@frontmcp/sdk 1.8.5 → 1.8.7

package/index.js

@@ -1859,7 +1859,7 @@ var init_session = __esm({
 });
 
 // libs/sdk/src/common/types/options/http/schema.ts
-var import_lazy_zod8, HTTP_METHODS, httpRouteSchema, bodyParserLimitSchema, corsOptionsSchema, httpOptionsSchema;
+var import_lazy_zod8, HTTP_METHODS, httpRouteSchema, bodyParserLimitSchema, corsOptionsSchema, securityHeaderValueSchema, securityHeadersSchema, httpOptionsSchema;
 var init_schema3 = __esm({
   "libs/sdk/src/common/types/options/http/schema.ts"() {
     "use strict";
@@ -1897,6 +1897,19 @@ var init_schema3 = __esm({
       credentials: import_lazy_zod8.z.boolean().optional(),
       maxAge: import_lazy_zod8.z.number().optional()
     });
+    securityHeaderValueSchema = import_lazy_zod8.z.union([import_lazy_zod8.z.string(), import_lazy_zod8.z.literal(false)]);
+    securityHeadersSchema = import_lazy_zod8.z.object({
+      hsts: securityHeaderValueSchema.optional(),
+      contentTypeOptions: securityHeaderValueSchema.optional(),
+      frameOptions: securityHeaderValueSchema.optional(),
+      custom: import_lazy_zod8.z.record(import_lazy_zod8.z.string(), import_lazy_zod8.z.string()).optional(),
+      csp: import_lazy_zod8.z.object({
+        enabled: import_lazy_zod8.z.boolean().optional(),
+        directives: import_lazy_zod8.z.record(import_lazy_zod8.z.string(), import_lazy_zod8.z.union([import_lazy_zod8.z.string(), import_lazy_zod8.z.array(import_lazy_zod8.z.string())])).optional(),
+        reportUri: import_lazy_zod8.z.string().optional(),
+        reportOnly: import_lazy_zod8.z.boolean().optional()
+      }).optional()
+    });
     httpOptionsSchema = import_lazy_zod8.z.object({
       port: import_lazy_zod8.z.number().optional().default(Number(process.env["PORT"]) || 3e3),
       // `FRONTMCP_HTTP_ENTRY_PATH` lets `frontmcp dev` propagate the configured
@@ -1955,7 +1968,9 @@ var init_schema3 = __esm({
        * app as the MCP endpoint; public by default, `auth: true` opts into the MCP
        * `session:verify` flow. Reserved-path collisions are rejected at startup.
        */
-      routes: import_lazy_zod8.z.array(httpRouteSchema).optional()
+      routes: import_lazy_zod8.z.array(httpRouteSchema).optional(),
+      /** Response security headers; see `SecurityHeadersOptions`. */
+      securityHeaders: securityHeadersSchema.optional()
     });
   }
 });
@@ -2357,7 +2372,7 @@ var init_schema7 = __esm({
     persistenceConfigSchema = import_lazy_zod12.z.object({
       redis: redisOptionsSchema.optional(),
       sqlite: sqliteOptionsSchema.optional(),
-      defaultTtlMs: import_lazy_zod12.z.number().int().positive().default(36e5)
+      defaultTtlMs: import_lazy_zod12.z.number().int().positive().optional()
     }).refine((cfg) => !(cfg.redis && cfg.sqlite), {
       message: "Invalid persistence config: choose either redis or sqlite, not both",
       path: ["sqlite"]
@@ -5972,6 +5987,33 @@ var init_errors = __esm({
   }
 });
 
+// libs/sdk/src/common/utils/list-all-pages.utils.ts
+async function listAllPages(method, fetchPage, fail = (message) => new InternalMcpError(message, "LIST_PAGINATION_STALLED")) {
+  const items = [];
+  const seenCursors = /* @__PURE__ */ new Set();
+  let cursor;
+  for (let page = 0; page < MAX_LIST_PAGES; page++) {
+    const result = await fetchPage(cursor);
+    items.push(...result.items ?? []);
+    const next = result.nextCursor;
+    if (!next) return items;
+    if (seenCursors.has(next)) {
+      throw fail(`${method} returned the cursor "${next}" twice`);
+    }
+    seenCursors.add(next);
+    cursor = next;
+  }
+  throw fail(`${method} did not finish within ${MAX_LIST_PAGES} pages`);
+}
+var MAX_LIST_PAGES;
+var init_list_all_pages_utils = __esm({
+  "libs/sdk/src/common/utils/list-all-pages.utils.ts"() {
+    "use strict";
+    init_mcp_error();
+    MAX_LIST_PAGES = 1e3;
+  }
+});
+
 // libs/sdk/src/transport/mcp-handlers/skills-mcp.types.ts
 var import_lazy_zod40, SkillsSearchRequestSchema, SkillsSearchResultSchema, SkillsLoadRequestSchema, SkillsLoadResultSchema, SkillsListRequestSchema, SkillsListResultSchema;
 var init_skills_mcp_types = __esm({
@@ -6415,6 +6457,7 @@ var require_dist = __commonJS({
     var __toCommonJS2 = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
     var index_exports2 = {};
     __export2(index_exports2, {
+      SqliteDecryptionError: () => SqliteDecryptionError,
       SqliteElicitationStore: () => SqliteElicitationStore,
       SqliteEventStore: () => SqliteEventStore,
       SqliteKvStore: () => SqliteKvStore,
@@ -6426,34 +6469,47 @@ var require_dist = __commonJS({
       encryptValue: () => encryptValue,
       loadBetterSqlite3: () => loadBetterSqlite3,
       openDatabase: () => openDatabase,
-      sqliteStorageOptionsSchema: () => sqliteStorageOptionsSchema
+      sqliteStorageOptionsSchema: () => sqliteStorageOptionsSchema,
+      withBusyRetry: () => withBusyRetry
     });
     module2.exports = __toCommonJS2(index_exports2);
-    var import_utils114 = require("@frontmcp/utils");
+    var import_utils119 = require("@frontmcp/utils");
+    var SqliteDecryptionError = class extends Error {
+      code = "SQLITE_DECRYPTION_FAILED";
+      constructor() {
+        super(
+          "SqliteKvStore: failed to decrypt a stored value. The encryption secret differs from the one the database was written with (or the value is corrupted). Restore the original secret, or delete the database file to start empty."
+        );
+        this.name = "SqliteDecryptionError";
+      }
+    };
     var HKDF_SALT = new TextEncoder().encode("frontmcp-sqlite-storage-v1");
     var HKDF_INFO = new TextEncoder().encode("aes-256-gcm-value-encryption");
     var KEY_LENGTH = 32;
     function deriveEncryptionKey(secret) {
       const ikm = new TextEncoder().encode(secret);
-      return (0, import_utils114.hkdfSha256)(ikm, HKDF_SALT, HKDF_INFO, KEY_LENGTH);
+      return (0, import_utils119.hkdfSha256)(ikm, HKDF_SALT, HKDF_INFO, KEY_LENGTH);
     }
     var SEPARATOR = ":";
     function encryptValue(key, plaintext) {
-      const iv = (0, import_utils114.randomBytes)(12);
+      const iv = (0, import_utils119.randomBytes)(12);
       const plaintextBytes = new TextEncoder().encode(plaintext);
-      const { ciphertext, tag } = (0, import_utils114.encryptAesGcm)(key, plaintextBytes, iv);
-      return [(0, import_utils114.base64urlEncode)(iv), (0, import_utils114.base64urlEncode)(tag), (0, import_utils114.base64urlEncode)(ciphertext)].join(SEPARATOR);
+      const { ciphertext, tag } = (0, import_utils119.encryptAesGcm)(key, plaintextBytes, iv);
+      return [(0, import_utils119.base64urlEncode)(iv), (0, import_utils119.base64urlEncode)(tag), (0, import_utils119.base64urlEncode)(ciphertext)].join(SEPARATOR);
     }
     function decryptValue(key, encrypted) {
       const parts = encrypted.split(SEPARATOR);
       if (parts.length !== 3) {
         throw new Error("Invalid encrypted value format");
       }
-      const iv = (0, import_utils114.base64urlDecode)(parts[0]);
-      const tag = (0, import_utils114.base64urlDecode)(parts[1]);
-      const ciphertext = (0, import_utils114.base64urlDecode)(parts[2]);
-      const plaintext = (0, import_utils114.decryptAesGcm)(key, ciphertext, iv, tag);
-      return new TextDecoder().decode(plaintext);
+      const iv = (0, import_utils119.base64urlDecode)(parts[0]);
+      const tag = (0, import_utils119.base64urlDecode)(parts[1]);
+      const ciphertext = (0, import_utils119.base64urlDecode)(parts[2]);
+      try {
+        return new TextDecoder().decode((0, import_utils119.decryptAesGcm)(key, ciphertext, iv, tag));
+      } catch {
+        throw new SqliteDecryptionError();
+      }
     }
     var import_utils210 = require("@frontmcp/utils");
     var cached = null;
@@ -6466,7 +6522,27 @@ var require_dist = __commonJS({
       return mod;
     }
     var MEMORY_PATH = ":memory:";
-    function openDatabase(path3, storeName) {
+    var DEFAULT_BUSY_TIMEOUT_MS = 5e3;
+    function isBusyError(err) {
+      const code = err?.code;
+      return code === "SQLITE_BUSY" || code === "SQLITE_BUSY_RECOVERY" || code === "SQLITE_BUSY_SNAPSHOT";
+    }
+    function sleepSync(ms) {
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+    }
+    function withBusyRetry(operation, options = {}) {
+      const attempts = options.attempts ?? 5;
+      const delayMs = options.delayMs ?? 50;
+      for (let attempt = 1; ; attempt++) {
+        try {
+          return operation();
+        } catch (err) {
+          if (!isBusyError(err) || attempt >= attempts) throw err;
+          sleepSync(delayMs * attempt);
+        }
+      }
+    }
+    function openDatabase(path3, storeName, options = {}) {
       const BetterSqlite3 = loadBetterSqlite3();
       if (path3 !== MEMORY_PATH && path3 !== "") {
         const dir = (0, import_utils210.dirname)(path3);
@@ -6475,16 +6551,28 @@ var require_dist = __commonJS({
             (0, import_utils210.ensureDirSync)(dir);
           } catch (err) {
             const message = err instanceof Error ? err.message : String(err);
-            throw new Error(`${storeName}: failed to create directory "${dir}" for database "${path3}": ${message}`);
+            throw new Error(`${storeName}: failed to create directory "${dir}" for database "${path3}": ${message}`, {
+              cause: err
+            });
           }
         }
       }
+      let db;
+      try {
+        db = new BetterSqlite3(path3);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`${storeName}: failed to open database at "${path3}": ${message}`, { cause: err });
+      }
       try {
-        return new BetterSqlite3(path3);
+        db.pragma(`busy_timeout = ${Math.max(0, Math.floor(options.busyTimeoutMs ?? DEFAULT_BUSY_TIMEOUT_MS))}`);
+        if (options.walMode) withBusyRetry(() => db.pragma("journal_mode = WAL"));
       } catch (err) {
+        db.close();
         const message = err instanceof Error ? err.message : String(err);
-        throw new Error(`${storeName}: failed to open database at "${path3}": ${message}`);
+        throw new Error(`${storeName}: failed to configure database at "${path3}": ${message}`, { cause: err });
       }
+      return db;
     }
     var SqliteKvStore = class {
       db;
@@ -6492,14 +6580,14 @@ var require_dist = __commonJS({
       cleanupTimer = null;
       stmts = null;
       constructor(options) {
-        this.db = openDatabase(options.path, "SqliteKvStore");
-        if (options.walMode !== false) {
-          this.db.pragma("journal_mode = WAL");
-        }
+        this.db = openDatabase(options.path, "SqliteKvStore", {
+          busyTimeoutMs: options.busyTimeoutMs,
+          walMode: options.walMode !== false
+        });
         if (options.encryption?.secret) {
           this.encryptionKey = deriveEncryptionKey(options.encryption.secret);
         }
-        this.initSchema();
+        withBusyRetry(() => this.initSchema());
         this.prepareStatements();
         const cleanupInterval = options.ttlCleanupIntervalMs ?? 6e4;
         if (cleanupInterval > 0) {
@@ -6958,17 +7046,17 @@ var require_dist = __commonJS({
       encryptionKey = null;
       stmts = null;
       constructor(options) {
-        this.db = openDatabase(options.path, "SqliteTaskStore");
-        if (options.walMode !== false) {
-          this.db.pragma("journal_mode = WAL");
-        }
+        this.db = openDatabase(options.path, "SqliteTaskStore", {
+          busyTimeoutMs: options.busyTimeoutMs,
+          walMode: options.walMode !== false
+        });
         this.logger = options.logger;
         this.liveness = options.livenessProbe ?? defaultLivenessProbe;
         if (options.encryption?.secret) {
           this.encryptionKey = deriveEncryptionKey(options.encryption.secret);
         }
         this.emitter.setMaxListeners(200);
-        this.initSchema();
+        withBusyRetry(() => this.initSchema());
         this.prepareStatements();
         const cleanupInterval = options.ttlCleanupIntervalMs ?? 6e4;
         if (cleanupInterval > 0) {
@@ -7205,13 +7293,13 @@ var require_dist = __commonJS({
       cleanupTimer = null;
       stmts = null;
       constructor(options) {
-        this.db = openDatabase(options.path, "SqliteEventStore");
-        if (options.walMode !== false) {
-          this.db.pragma("journal_mode = WAL");
-        }
+        this.db = openDatabase(options.path, "SqliteEventStore", {
+          busyTimeoutMs: options.busyTimeoutMs,
+          walMode: options.walMode !== false
+        });
         this.maxEvents = options.maxEvents ?? 1e4;
         this.ttlMs = options.ttlMs ?? 3e5;
-        this.initSchema();
+        withBusyRetry(() => this.initSchema());
         this.prepareStatements();
         const cleanupInterval = options.ttlCleanupIntervalMs ?? 6e4;
         if (cleanupInterval > 0) {
@@ -7346,7 +7434,8 @@ var require_dist = __commonJS({
         secret: import_lazy_zod113.z.string().min(1)
       }).optional(),
       ttlCleanupIntervalMs: import_lazy_zod113.z.number().int().nonnegative().optional().default(6e4),
-      walMode: import_lazy_zod113.z.boolean().optional().default(true)
+      walMode: import_lazy_zod113.z.boolean().optional().default(true),
+      busyTimeoutMs: import_lazy_zod113.z.number().int().nonnegative().optional().default(5e3)
     });
   }
 });
@@ -7364,6 +7453,14 @@ function detectStorageType(storage, configuredType) {
   if ((0, import_utils15.getEnv)("REDIS_URL") || (0, import_utils15.getEnv)("REDIS_HOST")) return "redis";
   return "memory";
 }
+function isExplicitStorage(storage) {
+  return Boolean(storage?.type && storage.type !== "auto");
+}
+function resolvesToVercelKvTaskBackend(redis, storage) {
+  if (isExplicitStorage(storage)) return storage.type === "vercel-kv";
+  if (redis) return "provider" in redis && redis.provider === "vercel-kv";
+  return Boolean((0, import_utils15.getEnv)("KV_REST_API_URL"));
+}
 async function createTaskStore(options = {}) {
   const { storage: storageConfig, redis, keyPrefix = "mcp:task:", logger, isEdgeRuntime: isEdgeRuntime3 = false, sqlite } = options;
   if (isEdgeRuntime3 && sqlite) {
@@ -7388,7 +7485,7 @@ async function createTaskStore(options = {}) {
     return { store: store2, type: "sqlite" };
   }
   let finalStorageConfig = storageConfig;
-  if (redis && !storageConfig) {
+  if (redis && !isExplicitStorage(storageConfig)) {
     if ("provider" in redis && redis.provider === "vercel-kv") {
       throw new TaskStoreNotSupportedError(
         "Vercel KV is not supported for task stores. Task result blocking and cancel signalling require pub/sub. Use Redis or Upstash instead."
@@ -7416,7 +7513,8 @@ async function createTaskStore(options = {}) {
       };
     }
   }
-  if (finalStorageConfig?.type === "vercel-kv" || (0, import_utils15.getEnv)("KV_REST_API_URL")) {
+  const explicitBackend = isExplicitStorage(storageConfig) || Boolean(redis);
+  if (finalStorageConfig?.type === "vercel-kv" || !explicitBackend && (0, import_utils15.getEnv)("KV_REST_API_URL")) {
     throw new TaskStoreNotSupportedError(
       "Vercel KV is not supported for task stores (pub/sub required). Use Redis or Upstash."
     );
@@ -8657,11 +8755,8 @@ var init_get_prompt_request_handler = __esm({
 
