@frontmcp/sdk 1.4.1 → 1.5.0-rc.1

package/index.js

@@ -6,11 +6,20 @@ var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name41 in all)
@@ -671,7 +680,10 @@ var init_server_tokens = __esm({
       intent: tokenFactory.meta("intent"),
       auth: tokenFactory.meta("auth"),
       sessionId: tokenFactory.meta("sessionId"),
-      reinitialize: tokenFactory.meta("reinitialize")
+      reinitialize: tokenFactory.meta("reinitialize"),
+      webRequest: tokenFactory.meta("webRequest"),
+      webCtx: tokenFactory.meta("webCtx"),
+      webTransport: tokenFactory.meta("webTransport")
     };
   }
 });
@@ -1372,7 +1384,7 @@ var init_annotated_class_schema = __esm({
 });
 
 // libs/sdk/src/common/schemas/http-output.schema.ts
-var import_lazy_zod2, import_protocol, import_utils2, JSON_RPC, REDIRECTS, NO_BODY_STATUSES, zNumUnion, HttpStatus, HttpRedirectStatus, HttpEmptyStatus, HttpHeaders, HttpCookieSchema, HttpCookies, HttpMeta, statusAllowsBody, HttpRedirectSchema, HttpJsonSchema, HttpNextSchema, HttpConsumedSchema, HttpTextSchema, HttpHtmlSchema, HttpBinarySchema, HttpImageSchema, isHttpReadableLike, HttpStreamSchema, HttpSseSchema, HttpJsonRpcSchema, HttpProblemSchema, HttpEmptySchema, httpOutputSchema, httpRespond;
+var import_lazy_zod2, import_protocol, import_utils2, JSON_RPC, REDIRECTS, NO_BODY_STATUSES, zNumUnion, HttpStatus, HttpRedirectStatus, HttpEmptyStatus, HttpHeaders, HttpCookieSchema, HttpCookies, HttpMeta, statusAllowsBody, HttpRedirectSchema, HttpJsonSchema, HttpNextSchema, HttpConsumedSchema, HttpWebResponseSchema, HttpTextSchema, HttpHtmlSchema, HttpBinarySchema, HttpImageSchema, isHttpReadableLike, HttpStreamSchema, HttpSseSchema, HttpJsonRpcSchema, HttpProblemSchema, HttpEmptySchema, httpOutputSchema, httpRespond;
 var init_http_output_schema = __esm({
   "libs/sdk/src/common/schemas/http-output.schema.ts"() {
     "use strict";
@@ -1427,6 +1439,13 @@ var init_http_output_schema = __esm({
       kind: import_lazy_zod2.z.literal("next")
     }).passthrough();
     HttpConsumedSchema = import_lazy_zod2.z.object({ kind: import_lazy_zod2.z.literal("consumed") });
+    HttpWebResponseSchema = import_lazy_zod2.z.object({
+      kind: import_lazy_zod2.z.literal("web-response"),
+      response: import_lazy_zod2.z.custom(
+        (v) => typeof Response !== "undefined" && v instanceof Response,
+        "must be a Web Response"
+      )
+    });
     HttpTextSchema = import_lazy_zod2.z.object({
       kind: import_lazy_zod2.z.literal("text"),
       status: HttpStatus.refine((s) => statusAllowsBody(s) && !REDIRECTS.includes(s), {
@@ -1519,7 +1538,8 @@ var init_http_output_schema = __esm({
       HttpProblemSchema,
       HttpEmptySchema,
       HttpNextSchema,
-      HttpConsumedSchema
+      HttpConsumedSchema,
+      HttpWebResponseSchema
     ]);
     httpRespond = {
       json: (body, extra = {}) => {
@@ -1619,6 +1639,9 @@ var init_http_output_schema = __esm({
       consumed() {
         return { kind: "consumed" };
       },
+      webResponse(response) {
+        return { kind: "web-response", response };
+      },
       empty(status = 204, headers) {
         return { kind: "empty", status, headers };
       },
@@ -2138,6 +2161,18 @@ var init_sqlite = __esm({
 });
 
 // libs/sdk/src/common/types/options/transport/schema.ts
+var schema_exports = {};
+__export(schema_exports, {
+  PROTOCOL_PRESETS: () => PROTOCOL_PRESETS,
+  eventStoreConfigSchema: () => eventStoreConfigSchema,
+  expandProtocolConfig: () => expandProtocolConfig,
+  expandTransportConfig: () => expandTransportConfig,
+  isDistributedMode: () => isDistributedMode,
+  persistenceConfigSchema: () => persistenceConfigSchema,
+  shouldCacheProviders: () => shouldCacheProviders,
+  toLegacyProtocolFlags: () => toLegacyProtocolFlags,
+  transportOptionsSchema: () => transportOptionsSchema
+});
 function expandProtocolConfig(protocol) {
   if (!protocol) {
     return { ...PROTOCOL_PRESETS.legacy };
@@ -2457,7 +2492,8 @@ var init_schema10 = __esm({
       sep2640InInstructions: import_lazy_zod15.z.boolean().optional().default(false),
       cache: skillsConfigCacheOptionsSchema.optional(),
       audit: skillsConfigAuditOptionsSchema.optional(),
-      injectInstructions: import_lazy_zod15.z.enum(["off", "append", "prepend", "replace"]).optional().default("append")
+      injectInstructions: import_lazy_zod15.z.enum(["off", "append", "prepend", "replace"]).optional().default("append"),
+      scoring: import_lazy_zod15.z.enum(["cosine", "bm25"]).optional()
     });
   }
 });
@@ -4671,6 +4707,12 @@ var init_elicitation_error = __esm({
         this.toolInput = toolInput;
         this.ttl = ttl;
       }
+      elicitId;
+      elicitMessage;
+      schema;
+      toolName;
+      toolInput;
+      ttl;
       getPublicMessage() {
         return this.elicitMessage;
       }
@@ -6129,30 +6171,30 @@ var require_dist = __commonJS({
       sqliteStorageOptionsSchema: () => sqliteStorageOptionsSchema
     });
     module2.exports = __toCommonJS2(index_exports2);
-    var import_utils101 = require("@frontmcp/utils");
+    var import_utils103 = require("@frontmcp/utils");
     var HKDF_SALT = new TextEncoder().encode("frontmcp-sqlite-storage-v1");
     var HKDF_INFO = new TextEncoder().encode("aes-256-gcm-value-encryption");
     var KEY_LENGTH = 32;
     function deriveEncryptionKey(secret) {
       const ikm = new TextEncoder().encode(secret);
-      return (0, import_utils101.hkdfSha256)(ikm, HKDF_SALT, HKDF_INFO, KEY_LENGTH);
+      return (0, import_utils103.hkdfSha256)(ikm, HKDF_SALT, HKDF_INFO, KEY_LENGTH);
     }
     var SEPARATOR = ":";
     function encryptValue(key, plaintext) {
-      const iv = (0, import_utils101.randomBytes)(12);
+      const iv = (0, import_utils103.randomBytes)(12);
       const plaintextBytes = new TextEncoder().encode(plaintext);
-      const { ciphertext, tag } = (0, import_utils101.encryptAesGcm)(key, plaintextBytes, iv);
-      return [(0, import_utils101.base64urlEncode)(iv), (0, import_utils101.base64urlEncode)(tag), (0, import_utils101.base64urlEncode)(ciphertext)].join(SEPARATOR);
+      const { ciphertext, tag } = (0, import_utils103.encryptAesGcm)(key, plaintextBytes, iv);
+      return [(0, import_utils103.base64urlEncode)(iv), (0, import_utils103.base64urlEncode)(tag), (0, import_utils103.base64urlEncode)(ciphertext)].join(SEPARATOR);
     }
     function decryptValue(key, encrypted) {
       const parts = encrypted.split(SEPARATOR);
       if (parts.length !== 3) {
         throw new Error("Invalid encrypted value format");
       }
-      const iv = (0, import_utils101.base64urlDecode)(parts[0]);
-      const tag = (0, import_utils101.base64urlDecode)(parts[1]);
-      const ciphertext = (0, import_utils101.base64urlDecode)(parts[2]);
-      const plaintext = (0, import_utils101.decryptAesGcm)(key, ciphertext, iv, tag);
+      const iv = (0, import_utils103.base64urlDecode)(parts[0]);
+      const tag = (0, import_utils103.base64urlDecode)(parts[1]);
+      const ciphertext = (0, import_utils103.base64urlDecode)(parts[2]);
+      const plaintext = (0, import_utils103.decryptAesGcm)(key, ciphertext, iv, tag);
       return new TextDecoder().decode(plaintext);
     }
     var import_utils210 = require("@frontmcp/utils");
@@ -7273,6 +7315,8 @@ var init_task_notifier = __esm({
         this.notifications = notifications;
         this.logger = logger;
       }
+      notifications;
+      logger;
       sendStatus(record) {
         const params = {
           ...toWireShape(record)
@@ -7429,6 +7473,7 @@ var init_in_process_task_runner = __esm({
       constructor(deps) {
         this.deps = deps;
       }
+      deps;
       kind = "in-process";
       async run(record, context) {
         await this.deps.store.update(record.taskId, record.sessionId, {
@@ -7483,6 +7528,7 @@ var init_cli_task_runner = __esm({
       constructor(deps) {
         this.deps = deps;
       }
+      deps;
       kind = "cli";
       async run(record, _context) {
         const { exe, args } = this.resolveCommand();
@@ -7837,6 +7883,9 @@ var init_tasks_result_flow = __esm({
         this.taskId = taskId;
         this.name = "JsonRpcReplayError";
       }
+      code;
+      data;
+      taskId;
       toJsonRpcError() {
         const out = {
           code: this.code,
@@ -8060,6 +8109,72 @@ var init_task = __esm({
   }
 });
 
+// libs/sdk/src/transport/build-scoped-server-options.ts
+var build_scoped_server_options_exports = {};
+__export(build_scoped_server_options_exports, {
+  buildScopedServerOptions: () => buildScopedServerOptions
+});
+function buildScopedServerOptions(scope, instructions = "") {
+  const hasRemoteApps = scope.apps?.getApps().some((app) => app.isRemote) ?? false;
+  const hasPrompts = scope.prompts.hasAny() || hasRemoteApps;
+  const hasResources = scope.resources.hasAny() || hasRemoteApps;
+  const completionsCapability = hasPrompts || hasResources ? { completions: {} } : {};
+  const remoteCapabilities = hasRemoteApps ? {
+    tools: { listChanged: true },
+    resources: { subscribe: true, listChanged: true },
+    prompts: { listChanged: true }
+  } : {};
+  const skillsCapabilities = scope.skills?.getCapabilities() ?? {};
+  const toolsCapabilities = scope.tools.getCapabilities();
+  const resourcesCapabilities = scope.resources.getCapabilities();
+  const promptsCapabilities = scope.prompts.getCapabilities();
+  const agentsCapabilities = scope.agents.getCapabilities();
+  const taskCapabilities = computeTaskCapabilities(scope);
+  const fragments = [
+    remoteCapabilities,
+    toolsCapabilities,
+    resourcesCapabilities,
+    promptsCapabilities,
+    agentsCapabilities,
+    skillsCapabilities,
+    completionsCapability,
+    taskCapabilities
+  ];
+  const experimental = {};
+  const extensions = {};
+  for (const cap2 of fragments) {
+    if (cap2["experimental"] && typeof cap2["experimental"] === "object") {
+      Object.assign(experimental, cap2["experimental"]);
+    }
+    if (cap2["extensions"] && typeof cap2["extensions"] === "object") {
+      Object.assign(extensions, cap2["extensions"]);
+    }
+  }
+  const baseCapabilities = {
+    ...remoteCapabilities,
+    ...toolsCapabilities,
+    ...resourcesCapabilities,
+    ...promptsCapabilities,
+    ...agentsCapabilities,
+    ...completionsCapability,
+    ...taskCapabilities,
+    logging: {}
+  };
+  if (Object.keys(experimental).length > 0) baseCapabilities["experimental"] = experimental;
+  if (Object.keys(extensions).length > 0) baseCapabilities["extensions"] = extensions;
+  return {
+    instructions,
+    capabilities: baseCapabilities,
+    serverInfo: scope.metadata.info
+  };
+}
+var init_build_scoped_server_options = __esm({
+  "libs/sdk/src/transport/build-scoped-server-options.ts"() {
+    "use strict";
+    init_task();
+  }
+});
+
 // libs/sdk/src/transport/mcp-handlers/mcp-error.utils.ts
 function toSdkMcpError(err) {
   if (err && typeof err === "object") {
@@ -8328,6 +8443,8 @@ var init_notification_service = __esm({
         this.options = options;
         this.logger = scope.logger.child("NotificationService");
       }
+      scope;
+      options;
       logger;
       servers = /* @__PURE__ */ new Map();
       unsubscribers = [];
@@ -10748,58 +10865,7 @@ async function createInMemoryServer(scope, options) {
   const sessionId = options?.sessionId ?? `in-memory:${(0, import_utils21.randomUUID)()}`;
   const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
   let currentAuthInfo = options?.authInfo ?? {};
-  const hasRemoteApps = scope.apps?.getApps().some((app) => app.isRemote) ?? false;
-  const hasPrompts = scope.prompts.hasAny() || hasRemoteApps;
-  const hasResources = scope.resources.hasAny() || hasRemoteApps;
-  const completionsCapability = hasPrompts || hasResources ? { completions: {} } : {};
-  const remoteCapabilities = hasRemoteApps ? {
-    tools: { listChanged: true },
-    resources: { subscribe: true, listChanged: true },
-    prompts: { listChanged: true }
-  } : {};
-  const skillsCapabilities = scope.skills?.getCapabilities() ?? {};
-  const toolsCapabilities = scope.tools.getCapabilities();
-  const resourcesCapabilities = scope.resources.getCapabilities();
-  const promptsCapabilities = scope.prompts.getCapabilities();
-  const agentsCapabilities = scope.agents.getCapabilities();
-  const taskCapabilities = computeTaskCapabilities(scope);
-  const fragments = [
-    remoteCapabilities,
-    toolsCapabilities,
-    resourcesCapabilities,
-    promptsCapabilities,
-    agentsCapabilities,
-    skillsCapabilities,
-    completionsCapability,
-    taskCapabilities
-  ];
-  const experimental = {};
-  const extensions = {};
-  for (const cap2 of fragments) {
-    if (cap2["experimental"] && typeof cap2["experimental"] === "object") {
-      Object.assign(experimental, cap2["experimental"]);
-    }
-    if (cap2["extensions"] && typeof cap2["extensions"] === "object") {
-      Object.assign(extensions, cap2["extensions"]);
-    }
-  }
-  const baseCapabilities = {
-    ...remoteCapabilities,
-    ...toolsCapabilities,
-    ...resourcesCapabilities,
-    ...promptsCapabilities,
-    ...agentsCapabilities,
-    ...completionsCapability,
-    ...taskCapabilities,
-    logging: {}
-  };
-  if (Object.keys(experimental).length > 0) baseCapabilities["experimental"] = experimental;
-  if (Object.keys(extensions).length > 0) baseCapabilities["extensions"] = extensions;
-  const serverOptions = {
-    instructions: "",
-    capabilities: baseCapabilities,
-    serverInfo: scope.metadata.info
-  };
+  const serverOptions = buildScopedServerOptions(scope);
   const mcpServer = new McpServer2(scope.metadata.info, serverOptions);
   const handlers = createMcpHandlers2({ scope, serverOptions });
   for (const handler of handlers) {
@@ -10834,7 +10900,7 @@ var init_in_memory_server = __esm({
   "libs/sdk/src/transport/in-memory-server.ts"() {
     "use strict";
     import_utils21 = require("@frontmcp/utils");
-    init_task();
+    init_build_scoped_server_options();
   }
 });
 
@@ -10844,29 +10910,29 @@ __export(direct_client_exports, {
   DirectClientImpl: () => DirectClientImpl
 });
 function findFileFromRoot(root, relativePath) {
-  const fs2 = require("fs");
+  const fs = require("fs");
   const path3 = require("path");
   const cleanRelative = relativePath.replace(/^\.\//, "");
   const searchDirs = ["src", "."];
   for (const srcDir of searchDirs) {
     const srcRoot = path3.join(root, srcDir);
-    if (!fs2.existsSync(srcRoot)) continue;
-    const found = walkForFile(srcRoot, cleanRelative, fs2, path3);
+    if (!fs.existsSync(srcRoot)) continue;
+    const found = walkForFile(srcRoot, cleanRelative, fs, path3);
     if (found) return found;
   }
   return void 0;
 }
-function walkForFile(dir, targetRelative, fs2, path3, maxDepth = 10) {
+function walkForFile(dir, targetRelative, fs, path3, maxDepth = 10) {
   const candidate = path3.join(dir, targetRelative);
-  if (fs2.existsSync(candidate)) {
+  if (fs.existsSync(candidate)) {
     return { absolute: candidate, baseDir: dir };
   }
   if (maxDepth <= 0) return void 0;
   try {
-    const entries = fs2.readdirSync(dir, { withFileTypes: true });
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory() && !entry.name.startsWith(".") && entry.name !== "node_modules" && entry.name !== "dist") {
-        const result = walkForFile(path3.join(dir, entry.name), targetRelative, fs2, path3, maxDepth - 1);
+        const result = walkForFile(path3.join(dir, entry.name), targetRelative, fs, path3, maxDepth - 1);
         if (result) return result;
       }
     }
@@ -12049,14 +12115,16 @@ var init_health2 = __esm({
 });
 
 // libs/sdk/src/logger/instances/instance.file-logger.ts
+function getFs() {
+  return _fs ??= require("fs");
+}
 function stripAnsi(str) {
   return str.split(ESC).map((s) => s.replace(/\[[0-9;]*m/, "")).join("");
 }
-var fs, os, path2, LOG_LEVEL_LABELS, ESC, DEFAULT_LOGS_MAX, FileLogTransportInstance;
+var os, path2, _fs, LOG_LEVEL_LABELS, ESC, DEFAULT_LOGS_MAX, FileLogTransportInstance;
 var init_instance_file_logger = __esm({
   "libs/sdk/src/logger/instances/instance.file-logger.ts"() {
     "use strict";
-    fs = __toESM(require("fs"));
     os = __toESM(require("os"));
     path2 = __toESM(require("path"));
     init_common();
@@ -12086,10 +12154,10 @@ var init_instance_file_logger = __esm({
           return;
         }
         try {
-          fs.mkdirSync(this.logDir, { recursive: true });
+          getFs().mkdirSync(this.logDir, { recursive: true });
           const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/:/g, "_");
           const filePath = path2.join(this.logDir, `${this.appName}-${ts}.log`);
-          this.fd = fs.openSync(filePath, "a");
+          this.fd = getFs().openSync(filePath, "a");
           this.rotate(isNaN(logsMax) ? DEFAULT_LOGS_MAX : logsMax);
         } catch {
           this.fd = void 0;
@@ -12099,7 +12167,7 @@ var init_instance_file_logger = __esm({
       close() {
         if (this.fd !== void 0) {
           try {
-            fs.closeSync(this.fd);
+            getFs().closeSync(this.fd);
           } catch {
           }
           this.fd = void 0;
@@ -12114,7 +12182,7 @@ var init_instance_file_logger = __esm({
         const line = `[${ts}] ${level}${prefix} ${message}
 `;
         try {
-          fs.writeSync(this.fd, line);
+          getFs().writeSync(this.fd, line);
         } catch {
         }
       }
@@ -12122,12 +12190,12 @@ var init_instance_file_logger = __esm({
       rotate(maxFiles) {
         try {
           const prefix = `${this.appName}-`;
-          const files = fs.readdirSync(this.logDir).filter((f) => f.startsWith(prefix) && f.endsWith(".log")).sort();
+          const files = getFs().readdirSync(this.logDir).filter((f) => f.startsWith(prefix) && f.endsWith(".log")).sort();
           const excess = files.length - maxFiles;
           if (excess <= 0) return;
           for (let i = 0; i < excess; i++) {
             try {
-              fs.unlinkSync(path2.join(this.logDir, files[i]));
+              getFs().unlinkSync(path2.join(this.logDir, files[i]));
             } catch {
             }
           }
@@ -12285,6 +12353,8 @@ var init_instance_logger = __esm({
         this.transports = transports;
         this.consoleTransport = consoleTransport;
       }
+      config;
+      getTransports;
       level;
       prefix;
       transports;
@@ -15188,6 +15258,7 @@ var init_tool_instance = __esm({
         super(args);
         this.record = record;
       }
+      record;
       execute(input) {
         return this.record.provide(input, this);
       }
@@ -15294,6 +15365,10 @@ var init_base_adapter = __esm({
         this.raw = raw;
         this.name = "LlmAdapterError";
       }
+      provider;
+      code;
+      statusCode;
+      raw;
     };
   }
 });
@@ -16244,6 +16319,7 @@ var init_providers = __esm({
       constructor(options) {
         this.options = options;
       }
+      options;
       adapter = null;
       getAdapter() {
         if (this.adapter) {
@@ -16528,6 +16604,8 @@ var init_flow_context_providers = __esm({
         this.baseProviders = baseProviders;
         this.contextDeps = contextDeps;
       }
+      baseProviders;
+      contextDeps;
       get(token) {
         if (this.contextDeps.has(token)) {
           return this.contextDeps.get(token);
@@ -17279,6 +17357,7 @@ var init_prompt_instance = __esm({
         super(args);
         this.record = record;
       }
+      record;
       execute(args) {
         return this.record.provide(args, this);
       }
@@ -19446,6 +19525,7 @@ var init_resource_instance = __esm({
         super(args);
         this.record = record;
       }
+      record;
       execute(uri, params) {
         return this.record.provide(uri, params, this);
       }
@@ -23080,6 +23160,8 @@ var init_flow_interface = __esm({
         this.type = type;
         this.output = output;
       }
+      type;
+      output;
       static respond(output) {
         throw new _FlowControl("respond", output);
       }
@@ -23108,6 +23190,11 @@ var init_flow_interface = __esm({
         this.input = metadata.inputSchema?.parse?.(rawInput);
         this.scopeLogger = scope.logger;
       }
+      metadata;
+      rawInput;
+      scope;
+      appendContextHooks;
+      deps;
       input;
       state = FlowState.create({});
       scopeLogger;
@@ -23760,6 +23847,18 @@ async function writeHttpResponse(res, value) {
       res.status(out.status).end();
       return;
     }
+    case "web-response": {
+      const r = out.response;
+      r.headers.forEach((v, k) => res.setHeader(k, v));
+      res.status(r.status);
+      if (r.body) {
+        for await (const chunk of r.body) {
+          res.write(chunk);
+        }
+      }
+      res.end();
+      return;
+    }
   }
 }
 var import_utils50;
@@ -23978,6 +24077,34 @@ var init_flow_instance = __esm({
         const results = await Promise.all(canActivate.map((m) => m(request, this.scope)));
         return results.every((r) => r);
       }
+      /**
+       * Express-equivalent HTTP match for runtimes that have NO middleware server
+       * (the Cloudflare Worker / web-fetch handler, where `registerMiddleware` is a
+       * no-op so flows never mount as routes). It mirrors how Express dispatches:
+       * method + `middleware.path` (mounted as a prefix) + `canActivate`.
+       *
+       * Only flows with a SPECIFIC matcher qualify — a `middleware.path` (e.g.
+       * `/oauth/token`) and/or a `canActivate` (static class method or
+       * `middleware.canActivate`, e.g. the well-known PRM path set). A bare
+       * `{ method }` middleware is too broad to safely claim an arbitrary request,
+       * so it returns false. Used by the web-fetch handler to serve auth/well-known/
+       * oauth endpoints through the real flow pipeline.
+       */
+      async matchHttp(request) {
+        const mw = this.metadata.middleware;
+        if (!mw) return false;
+        const path3 = typeof mw.path === "string" ? mw.path : "";
+        const hasStaticCanActivate = typeof this.FlowClass.canActivate === "function";
+        const hasMwCanActivate = (mw.canActivate?.length ?? 0) > 0;
+        if (!path3 && !hasStaticCanActivate && !hasMwCanActivate) return false;
+        if (this.method && request.method !== this.method) return false;
+        if (path3) {
+          const reqPath = request.path;
+          const prefix = path3.endsWith("/") ? path3 : `${path3}/`;
+          if (reqPath !== path3 && !reqPath.startsWith(prefix)) return false;
+        }
+        return this.canActivate(request);
+      }
       /**
        * Get FrontMcpContextStorage from providers (with fallback).
        * Returns undefined if not available (backward compatibility).
@@ -24380,6 +24507,21 @@ var init_flow_registry = __esm({
           )
         );
       }
+      /**
+       * Find the name of the first registered flow whose HTTP matcher claims this
+       * request (method + `middleware.path` prefix + `canActivate`). For runtimes
+       * with no middleware server (the web-fetch/Worker handler), this replaces
+       * Express's route dispatch so auth/well-known/oauth flows still run. Returns
+       * `undefined` when no flow matches.
+       */
+      async findHttpFlowName(request, exclude = /* @__PURE__ */ new Set()) {
+        for (const instance of this.instances.values()) {
+          const name41 = instance.name;
+          if (exclude.has(name41)) continue;
+          if (await instance.matchHttp(request)) return name41;
+        }
+        return void 0;
+      }
       /**
        * Get FrontMcpContextStorage from providers (with fallback).
        * Returns undefined if not available (backward compatibility).
@@ -24969,12 +25111,51 @@ var init_skill_validation_error = __esm({
   }
 });
 
