@frontmcp/sdk 1.8.1 → 1.8.2

package/esm/index.mjs

@@ -3204,7 +3204,8 @@ var init_front_mcp_metadata = __esm({
       extApps: extAppsOptionsSchema.optional(),
       sqlite: sqliteOptionsSchema.optional(),
       ui: z25.object({
-        cdnOverrides: z25.record(z25.string(), z25.string()).optional()
+        cdnOverrides: z25.record(z25.string(), z25.string()).optional(),
+        escapeStringResults: z25.boolean().optional()
       }).optional(),
       /**
        * Output-validation policy applied after entry-level Zod parsing succeeds.
@@ -9666,7 +9667,7 @@ function initializeRequestHandler({
       const requestedVersion = request.params.protocolVersion;
       const protocolVersion = SUPPORTED_PROTOCOL_VERSIONS.includes(requestedVersion) ? requestedVersion : LATEST_PROTOCOL_VERSION;
       const configuredInfo = scope.metadata?.info ?? { name: "FrontMcpServer", version: "0.0.1" };
-      const composed = composeInstructions?.();
+      const composed = await composeInstructions?.(ctx);
       const instructions = composed !== void 0 ? composed : serverOptions.instructions;
       const result = {
         capabilities: serverOptions.capabilities ?? {},
@@ -9972,31 +9973,49 @@ async function filterSkillsByAuthorities(scope, skills, authInfo) {
   );
   return skills.filter((_, i) => grants[i]);
 }
-async function filterSkillMetadataByAuthorities(scope, registry, results, authInfo) {
-  const engine = scope.authoritiesEngine;
-  const ctxBuilder = scope.authoritiesContextBuilder;
-  if (!engine || !ctxBuilder) return [...results];
-  const normalized = normalizeAuthInfoForAuthorities(authInfo);
-  const grants = await Promise.all(
-    results.map(async (r) => {
-      const id = r.metadata.id ?? r.metadata.name;
-      const entry = registry.findByName(id) ?? registry.getSkills(true).find((s) => (s.metadata.id ?? s.name) === id || s.metadata.name === id);
-      if (!entry) return true;
-      const authorities = getSkillAuthorities(entry);
-      if (!authorities) return true;
-      const evalCtx = ctxBuilder.build(normalized);
-      const result = await engine.evaluate(authorities, evalCtx);
-      return result.granted;
-    })
-  );
-  return results.filter((_, i) => grants[i]);
-}
 var init_skill_authorities_helper = __esm({
   "libs/sdk/src/skill/skill-authorities.helper.ts"() {
     "use strict";
   }
 });
 
+// libs/sdk/src/skill/skill-entry.resolver.ts
+function skillResultId(result) {
+  return result.metadata.id ?? result.metadata.name;
+}
+function createSkillEntryResolver(registry) {
+  let fallback;
+  const fallbackEntry = (id) => {
+    if (!fallback) {
+      const skills = registry.getSkills(true);
+      fallback = /* @__PURE__ */ new Map();
+      for (const skill of skills) {
+        const skillId = skill.metadata.id ?? skill.name;
+        if (!fallback.has(skillId)) fallback.set(skillId, skill);
+      }
+      for (const skill of skills) {
+        if (!fallback.has(skill.metadata.name)) fallback.set(skill.metadata.name, skill);
+      }
+    }
+    return fallback.get(id);
+  };
+  const lookup = (id) => registry.findByName(id) ?? // Qualified names always carry an owner prefix, so plain ids skip that scan.
+  (id.includes(":") ? registry.findByQualifiedName(id) : void 0) ?? fallbackEntry(id);
+  return (...ids) => {
+    for (const id of ids) {
+      if (!id) continue;
+      const entry = lookup(id);
+      if (entry) return entry;
+    }
+    return void 0;
+  };
+}
+var init_skill_entry_resolver = __esm({
+  "libs/sdk/src/skill/skill-entry.resolver.ts"() {
+    "use strict";
+  }
+});
+
 // libs/sdk/src/skill/skill-filter.helper.ts
 async function filterServableSkills(scope, skills, ctx) {
   if (skills.length === 0) return [];
@@ -10008,21 +10027,22 @@ async function isSkillServable(scope, skill, ctx) {
   const servable = await filterServableSkills(scope, [skill], ctx);
   return servable.length === 1;
 }
-async function filterServableSkillResults(scope, registry, results, ctx) {
-  const entries = results.map((result) => findSkillEntry(registry, result.metadata.id ?? result.metadata.name));
-  const registered = entries.filter((entry) => entry !== void 0);
-  const servable = new Set(await filterServableSkills(scope, registered, ctx));
+async function filterDiscoverableSkillResults(scope, registry, results, caller = {}) {
+  const resolve = createSkillEntryResolver(registry);
+  const entries = results.map((result) => resolve(skillResultId(result)));
+  const registered = [...new Set(entries.filter((entry) => entry !== void 0))];
+  const authorized = await filterSkillsByAuthorities(scope, registered, caller.authInfo ?? {});
+  const servable = new Set(await filterServableSkills(scope, authorized, caller.ctx));
   return results.filter((_, index) => {
     const entry = entries[index];
     return entry === void 0 || servable.has(entry);
   });
 }
-function findSkillEntry(registry, id) {
-  return registry.findByName(id) ?? registry.getSkills(true).find((skill) => (skill.metadata.id ?? skill.name) === id || skill.metadata.name === id);
-}
 var init_skill_filter_helper = __esm({
   "libs/sdk/src/skill/skill-filter.helper.ts"() {
     "use strict";
+    init_skill_authorities_helper();
+    init_skill_entry_resolver();
   }
 });
 
@@ -10052,8 +10072,7 @@ function skillsListRequestHandler({
       });
       const authInfo = ctx?.authInfo ?? {};
       const wrapped = listResult.skills.map((metadata) => ({ metadata }));
-      const authVisible = await filterSkillMetadataByAuthorities(scope, skillRegistry, wrapped, authInfo);
-      const visible = await filterServableSkillResults(scope, skillRegistry, authVisible, ctx);
+      const visible = await filterDiscoverableSkillResults(scope, skillRegistry, wrapped, { authInfo, ctx });
       const removed = listResult.skills.length - visible.length;
       const skills = visible.map(({ metadata: s }) => ({
         id: s.id ?? s.name,
@@ -10077,7 +10096,6 @@ var init_skills_list_request_handler = __esm({
   "libs/sdk/src/transport/mcp-handlers/skills-list-request.handler.ts"() {
     "use strict";
     init_errors();
-    init_skill_authorities_helper();
     init_skill_filter_helper();
     init_skills_mcp_types();
   }
@@ -10489,10 +10507,10 @@ async function loadInstructions(source, basePath) {
   }
   throw new InvalidInstructionSourceError();
 }
-function buildSkillContent(metadata, instructions, resolvedReferences, resolvedExamples) {
+function buildSkillContent(metadata, instructions, resolvedReferences2, resolvedExamples) {
   let finalInstructions = instructions;
-  if (resolvedReferences && resolvedReferences.length > 0) {
-    finalInstructions += buildReferencesTable(resolvedReferences);
+  if (resolvedReferences2 && resolvedReferences2.length > 0) {
+    finalInstructions += buildReferencesTable(resolvedReferences2);
   }
   if (resolvedExamples && resolvedExamples.length > 0) {
     finalInstructions += buildExamplesTable(resolvedExamples);
@@ -10510,7 +10528,7 @@ function buildSkillContent(metadata, instructions, resolvedReferences, resolvedE
     specMetadata: metadata.specMetadata,
     allowedTools: metadata.allowedTools,
     resources: metadata.resources,
-    resolvedReferences,
+    resolvedReferences: resolvedReferences2,
     resolvedExamples
   };
 }
@@ -10777,13 +10795,14 @@ function skillsLoadRequestHandler({
           toolsByName.set(tool.name, tool);
         }
       }
+      const resolveEntry = createSkillEntryResolver(skillRegistry);
       for (const skillId of skillIds) {
         const loadResult = await skillRegistry.loadSkill(skillId);
         if (!loadResult) {
           warnings.push(`Skill "${skillId}" not found`);
           continue;
         }
-        const entry = skillRegistry.findByName(skillId) ?? skillRegistry.findByQualifiedName(skillId) ?? skillRegistry.findByName(loadResult.skill.id) ?? skillRegistry.getSkills(true).find((s) => (s.metadata.id ?? s.name) === loadResult.skill.id || s.metadata.name === loadResult.skill.id);
+        const entry = resolveEntry(skillId, loadResult.skill.id);
         if (entry) {
           if (!await isSkillServable(scope, entry, ctx)) {
