@frontmcp/sdk 1.8.5 → 1.8.6

package/esm/index.mjs

@@ -6035,6 +6035,33 @@ var init_errors = __esm({
   }
 });
 
+// libs/sdk/src/common/utils/list-all-pages.utils.ts
+async function listAllPages(method, fetchPage, fail = (message) => new InternalMcpError(message, "LIST_PAGINATION_STALLED")) {
+  const items = [];
+  const seenCursors = /* @__PURE__ */ new Set();
+  let cursor;
+  for (let page = 0; page < MAX_LIST_PAGES; page++) {
+    const result = await fetchPage(cursor);
+    items.push(...result.items ?? []);
+    const next = result.nextCursor;
+    if (!next) return items;
+    if (seenCursors.has(next)) {
+      throw fail(`${method} returned the cursor "${next}" twice`);
+    }
+    seenCursors.add(next);
+    cursor = next;
+  }
+  throw fail(`${method} did not finish within ${MAX_LIST_PAGES} pages`);
+}
+var MAX_LIST_PAGES;
+var init_list_all_pages_utils = __esm({
+  "libs/sdk/src/common/utils/list-all-pages.utils.ts"() {
+    "use strict";
+    init_mcp_error();
+    MAX_LIST_PAGES = 1e3;
+  }
+});
+
 // libs/sdk/src/transport/mcp-handlers/skills-mcp.types.ts
 import { z as z40 } from "@frontmcp/lazy-zod";
 var SkillsSearchRequestSchema, SkillsSearchResultSchema, SkillsLoadRequestSchema, SkillsLoadResultSchema, SkillsListRequestSchema, SkillsListResultSchema;
@@ -12108,6 +12135,7 @@ var DirectClientImpl;
 var init_direct_client = __esm({
   "libs/sdk/src/direct/direct-client.ts"() {
     "use strict";
+    init_list_all_pages_utils();
     init_errors();
     init_skills_mcp_types();
     init_llm_platform();
@@ -12254,8 +12282,11 @@ var init_direct_client = __esm({
       // Tool Operations (platform-formatted)
       // ─────────────────────────────────────────────────────────────────────────────
       async listTools() {
-        const result = await this.mcpClient.listTools();
-        return formatToolsForPlatform(result.tools, this.platform);
+        const tools = await listAllPages("tools/list", async (cursor) => {
+          const result = await this.mcpClient.listTools(cursor ? { cursor } : void 0);
+          return { items: result.tools, nextCursor: result.nextCursor };
+        });
+        return formatToolsForPlatform(tools, this.platform);
       }
       async callTool(name44, args) {
         const result = await this.mcpClient.callTool({
@@ -22056,6 +22087,9 @@ var init_call_tool_flow = __esm({
       uiResult: z57.any().optional(),
       // UI metadata from rendering (merged into _meta)
       uiMeta: z57.record(z57.string(), z57.unknown()).optional(),
+      // Metadata hooks add to the result (e.g. the cache plugin's `cache: 'hit'`), merged into the
+      // result's _meta; never merged into rawOutput, which is the tool's data
+      resultMeta: z57.record(z57.string(), z57.unknown()).optional(),
       // Progress token from request's _meta (for progress notifications)
       progressToken: z57.union([z57.string(), z57.number()]).optional(),
       // JSON-RPC request ID (for elicitation routing)
@@ -22883,7 +22917,7 @@ ${JSON.stringify(error.schema, null, 2)}
       }
       async finalize() {
         this.logger.verbose("finalize:start");
-        const { tool, rawOutput, uiResult, uiMeta } = this.state;
+        const { tool, rawOutput, uiResult, uiMeta, resultMeta } = this.state;
         if (!tool) {
           this.logger.verbose("finalize: skipping (no tool in state)");
           return;
@@ -22926,6 +22960,9 @@ ${JSON.stringify(error.schema, null, 2)}
         if (rawMeta) {
           result._meta = { ...result._meta, ...rawMeta };
         }
+        if (resultMeta) {
+          result._meta = { ...result._meta, ...resultMeta };
+        }
         if (uiResult) {
           result.content = uiResult.content;
           if (uiResult.structuredContent !== void 0 && uiResult.structuredContent !== null) {
@@ -25468,6 +25505,56 @@ var init_dynamic_utils = __esm({
   }
 });
 
+// libs/sdk/src/common/dynamic/dynamic.plugin.ts
+function isDynamicPluginClass(value) {
+  return typeof value === "function" && value.prototype instanceof DynamicPlugin;
+}
+function initOptionsOf(instance) {
+  return initOptionsByInstance.has(instance) ? { options: initOptionsByInstance.get(instance) } : void 0;
+}
+var initOptionsByInstance, DynamicPlugin;
+var init_dynamic_plugin = __esm({
+  "libs/sdk/src/common/dynamic/dynamic.plugin.ts"() {
+    "use strict";
+    init_transport_errors();
+    init_dynamic_utils();
+    initOptionsByInstance = /* @__PURE__ */ new WeakMap();
+    DynamicPlugin = class {
+      get(token) {
+        throw new MethodNotImplementedError("DynamicPlugin", "get");
+      }
+      /**
+       * Static init() method to create a plugin provider.