+// libs/sdk/src/scope/optional-dependency.util.ts
+function probeOptionalDependency(moduleName, loadError, resolve) {
+  let resolvedPath;
+  try {
+    resolvedPath = resolve(moduleName);
+  } catch {
+    resolvedPath = void 0;
+  }
+  const error = loadError instanceof Error ? loadError.message : String(loadError);
+  return resolvedPath ? { status: "load-failed", resolvedPath, error } : { status: "not-installed", error };
+}
+async function importOptionalPeer(moduleName, importer, resolve, feature) {
+  try {
+    return await importer();
+  } catch (cause) {
+    const probe = probeOptionalDependency(moduleName, cause, resolve);
+    if (probe.status === "not-installed") {
+      throw new Error(
+        `@frontmcp/sdk ${feature} needs the optional peer dependency '${moduleName}'. Install it in your project (e.g. \`npm i ${moduleName}\`).`,
+        { cause }
+      );
+    }
+    throw new Error(
+      `@frontmcp/sdk ${feature} found '${moduleName}' at ${probe.resolvedPath} but it failed to load \u2014 reinstalling will not help. This is usually an export-condition, transpile, or transitive-peer mismatch. Original error: ${probe.error}`,
+      { cause }
+    );
+  }
+}
+var init_optional_dependency_util = __esm({
+  "libs/sdk/src/scope/optional-dependency.util.ts"() {
+    "use strict";
+  }
+});
+
 // libs/sdk/src/skill/providers/memory-skill.provider.ts
-var import_vectoriadb, STOP_WORDS, MemorySkillProvider;
+function isSnapshotCapable(db) {
+  const d = db;
+  return typeof d.toSnapshot === "function" && typeof d.loadSnapshot === "function";
+}
+var import_utils53, STOP_WORDS, MemorySkillProvider;
 var init_memory_skill_provider = __esm({
   "libs/sdk/src/skill/providers/memory-skill.provider.ts"() {
     "use strict";
-    import_vectoriadb = require("vectoriadb");
+    import_utils53 = require("@frontmcp/utils");
+    init_optional_dependency_util();
     STOP_WORDS = /* @__PURE__ */ new Set([
       // Articles & Determiners
       "the",
@@ -25050,19 +25231,118 @@ var init_memory_skill_provider = __esm({
     MemorySkillProvider = class {
       type = "memory";
       vectorDB;
+      vectorDBReady;
       skills = /* @__PURE__ */ new Map();
       defaultTopK;
       defaultMinScore;
       toolValidator;
       initialized = false;
+      /** Ranking mode passed to the vector DB (cosine | bm25). */
+      scoring;
+      /** Optional snapshot cache for fast cold-start (e.g. KV-backed on the edge). */
+      indexCache;
+      /**
+       * Whether the vector index reflects the current document set. Adds/removes
+       * mark it stale; the FIRST search after a mutation builds (or restores) it
+       * exactly once. This defers the expensive IDF/embedding pass off the
+       * registration hot-path — registering N skills no longer triggers N reindexes.
+       */
+      indexReady = false;
       constructor(options = {}) {
         this.defaultTopK = options.defaultTopK ?? 10;
         this.defaultMinScore = options.defaultMinScore ?? 0.1;
         this.toolValidator = options.toolValidator;
-        this.vectorDB = new import_vectoriadb.TFIDFVectoria({
+        this.scoring = options.scoring ?? "cosine";
+        this.indexCache = options.indexCache;
+        this.vectorDBReady = this.initVectorDB();
+        this.vectorDBReady.catch(() => void 0);
+      }
+      async initVectorDB() {
+        const mod = await importOptionalPeer(
+          "vectoriadb",
+          () => import("vectoriadb"),
+          require.resolve,
+          "skill storage"
+        );
+        const dbConfig = {
           defaultTopK: this.defaultTopK,
           defaultSimilarityThreshold: this.defaultMinScore
-        });
+        };
+        if (this.scoring !== "cosine") dbConfig.scoring = this.scoring;
+        this.vectorDB = new mod.TFIDFVectoria(dbConfig);
+      }
+      /**
+       * Attach (or replace) the snapshot cache after construction — useful when the
+       * cache binding only exists at request time (e.g. a Cloudflare KV namespace on
+       * `env`). Marks the index stale so the next search consults the new cache.
+       */
+      setIndexCache(cache2) {
+        this.indexCache = cache2;
+        this.indexReady = false;
+      }
+      /**
+       * Ensure the vector index reflects the current document set, building it AT
+       * MOST once per mutation batch. When a snapshot cache is configured and the
+       * vector DB supports snapshots, a content-hash hit restores the index without
+       * recomputing IDF/embeddings (the cold-start fast path); a miss rebuilds and
+       * persists the snapshot for next time. Cache failures degrade to a local
+       * rebuild — they never block search.
+       */
+      async ensureIndexed() {
+        if (this.indexReady) return;
+        const db = await this.db();
+        if (this.indexCache && isSnapshotCapable(db)) {
+          const key = await this.computeIndexKey();
+          try {
+            const snapshot = await this.indexCache.get(key);
+            if (snapshot !== void 0 && snapshot !== null) {
+              db.loadSnapshot(snapshot);
+              this.indexReady = true;
+              return;
+            }
+          } catch {
+          }
+          this.reindexNow(db);
+          this.indexReady = true;
+          try {
+            await this.indexCache.set(key, db.toSnapshot());
+          } catch {
+          }
+          return;
+        }
+        this.reindexNow(db);
+        this.indexReady = true;
+      }
+      /**
+       * Eagerly build (or restore from cache) the search index now, rather than on
+       * the first search. A host calls this after registration completes to move the
+       * one-time index build off the first request's critical path (e.g. the edge
+       * does this right after attaching the KV cache).
+       */
+      async warm() {
+        await this.ensureIndexed();
+      }
+      /** Force the vector DB to (re)compute its index now. */
+      reindexNow(db) {
+        db.reindex();
+      }
+      /**
+       * Stable content hash of the indexed skill set + scoring mode. Changing any
+       * skill's searchable text, the set of skills, or the scoring mode changes the
+       * key, so a stale snapshot is never restored.
+       */
+      async computeIndexKey() {
+        const parts = Array.from(this.skills.values()).map((s) => `${s.id}\0${this.buildSearchableText(s)}`).sort();
+        const canonical = `frontmcp-skill-index:v1|${this.scoring}|${this.skills.size}|${parts.join("
")}`;
+        return (0, import_utils53.sha256Hex)(canonical);
+      }
+      /** Await the lazy vectoriadb load (throws the clear install hint if absent). */
+      async db() {
+        await this.vectorDBReady;
+        if (!this.vectorDB) {
+          throw new Error("Vector DB not initialized; await this.vectorDBReady before use.");
+        }
+        return this.vectorDB;
       }
       /**
        * Set the tool validator after construction.
@@ -25072,9 +25352,13 @@ var init_memory_skill_provider = __esm({
         this.toolValidator = validator;
       }
       async initialize() {
+        await this.vectorDBReady;
         this.initialized = true;
       }
       async search(query, options = {}) {
+        if (query.trim().length === 0) {
+          return [];
+        }
         const {
           topK = this.defaultTopK,
           tags,
@@ -25105,10 +25389,16 @@ var init_memory_skill_provider = __esm({
           }
           return true;
         };
-        let results = await this.vectorDB.search(query, {
+        const db = await this.db();
+        await this.ensureIndexed();
+        let results = await db.search(query, {
           topK,
           threshold: minScore,
-          filter
+          filter,
+          // `negativeQuery` (anti-query demotion) is honored by newer vectoriadb
+          // versions; older ones ignore the extra field.
+          ...options.negativeQuery !== void 0 ? { negativeQuery: options.negativeQuery } : {},
+          ...options.negativeWeight !== void 0 ? { negativeWeight: options.negativeWeight } : {}
         });
         if (results.length === 0 && query.trim().length > 0 && this.skills.size > 0) {
           results = this.fallbackTextSearch(query, topK, filter);
@@ -25216,29 +25506,35 @@ var init_memory_skill_provider = __esm({
       }
       async add(skill) {
         this.skills.set(skill.id, skill);
-        this.indexSkill(skill);
+        await this.indexSkill(skill);
       }
       async update(skillId, skill) {
         const normalizedSkill = skill.id !== skillId ? { ...skill, id: skillId } : skill;
-        if (this.vectorDB.hasDocument(skillId)) {
-          this.vectorDB.removeDocument(skillId);
+        const db = await this.db();
+        if (db.hasDocument(skillId)) {
+          db.removeDocument(skillId);
         }
         this.skills.set(skillId, normalizedSkill);
-        this.indexSkill(normalizedSkill);
+        await this.indexSkill(normalizedSkill);
       }
       async remove(skillId) {
         this.skills.delete(skillId);
-        if (this.vectorDB.hasDocument(skillId)) {
-          this.vectorDB.removeDocument(skillId);
+        const db = await this.db();
+        if (db.hasDocument(skillId)) {
+          db.removeDocument(skillId);
         }
+        this.indexReady = false;
       }
       async clear() {
         this.skills.clear();
-        this.vectorDB.clear();
+        const db = await this.db().catch(() => void 0);
+        db?.clear();
+        this.indexReady = false;
       }
       async dispose() {
         this.skills.clear();
-        this.vectorDB.clear();
+        const db = await this.db().catch(() => void 0);
+        db?.clear();
         this.initialized = false;
       }
       /**
@@ -25257,13 +25553,14 @@ var init_memory_skill_provider = __esm({
             }
           };
         });
-        this.vectorDB.addDocuments(documents);
-        this.vectorDB.reindex();
+        const db = await this.db();
+        db.addDocuments(documents);
+        this.indexReady = false;
       }
       /**
        * Index a single skill in the vector database.
        */
-      indexSkill(skill) {
+      async indexSkill(skill) {
         const document = {
           id: skill.id,
           text: this.buildSearchableText(skill),
@@ -25273,8 +25570,9 @@ var init_memory_skill_provider = __esm({
             skill
           }
         };
-        this.vectorDB.addDocuments([document]);
-        this.vectorDB.reindex();
+        const db = await this.db();
+        db.addDocuments([document]);
+        this.indexReady = false;
       }
       /**
        * Build searchable text for TF-IDF indexing.
@@ -25688,7 +25986,7 @@ function createSkillInstance(record, providers, owner) {
 }
 function getSkillManifestMainDir() {
   try {
-    const cwd = (0, import_utils53.getCwd)();
+    const cwd = (0, import_utils54.getCwd)();
     return cwd && cwd.length > 0 ? cwd : void 0;
   } catch {
     return void 0;
@@ -25696,7 +25994,7 @@ function getSkillManifestMainDir() {
 }
 async function loadResourceWithManifestFallback(resourcePath, baseDir, skillName, resourceType, loader) {
   if (!resourcePath) return void 0;
-  let dir = resourcePath.startsWith("/") ? resourcePath : baseDir ? (0, import_utils53.pathResolve)(baseDir, resourcePath) : void 0;
+  let dir = resourcePath.startsWith("/") ? resourcePath : baseDir ? (0, import_utils54.pathResolve)(baseDir, resourcePath) : void 0;
   if (dir) {
     try {
       return await loader(dir);
@@ -25720,9 +26018,9 @@ async function resolveFromSkillManifest(skillName) {
       return void 0;
     }
     try {
-      const manifestPath = (0, import_utils53.pathJoin)(mainDir2, "_skills", "manifest.json");
-      if (await (0, import_utils53.fileExists)(manifestPath)) {
-        skillManifestCache = await (0, import_utils53.readJSON)(manifestPath);
+      const manifestPath = (0, import_utils54.pathJoin)(mainDir2, "_skills", "manifest.json");
+      if (await (0, import_utils54.fileExists)(manifestPath)) {
+        skillManifestCache = await (0, import_utils54.readJSON)(manifestPath);
       } else {
         skillManifestCache = null;
         return void 0;
@@ -25740,7 +26038,7 @@ async function resolveFromSkillManifest(skillName) {
   if (!entry?.instructions) return void 0;
   const mainDir = getSkillManifestMainDir();
   if (!mainDir) return void 0;
-  return (0, import_utils53.pathResolve)(mainDir, entry.instructions);
+  return (0, import_utils54.pathResolve)(mainDir, entry.instructions);
 }
 async function resolveResourceFromManifest(skillName, resourceType) {
   await resolveFromSkillManifest(skillName);
@@ -25750,13 +26048,13 @@ async function resolveResourceFromManifest(skillName, resourceType) {
   if (!relPath) return void 0;
   const mainDir = getSkillManifestMainDir();
   if (!mainDir) return void 0;
-  return (0, import_utils53.pathResolve)(mainDir, relPath);
+  return (0, import_utils54.pathResolve)(mainDir, relPath);
 }
-var import_utils53, SkillInstance, skillManifestCache;
+var import_utils54, SkillInstance, skillManifestCache;
 var init_skill_instance = __esm({
   "libs/sdk/src/skill/skill.instance.ts"() {
     "use strict";
-    import_utils53 = require("@frontmcp/utils");
+    import_utils54 = require("@frontmcp/utils");
     init_common();
     init_skill_utils();
     SkillInstance = class extends SkillEntry {
@@ -25839,7 +26137,7 @@ var init_skill_instance = __esm({
        */
       getBaseDir() {
         if (this.record.kind === "FILE" /* FILE */) {
-          return (0, import_utils53.dirname)(this.record.filePath) || void 0;
+          return (0, import_utils54.dirname)(this.record.filePath) || void 0;
         }
         if ((this.record.kind === "VALUE" /* VALUE */ || this.record.kind === "CLASS_TOKEN" /* CLASS_TOKEN */) && this.record.callerDir) {
           return this.record.callerDir;
@@ -25942,12 +26240,12 @@ var init_skill_instance = __esm({
 });
 
 // libs/sdk/src/skill/skill.registry.ts
-var import_di22, import_utils54, SkillRegistry;
+var import_di22, import_utils55, SkillRegistry;
 var init_skill_registry = __esm({
   "libs/sdk/src/skill/skill.registry.ts"() {
     "use strict";
     import_di22 = require("@frontmcp/di");
-    import_utils54 = require("@frontmcp/utils");
+    import_utils55 = require("@frontmcp/utils");
     init_availability();
     init_errors();
     init_regsitry();
@@ -26012,7 +26310,9 @@ var init_skill_registry = __esm({
         this.options = options ?? {};
         this.storageProvider = new MemorySkillProvider({
           defaultTopK: 10,
-          defaultMinScore: 0.1
+          defaultMinScore: 0.1,
+          ...this.options.scoring ? { scoring: this.options.scoring } : {},
+          ...this.options.indexCache ? { indexCache: this.options.indexCache } : {}
         });
         this.buildGraph();
         this.ready = this.initialize();
@@ -26150,8 +26450,8 @@ var init_skill_registry = __esm({
             return skillVis === visibility;
           });
         }
-        const ctx = (0, import_utils54.getRuntimeContext)();
-        skills = skills.filter((s) => (0, import_utils54.isEntryAvailable)(s.metadata.availableWhen, ctx));
+        const ctx = (0, import_utils55.getRuntimeContext)();
+        skills = skills.filter((s) => (0, import_utils55.isEntryAvailable)(s.metadata.availableWhen, ctx));
         return skills;
       }
       /**
@@ -26172,8 +26472,8 @@ var init_skill_registry = __esm({
       getAlwaysLoadedSkills() {
         let skills = this.listAllIndexed().map((r) => r.instance);
         skills = skills.filter((s) => s.isAlwaysLoaded());
-        const ctx = (0, import_utils54.getRuntimeContext)();
-        skills = skills.filter((s) => (0, import_utils54.isEntryAvailable)(s.metadata.availableWhen, ctx));
+        const ctx = (0, import_utils55.getRuntimeContext)();
+        skills = skills.filter((s) => (0, import_utils55.isEntryAvailable)(s.metadata.availableWhen, ctx));
         return skills;
       }
       /**
@@ -26222,6 +26522,31 @@ var init_skill_registry = __esm({
        * provider update lagged or failed) would mask the newer dynamic content.
        * Provider-only rows pass through unchanged; overlay-only rows are appended.
        */
+      /**
+       * Attach (or replace) the snapshot cache used to persist/restore the search
+       * index — for runtimes where the cache binding only exists at request time
+       * (e.g. a Cloudflare KV namespace on `env`). No-op if the storage provider
+       * doesn't support index caching. Pair with {@link warmIndex} to build/restore
+       * the index off the first request's critical path.
+       */
+      setIndexCache(cache2) {
+        const provider = this.storageProvider;
+        if (typeof provider.setIndexCache === "function") {
+          provider.setIndexCache(cache2);
+        }
+      }
+      /**
+       * Eagerly build (or restore from the cache) the search index now. Called by a
+       * host after registration so the one-time index build (or a KV restore) is
+       * paid here rather than inside the first `search`. No-op if unsupported.
+       */
+      async warmIndex() {
+        await this.ready;
+        const provider = this.storageProvider;
+        if (typeof provider.warm === "function") {
+          await provider.warm();
+        }
+      }
       async search(query, options) {
         const baseResults = await this.storageProvider.search(query, options);
         if (this.dynamicContents.size === 0) return baseResults;
@@ -26272,8 +26597,8 @@ var init_skill_registry = __esm({
           }
         }
         if (localSkill) {
-          const ctx = (0, import_utils54.getRuntimeContext)();
-          if (!(0, import_utils54.isEntryAvailable)(localSkill.metadata.availableWhen, ctx)) {
+          const ctx = (0, import_utils55.getRuntimeContext)();
+          if (!(0, import_utils55.isEntryAvailable)(localSkill.metadata.availableWhen, ctx)) {
             return void 0;
           }
           const dynamicResolved = this.dynamicContents.get(localSkill.metadata.id ?? localSkill.metadata.name);
@@ -27272,6 +27597,7 @@ var init_agent_scope = __esm({
         };
         this.ready = this.initialize();
       }
+      metadata;
       id;
       entryPath;
       routeBase;
@@ -27441,6 +27767,7 @@ var init_agent_scope = __esm({
         this.fullPath = agentScope.fullPath;
         this.logger = agentScope.logger;
       }
+      agentScope;
       id;
       entryPath;
       routeBase;
@@ -28173,6 +28500,7 @@ var init_agent_instance = __esm({
         super(args);
         this.record = record;
       }
+      record;
       async execute(input) {
         return this.record.provide(input, this);
       }
@@ -28196,12 +28524,12 @@ function dedupLineage4(l) {
   }
   return out;
 }
-var import_di26, import_utils55, AgentRegistry;
+var import_di26, import_utils56, AgentRegistry;
 var init_agent_registry = __esm({
   "libs/sdk/src/agent/agent.registry.ts"() {
     "use strict";
     import_di26 = require("@frontmcp/di");
-    import_utils55 = require("@frontmcp/utils");
+    import_utils56 = require("@frontmcp/utils");
     init_availability();
     init_mcp_error();
     init_regsitry();
@@ -28396,11 +28724,11 @@ var init_agent_registry = __esm({
        */
       // NOTE: `any` is intentional - heterogeneous agent collections
       getAgents(includeHidden = false) {
-        const ctx = (0, import_utils55.getRuntimeContext)();
+        const ctx = (0, import_utils56.getRuntimeContext)();
         const local = [...this.localRows].map((a) => a.instance);
         const adopted = [...this.adopted.values()].flat().map((a) => a.instance);
         return [...local, ...adopted].filter((a) => {
-          if (!(0, import_utils55.isEntryAvailable)(a.metadata.availableWhen, ctx)) return false;
+          if (!(0, import_utils56.isEntryAvailable)(a.metadata.availableWhen, ctx)) return false;
           if (!includeHidden && a.metadata.hideFromDiscovery === true) return false;
           return true;
         });
@@ -28429,8 +28757,8 @@ var init_agent_registry = __esm({
        * Used by discovery/listing APIs to enforce registry-level constraints.
        */
       getAvailableInstances() {
-        const ctx = (0, import_utils55.getRuntimeContext)();
-        return [...this.listAllInstances()].filter((a) => (0, import_utils55.isEntryAvailable)(a.metadata.availableWhen, ctx));
+        const ctx = (0, import_utils56.getRuntimeContext)();
+        return [...this.listAllInstances()].filter((a) => (0, import_utils56.isEntryAvailable)(a.metadata.availableWhen, ctx));
       }
       /**
        * Find an agent by ID.
@@ -29060,7 +29388,7 @@ function isRemoteAppConfig(item) {
     return true;
   }
   if (obj["urlType"] === "url" || obj["urlType"] === "worker") {
-    return (0, import_utils56.isValidMcpUri)(obj["url"]);
+    return (0, import_utils57.isValidMcpUri)(obj["url"]);
   }
   return false;
 }
@@ -29108,23 +29436,23 @@ function appDiscoveryDeps(rec) {
       return (0, import_di27.depsOfClass)(rec.provide, "discovery");
   }
 }
-var import_di27, import_utils56;
+var import_di27, import_utils57;
 var init_app_utils = __esm({
   "libs/sdk/src/app/app.utils.ts"() {
     "use strict";
     import_di27 = require("@frontmcp/di");
-    import_utils56 = require("@frontmcp/utils");
+    import_utils57 = require("@frontmcp/utils");
     init_common();
     init_errors();
   }
 });
 
 // libs/sdk/src/app/instances/app.local.instance.ts
-var import_utils57, AppLocalInstance;
+var import_utils58, AppLocalInstance;
 var init_app_local_instance = __esm({
   "libs/sdk/src/app/instances/app.local.instance.ts"() {
     "use strict";
-    import_utils57 = require("@frontmcp/utils");
+    import_utils58 = require("@frontmcp/utils");
     init_adapter_registry();
     init_agent_registry();
     init_common();
@@ -29149,7 +29477,7 @@ var init_app_local_instance = __esm({
       constructor(record, scopeProviders) {
         super(record);
         this.scopeProviders = scopeProviders;
-        this.id = this.metadata.id ?? (0, import_utils57.idFromString)(this.metadata.name);
+        this.id = this.metadata.id ?? (0, import_utils58.idFromString)(this.metadata.name);
         try {
           this.logger = scopeProviders.get(FrontMcpLogger)?.child("AppLocalInstance");
         } catch {
@@ -30851,11 +31179,11 @@ var init_remote_mcp = __esm({
 });
 
