@frontmcp/sdk 1.8.5 → 1.8.6

package/index.js

@@ -5972,6 +5972,33 @@ var init_errors = __esm({
   }
 });
 
+// libs/sdk/src/common/utils/list-all-pages.utils.ts
+async function listAllPages(method, fetchPage, fail = (message) => new InternalMcpError(message, "LIST_PAGINATION_STALLED")) {
+  const items = [];
+  const seenCursors = /* @__PURE__ */ new Set();
+  let cursor;
+  for (let page = 0; page < MAX_LIST_PAGES; page++) {
+    const result = await fetchPage(cursor);
+    items.push(...result.items ?? []);
+    const next = result.nextCursor;
+    if (!next) return items;
+    if (seenCursors.has(next)) {
+      throw fail(`${method} returned the cursor "${next}" twice`);
+    }
+    seenCursors.add(next);
+    cursor = next;
+  }
+  throw fail(`${method} did not finish within ${MAX_LIST_PAGES} pages`);
+}
+var MAX_LIST_PAGES;
+var init_list_all_pages_utils = __esm({
+  "libs/sdk/src/common/utils/list-all-pages.utils.ts"() {
+    "use strict";
+    init_mcp_error();
+    MAX_LIST_PAGES = 1e3;
+  }
+});
+
 // libs/sdk/src/transport/mcp-handlers/skills-mcp.types.ts
 var import_lazy_zod40, SkillsSearchRequestSchema, SkillsSearchResultSchema, SkillsLoadRequestSchema, SkillsLoadResultSchema, SkillsListRequestSchema, SkillsListResultSchema;
 var init_skills_mcp_types = __esm({
@@ -12043,6 +12070,7 @@ var init_direct_client = __esm({
     "use strict";
     import_protocol30 = require("@frontmcp/protocol");
     import_utils29 = require("@frontmcp/utils");
+    init_list_all_pages_utils();
     init_errors();
     init_skills_mcp_types();
     init_llm_platform();
@@ -12189,8 +12217,11 @@ var init_direct_client = __esm({
       // Tool Operations (platform-formatted)
       // ─────────────────────────────────────────────────────────────────────────────
       async listTools() {
-        const result = await this.mcpClient.listTools();
-        return formatToolsForPlatform(result.tools, this.platform);
+        const tools = await listAllPages("tools/list", async (cursor) => {
+          const result = await this.mcpClient.listTools(cursor ? { cursor } : void 0);
+          return { items: result.tools, nextCursor: result.nextCursor };
+        });
+        return formatToolsForPlatform(tools, this.platform);
       }
       async callTool(name44, args) {
         const result = await this.mcpClient.callTool({
@@ -21992,6 +22023,9 @@ var init_call_tool_flow = __esm({
       uiResult: import_lazy_zod57.z.any().optional(),
       // UI metadata from rendering (merged into _meta)
       uiMeta: import_lazy_zod57.z.record(import_lazy_zod57.z.string(), import_lazy_zod57.z.unknown()).optional(),
+      // Metadata hooks add to the result (e.g. the cache plugin's `cache: 'hit'`), merged into the
+      // result's _meta; never merged into rawOutput, which is the tool's data
+      resultMeta: import_lazy_zod57.z.record(import_lazy_zod57.z.string(), import_lazy_zod57.z.unknown()).optional(),
       // Progress token from request's _meta (for progress notifications)
       progressToken: import_lazy_zod57.z.union([import_lazy_zod57.z.string(), import_lazy_zod57.z.number()]).optional(),
       // JSON-RPC request ID (for elicitation routing)
@@ -22819,7 +22853,7 @@ ${JSON.stringify(error.schema, null, 2)}
       }
       async finalize() {
         this.logger.verbose("finalize:start");
-        const { tool, rawOutput, uiResult, uiMeta } = this.state;
+        const { tool, rawOutput, uiResult, uiMeta, resultMeta } = this.state;
         if (!tool) {
           this.logger.verbose("finalize: skipping (no tool in state)");
           return;
@@ -22862,6 +22896,9 @@ ${JSON.stringify(error.schema, null, 2)}
         if (rawMeta) {
           result._meta = { ...result._meta, ...rawMeta };
         }
+        if (resultMeta) {
+          result._meta = { ...result._meta, ...resultMeta };
+        }
         if (uiResult) {
           result.content = uiResult.content;
