@lovable.dev/mcp-js 0.28.0 → 0.29.0-rc.1

package/dist/mcp-HDkUr85V.js

@@ -0,0 +1,340 @@
+import { i as log, r as describeError } from "./logger-Ctv5xUSD.js";
+import { n as schemaFromDefinition, t as jsonSchemaFromDefinition } from "./schema-CW1jKvio.js";
+import { i as ToolContext, n as errorSummary, r as resolveToolErrorMessage } from "./errors-DSe96Ffd.js";
+import { r as createRequestAuthorizer, u as nowMs } from "./cors-BDTQQJE2.js";
+import { n as extractTextContent, t as finalizeToolResult } from "./tool-result-DfCk445b.js";
+import { t as createGatedHandler } from "./gate-uCVrbDBb.js";
+import { normalizeObjectSchema, safeParseAsync } from "@modelcontextprotocol/sdk/server/zod-compat.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { McpServer as McpServer$1, classifyInboundRequest, createMcpHandler, isJsonContentType, isLegacyRequest } from "@modelcontextprotocol/server";
+//#region src/protocols/mcp/protocol.ts
+const MODERN_PROTOCOL_VERSION = "2026-07-28";
+function statelessMethodNotAllowed(allow) {
+	return Response.json({
+		jsonrpc: "2.0",
+		id: null,
+		error: {
+			code: -32e3,
+			message: "Method not allowed: stateless server offers no standalone SSE stream (GET) or session (DELETE)."
+		}
+	}, {
+		status: 405,
+		headers: { Allow: allow }
+	});
+}
+function acceptsResponseType(accept, responseType) {
+	if (accept === null) return false;
+	return accept.split(",").some((range) => {
+		const [mediaType, ...parameters] = range.split(";");
+		if (mediaType.trim().toLowerCase() !== responseType) return false;
+		const quality = parameters.find((parameter) => parameter.split("=", 1)[0]?.trim().toLowerCase() === "q");
+		if (quality === void 0) return true;
+		const separator = quality.indexOf("=");
+		if (separator === -1) return false;
+		const value = Number(quality.slice(separator + 1).trim());
+		return value > 0 && value <= 1;
+	});
+}
+function missingProtocolVersionHeader(id) {
+	return Response.json({
+		jsonrpc: "2.0",
+		id,
+		error: {
+			code: -32020,
+			message: "Bad Request: the required MCP-Protocol-Version header is absent",
+			data: { mismatch: {
+				header: "(missing)",
+				body: "the request body names protocol version 2026-07-28"
+			} }
+		}
+	}, { status: 400 });
+}
+function modernMessageWithoutProtocolHeader(request, body) {
+	if (request.headers.has("MCP-Protocol-Version")) return void 0;
+	const outcome = classifyInboundRequest({
+		httpMethod: request.method,
+		mcpMethodHeader: request.headers.get("Mcp-Method") ?? void 0,
+		mcpNameHeader: request.headers.get("Mcp-Name") ?? void 0,
+		body
+	});
+	if (outcome.kind !== "modern" || outcome.classification.revision !== MODERN_PROTOCOL_VERSION) return;
+	return { id: outcome.messageKind === "request" ? outcome.message.id : null };
+}
+function zodIssues(error) {
+	const issues = error?.issues;
+	if (!Array.isArray(issues)) return [{ message: String(error) }];
+	return issues.map((issue) => {
+		const value = issue;
+		return {
+			message: typeof value.message === "string" ? value.message : String(value.message),
+			...Array.isArray(value.path) ? { path: value.path } : {}
+		};
+	});
+}
+function standardSchemaFromDefinition(definition) {
+	const schema = schemaFromDefinition(definition);
+	return { "~standard": {
+		version: 1,
+		vendor: "zod",
+		validate: async (value) => {
+			const parsed = await safeParseAsync(schema, value);
+			return parsed.success ? { value: parsed.data } : { issues: zodIssues(parsed.error) };
+		},
+		jsonSchema: {
+			input: () => jsonSchemaFromDefinition(definition, "input"),
+			output: () => jsonSchemaFromDefinition(definition, "output")
+		}
+	} };
+}
+async function invokeTool(tool, auth, recorder, first, protocol) {
+	const endUserId = auth?.principal.sub;
+	const args = tool.inputSchema ? first ?? {} : {};
+	const start = nowMs();
+	let result;
+	try {
+		result = await tool.handler(args, new ToolContext(auth));
+	} catch (err) {
+		const callerMessage = resolveToolErrorMessage(err);