 // libs/sdk/src/app/instances/app.remote.instance.ts
-var import_utils58, EmptyPluginRegistry, EmptyAdapterRegistry, EmptySkillRegistry, AppRemoteInstance;
+var import_utils59, EmptyPluginRegistry, EmptyAdapterRegistry, EmptySkillRegistry, AppRemoteInstance;
 var init_app_remote_instance = __esm({
   "libs/sdk/src/app/instances/app.remote.instance.ts"() {
     "use strict";
-    import_utils58 = require("@frontmcp/utils");
+    import_utils59 = require("@frontmcp/utils");
     init_common();
     init_errors();
     init_prompt_registry();
@@ -30970,7 +31298,7 @@ var init_app_remote_instance = __esm({
       _unsubscribeCapability;
       constructor(record, scopeProviders) {
         super(record);
-        this.id = this.metadata.id ?? (0, import_utils58.idFromString)(this.metadata.name);
+        this.id = this.metadata.id ?? (0, import_utils59.idFromString)(this.metadata.name);
         this.scopeProviders = scopeProviders;
         this.appOwner = {
           kind: "app",
@@ -31356,8 +31684,8 @@ function getDefaultCacheDir() {
     const path3 = require("node:path");
     try {
       const nodeModulesDir = path3.join(process.cwd(), "node_modules");
-      const fs2 = require("node:fs");
-      if (fs2.existsSync(nodeModulesDir)) {
+      const fs = require("node:fs");
+      if (fs.existsSync(nodeModulesDir)) {
         return path3.join(nodeModulesDir, ".cache", "frontmcp-esm");
       }
     } catch {
@@ -31372,20 +31700,31 @@ function getDefaultCacheDir() {
     return "";
   }
 }
-var import_utils59, DEFAULT_CACHE_DIR, DEFAULT_MAX_AGE_MS, EsmCacheManager;
+var import_utils60, DEFAULT_CACHE_DIR, DEFAULT_MAX_AGE_MS, DEFAULT_MAX_ENTRIES, EsmCacheManager;
 var init_esm_cache = __esm({
   "libs/sdk/src/esm-loader/esm-cache.ts"() {
     "use strict";
-    import_utils59 = require("@frontmcp/utils");
+    import_utils60 = require("@frontmcp/utils");
     DEFAULT_CACHE_DIR = getDefaultCacheDir();
     DEFAULT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+    DEFAULT_MAX_ENTRIES = 100;
     EsmCacheManager = class {
       cacheDir;
       maxAgeMs;
+      maxEntries;
       memoryStore = /* @__PURE__ */ new Map();
       constructor(options) {
         this.cacheDir = options?.cacheDir ?? DEFAULT_CACHE_DIR;
         this.maxAgeMs = options?.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
+        this.maxEntries = options?.maxEntries ?? DEFAULT_MAX_ENTRIES;
+      }
+      /** Evict oldest in-memory entries (FIFO via Map insertion order) past the cap. */
+      evictIfNeeded() {
+        while (this.memoryStore.size > this.maxEntries) {
+          const oldest = this.memoryStore.keys().next().value;
+          if (oldest === void 0) break;
+          this.memoryStore.delete(oldest);
+        }
       }
       /**
        * Get a cached ESM bundle entry if it exists and is not expired.
@@ -31419,6 +31758,7 @@ var init_esm_cache = __esm({
             return void 0;
           }
           this.memoryStore.set(memKey, meta);
+          this.evictIfNeeded();
           return meta;
         } catch {
           return void 0;
@@ -31428,7 +31768,7 @@ var init_esm_cache = __esm({
        * Store an ESM bundle in the cache.
        */
       async put(packageName, version, bundleContent, packageUrl, etag) {
-        if (!(0, import_utils59.isValidMcpUri)(packageUrl)) {
+        if (!(0, import_utils60.isValidMcpUri)(packageUrl)) {
           throw new Error("URI must have a valid scheme (e.g., file://, https://, custom://)");
         }
         const memKey = `${packageName}@${version}`;
@@ -31465,6 +31805,7 @@ var init_esm_cache = __esm({
           bundleContent
         };
         this.memoryStore.set(memKey, entry);
+        this.evictIfNeeded();
         return entry;
       }
       /**
@@ -31558,7 +31899,7 @@ var init_esm_cache = __esm({
        */
       getEntryDir(packageName, version) {
         const path3 = require("node:path");
-        const hash = (0, import_utils59.sha256Hex)(`${packageName}@${version}`);
+        const hash = (0, import_utils60.sha256Hex)(`${packageName}@${version}`);
         return path3.join(this.cacheDir, hash);
       }
     };
@@ -31609,7 +31950,7 @@ function normalizeResourceFromEsmExport(raw) {
   const obj = raw;
   if (typeof obj["read"] === "function" && typeof obj["name"] === "string" && typeof obj["uri"] === "string") {
     const uri = obj["uri"];
-    if (!(0, import_utils60.isValidMcpUri)(uri)) return void 0;
+    if (!(0, import_utils61.isValidMcpUri)(uri)) return void 0;
     const description = obj["description"];
     const mimeType = obj["mimeType"];
     return {
@@ -31637,12 +31978,12 @@ function normalizePromptFromEsmExport(raw) {
   }
   return void 0;
 }
-var import_di28, import_utils60;
+var import_di28, import_utils61;
 var init_esm_normalize_utils = __esm({
   "libs/sdk/src/app/instances/esm-normalize.utils.ts"() {
     "use strict";
     import_di28 = require("@frontmcp/di");
-    import_utils60 = require("@frontmcp/utils");
+    import_utils61 = require("@frontmcp/utils");
     init_tokens();
   }
 });
@@ -31911,6 +32252,13 @@ var init_version_resolver = __esm({
 });
 
 // libs/sdk/src/esm-loader/esm-module-loader.ts
+function importComputed(specifier) {
+  return import(
+    /* webpackIgnore: true */
+    /* @vite-ignore */
+    specifier
+  );
+}
 var EsmModuleLoader;
 var init_esm_module_loader = __esm({
   "libs/sdk/src/esm-loader/esm-module-loader.ts"() {
@@ -32042,9 +32390,7 @@ var init_esm_module_loader = __esm({
        */
       async importFromPath(filePath) {
         const { pathToFileURL } = await import("node:url");
-        const fileUrl = pathToFileURL(filePath).href;
-        const bustUrl = `${fileUrl}?t=${Date.now()}`;
-        return import(bustUrl);
+        return importComputed(pathToFileURL(filePath).href);
       }
       /**
        * Import a bundle from its source text.
@@ -32073,27 +32419,22 @@ var init_esm_module_loader = __esm({
           const blob = new Blob([bundleContent], { type: "text/javascript" });
           const url = URL.createObjectURL(blob);
           try {
-            return await import(
-              /* webpackIgnore: true */
-              url
-            );
+            return await importComputed(url);
           } finally {
             URL.revokeObjectURL(url);
           }
         }
-        const { mkdtemp, writeFile, rm } = await import("@frontmcp/utils");
+        const { ensureDir, fileExists: fileExists9, sha256Hex: sha256Hex9, writeFile } = await import("@frontmcp/utils");
         const nodePath = await import("node:path");
         const nodeOs = await import("node:os");
         const { pathToFileURL } = await import("node:url");
-        const tempDir = await mkdtemp(nodePath.join(nodeOs.tmpdir(), "frontmcp-esm-"));
-        const tempPath = nodePath.join(tempDir, "bundle.mjs");
-        try {
+        const dir = nodePath.join(nodeOs.tmpdir(), "frontmcp-esm-modules");
+        await ensureDir(dir);
+        const tempPath = nodePath.join(dir, `${sha256Hex9(bundleContent)}.mjs`);
+        if (!await fileExists9(tempPath)) {
           await writeFile(tempPath, bundleContent);
-          return await import(pathToFileURL(tempPath).href + `?t=${Date.now()}`);
-        } finally {
-          await rm(tempDir, { recursive: true, force: true }).catch(() => {
-          });
         }
+        return importComputed(pathToFileURL(tempPath).href);
       }
     };
   }
@@ -32414,11 +32755,11 @@ var init_esm_loader = __esm({
 });
 
 // libs/sdk/src/app/instances/app.esm.instance.ts
-var import_utils61, EmptyPluginRegistry2, EmptyAdapterRegistry2, EmptySkillRegistry2, AppEsmInstance;
+var import_utils62, EmptyPluginRegistry2, EmptyAdapterRegistry2, EmptySkillRegistry2, AppEsmInstance;
 var init_app_esm_instance = __esm({
   "libs/sdk/src/app/instances/app.esm.instance.ts"() {
     "use strict";
-    import_utils61 = require("@frontmcp/utils");
+    import_utils62 = require("@frontmcp/utils");
     init_common();
     init_errors();
     init_esm_loader();
@@ -32533,7 +32874,7 @@ var init_app_esm_instance = __esm({
       _skills;
       constructor(record, scopeProviders) {
         super(record);
-        this.id = this.metadata.id ?? (0, import_utils61.idFromString)(this.metadata.name);
+        this.id = this.metadata.id ?? (0, import_utils62.idFromString)(this.metadata.name);
         this.scopeProviders = scopeProviders;
         this.appOwner = {
           kind: "app",
@@ -32881,11 +33222,11 @@ function timingSafeEqualStr(a, b) {
   }
   return diff === 0;
 }
-var import_utils62, ALL_SLOTS, PENDING_UI_TTL_MS, AuthUiRegistry;
+var import_utils63, ALL_SLOTS, PENDING_UI_TTL_MS, AuthUiRegistry;
 var init_auth_ui_registry = __esm({
   "libs/sdk/src/auth/auth-ui/auth-ui.registry.ts"() {
     "use strict";
-    import_utils62 = require("@frontmcp/utils");
+    import_utils63 = require("@frontmcp/utils");
     ALL_SLOTS = ["login", "consent", "incremental", "federated", "error"];
     PENDING_UI_TTL_MS = 10 * 60 * 1e3;
     AuthUiRegistry = class {
@@ -32916,7 +33257,7 @@ var init_auth_ui_registry = __esm({
             throw new Error(`auth.ui slot "${slot}" is not one of: ${ALL_SLOTS.join(", ")}.`);
           }
           if (typeof rawPath !== "string" || rawPath.length === 0) continue;
-          const file = (0, import_utils62.isAbsolute)(rawPath) ? rawPath : (0, import_utils62.pathResolve)(sourceDir, rawPath);
+          const file = (0, import_utils63.isAbsolute)(rawPath) ? rawPath : (0, import_utils63.pathResolve)(sourceDir, rawPath);
           this.slots.set(slot, { file });
           this.logger?.verbose(`Registered auth.ui slot "${slot}" \u2192 ${file}`);
         }
@@ -33002,7 +33343,7 @@ var init_auth_ui_registry = __esm({
       mintCsrf(pendingAuthId) {
         const existing = this.pending.get(pendingAuthId);
         if (existing) return existing.csrf;
-        const csrf = (0, import_utils62.sha256Hex)((0, import_utils62.randomBytes)(32)).slice(0, 43);
+        const csrf = (0, import_utils63.sha256Hex)((0, import_utils63.randomBytes)(32)).slice(0, 43);
         this.pending.set(pendingAuthId, { csrf, addedItems: {}, createdAt: Date.now() });
         this.pruneExpired();
         return csrf;
@@ -33055,7 +33396,7 @@ var init_auth_ui_registry = __esm({
       ensurePending(pendingAuthId) {
         let state = this.pending.get(pendingAuthId);
         if (!state) {
-          state = { csrf: (0, import_utils62.sha256Hex)((0, import_utils62.randomBytes)(32)).slice(0, 43), addedItems: {}, createdAt: Date.now() };
+          state = { csrf: (0, import_utils63.sha256Hex)((0, import_utils63.randomBytes)(32)).slice(0, 43), addedItems: {}, createdAt: Date.now() };
           this.pending.set(pendingAuthId, state);
           this.pruneExpired();
         }
@@ -33640,13 +33981,13 @@ function getConfiguredProviders(auth) {
 function getConfiguredProviderIds(auth) {
   return getConfiguredProviders(auth).map((p) => p.id);
 }
-var import_auth21, import_lazy_zod64, import_utils63, pkceChallengeSchema, codeChallengeMethodSchema, responseTypeSchema, safeRedirectUriSchema, oauthAuthorizeRequestSchema, anonymousAuthorizeRequestSchema, inputSchema16, stateSchema15, outputSchema15, plan15, name15, Stage15, OauthAuthorizeFlow;
+var import_auth21, import_lazy_zod64, import_utils64, pkceChallengeSchema, codeChallengeMethodSchema, responseTypeSchema, safeRedirectUriSchema, oauthAuthorizeRequestSchema, anonymousAuthorizeRequestSchema, inputSchema16, stateSchema15, outputSchema15, plan15, name15, Stage15, OauthAuthorizeFlow;
 var init_oauth_authorize_flow = __esm({
   "libs/sdk/src/auth/flows/oauth.authorize.flow.ts"() {
     "use strict";
     import_auth21 = require("@frontmcp/auth");
     import_lazy_zod64 = require("@frontmcp/lazy-zod");
-    import_utils63 = require("@frontmcp/utils");
+    import_utils64 = require("@frontmcp/utils");
     init_common();
     init_auth_ui();
     init_cimd();
@@ -33877,6 +34218,15 @@ var init_oauth_authorize_flow = __esm({
             return;
           }
         }
+        if (!isCimdClientId2) {
+          const registry = this.scope.auth.dcrClientRegistry;
+          const registered = registry?.get?.(client_id);
+          if (registered && !registered.redirect_uris.includes(redirect_uri)) {
+            this.logger.warn(`OAuth authorize: redirect_uri "${redirect_uri}" not registered for client "${client_id}"`);
+            this.respondWithError(["redirect_uri is not registered for this client"], void 0, rawState);
+            return;
+          }
+        }
       }
       async checkIfAuthorized() {
       }
@@ -34141,7 +34491,7 @@ var init_oauth_authorize_flow = __esm({
         }
         const state = buildState({
           pendingAuthId,
-          submitUrl: `${this.scope.fullPath}/oauth/callback`,
+          submitUrl: "/oauth/callback",
           extraUrl: authUiExtraPath(this.scope.fullPath),
           csrfToken,
           addedItems: authUi.getAddedItems(pendingAuthId)
@@ -34194,10 +34544,10 @@ var init_oauth_authorize_flow = __esm({
           frontmcpPkce: { challenge: validatedRequest.code_challenge, method: "S256" },
           providerIds: [providerId]
         });
-        const verifier = (0, import_utils63.generateCodeVerifier)();
-        const challenge = (0, import_utils63.sha256Base64url)(verifier);
+        const verifier = (0, import_utils64.generateCodeVerifier)();
+        const challenge = (0, import_utils64.sha256Base64url)(verifier);
         const pkce = { verifier, challenge, method: "S256" };
-        const providerState = `federated:${session.id}:${(0, import_utils63.randomUUID)()}`;
+        const providerState = `federated:${session.id}:${(0, import_utils64.randomUUID)()}`;
         (0, import_auth21.startNextProvider)(session, pkce, providerState);
         await localAuth.federatedSessionStore.store(session);
         const redirectUrl = await localAuth.buildProviderAuthorizeUrl(providerId, {
@@ -34287,7 +34637,7 @@ var init_oauth_authorize_flow = __esm({
        */
       renderLoginPage(params) {
         const { pendingAuthId, clientId, clientName, scope, logoUri } = params;
-        const callbackPath = `${this.scope.fullPath}/oauth/callback`;
+        const callbackPath = "/oauth/callback";
         const auth = this.scope.metadata.auth;
         const login = auth && auth.mode === "local" ? auth.login : void 0;
         const ctx = {
@@ -34306,7 +34656,7 @@ var init_oauth_authorize_flow = __esm({
        */
       renderIncrementalAuthPage(params) {
         const { pendingAuthId, appId, appName, appDescription, toolId } = params;
-        const callbackPath = `${this.scope.fullPath}/oauth/callback`;
+        const callbackPath = "/oauth/callback";
         const app = {
           appId,
           appName,
@@ -34324,7 +34674,7 @@ var init_oauth_authorize_flow = __esm({
        */
       renderFederatedLoginPage(params) {
         const { pendingAuthId, detection, clientId } = params;
-        const callbackPath = `${this.scope.fullPath}/oauth/callback`;
+        const callbackPath = "/oauth/callback";
         const providers = [...detection.providers.values()].map((provider) => ({
           providerId: provider.id,
           providerName: provider.id,
@@ -34428,13 +34778,13 @@ function timingSafeEqualStr3(a, b) {
   }
   return diff === 0;
 }
-var import_auth22, import_lazy_zod65, import_utils64, inputSchema17, stateSchema16, outputSchema16, plan16, name16, Stage16, OauthCallbackFlow;
+var import_auth22, import_lazy_zod65, import_utils65, inputSchema17, stateSchema16, outputSchema16, plan16, name16, Stage16, OauthCallbackFlow;
 var init_oauth_callback_flow = __esm({
   "libs/sdk/src/auth/flows/oauth.callback.flow.ts"() {
     "use strict";
     import_auth22 = require("@frontmcp/auth");
     import_lazy_zod65 = require("@frontmcp/lazy-zod");
-    import_utils64 = require("@frontmcp/utils");
+    import_utils65 = require("@frontmcp/utils");
     init_common();
     init_auth_ui();
     init_consent_tools_helper();
@@ -34855,7 +35205,7 @@ var init_oauth_callback_flow = __esm({
           return;
         }
         const federatedSession = (0, import_auth22.createFederatedAuthSession)({
-          pendingAuthId: this.state.required.pendingAuthId || (0, import_utils64.randomUUID)(),
+          pendingAuthId: this.state.required.pendingAuthId || (0, import_utils65.randomUUID)(),
           clientId,
           redirectUri,
           scopes: scopes ?? [],
@@ -34875,14 +35225,14 @@ var init_oauth_callback_flow = __esm({
         await sessionStore.store(federatedSession);
         this.logger.info(`Created federated session: ${federatedSession.id}`);
         const firstProviderId = selectedProviders[0];
-        const verifier = (0, import_utils64.generateCodeVerifier)();
-        const challenge = (0, import_utils64.sha256Base64url)(verifier);
+        const verifier = (0, import_utils65.generateCodeVerifier)();
+        const challenge = (0, import_utils65.sha256Base64url)(verifier);
         const pkce = {
           verifier,
           challenge,
           method: "S256"
         };
-        const providerState = `federated:${federatedSession.id}:${(0, import_utils64.randomUUID)()}`;
+        const providerState = `federated:${federatedSession.id}:${(0, import_utils65.randomUUID)()}`;
         (0, import_auth22.startNextProvider)(federatedSession, pkce, providerState);
         await sessionStore.update(federatedSession);
         const providerConfig = localAuth.getProviderConfig(firstProviderId);
@@ -35148,7 +35498,7 @@ var init_oauth_callback_flow = __esm({
        * preserved on the form so the user does not have to re-enter everything.
        */
       renderLoginRetryPage(pendingAuth, login, fields, failure) {
-        const callbackPath = `${this.scope.fullPath}/oauth/callback`;
+        const callbackPath = "/oauth/callback";
         const ctx = {
           clientId: pendingAuth.clientId,
           clientName: pendingAuth.clientId,
@@ -35214,7 +35564,7 @@ var init_oauth_callback_flow = __esm({
         const state = buildConsentState(
           {
             pendingAuthId: pendingAuth.id,
-            submitUrl: `${this.scope.fullPath}/oauth/callback`,
+            submitUrl: "/oauth/callback",
             extraUrl: authUiExtraPath(this.scope.fullPath),
             csrfToken,
             addedItems: authUi.getAddedItems(pendingAuth.id)
@@ -35241,7 +35591,7 @@ var init_oauth_callback_flow = __esm({
        * (used for an empty `requireSelection` submit).
        */
       renderConsentScreen(pendingAuth, consentConfig, identity, error, preSelectedTools) {
-        const callbackPath = `${this.scope.fullPath}/oauth/callback`;
+        const callbackPath = "/oauth/callback";
         const { toolCards } = projectConsentTools(this.scope, consentConfig?.excludedTools);
         const hiddenFields = [];
         if (identity.email) hiddenFields.push({ name: "email", value: identity.email });
@@ -35280,7 +35630,7 @@ var init_oauth_callback_flow = __esm({
        * In production, this would be the user's ID from the database
        */
       generateUserSub(email) {
-        const hash = (0, import_utils64.sha256Hex)(email.toLowerCase());
+        const hash = (0, import_utils65.sha256Hex)(email.toLowerCase());
         return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-${hash.slice(12, 16)}-${hash.slice(16, 20)}-${hash.slice(20, 32)}`;
       }
       /**
@@ -35664,13 +36014,13 @@ var init_oauth_connect_flow = __esm({
 });
 