           if (uiResult.structuredContent !== void 0 && uiResult.structuredContent !== null) {
@@ -25407,6 +25444,56 @@ var init_dynamic_utils = __esm({
   }
 });
 
+// libs/sdk/src/common/dynamic/dynamic.plugin.ts
+function isDynamicPluginClass(value) {
+  return typeof value === "function" && value.prototype instanceof DynamicPlugin;
+}
+function initOptionsOf(instance) {
+  return initOptionsByInstance.has(instance) ? { options: initOptionsByInstance.get(instance) } : void 0;
+}
+var initOptionsByInstance, DynamicPlugin;
+var init_dynamic_plugin = __esm({
+  "libs/sdk/src/common/dynamic/dynamic.plugin.ts"() {
+    "use strict";
+    init_transport_errors();
+    init_dynamic_utils();
+    initOptionsByInstance = /* @__PURE__ */ new WeakMap();
+    DynamicPlugin = class {
+      get(token) {
+        throw new MethodNotImplementedError("DynamicPlugin", "get");
+      }
+      /**
+       * Static init() method to create a plugin provider.
+       * @param options - Input options (with optional fields for defaults). Omitted, the plugin is
+       *   built with `{}`, as `ApprovalPlugin.init()` is documented.
+       */
+      static init(options = {}) {
+        const extraProviders = options.providers;
+        const typedOptions = options;
+        if ("useFactory" in options) {
+          return {
+            ...typedOptions,
+            provide: this,
+            inject: options.inject,
+            useFactory: options.useFactory,
+            providers: dedupePluginProviders(extraProviders ?? [])
+          };
+        }
+        const dyn = collectDynamicProviders(this, typedOptions);
+        const mergedProviders = dedupePluginProviders([...dyn ?? [], ...extraProviders ?? []]);
+        const instance = new this(options);
+        initOptionsByInstance.set(instance, options);
+        return {
+          ...typedOptions,
+          provide: this,
+          useValue: instance,
+          providers: mergedProviders
+        };
+      }
+    };
+  }
+});
+
 // libs/sdk/src/common/interfaces/internal/flow.utils.ts
 var FlowState;
 var init_flow_utils2 = __esm({
@@ -28895,7 +28982,7 @@ var init_plugin_utils = __esm({
 });
 
 // libs/sdk/src/plugin/plugin.registry.ts
-var import_reflect_metadata12, import_di24, PluginRegistry;
+var import_reflect_metadata12, import_di24, installedPluginValues, PluginRegistry;
 var init_plugin_registry = __esm({
   "libs/sdk/src/plugin/plugin.registry.ts"() {
     "use strict";
@@ -28903,6 +28990,7 @@ var init_plugin_registry = __esm({
     import_di24 = require("@frontmcp/di");
     init_adapter_registry();
     init_common();
+    init_dynamic_plugin();
     init_dynamic_utils();
     init_context_extension();
     init_errors();
@@ -28915,6 +29003,7 @@ var init_plugin_registry = __esm({
     init_skill_registry();
     init_tool_registry();
     init_plugin_utils();
+    installedPluginValues = /* @__PURE__ */ new WeakSet();
     PluginRegistry = class _PluginRegistry extends RegistryAbstract {
       /** providers by token */
       pProviders = /* @__PURE__ */ new Map();
@@ -29103,8 +29192,15 @@ var init_plugin_registry = __esm({
               pluginInstance: new rec.provide(...depsInstances),
               dynamicProviders: rec.providers
             };
-          case "VALUE" /* VALUE */:
-            return { pluginInstance: rec.useValue, dynamicProviders: rec.providers };
+          case "VALUE" /* VALUE */: {
+            const value = rec.useValue;
+            const init = installedPluginValues.has(value) ? initOptionsOf(value) : void 0;
+            installedPluginValues.add(value);
+            if (init && isDynamicPluginClass(rec.provide)) {
+              return { pluginInstance: new rec.provide(init.options), dynamicProviders: rec.providers };
+            }
+            return { pluginInstance: value, dynamicProviders: rec.providers };
+          }
           case "FACTORY" /* FACTORY */: {
             const args = [];