+		if (callerMessage === void 0) {
+			await recorder.emit({
+				tool: tool.name,
+				method: "tools/call",
+				outcome: "handler_error",
+				durationMs: nowMs() - start,
+				errorText: errorSummary(err),
+				endUserId,
+				protocol
+			});
+			return finalizeToolResult(tool, {
+				content: [{
+					type: "text",
+					text: "tool execution failed"
+				}],
+				isError: true
+			});
+		}
+		result = {
+			content: [{
+				type: "text",
+				text: callerMessage
+			}],
+			isError: true
+		};
+	}
+	if (result == null) {
+		await recorder.emit({
+			tool: tool.name,
+			method: "tools/call",
+			outcome: "handler_error",
+			durationMs: nowMs() - start,
+			endUserId,
+			protocol
+		});
+		return finalizeToolResult(tool, {
+			content: [{
+				type: "text",
+				text: `tool "${tool.name}" returned no result`
+			}],
+			isError: true
+		});
+	}
+	result = await finalizeToolResult(tool, result);
+	await recorder.emit({
+		tool: tool.name,
+		method: "tools/call",
+		outcome: result.isError ? "tool_error" : "ok",
+		durationMs: nowMs() - start,
+		errorText: result.isError ? extractTextContent(result.content) : void 0,
+		endUserId,
+		protocol
+	});
+	return result;
+}
+function adaptToolCallback(tool, auth, recorder, legacy = false, legacyOutputSchemaWrapped = false) {
+	return async (first) => {
+		const result = await invokeTool(tool, auth, recorder, first, legacy ? "legacy" : MODERN_PROTOCOL_VERSION);
+		const content = result.content ?? [];
+		const structuredContent = result.structuredContent;
+		return {
+			content,
+			structuredContent: legacy && structuredContent !== void 0 && (legacyOutputSchemaWrapped || structuredContent !== void 0 && (structuredContent === null || typeof structuredContent !== "object" || Array.isArray(structuredContent))) ? { result: structuredContent } : structuredContent,
+			isError: result.isError
+		};
+	};
+}
+function buildServer(mcp, auth, recorder) {
+	const server = new McpServer$1({
+		name: mcp.name,
+		version: mcp.version,
+		title: mcp.title
+	}, {
+		instructions: mcp.instructions,
+		capabilities: { tools: { listChanged: false } }
+	});
+	for (const tool of mcp.tools) {
+		const config = {
+			title: tool.title,
+			description: tool.description,
+			annotations: tool.annotations,
+			...tool.outputSchema ? { outputSchema: standardSchemaFromDefinition(tool.outputSchema) } : {}
+		};
+		const callback = adaptToolCallback(tool, auth, recorder);
+		if (tool.inputSchema) server.registerTool(tool.name, {
+			...config,
+			inputSchema: standardSchemaFromDefinition(tool.inputSchema)
+		}, callback);
+		else server.registerTool(tool.name, config, callback);
+	}
+	return server;
+}
+function buildLegacyServer(mcp, auth, recorder) {
+	const server = new McpServer({
+		name: mcp.name,
+		version: mcp.version,
+		title: mcp.title
+	}, { instructions: mcp.instructions });
+	for (const tool of mcp.tools) {
+		const naturalOutputSchema = tool.outputSchema ? schemaFromDefinition(tool.outputSchema) : void 0;
+		const legacyOutputSchemaWrapped = naturalOutputSchema !== void 0 && normalizeObjectSchema(naturalOutputSchema) === void 0;
+		server.registerTool(tool.name, {
+			title: tool.title,
+			description: tool.description,
+			inputSchema: tool.inputSchema,
+			outputSchema: legacyOutputSchemaWrapped ? { result: naturalOutputSchema } : tool.outputSchema,
+			annotations: tool.annotations
+		}, adaptToolCallback(tool, auth, recorder, true, legacyOutputSchemaWrapped));
+	}
+	server.server.registerCapabilities({ tools: { listChanged: false } });
+	return server;
+}
+async function serveLegacy(request, parsedBody, mcp, auth, recorder) {
+	const server = buildLegacyServer(mcp, auth, recorder);
+	const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
+	let closed = false;
+	const close = () => {
+		if (closed) return;
+		closed = true;
+		transport.close().catch(() => {});
+		server.close().catch(() => {});
+	};
+	try {
+		await server.connect(transport);