 // libs/sdk/src/auth/flows/oauth.provider-callback.flow.ts
-var import_auth24, import_lazy_zod67, import_utils65, inputSchema19, stateSchema18, outputSchema18, plan18, name18, Stage18, OauthProviderCallbackFlow;
+var import_auth24, import_lazy_zod67, import_utils66, inputSchema19, stateSchema18, outputSchema18, plan18, name18, Stage18, OauthProviderCallbackFlow;
 var init_oauth_provider_callback_flow = __esm({
   "libs/sdk/src/auth/flows/oauth.provider-callback.flow.ts"() {
     "use strict";
     import_auth24 = require("@frontmcp/auth");
     import_lazy_zod67 = require("@frontmcp/lazy-zod");
-    import_utils65 = require("@frontmcp/utils");
+    import_utils66 = require("@frontmcp/utils");
     init_common();
     init_errors();
     init_consent_tools_helper();
@@ -35983,14 +36333,14 @@ var init_oauth_provider_callback_flow = __esm({
         if (!nextProviderId) {
           return this.completeFederatedAuth(session);
         }
-        const verifier = (0, import_utils65.generateCodeVerifier)();
-        const challenge = (0, import_utils65.sha256Base64url)(verifier);
+        const verifier = (0, import_utils66.generateCodeVerifier)();
+        const challenge = (0, import_utils66.sha256Base64url)(verifier);
         const pkce = {
           verifier,
           challenge,
           method: "S256"
         };
-        const providerState = `federated:${session.id}:${(0, import_utils65.randomUUID)()}`;
+        const providerState = `federated:${session.id}:${(0, import_utils66.randomUUID)()}`;
         (0, import_auth24.startNextProvider)(session, pkce, providerState);
         const sessionStore = localAuth.federatedSessionStore;
         if (sessionStore) {
@@ -36181,9 +36531,9 @@ var init_oauth_provider_callback_flow = __esm({
        */
       generateUserSub(email) {
         if (!email) {
-          return `anon:${(0, import_utils65.randomUUID)()}`;
+          return `anon:${(0, import_utils66.randomUUID)()}`;
         }
-        const hash = (0, import_utils65.sha256Base64url)(email.toLowerCase());
+        const hash = (0, import_utils66.sha256Base64url)(email.toLowerCase());
         return `user:${hash.substring(0, 16)}`;
       }
       /**
@@ -36292,12 +36642,12 @@ function extractBearer(headers) {
   const match = /^Bearer\s+(.+)$/i.exec(raw.trim());
   return match ? match[1].trim() : void 0;
 }
-var import_lazy_zod68, import_utils66, inputSchema20, outputSchema19, registrationRequestSchema, stateSchema19, plan19, name19, Stage19, OauthRegisterFlow;
+var import_lazy_zod68, import_utils67, inputSchema20, outputSchema19, registrationRequestSchema, stateSchema19, plan19, name19, Stage19, OauthRegisterFlow;
 var init_oauth_register_flow = __esm({
   "libs/sdk/src/auth/flows/oauth.register.flow.ts"() {
     "use strict";
     import_lazy_zod68 = require("@frontmcp/lazy-zod");
-    import_utils66 = require("@frontmcp/utils");
+    import_utils67 = require("@frontmcp/utils");
     init_common();
     inputSchema20 = httpInputSchema;
     outputSchema19 = HttpJsonSchema;
@@ -36450,10 +36800,10 @@ var init_oauth_register_flow = __esm({
       async registerClient() {
         const now = Math.floor(Date.now() / 1e3);
         const { token_endpoint_auth_method, grant_types, response_types, redirect_uris, client_name, scope } = this.state.required.body;
-        const client_id = (0, import_utils66.randomUUID)();
+        const client_id = (0, import_utils67.randomUUID)();
         let client_secret;
         if (token_endpoint_auth_method === "client_secret_post" || token_endpoint_auth_method === "client_secret_basic") {
-          client_secret = (0, import_utils66.base64urlEncode)((0, import_utils66.randomBytes)(24));
+          client_secret = (0, import_utils67.base64urlEncode)((0, import_utils67.randomBytes)(24));
         }
         this.registered = {
           client_id,
@@ -36560,12 +36910,12 @@ function parseRawTokenBody(raw) {
   }
   return {};
 }
-var import_lazy_zod69, import_utils67, inputSchema21, pkceVerifierRegex, authorizationCodeGrant, refreshTokenGrant, anonymousGrant, tokenRequestSchema, stateSchema20, outputSchema20, plan20, name20, Stage20, OauthTokenFlow;
+var import_lazy_zod69, import_utils68, inputSchema21, pkceVerifierRegex, authorizationCodeGrant, refreshTokenGrant, anonymousGrant, tokenRequestSchema, stateSchema20, outputSchema20, plan20, name20, Stage20, OauthTokenFlow;
 var init_oauth_token_flow = __esm({
   "libs/sdk/src/auth/flows/oauth.token.flow.ts"() {
     "use strict";
     import_lazy_zod69 = require("@frontmcp/lazy-zod");
-    import_utils67 = require("@frontmcp/utils");
+    import_utils68 = require("@frontmcp/utils");
     init_common();
     inputSchema21 = httpInputSchema;
     pkceVerifierRegex = /^[A-Za-z0-9_.~-]{43,128}$/;
@@ -36669,14 +37019,15 @@ var init_oauth_token_flow = __esm({
       async handleAuthorizationCodeGrant() {
         const { body, isDefaultAuthProvider } = this.state.required;
         if (body?.grant_type !== "authorization_code") return;
-        if (isDefaultAuthProvider && body.code === "anonymous") {
+        const authOptions = this.scope.auth?.options;
+        if (isDefaultAuthProvider && body.code === "anonymous" && !!authOptions && (0, import_auth10.allowsPublicAccess)(authOptions)) {
           const localAuth2 = this.scope.auth;
           const accessToken = await localAuth2.signAnonymousJwt();
           this.state.set("tokenResponse", {
             access_token: accessToken,
             token_type: "Bearer",
             expires_in: 86400,
-            refresh_token: (0, import_utils67.randomUUID)()
+            refresh_token: (0, import_utils68.randomUUID)()
           });
           return;
         }
@@ -36707,13 +37058,23 @@ var init_oauth_token_flow = __esm({
         const { body, isDefaultAuthProvider } = this.state.required;
         if (body?.grant_type !== "refresh_token") return;
         if (isDefaultAuthProvider) {
+          const authOptions = this.scope.auth?.options;
+          if (!authOptions || !(0, import_auth10.allowsPublicAccess)(authOptions)) {
+            this.respond(
+              httpRespond.json(
+                { error: "invalid_grant", error_description: "Refresh requires re-authentication on this server" },
+                { status: 400 }
+              )
+            );
+            return;
+          }
           const localAuth2 = this.scope.auth;
           const accessToken = await localAuth2.signAnonymousJwt();
           this.state.set("tokenResponse", {
             access_token: accessToken,
             token_type: "Bearer",
             expires_in: 86400,
-            refresh_token: (0, import_utils67.randomUUID)()
+            refresh_token: (0, import_utils68.randomUUID)()
           });
           return;
         }
@@ -36742,6 +37103,19 @@ var init_oauth_token_flow = __esm({
       }
       async handleAnonymousGrant() {
         const { body } = this.state.required;
+        const authOptions = this.scope.auth?.options;
+        if (!authOptions || !(0, import_auth10.allowsPublicAccess)(authOptions)) {
+          this.respond(
+            httpRespond.json(
+              {
+                error: "unsupported_grant_type",
+                error_description: "Anonymous access is not enabled on this server"
+              },
+              { status: 400 }
+            )
+          );
+          return;
+        }
         if (body?.grant_type === "anonymous" && body.resource) {
           const { request } = this.rawInput;
           const canonicalResource = computeResource(request, this.scope.entryPath, this.scope.routeBase);
@@ -36765,7 +37139,7 @@ var init_oauth_token_flow = __esm({
           access_token: accessToken,
           token_type: "Bearer",
           expires_in: 86400,
-          refresh_token: (0, import_utils67.randomUUID)()
+          refresh_token: (0, import_utils68.randomUUID)()
         });
       }
       async buildTokenResponse() {
@@ -36928,7 +37302,7 @@ var init_oauth_userinfo_flow = __esm({
 });
 
 // libs/sdk/src/auth/flows/session.verify.flow.ts
-var import_reflect_metadata17, import_auth26, import_lazy_zod71, import_utils68, inputSchema23, stateSchema22, UnauthorizedSchema, AuthorizedSchema, ForbiddenSchema, sessionVerifyOutputSchema, plan22, name22, Stage22, SessionVerifyFlow;
+var import_reflect_metadata17, import_auth26, import_lazy_zod71, import_utils69, inputSchema23, stateSchema22, UnauthorizedSchema, AuthorizedSchema, ForbiddenSchema, sessionVerifyOutputSchema, plan22, name22, Stage22, SessionVerifyFlow;
 var init_session_verify_flow = __esm({
   "libs/sdk/src/auth/flows/session.verify.flow.ts"() {
     "use strict";
@@ -36936,7 +37310,7 @@ var init_session_verify_flow = __esm({
     import_reflect_metadata17 = require("reflect-metadata");
     import_auth26 = require("@frontmcp/auth");
     import_lazy_zod71 = require("@frontmcp/lazy-zod");
-    import_utils68 = require("@frontmcp/utils");
+    import_utils69 = require("@frontmcp/utils");
     init_notification_service();
     init_session_id_utils();
     inputSchema23 = httpRequestInputSchema;
@@ -36991,10 +37365,10 @@ var init_session_verify_flow = __esm({
       createAnonymousSession(options) {
         const { authMode, issuer, scopes = ["anonymous"], sessionIdHeader } = options;
         this.logger.verbose("createAnonymousSession", { authMode, hasExistingSession: !!sessionIdHeader });
-        const machineId = (0, import_utils68.getMachineId)();
+        const machineId = (0, import_utils69.getMachineId)();
         if (sessionIdHeader) {
           const existingPayload = decryptPublicSession(sessionIdHeader);
-          const user2 = existingPayload ? { sub: `anon:${existingPayload.iat * 1e3}`, iss: issuer, name: "Anonymous", scope: scopes.join(" ") } : { sub: `anon:${(0, import_utils68.randomUUID)()}`, iss: issuer, name: "Anonymous", scope: scopes.join(" ") };
+          const user2 = existingPayload ? { sub: `anon:${existingPayload.iat * 1e3}`, iss: issuer, name: "Anonymous", scope: scopes.join(" ") } : { sub: `anon:${(0, import_utils69.randomUUID)()}`, iss: issuer, name: "Anonymous", scope: scopes.join(" ") };
           const finalPayload = existingPayload && existingPayload.nodeId === machineId ? existingPayload : void 0;
           this.respond({
             kind: "authorized",
@@ -37011,12 +37385,12 @@ var init_session_verify_flow = __esm({
         }
         const now = Date.now();
         const user = {
-          sub: `anon:${(0, import_utils68.randomUUID)()}`,
+          sub: `anon:${(0, import_utils69.randomUUID)()}`,
           iss: issuer,
           name: "Anonymous",
           scope: scopes.join(" ")
         };
-        const uuid = (0, import_utils68.randomUUID)();
+        const uuid = (0, import_utils69.randomUUID)();
         const platformDetectionConfig = this.scope.metadata.transport?.platformDetection;
         const platformType = detectPlatformFromUserAgent(this.state.userAgent, platformDetectionConfig);
         const payload = {
@@ -37052,7 +37426,7 @@ var init_session_verify_flow = __esm({
         const token = (0, import_auth26.extractBearerToken)(authorizationHeader);
         const userAgent = request.headers?.["user-agent"] ?? void 0;
         const prmMetadataPath = `/.well-known/oauth-protected-resource${entryPath}${routeBase}`;
-        const prmUrl = `${baseUrl}${prmMetadataPath}`;
+        const prmUrl = `${getRequestBaseUrl(request)}${prmMetadataPath}`;
         const prmMetadataHeader = (0, import_auth26.buildUnauthorizedHeader)(prmUrl);
         this.logger.verbose("parseInput", {
           hasAuthHeader: !!authorizationHeader,
@@ -37359,15 +37733,15 @@ function resolveDcrEnabled(auth) {
       return dcr.enabled;
     }
   }
-  return !(0, import_utils69.isProduction)();
+  return !(0, import_utils70.isProduction)();
 }
-var import_reflect_metadata19, import_lazy_zod73, import_utils69, inputSchema25, AuthServerMetadataSchema, outputSchema23, wellKnownAsStateSchema, wellKnownAsPlan, name24, Stage24, WellKnownAsFlow;
+var import_reflect_metadata19, import_lazy_zod73, import_utils70, inputSchema25, AuthServerMetadataSchema, outputSchema23, wellKnownAsStateSchema, wellKnownAsPlan, name24, Stage24, WellKnownAsFlow;
 var init_well_known_oauth_authorization_server_flow = __esm({
   "libs/sdk/src/auth/flows/well-known.oauth-authorization-server.flow.ts"() {
     "use strict";
     import_reflect_metadata19 = require("reflect-metadata");
     import_lazy_zod73 = require("@frontmcp/lazy-zod");
-    import_utils69 = require("@frontmcp/utils");
+    import_utils70 = require("@frontmcp/utils");
     init_common();
     init_sdk_errors();
     inputSchema25 = httpInputSchema;
@@ -37667,13 +38041,19 @@ var init_secure_store = __esm({
 });
 
 // libs/sdk/src/auth/instances/instance.local-primary-auth.ts
-var import_jose, import_auth30, import_utils70, DEFAULT_NO_AUTH_SECRET, RESERVED_JWT_CLAIMS, LocalPrimaryAuth;
+function getDefaultNoAuthSecret() {
+  if (!defaultNoAuthSecret) {
+    defaultNoAuthSecret = (0, import_utils71.randomBytes)(32);
+  }
+  return defaultNoAuthSecret;
+}
+var import_jose, import_auth30, import_utils71, defaultNoAuthSecret, RESERVED_JWT_CLAIMS, LocalPrimaryAuth;
 var init_instance_local_primary_auth = __esm({
   "libs/sdk/src/auth/instances/instance.local-primary-auth.ts"() {
     "use strict";
     import_jose = require("jose");
     import_auth30 = require("@frontmcp/auth");
-    import_utils70 = require("@frontmcp/utils");
+    import_utils71 = require("@frontmcp/utils");
     init_common();
     init_auth2();
     init_context_extension();
@@ -37694,7 +38074,6 @@ var init_instance_local_primary_auth = __esm({
     init_well_known_prm_flow();
     init_secure_store();
     init_secure_store_context_extension();
-    DEFAULT_NO_AUTH_SECRET = (0, import_utils70.randomBytes)(32);
     RESERVED_JWT_CLAIMS = /* @__PURE__ */ new Set([
       "sub",
       "iss",
@@ -37719,14 +38098,14 @@ var init_instance_local_primary_auth = __esm({
         this.providers = providers;
         this.logger = this.providers.getActiveScope().logger.child("LocalPrimaryAuth");
         this.port = this.providers.getActiveScope().metadata.http?.port ?? 3001;
-        this.host = (0, import_utils70.getEnv)("FRONTMCP_PUBLIC_HOST")?.trim() || "localhost";
+        this.host = (0, import_utils71.getEnv)("FRONTMCP_PUBLIC_HOST")?.trim() || "localhost";
         this.issuer = this.deriveIssuer(options);
-        const jwtSecret = (0, import_utils70.getEnv)("JWT_SECRET");
+        const jwtSecret = (0, import_utils71.getEnv)("JWT_SECRET");
         if (jwtSecret) {
           this.secret = new TextEncoder().encode(jwtSecret);
         } else {
           this.logger.warn("JWT_SECRET is not set, using default secret");
-          this.secret = DEFAULT_NO_AUTH_SECRET;
+          this.secret = getDefaultNoAuthSecret();
         }
         this.tokenStorage = this.readTokenStorage(options);
         this.authorizationStoreImpl = new import_auth30.InMemoryAuthorizationStore();
@@ -37743,6 +38122,8 @@ var init_instance_local_primary_auth = __esm({
         }
         this.ready = this.initialize();
       }
+      scope;
+      providers;
       host;
       port;
       issuer;
@@ -37848,7 +38229,7 @@ var init_instance_local_primary_auth = __esm({
         if (dcr && typeof dcr.enabled === "boolean") {
           return dcr.enabled;
         }
-        return !(0, import_utils70.isProduction)();
+        return !(0, import_utils71.isProduction)();
       }
       /** Provider configurations (indexed by provider ID) */
       providerConfigs = /* @__PURE__ */ new Map();
@@ -37955,11 +38336,11 @@ var init_instance_local_primary_auth = __esm({
         if (this.storageAdapter) {
           storage = this.storageAdapter;
         } else {
-          const memory = new import_utils70.MemoryStorageAdapter();
+          const memory = new import_utils71.MemoryStorageAdapter();
           await memory.connect();
           storage = memory;
         }
-        const pepper = (0, import_utils70.getEnv)("VAULT_SECRET") ?? (0, import_utils70.getEnv)("JWT_SECRET") ?? void 0;
+        const pepper = (0, import_utils71.getEnv)("VAULT_SECRET") ?? (0, import_utils71.getEnv)("JWT_SECRET") ?? void 0;
         this.credentialVaultImpl = new import_auth30.SessionCredentialVault({
           storage,
           pepper,
@@ -38010,7 +38391,7 @@ var init_instance_local_primary_auth = __esm({
         }
         const config = this.readSecureStoreConfig();
         const reuseAdapter = this.storageAdapter && this.secureStoreSharesTokenStorage(config) ? this.storageAdapter : void 0;
-        const pepper = (0, import_utils70.getEnv)("VAULT_SECRET") ?? (0, import_utils70.getEnv)("JWT_SECRET") ?? new TextDecoder().decode(this.secret);
+        const pepper = (0, import_utils71.getEnv)("VAULT_SECRET") ?? (0, import_utils71.getEnv)("JWT_SECRET") ?? new TextDecoder().decode(this.secret);
         const resolved = await (0, import_auth30.createSecureStore)({
           config,
           pepper,
@@ -38043,7 +38424,7 @@ var init_instance_local_primary_auth = __esm({
         return false;
       }
       async signAnonymousJwt() {
-        const sub = (0, import_utils70.randomUUID)();
+        const sub = (0, import_utils71.randomUUID)();
         return new import_jose.SignJWT({ sub, role: "user", anonymous: true }).setProtectedHeader({ alg: "HS256", typ: "JWT" }).setIssuedAt().setIssuer(this.issuer).setExpirationTime("1d").sign(this.secret);
       }
       /**
@@ -38116,7 +38497,7 @@ var init_instance_local_primary_auth = __esm({
             }
           }
         }
-        const jwt = new import_jose.SignJWT(claims).setProtectedHeader({ alg: "HS256", typ: "JWT" }).setIssuedAt().setIssuer(this.issuer).setExpirationTime(`${this.accessTokenTtlSeconds}s`).setJti((0, import_utils70.randomUUID)());
+        const jwt = new import_jose.SignJWT(claims).setProtectedHeader({ alg: "HS256", typ: "JWT" }).setIssuedAt().setIssuer(this.issuer).setExpirationTime(`${this.accessTokenTtlSeconds}s`).setJti((0, import_utils71.randomUUID)());
         if (audience) {
           jwt.setAudience(audience);
         }
@@ -38186,7 +38567,7 @@ var init_instance_local_primary_auth = __esm({
             const pendingAuthId = `pending:${codeRecord.pendingAuthId}`;
             const parts = accessToken.split(".");
             const signature = parts[2] || accessToken;
-            const newAuthId = (0, import_utils70.sha256Hex)(signature).substring(0, 16);
+            const newAuthId = (0, import_utils71.sha256Hex)(signature).substring(0, 16);
             await this.orchestratedTokenStore.migrateTokens(pendingAuthId, newAuthId);
             this.logger.info(`Migrated tokens from ${pendingAuthId} to ${newAuthId}`);
           } catch (err) {
@@ -38533,7 +38914,7 @@ var init_instance_local_primary_auth = __esm({
         if (idToken) {
           try {
             const [, payloadB64] = idToken.split(".");
-            const payload = JSON.parse(new TextDecoder().decode((0, import_utils70.base64urlDecode)(payloadB64)));
+            const payload = JSON.parse(new TextDecoder().decode((0, import_utils71.base64urlDecode)(payloadB64)));
             return {
               sub: payload["sub"],
               email: payload["email"],
@@ -38636,6 +39017,8 @@ var init_instance_remote_primary_auth = __esm({
         this.providers = providers;
         this.ready = this.initialize();
       }
+      scope;
+      providers;
       ready;
       jwks = new import_auth32.JwksService();
       fetch(input, init) {
@@ -38890,6 +39273,7 @@ var init_channel_notification_service = __esm({
         this.logger = logger.child("ChannelNotificationService");
         this.defaultMeta = defaultMeta ?? {};
       }
+      notificationService;
       logger;
       defaultMeta;
       /**
@@ -40189,12 +40573,12 @@ var init_complete_flow = __esm({
 });
 
 // libs/sdk/src/elicitation/store/storage-elicitation.store.ts
-var import_utils71, import_utils72, RESOLVED_RESULT_TTL_SECONDS, RESULT_CHANNEL_PREFIX, FALLBACK_RESULT_CHANNEL_PREFIX, StorageElicitationStore;
+var import_utils72, import_utils73, RESOLVED_RESULT_TTL_SECONDS, RESULT_CHANNEL_PREFIX, FALLBACK_RESULT_CHANNEL_PREFIX, StorageElicitationStore;
 var init_storage_elicitation_store = __esm({
   "libs/sdk/src/elicitation/store/storage-elicitation.store.ts"() {
     "use strict";
-    import_utils71 = require("@frontmcp/utils");
     import_utils72 = require("@frontmcp/utils");
+    import_utils73 = require("@frontmcp/utils");
     RESOLVED_RESULT_TTL_SECONDS = 300;
     RESULT_CHANNEL_PREFIX = "result:";
     FALLBACK_RESULT_CHANNEL_PREFIX = "fallback-result:";
@@ -40219,9 +40603,9 @@ var init_storage_elicitation_store = __esm({
       constructor(storage, logger) {
         this.storage = storage;
         this.logger = logger;
-        this.pending = new import_utils71.TypedStorage(storage.namespace("pending"));
-        this.fallback = new import_utils71.TypedStorage(storage.namespace("fallback"));
-        this.resolved = new import_utils71.TypedStorage(storage.namespace("resolved"));
+        this.pending = new import_utils72.TypedStorage(storage.namespace("pending"));
+        this.fallback = new import_utils72.TypedStorage(storage.namespace("fallback"));
+        this.resolved = new import_utils72.TypedStorage(storage.namespace("resolved"));
       }
       // ============================================
       // Pending Elicitation Methods
@@ -40231,7 +40615,7 @@ var init_storage_elicitation_store = __esm({
        */
       async setPending(record) {
         const { sessionId, expiresAt } = record;
-        const ttlSeconds = (0, import_utils72.expiresAtToTTL)(expiresAt);
+        const ttlSeconds = (0, import_utils73.expiresAtToTTL)(expiresAt);
         if (ttlSeconds <= 0) {
           this.logger?.warn("[StorageElicitationStore] Record already expired, not storing", {
             sessionId,
@@ -40409,7 +40793,7 @@ var init_storage_elicitation_store = __esm({
        */
       async setPendingFallback(record) {
         const { elicitId, expiresAt } = record;
-        const ttlSeconds = (0, import_utils72.expiresAtToTTL)(expiresAt);
+        const ttlSeconds = (0, import_utils73.expiresAtToTTL)(expiresAt);
         if (ttlSeconds <= 0) {
           this.logger?.warn("[StorageElicitationStore] Fallback record already expired, not storing", { elicitId });
           return;
@@ -40664,7 +41048,7 @@ var init_storage_elicitation_store = __esm({
 
 // libs/sdk/src/elicitation/store/elicitation-encryption.ts
 function getElicitationSecret() {
-  return (0, import_utils73.getEnv)("MCP_ELICITATION_SECRET") || (0, import_utils73.getEnv)("MCP_SESSION_SECRET") || (0, import_utils73.getEnv)("MCP_SERVER_SECRET") || null;
+  return (0, import_utils74.getEnv)("MCP_ELICITATION_SECRET") || (0, import_utils74.getEnv)("MCP_SESSION_SECRET") || (0, import_utils74.getEnv)("MCP_SERVER_SECRET") || null;
 }
 function isElicitationEncryptionAvailable() {
   return getElicitationSecret() !== null;
@@ -40677,27 +41061,27 @@ async function deriveElicitationKey(sessionId, secret) {
   const ikm = textEncoder.encode(serverSecret + sessionId);
   const salt = textEncoder.encode(ELICITATION_SALT);
   const info = textEncoder.encode(`elicit:${sessionId}`);
-  return (0, import_utils73.hkdfSha256)(ikm, salt, info, 32);
+  return (0, import_utils74.hkdfSha256)(ikm, salt, info, 32);
 }
 async function encryptElicitationData(data, sessionId, secret) {
   const key = await deriveElicitationKey(sessionId, secret);
   const plaintext = textEncoder.encode(JSON.stringify(data));
-  const iv = (0, import_utils73.randomBytes)(12);
-  const { ciphertext, tag } = (0, import_utils73.encryptAesGcm)(key, plaintext, iv);
+  const iv = (0, import_utils74.randomBytes)(12);
+  const { ciphertext, tag } = (0, import_utils74.encryptAesGcm)(key, plaintext, iv);
   return {
     alg: "A256GCM",
-    iv: (0, import_utils73.base64urlEncode)(iv),
-    tag: (0, import_utils73.base64urlEncode)(tag),
-    data: (0, import_utils73.base64urlEncode)(ciphertext)
+    iv: (0, import_utils74.base64urlEncode)(iv),
+    tag: (0, import_utils74.base64urlEncode)(tag),
+    data: (0, import_utils74.base64urlEncode)(ciphertext)
   };
 }
 async function decryptElicitationData(blob, sessionId, secret) {
   try {
     const key = await deriveElicitationKey(sessionId, secret);
-    const iv = (0, import_utils73.base64urlDecode)(blob.iv);
-    const tag = (0, import_utils73.base64urlDecode)(blob.tag);
-    const ciphertext = (0, import_utils73.base64urlDecode)(blob.data);
-    const decrypted = (0, import_utils73.decryptAesGcm)(key, ciphertext, iv, tag);
+    const iv = (0, import_utils74.base64urlDecode)(blob.iv);
+    const tag = (0, import_utils74.base64urlDecode)(blob.tag);
+    const ciphertext = (0, import_utils74.base64urlDecode)(blob.data);
+    const decrypted = (0, import_utils74.decryptAesGcm)(key, ciphertext, iv, tag);
     return JSON.parse(textDecoder.decode(decrypted));
   } catch {
     return null;
@@ -40737,11 +41121,11 @@ async function tryDecryptStoredValue(value, sessionId, secret) {
   }
   return decryptElicitationData(value, sessionId, secret);
 }
-var import_utils73, ELICITATION_SALT, textEncoder, textDecoder;
+var import_utils74, ELICITATION_SALT, textEncoder, textDecoder;
 var init_elicitation_encryption = __esm({
   "libs/sdk/src/elicitation/store/elicitation-encryption.ts"() {
     "use strict";
-    import_utils73 = require("@frontmcp/utils");
+    import_utils74 = require("@frontmcp/utils");
     init_auth_internal_errors();
     ELICITATION_SALT = "elicitation-store-v1";
     textEncoder = new TextEncoder();
@@ -41143,10 +41527,10 @@ var init_encrypted_elicitation_store = __esm({
 
