@lovable.dev/mcp-js 0.29.0-rc.1 → 0.29.0-rc.3

package/dist/{types-D1cgsnPu.d.cts → types-3CZPz364.d.cts}

@@ -85,16 +85,49 @@ interface McpAuthConfig {
 }
 //#endregion
 //#region src/auth/context.d.ts
-/**
- * The auth surface passed to every tool handler as its second argument. It wraps
- * the verified per-request auth context in a private field, so the context — and
- * the bearer token inside it — can't be read, enumerated, spread, or
- * `JSON.stringify`'d off the instance; the accessors below are the only way out.
- * `getToken()` is the single intentional escape hatch for the raw bearer.
- */
+/** Protocol era of an in-flight request: self-describing `2026-07-28` or the
+ * initialization-era `legacy` fallback. */
+type McpProtocolEra = "2026-07-28" | "legacy";
+/** What the client declared about itself on the in-flight request. Unverified
+ * client input — a hint, never an authorization signal (use the auth accessors). */
+interface McpClientInfo {
+  /** Protocol era of the in-flight request. */
+  protocol: McpProtocolEra;
+  /** Client name/version from the request envelope (`2026-07-28` era only). */
+  info?: {
+    name: string;
+    version: string;
+    title?: string;
+  };
+  /** Client capabilities from the request envelope (`2026-07-28` era only). */
+  capabilities?: Record<string, unknown>;
+  /** Extension declarations (`capabilities.extensions`), keyed by extension id. */
+  extensions?: Record<string, Record<string, unknown>>;
+}
+/** A progress notification payload. `progress` should increase monotonically. */
+interface ProgressUpdate {
+  progress: number;
+  total?: number;
+  message?: string;
+}
+/** Per-request runtime surface threaded into `ToolContext` by the protocol layer. */
+interface ToolRequestContext {
+  signal?: AbortSignal;
+  client?: McpClientInfo;
+  sendProgress?: (update: ProgressUpdate) => Promise<void>;
+}
+/** The per-request context passed to every tool handler as its second argument. The
+ * auth context lives in a private field so the accessors are the only way out; `getToken()` is the sole bearer escape hatch. */
 declare class ToolContext {
   #private;
-  constructor(auth: McpAuthContext | undefined);
+  constructor(auth: McpAuthContext | undefined, request?: ToolRequestContext);
+  /** Aborts when the client cancels the request or disconnects. */
+  get signal(): AbortSignal;
+  /** What the client declared about itself on this request. Unverified input. */
+  get client(): McpClientInfo;
+  /** Send a progress notification for this call. A no-op when the client
+   * didn't request progress (no `progressToken` on the request). */
+  progress(update: ProgressUpdate): Promise<void>;
   /** Whether the in-flight tool call carries a verified auth context. */
   isAuthenticated(): boolean;
   /** The verified bearer token, or `undefined` when unauthenticated. Pass it to downstream APIs; never return or log it. */
@@ -148,11 +181,8 @@ type MetricsConfig = boolean | MetricsOptions;
  * `inputSchema`, use `ZodRawShape`.
  */
 type ZodSchema = ZodType;
-/**
- * A raw zod shape (`{ text: z.string(), n: z.number() }`) — the format
- * `defineTool`'s `inputSchema` expects and the object shorthand accepted by
- * `outputSchema`.
- */
+/** A raw zod shape (`{ text: z.string() }`) — the format `defineTool`'s
+ *  `inputSchema` expects and the object shorthand accepted by `outputSchema`. */
 type ZodRawShape$1 = ZodRawShape;
 type ZodOutputSchema = ZodSchema | ZodRawShape$1;
 /**
@@ -246,6 +276,11 @@ type ToolContent = ContentBlock[];
 type JsonValue = null | boolean | number | string | JsonValue[] | {
   [key: string]: JsonValue;
 };
+/** Handler-input relaxation of `JsonValue`: object properties may be `undefined`
