase) {
   const t = trimSlashes(scopeBase ?? "");
   return t ? `/${t}` : "";
 }
+function readPublicUrlPin() {
+  try {
+    if (typeof process !== "undefined" && process.env) {
+      const v = process.env["FRONTMCP_PUBLIC_URL"];
+      if (typeof v === "string" && v.trim()) {
+        return v.trim().replace(/\/+$/, "");
+      }
+    }
+  } catch {
+  }
+  return void 0;
+}
 function getRequestBaseUrl(req, entryPath) {
+  const pin = readPublicUrlPin();
+  if (pin) {
+    return `${pin}${entryPath ?? ""}`;
+  }
   const proto = req.headers["x-forwarded-proto"] || req.protocol || "http";
   const host = req.headers["x-forwarded-host"] || req.headers["host"];
   return `${proto}://${host}${entryPath ?? ""}`;
@@ -50073,6 +50485,8 @@ return 0
         this.haKeyPrefix = options?.haKeyPrefix ?? "mcp:ha:";
         this.logger = options?.logger;
       }
+      redis;
+      machineId;
       keyPrefix;
       ttlSeconds;
       haKeyPrefix;
@@ -51829,6 +52243,8 @@ var init_base_sse_transport = __esm({
         this._sessionId = options?.sessionId ?? randomUUID25();
         this._options = options || { enableDnsRebindingProtection: false };
       }
+      _endpoint;
+      res;
       _sseResponse;
       _sessionId;
       _options;
@@ -52073,6 +52489,12 @@ function sanitizeDescription(raw) {
   if (!raw) return "";
   return raw.replace(/\r?\n/g, " ").replace(/\s+/g, " ").replace(/^\s*-{3,}\s*$/g, "").replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\*/g, "\\*").replace(/_/g, "\\_").replace(/\[/g, "\\[").trim();
 }
+function sanitizeName(raw) {
+  if (!raw) return "(unnamed)";
+  const s = raw.replace(/\s+/g, " ").trim();
+  if (!s) return "(unnamed)";
+  return s.length > MAX_SKILL_NAME_CHARS ? `${s.slice(0, MAX_SKILL_NAME_CHARS)}\u2026` : s;
+}
 function buildSkillsCatalogSummary(skillRegistry) {
   if (!skillRegistry) return "";
   const skills = skillRegistry.getSkills({ visibility: "mcp" });
@@ -52084,7 +52506,7 @@ function buildSkillsCatalogSummary(skillRegistry) {
   const effectiveCap = MAX_SKILL_CATALOG_CHARS - TRUNCATION_FOOTER_RESERVE;
   for (const skill of skills) {
     const meta = skill.metadata;
-    const name41 = meta.name;
+    const name41 = sanitizeName(meta.name);
     const description = sanitizeDescription(meta.description);
     const line = description ? `- **${name41}**: ${description}` : `- **${name41}**`;
     if (charCount + line.length + 1 > effectiveCap) {
@@ -52129,13 +52551,14 @@ function buildChannelInstructions(channels) {
 function joinSections(sections) {
   return sections.map((s) => (s ?? "").trim()).filter((s) => s.length > 0).join("\n\n---\n\n");
 }
-var DEFAULT_POLICY, MAX_SKILL_CATALOG_CHARS, TRUNCATION_FOOTER_RESERVE, CATALOG_HEADER;
+var DEFAULT_POLICY, MAX_SKILL_CATALOG_CHARS, TRUNCATION_FOOTER_RESERVE, MAX_SKILL_NAME_CHARS, CATALOG_HEADER;
 var init_skill_instructions_helper = __esm({
   "libs/sdk/src/skill/skill-instructions.helper.ts"() {
     "use strict";
     DEFAULT_POLICY = "append";
     MAX_SKILL_CATALOG_CHARS = 16e3;
     TRUNCATION_FOOTER_RESERVE = 160;
+    MAX_SKILL_NAME_CHARS = 80;
     CATALOG_HEADER = "Available skills (read the `skills://catalog` resource to browse, or `skills://{name}/SKILL.md` for full content):";
   }
 });
@@ -52188,6 +52611,9 @@ var init_transport_local_adapter = __esm({
         this.transport = this.createTransport(key.sessionId, res);
         this.ready = this.connectServer();
       }
+      scope;
+      key;
+      onDispose;
       logger;
       transport;
       /**
@@ -53108,6 +53534,7 @@ var init_transport_local = __esm({
             throw new UnsupportedTransportTypeError(this.type);
         }
       }
+      onDispose;
       type;
       tokenHash;
       sessionId;
@@ -53177,6 +53604,8 @@ var init_transport_remote = __esm({
         this.tokenHash = key.tokenHash;
         this.sessionId = key.sessionId;
       }
+      key;
+      bus;
       type;
       tokenHash;
       sessionId;
@@ -53206,7 +53635,7 @@ var init_transport_remote = __esm({
 });
 
 // libs/sdk/src/transport/transport.registry.ts
-import { getMachineId as getMachineId5, sha256Hex as sha256Hex7 } from "@frontmcp/utils";
+import { getMachineId as getMachineId5, sha256Hex as sha256Hex8 } from "@frontmcp/utils";
 var TransportService;
 var init_transport_registry = __esm({
   "libs/sdk/src/transport/transport.registry.ts"() {
@@ -53736,7 +54165,7 @@ var init_transport_registry = __esm({
       }
       /* --------------------------------- internals -------------------------------- */
       sha256(value) {
-        return sha256Hex7(value);
+        return sha256Hex8(value);
       }
       /**
        * Create a history key from components.