             warnings.push(`Skill "${skillId}" not found`);
@@ -10862,6 +10881,7 @@ var init_skills_load_request_handler = __esm({
     "use strict";
     init_errors();
     init_skill_authorities_helper();
+    init_skill_entry_resolver();
     init_skill_filter_helper();
     init_skill_http_utils();
     init_skill_utils();
@@ -10896,13 +10916,10 @@ function skillsSearchRequestHandler({
         return visibility === "mcp" || visibility === "both";
       });
       const authInfo = ctx?.authInfo ?? {};
-      const authVisibleResults = await filterSkillMetadataByAuthorities(
-        scope,
-        skillRegistry,
-        mcpVisibleResults,
-        authInfo
-      );
-      const servableResults = await filterServableSkillResults(scope, skillRegistry, authVisibleResults, ctx);
+      const servableResults = await filterDiscoverableSkillResults(scope, skillRegistry, mcpVisibleResults, {
+        authInfo,
+        ctx
+      });
       const skills = servableResults.map((r) => {
         const toolNames = extractToolNames(r.metadata);
         return {
@@ -10936,7 +10953,6 @@ var init_skills_search_request_handler = __esm({
     "use strict";
     init_skill_metadata();
     init_errors();
-    init_skill_authorities_helper();
     init_skill_filter_helper();
     init_skills_mcp_types();
   }
@@ -13123,6 +13139,15 @@ var init_metrics2 = __esm({
   }
 });
 
+// libs/sdk/src/transport/transport.types.ts
+var STATELESS_SESSION_ID;
+var init_transport_types = __esm({
+  "libs/sdk/src/transport/transport.types.ts"() {
+    "use strict";
+    STATELESS_SESSION_ID = "__stateless__";
+  }
+});
+
 // libs/sdk/src/context/trace-context.ts
 import { randomUUID as randomUUID7 } from "@frontmcp/utils";
 function parseTraceContext(headers) {
@@ -13238,6 +13263,7 @@ var init_frontmcp_context = __esm({
   "libs/sdk/src/context/frontmcp-context.ts"() {
     "use strict";
     init_mcp_error();
+    init_transport_types();
     init_trace_context();
     PRE_RESOLVED_ELICIT_KEY = /* @__PURE__ */ Symbol.for("frontmcp:pre-resolved-elicit");
     MRTR_EXCHANGE_KEY = /* @__PURE__ */ Symbol.for("frontmcp:mrtr-exchange");
@@ -13339,6 +13365,12 @@ var init_frontmcp_context = __esm({
       updateAuthInfo(authInfo) {
         this._authInfo = { ...this._authInfo, ...authInfo };
       }
+      /** `sessionId` when the server verified it; undefined for stateless and per-request placeholder ids. */
+      get verifiedSessionId() {
+        if (this.sessionId === STATELESS_SESSION_ID) return void 0;
+        const verified = this._authInfo.sessionId ?? this._authInfo.extra?.["sessionId"];
+        return verified === this.sessionId ? this.sessionId : void 0;
+      }
       /**
        * The client's self-reported identity, sent with this request (MCP 2026-07-28 `_meta`).
        * Session-based clients report it once at initialize instead; see the notification service.
@@ -17496,9 +17528,24 @@ function appOwnerIdOf(lineage, owner) {
   const owners = owner ? [...lineage, owner] : lineage;
   return owners.find((candidate) => candidate.kind === "app")?.id;
 }
+var EntryLineageIndex;
 var init_lineage_utils = __esm({
   "libs/sdk/src/utils/lineage.utils.ts"() {
     "use strict";
+    EntryLineageIndex = class {
+      lineages = /* @__PURE__ */ new Map();
+      /** Replace the index with these rows; an entry held by several rows keeps the first row's lineage. */
+      rebuild(rows) {
+        this.lineages.clear();
+        for (const row of rows) {
+          if (!this.lineages.has(row.instance)) this.lineages.set(row.instance, row.lineage);
+        }
+      }
+      /** Owner lineage (root → leaf) of an entry, or undefined when no row holds it. */
+      lineageOf(entry) {
+        return this.lineages.get(entry);
+      }
+    };
   }
 });
 
@@ -17531,6 +17578,28 @@ var init_remote_capabilities_utils = __esm({
   }
 });
 
+// libs/sdk/src/flows/resolved-entries.ts
+var ResolvedEntries;
+var init_resolved_entries = __esm({
+  "libs/sdk/src/flows/resolved-entries.ts"() {
+    "use strict";
+    ResolvedEntries = class {
+      byInput = /* @__PURE__ */ new WeakMap();
+      /** Keep the entry resolved for this run's raw input and lookup key. */
+      remember(rawInput, key, entry) {
+        if (typeof rawInput === "object" && rawInput !== null) this.byInput.set(rawInput, { key, entry });
+      }
+      /** The entry kept for this run when it was resolved from the same key; undefined otherwise. */
+      take(rawInput, key) {
+        if (typeof rawInput !== "object" || rawInput === null) return void 0;
+        const resolved = this.byInput.get(rawInput);
+        this.byInput.delete(rawInput);
+        return resolved?.key === key ? resolved.entry : void 0;
+      }
+    };
+  }
+});
+
 // libs/sdk/src/provider/flow-context-providers.ts
 var FlowContextProviders;
 var init_flow_context_providers = __esm({
@@ -17569,13 +17638,14 @@ var init_flow_context_providers = __esm({
 import { AuthorityDeniedError as AuthorityDeniedError3, resolveRequiredScopes as resolveRequiredScopes2 } from "@frontmcp/auth";
 import { z as z49 } from "@frontmcp/lazy-zod";
 import { GetPromptRequestSchema as GetPromptRequestSchema2, GetPromptResultSchema } from "@frontmcp/protocol";
-var inputSchema5, outputSchema5, stateSchema5, plan5, name5, Stage5, GetPromptFlow;
+var inputSchema5, outputSchema5, stateSchema5, plan5, name5, Stage5, resolvedPrompts, GetPromptFlow;
 var init_get_prompt_flow = __esm({
   "libs/sdk/src/prompt/flows/get-prompt.flow.ts"() {
     "use strict";
     init_remote_capabilities_utils();
     init_common();
     init_errors();
+    init_resolved_entries();
     init_hooks_utils();
     init_flow_context_providers();
     init_lineage_utils();
@@ -17611,17 +17681,19 @@ var init_get_prompt_flow = __esm({
     };
     name5 = "prompts:get-prompt";
     ({ Stage: Stage5 } = FlowHooksOf(name5));
+    resolvedPrompts = new ResolvedEntries();
     GetPromptFlow = class extends FlowBase {
       static async resolveHookOwnerId(rawInput, scope) {
-        const parsed = inputSchema5.safeParse(rawInput);
-        if (!parsed.success) return void 0;
-        const findPrompt = () => scope.prompts.findByName(parsed.data.request.params.name);
-        let prompt = findPrompt();
+        const promptName = rawInput?.request?.params?.name;
+        if (typeof promptName !== "string") return void 0;
+        let prompt = scope.prompts.findByName(promptName);
         if (!prompt) {
           await loadRemoteAppCapabilities(scope);
-          prompt = findPrompt();
+          prompt = scope.prompts.findByName(promptName);
         }
-        return prompt ? appOwnerIdOf(scope.prompts.lineageOf(prompt) ?? [], prompt.owner) : void 0;
+        if (!prompt) return void 0;
+        resolvedPrompts.remember(rawInput, promptName, prompt);
+        return appOwnerIdOf(scope.prompts.lineageOf(prompt) ?? [], prompt.owner);
       }
       logger = this.scopeLogger.child("GetPromptFlow");
       async parseInput() {
@@ -17685,7 +17757,7 @@ var init_get_prompt_flow = __esm({
         this.logger.verbose("findPrompt:start");
         const { name: name44 } = this.state.required.input;
         this.logger.info(`findPrompt: looking for prompt with name "${name44}"`);
-        const prompt = this.scope.prompts.findByName(name44);
+        const prompt = resolvedPrompts.take(this.rawInput, name44) ?? this.scope.prompts.findByName(name44);
         if (!prompt) {
           this.logger.warn(`findPrompt: prompt "${name44}" not found`);
           throw new PromptNotFoundError(name44);
@@ -17741,14 +17813,8 @@ var init_get_prompt_flow = __esm({
           const parsedArgs = prompt.parseArguments(input.arguments);
           this.state.set("parsedArgs", parsedArgs);
           const sessionKey = authInfo?.sessionId ?? "anonymous";
-          const promptViews = await prompt.providers.buildViews(sessionKey, new Map(this.deps));
-          const mergedContextDeps = new Map(this.deps);
-          for (const [token, instance] of promptViews.context) {
-            if (!mergedContextDeps.has(token)) {
