@lovable.dev/mcp-js 0.29.0-rc.4 → 0.30.0-rc.0

package/dist/mcp-Dq6dXUKT.cjs

@@ -0,0 +1,353 @@
+const require_logger = require("./logger-CN1q-KNn.cjs");
+const require_schema = require("./schema-D3vClxb7.cjs");
+const require_errors = require("./errors-Cr95rSkB.cjs");
+const require_cors = require("./cors-DIQIXIHY.cjs");
+let _modelcontextprotocol_sdk_server_zod_compat_js = require("@modelcontextprotocol/sdk/server/zod-compat.js");
+let _modelcontextprotocol_server = require("@modelcontextprotocol/server");
+//#region src/core/content.ts
+/** Join the text of a result's `type: "text"` blocks into one string, dropping
+*  binary/resource blocks. Used to surface a `tool_error` message in the local
+*  log; never sent over the telemetry wire. Returns undefined when there is no
+*  text to show. */
+function extractTextContent(content) {
+	if (!content) return void 0;
+	const text = content.filter((block) => block.type === "text").map((block) => block.text).join("\n").trim();
+	return text.length > 0 ? text : void 0;
+}
+//#endregion
+//#region src/core/tool-result.ts
+function normalizeResourceLinkIcon(icon) {
+	if (typeof icon.sizes !== "string") return icon;
+	const { sizes, ...rest } = icon;
+	const normalized = sizes.trim();
+	return normalized === "" ? rest : {
+		...rest,
+		sizes: normalized.split(/\s+/)
+	};
+}
+function normalizeToolContent(content) {
+	return (content ?? []).map((block) => {
+		if (block.type !== "resource_link" || block.icons === void 0) return block;
+		return {
+			...block,
+			icons: block.icons.map(normalizeResourceLinkIcon)
+		};
+	});
+}
+function outputValidationError(text) {
+	return {
+		content: [{
+			type: "text",
+			text
+		}],
+		isError: true
+	};
+}
+function isJsonValue(value, ancestors = /* @__PURE__ */ new Set()) {
+	if (value === null || typeof value === "boolean" || typeof value === "string") return true;
+	if (typeof value === "number") return Number.isFinite(value);
+	if (typeof value !== "object" || ancestors.has(value)) return false;
+	const prototype = Object.getPrototypeOf(value);
+	if (!Array.isArray(value) && prototype !== Object.prototype && prototype !== null) return false;
+	ancestors.add(value);
+	const valid = (Array.isArray(value) ? value : Object.values(value).filter((entry) => entry !== void 0)).every((entry) => isJsonValue(entry, ancestors));
+	ancestors.delete(value);
+	return valid;
+}
+async function finalizeToolResult(tool, result) {
+	const content = normalizeToolContent(result.content);
+	let structuredContent = result.structuredContent;
+	if (tool.outputSchema && !result.isError) {
+		if (structuredContent === void 0) return outputValidationError(`Output validation error: Tool ${tool.name} has an output schema but no structured content was provided`);
+		try {
+			const parsed = await (0, _modelcontextprotocol_sdk_server_zod_compat_js.safeParseAsync)(require_schema.schemaFromDefinition(tool.outputSchema), structuredContent);
+			if (!parsed.success) return outputValidationError(`Output validation error: Invalid structured content for tool ${tool.name}: ${(0, _modelcontextprotocol_sdk_server_zod_compat_js.getParseErrorMessage)(parsed.error)}`);
+			structuredContent = parsed.data;
+		} catch {
+			return outputValidationError(`Output validation error: Could not validate structured content for tool ${tool.name}`);
+		}
+	}
+	if (structuredContent !== void 0 && !isJsonValue(structuredContent)) {
+		if (!result.isError) return outputValidationError(`Output validation error: Tool ${tool.name} returned a non-JSON structured value`);
+		structuredContent = void 0;
+	}
+	if (structuredContent !== void 0 && (structuredContent === null || typeof structuredContent !== "object" || Array.isArray(structuredContent)) && !content.some((block) => block.type === "text")) content.push({
+		type: "text",
+		text: JSON.stringify(structuredContent)
+	});
+	return {
+		content,
+		structuredContent,
+		isError: result.isError
+	};
+}
+//#endregion
+//#region src/protocols/gate.ts
+function createGatedHandler(gate) {
+	const allow = [...gate.methods, "OPTIONS"].join(", ");
+	const respond = async (request, recorder) => {
+		const authResult = await gate.authorizer.authorize(request, recorder);