+ * (they serialize away, matching `JSON.stringify` semantics). */
+type JsonValueInput = null | boolean | number | string | JsonValueInput[] | {
+  [key: string]: JsonValueInput | undefined;
+};
 type McpAllowedOrigins = "any" | readonly string[];
 /**
  * Per-tool client hints (not enforcement). `annotations.title` is
@@ -264,7 +299,7 @@ interface ToolAnnotations {
 }
 interface ToolHandlerResult {
   content?: ToolContent;
-  structuredContent?: JsonValue;
+  structuredContent?: JsonValueInput;
   isError?: boolean;
 }
 interface ToolDefinition<TInput extends ZodRawShape$1 | undefined = ZodRawShape$1 | undefined, TOutput extends ZodOutputSchema | undefined = ZodOutputSchema | undefined> {
@@ -278,10 +313,8 @@ interface ToolDefinition<TInput extends ZodRawShape$1 | undefined = ZodRawShape$
   readonly annotations?: ToolAnnotations;
   readonly handler: TInput extends ZodRawShape$1 ? (args: ShapeOutput<TInput>, ctx: ToolContext) => ToolHandlerResult | Promise<ToolHandlerResult> : (args: Record<string, never> | undefined, ctx: ToolContext) => ToolHandlerResult | Promise<ToolHandlerResult>;
 }
-/**
- * Type-erased element of `McpDefinition.tools`. Per-tool generic typing
- * happens at the `defineTool` call site; see README §6 for the rationale.
- */
+/** Type-erased element of `McpDefinition.tools`; per-tool generic typing
+ * happens at the `defineTool` call site. */
 interface AnyToolDefinition {
   readonly name: string;
   readonly title: string;
@@ -291,13 +324,8 @@ interface AnyToolDefinition {
   readonly annotations?: ToolAnnotations;
   readonly handler: (args: any, ctx: ToolContext) => ToolHandlerResult | Promise<ToolHandlerResult>;
 }
-/**
- * Fields a caller supplies when constructing an MCP definition. Pass this
- * shape to `defineMcp(...)` — its return type is the branded `McpDefinition`,
- * which is the type every internal factory (`createInvokeToolHandler`,
- * `createMcpProtocolHandler`, …) consumes. The brand forces consumers
- * through `defineMcp`'s `assertUniqueNames` + freeze.
- */
+/** Input shape for `defineMcp(...)`, whose branded `McpDefinition` return type is what
+ * `createMcpProtocolHandler` consumes — the brand forces validation + freeze. */
 interface McpDefinitionInput {
   readonly name: string;
   /** Human-readable display name shown to MCP clients. Required. */
@@ -326,4 +354,4 @@ type McpDefinition = McpDefinitionInput & {
   readonly [McpDefinitionBrand]: never;
 };
 //#endregion
-export { MetricsOptions as C, McpAuthConfig as E, MetricsConfig as S, JwtClaims as T, ToolDefinition as _, EmbeddedResource as a, ZodRawShape$1 as b, JsonValue as c, McpDefinitionInput as d, ResourceLink as f, ToolContent as g, ToolAnnotations as h, EmbeddedBlobResource as i, McpAllowedOrigins as l, TextContent as m, ContentAnnotations as n, EmbeddedTextResource as o, ResourceLinkIcon as p, ContentBlock as r, ImageContent as s, AudioContent as t, McpDefinition as u, ToolHandlerResult as v, ToolContext as w, ZodSchema as x, ZodOutputSchema as y };
+export { McpAuthConfig as A, MetricsConfig as C, ProgressUpdate as D, McpProtocolEra as E, ToolContext as O, ZodSchema as S, McpClientInfo as T, ToolContent as _, EmbeddedResource as a, ZodOutputSchema as b, JsonValue as c, McpDefinition as d, McpDefinitionInput as f, ToolAnnotations as g, TextContent as h, EmbeddedBlobResource as i, JwtClaims as k, JsonValueInput as l, ResourceLinkIcon as m, ContentAnnotations as n, EmbeddedTextResource as o, ResourceLink as p, ContentBlock as r, ImageContent as s, AudioContent as t, McpAllowedOrigins as u, ToolDefinition as v, MetricsOptions as w, ZodRawShape$1 as x, ToolHandlerResult as y };

