@decocms/runtime 1.1.3 → 1.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/runtime",
-  "version": "1.1.3",
+  "version": "1.2.1",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",
@@ -9,7 +9,7 @@
   "dependencies": {
     "@cloudflare/workers-types": "^4.20250617.0",
     "@decocms/bindings": "^1.0.7",
-    "@modelcontextprotocol/sdk": "1.25.1",
+    "@modelcontextprotocol/sdk": "1.25.2",
     "@ai-sdk/provider": "^3.0.0",
     "hono": "^4.10.7",
     "jose": "^6.0.11",

package/src/asset-server/index.ts

@@ -1,5 +1,5 @@
 import { devServerProxy } from "./dev-server-proxy";
-import { resolve, dirname } from "path";
+import { resolve, dirname, join } from "path";
 
 export interface AssetServerConfig {
   /**
@@ -209,9 +209,11 @@ export function createAssetHandler(config: AssetServerConfig = {}) {
       return null; // Path traversal attempt blocked
     }
 
+    // Try to serve the index.html file relative to the requested file
+    const indexRelativeToFilePath = join(filePath, "index.html");
     // Try to serve the requested file, fall back to index.html for SPA routing
     const indexPath = resolve(clientDir, "index.html");
-    for (const pathToTry of [filePath, indexPath]) {
+    for (const pathToTry of [filePath, indexRelativeToFilePath, indexPath]) {
       try {
         const file = Bun.file(pathToTry);
         if (await file.exists()) {

package/src/index.ts

@@ -22,6 +22,12 @@ export {
   type PromptExecutionContext,
   type CreatedPrompt,
   type GetPromptResult,
+  createResource,
+  createPublicResource,
+  type Resource,
+  type ResourceExecutionContext,
+  type ResourceContents,
+  type CreatedResource,
 } from "./tools.ts";
 import type { Binding } from "./wrangler.ts";
 export { proxyConnectionForId, BindingOf } from "./bindings.ts";

package/src/tools.ts

@@ -133,6 +133,67 @@ export type CreatedPrompt = {
   }): Promise<GetPromptResult> | GetPromptResult;
 };
 
+// ============================================================================
+// Resource Types
+// ============================================================================
+
+/**
+ * Context passed to resource read functions.
+ */
+export interface ResourceExecutionContext {
+  uri: URL;
+  runtimeContext: AppContext;
+}
+
+/**
+ * Resource contents returned from read operations.
+ * Per MCP spec, resources return either text or blob content.
+ */
+export interface ResourceContents {
+  /** The URI of the resource */
+  uri: string;
+  /** MIME type of the content */
+  mimeType?: string;
+  /** Text content (for text-based resources) */
+  text?: string;
+  /** Base64-encoded binary content (for binary resources) */
+  blob?: string;
+}
+
+/**
+ * Resource interface for defining MCP resources.
+ * Resources are read-only, addressable entities that expose data like config, docs, or context.
+ */
+export interface Resource {
+  /** Resource URI (static) or URI template (e.g., "config://app" or "file://{path}") */
+  uri: string;
+  /** Human-readable name for the resource */
+  name: string;
+  /** Description of what the resource contains */
+  description?: string;
+  /** MIME type of the resource content */
+  mimeType?: string;
+  /** Handler function to read the resource content */
+  read(
+    context: ResourceExecutionContext,
+  ): Promise<ResourceContents> | ResourceContents;
+}
+
+/**
+ * CreatedResource is a permissive type that any Resource can be assigned to.
+ * Uses a structural type with relaxed read signature to allow resources with any context.
+ */
+export type CreatedResource = {
+  uri: string;
+  name: string;
+  description?: string;
+  mimeType?: string;
+  read(context: {
+    uri: URL;
+    runtimeContext: AppContext;
+  }): Promise<ResourceContents> | ResourceContents;
+};
+
 /**
  * creates a private tool that always ensure for athentication before being executed
  */
@@ -223,6 +284,39 @@ export function createPrompt<TArgs extends PromptArgsRawShape>(
   });
 }
 
+/**
+ * Creates a public resource that does not require authentication.
+ */
+export function createPublicResource(opts: Resource): Resource {
+  return {
+    ...opts,
+    read: (input: ResourceExecutionContext) => {
+      return opts.read({
+        ...input,
+        runtimeContext: createRuntimeContext(input.runtimeContext),
+      });
+    },
+  };
+}
+
+/**
+ * Creates a resource that always ensures authentication before being read.
+ * This is the default and recommended way to create resources.
+ */
+export function createResource(opts: Resource): Resource {
+  const read = opts.read;
+  return createPublicResource({
+    ...opts,
+    read: (input: ResourceExecutionContext) => {
+      const env = input.runtimeContext.env;
+      if (env) {
+        env.MESH_REQUEST_CONTEXT?.ensureAuthenticated();
+      }
+      return read(input);
+    },
+  });
+}
+
 export interface ViewExport {
   title: string;
   icon: string;
@@ -360,6 +454,17 @@ export interface CreateMCPServerOptions<
           | Promise<CreatedPrompt[]>
       >
     | ((env: TEnv) => CreatedPrompt[] | Promise<CreatedPrompt[]>);
+  resources?:
+    | Array<
+        (
+          env: TEnv,
+        ) =>
+          | Promise<CreatedResource>
+          | CreatedResource
+          | CreatedResource[]
+          | Promise<CreatedResource[]>
+      >
+    | ((env: TEnv) => CreatedResource[] | Promise<CreatedResource[]>);
 }
 