 // libs/sdk/src/elicitation/store/elicitation-store.factory.ts
 function detectStorageType2(storage) {
-  if ((0, import_utils74.getEnv)("UPSTASH_REDIS_REST_URL")) {
+  if ((0, import_utils75.getEnv)("UPSTASH_REDIS_REST_URL")) {
     return "upstash";
   }
-  if ((0, import_utils74.getEnv)("REDIS_URL") || (0, import_utils74.getEnv)("REDIS_HOST")) {
+  if ((0, import_utils75.getEnv)("REDIS_URL") || (0, import_utils75.getEnv)("REDIS_HOST")) {
     return "redis";
   }
   return "memory";
@@ -41232,7 +41616,7 @@ async function createElicitationStore(options = {}) {
       });
     }
   }
-  if (finalStorageConfig?.type === "vercel-kv" || (0, import_utils74.getEnv)("KV_REST_API_URL")) {
+  if (finalStorageConfig?.type === "vercel-kv" || (0, import_utils75.getEnv)("KV_REST_API_URL")) {
     throw new ElicitationNotSupportedError(
       "Vercel KV is not supported for elicitation stores. Elicitation requires pub/sub for cross-node result routing, which Vercel KV does not support. Use Redis or Upstash instead."
     );
@@ -41242,7 +41626,7 @@ async function createElicitationStore(options = {}) {
       "Elicitation requires distributed storage when running on Edge runtime. Edge functions are stateless and cannot use in-memory elicitation. Configure Redis or Upstash storage."
     );
   }
-  const storage = await (0, import_utils74.createStorage)({
+  const storage = await (0, import_utils75.createStorage)({
     ...finalStorageConfig,
     prefix: keyPrefix,
     fallback: isEdgeRuntime2 ? "error" : "memory"
@@ -41280,7 +41664,7 @@ async function createElicitationStore(options = {}) {
 }
 function createMemoryElicitationStore(options = {}) {
   const { keyPrefix = "mcp:elicit:", logger, encryption } = options;
-  const storage = (0, import_utils74.createMemoryStorage)({ prefix: keyPrefix });
+  const storage = (0, import_utils75.createMemoryStorage)({ prefix: keyPrefix });
   let store = new StorageElicitationStore(storage, logger);
   const encryptionEnabled = encryption?.enabled ?? "auto";
   const encryptionSecret = encryption?.secret;
@@ -41336,11 +41720,11 @@ function createSqliteElicitationStore(sqliteConfig, storeOptions = {}) {
     keyPrefix
   });
 }
-var import_utils74;
+var import_utils75;
 var init_elicitation_store_factory = __esm({
   "libs/sdk/src/elicitation/store/elicitation-store.factory.ts"() {
     "use strict";
-    import_utils74 = require("@frontmcp/utils");
+    import_utils75 = require("@frontmcp/utils");
     init_elicitation_error();
     init_elicitation_encryption();
     init_encrypted_elicitation_store();
@@ -41371,12 +41755,12 @@ var init_elicitation2 = __esm({
 });
 
 // libs/sdk/src/elicitation/flows/elicitation-request.flow.ts
-var import_lazy_zod79, import_utils75, inputSchema30, outputSchema28, stateSchema28, plan28, name29, Stage29, ElicitationRequestFlow;
+var import_lazy_zod79, import_utils76, inputSchema30, outputSchema28, stateSchema28, plan28, name29, Stage29, ElicitationRequestFlow;
 var init_elicitation_request_flow = __esm({
   "libs/sdk/src/elicitation/flows/elicitation-request.flow.ts"() {
     "use strict";
     import_lazy_zod79 = require("@frontmcp/lazy-zod");
-    import_utils75 = require("@frontmcp/utils");
+    import_utils76 = require("@frontmcp/utils");
     init_common();
     init_errors();
     init_elicitation_types();
@@ -41459,7 +41843,7 @@ var init_elicitation_request_flow = __esm({
       async generateElicitId() {
         this.logger.verbose("generateElicitId:start");
         const { elicitationId, ttl } = this.state;
-        const elicitId = elicitationId ?? `elicit-${(0, import_utils75.randomUUID)()}`;
+        const elicitId = elicitationId ?? `elicit-${(0, import_utils76.randomUUID)()}`;
         const expiresAt = Date.now() + (ttl ?? DEFAULT_ELICIT_TTL);
         this.state.set({ elicitId, expiresAt });
         this.logger.verbose("generateElicitId:done", { elicitId });
@@ -41776,6 +42160,8 @@ var init_heartbeat_service = __esm({
         this.intervalMs = config?.heartbeatIntervalMs ?? DEFAULT_HA_CONFIG.heartbeatIntervalMs;
         this.ttlMs = config?.heartbeatTtlMs ?? DEFAULT_HA_CONFIG.heartbeatTtlMs;
       }
+      redis;
+      nodeId;
       timer;
       startedAt;
       keyPrefix;
@@ -41855,6 +42241,9 @@ var init_notification_relay = __esm({
         this.keyPrefix = config?.redisKeyPrefix ?? DEFAULT_HA_CONFIG.redisKeyPrefix;
         this.channel = `${this.keyPrefix}notify:${nodeId}`;
       }
+      subscriber;
+      publisher;
+      nodeId;
       handler;
       channel;
       keyPrefix;
@@ -41964,6 +42353,8 @@ var init_ha_manager = __esm({
           this.relay = new NotificationRelay(options.pubsubSubscriber, options.pubsubPublisher, nodeId, this.config);
         }
       }
+      redis;
+      nodeId;
       heartbeat;
       relay;
       config;
@@ -43001,11 +43392,11 @@ var init_workflow_engine = __esm({
 });
 
 // libs/sdk/src/job/execution/job-execution.manager.ts
-var import_utils76, JobExecutionManager;
+var import_utils77, JobExecutionManager;
 var init_job_execution_manager = __esm({
   "libs/sdk/src/job/execution/job-execution.manager.ts"() {
     "use strict";
-    import_utils76 = require("@frontmcp/utils");
+    import_utils77 = require("@frontmcp/utils");
     init_workflow_engine();
     JobExecutionManager = class {
       stateStore;
@@ -43020,7 +43411,7 @@ var init_job_execution_manager = __esm({
        * Execute a job inline (synchronous) or in background.
        */
       async executeJob(job, input, opts = {}) {
-        const runId = (0, import_utils76.randomUUID)();
+        const runId = (0, import_utils77.randomUUID)();
         const retryConfig = job.metadata.retry ?? {};
         const maxAttempts = retryConfig.maxAttempts ?? 1;
         const runRecord = {
@@ -43058,7 +43449,7 @@ var init_job_execution_manager = __esm({
        * Execute a workflow inline or in background.
        */
       async executeWorkflow(workflow, jobRegistry, opts = {}) {
-        const runId = (0, import_utils76.randomUUID)();
+        const runId = (0, import_utils77.randomUUID)();
         const runRecord = {
           runId,
           jobId: workflow.metadata.id ?? workflow.name,
@@ -43466,6 +43857,7 @@ var init_job_instance = __esm({
         super(args);
         this.record = record;
       }
+      record;
       execute(input) {
         return this.record.provide(input, this);
       }
@@ -44634,6 +45026,9 @@ var init_custom_routes_helper = __esm({
         this.reserved = reserved;
         this.name = "ReservedRouteCollisionError";
       }
+      method;
+      path;
+      reserved;
     };
   }
 });
@@ -44878,15 +45273,15 @@ var init_skill_session_types = __esm({
 });
 
 // libs/sdk/src/skill/session/skill-session.manager.ts
-var import_utils77, SkillSessionManager;
+var import_utils78, SkillSessionManager;
 var init_skill_session_manager = __esm({
   "libs/sdk/src/skill/session/skill-session.manager.ts"() {
     "use strict";
-    import_utils77 = require("@frontmcp/utils");
+    import_utils78 = require("@frontmcp/utils");
     init_errors();
     init_skill_session_types();
-    SkillSessionManager = class extends import_utils77.EventEmitter {
-      storage = new import_utils77.AsyncLocalStorage();
+    SkillSessionManager = class extends import_utils78.EventEmitter {
+      storage = new import_utils78.AsyncLocalStorage();
       options;
       logger;
       store;
@@ -46022,11 +46417,11 @@ function createSkillHttpAuthValidator(skillsConfig, logger) {
   }
   return new SkillHttpAuthValidator({ skillsConfig, logger });
 }
-var import_utils78, SkillHttpAuthValidator;
+var import_utils79, SkillHttpAuthValidator;
 var init_skill_http_auth = __esm({
   "libs/sdk/src/skill/auth/skill-http-auth.ts"() {
     "use strict";
-    import_utils78 = require("@frontmcp/utils");
+    import_utils79 = require("@frontmcp/utils");
     SkillHttpAuthValidator = class {
       skillsConfig;
       logger;
@@ -46096,14 +46491,14 @@ var init_skill_http_auth = __esm({
        * This prevents timing attacks that could reveal information about valid API keys.
        */
       timingSafeIncludes(keys, candidate) {
-        const encoder = new TextEncoder();
-        const candidateBytes = encoder.encode(candidate);
+        const encoder2 = new TextEncoder();
+        const candidateBytes = encoder2.encode(candidate);
         let found = false;
         for (const key of keys) {
-          const keyBytes = encoder.encode(key);
+          const keyBytes = encoder2.encode(key);
           if (keyBytes.length === candidateBytes.length) {
             try {
-              if ((0, import_utils78.timingSafeEqual)(keyBytes, candidateBytes)) {
+              if ((0, import_utils79.timingSafeEqual)(keyBytes, candidateBytes)) {
                 found = true;
               }
             } catch {
@@ -48034,6 +48429,7 @@ var init_agent_execution_loop = __esm({
         this.maxIterations = maxIterations;
         this.name = "AgentMaxIterationsError";
       }
+      maxIterations;
     };
   }
 });
@@ -49016,14 +49412,30 @@ var init_decide_request_intent_utils = __esm({
 
 // libs/sdk/src/common/utils/path.utils.ts
 function normalizeEntryPrefix(entryPath) {
-  const t = (0, import_utils79.trimSlashes)(entryPath ?? "");
+  const t = (0, import_utils80.trimSlashes)(entryPath ?? "");
   return t ? `/${t}` : "";
 }
 function normalizeScopeBase(scopeBase) {
-  const t = (0, import_utils79.trimSlashes)(scopeBase ?? "");
+  const t = (0, import_utils80.trimSlashes)(scopeBase ?? "");
   return t ? `/${t}` : "";
 }
+function readPublicUrlPin() {
+  try {
+    if (typeof process !== "undefined" && process.env) {
+      const v = process.env["FRONTMCP_PUBLIC_URL"];
+      if (typeof v === "string" && v.trim()) {
+        return v.trim().replace(/\/+$/, "");
+      }
+    }
+  } catch {
+  }
+  return void 0;
+}
 function getRequestBaseUrl(req, entryPath) {
+  const pin = readPublicUrlPin();
+  if (pin) {
+    return `${pin}${entryPath ?? ""}`;
+  }
   const proto = req.headers["x-forwarded-proto"] || req.protocol || "http";
   const host = req.headers["x-forwarded-host"] || req.headers["host"];
   return `${proto}://${host}${entryPath ?? ""}`;
@@ -49062,22 +49474,22 @@ function resourceUriMatches(provided, canonical) {
 function urlToSafeId(url) {
   const u = new URL(url);
   const raw = (u.host + (u.pathname && u.pathname !== "/" ? u.pathname : "")).replace(/\/+$/, "");
-  return (0, import_utils79.trimSlashes)(raw).replace(/[^a-zA-Z0-9_-]/g, "-");
+  return (0, import_utils80.trimSlashes)(raw).replace(/[^a-zA-Z0-9_-]/g, "-");
 }
 function makeWellKnownPaths(name41, entryPrefix, scopeBase = "") {
   const prefix = normalizeEntryPrefix(entryPrefix);
   const scope = normalizeScopeBase(scopeBase);
-  const reversed = (0, import_utils79.joinPath)(".well-known", name41) + `${prefix}${scope}`;
-  const inPrefixRoot = `${prefix}${(0, import_utils79.joinPath)(".well-known", name41)}${scope}`;
-  const inPrefixScope = `${prefix}${scope}${(0, import_utils79.joinPath)(".well-known", name41)}`;
+  const reversed = (0, import_utils80.joinPath)(".well-known", name41) + `${prefix}${scope}`;
+  const inPrefixRoot = `${prefix}${(0, import_utils80.joinPath)(".well-known", name41)}${scope}`;
+  const inPrefixScope = `${prefix}${scope}${(0, import_utils80.joinPath)(".well-known", name41)}`;
   return /* @__PURE__ */ new Set([reversed, inPrefixRoot, inPrefixScope]);
 }
-var import_utils79, import_utils80;
+var import_utils80, import_utils81;
 var init_path_utils = __esm({
   "libs/sdk/src/common/utils/path.utils.ts"() {
     "use strict";
-    import_utils79 = require("@frontmcp/utils");
     import_utils80 = require("@frontmcp/utils");
+    import_utils81 = require("@frontmcp/utils");
   }
 });
 
@@ -49357,15 +49769,15 @@ async function readSkillFileByPath(instance, filePath) {
   let candidatePath;
   for (const [subdir, configured] of candidateDirs) {
     if (segments[0] !== subdir) continue;
-    const dir = configured ? (0, import_utils82.isAbsolute)(configured) ? configured : (0, import_utils82.pathResolve)(baseDir, configured) : (0, import_utils82.joinPath)(baseDir, subdir);
-    candidatePath = (0, import_utils82.pathResolve)(dir, ...segments.slice(1));
+    const dir = configured ? (0, import_utils83.isAbsolute)(configured) ? configured : (0, import_utils83.pathResolve)(baseDir, configured) : (0, import_utils83.joinPath)(baseDir, subdir);
+    candidatePath = (0, import_utils83.pathResolve)(dir, ...segments.slice(1));
     if (!isInside(candidatePath, dir)) {
       throw new PublicMcpError(`Invalid file path "${filePath}".`, "INVALID_PARAMS", 400);
     }
     break;
   }
   if (!candidatePath) {
-    candidatePath = (0, import_utils82.pathResolve)(baseDir, ...segments);
+    candidatePath = (0, import_utils83.pathResolve)(baseDir, ...segments);
     if (!isInside(candidatePath, baseDir)) {
       throw new PublicMcpError(`Invalid file path "${filePath}".`, "INVALID_PARAMS", 400);
     }
@@ -49373,7 +49785,7 @@ async function readSkillFileByPath(instance, filePath) {
   const mimeType = guessMimeType(filePath);
   let buffer;
   try {
-    buffer = await (0, import_utils82.readFileBuffer)(candidatePath);
+    buffer = await (0, import_utils83.readFileBuffer)(candidatePath);
   } catch (err) {
     if (isFileMissingError(err)) {
       throw new ResourceNotFoundError(`skill://${instance.getSkillPath()}/${filePath}`);
@@ -49416,7 +49828,7 @@ async function tryResolvedSubFile(instance, kind, tail) {
     const resolvedPath = resolveEntryPath(instance, kind, absolutePath, filename);
     if (!resolvedPath) continue;
     try {
-      const buf = await (0, import_utils82.readFileBuffer)(resolvedPath);
+      const buf = await (0, import_utils83.readFileBuffer)(resolvedPath);
       const text = (Buffer.isBuffer(buf) ? buf : Buffer.from(buf)).toString("utf-8");
       return parseSkillMdFrontmatter(text).body;
     } catch (err) {
@@ -49429,18 +49841,18 @@ async function tryResolvedSubFile(instance, kind, tail) {
   return void 0;
 }
 function resolveEntryPath(instance, kind, absolutePath, filename) {
-  if (absolutePath && (0, import_utils82.isAbsolute)(absolutePath)) return absolutePath;
+  if (absolutePath && (0, import_utils83.isAbsolute)(absolutePath)) return absolutePath;
   if (!filename) return void 0;
   const baseDir = instance.getBaseDir();
   const configured = instance.getResources()?.[kind];
   let dir;
-  if (configured && (0, import_utils82.isAbsolute)(configured)) {
+  if (configured && (0, import_utils83.isAbsolute)(configured)) {
     dir = configured;
   } else if (baseDir) {
-    dir = configured ? (0, import_utils82.pathResolve)(baseDir, configured) : (0, import_utils82.joinPath)(baseDir, kind);
+    dir = configured ? (0, import_utils83.pathResolve)(baseDir, configured) : (0, import_utils83.joinPath)(baseDir, kind);
   }
   if (!dir) return void 0;
-  const resolved = (0, import_utils82.pathResolve)(dir, filename);
+  const resolved = (0, import_utils83.pathResolve)(dir, filename);
   if (!isInside(resolved, dir)) return void 0;
   return resolved;
 }
@@ -49472,11 +49884,11 @@ function isInside(child, parent) {
   const parentPrefix = normParent.endsWith("/") ? normParent : `${normParent}/`;
   return normChild === normParent || normChild.startsWith(parentPrefix);
 }
-var import_utils82;
+var import_utils83;
 var init_sep_2640_resource_helpers = __esm({
   "libs/sdk/src/skill/sep-2640/sep-2640.resource-helpers.ts"() {
     "use strict";
-    import_utils82 = require("@frontmcp/utils");
+    import_utils83 = require("@frontmcp/utils");
     init_errors();
     init_skill_md_parser();
   }
@@ -49676,17 +50088,17 @@ async function resolveLastModifiedForSkill(skill) {
     return void 0;
   }
   try {
-    const s = await (0, import_utils83.stat)(record.filePath);
+    const s = await (0, import_utils84.stat)(record.filePath);
     return s.mtime instanceof Date ? s.mtime.toISOString() : void 0;
   } catch {
     return void 0;
   }
 }
-var import_utils83;
+var import_utils84;
 var init_sep_2640_last_modified = __esm({
   "libs/sdk/src/skill/sep-2640/sep-2640.last-modified.ts"() {
     "use strict";
-    import_utils83 = require("@frontmcp/utils");
+    import_utils84 = require("@frontmcp/utils");
   }
 });
 
@@ -49833,7 +50245,7 @@ function createDefaultSigner(mod, logger) {
       "[skill-audit] refusing to use the default HS256 signer in production. Configure skillsConfig.audit.signer with a host-managed key (e.g. RS256 pointing at the same key registry your bundle signing uses)."
     );
   }
-  const bytes = (0, import_utils84.randomBytes)(32);
+  const bytes = (0, import_utils85.randomBytes)(32);
   logger.warn(
     "[skill-audit] no audit signer configured \u2014 using process-local HS256 with a CSPRNG-generated secret. Records signed by this instance cannot be verified after restart. Configure skillsConfig.audit.signer for production."
   );
@@ -49845,12 +50257,12 @@ function createDefaultStore(mod, logger) {
   );
   return new mod.MemoryAuditStore();
 }
-var import_di38, import_utils84, injectedFactory;
+var import_di38, import_utils85, injectedFactory;
 var init_skill_audit_helper = __esm({
   "libs/sdk/src/skill/skill-audit.helper.ts"() {
     "use strict";
     import_di38 = require("@frontmcp/di");
-    import_utils84 = require("@frontmcp/utils");
+    import_utils85 = require("@frontmcp/utils");
   }
 });
 
@@ -49933,6 +50345,8 @@ return 0
         this.haKeyPrefix = options?.haKeyPrefix ?? "mcp:ha:";
         this.logger = options?.logger;
       }
+      redis;
+      machineId;
       keyPrefix;
       ttlSeconds;
       haKeyPrefix;
@@ -50389,11 +50803,11 @@ function createSqliteSessionStore(options, logger) {
   logger?.info("[SessionStoreFactory] Creating SQLite session store", { path: options.path });
   return new SqliteSessionStore(options);
 }
-var import_utils85;
+var import_utils86;
 var init_session_store_factory = __esm({
   "libs/sdk/src/auth/session/session-store.factory.ts"() {
     "use strict";
-    import_utils85 = require("@frontmcp/utils");
+    import_utils86 = require("@frontmcp/utils");
     init_common();
   }
 });
@@ -50426,12 +50840,12 @@ function getQuerySessionId2(urlPath) {
     return void 0;
   }
 }
-var import_lazy_zod100, import_utils86, plan36, stateSessionSchema, stateSchema36, name37, Stage37, HandleSseFlow;
+var import_lazy_zod100, import_utils87, plan36, stateSessionSchema, stateSchema36, name37, Stage37, HandleSseFlow;
 var init_handle_sse_flow = __esm({
   "libs/sdk/src/transport/flows/handle.sse.flow.ts"() {
     "use strict";
     import_lazy_zod100 = require("@frontmcp/lazy-zod");
-    import_utils86 = require("@frontmcp/utils");
+    import_utils87 = require("@frontmcp/utils");
     init_session_id_utils();
     init_common();
     init_errors();
@@ -50522,10 +50936,10 @@ var init_handle_sse_flow = __esm({
         const { request, response } = this.rawInput;
         const { token, session } = this.state.required;
         const transport = await transportService.createTransporter("sse", token, session.id, response);
-        if ((0, import_utils86.getRuntimeContext)().deployment === "distributed") {
-          const nodeId = (0, import_utils86.getMachineId)();
+        if ((0, import_utils87.getRuntimeContext)().deployment === "distributed") {
+          const nodeId = (0, import_utils87.getMachineId)();
           response.setHeader(DEFAULT_FRONTMCP_MACHINE_ID_HEADER, nodeId);
-          const cookie = (0, import_utils86.buildSetCookie)({ name: DEFAULT_FRONTMCP_NODE_COOKIE, value: nodeId }, request);
+          const cookie = (0, import_utils87.buildSetCookie)({ name: DEFAULT_FRONTMCP_NODE_COOKIE, value: nodeId }, request);
           if (cookie) {
             const existing = response.getHeader("Set-Cookie");
             const existingArr = Array.isArray(existing) ? existing : existing ? [String(existing)] : [];
@@ -50547,12 +50961,12 @@ var init_handle_sse_flow = __esm({
         const { request, response } = this.rawInput;
         const { token, session } = this.state.required;
         const transport = await transportService.getTransporter("sse", token, session.id);
-        if (!transport && (0, import_utils86.getRuntimeContext)().deployment === "distributed") {
+        if (!transport && (0, import_utils87.getRuntimeContext)().deployment === "distributed") {
           const storedSession = await transportService.getStoredSession("sse", token, session.id);
           if (storedSession) {
             const haManager = this.scope.haManager;
             const relay = haManager?.getRelay();
-            if (relay && storedSession.session.nodeId && storedSession.session.nodeId !== (0, import_utils86.getMachineId)()) {
+            if (relay && storedSession.session.nodeId && storedSession.session.nodeId !== (0, import_utils87.getMachineId)()) {
               const isAlive2 = await haManager.isNodeAlive(storedSession.session.nodeId);
               if (isAlive2) {
                 try {
@@ -50777,11 +51191,11 @@ var init_ext_apps_types = __esm({
 function createExtAppsMessageHandler(options) {
   return new ExtAppsMessageHandler(options);
 }
-var import_utils87, ExtAppsMessageHandler, ExtAppsError, ExtAppsMethodNotFoundError, ExtAppsInvalidParamsError, ExtAppsNotSupportedError, ExtAppsToolNotFoundError;
+var import_utils88, ExtAppsMessageHandler, ExtAppsError, ExtAppsMethodNotFoundError, ExtAppsInvalidParamsError, ExtAppsNotSupportedError, ExtAppsToolNotFoundError;
 var init_ext_apps_handler = __esm({
   "libs/sdk/src/ext-apps/ext-apps.handler.ts"() {
     "use strict";
-    import_utils87 = require("@frontmcp/utils");
+    import_utils88 = require("@frontmcp/utils");
     init_ext_apps_types();
     ExtAppsMessageHandler = class {
       context;
@@ -50825,7 +51239,7 @@ var init_ext_apps_handler = __esm({
               code: errorCode,
               message: errorMessage,
               // Only include stack traces in development to avoid leaking internals in production
-              data: (0, import_utils87.isDevelopment)() && error instanceof Error ? { stack: error.stack } : void 0
+              data: (0, import_utils88.isDevelopment)() && error instanceof Error ? { stack: error.stack } : void 0
             }
           };
         }
@@ -51187,13 +51601,13 @@ async function lookupStreamableHttpTransport(params) {
   }
   return { kind: "session-not-initialized", recreationError };
 }
-var import_lazy_zod102, import_protocol46, import_utils88, plan38, stateSessionSchema2, stateSchema38, name39, Stage39, HandleStreamableHttpFlow;
+var import_lazy_zod102, import_protocol46, import_utils89, plan38, stateSessionSchema2, stateSchema38, name39, Stage39, HandleStreamableHttpFlow;
 var init_handle_streamable_http_flow = __esm({
   "libs/sdk/src/transport/flows/handle.streamable-http.flow.ts"() {
     "use strict";
     import_lazy_zod102 = require("@frontmcp/lazy-zod");
     import_protocol46 = require("@frontmcp/protocol");
-    import_utils88 = require("@frontmcp/utils");
+    import_utils89 = require("@frontmcp/utils");
     init_session_id_utils();
     init_common();
     init_errors();
@@ -51325,10 +51739,10 @@ var init_handle_streamable_http_flow = __esm({
               return;
             }
           }
-          if ((0, import_utils88.getRuntimeContext)().deployment === "distributed") {
-            const nodeId = (0, import_utils88.getMachineId)();
+          if ((0, import_utils89.getRuntimeContext)().deployment === "distributed") {
+            const nodeId = (0, import_utils89.getMachineId)();
             response.setHeader(DEFAULT_FRONTMCP_MACHINE_ID_HEADER, nodeId);
-            const cookie = (0, import_utils88.buildSetCookie)({ name: DEFAULT_FRONTMCP_NODE_COOKIE, value: nodeId }, request);
+            const cookie = (0, import_utils89.buildSetCookie)({ name: DEFAULT_FRONTMCP_NODE_COOKIE, value: nodeId }, request);
             if (cookie) {
               const existing = response.getHeader("Set-Cookie");
               const existingArr = Array.isArray(existing) ? existing : existing ? [String(existing)] : [];
@@ -51646,21 +52060,21 @@ var init_handle_streamable_http_flow = __esm({
 });
 