package/dist/{types-D1cgsnPu.d.ts → types-3CZPz364.d.ts}

@@ -85,16 +85,49 @@ interface McpAuthConfig {
 }
 //#endregion
 //#region src/auth/context.d.ts
-/**
- * The auth surface passed to every tool handler as its second argument. It wraps
- * the verified per-request auth context in a private field, so the context — and
- * the bearer token inside it — can't be read, enumerated, spread, or
- * `JSON.stringify`'d off the instance; the accessors below are the only way out.
- * `getToken()` is the single intentional escape hatch for the raw bearer.
- */
+/** Protocol era of an in-flight request: self-describing `2026-07-28` or the
+ * initialization-era `legacy` fallback. */
+type McpProtocolEra = "2026-07-28" | "legacy";
+/** What the client declared about itself on the in-flight request. Unverified
+ * client input — a hint, never an authorization signal (use the auth accessors). */
+interface McpClientInfo {
+  /** Protocol era of the in-flight request. */
+  protocol: McpProtocolEra;
+  /** Client name/version from the request envelope (`2026-07-28` era only). */
+  info?: {
+    name: string;
+    version: string;
+    title?: string;
+  };
+  /** Client capabilities from the request envelope (`2026-07-28` era only). */
+  capabilities?: Record<string, unknown>;
+  /** Extension declarations (`capabilities.extensions`), keyed by extension id. */
+  extensions?: Record<string, Record<string, unknown>>;
+}
+/** A progress notification payload. `progress` should increase monotonically. */
+interface ProgressUpdate {
+  progress: number;
+  total?: number;
+  message?: string;
+}
+/** Per-request runtime surface threaded into `ToolContext` by the protocol layer. */
+interface ToolRequestContext {
+  signal?: AbortSignal;
+  client?: McpClientInfo;
+  sendProgress?: (update: ProgressUpdate) => Promise<void>;
+}
+/** The per-request context passed to every tool handler as its second argument. The
+ * auth context lives in a private field so the accessors are the only way out; `getToken()` is the sole bearer escape hatch. */
 declare class ToolContext {
   #private;
-  constructor(auth: McpAuthContext | undefined);
+  constructor(auth: McpAuthContext | undefined, request?: ToolRequestContext);
+  /** Aborts when the client cancels the request or disconnects. */
+  get signal(): AbortSignal;
+  /** What the client declared about itself on this request. Unverified input. */
+  get client(): McpClientInfo;
+  /** Send a progress notification for this call. A no-op when the client
+   * didn't request progress (no `progressToken` on the request). */
+  progress(update: ProgressUpdate): Promise<void>;
   /** Whether the in-flight tool call carries a verified auth context. */
   isAuthenticated(): boolean;
   /** The verified bearer token, or `undefined` when unauthenticated. Pass it to downstream APIs; never return or log it. */
@@ -148,11 +181,8 @@ type MetricsConfig = boolean | MetricsOptions;
  * `inputSchema`, use `ZodRawShape`.
  */
 type ZodSchema = ZodType;
-/**
- * A raw zod shape (`{ text: z.string(), n: z.number() }`) — the format
- * `defineTool`'s `inputSchema` expects and the object shorthand accepted by
- * `outputSchema`.
- */
+/** A raw zod shape (`{ text: z.string() }`) — the format `defineTool`'s
+ *  `inputSchema` expects and the object shorthand accepted by `outputSchema`. */
 type ZodRawShape$1 = ZodRawShape;
 type ZodOutputSchema = ZodSchema | ZodRawShape$1;
 /**
@@ -246,6 +276,11 @@ type ToolContent = ContentBlock[];
 type JsonValue = null | boolean | number | string | JsonValue[] | {
   [key: string]: JsonValue;
 };
+/** Handler-input relaxation of `JsonValue`: object properties may be `undefined`