@@ -53842,6 +54271,74 @@ var init_transport_registry = __esm({
   }
 });
 
+// libs/sdk/src/transport/web-standard-mcp.ts
+var web_standard_mcp_exports = {};
+__export(web_standard_mcp_exports, {
+  buildPersistentWebStandardMcp: () => buildPersistentWebStandardMcp,
+  runWebStandardMcp: () => runWebStandardMcp
+});
+import { randomUUID as randomUUID26 } from "@frontmcp/utils";
+async function wireServer(scope, serverOptions, sessionId, sessionIdGenerator, enableJsonResponse) {
+  const { McpServer: McpServer2, WebStandardStreamableHTTPServerTransport: WebStandardStreamableHTTPServerTransport2 } = await import("@frontmcp/protocol");
+  const { createMcpHandlers: createMcpHandlers2 } = await Promise.resolve().then(() => (init_mcp_handlers(), mcp_handlers_exports));
+  const mcpServer = new McpServer2(scope.metadata.info, serverOptions);
+  for (const handler of createMcpHandlers2({ scope, serverOptions })) {
+    const originalHandler = handler.handler;
+    const wrappedHandler = async (req, ctx) => {
+      const existingAuthInfo = ctx?.["authInfo"] ?? {};
+      const enrichedCtx = { ...ctx, authInfo: { ...existingAuthInfo, sessionId } };
+      return originalHandler(req, enrichedCtx);
+    };
+    mcpServer.setRequestHandler(handler.requestSchema, wrappedHandler);
+  }
+  const transport = new WebStandardStreamableHTTPServerTransport2({ sessionIdGenerator, enableJsonResponse });
+  await mcpServer.connect(transport);
+  return { mcpServer, transport };
+}
+async function buildPersistentWebStandardMcp(scope, options) {
+  const serverOptions = buildScopedServerOptions(scope);
+  return wireServer(scope, serverOptions, options.sessionId, () => options.sessionId, false);
+}
+async function runWebStandardMcp(scope, request, options) {
+  if (options.persistent) {
+    return options.persistent.transport.handleRequest(request, { authInfo: options.authInfo });
+  }
+  const sessionId = `web:${randomUUID26()}`;
+  const accept = request.headers.get("accept") ?? "";
+  const wantsStream = request.method === "GET" || options.sse && accept.includes("text/event-stream");
+  const { mcpServer, transport } = await wireServer(
+    scope,
+    options.serverOptions,
+    sessionId,
+    void 0,
+    !wantsStream
+  );
+  const response = await transport.handleRequest(request, {
+    authInfo: options.authInfo
+  });
+  if (response.headers.get("content-type")?.includes("text/event-stream")) {
+    const closed = new Promise((resolve) => {
+      const prev = transport.onclose;
+      transport.onclose = () => {
+        prev?.();
+        resolve();
+      };
+    });
+    const teardown = closed.then(() => mcpServer.close().catch(() => void 0));
+    if (options.ctx?.waitUntil) options.ctx.waitUntil(teardown);
+    else void teardown;
+  } else {
+    void mcpServer.close().catch(() => void 0);
+  }
+  return response;
+}
+var init_web_standard_mcp = __esm({
+  "libs/sdk/src/transport/web-standard-mcp.ts"() {
+    "use strict";
+    init_build_scoped_server_options();
+  }
+});
+
 // libs/sdk/src/scope/flows/http.request.flow.ts
 import {
   deriveAuthorizationId,
@@ -53850,7 +54347,7 @@ import {
   OrchestratedAuthorization
 } from "@frontmcp/auth";
 import { z as z103 } from "@frontmcp/lazy-zod";
-import { randomUUID as randomUUID26 } from "@frontmcp/utils";
+import { randomUUID as randomUUID27 } from "@frontmcp/utils";
 var plan39, httpRequestStateSchema, name40, Stage40, HttpRequestFlow;
 var init_http_request_flow = __esm({
   "libs/sdk/src/scope/flows/http.request.flow.ts"() {
@@ -53870,6 +54367,11 @@ var init_http_request_flow = __esm({
         "router"
       ],
       execute: [
+        // Web-fetch (V8-isolate / Cloudflare Worker) MCP handling. Runs FIRST and,
+        // in web mode only, responds with a Web `Response` (short-circuiting the
+        // Node handle stages below). On the Node/Express path it's a no-op and falls
+        // through to the runtime-coupled stages.
+        "handleWebFetch",
         "handleLegacySse",
         "handleSse",
         "handleStreamableHttp",
@@ -53912,7 +54414,7 @@ var init_http_request_flow = __esm({
         const { request } = this.rawInput;
         this.requestStartTime = Date.now();
         const ctx = this.tryGetContext();
-        this.requestId = ctx?.requestId ?? `req-${randomUUID26()}`;
+        this.requestId = ctx?.requestId ?? `req-${randomUUID27()}`;
         const headers = request.headers ?? {};
         const body = request.body;
         const userAgent = headers["user-agent"];
@@ -54071,6 +54573,10 @@ var init_http_request_flow = __esm({
             accept: request.headers?.["accept"]
           });
           const decision = decideIntent(request, { ...legacyFlags, tolerateMissingAccept: true });
+          const isWebMode = !!request[ServerRequestTokens.webRequest];
+          if (isWebMode && decision.intent === "unknown") {
+            decision.intent = "stateless-http";
+          }
           this.logger.debug(`[${this.requestId}] decision result`, {
             intent: decision.intent,
             reasons: decision.reasons,
@@ -54197,6 +54703,47 @@ var init_http_request_flow = __esm({
           throw error;
         }
