[frontegg-david]

Stacked on #1011 (which adds internalZ; split out so each PR stays under CodeRabbit's 150-file limit)

Closes #949

What and why

Follow-up to the 1.10.9 performance work (#914, #919–#925, #932, #934–#943), on the follow-up stack's P03. After
startup, a FrontMCP server held 5,529 Zod schema instances plus 953 lazy stand-ins, which together retained 6.32 MB.
@frontmcp/lazy-zod already deferred compound schemas (z.object(), z.union(), …), but leaf schemas
(z.string(), z.enum(), …) were built when their module loaded, and 440 of the 953 stand-ins were built during
startup anyway.

Those 440 aren't built by FrontMCP code reading metadata. They come from Zod itself. Zod 4.6 attaches a
memoizer to every container (object, array, tuple, record, map, set), and the first parse of each runs isRecursive,
which walks the container's whole subtree to look for cycles and reads _zod on every child. Parsing the
@FrontMcp config (219 stand-ins built), @App (93), @Flow (57) and @Tool (44) metadata therefore built every
schema under them, including optional sections the input doesn't have, such as auth, redis and jobs.

This PR covers both items of the issue's proposal. Item 1 is the internal export, used for the schemas in sdk, auth
and utils. Item 2 is startup no longer building schemas it only walks: the walk is skipped for FrontMCP's own
schemas.

What changed

@frontmcp/lazy-zod

• internalZ, a new export. It defers every schema factory: the compound ones z defers, plus string,
  number, int, boolean, bigint, symbol, date, undefined, null, void, any, unknown, never,
  nan, literal, enum, nativeEnum, url, email, uuid, array, set, map, partialRecord, optional,
  nullable, lazy, function, custom, instanceof and preprocess. Anything else passes through to Zod.
  • A stand-in builds its leaf children with it, and swaps in children that are already built. A built schema
    therefore holds Zod's own leaves, and parses on Zod's compiled fast path. Leaving the stand-ins in place would
    make a five-field object parse about 4.5× slower in a microbenchmark (41 ns → 185 ns, about 30 ns per proxied
    child). On the
    benchmark it would raise proxy reads per tools/call from 17 to 59. Compound children stay deferred until a
    parse reaches them.
  • It builds without Zod's cycle-check walk. It builds with Zod's memoizer minus attach, swapped in through
    z.config() for the duration of the build and restored afterwards, even when the build throws. A parse then
    builds only what it touches. Zod's memoizer stays in place for every other schema, and z's schemas keep it:
    a stand-in from z or lazyZ() that Zod builds while it builds one of FrontMCP's (.merge(), record() and
    discriminatedUnion() read their arguments) is built with Zod's memoizer, from this copy of lazy-zod or another
    one in the process. When Zod has no memoizer to swap, the build is left to Zod.
• The public z is unchanged. Its leaf factories are Zod's own functions and return Zod's own schemas, which
  new tests pin. The README lists internalZ as internal. It isn't re-exported from @frontmcp/sdk.
• Stand-in memory. Stand-ins, from z and internalZ alike, share one Proxy handler instead of allocating a
  handler and three trap closures each, and drop their factory and its captured arguments once built.
• forceMaterialize, which toJSONSchema runs first, also follows catchall, tuple rest and pipe in/out.
  It leaves alone the catchall getter that .merge() defines, so merged schemas still convert.

sdk, auth, utils

• 139 source files that build schemas now import internalZ as z: 117 in sdk, 18 in auth, 4 in utils. Only the
  import line changes.
• Two files stay on z:
  • auth/src/authorities/authorities.schema.ts: authoritiesPolicySchema is recursive (z.lazy refers to
    itself), and only Zod's memoizer lets it parse a policy that refers to itself. A new test pins that it still
    does. With internalZ it overflows the stack.
  • auth/src/session/vault-encryption.ts (two small schemas): the pre-commit hook's lint config rejects an existing
    throw without cause in it, and changing that error is outside this PR.
• The remaining files that import from @frontmcp/lazy-zod import z only as a type, or import no z, so nothing
  changes for them at runtime. That leaves no runtime schema module in the three packages unswapped, hence Closes.