+		request.signal.addEventListener("abort", close, { once: true });
+		const response = await transport.handleRequest(request, { parsedBody });
+		if (response.body === null || !response.headers.get("Content-Type")?.startsWith("text/event-stream")) {
+			close();
+			return response;
+		}
+		const reader = response.body.getReader();
+		const body = new ReadableStream({
+			async pull(controller) {
+				try {
+					const { done, value } = await reader.read();
+					if (done) {
+						close();
+						controller.close();
+					} else controller.enqueue(value);
+				} catch (error) {
+					close();
+					controller.error(error);
+				}
+			},
+			cancel(reason) {
+				close();
+				return reader.cancel(reason);
+			}
+		});
+		return new Response(body, response);
+	} catch (error) {
+		close();
+		throw error;
+	}
+}
+/**
+* Build a Web-Standard request handler that serves the MCP protocol over
+* streamable HTTP. A fresh `McpServer` + transport is constructed per
+* request — the transport is stateless, so this is cheap and there is no
+* cross-request state to leak. The per-request `recorder` is supplied by the
+* caller (the stack handler) so telemetry reads the runtime env in-flight.
+*/
+function createMcpProtocolHandler(mcp, options = {}) {
+	const authorizer = createRequestAuthorizer(mcp, options);
+	const handle = async (request, authResult, recorder) => {
+		const accept = request.headers.get("Accept");
+		if (!acceptsResponseType(accept, "application/json") || !acceptsResponseType(accept, "text/event-stream")) return Response.json({
+			jsonrpc: "2.0",
+			id: null,
+			error: {
+				code: -32e3,
+				message: "Not Acceptable: Client must accept both application/json and text/event-stream"
+			}
+		}, { status: 406 });
+		let protocolError;
+		try {
+			const protocol = createMcpHandler(() => buildServer(mcp, authResult.auth, recorder), {
+				legacy: "reject",
+				onerror: (error) => {
+					protocolError = error;
+				}
+			});
+			let response;
+			if (isJsonContentType(request.headers.get("Content-Type"))) {
+				let parsedBody;
+				try {
+					parsedBody = await request.clone().json();
+				} catch {
+					const headerVersion = request.headers.get("MCP-Protocol-Version")?.trim();
+					response = headerVersion === void 0 || headerVersion < MODERN_PROTOCOL_VERSION ? await serveLegacy(request, void 0, mcp, authResult.auth, recorder) : await protocol.fetch(request);
+				}
+				if (response === void 0) {
+					const missingProtocolHeader = modernMessageWithoutProtocolHeader(request, parsedBody);
+					if (missingProtocolHeader !== void 0) return missingProtocolVersionHeader(missingProtocolHeader.id);
+					response = await isLegacyRequest(request, parsedBody) ? await serveLegacy(request, parsedBody, mcp, authResult.auth, recorder) : await protocol.fetch(request, { parsedBody });
+				}
+			} else response = await protocol.fetch(request);
+			if (response.status < 500) return response;
+			await recorder.emit({
+				tool: null,
+				method: "transport",
+				outcome: "transport_error",
+				durationMs: 0,
+				endUserId: authResult.auth?.principal.sub
+			});
+			log.error("mcp.transport_error", {
+				...protocolError ? describeError(protocolError) : {},
+				outcome: "500 internal error"
+			});
+			return response;
+		} catch (err) {
+			await recorder.emit({
+				tool: null,
+				method: "transport",
+				outcome: "transport_error",
+				durationMs: 0,
+				endUserId: authResult.auth?.principal.sub
+			});
+			log.error("mcp.transport_error", {
+				...describeError(err),
+				outcome: "500 internal error"
+			});
+			return Response.json({
+				jsonrpc: "2.0",
+				id: null,
+				error: {
+					code: -32603,
+					message: "internal error"
+				}
+			}, { status: 500 });
+		}
+	};
+	return createGatedHandler({
+		authorizer,
+		allowedOrigins: mcp.allowedOrigins,
+		methods: ["POST"],
+		methodNotAllowed: statelessMethodNotAllowed,
+		handle
+	});
+}
+//#endregion
+export { createMcpProtocolHandler as t };

