@frontmcp/sdk 1.9.0 → 1.9.1-rc.1

package/esm/index.mjs

@@ -5423,7 +5423,7 @@ var init_normalization_errors = __esm({
 });
 
 // libs/sdk/src/errors/registry.errors.ts
-var RegistryDefinitionNotFoundError, RegistryGraphEntryNotFoundError, RegistryDependencyNotRegisteredError, InvalidRegistryKindError, NameDisambiguationError, EntryValidationError, ToolNameConflictError, FlowNotRegisteredError, UnsupportedHookOwnerKindError;
+var RegistryDefinitionNotFoundError, RegistryGraphEntryNotFoundError, RegistryDependencyNotRegisteredError, InvalidRegistryKindError, NameDisambiguationError, EntryValidationError, ToolNameConflictError, ReservedAppIdError, FlowNotRegisteredError, UnsupportedHookOwnerKindError;
 var init_registry_errors = __esm({
   "libs/sdk/src/errors/registry.errors.ts"() {
     "use strict";
@@ -5466,6 +5466,14 @@ var init_registry_errors = __esm({
         super(`A tool named "${toolName}" is already registered`, "TOOL_NAME_CONFLICT");
       }
     };
+    ReservedAppIdError = class extends InternalMcpError {
+      constructor(appId) {
+        super(
+          `App id "${appId}" is reserved while @FrontMcp declares tools or resources: a server-level entry named like an app's is listed as "${appId}:<name>". Give the app another id.`,
+          "RESERVED_APP_ID"
+        );
+      }
+    };
     FlowNotRegisteredError = class extends InternalMcpError {
       constructor(flowName) {
         super(`Flow "${flowName}" is not registered`, "FLOW_NOT_REGISTERED");
@@ -6115,6 +6123,7 @@ __export(errors_exports, {
   RemoteUnsupportedTransportError: () => RemoteUnsupportedTransportError,
   RequestContextNotAvailableError: () => RequestContextNotAvailableError,
   RequiredConfigUndefinedError: () => RequiredConfigUndefinedError,
+  ReservedAppIdError: () => ReservedAppIdError,
   ResourceNotFoundError: () => ResourceNotFoundError,
   ResourceReadError: () => ResourceReadError,
   SamplingNotAvailableError: () => SamplingNotAvailableError,
@@ -13944,7 +13953,19 @@ var init_flow_context_providers = __esm({
   }
 });
 
+// libs/sdk/src/front-mcp/front-mcp.tokens.ts
+var FrontMcpConfig;
+var init_front_mcp_tokens2 = __esm({
+  "libs/sdk/src/front-mcp/front-mcp.tokens.ts"() {
+    "use strict";
+    FrontMcpConfig = /* @__PURE__ */ Symbol("FrontMcpConfig");
+  }
+});
+
 // libs/sdk/src/utils/lineage.utils.ts
+function isServerEntryOwner(owner) {
+  return owner?.kind === serverEntryOwner.kind && owner.id === serverEntryOwner.id && owner.ref === serverEntryOwner.ref;
+}
 function ownerKeyOf(lineage) {
   return lineage.map((o) => `${o.kind}:${o.id}`).join("/");
 }
@@ -13959,10 +13980,12 @@ function appOwnerIdOf(lineage, owner) {
   const owners2 = owner ? [...lineage, owner] : lineage;
   return owners2.find((candidate) => candidate.kind === "app")?.id;
 }
-var EntryLineageIndex;
+var serverEntryOwner, EntryLineageIndex;
 var init_lineage_utils = __esm({
   "libs/sdk/src/utils/lineage.utils.ts"() {
     "use strict";
+    init_front_mcp_tokens2();
+    serverEntryOwner = { kind: "scope", id: "server", ref: FrontMcpConfig };
     EntryLineageIndex = class {
       lineages = /* @__PURE__ */ new Map();
       /** Replace the index with these rows; an entry held by several rows keeps the first row's lineage. */
@@ -14411,9 +14434,9 @@ var init_call_tool_flow = __esm({
             "checkToolAuthorization: incrementalAuth enabled but the verified token carries no authorized_apps claim \u2014 failing closed"
           );
         }
-        const appId = tool?.owner?.id;
+        const appId = isServerEntryOwner(tool?.owner) ? void 0 : tool?.owner?.id;
         if (!appId) {
-          this.logger.verbose("checkToolAuthorization:skip (no owner)");
+          this.logger.verbose("checkToolAuthorization:skip (no app owner)");
           return;
         }
         const isAppAuthorized = (claimAuthorizedApps?.has(appId) ?? false) || (legacyAuthorization?.authorizedAppIds?.includes(appId) ?? false) || appId in (legacyAuthorization?.authorizedApps || {});
@@ -16523,15 +16546,6 @@ var init_instance_file_logger = __esm({
   }
 });
 