       }
+      async handleWebFetch() {
+        const { request } = this.rawInput;
+        const req = request;
+        const webRequest = req[ServerRequestTokens.webRequest];
+        if (!webRequest) return;
+        try {
+          const webCtx = req[ServerRequestTokens.webCtx];
+          const { runWebStandardMcp: runWebStandardMcp2 } = await Promise.resolve().then(() => (init_web_standard_mcp(), web_standard_mcp_exports));
+          const { buildScopedServerOptions: buildScopedServerOptions2 } = await Promise.resolve().then(() => (init_build_scoped_server_options(), build_scoped_server_options_exports));
+          const { expandProtocolConfig: expandProtocolConfig2 } = await Promise.resolve().then(() => (init_schema7(), schema_exports));
+          const scope = this.scope;
+          const proto = expandProtocolConfig2(scope.metadata.transport?.protocol);
+          const sse = proto.streamable && !proto.json;
+          const authorization = req[ServerRequestTokens.auth];
+          const authInfo = authorization ? {
+            token: authorization.token,
+            clientId: authorization.user?.sub,
+            scopes: [],
+            expiresAt: authorization.user?.exp ? authorization.user.exp * 1e3 : void 0,
+            extra: {
+              user: authorization.user,
+              sessionId: authorization.session?.id,
+              sessionPayload: authorization.session?.payload
+            }
+          } : void 0;
+          const persistent = req[ServerRequestTokens.webTransport];
+          const response = await runWebStandardMcp2(scope, webRequest, {
+            serverOptions: buildScopedServerOptions2(scope),
+            authInfo,
+            sse,
+            ctx: webCtx,
+            persistent
+          });
+          this.respond(httpRespond.webResponse(response));
+        } catch (error) {
+          if (!(error instanceof FlowControl)) {
+            this.logError(error, "handleWebFetch");
+          }
+          throw error;
+        }
+      }
       async handleLegacySse() {
         try {
           const response = await this.scope.runFlow("handle:legacy-sse", this.rawInput);
@@ -54366,6 +54913,9 @@ var init_http_request_flow = __esm({
     __decorateClass([
       Stage40("router")
     ], HttpRequestFlow.prototype, "router", 1);
+    __decorateClass([
+      Stage40("handleWebFetch")
+    ], HttpRequestFlow.prototype, "handleWebFetch", 1);
     __decorateClass([
       Stage40("handleLegacySse", {
         filter: ({
@@ -54438,28 +54988,11 @@ var init_http_request_flow = __esm({
   }
 });
 
-// libs/sdk/src/scope/optional-dependency.util.ts
-function probeOptionalDependency(moduleName, loadError, resolve) {
-  let resolvedPath;
-  try {
-    resolvedPath = resolve(moduleName);
-  } catch {
-    resolvedPath = void 0;
-  }
-  const error = loadError instanceof Error ? loadError.message : String(loadError);
-  return resolvedPath ? { status: "load-failed", resolvedPath, error } : { status: "not-installed", error };
-}
-var init_optional_dependency_util = __esm({
-  "libs/sdk/src/scope/optional-dependency.util.ts"() {
-    "use strict";
-  }
-});
-
 // libs/sdk/src/scope/scope.instance.ts
 import "reflect-metadata";
 import { createGuardManager } from "@frontmcp/guard";
 import { getEnvFlag, getMachineId as getMachineId6, getRuntimeContext as getRuntimeContext15, isEdgeRuntime } from "@frontmcp/utils";
-var Scope;
+var SCOPE_NON_DISPATCHABLE_FLOWS, Scope;
 var init_scope_instance = __esm({
   "libs/sdk/src/scope/scope.instance.ts"() {
     "use strict";
@@ -54505,6 +55038,7 @@ var init_scope_instance = __esm({
     init_transport_registry();
     init_http_request_flow();
     init_optional_dependency_util();
+    SCOPE_NON_DISPATCHABLE_FLOWS = /* @__PURE__ */ new Set(["http:request"]);
     Scope = class _Scope extends ScopeEntry {
       id;
       globalProviders;
@@ -54898,7 +55432,9 @@ var init_scope_instance = __esm({
         this.scopeResources = new ResourceRegistry(this.scopeProviders, [], scopeRef);
         this.scopePrompts = new PromptRegistry(this.scopeProviders, [], scopeRef);
         this.scopeAgents = new AgentRegistry(this.scopeProviders, [], scopeRef);
-        this.scopeSkills = new SkillRegistry(this.scopeProviders, this.metadata.skills ?? [], scopeRef);
+        this.scopeSkills = new SkillRegistry(this.scopeProviders, this.metadata.skills ?? [], scopeRef, {
+          ...this.metadata.skillsConfig?.scoring ? { scoring: this.metadata.skillsConfig.scoring } : {}
+        });
         await Promise.all([
           this.scopeTools.ready,
           this.scopeResources.ready,
@@ -55659,6 +56195,16 @@ var init_scope_instance = __esm({
       runFlow(name41, input, deps) {
         return this.scopeFlows.runFlow(name41, input, deps);
       }
+      /**
+       * Find the registered flow that handles this HTTP request (by method +
+       * `middleware.path` + `canActivate`), excluding `http:request` (which the
+       * web-fetch handler runs directly for the MCP entry path). Lets the
+       * Worker/web-fetch adapter dispatch auth/well-known/oauth flows the same way
+       * the Express host routes them — without a middleware server.