+       * @param options - Input options (with optional fields for defaults). Omitted, the plugin is
+       *   built with `{}`, as `ApprovalPlugin.init()` is documented.
+       */
+      static init(options = {}) {
+        const extraProviders = options.providers;
+        const typedOptions = options;
+        if ("useFactory" in options) {
+          return {
+            ...typedOptions,
+            provide: this,
+            inject: options.inject,
+            useFactory: options.useFactory,
+            providers: dedupePluginProviders(extraProviders ?? [])
+          };
+        }
+        const dyn = collectDynamicProviders(this, typedOptions);
+        const mergedProviders = dedupePluginProviders([...dyn ?? [], ...extraProviders ?? []]);
+        const instance = new this(options);
+        initOptionsByInstance.set(instance, options);
+        return {
+          ...typedOptions,
+          provide: this,
+          useValue: instance,
+          providers: mergedProviders
+        };
+      }
+    };
+  }
+});
+
 // libs/sdk/src/common/interfaces/internal/flow.utils.ts
 var FlowState;
 var init_flow_utils2 = __esm({
@@ -28955,12 +29042,13 @@ var init_plugin_utils = __esm({
 // libs/sdk/src/plugin/plugin.registry.ts
 import "reflect-metadata";
 import { tokenName as tokenName11 } from "@frontmcp/di";
-var PluginRegistry;
+var installedPluginValues, PluginRegistry;
 var init_plugin_registry = __esm({
   "libs/sdk/src/plugin/plugin.registry.ts"() {
     "use strict";
     init_adapter_registry();
     init_common();
+    init_dynamic_plugin();
     init_dynamic_utils();
     init_context_extension();
     init_errors();
@@ -28973,6 +29061,7 @@ var init_plugin_registry = __esm({
     init_skill_registry();
     init_tool_registry();
     init_plugin_utils();
+    installedPluginValues = /* @__PURE__ */ new WeakSet();
     PluginRegistry = class _PluginRegistry extends RegistryAbstract {
       /** providers by token */
       pProviders = /* @__PURE__ */ new Map();
@@ -29161,8 +29250,15 @@ var init_plugin_registry = __esm({
               pluginInstance: new rec.provide(...depsInstances),
               dynamicProviders: rec.providers
             };
-          case "VALUE" /* VALUE */:
-            return { pluginInstance: rec.useValue, dynamicProviders: rec.providers };
+          case "VALUE" /* VALUE */: {
+            const value = rec.useValue;
+            const init = installedPluginValues.has(value) ? initOptionsOf(value) : void 0;
+            installedPluginValues.add(value);
+            if (init && isDynamicPluginClass(rec.provide)) {
+              return { pluginInstance: new rec.provide(init.options), dynamicProviders: rec.providers };
+            }
+            return { pluginInstance: value, dynamicProviders: rec.providers };
+          }
           case "FACTORY" /* FACTORY */: {
             const args = [];
             for (const d of rec.inject()) args.push(await this.providers.resolveBootstrapDep(d));
@@ -31697,13 +31793,46 @@ var init_request_validation = __esm({
 });
 
 // libs/sdk/src/transport/mcp-20260728/request-state.ts
-import { base64urlDecode as base64urlDecode2, base64urlEncode as base64urlEncode2, hmacSha256, randomBytes as randomBytes3, sha256Hex as sha256Hex5, timingSafeEqual } from "@frontmcp/utils";
-function getRequestStateKey() {
+import {
+  base64urlDecode as base64urlDecode2,
+  base64urlEncode as base64urlEncode2,
+  getEnv as getEnv4,
+  hmacSha256,
+  isProduction as isProduction4,
+  randomBytes as randomBytes3,
+  sha256Hex as sha256Hex5,
+  timingSafeEqual
+} from "@frontmcp/utils";
+function configuredSecret(name44) {
+  const value = getEnv4(name44);
+  return value && value.trim().length > 0 ? value : void 0;
+}
+function resolveKey() {
   if (cachedKey) return cachedKey;