             for (const d of rec.inject()) args.push(await this.providers.resolveBootstrapDep(d));
@@ -31641,12 +31737,36 @@ var init_request_validation = __esm({
 });
 
 // libs/sdk/src/transport/mcp-20260728/request-state.ts
-function getRequestStateKey() {
+function configuredSecret(name44) {
+  const value = (0, import_utils65.getEnv)(name44);
+  return value && value.trim().length > 0 ? value : void 0;
+}
+function resolveKey() {
   if (cachedKey) return cachedKey;
-  const secret = process.env["VAULT_SECRET"] ?? process.env["JWT_SECRET"];
-  cachedKey = secret ? encoder.encode(secret) : (0, import_utils65.randomBytes)(32);
+  const vault = configuredSecret("VAULT_SECRET");
+  const jwt = vault ? void 0 : configuredSecret("JWT_SECRET");
+  if (vault) cachedKey = { key: encoder.encode(vault), source: "VAULT_SECRET" };
+  else if (jwt) cachedKey = { key: encoder.encode(jwt), source: "JWT_SECRET" };
+  else cachedKey = { key: (0, import_utils65.randomBytes)(32), source: "per-process" };
   return cachedKey;
 }
+function getRequestStateKey() {
+  return resolveKey().key;
+}
+function getRequestStateKeySource() {
+  return resolveKey().source;
+}
+function warnIfRequestStateKeyNotShared(options) {
+  if (warnedKeyNotShared || !(0, import_utils65.isProduction)()) return;
+  const { metadata } = options;
+  const persistence = metadata.transport?.persistence;
+  const sharesState = Boolean(metadata.redis) || typeof persistence === "object" && persistence !== null;
+  if (!sharesState || getRequestStateKeySource() !== "per-process") return;
+  warnedKeyNotShared = true;
+  options.logger.warn(
+    "requestState is signed with a per-process key (neither VAULT_SECRET nor JWT_SECRET is set). Multi-round tools (elicit/sample) restart when a round lands on another instance; set VAULT_SECRET (or JWT_SECRET) to the same value on every instance."
+  );
+}
 function computeRequestBinding(method, params) {
   const salient = {};
   for (const key of ["name", "uri", "arguments"]) {
@@ -31696,13 +31816,14 @@ function decodeRequestState(state, expected) {
   if (payload.b !== expected.binding) return { ok: false, reason: "request-mismatch" };
   return { ok: true, responses: payload.r };
 }
-var import_utils65, DEFAULT_REQUEST_STATE_TTL_MS, MAX_REQUEST_STATE_BYTES, cachedKey, encoder, decoder;
+var import_utils65, DEFAULT_REQUEST_STATE_TTL_MS, MAX_REQUEST_STATE_BYTES, cachedKey, warnedKeyNotShared, encoder, decoder;
 var init_request_state = __esm({
   "libs/sdk/src/transport/mcp-20260728/request-state.ts"() {
     "use strict";
     import_utils65 = require("@frontmcp/utils");
     DEFAULT_REQUEST_STATE_TTL_MS = 10 * 60 * 1e3;
     MAX_REQUEST_STATE_BYTES = 256 * 1024;
+    warnedKeyNotShared = false;
     encoder = new TextEncoder();
     decoder = new TextDecoder();
   }
@@ -32423,7 +32544,8 @@ async function dispatch20260728(options) {
   };
   const carried = decodeRequestState(params["requestState"], binding);
   if (!carried.ok && carried.reason !== "absent") {
-    scope.logger.warn("mcp-20260728: rejected requestState", { method, reason: carried.reason });
+    const hint = carried.reason === "bad-signature" && getRequestStateKeySource() === "per-process" ? "requestState is signed with a per-process key; set VAULT_SECRET (or JWT_SECRET) to the same value on every instance so a round can land on any of them" : void 0;
+    scope.logger.warn("mcp-20260728: rejected requestState", { method, reason: carried.reason, ...hint && { hint } });
   }
   const exchange = new MrtrExchange({
     inputResponses: params["inputResponses"],
@@ -32580,6 +32702,7 @@ var init_mcp_stateless_client = __esm({
   "libs/sdk/src/transport/mcp-20260728/client/mcp-stateless.client.ts"() {
     "use strict";
     import_protocol47 = require("@frontmcp/protocol");
+    init_list_all_pages_utils();
     init_header_codec();
     init_protocol_20260728_constants();
     init_tasks_extension();
@@ -32620,10 +32743,22 @@ var init_mcp_stateless_client = __esm({