+       */
+      async findHttpFlowName(request) {
+        return this.scopeFlows.findHttpFlowName(request, SCOPE_NON_DISPATCHABLE_FLOWS);
+      }
       async runFlowForOutput(name41, input, deps) {
         const result = await this.scopeFlows.runFlow(name41, input, deps);
         if (result) {
@@ -55743,6 +56289,7 @@ var init_provider_registry = __esm({
         this.topoSort();
         this.ready = this.initialize();
       }
+      parentProviders;
       /** used to track which registry provided which token */
       providedBy;
       /** topo order (deps first) */
@@ -56695,6 +57242,292 @@ var init_scope_registry = __esm({
   }
 });
 
+// libs/sdk/src/transport/web-response.renderer.ts
+function toByteStream(streamLike) {
+  const iter = streamLike[Symbol.asyncIterator];
+  if (typeof iter !== "function") {
+    return new ReadableStream({ start: (c) => c.close() });
+  }
+  const it = iter.call(streamLike);
+  return new ReadableStream({
+    async pull(controller) {
+      const { value, done } = await it.next();
+      if (done) {
+        controller.close();
+        return;
+      }
+      controller.enqueue(typeof value === "string" ? encoder.encode(value) : value);
+    },
+    async cancel() {
+      await it.return?.(void 0);
+    }
+  });
+}
+function bytesFrom(body, encoding) {
+  if (typeof body !== "string") return body;
+  if (encoding === "base64") return Uint8Array.from(atob(body), (c) => c.charCodeAt(0));
+  if (encoding === "hex") {
+    if (body.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(body)) {
+      throw new TypeError("Invalid hex-encoded body");
+    }
+    const out = new Uint8Array(body.length / 2);
+    for (let i = 0; i < out.length; i++) out[i] = parseInt(body.slice(i * 2, i * 2 + 2), 16);
+    return out;
+  }
+  return encoder.encode(body);
+}
+function buildHeaders(out, contentType2) {
+  const headers = new Headers();
+  if (contentType2) headers.set("Content-Type", contentType2);
+  const extra = out["headers"];
+  if (extra) for (const [k, v] of Object.entries(extra)) headers.set(k, v);
+  const cookies = out["cookies"];
+  if (Array.isArray(cookies)) for (const c of cookies) headers.append("Set-Cookie", c);
+  return headers;
+}
+function renderHttpOutputToWebResponse(output) {
+  const out = output;
+  switch (out.kind) {
+    // Already a Web Response (the MCP execute stage on a worker) — return verbatim.
+    case "web-response":
+      return out.response;
+    // "no response" — let the adapter fall through (404 / next middleware).
+    case "next":
+    case "consumed":
+      return void 0;
+    case "redirect": {
+      const headers = buildHeaders(out);
+      headers.set("Location", out.location);
+      return new Response(null, { status: out.status, headers });
+    }
+    case "json":
+    case "jsonrpc":
+    case "problem":
+      return new Response(JSON.stringify(out.body), { status: out.status, headers: buildHeaders(out, out.contentType) });
+    case "text":
+    case "html":
+      return new Response(out.body, { status: out.status, headers: buildHeaders(out, out.contentType) });
+    case "binary":
+    case "image": {
+      const headers = buildHeaders(out, out.contentType);
+      headers.set(
+        "Content-Disposition",
+        out.filename ? `${out.disposition}; filename="${out.filename}"` : out.disposition
+      );
+      return new Response(bytesFrom(out.body, out.encoding), { status: out.status, headers });
+    }
+    case "stream":
+    case "sse": {
+      const headers = buildHeaders(out, out.contentType);
+      if (out.kind === "sse" && !headers.has("Cache-Control")) headers.set("Cache-Control", "no-cache");
+      return new Response(toByteStream(out.stream), { status: out.status, headers });
+    }
+    case "empty":
+      return new Response(null, { status: out.status, headers: buildHeaders(out) });
+    default:
+      return void 0;
+  }
+}
+var encoder;
+var init_web_response_renderer = __esm({
+  "libs/sdk/src/transport/web-response.renderer.ts"() {
+    "use strict";
+    encoder = new TextEncoder();
+  }
+});
+
+// libs/sdk/src/transport/web-fetch-handler.ts
+function mapHttpCors(httpCors, scope) {
+  if (!httpCors) return void 0;
+  const { origin, credentials, maxAge } = httpCors;
+  if (typeof origin === "function") {
+    scope.logger.warn(
+      "[web-fetch] http.cors.origin is a function, which the worker adapter cannot replay \u2014 CORS left disabled. Use a static origin (true / string / string[])."
+    );
+    return void 0;
+  }
+  return { origin, credentials, maxAge };
+}
+function createWebFetchHandler(scope, options = {}) {
+  const httpConfig = scope.metadata.http;
+  const healthPaths = new Set(options.healthPaths ?? ["/healthz", "/readyz"]);
+  const normalizePath = (p) => {
+    const withSlash = p.startsWith("/") ? p : `/${p}`;
+    let end = withSlash.length;
+    while (end > 1 && withSlash.charCodeAt(end - 1) === 47) end--;
+    return withSlash.slice(0, end);
+  };
+  const rawEntry = options.entryPath ?? (normalizeEntryPrefix(httpConfig?.entryPath) || "/");
+  const entryPaths = new Set((Array.isArray(rawEntry) ? rawEntry : [rawEntry]).map(normalizePath));
+  const cors2 = options.cors ?? mapHttpCors(httpConfig?.cors, scope);
+  const corsEnabled = cors2?.origin !== void 0 && cors2.origin !== false;
+  const corsHeadersFor = (request) => {
+    if (!corsEnabled) return {};
+    const reqOrigin = request.headers.get("origin") ?? "";
+    let allowOrigin;
+    if (cors2.origin === true) allowOrigin = reqOrigin || "*";
+    else if (cors2.origin === "*" || cors2.origin === reqOrigin) allowOrigin = cors2.origin;
+    else if (typeof cors2.origin === "string") allowOrigin = cors2.origin;
+    else if (Array.isArray(cors2.origin)) allowOrigin = cors2.origin.includes(reqOrigin) ? reqOrigin : void 0;
+    if (!allowOrigin) return {};
+    const h2 = {
+      "Access-Control-Allow-Origin": allowOrigin,
+      "Access-Control-Allow-Methods": (cors2.methods ?? ["GET", "POST", "OPTIONS", "DELETE"]).join(", "),
+      "Access-Control-Allow-Headers": (cors2.headers ?? [