-  const secret = process.env["VAULT_SECRET"] ?? process.env["JWT_SECRET"];
-  cachedKey = secret ? encoder.encode(secret) : randomBytes3(32);
+  const vault = configuredSecret("VAULT_SECRET");
+  const jwt = vault ? void 0 : configuredSecret("JWT_SECRET");
+  if (vault) cachedKey = { key: encoder.encode(vault), source: "VAULT_SECRET" };
+  else if (jwt) cachedKey = { key: encoder.encode(jwt), source: "JWT_SECRET" };
+  else cachedKey = { key: randomBytes3(32), source: "per-process" };
   return cachedKey;
 }
+function getRequestStateKey() {
+  return resolveKey().key;
+}
+function getRequestStateKeySource() {
+  return resolveKey().source;
+}
+function warnIfRequestStateKeyNotShared(options) {
+  if (warnedKeyNotShared || !isProduction4()) return;
+  const { metadata } = options;
+  const persistence = metadata.transport?.persistence;
+  const sharesState = Boolean(metadata.redis) || typeof persistence === "object" && persistence !== null;
+  if (!sharesState || getRequestStateKeySource() !== "per-process") return;
+  warnedKeyNotShared = true;
+  options.logger.warn(
+    "requestState is signed with a per-process key (neither VAULT_SECRET nor JWT_SECRET is set). Multi-round tools (elicit/sample) restart when a round lands on another instance; set VAULT_SECRET (or JWT_SECRET) to the same value on every instance."
+  );
+}
 function computeRequestBinding(method, params) {
   const salient = {};
   for (const key of ["name", "uri", "arguments"]) {
@@ -31753,12 +31882,13 @@ function decodeRequestState(state, expected) {
   if (payload.b !== expected.binding) return { ok: false, reason: "request-mismatch" };
   return { ok: true, responses: payload.r };
 }
-var DEFAULT_REQUEST_STATE_TTL_MS, MAX_REQUEST_STATE_BYTES, cachedKey, encoder, decoder;
+var DEFAULT_REQUEST_STATE_TTL_MS, MAX_REQUEST_STATE_BYTES, cachedKey, warnedKeyNotShared, encoder, decoder;
 var init_request_state = __esm({
   "libs/sdk/src/transport/mcp-20260728/request-state.ts"() {
     "use strict";
     DEFAULT_REQUEST_STATE_TTL_MS = 10 * 60 * 1e3;
     MAX_REQUEST_STATE_BYTES = 256 * 1024;
+    warnedKeyNotShared = false;
     encoder = new TextEncoder();
     decoder = new TextDecoder();
   }
@@ -32486,7 +32616,8 @@ async function dispatch20260728(options) {
   };
   const carried = decodeRequestState(params["requestState"], binding);
   if (!carried.ok && carried.reason !== "absent") {
-    scope.logger.warn("mcp-20260728: rejected requestState", { method, reason: carried.reason });
+    const hint = carried.reason === "bad-signature" && getRequestStateKeySource() === "per-process" ? "requestState is signed with a per-process key; set VAULT_SECRET (or JWT_SECRET) to the same value on every instance so a round can land on any of them" : void 0;
+    scope.logger.warn("mcp-20260728: rejected requestState", { method, reason: carried.reason, ...hint && { hint } });
   }
   const exchange = new MrtrExchange({
     inputResponses: params["inputResponses"],
@@ -32640,6 +32771,7 @@ var McpStatelessError, DEFAULT_CLIENT_INFO, McpStatelessClient, TASKS_CLIENT_CAP
 var init_mcp_stateless_client = __esm({
   "libs/sdk/src/transport/mcp-20260728/client/mcp-stateless.client.ts"() {
     "use strict";
+    init_list_all_pages_utils();
     init_header_codec();
     init_protocol_20260728_constants();
     init_tasks_extension();
@@ -32680,10 +32812,22 @@ var init_mcp_stateless_client = __esm({
        * The spec requires this: one malformed tool definition must not prevent the
        * other tools from being used, so the offender is excluded and logged rather
        * than failing the call.
+       *
+       * Every page is fetched (`nextCursor` is followed to the end), since the
+       * schemas cached here are what later `tools/call` headers are derived from.