 // libs/sdk/src/notification/notification.service.ts
 function hasMcpAppsExtension(capabilities) {
-  if (!capabilities?.experimental) {
-    return false;
-  }
-  const uiExtension = capabilities.experimental[MCP_APPS_EXTENSION_KEY];
-  return uiExtension !== void 0 && uiExtension !== null;
+  const declared = capabilities?.experimental?.[MCP_APPS_EXTENSION_KEY] ?? capabilities?.extensions?.[MCP_APPS_EXTENSION_KEY];
+  return declared !== void 0 && declared !== null;
 }
 function detectPlatformFromCapabilities(capabilities) {
   if (hasMcpAppsExtension(capabilities)) {
@@ -11263,6 +11358,8 @@ var init_ui_shared = __esm({
       widgets = /* @__PURE__ */ new Map();
       manifests = /* @__PURE__ */ new Map();
       resourceMeta = /* @__PURE__ */ new Map();
+      uiTools = /* @__PURE__ */ new Set();
+      customUris = /* @__PURE__ */ new Map();
       resolver;
       options;
       constructor(resolver, options = {}) {
@@ -11277,6 +11374,28 @@ var init_ui_shared = __esm({
           logger: this.options.logger
         };
       }
+      /**
+       * Record that `toolName` has a UI, and the custom `ui.resourceUri` it advertises (if any).
+       * `tools/list` advertises that URI verbatim, so `resources/read` must resolve it back to the
+       * tool; and only registered tools may be served a placeholder widget.
+       */
+      registerTool(toolName, resourceUri) {
+        this.uiTools.add(toolName);
+        if (resourceUri) this.customUris.set(resourceUri, toolName);
+      }
+      /** The tool that advertised `uri` as its custom `ui.resourceUri`. */
+      resolveCustomUri(uri) {
+        return this.customUris.get(uri);
+      }
+      /**
+       * Whether `name` (or its app-qualified form `app:name`) is a tool with a UI.
+       */
+      hasTool(name44) {
+        const known = (n) => this.uiTools.has(n) || this.widgets.has(n) || this.resourceMeta.has(n);
+        if (known(name44)) return true;
+        const sep = name44.indexOf(":");
+        return sep > 0 && known(name44.slice(sep + 1));
+      }
       getStaticWidget(name44) {
         return this.widgets.get(name44);
       }
@@ -11305,8 +11424,9 @@ var init_ui_shared = __esm({
         const output = options["output"] ?? {};
         const uiConfig = options["uiConfig"];
         const resourceMode = uiConfig?.["resourceMode"] ?? options["resourceMode"];
-        if (!toolName || !template) return;
+        if (!toolName) return;
         this.updateResourceMetaFromConfig(toolName, uiConfig);
+        if (!template) return;
         const result = (0, import_adapters.renderToolTemplate)({
           toolName,
           input,
@@ -11315,6 +11435,7 @@ var init_ui_shared = __esm({
           resolver: this.resolver,
           resourceMode,
           sizing: extractSizing(uiConfig),
+          csp: uiConfig?.["csp"],
           ...this.stringResultOptions(uiConfig)
         });
         this.widgets.set(toolName, result.html);
@@ -11393,6 +11514,7 @@ var init_ui_shared = __esm({
           resolver: this.resolver,
           resourceMode,
           sizing: extractSizing(uiConfig),
+          csp: uiConfig?.["csp"],
           ...this.stringResultOptions(uiConfig)
         });
         return { meta: result.meta };
@@ -11445,26 +11567,14 @@ function handleUIResourceRead(uri, registry, platformType) {
     return { handled: false };
   }
   const mimeType = getUIResourceMimeType(platformType);
-  const widgetParsed = parseWidgetUri(uri);
+  const customTool = registry.resolveCustomUri(uri);
+  const widgetParsed = customTool ? { toolName: customTool } : parseWidgetUri(uri);
   if (widgetParsed) {
-    const resourceMeta = buildResourceMetaForWidget(registry, widgetParsed.toolName);
-    const cachedWidget = registry.getStaticWidget(widgetParsed.toolName);
-    if (cachedWidget) {
-      return {
-        handled: true,
-        result: {
-          contents: [
-            {
-              uri,
-              mimeType,
-              text: cachedWidget,
-              ...resourceMeta ? { _meta: resourceMeta } : {}
-            }
-          ]
-        }
-      };
+    if (!registry.hasTool(widgetParsed.toolName)) {
+      return { handled: true, error: `No UI widget is registered for ${uri}` };
     }
-    const html = generatePlaceholderWidget(widgetParsed.toolName);
+    const resourceMeta = buildResourceMetaForWidget(registry, widgetParsed.toolName);
+    const html = registry.getStaticWidget(widgetParsed.toolName) ?? generatePlaceholderWidget(widgetParsed.toolName);
     return {
       handled: true,
       result: {
@@ -12043,6 +12153,7 @@ var init_direct_client = __esm({
     "use strict";
     import_protocol30 = require("@frontmcp/protocol");
     import_utils29 = require("@frontmcp/utils");
+    init_list_all_pages_utils();
     init_errors();
     init_skills_mcp_types();
     init_llm_platform();
@@ -12189,8 +12300,11 @@ var init_direct_client = __esm({
       // Tool Operations (platform-formatted)
       // ─────────────────────────────────────────────────────────────────────────────
       async listTools() {
-        const result = await this.mcpClient.listTools();
-        return formatToolsForPlatform(result.tools, this.platform);
+        const tools = await listAllPages("tools/list", async (cursor) => {
+          const result = await this.mcpClient.listTools(cursor ? { cursor } : void 0);
+          return { items: result.tools, nextCursor: result.nextCursor };
+        });
+        return formatToolsForPlatform(tools, this.platform);
       }
       async callTool(name44, args) {
         const result = await this.mcpClient.callTool({
@@ -12203,19 +12317,34 @@ var init_direct_client = __esm({
       // Resource Operations (raw format)
       // ─────────────────────────────────────────────────────────────────────────────
       async listResources() {
-        return this.mcpClient.listResources();
+        const resources = await listAllPages("resources/list", async (cursor) => {
+          const result = await this.mcpClient.listResources(cursor ? { cursor } : void 0);
+          return { items: result.resources, nextCursor: result.nextCursor };
+        });
+        return { resources };
       }
       async readResource(uri) {
         return this.mcpClient.readResource({ uri });
       }
       async listResourceTemplates() {
-        return this.mcpClient.listResourceTemplates();
+        const resourceTemplates = await listAllPages(
+          "resources/templates/list",
+          async (cursor) => {
+            const result = await this.mcpClient.listResourceTemplates(cursor ? { cursor } : void 0);
+            return { items: result.resourceTemplates, nextCursor: result.nextCursor };
+          }
+        );
+        return { resourceTemplates };
       }
       // ─────────────────────────────────────────────────────────────────────────────
       // Prompt Operations (raw format)
       // ─────────────────────────────────────────────────────────────────────────────
       async listPrompts() {
-        return this.mcpClient.listPrompts();
+        const prompts = await listAllPages("prompts/list", async (cursor) => {
+          const result = await this.mcpClient.listPrompts(cursor ? { cursor } : void 0);
+          return { items: result.prompts, nextCursor: result.nextCursor };
+        });
+        return { prompts };
       }
       async getPrompt(name44, args) {
         return this.mcpClient.getPrompt({
@@ -12943,8 +13072,8 @@ function createRemoteAppProbe(appId, provider) {
     name: `remote:${appId}`,
     async check() {
       const result = provider.getHealthStatus(appId);
-      if (!result) {
-        return { status: "unhealthy", error: "No health check result available" };
+      if (!result || result.status === "unknown" && result.consecutiveFailures === 0) {
+        return { status: "degraded", details: { state: "unknown" } };
       }
       return {
         status: result.status === "healthy" ? "healthy" : result.status === "degraded" ? "degraded" : "unhealthy",
@@ -14060,6 +14189,12 @@ var init_frontmcp_context = __esm({
       // =====================
       /** Request metadata (headers, user-agent, etc.) */
       metadata;
+      /**
+       * The hosting platform's bindings object for this request: a Cloudflare Worker's `env`
+       * (KV namespaces, D1 databases, R2 buckets, Durable Objects, `[vars]`, secrets).
+       * `undefined` on Node, where bindings do not exist.
+       */
+      platformEnv;
       // =====================
       // Auth (mutable, progressively populated)
       // =====================
@@ -14095,6 +14230,7 @@ var init_frontmcp_context = __esm({
         this.traceContext = args.traceContext ?? generateTraceContext();
         this.timestamp = args.timestamp ?? Date.now();
         this._authInfo = args.authInfo ?? {};
+        this.platformEnv = args.platformEnv;
         this.config = {
           forwardCallerTokenTo: toOrigins(args.config?.forwardCallerTokenTo),
           forwardCustomHeadersTo: toOrigins(args.config?.forwardCustomHeadersTo),
@@ -14797,6 +14933,7 @@ var init_frontmcp_context_storage = __esm({
     import_utils39 = require("@frontmcp/utils");
     init_decorators();
     init_metadata();
+    init_tokens();
     init_mcp_error();
     init_frontmcp_context();
     init_metadata_utils();
@@ -14864,7 +15001,12 @@ var init_frontmcp_context_storage = __esm({
         const headers = request.headers ?? {};
         const headerSessionId = typeof headers["mcp-session-id"] === "string" ? headers["mcp-session-id"].trim() : "";
         const sessionId = headerSessionId.length > 0 ? headerSessionId : `anon:${(0, import_utils39.randomUUID)()}`;
-        return this.runFromHeaders(headers, { sessionId, scopeId, peerAddress: request.socket?.remoteAddress }, fn);
+        const platformEnv = request[ServerRequestTokens.webEnv];
+        return this.runFromHeaders(
+          headers,
+          { sessionId, scopeId, peerAddress: request.socket?.remoteAddress, platformEnv },
+          fn
+        );
       }
       withServerConfig(args) {
         return { ...args, config: { ...this.contextConfig, ...args.config } };
@@ -21917,6 +22059,14 @@ var init_tool_credentials_gate = __esm({
 });
 
 // libs/sdk/src/tool/flows/call-tool.flow.ts
+function declaredOutput(tool, output) {
+  if (!tool?.outputSchema || typeof output !== "object" || output === null || Array.isArray(output)) return output;
+  if (Array.isArray(output["content"])) return output;
+  const parsed = tool.safeParseOutput(output);
+  if (!parsed.success) return output;
+  const structured = parsed.data.structuredContent;
+  return typeof structured === "object" && structured !== null && !Array.isArray(structured) ? structured : output;
+}
 function toolNameCandidates(name44) {
   if (!/[-_]/.test(name44)) return [name44];
   return [name44, name44.includes("_") ? name44.replace(/_/g, "-") : name44.replace(/-/g, "_")];
@@ -21992,6 +22142,9 @@ var init_call_tool_flow = __esm({
       uiResult: import_lazy_zod57.z.any().optional(),
       // UI metadata from rendering (merged into _meta)
       uiMeta: import_lazy_zod57.z.record(import_lazy_zod57.z.string(), import_lazy_zod57.z.unknown()).optional(),
+      // Metadata hooks add to the result (e.g. the cache plugin's `cache: 'hit'`), merged into the
+      // result's _meta; never merged into rawOutput, which is the tool's data
+      resultMeta: import_lazy_zod57.z.record(import_lazy_zod57.z.string(), import_lazy_zod57.z.unknown()).optional(),
       // Progress token from request's _meta (for progress notifications)
       progressToken: import_lazy_zod57.z.union([import_lazy_zod57.z.string(), import_lazy_zod57.z.number()]).optional(),
       // JSON-RPC request ID (for elicitation routing)
@@ -22647,7 +22800,7 @@ ${JSON.stringify(error.schema, null, 2)}
             this.logger.verbose("execute:done (elicitation fire-and-forget fallback)");
             return;
           }
-          if (isClientFacingError(error)) throw error;
+          if (isClientFacingError(error) || error instanceof InvalidOutputError) throw error;
           throw new ToolExecutionError(
             this.state.tool?.metadata.name || "unknown",
             error instanceof Error ? error : void 0
@@ -22690,7 +22843,8 @@ ${JSON.stringify(error.schema, null, 2)}
       }
       async applyUI() {
         this.logger.verbose("applyUI:start");
-        const { tool, rawOutput, input } = this.state;
+        const { tool, rawOutput: executeOutput, input } = this.state;
+        const rawOutput = declaredOutput(tool, executeOutput);
         const ctx = this.input.ctx;
         if (ctx?._skipUI) {
           this.logger.verbose("applyUI:skip (agent context - structured data only)");
@@ -22819,7 +22973,7 @@ ${JSON.stringify(error.schema, null, 2)}
       }
       async finalize() {
         this.logger.verbose("finalize:start");
-        const { tool, rawOutput, uiResult, uiMeta } = this.state;
+        const { tool, rawOutput, uiResult, uiMeta, resultMeta } = this.state;
         if (!tool) {
           this.logger.verbose("finalize: skipping (no tool in state)");
           return;
@@ -22862,6 +23016,9 @@ ${JSON.stringify(error.schema, null, 2)}
         if (rawMeta) {
           result._meta = { ...result._meta, ...rawMeta };
         }
+        if (resultMeta) {
+          result._meta = { ...result._meta, ...resultMeta };
+        }
         if (uiResult) {
           result.content = uiResult.content;
           if (uiResult.structuredContent !== void 0 && uiResult.structuredContent !== null) {
@@ -24313,6 +24470,38 @@ var init_context = __esm({
   }
 });
 
+// libs/sdk/src/errors/misconfiguration.ts
+function findMisconfiguration(error) {
+  let current = error;
+  for (let depth = 0; current instanceof Error && depth < 5; depth++) {
+    const code = current.code;
+    if (typeof code === "string" && Object.prototype.hasOwnProperty.call(MISCONFIGURATION_REMEDIES, code)) {
+      return { code, remedy: MISCONFIGURATION_REMEDIES[code] };
+    }
+    if (current.name === "ZodError") return { code: "CONFIG_INVALID", remedy: CONFIG_INVALID_REMEDY };
+    current = current.cause;
+  }
+  return void 0;
+}
+function misconfigurationBody(m) {
+  return { error: "server_misconfigured", code: m.code, message: m.remedy };
+}
+var MISCONFIGURATION_REMEDIES, CONFIG_INVALID_REMEDY;
+var init_misconfiguration = __esm({
+  "libs/sdk/src/errors/misconfiguration.ts"() {
+    "use strict";
+    MISCONFIGURATION_REMEDIES = {
+      SESSION_SECRET_REQUIRED: "Set MCP_SESSION_SECRET in the deployment environment (e.g. `wrangler secret put MCP_SESSION_SECRET` on Cloudflare, or the platform environment settings on Node, Vercel and Lambda). Session IDs are encrypted with it, and production refuses the development machine-id fallback.",
+      JWT_SECRET_INVALID: "JWT_SECRET is present but too weak: HS256 requires at least 32 bytes (RFC 7518). Replace it with `openssl rand -hex 32`.",
+      JWT_SECRET_REQUIRED: "Set JWT_SECRET in the deployment environment (e.g. `wrangler secret put JWT_SECRET`). Tokens are signed with it; production refuses the random per-process fallback because tokens would not survive a restart or verify across instances.",
+      // The startup checks: a server whose entries ask for protection nothing gives them does not start.
+      UNENFORCED_METADATA: "An entry declares a field only a plugin enforces (approval, featureFlag, ...) and no installed plugin that enforces it reaches the entry, so the server refuses to start. Install the plugin or remove the field; the server log names the entries.",
+      AUTH_CONFIGURATION_ERROR: "The auth or authorities configuration is invalid (for example, entries declare authorities and the server has no authorities option, or a rule checks nothing), so the server refuses to start. The server log names the entries."
+    };
+    CONFIG_INVALID_REMEDY = "The FrontMCP configuration failed validation, so the server refuses to start. The server log names the invalid fields.";
+  }
+});
+
 // libs/sdk/src/server/server.validation.ts
 function applyHeaders(res, headers) {
   if (!headers) return;
@@ -24625,6 +24814,7 @@ var init_flow_instance = __esm({
     init_common();
     init_context();
     init_errors();
+    init_misconfiguration();
     init_server_validation();
     init_flow_http_path();
     init_flow_stages();
@@ -24684,6 +24874,15 @@ var init_flow_instance = __esm({
                     return writeHttpResponse(response, e.output);
                 }
               }
+              const misconfiguration = findMisconfiguration(e);
+              if (misconfiguration) {
+                this.logger.error("Server misconfigured", { flow: this.name, code: misconfiguration.code });
+                return writeHttpResponse(response, {
+                  kind: "json",
+                  status: 500,
+                  body: misconfigurationBody(misconfiguration)
+                });
+              }
               if (e instanceof PublicMcpError) {
                 const challenge = e.wwwAuthenticate;
                 this.logger.warn("Public error in flow", {
@@ -25396,14 +25595,90 @@ function collectDynamicProviders(klass, options) {
   }
   return out;
 }
+function collectDynamicTools(klass, options) {
+  const chain = [];
+  for (let k = klass; k && k !== Function.prototype; k = Object.getPrototypeOf(k)) {
+    chain.push(k);
+  }
+  const out = [];
+  for (let i = chain.length - 1; i >= 0; i--) {
+    const k = chain[i];
+    if (Object.prototype.hasOwnProperty.call(k, "dynamicTools") && typeof k.dynamicTools === "function") {
+      out.push(...k.dynamicTools(options) ?? []);
+    }
+  }
+  return out;
+}
+function pluginMetadataFromOptions(options, dynamicTools) {
+  const out = { ...options };
+  for (const key of LIST_METADATA_KEYS) {
+    if (key in out && !Array.isArray(out[key])) delete out[key];
+  }
+  const tools = [...out["tools"] ?? [], ...dynamicTools];
+  if (tools.length > 0) out["tools"] = tools;
+  return out;
+}
 function dedupePluginProviders(providers) {
   const map = /* @__PURE__ */ new Map();
   for (const p of providers) map.set(p["provide"] ?? p, p);
   return [...map.values()];
 }
+var LIST_METADATA_KEYS;
 var init_dynamic_utils = __esm({
   "libs/sdk/src/common/dynamic/dynamic.utils.ts"() {
     "use strict";
+    LIST_METADATA_KEYS = ["exports", "plugins", "adapters", "tools", "resources", "prompts", "skills"];
+  }
+});
+
+// libs/sdk/src/common/dynamic/dynamic.plugin.ts
+function isDynamicPluginClass(value) {
+  return typeof value === "function" && value.prototype instanceof DynamicPlugin;
+}
+function initOptionsOf(instance) {
+  return initOptionsByInstance.has(instance) ? { options: initOptionsByInstance.get(instance) } : void 0;
+}
+var initOptionsByInstance, DynamicPlugin;
+var init_dynamic_plugin = __esm({
+  "libs/sdk/src/common/dynamic/dynamic.plugin.ts"() {
+    "use strict";
+    init_transport_errors();
+    init_dynamic_utils();
+    initOptionsByInstance = /* @__PURE__ */ new WeakMap();
+    DynamicPlugin = class {
+      get(token) {
+        throw new MethodNotImplementedError("DynamicPlugin", "get");
+      }
+      /**
+       * Static init() method to create a plugin provider.
+       * @param options - Input options (with optional fields for defaults). Omitted, the plugin is
+       *   built with `{}`, as `ApprovalPlugin.init()` is documented.
+       */
+      static init(options = {}) {
+        const extraProviders = options.providers;
+        const typedOptions = options;
+        if ("useFactory" in options) {
+          return {
+            ...pluginMetadataFromOptions(typedOptions, []),
+            provide: this,
+            inject: options.inject,
+            useFactory: options.useFactory,
+            providers: dedupePluginProviders(extraProviders ?? [])
+          };
+        }
+        const dyn = collectDynamicProviders(this, typedOptions);
+        const mergedProviders = dedupePluginProviders([...dyn ?? [], ...extraProviders ?? []]);
+        const dynamicTools = collectDynamicTools(this, typedOptions);
+        const instance = new this(options);
+        initOptionsByInstance.set(instance, options);
+        return {
+          ...pluginMetadataFromOptions(typedOptions, dynamicTools),
+          provide: this,
+          useValue: instance,
+          providers: mergedProviders
+        };
+      }
+    };
   }
 });
 
@@ -25659,9 +25934,18 @@ var init_execution_context_interface = __esm({
         if (this._authContext) return this._authContext;
         const rawAuth = require("@frontmcp/auth");
         const auth = rawAuth.default ?? rawAuth;
-        this._authContext = auth.buildAuthContext(this._authInfo, this.scope.metadata.authorities?.claimsMapping);
+        this._authContext = auth.buildAuthContext(this.resolveAuthSource(), this.scope.metadata.authorities?.claimsMapping);
         return this._authContext;
       }
+      resolveAuthSource() {
+        const fromContext = this.tryGetContext()?.authInfo;
+        if (!fromContext) return this._authInfo;
+        const merged = { ...this._authInfo };
+        for (const [key, value] of Object.entries(fromContext)) {
+          if (value !== void 0) merged[key] = value;
+        }
+        return merged;
+      }
       /**
        * Try to get the context, returning undefined if not available.
        *
@@ -25847,6 +26131,23 @@ var init_execution_context_interface = __esm({
       get config() {
         return this.providers.get(ConfigService);
       }
+      // ---- Platform bindings ----
+      /**
+       * The hosting platform's bindings for the current request — on a Cloudflare Worker, the `env`
+       * object holding KV namespaces, D1 databases, R2 buckets, Durable Object namespaces, `[vars]`
+       * and secrets. `undefined` on Node/Express, where no such object exists.
+       *
+       * Only string bindings are mirrored into `process.env`; use this for the rest.
+       *
+       * @example
+       * ```typescript
+       * const kv = this.workerEnv?.['MY_KV'] as KVNamespace | undefined;
+       * ```
+       */
+      get workerEnv() {
+        const env = this.tryGetContext()?.platformEnv;
+        return env !== null && typeof env === "object" ? env : void 0;
+      }
       // ---- Runtime context helpers ----
       /**
        * Get the current runtime context (platform, runtime, deployment, env).
@@ -28895,7 +29196,7 @@ var init_plugin_utils = __esm({
 });
 