+ * (they serialize away, matching `JSON.stringify` semantics). */
+type JsonValueInput = null | boolean | number | string | JsonValueInput[] | {
+  [key: string]: JsonValueInput | undefined;
+};
 type McpAllowedOrigins = "any" | readonly string[];
 /**
  * Per-tool client hints (not enforcement). `annotations.title` is
@@ -264,7 +299,7 @@ interface ToolAnnotations {
 }
 interface ToolHandlerResult {
   content?: ToolContent;
-  structuredContent?: JsonValue;
+  structuredContent?: JsonValueInput;
   isError?: boolean;
 }
 interface ToolDefinition<TInput extends ZodRawShape$1 | undefined = ZodRawShape$1 | undefined, TOutput extends ZodOutputSchema | undefined = ZodOutputSchema | undefined> {
@@ -278,10 +313,8 @@ interface ToolDefinition<TInput extends ZodRawShape$1 | undefined = ZodRawShape$
   readonly annotations?: ToolAnnotations;
   readonly handler: TInput extends ZodRawShape$1 ? (args: ShapeOutput<TInput>, ctx: ToolContext) => ToolHandlerResult | Promise<ToolHandlerResult> : (args: Record<string, never> | undefined, ctx: ToolContext) => ToolHandlerResult | Promise<ToolHandlerResult>;
 }
-/**
- * Type-erased element of `McpDefinition.tools`. Per-tool generic typing
- * happens at the `defineTool` call site; see README §6 for the rationale.
- */
+/** Type-erased element of `McpDefinition.tools`; per-tool generic typing
+ * happens at the `defineTool` call site. */
 interface AnyToolDefinition {
   readonly name: string;
   readonly title: string;
@@ -291,13 +324,8 @@ interface AnyToolDefinition {
   readonly annotations?: ToolAnnotations;
   readonly handler: (args: any, ctx: ToolContext) => ToolHandlerResult | Promise<ToolHandlerResult>;
 }
-/**
- * Fields a caller supplies when constructing an MCP definition. Pass this
- * shape to `defineMcp(...)` — its return type is the branded `McpDefinition`,
- * which is the type every internal factory (`createInvokeToolHandler`,
- * `createMcpProtocolHandler`, …) consumes. The brand forces consumers
- * through `defineMcp`'s `assertUniqueNames` + freeze.
- */
+/** Input shape for `defineMcp(...)`, whose branded `McpDefinition` return type is what
+ * `createMcpProtocolHandler` consumes — the brand forces validation + freeze. */
 interface McpDefinitionInput {
   readonly name: string;
   /** Human-readable display name shown to MCP clients. Required. */
@@ -326,4 +354,4 @@ type McpDefinition = McpDefinitionInput & {
   readonly [McpDefinitionBrand]: never;
 };
 //#endregion
-export { MetricsOptions as C, McpAuthConfig as E, MetricsConfig as S, JwtClaims as T, ToolDefinition as _, EmbeddedResource as a, ZodRawShape$1 as b, JsonValue as c, McpDefinitionInput as d, ResourceLink as f, ToolContent as g, ToolAnnotations as h, EmbeddedBlobResource as i, McpAllowedOrigins as l, TextContent as m, ContentAnnotations as n, EmbeddedTextResource as o, ResourceLinkIcon as p, ContentBlock as r, ImageContent as s, AudioContent as t, McpDefinition as u, ToolHandlerResult as v, ToolContext as w, ZodSchema as x, ZodOutputSchema as y };
+export { McpAuthConfig as A, MetricsConfig as C, ProgressUpdate as D, McpProtocolEra as E, ToolContext as O, ZodSchema as S, McpClientInfo as T, ToolContent as _, EmbeddedResource as a, ZodOutputSchema as b, JsonValue as c, McpDefinition as d, McpDefinitionInput as f, ToolAnnotations as g, TextContent as h, EmbeddedBlobResource as i, JwtClaims as k, JsonValueInput as l, ResourceLinkIcon as m, ContentAnnotations as n, EmbeddedTextResource as o, ResourceLink as p, ContentBlock as r, ImageContent as s, AudioContent as t, McpAllowedOrigins as u, ToolDefinition as v, MetricsOptions as w, ZodRawShape$1 as x, ToolHandlerResult as y };