Results

The benchmark's FrontMCP implementation (frontmcp build --target node, one add tool, logging off), run with
node on Node.js 24.22.1, against npm packed builds of origin/main (42b36fa1b, 1.10.16) and of this branch,
installed into two scratch copies and built with npm run build. Both copies resolve zod 4.6.7. Every run used the
benchmark's own harness functions, interleaved or in random order, and every tools/call returned the spec's result.
Apple M4 Pro, with other jobs running on the machine: the 1-minute load average was 25 to 100 across the sessions, and
macOS was swapping, so the timing rows carry wide intervals. MB is 10^6 bytes; the intervals are 95% bootstrap
intervals of the difference in medians.

• Heap snapshot: written in the server 700 ms after spawn, after the first tools/call. Reachable heap is the self
  size of everything reachable from the root over non-weak edges. The Zod set is every object with an own _zod
  property, plus lazy stand-ins; its retained size is what becomes unreachable when the whole set is removed. Three
  interleaved runs of each build, all within 5 KB of each other.
• Heap used and RSS: process.memoryUsage().heapUsed 700 ms after spawn, after the first call. RSS is the process
  tree's, 1 s after the first call, read with the harness's rssOfTree. 30 interleaved runs of each build with no
  forced GC (load 39 to 80), and 20 with two gc() calls at the 700 ms mark (load 32 to 37).
• Server CPU: process.cpuUsage() in the server at the 700 ms mark: startup plus the first call. The same 30 runs.
• Proxy reads: a counter added to the stand-in proxy's get trap in scratch copies of the installed lazy-zod,
  over 2,000 calls after 2,000 warm-up calls.
• Cold start: the harness's coldStartOnce, spawn to the first tools/call response with initialize included.
  One discarded start per server, then 16 rounds of 4 starts per transport in random order: 64 starts each, in two
  sessions.

	main	This PR	Change
Zod schema instances	5,529	2,187	−3,342
Lazy stand-ins	953	3,733	+2,780
Retained by Zod instances and stand-ins	6.32 MB	4.14 MB	−2.18 MB
Reachable heap	35.54 MB	33.19 MB	−2.35 MB
Stand-ins built during startup	440	1,124
Heap used, median [min–max]	38.99 [37.4–39.6] MB	35.34 [35.1–36.5] MB	−3.64 MB (−3.85 to −3.63)
RSS 1 s after the first call, median [min–max]	138.4 [137.6–144.6] MB	138.6 [131.0–140.9] MB	+0.3 MB (−0.5 to +0.3)
After a full GC: heap used	34.09 MB	31.73 MB	−2.35 MB
After a full GC: RSS, median [min–max]	141.5 [138.5–143.8] MB	136.6 [135.5–141.7] MB	−4.9 MB (−5.9 to −3.7)
Server CPU to the 700 ms mark, median [min–max]	354.6 [341–404] ms	346.1 [330–373] ms	−8.6 ms (−16.7 to −1.3)
Cold start, HTTP, p50 / p90, session 1 (load ~95)	314.0 / 404.4 ms	307.6 / 370.5 ms	−6.4 ms (−22.6 to +8.7)
Cold start, stdio, p50 / p90, session 1	220.4 / 279.8 ms	218.4 / 262.6 ms	−2.0 ms (−8.6 to +8.2)
Cold start, HTTP, p50 / p90, session 2 (load 25–56)	324.8 / 563.3 ms	336.1 / 517.7 ms	+11.3 ms (−3.0 to +58.6)
Cold start, stdio, p50 / p90, session 2	235.6 / 372.5 ms	230.1 / 439.7 ms	−5.5 ms (−25.6 to +28.5)
Proxy reads per tools/call	17	18	+1

Against the issue's best case, measured against 1.10.9-rc.4 plus #942 with every factory deferred through the public
z:

	Issue's best case	This PR
Reachable heap	−1.26 MB	−2.35 MB
Zod instances (retained)	6.30 → 5.18 MB	6.32 → 4.14 MB
Heap used	−2.2 MB	−3.64 MB
RSS	−4.4 to −4.8 MB	−4.9 MB after a full GC; no change 1 s after the first call without one
Cold start, HTTP / stdio	−6.8 / −1.8 ms	not measurable here: both sessions' intervals include zero

• What's left: about 2 MB of the 4.14 MB is the MCP SDK's own schemas, which this PR doesn't touch.
• RSS: right after startup, V8 hasn't given back the space the old schemas took (heapTotal doesn't move either),
  so the lower heap shows in RSS only once a GC has run.
• Cold start: these sessions can't resolve a few milliseconds; the server CPU row is the steadier figure.
• Stand-ins built during startup: 1,124 against 440, because leaves are stand-ins now. Each leaf a parse touches
  is built then, as one Zod instance; on main it was built when its module loaded.
• Per call: server CPU per tools/call, read in the server around 3,000 calls after 2,000 warm-up calls, 8
  interleaved runs of each build (load 59 to 68): median 400.2 µs [345.8–625.0] on main, 389.8 µs [319.1–500.0]
  with this PR. No measurable change.
• Review fixes: the heap snapshot, rerun after them (two runs), gives the same figures: 33.19 MB reachable,
  2,187 Zod instances, 4.14 MB retained, 1,124 stand-ins built.

Two variants were measured and dropped:

• Leaving leaf stand-ins in built schemas: 0.47 MB less reachable heap (32.71 MB), but 59 proxy reads per
  tools/call instead of 17.
• This PR without the shared handler and the factory release: 34.63 MB reachable.

User-facing change

• What changed: none in the public API. z, eagerZ, lazyZ, toJSONSchema and the schemas @frontmcp/sdk,
  @frontmcp/auth and @frontmcp/utils export accept and reject the same inputs, with the same issues and messages.
  @frontmcp/lazy-zod gains an internalZ export that its README marks as internal and not part of the public API;
  @frontmcp/sdk doesn't re-export it.
• toJSONSchema fix: lazy-zod's toJSONSchema converts a schema whose catchall, tuple rest or pipe holds a
  stand-in from z, for example eagerZ.object({...}).catchall(z.object({...}).optional()). It threw
  TypeError: Cannot set properties of undefined (setting 'ref') before.
• Before → after: a server builds FrontMCP's own schemas, leaves included, the first time they are used, and
  holds 2.35 MB less reachable heap after startup. Schemas built from those exports, for example with .extend(), are
  built without Zod's cycle-check walk: a recursive schema made by extending one of them, such as
  Exported.extend({ next: z.lazy(() => Node).optional() }), overflows the stack on a cyclic JavaScript object, as
  every recursive schema did before Zod 4.6. Inputs parsed from JSON can't be cyclic. A recursive schema built with
  z keeps the walk, including when it's passed to one of those exports' methods.
• frontmcp.dev pages affected (if known): none. The z, eagerZ and lazyZ reference describes z, which
  doesn't change.
• Skills catalog entries updated: none; no catalog entry covers lazy-zod's internals.

