@frontmcp/sdk 1.8.3 → 1.8.4

package/esm/index.mjs

@@ -110,7 +110,7 @@ function extractPublicMessageImpl(error, visited) {
   }
   return error == null ? "Unknown error" : String(error);
 }
-var MCP_ERROR_CODES, McpError, PublicMcpError, InternalMcpError, ToolNotFoundError, ToolNotConsentedError, EntryUnavailableError, ResourceNotFoundError, ResourceReadError, InvalidResourceUriError, InvalidInputError, InvalidOutputError, InvalidMethodError, PayloadTooLargeError, ToolExecutionError, RateLimitError, QuotaExceededError, UnauthorizedError, GenericServerError, DependencyNotFoundError, InvalidHookFlowError, InvalidPluginScopeError, RequestContextNotAvailableError, AuthConfigurationError, PromptNotFoundError, PromptExecutionError, SessionMissingError, UnsupportedClientVersionError, GlobalConfigNotFoundError, AuthorityDeniedMcpError, GuardLimitMcpError;
+var MCP_ERROR_CODES, sequentialErrorIds, McpError, PublicMcpError, InternalMcpError, ToolNotFoundError, ToolNotConsentedError, EntryUnavailableError, ResourceNotFoundError, ResourceReadError, InvalidResourceUriError, InvalidInputError, InvalidOutputError, InvalidMethodError, PayloadTooLargeError, ToolExecutionError, RateLimitError, QuotaExceededError, UnauthorizedError, GenericServerError, DependencyNotFoundError, InvalidHookFlowError, InvalidPluginScopeError, RequestContextNotAvailableError, AuthConfigurationError, PromptNotFoundError, PromptExecutionError, SessionMissingError, UnsupportedClientVersionError, GlobalConfigNotFoundError, AuthorityDeniedMcpError, GuardLimitMcpError;
 var init_mcp_error = __esm({
   "libs/sdk/src/errors/mcp.error.ts"() {
     "use strict";
@@ -132,6 +132,7 @@ var init_mcp_error = __esm({
       /** Parse error (-32700) */
       PARSE_ERROR: -32700
     };
+    sequentialErrorIds = 0;
     McpError = class extends Error {
       /**
        * Unique error ID for tracking in logs
@@ -144,7 +145,12 @@ var init_mcp_error = __esm({
         Error.captureStackTrace(this, this.constructor);
       }
       generateErrorId() {
-        return `err_${bytesToHex(randomBytes(8))}`;
+        try {
+          return `err_${bytesToHex(randomBytes(8))}`;
+        } catch {
+          sequentialErrorIds += 1;
+          return `err_${sequentialErrorIds.toString(16).padStart(16, "0")}`;
+        }
       }
       /**
        * Get the internal error message (for logging)
@@ -865,7 +871,8 @@ var init_plugin_tokens = __esm({
       skills: tokenFactory.meta("skills"),
       scope: tokenFactory.meta("scope"),
       contextExtensions: tokenFactory.meta("contextExtensions"),
-      enforcesMetadata: tokenFactory.meta("enforcesMetadata")
+      enforcesMetadata: tokenFactory.meta("enforcesMetadata"),
+      dynamicSkills: tokenFactory.meta("dynamicSkills")
     };
   }
 });
@@ -3436,7 +3443,8 @@ var init_plugin_metadata = __esm({
       skills: z30.array(annotatedFrontMcpSkillsSchema).optional(),
       scope: z30.enum(["app", "server"]).optional().default("app"),
       contextExtensions: z30.array(contextExtensionSchema).optional(),
-      enforcesMetadata: z30.array(z30.string().min(1)).optional()
+      enforcesMetadata: z30.array(z30.string().min(1)).optional(),
+      dynamicSkills: z30.boolean().optional()
     }).passthrough();
   }
 });
@@ -4571,6 +4579,25 @@ var init_tool_credentials_required_error = __esm({
   }
 });
 
+// libs/sdk/src/errors/session-identity-required.error.ts
+var SessionIdentityRequiredError;
+var init_session_identity_required_error = __esm({
+  "libs/sdk/src/errors/session-identity-required.error.ts"() {
+    "use strict";
+    init_mcp_error();
+    SessionIdentityRequiredError = class extends PublicMcpError {
+      mcpErrorCode = MCP_ERROR_CODES.FORBIDDEN;
+      constructor(what = "Session-scoped storage") {
+        super(
+          `${what} needs a verified session or a signed-in caller. Authenticate the request, or use a session transport (an MCP revision before 2026-07-28).`,
+          "SESSION_IDENTITY_REQUIRED",
+          403
+        );
+      }
+    };
+  }
+});
+
 // libs/sdk/src/errors/error-handler.ts
 import { isProduction as isProduction2 } from "@frontmcp/utils";
 function createErrorHandler(options = {}) {
@@ -5932,6 +5959,7 @@ __export(errors_exports, {
   ServerlessHandlerNotInitializedError: () => ServerlessHandlerNotInitializedError,
   SessionClaimConflictError: () => SessionClaimConflictError,
   SessionIdEmptyError: () => SessionIdEmptyError,
+  SessionIdentityRequiredError: () => SessionIdentityRequiredError,
   SessionMissingError: () => SessionMissingError,
   SessionSecretRequiredError: () => SessionSecretRequiredError,
   SessionVerificationFailedError: () => SessionVerificationFailedError,
@@ -5986,6 +6014,7 @@ var init_errors = __esm({
     init_mcp_error();
     init_authorization_required_error();
     init_tool_credentials_required_error();
+    init_session_identity_required_error();
     init_error_handler();
     init_agent_errors();
     init_task_error();
@@ -6468,30 +6497,30 @@ var require_dist = __commonJS({
       sqliteStorageOptionsSchema: () => sqliteStorageOptionsSchema
     });
     module.exports = __toCommonJS2(index_exports);
-    var import_utils108 = __require("@frontmcp/utils");
+    var import_utils113 = __require("@frontmcp/utils");
     var HKDF_SALT = new TextEncoder().encode("frontmcp-sqlite-storage-v1");
     var HKDF_INFO = new TextEncoder().encode("aes-256-gcm-value-encryption");
     var KEY_LENGTH = 32;
     function deriveEncryptionKey(secret) {
       const ikm = new TextEncoder().encode(secret);
-      return (0, import_utils108.hkdfSha256)(ikm, HKDF_SALT, HKDF_INFO, KEY_LENGTH);
+      return (0, import_utils113.hkdfSha256)(ikm, HKDF_SALT, HKDF_INFO, KEY_LENGTH);
     }
     var SEPARATOR = ":";
     function encryptValue(key, plaintext) {
-      const iv = (0, import_utils108.randomBytes)(12);
+      const iv = (0, import_utils113.randomBytes)(12);
       const plaintextBytes = new TextEncoder().encode(plaintext);
-      const { ciphertext, tag } = (0, import_utils108.encryptAesGcm)(key, plaintextBytes, iv);
-      return [(0, import_utils108.base64urlEncode)(iv), (0, import_utils108.base64urlEncode)(tag), (0, import_utils108.base64urlEncode)(ciphertext)].join(SEPARATOR);
+      const { ciphertext, tag } = (0, import_utils113.encryptAesGcm)(key, plaintextBytes, iv);
+      return [(0, import_utils113.base64urlEncode)(iv), (0, import_utils113.base64urlEncode)(tag), (0, import_utils113.base64urlEncode)(ciphertext)].join(SEPARATOR);
     }
     function decryptValue(key, encrypted) {
       const parts = encrypted.split(SEPARATOR);
       if (parts.length !== 3) {
         throw new Error("Invalid encrypted value format");
       }
-      const iv = (0, import_utils108.base64urlDecode)(parts[0]);
-      const tag = (0, import_utils108.base64urlDecode)(parts[1]);
-      const ciphertext = (0, import_utils108.base64urlDecode)(parts[2]);
-      const plaintext = (0, import_utils108.decryptAesGcm)(key, ciphertext, iv, tag);
+      const iv = (0, import_utils113.base64urlDecode)(parts[0]);
+      const tag = (0, import_utils113.base64urlDecode)(parts[1]);
+      const ciphertext = (0, import_utils113.base64urlDecode)(parts[2]);
+      const plaintext = (0, import_utils113.decryptAesGcm)(key, ciphertext, iv, tag);
       return new TextDecoder().decode(plaintext);
     }
     var import_utils210 = __require("@frontmcp/utils");
@@ -7405,8 +7434,8 @@ function detectStorageType(storage, configuredType) {
   return "memory";
 }
 async function createTaskStore(options = {}) {
-  const { storage: storageConfig, redis, keyPrefix = "mcp:task:", logger, isEdgeRuntime: isEdgeRuntime2 = false, sqlite } = options;
-  if (isEdgeRuntime2 && sqlite) {
+  const { storage: storageConfig, redis, keyPrefix = "mcp:task:", logger, isEdgeRuntime: isEdgeRuntime3 = false, sqlite } = options;
+  if (isEdgeRuntime3 && sqlite) {
     throw new TaskStoreNotSupportedError(
       "SQLite task store is not supported on Edge runtime (better-sqlite3 is a native module). Use Redis or Upstash."
     );
@@ -7461,7 +7490,7 @@ async function createTaskStore(options = {}) {
       "Vercel KV is not supported for task stores (pub/sub required). Use Redis or Upstash."
     );
   }
-  if (isEdgeRuntime2 && (!finalStorageConfig || finalStorageConfig.type === "memory")) {
+  if (isEdgeRuntime3 && (!finalStorageConfig || finalStorageConfig.type === "memory")) {
     throw new TaskStoreNotSupportedError(
       "Tasks require distributed storage on Edge runtime. Configure Redis or Upstash."
     );
@@ -7469,7 +7498,7 @@ async function createTaskStore(options = {}) {
   const storage = await createStorage({
     ...finalStorageConfig,
     prefix: keyPrefix,
-    fallback: isEdgeRuntime2 ? "error" : "memory"
+    fallback: isEdgeRuntime3 ? "error" : "memory"
   });
   const store = new StorageTaskStore(storage, logger);
   const type = detectStorageType(storage, finalStorageConfig?.type);
@@ -7651,8 +7680,9 @@ var init_task_id = __esm({
 });
 
 // libs/sdk/src/task/helpers/task-runner.ts
+import { runRequestExclusive } from "@frontmcp/utils";
 function runTaskInBackground(params) {
-  return Promise.resolve().then(() => executeTask(params));
+  return Promise.resolve().then(() => runRequestExclusive(() => executeTask(params)));
 }
 async function executeTask(params) {
   const { record, cleanedRequestParams, ctx, scope, store, registry, notifier, logger } = params;
@@ -8694,6 +8724,7 @@ var init_get_prompt_request_handler = __esm({
 import {
   ListRootsResultSchema
 } from "@frontmcp/protocol";
+import { awaitOutsideRequest } from "@frontmcp/utils";
 function hasMcpAppsExtension(capabilities) {
   if (!capabilities?.experimental) {
     return false;
@@ -9410,9 +9441,11 @@ var init_notification_service = __esm({
         }
         try {
           this.logger.verbose(`Requesting roots from client for session ${sessionId.slice(0, 20)}...`);
-          const result = await registered.server.request({ method: "roots/list" }, ListRootsResultSchema, {
-            timeout: options?.timeout ?? 3e4
-          });
+          const result = await awaitOutsideRequest(
+            registered.server.request({ method: "roots/list" }, ListRootsResultSchema, {
+              timeout: options?.timeout ?? 3e4
+            })
+          );
           registered.cachedRoots = result.roots;
           registered.rootsFetchedAt = Date.now();
           this.logger.verbose(
@@ -10221,7 +10254,7 @@ function callerSurface(ctx, surface) {
 }
 async function filterServableSkills(scope, skills, ctx, surface) {
   const caller = callerSurface(ctx, surface);
-  const offered = skills.filter((skill) => isOfferedOnSurface(skill.metadata.availableWhen, caller));
+  const offered = skills.filter((skill) => availabilityForCall(skill.metadata.availableWhen, caller) === "available");
   if (offered.length === 0) return [];
   const { skills: servable } = await scope.runFlowForOutput("skills:filter", { skills: [...offered], ctx });
   const servableSkills = new Set(servable);
@@ -11889,7 +11922,8 @@ function createMcpHandlers(options) {
   const hasPromptsOrResources = options.scope?.prompts?.hasAny() || options.scope?.resources?.hasAny();
   const completionHandler = hasPromptsOrResources && options.serverOptions?.capabilities?.completions ? [completeRequestHandler(options)] : [];
   const loggingHandler = options.serverOptions?.capabilities?.logging ? [LoggingSetLevelRequestHandler(options)] : [];
-  const skillsHandler = options.scope?.skills?.hasAny() ? [skillsSearchRequestHandler(options), skillsLoadRequestHandler(options), skillsListRequestHandler(options)] : [];
+  const skillRegistry = options.scope?.skills;
+  const skillsHandler = skillRegistry?.servesSkills?.() ?? skillRegistry?.hasAny() ? [skillsSearchRequestHandler(options), skillsLoadRequestHandler(options), skillsListRequestHandler(options)] : [];
   const tasksHandler = options.serverOptions?.capabilities?.["tasks"] ? [
     tasksGetRequestHandler(options),
     tasksResultRequestHandler(options),
@@ -11944,7 +11978,7 @@ var in_memory_server_exports = {};
 __export(in_memory_server_exports, {
   createInMemoryServer: () => createInMemoryServer
 });
-import { randomUUID as randomUUID4 } from "@frontmcp/utils";
+import { randomUUID as randomUUID4, runRequestExclusive as runRequestExclusive2 } from "@frontmcp/utils";
 async function createInMemoryServer(scope, options) {
   const { InMemoryTransport, McpServer: McpServer2 } = await import("@frontmcp/protocol");
   const { createMcpHandlers: createMcpHandlers2 } = await Promise.resolve().then(() => (init_mcp_handlers(), mcp_handlers_exports));
@@ -11964,7 +11998,7 @@ async function createInMemoryServer(scope, options) {
           sessionId
         }
       };
-      return originalHandler(request, enrichedCtx);
+      return runRequestExclusive2(() => originalHandler(request, enrichedCtx));
     };
     mcpServer.setRequestHandler(handler.requestSchema, wrappedHandler);
   }
@@ -12612,7 +12646,7 @@ var init_connect = __esm({
 });
 