        * The spec requires this: one malformed tool definition must not prevent the
        * other tools from being used, so the offender is excluded and logged rather
        * than failing the call.
+       *
+       * Every page is fetched (`nextCursor` is followed to the end), since the
+       * schemas cached here are what later `tools/call` headers are derived from.
        */
       async listTools() {
-        const result = await this.request("tools/list");
-        const tools = Array.isArray(result["tools"]) ? result["tools"] : [];
+        const tools = await listAllPages(
+          "tools/list",
+          async (cursor) => {
+            const result = await this.request("tools/list", cursor ? { cursor } : {});
+            return {
+              items: Array.isArray(result["tools"]) ? result["tools"] : [],
+              nextCursor: typeof result["nextCursor"] === "string" ? result["nextCursor"] : void 0
+            };
+          },
+          (message) => new McpStatelessError(-32603, message)
+        );
         const usable = [];
         for (const tool of tools) {
           const validation = validateHeaderParams(tool["inputSchema"]);
@@ -32642,11 +32777,13 @@ var init_mcp_stateless_client = __esm({
       async readResource(uri) {
         return this.request("resources/read", { uri });
       }
-      async listResources() {
-        return this.request("resources/list");
+      /** One page of `resources/list`; pass the previous page's `nextCursor` for the next. */
+      async listResources(cursor) {
+        return this.request("resources/list", cursor ? { cursor } : {});
       }
-      async listPrompts() {
-        return this.request("prompts/list");
+      /** One page of `prompts/list`; pass the previous page's `nextCursor` for the next. */
+      async listPrompts(cursor) {
+        return this.request("prompts/list", cursor ? { cursor } : {});
       }
       async getPrompt(name44, args = {}) {
         return this.request("prompts/get", { name: name44, arguments: args });
@@ -32932,6 +33069,10 @@ var init_mcp_20260728 = __esm({
 });
 
 // libs/sdk/src/remote-mcp/mcp-stateless-client.adapter.ts
+function nextCursorOf(result) {
+  const next = result["nextCursor"];
+  return typeof next === "string" && next.length > 0 ? { nextCursor: next } : {};
+}
 async function negotiateRemoteProtocol(url, configured, headers, fetchImpl = fetch) {
   if (configured === "2026-07-28") return "2026-07-28";
   if (configured !== "auto") return "legacy";
@@ -32974,16 +33115,22 @@ var init_mcp_stateless_client_adapter = __esm({
       async callTool(params) {
         return this.client.callTool(params.name, params.arguments ?? {});
       }
-      async listResources() {
-        const result = await this.client.listResources();
-        return { resources: Array.isArray(result["resources"]) ? result["resources"] : [] };
+      async listResources(params) {
+        const result = await this.client.listResources(params?.cursor);
+        return {
+          resources: Array.isArray(result["resources"]) ? result["resources"] : [],
+          ...nextCursorOf(result)
+        };
       }
       async readResource(params) {
         return this.client.readResource(params.uri);
       }
-      async listPrompts() {
-        const result = await this.client.listPrompts();
-        return { prompts: Array.isArray(result["prompts"]) ? result["prompts"] : [] };
+      async listPrompts(params) {
+        const result = await this.client.listPrompts(params?.cursor);
+        return {
+          prompts: Array.isArray(result["prompts"]) ? result["prompts"] : [],
+          ...nextCursorOf(result)
+        };
       }
       async getPrompt(params) {
         return this.client.getPrompt(params.name, params.arguments ?? {});
@@ -33506,6 +33653,7 @@ var init_mcp_client_service = __esm({
   "libs/sdk/src/remote-mcp/mcp-client.service.ts"() {
     "use strict";
     import_protocol48 = require("@frontmcp/protocol");