package/dist/{package-DgiA0xuY.js → package-BI5r4uGM.js}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.28.0";
+var version = "0.29.0-rc.1";
 //#endregion
 export { version as t };

package/dist/{package-CGLPZwz-.cjs → package-ClCIqol1.cjs}

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.28.0";
+var version = "0.29.0-rc.1";
 //#endregion
 Object.defineProperty(exports, "version", {
 	enumerable: true,

package/dist/protocols/mcp/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_mcp = require("../../mcp-CUGwXkxb.cjs");
+const require_mcp = require("../../mcp-C9B7o75m.cjs");
 exports.createMcpProtocolHandler = require_mcp.createMcpProtocolHandler;

package/dist/protocols/mcp/index.d.cts

@@ -1,6 +1,6 @@
-import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
-import { t as MetricsRecorder } from "../../base-CUkmyaXJ.cjs";
-import { t as McpRuntimeOptions } from "../../authorize-BcNuNPtP.cjs";
+import { u as McpDefinition } from "../../types-D1cgsnPu.cjs";
+import { t as MetricsRecorder } from "../../base-C8osWdMU.cjs";
+import { t as McpRuntimeOptions } from "../../authorize-BzZFS0zi.cjs";
 //#region src/protocols/mcp/protocol.d.ts
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
 /**

package/dist/protocols/mcp/index.d.ts

@@ -1,6 +1,6 @@
-import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
-import { t as MetricsRecorder } from "../../base-CUkmyaXJ.js";
-import { t as McpRuntimeOptions } from "../../authorize-Cs1yyLrq.js";
+import { u as McpDefinition } from "../../types-D1cgsnPu.js";
+import { t as MetricsRecorder } from "../../base-C8osWdMU.js";
+import { t as McpRuntimeOptions } from "../../authorize-BjNE3LPr.js";
 //#region src/protocols/mcp/protocol.d.ts
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
 /**

package/dist/protocols/mcp/index.js

@@ -1,2 +1,2 @@
-import { t as createMcpProtocolHandler } from "../../mcp-Czp-hHjN.js";
+import { t as createMcpProtocolHandler } from "../../mcp-HDkUr85V.js";
 export { createMcpProtocolHandler };

package/dist/protocols/oauth-metadata.cjs

@@ -1,12 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_logger = require("../logger-CN1q-KNn.cjs");
-const require_authorize = require("../authorize-ChY44o_1.cjs");
+const require_cors = require("../cors-BRv5KXKQ.cjs");
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
 	return new Response(JSON.stringify({ error: "not found" }), {
 		status: 404,
 		headers: {
-			...require_authorize.JSON_HEADERS,
+			...require_cors.JSON_HEADERS,
 			"Cache-Control": "no-store"
 		}
 	});
@@ -14,7 +14,7 @@ function notFound() {
 async function buildProtectedResourceMetadata(mcp, auth, request, options, discovery) {
 	const issuer = await discovery.resolveIssuer();
 	const body = {
-		resource: require_authorize.resolveProtectedResource(auth, request, options),
+		resource: require_cors.resolveProtectedResource(auth, request, options),
 		authorization_servers: [issuer],
 		bearer_methods_supported: ["header"],
 		resource_name: auth.resourceName ?? mcp.title,
@@ -24,7 +24,7 @@ async function buildProtectedResourceMetadata(mcp, auth, request, options, disco
 	return body;
 }
 function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
-	const runtime = require_authorize.getOAuthRuntime(mcp, options);
+	const runtime = require_cors.getOAuthRuntime(mcp, options);
 	if (runtime.kind === "configured" && runtime.auth.protectedResourceMetadataUrl === void 0 && runtime.auth.resource === void 0) {
 		if (runtime.options.resourcePath === void 0) throw new Error(`@lovable.dev/mcp-js: auth.resource or a resourcePath is required so the protected-resource metadata doesn't advertise the well-known URL as the resource`);
 		if (runtime.options.trustForwardedHost === true && runtime.options.forwardedHostTrustedByPlatform !== true) require_logger.log.warn("oauth.metadata.host_derived_resource", { detail: "trustForwardedHost is on and auth.resource is unpinned; the advertised resource follows X-Forwarded-Host. Pin auth.resource unless a trusted proxy overwrites that header." });
@@ -35,9 +35,9 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 	const vary = varyHeaders.join(", ");
 	const respond = async (request) => {
 		if (runtime.kind !== "configured" || runtime.auth.protectedResourceMetadataUrl !== void 0) return notFound();
-		if (request.method !== "GET" && request.method !== "HEAD") return require_authorize.methodNotAllowed("GET, HEAD, OPTIONS");
+		if (request.method !== "GET" && request.method !== "HEAD") return require_cors.methodNotAllowed("GET, HEAD, OPTIONS");
 		const headers = {
-			...require_authorize.JSON_HEADERS,
+			...require_cors.JSON_HEADERS,
 			"Cache-Control": "public, max-age=300",
 			Vary: vary
 		};
@@ -49,12 +49,14 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 				...require_logger.describeError(err),
 				outcome: "500 oauth configuration error"
 			});
-			return require_authorize.oauthConfigurationErrorResponse();
+			return require_cors.oauthConfigurationErrorResponse();
 		}
 	};
 	return async (request) => {
-		if (request.method === "OPTIONS") return require_authorize.corsPreflightResponse("GET, HEAD, OPTIONS");
-		return require_authorize.finalizeWireResponse(request, await respond(request));
+		const cors = require_cors.evaluateCors(request, mcp.allowedOrigins);
+		if (!cors.ok) return require_cors.finalizeWireResponse(request, cors.response);
+		if (request.method === "OPTIONS") return cors.preflight("GET, HEAD, OPTIONS");
+		return require_cors.finalizeWireResponse(request, cors.withHeaders(await respond(request)));
 	};
 }
 //#endregion