        */
       async listTools() {
-        const result = await this.request("tools/list");
-        const tools = Array.isArray(result["tools"]) ? result["tools"] : [];
+        const tools = await listAllPages(
+          "tools/list",
+          async (cursor) => {
+            const result = await this.request("tools/list", cursor ? { cursor } : {});
+            return {
+              items: Array.isArray(result["tools"]) ? result["tools"] : [],
+              nextCursor: typeof result["nextCursor"] === "string" ? result["nextCursor"] : void 0
+            };
+          },
+          (message) => new McpStatelessError(-32603, message)
+        );
         const usable = [];
         for (const tool of tools) {
           const validation = validateHeaderParams(tool["inputSchema"]);
@@ -32702,11 +32846,13 @@ var init_mcp_stateless_client = __esm({
       async readResource(uri) {
         return this.request("resources/read", { uri });
       }
-      async listResources() {
-        return this.request("resources/list");
+      /** One page of `resources/list`; pass the previous page's `nextCursor` for the next. */
+      async listResources(cursor) {
+        return this.request("resources/list", cursor ? { cursor } : {});
       }
-      async listPrompts() {
-        return this.request("prompts/list");
+      /** One page of `prompts/list`; pass the previous page's `nextCursor` for the next. */
+      async listPrompts(cursor) {
+        return this.request("prompts/list", cursor ? { cursor } : {});
       }
       async getPrompt(name44, args = {}) {
         return this.request("prompts/get", { name: name44, arguments: args });
@@ -32992,6 +33138,10 @@ var init_mcp_20260728 = __esm({
 });
 
 // libs/sdk/src/remote-mcp/mcp-stateless-client.adapter.ts
+function nextCursorOf(result) {
+  const next = result["nextCursor"];
+  return typeof next === "string" && next.length > 0 ? { nextCursor: next } : {};
+}
 async function negotiateRemoteProtocol(url, configured, headers, fetchImpl = fetch) {
   if (configured === "2026-07-28") return "2026-07-28";
   if (configured !== "auto") return "legacy";
@@ -33034,16 +33184,22 @@ var init_mcp_stateless_client_adapter = __esm({
       async callTool(params) {
         return this.client.callTool(params.name, params.arguments ?? {});
       }
-      async listResources() {
-        const result = await this.client.listResources();
-        return { resources: Array.isArray(result["resources"]) ? result["resources"] : [] };
+      async listResources(params) {
+        const result = await this.client.listResources(params?.cursor);
+        return {
+          resources: Array.isArray(result["resources"]) ? result["resources"] : [],
+          ...nextCursorOf(result)
+        };
       }
       async readResource(params) {
         return this.client.readResource(params.uri);
       }
-      async listPrompts() {
-        const result = await this.client.listPrompts();
-        return { prompts: Array.isArray(result["prompts"]) ? result["prompts"] : [] };
+      async listPrompts(params) {
+        const result = await this.client.listPrompts(params?.cursor);
+        return {
+          prompts: Array.isArray(result["prompts"]) ? result["prompts"] : [],
+          ...nextCursorOf(result)
+        };
       }
       async getPrompt(params) {
         return this.client.getPrompt(params.name, params.arguments ?? {});
@@ -33570,6 +33726,7 @@ var DEFAULT_RETRY_OPTIONS2, DEFAULT_CIRCUIT_BREAKER_OPTIONS, DEFAULT_HEALTH_CHEC
 var init_mcp_client_service = __esm({
   "libs/sdk/src/remote-mcp/mcp-client.service.ts"() {
     "use strict";
+    init_list_all_pages_utils();
     init_mcp_error();
     init_remote_errors();
     init_transport_errors();
@@ -34173,10 +34330,15 @@ var init_mcp_client_service = __esm({
         const httpOptions = request.transportOptions;
         return httpOptions?.fallbackToSSE ?? true;
       }
+      // Each list follows `nextCursor` to the end: a FrontMCP remote pages its lists
+      // (40 per page by default), and proxying only the first page silently dropped
+      // everything after it.