 // libs/sdk/src/direct/direct-server.ts
-import { randomUUID as randomUUID6, sha256Hex } from "@frontmcp/utils";
+import { randomUUID as randomUUID6, runRequestExclusive as runRequestExclusive3, sha256Hex } from "@frontmcp/utils";
 function buildAuthInfo(authContext, defaultSessionId) {
   if (!authContext && !defaultSessionId) {
     return void 0;
@@ -12687,7 +12721,7 @@ var init_direct_server = __esm({
         }
         const ctx = this.buildHandlerContext(options);
         try {
-          return await this.scope.runFlowForOutput(flowName, { request, ctx });
+          return await runRequestExclusive3(() => this.scope.runFlowForOutput(flowName, { request, ctx }));
         } catch (e) {
           if (e instanceof FlowControl && e.type === "respond") {
             return e.output;
@@ -14116,11 +14150,19 @@ var init_frontmcp_context = __esm({
       updateAuthInfo(authInfo) {
         this._authInfo = { ...this._authInfo, ...authInfo };
       }
-      /** `sessionId` when the server verified it; undefined for stateless and per-request placeholder ids. */
+      /**
+       * The session the server verified for this request; undefined for a request without one (MCP
+       * 2026-07-28, the stateless transports, an `mcp-session-id` the server did not accept).
+       *
+       * Over HTTP that is the session session verification recorded (`authInfo.extra.sessionId`),
+       * which it records only for a session the request presented: its `mcp-session-id` header, or the
+       * `?sessionId=` a legacy SSE client posts its messages with. Over an in-process transport (stdio,
+       * `connect()`, `createDirect()`) it is the session the transport runs the request in.
+       */
       get verifiedSessionId() {
-        if (this.sessionId === STATELESS_SESSION_ID) return void 0;
-        const verified = this._authInfo.sessionId ?? this._authInfo.extra?.["sessionId"];
-        return verified === this.sessionId ? this.sessionId : void 0;
+        const recorded = this._authInfo.extra?.["sessionId"];
+        const verified = typeof recorded === "string" && recorded.length > 0 ? recorded : this._authInfo.sessionId === this.sessionId ? this.sessionId : void 0;
+        return verified === STATELESS_SESSION_ID ? void 0 : verified;
       }
       /**
        * The client's self-reported identity, sent with this request (MCP 2026-07-28 `_meta`).
@@ -15863,6 +15905,9 @@ function registerHookOnClass(ctor, meta) {
 function resolvePendingTC39HooksForClass(ctor) {
   return pendingHookRegistry.resolveForClass(ctor);
 }
+function peekPendingTC39HooksForClass(ctor) {
+  return pendingHookRegistry.resolveForClass(ctor, false);
+}
 function registerPendingTC39Hook(method, meta) {
   pendingHookRegistry.store(method, meta);
 }
@@ -16008,7 +16053,7 @@ var init_elicitation_types = __esm({
 
 // libs/sdk/src/elicitation/helpers/elicit.helper.ts
 import { toJSONSchema, z as z45 } from "@frontmcp/lazy-zod";
-import { randomUUID as randomUUID10 } from "@frontmcp/utils";
+import { awaitOutsideRequest as awaitOutsideRequest2, randomUUID as randomUUID10 } from "@frontmcp/utils";
 async function performElicit(deps, message, requestedSchema, options) {
   const { sessionId, getClientCapabilities, tryGetContext, entryName, entryInput, elicitationEnabled } = deps;
   if (elicitationEnabled !== true) {
@@ -16056,7 +16101,7 @@ async function performElicit(deps, message, requestedSchema, options) {
   if (!transport) {
     throw new ElicitationNotSupportedError("Transport not available for elicitation");
   }
-  return transport.elicit(message, requestedSchema, options);
+  return awaitOutsideRequest2(transport.elicit(message, requestedSchema, options));
 }
 function generateElicitationId() {
   return `elicit-${randomUUID10()}`;
@@ -18224,12 +18269,12 @@ function qualifiedNameOf(lineage, name44) {
   return `${ownerKeyOf(lineage)}:${name44}`;
 }
 function hookOwnerIdOf(lineage, owner) {
-  const owners = owner ? [...lineage, owner] : lineage;
-  return appOwnerIdOf(owners) ?? owners[owners.length - 1]?.id;
+  const owners2 = owner ? [...lineage, owner] : lineage;
+  return appOwnerIdOf(owners2) ?? owners2[owners2.length - 1]?.id;
 }
 function appOwnerIdOf(lineage, owner) {
-  const owners = owner ? [...lineage, owner] : lineage;
-  return owners.find((candidate) => candidate.kind === "app")?.id;
+  const owners2 = owner ? [...lineage, owner] : lineage;
+  return owners2.find((candidate) => candidate.kind === "app")?.id;
 }
 var EntryLineageIndex;
 var init_lineage_utils = __esm({
@@ -18327,6 +18372,7 @@ var init_get_prompt_flow = __esm({
     init_remote_capabilities_utils();
     init_common();
     init_availability();
+    init_call_surface();
     init_errors();
     init_resolved_entries();
     init_hooks_utils();
@@ -18530,7 +18576,10 @@ var init_get_prompt_flow = __esm({
         }
         promptContext.mark("execute");
         try {
-          promptContext.output = await promptContext.execute(parsedArgs);
+          promptContext.output = await runOnSurface(
+            callSurfaceOf(this.input.ctx),
+            async () => promptContext.execute(parsedArgs)
+          );
           this.logger.verbose("execute:done");
         } catch (error) {
           if (error instanceof FlowControl || isClientFacingError(error)) throw error;
@@ -21615,6 +21664,7 @@ var init_send_elicitation_result_tool = __esm({
   "libs/sdk/src/elicitation/send-elicitation-result.tool.ts"() {
     "use strict";
     init_common();
+    init_call_surface();
     init_errors();
     init_fallback_helper();
     inputSchema12 = {
@@ -21695,8 +21745,15 @@ var init_send_elicitation_result_tool = __esm({
                 arguments: pending.toolInput
               }
             },
-            // Pass the context for auth info and request ID (used for elicitation routing)
-            ctx: this.tryGetContext() ?? { authInfo: this.getAuthInfo() }
+            // The call context of this call, whose caller is the owner: its auth info as its transport
+            // gave it (the tool reads it as `this.auth`), on the surface it was made from. Not the
+            // request context object, whose auth info is a getter a call context does not carry over.
+            ctx: {
+              authInfo: this.authInfo,
+              requestId: this.tryGetContext()?.requestId ?? this.runId,
+              surface: getCallSurface(),
+              ...this.signal ? { signal: this.signal } : {}
+            }
           });
           this.logger.info("sendElicitationResult: original tool completed", {
             elicitId,
@@ -21874,7 +21931,14 @@ import {
   MCP_APPS_MIME_TYPE as MCP_APPS_MIME_TYPE2,
   resolveServingMode
 } from "@frontmcp/uipack/adapters";
-import { findNonFiniteNumber, getRuntimeContext as getRuntimeContext7, isDebug, isDevelopment as isDevelopment2, randomUUID as randomUUID11 } from "@frontmcp/utils";
+import {
+  awaitOutsideRequest as awaitOutsideRequest3,
+  findNonFiniteNumber,
+  getRuntimeContext as getRuntimeContext7,
+  isDebug,
+  isDevelopment as isDevelopment2,
+  randomUUID as randomUUID11
+} from "@frontmcp/utils";
 function toolNameCandidates(name44) {
   if (!/[-_]/.test(name44)) return [name44];
   return [name44, name44.includes("_") ? name44.replace(/_/g, "-") : name44.replace(/-/g, "_")];
@@ -22138,6 +22202,8 @@ var init_call_tool_flow = __esm({
           request: { method: "tools/call", params: cleanedParams },
           scopeId: this.scope.id
         };
+        const callSurface = callSurfaceOf(this.input.ctx);
+        if (callSurface !== void 0) record.surface = callSurface;
         if (this.state.progressToken !== void 0) {
           record.progressToken = this.state.progressToken;
         }
@@ -22543,8 +22609,11 @@ var init_call_tool_flow = __esm({
               elicitId: error.elicitId,
               sessionId,
               owner,
-              toolName: error.toolName,
-              toolInput: error.toolInput,
+              // The answer re-runs the call this flow ran: this tool, with these arguments. What asked
+              // may be an entry the tool runs, like the agent behind `invoke_<agent>`, whose own name
+              // no `tools/call` resolves.
+              toolName: tool.fullName,
+              toolInput: this.state.required.input.arguments,
               elicitMessage: error.elicitMessage,
               elicitSchema: error.schema,
               createdAt: Date.now(),
@@ -22556,7 +22625,7 @@ var init_call_tool_flow = __esm({
                 elicitId: error.elicitId
               });
               const deps = { scope: this.scope, sessionId, logger: this.logger };
-              const result = await handleWaitingFallback(deps, error);
+              const result = await awaitOutsideRequest3(handleWaitingFallback(deps, error));
               toolContext.output = result;
               this.logger.verbose("execute:done (elicitation waiting fallback)");
               return;
@@ -24430,6 +24499,39 @@ var init_server_validation = __esm({
   }
 });
 