+		if (!authResult.ok) return authResult.response;
+		if (!gate.methods.includes(request.method)) return gate.methodNotAllowed(allow);
+		return gate.handle(request, authResult, recorder);
+	};
+	return async (request, recorder = require_cors.createNoopRecorder()) => {
+		const cors = require_cors.evaluateCors(request, gate.allowedOrigins);
+		if (!cors.ok) {
+			const httpMethod = require_cors.normalizeHttpMethod(request.method);
+			require_logger.log.info("cors.origin_rejected", {
+				origin: request.headers.get("Origin"),
+				httpMethod
+			});
+			await recorder.emit({
+				tool: null,
+				method: "authorize",
+				outcome: "origin_rejected",
+				httpMethod,
+				durationMs: 0
+			});
+			return require_cors.finalizeWireResponse(request, cors.response);
+		}
+		if (request.method === "OPTIONS") return cors.preflight(allow);
+		const final = require_cors.finalizeWireResponse(request, cors.withHeaders(await respond(request, recorder)));
+		if (!final.headers.has("Cache-Control")) final.headers.set("Cache-Control", "no-store");
+		return final;
+	};
+}
+//#endregion
+//#region src/protocols/mcp/protocol.ts
+const MODERN_PROTOCOL_VERSION = "2026-07-28";
+function statelessMethodNotAllowed(allow) {
+	return Response.json({
+		jsonrpc: "2.0",
+		id: null,
+		error: {
+			code: -32e3,
+			message: "Method not allowed: stateless server offers no standalone SSE stream (GET) or session (DELETE)."
+		}
+	}, {
+		status: 405,
+		headers: { Allow: allow }
+	});
+}
+function zodIssues(error) {
+	const issues = error?.issues;
+	if (!Array.isArray(issues)) return [{ message: String(error) }];
+	return issues.map((issue) => {
+		const value = issue;
+		return {
+			message: typeof value.message === "string" ? value.message : String(value.message),
+			...Array.isArray(value.path) ? { path: value.path } : {}
+		};
+	});
+}
+function standardSchemaFromDefinition(definition) {
+	const schema = require_schema.schemaFromDefinition(definition);
+	return { "~standard": {
+		version: 1,
+		vendor: "zod",
+		validate: async (value) => {
+			const parsed = await (0, _modelcontextprotocol_sdk_server_zod_compat_js.safeParseAsync)(schema, value);
+			return parsed.success ? { value: parsed.data } : { issues: zodIssues(parsed.error) };
+		},
+		jsonSchema: {
+			input: () => require_schema.jsonSchemaFromDefinition(definition, "input"),
+			output: () => require_schema.jsonSchemaFromDefinition(definition, "output")
+		}
+	} };
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function toolRequestContext(sdkCtx, protocol) {
+	const mcpReq = sdkCtx?.mcpReq;
+	const client = { protocol };
+	const envelope = mcpReq?.envelope;
+	const info = envelope?.[_modelcontextprotocol_server.CLIENT_INFO_META_KEY];
+	if (isPlainObject(info) && typeof info.name === "string" && typeof info.version === "string") client.info = info;
+	const capabilities = envelope?.[_modelcontextprotocol_server.CLIENT_CAPABILITIES_META_KEY];
+	if (isPlainObject(capabilities)) {
+		client.capabilities = capabilities;
+		if (isPlainObject(capabilities.extensions)) client.extensions = capabilities.extensions;
+	}
+	const progressToken = (mcpReq?._meta)?.progressToken;
+	const notify = mcpReq?.notify;
+	const sendProgress = progressToken !== void 0 && notify ? async (update) => {
+		try {
+			await notify({
+				method: "notifications/progress",
+				params: {
+					progressToken,
+					...update
+				}
+			});
+		} catch (err) {
+			require_logger.log.debug("mcp.progress_notify_failed", require_logger.describeError(err));
+		}
+	} : void 0;
+	return {
+		signal: mcpReq?.signal,
+		client,
+		sendProgress
+	};
+}
+async function invokeTool(tool, auth, recorder, args, protocol, sdkCtx) {
+	const endUserId = auth?.principal.sub;
+	const start = require_cors.nowMs();
+	let result;
+	try {
+		result = await tool.handler(args, new require_errors.ToolContext(auth, toolRequestContext(sdkCtx, protocol)));
+	} catch (err) {
+		const callerMessage = require_errors.resolveToolErrorMessage(err);
+		if (callerMessage === void 0) {
+			await recorder.emit({
+				tool: tool.name,
+				method: "tools/call",
+				outcome: "handler_error",
+				durationMs: require_cors.nowMs() - start,
+				errorText: require_errors.errorSummary(err),