       async listToolsInternal(connection) {
         try {
-          const result = await connection.client.listTools();
-          return result.tools || [];
+          return await listAllPages("tools/list", async (cursor) => {
+            const result = await connection.client.listTools(cursor ? { cursor } : void 0);
+            return { items: result.tools, nextCursor: result.nextCursor };
+          });
         } catch (error) {
           this.logger.warn(`Failed to list tools: ${error.message}`);
           return [];
@@ -34184,8 +34346,10 @@ var init_mcp_client_service = __esm({
       }
       async listResourcesInternal(connection) {
         try {
-          const result = await connection.client.listResources();
-          return result.resources || [];
+          return await listAllPages("resources/list", async (cursor) => {
+            const result = await connection.client.listResources(cursor ? { cursor } : void 0);
+            return { items: result.resources, nextCursor: result.nextCursor };
+          });
         } catch (error) {
           this.logger.warn(`Failed to list resources: ${error.message}`);
           return [];
@@ -34193,8 +34357,10 @@ var init_mcp_client_service = __esm({
       }
       async listResourceTemplatesInternal(connection) {
         try {
-          const result = await connection.client.listResourceTemplates();
-          return result.resourceTemplates || [];
+          return await listAllPages("resources/templates/list", async (cursor) => {
+            const result = await connection.client.listResourceTemplates(cursor ? { cursor } : void 0);
+            return { items: result.resourceTemplates, nextCursor: result.nextCursor };
+          });
         } catch (error) {
           this.logger.warn(`Failed to list resource templates: ${error.message}`);
           return [];
@@ -34202,8 +34368,10 @@ var init_mcp_client_service = __esm({
       }
       async listPromptsInternal(connection) {
         try {
-          const result = await connection.client.listPrompts();
-          return result.prompts || [];
+          return await listAllPages("prompts/list", async (cursor) => {
+            const result = await connection.client.listPrompts(cursor ? { cursor } : void 0);
+            return { items: result.prompts, nextCursor: result.nextCursor };
+          });
         } catch (error) {
           this.logger.warn(`Failed to list prompts: ${error.message}`);
           return [];
@@ -41748,8 +41916,11 @@ var init_session_verify_flow = __esm({
         const machineId = getMachineId2();
         const authSignature = subject ? `${authMode}:${subject}` : authMode;
         if (sessionIdHeader) {
-          const existingPayload = decryptPublicSession(sessionIdHeader, authSignature);
-          if (existingPayload && existingPayload.nodeId === machineId) {
+          const body = this.rawInput.request.body;
+          const isInitialize2 = typeof body === "object" && body !== null && "method" in body && body.method === "initialize";
+          const decrypted = decryptPublicSession(sessionIdHeader, authSignature);
+          const existingPayload = decrypted && isInitialize2 && decrypted.nodeId !== machineId ? void 0 : decrypted;
+          if (existingPayload) {
             const anonId = existingPayload.uuid ?? `${existingPayload.iat * 1e3}`;
             const user2 = anonymousCallerClaims(options, anonId);
             this.respond({
@@ -42209,7 +42380,7 @@ var init_well_known_jwks_flow = __esm({
 import "reflect-metadata";
 import { advertisedScopes } from "@frontmcp/auth";
 import { z as z74 } from "@frontmcp/lazy-zod";
-import { isProduction as isProduction4 } from "@frontmcp/utils";
+import { isProduction as isProduction5 } from "@frontmcp/utils";
 function resolveDcrEnabled(auth) {
   if (auth && isLocalMode(auth)) {
     const dcr = auth.dcr;
@@ -42217,7 +42388,7 @@ function resolveDcrEnabled(auth) {
       return dcr.enabled;
     }
   }
-  return !isProduction4();
+  return !isProduction5();
 }
 var inputSchema25, AuthServerMetadataSchema, outputSchema23, wellKnownAsStateSchema, wellKnownAsPlan, name24, Stage24, WellKnownAsFlow;
 var init_well_known_oauth_authorization_server_flow = __esm({
@@ -42619,8 +42790,8 @@ import {
   verifyPkce
 } from "@frontmcp/auth";
 import {
-  getEnv as getEnv4,
-  isProduction as isProduction5,
+  getEnv as getEnv5,
+  isProduction as isProduction6,
   MemoryStorageAdapter,
   randomBytes as randomBytes8,
   randomUUID as randomUUID21,
@@ -42716,21 +42887,21 @@ var init_instance_local_primary_auth = __esm({
         this.providers = providers;