+// libs/sdk/src/flows/flow.http-path.ts
+function matchMountedPath(pattern, path3) {
+  if (!pattern.includes("/:")) {
+    const prefix = pattern.endsWith("/") ? pattern : `${pattern}/`;
+    return path3 === pattern || path3.startsWith(prefix) ? {} : void 0;
+  }
+  const mount = pattern.endsWith("/") ? pattern.slice(0, -1) : pattern;
+  const expected = mount.split("/");
+  const actual = path3.split("/");
+  if (actual.length < expected.length) return void 0;
+  const params = {};
+  for (let i = 0; i < expected.length; i++) {
+    const segment = expected[i];
+    const value = actual[i];
+    if (segment.length > 1 && segment.startsWith(":")) {
+      if (value.length === 0) return void 0;
+      try {
+        params[segment.slice(1)] = decodeURIComponent(value);
+      } catch {
+        return void 0;
+      }
+    } else if (segment !== value) {
+      return void 0;
+    }
+  }
+  return params;
+}
+var init_flow_http_path = __esm({
+  "libs/sdk/src/flows/flow.http-path.ts"() {
+    "use strict";
+  }
+});
+
 // libs/sdk/src/flows/flow.stages.ts
 function sortStageMap(table) {
   for (const key of Object.keys(table)) {
@@ -24537,6 +24639,7 @@ var init_flow_instance = __esm({
     init_context();
     init_errors();
     init_server_validation();
+    init_flow_http_path();
     init_flow_stages();
     FAILED_OUTCOMES = /* @__PURE__ */ new Set(["fail", "abort", "unknown_error"]);
     CAP = (s) => s ? s[0].toUpperCase() + s.slice(1) : s;
@@ -24656,12 +24759,16 @@ var init_flow_instance = __esm({
         const hasMwCanActivate = (mw.canActivate?.length ?? 0) > 0;
         if (!path3 && !hasStaticCanActivate && !hasMwCanActivate) return false;
         if (this.method && request.method !== this.method) return false;
-        if (path3) {
-          const reqPath = request.path;
-          const prefix = path3.endsWith("/") ? path3 : `${path3}/`;
-          if (reqPath !== path3 && !reqPath.startsWith(prefix)) return false;
+        const captured = path3 ? matchMountedPath(path3, request.path) : {};
+        if (!captured) return false;
+        const previous = request.params;
+        if (Object.keys(captured).length > 0) request.params = { ...captured, ...previous };
+        const activated = await this.canActivate(request);
+        if (!activated) {
+          if (previous === void 0) delete request.params;
+          else request.params = previous;
         }
-        return this.canActivate(request);
+        return activated;
       }
       /**
        * Get FrontMcpContextStorage from providers (with fallback).
@@ -25656,6 +25763,11 @@ var init_execution_context_interface = __esm({
        * Authority/authorization checks still run — an internal call carries the
        * same `authInfo` as the surrounding request, so ABAC/RBAC guards apply.
        *
+       * `availableWhen.surface`: the call carries {@link callToolSurface}. From a tool, resource or
+       * prompt that is none (in-process dispatch, which no surface restricts); a job's call carries
+       * `'job'`, an agent's `'agent'`, and an HTTP trigger's `'http-trigger'`, so a tool whose `surface`
+       * leaves that caller out answers as an unknown tool.
+       *
        * @param name Tool name (or fully-qualified `owner.name`).
        * @param args Tool arguments — validated by the tool's input schema.
        * @param opts Optional progress token / abort signal forwarded into `_meta`.
@@ -25673,10 +25785,12 @@ var init_execution_context_interface = __esm({
             ...Object.keys(requestMeta).length > 0 && { _meta: requestMeta }
           }
         };
+        const surface = this.callToolSurface();
         const ctx = {
           authInfo: this.getAuthInfo(),
           requestId: this.tryGetContext()?.requestId ?? this.runId,
           internalCall: true,
+          ...surface && { surface },
           ...opts?.signal && { signal: opts.signal }
         };
         const result = await scope.runFlow("tools:call-tool", { request, ctx });
@@ -25685,6 +25799,14 @@ var init_execution_context_interface = __esm({
         }
         return result;
       }
+      /**
+       * The surface (`availableWhen.surface`) a {@link callTool} from this context calls on. None by
+       * default: a tool, resource or prompt composing with other tools is in-process dispatch. Contexts
+       * that are callers of their own (jobs, agents, HTTP triggers) name their surface.
+       */
+      callToolSurface() {
+        return void 0;
+      }
       /**
        * Fail the execution and trigger error handling.
        */
@@ -27491,12 +27613,16 @@ var init_skill_registry = __esm({
        * caller cannot remove a replacement registration.
        */
       dynamicGenerations = /* @__PURE__ */ new Map();
+      /** Whether a plugin registers skills at runtime ({@link expectDynamicSkills}). */
+      dynamicSkillsExpected = false;
       /** Adopted skills from child registries */
       adopted = /* @__PURE__ */ new Map();
       /** Children registries */
       children = /* @__PURE__ */ new Set();
       /** O(1) indexes */
       byQualifiedId = /* @__PURE__ */ new Map();
+      /** Owner lineage per skill instance, rebuilt with the index so `lineageOf` is O(1). */
+      lineages = new EntryLineageIndex();
       byName = /* @__PURE__ */ new Map();
       byOwnerAndName = /* @__PURE__ */ new Map();
       /** Version and emitter for change tracking */
@@ -27911,12 +28037,31 @@ var init_skill_registry = __esm({
           if (!page.hasMore || page.skills.length === 0) return all;
         }
       }
+      /**
+       * Owner lineage (root → leaf) of a skill, or undefined when no row holds it. A skill a plugin
+       * contributes is owned by the plugin; its lineage names the app the plugin is installed on.
+       */
+      lineageOf(entry) {
+        return this.lineages.lineageOf(entry);
+      }
       /**
        * Check if any skills exist.
        */
       hasAny() {
         return this.listAllIndexed().length > 0;
       }
+      /**
+       * Record that a plugin registers skills at runtime ({@link registerSkillContent}), such as a
+       * skill bundle loaded after the server starts. The scope then serves the skills capability and
+       * methods from startup, answering with the skills registered so far.
+       */
+      expectDynamicSkills() {
+        this.dynamicSkillsExpected = true;
+      }
+      /** Whether the scope serves skills: it has some, or a plugin registers them at runtime. */
+      servesSkills() {
+        return this.dynamicSkillsExpected || this.hasAny();
+      }
       /**
        * Get total skill count.
        *
@@ -28060,7 +28205,7 @@ var init_skill_registry = __esm({
        * of the schema cutover see the declaration.
        */
       getCapabilities() {
-        if (!this.hasAny()) return {};
+        if (!this.servesSkills()) return {};
         return {
           experimental: {
             [SEP_2640_EXTENSION_ID]: {}
@@ -28339,6 +28484,7 @@ var init_skill_registry = __esm({
       }
       reindex() {
         const effective = this.listAllIndexed();
+        this.lineages.rebuild(effective);
         this.byQualifiedId.clear();
         this.byName.clear();
         this.byOwnerAndName.clear();
@@ -29263,13 +29409,15 @@ var init_agent_utils = __esm({
 // libs/sdk/src/agent/agent.instance.ts
 import { AuthorityDeniedError as AuthorityDeniedError6 } from "@frontmcp/auth";
 import { toJSONSchema as toJSONSchema2, z as z59 } from "@frontmcp/lazy-zod";
-var VALID_AGENT_HOOK_FLOWS, AGENT_ONLY_METADATA_KEYS, AgentInstance, FunctionAgentContext;
+var VALID_AGENT_HOOK_FLOWS, AGENT_SURFACE, AGENT_ONLY_METADATA_KEYS, AgentInstance, FunctionAgentContext;
 var init_agent_instance = __esm({
   "libs/sdk/src/agent/agent.instance.ts"() {
     "use strict";
     init_config();
     init_common();
+    init_availability();
     init_tool_decorator();
+    init_call_surface();
     init_running_tool();
     init_errors();
     init_hooks_utils();
@@ -29279,6 +29427,7 @@ var init_agent_instance = __esm({
     init_agent_scope();
     init_agent_utils();
     VALID_AGENT_HOOK_FLOWS = ["agents:call-agent", "agents:list-agents"];
+    AGENT_SURFACE = "agent";
     AGENT_ONLY_METADATA_KEYS = /* @__PURE__ */ new Set([
       "id",
       "name",
@@ -29655,10 +29804,17 @@ var init_agent_instance = __esm({
       }
       /**
        * Get tool definitions available to this agent.
-       * Returns only the agent's own tools (from @Agent({ tools: [...] })).
+       * Returns only the agent's own tools (from @Agent({ tools: [...] })) that are offered to it.
        */
       getToolDefinitions() {
-        return buildAgentToolDefinitions(this.agentTools);
+        return buildAgentToolDefinitions(this.getOfferedTools());
+      }
+      /**
+       * The agent's tools its model may call: those whose `availableWhen.surface` offers them on the
+       * `'agent'` surface. The others are neither shown to the model nor run for it.
+       */
+      getOfferedTools() {
+        return this.agentTools.filter((tool) => isOfferedOnSurface(tool.metadata.availableWhen, AGENT_SURFACE));
       }
       /**
        * Create a tool executor for agent-scoped tools.
@@ -29681,12 +29837,13 @@ var init_agent_instance = __esm({
       createToolExecutor(ctx) {
         const useToolFlow = this.record.metadata.execution?.useToolFlow !== false;
         return async (toolName, args) => {
-          const tool = this.agentTools.find((t) => t.name === toolName || t.fullName === toolName);
+          const offeredTools = this.getOfferedTools();
+          const tool = offeredTools.find((t) => t.name === toolName || t.fullName === toolName);
           if (!tool) {
             throw new AgentToolNotFoundError(
               this.name,
               toolName,
-              this.agentTools.map((t) => t.name)
+              offeredTools.map((t) => t.name)
             );
           }
           if (useToolFlow && this.agentScope) {
@@ -29697,16 +29854,19 @@ var init_agent_instance = __esm({
               },
               ctx: {
                 authInfo: ctx.authInfo,
-                _skipUI: true
+                _skipUI: true,
                 // Skip UI rendering - agent returns structured data
+                surface: AGENT_SURFACE
               }
             });
             return this.extractToolResult(result);
           }
           await this.assertToolAuthorized(tool, ctx.authInfo, args);
           const runningTool = { name: tool.name, fullName: tool.fullName };
-          const toolContext = runAsTool(runningTool, () => tool.create(args, ctx));
-          return runAsTool(runningTool, () => Promise.resolve(toolContext.execute(args)));
+          return runOnSurface(AGENT_SURFACE, () => {
+            const toolContext = runAsTool(runningTool, () => tool.create(args, ctx));
+            return runAsTool(runningTool, () => Promise.resolve(toolContext.execute(args)));
+          });
         };
       }
       /**
@@ -35442,13 +35602,13 @@ var init_esm_module_loader = __esm({
             URL.revokeObjectURL(url);
           }
         }
-        const { ensureDir, fileExists: fileExists9, sha256Hex: sha256Hex13, writeFile } = await import("@frontmcp/utils");
+        const { ensureDir, fileExists: fileExists9, sha256Hex: sha256Hex14, writeFile } = await import("@frontmcp/utils");
         const nodePath = await import("node:path");
         const nodeOs = await import("node:os");
         const { pathToFileURL } = await import("node:url");
         const dir = nodePath.join(nodeOs.tmpdir(), "frontmcp-esm-modules");
         await ensureDir(dir);
-        const tempPath = nodePath.join(dir, `${sha256Hex13(bundleContent)}.mjs`);
+        const tempPath = nodePath.join(dir, `${sha256Hex14(bundleContent)}.mjs`);
         if (!await fileExists9(tempPath)) {
           await writeFile(tempPath, bundleContent);
         }
@@ -37187,7 +37347,7 @@ var init_oauth_authorize_flow = __esm({
     });
     inputSchema16 = httpInputSchema;
     stateSchema15 = z65.object({
-      isDefaultAuthProvider: z65.boolean().describe("If FrontMcp initialized without auth options"),
+      isDefaultAuthProvider: z65.boolean().describe("No sign-in to run: no auth options, or public mode (the same configuration, written out)"),
       isOrchestrated: z65.boolean().describe("If FrontMcp is orchestrated (local oauth proxy, remote oauth proxy)"),
       allowAnonymous: z65.boolean().describe("Allow anonymous access, force orchestrated mode"),
       // Validated OAuth request (after validation)
@@ -37253,9 +37413,13 @@ var init_oauth_authorize_flow = __esm({
        * Returns `undefined` when the configured auth instance has no issuer, so the
        * parameter is simply omitted rather than emitted empty — a client validating
        * `iss` treats absence as "not supported" and proceeds.
+       *
+       * With `request`, the issuer the tokens redeemed for this request name
+       * (`LocalPrimaryAuth.issuerFor`); without it, the boot-time issuer.
        */
-      resolveIssuer() {
-        const issuer = this.scope.auth?.issuer;
+      resolveIssuer(request) {
+        const auth = this.scope.auth;
+        const issuer = request && auth?.issuerFor ? auth.issuerFor(request) : auth?.issuer;
         return typeof issuer === "string" && issuer.length > 0 ? issuer : void 0;
       }
       logger = this.scope.logger.child("OauthAuthorizeFlow");
@@ -37295,7 +37459,7 @@ var init_oauth_authorize_flow = __esm({
           }
         }
         const existingSessionId = request.query["session_id"];
-        const isDefaultAuthProvider = !metadata.auth;
+        const isDefaultAuthProvider = !metadata.auth || isPublicMode(metadata.auth);
         let requiresFederatedLogin = false;
         if (metadata.auth && isOrchestratedMode(metadata.auth)) {
           const configProviders = getConfiguredProviderIds(metadata.auth);
@@ -37368,11 +37532,26 @@ var init_oauth_authorize_flow = __esm({
           if (result2.data.state) {
             url.searchParams.set("state", result2.data.state);
           }
-          const issuer = this.resolveIssuer();
+          const issuer = this.resolveIssuer(this.rawInput.request);
           if (issuer) url.searchParams.set("iss", issuer);
           this.respond(httpRespond.redirect(url.toString()));
           return;
         }
+        const authConfig = this.scope.metadata.auth;
+        if (!authConfig || !isOrchestratedMode(authConfig)) {
+          const mode = authConfig?.mode ?? "public";
+          this.logger.warn(`Authorization request refused: auth mode ${mode} does not sign users in`);
+          this.respond(
+            this.htmlPage(
+              this.renderErrorPage(
+                "unsupported_response_type",
+                `This server does not sign users in (auth mode: ${mode}). Present its access token instead.`
+              ),
+              400
+            )
+          );
+          return;
+        }
         const result = oauthAuthorizeRequestSchema.safeParse({
           response_type: request.query["response_type"],
           client_id: request.query["client_id"],
@@ -37408,10 +37587,10 @@ var init_oauth_authorize_flow = __esm({
         const redirectAllowlisted = !!registry?.hasRedirectAllowlist() && registry.isRedirectUriAllowed(redirect_uri);
         let redirectVerified = redirectAllowlisted;
         const isCimdClientId2 = !!cimdService?.enabled && cimdService.isCimdClientId(client_id);
-        const dcrError = this.checkDcrAllowlist(client_id, redirect_uri, isCimdClientId2);
-        if (dcrError) {
-          this.logger.warn(`OAuth authorize: DCR allowlist rejection \u2014 ${dcrError}`);
-          this.respondWithError([dcrError], redirectVerified ? redirect_uri : void 0, rawState);
+        const redirectError = this.checkDcrRedirectAllowlist(redirect_uri);
+        if (redirectError) {
+          this.logger.warn(`OAuth authorize: DCR allowlist rejection \u2014 ${redirectError}`);
+          this.respondWithError([redirectError], void 0, rawState);
           return;
         }
         if (isCimdClientId2) {
@@ -37435,24 +37614,34 @@ var init_oauth_authorize_flow = __esm({
             return;
           }
         }
-        if (!isCimdClientId2) {
-          const registered = registry?.get?.(client_id);
-          if (registered) {
-            if (!registered.redirect_uris.includes(redirect_uri)) {
-              this.logger.warn(`OAuth authorize: redirect_uri "${redirect_uri}" not registered for client "${client_id}"`);
-              this.respondWithError(["redirect_uri is not registered for this client"], void 0, rawState);
-              return;
-            }
-            redirectVerified = true;
-          } else if (authOptions?.requireRegisteredClients !== false) {
-            this.logger.warn(`OAuth authorize: rejecting unregistered client_id "${client_id}" (requireRegisteredClients)`);
-            this.respondWithError(
-              ["Unknown client_id: register the client (DCR / pre-registered) or use a CIMD client-id URL"],
-              void 0,
-              rawState
-            );
+        const registered = isCimdClientId2 ? void 0 : registry?.get?.(client_id);
+        if (registered) {
+          if (!registered.redirect_uris.includes(redirect_uri)) {
+            this.logger.warn(`OAuth authorize: redirect_uri "${redirect_uri}" not registered for client "${client_id}"`);
+            this.respondWithError(["redirect_uri is not registered for this client"], void 0, rawState);
             return;
           }
+          redirectVerified = true;
+        }
+        const clientIdError = isCimdClientId2 ? void 0 : this.checkDcrClientIdAllowlist(client_id);
+        if (clientIdError) {
+          this.logger.warn(`OAuth authorize: DCR allowlist rejection \u2014 ${clientIdError}`);
+          this.respondWithError(
+            [clientIdError],
+            redirectVerified ? redirect_uri : void 0,
+            rawState,
+            "unauthorized_client"
+          );
+          return;
+        }
+        if (!isCimdClientId2 && !registered && authOptions?.requireRegisteredClients !== false) {
+          this.logger.warn(`OAuth authorize: rejecting unregistered client_id "${client_id}" (requireRegisteredClients)`);
+          this.respondWithError(
+            ["Unknown client_id: register the client (DCR / pre-registered) or use a CIMD client-id URL"],
+            void 0,
+            rawState
+          );
+          return;
         }
         const canonicalResource = computeResource(request, this.scope.entryPath, this.scope.routeBase);
         if (!validatedRequest.resource) {
@@ -37893,26 +38082,28 @@ var init_oauth_authorize_flow = __esm({
         return httpRespond.html(markup, status, builtInAuthPageHeaders());
       }
       /**
-       * Enforce the local-AS DCR allowlists (#462) at authorize time. Returns a
-       * human-readable rejection reason, or `undefined` when the request is allowed
-       * (including when no allowlist is configured, or the auth instance does not
-       * expose a DCR registry — e.g. non-local modes).
-       *
-       * - `allowedRedirectUris`: applies to ALL clients (CIMD or not) as an
-       *   open-redirect / lateral-movement guard.
-       * - `allowedClientIds`: applies only to non-CIMD client ids; CIMD URLs are
-       *   validated by the CIMD layer instead.
+       * Enforce the local-AS DCR `allowedRedirectUris` (#462) at authorize time,
+       * for ALL clients (CIMD or not) as an open-redirect / lateral-movement guard.
+       * Returns a human-readable rejection reason, or `undefined` when the
+       * redirect_uri is allowed (including when no allowlist is configured, or the
+       * auth instance does not expose a DCR registry — e.g. non-local modes).
        */
-      checkDcrAllowlist(clientId, redirectUri, isCimdClientId2) {
-        const auth = this.scope.auth;
-        const registry = auth?.dcrClientRegistry;
-        if (!registry) {
-          return void 0;
-        }
-        if (registry.hasRedirectAllowlist() && !registry.isRedirectUriAllowed(redirectUri)) {
+      checkDcrRedirectAllowlist(redirectUri) {
+        const registry = this.scope.auth?.dcrClientRegistry;
+        if (registry?.hasRedirectAllowlist() && !registry.isRedirectUriAllowed(redirectUri)) {
           return `redirect_uri "${redirectUri}" is not in the configured allowlist`;
         }
-        if (!isCimdClientId2 && registry.hasClientIdAllowlist() && !registry.isClientIdAllowed(clientId)) {
+        return void 0;
+      }
+      /**
+       * Enforce the local-AS DCR `allowedClientIds` (#462) at authorize time, for
+       * non-CIMD client ids (the caller skips CIMD URLs, which the CIMD layer
+       * validates). Returns a human-readable rejection reason, or `undefined` when
+       * the client is allowed or no allowlist is configured.
+       */
+      checkDcrClientIdAllowlist(clientId) {
+        const registry = this.scope.auth?.dcrClientRegistry;
+        if (registry?.hasClientIdAllowlist() && !registry.isClientIdAllowed(clientId)) {
           return `client_id "${clientId}" is not in the configured allowlist`;
         }
         return void 0;
@@ -37927,15 +38118,18 @@ var init_oauth_authorize_flow = __esm({
         });
       }
       /**
-       * Respond with OAuth error - redirect if possible, otherwise show error page
+       * Respond with OAuth error - redirect if possible, otherwise show error page.
+       *
+       * @param redirectUri A redirect_uri validated for the client; omit it for an error page.
+       * @param error       The RFC 6749 §4.1.2.1 error code. Default `invalid_request`.
        */
-      respondWithError(errors, redirectUri, state) {
+      respondWithError(errors, redirectUri, state, error = "invalid_request") {
         const errorDescription = errors.join("; ");
         if (redirectUri) {
           const safe = safeRedirectUriSchema.safeParse(redirectUri);
           if (safe.success) {
             const url = new URL(safe.data);
-            url.searchParams.set("error", "invalid_request");
+            url.searchParams.set("error", error);
             url.searchParams.set("error_description", errorDescription);
             if (state) {
               url.searchParams.set("state", state);
@@ -37944,7 +38138,7 @@ var init_oauth_authorize_flow = __esm({
             return;
           }
         }
-        this.respond(this.htmlPage(this.renderErrorPage("invalid_request", errorDescription), 400));
+        this.respond(this.htmlPage(this.renderErrorPage(error, errorDescription), 400));
       }
       /**
        * Render the local login page.
@@ -38223,9 +38417,13 @@ var init_oauth_callback_flow = __esm({
        * Returns `undefined` when the configured auth instance has no issuer, so the
        * parameter is simply omitted rather than emitted empty — a client validating
        * `iss` treats absence as "not supported" and proceeds.
+       *
+       * With `request`, the issuer the tokens redeemed for this request name
+       * (`LocalPrimaryAuth.issuerFor`); without it, the boot-time issuer.
        */
-      resolveIssuer() {
-        const issuer = this.scope.auth?.issuer;
+      resolveIssuer(request) {
+        const auth = this.scope.auth;
+        const issuer = request && auth?.issuerFor ? auth.issuerFor(request) : auth?.issuer;
         return typeof issuer === "string" && issuer.length > 0 ? issuer : void 0;
       }
       async checkIpFilter() {
@@ -38763,7 +38961,7 @@ var init_oauth_callback_flow = __esm({
         if (originalState) {
           url.searchParams.set("state", originalState);
         }
-        const issuer = this.resolveIssuer();
+        const issuer = this.resolveIssuer(this.rawInput.request);
         if (issuer) url.searchParams.set("iss", issuer);
         if (isIncremental && targetAppId) {
           url.searchParams.set("incremental", "true");
@@ -40665,7 +40863,7 @@ var init_oauth_token_flow = __esm({
     stateSchema20 = z70.object({
       body: tokenRequestSchema.optional(),
       grantType: z70.enum(["authorization_code", "refresh_token", "anonymous"]).optional(),
-      isDefaultAuthProvider: z70.boolean().describe("If FrontMcp initialized without auth options"),
+      isDefaultAuthProvider: z70.boolean().describe("No sign-in to run: no auth options, or public mode (the same configuration, written out)"),
       isOrchestrated: z70.boolean().describe("If auth mode is orchestrated"),
       // Token response data
       tokenResponse: z70.object({
@@ -40695,7 +40893,7 @@ var init_oauth_token_flow = __esm({
       async parseInput() {
         const { metadata } = this.scope;
         const { request } = this.rawInput;
-        const isDefaultAuthProvider = !metadata.auth;
+        const isDefaultAuthProvider = !metadata.auth || isPublicMode(metadata.auth);
         const isOrchestrated = !isDefaultAuthProvider;
         const rawBody = coerceTokenRequestBody(request);
         const basic = parseBasicAuthorization(request.headers?.["authorization"]);
@@ -40744,7 +40942,10 @@ var init_oauth_token_flow = __esm({
         const authOptions = this.scope.auth?.options;
         if (isDefaultAuthProvider && body.code === "anonymous" && !!authOptions && allowsPublicAccess(authOptions)) {
           const localAuth2 = this.scope.auth;
-          const accessToken = await localAuth2.signAnonymousJwt({ audience: this.canonicalResource() });
+          const accessToken = await localAuth2.signAnonymousJwt({
+            audience: this.canonicalResource(),
+            issuer: localAuth2.issuerFor(this.rawInput.request)
+          });
           this.state.set("tokenResponse", {
             access_token: accessToken,
             token_type: "Bearer",
@@ -40760,7 +40961,8 @@ var init_oauth_token_flow = __esm({
           body.redirect_uri,
           body.code_verifier,
           body.client_secret,
-          this.canonicalResource()
+          this.canonicalResource(),
+          localAuth.issuerFor(this.rawInput.request)
         );
         if ("error" in result) {
           this.logger.warn(`Code exchange failed: ${result.error}`);
@@ -40798,7 +41000,10 @@ var init_oauth_token_flow = __esm({
             return;
           }
           const localAuth2 = this.scope.auth;
-          const accessToken = await localAuth2.signAnonymousJwt({ audience: this.canonicalResource() });
+          const accessToken = await localAuth2.signAnonymousJwt({
+            audience: this.canonicalResource(),
+            issuer: localAuth2.issuerFor(this.rawInput.request)
+          });
           this.state.set("tokenResponse", {
             access_token: accessToken,
             token_type: "Bearer",
@@ -40812,7 +41017,8 @@ var init_oauth_token_flow = __esm({
           body.refresh_token,
           body.client_id,
           body.client_secret,
-          this.canonicalResource()
+          this.canonicalResource(),
+          localAuth.issuerFor(this.rawInput.request)
         );
         if ("error" in result) {
           this.logger.warn(`Refresh token failed: ${result.error}`);
@@ -40868,7 +41074,10 @@ var init_oauth_token_flow = __esm({
         }
         const localAuth = this.scope.auth;
         const audience = body?.grant_type === "anonymous" && body.resource ? body.resource : canonicalResource;
-        const accessToken = await localAuth.signAnonymousJwt({ audience });
+        const accessToken = await localAuth.signAnonymousJwt({
+          audience,
+          issuer: localAuth.issuerFor(this.rawInput.request)
+        });
         this.state.set("tokenResponse", {
           access_token: accessToken,
           token_type: "Bearer",
@@ -40996,7 +41205,8 @@ var init_oauth_userinfo_flow = __esm({
           return;
         }
         const localAuth = this.scope.auth;
-        const result = await localAuth.verifyGatewayToken(token, baseUrl);
+        const issuer = localAuth.issuerFor?.(this.rawInput.request);
+        const result = await localAuth.verifyGatewayToken(token, baseUrl, void 0, issuer);
         if (!result.ok) {
           this.logger.warn("userinfo: token verification failed", { error: result.error });
           this.respond(
@@ -41374,7 +41584,8 @@ var init_session_verify_flow = __esm({
         } else {
           const configuredAudience = isOrchestratedMode(authOptions) ? authOptions.expectedAudience : void 0;
           const resource = computeResource(this.rawInput.request, this.scope.entryPath, this.scope.routeBase);
-          verify = auth.verifyGatewayToken(token, this.state.required.baseUrl, configuredAudience ?? resource);
+          const issuer = auth.issuerFor?.(this.rawInput.request);
+          verify = auth.verifyGatewayToken(token, this.state.required.baseUrl, configuredAudience ?? resource, issuer);
         }
         const result = await verify;
         if (result.ok) {
@@ -41621,6 +41832,7 @@ var init_well_known_jwks_flow = __esm({
 