+        request.headers.get("access-control-request-headers") || "content-type, authorization, mcp-session-id, mcp-protocol-version, last-event-id"
+      ]).join(", "),
+      "Access-Control-Expose-Headers": (cors2.exposeHeaders ?? ["Mcp-Session-Id", "WWW-Authenticate"]).join(", ")
+    };
+    if (cors2.credentials) h2["Access-Control-Allow-Credentials"] = "true";
+    if (cors2.maxAge !== void 0) h2["Access-Control-Max-Age"] = String(cors2.maxAge);
+    if (allowOrigin !== "*") h2["Vary"] = "Origin";
+    return h2;
+  };
+  const withCors = (response, request) => {
+    if (!corsEnabled) return response;
+    const headers = new Headers(response.headers);
+    for (const [k, v] of Object.entries(corsHeadersFor(request))) headers.set(k, v);
+    return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+  };
+  return async function handle(request, ctx, env) {
+    const url = new URL(request.url);
+    if (corsEnabled && request.method === "OPTIONS") {
+      return new Response(null, { status: 204, headers: corsHeadersFor(request) });
+    }
+    if (healthPaths.has(url.pathname)) {
+      return withCors(
+        Response.json(
+          { status: "ok", server: scope.metadata.info, transport: "web-fetch" },
+          { headers: { "Cache-Control": "no-store" } }
+        ),
+        request
+      );
+    }
+    if (!entryPaths.has(normalizePath(url.pathname))) {
+      const authResponse = await runMatchingHttpFlowWeb(scope, request);
+      if (authResponse) return withCors(authResponse, request);
+      return withCors(Response.json({ error: "Not Found", entryPaths: [...entryPaths] }, { status: 404 }), request);
+    }
+    if (options.sessionRouter) {
+      const routed = await options.sessionRouter(request, env, ctx);
+      if (routed) return withCors(routed, request);
+    }
+    const rendered = await runHttpRequestFlowWeb(scope, request, { ctx });
+    return withCors(rendered ?? Response.json({ error: "Not Found" }, { status: 404 }), request);
+  };
+}
+async function runHttpRequestFlowWeb(scope, request, opts = {}) {
+  const url = new URL(request.url);
+  const serverRequest = await toServerRequest(request, url, opts.ctx, opts.persistent);
+  let output;
+  try {
+    output = await scope.runFlow("http:request", {
+      request: serverRequest,
+      response: {}
+    });
+  } catch (error) {
+    output = flowErrorToHttpOutput(error);
+  }
+  return output ? renderHttpOutputToWebResponse(output) : void 0;
+}
+async function runMatchingHttpFlowWeb(scope, request) {
+  const url = new URL(request.url);
+  const serverRequest = await toServerRequest(request, url);
+  const flowName = await scope.findHttpFlowName(serverRequest);
+  if (!flowName) return void 0;
+  let output;
+  try {
+    output = await scope.runFlow(flowName, {
+      request: serverRequest,
+      response: {}
+    });
+  } catch (error) {
+    output = flowErrorToHttpOutput(error);
+  }
+  return output ? renderHttpOutputToWebResponse(output) : void 0;
+}
+async function toServerRequest(request, url, ctx, persistent) {
+  const headers = {};
+  request.headers.forEach((v, k) => {
+    headers[k] = v;
+  });
+  const query = {};
+  url.searchParams.forEach((v, k) => {
+    const existing = query[k];
+    if (existing === void 0) query[k] = v;
+    else if (Array.isArray(existing)) existing.push(v);
+    else query[k] = [existing, v];
+  });
+  const method = request.method.toUpperCase();
+  const hasBody = method !== "GET" && method !== "HEAD";
+  let rawBody = "";
+  if (hasBody) {
+    try {
+      rawBody = await request.text();
+    } catch {
+      rawBody = "";
+    }
+  }
+  let body;
+  if (rawBody) {
+    try {
+      body = JSON.parse(rawBody);
+    } catch {
+      body = rawBody;
+    }
+  }
+  const init = { method: request.method, headers: request.headers };
+  if (rawBody) init.body = rawBody;
+  const webRequest = new Request(url.toString(), init);
+  const serverRequest = {
+    method,
+    path: url.pathname,
+    url: url.pathname + url.search,
+    headers,
+    query,
+    body
+  };
+  const tokenized = serverRequest;
+  tokenized[ServerRequestTokens.webRequest] = webRequest;
+  tokenized[ServerRequestTokens.webCtx] = ctx;
+  if (persistent) tokenized[ServerRequestTokens.webTransport] = persistent;
+  return serverRequest;
+}
+function flowErrorToHttpOutput(error) {
+  if (error instanceof FlowControl) {
+    switch (error.type) {
+      case "respond":
+        return error.output;
+      case "next":
+      case "handled":
+        return void 0;
+      default:
+        return { kind: "text", status: 500, body: "Internal Server Error", contentType: "text/plain; charset=utf-8" };
+    }
+  }
+  if (error instanceof PublicMcpError) {
+    const challenge = error.wwwAuthenticate;
+    return {
+      kind: "json",
+      status: error.statusCode,
+      contentType: "application/json; charset=utf-8",
+      body: { error: error.getPublicMessage() },
+      ...typeof challenge === "string" && challenge.length > 0 ? { headers: { "WWW-Authenticate": challenge } } : {}
+    };
+  }
+  return { kind: "text", status: 500, body: "Internal Server Error", contentType: "text/plain; charset=utf-8" };
+}
+var init_web_fetch_handler = __esm({
+  "libs/sdk/src/transport/web-fetch-handler.ts"() {
+    "use strict";
+    init_common();
+    init_server_tokens();
+    init_path_utils();
+    init_errors();
+    init_web_response_renderer();
+  }
+});
+
 // libs/sdk/src/server/noop-server.ts
 var NoopFrontMcpServer;
 var init_noop_server = __esm({
@@ -56720,6 +57553,122 @@ var init_noop_server = __esm({
   }
 });
 
+// libs/sdk/src/server/security/security-audit.ts
+function auditSecurityDefaults(config, isProduction5) {
+  const findings = [];
+  if (!isProduction5 && config.deploymentMode !== "distributed") {
+    return findings;
+  }
+  const strict = config.security?.strict === true;
+  if (config.cors === void 0 && !strict) {
+    findings.push({
+      level: "warn",
+      code: "CORS_PERMISSIVE_DEFAULT",
+      message: "CORS is using the permissive default (origin: true), which allows all origins.",
+      recommendation: "Set explicit cors.origin to restrict allowed origins in production."