-              mergedContextDeps.set(token, instance);
-            }
-          }
-          const contextProviders = new FlowContextProviders(prompt.providers, mergedContextDeps);
+          const promptViews = await prompt.providers.buildViews(sessionKey, new Map(this.deps), this.scope.providers);
+          const contextProviders = new FlowContextProviders(prompt.providers, promptViews.context);
           const context = prompt.create(parsedArgs, { ...ctx, contextProviders });
           this.appendContextHooks(hooksBoundTo(this.scope.hooks.getClsHooks(prompt.record.provide), context));
           context.mark("createPromptContext");
@@ -18369,6 +18435,8 @@ var init_prompt_registry = __esm({
       // "ownerKey:name" -> row
       byOwner = /* @__PURE__ */ new Map();
       // ownerKey -> rows
+      lineages = new EntryLineageIndex();
+      // instance -> first row's lineage
       // version + emitter
       version = 0;
       emitter = new PromptEmitter();
@@ -18552,7 +18620,7 @@ var init_prompt_registry = __esm({
       }
       /** Owner lineage (root → leaf) of a prompt this registry holds, or undefined when it holds none. */
       lineageOf(entry) {
-        return this.listAllIndexed().find((row) => row.instance === entry)?.lineage;
+        return this.lineages.lineageOf(entry);
       }
       /** List instances by owner path (e.g. "app:Portal/plugin:Okta") */
       listByOwner(ownerPath) {
@@ -18565,6 +18633,7 @@ var init_prompt_registry = __esm({
         this.byName.clear();
         this.byOwnerAndName.clear();
         this.byOwner.clear();
+        this.lineages.rebuild(effective);
         for (const r of effective) {
           this.byQualifiedId.set(r.qualifiedId, r);
           const listByName = this.byName.get(r.baseName) ?? [];
@@ -18830,7 +18899,11 @@ var init_resource_record = __esm({
 });
 
 // libs/sdk/src/tool/ui/ui-shared.ts
-import { MCP_APPS_MIME_TYPE, renderToolTemplate, detectUIType as uipackDetectUIType } from "@frontmcp/uipack/adapters";
+import {
+  MCP_APPS_MIME_TYPE,
+  renderToolTemplate,
+  detectUIType as uipackDetectUIType
+} from "@frontmcp/uipack/adapters";
 function extractSizing(uiConfig) {
   if (!uiConfig) return void 0;
   const sizing = {};
@@ -18891,8 +18964,18 @@ var init_ui_shared = __esm({
       manifests = /* @__PURE__ */ new Map();
       resourceMeta = /* @__PURE__ */ new Map();
       resolver;
-      constructor(resolver) {
+      options;
+      constructor(resolver, options = {}) {
         this.resolver = resolver;
+        this.options = options;
+      }
+      /** Tool-level `ui.escapeStringResults` wins over the server-wide default. */
+      stringResultOptions(uiConfig) {
+        const toolSetting = uiConfig?.["escapeStringResults"];
+        return {
+          escapeStringResults: typeof toolSetting === "boolean" ? toolSetting : this.options.escapeStringResults,
+          logger: this.options.logger
+        };
       }
       getStaticWidget(name44) {
         return this.widgets.get(name44);
@@ -18931,7 +19014,8 @@ var init_ui_shared = __esm({
           template,
           resolver: this.resolver,
           resourceMode,
-          sizing: extractSizing(uiConfig)
+          sizing: extractSizing(uiConfig),
+          ...this.stringResultOptions(uiConfig)
         });
         this.widgets.set(toolName, result.html);
         this.manifests.set(toolName, {
@@ -19008,7 +19092,8 @@ var init_ui_shared = __esm({
           platformType,
           resolver: this.resolver,
           resourceMode,
-          sizing: extractSizing(uiConfig)
+          sizing: extractSizing(uiConfig),
+          ...this.stringResultOptions(uiConfig)
         });
         return { meta: result.meta };
       }
@@ -19268,13 +19353,14 @@ import { AuthorityDeniedError as AuthorityDeniedError4, resolveRequiredScopes as
 import { z as z51 } from "@frontmcp/lazy-zod";
 import { ReadResourceRequestSchema as ReadResourceRequestSchema2, ReadResourceResultSchema } from "@frontmcp/protocol";
 import { randomBytes as randomBytes2 } from "@frontmcp/utils";
-var inputSchema7, outputSchema7, stateSchema7, plan7, name7, Stage7, ReadResourceFlow;
+var inputSchema7, outputSchema7, stateSchema7, plan7, name7, Stage7, resolvedResources, ReadResourceFlow;
 var init_read_resource_flow = __esm({
   "libs/sdk/src/resource/flows/read-resource.flow.ts"() {
     "use strict";
     init_remote_capabilities_utils();
     init_common();
     init_errors();
+    init_resolved_entries();
     init_hooks_utils();
     init_flow_context_providers();
     init_ui();
@@ -19316,17 +19402,19 @@ var init_read_resource_flow = __esm({
     };
     name7 = "resources:read-resource";
     ({ Stage: Stage7 } = FlowHooksOf(name7));
+    resolvedResources = new ResolvedEntries();
     ReadResourceFlow = class extends FlowBase {
       static async resolveHookOwnerId(rawInput, scope) {
-        const parsed = inputSchema7.safeParse(rawInput);
-        if (!parsed.success) return void 0;
-        const findResource = () => scope.resources.findResourceForUri(parsed.data.request.params.uri)?.instance;
-        let resource = findResource();
-        if (!resource) {
+        const uri = rawInput?.request?.params?.uri;
+        if (typeof uri !== "string") return void 0;
+        let match = scope.resources.findResourceForUri(uri);
+        if (!match) {
           await loadRemoteAppCapabilities(scope);
-          resource = findResource();
+          match = scope.resources.findResourceForUri(uri);
         }
-        return resource ? appOwnerIdOf(scope.resources.lineageOf(resource) ?? [], resource.owner) : void 0;
+        if (!match) return void 0;
+        resolvedResources.remember(rawInput, uri, match);
+        return appOwnerIdOf(scope.resources.lineageOf(match.instance) ?? [], match.instance.owner);
       }
       logger = this.scopeLogger.child("ReadResourceFlow");
       async parseInput() {
@@ -19411,7 +19499,7 @@ var init_read_resource_flow = __esm({
             return;
           }
         }
-        const match = this.scope.resources.findResourceForUri(uri);
+        const match = resolvedResources.take(this.rawInput, uri) ?? this.scope.resources.findResourceForUri(uri);
         if (!match) {
           this.logger.warn(`findResource: resource for URI "${uri}" not found`);
           throw new ResourceNotFoundError(uri);
@@ -19471,14 +19559,8 @@ var init_read_resource_flow = __esm({
         const { resource, input, params } = this.state.required;
         try {
           const sessionKey = this.state.sessionId ?? ctx.authInfo?.sessionId ?? `req-${Date.now()}-${Buffer.from(randomBytes2(16)).toString("hex")}`;
-          const resourceViews = await resource.providers.buildViews(sessionKey, new Map(this.deps));
-          const mergedContextDeps = new Map(this.deps);
-          for (const [token, instance] of resourceViews.context) {
-            if (!mergedContextDeps.has(token)) {
-              mergedContextDeps.set(token, instance);
-            }
-          }
-          const contextProviders = new FlowContextProviders(resource.providers, mergedContextDeps);
+          const resourceViews = await resource.providers.buildViews(sessionKey, new Map(this.deps), this.scope.providers);
+          const contextProviders = new FlowContextProviders(resource.providers, resourceViews.context);
           const context = resource.create(input.uri, params, { ...ctx, contextProviders });
           this.appendContextHooks(hooksBoundTo(this.scope.hooks.getClsHooks(resource.record.provide), context));
           context.mark("createResourceContext");
@@ -20727,6 +20809,8 @@ var init_resource_registry = __esm({
       // "ownerKey:name" -> row
       byOwner = /* @__PURE__ */ new Map();
       // ownerKey -> rows
+      lineages = new EntryLineageIndex();
+      // instance -> first row's lineage
       // version + emitter
       version = 0;
       emitter = new ResourceEmitter();
@@ -20939,7 +21023,7 @@ var init_resource_registry = __esm({
       }
       /** Owner lineage (root → leaf) of a resource this registry holds, or undefined when it holds none. */
       lineageOf(entry) {