         this.logger = this.providers.getActiveScope().logger.child("LocalPrimaryAuth");
         this.port = this.providers.getActiveScope().metadata.http?.port ?? 3001;
-        this.host = getEnv4("FRONTMCP_PUBLIC_HOST")?.trim() || "localhost";
+        this.host = getEnv5("FRONTMCP_PUBLIC_HOST")?.trim() || "localhost";
         this.issuer = this.deriveIssuer(options);
-        this.publicHostPinned = !!getEnv4("FRONTMCP_PUBLIC_HOST")?.trim();
-        const jwtSecret = getEnv4("JWT_SECRET");
+        this.publicHostPinned = !!getEnv5("FRONTMCP_PUBLIC_HOST")?.trim();
+        const jwtSecret = getEnv5("JWT_SECRET");
         const hasJwtSecret = !!jwtSecret?.trim();
         if (hasJwtSecret && jwtSecret) {
           const encoded = new TextEncoder().encode(jwtSecret);
           if (encoded.length < MIN_HS256_SECRET_BYTES) {
-            if (isProduction5()) throw new JwtSecretWeakError(encoded.length);
+            if (isProduction6()) throw new JwtSecretWeakError(encoded.length);
             this.logger.warn(
               `JWT_SECRET is ${encoded.length} bytes; HS256 wants at least ${MIN_HS256_SECRET_BYTES} (RFC 7518). This is refused in production \u2014 generate one with \`openssl rand -hex 32\`.`
             );
           }
           this.secret = encoded;
-        } else if (isProduction5() && isOrchestratedMode(options)) {
+        } else if (isProduction6() && isOrchestratedMode(options)) {
           throw new JwtSecretRequiredError(options.mode);
         } else {
           this.logger.warn(
@@ -42874,7 +43045,7 @@ var init_instance_local_primary_auth = __esm({
         if (dcr && typeof dcr.enabled === "boolean") {
           return dcr.enabled;
         }
-        return !isProduction5();
+        return !isProduction6();
       }
       /** Provider configurations (indexed by provider ID) */
       providerConfigs = /* @__PURE__ */ new Map();
@@ -43103,7 +43274,7 @@ var init_instance_local_primary_auth = __esm({
           await memory.connect();
           storage = memory;
         }
-        const pepper = getEnv4("VAULT_SECRET") ?? getEnv4("JWT_SECRET") ?? void 0;
+        const pepper = getEnv5("VAULT_SECRET") ?? getEnv5("JWT_SECRET") ?? void 0;
         this.credentialVaultImpl = new SessionCredentialVault({
           storage,
           pepper,
@@ -43154,7 +43325,7 @@ var init_instance_local_primary_auth = __esm({
         }
         const config = this.readSecureStoreConfig();
         const reuseAdapter = this.storageAdapter && this.secureStoreSharesTokenStorage(config) ? this.storageAdapter : void 0;
-        const pepper = getEnv4("VAULT_SECRET") ?? getEnv4("JWT_SECRET") ?? new TextDecoder().decode(this.secret);
+        const pepper = getEnv5("VAULT_SECRET") ?? getEnv5("JWT_SECRET") ?? new TextDecoder().decode(this.secret);
         const resolved = await createSecureStore({
           config,
           pepper,
@@ -46231,10 +46402,10 @@ import {
   randomBytes as randomBytes9,
   base64urlEncode as base64urlEncode6,
   base64urlDecode as base64urlDecode3,
-  getEnv as getEnv5
+  getEnv as getEnv6
 } from "@frontmcp/utils";
 function getElicitationSecret() {
-  return getEnv5("MCP_ELICITATION_SECRET") || getEnv5("MCP_SESSION_SECRET") || getEnv5("MCP_SERVER_SECRET") || null;
+  return getEnv6("MCP_ELICITATION_SECRET") || getEnv6("MCP_SESSION_SECRET") || getEnv6("MCP_SERVER_SECRET") || null;
 }
 function isElicitationEncryptionAvailable() {
   return getElicitationSecret() !== null;
@@ -46711,12 +46882,12 @@ var init_encrypted_elicitation_store = __esm({
 });
 
 // libs/sdk/src/elicitation/store/elicitation-store.factory.ts
-import { createMemoryStorage as createMemoryStorage2, createStorage as createStorage2, getEnv as getEnv6 } from "@frontmcp/utils";
+import { createMemoryStorage as createMemoryStorage2, createStorage as createStorage2, getEnv as getEnv7 } from "@frontmcp/utils";
 function detectStorageType2(storage) {
-  if (getEnv6("UPSTASH_REDIS_REST_URL")) {
+  if (getEnv7("UPSTASH_REDIS_REST_URL")) {
     return "upstash";
   }
-  if (getEnv6("REDIS_URL") || getEnv6("REDIS_HOST")) {
+  if (getEnv7("REDIS_URL") || getEnv7("REDIS_HOST")) {
     return "redis";
   }
   return "memory";
@@ -46802,7 +46973,7 @@ async function createElicitationStore(options = {}) {
       });
     }
   }
-  if (finalStorageConfig?.type === "vercel-kv" || getEnv6("KV_REST_API_URL")) {
+  if (finalStorageConfig?.type === "vercel-kv" || getEnv7("KV_REST_API_URL")) {
     throw new ElicitationNotSupportedError(
       "Vercel KV is not supported for elicitation stores. Elicitation requires pub/sub for cross-node result routing, which Vercel KV does not support. Use Redis or Upstash instead."