-// libs/sdk/src/front-mcp/front-mcp.tokens.ts
-var FrontMcpConfig;
-var init_front_mcp_tokens2 = __esm({
-  "libs/sdk/src/front-mcp/front-mcp.tokens.ts"() {
-    "use strict";
-    FrontMcpConfig = /* @__PURE__ */ Symbol("FrontMcpConfig");
-  }
-});
-
 // libs/sdk/src/regsitry/registry.base.ts
 var RegistryAbstract;
 var init_registry_base = __esm({
@@ -53967,7 +53981,7 @@ var init_skill_http_cache = __esm({
 });
 
 // libs/sdk/src/skill/cache/skill-http-cache.factory.ts
-import { attachRedisErrorListener as attachRedisErrorListener3 } from "@frontmcp/utils";
+import { attachRedisErrorListener as attachRedisErrorListener3, getEnv as getEnv11, StorageConfigError } from "@frontmcp/utils";
 function hasRedisProvider(redis) {
   if (!redis?.provider) return false;
   const provider = redis.provider;
@@ -53995,9 +54009,15 @@ async function createSkillHttpCache(options = {}) {
 async function createRedisCache(redis, keyPrefix, ttlMs, logger) {
   const provider = redis.provider;
   if (provider === "vercel-kv" || provider === "@vercel/kv") {
-    const { kv } = __require("@vercel/kv");
+    const url = getEnv11("KV_REST_API_URL");
+    const token = getEnv11("KV_REST_API_TOKEN");
+    if (!url || !token) {
+      throw new StorageConfigError("vercel-kv", "KV_REST_API_URL and KV_REST_API_TOKEN must be set.");
+    }
+    const { createClient } = __require("@vercel/kv");
+    const client2 = createClient({ url, token, automaticDeserialization: false });
     return new RedisSkillHttpCache({
-      getClient: async () => kv,
+      getClient: async () => client2,
       keyPrefix,
       ttlMs
     });
@@ -54043,7 +54063,7 @@ async function getSkillHttpCache(scope) {
   if (pending) {
     return pending;
   }
-  const creationPromise = createCacheForScope(scopeId, cacheConfig);
+  const creationPromise = createCacheForScope(scopeId, cacheConfig, scope.logger);
   pendingCreation.set(scopeId, creationPromise);
   try {
     const cache2 = await creationPromise;
@@ -54053,12 +54073,13 @@ async function getSkillHttpCache(scope) {
     pendingCreation.delete(scopeId);
   }
 }
-async function createCacheForScope(scopeId, cacheConfig) {
+async function createCacheForScope(scopeId, cacheConfig, logger) {
   try {
     const { cache: cache2 } = await createSkillHttpCache({
       redis: cacheConfig.redis,
       ttlMs: cacheConfig.ttlMs,
-      keyPrefix: cacheConfig.keyPrefix ?? `frontmcp:skills:${scopeId}:cache:`
+      keyPrefix: cacheConfig.keyPrefix ?? `frontmcp:skills:${scopeId}:cache:`,
+      logger
     });
     return cache2;
   } catch (error) {
@@ -59712,7 +59733,7 @@ var init_handle_mcp_20260728_flow = __esm({
 });
 
 // libs/sdk/src/ha/ha-headers.ts
-import { buildSetCookie, getEnv as getEnv11, getMachineId as getMachineId3, getRuntimeContext as getRuntimeContext13 } from "@frontmcp/utils";
+import { buildSetCookie, getEnv as getEnv12, getMachineId as getMachineId3, getRuntimeContext as getRuntimeContext13 } from "@frontmcp/utils";
 function machineIdHeader() {
   if (getRuntimeContext13().deployment !== "distributed") return void 0;
   return [DEFAULT_FRONTMCP_MACHINE_ID_HEADER, getMachineId3()];
@@ -59724,9 +59745,9 @@ function applyMachineIdHeader(response) {
   return true;
 }
 function affinityCookieOptions() {
-  const name44 = getEnv11("FRONTMCP_AFFINITY_COOKIE")?.trim() || DEFAULT_FRONTMCP_NODE_COOKIE;
-  const domain = getEnv11("FRONTMCP_AFFINITY_COOKIE_DOMAIN")?.trim() || void 0;
-  const rawSameSite = getEnv11("FRONTMCP_AFFINITY_COOKIE_SAMESITE")?.trim().toLowerCase();
+  const name44 = getEnv12("FRONTMCP_AFFINITY_COOKIE")?.trim() || DEFAULT_FRONTMCP_NODE_COOKIE;
+  const domain = getEnv12("FRONTMCP_AFFINITY_COOKIE_DOMAIN")?.trim() || void 0;
+  const rawSameSite = getEnv12("FRONTMCP_AFFINITY_COOKIE_SAMESITE")?.trim().toLowerCase();
   const sameSite = rawSameSite === "strict" ? "Strict" : rawSameSite === "lax" ? "Lax" : rawSameSite === "none" ? "None" : void 0;
   return { name: name44, ...domain ? { domain } : {}, ...sameSite ? { sameSite } : {} };
 }
@@ -64494,6 +64515,29 @@ var init_http_request_flow = __esm({
   }
 });
 