 // libs/sdk/src/transport/transport.error.ts
-var import_utils89, JSON_RPC2, rpcError, rpcRequest;
+var import_utils90, JSON_RPC2, rpcError, rpcRequest;
 var init_transport_error = __esm({
   "libs/sdk/src/transport/transport.error.ts"() {
     "use strict";
-    import_utils89 = require("@frontmcp/utils");
+    import_utils90 = require("@frontmcp/utils");
     JSON_RPC2 = "2.0";
     rpcError = (message, requestId) => ({
       jsonrpc: JSON_RPC2,
       error: { code: -32e3, message },
-      id: requestId ?? (0, import_utils89.randomUUID)()
+      id: requestId ?? (0, import_utils90.randomUUID)()
       // change it to request id + random
     });
     rpcRequest = (requestId, method, params) => ({
       jsonrpc: JSON_RPC2,
-      id: requestId ?? (0, import_utils89.randomUUID)(),
+      id: requestId ?? (0, import_utils90.randomUUID)(),
       method,
       ...params !== void 0 && { params }
     });
@@ -51668,14 +52082,14 @@ var init_transport_error = __esm({
 });
 
 // libs/sdk/src/transport/adapters/base-sse-transport.ts
-var import_content_type, import_raw_body, import_protocol47, import_utils90, MAXIMUM_MESSAGE_SIZE, SSEServerTransport;
+var import_content_type, import_raw_body, import_protocol47, import_utils91, MAXIMUM_MESSAGE_SIZE, SSEServerTransport;
 var init_base_sse_transport = __esm({
   "libs/sdk/src/transport/adapters/base-sse-transport.ts"() {
     "use strict";
     import_content_type = __toESM(require("content-type"));
     import_raw_body = __toESM(require("raw-body"));
     import_protocol47 = require("@frontmcp/protocol");
-    import_utils90 = require("@frontmcp/utils");
+    import_utils91 = require("@frontmcp/utils");
     init_transport_errors();
     MAXIMUM_MESSAGE_SIZE = "4mb";
     SSEServerTransport = class {
@@ -51685,9 +52099,11 @@ var init_base_sse_transport = __esm({
       constructor(_endpoint, res, options) {
         this._endpoint = _endpoint;
         this.res = res;
-        this._sessionId = options?.sessionId ?? (0, import_utils90.randomUUID)();
+        this._sessionId = options?.sessionId ?? (0, import_utils91.randomUUID)();
         this._options = options || { enableDnsRebindingProtection: false };
       }
+      _endpoint;
+      res;
       _sseResponse;
       _sessionId;
       _options;
@@ -51932,6 +52348,12 @@ function sanitizeDescription(raw) {
   if (!raw) return "";
   return raw.replace(/\r?\n/g, " ").replace(/\s+/g, " ").replace(/^\s*-{3,}\s*$/g, "").replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\*/g, "\\*").replace(/_/g, "\\_").replace(/\[/g, "\\[").trim();
 }
+function sanitizeName(raw) {
+  if (!raw) return "(unnamed)";
+  const s = raw.replace(/\s+/g, " ").trim();
+  if (!s) return "(unnamed)";
+  return s.length > MAX_SKILL_NAME_CHARS ? `${s.slice(0, MAX_SKILL_NAME_CHARS)}\u2026` : s;
+}
 function buildSkillsCatalogSummary(skillRegistry) {
   if (!skillRegistry) return "";
   const skills = skillRegistry.getSkills({ visibility: "mcp" });
@@ -51943,7 +52365,7 @@ function buildSkillsCatalogSummary(skillRegistry) {
   const effectiveCap = MAX_SKILL_CATALOG_CHARS - TRUNCATION_FOOTER_RESERVE;
   for (const skill of skills) {
     const meta = skill.metadata;
-    const name41 = meta.name;
+    const name41 = sanitizeName(meta.name);
     const description = sanitizeDescription(meta.description);
     const line = description ? `- **${name41}**: ${description}` : `- **${name41}**`;
     if (charCount + line.length + 1 > effectiveCap) {
@@ -51988,13 +52410,14 @@ function buildChannelInstructions(channels) {
 function joinSections(sections) {
   return sections.map((s) => (s ?? "").trim()).filter((s) => s.length > 0).join("\n\n---\n\n");
 }
-var DEFAULT_POLICY, MAX_SKILL_CATALOG_CHARS, TRUNCATION_FOOTER_RESERVE, CATALOG_HEADER;
+var DEFAULT_POLICY, MAX_SKILL_CATALOG_CHARS, TRUNCATION_FOOTER_RESERVE, MAX_SKILL_NAME_CHARS, CATALOG_HEADER;
 var init_skill_instructions_helper = __esm({
   "libs/sdk/src/skill/skill-instructions.helper.ts"() {
     "use strict";
     DEFAULT_POLICY = "append";
     MAX_SKILL_CATALOG_CHARS = 16e3;
     TRUNCATION_FOOTER_RESERVE = 160;
+    MAX_SKILL_NAME_CHARS = 80;
     CATALOG_HEADER = "Available skills (read the `skills://catalog` resource to browse, or `skills://{name}/SKILL.md` for full content):";
   }
 });
@@ -52043,6 +52466,9 @@ var init_transport_local_adapter = __esm({
         this.transport = this.createTransport(key.sessionId, res);
         this.ready = this.connectServer();
       }
+      scope;
+      key;
+      onDispose;
       logger;
       transport;
       /**
@@ -52963,6 +53389,7 @@ var init_transport_local = __esm({
             throw new UnsupportedTransportTypeError(this.type);
         }
       }
+      onDispose;
       type;
       tokenHash;
       sessionId;
@@ -53032,6 +53459,8 @@ var init_transport_remote = __esm({
         this.tokenHash = key.tokenHash;
         this.sessionId = key.sessionId;
       }
+      key;
+      bus;
       type;
       tokenHash;
       sessionId;
@@ -53061,11 +53490,11 @@ var init_transport_remote = __esm({
 });
 
 // libs/sdk/src/transport/transport.registry.ts
-var import_utils91, TransportService;
+var import_utils92, TransportService;
 var init_transport_registry = __esm({
   "libs/sdk/src/transport/transport.registry.ts"() {
     "use strict";
-    import_utils91 = require("@frontmcp/utils");
+    import_utils92 = require("@frontmcp/utils");
     init_session_store_factory();
     init_transport_errors();
     init_handle_sse_flow();
@@ -53350,7 +53779,7 @@ var init_transport_registry = __esm({
           protocol: storedSession.session.protocol,
           createdAt: storedSession.createdAt
         });
-        const currentNodeId = (0, import_utils91.getMachineId)();
+        const currentNodeId = (0, import_utils92.getMachineId)();
         if (this.scope.haManager && storedSession.session.nodeId && storedSession.session.nodeId !== currentNodeId) {
           const sessionKey = `${this.transportKeyPrefix}${sessionId}`;
           const result = await this.scope.haManager.attemptTakeover(sessionKey, storedSession.session.nodeId);
@@ -53445,7 +53874,7 @@ var init_transport_registry = __esm({
               authorizationId: key.tokenHash,
               protocol: type === "sse" ? "sse" : "streamable-http",
               createdAt: Date.now(),
-              nodeId: (0, import_utils91.getMachineId)()
+              nodeId: (0, import_utils92.getMachineId)()
             },
             authorizationId: key.tokenHash,
             createdAt: Date.now(),
@@ -53591,7 +54020,7 @@ var init_transport_registry = __esm({
       }
       /* --------------------------------- internals -------------------------------- */
       sha256(value) {
-        return (0, import_utils91.sha256Hex)(value);
+        return (0, import_utils92.sha256Hex)(value);
       }
       /**
        * Create a history key from components.
@@ -53697,14 +54126,83 @@ var init_transport_registry = __esm({
   }
 });
 
+// libs/sdk/src/transport/web-standard-mcp.ts
+var web_standard_mcp_exports = {};
+__export(web_standard_mcp_exports, {
+  buildPersistentWebStandardMcp: () => buildPersistentWebStandardMcp,
+  runWebStandardMcp: () => runWebStandardMcp
+});
+async function wireServer(scope, serverOptions, sessionId, sessionIdGenerator, enableJsonResponse) {
+  const { McpServer: McpServer2, WebStandardStreamableHTTPServerTransport: WebStandardStreamableHTTPServerTransport2 } = await import("@frontmcp/protocol");
+  const { createMcpHandlers: createMcpHandlers2 } = await Promise.resolve().then(() => (init_mcp_handlers(), mcp_handlers_exports));
+  const mcpServer = new McpServer2(scope.metadata.info, serverOptions);
+  for (const handler of createMcpHandlers2({ scope, serverOptions })) {
+    const originalHandler = handler.handler;
+    const wrappedHandler = async (req, ctx) => {
+      const existingAuthInfo = ctx?.["authInfo"] ?? {};
+      const enrichedCtx = { ...ctx, authInfo: { ...existingAuthInfo, sessionId } };
+      return originalHandler(req, enrichedCtx);
+    };
+    mcpServer.setRequestHandler(handler.requestSchema, wrappedHandler);
+  }
+  const transport = new WebStandardStreamableHTTPServerTransport2({ sessionIdGenerator, enableJsonResponse });
+  await mcpServer.connect(transport);
+  return { mcpServer, transport };
+}
+async function buildPersistentWebStandardMcp(scope, options) {
+  const serverOptions = buildScopedServerOptions(scope);
+  return wireServer(scope, serverOptions, options.sessionId, () => options.sessionId, false);
+}
+async function runWebStandardMcp(scope, request, options) {
+  if (options.persistent) {
+    return options.persistent.transport.handleRequest(request, { authInfo: options.authInfo });
+  }
+  const sessionId = `web:${(0, import_utils93.randomUUID)()}`;
+  const accept = request.headers.get("accept") ?? "";
+  const wantsStream = request.method === "GET" || options.sse && accept.includes("text/event-stream");
+  const { mcpServer, transport } = await wireServer(
+    scope,
+    options.serverOptions,
+    sessionId,
+    void 0,
+    !wantsStream
+  );
+  const response = await transport.handleRequest(request, {
+    authInfo: options.authInfo
+  });
+  if (response.headers.get("content-type")?.includes("text/event-stream")) {
+    const closed = new Promise((resolve) => {
+      const prev = transport.onclose;
+      transport.onclose = () => {
+        prev?.();
+        resolve();
+      };
+    });
+    const teardown = closed.then(() => mcpServer.close().catch(() => void 0));
+    if (options.ctx?.waitUntil) options.ctx.waitUntil(teardown);
+    else void teardown;
+  } else {
+    void mcpServer.close().catch(() => void 0);
+  }
+  return response;
+}
+var import_utils93;
+var init_web_standard_mcp = __esm({
+  "libs/sdk/src/transport/web-standard-mcp.ts"() {
+    "use strict";
+    import_utils93 = require("@frontmcp/utils");
+    init_build_scoped_server_options();
+  }
+});
+
 // libs/sdk/src/scope/flows/http.request.flow.ts
-var import_auth38, import_lazy_zod105, import_utils92, plan39, httpRequestStateSchema, name40, Stage40, HttpRequestFlow;
+var import_auth38, import_lazy_zod105, import_utils94, plan39, httpRequestStateSchema, name40, Stage40, HttpRequestFlow;
 var init_http_request_flow = __esm({
   "libs/sdk/src/scope/flows/http.request.flow.ts"() {
     "use strict";
     import_auth38 = require("@frontmcp/auth");
     import_lazy_zod105 = require("@frontmcp/lazy-zod");
-    import_utils92 = require("@frontmcp/utils");
+    import_utils94 = require("@frontmcp/utils");
     init_session_verify_flow();
     init_common();
     init_errors();
@@ -53720,6 +54218,11 @@ var init_http_request_flow = __esm({
         "router"
       ],
       execute: [
+        // Web-fetch (V8-isolate / Cloudflare Worker) MCP handling. Runs FIRST and,
+        // in web mode only, responds with a Web `Response` (short-circuiting the
+        // Node handle stages below). On the Node/Express path it's a no-op and falls
+        // through to the runtime-coupled stages.
+        "handleWebFetch",
         "handleLegacySse",
         "handleSse",
         "handleStreamableHttp",
@@ -53762,7 +54265,7 @@ var init_http_request_flow = __esm({
         const { request } = this.rawInput;
         this.requestStartTime = Date.now();
         const ctx = this.tryGetContext();
-        this.requestId = ctx?.requestId ?? `req-${(0, import_utils92.randomUUID)()}`;
+        this.requestId = ctx?.requestId ?? `req-${(0, import_utils94.randomUUID)()}`;
         const headers = request.headers ?? {};
         const body = request.body;
         const userAgent = headers["user-agent"];
@@ -53921,6 +54424,10 @@ var init_http_request_flow = __esm({
             accept: request.headers?.["accept"]
           });
           const decision = decideIntent(request, { ...legacyFlags, tolerateMissingAccept: true });
+          const isWebMode = !!request[ServerRequestTokens.webRequest];
+          if (isWebMode && decision.intent === "unknown") {
+            decision.intent = "stateless-http";
+          }
           this.logger.debug(`[${this.requestId}] decision result`, {
             intent: decision.intent,
             reasons: decision.reasons,
@@ -54047,6 +54554,47 @@ var init_http_request_flow = __esm({
           throw error;
         }
       }
+      async handleWebFetch() {
+        const { request } = this.rawInput;
+        const req = request;
+        const webRequest = req[ServerRequestTokens.webRequest];
+        if (!webRequest) return;
+        try {
+          const webCtx = req[ServerRequestTokens.webCtx];
+          const { runWebStandardMcp: runWebStandardMcp2 } = await Promise.resolve().then(() => (init_web_standard_mcp(), web_standard_mcp_exports));
+          const { buildScopedServerOptions: buildScopedServerOptions2 } = await Promise.resolve().then(() => (init_build_scoped_server_options(), build_scoped_server_options_exports));
+          const { expandProtocolConfig: expandProtocolConfig2 } = await Promise.resolve().then(() => (init_schema7(), schema_exports));
+          const scope = this.scope;
+          const proto = expandProtocolConfig2(scope.metadata.transport?.protocol);
+          const sse = proto.streamable && !proto.json;
+          const authorization = req[ServerRequestTokens.auth];
+          const authInfo = authorization ? {
+            token: authorization.token,
+            clientId: authorization.user?.sub,
+            scopes: [],
+            expiresAt: authorization.user?.exp ? authorization.user.exp * 1e3 : void 0,
+            extra: {
+              user: authorization.user,
+              sessionId: authorization.session?.id,
+              sessionPayload: authorization.session?.payload
+            }
+          } : void 0;
+          const persistent = req[ServerRequestTokens.webTransport];
+          const response = await runWebStandardMcp2(scope, webRequest, {
+            serverOptions: buildScopedServerOptions2(scope),
+            authInfo,
+            sse,
+            ctx: webCtx,
+            persistent
+          });
+          this.respond(httpRespond.webResponse(response));
+        } catch (error) {
+          if (!(error instanceof FlowControl)) {
+            this.logError(error, "handleWebFetch");
+          }
+          throw error;
+        }
+      }
       async handleLegacySse() {
         try {
           const response = await this.scope.runFlow("handle:legacy-sse", this.rawInput);
@@ -54216,6 +54764,9 @@ var init_http_request_flow = __esm({
     __decorateClass([
       Stage40("router")
     ], HttpRequestFlow.prototype, "router", 1);
+    __decorateClass([
+      Stage40("handleWebFetch")
+    ], HttpRequestFlow.prototype, "handleWebFetch", 1);
     __decorateClass([
       Stage40("handleLegacySse", {
         filter: ({
@@ -54288,31 +54839,14 @@ var init_http_request_flow = __esm({
   }
 });
 
-// libs/sdk/src/scope/optional-dependency.util.ts
-function probeOptionalDependency(moduleName, loadError, resolve) {
-  let resolvedPath;
-  try {
-    resolvedPath = resolve(moduleName);
-  } catch {
-    resolvedPath = void 0;
-  }
-  const error = loadError instanceof Error ? loadError.message : String(loadError);
-  return resolvedPath ? { status: "load-failed", resolvedPath, error } : { status: "not-installed", error };
-}
-var init_optional_dependency_util = __esm({
-  "libs/sdk/src/scope/optional-dependency.util.ts"() {
-    "use strict";
-  }
-});
-
 // libs/sdk/src/scope/scope.instance.ts
-var import_reflect_metadata25, import_guard6, import_utils93, Scope;
+var import_reflect_metadata25, import_guard6, import_utils95, SCOPE_NON_DISPATCHABLE_FLOWS, Scope;
 var init_scope_instance = __esm({
   "libs/sdk/src/scope/scope.instance.ts"() {
     "use strict";
     import_reflect_metadata25 = require("reflect-metadata");
     import_guard6 = require("@frontmcp/guard");
-    import_utils93 = require("@frontmcp/utils");
+    import_utils95 = require("@frontmcp/utils");
     init_agent_registry();
     init_call_agent_flow();
     init_app_registry();
@@ -54355,6 +54889,7 @@ var init_scope_instance = __esm({
     init_transport_registry();
     init_http_request_flow();
     init_optional_dependency_util();
+    SCOPE_NON_DISPATCHABLE_FLOWS = /* @__PURE__ */ new Set(["http:request"]);
     Scope = class _Scope extends ScopeEntry {
       id;
       globalProviders;
@@ -54440,7 +54975,7 @@ var init_scope_instance = __esm({
         await this.scopeProviders.ready;
         const scopeRef = { kind: "scope", id: this.id, ref: _Scope };
         const scopeProviders = this.scopeProviders;
-        const perf = (0, import_utils93.getEnvFlag)("FRONTMCP_PERF");
+        const perf = (0, import_utils95.getEnvFlag)("FRONTMCP_PERF");
         const t0 = perf ? performance.now() : 0;
         const mark = perf ? (label) => this.logger.info(`[PERF] ${label}: ${(performance.now() - t0).toFixed(1)}ms`) : () => {
         };
@@ -54450,13 +54985,13 @@ var init_scope_instance = __esm({
         this.scopeApps = new AppRegistry(this.scopeProviders, this.metadata.apps, scopeRef);
         this.logger.info(`Initializing ${this.metadata.apps.length} app(s)...`);
         const transportConfig = this.metadata.transport;
-        const isDistributed = (0, import_utils93.getRuntimeContext)().deployment === "distributed";
+        const isDistributed = (0, import_utils95.getRuntimeContext)().deployment === "distributed";
         if (isDistributed && this.metadata.redis && !this.cliMode) {
           try {
             const haRedis = this.metadata.redis;
             this.haManager = HaManager.create({
               redis: haRedis,
-              nodeId: (0, import_utils93.getMachineId)(),
+              nodeId: (0, import_utils95.getMachineId)(),
               logger: this.logger
             });
             await this.haManager.start();
@@ -54467,7 +55002,7 @@ var init_scope_instance = __esm({
         }
         let transportBus;
         if (this.haManager && isDistributed && this.metadata.redis) {
-          transportBus = new RedisTransportBus(this.metadata.redis, (0, import_utils93.getMachineId)(), {
+          transportBus = new RedisTransportBus(this.metadata.redis, (0, import_utils95.getMachineId)(), {
             logger: this.logger
           });
           this.logger.info("[HA] Transport bus created for distributed session routing");
@@ -54490,7 +55025,7 @@ var init_scope_instance = __esm({
             }
           });
         }
-        if ((0, import_utils93.getRuntimeContext)().deployment === "serverless") {
+        if ((0, import_utils95.getRuntimeContext)().deployment === "serverless") {
           const protocolCfg = transportConfig?.protocol;
           const hasSSE = typeof protocolCfg === "string" ? protocolCfg !== "stateless-api" : protocolCfg?.sse === true;
           if (hasSSE) {
@@ -54517,7 +55052,7 @@ var init_scope_instance = __esm({
             sqlite: elicitationSqlite,
             keyPrefix: elicitationRedis?.keyPrefix ?? "mcp:elicit:",
             logger: this.logger,
-            isEdgeRuntime: (0, import_utils93.isEdgeRuntime)()
+            isEdgeRuntime: (0, import_utils95.isEdgeRuntime)()
           });
           this._elicitationStore = elicitStore;
           this.elicitationBackendType = elicitType;
@@ -54533,7 +55068,7 @@ var init_scope_instance = __esm({
         const tasksPromise = shouldInitTasks ? (async () => {
           const tasksRedis = tasksConfig?.redis ?? this.metadata.redis;
           const tasksSqlite = tasksConfig?.sqlite ?? (tasksRedis ? void 0 : resolvedTopLevelSqlite);
-          const onEdge = (0, import_utils93.isEdgeRuntime)();
+          const onEdge = (0, import_utils95.isEdgeRuntime)();
           if (onEdge) {
             const msg = "[tasks] Background tasks are enabled on an edge/serverless runtime. The in-process runner cannot continue past the HTTP response on this platform \u2014 task bodies will not execute. Run on a long-lived Node process, or set `tasks.enabled: false`.";
             if (tasksConfig?.strict) {
@@ -54748,7 +55283,9 @@ var init_scope_instance = __esm({
         this.scopeResources = new ResourceRegistry(this.scopeProviders, [], scopeRef);
         this.scopePrompts = new PromptRegistry(this.scopeProviders, [], scopeRef);
         this.scopeAgents = new AgentRegistry(this.scopeProviders, [], scopeRef);
-        this.scopeSkills = new SkillRegistry(this.scopeProviders, this.metadata.skills ?? [], scopeRef);
+        this.scopeSkills = new SkillRegistry(this.scopeProviders, this.metadata.skills ?? [], scopeRef, {
+          ...this.metadata.skillsConfig?.scoring ? { scoring: this.metadata.skillsConfig.scoring } : {}
+        });
         await Promise.all([
           this.scopeTools.ready,
           this.scopeResources.ready,
@@ -55509,6 +56046,16 @@ var init_scope_instance = __esm({
       runFlow(name41, input, deps) {
         return this.scopeFlows.runFlow(name41, input, deps);
       }
+      /**
+       * Find the registered flow that handles this HTTP request (by method +
+       * `middleware.path` + `canActivate`), excluding `http:request` (which the
+       * web-fetch handler runs directly for the MCP entry path). Lets the
+       * Worker/web-fetch adapter dispatch auth/well-known/oauth flows the same way
+       * the Express host routes them — without a middleware server.
+       */
+      async findHttpFlowName(request) {
+        return this.scopeFlows.findHttpFlowName(request, SCOPE_NON_DISPATCHABLE_FLOWS);
+      }
       async runFlowForOutput(name41, input, deps) {
         const result = await this.scopeFlows.runFlow(name41, input, deps);
         if (result) {
@@ -55585,6 +56132,7 @@ var init_provider_registry = __esm({
         this.topoSort();
         this.ready = this.initialize();
       }
+      parentProviders;
       /** used to track which registry provided which token */
       providedBy;
       /** topo order (deps first) */
@@ -56538,6 +57086,292 @@ var init_scope_registry = __esm({
   }
 });
 