 // libs/sdk/src/auth/flows/well-known.oauth-authorization-server.flow.ts
 import "reflect-metadata";
+import { advertisedScopes } from "@frontmcp/auth";
 import { z as z74 } from "@frontmcp/lazy-zod";
 import { isProduction as isProduction4 } from "@frontmcp/utils";
 function resolveDcrEnabled(auth) {
@@ -41705,7 +41917,9 @@ var init_well_known_oauth_authorization_server_flow = __esm({
           wellKnownAsStateSchema.parse({
             baseUrl,
             oauthBaseUrl,
-            scopesSupported: [],
+            // The scopes this server grants (`allowedScopes`, #262): the literal
+            // entries; a `*` glob names no scope a client could ask for.
+            scopesSupported: metadata.auth && isOrchestratedMode(metadata.auth) ? advertisedScopes(metadata.auth.allowedScopes) : [],
             tokenEndpointAuthMethods: [],
             // #462 — advertise registration_endpoint only when local-AS DCR is
             // actually active (explicit auth.dcr.enabled, else dev/prod default).
@@ -41789,6 +42003,7 @@ var init_well_known_oauth_authorization_server_flow = __esm({
 
 // libs/sdk/src/auth/flows/well-known.prm.flow.ts
 import "reflect-metadata";
+import { advertisedScopes as advertisedScopes2 } from "@frontmcp/auth";
 import { z as z75 } from "@frontmcp/lazy-zod";
 var inputSchema26, stateSchema24, outputSchema24, plan24, name25, Stage25, WellKnownPrmFlow;
 var init_well_known_prm_flow = __esm({
@@ -41831,11 +42046,12 @@ var init_well_known_prm_flow = __esm({
         if (!request) throw new FlowInputMissingError("request", "well-known:prm");
         const resource = computeResource(request, scope.entryPath, scope.routeBase);
         const baseUrl = getRequestBaseUrl(request, scope.entryPath);
+        const auth = scope.metadata.auth;
         this.state.set(
           stateSchema24.parse({
             resource,
             baseUrl,
-            scopesSupported: scope.getAllSupportedScopes(),
+            scopesSupported: auth && isOrchestratedMode(auth) ? advertisedScopes2(auth.allowedScopes) : scope.getAllSupportedScopes(),
             isOrchestrated: false
             //scope.orchestrated,// TODO: fix
           })
@@ -41899,6 +42115,24 @@ var init_well_known_prm_flow = __esm({
   }
 });
 