 // libs/sdk/src/plugin/plugin.registry.ts
-var import_reflect_metadata12, import_di24, PluginRegistry;
+var import_reflect_metadata12, import_di24, installedPluginValues, PluginRegistry;
 var init_plugin_registry = __esm({
   "libs/sdk/src/plugin/plugin.registry.ts"() {
     "use strict";
@@ -28903,6 +29204,7 @@ var init_plugin_registry = __esm({
     import_di24 = require("@frontmcp/di");
     init_adapter_registry();
     init_common();
+    init_dynamic_plugin();
     init_dynamic_utils();
     init_context_extension();
     init_errors();
@@ -28915,6 +29217,7 @@ var init_plugin_registry = __esm({
     init_skill_registry();
     init_tool_registry();
     init_plugin_utils();
+    installedPluginValues = /* @__PURE__ */ new WeakSet();
     PluginRegistry = class _PluginRegistry extends RegistryAbstract {
       /** providers by token */
       pProviders = /* @__PURE__ */ new Map();
@@ -29103,8 +29406,15 @@ var init_plugin_registry = __esm({
               pluginInstance: new rec.provide(...depsInstances),
               dynamicProviders: rec.providers
             };
-          case "VALUE" /* VALUE */:
-            return { pluginInstance: rec.useValue, dynamicProviders: rec.providers };
+          case "VALUE" /* VALUE */: {
+            const value = rec.useValue;
+            const init = installedPluginValues.has(value) ? initOptionsOf(value) : void 0;
+            installedPluginValues.add(value);
+            if (init && isDynamicPluginClass(rec.provide)) {
+              return { pluginInstance: new rec.provide(init.options), dynamicProviders: rec.providers };
+            }
+            return { pluginInstance: value, dynamicProviders: rec.providers };
+          }
           case "FACTORY" /* FACTORY */: {
             const args = [];
             for (const d of rec.inject()) args.push(await this.providers.resolveBootstrapDep(d));
@@ -30644,6 +30954,9 @@ var init_completion_events = __esm({
 });
 
 // libs/sdk/src/agent/flows/call-agent.flow.ts
+function invalidOutputFrom(outputError) {
+  return outputError instanceof InvalidOutputError ? outputError : new InvalidOutputError();
+}
 var import_auth26, import_guard6, import_lazy_zod60, import_protocol41, inputSchema15, outputSchema14, stateSchema14, plan14, name14, Stage14, CallAgentFlow;
 var init_call_agent_flow = __esm({
   "libs/sdk/src/agent/flows/call-agent.flow.ts"() {
@@ -31030,7 +31343,7 @@ var init_call_agent_flow = __esm({
         const { agent, agentContext, executionStartedAt, executionError, outputError, authInfo } = this.state;
         if (!agent || executionStartedAt === void 0) return;
         if (executionError instanceof ElicitationFallbackRequired || executionError instanceof FlowControl) return;
-        const failure = executionError ?? (outputError !== void 0 ? new InvalidOutputError() : void 0);
+        const failure = executionError ?? (outputError !== void 0 ? invalidOutputFrom(outputError) : void 0);
         const failed = failure !== void 0;
         const requestId = this.tryGetContext()?.requestId;
         const sessionId = typeof authInfo?.sessionId === "string" && authInfo.sessionId ? authInfo.sessionId : void 0;
@@ -31060,7 +31373,7 @@ var init_call_agent_flow = __esm({
             agent: agent.metadata.name,
             errors: outputError
           });
-          throw new InvalidOutputError();
+          throw invalidOutputFrom(outputError);
         }
         const result = parsedOutput;
         if (executionMeta) {
@@ -31641,12 +31954,36 @@ var init_request_validation = __esm({
 });
 
 // libs/sdk/src/transport/mcp-20260728/request-state.ts
-function getRequestStateKey() {
+function configuredSecret(name44) {
+  const value = (0, import_utils65.getEnv)(name44);
+  return value && value.trim().length > 0 ? value : void 0;
+}
+function resolveKey() {
   if (cachedKey) return cachedKey;
-  const secret = process.env["VAULT_SECRET"] ?? process.env["JWT_SECRET"];
-  cachedKey = secret ? encoder.encode(secret) : (0, import_utils65.randomBytes)(32);
+  const vault = configuredSecret("VAULT_SECRET");
+  const jwt = vault ? void 0 : configuredSecret("JWT_SECRET");
+  if (vault) cachedKey = { key: encoder.encode(vault), source: "VAULT_SECRET" };
+  else if (jwt) cachedKey = { key: encoder.encode(jwt), source: "JWT_SECRET" };
+  else cachedKey = { key: (0, import_utils65.randomBytes)(32), source: "per-process" };
   return cachedKey;
 }
+function getRequestStateKey() {
+  return resolveKey().key;
+}
+function getRequestStateKeySource() {
+  return resolveKey().source;
+}
+function warnIfRequestStateKeyNotShared(options) {
+  if (warnedKeyNotShared || !(0, import_utils65.isProduction)()) return;
+  const { metadata } = options;
+  const persistence = metadata.transport?.persistence;
+  const sharesState = Boolean(metadata.redis) || typeof persistence === "object" && persistence !== null;
+  if (!sharesState || getRequestStateKeySource() !== "per-process") return;
+  warnedKeyNotShared = true;
+  options.logger.warn(
+    "requestState is signed with a per-process key (neither VAULT_SECRET nor JWT_SECRET is set). Multi-round tools (elicit/sample) restart when a round lands on another instance; set VAULT_SECRET (or JWT_SECRET) to the same value on every instance."
+  );
+}
 function computeRequestBinding(method, params) {
   const salient = {};
   for (const key of ["name", "uri", "arguments"]) {
@@ -31696,13 +32033,14 @@ function decodeRequestState(state, expected) {
   if (payload.b !== expected.binding) return { ok: false, reason: "request-mismatch" };
   return { ok: true, responses: payload.r };
 }
-var import_utils65, DEFAULT_REQUEST_STATE_TTL_MS, MAX_REQUEST_STATE_BYTES, cachedKey, encoder, decoder;
+var import_utils65, DEFAULT_REQUEST_STATE_TTL_MS, MAX_REQUEST_STATE_BYTES, cachedKey, warnedKeyNotShared, encoder, decoder;
 var init_request_state = __esm({
   "libs/sdk/src/transport/mcp-20260728/request-state.ts"() {
     "use strict";
     import_utils65 = require("@frontmcp/utils");
     DEFAULT_REQUEST_STATE_TTL_MS = 10 * 60 * 1e3;
     MAX_REQUEST_STATE_BYTES = 256 * 1024;
+    warnedKeyNotShared = false;
     encoder = new TextEncoder();
     decoder = new TextDecoder();
   }
@@ -32423,7 +32761,8 @@ async function dispatch20260728(options) {
   };
   const carried = decodeRequestState(params["requestState"], binding);
   if (!carried.ok && carried.reason !== "absent") {
-    scope.logger.warn("mcp-20260728: rejected requestState", { method, reason: carried.reason });
+    const hint = carried.reason === "bad-signature" && getRequestStateKeySource() === "per-process" ? "requestState is signed with a per-process key; set VAULT_SECRET (or JWT_SECRET) to the same value on every instance so a round can land on any of them" : void 0;
+    scope.logger.warn("mcp-20260728: rejected requestState", { method, reason: carried.reason, ...hint && { hint } });
   }
   const exchange = new MrtrExchange({
     inputResponses: params["inputResponses"],
@@ -32580,6 +32919,7 @@ var init_mcp_stateless_client = __esm({
   "libs/sdk/src/transport/mcp-20260728/client/mcp-stateless.client.ts"() {
     "use strict";
     import_protocol47 = require("@frontmcp/protocol");
+    init_list_all_pages_utils();
     init_header_codec();
     init_protocol_20260728_constants();
     init_tasks_extension();
@@ -32620,10 +32960,22 @@ var init_mcp_stateless_client = __esm({
        * The spec requires this: one malformed tool definition must not prevent the
        * other tools from being used, so the offender is excluded and logged rather
        * than failing the call.
+       *
+       * Every page is fetched (`nextCursor` is followed to the end), since the
+       * schemas cached here are what later `tools/call` headers are derived from.
        */
       async listTools() {
-        const result = await this.request("tools/list");
-        const tools = Array.isArray(result["tools"]) ? result["tools"] : [];
+        const tools = await listAllPages(
+          "tools/list",
+          async (cursor) => {
+            const result = await this.request("tools/list", cursor ? { cursor } : {});
+            return {
+              items: Array.isArray(result["tools"]) ? result["tools"] : [],
+              nextCursor: typeof result["nextCursor"] === "string" ? result["nextCursor"] : void 0
+            };
+          },
+          (message) => new McpStatelessError(-32603, message)
+        );
         const usable = [];
         for (const tool of tools) {
           const validation = validateHeaderParams(tool["inputSchema"]);
@@ -32642,11 +32994,17 @@ var init_mcp_stateless_client = __esm({
       async readResource(uri) {
         return this.request("resources/read", { uri });
       }
-      async listResources() {
-        return this.request("resources/list");
+      /** One page of `resources/list`; pass the previous page's `nextCursor` for the next. */
+      async listResources(cursor) {
+        return this.request("resources/list", cursor ? { cursor } : {});
       }
-      async listPrompts() {
-        return this.request("prompts/list");
+      /** One page of `resources/templates/list`; pass the previous page's `nextCursor` for the next. */
+      async listResourceTemplates(cursor) {
+        return this.request("resources/templates/list", cursor ? { cursor } : {});
+      }
+      /** One page of `prompts/list`; pass the previous page's `nextCursor` for the next. */
+      async listPrompts(cursor) {
+        return this.request("prompts/list", cursor ? { cursor } : {});
       }
       async getPrompt(name44, args = {}) {
         return this.request("prompts/get", { name: name44, arguments: args });
@@ -32932,6 +33290,10 @@ var init_mcp_20260728 = __esm({
 });
 
 // libs/sdk/src/remote-mcp/mcp-stateless-client.adapter.ts
+function nextCursorOf(result) {
+  const next = result["nextCursor"];
+  return typeof next === "string" && next.length > 0 ? { nextCursor: next } : {};
+}
 async function negotiateRemoteProtocol(url, configured, headers, fetchImpl = fetch) {
   if (configured === "2026-07-28") return "2026-07-28";
   if (configured !== "auto") return "legacy";
@@ -32974,16 +33336,29 @@ var init_mcp_stateless_client_adapter = __esm({
       async callTool(params) {
         return this.client.callTool(params.name, params.arguments ?? {});
       }
-      async listResources() {
-        const result = await this.client.listResources();
-        return { resources: Array.isArray(result["resources"]) ? result["resources"] : [] };
+      async listResources(params) {
+        const result = await this.client.listResources(params?.cursor);
+        return {
+          resources: Array.isArray(result["resources"]) ? result["resources"] : [],
+          ...nextCursorOf(result)
+        };
+      }
+      async listResourceTemplates(params) {
+        const result = await this.client.listResourceTemplates(params?.cursor);
+        return {
+          resourceTemplates: Array.isArray(result["resourceTemplates"]) ? result["resourceTemplates"] : [],
+          ...nextCursorOf(result)
+        };
       }
       async readResource(params) {
         return this.client.readResource(params.uri);
       }
-      async listPrompts() {
-        const result = await this.client.listPrompts();
-        return { prompts: Array.isArray(result["prompts"]) ? result["prompts"] : [] };
+      async listPrompts(params) {
+        const result = await this.client.listPrompts(params?.cursor);
+        return {
+          prompts: Array.isArray(result["prompts"]) ? result["prompts"] : [],
+          ...nextCursorOf(result)
+        };
       }
       async getPrompt(params) {
         return this.client.getPrompt(params.name, params.arguments ?? {});
@@ -33342,7 +33717,7 @@ var init_health_check = __esm({
           this.consecutiveSuccesses++;
           this.consecutiveFailures = 0;
           const previousStatus = this.status;
-          if (this.consecutiveSuccesses >= this.options.healthyThreshold) {
+          if (previousStatus === "unknown" || this.consecutiveSuccesses >= this.options.healthyThreshold) {
             this.status = latencyMs > this.options.degradedLatencyMs ? "degraded" : "healthy";
           }
           this.lastResult = {
@@ -33506,6 +33881,7 @@ var init_mcp_client_service = __esm({
   "libs/sdk/src/remote-mcp/mcp-client.service.ts"() {
     "use strict";
     import_protocol48 = require("@frontmcp/protocol");
+    init_list_all_pages_utils();
     init_mcp_error();
     init_remote_errors();
     init_transport_errors();
@@ -34109,10 +34485,15 @@ var init_mcp_client_service = __esm({
         const httpOptions = request.transportOptions;
         return httpOptions?.fallbackToSSE ?? true;
       }
+      // Each list follows `nextCursor` to the end: a FrontMCP remote pages its lists
+      // (40 per page by default), and proxying only the first page silently dropped
+      // everything after it.
       async listToolsInternal(connection) {
         try {
-          const result = await connection.client.listTools();
-          return result.tools || [];
+          return await listAllPages("tools/list", async (cursor) => {
+            const result = await connection.client.listTools(cursor ? { cursor } : void 0);
+            return { items: result.tools, nextCursor: result.nextCursor };
+          });
         } catch (error) {
           this.logger.warn(`Failed to list tools: ${error.message}`);
           return [];
@@ -34120,8 +34501,10 @@ var init_mcp_client_service = __esm({
       }
       async listResourcesInternal(connection) {
         try {
-          const result = await connection.client.listResources();
-          return result.resources || [];
+          return await listAllPages("resources/list", async (cursor) => {
+            const result = await connection.client.listResources(cursor ? { cursor } : void 0);
+            return { items: result.resources, nextCursor: result.nextCursor };
+          });
         } catch (error) {
           this.logger.warn(`Failed to list resources: ${error.message}`);
           return [];
@@ -34129,8 +34512,10 @@ var init_mcp_client_service = __esm({
       }
       async listResourceTemplatesInternal(connection) {
         try {
-          const result = await connection.client.listResourceTemplates();
-          return result.resourceTemplates || [];
+          return await listAllPages("resources/templates/list", async (cursor) => {
+            const result = await connection.client.listResourceTemplates(cursor ? { cursor } : void 0);
+            return { items: result.resourceTemplates, nextCursor: result.nextCursor };
+          });
         } catch (error) {
           this.logger.warn(`Failed to list resource templates: ${error.message}`);
           return [];
@@ -34138,8 +34523,10 @@ var init_mcp_client_service = __esm({
       }
       async listPromptsInternal(connection) {
         try {
-          const result = await connection.client.listPrompts();
-          return result.prompts || [];
+          return await listAllPages("prompts/list", async (cursor) => {
+            const result = await connection.client.listPrompts(cursor ? { cursor } : void 0);
+            return { items: result.prompts, nextCursor: result.nextCursor };
+          });
         } catch (error) {
           this.logger.warn(`Failed to list prompts: ${error.message}`);
           return [];
@@ -41592,8 +41979,11 @@ var init_session_verify_flow = __esm({
         const machineId = (0, import_utils78.getMachineId)();
         const authSignature = subject ? `${authMode}:${subject}` : authMode;
         if (sessionIdHeader) {
-          const existingPayload = decryptPublicSession(sessionIdHeader, authSignature);
-          if (existingPayload && existingPayload.nodeId === machineId) {
+          const body = this.rawInput.request.body;
+          const isInitialize2 = typeof body === "object" && body !== null && "method" in body && body.method === "initialize";
+          const decrypted = decryptPublicSession(sessionIdHeader, authSignature);
+          const existingPayload = decrypted && isInitialize2 && decrypted.nodeId !== machineId ? void 0 : decrypted;
+          if (existingPayload) {
             const anonId = existingPayload.uuid ?? `${existingPayload.iat * 1e3}`;
             const user2 = (0, import_auth39.anonymousCallerClaims)(options, anonId);
             this.respond({
@@ -42549,9 +42939,11 @@ var init_instance_local_primary_auth = __esm({
         } else if ((0, import_utils80.isProduction)() && (0, import_auth12.isOrchestratedMode)(options)) {
           throw new import_auth14.JwtSecretRequiredError(options.mode);
         } else {
-          this.logger.warn(
-            "JWT_SECRET is not set; signing with a random per-process secret. Tokens will not survive a restart and will not verify across instances. Set JWT_SECRET for any deployment that mints tokens."
-          );
+          if (!(0, import_auth12.isPublicMode)(options)) {
+            this.logger.warn(
+              "JWT_SECRET is not set; signing with a random per-process secret. Tokens will not survive a restart and will not verify across instances. Set JWT_SECRET for any deployment that mints tokens."
+            );
+          }
           this.secret = getDefaultNoAuthSecret();
         }
         this.tokenStorage = this.readTokenStorage(options);
@@ -46520,7 +46912,14 @@ var init_encrypted_elicitation_store = __esm({
 });
 
 // libs/sdk/src/elicitation/store/elicitation-store.factory.ts
-function detectStorageType2(storage) {
+function detectStorageType2(storage, configuredType) {
+  if (configuredType === "redis" || configuredType === "upstash" || configuredType === "memory") {
+    return configuredType;
+  }
+  const backend = storage.type ?? storage.backendName;
+  if (backend === "redis" || backend === "upstash" || backend === "memory") {
+    return backend;
+  }
   if ((0, import_utils84.getEnv)("UPSTASH_REDIS_REST_URL")) {
     return "upstash";
   }
@@ -46610,7 +47009,8 @@ async function createElicitationStore(options = {}) {
       });
     }
   }
-  if (finalStorageConfig?.type === "vercel-kv" || (0, import_utils84.getEnv)("KV_REST_API_URL")) {
+  const explicitBackend = Boolean(storageConfig || redis);
+  if (finalStorageConfig?.type === "vercel-kv" || !explicitBackend && (0, import_utils84.getEnv)("KV_REST_API_URL")) {
     throw new ElicitationNotSupportedError(
       "Vercel KV is not supported for elicitation stores. Elicitation requires pub/sub for cross-node result routing, which Vercel KV does not support. Use Redis or Upstash instead."
     );
@@ -46631,7 +47031,7 @@ async function createElicitationStore(options = {}) {
     );
   }
   let store = new StorageElicitationStore(storage, logger);
-  const type = detectStorageType2(storage);
+  const type = detectStorageType2(storage, finalStorageConfig?.type);
   const encryptionEnabled = encryption?.enabled ?? "auto";
   const encryptionSecret = encryption?.secret;
   const hasSecret = encryptionSecret || isElicitationEncryptionAvailable();
@@ -49458,6 +49858,7 @@ function createJobDefinitionStore(options, logger) {
         host: options.redis.host ?? "localhost",
         port: options.redis.port ?? 6379
       });
+      (0, import_utils88.attachRedisErrorListener)(client, { label: "JobDefinitionStore", logger: effectiveLogger });
       return {
         // Factory-created client lifetime is bound to the store, so the store
         // must close it on dispose() — pass ownsClient: true.
@@ -49473,10 +49874,11 @@ function createJobDefinitionStore(options, logger) {
     type: "memory"
   };
 }
-var noopFn, noopLogger2;
+var import_utils88, noopFn, noopLogger2;
 var init_job_definition_store_factory = __esm({
   "libs/sdk/src/job/store/job-definition-store.factory.ts"() {
     "use strict";
+    import_utils88 = require("@frontmcp/utils");
     init_memory_job_definition_store();
     noopFn = () => {
     };
@@ -49669,6 +50071,7 @@ function createJobStateStore(options, logger) {
         host: options.redis.host ?? "localhost",
         port: options.redis.port ?? 6379
       });
+      (0, import_utils89.attachRedisErrorListener)(client, { label: "JobStateStore", logger });
       return {
         store: new RedisJobStateStore2(client, logger, keyPrefix, ttlSeconds),
         type: "redis"
@@ -49682,9 +50085,11 @@ function createJobStateStore(options, logger) {
     type: "memory"
   };
 }
+var import_utils89;
 var init_job_state_store_factory = __esm({
   "libs/sdk/src/job/store/job-state-store.factory.ts"() {
     "use strict";
+    import_utils89 = require("@frontmcp/utils");
     init_memory_job_state_store();
   }
 });
@@ -50555,15 +50960,15 @@ var init_skill_session_types = __esm({
 });
 