+    init_list_all_pages_utils();
     init_mcp_error();
     init_remote_errors();
     init_transport_errors();
@@ -34109,10 +34257,15 @@ var init_mcp_client_service = __esm({
         const httpOptions = request.transportOptions;
         return httpOptions?.fallbackToSSE ?? true;
       }
+      // Each list follows `nextCursor` to the end: a FrontMCP remote pages its lists
+      // (40 per page by default), and proxying only the first page silently dropped
+      // everything after it.
       async listToolsInternal(connection) {
         try {
-          const result = await connection.client.listTools();
-          return result.tools || [];
+          return await listAllPages("tools/list", async (cursor) => {
+            const result = await connection.client.listTools(cursor ? { cursor } : void 0);
+            return { items: result.tools, nextCursor: result.nextCursor };
+          });
         } catch (error) {
           this.logger.warn(`Failed to list tools: ${error.message}`);
           return [];
@@ -34120,8 +34273,10 @@ var init_mcp_client_service = __esm({
       }
       async listResourcesInternal(connection) {
         try {
-          const result = await connection.client.listResources();
-          return result.resources || [];
+          return await listAllPages("resources/list", async (cursor) => {
+            const result = await connection.client.listResources(cursor ? { cursor } : void 0);
+            return { items: result.resources, nextCursor: result.nextCursor };
+          });
         } catch (error) {
           this.logger.warn(`Failed to list resources: ${error.message}`);
           return [];
@@ -34129,8 +34284,10 @@ var init_mcp_client_service = __esm({
       }
       async listResourceTemplatesInternal(connection) {
         try {
-          const result = await connection.client.listResourceTemplates();
-          return result.resourceTemplates || [];
+          return await listAllPages("resources/templates/list", async (cursor) => {
+            const result = await connection.client.listResourceTemplates(cursor ? { cursor } : void 0);
+            return { items: result.resourceTemplates, nextCursor: result.nextCursor };
+          });
         } catch (error) {
           this.logger.warn(`Failed to list resource templates: ${error.message}`);
           return [];
@@ -34138,8 +34295,10 @@ var init_mcp_client_service = __esm({
       }
       async listPromptsInternal(connection) {
         try {
-          const result = await connection.client.listPrompts();
-          return result.prompts || [];
+          return await listAllPages("prompts/list", async (cursor) => {
+            const result = await connection.client.listPrompts(cursor ? { cursor } : void 0);
+            return { items: result.prompts, nextCursor: result.nextCursor };
+          });
         } catch (error) {
           this.logger.warn(`Failed to list prompts: ${error.message}`);
           return [];
@@ -41592,8 +41751,11 @@ var init_session_verify_flow = __esm({
         const machineId = (0, import_utils78.getMachineId)();
         const authSignature = subject ? `${authMode}:${subject}` : authMode;
         if (sessionIdHeader) {
-          const existingPayload = decryptPublicSession(sessionIdHeader, authSignature);
-          if (existingPayload && existingPayload.nodeId === machineId) {
+          const body = this.rawInput.request.body;
+          const isInitialize2 = typeof body === "object" && body !== null && "method" in body && body.method === "initialize";
+          const decrypted = decryptPublicSession(sessionIdHeader, authSignature);
+          const existingPayload = decrypted && isInitialize2 && decrypted.nodeId !== machineId ? void 0 : decrypted;
+          if (existingPayload) {
             const anonId = existingPayload.uuid ?? `${existingPayload.iat * 1e3}`;
             const user2 = (0, import_auth39.anonymousCallerClaims)(options, anonId);