-        return this.listAllIndexed().find((row) => row.instance === entry)?.lineage;
+        return this.lineages.lineageOf(entry);
       }
       /** List instances by owner path (e.g. "app:Portal/plugin:Okta") */
       listByOwner(ownerPath) {
@@ -20954,6 +21038,7 @@ var init_resource_registry = __esm({
         this.byUriTemplate.clear();
         this.byOwnerAndName.clear();
         this.byOwner.clear();
+        this.lineages.rebuild(effective);
         for (const r of effective) {
           this.byQualifiedId.set(r.qualifiedId, r);
           const listByName = this.byName.get(r.baseName) ?? [];
@@ -21561,7 +21646,7 @@ function linkedAbortController(signal) {
   else signal?.addEventListener("abort", () => controller.abort(signal.reason), { once: true });
   return controller;
 }
-var inputSchema13, outputSchema12, stateSchema12, plan12, name12, Stage12, CallToolFlow;
+var inputSchema13, outputSchema12, stateSchema12, plan12, name12, Stage12, resolvedTools, CallToolFlow;
 var init_call_tool_flow = __esm({
   "libs/sdk/src/tool/flows/call-tool.flow.ts"() {
     "use strict";
@@ -21572,6 +21657,7 @@ var init_call_tool_flow = __esm({
     init_tool_metadata();
     init_helpers();
     init_errors();
+    init_resolved_entries();
     init_hooks_utils();
     init_flow_context_providers();
     init_task_id();
@@ -21646,6 +21732,7 @@ var init_call_tool_flow = __esm({
     };
     name12 = "tools:call-tool";
     ({ Stage: Stage12 } = FlowHooksOf(name12));
+    resolvedTools = new ResolvedEntries();
     CallToolFlow = class extends FlowBase {
       static async resolveHookOwnerId(rawInput, scope) {
         const toolName = rawInput?.request?.params?.name;
@@ -21655,7 +21742,9 @@ var init_call_tool_flow = __esm({
           await loadRemoteAppCapabilities(scope);
           tool = lookupTool(scope, toolName);
         }
-        return tool ? hookOwnerIdOf(scope.tools.lineageOf(tool) ?? [], tool.owner) : void 0;
+        if (!tool) return void 0;
+        resolvedTools.remember(rawInput, toolName, tool);
+        return hookOwnerIdOf(scope.tools.lineageOf(tool) ?? [], tool.owner);
       }
       logger = this.scopeLogger.child("CallToolFlow");
       async parseInput() {
@@ -21698,7 +21787,7 @@ var init_call_tool_flow = __esm({
       async findTool() {
         this.logger.verbose("findTool:start");
         const { name: name44 } = this.state.required.input;
-        const tool = lookupTool(this.scope, name44);
+        const tool = resolvedTools.take(this.rawInput, name44) ?? lookupTool(this.scope, name44);
         if (tool && tool.fullName !== name44 && tool.name !== name44) {
           const [, alias] = toolNameCandidates(name44);
           this.logger.warn(
@@ -22001,14 +22090,8 @@ var init_call_tool_flow = __esm({
         const progressToken = this.state.progressToken;
         try {
           const sessionKey = authInfo?.sessionId ?? "anonymous";
-          const toolViews = await tool.providers.buildViews(sessionKey, new Map(this.deps));
-          const mergedContextDeps = new Map(this.deps);
-          for (const [token, instance] of toolViews.context) {
-            if (!mergedContextDeps.has(token)) {
-              mergedContextDeps.set(token, instance);
-            }
-          }
-          const contextProviders = new FlowContextProviders(tool.providers, mergedContextDeps);
+          const toolViews = await tool.providers.buildViews(sessionKey, new Map(this.deps), this.scope.providers);
+          const contextProviders = new FlowContextProviders(tool.providers, toolViews.context);
           const executionAbort = linkedAbortController(ctx.signal);
           this.state.set("executionAbort", executionAbort);
           const context = tool.create(input.arguments, {
@@ -23079,8 +23162,8 @@ var init_tool_registry = __esm({
       // "providerId:name" -> row (best-effort)
       byOwner = /* @__PURE__ */ new Map();
       // ownerKey -> rows
-      byInstance = /* @__PURE__ */ new Map();
-      // instance -> first row
+      lineages = new EntryLineageIndex();
+      // instance -> first row's lineage
       // version + emitter
       version = 0;
       emitter = new ToolEmitter();
@@ -23300,10 +23383,9 @@ var init_tool_registry = __esm({
         this.byOwnerAndName.clear();
         this.byProviderAndName.clear();
         this.byOwner.clear();
-        this.byInstance.clear();
+        this.lineages.rebuild(effective);
         for (const r of effective) {
           this.byQualifiedId.set(r.qualifiedId, r);
-          if (!this.byInstance.has(r.instance)) this.byInstance.set(r.instance, r);
           const listByName = this.byName.get(r.baseName) ?? [];
           listByName.push(r);
           this.byName.set(r.baseName, listByName);
@@ -23325,7 +23407,7 @@ var init_tool_registry = __esm({
       }
       /** Owner lineage (root → leaf) of a tool this registry holds, or undefined when it holds none. */
       lineageOf(entry) {
-        return this.byInstance.get(entry)?.lineage;
+        return this.lineages.lineageOf(entry);
       }
       /** List instances by owner path (e.g. "app:Portal/plugin:Okta") */
       listByOwner(ownerPath) {
@@ -28315,6 +28397,10 @@ var init_plugin_registry = __esm({
           const providers = new ProviderRegistry(rec.metadata.providers ?? [], this.providers);
           await providers.ready;
           const providerHooks = normalizeHooksFromProviders(providers);
+          const { pluginInstance, dynamicProviders } = await this.instantiatePlugin(rec, deps);
+          if (dynamicProviders) {
+            await providers.addDynamicProviders(dynamicProviders);
+          }
           const pluginOwner = {
             kind: "plugin",
             id: rec.metadata.name,
@@ -28346,32 +28432,6 @@ var init_plugin_registry = __esm({
             return providers.getProviderInfo(token2.provide);
           });
           this.providers.mergeFromRegistry(providers, exported);
-          const depsTokens = [...deps];
-          const depsInstances = await Promise.all(depsTokens.map((t) => this.providers.resolveBootstrapDep(t)));
-          let pluginInstance;
-          let optionDerivedProviders = [];
-          if (rec.kind === "CLASS" /* CLASS */) {
-            const klass = rec.useClass;
-            pluginInstance = new klass(...depsInstances);
-          } else if (rec.kind === "CLASS_TOKEN" /* CLASS_TOKEN */) {
-            const klass = rec.provide;
-            pluginInstance = new klass(...depsInstances);
-          } else if (rec.kind === "FACTORY" /* FACTORY */) {
-            const factoryDeps = [...rec.inject()];
-            const args = [];
-            for (const d of factoryDeps) args.push(await this.providers.resolveBootstrapDep(d));
-            const produced = rec.useFactory(...args);
-            if (isDynamicPluginClass(rec.provide) && !(produced instanceof rec.provide)) {
-              pluginInstance = new rec.provide(produced);
-              optionDerivedProviders = collectDynamicProviders(rec.provide, produced);
-            } else {
-              pluginInstance = produced;
-            }
-          } else if (rec.kind === "VALUE" /* VALUE */) {
-            pluginInstance = rec.useValue;
-          } else {
-            throw new InvalidRegistryKindError("plugin", rec.kind);
-          }
           const pluginScope = rec.metadata.scope ?? "app";
           if (this.scopeInfo?.isStandaloneApp && pluginScope === "server") {
             throw new InvalidPluginScopeError(
@@ -28405,9 +28465,7 @@ var init_plugin_registry = __esm({
           if (contextExtensions && contextExtensions.length > 0) {
             installContextExtensions(rec.metadata.name, contextExtensions);
           }
-          const dynamicProviders = optionDerivedProviders.length > 0 ? dedupePluginProviders([...optionDerivedProviders, ...rec.providers ?? []]) : rec.providers;
           if (dynamicProviders) {
-            await providers.addDynamicProviders(dynamicProviders);
             const normalized = dynamicProviders.map((p) => normalizeProvider(p));
             const singletons = providers.getAllSingletons();