Tests

• New, libs/lazy-zod/src/__tests__/internal-z.spec.ts (167 tests).
  • The public z: every leaf factory is Zod's own function and returns Zod's own schema; only the compound
    factories are deferred.
  • internalZ, table-driven over every factory it defers: a stand-in builds nothing until used, accepts and
    rejects the same inputs as Zod with the same issues and message, and converts to the same JSON Schema as Zod's
    own toJSONSchema. Then 16 chained cases, compared the same way: string and number checks, default,
    describe, nullish, refine, superRefine, transform, pipe, or/and, array(), catch,
    extend/pick/omit/partial/strict, merge, catchall, exclude, and nested optional sections.
  • How it builds: leaf children are built with their parent and come back as Zod's own schemas; compound
    children stay deferred until a parse reaches them; an already-built child is reused; Zod's memoizer stays in place
    for other schemas, which still parse a cyclic input; the memoizer is restored when a build throws.
  • The caller's schemas: a recursive schema from z, passed to .merge(), record() or
    discriminatedUnion() of internalZ's and built with it, still parses a cyclic input, and so does one from a
    second copy of lazy-zod (jest.isolateModules).
  • The Zod version: Zod attaches z.config().memoizer, z.memoizer(), to every container and it has attach;
    with that internal renamed away, internalZ builds with whatever Zod does and still validates the same.
  • Introspection and types: instanceof, .options, .shape, ._def, .isOptional(), .description after
    .extend(), discriminated unions, a toJSONSchema → z.fromJSONSchema round trip, and internalZ.infer /
    internalZ.ZodType.
• libs/lazy-zod/src/__tests__/materialization.spec.ts: toJSONSchema converts a merged schema, from z and
  from Zod, to what Zod's own toJSONSchema gives.
• New, libs/sdk/src/__tests__/internal-z-schema-parity.spec.ts (527 tests).
  • Loads @frontmcp/utils, @frontmcp/auth and @frontmcp/sdk twice: as built, and with internalZ mocked to the
    public z, i.e. how main built them.
  • For every exported schema (262: 6, 107 and 149): it generates a sample from the schema's definition, the
    sample with each key removed and with each key given a wrong type, and generic probes. That is 5,270 inputs, 879
    of them accepted. It checks that both builds give the same success, data, issues and error message.
  • Cyclic inputs: for a recursive schema it also builds a sample that refers back to itself, so a recursive
    schema moved to internalZ fails the spec. It finds three, authoritiesPolicySchema,
    authoritiesMetadataSchema and authoritiesConfigSchema; with authorities.schema.ts on internalZ, their six
    tests fail.
  • What consumers derive and read: for every exported schema, .optional(), .array(), .or() and
    z.object({ field }); for object schemas also .extend(), .merge(), .partial(), .strict(), .pick(),
    .omit(), z.object({ ...shape }) and, with a literal key, z.discriminatedUnion(). Each validates the same
    inputs and converts to the same JSON Schema with both builds. It also compares _zod.def.type, the class name,
    instanceof ZodType, .description, .meta(), isOptional(), isNullable(), the shape's keys and types,
    lazy-zod's toJSONSchema (output and input), and Zod's own toJSONSchema wherever the main-style build
    converts.
  • The spec catches changes: reversing internalZ's array arguments (enum values, union options) in the built
    package makes 105 of its 264 tests fail.
• New, libs/auth/src/authorities/__tests__/authorities.schema.cycles.spec.ts: a policy that refers to itself
  still parses, and keeps the cycle. It passes with z and overflows the stack with internalZ, which is why that
  file stays on z.
• nx run-many -t lint,test,build -p lazy-zod,utils,auth,sdk: all pass, with no lint errors.
  • Tests: lazy-zod 365, utils 1,923, auth 2,811 and sdk 7,946 (573 suites).
  • lazy-zod coverage: 98.0% statements, 93.6% branches, 98.7% functions, 99.0% lines; internal-z.ts and
    memoizer.ts 100%.
• nx run-many -t test over the other 23 publishable projects: all pass.
  • uipack 537, storage-sqlite 196, di 245, guard 271, protocol 9, ui 488, testing 401 (8 skipped), adapters 1,011,
    plugin-dashboard 226, plugin-remember 515, plugin-cache 202, plugin-skilled-openapi 433, plugin-codecall 1,208,
    react 758, skills 249, plugin-webmcp 91, plugin-approval 427, plugin-feature-flags 239, cli 2,115,
    observability 498 and nx-plugin 424.
• node --test scripts/*.test.mjs (the Worker export-condition and browser-build guards among them): 84 pass.
• e2e: bundle-size 10, dts-consumer 11, stdio-transport 27, direct 88, config 99, frontmcp-config 32,
  authorities 43 and standalone 53.
  • standalone's observability tests need @frontmcp/observability built, which its project doesn't list as a
    dependency. They passed once it was built.
• tsc --noEmit: 0 errors in the lazy-zod lib and spec configs, the utils and auth lib configs, and the sdk lib
  and spec configs.
• Prettier and scripts/fix-unused-imports.mjs: Prettier passes on the changed files, and the script changes
  nothing.
• Review cycle 1, CodeRabbit CLI: three findings, all fixed. The import rewrite had also changed the
  import { z } from '@frontmcp/lazy-zod' lines inside the JSDoc examples of agent/index.ts,
  builtin/config/index.ts and builtin/config/config.plugin.ts. Those are user-facing docs, so they are back to z.