+// libs/sdk/src/scope/server-entries.helper.ts
+async function registerServerEntries(providers, entries, appIds) {
+  if (!entries.tools?.length && !entries.resources?.length) return;
+  if (appIds.includes(serverEntryOwner.id)) throw new ReservedAppIdError(serverEntryOwner.id);
+  const registries = [];
+  if (entries.tools?.length) {
+    registries.push(new ToolRegistry(providers, entries.tools, serverEntryOwner, { adopt: false }).ready);
+  }
+  if (entries.resources?.length) {
+    registries.push(new ResourceRegistry(providers, entries.resources, serverEntryOwner, { adopt: false }).ready);
+  }
+  await Promise.all(registries);
+}
+var init_server_entries_helper = __esm({
+  "libs/sdk/src/scope/server-entries.helper.ts"() {
+    "use strict";
+    init_errors();
+    init_resource_registry();
+    init_tool_registry();
+    init_lineage_utils();
+  }
+});
+
 // libs/sdk/src/scope/scope.instance.ts
 import "reflect-metadata";
 import {
@@ -64560,6 +64604,7 @@ var init_scope_instance = __esm({
     init_http_ip_filter_flow();
     init_http_request_flow();
     init_optional_dependency_util();
+    init_server_entries_helper();
     SCOPE_NON_DISPATCHABLE_FLOWS = /* @__PURE__ */ new Set(["http:request"]);
     Scope = class _Scope extends ScopeEntry {
       id;
@@ -64991,6 +65036,11 @@ var init_scope_instance = __esm({
           await scopeAdapters.ready;
           this.onDispose(() => scopeAdapters.dispose());
         }
+        await registerServerEntries(
+          this.scopeProviders,
+          this.metadata,
+          this.scopeApps.getApps().map((app) => app.id)
+        );
         this.initAuthoritiesFromConfig();
         this.scopeTools = new ToolRegistry(this.scopeProviders, [], scopeRef);
         this.scopeResources = new ResourceRegistry(this.scopeProviders, [], scopeRef);
@@ -67174,9 +67224,9 @@ var init_ipc_server_transport = __esm({
 });
 
 // libs/sdk/src/server/middleware/cors-env.ts
-import { getEnv as getEnv12 } from "@frontmcp/utils";
+import { getEnv as getEnv13 } from "@frontmcp/utils";
 function readCorsFromEnv() {
-  const rawOrigins = getEnv12("FRONTMCP_CORS_ORIGINS");
+  const rawOrigins = getEnv13("FRONTMCP_CORS_ORIGINS");
   if (!rawOrigins) return void 0;
   let origins;
   try {
@@ -67187,9 +67237,9 @@ function readCorsFromEnv() {
   const list = (Array.isArray(origins) ? origins : [origins]).filter((origin) => typeof origin === "string").map((origin) => origin.trim()).filter((origin) => origin.length > 0);
   if (list.length === 0) return void 0;
   const cors2 = { origin: list.includes("*") ? true : list };
-  const credentials = getEnv12("FRONTMCP_CORS_CREDENTIALS");
+  const credentials = getEnv13("FRONTMCP_CORS_CREDENTIALS");
   if (credentials !== void 0) cors2.credentials = credentials === "true" || credentials === "1";
-  const maxAge = Number(getEnv12("FRONTMCP_CORS_MAX_AGE"));
+  const maxAge = Number(getEnv13("FRONTMCP_CORS_MAX_AGE"));
   if (Number.isFinite(maxAge) && maxAge > 0) cors2.maxAge = maxAge;
   return cors2;
 }
@@ -67203,10 +67253,10 @@ var init_cors_env = __esm({
 });
 
 // libs/sdk/src/server/middleware/csp.middleware.ts
-import { getEnv as getEnv13, getEnvFlag as getEnvFlag2 } from "@frontmcp/utils";
+import { getEnv as getEnv14, getEnvFlag as getEnvFlag2 } from "@frontmcp/utils";
 function readCspFromEnv() {
   if (!getEnvFlag2("FRONTMCP_CSP_ENABLED")) return void 0;
-  const rawDirectives = getEnv13("FRONTMCP_CSP_DIRECTIVES") ?? "";
+  const rawDirectives = getEnv14("FRONTMCP_CSP_DIRECTIVES") ?? "";
   const directives = {};
   for (const part of rawDirectives.split(";")) {
     const trimmed = part.trim();
@@ -67221,7 +67271,7 @@ function readCspFromEnv() {
   return {
     enabled: true,
     directives,
-    reportUri: getEnv13("FRONTMCP_CSP_REPORT_URI"),
+    reportUri: getEnv14("FRONTMCP_CSP_REPORT_URI"),
     reportOnly: getEnvFlag2("FRONTMCP_CSP_REPORT_ONLY")
   };
 }
@@ -67247,12 +67297,12 @@ function readSecurityHeadersFromEnv() {
   };
 }
 function readHeaderEnv(name44, fallback) {
-  const value = getEnv13(name44);
+  const value = getEnv14(name44);
   if (value === void 0 || value === "") return fallback;
   return ["off", "false", "none"].includes(value.trim().toLowerCase()) ? void 0 : value;
 }
 function readCustomHeadersFromEnv() {
-  const raw = getEnv13("FRONTMCP_HEADERS_CUSTOM");
+  const raw = getEnv14("FRONTMCP_HEADERS_CUSTOM");
   if (!raw) return void 0;
   try {
     const parsed = JSON.parse(raw);
@@ -68432,7 +68482,7 @@ var init_server_instance = __esm({
 