 export type Fetch<TEnv = unknown> = (
@@ -530,7 +635,7 @@ export const createMCPServer = <
 
     const server = new McpServer(
       { name: "@deco/mcp-api", version: "1.0.0" },
-      { capabilities: { tools: {}, prompts: {} } },
+      { capabilities: { tools: {}, prompts: {}, resources: {} } },
     );
 
     const toolsFn =
@@ -576,13 +681,28 @@ export const createMCPServer = <
               : z.object({}).shape,
         },
         async (args) => {
-          let result = await tool.execute({
+          const result = await tool.execute({
             context: args,
             runtimeContext: createRuntimeContext(),
           });
 
+          // For streamable tools, the Response is handled at the transport layer
+          // Do NOT call result.bytes() - it buffers the entire response in memory
+          // causing massive memory leaks (2GB+ Uint8Array accumulation)
           if (isStreamableTool(tool) && result instanceof Response) {
-            result = { bytes: await result.bytes() };
+            return {
+              structuredContent: {
+                streamable: true,
+                status: result.status,
+                statusText: result.statusText,
+              },
+              content: [
+                {
+                  type: "text",
+                  text: `Streaming response: ${result.status} ${result.statusText}`,
+                },
+              ],
+            };
           }
           return {
             structuredContent: result as Record<string, unknown>,
@@ -637,7 +757,86 @@ export const createMCPServer = <
       );
     }
 
-    return { server, tools, prompts };
+    // Resolve and register resources
+    const resourcesFn =
+      typeof options.resources === "function"
+        ? options.resources
+        : async (bindings: TEnv) => {
+            if (typeof options.resources === "function") {
+              return await options.resources(bindings);
+            }
+            return await Promise.all(
+              options.resources?.flatMap(async (resource) => {
+                const resourceResult = resource(bindings);
+                const awaited = await resourceResult;
+                if (Array.isArray(awaited)) {
+                  return awaited;
+                }
+                return [awaited];
+              }) ?? [],
+            ).then((r) => r.flat());
+          };
+    const resources = await resourcesFn(bindings);
+
+    for (const resource of resources) {
+      server.resource(
+        resource.name,
+        resource.uri,
+        {
+          description: resource.description,
+          mimeType: resource.mimeType,
+        },
+        async (uri) => {
+          const result = await resource.read({
+            uri,
+            runtimeContext: createRuntimeContext(),
+          });
+          // Build content object based on what's provided (text or blob, not both)
+          const content: {
+            uri: string;
+            mimeType?: string;
+            text?: string;
+            blob?: string;
+          } = { uri: result.uri };
+
+          if (result.mimeType) {
+            content.mimeType = result.mimeType;
+          }
+
+          // MCP SDK expects either text or blob content, not both
+          if (result.text !== undefined) {
+            return {
+              contents: [
+                {
+                  uri: result.uri,
+                  mimeType: result.mimeType,
+                  text: result.text,
+                },
+              ],
+            };
+          } else if (result.blob !== undefined) {
+            return {
+              contents: [
+                {
+                  uri: result.uri,
+                  mimeType: result.mimeType,
+                  blob: result.blob,
+                },
+              ],
+            };
+          }
+
+          // Fallback to empty text if neither provided
+          return {
+            contents: [
+              { uri: result.uri, mimeType: result.mimeType, text: "" },
+            ],
+          };
+        },
+      );
+    }
+
+    return { server, tools, prompts, resources };
   };
 
   const fetch = async (req: Request, env: TEnv) => {
@@ -646,7 +845,18 @@ export const createMCPServer = <
 
     await server.connect(transport);
 
-    return await transport.handleRequest(req);
+    try {
+      return await transport.handleRequest(req);
+    } finally {
+      // CRITICAL: Close transport to prevent memory leaks
+      // Without this, ReadableStream/WritableStream controllers accumulate
+      // causing thousands of stream objects to be retained in memory
+      try {
+        await transport.close?.();
+      } catch {
+        // Ignore close errors - transport may already be closed
+      }
+    }
   };
 
   const callTool: CallTool = async ({ toolCallId, toolCallInput }) => {