+    });
+  } else if (config.cors !== false && config.cors?.origin === true && !strict) {
+    findings.push({
+      level: "warn",
+      code: "CORS_ORIGIN_TRUE",
+      message: "CORS origin=true allows all origins to make cross-origin requests.",
+      recommendation: "Set cors.origin to specific allowed origins."
+    });
+  } else if (config.cors === false) {
+    findings.push({
+      level: "info",
+      code: "CORS_DISABLED",
+      message: "CORS is disabled. Cross-origin requests will be blocked by browsers."
+    });
+  } else {
+    findings.push({
+      level: "info",
+      code: "CORS_CONFIGURED",
+      message: "CORS is explicitly configured."
+    });
+  }
+  const bindAddress = config.resolvedBindAddress ?? "0.0.0.0";
+  if (bindAddress === "0.0.0.0" || bindAddress === "::") {
+    if (config.deploymentMode !== "distributed") {
+      findings.push({
+        level: "warn",
+        code: "BIND_ALL_INTERFACES",
+        message: `Server bound to ${bindAddress} \u2014 accessible from all network interfaces.`,
+        recommendation: "Set security.bindAddress to 'loopback' or '127.0.0.1' for local-only access, or configure a reverse proxy. Distributed deployments require 'all' (0.0.0.0)."
+      });
+    } else {
+      findings.push({
+        level: "info",
+        code: "BIND_ALL_INTERFACES_DISTRIBUTED",
+        message: `Server bound to ${bindAddress} (expected for distributed deployment).`
+      });
+    }
+  } else {
+    findings.push({
+      level: "info",
+      code: "BIND_RESTRICTED",
+      message: `Server bound to ${bindAddress}.`
+    });
+  }
+  const dnsProtectionEnabled = config.security?.dnsRebindingProtection?.enabled ?? strict;
+  if (!dnsProtectionEnabled) {
+    findings.push({
+      level: "warn",
+      code: "DNS_REBINDING_UNPROTECTED",
+      message: "DNS rebinding protection is disabled.",
+      recommendation: "Enable security.dnsRebindingProtection with allowedHosts to prevent DNS rebinding attacks."
+    });
+  } else {
+    findings.push({
+      level: "info",
+      code: "DNS_REBINDING_PROTECTED",
+      message: "DNS rebinding protection is enabled."
+    });
+  }
+  if (config.security?.strict) {
+    findings.push({
+      level: "info",
+      code: "STRICT_MODE_ENABLED",
+      message: "Strict security mode is enabled: loopback binding, restrictive CORS, DNS rebinding protection."
+    });
+  } else {
+    findings.push({
+      level: "info",
+      code: "STRICT_MODE_HINT",
+      message: "To enable strict security defaults, set security.strict = true in HttpOptions."
+    });
+  }
+  return findings;
+}
+function logSecurityFindings(findings, logger) {
+  if (findings.length === 0) return;
+  for (const finding of findings) {
+    const prefix = `[Security] ${finding.code}:`;
+    const message = finding.recommendation ? `${prefix} ${finding.message} ${finding.recommendation}` : `${prefix} ${finding.message}`;
+    if (finding.level === "warn") {
+      logger.warn(message);
+    } else {
+      logger.info(message);
+    }
+  }
+}
+function resolveBindAddress(security, deploymentMode) {
+  if (security?.bindAddress) {
+    if (security.bindAddress === "loopback") return "127.0.0.1";
+    if (security.bindAddress === "all") return "0.0.0.0";
+    return security.bindAddress;
+  }
+  if (security?.strict) {
+    return deploymentMode === "distributed" ? "0.0.0.0" : "127.0.0.1";
+  }
+  return "0.0.0.0";
+}
+var init_security_audit = __esm({
+  "libs/sdk/src/server/security/security-audit.ts"() {
+    "use strict";
+  }
+});
+
 // libs/sdk/src/server/middleware/host-validation.middleware.ts
 function createHostValidationMiddleware(options) {
   if (!options.enabled) {
@@ -56887,8 +57836,8 @@ var init_express_host_adapter = __esm({
             server.on("error", reject);
             server.listen(portOrSocketPath, () => {
               try {
-                const fs2 = __require("node:fs");
-                fs2.chmodSync(portOrSocketPath, 432);
+                const fs = __require("node:fs");
+                fs.chmodSync(portOrSocketPath, 432);
               } catch {
               }
               console.log(`MCP HTTP (Express) on unix://${portOrSocketPath}`);
@@ -56919,6 +57868,11 @@ var init_express_host_adapter = __esm({
 });
 
 // libs/sdk/src/server/adapters/polyfills/node-express-host.ts
+var node_express_host_exports = {};
+__export(node_express_host_exports, {
+  DEFAULT_EXPRESS_BODY_LIMIT: () => DEFAULT_EXPRESS_BODY_LIMIT,
+  ExpressHostAdapter: () => ExpressHostAdapter
+});
 var init_node_express_host = __esm({
   "libs/sdk/src/server/adapters/polyfills/node-express-host.ts"() {
     "use strict";
@@ -56926,129 +57880,12 @@ var init_node_express_host = __esm({
   }
 });
 
-// libs/sdk/src/server/security/security-audit.ts
-function auditSecurityDefaults(config, isProduction5) {
-  const findings = [];
-  if (!isProduction5 && config.deploymentMode !== "distributed") {
-    return findings;
-  }
-  const strict = config.security?.strict === true;
-  if (config.cors === void 0 && !strict) {
-    findings.push({
-      level: "warn",
-      code: "CORS_PERMISSIVE_DEFAULT",
-      message: "CORS is using the permissive default (origin: true), which allows all origins.",
-      recommendation: "Set explicit cors.origin to restrict allowed origins in production."