 // libs/sdk/src/front-mcp/front-mcp.providers.ts
 import { ProviderScope as ProviderScope9 } from "@frontmcp/di";
-import { getEnv as getEnv14 } from "@frontmcp/utils";
+import { getEnv as getEnv15 } from "@frontmcp/utils";
 function createMcpGlobalProviders(metadata) {
   const isCli = !!metadata["__cliMode"];
   const isNoServe = metadata.serve === false;
@@ -68456,7 +68506,7 @@ var init_front_mcp_providers = __esm({
         useValue: metadata
       })
     };
-    defaultHttpOptions = () => ({ port: Number(getEnv14("PORT")) || 3e3, entryPath: "/mcp", bodyLimit: "4mb" });
+    defaultHttpOptions = () => ({ port: Number(getEnv15("PORT")) || 3e3, entryPath: "/mcp", bodyLimit: "4mb" });
     frontMcpServer = AsyncProvider({
       name: "frontmcp:server",
       scope: ProviderScope9.GLOBAL,
@@ -68549,9 +68599,10 @@ function collectStaticEntries(config) {
   };
   const visitEntries = (owner, app) => {
     const reach = app ? { app } : "every-plugin";
+    const toolReach = app ? { app } : "every-app";
     for (const item of owner.tools ?? []) {
       const record = tryNormalize(() => normalizeTool(item));
-      if (record) add(`Tool "${record.metadata.id || record.metadata.name}"`, record.metadata, reach);
+      if (record) add(`Tool "${record.metadata.id || record.metadata.name}"`, record.metadata, toolReach);
     }
     for (const item of owner.resources ?? []) {
       if (tryNormalize(() => isResourceTemplate(item))) {
@@ -68584,7 +68635,10 @@ function collectStaticEntries(config) {
     visitPlugins(owner.plugins, app);
   };
   const server = config;
-  visitEntries({ skills: server.skills, plugins: server.plugins }, void 0);
+  visitEntries(
+    { tools: server.tools, resources: server.resources, skills: server.skills, plugins: server.plugins },
+    void 0
+  );
   for (const app of server.apps ?? []) {
     const record = tryNormalize(() => normalizeApp(app));
     if (record?.kind === "LOCAL_CLASS" /* LOCAL_CLASS */) visitEntries(record.metadata, record);
@@ -68592,6 +68646,7 @@ function collectStaticEntries(config) {
   const everyPluginKeys = /* @__PURE__ */ new Set([...everyAppKeys, ...[...ownAppKeys.values()].flatMap((keys) => [...keys])]);
   const keysReaching = (reach) => {
     if (reach === "every-plugin") return everyPluginKeys;
+    if (reach === "every-app") return everyAppKeys;
     if ("agentKeys" in reach) return reach.agentKeys;
     return /* @__PURE__ */ new Set([...everyAppKeys, ...ownAppKeys.get(reach.app) ?? []]);
   };
@@ -68640,7 +68695,7 @@ var front_mcp_exports = {};
 __export(front_mcp_exports, {
   FrontMcpInstance: () => FrontMcpInstance
 });
-import { fileExists as fileExists7, getEnv as getEnv15, isEdgeRuntime as isEdgeRuntime2, randomUUID as randomUUID29, unlink as unlink2 } from "@frontmcp/utils";
+import { fileExists as fileExists7, getEnv as getEnv16, isEdgeRuntime as isEdgeRuntime2, randomUUID as randomUUID29, unlink as unlink2 } from "@frontmcp/utils";
 function resolveConfigInput(optionsOrClass) {
   if (typeof optionsOrClass === "function") {
     const stored = getDecoratorConfig(optionsOrClass);
@@ -68708,7 +68763,7 @@ var init_front_mcp = __esm({
         for (const scope of this.getScopes()) {
           await scope.emitServerStarted();
         }
-        if (getEnv15("FRONTMCP_DEV_BOOTSTRAP_SENTINEL") === "1") {
+        if (getEnv16("FRONTMCP_DEV_BOOTSTRAP_SENTINEL") === "1") {
           process.stderr.write(`__FRONTMCP_BOOTSTRAP_COMPLETE__ ${JSON.stringify(this.devListenerInfo(server))}
 `);
         }
@@ -71980,6 +72035,7 @@ export {
   RemoveWorkflowTool,
   RequestContextNotAvailableError,
   RequiredConfigUndefinedError,
+  ReservedAppIdError,
   Resource,
   ResourceContext,
   ResourceEntry,

package/front-mcp/static-startup.check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"static-startup.check.d.ts","sourceRoot":"","sources":["../../src/front-mcp/static-startup.check.ts"],"names":[],"mappings":"AA+BA,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EAGxB,MAAM,WAAW,CAAC;AA0LnB;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,IAAI,CA6BhG"}
+{"version":3,"file":"static-startup.check.d.ts","sourceRoot":"","sources":["../../src/front-mcp/static-startup.check.ts"],"names":[],"mappings":"AA+BA,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EAGxB,MAAM,WAAW,CAAC;AA+LnB;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,IAAI,CA6BhG"}