 // libs/sdk/src/skill/session/skill-session.manager.ts
-var import_utils88, SkillSessionManager;
+var import_utils90, SkillSessionManager;
 var init_skill_session_manager = __esm({
   "libs/sdk/src/skill/session/skill-session.manager.ts"() {
     "use strict";
-    import_utils88 = require("@frontmcp/utils");
+    import_utils90 = require("@frontmcp/utils");
     init_errors();
     init_skill_session_types();
-    SkillSessionManager = class extends import_utils88.EventEmitter {
-      storage = new import_utils88.AsyncLocalStorage();
+    SkillSessionManager = class extends import_utils90.EventEmitter {
+      storage = new import_utils90.AsyncLocalStorage();
       options;
       logger;
       store;
@@ -51762,11 +52167,11 @@ function createSkillHttpAuthValidator(skillsConfig, logger) {
     logger
   });
 }
-var import_utils89, SkillHttpAuthValidator;
+var import_utils91, SkillHttpAuthValidator;
 var init_skill_http_auth = __esm({
   "libs/sdk/src/skill/auth/skill-http-auth.ts"() {
     "use strict";
-    import_utils89 = require("@frontmcp/utils");
+    import_utils91 = require("@frontmcp/utils");
     init_common();
     SkillHttpAuthValidator = class {
       skillsConfig;
@@ -51848,7 +52253,7 @@ var init_skill_http_auth = __esm({
           const keyBytes = encoder5.encode(key);
           if (keyBytes.length === candidateBytes.length) {
             try {
-              if ((0, import_utils89.timingSafeEqual)(keyBytes, candidateBytes)) {
+              if ((0, import_utils91.timingSafeEqual)(keyBytes, candidateBytes)) {
                 found = true;
               }
             } catch {
@@ -52129,6 +52534,7 @@ async function createRedisCache(redis, keyPrefix, ttlMs, logger) {
     enableReadyCheck: false,
     maxRetriesPerRequest: 3
   });
+  (0, import_utils92.attachRedisErrorListener)(client, { label: "SkillHttpCache" });
   await client.connect();
   return new RedisSkillHttpCache({
     getClient: async () => client,
@@ -52136,9 +52542,11 @@ async function createRedisCache(redis, keyPrefix, ttlMs, logger) {
     ttlMs
   });
 }
+var import_utils92;
 var init_skill_http_cache_factory = __esm({
   "libs/sdk/src/skill/cache/skill-http-cache.factory.ts"() {
     "use strict";
+    import_utils92 = require("@frontmcp/utils");
     init_skill_http_cache();
   }
 });
@@ -55309,15 +55717,15 @@ async function readSkillFileByPath(instance, filePath) {
   let candidatePath;
   for (const [subdir, configured] of candidateDirs) {
     if (segments[0] !== subdir) continue;
-    const dir = configured ? (0, import_utils91.isAbsolute)(configured) ? configured : (0, import_utils91.pathResolve)(baseDir, configured) : (0, import_utils91.joinPath)(baseDir, subdir);
-    candidatePath = (0, import_utils91.pathResolve)(dir, ...segments.slice(1));
+    const dir = configured ? (0, import_utils94.isAbsolute)(configured) ? configured : (0, import_utils94.pathResolve)(baseDir, configured) : (0, import_utils94.joinPath)(baseDir, subdir);
+    candidatePath = (0, import_utils94.pathResolve)(dir, ...segments.slice(1));
     if (!isInside(candidatePath, dir)) {
       throw new PublicMcpError(`Invalid file path "${filePath}".`, "INVALID_PARAMS", 400);
     }
     break;
   }
   if (!candidatePath) {
-    candidatePath = (0, import_utils91.pathResolve)(baseDir, ...segments);
+    candidatePath = (0, import_utils94.pathResolve)(baseDir, ...segments);
     if (!isInside(candidatePath, baseDir)) {
       throw new PublicMcpError(`Invalid file path "${filePath}".`, "INVALID_PARAMS", 400);
     }
@@ -55325,7 +55733,7 @@ async function readSkillFileByPath(instance, filePath) {
   const mimeType = guessMimeType(filePath);
   let buffer;
   try {
-    buffer = await (0, import_utils91.readFileBuffer)(candidatePath);
+    buffer = await (0, import_utils94.readFileBuffer)(candidatePath);
   } catch (err) {
     if (isFileMissingError(err)) {
       throw new ResourceNotFoundError(`skill://${instance.getSkillPath()}/${filePath}`);
@@ -55368,7 +55776,7 @@ async function tryResolvedSubFile(instance, kind, tail) {
     const resolvedPath = resolveEntryPath2(instance, kind, absolutePath, filename);
     if (!resolvedPath) continue;
     try {
-      const buf = await (0, import_utils91.readFileBuffer)(resolvedPath);
+      const buf = await (0, import_utils94.readFileBuffer)(resolvedPath);
       const text = (Buffer.isBuffer(buf) ? buf : Buffer.from(buf)).toString("utf-8");
       return parseSkillMdFrontmatter(text).body;
     } catch (err) {
@@ -55381,18 +55789,18 @@ async function tryResolvedSubFile(instance, kind, tail) {
   return void 0;
 }
 function resolveEntryPath2(instance, kind, absolutePath, filename) {
-  if (absolutePath && (0, import_utils91.isAbsolute)(absolutePath)) return absolutePath;
+  if (absolutePath && (0, import_utils94.isAbsolute)(absolutePath)) return absolutePath;
   if (!filename) return void 0;
   const baseDir = instance.getBaseDir();
   const configured = instance.getResources()?.[kind];
   let dir;
-  if (configured && (0, import_utils91.isAbsolute)(configured)) {
+  if (configured && (0, import_utils94.isAbsolute)(configured)) {
     dir = configured;
   } else if (baseDir) {
-    dir = configured ? (0, import_utils91.pathResolve)(baseDir, configured) : (0, import_utils91.joinPath)(baseDir, kind);
+    dir = configured ? (0, import_utils94.pathResolve)(baseDir, configured) : (0, import_utils94.joinPath)(baseDir, kind);
   }
   if (!dir) return void 0;
-  const resolved = (0, import_utils91.pathResolve)(dir, filename);
+  const resolved = (0, import_utils94.pathResolve)(dir, filename);
   if (!isInside(resolved, dir)) return void 0;
   return resolved;
 }
@@ -55424,11 +55832,11 @@ function isInside(child, parent) {
   const parentPrefix = normParent.endsWith("/") ? normParent : `${normParent}/`;
   return normChild === normParent || normChild.startsWith(parentPrefix);
 }
-var import_utils91;
+var import_utils94;
 var init_sep_2640_resource_helpers = __esm({
   "libs/sdk/src/skill/sep-2640/sep-2640.resource-helpers.ts"() {
     "use strict";
-    import_utils91 = require("@frontmcp/utils");
+    import_utils94 = require("@frontmcp/utils");
     init_errors();
     init_skill_filter_helper();
     init_skill_md_parser();
@@ -55655,17 +56063,17 @@ async function resolveLastModifiedForSkill(skill) {
     return void 0;
   }
   try {
-    const s = await (0, import_utils92.stat)(record.filePath);
+    const s = await (0, import_utils95.stat)(record.filePath);
     return s.mtime instanceof Date ? s.mtime.toISOString() : void 0;
   } catch {
     return void 0;
   }
 }
-var import_utils92;
+var import_utils95;
 var init_sep_2640_last_modified = __esm({
   "libs/sdk/src/skill/sep-2640/sep-2640.last-modified.ts"() {
     "use strict";
-    import_utils92 = require("@frontmcp/utils");
+    import_utils95 = require("@frontmcp/utils");
   }
 });
 
@@ -55855,7 +56263,7 @@ function createDefaultSigner(mod, logger) {
       "[skill-audit] refusing to use the default HS256 signer in production. Configure skillsConfig.audit.signer with a host-managed key (e.g. RS256 pointing at the same key registry your bundle signing uses)."
     );
   }
-  const bytes = (0, import_utils93.randomBytes)(32);
+  const bytes = (0, import_utils96.randomBytes)(32);
   logger.warn(
     "[skill-audit] no audit signer configured \u2014 using process-local HS256 with a CSPRNG-generated secret. Records signed by this instance cannot be verified after restart. Configure skillsConfig.audit.signer for production."
   );
@@ -55867,12 +56275,12 @@ function createDefaultStore(mod, logger) {
   );
   return new mod.MemoryAuditStore();
 }
-var import_di39, import_utils93, injectedFactory;
+var import_di39, import_utils96, injectedFactory;
 var init_skill_audit_helper = __esm({
   "libs/sdk/src/skill/skill-audit.helper.ts"() {
     "use strict";
     import_di39 = require("@frontmcp/di");
-    import_utils93 = require("@frontmcp/utils");
+    import_utils96 = require("@frontmcp/utils");
   }
 });
 
@@ -55944,6 +56352,51 @@ var init_skill_scope_helper = __esm({
   }
 });
 
+// libs/sdk/src/tool/ui/ui-option-warnings.ts
+function describeIgnoredUiOptions(toolName, ui) {
+  if (!ui) return [];
+  const messages = [];
+  const ignored = IGNORED_UI_OPTIONS.filter((key) => ui[key] !== void 0);
+  if (ignored.length > 0) {
+    messages.push(
+      `Tool "${toolName}": \`ui.${ignored.join("`, `ui.")}\` ${ignored.length === 1 ? "is" : "are"} accepted but not used yet, so ${ignored.length === 1 ? "it has" : "they have"} no effect.`
+    );
+  }
+  const mode = ui["servingMode"];
+  if (UNSUPPORTED_SERVING_MODES.includes(mode)) {
+    messages.push(
+      `Tool "${toolName}": \`ui.servingMode: '${String(mode)}'\` is not implemented; the widget is served inline, as with \`servingMode: 'inline'\`.`
+    );
+  }
+  if (mode === "hybrid") {
+    messages.push(
+      `Tool "${toolName}": \`ui.servingMode: 'hybrid'\` sends only a reference in \`_meta['ui/component']\` ({ type, hash, toolName }), not the component code; the widget is rendered from its \`ui://\` resource.`
+    );
+  }
+  return messages;
+}
+var IGNORED_UI_OPTIONS, UNSUPPORTED_SERVING_MODES;
+var init_ui_option_warnings = __esm({
+  "libs/sdk/src/tool/ui/ui-option-warnings.ts"() {
+    "use strict";
+    IGNORED_UI_OPTIONS = [
+      "widgetDescription",
+      "widgetAccessible",
+      "displayMode",
+      "prefersBorder",
+      "sandboxDomain",
+      "contentSecurity",
+      "hydrate",
+      "runtimeOptions",
+      "mdxComponents",
+      "bundlingMode",
+      "uiType",
+      "htmlResponsePrefix"
+    ];
+    UNSUPPORTED_SERVING_MODES = ["direct-url", "custom-url"];
+  }
+});
+
 // libs/sdk/src/transport/bus/redis-transport-bus.ts
 var DEFAULT_BUS_PREFIX, DEFAULT_BUS_TTL_SECONDS, REVOKE_LUA, RedisTransportBus;
 var init_redis_transport_bus = __esm({
@@ -56073,10 +56526,11 @@ var redis_event_store_exports = {};
 __export(redis_event_store_exports, {
   RedisEventStore: () => RedisEventStore
 });
-var RedisEventStore;
+var import_utils97, RedisEventStore;
 var init_redis_event_store = __esm({
   "libs/sdk/src/transport/event-stores/redis.event-store.ts"() {
     "use strict";
+    import_utils97 = require("@frontmcp/utils");
     init_sdk_errors();
     RedisEventStore = class {
       client;
@@ -56120,6 +56574,9 @@ var init_redis_event_store = __esm({
             enableReadyCheck: false,
             maxRetriesPerRequest: 3
           });
+          (0, import_utils97.attachRedisErrorListener)(this.client, {
+            label: "RedisEventStore"
+          });
           await this.client.connect();
         }
         return this.client;
@@ -56512,11 +56969,11 @@ function createSqliteSessionStore(options, logger) {
   logger?.info("[SessionStoreFactory] Creating SQLite session store", { path: options.path });
   return new SqliteSessionStore(options);
 }
-var import_utils94;
+var import_utils98;
 var init_session_store_factory = __esm({
   "libs/sdk/src/auth/session/session-store.factory.ts"() {
     "use strict";
-    import_utils94 = require("@frontmcp/utils");
+    import_utils98 = require("@frontmcp/utils");
     init_common();
   }
 });
@@ -56591,14 +57048,14 @@ function toClientInfo(value) {
   const { name: name44, version } = value;
   return typeof name44 === "string" && typeof version === "string" ? { name: name44, version } : void 0;
 }
-var import_auth55, import_lazy_zod102, import_protocol52, import_utils95, plan37, subscriptionParamsSchema, requestIdSchema, stateSchema37, name38, Stage38, encoder3, TRACE_META_KEYS, HandleMcp20260728Flow;
+var import_auth55, import_lazy_zod102, import_protocol52, import_utils99, plan37, subscriptionParamsSchema, requestIdSchema, stateSchema37, name38, Stage38, encoder3, TRACE_META_KEYS, HandleMcp20260728Flow;
 var init_handle_mcp_20260728_flow = __esm({
   "libs/sdk/src/transport/flows/handle.mcp-20260728.flow.ts"() {
     "use strict";
     import_auth55 = require("@frontmcp/auth");
     import_lazy_zod102 = require("@frontmcp/lazy-zod");
     import_protocol52 = require("@frontmcp/protocol");
-    import_utils95 = require("@frontmcp/utils");
+    import_utils99 = require("@frontmcp/utils");
     init_common();
     init_context();
     init_notification();
@@ -56696,7 +57153,7 @@ var init_handle_mcp_20260728_flow = __esm({
         if (!context) return (fn) => fn();
         const storage = this.scope.providers.get(FrontMcpContextStorage);
         return async (fn) => {
-          await (0, import_utils95.runRequestExclusive)(() => storage.runWithContext(context, fn));
+          await (0, import_utils99.runRequestExclusive)(() => storage.runWithContext(context, fn));
         };
       }
       findToolSchema(scope, toolName) {
@@ -56773,7 +57230,7 @@ var init_handle_mcp_20260728_flow = __esm({
         const sink = new RequestNotificationSink(logLevel, progressToken);
         const clientInfo = toClientInfo(meta[import_protocol52.MCP_20260728_META.clientInfo]);
         if (clientInfo) {
-          const platformType = detectAIPlatform(clientInfo, this.scope.metadata.transport?.platformDetection);
+          const platformType = detectPlatformFromCapabilities(clientCapabilities) ?? detectAIPlatform(clientInfo, this.scope.metadata.transport?.platformDetection);
           this.tryGetContext()?.setClientInfo(clientInfo, platformType);
         }
         const dispatchOptions = {
@@ -56871,6 +57328,29 @@ var init_handle_mcp_20260728_flow = __esm({
   }
 });
 