             const exported2 = normalized.map((def) => ({
@@ -28430,6 +28488,39 @@ var init_plugin_registry = __esm({
           );
         }
       }
+      /** Builds the plugin instance and the providers it contributes; a factory's options exist only once it has run. */
+      async instantiatePlugin(rec, deps) {
+        const depsInstances = await Promise.all([...deps].map((t) => this.providers.resolveBootstrapDep(t)));
+        switch (rec.kind) {
+          case "CLASS" /* CLASS */:
+            return {
+              pluginInstance: new rec.useClass(...depsInstances),
+              dynamicProviders: rec.providers
+            };
+          case "CLASS_TOKEN" /* CLASS_TOKEN */:
+            return {
+              pluginInstance: new rec.provide(...depsInstances),
+              dynamicProviders: rec.providers
+            };
+          case "VALUE" /* VALUE */:
+            return { pluginInstance: rec.useValue, dynamicProviders: rec.providers };
+          case "FACTORY" /* FACTORY */: {
+            const args = [];
+            for (const d of rec.inject()) args.push(await this.providers.resolveBootstrapDep(d));
+            const produced = rec.useFactory(...args);
+            if (isDynamicPluginClass(rec.provide) && !(produced instanceof rec.provide)) {
+              const optionDerived = collectDynamicProviders(rec.provide, produced);
+              return {
+                pluginInstance: new rec.provide(produced),
+                dynamicProviders: optionDerived.length > 0 ? dedupePluginProviders([...optionDerived, ...rec.providers ?? []]) : rec.providers
+              };
+            }
+            return { pluginInstance: produced, dynamicProviders: rec.providers };
+          }
+          default:
+            throw new InvalidRegistryKindError("plugin", rec.kind);
+        }
+      }
     };
   }
 });
@@ -31462,12 +31553,13 @@ async function dispatch20260728(options) {
     return outcome.kind === "result" ? { kind: "result", result: decorate(outcome.result) } : outcome;
   }
   if (method === "server/discover") {
+    const instructions = await composeInstructions?.({ authInfo });
     return {
       kind: "result",
-      result: decorate(buildDiscoverResult(scope, composeInstructions?.()))
+      result: decorate(buildDiscoverResult(scope, instructions))
     };
   }
-  const serverOptions = buildScopedServerOptions(scope, composeInstructions?.() ?? "");
+  const serverOptions = buildScopedServerOptions(scope);
   const handlers = createMcpHandlers({ scope, serverOptions, composeInstructions });
   const handler = handlers.find((entry) => methodOfSchema(entry.requestSchema) === method);
   if (!handler) {
@@ -43696,13 +43788,24 @@ function findCompletionReference(scope, ref) {
   if (ref.type === "ref/prompt") return { prompt: scope.prompts.findByName(ref.name) };
   return { resource: scope.resources.findResourceForUri(ref.uri)?.instance };
 }
-var inputSchema29, outputSchema27, PromptRefSchema, ResourceRefSchema, stateSchema27, plan27, name28, Stage28, CompleteFlow;
+function referenceKeyOf(ref) {
+  return ref.type === "ref/prompt" ? `prompt:${ref.name}` : `resource:${ref.uri}`;
+}
+function isWidgetToolNameCompletion(ref, argumentName) {
+  return ref.type === "ref/resource" && ref.uri.startsWith("ui://widget/") && argumentName === "toolName";
+}
+function isListedTool(tool, listedNames) {
+  const baseName = tool.metadata.id ?? tool.metadata.name;
+  return listedNames.has(baseName) || listedNames.has(`${tool.owner.id}:${baseName}`);
+}
+var inputSchema29, outputSchema27, PromptRefSchema, ResourceRefSchema, CompletionRefSchema, stateSchema27, plan27, name28, Stage28, resolvedReferences, MAX_TOOL_LIST_PAGES, CompleteFlow;
 var init_complete_flow = __esm({
   "libs/sdk/src/completion/flows/complete.flow.ts"() {
     "use strict";
     init_remote_capabilities_utils();
     init_common();
     init_errors();
+    init_resolved_entries();
     init_ui();
     init_lineage_utils();
     inputSchema29 = z79.object({
@@ -43718,8 +43821,9 @@ var init_complete_flow = __esm({
       type: z79.literal("ref/resource"),
       uri: z79.string()
     });
+    CompletionRefSchema = z79.discriminatedUnion("type", [PromptRefSchema, ResourceRefSchema]);
     stateSchema27 = z79.object({
-      ref: z79.discriminatedUnion("type", [PromptRefSchema, ResourceRefSchema]),
+      ref: CompletionRefSchema,
       argument: z79.object({
         name: z79.string(),
         value: z79.string()
@@ -43727,25 +43831,33 @@ var init_complete_flow = __esm({
       // z.any() used because PromptEntry and ResourceEntry are complex abstract class types
       prompt: z79.any().optional(),
       resource: z79.any().optional(),
+      widgetTools: z79.array(z79.instanceof(ToolEntry)).optional(),
       output: outputSchema27
     });
     plan27 = {
-      pre: ["parseInput", "findReference"],
+      pre: ["parseInput", "findReference", "findWidgetTools"],
       execute: ["complete"],
       finalize: ["finalize"]
     };
     name28 = "completion:complete";
     ({ Stage: Stage28 } = FlowHooksOf(name28));
+    resolvedReferences = new ResolvedEntries();
+    MAX_TOOL_LIST_PAGES = 1e3;
     CompleteFlow = class extends FlowBase {
       static async resolveHookOwnerId(rawInput, scope) {
-        const parsed = inputSchema29.safeParse(rawInput);
+        const parsed = CompletionRefSchema.safeParse(
+          rawInput?.request?.params?.ref
+        );
         if (!parsed.success) return void 0;
-        const { ref } = parsed.data.request.params;
-        let { prompt, resource } = findCompletionReference(scope, ref);
-        if (!prompt && !resource) {
+        const ref = parsed.data;
+        let reference = findCompletionReference(scope, ref);
+        if (!reference.prompt && !reference.resource) {
           await loadRemoteAppCapabilities(scope);
-          ({ prompt, resource } = findCompletionReference(scope, ref));
+          reference = findCompletionReference(scope, ref);
         }
+        const { prompt, resource } = reference;
+        if (!prompt && !resource) return void 0;
+        resolvedReferences.remember(rawInput, referenceKeyOf(ref), reference);
         if (prompt) return appOwnerIdOf(scope.prompts.lineageOf(prompt) ?? [], prompt.owner);
         return resource ? appOwnerIdOf(scope.resources.lineageOf(resource) ?? [], resource.owner) : void 0;
       }
@@ -43782,10 +43894,43 @@ var init_complete_flow = __esm({
       }
       async findReference() {
         this.logger.verbose("findReference:start");
-        const { prompt, resource } = findCompletionReference(this.scope, this.state.required.ref);
+        const { ref } = this.state.required;
+        const { prompt, resource } = resolvedReferences.take(this.rawInput, referenceKeyOf(ref)) ?? findCompletionReference(this.scope, ref);
         this.state.set({ prompt, resource });
         this.logger.verbose("findReference:done");
       }
+      async findWidgetTools() {
+        const { ref, argument } = this.state.required;
+        if (!isWidgetToolNameCompletion(ref, argument.name)) return;
+        this.logger.verbose("findWidgetTools:start");
+        const uiTools = this.scope.tools.getTools().filter((tool) => hasUIConfig(tool.metadata));
+        const listedNames = uiTools.length > 0 ? await this.listToolNames() : /* @__PURE__ */ new Set();
+        this.state.set(
+          "widgetTools",
+          uiTools.filter((tool) => isListedTool(tool, listedNames))
+        );
+        this.logger.verbose("findWidgetTools:done");
+      }
+      /** Every tool name `tools/list` returns this caller, across all pages; none when listing fails. */
+      async listToolNames() {
+        const names = /* @__PURE__ */ new Set();
+        let cursor;
+        try {
+          for (let page = 0; page < MAX_TOOL_LIST_PAGES; page++) {
+            const { tools, nextCursor } = await this.scope.runFlowForOutput("tools:list-tools", {
+              request: { method: "tools/list", params: cursor ? { cursor } : {} },
+              ctx: this.input.ctx
+            });
+            for (const tool of tools) names.add(tool.name);