package/index.d.ts

@@ -50,10 +50,10 @@ export declare const ListToolsHook: {
     Around: (stage: "parseInput" | "ensureRemoteCapabilities" | "filterByAuthorities" | "resolveConflicts" | "findTools" | "parseTools", opts?: import("./common").HookOptions<import("./tool/flows/tools-list.flow").default>) => MethodDecorator;
 };
 export declare const HttpHook: {
-    Stage: (stage: "metrics" | "finalize" | "acquireQuota" | "acquireSemaphore" | "releaseSemaphore" | "releaseQuota" | "checkIpFilter" | "router" | "traceRequest" | "relayToSessionOwner" | "checkAuthorization" | "acquireIdentityQuota" | "checkPersistentSessionOwner" | "handleMcp2026" | "handleWebFetch" | "handleLegacySse" | "handleSse" | "handleStreamableHttp" | "handleStatefulHttp" | "handleStatelessHttp" | "handleDeleteSession" | "audit", opts?: import("./common").HookOptions<import("./scope/flows/http.request.flow").default>) => MethodDecorator;
-    Will: (stage: "metrics" | "finalize" | "acquireQuota" | "acquireSemaphore" | "releaseSemaphore" | "releaseQuota" | "checkIpFilter" | "router" | "traceRequest" | "relayToSessionOwner" | "checkAuthorization" | "acquireIdentityQuota" | "checkPersistentSessionOwner" | "handleMcp2026" | "handleWebFetch" | "handleLegacySse" | "handleSse" | "handleStreamableHttp" | "handleStatefulHttp" | "handleStatelessHttp" | "handleDeleteSession" | "audit", opts?: import("./common").HookOptions<import("./scope/flows/http.request.flow").default>) => MethodDecorator;
-    Did: (stage: "metrics" | "finalize" | "acquireQuota" | "acquireSemaphore" | "releaseSemaphore" | "releaseQuota" | "checkIpFilter" | "router" | "traceRequest" | "relayToSessionOwner" | "checkAuthorization" | "acquireIdentityQuota" | "checkPersistentSessionOwner" | "handleMcp2026" | "handleWebFetch" | "handleLegacySse" | "handleSse" | "handleStreamableHttp" | "handleStatefulHttp" | "handleStatelessHttp" | "handleDeleteSession" | "audit", opts?: import("./common").HookOptions<import("./scope/flows/http.request.flow").default>) => MethodDecorator;
-    Around: (stage: "metrics" | "finalize" | "acquireQuota" | "acquireSemaphore" | "releaseSemaphore" | "releaseQuota" | "checkIpFilter" | "router" | "traceRequest" | "relayToSessionOwner" | "checkAuthorization" | "acquireIdentityQuota" | "checkPersistentSessionOwner" | "handleMcp2026" | "handleWebFetch" | "handleLegacySse" | "handleSse" | "handleStreamableHttp" | "handleStatefulHttp" | "handleStatelessHttp" | "handleDeleteSession" | "audit", opts?: import("./common").HookOptions<import("./scope/flows/http.request.flow").default>) => MethodDecorator;
+    Stage: (stage: "metrics" | "audit" | "finalize" | "acquireQuota" | "acquireSemaphore" | "releaseSemaphore" | "releaseQuota" | "checkIpFilter" | "router" | "traceRequest" | "relayToSessionOwner" | "checkAuthorization" | "acquireIdentityQuota" | "checkPersistentSessionOwner" | "handleMcp2026" | "handleWebFetch" | "handleLegacySse" | "handleSse" | "handleStreamableHttp" | "handleStatefulHttp" | "handleStatelessHttp" | "handleDeleteSession", opts?: import("./common").HookOptions<import("./scope/flows/http.request.flow").default>) => MethodDecorator;
+    Will: (stage: "metrics" | "audit" | "finalize" | "acquireQuota" | "acquireSemaphore" | "releaseSemaphore" | "releaseQuota" | "checkIpFilter" | "router" | "traceRequest" | "relayToSessionOwner" | "checkAuthorization" | "acquireIdentityQuota" | "checkPersistentSessionOwner" | "handleMcp2026" | "handleWebFetch" | "handleLegacySse" | "handleSse" | "handleStreamableHttp" | "handleStatefulHttp" | "handleStatelessHttp" | "handleDeleteSession", opts?: import("./common").HookOptions<import("./scope/flows/http.request.flow").default>) => MethodDecorator;
+    Did: (stage: "metrics" | "audit" | "finalize" | "acquireQuota" | "acquireSemaphore" | "releaseSemaphore" | "releaseQuota" | "checkIpFilter" | "router" | "traceRequest" | "relayToSessionOwner" | "checkAuthorization" | "acquireIdentityQuota" | "checkPersistentSessionOwner" | "handleMcp2026" | "handleWebFetch" | "handleLegacySse" | "handleSse" | "handleStreamableHttp" | "handleStatefulHttp" | "handleStatelessHttp" | "handleDeleteSession", opts?: import("./common").HookOptions<import("./scope/flows/http.request.flow").default>) => MethodDecorator;
+    Around: (stage: "metrics" | "audit" | "finalize" | "acquireQuota" | "acquireSemaphore" | "releaseSemaphore" | "releaseQuota" | "checkIpFilter" | "router" | "traceRequest" | "relayToSessionOwner" | "checkAuthorization" | "acquireIdentityQuota" | "checkPersistentSessionOwner" | "handleMcp2026" | "handleWebFetch" | "handleLegacySse" | "handleSse" | "handleStreamableHttp" | "handleStatefulHttp" | "handleStatelessHttp" | "handleDeleteSession", opts?: import("./common").HookOptions<import("./scope/flows/http.request.flow").default>) => MethodDecorator;
 };
 export declare const OAuthAuthorizeHook: {
     Stage: (stage: "parseInput" | "validateOutput" | "validateInput" | "checkIpFilter" | "checkIfAuthorized" | "prepareAuthorizationRequest" | "buildAuthorizeOutput", opts?: import("./common").HookOptions<import("./auth/flows/oauth.authorize.flow").default>) => MethodDecorator;