     );
@@ -57087,6 +57258,30 @@ function getQuerySessionId2(urlPath) {
     return void 0;
   }
 }
+function resolveLegacySseSession(params) {
+  const { rawHeader, requestUrl, authorizationSession, createSession } = params;
+  const rawMcpSessionHeader = typeof rawHeader === "string" ? rawHeader : void 0;
+  const mcpSessionHeader = validateMcpSessionHeader(rawMcpSessionHeader);
+  const querySessionId = getQuerySessionId2(requestUrl);
+  const validatedQuerySessionId = querySessionId ? validateMcpSessionHeader(querySessionId) : void 0;
+  if (rawHeader !== void 0 && !mcpSessionHeader) {
+    return { responded404: true, createdNew: false };
+  }
+  if (querySessionId !== void 0 && !validatedQuerySessionId) {
+    return { responded404: true, createdNew: false };
+  }
+  const effectiveSessionId = mcpSessionHeader ?? validatedQuerySessionId;
+  if (effectiveSessionId) {
+    if (authorizationSession?.id === effectiveSessionId) {
+      return { session: authorizationSession, createdNew: false, responded404: false };
+    }
+    return { responded404: true, createdNew: false };
+  }
+  if (authorizationSession) {
+    return { session: authorizationSession, createdNew: false, responded404: false };
+  }
+  return { session: createSession(), createdNew: true, responded404: false };
+}
 var plan38, stateSessionSchema, stateSchema38, name39, Stage39, HandleSseFlow;
 var init_handle_sse_flow = __esm({
   "libs/sdk/src/transport/flows/handle.sse.flow.ts"() {
@@ -57126,39 +57321,26 @@ var init_handle_sse_flow = __esm({
         const { request } = this.rawInput;
         const authorization = request[ServerRequestTokens.auth];
         const { token } = authorization;
-        const raw = request.headers?.["mcp-session-id"];
-        const rawMcpSessionHeader = typeof raw === "string" ? raw : void 0;
-        const mcpSessionHeader = validateMcpSessionHeader(rawMcpSessionHeader);
         const anyReq = request;
-        const querySessionId = getQuerySessionId2(anyReq.url ?? anyReq.path);
-        const validatedQuerySessionId = querySessionId ? validateMcpSessionHeader(querySessionId) : void 0;
-        if (raw !== void 0 && !mcpSessionHeader) {
-          this.respond(httpRespond.sessionNotFound("invalid session id"));
-          return;
-        }
-        if (querySessionId !== void 0 && !validatedQuerySessionId) {
+        const resolution = resolveLegacySseSession({
+          rawHeader: request.headers?.["mcp-session-id"],
+          requestUrl: anyReq.url ?? anyReq.path,
+          authorizationSession: authorization.session,
+          createSession: () => {
+            const query = request.query;
+            const skillsOnlyMode = detectSkillsOnlyMode(query);
+            return createSessionId("legacy-sse", token, {
+              userAgent: request.headers?.["user-agent"],
+              platformDetectionConfig: this.scope.metadata.transport?.platformDetection,
+              skillsOnlyMode
+            });
+          }
+        });
+        if (resolution.responded404 || !resolution.session) {
           this.respond(httpRespond.sessionNotFound("invalid session id"));
           return;
         }
-        const effectiveSessionId = mcpSessionHeader ?? validatedQuerySessionId;
-        let session;
-        if (effectiveSessionId) {
-          if (authorization.session?.id === effectiveSessionId) {
-            session = authorization.session;
-          } else {
-            session = { id: effectiveSessionId };
-          }
-        } else if (authorization.session) {
-          session = authorization.session;
-        } else {
-          const query = request.query;
-          const skillsOnlyMode = detectSkillsOnlyMode(query);
-          session = createSessionId("legacy-sse", token, {
-            userAgent: request.headers?.["user-agent"],
-            platformDetectionConfig: this.scope.metadata.transport?.platformDetection,
-            skillsOnlyMode
-          });
-        }
+        const session = resolution.session;
         this.state.set(stateSchema38.parse({ token, session }));
       }
       async router() {
@@ -57774,7 +57956,7 @@ function resolveStreamableHttpSession(params) {
     if (authorizationSession?.id === mcpSessionHeader) {
       return { session: authorizationSession, createdNew: false, responded404: false };
     }
-    return { session: { id: mcpSessionHeader }, createdNew: false, responded404: false };
+    return { responded404: true, createdNew: false };
   }