+// libs/sdk/src/ha/ha-headers.ts
+function applyMachineIdHeader(response) {
+  if ((0, import_utils100.getRuntimeContext)().deployment !== "distributed") return false;
+  response.setHeader(DEFAULT_FRONTMCP_MACHINE_ID_HEADER, (0, import_utils100.getMachineId)());
+  return true;
+}
+function applyNodeAffinity(response, request) {
+  if (!applyMachineIdHeader(response)) return;
+  const cookie = (0, import_utils100.buildSetCookie)({ name: DEFAULT_FRONTMCP_NODE_COOKIE, value: (0, import_utils100.getMachineId)() }, request);
+  if (!cookie) return;
+  const existing = response.getHeader("Set-Cookie");
+  const existingArr = Array.isArray(existing) ? existing : existing ? [String(existing)] : [];
+  response.setHeader("Set-Cookie", [...existingArr, cookie]);
+}
+var import_utils100;
+var init_ha_headers = __esm({
+  "libs/sdk/src/ha/ha-headers.ts"() {
+    "use strict";
+    import_utils100 = require("@frontmcp/utils");
+    init_ha_constants();
+  }
+});
+
 // libs/sdk/src/skill/skill-mode.utils.ts
 function detectSkillsOnlyMode(query) {
   if (!query) return false;
@@ -56899,16 +57379,40 @@ function getQuerySessionId2(urlPath) {
     return void 0;
   }
 }
-var import_lazy_zod103, import_utils96, plan38, stateSessionSchema, stateSchema38, name39, Stage39, HandleSseFlow;
+function resolveLegacySseSession(params) {
+  const { rawHeader, requestUrl, authorizationSession, createSession } = params;
+  const rawMcpSessionHeader = typeof rawHeader === "string" ? rawHeader : void 0;
+  const mcpSessionHeader = validateMcpSessionHeader(rawMcpSessionHeader);
+  const querySessionId = getQuerySessionId2(requestUrl);
+  const validatedQuerySessionId = querySessionId ? validateMcpSessionHeader(querySessionId) : void 0;
+  if (rawHeader !== void 0 && !mcpSessionHeader) {
+    return { responded404: true, createdNew: false };
+  }
+  if (querySessionId !== void 0 && !validatedQuerySessionId) {
+    return { responded404: true, createdNew: false };
+  }
+  const effectiveSessionId = mcpSessionHeader ?? validatedQuerySessionId;
+  if (effectiveSessionId) {
+    if (authorizationSession?.id === effectiveSessionId) {
+      return { session: authorizationSession, createdNew: false, responded404: false };
+    }
+    return { responded404: true, createdNew: false };
+  }
+  if (authorizationSession) {
+    return { session: authorizationSession, createdNew: false, responded404: false };
+  }
+  return { session: createSession(), createdNew: true, responded404: false };
+}
+var import_lazy_zod103, import_utils101, plan38, stateSessionSchema, stateSchema38, name39, Stage39, HandleSseFlow;
 var init_handle_sse_flow = __esm({
   "libs/sdk/src/transport/flows/handle.sse.flow.ts"() {
     "use strict";
     import_lazy_zod103 = require("@frontmcp/lazy-zod");
-    import_utils96 = require("@frontmcp/utils");
+    import_utils101 = require("@frontmcp/utils");
     init_session_id_utils();
     init_common();
     init_errors();
-    init_ha_constants();
+    init_ha_headers();
     init_skill_mode_utils();
     plan38 = {
       pre: ["parseInput", "router"],
@@ -56940,39 +57444,26 @@ var init_handle_sse_flow = __esm({
         const { request } = this.rawInput;
         const authorization = request[ServerRequestTokens.auth];
         const { token } = authorization;
-        const raw = request.headers?.["mcp-session-id"];
-        const rawMcpSessionHeader = typeof raw === "string" ? raw : void 0;
-        const mcpSessionHeader = validateMcpSessionHeader(rawMcpSessionHeader);
         const anyReq = request;
-        const querySessionId = getQuerySessionId2(anyReq.url ?? anyReq.path);
-        const validatedQuerySessionId = querySessionId ? validateMcpSessionHeader(querySessionId) : void 0;
-        if (raw !== void 0 && !mcpSessionHeader) {
-          this.respond(httpRespond.sessionNotFound("invalid session id"));
-          return;
-        }
-        if (querySessionId !== void 0 && !validatedQuerySessionId) {
+        const resolution = resolveLegacySseSession({
+          rawHeader: request.headers?.["mcp-session-id"],
+          requestUrl: anyReq.url ?? anyReq.path,
+          authorizationSession: authorization.session,
+          createSession: () => {
+            const query = request.query;
+            const skillsOnlyMode = detectSkillsOnlyMode(query);
+            return createSessionId("legacy-sse", token, {
+              userAgent: request.headers?.["user-agent"],
+              platformDetectionConfig: this.scope.metadata.transport?.platformDetection,
+              skillsOnlyMode
+            });
+          }
+        });
+        if (resolution.responded404 || !resolution.session) {
           this.respond(httpRespond.sessionNotFound("invalid session id"));
           return;
         }
-        const effectiveSessionId = mcpSessionHeader ?? validatedQuerySessionId;
-        let session;
-        if (effectiveSessionId) {
-          if (authorization.session?.id === effectiveSessionId) {
-            session = authorization.session;
-          } else {
-            session = { id: effectiveSessionId };
-          }
-        } else if (authorization.session) {
-          session = authorization.session;
-        } else {
-          const query = request.query;
-          const skillsOnlyMode = detectSkillsOnlyMode(query);
-          session = createSessionId("legacy-sse", token, {
-            userAgent: request.headers?.["user-agent"],
-            platformDetectionConfig: this.scope.metadata.transport?.platformDetection,
-            skillsOnlyMode
-          });
-        }
+        const session = resolution.session;
         this.state.set(stateSchema38.parse({ token, session }));
       }
       async router() {
@@ -56995,16 +57486,7 @@ var init_handle_sse_flow = __esm({
         const { request, response } = this.rawInput;
         const { token, session } = this.state.required;
         const transport = await transportService.createTransporter("sse", token, session.id, response);
-        if ((0, import_utils96.getRuntimeContext)().deployment === "distributed") {
-          const nodeId = (0, import_utils96.getMachineId)();
-          response.setHeader(DEFAULT_FRONTMCP_MACHINE_ID_HEADER, nodeId);
-          const cookie = (0, import_utils96.buildSetCookie)({ name: DEFAULT_FRONTMCP_NODE_COOKIE, value: nodeId }, request);
-          if (cookie) {
-            const existing = response.getHeader("Set-Cookie");
-            const existingArr = Array.isArray(existing) ? existing : existing ? [String(existing)] : [];
-            response.setHeader("Set-Cookie", [...existingArr, cookie]);
-          }
-        }
+        applyNodeAffinity(response, request);
         await transport.initialize(request, response);
         this.handled();
       }
@@ -57020,12 +57502,12 @@ var init_handle_sse_flow = __esm({
         const { request, response } = this.rawInput;
         const { token, session } = this.state.required;
         const transport = await transportService.getTransporter("sse", token, session.id);
-        if (!transport && (0, import_utils96.getRuntimeContext)().deployment === "distributed") {
+        if (!transport && (0, import_utils101.getRuntimeContext)().deployment === "distributed") {
           const storedSession = await transportService.getStoredSession("sse", token, session.id);
           if (storedSession) {
             const haManager = this.scope.haManager;
             const relay = haManager?.getRelay();
-            if (relay && storedSession.session.nodeId && storedSession.session.nodeId !== (0, import_utils96.getMachineId)()) {
+            if (relay && storedSession.session.nodeId && storedSession.session.nodeId !== (0, import_utils101.getMachineId)()) {
               const isAlive2 = await haManager.isNodeAlive(storedSession.session.nodeId);
               if (isAlive2) {
                 try {
@@ -57120,9 +57602,10 @@ var init_handle_stateless_http_flow = __esm({
     import_protocol53 = require("@frontmcp/protocol");
     init_common();
     init_errors();
+    init_ha_headers();
     init_transport_types();
     plan39 = {
-      pre: ["parseInput", "router"],
+      pre: ["applyNodeHeaders", "parseInput", "router"],
       execute: ["handleRequest"],
       post: [],
       finalize: ["cleanup"]
@@ -57136,6 +57619,9 @@ var init_handle_stateless_http_flow = __esm({
     ({ Stage: Stage40 } = FlowHooksOf(name40));
     HandleStatelessHttpFlow = class extends FlowBase {
       name = name40;
+      async applyNodeHeaders() {
+        applyMachineIdHeader(this.rawInput.response);
+      }
       async parseInput() {
         const { request } = this.rawInput;
         const logger = this.scope.logger.child("HandleStatelessHttpFlow");
@@ -57197,6 +57683,9 @@ var init_handle_stateless_http_flow = __esm({
         this.handled();
       }
     };
+    __decorateClass([
+      Stage40("applyNodeHeaders")
+    ], HandleStatelessHttpFlow.prototype, "applyNodeHeaders", 1);
     __decorateClass([
       Stage40("parseInput")
     ], HandleStatelessHttpFlow.prototype, "parseInput", 1);
@@ -57251,11 +57740,11 @@ var init_ext_apps_types = __esm({
 function createExtAppsMessageHandler(options) {
   return new ExtAppsMessageHandler(options);
 }
-var import_utils97, ExtAppsMessageHandler, ExtAppsError, ExtAppsMethodNotFoundError, ExtAppsInvalidParamsError, ExtAppsNotSupportedError, ExtAppsToolNotFoundError;
+var import_utils102, ExtAppsMessageHandler, ExtAppsError, ExtAppsMethodNotFoundError, ExtAppsInvalidParamsError, ExtAppsNotSupportedError, ExtAppsToolNotFoundError;
 var init_ext_apps_handler = __esm({
   "libs/sdk/src/ext-apps/ext-apps.handler.ts"() {
     "use strict";
-    import_utils97 = require("@frontmcp/utils");
+    import_utils102 = require("@frontmcp/utils");
     init_ext_apps_types();
     ExtAppsMessageHandler = class {
       context;
@@ -57299,7 +57788,7 @@ var init_ext_apps_handler = __esm({
               code: errorCode,
               message: errorMessage,
               // Only include stack traces in development to avoid leaking internals in production
-              data: (0, import_utils97.isDevelopment)() && error instanceof Error ? { stack: error.stack } : void 0
+              data: (0, import_utils102.isDevelopment)() && error instanceof Error ? { stack: error.stack } : void 0
             }
           };
         }
@@ -57585,7 +58074,7 @@ function resolveStreamableHttpSession(params) {
     if (authorizationSession?.id === mcpSessionHeader) {
       return { session: authorizationSession, createdNew: false, responded404: false };
     }
-    return { session: { id: mcpSessionHeader }, createdNew: false, responded404: false };
+    return { responded404: true, createdNew: false };
   }
   if (authorizationSession) {
     return { session: authorizationSession, createdNew: false, responded404: false };
@@ -57661,22 +58150,21 @@ async function lookupStreamableHttpTransport(params) {
   }
   return { kind: "session-not-initialized", recreationError };
 }
-var import_lazy_zod105, import_protocol54, import_utils98, plan40, stateSessionSchema2, stateSchema40, name41, Stage41, HandleStreamableHttpFlow;
+var import_lazy_zod105, import_protocol54, plan40, stateSessionSchema2, stateSchema40, name41, Stage41, HandleStreamableHttpFlow;
 var init_handle_streamable_http_flow = __esm({
   "libs/sdk/src/transport/flows/handle.streamable-http.flow.ts"() {
     "use strict";
     import_lazy_zod105 = require("@frontmcp/lazy-zod");
     import_protocol54 = require("@frontmcp/protocol");
-    import_utils98 = require("@frontmcp/utils");
     init_session_id_utils();
     init_common();
     init_errors();
     init_ext_apps2();
-    init_ha_constants();
+    init_ha_headers();
     init_skill_mode_utils();
     init_mcp_surface();
     plan40 = {
-      pre: ["parseInput", "router"],
+      pre: ["applyNodeHeaders", "parseInput", "router"],
       execute: ["onInitialize", "onMessage", "onElicitResult", "onSseListener", "onExtApps"],
       post: [],
       finalize: ["cleanup"]
@@ -57702,6 +58190,9 @@ var init_handle_streamable_http_flow = __esm({
     ({ Stage: Stage41 } = FlowHooksOf(name41));
     HandleStreamableHttpFlow = class extends FlowBase {
       name = name41;
+      async applyNodeHeaders() {
+        applyMachineIdHeader(this.rawInput.response);
+      }
       async parseInput() {
         const { request } = this.rawInput;
         const authorization = request[ServerRequestTokens.auth];
@@ -57733,7 +58224,7 @@ var init_handle_streamable_http_flow = __esm({
           });
         }
         if (sessionResolution.responded404 || !sessionResolution.session) {
-          logger.warn("parseInput: invalid mcp-session-id header");
+          logger.warn("parseInput: mcp-session-id is not a session this server verified");
           this.respond(httpRespond.sessionNotFound("invalid session id"));
           return;
         }
@@ -57800,16 +58291,7 @@ var init_handle_streamable_http_flow = __esm({
               return;
             }
           }
-          if ((0, import_utils98.getRuntimeContext)().deployment === "distributed") {
-            const nodeId = (0, import_utils98.getMachineId)();
-            response.setHeader(DEFAULT_FRONTMCP_MACHINE_ID_HEADER, nodeId);
-            const cookie = (0, import_utils98.buildSetCookie)({ name: DEFAULT_FRONTMCP_NODE_COOKIE, value: nodeId }, request);
-            if (cookie) {
-              const existing = response.getHeader("Set-Cookie");
-              const existingArr = Array.isArray(existing) ? existing : existing ? [String(existing)] : [];
-              response.setHeader("Set-Cookie", [...existingArr, cookie]);
-            }
-          }
+          applyNodeAffinity(response, request);
           logger.info("onInitialize: transport created, calling initialize");
           await transport.initialize(request, response);
           logger.info("onInitialize: completed successfully");
@@ -57992,6 +58474,17 @@ var init_handle_streamable_http_flow = __esm({
         const logger = this.scopeLogger.child("handle:streamable-http:onExtApps");
         const { request, response } = this.rawInput;
         const { token, session } = this.state.required;
+        if (this.scope.metadata.extApps?.enabled === false) {
+          const rpc = request.body;
+          logger.verbose("onExtApps: ext-apps disabled by config", { method: rpc?.method });
+          response.status(200).json({
+            jsonrpc: "2.0",
+            id: rpc?.id ?? null,
+            error: { code: -32601, message: `Method not found: ${rpc?.method}` }
+          });
+          this.handled();
+          return;
+        }
         logger.info("onExtApps: starting", {
           sessionId: session.id?.slice(0, 20),
           method: request.body?.method
@@ -58043,8 +58536,20 @@ var init_handle_streamable_http_flow = __esm({
         const hostCapabilities = {
           serverToolProxy: configuredCapabilities?.serverToolProxy ?? true,
           logging: configuredCapabilities?.logging ?? true,
-          ...configuredCapabilities
+          ...configuredCapabilities,
+          // Only advertise what this host can serve: the context below provides callTool and nothing else
+          openLink: false,
+          modelContextUpdate: false,
+          widgetTools: false
         };
+        const unsupported = ["openLink", "modelContextUpdate", "widgetTools"].filter(
+          (key) => configuredCapabilities?.[key] === true
+        );
+        if (unsupported.length > 0) {
+          logger.warn(
+            `onExtApps: extApps.hostCapabilities ${unsupported.join(", ")} are not supported yet and are not advertised`
+          );
+        }
         const handler = createExtAppsMessageHandler({
           context: {
             sessionId: session.id,
@@ -58078,6 +58583,9 @@ var init_handle_streamable_http_flow = __esm({
         this.handled();
       }
     };
+    __decorateClass([
+      Stage41("applyNodeHeaders")
+    ], HandleStreamableHttpFlow.prototype, "applyNodeHeaders", 1);
     __decorateClass([
       Stage41("parseInput")
     ], HandleStreamableHttpFlow.prototype, "parseInput", 1);
@@ -58122,21 +58630,21 @@ var init_handle_streamable_http_flow = __esm({
 });
 
 // libs/sdk/src/transport/transport.error.ts
-var import_utils99, JSON_RPC2, rpcError, rpcRequest;
+var import_utils103, JSON_RPC2, rpcError, rpcRequest;
 var init_transport_error = __esm({
   "libs/sdk/src/transport/transport.error.ts"() {
     "use strict";
-    import_utils99 = require("@frontmcp/utils");
+    import_utils103 = require("@frontmcp/utils");
     JSON_RPC2 = "2.0";
     rpcError = (message, requestId) => ({
       jsonrpc: JSON_RPC2,
       error: { code: -32e3, message },
-      id: requestId ?? (0, import_utils99.randomUUID)()
+      id: requestId ?? (0, import_utils103.randomUUID)()
       // change it to request id + random
     });
     rpcRequest = (requestId, method, params) => ({
       jsonrpc: JSON_RPC2,
-      id: requestId ?? (0, import_utils99.randomUUID)(),
+      id: requestId ?? (0, import_utils103.randomUUID)(),
       method,
       ...params !== void 0 && { params }
     });
@@ -58199,14 +58707,14 @@ var init_host_validation = __esm({
 });
 
 // libs/sdk/src/transport/adapters/base-sse-transport.ts
-var import_content_type, import_raw_body, import_protocol55, import_utils100, MAXIMUM_MESSAGE_SIZE, SSEServerTransport;
+var import_content_type, import_raw_body, import_protocol55, import_utils104, MAXIMUM_MESSAGE_SIZE, SSEServerTransport;
 var init_base_sse_transport = __esm({
   "libs/sdk/src/transport/adapters/base-sse-transport.ts"() {
     "use strict";
     import_content_type = __toESM(require("content-type"));
     import_raw_body = __toESM(require("raw-body"));
     import_protocol55 = require("@frontmcp/protocol");
-    import_utils100 = require("@frontmcp/utils");
+    import_utils104 = require("@frontmcp/utils");
     init_transport_errors();
     init_host_validation();
     MAXIMUM_MESSAGE_SIZE = "4mb";
@@ -58217,7 +58725,7 @@ var init_base_sse_transport = __esm({
       constructor(_endpoint, res, options) {
         this._endpoint = _endpoint;
         this.res = res;
-        this._sessionId = options?.sessionId ?? (0, import_utils100.randomUUID)();
+        this._sessionId = options?.sessionId ?? (0, import_utils104.randomUUID)();
         this._options = options || { enableDnsRebindingProtection: false };
       }
       _endpoint;
@@ -59663,11 +60171,11 @@ var init_transport_remote = __esm({
 });
 