             this.respond({
@@ -56899,6 +57061,30 @@ function getQuerySessionId2(urlPath) {
     return void 0;
   }
 }
+function resolveLegacySseSession(params) {
+  const { rawHeader, requestUrl, authorizationSession, createSession } = params;
+  const rawMcpSessionHeader = typeof rawHeader === "string" ? rawHeader : void 0;
+  const mcpSessionHeader = validateMcpSessionHeader(rawMcpSessionHeader);
+  const querySessionId = getQuerySessionId2(requestUrl);
+  const validatedQuerySessionId = querySessionId ? validateMcpSessionHeader(querySessionId) : void 0;
+  if (rawHeader !== void 0 && !mcpSessionHeader) {
+    return { responded404: true, createdNew: false };
+  }
+  if (querySessionId !== void 0 && !validatedQuerySessionId) {
+    return { responded404: true, createdNew: false };
+  }
+  const effectiveSessionId = mcpSessionHeader ?? validatedQuerySessionId;
+  if (effectiveSessionId) {
+    if (authorizationSession?.id === effectiveSessionId) {
+      return { session: authorizationSession, createdNew: false, responded404: false };
+    }
+    return { responded404: true, createdNew: false };
+  }
+  if (authorizationSession) {
+    return { session: authorizationSession, createdNew: false, responded404: false };
+  }
+  return { session: createSession(), createdNew: true, responded404: false };
+}
 var import_lazy_zod103, import_utils96, plan38, stateSessionSchema, stateSchema38, name39, Stage39, HandleSseFlow;
 var init_handle_sse_flow = __esm({
   "libs/sdk/src/transport/flows/handle.sse.flow.ts"() {
@@ -56940,39 +57126,26 @@ var init_handle_sse_flow = __esm({
         const { request } = this.rawInput;
         const authorization = request[ServerRequestTokens.auth];
         const { token } = authorization;
-        const raw = request.headers?.["mcp-session-id"];
-        const rawMcpSessionHeader = typeof raw === "string" ? raw : void 0;
-        const mcpSessionHeader = validateMcpSessionHeader(rawMcpSessionHeader);
         const anyReq = request;
-        const querySessionId = getQuerySessionId2(anyReq.url ?? anyReq.path);
-        const validatedQuerySessionId = querySessionId ? validateMcpSessionHeader(querySessionId) : void 0;
-        if (raw !== void 0 && !mcpSessionHeader) {
-          this.respond(httpRespond.sessionNotFound("invalid session id"));
-          return;
-        }
-        if (querySessionId !== void 0 && !validatedQuerySessionId) {
+        const resolution = resolveLegacySseSession({
+          rawHeader: request.headers?.["mcp-session-id"],
+          requestUrl: anyReq.url ?? anyReq.path,
+          authorizationSession: authorization.session,
+          createSession: () => {
+            const query = request.query;
+            const skillsOnlyMode = detectSkillsOnlyMode(query);
+            return createSessionId("legacy-sse", token, {
+              userAgent: request.headers?.["user-agent"],
+              platformDetectionConfig: this.scope.metadata.transport?.platformDetection,
+              skillsOnlyMode
+            });
+          }
+        });
+        if (resolution.responded404 || !resolution.session) {
           this.respond(httpRespond.sessionNotFound("invalid session id"));
           return;
         }
-        const effectiveSessionId = mcpSessionHeader ?? validatedQuerySessionId;
-        let session;
-        if (effectiveSessionId) {
-          if (authorization.session?.id === effectiveSessionId) {
-            session = authorization.session;
-          } else {
-            session = { id: effectiveSessionId };
-          }
-        } else if (authorization.session) {
-          session = authorization.session;
-        } else {
-          const query = request.query;
-          const skillsOnlyMode = detectSkillsOnlyMode(query);
-          session = createSessionId("legacy-sse", token, {
-            userAgent: request.headers?.["user-agent"],