+// libs/sdk/src/auth/session-scope-identity.ts
+import { isAnonymousSubject as isAnonymousSubject3 } from "@frontmcp/auth";
+function sessionScopeIdentity(ctx) {
+  const verified = ctx.verifiedSessionId;
+  if (verified) return verified;
+  const authInfo = ctx.authInfo ?? {};
+  const extraUser = authInfo.extra?.["user"];
+  const principal = [authInfo.user?.sub, extraUser?.sub, authInfo.clientId].find(
+    (candidate) => !isAnonymousSubject3(candidate)
+  );
+  return principal ? `principal:${principal}` : void 0;
+}
+var init_session_scope_identity = __esm({
+  "libs/sdk/src/auth/session-scope-identity.ts"() {
+    "use strict";
+  }
+});
+
 // libs/sdk/src/auth/secure-store/secure-store.providers.ts
 import {
   SECURE_STORE_ACCESSOR,
@@ -41906,8 +42140,9 @@ import {
 } from "@frontmcp/auth";
 import { ProviderScope as ProviderScope6 } from "@frontmcp/di";
 function resolveRequestSessionId(ctx) {
-  const sid = ctx.sessionId;
-  return typeof sid === "string" && sid.length > 0 ? sid : void 0;
+  const identity = sessionScopeIdentity(ctx);
+  if (identity) return identity;
+  throw new SessionIdentityRequiredError("The secure store's session scope");
 }
 function createSecureStoreProviders(opts) {
   const { backend, scope, ttlMs } = opts;
@@ -41939,7 +42174,9 @@ var init_secure_store_providers = __esm({
     "use strict";
     init_common();
     init_frontmcp_context_provider();
+    init_session_identity_required_error();
     init_credentials_providers();
+    init_session_scope_identity();
     SECURE_STORE_BACKEND = /* @__PURE__ */ Symbol.for("frontmcp:SECURE_STORE_BACKEND");
   }
 });
@@ -42079,6 +42316,7 @@ var init_instance_local_primary_auth = __esm({
         this.port = this.providers.getActiveScope().metadata.http?.port ?? 3001;
         this.host = getEnv4("FRONTMCP_PUBLIC_HOST")?.trim() || "localhost";
         this.issuer = this.deriveIssuer(options);
+        this.issuerIsConfigured = this.configuredIssuer(options) !== void 0 || !!getEnv4("FRONTMCP_PUBLIC_HOST")?.trim();
         const jwtSecret = getEnv4("JWT_SECRET");
         const hasJwtSecret = !!jwtSecret?.trim();
         if (hasJwtSecret && jwtSecret) {
@@ -42117,7 +42355,10 @@ var init_instance_local_primary_auth = __esm({
       providers;
       host;
       port;
+      /** The boot-time issuer: the configured one, else this server's listener address (see {@link issuerFor}). */
       issuer;
+      /** Whether the operator named the issuer (`issuer` / `local.issuer`, or its host with `FRONTMCP_PUBLIC_HOST`). */
+      issuerIsConfigured;
       keys = [];
       secret;
       logger;
@@ -42266,18 +42507,36 @@ var init_instance_local_primary_auth = __esm({
        * supported knob for aligning the issuer with discovery.
        */
       deriveIssuer(options) {
-        const basePath = `http://${this.host}:${this.port}${this.scope.fullPath}`;
-        if (isPublicMode(options)) {
-          return options.issuer ?? basePath;
-        }
-        if (isOrchestratedMode(options)) {
-          if (isOrchestratedLocal(options)) {
-            return options.local?.issuer ?? basePath;
-          } else {
-            return options.local?.issuer ?? basePath;
-          }
-        }
-        return basePath;
+        return this.configuredIssuer(options) ?? `http://${this.host}:${this.port}${this.scope.fullPath}`;
+      }
+      /** The issuer the options name: `issuer` in public mode, `local.issuer` in local and remote mode. */
+      configuredIssuer(options) {
+        if (isPublicMode(options)) return options.issuer;
+        if (isOrchestratedMode(options)) return options.local?.issuer;
+        return void 0;
+      }
+      /**
+       * The issuer (`iss`) this server names on the tokens it issues in answer to
+       * `request`, and requires on the tokens it accepts there (#269). Issuing and
+       * verifying both ask this, so they can't disagree:
+       *
+       * - a configured issuer (`issuer` / `local.issuer`) is the issuer;
+       * - with `FRONTMCP_PUBLIC_URL` pinned, the issuer is that URL plus this
+       *   scope's path, the address discovery advertises;
+       * - with `FRONTMCP_PUBLIC_HOST` or `expectedAudience` set, the boot-time
+       *   issuer, so a token serves at every address the server answers to;
+       * - a request that came through a Web fetch handler (a Worker, Deno, Bun, a
+       *   Durable Object) has no listener the boot-time issuer could describe, so
+       *   the issuer is the request's own origin plus this scope's path;
+       * - otherwise (the Node server) the boot-time issuer.
+       */
+      issuerFor(request) {
+        if (!request || this.issuerIsConfigured) return this.issuer;
+        if (isPublicUrlPinned()) return computeIssuer(request, this.scope.entryPath, this.scope.routeBase);
+        const options = this.options;
+        if (isOrchestratedMode(options) && options.expectedAudience !== void 0) return this.issuer;
+        const webRequest = request[ServerRequestTokens.webRequest];
+        return webRequest === void 0 ? this.issuer : computeIssuer(request, this.scope.entryPath, this.scope.routeBase);
       }
       /**
        * Read the `tokenStorage` selection off the auth options. Only
@@ -42508,9 +42767,10 @@ var init_instance_local_primary_auth = __esm({
        * user, and its scopes are the configured `anonymousScopes`, never a role.
        *
        * @param options.audience The protected resource the token is for (`aud`, #269).
+       * @param options.issuer   The issuer to name (`iss`): {@link issuerFor} the request. Default: the boot-time issuer.
        */
       async signAnonymousJwt(options = {}) {
-        const jwt = new SignJWT({ sub: `anon:${randomUUID21()}`, anonymous: true, scope: this.anonymousScopes().join(" ") }).setProtectedHeader({ alg: "HS256", typ: "JWT" }).setIssuedAt().setIssuer(this.issuer).setExpirationTime("1d").setJti(randomUUID21());
+        const jwt = new SignJWT({ sub: `anon:${randomUUID21()}`, anonymous: true, scope: this.anonymousScopes().join(" ") }).setProtectedHeader({ alg: "HS256", typ: "JWT" }).setIssuedAt().setIssuer(options.issuer ?? this.issuer).setExpirationTime("1d").setJti(randomUUID21());
         if (options.audience) jwt.setAudience(options.audience);
         return jwt.sign(this.secret);
       }
@@ -42527,8 +42787,10 @@ var init_instance_local_primary_auth = __esm({
        *
        * The secret alone doesn't make a token this server's: every server started
        * with the same JWT_SECRET holds it. So a token must also (#269):
-       * - name THIS instance as its issuer (`iss`, the boot-time issuer it signs
-       *   with, never the request-derived base URL), and
+       * - name THIS instance as its issuer (`iss`): `expectedIssuer`, which callers
+       *   take from {@link issuerFor} the request, as the token endpoint does when
+       *   it signs; the boot-time issuer when not given. Never the token's own
+       *   claim; and
        * - when `expectedAudience` is given, be issued for that protected resource,
        *   or one of those resources (`aud`, compared as RFC 8707 resource URIs).
        *   `session:verify` passes the request's resource URL, or the configured
@@ -42537,11 +42799,11 @@ var init_instance_local_primary_auth = __esm({
        * Lifetime: `exp` is required (#272) and checked with `nbf` by `jose`. The
        * algorithm is pinned to HS256 to block `alg` confusion.
        */
-      async verifyGatewayToken(token, requestBaseUrl, expectedAudience) {
+      async verifyGatewayToken(token, requestBaseUrl, expectedAudience, expectedIssuer) {
         try {
           const { payload, protectedHeader } = await jwtVerify(token, this.secret, {
             algorithms: ["HS256"],
-            issuer: this.issuer,
+            issuer: expectedIssuer ?? this.issuer,
             requiredClaims: ["exp"]
           });
           if (expectedAudience !== void 0 && !audienceMatchesResource(payload.aud, expectedAudience)) {
@@ -42562,7 +42824,7 @@ var init_instance_local_primary_auth = __esm({
       /**
        * Sign an access token for an authenticated user
        */
-      async signAccessToken(user, scopes, audience, consentMetadata) {
+      async signAccessToken(user, scopes, audience, consentMetadata, issuer) {
         const claims = {
           sub: user.sub,
           scope: scopes.join(" ")
@@ -42598,7 +42860,7 @@ var init_instance_local_primary_auth = __esm({
             }
           }
         }
-        const jwt = new SignJWT(claims).setProtectedHeader({ alg: "HS256", typ: "JWT" }).setIssuedAt().setIssuer(this.issuer).setExpirationTime(`${this.accessTokenTtlSeconds}s`).setJti(randomUUID21());
+        const jwt = new SignJWT(claims).setProtectedHeader({ alg: "HS256", typ: "JWT" }).setIssuedAt().setIssuer(issuer ?? this.issuer).setExpirationTime(`${this.accessTokenTtlSeconds}s`).setJti(randomUUID21());
         if (audience) {
           jwt.setAudience(audience);
         }
@@ -42607,7 +42869,7 @@ var init_instance_local_primary_auth = __esm({
       /**
        * Exchange an authorization code for tokens
        */
-      async exchangeCode(code, clientId, redirectUri, codeVerifier, clientSecret, defaultAudience) {
+      async exchangeCode(code, clientId, redirectUri, codeVerifier, clientSecret, defaultAudience, issuer) {
         if (this.dcrClientRegistryImpl.verifyClientSecret(clientId, clientSecret) === "invalid") {
           this.logger.warn("Client authentication failed at token endpoint (authorization_code)");
           return { error: "invalid_client", error_description: "Client authentication failed" };
@@ -42674,7 +42936,7 @@ var init_instance_local_primary_auth = __esm({
           customClaims: codeRecord.customClaims
         } : void 0;
         const resource = codeRecord.resource ?? defaultAudience;
-        const accessToken = await this.signAccessToken(user, codeRecord.scopes, resource, consentMetadata);
+        const accessToken = await this.signAccessToken(user, codeRecord.scopes, resource, consentMetadata, issuer);
         if (codeRecord.pendingAuthId && codeRecord.federatedLoginUsed) {
           try {
             const pendingAuthId = `pending:${codeRecord.pendingAuthId}`;
@@ -42716,7 +42978,7 @@ var init_instance_local_primary_auth = __esm({
       /**
        * Refresh an access token using a refresh token
        */
-      async refreshAccessToken(refreshToken, clientId, clientSecret, defaultAudience) {
+      async refreshAccessToken(refreshToken, clientId, clientSecret, defaultAudience, issuer) {
         if (this.dcrClientRegistryImpl.verifyClientSecret(clientId, clientSecret) === "invalid") {
           this.logger.warn("Client authentication failed at token endpoint (refresh_token)");
           return { error: "invalid_client", error_description: "Client authentication failed" };
@@ -42753,7 +43015,7 @@ var init_instance_local_primary_auth = __esm({
           customClaims: tokenRecord.customClaims
         } : void 0;
         const resource = tokenRecord.resource ?? defaultAudience;
-        const accessToken = await this.signAccessToken(user, tokenRecord.scopes, resource, consentMetadata);
+        const accessToken = await this.signAccessToken(user, tokenRecord.scopes, resource, consentMetadata, issuer);
         const newRefreshRecord = this.authorizationStore.createRefreshTokenRecord({
           clientId,
           userSub: tokenRecord.userSub,
@@ -45876,12 +46138,12 @@ async function createElicitationStore(options = {}) {
     sqlite,
     keyPrefix = "mcp:elicit:",
     logger,
-    isEdgeRuntime: isEdgeRuntime2 = false,
+    isEdgeRuntime: isEdgeRuntime3 = false,
     requiresPubSub = true,
     encryption
   } = options;
   if (sqlite) {
-    if (isEdgeRuntime2) {
+    if (isEdgeRuntime3) {
       throw new ElicitationNotSupportedError(
         "SQLite elicitation store is not supported on Edge runtime (better-sqlite3 is a native module). Use Redis or Upstash instead."
       );
@@ -45955,7 +46217,7 @@ async function createElicitationStore(options = {}) {
       "Vercel KV is not supported for elicitation stores. Elicitation requires pub/sub for cross-node result routing, which Vercel KV does not support. Use Redis or Upstash instead."
     );
   }
-  if (isEdgeRuntime2 && (!finalStorageConfig || finalStorageConfig.type === "memory")) {
+  if (isEdgeRuntime3 && (!finalStorageConfig || finalStorageConfig.type === "memory")) {
     throw new ElicitationNotSupportedError(
       "Elicitation requires distributed storage when running on Edge runtime. Edge functions are stateless and cannot use in-memory elicitation. Configure Redis or Upstash storage."
     );
@@ -45963,7 +46225,7 @@ async function createElicitationStore(options = {}) {
   const storage = await createStorage2({
     ...finalStorageConfig,
     prefix: keyPrefix,
-    fallback: isEdgeRuntime2 ? "error" : "memory"
+    fallback: isEdgeRuntime3 ? "error" : "memory"
   });
   if (requiresPubSub && !storage.supportsPubSub()) {
     throw new ElicitationNotSupportedError(
@@ -47629,6 +47891,7 @@ var WorkflowStepExecutor;
 var init_workflow_step_executor = __esm({
   "libs/sdk/src/workflow/engine/workflow-step.executor.ts"() {
     "use strict";
+    init_call_surface();
     init_errors();
     init_job_errors();
     init_workflow_errors();
@@ -47691,7 +47954,7 @@ var init_workflow_step_executor = __esm({
           const timer = setTimeout(() => {
             reject(new WorkflowJobTimeoutError(job.name, timeout));
           }, timeout);
-          Promise.resolve(ctx.execute(parsedInput)).then((result) => {
+          runOnSurface("job", async () => ctx.execute(parsedInput)).then((result) => {
             clearTimeout(timer);
             resolve(result);
           }).catch((err) => {
@@ -47881,12 +48144,13 @@ var init_workflow_engine = __esm({
 });
 