 // libs/sdk/src/transport/transport.registry.ts
-var import_utils101, TransportService;
+var import_utils105, SESSION_STORE_RETRY_BASE_MS, SESSION_STORE_RETRY_MAX_MS, TransportService;
 var init_transport_registry = __esm({
   "libs/sdk/src/transport/transport.registry.ts"() {
     "use strict";
-    import_utils101 = require("@frontmcp/utils");
+    import_utils105 = require("@frontmcp/utils");
     init_session_store_factory();
     init_transport_errors();
     init_handle_mcp_20260728_flow();
@@ -59677,6 +60185,8 @@ var init_transport_registry = __esm({
     init_transport_local();
     init_transport_remote();
     init_transport_types();
+    SESSION_STORE_RETRY_BASE_MS = 1e3;
+    SESSION_STORE_RETRY_MAX_MS = 3e4;
     TransportService = class {
       ready;
       byType = /* @__PURE__ */ new Map();
@@ -59733,8 +60243,28 @@ var init_transport_registry = __esm({
        * Returns undefined if persistence is disabled or not configured.
        */
       getDefaultTtlMs() {
+        if (this.resolvedTtlMs !== void 0) return this.resolvedTtlMs;
         return typeof this.persistenceConfig === "object" ? this.persistenceConfig?.defaultTtlMs : void 0;
       }
+      /**
+       * TTL resolved from `persistence.defaultTtlMs`, then `persistence.redis.defaultTtlMs`, then 1 hour.
+       * Set only when a persistence backend is configured.
+       */
+      resolvedTtlMs;
+      /** Store config kept after a successful create so a failed ping can be retried. */
+      storeRetryConfig;
+      storeRetryTimer;
+      storeRetryAttempt = 0;
+      destroyed = false;
+      /** Last time a request refreshed the stored session's TTL, by session id. */
+      lastTtlRefreshAt = /* @__PURE__ */ new Map();
+      /**
+       * Redis key prefix under which session records are stored.
+       * The session store appends `session:` to the transport key prefix.
+       */
+      getSessionKeyPrefix() {
+        return `${this.transportKeyPrefix}session:`;
+      }
       constructor(scope, persistenceConfig, bus) {
         this.scope = scope;
         this.persistenceConfig = persistenceConfig;
@@ -59745,10 +60275,11 @@ var init_transport_registry = __esm({
           this.backendKind = "sqlite";
           const sqliteConfig = persistenceConfig.sqlite;
           this.transportKeyPrefix = "mcp:transport:";
+          this.resolvedTtlMs = persistenceConfig.defaultTtlMs ?? 36e5;
           this.pendingStoreConfig = {
             sqlite: sqliteConfig,
             keyPrefix: this.transportKeyPrefix,
-            defaultTtlMs: persistenceConfig.defaultTtlMs ?? 36e5
+            defaultTtlMs: this.resolvedTtlMs
           };
           this.scope.logger.info("[TransportService] sqlite session store will be initialized for transport persistence");
         } else if (persistenceConfig !== false && persistenceConfig?.redis) {
@@ -59757,43 +60288,23 @@ var init_transport_registry = __esm({
           const providerType = "provider" in redisConfig ? redisConfig.provider : "redis";
           this.backendKind = providerType === "vercel-kv" ? "vercel-kv" : "redis";
           this.transportKeyPrefix = redisConfig.keyPrefix ?? "mcp:transport:";
+          this.resolvedTtlMs = persistenceConfig.defaultTtlMs ?? redisConfig.defaultTtlMs ?? 36e5;
           this.pendingStoreConfig = {
             ...redisConfig,
             keyPrefix: this.transportKeyPrefix,
-            defaultTtlMs: persistenceConfig.defaultTtlMs ?? 36e5
-            // 1 hour default
+            defaultTtlMs: this.resolvedTtlMs
           };
           this.scope.logger.info(
             `[TransportService] ${providerType} session store will be initialized for transport persistence`
           );
         }
+        this.storeRetryConfig = this.pendingStoreConfig;
         this.ready = this.initialize();
       }
       async initialize() {
         if (this.pendingStoreConfig) {
-          try {
-            const store = await createSessionStore(this.pendingStoreConfig, this.scope.logger.child("SessionStore"));
-            this.sessionStore = store;
-            this.pendingStoreConfig = void 0;
-          } catch (error) {
-            const err = error;
-            this.scope.logger.error("[TransportService] Failed to create session store - session persistence disabled", {
-              error: err.message,
-              cause: err.cause?.message
-            });
-          }
-        }
-        if (this.sessionStore) {
-          const isConnected = this.sessionStore.ping ? await this.sessionStore.ping() : true;
-          if (!isConnected) {
-            const providerType = this.backendKind ?? "redis";
-            this.scope.logger.error(
-              `[TransportService] Failed to connect to ${providerType} - session persistence disabled`
-            );
-            await this.teardownSessionStore().catch(() => void 0);
-          } else {
-            this.scope.logger.info("[TransportService] Session store connection validated successfully");
-          }
+          const connected = await this.connectSessionStore();
+          if (!connected && this.backendKind !== "sqlite") this.scheduleSessionStoreRetry();
         }
         await this.scope.registryFlows(
           HandleStreamableHttpFlow,
@@ -59802,7 +60313,70 @@ var init_transport_registry = __esm({
           HandleMcp20260728Flow
         );
       }
+      /**
+       * Create the session store and validate the connection.
+       * Returns true when the store is usable; on failure the store is left undefined.
+       */
+      async connectSessionStore() {
+        const storeConfig = this.pendingStoreConfig ?? this.storeRetryConfig;
+        if (!storeConfig) return false;
+        try {
+          const store = await createSessionStore(storeConfig, this.scope.logger.child("SessionStore"));
+          this.sessionStore = store;
+          this.pendingStoreConfig = void 0;
+        } catch (error) {
+          const err = error;
+          this.scope.logger.error("[TransportService] Failed to create session store - session persistence disabled", {
+            error: err.message,
+            cause: err.cause?.message
+          });
+          return false;
+        }
+        const isConnected = this.sessionStore?.ping ? await this.sessionStore.ping() : true;
+        if (!isConnected) {
+          const providerType = this.backendKind ?? "redis";
+          this.scope.logger.error(`[TransportService] Failed to connect to ${providerType} - session persistence disabled`);
+          await this.teardownSessionStore().catch(() => void 0);
+          return false;
+        }
+        this.scope.logger.info("[TransportService] Session store connection validated successfully");
+        return true;
+      }
+      /**
+       * Retry the session store with exponential backoff (1s doubling to 30s) so a Redis that
+       * was down at startup is picked up when it comes back, and `/readyz` turns healthy.
+       */
+      scheduleSessionStoreRetry() {
+        if (this.destroyed || this.storeRetryTimer) return;
+        const delay = Math.min(SESSION_STORE_RETRY_MAX_MS, SESSION_STORE_RETRY_BASE_MS * 2 ** this.storeRetryAttempt);
+        this.storeRetryAttempt++;
+        this.storeRetryTimer = setTimeout(() => {
+          this.storeRetryTimer = void 0;
+          void this.retrySessionStore();
+        }, delay);
+        this.storeRetryTimer.unref?.();
+      }
+      async retrySessionStore() {
+        if (this.destroyed || this.sessionStore) return;
+        const connected = await this.connectSessionStore().catch(() => false);
+        if (this.destroyed) {
+          await this.teardownSessionStore().catch(() => void 0);
+          return;
+        }
+        if (connected) {
+          this.storeRetryAttempt = 0;
+          this.scope.logger.info("[TransportService] Session store recovered after startup failure");
+          return;
+        }
+        this.scheduleSessionStoreRetry();
+      }
       async destroy() {
+        this.destroyed = true;
+        if (this.storeRetryTimer) {
+          clearTimeout(this.storeRetryTimer);
+          this.storeRetryTimer = void 0;
+        }
+        this.lastTtlRefreshAt.clear();
         await this.teardownSessionStore();
       }
       /**
@@ -59863,10 +60437,33 @@ var init_transport_registry = __esm({
       getBackendKind() {
         return this.backendKind;
       }
+      /**
+       * Slide the stored session's TTL while this instance is serving it. Redis and Vercel KV
+       * session stores extend the TTL on read, so a plain `get` is enough. Throttled per session
+       * to a quarter of the TTL, fire-and-forget.
+       */
+      refreshStoredSessionTtl(sessionId) {
+        const store = this.sessionStore;
+        const ttlMs = this.getDefaultTtlMs();
+        if (!store || !ttlMs || this.backendKind !== "redis" && this.backendKind !== "vercel-kv") return;
+        const now = Date.now();
+        const last = this.lastTtlRefreshAt.get(sessionId);
+        if (last !== void 0 && now - last < Math.max(1e3, Math.floor(ttlMs / 4))) return;
+        this.lastTtlRefreshAt.set(sessionId, now);
+        store.get(sessionId).catch((err) => {
+          this.scope.logger.warn("[TransportService] Failed to refresh session TTL", {
+            sessionId: sessionId.slice(0, 20),
+            error: err instanceof Error ? err.message : String(err)
+          });
+        });
+      }
       async getTransporter(type, token, sessionId) {
         const key = this.keyOf(type, token, sessionId);
         const local = this.lookupLocal(key);
-        if (local) return local;
+        if (local) {
+          this.refreshStoredSessionTtl(sessionId);
+          return local;
+        }
         if (this.distributed && this.bus) {
           const location = await this.bus.lookup(key);
           if (location) {
@@ -59959,9 +60556,9 @@ var init_transport_registry = __esm({
           protocol: storedSession.session.protocol,
           createdAt: storedSession.createdAt
         });
-        const currentNodeId = (0, import_utils101.getMachineId)();
+        const currentNodeId = (0, import_utils105.getMachineId)();
         if (this.scope.haManager && storedSession.session.nodeId && storedSession.session.nodeId !== currentNodeId) {
-          const sessionKey = `${this.transportKeyPrefix}${sessionId}`;
+          const sessionKey = `${this.getSessionKeyPrefix()}${sessionId}`;
           const result = await this.scope.haManager.attemptTakeover(sessionKey, storedSession.session.nodeId);
           if (!result.claimed) {
             this.scope.logger.debug("[HA] Session already claimed by another pod", { sessionId: sessionId.slice(0, 20) });
@@ -60054,7 +60651,7 @@ var init_transport_registry = __esm({
               authorizationId: key.tokenHash,
               protocol: type === "sse" ? "sse" : "streamable-http",
               createdAt: Date.now(),
-              nodeId: (0, import_utils101.getMachineId)()
+              nodeId: (0, import_utils105.getMachineId)()
             },
             authorizationId: key.tokenHash,
             createdAt: Date.now(),
@@ -60200,7 +60797,7 @@ var init_transport_registry = __esm({
       }
       /* --------------------------------- internals -------------------------------- */
       sha256(value) {
-        return (0, import_utils101.sha256Hex)(value);
+        return (0, import_utils105.sha256Hex)(value);
       }
       /**
        * Create a history key from components.
@@ -60294,6 +60891,7 @@ var init_transport_registry = __esm({
         }
       }
       evictLocal(key) {
+        this.lastTtlRefreshAt.delete(key.sessionId);
         const typeBucket = this.byType.get(key.type);
         if (!typeBucket) return;
         const tokenBucket = typeBucket.get(key.tokenHash);
@@ -60384,9 +60982,9 @@ function persistentSessionCallerKey(authorization) {
   const sub = authorization?.user?.sub;
   if (!(0, import_auth56.isAnonymousSubject)(sub)) {
     const iss = authorization?.user?.iss;
-    return `sub:${(0, import_utils102.sha256Hex)(JSON.stringify([typeof iss === "string" ? iss : "", sub]))}`;
+    return `sub:${(0, import_utils106.sha256Hex)(JSON.stringify([typeof iss === "string" ? iss : "", sub]))}`;
   }
-  if (authorization?.token) return `token:${(0, import_utils102.sha256Hex)(authorization.token)}`;
+  if (authorization?.token) return `token:${(0, import_utils106.sha256Hex)(authorization.token)}`;
   return null;
 }
 function claimPersistentSession(session, callerKey, store) {
@@ -60399,12 +60997,12 @@ function claimPersistentSession(session, callerKey, store) {
   }
   return owners.get(session) === callerKey ? "owner" : "refused";
 }
-var import_auth56, import_utils102, owners;
+var import_auth56, import_utils106, owners;
 var init_persistent_session_owner = __esm({
   "libs/sdk/src/transport/persistent-session-owner.ts"() {
     "use strict";
     import_auth56 = require("@frontmcp/auth");
-    import_utils102 = require("@frontmcp/utils");
+    import_utils106 = require("@frontmcp/utils");
     owners = /* @__PURE__ */ new WeakMap();
   }
 });
@@ -60441,7 +61039,7 @@ async function runWebStandardMcp(scope, request, options) {
   if (options.persistent) {
     return options.persistent.transport.handleRequest(request, { authInfo: options.authInfo });
   }
-  const sessionId = `web:${(0, import_utils103.randomUUID)()}`;
+  const sessionId = `web:${(0, import_utils107.randomUUID)()}`;
   const accept = request.headers.get("accept") ?? "";
   const wantsStream = request.method === "GET" || options.sse && accept.includes("text/event-stream");
   const { mcpServer, transport } = await wireServer(scope, options.serverOptions, sessionId, void 0, !wantsStream);
@@ -60464,23 +61062,23 @@ async function runWebStandardMcp(scope, request, options) {
   }
   return response;
 }
-var import_utils103;
+var import_utils107;
 var init_web_standard_mcp = __esm({
   "libs/sdk/src/transport/web-standard-mcp.ts"() {
     "use strict";
-    import_utils103 = require("@frontmcp/utils");
+    import_utils107 = require("@frontmcp/utils");
     init_build_scoped_server_options();
   }
 });
 
 // libs/sdk/src/scope/flows/http.request.flow.ts
-var import_auth57, import_lazy_zod108, import_utils104, plan42, httpRequestStateSchema, name43, Stage43, HttpRequestFlow;
+var import_auth57, import_lazy_zod108, import_utils108, plan42, httpRequestStateSchema, name43, Stage43, HttpRequestFlow;
 var init_http_request_flow = __esm({
   "libs/sdk/src/scope/flows/http.request.flow.ts"() {
     "use strict";
     import_auth57 = require("@frontmcp/auth");
     import_lazy_zod108 = require("@frontmcp/lazy-zod");
-    import_utils104 = require("@frontmcp/utils");
+    import_utils108 = require("@frontmcp/utils");
     init_session_verify_flow();
     init_common();
     init_schema7();
@@ -60559,7 +61157,7 @@ var init_http_request_flow = __esm({
         const { request } = this.rawInput;
         this.requestStartTime = Date.now();
         const ctx = this.tryGetContext();
-        this.requestId = ctx?.requestId ?? `req-${(0, import_utils104.randomUUID)()}`;
+        this.requestId = ctx?.requestId ?? `req-${(0, import_utils108.randomUUID)()}`;
         const headers = request.headers ?? {};
         const body = request.body;
         const userAgent = headers["user-agent"];
@@ -61244,13 +61842,13 @@ var init_http_request_flow = __esm({
 });
 
 // libs/sdk/src/scope/scope.instance.ts
-var import_reflect_metadata25, import_guard8, import_utils105, SCOPE_NON_DISPATCHABLE_FLOWS, Scope;
+var import_reflect_metadata25, import_guard8, import_utils109, SCOPE_NON_DISPATCHABLE_FLOWS, Scope;
 var init_scope_instance = __esm({
   "libs/sdk/src/scope/scope.instance.ts"() {
     "use strict";
     import_reflect_metadata25 = require("reflect-metadata");
     import_guard8 = require("@frontmcp/guard");
-    import_utils105 = require("@frontmcp/utils");
+    import_utils109 = require("@frontmcp/utils");
     init_agent_registry();
     init_call_agent_flow();
     init_app_registry();
@@ -61291,8 +61889,10 @@ var init_scope_instance = __esm({
     init_tool_registry();
     init_tool_utils();
     init_ui();
+    init_ui_option_warnings();
     init_bus();
     init_event_stores();
+    init_request_state();
     init_transport_registry();
     init_http_ip_filter_flow();
     init_http_request_flow();
@@ -61316,6 +61916,8 @@ var init_scope_instance = __esm({
       transportService;
       // TODO: migrate transport service to transport.registry
       notificationService;
+      /** ioredis client owned by the HA manager and transport bus; closed in shutdown(). */
+      haRedisClient;
       toolUIRegistry;
       authUiRegistry;
       entryPath;
@@ -61383,7 +61985,7 @@ var init_scope_instance = __esm({
         await this.scopeProviders.ready;
         const scopeRef = { kind: "scope", id: this.id, ref: _Scope };
         const scopeProviders = this.scopeProviders;
-        const perf = (0, import_utils105.getEnvFlag)("FRONTMCP_PERF");
+        const perf = (0, import_utils109.getEnvFlag)("FRONTMCP_PERF");
         const t0 = perf ? performance.now() : 0;
         const mark = perf ? (label) => this.logger.info(`[PERF] ${label}: ${(performance.now() - t0).toFixed(1)}ms`) : () => {
         };
@@ -61393,24 +61995,26 @@ var init_scope_instance = __esm({
         this.scopeApps = new AppRegistry(this.scopeProviders, this.metadata.apps, scopeRef);
         this.logger.info(`Initializing ${this.metadata.apps.length} app(s)...`);
         const transportConfig = this.metadata.transport;
-        const isDistributed = (0, import_utils105.getRuntimeContext)().deployment === "distributed";
+        const isDistributed = (0, import_utils109.getRuntimeContext)().deployment === "distributed";
         if (isDistributed && this.metadata.redis && !this.cliMode) {
           try {
-            const haRedis = this.metadata.redis;
+            const haRedis = this.createHaRedisClient();
             this.haManager = HaManager.create({
               redis: haRedis,
-              nodeId: (0, import_utils105.getMachineId)(),
+              nodeId: (0, import_utils109.getMachineId)(),
               logger: this.logger
             });
             await this.haManager.start();
             this.logger.info("[HA] Manager started for distributed deployment");
           } catch (err) {
             this.logger.warn("[HA] Failed to start HA manager \u2014 running without HA", { error: err });
+            this.haManager = void 0;
+            await this.closeHaRedisClient();
           }
         }
         let transportBus;
-        if (this.haManager && isDistributed && this.metadata.redis) {
-          transportBus = new RedisTransportBus(this.metadata.redis, (0, import_utils105.getMachineId)(), {
+        if (this.haManager && this.haRedisClient && isDistributed) {
+          transportBus = new RedisTransportBus(this.haRedisClient, (0, import_utils109.getMachineId)(), {
             logger: this.logger
           });
           this.logger.info("[HA] Transport bus created for distributed session routing");
@@ -61421,11 +62025,10 @@ var init_scope_instance = __esm({
           effectivePersistence = { sqlite: resolvedTopLevelSqlite };
         }
         this.transportService = new TransportService(this, effectivePersistence, transportBus);
-        if (this.haManager && isDistributed) {
-          const persistCfg = transportConfig?.persistence;
-          const resolvedPrefix = persistCfg && typeof persistCfg === "object" && persistCfg.redis?.keyPrefix ? persistCfg.redis.keyPrefix : "mcp:transport:";
+        warnIfRequestStateKeyNotShared({ logger: this.logger, metadata: this.metadata });
+        if (this.haManager && isDistributed && this.transportService.getBackendKind() === "redis") {
           this.haManager.startOrphanScanner({
-            sessionKeyPrefix: resolvedPrefix,
+            sessionKeyPrefix: this.transportService.getSessionKeyPrefix(),
             onOrphan: (sessionId, previousNodeId) => {
               this.logger.info(
                 `[HA] Orphaned session ${sessionId.slice(0, 20)} from ${previousNodeId} \u2014 available for recreation`
@@ -61433,7 +62036,7 @@ var init_scope_instance = __esm({
             }
           });
         }
-        if ((0, import_utils105.getRuntimeContext)().deployment === "serverless") {
+        if ((0, import_utils109.getRuntimeContext)().deployment === "serverless") {
           const protocolCfg = transportConfig?.protocol;
           const hasSSE = typeof protocolCfg === "string" ? protocolCfg !== "stateless-api" : protocolCfg?.sse === true;
           if (hasSSE) {
@@ -61460,7 +62063,7 @@ var init_scope_instance = __esm({
             sqlite: elicitationSqlite,
             keyPrefix: elicitationRedis?.keyPrefix ?? "mcp:elicit:",
             logger: this.logger,
-            isEdgeRuntime: (0, import_utils105.isEdgeRuntime)()
+            isEdgeRuntime: (0, import_utils109.isEdgeRuntime)()
           });
           this._elicitationStore = elicitStore;
           this.elicitationBackendType = elicitType;
@@ -61474,14 +62077,22 @@ var init_scope_instance = __esm({
         );
         const tasksEnabledForCli = this.cliMode && hasPersistentBackend;
         const hasDistributedTaskBackend = Boolean(tasksConfig?.redis ?? this.metadata.redis);
-        const onEdgeRuntime = (0, import_utils105.isEdgeRuntime)();
+        const onEdgeRuntime = (0, import_utils109.isEdgeRuntime)();
         const tasksUnavailableOnEdge = onEdgeRuntime && !hasDistributedTaskBackend && !tasksExplicitlyEnabled;
         if (tasksUnavailableOnEdge) {
           this.logger.info(
             "[tasks] Background tasks are unavailable on this edge/serverless runtime: the in-process runner cannot continue past the HTTP response, and an in-memory store is not shared between isolates. Serving without tasks. Configure `tasks.redis` (Upstash Redis over HTTP works on Workers) to enable them."
           );
         }
-        const shouldInitTasks = !tasksExplicitlyDisabled && !tasksUnavailableOnEdge && (!this.cliMode || tasksEnabledForCli || isTaskWorker);
+        const gateTasksRedis = tasksConfig?.redis ?? this.metadata.redis;
+        const tasksUseSqlite = Boolean(tasksConfig?.sqlite ?? (gateTasksRedis ? void 0 : resolvedTopLevelSqlite));
+        const tasksUnavailableOnVercelKv = !tasksExplicitlyEnabled && !tasksUseSqlite && resolvesToVercelKvTaskBackend(gateTasksRedis);
+        if (tasksUnavailableOnVercelKv && !tasksExplicitlyDisabled) {
+          this.logger.warn(
+            "[tasks] Background tasks are disabled: Vercel KV has no pub/sub, which task results and cancellation require. Serving without tasks. Configure `tasks.redis` with Redis or Upstash to enable them."
+          );
+        }
+        const shouldInitTasks = !tasksExplicitlyDisabled && !tasksUnavailableOnEdge && !tasksUnavailableOnVercelKv && (!this.cliMode || tasksEnabledForCli || isTaskWorker);
         const tasksPromise = shouldInitTasks ? (async () => {
           const tasksRedis = tasksConfig?.redis ?? this.metadata.redis;
           const tasksSqlite = tasksConfig?.sqlite ?? (tasksRedis ? void 0 : resolvedTopLevelSqlite);
@@ -61980,6 +62591,16 @@ var init_scope_instance = __esm({
       async compileUIWidgets() {
         const toolsWithUI = this.scopeTools.getTools(true).filter((t) => hasUIConfig(t.metadata));
         if (toolsWithUI.length === 0) return;
+        for (const tool of toolsWithUI) {
+          const resourceUri = tool.metadata.ui?.resourceUri;
+          this.toolUIRegistry.registerTool(tool.metadata.name, typeof resourceUri === "string" ? resourceUri : void 0);
+          for (const message of describeIgnoredUiOptions(
+            tool.metadata.name,
+            tool.metadata.ui
+          )) {
+            this.logger.warn(message);
+          }
+        }
         this.scopeResources.registerDynamicResource(StaticWidgetResourceTemplate);
         this.logger.verbose(`Registered UI resource template for ${toolsWithUI.length} tool(s) with UI configs`);
         const staticModeTools = toolsWithUI.filter(
@@ -62558,6 +63179,29 @@ var init_scope_instance = __esm({
         }
         throw new FlowExitedWithoutOutputError();
       }
+      /**
+       * Build the ioredis client shared by the HA manager and the transport bus from `metadata.redis`.
+       * The client reconnects on its own and has a permanent, rate-limited 'error' listener.
+       */
+      createHaRedisClient() {
+        const redis = this.metadata.redis;
+        if (!redis || redis.provider === "vercel-kv") {
+          throw new Error("Distributed HA requires a TCP Redis (ioredis); Vercel KV over REST has no Lua/pub-sub support");
+        }
+        const client = (0, import_utils109.createRedisClient)({ ...redis, label: "ha", logger: this.logger });
+        this.haRedisClient = client;
+        return client;
+      }
+      async closeHaRedisClient() {
+        const client = this.haRedisClient;
+        if (!client) return;
+        this.haRedisClient = void 0;
+        try {
+          await client.quit();
+        } catch {
+          client.disconnect();
+        }
+      }
       /**
        * Shut down the scope and release resources.
        * Disconnects channel service connectors, unsubscribes event handlers,
@@ -62571,6 +63215,7 @@ var init_scope_instance = __esm({
             this.logger.error("[HA] Manager shutdown failed", { error: err });
           }
         }
+        await this.closeHaRedisClient();
         if (this._channelTeardown) {
           try {
             await this._channelTeardown();
@@ -63692,6 +64337,178 @@ var init_scope_registry = __esm({
   }
 });
 
