@decocms/runtime 1.2.7 → 1.2.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/runtime",
-  "version": "1.2.7",
+  "version": "1.2.9",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",
@@ -9,7 +9,7 @@
   "dependencies": {
     "@cloudflare/workers-types": "^4.20250617.0",
     "@decocms/bindings": "^1.0.7",
-    "@modelcontextprotocol/sdk": "1.25.3",
+    "@modelcontextprotocol/sdk": "1.26.0",
     "@ai-sdk/provider": "^3.0.0",
     "hono": "^4.10.7",
     "jose": "^6.0.11",

package/src/bindings.ts

@@ -108,6 +108,12 @@ export const proxyConnectionForId = (
     headers ??= {};
     headers.cookie = ctx.cookie;
   }
+
+  if (ctx.token) {
+    headers ??= {};
+    headers["x-mesh-token"] = ctx.token;
+  }
+
   return {
     type: "HTTP",
     url: new URL(`/mcp/${connectionId}`, ctx.meshUrl).href,

package/src/index.ts

@@ -195,7 +195,7 @@ export const withBindings = <TEnv>({
 
     context = {
       authorization,
-      state: decoded.state ?? metadata.state,
+      state: decoded.state ?? metadata.state ?? {},
       token: tokenOrContext,
       meshUrl: (decoded.meshUrl as string) ?? metadata.meshUrl,
       connectionId: (decoded.connectionId as string) ?? metadata.connectionId,

package/src/oauth.ts

@@ -70,27 +70,6 @@ interface CodePayload {
   codeChallengeMethod?: string;
 }
 
-/**
- * OAuth 2.0/2.1 Token Request Parameters
- * Per RFC 6749 (OAuth 2.0) and RFC 9207 (OAuth 2.1)
- * All parameters are strings when properly formatted
- * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
- */
-interface OAuthTokenRequestBody {
-  /** REQUIRED for authorization_code grant - The authorization code from callback */
-  code?: string;
-  /** OPTIONAL - PKCE code verifier (RFC 7636) */
-  code_verifier?: string;
-  /** REQUIRED - Grant type: "authorization_code" or "refresh_token" */
-  grant_type?: string;
-  /** REQUIRED for refresh_token grant - The refresh token */
-  refresh_token?: string;
-  /** OPTIONAL - Redirect URI used in authorization request */
-  redirect_uri?: string;
-  /** Additional provider-specific parameters */
-  [key: string]: unknown;
-}
-
 const forceHttps = (url: URL) => {
   const isLocal = url.hostname === "localhost" || url.hostname === "127.0.0.1";
   if (!isLocal) {

package/src/tools.ts

@@ -7,7 +7,10 @@ import {
 } from "@decocms/bindings";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport as HttpServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-import type { GetPromptResult } from "@modelcontextprotocol/sdk/types.js";
+import type {
+  GetPromptResult,
+  ToolAnnotations,
+} from "@modelcontextprotocol/sdk/types.js";
 import { z } from "zod";
 import type { ZodRawShape, ZodSchema, ZodTypeAny } from "zod";
 import { BindingRegistry } from "./bindings.ts";
@@ -47,6 +50,7 @@ export interface Tool<
   _meta?: Record<string, unknown>;
   id: string;
   description?: string;
+  annotations?: ToolAnnotations;
   inputSchema: TSchemaIn;
   outputSchema?: TSchemaOut;
   execute(
@@ -76,6 +80,7 @@ export type CreatedTool = {
   _meta?: Record<string, unknown>;
   id: string;
   description?: string;
+  annotations?: ToolAnnotations;
   inputSchema: ZodTypeAny;
   outputSchema?: ZodTypeAny;
   streamable?: true;
@@ -86,8 +91,11 @@ export type CreatedTool = {
   }): Promise<unknown>;
 };
 
-// Re-export GetPromptResult for external use
-export type { GetPromptResult } from "@modelcontextprotocol/sdk/types.js";
+// Re-export types for external use
+export type {
+  GetPromptResult,
+  ToolAnnotations,
+} from "@modelcontextprotocol/sdk/types.js";
 
 /**
  * Prompt argument schema shape - must be string types per MCP specification.
@@ -530,7 +538,7 @@ const getEventBus = (
   const bus = env as unknown as { [prop]: EventBusBindingClient };
   return typeof bus[prop] !== "undefined"
     ? bus[prop]
-    : env?.MESH_REQUEST_CONTEXT.state[prop];
+    : env?.MESH_REQUEST_CONTEXT?.state?.[prop];
 };
 
 const toolsFor = <TSchema extends ZodTypeAny = never>({
@@ -713,6 +721,7 @@ export const createMCPServer = <
             ...(tool._meta ?? {}),
           },
           description: tool.description,
+          annotations: tool.annotations,
           inputSchema:
             tool.inputSchema && "shape" in tool.inputSchema
               ? (tool.inputSchema.shape as ZodRawShape)