-            platformDetectionConfig: this.scope.metadata.transport?.platformDetection,
-            skillsOnlyMode
-          });
-        }
+        const session = resolution.session;
         this.state.set(stateSchema38.parse({ token, session }));
       }
       async router() {
@@ -57585,7 +57758,7 @@ function resolveStreamableHttpSession(params) {
     if (authorizationSession?.id === mcpSessionHeader) {
       return { session: authorizationSession, createdNew: false, responded404: false };
     }
-    return { session: { id: mcpSessionHeader }, createdNew: false, responded404: false };
+    return { responded404: true, createdNew: false };
   }
   if (authorizationSession) {
     return { session: authorizationSession, createdNew: false, responded404: false };
@@ -57733,7 +57906,7 @@ var init_handle_streamable_http_flow = __esm({
           });
         }
         if (sessionResolution.responded404 || !sessionResolution.session) {
-          logger.warn("parseInput: invalid mcp-session-id header");
+          logger.warn("parseInput: mcp-session-id is not a session this server verified");
           this.respond(httpRespond.sessionNotFound("invalid session id"));
           return;
         }
@@ -61293,6 +61466,7 @@ var init_scope_instance = __esm({
     init_ui();
     init_bus();
     init_event_stores();
+    init_request_state();
     init_transport_registry();
     init_http_ip_filter_flow();
     init_http_request_flow();
@@ -61421,6 +61595,7 @@ var init_scope_instance = __esm({
           effectivePersistence = { sqlite: resolvedTopLevelSqlite };
         }
         this.transportService = new TransportService(this, effectivePersistence, transportBus);
+        warnIfRequestStateKeyNotShared({ logger: this.logger, metadata: this.metadata });
         if (this.haManager && isDistributed) {
           const persistCfg = transportConfig?.persistence;
           const resolvedPrefix = persistCfg && typeof persistCfg === "object" && persistCfg.redis?.keyPrefix ? persistCfg.redis.keyPrefix : "mcp:transport:";
@@ -64135,9 +64310,9 @@ var init_noop_server = __esm({
 });
 
 // libs/sdk/src/server/security/security-audit.ts
-function auditSecurityDefaults(config, isProduction6) {
+function auditSecurityDefaults(config, isProduction7) {
   const findings = [];
-  if (!isProduction6 && config.deploymentMode !== "distributed") {
+  if (!isProduction7 && config.deploymentMode !== "distributed") {
     return findings;
   }
   const strict = config.security?.strict === true;
@@ -64693,7 +64868,7 @@ var init_server_instance = __esm({
         this.prepare();
         const deploymentMode = (0, import_utils108.getRuntimeContext)().deployment;
         const bindAddress = resolveBindAddress(this.config.security, deploymentMode);
-        const isProduction6 = process.env["NODE_ENV"] === "production";
+        const isProduction7 = process.env["NODE_ENV"] === "production";
         const findings = auditSecurityDefaults(
           {
             cors: this.config.cors,
@@ -64701,7 +64876,7 @@ var init_server_instance = __esm({
             resolvedBindAddress: bindAddress,
             deploymentMode
           },
-          isProduction6
+          isProduction7
         );
         logSecurityFindings(findings, console);
         await this.host.start(this.config.socketPath ?? this.config.port, bindAddress);
@@ -66546,49 +66721,6 @@ var init_dynamic_adapter = __esm({
   }
 });
 
-// libs/sdk/src/common/dynamic/dynamic.plugin.ts
-function isDynamicPluginClass(value) {
-  return typeof value === "function" && value.prototype instanceof DynamicPlugin;
-}
-var DynamicPlugin;
-var init_dynamic_plugin = __esm({
-  "libs/sdk/src/common/dynamic/dynamic.plugin.ts"() {
-    "use strict";
-    init_transport_errors();
-    init_dynamic_utils();
-    DynamicPlugin = class {
-      get(token) {
-        throw new MethodNotImplementedError("DynamicPlugin", "get");
-      }
-      /**
-       * Static init() method to create a plugin provider.