+// libs/sdk/src/transport/ipc-server.transport.ts
+function isIpcStdioRequested() {
+  return !!process.env["FRONTMCP_DEV_STDIO_FD"] && typeof process.send === "function";
+}
+var IPC_READY_MESSAGE, IpcServerTransport;
+var init_ipc_server_transport = __esm({
+  "libs/sdk/src/transport/ipc-server.transport.ts"() {
+    "use strict";
+    IPC_READY_MESSAGE = { __frontmcp: "ready" };
+    IpcServerTransport = class {
+      onclose;
+      onerror;
+      onmessage;
+      started = false;
+      handleMessage = (raw) => {
+        if (!raw || typeof raw !== "object" || raw.__frontmcp !== void 0) return;
+        this.onmessage?.(raw);
+      };
+      handleDisconnect = () => {
+        this.onclose?.();
+      };
+      async start() {
+        if (this.started) throw new Error("IpcServerTransport already started");
+        if (typeof process.send !== "function") {
+          throw new Error("IpcServerTransport requires a process forked with an IPC channel");
+        }
+        this.started = true;
+        process.on("message", this.handleMessage);
+        process.once("disconnect", this.handleDisconnect);
+        process.send(IPC_READY_MESSAGE);
+      }
+      async send(message) {
+        const send = process.send;
+        if (!process.connected || typeof send !== "function") {
+          throw new Error("IPC channel is closed");
+        }
+        await new Promise((resolve, reject) => {
+          send.call(process, message, (err) => err ? reject(err) : resolve());
+        });
+      }
+      async close() {
+        process.off("message", this.handleMessage);
+        process.off("disconnect", this.handleDisconnect);
+        this.started = false;
+        this.onclose?.();
+      }
+    };
+  }
+});
+
+// libs/sdk/src/server/middleware/csp.middleware.ts
+function readCspFromEnv() {
+  if (!(0, import_utils110.getEnvFlag)("FRONTMCP_CSP_ENABLED")) return void 0;
+  const rawDirectives = (0, import_utils110.getEnv)("FRONTMCP_CSP_DIRECTIVES") ?? "";
+  const directives = {};
+  for (const part of rawDirectives.split(";")) {
+    const trimmed = part.trim();
+    if (!trimmed) continue;
+    const spaceIdx = trimmed.indexOf(" ");
+    if (spaceIdx > 0) {
+      directives[trimmed.slice(0, spaceIdx)] = trimmed.slice(spaceIdx + 1);
+    } else {
+      directives[trimmed] = "";
+    }
+  }
+  return {
+    enabled: true,
+    directives,
+    reportUri: (0, import_utils110.getEnv)("FRONTMCP_CSP_REPORT_URI"),
+    reportOnly: (0, import_utils110.getEnvFlag)("FRONTMCP_CSP_REPORT_ONLY")
+  };
+}
+function buildCspHeaderValue(options) {
+  const parts = [];
+  for (const [directive, value] of Object.entries(options.directives)) {
+    parts.push(value ? `${directive} ${value}` : directive);
+  }
+  if (options.reportUri) {
+    parts.push(`report-uri ${options.reportUri}`);
+  }
+  return parts.join("; ");
+}
+function getCspHeaderName(reportOnly) {
+  return reportOnly ? "Content-Security-Policy-Report-Only" : "Content-Security-Policy";
+}
+function readSecurityHeadersFromEnv() {
+  return {
+    hsts: readHeaderEnv("FRONTMCP_HSTS"),
+    contentTypeOptions: readHeaderEnv("FRONTMCP_CONTENT_TYPE_OPTIONS", "nosniff"),
+    frameOptions: readHeaderEnv("FRONTMCP_FRAME_OPTIONS", "DENY"),
+    custom: readCustomHeadersFromEnv()
+  };
+}
+function readHeaderEnv(name44, fallback) {
+  const value = (0, import_utils110.getEnv)(name44);
+  if (value === void 0 || value === "") return fallback;
+  return ["off", "false", "none"].includes(value.trim().toLowerCase()) ? void 0 : value;
+}
+function readCustomHeadersFromEnv() {
+  const raw = (0, import_utils110.getEnv)("FRONTMCP_HEADERS_CUSTOM");
+  if (!raw) return void 0;
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+    return Object.fromEntries(
+      Object.entries(parsed).filter((entry) => typeof entry[1] === "string")
+    );
+  } catch {
+    return void 0;
+  }
+}
+function applySecurityHeaders(res, headers, csp) {
+  if (headers.hsts) {
+    res.setHeader("Strict-Transport-Security", headers.hsts);
+  }
+  if (headers.contentTypeOptions) {
+    res.setHeader("X-Content-Type-Options", headers.contentTypeOptions);
+  }
+  if (headers.frameOptions) {
+    res.setHeader("X-Frame-Options", headers.frameOptions);
+  }
+  if (headers.custom) {
+    for (const [name44, value] of Object.entries(headers.custom)) {
+      res.setHeader(name44, value);
+    }
+  }
+  if (csp?.enabled) {
+    const headerName = getCspHeaderName(csp.reportOnly);
+    const headerValue = buildCspHeaderValue(csp);
+    if (headerValue) {
+      res.setHeader(headerName, headerValue);
+    }
+  }
+}
+function resolveSecurityHeaders(options = {}) {
+  const env = readSecurityHeadersFromEnv();
+  const pick = (explicit, fromEnv) => explicit === false ? void 0 : explicit ?? fromEnv;
+  const resolved = {
+    hsts: pick(options.hsts, env.hsts),
+    contentTypeOptions: pick(options.contentTypeOptions, env.contentTypeOptions),
+    frameOptions: pick(options.frameOptions, env.frameOptions),
+    custom: { ...env.custom, ...options.custom }
+  };
+  let csp;
+  if (options.csp?.enabled === false) {
+    csp = void 0;
+  } else if (options.csp?.enabled === true) {
+    const directives = {};
+    for (const [name44, value] of Object.entries(options.csp.directives ?? {})) {
+      directives[name44] = Array.isArray(value) ? value.join(" ") : value;
+    }
+    csp = {
+      enabled: true,
+      directives,
+      reportUri: options.csp.reportUri,
+      reportOnly: options.csp.reportOnly ?? false
+    };
+  } else {
+    csp = readCspFromEnv();
+  }
+  const headers = {};
+  applySecurityHeaders({ setHeader: (name44, value) => void (headers[name44] = value) }, resolved, csp);
+  return headers;
+}
+var import_utils110;
+var init_csp_middleware = __esm({
+  "libs/sdk/src/server/middleware/csp.middleware.ts"() {
+    "use strict";
+    import_utils110 = require("@frontmcp/utils");
+  }
+});
+
 // libs/sdk/src/transport/web-response.renderer.ts
 function toByteStream(streamLike) {
   const iter = streamLike[Symbol.asyncIterator];
@@ -63796,6 +64613,7 @@ function isCloudflareWorkersRuntime(request) {
   return typeof cloudflareProperties === "object" && cloudflareProperties !== null;
 }
 function resolvePeerAddress(request, ctx) {
+  if (carriedPeerAddresses.has(request)) return carriedPeerAddresses.get(request);
   if (typeof ctx?.requestIP === "function") return ctx.requestIP(request)?.address;
   if (typeof ctx?.remoteAddr?.hostname === "string") return ctx.remoteAddr.hostname;
   if (isCloudflareWorkersRuntime(request)) return request.headers.get("cf-connecting-ip") ?? void 0;
@@ -63814,7 +64632,13 @@ function mapHttpCors(httpCors, scope) {
 }
 function createWebFetchHandler(scope, options = {}) {
   const httpConfig = scope.metadata.http;
-  const healthPaths = new Set(options.healthPaths ?? ["/healthz", "/readyz"]);
+  const healthConfig = scope.metadata.health ?? {};
+  const healthEnabled = healthConfig.enabled !== false;
+  const healthzPath = healthConfig.healthzPath ?? "/healthz";
+  const readyzPath = healthConfig.readyzPath ?? "/readyz";
+  const readyzEnabled = isReadyzEnabled(healthConfig);
+  const bodyLimit = parseByteLimit(httpConfig?.bodyLimit);
+  const securityHeaders = resolveSecurityHeaders(httpConfig?.securityHeaders);
   const normalizePath = (p) => {
     const withSlash = p.startsWith("/") ? p : `/${p}`;
     let end = withSlash.length;
@@ -63858,7 +64682,13 @@ function createWebFetchHandler(scope, options = {}) {
     for (const [k, v] of Object.entries(corsHeadersFor(request))) headers.set(k, v);
     return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
   };
-  return async function handle(request, ctx, env) {
+  const withSecurityHeaders = (response) => {
+    const headers = new Headers(response.headers);
+    for (const [k, v] of Object.entries(securityHeaders)) if (!headers.has(k)) headers.set(k, v);
+    headers.delete("x-powered-by");
+    return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+  };
+  const handleRequest = async (request, ctx, env) => {
     const url = new URL(request.url);
     if (hostValidation) {
       const rejection = validateHostHeaders(
@@ -63873,17 +64703,34 @@ function createWebFetchHandler(scope, options = {}) {
         return Response.json({ error: rejection.error, message: rejection.message }, { status: rejection.status });
       }
     }
+    const limited = await enforceBodyLimit(request, bodyLimit, ctx);
+    if (limited instanceof Response) return withCors(limited, request);
+    request = limited;
     if (corsEnabled && request.method === "OPTIONS") {
       return new Response(null, { status: 204, headers: corsHeadersFor(request) });
     }
-    if (healthPaths.has(url.pathname)) {
-      return withCors(
-        Response.json(
-          { status: "ok", server: scope.metadata.info, transport: "web-fetch" },
-          { headers: { "Cache-Control": "no-store" } }
-        ),
-        request
-      );
+    if (options.healthPaths ? options.healthPaths.includes(url.pathname) : healthEnabled) {
+      const isReadyz = !options.healthPaths && url.pathname === readyzPath && readyzEnabled;
+      const isHealthz = options.healthPaths ? url.pathname !== "/readyz" : url.pathname === healthzPath || url.pathname === "/health";
+      if (isReadyz && scope.healthService) {
+        const readiness = await scope.healthService.getReadyz();
+        return withCors(
+          Response.json(
+            { ...readiness, transport: "web-fetch" },
+            { status: readiness.status === "ready" ? 200 : 503, headers: { "Cache-Control": "no-store" } }
+          ),
+          request
+        );
+      }
+      if (isHealthz || isReadyz || options.healthPaths) {
+        return withCors(
+          Response.json(
+            { status: "ok", server: scope.metadata.info, transport: "web-fetch" },
+            { headers: { "Cache-Control": "no-store" } }
+          ),
+          request
+        );
+      }
     }
     if (!entryPaths.has(normalizePath(url.pathname))) {
       const authResponse = await runMatchingHttpFlowWeb(scope, request, { ctx, env });
@@ -63897,13 +64744,60 @@ function createWebFetchHandler(scope, options = {}) {
     const rendered = await runHttpRequestFlowWeb(scope, request, { ctx, env });
     return withCors(rendered ?? Response.json({ error: "Not Found" }, { status: 404 }), request);
   };
+  return async function handle(request, ctx, env) {
+    return withSecurityHeaders(await handleRequest(request, ctx, env));
+  };
+}
+function parseByteLimit(limit) {
+  if (typeof limit === "number" && Number.isFinite(limit) && limit >= 0) return limit;
+  if (typeof limit === "string") {
+    const match = /^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb)?$/i.exec(limit.trim());
+    if (match) return Math.floor(Number(match[1]) * BYTE_UNITS[(match[2] ?? "b").toLowerCase()]);
+  }
+  return DEFAULT_BODY_LIMIT_BYTES;
+}
+function payloadTooLarge(limit, length) {
+  const error = new PayloadTooLargeError(limit, length);
+  return Response.json({ jsonrpc: "2.0", error: error.toJsonRpcError(), id: null }, { status: 413 });
+}
+async function enforceBodyLimit(request, limit, ctx) {
+  const method = request.method.toUpperCase();
+  if (method === "GET" || method === "HEAD" || method === "OPTIONS" || !request.body) return request;
+  const declared = request.headers.get("content-length");
+  if (declared !== null) {
+    const length = Number(declared);
+    if (Number.isFinite(length) && length > limit) return payloadTooLarge(limit, length);
+  }
+  const peerAddress = resolvePeerAddress(request, ctx);
+  const reader = request.body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > limit) {
+      await reader.cancel().catch(() => void 0);
+      return payloadTooLarge(limit, total);
+    }
+    chunks.push(value);
+  }
+  const buffered = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    buffered.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  const rebuilt = new Request(request.url, { method: request.method, headers: request.headers, body: buffered });
+  carriedPeerAddresses.set(rebuilt, peerAddress);
+  return rebuilt;
 }
 async function runHttpRequestFlowWeb(scope, request, opts = {}) {
   const url = new URL(request.url);
   const serverRequest = await toServerRequest(request, url, opts.ctx, opts.persistent, opts.env);
   let output;
   try {
-    output = await (0, import_utils106.runRequestExclusive)(
+    output = await (0, import_utils111.runRequestExclusive)(
       () => scope.runFlow("http:request", {
         request: serverRequest,
         response: {}
@@ -63921,7 +64815,7 @@ async function runMatchingHttpFlowWeb(scope, request, opts = {}) {
   if (!flowName) return void 0;
   let output;
   try {
-    output = await (0, import_utils106.runRequestExclusive)(
+    output = await (0, import_utils111.runRequestExclusive)(
       () => scope.runFlow(flowName, {
         request: serverRequest,
         response: {}
@@ -63987,22 +64881,7 @@ async function toServerRequest(request, url, ctx, persistent, env) {
 function misconfigurationResponse(error) {
   const misconfiguration = findMisconfiguration(error);
   if (!misconfiguration) return void 0;
-  return Response.json(
-    { error: "server_misconfigured", code: misconfiguration.code, message: misconfiguration.remedy },
-    { status: 500 }
-  );
-}
-function findMisconfiguration(error) {
-  let current = error;
-  for (let depth = 0; current instanceof Error && depth < 5; depth++) {
-    const code = current.code;
-    if (typeof code === "string" && MISCONFIGURATION_REMEDIES[code]) {
-      return { code, remedy: MISCONFIGURATION_REMEDIES[code] };
-    }
-    if (current.name === "ZodError") return { code: "CONFIG_INVALID", remedy: CONFIG_INVALID_REMEDY };
-    current = current.cause;
-  }
-  return void 0;
+  return Response.json(misconfigurationBody(misconfiguration), { status: 500 });
 }
 function createDeferredServerBuild(build, options = {}) {
   const now = options.now ?? Date.now;
@@ -64057,7 +64936,7 @@ function flowErrorToHttpOutput(error) {
       kind: "json",
       status: 500,
       contentType: "application/json; charset=utf-8",
-      body: { error: "server_misconfigured", code: misconfiguration.code, message: misconfiguration.remedy }
+      body: misconfigurationBody(misconfiguration)
     };
   }
   if (error instanceof FlowControl) {
@@ -64083,27 +64962,24 @@ function flowErrorToHttpOutput(error) {
   }
   return { kind: "text", status: 500, body: "Internal Server Error", contentType: "text/plain; charset=utf-8" };
 }
-var import_utils106, CLOUDFLARE_WORKERS_USER_AGENT, MISCONFIGURATION_REMEDIES, CONFIG_INVALID_REMEDY, STARTUP_RETRY_MIN_MS, STARTUP_RETRY_MAX_MS;
+var import_utils111, CLOUDFLARE_WORKERS_USER_AGENT, carriedPeerAddresses, DEFAULT_BODY_LIMIT_BYTES, BYTE_UNITS, STARTUP_RETRY_MIN_MS, STARTUP_RETRY_MAX_MS;
 var init_web_fetch_handler = __esm({
   "libs/sdk/src/transport/web-fetch-handler.ts"() {
     "use strict";
-    import_utils106 = require("@frontmcp/utils");
+    import_utils111 = require("@frontmcp/utils");
     init_common();
     init_server_tokens();
     init_path_utils();
     init_errors();
+    init_misconfiguration();
+    init_health_routes();
+    init_csp_middleware();
     init_host_validation();
     init_web_response_renderer();
     CLOUDFLARE_WORKERS_USER_AGENT = "Cloudflare-Workers";
-    MISCONFIGURATION_REMEDIES = {
-      SESSION_SECRET_REQUIRED: "Set MCP_SESSION_SECRET in the deployment environment (e.g. `wrangler secret put MCP_SESSION_SECRET`). Session IDs are encrypted with it, and production refuses the development machine-id fallback.",
-      JWT_SECRET_INVALID: "JWT_SECRET is present but too weak: HS256 requires at least 32 bytes (RFC 7518). Replace it with `openssl rand -hex 32`.",
-      JWT_SECRET_REQUIRED: "Set JWT_SECRET in the deployment environment (e.g. `wrangler secret put JWT_SECRET`). Tokens are signed with it; production refuses the random per-process fallback because tokens would not survive a restart or verify across instances.",
-      // The startup checks: a server whose entries ask for protection nothing gives them does not start.
-      UNENFORCED_METADATA: "An entry declares a field only a plugin enforces (approval, featureFlag, ...) and no installed plugin that enforces it reaches the entry, so the server refuses to start. Install the plugin or remove the field; the server log names the entries.",
-      AUTH_CONFIGURATION_ERROR: "The auth or authorities configuration is invalid (for example, entries declare authorities and the server has no authorities option, or a rule checks nothing), so the server refuses to start. The server log names the entries."
-    };
-    CONFIG_INVALID_REMEDY = "The FrontMCP configuration failed validation, so the server refuses to start. The server log names the invalid fields.";
+    carriedPeerAddresses = /* @__PURE__ */ new WeakMap();
+    DEFAULT_BODY_LIMIT_BYTES = 4 * 1024 * 1024;
+    BYTE_UNITS = { b: 1, kb: 1024, mb: 1024 ** 2, gb: 1024 ** 3 };
     STARTUP_RETRY_MIN_MS = 1e3;
     STARTUP_RETRY_MAX_MS = 6e4;
   }
@@ -64135,9 +65011,9 @@ var init_noop_server = __esm({
 });
 
 // libs/sdk/src/server/security/security-audit.ts
-function auditSecurityDefaults(config, isProduction6) {
+function auditSecurityDefaults(config, isProduction7) {
   const findings = [];
-  if (!isProduction6 && config.deploymentMode !== "distributed") {
+  if (!isProduction7 && config.deploymentMode !== "distributed") {
     return findings;
   }
   const strict = config.security?.strict === true;
@@ -64185,13 +65061,13 @@ function auditSecurityDefaults(config, isProduction6) {
       message: `Server bound to ${bindAddress}.`
     });
   }
-  const dnsProtectionEnabled = config.security?.dnsRebindingProtection?.enabled ?? strict;
+  const dnsProtectionEnabled = config.security?.dnsRebindingProtection?.enabled !== false;
   if (!dnsProtectionEnabled) {
     findings.push({
       level: "warn",
       code: "DNS_REBINDING_UNPROTECTED",
-      message: "DNS rebinding protection is disabled.",
-      recommendation: "Enable security.dnsRebindingProtection with allowedHosts to prevent DNS rebinding attacks."
+      message: "DNS rebinding protection is disabled (security.dnsRebindingProtection.enabled is false).",
+      recommendation: "Remove `enabled: false`, or set security.dnsRebindingProtection.allowedHosts, to prevent DNS rebinding attacks."
     });
   } else {
     findings.push({
@@ -64371,15 +65247,16 @@ var init_base_host_adapter = __esm({
 });
 
 // libs/sdk/src/server/adapters/express.host.adapter.ts
-var http, import_cors, import_express, import_utils107, DEFAULT_EXPRESS_BODY_LIMIT, ExpressHostAdapter;
+var http, import_cors, import_express, import_utils112, DEFAULT_EXPRESS_BODY_LIMIT, ExpressHostAdapter;
 var init_express_host_adapter = __esm({
   "libs/sdk/src/server/adapters/express.host.adapter.ts"() {
     "use strict";
     http = __toESM(require("node:http"));
     import_cors = __toESM(require("cors"));
     import_express = __toESM(require("express"));
-    import_utils107 = require("@frontmcp/utils");
+    import_utils112 = require("@frontmcp/utils");
     init_mcp_error();
+    init_csp_middleware();
     init_host_validation_middleware();
     init_resolve_allowed_hosts();
     init_base_host_adapter();
@@ -64394,6 +65271,12 @@ var init_express_host_adapter = __esm({
       deriveHostValidation;
       constructor(options) {
         super();
+        this.app.disable("x-powered-by");
+        const securityHeaders = resolveSecurityHeaders(options?.securityHeaders);
+        this.app.use((_req, res, next) => {
+          for (const [name44, value] of Object.entries(securityHeaders)) res.setHeader(name44, value);
+          next();
+        });
         const corsOptions = options?.cors;
         const corsEnabled = corsOptions?.origin !== void 0 && corsOptions.origin !== false;
         if (corsEnabled) {
@@ -64561,8 +65444,8 @@ var init_express_host_adapter = __esm({
       }
       async cleanupStaleSocket(socketPath) {
         try {
-          if (await (0, import_utils107.fileExists)(socketPath)) {
-            await (0, import_utils107.unlink)(socketPath);
+          if (await (0, import_utils112.fileExists)(socketPath)) {
+            await (0, import_utils112.unlink)(socketPath);
           }
         } catch {
         }
@@ -64585,11 +65468,11 @@ var init_node_express_host = __esm({
 });
 