package/index.js

@@ -5378,7 +5378,7 @@ var init_normalization_errors = __esm({
 });
 
 // libs/sdk/src/errors/registry.errors.ts
-var RegistryDefinitionNotFoundError, RegistryGraphEntryNotFoundError, RegistryDependencyNotRegisteredError, InvalidRegistryKindError, NameDisambiguationError, EntryValidationError, ToolNameConflictError, FlowNotRegisteredError, UnsupportedHookOwnerKindError;
+var RegistryDefinitionNotFoundError, RegistryGraphEntryNotFoundError, RegistryDependencyNotRegisteredError, InvalidRegistryKindError, NameDisambiguationError, EntryValidationError, ToolNameConflictError, ReservedAppIdError, FlowNotRegisteredError, UnsupportedHookOwnerKindError;
 var init_registry_errors = __esm({
   "libs/sdk/src/errors/registry.errors.ts"() {
     "use strict";
@@ -5421,6 +5421,14 @@ var init_registry_errors = __esm({
         super(`A tool named "${toolName}" is already registered`, "TOOL_NAME_CONFLICT");
       }
     };
+    ReservedAppIdError = class extends InternalMcpError {
+      constructor(appId) {
+        super(
+          `App id "${appId}" is reserved while @FrontMcp declares tools or resources: a server-level entry named like an app's is listed as "${appId}:<name>". Give the app another id.`,
+          "RESERVED_APP_ID"
+        );
+      }
+    };
     FlowNotRegisteredError = class extends InternalMcpError {
       constructor(flowName) {
         super(`Flow "${flowName}" is not registered`, "FLOW_NOT_REGISTERED");
@@ -6051,6 +6059,7 @@ __export(errors_exports, {
   RemoteUnsupportedTransportError: () => RemoteUnsupportedTransportError,
   RequestContextNotAvailableError: () => RequestContextNotAvailableError,
   RequiredConfigUndefinedError: () => RequiredConfigUndefinedError,
+  ReservedAppIdError: () => ReservedAppIdError,
   ResourceNotFoundError: () => ResourceNotFoundError,
   ResourceReadError: () => ResourceReadError,
   SamplingNotAvailableError: () => SamplingNotAvailableError,
@@ -13885,7 +13894,19 @@ var init_flow_context_providers = __esm({
   }
 });
 
+// libs/sdk/src/front-mcp/front-mcp.tokens.ts
+var FrontMcpConfig;
+var init_front_mcp_tokens2 = __esm({
+  "libs/sdk/src/front-mcp/front-mcp.tokens.ts"() {
+    "use strict";
+    FrontMcpConfig = /* @__PURE__ */ Symbol("FrontMcpConfig");
+  }
+});
+
 // libs/sdk/src/utils/lineage.utils.ts
+function isServerEntryOwner(owner) {
+  return owner?.kind === serverEntryOwner.kind && owner.id === serverEntryOwner.id && owner.ref === serverEntryOwner.ref;
+}
 function ownerKeyOf(lineage) {
   return lineage.map((o) => `${o.kind}:${o.id}`).join("/");
 }
@@ -13900,10 +13921,12 @@ function appOwnerIdOf(lineage, owner) {
   const owners2 = owner ? [...lineage, owner] : lineage;
   return owners2.find((candidate) => candidate.kind === "app")?.id;
 }
-var EntryLineageIndex;
+var serverEntryOwner, EntryLineageIndex;
 var init_lineage_utils = __esm({
   "libs/sdk/src/utils/lineage.utils.ts"() {
     "use strict";
+    init_front_mcp_tokens2();
+    serverEntryOwner = { kind: "scope", id: "server", ref: FrontMcpConfig };
     EntryLineageIndex = class {
       lineages = /* @__PURE__ */ new Map();
       /** Replace the index with these rows; an entry held by several rows keeps the first row's lineage. */
@@ -14341,9 +14364,9 @@ var init_call_tool_flow = __esm({
             "checkToolAuthorization: incrementalAuth enabled but the verified token carries no authorized_apps claim \u2014 failing closed"
           );
         }
-        const appId = tool?.owner?.id;
+        const appId = isServerEntryOwner(tool?.owner) ? void 0 : tool?.owner?.id;
         if (!appId) {
-          this.logger.verbose("checkToolAuthorization:skip (no owner)");
+          this.logger.verbose("checkToolAuthorization:skip (no app owner)");
           return;
         }
         const isAppAuthorized = (claimAuthorizedApps?.has(appId) ?? false) || (legacyAuthorization?.authorizedAppIds?.includes(appId) ?? false) || appId in (legacyAuthorization?.authorizedApps || {});
@@ -16456,15 +16479,6 @@ var init_instance_file_logger = __esm({
   }
 });
 