-    });
-  } else if (config.cors !== false && config.cors?.origin === true && !strict) {
-    findings.push({
-      level: "warn",
-      code: "CORS_ORIGIN_TRUE",
-      message: "CORS origin=true allows all origins to make cross-origin requests.",
-      recommendation: "Set cors.origin to specific allowed origins."
-    });
-  } else if (config.cors === false) {
-    findings.push({
-      level: "info",
-      code: "CORS_DISABLED",
-      message: "CORS is disabled. Cross-origin requests will be blocked by browsers."
-    });
-  } else {
-    findings.push({
-      level: "info",
-      code: "CORS_CONFIGURED",
-      message: "CORS is explicitly configured."
-    });
-  }
-  const bindAddress = config.resolvedBindAddress ?? "0.0.0.0";
-  if (bindAddress === "0.0.0.0" || bindAddress === "::") {
-    if (config.deploymentMode !== "distributed") {
-      findings.push({
-        level: "warn",
-        code: "BIND_ALL_INTERFACES",
-        message: `Server bound to ${bindAddress} \u2014 accessible from all network interfaces.`,
-        recommendation: "Set security.bindAddress to 'loopback' or '127.0.0.1' for local-only access, or configure a reverse proxy. Distributed deployments require 'all' (0.0.0.0)."
-      });
-    } else {
-      findings.push({
-        level: "info",
-        code: "BIND_ALL_INTERFACES_DISTRIBUTED",
-        message: `Server bound to ${bindAddress} (expected for distributed deployment).`
-      });
-    }
-  } else {
-    findings.push({
-      level: "info",
-      code: "BIND_RESTRICTED",
-      message: `Server bound to ${bindAddress}.`
-    });
-  }
-  const dnsProtectionEnabled = config.security?.dnsRebindingProtection?.enabled ?? strict;
-  if (!dnsProtectionEnabled) {
-    findings.push({
-      level: "warn",
-      code: "DNS_REBINDING_UNPROTECTED",
-      message: "DNS rebinding protection is disabled.",
-      recommendation: "Enable security.dnsRebindingProtection with allowedHosts to prevent DNS rebinding attacks."
-    });
-  } else {
-    findings.push({
-      level: "info",
-      code: "DNS_REBINDING_PROTECTED",
-      message: "DNS rebinding protection is enabled."
-    });
-  }
-  if (config.security?.strict) {
-    findings.push({
-      level: "info",
-      code: "STRICT_MODE_ENABLED",
-      message: "Strict security mode is enabled: loopback binding, restrictive CORS, DNS rebinding protection."
-    });
-  } else {
-    findings.push({
-      level: "info",
-      code: "STRICT_MODE_HINT",
-      message: "To enable strict security defaults, set security.strict = true in HttpOptions."
-    });
-  }
-  return findings;
-}
-function logSecurityFindings(findings, logger) {
-  if (findings.length === 0) return;
-  for (const finding of findings) {
-    const prefix = `[Security] ${finding.code}:`;
-    const message = finding.recommendation ? `${prefix} ${finding.message} ${finding.recommendation}` : `${prefix} ${finding.message}`;
-    if (finding.level === "warn") {
-      logger.warn(message);
-    } else {
-      logger.info(message);
-    }
-  }
-}
-function resolveBindAddress(security, deploymentMode) {
-  if (security?.bindAddress) {
-    if (security.bindAddress === "loopback") return "127.0.0.1";
-    if (security.bindAddress === "all") return "0.0.0.0";
-    return security.bindAddress;
-  }
-  if (security?.strict) {
-    return deploymentMode === "distributed" ? "0.0.0.0" : "127.0.0.1";
-  }
-  return "0.0.0.0";
-}
-var init_security_audit = __esm({
-  "libs/sdk/src/server/security/security-audit.ts"() {
-    "use strict";
-  }
-});
-
 // libs/sdk/src/server/server.instance.ts
 import { getRuntimeContext as getRuntimeContext16 } from "@frontmcp/utils";
 var DEFAULT_CORS, FrontMcpServerInstance;
 var init_server_instance = __esm({
   "libs/sdk/src/server/server.instance.ts"() {
     "use strict";
-    init_node_express_host();
     init_common();
     init_health2();
     init_metrics2();
@@ -57076,7 +57913,8 @@ var init_server_instance = __esm({
           this.host = this.config.hostFactory;
         } else {
           const corsConfig = this.config.cors === false ? void 0 : this.config.cors ?? DEFAULT_CORS;
-          this.host = new ExpressHostAdapter({
+          const { ExpressHostAdapter: ExpressHostAdapter2 } = (init_node_express_host(), __toCommonJS(node_express_host_exports));
+          this.host = new ExpressHostAdapter2({
             ...corsConfig ? { cors: corsConfig } : {},
             ...this.config.security ? { security: this.config.security } : {},
             ...this.config.bodyLimit !== void 0 ? { bodyLimit: this.config.bodyLimit } : {},
@@ -57217,7 +58055,7 @@ var front_mcp_exports = {};
 __export(front_mcp_exports, {
   FrontMcpInstance: () => FrontMcpInstance
 });
-import { fileExists as fileExists7, randomUUID as randomUUID27, unlink as unlink2 } from "@frontmcp/utils";
+import { fileExists as fileExists7, randomUUID as randomUUID28, unlink as unlink2 } from "@frontmcp/utils";
 function resolveConfigInput(optionsOrClass) {
   if (typeof optionsOrClass === "function") {
     const stored = getDecoratorConfig(optionsOrClass);
@@ -57243,6 +58081,7 @@ var init_front_mcp = __esm({
     init_scope_registry();
     init_skill_instructions_helper();
     init_task();
+    init_web_fetch_handler();
     init_front_mcp_providers();
     stdioServing = false;
     FrontMcpInstance = class _FrontMcpInstance2 {
@@ -57387,6 +58226,44 @@ var init_front_mcp = __esm({
         frontMcp.log?.info("FrontMCP handler created (serverless mode)");
         return server.getHandler();
       }
+      /**
+       * Creates and initializes a FrontMCP instance and returns a Web-standard
+       * `fetch` handler — `(request: Request) => Promise<Response>` — backed by the
+       * MCP WebStandard transport. Unlike {@link createHandler} this needs no
+       * Express / Node `req`/`res` and runs on V8-isolate targets (Cloudflare
+       * Workers, Deno Deploy, Bun).