 // libs/sdk/src/server/server.instance.ts
-var import_utils108, DEFAULT_CORS, FrontMcpServerInstance;
+var import_utils113, DEFAULT_CORS, FrontMcpServerInstance;
 var init_server_instance = __esm({
   "libs/sdk/src/server/server.instance.ts"() {
     "use strict";
-    import_utils108 = require("@frontmcp/utils");
+    import_utils113 = require("@frontmcp/utils");
     init_common();
     init_health2();
     init_metrics2();
@@ -64621,6 +65504,7 @@ var init_server_instance = __esm({
           this.host = new ExpressHostAdapter2({
             ...corsConfig ? { cors: corsConfig } : {},
             ...this.config.security ? { security: this.config.security } : {},
+            ...this.config.securityHeaders ? { securityHeaders: this.config.securityHeaders } : {},
             ...this.config.bodyLimit !== void 0 ? { bodyLimit: this.config.bodyLimit } : {},
             ...this.config.urlencodedLimit !== void 0 ? { urlencodedLimit: this.config.urlencodedLimit } : {}
           });
@@ -64691,9 +65575,9 @@ var init_server_instance = __esm({
       }
       async start() {
         this.prepare();
-        const deploymentMode = (0, import_utils108.getRuntimeContext)().deployment;
+        const deploymentMode = (0, import_utils113.getRuntimeContext)().deployment;
         const bindAddress = resolveBindAddress(this.config.security, deploymentMode);
-        const isProduction6 = process.env["NODE_ENV"] === "production";
+        const isProduction7 = process.env["NODE_ENV"] === "production";
         const findings = auditSecurityDefaults(
           {
             cors: this.config.cors,
@@ -64701,7 +65585,7 @@ var init_server_instance = __esm({
             resolvedBindAddress: bindAddress,
             deploymentMode
           },
-          isProduction6
+          isProduction7
         );
         logSecurityFindings(findings, console);
         await this.host.start(this.config.socketPath ?? this.config.port, bindAddress);
@@ -64929,11 +65813,11 @@ function resolveConfigInput(optionsOrClass) {
   }
   return optionsOrClass;
 }
-var import_utils109, stdioServing, FrontMcpInstance;
+var import_utils114, stdioServing, FrontMcpInstance;
 var init_front_mcp = __esm({
   "libs/sdk/src/front-mcp/front-mcp.ts"() {
     "use strict";
-    import_utils109 = require("@frontmcp/utils");
+    import_utils114 = require("@frontmcp/utils");
     init_common();
     init_direct();
     init_errors();
@@ -64945,6 +65829,7 @@ var init_front_mcp = __esm({
     init_scope_registry();
     init_skill_instructions_helper();
     init_task();
+    init_ipc_server_transport();
     init_web_fetch_handler();
     init_front_mcp_providers();
     init_static_startup_check();
@@ -65064,7 +65949,13 @@ var init_front_mcp = __esm({
         }
       }
       static async bootstrap(options) {
-        const parsedConfig = frontMcpMetadataSchema.parse(options);
+        const sqlitePath = process.env["FRONTMCP_SQLITE_PATH"];
+        const parsedConfig = frontMcpMetadataSchema.parse(
+          sqlitePath ? {
+            ...options,
+            sqlite: { ...options.sqlite ?? {}, path: sqlitePath }
+          } : options
+        );
         const daemonSocket = process.env["FRONTMCP_DAEMON_SOCKET"];
         if (daemonSocket) {
           await _FrontMcpInstance2.runUnixSocket({ ...parsedConfig, socketPath: daemonSocket });
@@ -65137,7 +66028,7 @@ var init_front_mcp = __esm({
           frontMcp.log?.info("FrontMCP fetch handler created (web-standard transport)");
           return createWebFetchHandler(scope);
         };
-        if (!(0, import_utils109.isEdgeRuntime)()) return build(false);
+        if (!(0, import_utils114.isEdgeRuntime)()) return build(false);
         assertStaticStartupConfig(options);
         const server = createDeferredServerBuild(() => build(true));
         return async (request, ctx, env) => {
@@ -65282,8 +66173,8 @@ var init_front_mcp = __esm({
         frontMcp.log?.info(`MCP server listening on unix://${socketPath}`);
         const cleanup = async () => {
           try {
-            if (await (0, import_utils109.fileExists)(socketPath)) {
-              await (0, import_utils109.unlink)(socketPath);
+            if (await (0, import_utils114.fileExists)(socketPath)) {
+              await (0, import_utils114.unlink)(socketPath);
             }
           } catch {
           }
@@ -65427,7 +66318,7 @@ var init_front_mcp = __esm({
           };
           const mcpServer = new McpServer2(scope.metadata.info, serverOptions);
           startupCleanups.push(() => mcpServer.close());
-          const sessionId = `stdio:${(0, import_utils109.randomUUID)()}`;
+          const sessionId = `stdio:${(0, import_utils114.randomUUID)()}`;
           const handlers = createMcpHandlers2({ scope, serverOptions, composeInstructions });
           for (const handler of handlers) {
             const originalHandler = handler.handler;
@@ -65441,7 +66332,7 @@ var init_front_mcp = __esm({
             };
             mcpServer.setRequestHandler(handler.requestSchema, wrappedHandler);
           }
-          const transport = new StdioServerTransport();
+          const transport = isIpcStdioRequested() ? new IpcServerTransport() : new StdioServerTransport();
           startupCleanups.push(() => transport.close());
           await mcpServer.connect(transport);
           startupSucceeded = true;
@@ -65747,9 +66638,9 @@ function FrontMcp(providedMetadata) {
       Reflect.defineMetadata(FrontMcpTokens[property] ?? property, metadata[property], target);
     }
     Reflect.defineMetadata(FRONTMCP_CONFIG_METADATA_KEY, metadata, target);
-    const isServerless2 = (0, import_utils110.getEnvFlag)("FRONTMCP_SERVERLESS");
-    const isSchemaExtract = (0, import_utils110.getEnvFlag)("FRONTMCP_SCHEMA_EXTRACT");
-    const isStdio = (0, import_utils110.getEnvFlag)("FRONTMCP_STDIO");
+    const isServerless2 = (0, import_utils115.getEnvFlag)("FRONTMCP_SERVERLESS");
+    const isSchemaExtract = (0, import_utils115.getEnvFlag)("FRONTMCP_SCHEMA_EXTRACT");
+    const isStdio = (0, import_utils115.getEnvFlag)("FRONTMCP_STDIO");
     const taskWorkerId = typeof process !== "undefined" ? process.env?.["FRONTMCP_RUN_TASK_ID"] : void 0;
     if (taskWorkerId && metadata.serve !== false) {
       void (async () => {
@@ -65775,7 +66666,7 @@ function FrontMcp(providedMetadata) {
     } else if (isServerless2) {
       const ServerlessInstance = getFrontMcpInstance();
       const { setServerlessHandler: setServerlessHandler2, setServerlessHandlerPromise: setServerlessHandlerPromise2, setServerlessHandlerError: setServerlessHandlerError2 } = getServerlessHandlerFns();
-      const isWorker = (0, import_utils110.getEnvFlag)("FRONTMCP_WORKER");
+      const isWorker = (0, import_utils115.getEnvFlag)("FRONTMCP_WORKER");
       const handlerPromise = isWorker ? ServerlessInstance.createFetchHandler(metadata) : ServerlessInstance.createHandler(metadata);
       setServerlessHandlerPromise2(handlerPromise);
       handlerPromise.then(setServerlessHandler2).catch((err) => {
@@ -65788,12 +66679,12 @@ function FrontMcp(providedMetadata) {
     }
   };
 }
-var import_reflect_metadata28, import_utils110, FRONT_MCP_DECORATOR_BASENAMES, FRONTMCP_CONFIG_METADATA_KEY, _FrontMcpInstance, _serverlessHandlerFns;
+var import_reflect_metadata28, import_utils115, FRONT_MCP_DECORATOR_BASENAMES, FRONTMCP_CONFIG_METADATA_KEY, _FrontMcpInstance, _serverlessHandlerFns;
 var init_front_mcp_decorator = __esm({
   "libs/sdk/src/common/decorators/front-mcp.decorator.ts"() {
     "use strict";
     import_reflect_metadata28 = require("reflect-metadata");
-    import_utils110 = require("@frontmcp/utils");
+    import_utils115 = require("@frontmcp/utils");
     init_decorator_errors();
     init_mcp_error();
     init_metadata();
@@ -66507,7 +67398,7 @@ var init_dynamic_adapter = __esm({
        * @param options - Adapter options including required `name` field
        * @throws Error if `name` is missing/empty or if a duplicate name is detected
        */
-      static init(options) {
+      static init(options = {}) {
         const typedOptions = options;
         const adapterName = typedOptions.name;
         if (!adapterName || typeof adapterName !== "string" || adapterName.trim() === "") {
@@ -66546,49 +67437,6 @@ var init_dynamic_adapter = __esm({
   }
 });
 
-// libs/sdk/src/common/dynamic/dynamic.plugin.ts
-function isDynamicPluginClass(value) {
-  return typeof value === "function" && value.prototype instanceof DynamicPlugin;
-}
-var DynamicPlugin;
-var init_dynamic_plugin = __esm({
-  "libs/sdk/src/common/dynamic/dynamic.plugin.ts"() {
-    "use strict";
-    init_transport_errors();
-    init_dynamic_utils();
-    DynamicPlugin = class {
-      get(token) {
-        throw new MethodNotImplementedError("DynamicPlugin", "get");
-      }
-      /**
-       * Static init() method to create a plugin provider.
-       * @param options - Input options (with optional fields for defaults)
-       */
-      static init(options) {
-        const extraProviders = options.providers;
-        const typedOptions = options;
-        if ("useFactory" in options) {
-          return {
-            ...typedOptions,
-            provide: this,
-            inject: options.inject,
-            useFactory: options.useFactory,
-            providers: dedupePluginProviders(extraProviders ?? [])
-          };
-        }
-        const dyn = collectDynamicProviders(this, typedOptions);
-        const mergedProviders = dedupePluginProviders([...dyn ?? [], ...extraProviders ?? []]);
-        return {
-          ...typedOptions,
-          provide: this,
-          useValue: new this(options),
-          providers: mergedProviders
-        };
-      }
-    };
-  }
-});
-
 // libs/sdk/src/common/dynamic/index.ts
 var init_dynamic = __esm({
   "libs/sdk/src/common/dynamic/index.ts"() {
@@ -66752,12 +67600,12 @@ var init_adapter_entry = __esm({
 });
 
 // libs/sdk/src/common/entries/tool.entry.ts
-var import_lazy_zod109, import_utils112, ToolEntry;
+var import_lazy_zod109, import_utils117, ToolEntry;
 var init_tool_entry = __esm({
   "libs/sdk/src/common/entries/tool.entry.ts"() {
     "use strict";
     import_lazy_zod109 = require("@frontmcp/lazy-zod");
-    import_utils112 = require("@frontmcp/utils");
+    import_utils117 = require("@frontmcp/utils");
     init_base_entry();
     ToolEntry = class extends BaseEntry {
       owner;
@@ -66824,7 +67672,7 @@ var init_tool_entry = __esm({
           try {
             return (0, import_lazy_zod109.toJSONSchema)(import_lazy_zod109.z.object(this.inputSchema), { io: "input", unrepresentable: "any" });
           } catch (error) {
-            if ((0, import_utils112.isDebug)() || (0, import_utils112.isDevelopment)()) {
+            if ((0, import_utils117.isDebug)() || (0, import_utils117.isDevelopment)()) {
               console.warn("[ToolEntry] Failed to convert Zod schema to JSON Schema:", error);
             }
             return { type: "object", properties: {} };
@@ -66870,7 +67718,7 @@ var init_tool_entry = __esm({
           const json = (0, import_lazy_zod109.toJSONSchema)(zodSchema);
           return json && json["type"] === "object" ? json : null;
         } catch (error) {
-          if ((0, import_utils112.isDebug)() || (0, import_utils112.isDevelopment)()) {
+          if ((0, import_utils117.isDebug)() || (0, import_utils117.isDevelopment)()) {
             console.warn("[ToolEntry] Failed to convert output Zod schema to JSON Schema:", error);
           }
           return null;
@@ -68188,6 +69036,7 @@ __export(index_exports, {
   httpRequestInputSchema: () => httpRequestInputSchema,
   httpRespond: () => httpRespond,
   incrementalAuthConfigSchema: () => import_auth5.incrementalAuthConfigSchema,
+  initOptionsOf: () => initOptionsOf,
   intentSchema: () => intentSchema,
   isAlive: () => isAlive,
   isAnonymousSubject: () => import_auth61.isAnonymousSubject,
@@ -68310,6 +69159,7 @@ __export(index_exports, {
   resolveSchemaDescriptionFormat: () => resolveSchemaDescriptionFormat,
   resolveToolVisibility: () => resolveToolVisibility,
   resolveWithFallbacks: () => resolveWithFallbacks,
+  resolvesToVercelKvTaskBackend: () => resolvesToVercelKvTaskBackend,
   resource: () => frontMcpResource,
   resourceTemplate: () => frontMcpResourceTemplate,
   resourceUriMatches: () => resourceUriMatches,
@@ -68534,22 +69384,22 @@ function createMemorySkillProvider(options = {}) {
 init_skill_utils();
 
 // libs/sdk/src/skill/skill-directory-loader.ts
-var import_utils113 = require("@frontmcp/utils");
+var import_utils118 = require("@frontmcp/utils");
 init_skill_metadata();
 init_sdk_errors();
 init_skill_md_parser();
 async function scanSkillResources(dirPath) {
   const resources = {};
-  const scriptsPath = (0, import_utils113.joinPath)(dirPath, "scripts");
-  const referencesPath = (0, import_utils113.joinPath)(dirPath, "references");
-  const assetsPath = (0, import_utils113.joinPath)(dirPath, "assets");
-  const examplesPath = (0, import_utils113.joinPath)(dirPath, "examples");
+  const scriptsPath = (0, import_utils118.joinPath)(dirPath, "scripts");
+  const referencesPath = (0, import_utils118.joinPath)(dirPath, "references");
+  const assetsPath = (0, import_utils118.joinPath)(dirPath, "assets");
+  const examplesPath = (0, import_utils118.joinPath)(dirPath, "examples");
   const checks = await Promise.all([
     checkDirectory(scriptsPath),
     checkDirectory(referencesPath),
     checkDirectory(assetsPath),
     checkDirectory(examplesPath),
-    (0, import_utils113.fileExists)((0, import_utils113.joinPath)(dirPath, "SKILL.md"))
+    (0, import_utils118.fileExists)((0, import_utils118.joinPath)(dirPath, "SKILL.md"))
   ]);
   if (checks[0]) resources.scripts = scriptsPath;
   if (checks[1]) resources.references = referencesPath;
@@ -68562,7 +69412,7 @@ async function scanSkillResources(dirPath) {
 }
 async function checkDirectory(path3) {
   try {
-    const s = await (0, import_utils113.stat)(path3);
+    const s = await (0, import_utils118.stat)(path3);
     return s.isDirectory();
   } catch (err) {
     if (err.code === "ENOENT") return false;
@@ -68575,16 +69425,16 @@ async function findNestedSkillMd(dirPath, maxDepth = Number.POSITIVE_INFINITY) {
     if (depth > maxDepth) return;
     let entries;
     try {
-      entries = await (0, import_utils113.readdir)(current);
+      entries = await (0, import_utils118.readdir)(current);
     } catch (err) {
       if (err.code === "ENOENT") return;
       throw err;
     }
     for (const entry of entries) {
-      const full = (0, import_utils113.joinPath)(current, entry);
+      const full = (0, import_utils118.joinPath)(current, entry);
       let entryStat;
       try {
-        entryStat = await (0, import_utils113.stat)(full);
+        entryStat = await (0, import_utils118.stat)(full);
       } catch (err) {
         if (err.code === "ENOENT") continue;
         throw err;
@@ -68600,19 +69450,19 @@ async function findNestedSkillMd(dirPath, maxDepth = Number.POSITIVE_INFINITY) {
   return found.sort();
 }
 async function loadSkillDirectory(dirPath, logger) {
-  const skillMdPath = (0, import_utils113.joinPath)(dirPath, "SKILL.md");
-  const exists = await (0, import_utils113.fileExists)(skillMdPath);
+  const skillMdPath = (0, import_utils118.joinPath)(dirPath, "SKILL.md");
+  const exists = await (0, import_utils118.fileExists)(skillMdPath);
   if (!exists) {
-    throw new InvalidSkillError((0, import_utils113.basename)(dirPath), "SKILL.md not found in directory");
+    throw new InvalidSkillError((0, import_utils118.basename)(dirPath), "SKILL.md not found in directory");
   }
   let content;
   let partialMetadata;
   try {
-    content = await (0, import_utils113.readFile)(skillMdPath, "utf-8");
+    content = await (0, import_utils118.readFile)(skillMdPath, "utf-8");
     const { frontmatter, body } = parseSkillMdFrontmatter(content);
     partialMetadata = skillMdFrontmatterToMetadata(frontmatter, body);
   } catch (err) {
-    const name44 = (0, import_utils113.basename)(dirPath);
+    const name44 = (0, import_utils118.basename)(dirPath);
     const message = err instanceof Error ? err.message : String(err);
     throw new InvalidSkillError(name44, `Failed to read or parse SKILL.md: ${message}`);
   }
@@ -68623,13 +69473,13 @@ async function loadSkillDirectory(dirPath, logger) {
   }
   const nested = await findNestedSkillMd(dirPath);
   if (nested.length > 0) {
-    const skillName2 = partialMetadata.name ?? (0, import_utils113.basename)(dirPath);
+    const skillName2 = partialMetadata.name ?? (0, import_utils118.basename)(dirPath);
     throw new InvalidSkillError(
       skillName2,
       `Skill directory contains nested SKILL.md files (forbidden by SEP-2640 \xA7Resource Mapping): ${nested.join(", ")}`
     );
   }
-  const dirName = (0, import_utils113.basename)(dirPath);
+  const dirName = (0, import_utils118.basename)(dirPath);
   if (partialMetadata.name && dirName && partialMetadata.name !== dirName) {
     const msg = `Skill name "${partialMetadata.name}" does not match directory name "${dirName}"`;
     if (logger) {
@@ -69430,6 +70280,7 @@ var ChannelListHook = FlowHooksOf("channels:list");
   httpRequestInputSchema,
   httpRespond,
   incrementalAuthConfigSchema,
+  initOptionsOf,
   intentSchema,
   isAlive,
   isAnonymousSubject,
@@ -69552,6 +70403,7 @@ var ChannelListHook = FlowHooksOf("channels:list");
   resolveSchemaDescriptionFormat,
   resolveToolVisibility,
   resolveWithFallbacks,
+  resolvesToVercelKvTaskBackend,
   resource,
   resourceTemplate,
   resourceUriMatches,