-// libs/sdk/src/front-mcp/front-mcp.tokens.ts
-var FrontMcpConfig;
-var init_front_mcp_tokens2 = __esm({
-  "libs/sdk/src/front-mcp/front-mcp.tokens.ts"() {
-    "use strict";
-    FrontMcpConfig = /* @__PURE__ */ Symbol("FrontMcpConfig");
-  }
-});
-
 // libs/sdk/src/regsitry/registry.base.ts
 var RegistryAbstract;
 var init_registry_base = __esm({
@@ -53798,9 +53812,15 @@ async function createSkillHttpCache(options = {}) {
 async function createRedisCache(redis, keyPrefix, ttlMs, logger) {
   const provider = redis.provider;
   if (provider === "vercel-kv" || provider === "@vercel/kv") {
-    const { kv } = require("@vercel/kv");
+    const url = (0, import_utils97.getEnv)("KV_REST_API_URL");
+    const token = (0, import_utils97.getEnv)("KV_REST_API_TOKEN");
+    if (!url || !token) {
+      throw new import_utils97.StorageConfigError("vercel-kv", "KV_REST_API_URL and KV_REST_API_TOKEN must be set.");
+    }
+    const { createClient } = require("@vercel/kv");
+    const client2 = createClient({ url, token, automaticDeserialization: false });
     return new RedisSkillHttpCache({
-      getClient: async () => kv,
+      getClient: async () => client2,
       keyPrefix,
       ttlMs
     });
@@ -53848,7 +53868,7 @@ async function getSkillHttpCache(scope) {
   if (pending) {
     return pending;
   }
-  const creationPromise = createCacheForScope(scopeId, cacheConfig);
+  const creationPromise = createCacheForScope(scopeId, cacheConfig, scope.logger);
   pendingCreation.set(scopeId, creationPromise);
   try {
     const cache2 = await creationPromise;
@@ -53858,12 +53878,13 @@ async function getSkillHttpCache(scope) {
     pendingCreation.delete(scopeId);
   }
 }
-async function createCacheForScope(scopeId, cacheConfig) {
+async function createCacheForScope(scopeId, cacheConfig, logger) {
   try {
     const { cache: cache2 } = await createSkillHttpCache({
       redis: cacheConfig.redis,
       ttlMs: cacheConfig.ttlMs,
-      keyPrefix: cacheConfig.keyPrefix ?? `frontmcp:skills:${scopeId}:cache:`
+      keyPrefix: cacheConfig.keyPrefix ?? `frontmcp:skills:${scopeId}:cache:`,
+      logger
     });
     return cache2;
   } catch (error) {
@@ -64291,6 +64312,29 @@ var init_http_request_flow = __esm({
   }
 });
 