+				endUserId,
+				protocol
+			});
+			return finalizeToolResult(tool, {
+				content: [{
+					type: "text",
+					text: "tool execution failed"
+				}],
+				isError: true
+			});
+		}
+		result = {
+			content: [{
+				type: "text",
+				text: callerMessage
+			}],
+			isError: true
+		};
+	}
+	if (result == null) {
+		await recorder.emit({
+			tool: tool.name,
+			method: "tools/call",
+			outcome: "handler_error",
+			durationMs: require_cors.nowMs() - start,
+			endUserId,
+			protocol
+		});
+		return finalizeToolResult(tool, {
+			content: [{
+				type: "text",
+				text: `tool "${tool.name}" returned no result`
+			}],
+			isError: true
+		});
+	}
+	result = await finalizeToolResult(tool, result);
+	await recorder.emit({
+		tool: tool.name,
+		method: "tools/call",
+		outcome: result.isError ? "tool_error" : "ok",
+		durationMs: require_cors.nowMs() - start,
+		errorText: result.isError ? extractTextContent(result.content) : void 0,
+		endUserId,
+		protocol
+	});
+	return result;
+}
+function adaptToolCallback(tool, auth, recorder, protocol) {
+	return async (first, second) => {
+		const sdkCtx = tool.inputSchema ? second : first;
+		const result = await invokeTool(tool, auth, recorder, tool.inputSchema ? first ?? {} : {}, protocol, sdkCtx);
+		return {
+			content: result.content ?? [],
+			structuredContent: result.structuredContent,
+			isError: result.isError
+		};
+	};
+}
+function buildServer(mcp, auth, recorder, era) {
+	const server = new _modelcontextprotocol_server.McpServer({
+		name: mcp.name,
+		version: mcp.version,
+		title: mcp.title
+	}, {
+		instructions: mcp.instructions,
+		capabilities: { tools: { listChanged: false } }
+	});
+	for (const tool of mcp.tools) {
+		const config = {
+			title: tool.title,
+			description: tool.description,
+			annotations: tool.annotations,
+			...tool.outputSchema ? { outputSchema: standardSchemaFromDefinition(tool.outputSchema) } : {}
+		};
+		const callback = adaptToolCallback(tool, auth, recorder, era === "legacy" ? "legacy" : MODERN_PROTOCOL_VERSION);
+		if (tool.inputSchema) server.registerTool(tool.name, {
+			...config,
+			inputSchema: standardSchemaFromDefinition(tool.inputSchema)
+		}, callback);
+		else server.registerTool(tool.name, config, callback);
+	}
+	return server;
+}
+/**
+* Build a Web-Standard request handler that serves the MCP protocol over
+* streamable HTTP. A fresh `McpServer` + transport is constructed per
+* request — the transport is stateless, so this is cheap and there is no
+* cross-request state to leak. The per-request `recorder` is supplied by the
+* caller (the stack handler) so telemetry reads the runtime env in-flight.
+*/
+function createMcpProtocolHandler(mcp, options = {}) {
+	const authorizer = require_cors.createRequestAuthorizer(mcp, options);
+	const handle = async (request, authResult, recorder) => {
+		let protocolError;
+		const reportTransportError = async (error) => {
+			await recorder.emit({
+				tool: null,
+				method: "transport",
+				outcome: "transport_error",
+				durationMs: 0,
+				endUserId: authResult.auth?.principal.sub
+			});
+			require_logger.log.error("mcp.transport_error", {
+				...error === void 0 ? {} : require_logger.describeError(error),
+				outcome: "500 internal error"
+			});
+		};
+		try {
+			const response = await (0, _modelcontextprotocol_server.createMcpHandler)(({ era }) => buildServer(mcp, authResult.auth, recorder, era), {
+				legacy: "stateless",
+				maxSubscriptions: 0,
+				onerror: (error) => {
+					protocolError = error;
+				}
+			}).fetch(request);
+			if (response.status >= 500) await reportTransportError(protocolError);
+			return response;
+		} catch (err) {
+			await reportTransportError(err);
+			return Response.json({
+				jsonrpc: "2.0",
+				id: null,
+				error: {
+					code: -32603,
+					message: "internal error"
+				}
+			}, { status: 500 });
+		}
+	};
+	return createGatedHandler({
+		authorizer,
+		allowedOrigins: mcp.allowedOrigins,
+		methods: ["POST"],
+		methodNotAllowed: statelessMethodNotAllowed,
+		handle
+	});
+}
+//#endregion
+Object.defineProperty(exports, "createMcpProtocolHandler", {
+	enumerable: true,
+	get: function() {
+		return createMcpProtocolHandler;
+	}
+});