 // libs/sdk/src/job/execution/job-execution.manager.ts
-import { randomUUID as randomUUID23 } from "@frontmcp/utils";
+import { randomUUID as randomUUID23, runRequestExclusive as runRequestExclusive4 } from "@frontmcp/utils";
 var JobExecutionManager;
 var init_job_execution_manager = __esm({
   "libs/sdk/src/job/execution/job-execution.manager.ts"() {
     "use strict";
     init_principal_utils();
+    init_call_surface();
     init_errors();
     init_workflow_engine();
     init_job_permission_guard();
@@ -47923,7 +48187,7 @@ var init_job_execution_manager = __esm({
         };
         await this.stateStore.createRun(runRecord);
         if (opts.background) {
-          this.executeJobBackground(job, input, runId, opts).catch(async (err) => {
+          runRequestExclusive4(() => this.executeJobBackground(job, input, runId, opts)).catch(async (err) => {
             this.logger.error(`Background job execution failed: ${err}`);
             try {
               await this.updateState(runId, {
@@ -47963,18 +48227,20 @@ var init_job_execution_manager = __esm({
         };
         await this.stateStore.createRun(runRecord);
         if (opts.background) {
-          this.executeWorkflowBackground(workflow, jobRegistry, runId, opts).catch(async (err) => {
-            this.logger.error(`Background workflow execution failed: ${err}`);
-            try {
-              await this.updateState(runId, {
-                state: "failed",
-                error: { message: err?.message ?? String(err), name: err?.name ?? "Error" },
-                completedAt: Date.now()
-              });
-            } catch (updateErr) {
-              this.logger.error(`Failed to update run state after error: ${updateErr}`);
+          runRequestExclusive4(() => this.executeWorkflowBackground(workflow, jobRegistry, runId, opts)).catch(
+            async (err) => {
+              this.logger.error(`Background workflow execution failed: ${err}`);
+              try {
+                await this.updateState(runId, {
+                  state: "failed",
+                  error: { message: err?.message ?? String(err), name: err?.name ?? "Error" },
+                  completedAt: Date.now()
+                });
+              } catch (updateErr) {
+                this.logger.error(`Failed to update run state after error: ${updateErr}`);
+              }
             }
-          });
+          );
           return { runId, state: "pending" };
         }
         return this.executeWorkflowInline(workflow, jobRegistry, runId, opts);
@@ -48027,7 +48293,7 @@ var init_job_execution_manager = __esm({
               authInfo: opts.authInfo ?? {},
               contextProviders: opts.contextProviders
             });
-            const result = await ctx.execute(parsedInput);
+            const result = await runOnSurface("job", async () => ctx.execute(parsedInput));
             const logs = ctx.getLogs();
             await this.updateState(runId, {
               state: "completed",
@@ -48262,6 +48528,10 @@ var init_job_interface = __esm({
       getLogs() {
         return this._logs;
       }
+      /** A job (or a workflow step running it) calls tools on the `'job'` surface. */
+      callToolSurface() {
+        return "job";
+      }
     };
   }
 });
@@ -52401,6 +52671,8 @@ var init_server_interface = __esm({
     ServerRequest = class extends IncomingMessage {
       path;
       query;
+      /** Path parameters of the matched route (`:providerId` in `/oauth/provider/:providerId/callback`). */
+      params;
       body;
       authSession;
     };
@@ -52923,9 +53195,10 @@ var init_agent_execution_loop = __esm({
         let iterations = 0;
         let totalPromptTokens = 0;
         let totalCompletionTokens = 0;
+        let timeout;
         try {
           const timeoutPromise = new Promise((_, reject) => {
-            setTimeout(
+            timeout = setTimeout(
               () => reject(new Error(`Agent execution timed out after ${this.config.timeout}ms`)),
               this.config.timeout
             );
@@ -52969,6 +53242,8 @@ var init_agent_execution_loop = __esm({
             error,
             durationMs: Date.now() - startTime
           };
+        } finally {
+          clearTimeout(timeout);
         }
       }
       /**
@@ -53288,6 +53563,7 @@ var init_agent_interface = __esm({
   "libs/sdk/src/common/interfaces/agent.interface.ts"() {
     "use strict";
     init_agent_execution_loop();
+    init_frontmcp_context_storage();
     init_elicitation2();
     init_errors();
     init_execution_context_interface();
@@ -53555,6 +53831,10 @@ var init_agent_interface = __esm({
       async invokeAgent(agentId, input) {
         throw new AgentMethodNotAvailableError("invokeAgent", agentId);
       }
+      /** An agent calls tools on the `'agent'` surface, as its model's tool calls do. */
+      callToolSurface() {
+        return "agent";
+      }
       // ============================================================================
       // Notification Methods
       // ============================================================================
@@ -53671,7 +53951,9 @@ var init_agent_interface = __esm({
           {
             sessionId: this.authInfo.sessionId,
             getClientCapabilities: (sid) => this.scope.notifications.getClientCapabilities(sid),
-            tryGetContext: () => this.tryGetContext(),
+            // The request holds what answers this question: a fallback answer the owner already sent
+            // (the re-run of its call), or the 2026-07-28 exchange.
+            tryGetContext: () => this.tryGetContext() ?? this.runningRequestContext(),
             entryName: this._agentNameInternal ?? this.agentName,
             entryInput: this._agentInputInternal ?? this.input,
             elicitationEnabled: this.scope.metadata.elicitation?.enabled === true
@@ -53681,6 +53963,17 @@ var init_agent_interface = __esm({
           options
         );
       }
+      /**
+       * The context of the request this agent runs in. An agent is built with its own provider registry,
+       * which holds no request-scoped instances, so the context is read from the running request.
+       */
+      runningRequestContext() {
+        try {
+          return this.scope.providers.get(FrontMcpContextStorage).getStore();
+        } catch {
+          return void 0;
+        }
+      }
       /**
        * Respond with the final output and end execution.
        *
@@ -53836,6 +54129,7 @@ var ChannelContext;
 var init_channel_interface = __esm({
   "libs/sdk/src/common/interfaces/channel.interface.ts"() {
     "use strict";
+    init_call_surface();
     init_mcp_error();
     init_execution_context_interface();
     ChannelContext = class extends ExecutionContextBase {
@@ -53913,13 +54207,27 @@ var init_channel_interface = __esm({
           this.logger.warn(`Channel "${this.channelName}": pushIncoming called but no handler is wired`);
         }
       }
+      /**
+       * While it handles an HTTP trigger (a webhook source's request), a channel calls tools on the
+       * `'http-trigger'` surface. Handling any other event, it dispatches in-process.
+       */
+      callToolSurface() {
+        return getCallSurface() === "http-trigger" ? "http-trigger" : void 0;
+      }
     };
   }
 });
 
 // libs/sdk/src/common/utils/auth-info.utils.ts
-function authInfoFromAuthorization(authorization) {
+function sessionIdPresentedBy(request) {
+  const header = request.headers?.["mcp-session-id"];
+  if (typeof header === "string" && header.length > 0) return header;
+  const query = request.query?.["sessionId"];
+  return typeof query === "string" && query.length > 0 ? query : void 0;
+}
+function authInfoFromAuthorization(authorization, presentedSessionId) {
   const { token, user, session } = authorization;
+  const verifiedSession = session !== void 0 && presentedSessionId !== void 0 && session.id === presentedSessionId ? session : void 0;
   return {
     token,
     clientId: user?.sub,
@@ -53929,8 +54237,8 @@ function authInfoFromAuthorization(authorization) {
     user,
     extra: {
       user,
-      sessionId: session?.id,
-      sessionPayload: session?.payload
+      sessionId: verifiedSession?.id,
+      sessionPayload: verifiedSession?.payload
     }
   };
 }
@@ -54308,7 +54616,7 @@ var init_decide_request_intent_utils = __esm({
 });
 
 // libs/sdk/src/common/utils/guard.utils.ts
-import { isAnonymousSubject as isAnonymousSubject3 } from "@frontmcp/auth";
+import { isAnonymousSubject as isAnonymousSubject4 } from "@frontmcp/auth";
 import {
   ConcurrencyLimitError
 } from "@frontmcp/guard";
@@ -54321,15 +54629,19 @@ function enforceIpFilter(scope, clientIp, buildRejection = () => httpRespond.for
 function buildPartitionContext(source) {
   if (!source) return void 0;
   const clientId = source.authInfo?.clientId;
-  const userId = isAnonymousSubject3(clientId) ? void 0 : String(clientId);
-  const verifiedSessionId = source.authInfo?.sessionId ?? source.authInfo?.extra?.sessionId;
+  const userId = isAnonymousSubject4(clientId) ? void 0 : String(clientId);
   const callerKey = userId ? `user:${userId}` : "anonymous";
   return {
-    sessionId: verifiedSessionId === source.sessionId ? source.sessionId : callerKey,
+    sessionId: verifiedSessionOf(source) ?? callerKey,
     clientIp: source.metadata?.clientIp,
     userId
   };
 }
+function verifiedSessionOf(source) {
+  if ("verifiedSessionId" in source) return source.verifiedSessionId;
+  const confirmed = source.authInfo?.sessionId ?? source.authInfo?.extra?.sessionId;
+  return confirmed === source.sessionId ? source.sessionId : void 0;
+}
 function partitionsByIdentity(partitionBy) {
   return partitionBy === "session" || partitionBy === "userId" || typeof partitionBy === "function";
 }
@@ -54512,8 +54824,12 @@ var init_primary_auth_provider_interface = __esm({
        * @param _expectedAudience  The protected resource(s) the token must be for
        *                           (`aud` names at least one), when the caller is a
        *                           resource endpoint.
+       * @param _expectedIssuer    The issuer the token must name: the one this
+       *                           instance issues tokens under for the request
+       *                           (`LocalPrimaryAuth.issuerFor`). Default: its
+       *                           boot-time issuer.
        */
-      verifyGatewayToken(_token, _requestBaseUrl, _expectedAudience) {
+      verifyGatewayToken(_token, _requestBaseUrl, _expectedAudience, _expectedIssuer) {
         return Promise.resolve({
           ok: false,
           error: "gateway token verification is not supported by this auth mode"
@@ -55045,7 +55361,10 @@ function buildPerSkillResourceRecord(scope, skill, opts = {}) {
     description: skill.metadata.description,
     mimeType: SKILL_MD_MIME_TYPE,
     annotations,
-    _meta: meta
+    _meta: meta,
+    // The skill's own `availableWhen`, so `resources/list` and `resources/read` offer its SKILL.md
+    // on the surfaces that offer the skill, and answer others as for an unknown resource.
+    ...skill.metadata.availableWhen !== void 0 && { availableWhen: skill.metadata.availableWhen }
   };
   const handler = async () => {
     const { loadResult } = await findAndLoadSkillByPath(scope, skillPath);
@@ -55119,6 +55438,8 @@ function refreshFromSkill(resource, skill) {
   }
   Object.assign(resource.metadata, extensions);
   resource.metadata["description"] = skill.metadata.description;
+  if (skill.metadata.availableWhen === void 0) Reflect.deleteProperty(resource.metadata, "availableWhen");
+  else resource.metadata["availableWhen"] = skill.metadata.availableWhen;
   resource.extensionKeys = Object.keys(extensions);
 }
 var init_sep_2640_per_skill = __esm({
@@ -55218,11 +55539,23 @@ var init_skill_audit_helper = __esm({
 });
 
 // libs/sdk/src/skill/skill-scope.helper.ts
+function declaresDynamicSkills(metadata) {
+  return metadata.dynamicSkills === true || (metadata.plugins ?? []).some((plugin) => declaresDynamicSkills(normalizePlugin(plugin).metadata));
+}
+function pluginsRegisterDynamicSkills(plugins) {
+  for (const plugin of plugins) {
+    if (declaresDynamicSkills(normalizePlugin(plugin).metadata)) return true;
+  }
+  return false;
+}
 async function registerSkillCapabilities(options) {
-  const { skillRegistry, flowRegistry, resourceRegistry, providers, skillsConfig, logger } = options;
+  const { skillRegistry, flowRegistry, resourceRegistry, providers, skillsConfig, logger, dynamicSkills } = options;
   registerSkillAuditWriter({ providers, audit: skillsConfig?.audit, logger });
   await flowRegistry.registryFlows([FilterSkillsFlow]);
-  if (!skillRegistry.hasAny()) {
+  if (dynamicSkills) {
+    skillRegistry.expectDynamicSkills();
+  }
+  if (!skillRegistry.servesSkills()) {
     return;
   }
   await flowRegistry.registryFlows([SearchSkillsFlow, LoadSkillFlow]);
@@ -55264,6 +55597,7 @@ async function registerSep2640Resources(options) {
 var init_skill_scope_helper = __esm({
   "libs/sdk/src/skill/skill-scope.helper.ts"() {
     "use strict";
+    init_plugin_utils();
     init_flows2();
     init_resources();
     init_sep_2640_last_modified();
@@ -55849,8 +56183,10 @@ var init_session_store_factory = __esm({
 });
 
 // libs/sdk/src/transport/flows/handle.mcp-20260728.flow.ts
+import { isAnonymousSubject as isAnonymousSubject5 } from "@frontmcp/auth";
 import { z as z102 } from "@frontmcp/lazy-zod";
 import { MCP_20260728_META as MCP_20260728_META5 } from "@frontmcp/protocol";
+import { runRequestExclusive as runRequestExclusive5 } from "@frontmcp/utils";
 function frame2(message) {
   return encoder3.encode(`event: message
 data: ${JSON.stringify(message)}
@@ -55900,6 +56236,11 @@ async function* streamMessageResponse(options, sink, requestId, runInContext) {
   }
   yield frame2({ jsonrpc: "2.0", id, result: outcome?.result });
 }
+function isAnonymousCaller(auth) {
+  if (!auth) return true;
+  if (!isAnonymousSubject5(auth.user?.sub)) return false;
+  return !auth.token || auth.session?.payload?.isPublic === true;
+}
 function errorResponse(status, error, id) {
   return httpRespond.json(
     {
@@ -55956,11 +56297,7 @@ var init_handle_mcp_20260728_flow = __esm({
       async parseInput() {
         const { request } = this.rawInput;
         const auth = request[ServerRequestTokens.auth];
-        this.state.set(
-          stateSchema37.parse({
-            isAnonymous: !auth?.token || auth.token.length === 0 || auth.session?.payload?.isPublic === true
-          })
-        );
+        this.state.set(stateSchema37.parse({ isAnonymous: isAnonymousCaller(auth) }));
       }
       async validate() {
         const { request } = this.rawInput;
@@ -56017,7 +56354,7 @@ var init_handle_mcp_20260728_flow = __esm({
         if (!context) return (fn) => fn();
         const storage = this.scope.providers.get(FrontMcpContextStorage);
         return async (fn) => {
-          await storage.runWithContext(context, fn);
+          await runRequestExclusive5(() => storage.runWithContext(context, fn));
         };
       }
       findToolSchema(scope, toolName) {
@@ -56103,10 +56440,12 @@ var init_handle_mcp_20260728_flow = __esm({
           clientCapabilities,
           frontmcpContext: this.tryGetContext(),
           authInfo: auth ? {
+            // No session is presented: this revision has none, so the request has no verified
+            // session (`extra.sessionId`), and anything kept across requests falls back to the
+            // authenticated caller.
             ...authInfoFromAuthorization(auth),
-            // Sessions no longer exist at the protocol level, but the shared
-            // handlers key per-request state (memory, credentials) off an id.
-            // Derive a request-scoped one so nothing leaks between calls.
+            // The shared handlers still key per-request state (provider views, notifications)
+            // off an id. This one names the request only; the request context does not vouch for it.
             sessionId: auth.session?.id
           } : void 0,
           isAnonymous: this.state.required.isAnonymous,
@@ -56991,6 +57330,7 @@ var init_handle_streamable_http_flow = __esm({
     init_ext_apps2();
     init_ha_constants();
     init_skill_mode_utils();
+    init_mcp_surface();
     plan40 = {
       pre: ["parseInput", "router"],
       execute: ["onInitialize", "onMessage", "onElicitResult", "onSseListener", "onExtApps"],
@@ -57373,7 +57713,8 @@ var init_handle_streamable_http_flow = __esm({
                     sessionId: session.id,
                     sessionIdPayload: session.payload,
                     token
-                  }
+                  },
+                  surface: mcpRequestSurface(this.scope)
                 }
               });
               const parsed = CallToolResultSchema4.safeParse(result);
@@ -59695,6 +60036,41 @@ var init_request_log_redaction = __esm({
   }
 });
 