[frontegg-david]

@coderabbitai review

[coderabbitai]

Warning

Review limit reached

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Next included review available in 46 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available. Your 52 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: agentfront/frontmcp
• Branch: perf/p03a-internal-z
• File: .coderabbit.yaml
• Commit: 29aedfd
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Essentials
• Run ID: 08a268ab-1eb5-418f-8e83-07740b705402

Commits

Reviewing files that changed from the base of the PR and between 29aedfd and 39816f7.

Files selected for processing: 141

• libs/auth/src/authorities/__tests__/authorities.schema.cycles.spec.ts
• libs/auth/src/authorization/authorization.types.ts
• libs/auth/src/cimd/cimd.types.ts
• libs/auth/src/common/jwt.types.ts
• libs/auth/src/common/session.types.ts
• libs/auth/src/consent/consent.types.ts
• libs/auth/src/detection/auth-provider-detection.ts
• libs/auth/src/options/app-auth.schema.ts
• libs/auth/src/options/orchestrated.schema.ts
• libs/auth/src/options/public.schema.ts
• libs/auth/src/options/schema.ts
• libs/auth/src/options/shared.schemas.ts
• libs/auth/src/options/static.schema.ts
• libs/auth/src/options/transparent.schema.ts
• libs/auth/src/session/authorization-vault.ts
• libs/auth/src/session/authorization.store.ts
• libs/auth/src/session/encrypted-authorization-vault.ts
• libs/auth/src/session/transport-session.types.ts
• libs/auth/src/vault/auth-providers.types.ts
• libs/sdk/src/__tests__/internal-z-schema-parity.spec.ts
• libs/sdk/src/agent/agent-builtin-tools.ts
• libs/sdk/src/agent/agent.instance.ts
• libs/sdk/src/agent/flows/call-agent.flow.ts
• libs/sdk/src/auth/flows/auth.verify.flow.ts
• libs/sdk/src/auth/flows/oauth.auth-ui.flow.ts
• libs/sdk/src/auth/flows/oauth.authorize.flow.ts
• libs/sdk/src/auth/flows/oauth.callback.flow.ts
• libs/sdk/src/auth/flows/oauth.connect.flow.ts
• libs/sdk/src/auth/flows/oauth.provider-callback.flow.ts
• libs/sdk/src/auth/flows/oauth.register.flow.ts
• libs/sdk/src/auth/flows/oauth.token.flow.ts
• libs/sdk/src/auth/flows/oauth.userinfo.flow.ts
• libs/sdk/src/auth/flows/session.verify.flow.ts
• libs/sdk/src/auth/flows/well-known.jwks.flow.ts
• libs/sdk/src/auth/flows/well-known.oauth-authorization-server.flow.ts
• libs/sdk/src/auth/flows/well-known.prm.flow.ts
• libs/sdk/src/channel/flows/list-channels.flow.ts
• libs/sdk/src/channel/flows/send-channel-notification.flow.ts
• libs/sdk/src/channel/reply/reply.types.ts
• libs/sdk/src/common/common.schema.ts
• libs/sdk/src/common/entries/job.entry.ts
• libs/sdk/src/common/entries/tool.entry.ts
• libs/sdk/src/common/flow/flow.utils.ts
• libs/sdk/src/common/metadata/adapter.metadata.ts
• libs/sdk/src/common/metadata/agent.metadata.ts
• libs/sdk/src/common/metadata/app-filter.metadata.ts
• libs/sdk/src/common/metadata/app.metadata.ts
• libs/sdk/src/common/metadata/auth-provider.metadata.ts
• libs/sdk/src/common/metadata/channel.metadata.ts
• libs/sdk/src/common/metadata/flow.metadata.ts
• libs/sdk/src/common/metadata/front-mcp.metadata.ts
• libs/sdk/src/common/metadata/job.metadata.ts
• libs/sdk/src/common/metadata/logger.metadata.ts
• libs/sdk/src/common/metadata/output-policy.ts
• libs/sdk/src/common/metadata/plugin.metadata.ts
• libs/sdk/src/common/metadata/prompt.metadata.ts
• libs/sdk/src/common/metadata/provider.metadata.ts
• libs/sdk/src/common/metadata/resource.metadata.ts
• libs/sdk/src/common/metadata/skill.metadata.ts
• libs/sdk/src/common/metadata/tool.metadata.ts
• libs/sdk/src/common/metadata/ui-serving-mode.ts
• libs/sdk/src/common/metadata/workflow.metadata.ts
• libs/sdk/src/common/schemas/annotated-class.schema.ts
• libs/sdk/src/common/schemas/http-input.schema.ts
• libs/sdk/src/common/schemas/http-output.schema.ts
• libs/sdk/src/common/schemas/session-header.schema.ts
• libs/sdk/src/common/types/auth/session.types.ts