package/dist/protocols/oauth-metadata.d.cts

@@ -1,5 +1,5 @@
-import { c as McpDefinition } from "../types-C0Wgm9zp.cjs";
-import { t as McpRuntimeOptions } from "../authorize-BcNuNPtP.cjs";
+import { u as McpDefinition } from "../types-D1cgsnPu.cjs";
+import { t as McpRuntimeOptions } from "../authorize-BzZFS0zi.cjs";
 //#region src/protocols/oauth-metadata.d.ts
 type OAuthProtectedResourceMetadataHandler = (request: Request) => Promise<Response>;
 declare function createOAuthProtectedResourceMetadataHandler(mcp: McpDefinition, options?: McpRuntimeOptions): OAuthProtectedResourceMetadataHandler;

package/dist/protocols/oauth-metadata.d.ts

@@ -1,5 +1,5 @@
-import { c as McpDefinition } from "../types-C0Wgm9zp.js";
-import { t as McpRuntimeOptions } from "../authorize-Cs1yyLrq.js";
+import { u as McpDefinition } from "../types-D1cgsnPu.js";
+import { t as McpRuntimeOptions } from "../authorize-BjNE3LPr.js";
 //#region src/protocols/oauth-metadata.d.ts
 type OAuthProtectedResourceMetadataHandler = (request: Request) => Promise<Response>;
 declare function createOAuthProtectedResourceMetadataHandler(mcp: McpDefinition, options?: McpRuntimeOptions): OAuthProtectedResourceMetadataHandler;

package/dist/protocols/oauth-metadata.js

@@ -1,5 +1,5 @@
 import { i as log, r as describeError } from "../logger-Ctv5xUSD.js";
-import { d as finalizeWireResponse, f as methodNotAllowed, i as oauthConfigurationErrorResponse, o as resolveProtectedResource, p as corsPreflightResponse, r as getOAuthRuntime, u as JSON_HEADERS } from "../authorize--rUeMOGU.js";
+import { a as oauthConfigurationErrorResponse, d as JSON_HEADERS, f as finalizeWireResponse, i as getOAuthRuntime, p as methodNotAllowed, s as resolveProtectedResource, t as evaluateCors } from "../cors-BDTQQJE2.js";
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
 	return new Response(JSON.stringify({ error: "not found" }), {
@@ -52,8 +52,10 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 		}
 	};
 	return async (request) => {
-		if (request.method === "OPTIONS") return corsPreflightResponse("GET, HEAD, OPTIONS");
-		return finalizeWireResponse(request, await respond(request));
+		const cors = evaluateCors(request, mcp.allowedOrigins);
+		if (!cors.ok) return finalizeWireResponse(request, cors.response);
+		if (request.method === "OPTIONS") return cors.preflight("GET, HEAD, OPTIONS");
+		return finalizeWireResponse(request, cors.withHeaders(await respond(request)));
 	};
 }
 //#endregion

package/dist/protocols/rest/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_list_tools = require("../../list-tools-DCF6G4fn.cjs");
-const require_rest = require("../../rest-BE05MUNS.cjs");
+const require_list_tools = require("../../list-tools-DES10avA.cjs");
+const require_rest = require("../../rest-BBdfHMGh.cjs");
 exports.createInvokeToolHandler = require_rest.createInvokeToolHandler;
 exports.createListToolsHandler = require_list_tools.createListToolsHandler;