+       *
+       * @example
+       * // worker entry
+       * const handler = await FrontMcpInstance.createFetchHandler(config);
+       * export default { fetch: (request) => handler(request) };
+       */
+      static async createFetchHandler(options) {
+        let inner;
+        let building;
+        const build = async () => {
+          const frontMcp = new _FrontMcpInstance2(options);
+          await frontMcp.ready;
+          const scope = frontMcp.getScopes()[0];
+          if (!scope) {
+            throw new ServerNotFoundError();
+          }
+          frontMcp.log?.info("FrontMCP fetch handler created (web-standard transport)");
+          return createWebFetchHandler(scope);
+        };
+        return async (request) => {
+          if (!inner) {
+            if (!building) {
+              building = build().catch((err) => {
+                building = void 0;
+                throw err;
+              });
+            }
+            inner = await building;
+          }
+          return inner(request);
+        };
+      }
       /**
        * Creates and initializes a FrontMCP instance without starting any server.
        * Returns the instance for graph extraction and introspection purposes.
@@ -57669,7 +58546,7 @@ var init_front_mcp = __esm({
           };
           const mcpServer = new McpServer2(scope.metadata.info, serverOptions);
           startupCleanups.push(() => mcpServer.close());
-          const sessionId = `stdio:${randomUUID27()}`;
+          const sessionId = `stdio:${randomUUID28()}`;
           const handlers = createMcpHandlers2({ scope, serverOptions, composeInstructions });
           for (const handler of handlers) {
             const originalHandler = handler.handler;
@@ -57997,7 +58874,8 @@ function FrontMcp(providedMetadata) {
     } else if (isServerless2) {
       const ServerlessInstance = getFrontMcpInstance();
       const { setServerlessHandler: setServerlessHandler2, setServerlessHandlerPromise: setServerlessHandlerPromise2, setServerlessHandlerError: setServerlessHandlerError2 } = getServerlessHandlerFns();
-      const handlerPromise = ServerlessInstance.createHandler(metadata);
+      const isWorker = getEnvFlag2("FRONTMCP_WORKER");
+      const handlerPromise = isWorker ? ServerlessInstance.createFetchHandler(metadata) : ServerlessInstance.createHandler(metadata);
       setServerlessHandlerPromise2(handlerPromise);
       handlerPromise.then(setServerlessHandler2).catch((err) => {
         const e = err instanceof Error ? err : new InternalMcpError(String(err), "SERVERLESS_INIT_FAILED");
@@ -58139,6 +59017,12 @@ function remoteApp(url, options) {
     filter: options?.filter
   };
 }
+function frontMcpApp(metadata) {
+  const FunctionalApp = class {
+  };
+  FrontMcpApp(metadata)(FunctionalApp);
+  return FunctionalApp;
+}
 var APP_DECORATOR_BASENAMES, App;
 var init_app_decorator = __esm({
   "libs/sdk/src/common/decorators/app.decorator.ts"() {
@@ -60127,6 +61011,8 @@ init_direct();
 
 // libs/sdk/src/transport/index.ts
 init_in_memory_server();
+init_web_fetch_handler();
+init_web_standard_mcp();
 
 // libs/sdk/src/index.ts
 init_ext_apps2();
@@ -60356,6 +61242,7 @@ export {
   HttpStatus,
   HttpStreamSchema,
   HttpTextSchema,
+  HttpWebResponseSchema,
   ImageOutputSchema,
   InMemoryOrchestratedTokenStore2 as InMemoryOrchestratedTokenStore,
   InMemoryStoreRequiredError,
@@ -60625,6 +61512,7 @@ export {
   annotatedFrontMcpSkillsSchema,
   annotatedFrontMcpToolsSchema,
   annotatedFrontMcpWorkflowsSchema,
+  frontMcpApp as app,
   appAuthOptionsSchema,
   appFilterConfigSchema,
   applyPrimitiveFilter,
@@ -60639,6 +61527,7 @@ export {
   buildEsmResourceRecord,
   buildEsmShUrl,
   buildEsmToolRecord,
+  buildPersistentWebStandardMcp,
   buildRemotePromptRecord,
   buildRemoteResourceRecord,
   buildRemoteResourceTemplateRecord,
@@ -60691,6 +61580,7 @@ export {
   createSkillInstance,
   createSkillStorageProvider,
   createTaskStore,
+  createWebFetchHandler,
   decideIntent,
   decisionSchema,
   decryptElicitationData,
@@ -60734,6 +61624,7 @@ export {
   frontMcpAdapterMetadataSchema,
   frontMcpAgent,
   frontMcpAgentMetadataSchema,
+  frontMcpApp,
   frontMcpAuthProviderMetadataSchema,
   frontMcpBaseSchema,
   frontMcpChannelMetadataSchema,
@@ -60893,7 +61784,9 @@ export {
   frontMcpResource as resource,
   frontMcpResourceTemplate as resourceTemplate,
   resourceUriMatches,
+  runHttpRequestFlowWeb,
   runTaskInBackground,
+  runWebStandardMcp,
   satisfiesRange,
   scanSkillResources,
   secureStoreConfigSchema,