+            if (!nextCursor) break;
+            cursor = nextCursor;
+          }
+        } catch (e) {
+          this.logger.warn(`findWidgetTools: tools/list failed, offering no tool names: ${e}`);
+          names.clear();
+        }
+        return names;
+      }
       async complete() {
         this.logger.verbose("complete:start");
         const { ref, argument } = this.state.required;
@@ -43823,9 +43968,8 @@ var init_complete_flow = __esm({
           this.logger.debug(
             `complete: resource completion for URI "${uri}" argument "${argName}" with value "${argValue}"`
           );
-          if (uri.startsWith("ui://widget/") && argName === "toolName") {
-            const toolsWithUI = this.scope.tools.getTools().filter((t) => hasUIConfig(t.metadata));
-            const toolNames = toolsWithUI.map((t) => t.metadata.id ?? t.metadata.name);
+          if (isWidgetToolNameCompletion(ref, argName)) {
+            const toolNames = (this.state.widgetTools ?? []).map((t) => t.metadata.id ?? t.metadata.name);
             const prefix = argValue.toLowerCase();
             values = toolNames.filter((name44) => name44.toLowerCase().startsWith(prefix));
             total = values.length;
@@ -43869,6 +44013,9 @@ var init_complete_flow = __esm({
     __decorateClass([
       Stage28("findReference")
     ], CompleteFlow.prototype, "findReference", 1);
+    __decorateClass([
+      Stage28("findWidgetTools")
+    ], CompleteFlow.prototype, "findWidgetTools", 1);
     __decorateClass([
       Stage28("complete")
     ], CompleteFlow.prototype, "complete", 1);
@@ -49484,7 +49631,6 @@ var init_search_skills_flow = __esm({
     "use strict";
     init_common();
     init_errors();
-    init_skill_authorities_helper();
     init_skill_filter_helper();
     TELEMETRY_ACCESSOR_TOKEN = /* @__PURE__ */ Symbol.for("frontmcp:observability:telemetry-accessor");
     inputSchema33 = z95.object({
@@ -49592,8 +49738,10 @@ var init_search_skills_flow = __esm({
           const visibility = result.metadata.visibility ?? "both";
           return visibility === "mcp" || visibility === "both";
         });
-        const authVisibleResults = await this.filterResultsByAuthorities(mcpVisibleResults);
-        const servableResults = this.scope.skills ? await filterServableSkillResults(this.scope, this.scope.skills, authVisibleResults) : authVisibleResults;
+        const registry = this.scope.skills;
+        const ctx = this.rawInput["ctx"];
+        const authInfo = ctx?.["authInfo"] ?? {};
+        const servableResults = registry ? await filterDiscoverableSkillResults(this.scope, registry, mcpVisibleResults, { authInfo }) : mcpVisibleResults;
         const skills = servableResults.map((result) => ({
           id: result.metadata.id ?? result.metadata.name,
           name: result.metadata.name,
@@ -49629,25 +49777,6 @@ var init_search_skills_flow = __esm({
         this.respond(output);
         this.logger.verbose("finalize:done");
       }
-      /**
-       * Remove search results the caller is not authorized to discover.
-       *
-       * Search-result metadata is projected from `SkillContent` and does NOT carry
-       * the `authorities` field, so we resolve the live skill entry (by id/name)
-       * to read its declared authorities, then evaluate via the scope's engine.
-       * No-op when no authorities engine is configured; results unchanged.
-       *
-       * Evaluated WITHOUT request input — `fromInput`/ReBAC-by-input policies can't
-       * be evaluated at search time and will be treated as a denial. Use
-       * role/permission/claims-based authorities for discoverable skills.
-       */
-      async filterResultsByAuthorities(results) {
-        const registry = this.scope.skills;
-        if (!registry) return results;
-        const ctx = this.rawInput["ctx"];
-        const authInfo = ctx?.["authInfo"] ?? {};
-        return filterSkillMetadataByAuthorities(this.scope, registry, results, authInfo);
-      }
     };
     __decorateClass([
       Stage32("parseInput")
@@ -49679,6 +49808,7 @@ var init_load_skill_flow = __esm({
     init_common();
     init_errors();
     init_skill_authorities_helper();
+    init_skill_entry_resolver();
     init_skill_filter_helper();
     init_skill_http_utils();
     init_skill_utils();
@@ -49780,13 +49910,14 @@ var init_load_skill_flow = __esm({
         const ctx = this.rawInput["ctx"];
         const authInfo = ctx?.["authInfo"] ?? {};
         const loadResults = [];
+        const resolveEntry = createSkillEntryResolver(skillRegistry);
         for (const skillId of skillIds) {
           const result = await skillRegistry.loadSkill(skillId);
           if (!result) {
             warnings.push(`Skill "${skillId}" not found`);
             continue;
           }
-          const entry = this.findSkillEntry(skillId, result.skill.id);
+          const entry = resolveEntry(skillId, result.skill.id);
           if (entry) {
             if (!await isSkillServable(this.scope, entry)) {
               warnings.push(`Skill "${skillId}" not found`);
@@ -49799,17 +49930,6 @@ var init_load_skill_flow = __esm({
         this.state.set({ loadResults, warnings });
         this.logger.verbose("loadSkills:done", { loaded: loadResults.length, notFound: warnings.length });
       }
-      /**
-       * Resolve the registered skill entry that backs a loaded skill, so its
-       * `authorities` metadata can be evaluated. Matches by the requested id, the
-       * resolved content id, and finally by display name — covering id/name/
-       * qualified-name lookups the registry's `loadSkill` accepts.
-       */
-      findSkillEntry(requestedId, resolvedId) {
-        const registry = this.scope.skills;
-        if (!registry) return void 0;
-        return registry.findByName(requestedId) ?? registry.findByQualifiedName(requestedId) ?? registry.findByName(resolvedId) ?? registry.getSkills(true).find((s) => (s.metadata.id ?? s.name) === resolvedId || s.metadata.name === resolvedId);
-      }
       async activateSessions() {
         this.logger.verbose("activateSessions:start");
         const { activateSession, policyMode, loadResults } = this.state.required;
@@ -50805,6 +50925,7 @@ var init_skills_api_flow = __esm({
     init_skills_http();
     init_auth3();
     init_skill_authorities_helper();
+    init_skill_entry_resolver();
     init_skill_filter_helper();
     init_skill_http_utils();
     init_skill_utils();
@@ -50989,7 +51110,7 @@ var init_skills_api_flow = __esm({
           return;
         }
         const { skill, availableTools, missingTools, isComplete, warning } = loadResult;
-        const skillEntry = skillRegistry.getSkills(true).find((s) => s.metadata.id === skill.id || s.metadata.id === void 0 && s.name === skill.id);
+        const skillEntry = createSkillEntryResolver(skillRegistry)(skillId, skill.id);
         if (skillEntry) {
           if (!await isSkillServable(this.scope, skillEntry)) {
             respondNotFound();
@@ -51082,8 +51203,9 @@ var init_skills_api_flow = __esm({
           const visibility = r.metadata.visibility ?? "both";
           return visibility !== "mcp";
         });
-        filteredResults = await this.filterHttpResultsByAuthorities(filteredResults, skillRegistry);
-        filteredResults = await filterServableSkillResults(this.scope, skillRegistry, filteredResults);
+        filteredResults = await filterDiscoverableSkillResults(this.scope, skillRegistry, filteredResults, {
+          authInfo: this.httpAuthInfo()
+        });
         if (options.category) {
           filteredResults = filteredResults.filter((r) => r.metadata.category === options.category);
         }
@@ -51158,14 +51280,6 @@ var init_skills_api_flow = __esm({
         const user = request?.authSession?.user;
         return user ? { user } : {};
       }
-      /**
-       * Filter search results (whose projected metadata lacks `authorities`) down
-       * to skills the caller can discover, by resolving the live skill entry to
-       * read its declared authorities. No-op when no engine is configured.