+// libs/sdk/src/transport/persistent-session-owner.ts
+var persistent_session_owner_exports = {};
+__export(persistent_session_owner_exports, {
+  claimPersistentSession: () => claimPersistentSession,
+  persistentSessionCallerKey: () => persistentSessionCallerKey
+});
+import { isAnonymousSubject as isAnonymousSubject6 } from "@frontmcp/auth";
+import { sha256Hex as sha256Hex13 } from "@frontmcp/utils";
+function persistentSessionCallerKey(authorization) {
+  const sub = authorization?.user?.sub;
+  if (!isAnonymousSubject6(sub)) {
+    const iss = authorization?.user?.iss;
+    return `sub:${sha256Hex13(JSON.stringify([typeof iss === "string" ? iss : "", sub]))}`;
+  }
+  if (authorization?.token) return `token:${sha256Hex13(authorization.token)}`;
+  return null;
+}
+function claimPersistentSession(session, callerKey, store) {
+  if (!owners.has(session) && store && store.initial !== void 0) {
+    owners.set(session, store.initial);
+  }
+  if (!owners.has(session)) {
+    owners.set(session, callerKey);
+    return "claimed";
+  }
+  return owners.get(session) === callerKey ? "owner" : "refused";
+}
+var owners;
+var init_persistent_session_owner = __esm({
+  "libs/sdk/src/transport/persistent-session-owner.ts"() {
+    "use strict";
+    owners = /* @__PURE__ */ new WeakMap();
+  }
+});
+
 // libs/sdk/src/transport/web-standard-mcp.ts
 var web_standard_mcp_exports = {};
 __export(web_standard_mcp_exports, {
@@ -59721,7 +60097,8 @@ async function wireServer(scope, serverOptions, sessionId, sessionIdGenerator, e
 }
 async function buildPersistentWebStandardMcp(scope, options) {
   const serverOptions = buildScopedServerOptions(scope);
-  return wireServer(scope, serverOptions, options.sessionId, () => options.sessionId, false);
+  const pair = await wireServer(scope, serverOptions, options.sessionId, () => options.sessionId, false);
+  return options.owner ? { ...pair, owner: options.owner } : pair;
 }
 async function runWebStandardMcp(scope, request, options) {
   if (options.persistent) {
@@ -59730,13 +60107,7 @@ async function runWebStandardMcp(scope, request, options) {
   const sessionId = `web:${randomUUID26()}`;
   const accept = request.headers.get("accept") ?? "";
   const wantsStream = request.method === "GET" || options.sse && accept.includes("text/event-stream");
-  const { mcpServer, transport } = await wireServer(
-    scope,
-    options.serverOptions,
-    sessionId,
-    void 0,
-    !wantsStream
-  );
+  const { mcpServer, transport } = await wireServer(scope, options.serverOptions, sessionId, void 0, !wantsStream);
   const response = await transport.handleRequest(request, {
     authInfo: options.authInfo
   });
@@ -59798,6 +60169,10 @@ var init_http_request_flow = __esm({
         "router"
       ],
       execute: [
+        // A Durable Object's persistent session serves only the caller that opened
+        // it: anyone else presenting its id is answered as an unknown session. First,
+        // before every protocol handler (2026-07-28 included), so none can serve it.
+        "checkPersistentSessionOwner",
         // Protocol 2026-07-28. Runs before EVERY session-era handler — including
         // `handleWebFetch`, which answers any request carrying a Web `Request`
         // regardless of intent and would otherwise swallow 2026 traffic on a
@@ -59934,7 +60309,8 @@ var init_http_request_flow = __esm({
             const ctx = this.tryGetContext();
             if (ctx) {
               const { token, user } = result.authorization;
-              ctx.updateAuthInfo(authInfoFromAuthorization(result.authorization));
+              const presentedSessionId = this.servesProtocol20260728() ? void 0 : sessionIdPresentedBy(request);
+              ctx.updateAuthInfo(authInfoFromAuthorization(result.authorization, presentedSessionId));
               await this.bindOrchestrationAccessor(ctx, token, user);
             }
           }
@@ -59986,6 +60362,24 @@ var init_http_request_flow = __esm({
         });
         ctx.setContextToken(ORCHESTRATED_AUTH_ACCESSOR2, new OrchestratedAuthAccessorAdapter(authorization));
       }
+      /**
+       * Whether this request is served under MCP protocol 2026-07-28.
+       *
+       * A V8-isolate deployment (Cloudflare Worker) defaults to the stateless revision: it needs no
+       * session storage, so an unversioned call is served directly instead of minting a session in a
+       * Durable Object. Node keeps defaulting to the session pipeline. Either way an explicit declaration
+       * from the client always wins.
+       */
+      servesProtocol20260728() {
+        const { request } = this.rawInput;
+        const isWebMode = !!request[ServerRequestTokens.webRequest];
+        const defaultProtocolVersion = this.scope.metadata.transport?.defaultProtocolVersion ?? (isWebMode ? "2026-07-28" : "legacy");
+        return isProtocol20260728Request({
+          headers: request.headers,
+          body: request.body,
+          defaultVersion: defaultProtocolVersion
+        });
+      }
       async router() {
         try {
           const { request } = this.rawInput;
@@ -60019,12 +60413,7 @@ var init_http_request_flow = __esm({
             reasons: decision.reasons,
             debug: decision.debug
           });
-          const defaultProtocolVersion = transportConfig.defaultProtocolVersion ?? (isWebMode ? "2026-07-28" : "legacy");
-          if (isProtocol20260728Request({
-            headers: request.headers,
-            body: request.body,
-            defaultVersion: defaultProtocolVersion
-          })) {
+          if (this.servesProtocol20260728()) {
             const verify = this.state.required.verifyResult;
             if (verify.kind === "authorized") {
               request[ServerRequestTokens.auth] = verify.authorization;
@@ -60070,6 +60459,11 @@ var init_http_request_flow = __esm({
             const deleteVerify = this.state.required.verifyResult;
             const requestedSessionId = request[ServerRequestTokens.sessionId] ?? request.headers["mcp-session-id"] ?? request.query?.["sessionId"];
             const deleteAuthz = authorizeSessionTermination(deleteVerify, requestedSessionId);
+            if (request[ServerRequestTokens.webTransport] && deleteAuthz.kind !== "unauthorized") {
+              request[ServerRequestTokens.auth] = deleteVerify.authorization;
+              this.state.set("intent", decision.intent);
+              return;
+            }
             if (deleteAuthz.kind === "unauthorized") {
               this.logger.warn(`[${this.requestId}] DELETE session denied: request is not authenticated`);
               this.respond(
@@ -60183,6 +60577,28 @@ var init_http_request_flow = __esm({
           throw error;
         }
       }
+      async checkPersistentSessionOwner() {
+        const req = this.rawInput.request;
+        const persistent = req[ServerRequestTokens.webTransport];
+        if (!req[ServerRequestTokens.webRequest] || !persistent || typeof persistent !== "object") return;
+        const { claimPersistentSession: claimPersistentSession2, persistentSessionCallerKey: persistentSessionCallerKey2 } = await Promise.resolve().then(() => (init_persistent_session_owner(), persistent_session_owner_exports));
+        const authorization = req[ServerRequestTokens.auth];
+        const callerKey = persistentSessionCallerKey2(authorization);
+        const store = persistent.owner;
+        const claim = claimPersistentSession2(persistent, callerKey, store);
+        if (claim === "claimed") {
+          await store?.save(callerKey);
+          return;
+        }
+        if (claim === "owner") return;
+        this.logger.warn(`[${this.requestId}] Persistent session refused: it was opened by another caller`);
+        this.respond(
+          httpRespond.json(
+            { jsonrpc: "2.0", error: { code: -32001, message: "Session not found" }, id: null },
+            { status: 404 }
+          )
+        );
+      }
       async handleWebFetch() {
         const { request } = this.rawInput;
         const req = request;
@@ -60197,7 +60613,7 @@ var init_http_request_flow = __esm({
           const proto = expandProtocolConfig2(scope.metadata.transport?.protocol);
           const sse = proto.streamable && !proto.json;
           const authorization = req[ServerRequestTokens.auth];
-          const authInfo = authorization ? authInfoFromAuthorization(authorization) : void 0;
+          const authInfo = authorization ? authInfoFromAuthorization(authorization, sessionIdPresentedBy(request)) : void 0;
           const persistent = req[ServerRequestTokens.webTransport];
           const response = await runWebStandardMcp2(scope, webRequest, {
             serverOptions: buildScopedServerOptions2(scope),
@@ -60403,6 +60819,9 @@ var init_http_request_flow = __esm({
     __decorateClass([
       Stage43("router")
     ], HttpRequestFlow.prototype, "router", 1);
+    __decorateClass([
+      Stage43("checkPersistentSessionOwner")
+    ], HttpRequestFlow.prototype, "checkPersistentSessionOwner", 1);
     __decorateClass([
       Stage43("handleWebFetch")
     ], HttpRequestFlow.prototype, "handleWebFetch", 1);
@@ -60990,7 +61409,11 @@ var init_scope_instance = __esm({
         if (!this.cliMode) {
           await this.buildAuthUiRegistry();
         }
-        if (this.scopeSkills.hasAny()) {
+        const dynamicSkills = pluginsRegisterDynamicSkills([
+          ...serverPlugins,
+          ...this.scopeApps.getApps().flatMap((app) => "plugins" in app.metadata ? app.metadata.plugins ?? [] : [])
+        ]);
+        if (this.scopeSkills.hasAny() || dynamicSkills) {
           const store = createSkillSessionStore({ type: "memory" });
           this._skillSession = new SkillSessionManager(
             {
@@ -61041,7 +61464,8 @@ var init_scope_instance = __esm({
           resourceRegistry: this.scopeResources,
           providers: this.scopeProviders,
           skillsConfig: this.metadata.skillsConfig,
-          logger: this.logger
+          logger: this.logger,
+          dynamicSkills
         });
         const jobsConfig = this.metadata.jobs;
         const metaRecord = this.metadata;
@@ -61844,7 +62268,7 @@ import {
   ProviderScope as ProviderScope8,
   tokenName as tokenName18
 } from "@frontmcp/di";
-function verifiedSessionOf(requestContext) {
+function verifiedSessionOf2(requestContext) {
   const { authInfo } = requestContext;
   const verified = authInfo.sessionId ?? authInfo.extra?.["sessionId"];
   return typeof verified === "string" && verified.length > 0 && verified !== STATELESS_SESSION_ID ? verified : void 0;
@@ -62605,7 +63029,7 @@ var init_provider_registry = __esm({
         if (!(requestContext instanceof FrontMcpContext)) {
           return newProviderStore();
         }
-        if (!this.sessionCacheEnabled || verifiedSessionOf(requestContext) !== sessionKey) {
+        if (!this.sessionCacheEnabled || verifiedSessionOf2(requestContext) !== sessionKey) {
           let stores = requestContext.get(REQUEST_PROVIDER_STORES);
           if (!stores) {
             stores = /* @__PURE__ */ new WeakMap();
@@ -63027,6 +63451,7 @@ var init_web_response_renderer = __esm({
 });
 
 // libs/sdk/src/transport/web-fetch-handler.ts
+import { runRequestExclusive as runRequestExclusive6 } from "@frontmcp/utils";
 function isCloudflareWorkersRuntime(request) {
   if (typeof navigator !== "undefined" && navigator.userAgent === CLOUDFLARE_WORKERS_USER_AGENT) return true;
   const cloudflareProperties = request.cf;
@@ -63140,10 +63565,12 @@ async function runHttpRequestFlowWeb(scope, request, opts = {}) {
   const serverRequest = await toServerRequest(request, url, opts.ctx, opts.persistent, opts.env);
   let output;
   try {
-    output = await scope.runFlow("http:request", {
-      request: serverRequest,
-      response: {}
-    });
+    output = await runRequestExclusive6(
+      () => scope.runFlow("http:request", {
+        request: serverRequest,
+        response: {}
+      })
+    );
   } catch (error) {
     output = flowErrorToHttpOutput(error);
   }
@@ -63156,10 +63583,12 @@ async function runMatchingHttpFlowWeb(scope, request, opts = {}) {
   if (!flowName) return void 0;
   let output;
   try {
-    output = await scope.runFlow(flowName, {
-      request: serverRequest,
-      response: {}
-    });
+    output = await runRequestExclusive6(
+      () => scope.runFlow(flowName, {
+        request: serverRequest,
+        response: {}
+      })
+    );
   } catch (error) {
     output = flowErrorToHttpOutput(error);
   }
@@ -63170,6 +63599,7 @@ async function toServerRequest(request, url, ctx, persistent, env) {
   request.headers.forEach((v, k) => {
     headers[k] = v;
   });
+  headers["host"] = url.host;
   const query = {};
   url.searchParams.forEach((v, k) => {
     const existing = query[k];
@@ -63200,6 +63630,8 @@ async function toServerRequest(request, url, ctx, persistent, env) {
   const webRequest = new Request(url.toString(), init);
   const serverRequest = {
     method,
+    // The scheme the client used, as Express reports it (`req.protocol`).
+    protocol: url.protocol.slice(0, -1),
     path: url.pathname,
     url: url.pathname + url.search,
     headers,
@@ -63280,7 +63712,10 @@ var init_web_fetch_handler = __esm({
     MISCONFIGURATION_REMEDIES = {
       SESSION_SECRET_REQUIRED: "Set MCP_SESSION_SECRET in the deployment environment (e.g. `wrangler secret put MCP_SESSION_SECRET`). Session IDs are encrypted with it, and production refuses the development machine-id fallback.",
       JWT_SECRET_INVALID: "JWT_SECRET is present but too weak: HS256 requires at least 32 bytes (RFC 7518). Replace it with `openssl rand -hex 32`.",
-      JWT_SECRET_REQUIRED: "Set JWT_SECRET in the deployment environment (e.g. `wrangler secret put JWT_SECRET`). Tokens are signed with it; production refuses the random per-process fallback because tokens would not survive a restart or verify across instances."
+      JWT_SECRET_REQUIRED: "Set JWT_SECRET in the deployment environment (e.g. `wrangler secret put JWT_SECRET`). Tokens are signed with it; production refuses the random per-process fallback because tokens would not survive a restart or verify across instances.",
+      // The startup checks: a server whose entries ask for protection nothing gives them does not start.
+      UNENFORCED_METADATA: "An entry declares a field only a plugin enforces (approval, featureFlag, ...) and no installed plugin that enforces it reaches the entry, so the server refuses to start. Install the plugin or remove the field; the server log names the entries.",
+      AUTH_CONFIGURATION_ERROR: "The auth or authorities configuration is invalid (for example, entries declare authorities and the server has no authorities option, or a rule checks nothing), so the server refuses to start. The server log names the entries."
     };
   }
 });
@@ -63930,12 +64365,172 @@ var init_front_mcp_providers = __esm({
   }
 });
 