   if (authorizationSession) {
     return { session: authorizationSession, createdNew: false, responded404: false };
@@ -57919,7 +58101,7 @@ var init_handle_streamable_http_flow = __esm({
           });
         }
         if (sessionResolution.responded404 || !sessionResolution.session) {
-          logger.warn("parseInput: invalid mcp-session-id header");
+          logger.warn("parseInput: mcp-session-id is not a session this server verified");
           this.respond(httpRespond.sessionNotFound("invalid session id"));
           return;
         }
@@ -61489,6 +61671,7 @@ var init_scope_instance = __esm({
     init_ui();
     init_bus();
     init_event_stores();
+    init_request_state();
     init_transport_registry();
     init_http_ip_filter_flow();
     init_http_request_flow();
@@ -61617,6 +61800,7 @@ var init_scope_instance = __esm({
           effectivePersistence = { sqlite: resolvedTopLevelSqlite };
         }
         this.transportService = new TransportService(this, effectivePersistence, transportBus);
+        warnIfRequestStateKeyNotShared({ logger: this.logger, metadata: this.metadata });
         if (this.haManager && isDistributed) {
           const persistCfg = transportConfig?.persistence;
           const resolvedPrefix = persistCfg && typeof persistCfg === "object" && persistCfg.redis?.keyPrefix ? persistCfg.redis.keyPrefix : "mcp:transport:";
@@ -64338,9 +64522,9 @@ var init_noop_server = __esm({
 });
 
 // libs/sdk/src/server/security/security-audit.ts
-function auditSecurityDefaults(config, isProduction6) {
+function auditSecurityDefaults(config, isProduction7) {
   const findings = [];
-  if (!isProduction6 && config.deploymentMode !== "distributed") {
+  if (!isProduction7 && config.deploymentMode !== "distributed") {
     return findings;
   }
   const strict = config.security?.strict === true;
@@ -64896,7 +65080,7 @@ var init_server_instance = __esm({
         this.prepare();
         const deploymentMode = getRuntimeContext16().deployment;
         const bindAddress = resolveBindAddress(this.config.security, deploymentMode);
-        const isProduction6 = process.env["NODE_ENV"] === "production";
+        const isProduction7 = process.env["NODE_ENV"] === "production";
         const findings = auditSecurityDefaults(
           {
             cors: this.config.cors,
@@ -64904,7 +65088,7 @@ var init_server_instance = __esm({
             resolvedBindAddress: bindAddress,
             deploymentMode
           },
-          isProduction6
+          isProduction7
         );
         logSecurityFindings(findings, console);
         await this.host.start(this.config.socketPath ?? this.config.port, bindAddress);
@@ -66743,49 +66927,6 @@ var init_dynamic_adapter = __esm({
   }
 });
 
-// libs/sdk/src/common/dynamic/dynamic.plugin.ts
-function isDynamicPluginClass(value) {
-  return typeof value === "function" && value.prototype instanceof DynamicPlugin;
-}
-var DynamicPlugin;
-var init_dynamic_plugin = __esm({
-  "libs/sdk/src/common/dynamic/dynamic.plugin.ts"() {
-    "use strict";
-    init_transport_errors();
-    init_dynamic_utils();
-    DynamicPlugin = class {
-      get(token) {
-        throw new MethodNotImplementedError("DynamicPlugin", "get");
-      }
-      /**
-       * Static init() method to create a plugin provider.
-       * @param options - Input options (with optional fields for defaults)
-       */
-      static init(options) {
-        const extraProviders = options.providers;
-        const typedOptions = options;
-        if ("useFactory" in options) {
-          return {
-            ...typedOptions,
-            provide: this,
-            inject: options.inject,
-            useFactory: options.useFactory,
-            providers: dedupePluginProviders(extraProviders ?? [])
-          };
-        }
-        const dyn = collectDynamicProviders(this, typedOptions);
-        const mergedProviders = dedupePluginProviders([...dyn ?? [], ...extraProviders ?? []]);
-        return {
-          ...typedOptions,
-          provide: this,
-          useValue: new this(options),
-          providers: mergedProviders
-        };
-      }
-    };
-  }
-});
-
 // libs/sdk/src/common/dynamic/index.ts
 var init_dynamic = __esm({
   "libs/sdk/src/common/dynamic/index.ts"() {
@@ -68801,6 +68942,7 @@ export {
   httpRequestInputSchema,
   httpRespond,
   incrementalAuthConfigSchema,
+  initOptionsOf,
   intentSchema,
   isAlive,
   isAnonymousSubject7 as isAnonymousSubject,