-       */
-      async filterHttpResultsByAuthorities(results, skillRegistry) {
-        return filterSkillMetadataByAuthorities(this.scope, skillRegistry, results, this.httpAuthInfo());
-      }
       async handleListSkills(options, skillRegistry) {
         const allSkills = skillRegistry.getSkills({ includeHidden: false, visibility: "http" });
         let filteredSkills = await filterServableSkills(
@@ -53944,6 +54058,7 @@ function buildPerSkillResourceRecord(scope, skill, opts = {}) {
 }
 async function registerPerSkillResources(options) {
   const { scope, resourceRegistry, skills, logger, resolveLastModified } = options;
+  const registered = [];
   for (const skill of skills) {
     let lastModified;
     if (resolveLastModified) {
@@ -53958,6 +54073,11 @@ async function registerPerSkillResources(options) {
     try {
       const record = buildPerSkillResourceRecord(scope, skill, { lastModified });
       resourceRegistry.registerDynamicResource(record);
+      registered.push({
+        skillPath: skill.getSkillPath(),
+        metadata: record.metadata,
+        extensionKeys: Object.keys(skillExtensionMetadata(skill))
+      });
       logger.verbose(`Registered SEP-2640 per-skill resource: ${record.metadata.uri}`);
     } catch (err) {
       logger.warn(
@@ -53965,6 +54085,32 @@ async function registerPerSkillResources(options) {
       );
     }
   }
+  if (registered.length > 0) {
+    scope.skills?.subscribe({ immediate: false }, () => {
+      const served = servedSkillsByPath(scope);
+      for (const resource of registered) {
+        const skill = served.get(resource.skillPath);
+        if (skill) refreshFromSkill(resource, skill);
+      }
+    });
+  }
+}
+function servedSkillsByPath(scope) {
+  const served = /* @__PURE__ */ new Map();
+  for (const skill of getSepVisibleSkills(scope)) {
+    const skillPath = skill.getSkillPath();
+    if (!served.has(skillPath)) served.set(skillPath, skill);
+  }
+  return served;
+}
+function refreshFromSkill(resource, skill) {
+  const extensions = skillExtensionMetadata(skill);
+  for (const key of resource.extensionKeys) {
+    if (!(key in extensions)) Reflect.deleteProperty(resource.metadata, key);
+  }
+  Object.assign(resource.metadata, extensions);
+  resource.metadata["description"] = skill.metadata.description;
+  resource.extensionKeys = Object.keys(extensions);
 }
 var init_sep_2640_per_skill = __esm({
   "libs/sdk/src/skill/sep-2640/sep-2640.per-skill.ts"() {
@@ -55273,15 +55419,6 @@ var init_handle_sse_flow = __esm({
   }
 });
 
-// libs/sdk/src/transport/transport.types.ts
-var STATELESS_SESSION_ID;
-var init_transport_types = __esm({
-  "libs/sdk/src/transport/transport.types.ts"() {
-    "use strict";
-    STATELESS_SESSION_ID = "__stateless__";
-  }
-});
-
 // libs/sdk/src/transport/flows/handle.stateless-http.flow.ts
 import { z as z104 } from "@frontmcp/lazy-zod";
 import { RequestSchema } from "@frontmcp/protocol";
@@ -56650,8 +56787,7 @@ function sanitizeName(raw) {
   return s.length > MAX_SKILL_NAME_CHARS ? `${s.slice(0, MAX_SKILL_NAME_CHARS)}\u2026` : s;
 }
 function buildSkillsCatalogSummary(skillRegistry, options = {}) {
-  if (!skillRegistry) return "";
-  const skills = skillRegistry.getSkills({ visibility: "mcp" });
+  const skills = options.skills ?? skillRegistry?.getSkills({ visibility: "mcp" }) ?? [];
   if (skills.length === 0) return "";
   const pointers = options.mcpResources === false ? METHOD_POINTERS : RESOURCE_POINTERS;
   const lines = [pointers.header, ""];
@@ -56692,7 +56828,10 @@ function composeInitializeInstructions(options) {
   if (policy === "off") {
     return joinSections([user, channel2]);
   }
-  const catalog = buildSkillsCatalogSummary(options.skillRegistry, { mcpResources: options.mcpResources });
+  const catalog = buildSkillsCatalogSummary(options.skillRegistry, {
+    mcpResources: options.mcpResources,
+    skills: options.skills
+  });
   if (policy === "prepend") {
     return joinSections([catalog, channel2, user]);
   }
@@ -56703,6 +56842,60 @@ function buildChannelInstructions(channels) {
   const hasTwoWay = channels.getChannelInstances().some((ch) => ch.twoWay);
   return hasTwoWay ? "Events arrive as <channel> tags. Reply with the channel-reply tool." : "Events arrive as <channel> tags.";
 }
+async function composeCallerInstructions(scope, options = {}) {
+  const skillsConfig = scope.metadata.skillsConfig;
+  const composeOptions = {
+    userInstructions: scope.metadata.instructions,
+    channelInstructions: buildChannelInstructions(scope.channels),
+    skillRegistry: scope.skills,
+    policy: skillsConfig?.injectInstructions,
+    mcpResources: skillsConfig?.mcpResources
+  };
+  const withUriHints = options.skillUriHints === true && skillUriHintsEnabled(scope);
+  const listsSkills = withUriHints || includesSkillCatalog(composeOptions);
+  let skills = [];
+  if (listsSkills) {
+    try {
+      skills = await skillsVisibleTo(scope, options.ctx);
+    } catch (error) {
+      scope.logger.warn("initialize instructions: left the skills out, the skills:filter flow failed", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  const composed = composeInitializeInstructions({ ...composeOptions, skills });
+  const uriHints = withUriHints ? buildSkillUriHints(skills, scope.skills?.getSep2640InstructionUris?.() ?? []) : "";
+  return [composed, uriHints].filter((section) => section.length > 0).join("\n\n---\n\n");
+}
+function buildSkillUriHints(skills, extraUris = []) {
+  if (skills.length === 0) return "";
+  const lines = ["Available skills (load via resources/read):"];
+  for (const skill of skills) {
+    lines.push(`- skill://${skill.getSkillPath()}/SKILL.md \u2014 ${skill.metadata.description}`);
+  }
+  for (const extra of extraUris) {
+    lines.push(`- ${extra}`);
+  }
+  return lines.join("\n");
+}
+function skillUriHintsEnabled(scope) {
+  const skillsConfig = scope.metadata.skillsConfig;
+  if (!skillsConfig?.sep2640InInstructions || skillsConfig.mcpResources === false) return false;
+  const serverInstructions = (scope.metadata.instructions ?? "").trim();
+  return !(skillsConfig.injectInstructions === "replace" && serverInstructions.length > 0);
+}
+function includesSkillCatalog(options) {
+  const policy = options.policy ?? DEFAULT_POLICY;
+  if (policy === "off") return false;
+  return !(policy === "replace" && (options.userInstructions ?? "").trim().length > 0);
+}
+async function skillsVisibleTo(scope, ctx) {
+  const visible = scope.skills?.getSkills({ visibility: "mcp" }) ?? [];
+  if (visible.length === 0) return [];
+  const authInfo = ctx?.authInfo ?? {};
+  const authorized = await filterSkillsByAuthorities(scope, visible, authInfo);
+  return filterServableSkills(scope, authorized, ctx);
+}
 function joinSections(sections) {
   return sections.map((s) => (s ?? "").trim()).filter((s) => s.length > 0).join("\n\n---\n\n");
 }
@@ -56711,6 +56904,8 @@ var init_skill_instructions_helper = __esm({
   "libs/sdk/src/skill/skill-instructions.helper.ts"() {
     "use strict";
     init_sep_2640_constants();
+    init_skill_authorities_helper();
+    init_skill_filter_helper();
     DEFAULT_POLICY = "append";
     MAX_SKILL_CATALOG_CHARS = 16e3;
     TRUNCATION_FOOTER_RESERVE = 160;
@@ -56843,18 +57038,8 @@ var init_transport_local_adapter = __esm({
         const elicitationCapability = this.scope.metadata.elicitation?.enabled ? { elicitation: {} } : {};
         const channelCapabilities = this.scope.channels?.getCapabilities() ?? {};
         const skillsCapabilities = this.scope.skills?.getCapabilities() ?? {};
-        const composeInstructions = () => {
-          const composed = composeInitializeInstructions({
-            userInstructions: this.scope.metadata.instructions,
-            channelInstructions: buildChannelInstructions(this.scope.channels),
-            skillRegistry: this.scope.skills,
-            policy: this.scope.metadata.skillsConfig?.injectInstructions,
-            mcpResources: this.scope.metadata.skillsConfig?.mcpResources
-          });
-          const sep2640Hints = this.buildSkillInstructionHints();
-          return [composed, sep2640Hints].filter((s) => s.length > 0).join("\n\n---\n\n");
-        };
-        const instructions = composeInstructions();
+        const composeInstructions = (caller) => composeCallerInstructions(this.scope, { ctx: caller, skillUriHints: true });
+        const instructions = "";
         const mergedCapabilities = mergeExperimental([
           remoteCapabilities,
           // Pre-advertise for remote apps (may be overwritten by local)
@@ -57104,34 +57289,6 @@ var init_transport_local_adapter = __esm({
         const appObj = app;
         return "urlType" in appObj && appObj["standalone"] !== true;
       }
-      /**
-       * SEP-2640 §Discovery — opt-in `instructions` text listing each
-       * MCP-visible skill's `skill://` URI. Returns an empty string unless
-       * `skillsConfig.sep2640InInstructions` is true and the `skill://`
-       * resources are served (`skillsConfig.mcpResources` is not false). Also
-       * empty under `injectInstructions: 'replace'` with non-empty server
-       * instructions, which must then be sent alone.