• libs/sdk/src/common/types/options/elicitation/schema.ts
• libs/sdk/src/common/types/options/ext-apps/schema.ts
• libs/sdk/src/common/types/options/health/schema.ts
• libs/sdk/src/common/types/options/http/schema.ts
• libs/sdk/src/common/types/options/logging/schema.ts
• libs/sdk/src/common/types/options/metrics/schema.ts
• libs/sdk/src/common/types/options/observability/schema.ts
• libs/sdk/src/common/types/options/outbound-fetch/schema.ts
• libs/sdk/src/common/types/options/pagination/schema.ts
• libs/sdk/src/common/types/options/redis/schema.ts
• libs/sdk/src/common/types/options/registry/schema.ts
• libs/sdk/src/common/types/options/server-info/schema.ts
• libs/sdk/src/common/types/options/session/schema.ts
• libs/sdk/src/common/types/options/skills-http/schema.ts
• libs/sdk/src/common/types/options/sqlite/schema.ts
• libs/sdk/src/common/types/options/transport/schema.ts
• libs/sdk/src/common/utils/decide-request-intent.utils.ts
• libs/sdk/src/completion/flows/complete.flow.ts
• libs/sdk/src/elicitation/flows/elicitation-request.flow.ts
• libs/sdk/src/elicitation/flows/elicitation-result.flow.ts
• libs/sdk/src/elicitation/helpers/elicit.helper.ts
• libs/sdk/src/elicitation/helpers/validate-elicitation-content.ts
• libs/sdk/src/elicitation/send-elicitation-result.tool.ts
• libs/sdk/src/errors/authorization-required.error.ts
• libs/sdk/src/esm-loader/esm-auth.types.ts
• libs/sdk/src/esm-loader/esm-manifest.ts
• libs/sdk/src/esm-loader/factories/esm-record-builders.ts
• libs/sdk/src/job/flows/execute-job.flow.ts
• libs/sdk/src/job/job.instance.ts
• libs/sdk/src/job/tools/execute-job.tool.ts
• libs/sdk/src/job/tools/get-job-status.tool.ts
• libs/sdk/src/job/tools/list-jobs.tool.ts
• libs/sdk/src/job/tools/register-job.tool.ts
• libs/sdk/src/job/tools/remove-job.tool.ts
• libs/sdk/src/logging/flows/set-level.flow.ts
• libs/sdk/src/mcp-registry/flows/server-card.flow.ts
• libs/sdk/src/mcp-registry/flows/well-known.ai-catalog.flow.ts
• libs/sdk/src/prompt/flows/get-prompt.flow.ts
• libs/sdk/src/prompt/flows/prompts-list.flow.ts
• libs/sdk/src/resource/flows/read-resource.flow.ts
• libs/sdk/src/resource/flows/resource-templates-list.flow.ts
• libs/sdk/src/resource/flows/resources-list.flow.ts
• libs/sdk/src/resource/flows/subscribe-resource.flow.ts
• libs/sdk/src/resource/flows/unsubscribe-resource.flow.ts
• libs/sdk/src/scope/flows/http.request.flow.ts
• libs/sdk/src/skill/flows/filter-skills.flow.ts
• libs/sdk/src/skill/flows/http/llm-full-txt.flow.ts
• libs/sdk/src/skill/flows/http/llm-txt.flow.ts
• libs/sdk/src/skill/flows/http/skills-api.flow.ts
• libs/sdk/src/skill/flows/load-skill.flow.ts
• libs/sdk/src/skill/flows/search-skills.flow.ts
• libs/sdk/src/task/flows/tasks-cancel.flow.ts
• libs/sdk/src/task/flows/tasks-get.flow.ts
• libs/sdk/src/task/flows/tasks-list.flow.ts
• libs/sdk/src/task/flows/tasks-result.flow.ts
• libs/sdk/src/tool/flows/call-tool.flow.ts
• libs/sdk/src/tool/flows/tools-list.flow.ts
• libs/sdk/src/tool/tool.instance.ts
• libs/sdk/src/tool/tool.utils.ts
• libs/sdk/src/transport/flows/handle.mcp-20260728.flow.ts
• libs/sdk/src/transport/flows/handle.sse.flow.ts
• libs/sdk/src/transport/flows/handle.stateless-http.flow.ts
• libs/sdk/src/transport/flows/handle.streamable-http.flow.ts
• libs/sdk/src/transport/mcp-20260728/dispatcher.ts
• libs/sdk/src/transport/mcp-handlers/skills-mcp.types.ts
• libs/sdk/src/workflow/tools/execute-workflow.tool.ts
• libs/sdk/src/workflow/tools/get-workflow-status.tool.ts
• libs/sdk/src/workflow/tools/list-workflows.tool.ts
• libs/sdk/src/workflow/tools/register-workflow.tool.ts
• libs/sdk/src/workflow/tools/remove-workflow.tool.ts
• libs/utils/src/crypto/key-persistence/schemas.ts
• libs/utils/src/crypto/secret-persistence/schema.ts
• libs/utils/src/env/browser-runtime-context.ts
• libs/utils/src/env/runtime-context.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[coderabbitai]

Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[frontegg-david]

@coderabbitai review

[coderabbitai]

Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[github-actions]

Performance Test Results

Status: ✅ All tests passed

Summary

Project	Tests	Passed	Warnings	Failed	Leaks
✅ demo-e2e-agents	4	4	0	0	0
✅ demo-e2e-cache	11	11	0	0	0
✅ demo-e2e-codecall	4	4	0	0	0
✅ demo-e2e-config	4	4	0	0	0
✅ demo-e2e-direct	3	3	0	0	0
✅ demo-e2e-elicitation	1	1	0	0	0
✅ demo-e2e-errors	4	4	0	0	0
✅ demo-e2e-hooks	3	3	0	0	0
✅ demo-e2e-multiapp	4	4	0	0	0
✅ demo-e2e-notifications	3	3	0	0	0
✅ demo-e2e-openapi	2	2	0	0	0
✅ demo-e2e-providers	4	4	0	0	0
✅ demo-e2e-public	4	4	0	0	0
✅ demo-e2e-redis	15	15	0	0	0
✅ demo-e2e-remember	4	4	0	0	0
✅ demo-e2e-remote	5	5	0	0	0
✅ demo-e2e-serverless	2	2	0	0	0
✅ demo-e2e-skills	15	15	0	0	0
✅ demo-e2e-standalone	2	2	0	0	0
✅ demo-e2e-transport-recreation	3	3	0	0	0
✅ demo-e2e-ui	4	4	0	0	0

Total: 101 tests across 21 projects

📊 View full report in workflow run

---

Generated at: 2026-11-02T17:50:44.724Z
Commit: 644b1f20