+// libs/sdk/src/front-mcp/static-startup.check.ts
+function tryNormalize(normalize) {
+  try {
+    return normalize();
+  } catch {
+    return void 0;
+  }
+}
+function asMetadata(value) {
+  return value !== null && typeof value === "object" ? value : void 0;
+}
+function isServedEverywhere(metadata) {
+  const availability = asMetadata(metadata["availableWhen"]);
+  if (!availability) return true;
+  return Object.entries(availability).every(
+    ([axis, value]) => value === void 0 || axis === "surface" && Array.isArray(value) && value.length > 0
+  );
+}
+function pluginClassOf(record) {
+  switch (record.kind) {
+    case "CLASS_TOKEN" /* CLASS_TOKEN */:
+      return record.provide;
+    case "CLASS" /* CLASS */:
+      return record.useClass;
+    case "VALUE" /* VALUE */:
+      return record.useValue?.constructor;
+    default:
+      return void 0;
+  }
+}
+function pluginHooksOf(record) {
+  const pluginClass = pluginClassOf(record);
+  if (!pluginClass) return void 0;
+  return [...collectHook(pluginClass), ...peekPendingTC39HooksForClass(pluginClass)];
+}
+function keysEnforcedByPlugins2(plugins, into = /* @__PURE__ */ new Set()) {
+  for (const plugin of plugins ?? []) {
+    const record = tryNormalize(() => normalizePlugin(plugin));
+    if (!record) continue;
+    for (const key of record.metadata.enforcesMetadata ?? []) into.add(key);
+    keysEnforcedByPlugins2(record.metadata.plugins, into);
+  }
+  return into;
+}
+function collectStaticEntries(config) {
+  const found = [];
+  const everyAppKeys = /* @__PURE__ */ new Set();
+  const ownAppKeys = /* @__PURE__ */ new Map();
+  const add = (label, metadata, reach) => {
+    const fields = asMetadata(metadata);
+    if (!fields || !isServedEverywhere(fields)) return false;
+    found.push({ label, metadata: fields, reach });
+    return true;
+  };
+  const keysOfApp = (app) => {
+    const keys = ownAppKeys.get(app) ?? /* @__PURE__ */ new Set();
+    ownAppKeys.set(app, keys);
+    return keys;
+  };
+  const visitPlugins = (plugins, app) => {
+    for (const plugin of plugins ?? []) {
+      const record = tryNormalize(() => normalizePlugin(plugin));
+      if (!record) continue;
+      const hooks = pluginHooksOf(record);
+      if (hooks === void 0 || hooks.length > 0) {
+        const gatesOnlyItsApp = hooks !== void 0 && !hooks.some((hook) => hook.appliesTo === "uncovered-apps");
+        const keys = app && gatesOnlyItsApp ? keysOfApp(app) : everyAppKeys;
+        for (const key of record.metadata.enforcesMetadata ?? []) keys.add(key);
+      }
+      visitEntries(record.metadata, app);
+    }
+  };
+  const visitEntries = (owner, app) => {
+    const reach = app ? { app } : "every-plugin";
+    for (const item of owner.tools ?? []) {
+      const record = tryNormalize(() => normalizeTool(item));
+      if (record) add(`Tool "${record.metadata.id || record.metadata.name}"`, record.metadata, reach);
+    }
+    for (const item of owner.resources ?? []) {
+      if (tryNormalize(() => isResourceTemplate(item))) {
+        const record = tryNormalize(() => normalizeResourceTemplate(item));
+        if (record) add(`Resource template "${record.metadata.name}"`, record.metadata, reach);
+      } else {
+        const record = tryNormalize(() => normalizeResource(item));
+        if (record) add(`Resource "${record.metadata.name}"`, record.metadata, reach);
+      }
+    }
+    for (const item of owner.prompts ?? []) {
+      const record = tryNormalize(() => normalizePrompt(item));
+      if (record) add(`Prompt "${record.metadata.name}"`, record.metadata, reach);
+    }
+    for (const item of owner.agents ?? []) {
+      const record = tryNormalize(() => normalizeAgent(item));
+      if (!record) continue;
+      const agentName = record.metadata.id ?? record.metadata.name;
+      if (!add(`Agent "${agentName}"`, record.metadata, reach)) continue;
+      const agentKeys = record.metadata.execution?.useToolFlow === false ? /* @__PURE__ */ new Set() : keysEnforcedByPlugins2(record.metadata.plugins);
+      for (const toolItem of record.metadata.tools ?? []) {
+        const toolRecord = tryNormalize(() => normalizeTool(toolItem));
+        if (toolRecord) add(`Tool "${agentName}:${toolRecord.metadata.name}"`, toolRecord.metadata, { agentKeys });
+      }
+    }
+    for (const item of owner.skills ?? []) {
+      const record = tryNormalize(() => normalizeSkill(item));
+      if (record) add(`Skill "${record.metadata.id ?? record.metadata.name}"`, record.metadata, "every-plugin");
+    }
+    visitPlugins(owner.plugins, app);
+  };
+  const server = config;
+  visitEntries({ skills: server.skills, plugins: server.plugins }, void 0);
+  for (const app of server.apps ?? []) {
+    const record = tryNormalize(() => normalizeApp(app));
+    if (record?.kind === "LOCAL_CLASS" /* LOCAL_CLASS */) visitEntries(record.metadata, record);
+  }
+  const everyPluginKeys = /* @__PURE__ */ new Set([...everyAppKeys, ...[...ownAppKeys.values()].flatMap((keys) => [...keys])]);
+  const keysReaching = (reach) => {
+    if (reach === "every-plugin") return everyPluginKeys;
+    if ("agentKeys" in reach) return reach.agentKeys;
+    return /* @__PURE__ */ new Set([...everyAppKeys, ...ownAppKeys.get(reach.app) ?? []]);
+  };
+  return found.map(({ label, metadata, reach }) => ({ label, metadata, enforcedBy: keysReaching(reach) }));
+}
+function assertStaticStartupConfig(config) {
+  const entries = collectStaticEntries(config);
+  if (!config.authorities) {
+    const labels = entries.filter(({ metadata }) => isEnforcementRequested(metadata["authorities"])).map(({ label }) => label);
+    if (labels.length > 0) {
+      const names = labels.slice(0, 5).join(", ");
+      const suffix = labels.length > 5 ? ` and ${labels.length - 5} more` : "";
+      throw new AuthConfigurationError(
+        `Authorities configuration required: ${names}${suffix} declare 'authorities' metadata but authorities enforcement is not fully configured (engine/context builder missing). Add 'authorities: { claimsMapping: {...}, profiles: {...} }' to your @FrontMcp() decorator to enable enforcement, or remove 'authorities' from entry metadata.`,
+        { suggestion: "Add authorities config to @FrontMcp() or remove authorities from entry metadata" }
+      );
+    }
+  }
+  const problems = entries.flatMap(
+    ({ label, metadata, enforcedBy }) => getEnforcedMetadataKeys().filter((key) => isEnforcementRequested(metadata[key]) && !enforcedBy.has(key)).map((key) => {
+      const enforcer = describeMetadataEnforcer(key);
+      return `${label} declares '${key}'${enforcer ? ` (enforced by ${enforcer})` : ""}`;
+    })
+  );
+  if (problems.length > 0) throw new UnenforcedMetadataError(problems);
+}
+var init_static_startup_check = __esm({
+  "libs/sdk/src/front-mcp/static-startup.check.ts"() {
+    "use strict";
+    init_agent_utils();
+    init_app_utils();
+    init_hook_decorator();
+    init_enforced_metadata_utils();
+    init_errors();
+    init_hooks_utils();
+    init_plugin_utils();
+    init_prompt_utils();
+    init_resource_utils();
+    init_skill_utils();
+    init_tool_utils();
+  }
+});
+
 // libs/sdk/src/front-mcp/front-mcp.ts
 var front_mcp_exports = {};
 __export(front_mcp_exports, {
   FrontMcpInstance: () => FrontMcpInstance
 });
-import { fileExists as fileExists7, randomUUID as randomUUID28, unlink as unlink2 } from "@frontmcp/utils";
+import { fileExists as fileExists7, isEdgeRuntime as isEdgeRuntime2, randomUUID as randomUUID28, unlink as unlink2 } from "@frontmcp/utils";
 function resolveConfigInput(optionsOrClass) {
   if (typeof optionsOrClass === "function") {
     const stored = getDecoratorConfig(optionsOrClass);
@@ -63963,6 +64558,7 @@ var init_front_mcp = __esm({
     init_task();
     init_web_fetch_handler();
     init_front_mcp_providers();
+    init_static_startup_check();
     stdioServing = false;
     FrontMcpInstance = class _FrontMcpInstance2 {
       config;
@@ -64121,17 +64717,25 @@ var init_front_mcp = __esm({
        * Express / Node `req`/`res` and runs on V8-isolate targets (Cloudflare
        * Workers, Deno Deploy, Bun).
        *
+       * A server the startup checks refuse (an entry whose `approval`, `featureFlag`
+       * or `authorities` nothing enforces, a missing secret, ...) rejects here, as
+       * with {@link createDirect}. On an edge isolate the server is built on its
+       * first request instead (see below).
+       *
        * @example
        * // worker entry
        * const handler = await FrontMcpInstance.createFetchHandler(config);
        * export default { fetch: (request) => handler(request) };
        */
       static async createFetchHandler(options) {
-        let inner;
-        let building;
-        const build = async () => {
+        const build = async (deferred) => {
           const frontMcp = new _FrontMcpInstance2(frontMcpMetadataSchema.parse(options));
-          await frontMcp.ready;
+          try {
+            await frontMcp.ready;
+          } catch (err) {
+            if (deferred) frontMcp.log?.error("FrontMCP failed to start; requests are refused until it does", err);
+            throw err;
+          }
           const scope = frontMcp.getPrimaryScope();
           if (!scope) {
             throw new ServerNotFoundError();
@@ -64139,10 +64743,14 @@ var init_front_mcp = __esm({
           frontMcp.log?.info("FrontMCP fetch handler created (web-standard transport)");
           return createWebFetchHandler(scope);
         };
+        if (!isEdgeRuntime2()) return build(false);
+        assertStaticStartupConfig(options);
+        let inner;
+        let building;
         return async (request, ctx, env) => {
           if (!inner) {
             if (!building) {
-              building = build().catch((err) => {
+              building = build(true).catch((err) => {
                 building = void 0;
                 throw err;
               });
@@ -64649,7 +65257,8 @@ async function executeTaskWorker(options, taskId) {
     await runTaskInBackground({
       record,
       cleanedRequestParams: record.request.params,
-      ctx: { authInfo: { sessionId } },
+      // On the surface of the call that created the task, as the in-process runner runs it.
+      ctx: { authInfo: { sessionId }, ...record.surface !== void 0 && { surface: record.surface } },
       scope,
       store: taskStore,
       registry,
@@ -66519,6 +67128,7 @@ var init_common = __esm({
 // libs/sdk/src/index.ts
 init_common();
 init_front_mcp2();
+init_static_startup_check();
 init_serverless_handler();
 init_common();
 init_errors();
@@ -66856,6 +67466,39 @@ init_agent_decorator();
 
 // libs/sdk/src/index.ts
 init_adapters();
+
+// libs/sdk/src/hooks/hook-coverage.ts
+init_lineage_utils();
+function gateOf(scope, entry) {
+  if ("tool" in entry) {
+    return {
+      flow: "tools:call-tool",
+      ownerId: hookOwnerIdOf(scope.tools.lineageOf(entry.tool) ?? [], entry.tool.owner)
+    };
+  }
+  if ("resource" in entry) {
+    return {
+      flow: "resources:read-resource",
+      ownerId: appOwnerIdOf(scope.resources.lineageOf(entry.resource) ?? [], entry.resource.owner)
+    };
+  }
+  if ("prompt" in entry) {
+    return {
+      flow: "prompts:get-prompt",
+      ownerId: appOwnerIdOf(scope.prompts.lineageOf(entry.prompt) ?? [], entry.prompt.owner)
+    };
+  }
+  return {
+    flow: "skills:filter",
+    ownerId: appOwnerIdOf(scope.skills.lineageOf?.(entry.skill) ?? [], entry.skill.owner)
+  };
+}
+function isEntryGatedBy(scope, entry, target) {
+  const { flow, ownerId } = gateOf(scope, entry);
+  return scope.hooks.getFlowHooksForOwner(flow, ownerId).some((hook) => hook.metadata.target === target);
+}
+
+// libs/sdk/src/index.ts
 init_config();
 init_config();
 init_direct();
@@ -66876,6 +67519,7 @@ init_mcp_stateless_client_adapter();
 init_ext_apps2();
 import { PROTOCOL_2026_07_28 as PROTOCOL_2026_07_284 } from "@frontmcp/protocol";
 import { InMemoryOrchestratedTokenStore as InMemoryOrchestratedTokenStore2 } from "@frontmcp/auth";
+import { isAnonymousSubject as isAnonymousSubject7 } from "@frontmcp/auth";
 (function suppressZodExpressWarning() {
   if (typeof process === "undefined" || typeof process.emitWarning !== "function") return;
   const originalEmitWarning = process.emitWarning.bind(process);
@@ -67270,6 +67914,7 @@ export {
   SessionClaimConflictError,
   SessionHookStage,
   SessionIdEmptyError,
+  SessionIdentityRequiredError,
   SessionMissingError,
   SessionSecretRequiredError,
   SessionVerificationFailedError,
@@ -67397,6 +68042,7 @@ export {
   appAuthOptionsSchema,
   appFilterConfigSchema,
   applyPrimitiveFilter,
+  assertStaticStartupConfig,
   authInfoFromAuthorization,
   authOptionsSchema,
   authenticateFnSchema,
@@ -67568,6 +68214,7 @@ export {
   incrementalAuthConfigSchema,
   intentSchema,
   isAlive,
+  isAnonymousSubject7 as isAnonymousSubject,
   isAuthError,
   isChannelClass,
   isChannelFunction,
@@ -67577,6 +68224,7 @@ export {
   isDynamicPluginClass,
   isElicitationEncryptionAvailable,
   isEncryptedBlob,
+  isEntryGatedBy,
   isFileInstructions,
   isInlineInstructions,
   isLazy,
@@ -67657,6 +68305,7 @@ export {
   parseTraceContext,
   partitionsByIdentity,
   pathToEnvKey,
+  peekPendingTC39HooksForClass,
   performElicit,
   performListRoots,
   performSample,
@@ -67702,6 +68351,7 @@ export {
   serializeHttpCookie,
   serverInfoOptionsSchema,
   sessionIdPayloadSchema2 as sessionIdPayloadSchema,
+  sessionIdPresentedBy,
   sessionIdSchema,
   sessionOptionsSchema,
   setNestedValue,