package/package.json

@@ -1,6 +1,9 @@
 {
   "name": "@lovable.dev/mcp-js",
-  "version": "0.29.0-rc.1",
+  "version": "0.29.0-rc.3",
+  "engines": {
+    "node": ">=20"
+  },
   "description": "Author MCP servers for Lovable apps. Declare tools with defineTool, register them in defineMcp, and a framework adapter (TanStack or Supabase Edge Functions) emits the route(s) at build time.",
   "type": "module",
   "repository": {
@@ -49,16 +52,6 @@
         "default": "./dist/protocols/oauth-metadata.cjs"
       }
     },
-    "./protocols/rest": {
-      "import": {
-        "types": "./dist/protocols/rest/index.d.ts",
-        "default": "./dist/protocols/rest/index.js"
-      },
-      "require": {
-        "types": "./dist/protocols/rest/index.d.cts",
-        "default": "./dist/protocols/rest/index.cjs"
-      }
-    },
     "./stacks/tanstack": {
       "import": {
         "types": "./dist/stacks/tanstack/index.d.ts",

package/dist/forwarded-B3EBjHnA.js

@@ -1,43 +0,0 @@
-//#region src/core/forwarded.ts
-/**
-* Rewrites a request's URL to the public origin a reverse proxy forwards via
-* `X-Forwarded-*`, so SDK-derived OAuth `resource`/metadata/`WWW-Authenticate`
-* URLs name the host the client actually connected to — not the internal
-* backend origin the proxy rewrites `Host` to. Without this, an app on a custom
-* domain advertises its internal `*.lovable.dev`/`*.supabase.co` host and every
-* MCP call 401s on an audience the client can't satisfy.
-*
-* Each header is trusted independently, because a forwarded value is only as
-* trustworthy as the proxy that sets it:
-* - `X-Forwarded-Host` can redirect the advertised resource to an attacker
-*   origin (the threat `auth/resource.ts` guards against), so it is honored only
-*   when `trustForwardedHost` is set — enabled on emit paths that sit behind a
-*   proxy which *overwrites* the header (Lovable's web-proxy does), never by a
-*   bare SDK consumer.
-* - `X-Forwarded-Proto` only selects http/https, so it is gated separately:
-*   Supabase's gateway stamps it (that stack always trusts it), and Lovable's
-*   preview proxy overwrites it before the TanStack dev server, so the TanStack
-*   Vite plugin emits the flag by default.
-*/
-function applyForwardedOrigin(request, options) {
-	const proto = options.trustForwardedProto ? firstForwardedValue(request, "x-forwarded-proto") : void 0;
-	const host = options.trustForwardedHost ? firstForwardedValue(request, "x-forwarded-host") : void 0;
-	if (proto === void 0 && host === void 0) return request;
-	const url = new URL(request.url);
-	let changed = false;
-	if (proto !== void 0 && `${proto}:` !== url.protocol) {
-		url.protocol = `${proto}:`;
-		changed = true;
-	}
-	if (host !== void 0 && host !== url.host) {
-		url.host = host;
-		changed = true;
-	}
-	return changed ? new Request(url.href, request) : request;
-}
-function firstForwardedValue(request, header) {
-	const value = request.headers.get(header)?.split(",")[0]?.trim();
-	return value ? value : void 0;
-}
-//#endregion
-export { applyForwardedOrigin as t };

package/dist/forwarded-BC_RHnn5.cjs

@@ -1,48 +0,0 @@
-//#region src/core/forwarded.ts
-/**
-* Rewrites a request's URL to the public origin a reverse proxy forwards via
-* `X-Forwarded-*`, so SDK-derived OAuth `resource`/metadata/`WWW-Authenticate`
-* URLs name the host the client actually connected to — not the internal
-* backend origin the proxy rewrites `Host` to. Without this, an app on a custom
-* domain advertises its internal `*.lovable.dev`/`*.supabase.co` host and every
-* MCP call 401s on an audience the client can't satisfy.
-*
-* Each header is trusted independently, because a forwarded value is only as
-* trustworthy as the proxy that sets it:
-* - `X-Forwarded-Host` can redirect the advertised resource to an attacker
-*   origin (the threat `auth/resource.ts` guards against), so it is honored only
-*   when `trustForwardedHost` is set — enabled on emit paths that sit behind a
-*   proxy which *overwrites* the header (Lovable's web-proxy does), never by a
-*   bare SDK consumer.
-* - `X-Forwarded-Proto` only selects http/https, so it is gated separately:
-*   Supabase's gateway stamps it (that stack always trusts it), and Lovable's
-*   preview proxy overwrites it before the TanStack dev server, so the TanStack
-*   Vite plugin emits the flag by default.
-*/
-function applyForwardedOrigin(request, options) {
-	const proto = options.trustForwardedProto ? firstForwardedValue(request, "x-forwarded-proto") : void 0;
-	const host = options.trustForwardedHost ? firstForwardedValue(request, "x-forwarded-host") : void 0;
-	if (proto === void 0 && host === void 0) return request;
-	const url = new URL(request.url);
-	let changed = false;
-	if (proto !== void 0 && `${proto}:` !== url.protocol) {
-		url.protocol = `${proto}:`;
-		changed = true;
-	}
-	if (host !== void 0 && host !== url.host) {
-		url.host = host;
-		changed = true;
-	}
-	return changed ? new Request(url.href, request) : request;
-}
-function firstForwardedValue(request, header) {
-	const value = request.headers.get(header)?.split(",")[0]?.trim();
-	return value ? value : void 0;
-}
-//#endregion
-Object.defineProperty(exports, "applyForwardedOrigin", {
-	enumerable: true,
-	get: function() {
-		return applyForwardedOrigin;
-	}
-});