+// libs/sdk/src/transport/web-response.renderer.ts
+function toByteStream(streamLike) {
+  const iter = streamLike[Symbol.asyncIterator];
+  if (typeof iter !== "function") {
+    return new ReadableStream({ start: (c) => c.close() });
+  }
+  const it = iter.call(streamLike);
+  return new ReadableStream({
+    async pull(controller) {
+      const { value, done } = await it.next();
+      if (done) {
+        controller.close();
+        return;
+      }
+      controller.enqueue(typeof value === "string" ? encoder.encode(value) : value);
+    },
+    async cancel() {
+      await it.return?.(void 0);
+    }
+  });
+}
+function bytesFrom(body, encoding) {
+  if (typeof body !== "string") return body;
+  if (encoding === "base64") return Uint8Array.from(atob(body), (c) => c.charCodeAt(0));
+  if (encoding === "hex") {
+    if (body.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(body)) {
+      throw new TypeError("Invalid hex-encoded body");
+    }
+    const out = new Uint8Array(body.length / 2);
+    for (let i = 0; i < out.length; i++) out[i] = parseInt(body.slice(i * 2, i * 2 + 2), 16);
+    return out;
+  }
+  return encoder.encode(body);
+}
+function buildHeaders(out, contentType2) {
+  const headers = new Headers();
+  if (contentType2) headers.set("Content-Type", contentType2);
+  const extra = out["headers"];
+  if (extra) for (const [k, v] of Object.entries(extra)) headers.set(k, v);
+  const cookies = out["cookies"];
+  if (Array.isArray(cookies)) for (const c of cookies) headers.append("Set-Cookie", c);
+  return headers;
+}
+function renderHttpOutputToWebResponse(output) {
+  const out = output;
+  switch (out.kind) {
+    // Already a Web Response (the MCP execute stage on a worker) — return verbatim.
+    case "web-response":
+      return out.response;
+    // "no response" — let the adapter fall through (404 / next middleware).
+    case "next":
+    case "consumed":
+      return void 0;
+    case "redirect": {
+      const headers = buildHeaders(out);
+      headers.set("Location", out.location);
+      return new Response(null, { status: out.status, headers });
+    }
+    case "json":
+    case "jsonrpc":
+    case "problem":
+      return new Response(JSON.stringify(out.body), { status: out.status, headers: buildHeaders(out, out.contentType) });
+    case "text":
+    case "html":
+      return new Response(out.body, { status: out.status, headers: buildHeaders(out, out.contentType) });
+    case "binary":
+    case "image": {
+      const headers = buildHeaders(out, out.contentType);
+      headers.set(
+        "Content-Disposition",
+        out.filename ? `${out.disposition}; filename="${out.filename}"` : out.disposition
+      );
+      return new Response(bytesFrom(out.body, out.encoding), { status: out.status, headers });
+    }
+    case "stream":
+    case "sse": {
+      const headers = buildHeaders(out, out.contentType);
+      if (out.kind === "sse" && !headers.has("Cache-Control")) headers.set("Cache-Control", "no-cache");
+      return new Response(toByteStream(out.stream), { status: out.status, headers });
+    }
+    case "empty":
+      return new Response(null, { status: out.status, headers: buildHeaders(out) });
+    default:
+      return void 0;
+  }
+}
+var encoder;
+var init_web_response_renderer = __esm({
+  "libs/sdk/src/transport/web-response.renderer.ts"() {
+    "use strict";
+    encoder = new TextEncoder();
+  }
+});
+
+// libs/sdk/src/transport/web-fetch-handler.ts
+function mapHttpCors(httpCors, scope) {
+  if (!httpCors) return void 0;
+  const { origin, credentials, maxAge } = httpCors;
+  if (typeof origin === "function") {
+    scope.logger.warn(
+      "[web-fetch] http.cors.origin is a function, which the worker adapter cannot replay \u2014 CORS left disabled. Use a static origin (true / string / string[])."
+    );
+    return void 0;
+  }
+  return { origin, credentials, maxAge };
+}
+function createWebFetchHandler(scope, options = {}) {
+  const httpConfig = scope.metadata.http;
+  const healthPaths = new Set(options.healthPaths ?? ["/healthz", "/readyz"]);
+  const normalizePath = (p) => {
+    const withSlash = p.startsWith("/") ? p : `/${p}`;
+    let end = withSlash.length;
+    while (end > 1 && withSlash.charCodeAt(end - 1) === 47) end--;
+    return withSlash.slice(0, end);
+  };
+  const rawEntry = options.entryPath ?? (normalizeEntryPrefix(httpConfig?.entryPath) || "/");
+  const entryPaths = new Set((Array.isArray(rawEntry) ? rawEntry : [rawEntry]).map(normalizePath));
+  const cors2 = options.cors ?? mapHttpCors(httpConfig?.cors, scope);
+  const corsEnabled = cors2?.origin !== void 0 && cors2.origin !== false;
+  const corsHeadersFor = (request) => {
+    if (!corsEnabled) return {};
+    const reqOrigin = request.headers.get("origin") ?? "";
+    let allowOrigin;
+    if (cors2.origin === true) allowOrigin = reqOrigin || "*";
+    else if (cors2.origin === "*" || cors2.origin === reqOrigin) allowOrigin = cors2.origin;
+    else if (typeof cors2.origin === "string") allowOrigin = cors2.origin;
+    else if (Array.isArray(cors2.origin)) allowOrigin = cors2.origin.includes(reqOrigin) ? reqOrigin : void 0;
+    if (!allowOrigin) return {};
+    const h2 = {
+      "Access-Control-Allow-Origin": allowOrigin,
+      "Access-Control-Allow-Methods": (cors2.methods ?? ["GET", "POST", "OPTIONS", "DELETE"]).join(", "),
+      "Access-Control-Allow-Headers": (cors2.headers ?? [
+        request.headers.get("access-control-request-headers") || "content-type, authorization, mcp-session-id, mcp-protocol-version, last-event-id"
+      ]).join(", "),
+      "Access-Control-Expose-Headers": (cors2.exposeHeaders ?? ["Mcp-Session-Id", "WWW-Authenticate"]).join(", ")
+    };
+    if (cors2.credentials) h2["Access-Control-Allow-Credentials"] = "true";
+    if (cors2.maxAge !== void 0) h2["Access-Control-Max-Age"] = String(cors2.maxAge);
+    if (allowOrigin !== "*") h2["Vary"] = "Origin";
+    return h2;
+  };
+  const withCors = (response, request) => {
+    if (!corsEnabled) return response;
+    const headers = new Headers(response.headers);
+    for (const [k, v] of Object.entries(corsHeadersFor(request))) headers.set(k, v);
+    return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+  };
+  return async function handle(request, ctx, env) {
+    const url = new URL(request.url);
+    if (corsEnabled && request.method === "OPTIONS") {
+      return new Response(null, { status: 204, headers: corsHeadersFor(request) });
+    }
+    if (healthPaths.has(url.pathname)) {
+      return withCors(
+        Response.json(
+          { status: "ok", server: scope.metadata.info, transport: "web-fetch" },
+          { headers: { "Cache-Control": "no-store" } }
+        ),
+        request
+      );
+    }
+    if (!entryPaths.has(normalizePath(url.pathname))) {
+      const authResponse = await runMatchingHttpFlowWeb(scope, request);
+      if (authResponse) return withCors(authResponse, request);
+      return withCors(Response.json({ error: "Not Found", entryPaths: [...entryPaths] }, { status: 404 }), request);
+    }
+    if (options.sessionRouter) {
+      const routed = await options.sessionRouter(request, env, ctx);
+      if (routed) return withCors(routed, request);
+    }
+    const rendered = await runHttpRequestFlowWeb(scope, request, { ctx });
+    return withCors(rendered ?? Response.json({ error: "Not Found" }, { status: 404 }), request);
+  };
+}
+async function runHttpRequestFlowWeb(scope, request, opts = {}) {
+  const url = new URL(request.url);
+  const serverRequest = await toServerRequest(request, url, opts.ctx, opts.persistent);
+  let output;
+  try {
+    output = await scope.runFlow("http:request", {
+      request: serverRequest,
+      response: {}
+    });
+  } catch (error) {
+    output = flowErrorToHttpOutput(error);
+  }
+  return output ? renderHttpOutputToWebResponse(output) : void 0;
+}
+async function runMatchingHttpFlowWeb(scope, request) {
+  const url = new URL(request.url);
+  const serverRequest = await toServerRequest(request, url);
+  const flowName = await scope.findHttpFlowName(serverRequest);
+  if (!flowName) return void 0;
+  let output;
+  try {
+    output = await scope.runFlow(flowName, {
+      request: serverRequest,
+      response: {}
+    });
+  } catch (error) {
+    output = flowErrorToHttpOutput(error);
+  }
+  return output ? renderHttpOutputToWebResponse(output) : void 0;
+}
+async function toServerRequest(request, url, ctx, persistent) {
+  const headers = {};
+  request.headers.forEach((v, k) => {
+    headers[k] = v;
+  });
+  const query = {};
+  url.searchParams.forEach((v, k) => {
+    const existing = query[k];
+    if (existing === void 0) query[k] = v;
+    else if (Array.isArray(existing)) existing.push(v);
+    else query[k] = [existing, v];
+  });
+  const method = request.method.toUpperCase();
+  const hasBody = method !== "GET" && method !== "HEAD";
+  let rawBody = "";
+  if (hasBody) {
+    try {
+      rawBody = await request.text();
+    } catch {
+      rawBody = "";
+    }
+  }
+  let body;
+  if (rawBody) {
+    try {
+      body = JSON.parse(rawBody);
+    } catch {
+      body = rawBody;
+    }
+  }
+  const init = { method: request.method, headers: request.headers };
+  if (rawBody) init.body = rawBody;
+  const webRequest = new Request(url.toString(), init);
+  const serverRequest = {
+    method,
+    path: url.pathname,
+    url: url.pathname + url.search,
+    headers,
+    query,
+    body
+  };
+  const tokenized = serverRequest;
+  tokenized[ServerRequestTokens.webRequest] = webRequest;
+  tokenized[ServerRequestTokens.webCtx] = ctx;
+  if (persistent) tokenized[ServerRequestTokens.webTransport] = persistent;
+  return serverRequest;
+}
+function flowErrorToHttpOutput(error) {
+  if (error instanceof FlowControl) {
+    switch (error.type) {
+      case "respond":
+        return error.output;
+      case "next":
+      case "handled":
+        return void 0;
+      default:
+        return { kind: "text", status: 500, body: "Internal Server Error", contentType: "text/plain; charset=utf-8" };
+    }
+  }
+  if (error instanceof PublicMcpError) {
+    const challenge = error.wwwAuthenticate;
+    return {
+      kind: "json",
+      status: error.statusCode,
+      contentType: "application/json; charset=utf-8",
+      body: { error: error.getPublicMessage() },
+      ...typeof challenge === "string" && challenge.length > 0 ? { headers: { "WWW-Authenticate": challenge } } : {}
+    };
+  }
+  return { kind: "text", status: 500, body: "Internal Server Error", contentType: "text/plain; charset=utf-8" };
+}
+var init_web_fetch_handler = __esm({
+  "libs/sdk/src/transport/web-fetch-handler.ts"() {
+    "use strict";
+    init_common();
+    init_server_tokens();
+    init_path_utils();
+    init_errors();
+    init_web_response_renderer();
+  }
+});
+
 // libs/sdk/src/server/noop-server.ts
 var NoopFrontMcpServer;
 var init_noop_server = __esm({
@@ -56563,6 +57397,122 @@ var init_noop_server = __esm({
   }
 });
 
+// libs/sdk/src/server/security/security-audit.ts
+function auditSecurityDefaults(config, isProduction5) {
+  const findings = [];
+  if (!isProduction5 && config.deploymentMode !== "distributed") {
+    return findings;
+  }
+  const strict = config.security?.strict === true;
+  if (config.cors === void 0 && !strict) {
+    findings.push({
+      level: "warn",
+      code: "CORS_PERMISSIVE_DEFAULT",
+      message: "CORS is using the permissive default (origin: true), which allows all origins.",
+      recommendation: "Set explicit cors.origin to restrict allowed origins in production."
+    });
+  } else if (config.cors !== false && config.cors?.origin === true && !strict) {
+    findings.push({
+      level: "warn",
+      code: "CORS_ORIGIN_TRUE",
+      message: "CORS origin=true allows all origins to make cross-origin requests.",
+      recommendation: "Set cors.origin to specific allowed origins."
+    });
+  } else if (config.cors === false) {
+    findings.push({
+      level: "info",
+      code: "CORS_DISABLED",
+      message: "CORS is disabled. Cross-origin requests will be blocked by browsers."
+    });
+  } else {
+    findings.push({
+      level: "info",
+      code: "CORS_CONFIGURED",
+      message: "CORS is explicitly configured."
+    });
+  }
+  const bindAddress = config.resolvedBindAddress ?? "0.0.0.0";
+  if (bindAddress === "0.0.0.0" || bindAddress === "::") {
+    if (config.deploymentMode !== "distributed") {
+      findings.push({
+        level: "warn",
+        code: "BIND_ALL_INTERFACES",
+        message: `Server bound to ${bindAddress} \u2014 accessible from all network interfaces.`,
+        recommendation: "Set security.bindAddress to 'loopback' or '127.0.0.1' for local-only access, or configure a reverse proxy. Distributed deployments require 'all' (0.0.0.0)."
+      });
+    } else {
+      findings.push({
+        level: "info",
+        code: "BIND_ALL_INTERFACES_DISTRIBUTED",
+        message: `Server bound to ${bindAddress} (expected for distributed deployment).`
+      });
+    }
+  } else {
+    findings.push({
+      level: "info",
+      code: "BIND_RESTRICTED",
+      message: `Server bound to ${bindAddress}.`
+    });
+  }
+  const dnsProtectionEnabled = config.security?.dnsRebindingProtection?.enabled ?? strict;
+  if (!dnsProtectionEnabled) {
+    findings.push({
+      level: "warn",
+      code: "DNS_REBINDING_UNPROTECTED",
+      message: "DNS rebinding protection is disabled.",
+      recommendation: "Enable security.dnsRebindingProtection with allowedHosts to prevent DNS rebinding attacks."
+    });
+  } else {
+    findings.push({
+      level: "info",
+      code: "DNS_REBINDING_PROTECTED",
+      message: "DNS rebinding protection is enabled."
+    });
+  }
+  if (config.security?.strict) {
+    findings.push({
+      level: "info",
+      code: "STRICT_MODE_ENABLED",
+      message: "Strict security mode is enabled: loopback binding, restrictive CORS, DNS rebinding protection."
+    });
+  } else {
+    findings.push({
+      level: "info",
+      code: "STRICT_MODE_HINT",
+      message: "To enable strict security defaults, set security.strict = true in HttpOptions."
+    });
+  }
+  return findings;
+}
+function logSecurityFindings(findings, logger) {
+  if (findings.length === 0) return;
+  for (const finding of findings) {
+    const prefix = `[Security] ${finding.code}:`;
+    const message = finding.recommendation ? `${prefix} ${finding.message} ${finding.recommendation}` : `${prefix} ${finding.message}`;
+    if (finding.level === "warn") {
+      logger.warn(message);
+    } else {
+      logger.info(message);
+    }
+  }
+}
+function resolveBindAddress(security, deploymentMode) {
+  if (security?.bindAddress) {
+    if (security.bindAddress === "loopback") return "127.0.0.1";
+    if (security.bindAddress === "all") return "0.0.0.0";
+    return security.bindAddress;
+  }
+  if (security?.strict) {
+    return deploymentMode === "distributed" ? "0.0.0.0" : "127.0.0.1";
+  }
+  return "0.0.0.0";
+}
+var init_security_audit = __esm({
+  "libs/sdk/src/server/security/security-audit.ts"() {
+    "use strict";
+  }
+});
+
 // libs/sdk/src/server/middleware/host-validation.middleware.ts
 function createHostValidationMiddleware(options) {
   if (!options.enabled) {
@@ -56612,14 +57562,14 @@ var init_base_host_adapter = __esm({
 });
 
 // libs/sdk/src/server/adapters/express.host.adapter.ts
-var http, import_cors, import_express, import_utils94, DEFAULT_EXPRESS_BODY_LIMIT, ExpressHostAdapter;
+var http, import_cors, import_express, import_utils96, DEFAULT_EXPRESS_BODY_LIMIT, ExpressHostAdapter;
 var init_express_host_adapter = __esm({
   "libs/sdk/src/server/adapters/express.host.adapter.ts"() {
     "use strict";
     http = __toESM(require("node:http"));
     import_cors = __toESM(require("cors"));
     import_express = __toESM(require("express"));
-    import_utils94 = require("@frontmcp/utils");
+    import_utils96 = require("@frontmcp/utils");
     init_mcp_error();
     init_host_validation_middleware();
     init_base_host_adapter();
@@ -56730,8 +57680,8 @@ var init_express_host_adapter = __esm({
             server.on("error", reject);
             server.listen(portOrSocketPath, () => {
               try {
-                const fs2 = require("node:fs");
-                fs2.chmodSync(portOrSocketPath, 432);
+                const fs = require("node:fs");
+                fs.chmodSync(portOrSocketPath, 432);
               } catch {
               }
               console.log(`MCP HTTP (Express) on unix://${portOrSocketPath}`);
@@ -56751,8 +57701,8 @@ var init_express_host_adapter = __esm({
       }
       async cleanupStaleSocket(socketPath) {
         try {
-          if (await (0, import_utils94.fileExists)(socketPath)) {
-            await (0, import_utils94.unlink)(socketPath);
+          if (await (0, import_utils96.fileExists)(socketPath)) {
+            await (0, import_utils96.unlink)(socketPath);
           }
         } catch {
         }
@@ -56762,6 +57712,11 @@ var init_express_host_adapter = __esm({
 });
 
 // libs/sdk/src/server/adapters/polyfills/node-express-host.ts
+var node_express_host_exports = {};
+__export(node_express_host_exports, {
+  DEFAULT_EXPRESS_BODY_LIMIT: () => DEFAULT_EXPRESS_BODY_LIMIT,
+  ExpressHostAdapter: () => ExpressHostAdapter
+});
 var init_node_express_host = __esm({
   "libs/sdk/src/server/adapters/polyfills/node-express-host.ts"() {
     "use strict";
@@ -56769,129 +57724,12 @@ var init_node_express_host = __esm({
   }
 });
 