-       */
-      buildSkillInstructionHints() {
-        const skillRegistry = this.scope.skills;
-        if (!skillRegistry?.hasAny()) return "";
-        const skillsConfig = this.scope.metadata?.skillsConfig;
-        if (!skillsConfig?.sep2640InInstructions || skillsConfig.mcpResources === false) return "";
-        const serverInstructions = (this.scope.metadata.instructions ?? "").trim();
-        if (skillsConfig.injectInstructions === "replace" && serverInstructions.length > 0) return "";
-        const visible = skillRegistry.getSkills({ visibility: "mcp" });
-        if (visible.length === 0) return "";
-        const lines = ["Available skills (load via resources/read):"];
-        for (const skill of visible) {
-          const uri = `skill://${skill.getSkillPath()}/SKILL.md`;
-          lines.push(`- ${uri} \u2014 ${skill.metadata.description}`);
-        }
-        const extras = skillRegistry.getSep2640InstructionUris?.() ?? [];
-        for (const extra of extras) {
-          lines.push(`- ${extra}`);
-        }
-        return lines.join("\n");
-      }
       /**
        * Build capabilities that should be pre-advertised for remote apps.
        * Remote apps load their tools/resources/prompts asynchronously after connection,
@@ -59782,7 +59939,10 @@ var init_scope_instance = __esm({
             this.logger.verbose("Created UI resolver with CDN overrides", { overrides: Object.keys(cdnOverrides) });
           }
         }
-        this.toolUIRegistry = new ToolUIRegistry(uiResolver);
+        this.toolUIRegistry = new ToolUIRegistry(uiResolver, {
+          escapeStringResults: this.metadata.ui?.escapeStringResults,
+          logger: this.logger
+        });
         if (!this.cliMode) {
           await this.compileUIWidgets();
         }
@@ -61283,26 +61443,37 @@ var init_provider_registry = __esm({
        *
        * @param sessionKey - Unique context/session identifier for CONTEXT-scoped providers
        * @param contextProviders - Optional pre-built CONTEXT-scoped providers (e.g., FrontMcpContext)
+       * @param contextSource - The ancestor registry whose views built `contextProviders`. Tokens this registry's
+       *   hierarchy defines below it are resolved from their own nearest definition instead of the pre-built instance,
+       *   so an app's plugin providers are not shadowed by the definition another app merged into the scope.
        * @returns ProviderViews with global and context provider maps (session/request as aliases)
        */
-      async buildViews(sessionKey, contextProviders) {
+      async buildViews(sessionKey, contextProviders, contextSource) {
         validateSessionId(sessionKey);
         const global = this.getAllSingletons();
         let sessionProviders;
+        const ownDefs = (contextSource && this.defsBelow(contextSource)) ?? /* @__PURE__ */ new Map();
         if (this.sessionCacheEnabled) {
           let cached = this.sessionStores.get(sessionKey);
           if (!cached) {
-            cached = { providers: /* @__PURE__ */ new Map(), lastAccess: Date.now() };
+            cached = { providers: /* @__PURE__ */ new Map(), bySource: /* @__PURE__ */ new Map(), lastAccess: Date.now() };
             this.sessionStores.set(sessionKey, cached);
           } else {
             cached.lastAccess = Date.now();
           }
           sessionProviders = cached.providers;
+          if (contextSource && ownDefs.size > 0) {
+            sessionProviders = cached.bySource.get(contextSource);
+            if (!sessionProviders) {
+              sessionProviders = /* @__PURE__ */ new Map();
+              cached.bySource.set(contextSource, sessionProviders);
+            }
+          }
         }
         const requestTokens = requestScopedTokens(contextProviders);
         const contextStore = new Map(sessionProviders ?? []);
         for (const [token, instance] of contextProviders ?? []) {
-          contextStore.set(token, instance);
+          if (!ownDefs.has(token)) contextStore.set(token, instance);
         }
         for (const token of this.order) {
           const rec = this.defs.get(token);
@@ -61317,6 +61488,18 @@ var init_provider_registry = __esm({
           if (contextStore.has(token)) continue;
           await this.buildIntoStoreWithViews(token, rec, contextStore, sessionKey, contextStore, global);
         }
+        for (const [token, { registry, rec }] of ownDefs) {
+          if (registry === this || contextStore.has(token)) continue;
+          if (registry.getProviderScope(rec) !== ProviderScope8.CONTEXT) continue;
+          await registry.buildIntoStoreWithViews(
+            token,
+            rec,
+            contextStore,
+            sessionKey,
+            contextStore,
+            registry.getAllSingletons()
+          );
+        }
         if (sessionProviders) {
           for (const [token, instance] of contextStore) {
             if (!sessionProviders.has(token) && !this.dependsOnAny(token, requestTokens)) {
@@ -61329,6 +61512,14 @@ var init_provider_registry = __esm({
           context: contextStore
         };
       }
+      /** Nearest definition of each token declared between this registry and `ancestor`; undefined when `ancestor` is not above it. */
+      defsBelow(ancestor) {
+        if (this === ancestor) return /* @__PURE__ */ new Map();
+        const owned = this.parentProviders?.defsBelow(ancestor);
+        if (!owned) return void 0;
+        for (const [token, rec] of this.defs) owned.set(token, { registry: this, rec });
+        return owned;
+      }
       dependsOnAny(token, targets, visited = /* @__PURE__ */ new Set()) {
         if (targets.has(token)) return true;
         if (visited.has(token)) return false;
@@ -61414,6 +61605,15 @@ var init_provider_registry = __esm({
             if (v !== void 0) return v;
             throw new ProviderNotInstantiatedError(tokenName18(token), "GLOBAL", "parent");
           }
+          await up.registry.buildIntoStoreWithViews(
+            token,
+            up.rec,
+            contextStore,
+            scopeKey,
+            contextStore,
+            up.registry.getAllSingletons()
+          );
+          return contextStore.get(token);
         }
         throw new ProviderDependencyError(`Cannot resolve dependency ${tokenName18(token)} from views`);
       }
@@ -63077,14 +63277,8 @@ var init_front_mcp = __esm({
             prompts: { listChanged: true }
           } : {};
           const channelCapabilities = scope.channels?.getCapabilities() ?? {};
-          const composeInstructions = () => composeInitializeInstructions({
-            userInstructions: scope.metadata.instructions,
-            channelInstructions: buildChannelInstructions(scope.channels),
-            skillRegistry: scope.skills,
-            policy: scope.metadata.skillsConfig?.injectInstructions,
-            mcpResources: scope.metadata.skillsConfig?.mcpResources
-          });
-          const instructions = composeInstructions();
+          const composeInstructions = (caller) => composeCallerInstructions(scope, { ctx: caller });
+          const instructions = "";
           const serverOptions = {
             instructions,
             capabilities: {
@@ -66064,6 +66258,7 @@ export {
   channelsConfigSchema,
   clearCreateCache,
   compareVersions,
+  composeCallerInstructions,
   composeInitializeInstructions,
   computeIssuer,
   computeResource,