package/dist/gate-CAJSRt_t.cjs

@@ -1,26 +0,0 @@
-const require_cors = require("./cors-BRv5KXKQ.cjs");
-//#region src/protocols/gate.ts
-function createGatedHandler(gate) {
-	const allow = [...gate.methods, "OPTIONS"].join(", ");
-	const respond = async (request, recorder, ...extra) => {
-		const authResult = await gate.authorizer.authorize(request, recorder);
-		if (!authResult.ok) return authResult.response;
-		if (!gate.methods.includes(request.method)) return gate.methodNotAllowed(allow);
-		return gate.handle(request, authResult, recorder, ...extra);
-	};
-	return async (request, recorder = require_cors.createNoopRecorder(), ...extra) => {
-		const cors = require_cors.evaluateCors(request, gate.allowedOrigins);
-		if (!cors.ok) return require_cors.finalizeWireResponse(request, cors.response);
-		if (request.method === "OPTIONS") return cors.preflight(allow);
-		const final = require_cors.finalizeWireResponse(request, cors.withHeaders(await respond(request, recorder, ...extra)));
-		if (!final.headers.has("Cache-Control")) final.headers.set("Cache-Control", "no-store");
-		return final;
-	};
-}
-//#endregion
-Object.defineProperty(exports, "createGatedHandler", {
-	enumerable: true,
-	get: function() {
-		return createGatedHandler;
-	}
-});

package/dist/gate-uCVrbDBb.js

@@ -1,21 +0,0 @@
-import { f as finalizeWireResponse, l as createNoopRecorder, t as evaluateCors } from "./cors-BDTQQJE2.js";
-//#region src/protocols/gate.ts
-function createGatedHandler(gate) {
-	const allow = [...gate.methods, "OPTIONS"].join(", ");
-	const respond = async (request, recorder, ...extra) => {
-		const authResult = await gate.authorizer.authorize(request, recorder);
-		if (!authResult.ok) return authResult.response;
-		if (!gate.methods.includes(request.method)) return gate.methodNotAllowed(allow);
-		return gate.handle(request, authResult, recorder, ...extra);
-	};
-	return async (request, recorder = createNoopRecorder(), ...extra) => {
-		const cors = evaluateCors(request, gate.allowedOrigins);
-		if (!cors.ok) return finalizeWireResponse(request, cors.response);
-		if (request.method === "OPTIONS") return cors.preflight(allow);
-		const final = finalizeWireResponse(request, cors.withHeaders(await respond(request, recorder, ...extra)));
-		if (!final.headers.has("Cache-Control")) final.headers.set("Cache-Control", "no-store");
-		return final;
-	};
-}
-//#endregion
-export { createGatedHandler as t };