package/dist/protocols/rest/index.d.cts

@@ -1,7 +1,7 @@
-import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
-import { t as MetricsRecorder } from "../../base-CUkmyaXJ.cjs";
-import { t as McpRuntimeOptions } from "../../authorize-BcNuNPtP.cjs";
-import { n as createListToolsHandler, t as RestListToolsHandler } from "../../list-tools-BN97L2Yv.cjs";
+import { u as McpDefinition } from "../../types-D1cgsnPu.cjs";
+import { t as MetricsRecorder } from "../../base-C8osWdMU.cjs";
+import { t as McpRuntimeOptions } from "../../authorize-BzZFS0zi.cjs";
+import { n as createListToolsHandler, t as RestListToolsHandler } from "../../list-tools-C3AoI2Zw.cjs";
 //#region src/protocols/rest/invoke-tool.d.ts
 type RestInvokeToolHandler = (request: Request, toolName: string, recorder?: MetricsRecorder) => Promise<Response>;
 declare function createInvokeToolHandler(mcp: McpDefinition, options?: McpRuntimeOptions): RestInvokeToolHandler;

package/dist/protocols/rest/index.d.ts

@@ -1,7 +1,7 @@
-import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
-import { t as MetricsRecorder } from "../../base-CUkmyaXJ.js";
-import { t as McpRuntimeOptions } from "../../authorize-Cs1yyLrq.js";
-import { n as createListToolsHandler, t as RestListToolsHandler } from "../../list-tools-BAqQVIHk.js";
+import { u as McpDefinition } from "../../types-D1cgsnPu.js";
+import { t as MetricsRecorder } from "../../base-C8osWdMU.js";
+import { t as McpRuntimeOptions } from "../../authorize-BjNE3LPr.js";
+import { n as createListToolsHandler, t as RestListToolsHandler } from "../../list-tools-DXqSPvNY.js";
 //#region src/protocols/rest/invoke-tool.d.ts
 type RestInvokeToolHandler = (request: Request, toolName: string, recorder?: MetricsRecorder) => Promise<Response>;
 declare function createInvokeToolHandler(mcp: McpDefinition, options?: McpRuntimeOptions): RestInvokeToolHandler;

package/dist/protocols/rest/index.js

@@ -1,3 +1,3 @@
-import { n as createListToolsHandler } from "../../list-tools-BLGr7mot.js";
-import { t as createInvokeToolHandler } from "../../rest-BS7bBOd9.js";
+import { n as createListToolsHandler } from "../../list-tools-C1OiTDR9.js";
+import { t as createInvokeToolHandler } from "../../rest-Cr7NhxL3.js";
 export { createInvokeToolHandler, createListToolsHandler };