+// libs/sdk/src/scope/server-entries.helper.ts
+async function registerServerEntries(providers, entries, appIds) {
+  if (!entries.tools?.length && !entries.resources?.length) return;
+  if (appIds.includes(serverEntryOwner.id)) throw new ReservedAppIdError(serverEntryOwner.id);
+  const registries = [];
+  if (entries.tools?.length) {
+    registries.push(new ToolRegistry(providers, entries.tools, serverEntryOwner, { adopt: false }).ready);
+  }
+  if (entries.resources?.length) {
+    registries.push(new ResourceRegistry(providers, entries.resources, serverEntryOwner, { adopt: false }).ready);
+  }
+  await Promise.all(registries);
+}
+var init_server_entries_helper = __esm({
+  "libs/sdk/src/scope/server-entries.helper.ts"() {
+    "use strict";
+    init_errors();
+    init_resource_registry();
+    init_tool_registry();
+    init_lineage_utils();
+  }
+});
+
 // libs/sdk/src/scope/scope.instance.ts
 var import_reflect_metadata25, import_auth60, import_guard9, import_utils115, SCOPE_NON_DISPATCHABLE_FLOWS, Scope;
 var init_scope_instance = __esm({
@@ -64352,6 +64396,7 @@ var init_scope_instance = __esm({
     init_http_ip_filter_flow();
     init_http_request_flow();
     init_optional_dependency_util();
+    init_server_entries_helper();
     SCOPE_NON_DISPATCHABLE_FLOWS = /* @__PURE__ */ new Set(["http:request"]);
     Scope = class _Scope extends ScopeEntry {
       id;
@@ -64783,6 +64828,11 @@ var init_scope_instance = __esm({
           await scopeAdapters.ready;
           this.onDispose(() => scopeAdapters.dispose());
         }
+        await registerServerEntries(
+          this.scopeProviders,
+          this.metadata,
+          this.scopeApps.getApps().map((app) => app.id)
+        );
         this.initAuthoritiesFromConfig();
         this.scopeTools = new ToolRegistry(this.scopeProviders, [], scopeRef);
         this.scopeResources = new ResourceRegistry(this.scopeProviders, [], scopeRef);
@@ -68336,9 +68386,10 @@ function collectStaticEntries(config) {
   };
   const visitEntries = (owner, app) => {
     const reach = app ? { app } : "every-plugin";
+    const toolReach = app ? { app } : "every-app";
     for (const item of owner.tools ?? []) {
       const record = tryNormalize(() => normalizeTool(item));
-      if (record) add(`Tool "${record.metadata.id || record.metadata.name}"`, record.metadata, reach);
+      if (record) add(`Tool "${record.metadata.id || record.metadata.name}"`, record.metadata, toolReach);
     }
     for (const item of owner.resources ?? []) {
       if (tryNormalize(() => isResourceTemplate(item))) {
@@ -68371,7 +68422,10 @@ function collectStaticEntries(config) {
     visitPlugins(owner.plugins, app);
   };
   const server = config;
-  visitEntries({ skills: server.skills, plugins: server.plugins }, void 0);
+  visitEntries(
+    { tools: server.tools, resources: server.resources, skills: server.skills, plugins: server.plugins },
+    void 0
+  );
   for (const app of server.apps ?? []) {
     const record = tryNormalize(() => normalizeApp(app));
     if (record?.kind === "LOCAL_CLASS" /* LOCAL_CLASS */) visitEntries(record.metadata, record);
@@ -68379,6 +68433,7 @@ function collectStaticEntries(config) {
   const everyPluginKeys = /* @__PURE__ */ new Set([...everyAppKeys, ...[...ownAppKeys.values()].flatMap((keys) => [...keys])]);
   const keysReaching = (reach) => {
     if (reach === "every-plugin") return everyPluginKeys;
+    if (reach === "every-app") return everyAppKeys;
     if ("agentKeys" in reach) return reach.agentKeys;
     return /* @__PURE__ */ new Set([...everyAppKeys, ...ownAppKeys.get(reach.app) ?? []]);
   };
@@ -71354,6 +71409,7 @@ __export(index_exports, {
   RemoveWorkflowTool: () => RemoveWorkflowTool,
   RequestContextNotAvailableError: () => RequestContextNotAvailableError,
   RequiredConfigUndefinedError: () => RequiredConfigUndefinedError,
+  ReservedAppIdError: () => ReservedAppIdError,
   Resource: () => Resource,
   ResourceContext: () => ResourceContext,
   ResourceEntry: () => ResourceEntry,
@@ -72611,6 +72667,7 @@ var ChannelListHook = FlowHooksOf("channels:list");
   RemoveWorkflowTool,
   RequestContextNotAvailableError,
   RequiredConfigUndefinedError,
+  ReservedAppIdError,
   Resource,
   ResourceContext,
   ResourceEntry,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/sdk",
-  "version": "1.9.0",
+  "version": "1.9.1-rc.1",
   "description": "FrontMCP SDK",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -95,9 +95,9 @@
   },
   "peerDependencies": {
     "@anthropic-ai/sdk": "^0.30.0 || ^0.78.0",
-    "@enclave-vm/core": "^2.15.3",
-    "@frontmcp/observability": "1.9.0",
-    "@frontmcp/storage-sqlite": "1.9.0",
+    "@enclave-vm/core": "^2.16.0",
+    "@frontmcp/observability": "1.9.1-rc.1",
+    "@frontmcp/storage-sqlite": "1.9.1-rc.1",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/sdk-trace-base": "^2.8.0",
     "@vercel/kv": "^3.0.0",
@@ -138,13 +138,13 @@
     }
   },
   "dependencies": {
-    "@frontmcp/auth": "1.9.0",
-    "@frontmcp/di": "1.9.0",
-    "@frontmcp/guard": "1.9.0",
-    "@frontmcp/lazy-zod": "1.9.0",
-    "@frontmcp/protocol": "1.9.0",
-    "@frontmcp/uipack": "1.9.0",
-    "@frontmcp/utils": "1.9.0",
+    "@frontmcp/auth": "1.9.1-rc.1",
+    "@frontmcp/di": "1.9.1-rc.1",
+    "@frontmcp/guard": "1.9.1-rc.1",
+    "@frontmcp/lazy-zod": "1.9.1-rc.1",
+    "@frontmcp/protocol": "1.9.1-rc.1",
+    "@frontmcp/uipack": "1.9.1-rc.1",
+    "@frontmcp/utils": "1.9.1-rc.1",
     "@types/cors": "^2.8.17",
     "ioredis": "^5.8.0",
     "jose": "^6.1.3",