-       * @param options - Input options (with optional fields for defaults)
-       */
-      static init(options) {
-        const extraProviders = options.providers;
-        const typedOptions = options;
-        if ("useFactory" in options) {
-          return {
-            ...typedOptions,
-            provide: this,
-            inject: options.inject,
-            useFactory: options.useFactory,
-            providers: dedupePluginProviders(extraProviders ?? [])
-          };
-        }
-        const dyn = collectDynamicProviders(this, typedOptions);
-        const mergedProviders = dedupePluginProviders([...dyn ?? [], ...extraProviders ?? []]);
-        return {
-          ...typedOptions,
-          provide: this,
-          useValue: new this(options),
-          providers: mergedProviders
-        };
-      }
-    };
-  }
-});
-
 // libs/sdk/src/common/dynamic/index.ts
 var init_dynamic = __esm({
   "libs/sdk/src/common/dynamic/index.ts"() {
@@ -68188,6 +68320,7 @@ __export(index_exports, {
   httpRequestInputSchema: () => httpRequestInputSchema,
   httpRespond: () => httpRespond,
   incrementalAuthConfigSchema: () => import_auth5.incrementalAuthConfigSchema,
+  initOptionsOf: () => initOptionsOf,
   intentSchema: () => intentSchema,
   isAlive: () => isAlive,
   isAnonymousSubject: () => import_auth61.isAnonymousSubject,
@@ -69430,6 +69563,7 @@ var ChannelListHook = FlowHooksOf("channels:list");
   httpRequestInputSchema,
   httpRespond,
   incrementalAuthConfigSchema,
+  initOptionsOf,
   intentSchema,
   isAlive,
   isAnonymousSubject,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/sdk",
-  "version": "1.8.5",
+  "version": "1.8.6",
   "description": "FrontMCP SDK",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -90,8 +90,8 @@
   "peerDependencies": {
     "@anthropic-ai/sdk": "^0.30.0 || ^0.78.0",
     "@enclave-vm/core": "^2.15.3",
-    "@frontmcp/observability": "1.8.5",
-    "@frontmcp/storage-sqlite": "1.8.5",
+    "@frontmcp/observability": "1.8.6",
+    "@frontmcp/storage-sqlite": "1.8.6",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/sdk-trace-base": "^2.8.0",
     "@vercel/kv": "^3.0.0",
@@ -132,13 +132,13 @@
     }
   },
   "dependencies": {
-    "@frontmcp/auth": "1.8.5",
-    "@frontmcp/di": "1.8.5",
-    "@frontmcp/guard": "1.8.5",
-    "@frontmcp/lazy-zod": "1.8.5",
-    "@frontmcp/protocol": "1.8.5",
-    "@frontmcp/uipack": "1.8.5",
-    "@frontmcp/utils": "1.8.5",
+    "@frontmcp/auth": "1.8.6",
+    "@frontmcp/di": "1.8.6",
+    "@frontmcp/guard": "1.8.6",
+    "@frontmcp/lazy-zod": "1.8.6",
+    "@frontmcp/protocol": "1.8.6",
+    "@frontmcp/uipack": "1.8.6",
+    "@frontmcp/utils": "1.8.6",
     "@types/cors": "^2.8.17",
     "ioredis": "^5.8.0",
     "jose": "^6.1.3",