package/dist/{rest-BE05MUNS.cjs → rest-BBdfHMGh.cjs}

@@ -1,8 +1,8 @@
 const require_errors = require("./errors-CN6Da8iz.cjs");
-const require_authorize = require("./authorize-ChY44o_1.cjs");
-const require_content = require("./content-NCYIGgOb.cjs");
-const require_gate = require("./gate-CGZl0gjJ.cjs");
-require("./list-tools-DCF6G4fn.cjs");
+const require_cors = require("./cors-BRv5KXKQ.cjs");
+const require_tool_result = require("./tool-result-CK6hXO43.cjs");
+const require_gate = require("./gate-CAJSRt_t.cjs");
+require("./list-tools-DES10avA.cjs");
 let _modelcontextprotocol_sdk_server_zod_compat_js = require("@modelcontextprotocol/sdk/server/zod-compat.js");
 //#region src/protocols/rest/invoke-tool.ts
 const MAX_REFLECTED_TOOL_NAME = 256;
@@ -16,13 +16,13 @@ function isEmptyArgs(value) {
 	return Object.keys(value).length === 0;
 }
 function createInvokeToolHandler(mcp, options = {}) {
-	require_authorize.assertRestResourceBinding(mcp, options);
+	require_cors.assertRestResourceBinding(mcp, options);
 	const handle = async (request, authResult, recorder, toolName) => {
 		const endUserId = authResult.auth?.principal.sub;
 		const tool = mcp.tools.find((t) => t.name === toolName);
 		if (!tool) return new Response(JSON.stringify({ error: `unknown tool: ${safeReflectName(toolName)}` }), {
 			status: 404,
-			headers: require_authorize.JSON_HEADERS
+			headers: require_cors.JSON_HEADERS
 		});
 		let rawArgs = {};
 		const text = await request.text();
@@ -31,7 +31,7 @@ function createInvokeToolHandler(mcp, options = {}) {
 		} catch {
 			return new Response(JSON.stringify({ error: "invalid JSON body" }), {
 				status: 400,
-				headers: require_authorize.JSON_HEADERS
+				headers: require_cors.JSON_HEADERS
 			});
 		}
 		let args = rawArgs;
@@ -42,7 +42,7 @@ function createInvokeToolHandler(mcp, options = {}) {
 				details: (0, _modelcontextprotocol_sdk_server_zod_compat_js.getParseErrorMessage)(parsed.error)
 			}), {
 				status: 400,
-				headers: require_authorize.JSON_HEADERS
+				headers: require_cors.JSON_HEADERS
 			});
 			args = parsed.data;
 		} catch {
@@ -51,15 +51,15 @@ function createInvokeToolHandler(mcp, options = {}) {
 				tool: toolName
 			}), {
 				status: 500,
-				headers: require_authorize.JSON_HEADERS
+				headers: require_cors.JSON_HEADERS
 			});
 		}
 		else if (!isEmptyArgs(rawArgs)) return new Response(JSON.stringify({ error: "tool has no inputSchema; expected empty body" }), {
 			status: 400,
-			headers: require_authorize.JSON_HEADERS
+			headers: require_cors.JSON_HEADERS
 		});
 		let result;
-		const start = require_authorize.nowMs();
+		const start = require_cors.nowMs();
 		try {
 			result = await tool.handler(args, new require_errors.ToolContext(authResult.auth));
 		} catch (err) {
@@ -69,16 +69,17 @@ function createInvokeToolHandler(mcp, options = {}) {
 					tool: tool.name,
 					method: "tools/call",
 					outcome: "handler_error",
-					durationMs: require_authorize.nowMs() - start,
+					durationMs: require_cors.nowMs() - start,
 					errorText: require_errors.errorSummary(err),
-					endUserId
+					endUserId,
+					protocol: "rest"
 				});
 				return new Response(JSON.stringify({
 					error: "handler threw",
 					tool: toolName
 				}), {
 					status: 500,
-					headers: require_authorize.JSON_HEADERS
+					headers: require_cors.JSON_HEADERS
 				});
 			}
 			result = {
@@ -94,32 +95,32 @@ function createInvokeToolHandler(mcp, options = {}) {
 				tool: tool.name,
 				method: "tools/call",
 				outcome: "handler_error",
-				durationMs: require_authorize.nowMs() - start,
-				endUserId
+				durationMs: require_cors.nowMs() - start,
+				endUserId,
+				protocol: "rest"
 			});
 			return new Response(JSON.stringify({ error: `tool "${toolName}" returned no result` }), {
 				status: 500,
-				headers: require_authorize.JSON_HEADERS
+				headers: require_cors.JSON_HEADERS
 			});
 		}
+		result = await require_tool_result.finalizeToolResult(tool, result);
 		await recorder.emit({
 			tool: tool.name,
 			method: "tools/call",
 			outcome: result.isError ? "tool_error" : "ok",
-			durationMs: require_authorize.nowMs() - start,
-			errorText: result.isError ? require_content.extractTextContent(result.content) : void 0,
-			endUserId
-		});
-		return Response.json({
-			content: result.content ?? [],
-			structuredContent: result.structuredContent,
-			isError: result.isError
+			durationMs: require_cors.nowMs() - start,
+			errorText: result.isError ? require_tool_result.extractTextContent(result.content) : void 0,
+			endUserId,
+			protocol: "rest"
 		});
+		return Response.json(result);
 	};
 	const gated = require_gate.createGatedHandler({
-		authorizer: require_authorize.createRequestAuthorizer(mcp, options),
+		authorizer: require_cors.createRequestAuthorizer(mcp, options),
+		allowedOrigins: mcp.allowedOrigins,
 		methods: ["POST"],
-		methodNotAllowed: require_authorize.methodNotAllowed,
+		methodNotAllowed: require_cors.methodNotAllowed,
 		handle
 	});
 	return (request, toolName, recorder) => gated(request, recorder, toolName);