-// libs/sdk/src/server/security/security-audit.ts
-function auditSecurityDefaults(config, isProduction5) {
-  const findings = [];
-  if (!isProduction5 && config.deploymentMode !== "distributed") {
-    return findings;
-  }
-  const strict = config.security?.strict === true;
-  if (config.cors === void 0 && !strict) {
-    findings.push({
-      level: "warn",
-      code: "CORS_PERMISSIVE_DEFAULT",
-      message: "CORS is using the permissive default (origin: true), which allows all origins.",
-      recommendation: "Set explicit cors.origin to restrict allowed origins in production."
-    });
-  } else if (config.cors !== false && config.cors?.origin === true && !strict) {
-    findings.push({
-      level: "warn",
-      code: "CORS_ORIGIN_TRUE",
-      message: "CORS origin=true allows all origins to make cross-origin requests.",
-      recommendation: "Set cors.origin to specific allowed origins."
-    });
-  } else if (config.cors === false) {
-    findings.push({
-      level: "info",
-      code: "CORS_DISABLED",
-      message: "CORS is disabled. Cross-origin requests will be blocked by browsers."
-    });
-  } else {
-    findings.push({
-      level: "info",
-      code: "CORS_CONFIGURED",
-      message: "CORS is explicitly configured."
-    });
-  }
-  const bindAddress = config.resolvedBindAddress ?? "0.0.0.0";
-  if (bindAddress === "0.0.0.0" || bindAddress === "::") {
-    if (config.deploymentMode !== "distributed") {
-      findings.push({
-        level: "warn",
-        code: "BIND_ALL_INTERFACES",
-        message: `Server bound to ${bindAddress} \u2014 accessible from all network interfaces.`,
-        recommendation: "Set security.bindAddress to 'loopback' or '127.0.0.1' for local-only access, or configure a reverse proxy. Distributed deployments require 'all' (0.0.0.0)."
-      });
-    } else {
-      findings.push({
-        level: "info",
-        code: "BIND_ALL_INTERFACES_DISTRIBUTED",
-        message: `Server bound to ${bindAddress} (expected for distributed deployment).`
-      });
-    }
-  } else {
-    findings.push({
-      level: "info",
-      code: "BIND_RESTRICTED",
-      message: `Server bound to ${bindAddress}.`
-    });
-  }
-  const dnsProtectionEnabled = config.security?.dnsRebindingProtection?.enabled ?? strict;
-  if (!dnsProtectionEnabled) {
-    findings.push({
-      level: "warn",
-      code: "DNS_REBINDING_UNPROTECTED",
-      message: "DNS rebinding protection is disabled.",
-      recommendation: "Enable security.dnsRebindingProtection with allowedHosts to prevent DNS rebinding attacks."
-    });
-  } else {
-    findings.push({
-      level: "info",
-      code: "DNS_REBINDING_PROTECTED",
-      message: "DNS rebinding protection is enabled."
-    });
-  }
-  if (config.security?.strict) {
-    findings.push({
-      level: "info",
-      code: "STRICT_MODE_ENABLED",
-      message: "Strict security mode is enabled: loopback binding, restrictive CORS, DNS rebinding protection."
-    });
-  } else {
-    findings.push({
-      level: "info",
-      code: "STRICT_MODE_HINT",
-      message: "To enable strict security defaults, set security.strict = true in HttpOptions."
-    });
-  }
-  return findings;
-}
-function logSecurityFindings(findings, logger) {
-  if (findings.length === 0) return;
-  for (const finding of findings) {
-    const prefix = `[Security] ${finding.code}:`;
-    const message = finding.recommendation ? `${prefix} ${finding.message} ${finding.recommendation}` : `${prefix} ${finding.message}`;
-    if (finding.level === "warn") {
-      logger.warn(message);
-    } else {
-      logger.info(message);
-    }
-  }
-}
-function resolveBindAddress(security, deploymentMode) {
-  if (security?.bindAddress) {
-    if (security.bindAddress === "loopback") return "127.0.0.1";
-    if (security.bindAddress === "all") return "0.0.0.0";
-    return security.bindAddress;
-  }
-  if (security?.strict) {
-    return deploymentMode === "distributed" ? "0.0.0.0" : "127.0.0.1";
-  }
-  return "0.0.0.0";
-}
-var init_security_audit = __esm({
-  "libs/sdk/src/server/security/security-audit.ts"() {
-    "use strict";
-  }
-});
-
 // libs/sdk/src/server/server.instance.ts
-var import_utils95, DEFAULT_CORS, FrontMcpServerInstance;
+var import_utils97, DEFAULT_CORS, FrontMcpServerInstance;
 var init_server_instance = __esm({
   "libs/sdk/src/server/server.instance.ts"() {
     "use strict";
-    import_utils95 = require("@frontmcp/utils");
-    init_node_express_host();
+    import_utils97 = require("@frontmcp/utils");
     init_common();
     init_health2();
     init_metrics2();
@@ -56919,7 +57757,8 @@ var init_server_instance = __esm({
           this.host = this.config.hostFactory;
         } else {
           const corsConfig = this.config.cors === false ? void 0 : this.config.cors ?? DEFAULT_CORS;
-          this.host = new ExpressHostAdapter({
+          const { ExpressHostAdapter: ExpressHostAdapter2 } = (init_node_express_host(), __toCommonJS(node_express_host_exports));
+          this.host = new ExpressHostAdapter2({
             ...corsConfig ? { cors: corsConfig } : {},
             ...this.config.security ? { security: this.config.security } : {},
             ...this.config.bodyLimit !== void 0 ? { bodyLimit: this.config.bodyLimit } : {},
@@ -56992,7 +57831,7 @@ var init_server_instance = __esm({
       }
       async start() {
         this.prepare();
-        const deploymentMode = (0, import_utils95.getRuntimeContext)().deployment;
+        const deploymentMode = (0, import_utils97.getRuntimeContext)().deployment;
         const bindAddress = resolveBindAddress(this.config.security, deploymentMode);
         const isProduction5 = process.env["NODE_ENV"] === "production";
         const findings = auditSecurityDefaults(
@@ -57070,11 +57909,11 @@ function resolveConfigInput(optionsOrClass) {
   }
   return optionsOrClass;
 }
-var import_utils96, stdioServing, FrontMcpInstance;
+var import_utils98, stdioServing, FrontMcpInstance;
 var init_front_mcp = __esm({
   "libs/sdk/src/front-mcp/front-mcp.ts"() {
     "use strict";
-    import_utils96 = require("@frontmcp/utils");
+    import_utils98 = require("@frontmcp/utils");
     init_common();
     init_direct();
     init_errors();
@@ -57086,6 +57925,7 @@ var init_front_mcp = __esm({
     init_scope_registry();
     init_skill_instructions_helper();
     init_task();
+    init_web_fetch_handler();
     init_front_mcp_providers();
     stdioServing = false;
     FrontMcpInstance = class _FrontMcpInstance2 {
@@ -57230,6 +58070,44 @@ var init_front_mcp = __esm({
         frontMcp.log?.info("FrontMCP handler created (serverless mode)");
         return server.getHandler();
       }
+      /**
+       * Creates and initializes a FrontMCP instance and returns a Web-standard
+       * `fetch` handler — `(request: Request) => Promise<Response>` — backed by the
+       * MCP WebStandard transport. Unlike {@link createHandler} this needs no
+       * Express / Node `req`/`res` and runs on V8-isolate targets (Cloudflare
+       * Workers, Deno Deploy, Bun).
+       *
+       * @example
+       * // worker entry
+       * const handler = await FrontMcpInstance.createFetchHandler(config);
+       * export default { fetch: (request) => handler(request) };
+       */
+      static async createFetchHandler(options) {
+        let inner;
+        let building;
+        const build = async () => {
+          const frontMcp = new _FrontMcpInstance2(options);
+          await frontMcp.ready;
+          const scope = frontMcp.getScopes()[0];
+          if (!scope) {
+            throw new ServerNotFoundError();
+          }
+          frontMcp.log?.info("FrontMCP fetch handler created (web-standard transport)");
+          return createWebFetchHandler(scope);
+        };
+        return async (request) => {
+          if (!inner) {
+            if (!building) {
+              building = build().catch((err) => {
+                building = void 0;
+                throw err;
+              });
+            }
+            inner = await building;
+          }
+          return inner(request);
+        };
+      }
       /**
        * Creates and initializes a FrontMCP instance without starting any server.
        * Returns the instance for graph extraction and introspection purposes.
@@ -57362,8 +58240,8 @@ var init_front_mcp = __esm({
         frontMcp.log?.info(`MCP server listening on unix://${socketPath}`);
         const cleanup = async () => {
           try {
-            if (await (0, import_utils96.fileExists)(socketPath)) {
-              await (0, import_utils96.unlink)(socketPath);
+            if (await (0, import_utils98.fileExists)(socketPath)) {
+              await (0, import_utils98.unlink)(socketPath);
             }
           } catch {
           }
@@ -57512,7 +58390,7 @@ var init_front_mcp = __esm({
           };
           const mcpServer = new McpServer2(scope.metadata.info, serverOptions);
           startupCleanups.push(() => mcpServer.close());
-          const sessionId = `stdio:${(0, import_utils96.randomUUID)()}`;
+          const sessionId = `stdio:${(0, import_utils98.randomUUID)()}`;
           const handlers = createMcpHandlers2({ scope, serverOptions, composeInstructions });
           for (const handler of handlers) {
             const originalHandler = handler.handler;
@@ -57810,9 +58688,9 @@ function FrontMcp(providedMetadata) {
       Reflect.defineMetadata(FrontMcpTokens[property] ?? property, metadata[property], target);
     }
     Reflect.defineMetadata(FRONTMCP_CONFIG_METADATA_KEY, metadata, target);
-    const isServerless2 = (0, import_utils97.getEnvFlag)("FRONTMCP_SERVERLESS");
-    const isSchemaExtract = (0, import_utils97.getEnvFlag)("FRONTMCP_SCHEMA_EXTRACT");
-    const isStdio = (0, import_utils97.getEnvFlag)("FRONTMCP_STDIO");
+    const isServerless2 = (0, import_utils99.getEnvFlag)("FRONTMCP_SERVERLESS");
+    const isSchemaExtract = (0, import_utils99.getEnvFlag)("FRONTMCP_SCHEMA_EXTRACT");
+    const isStdio = (0, import_utils99.getEnvFlag)("FRONTMCP_STDIO");
     const taskWorkerId = typeof process !== "undefined" ? process.env?.["FRONTMCP_RUN_TASK_ID"] : void 0;
     if (taskWorkerId && metadata.serve !== false) {
       void (async () => {
@@ -57838,7 +58716,8 @@ function FrontMcp(providedMetadata) {
     } else if (isServerless2) {
       const ServerlessInstance = getFrontMcpInstance();
       const { setServerlessHandler: setServerlessHandler2, setServerlessHandlerPromise: setServerlessHandlerPromise2, setServerlessHandlerError: setServerlessHandlerError2 } = getServerlessHandlerFns();
-      const handlerPromise = ServerlessInstance.createHandler(metadata);
+      const isWorker = (0, import_utils99.getEnvFlag)("FRONTMCP_WORKER");
+      const handlerPromise = isWorker ? ServerlessInstance.createFetchHandler(metadata) : ServerlessInstance.createHandler(metadata);
       setServerlessHandlerPromise2(handlerPromise);
       handlerPromise.then(setServerlessHandler2).catch((err) => {
         const e = err instanceof Error ? err : new InternalMcpError(String(err), "SERVERLESS_INIT_FAILED");
@@ -57850,12 +58729,12 @@ function FrontMcp(providedMetadata) {
     }
   };
 }
-var import_reflect_metadata28, import_utils97, FRONT_MCP_DECORATOR_BASENAMES, FRONTMCP_CONFIG_METADATA_KEY, _FrontMcpInstance, _serverlessHandlerFns;
+var import_reflect_metadata28, import_utils99, FRONT_MCP_DECORATOR_BASENAMES, FRONTMCP_CONFIG_METADATA_KEY, _FrontMcpInstance, _serverlessHandlerFns;
 var init_front_mcp_decorator = __esm({
   "libs/sdk/src/common/decorators/front-mcp.decorator.ts"() {
     "use strict";
     import_reflect_metadata28 = require("reflect-metadata");
-    import_utils97 = require("@frontmcp/utils");
+    import_utils99 = require("@frontmcp/utils");
     init_decorator_errors();
     init_mcp_error();
     init_metadata();
@@ -57981,6 +58860,12 @@ function remoteApp(url, options) {
     filter: options?.filter
   };
 }
+function frontMcpApp(metadata) {
+  const FunctionalApp = class {
+  };
+  FrontMcpApp(metadata)(FunctionalApp);
+  return FunctionalApp;
+}
 var import_reflect_metadata29, APP_DECORATOR_BASENAMES, App;
 var init_app_decorator = __esm({
   "libs/sdk/src/common/decorators/app.decorator.ts"() {
@@ -58826,12 +59711,12 @@ var init_adapter_entry = __esm({
 });
 
 // libs/sdk/src/common/entries/tool.entry.ts
-var import_lazy_zod106, import_utils99, ToolEntry;
+var import_lazy_zod106, import_utils101, ToolEntry;
 var init_tool_entry = __esm({
   "libs/sdk/src/common/entries/tool.entry.ts"() {
     "use strict";
     import_lazy_zod106 = require("@frontmcp/lazy-zod");
-    import_utils99 = require("@frontmcp/utils");
+    import_utils101 = require("@frontmcp/utils");
     init_base_entry();
     ToolEntry = class extends BaseEntry {
       owner;
@@ -58898,7 +59783,7 @@ var init_tool_entry = __esm({
           try {
             return (0, import_lazy_zod106.toJSONSchema)(import_lazy_zod106.z.object(this.inputSchema));
           } catch (error) {
-            if ((0, import_utils99.isDebug)() || (0, import_utils99.isDevelopment)()) {
+            if ((0, import_utils101.isDebug)() || (0, import_utils101.isDevelopment)()) {
               console.warn("[ToolEntry] Failed to convert Zod schema to JSON Schema:", error);
             }
             return { type: "object", properties: {} };
@@ -58944,7 +59829,7 @@ var init_tool_entry = __esm({
           const json = (0, import_lazy_zod106.toJSONSchema)(zodSchema);
           return json && json["type"] === "object" ? json : null;
         } catch (error) {
-          if ((0, import_utils99.isDebug)() || (0, import_utils99.isDevelopment)()) {
+          if ((0, import_utils101.isDebug)() || (0, import_utils101.isDevelopment)()) {
             console.warn("[ToolEntry] Failed to convert output Zod schema to JSON Schema:", error);
           }
           return null;
@@ -59793,6 +60678,7 @@ __export(index_exports, {
   HttpStatus: () => HttpStatus,
   HttpStreamSchema: () => HttpStreamSchema,
   HttpTextSchema: () => HttpTextSchema,
+  HttpWebResponseSchema: () => HttpWebResponseSchema,
   ImageOutputSchema: () => ImageOutputSchema,
   InMemoryOrchestratedTokenStore: () => import_auth40.InMemoryOrchestratedTokenStore,
   InMemoryStoreRequiredError: () => import_auth11.InMemoryStoreRequiredError,
@@ -60062,6 +60948,7 @@ __export(index_exports, {
   annotatedFrontMcpSkillsSchema: () => annotatedFrontMcpSkillsSchema,
   annotatedFrontMcpToolsSchema: () => annotatedFrontMcpToolsSchema,
   annotatedFrontMcpWorkflowsSchema: () => annotatedFrontMcpWorkflowsSchema,
+  app: () => frontMcpApp,
   appAuthOptionsSchema: () => import_auth9.appAuthOptionsSchema,
   appFilterConfigSchema: () => appFilterConfigSchema,
   applyPrimitiveFilter: () => applyPrimitiveFilter,
@@ -60076,6 +60963,7 @@ __export(index_exports, {
   buildEsmResourceRecord: () => buildEsmResourceRecord,
   buildEsmShUrl: () => buildEsmShUrl,
   buildEsmToolRecord: () => buildEsmToolRecord,
+  buildPersistentWebStandardMcp: () => buildPersistentWebStandardMcp,
   buildRemotePromptRecord: () => buildRemotePromptRecord,
   buildRemoteResourceRecord: () => buildRemoteResourceRecord,
   buildRemoteResourceTemplateRecord: () => buildRemoteResourceTemplateRecord,
@@ -60128,6 +61016,7 @@ __export(index_exports, {
   createSkillInstance: () => createSkillInstance,
   createSkillStorageProvider: () => createSkillStorageProvider,
   createTaskStore: () => createTaskStore,
+  createWebFetchHandler: () => createWebFetchHandler,
   decideIntent: () => decideIntent,
   decisionSchema: () => decisionSchema,
   decryptElicitationData: () => decryptElicitationData,
@@ -60171,6 +61060,7 @@ __export(index_exports, {
   frontMcpAdapterMetadataSchema: () => frontMcpAdapterMetadataSchema,
   frontMcpAgent: () => frontMcpAgent,
   frontMcpAgentMetadataSchema: () => frontMcpAgentMetadataSchema,
+  frontMcpApp: () => frontMcpApp,
   frontMcpAuthProviderMetadataSchema: () => frontMcpAuthProviderMetadataSchema,
   frontMcpBaseSchema: () => frontMcpBaseSchema,
   frontMcpChannelMetadataSchema: () => frontMcpChannelMetadataSchema,
@@ -60257,7 +61147,7 @@ __export(index_exports, {
   isValidVersion: () => isValidVersion,
   isVercelKvProvider: () => isVercelKvProvider,
   job: () => frontMcpJob,
-  joinPath: () => import_utils80.joinPath,
+  joinPath: () => import_utils81.joinPath,
   jsonWebKeySetSchema: () => import_auth.jsonWebKeySetSchema,
   jwkParametersSchema: () => import_auth.jwkParametersSchema,
   jwkSchema: () => import_auth.jwkSchema,
@@ -60330,7 +61220,9 @@ __export(index_exports, {
   resource: () => frontMcpResource,
   resourceTemplate: () => frontMcpResourceTemplate,
   resourceUriMatches: () => resourceUriMatches,
+  runHttpRequestFlowWeb: () => runHttpRequestFlowWeb,
   runTaskInBackground: () => runTaskInBackground,
+  runWebStandardMcp: () => runWebStandardMcp,
   satisfiesRange: () => satisfiesRange,
   scanSkillResources: () => scanSkillResources,
   secureStoreConfigSchema: () => import_auth4.secureStoreConfigSchema,
@@ -60372,7 +61264,7 @@ __export(index_exports, {
   toolPaginationOptionsSchema: () => toolPaginationOptionsSchema,
   transparentAuthOptionsSchema: () => import_auth6.transparentAuthOptionsSchema,
   transportOptionsSchema: () => transportOptionsSchema,
-  trimSlashes: () => import_utils80.trimSlashes,
+  trimSlashes: () => import_utils81.trimSlashes,
   tryDecryptStoredValue: () => tryDecryptStoredValue,
   tryGetConfig: () => tryGetConfig,
   upstreamProviderSchema: () => import_auth4.upstreamProviderSchema,
@@ -60586,22 +61478,22 @@ function createMemorySkillProvider(options = {}) {
 init_skill_utils();
 
 // libs/sdk/src/skill/skill-directory-loader.ts
-var import_utils100 = require("@frontmcp/utils");
+var import_utils102 = require("@frontmcp/utils");
 init_skill_metadata();
 init_sdk_errors();
 init_skill_md_parser();
 async function scanSkillResources(dirPath) {
   const resources = {};
-  const scriptsPath = (0, import_utils100.joinPath)(dirPath, "scripts");
-  const referencesPath = (0, import_utils100.joinPath)(dirPath, "references");
-  const assetsPath = (0, import_utils100.joinPath)(dirPath, "assets");
-  const examplesPath = (0, import_utils100.joinPath)(dirPath, "examples");
+  const scriptsPath = (0, import_utils102.joinPath)(dirPath, "scripts");
+  const referencesPath = (0, import_utils102.joinPath)(dirPath, "references");
+  const assetsPath = (0, import_utils102.joinPath)(dirPath, "assets");
+  const examplesPath = (0, import_utils102.joinPath)(dirPath, "examples");
   const checks = await Promise.all([
     checkDirectory(scriptsPath),
     checkDirectory(referencesPath),
     checkDirectory(assetsPath),
     checkDirectory(examplesPath),
-    (0, import_utils100.fileExists)((0, import_utils100.joinPath)(dirPath, "SKILL.md"))
+    (0, import_utils102.fileExists)((0, import_utils102.joinPath)(dirPath, "SKILL.md"))
   ]);
   if (checks[0]) resources.scripts = scriptsPath;
   if (checks[1]) resources.references = referencesPath;
@@ -60614,7 +61506,7 @@ async function scanSkillResources(dirPath) {
 }
 async function checkDirectory(path3) {
   try {
-    const s = await (0, import_utils100.stat)(path3);
+    const s = await (0, import_utils102.stat)(path3);
     return s.isDirectory();
   } catch (err) {
     if (err.code === "ENOENT") return false;
@@ -60627,16 +61519,16 @@ async function findNestedSkillMd(dirPath, maxDepth = Number.POSITIVE_INFINITY) {
     if (depth > maxDepth) return;
     let entries;
     try {
-      entries = await (0, import_utils100.readdir)(current);
+      entries = await (0, import_utils102.readdir)(current);
     } catch (err) {
       if (err.code === "ENOENT") return;
       throw err;
     }
     for (const entry of entries) {
-      const full = (0, import_utils100.joinPath)(current, entry);
+      const full = (0, import_utils102.joinPath)(current, entry);
       let entryStat;
       try {
-        entryStat = await (0, import_utils100.stat)(full);
+        entryStat = await (0, import_utils102.stat)(full);
       } catch (err) {
         if (err.code === "ENOENT") continue;
         throw err;
@@ -60652,19 +61544,19 @@ async function findNestedSkillMd(dirPath, maxDepth = Number.POSITIVE_INFINITY) {
   return found.sort();
 }
 async function loadSkillDirectory(dirPath, logger) {
-  const skillMdPath = (0, import_utils100.joinPath)(dirPath, "SKILL.md");
-  const exists = await (0, import_utils100.fileExists)(skillMdPath);
+  const skillMdPath = (0, import_utils102.joinPath)(dirPath, "SKILL.md");
+  const exists = await (0, import_utils102.fileExists)(skillMdPath);
   if (!exists) {
-    throw new InvalidSkillError((0, import_utils100.basename)(dirPath), "SKILL.md not found in directory");
+    throw new InvalidSkillError((0, import_utils102.basename)(dirPath), "SKILL.md not found in directory");
   }
   let content;
   let partialMetadata;
   try {
-    content = await (0, import_utils100.readFile)(skillMdPath, "utf-8");
+    content = await (0, import_utils102.readFile)(skillMdPath, "utf-8");
     const { frontmatter, body } = parseSkillMdFrontmatter(content);
     partialMetadata = skillMdFrontmatterToMetadata(frontmatter, body);
   } catch (err) {
-    const name41 = (0, import_utils100.basename)(dirPath);
+    const name41 = (0, import_utils102.basename)(dirPath);
     const message = err instanceof Error ? err.message : String(err);
     throw new InvalidSkillError(name41, `Failed to read or parse SKILL.md: ${message}`);
   }
@@ -60675,13 +61567,13 @@ async function loadSkillDirectory(dirPath, logger) {
   }
   const nested = await findNestedSkillMd(dirPath);
   if (nested.length > 0) {
-    const skillName2 = partialMetadata.name ?? (0, import_utils100.basename)(dirPath);
+    const skillName2 = partialMetadata.name ?? (0, import_utils102.basename)(dirPath);
     throw new InvalidSkillError(
       skillName2,
       `Skill directory contains nested SKILL.md files (forbidden by SEP-2640 \xA7Resource Mapping): ${nested.join(", ")}`
     );
   }
-  const dirName = (0, import_utils100.basename)(dirPath);
+  const dirName = (0, import_utils102.basename)(dirPath);
   if (partialMetadata.name && dirName && partialMetadata.name !== dirName) {
     const msg = `Skill name "${partialMetadata.name}" does not match directory name "${dirName}"`;
     if (logger) {
@@ -60740,6 +61632,8 @@ init_direct();
 
 // libs/sdk/src/transport/index.ts
 init_in_memory_server();
+init_web_fetch_handler();
+init_web_standard_mcp();
 
 // libs/sdk/src/index.ts
 init_ext_apps2();
@@ -60970,6 +61864,7 @@ var ChannelListHook = FlowHooksOf("channels:list");
   HttpStatus,
   HttpStreamSchema,
   HttpTextSchema,
+  HttpWebResponseSchema,
   ImageOutputSchema,
   InMemoryOrchestratedTokenStore,
   InMemoryStoreRequiredError,
@@ -61239,6 +62134,7 @@ var ChannelListHook = FlowHooksOf("channels:list");
   annotatedFrontMcpSkillsSchema,
   annotatedFrontMcpToolsSchema,
   annotatedFrontMcpWorkflowsSchema,
+  app,
   appAuthOptionsSchema,
   appFilterConfigSchema,
   applyPrimitiveFilter,
@@ -61253,6 +62149,7 @@ var ChannelListHook = FlowHooksOf("channels:list");
   buildEsmResourceRecord,
   buildEsmShUrl,
   buildEsmToolRecord,
+  buildPersistentWebStandardMcp,
   buildRemotePromptRecord,
   buildRemoteResourceRecord,
   buildRemoteResourceTemplateRecord,
@@ -61305,6 +62202,7 @@ var ChannelListHook = FlowHooksOf("channels:list");
   createSkillInstance,
   createSkillStorageProvider,
   createTaskStore,
+  createWebFetchHandler,
   decideIntent,
   decisionSchema,
   decryptElicitationData,
@@ -61347,6 +62245,7 @@ var ChannelListHook = FlowHooksOf("channels:list");
   frontMcpAdapterMetadataSchema,
   frontMcpAgent,
   frontMcpAgentMetadataSchema,
+  frontMcpApp,
   frontMcpAuthProviderMetadataSchema,
   frontMcpBaseSchema,
   frontMcpChannelMetadataSchema,
@@ -61506,7 +62405,9 @@ var ChannelListHook = FlowHooksOf("channels:list");
   resource,
   resourceTemplate,
   resourceUriMatches,
+  runHttpRequestFlowWeb,
   runTaskInBackground,
+  runWebStandardMcp,
   satisfiesRange,
   scanSkillResources,
   secureStoreConfigSchema,