package/dist/list-tools-C1OiTDR9.js

@@ -1,37 +0,0 @@
-import { t as jsonSchemaFromDefinition } from "./schema-CW1jKvio.js";
-import { n as assertRestResourceBinding, p as methodNotAllowed, r as createRequestAuthorizer } from "./cors-BDTQQJE2.js";
-import { t as createGatedHandler } from "./gate-uCVrbDBb.js";
-//#region src/protocols/rest/list-tools.ts
-function schemaToJsonSchema(definition, pipeStrategy) {
-	if (!definition) return null;
-	return jsonSchemaFromDefinition(definition, pipeStrategy);
-}
-function buildMcpListing(mcp) {
-	return {
-		server: {
-			name: mcp.name,
-			version: mcp.version,
-			title: mcp.title
-		},
-		tools: mcp.tools.map((tool) => ({
-			name: tool.name,
-			title: tool.title,
-			description: tool.description,
-			annotations: tool.annotations,
-			inputSchema: schemaToJsonSchema(tool.inputSchema, "input"),
-			outputSchema: schemaToJsonSchema(tool.outputSchema, "output")
-		}))
-	};
-}
-function createListToolsHandler(mcp, options = {}) {
-	assertRestResourceBinding(mcp, options);
-	return createGatedHandler({
-		authorizer: createRequestAuthorizer(mcp, options),
-		allowedOrigins: mcp.allowedOrigins,
-		methods: ["GET", "HEAD"],
-		methodNotAllowed,
-		handle: async () => Response.json(buildMcpListing(mcp))
-	});
-}
-//#endregion
-export { createListToolsHandler as n, buildMcpListing as t };

package/dist/list-tools-C3AoI2Zw.d.cts

@@ -1,8 +0,0 @@
-import { u as McpDefinition } from "./types-D1cgsnPu.cjs";
-import { t as MetricsRecorder } from "./base-C8osWdMU.cjs";
-import { t as McpRuntimeOptions } from "./authorize-BzZFS0zi.cjs";
-//#region src/protocols/rest/list-tools.d.ts
-type RestListToolsHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
-declare function createListToolsHandler(mcp: McpDefinition, options?: McpRuntimeOptions): RestListToolsHandler;
-//#endregion
-export { createListToolsHandler as n, RestListToolsHandler as t };

package/dist/list-tools-DES10avA.cjs

@@ -1,48 +0,0 @@
-const require_schema = require("./schema-D3vClxb7.cjs");
-const require_cors = require("./cors-BRv5KXKQ.cjs");
-const require_gate = require("./gate-CAJSRt_t.cjs");
-//#region src/protocols/rest/list-tools.ts
-function schemaToJsonSchema(definition, pipeStrategy) {
-	if (!definition) return null;
-	return require_schema.jsonSchemaFromDefinition(definition, pipeStrategy);
-}
-function buildMcpListing(mcp) {
-	return {
-		server: {
-			name: mcp.name,
-			version: mcp.version,
-			title: mcp.title
-		},
-		tools: mcp.tools.map((tool) => ({
-			name: tool.name,
-			title: tool.title,
-			description: tool.description,
-			annotations: tool.annotations,
-			inputSchema: schemaToJsonSchema(tool.inputSchema, "input"),
-			outputSchema: schemaToJsonSchema(tool.outputSchema, "output")
-		}))
-	};
-}
-function createListToolsHandler(mcp, options = {}) {
-	require_cors.assertRestResourceBinding(mcp, options);
-	return require_gate.createGatedHandler({
-		authorizer: require_cors.createRequestAuthorizer(mcp, options),
-		allowedOrigins: mcp.allowedOrigins,
-		methods: ["GET", "HEAD"],
-		methodNotAllowed: require_cors.methodNotAllowed,
-		handle: async () => Response.json(buildMcpListing(mcp))
-	});
-}
-//#endregion
-Object.defineProperty(exports, "buildMcpListing", {
-	enumerable: true,
-	get: function() {
-		return buildMcpListing;
-	}
-});
-Object.defineProperty(exports, "createListToolsHandler", {
-	enumerable: true,
-	get: function() {
-		return createListToolsHandler;
-	}
-});

package/dist/list-tools-DXqSPvNY.d.ts

@@ -1,8 +0,0 @@
-import { u as McpDefinition } from "./types-D1cgsnPu.js";
-import { t as MetricsRecorder } from "./base-C8osWdMU.js";
-import { t as McpRuntimeOptions } from "./authorize-BjNE3LPr.js";
-//#region src/protocols/rest/list-tools.d.ts
-type RestListToolsHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
-declare function createListToolsHandler(mcp: McpDefinition, options?: McpRuntimeOptions): RestListToolsHandler;
-//#endregion
-export { createListToolsHandler as n, RestListToolsHandler as t };