package/dist/{package-Xk8p8Q_E.cjs → package-QViIguII.cjs}

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.29.0-rc.4";
+var version = "0.30.0-rc.0";
 //#endregion
 Object.defineProperty(exports, "version", {
 	enumerable: true,

package/dist/{package-DMs4EVwG.js → package-ZFJI6B7S.js}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.29.0-rc.4";
+var version = "0.30.0-rc.0";
 //#endregion
 export { version as t };

package/dist/protocols/mcp/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_mcp = require("../../mcp-DtHM-41c.cjs");
+const require_mcp = require("../../mcp-Dq6dXUKT.cjs");
 exports.createMcpProtocolHandler = require_mcp.createMcpProtocolHandler;

package/dist/protocols/mcp/index.d.cts

@@ -1,36 +1,6 @@
-import { c as McpDefinition } from "../../types-C0Wgm9zp.cjs";
-import { t as McpRuntimeOptions } from "../../authorize-DIYS7zBP.cjs";
-//#region src/metrics/impl/base.d.ts
-type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_challenge" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
-/** One recorded MCP call. Carries no arguments or response payloads — only the
- *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
- *  `errorText` is the sole exception: it is logged locally for debugging and
- *  deliberately never included in the OTLP payload (see `emit` / `buildLogsPayload`). */
-interface InvocationRecord {
-  /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and `authorize` records. */
-  tool: string | null;
-  /** JSON-RPC method, e.g. `tools/call`; `authorize` for records from the authorization gate. */
-  method: string;
-  outcome: InvocationOutcome;
-  durationMs: number;
-  reqBytes?: number;
-  resBytes?: number;
-  /** HTTP request method. Set on `auth_challenge` so probe traffic (GET vs
-   *  POST discovery) is distinguishable; absent on tool-call records. */
-  httpMethod?: string;
-  /** The app end-user that made the call (the access token `sub`), or
-   *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
-  endUserId?: string;
-  /** Caller-visible `isError` text (`tool_error`) or a bounded internal-exception
-   *  summary (`handler_error`). Local log only — never sent to the collector. */
-  errorText?: string;
-}
-/** A per-request telemetry recorder. `emit` logs the invocation and sends it as a
- *  single OTLP POST, awaited so it lands before the request ends. */
-interface MetricsRecorder {
-  emit(ev: InvocationRecord): Promise<void>;
-}
-//#endregion
+import { d as McpDefinition } from "../../types-3CZPz364.cjs";
+import { t as MetricsRecorder } from "../../base-CHNFFrMG.cjs";
+import { t as McpRuntimeOptions } from "../../authorize-9hTTG-qJ.cjs";
 //#region src/protocols/mcp/protocol.d.ts
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
 /**

package/dist/protocols/mcp/index.d.ts

@@ -1,36 +1,6 @@
-import { c as McpDefinition } from "../../types-C0Wgm9zp.js";
-import { t as McpRuntimeOptions } from "../../authorize-CqYsQYfa.js";
-//#region src/metrics/impl/base.d.ts
-type InvocationOutcome = "ok" | "tool_error" | "handler_error" | "transport_error" | "auth_challenge" | "auth_discovery_config_error" | "auth_discovery_unreachable" | "auth_jwks_config_error" | "auth_jwks_unreachable";
-/** One recorded MCP call. Carries no arguments or response payloads — only the
- *  tool name, the JSON-RPC method, the result class, timing, and byte sizes.
- *  `errorText` is the sole exception: it is logged locally for debugging and
- *  deliberately never included in the OTLP payload (see `emit` / `buildLogsPayload`). */
-interface InvocationRecord {
-  /** Tool name for `tools/call`; `null` for list/initialize, transport faults, and `authorize` records. */
-  tool: string | null;
-  /** JSON-RPC method, e.g. `tools/call`; `authorize` for records from the authorization gate. */
-  method: string;
-  outcome: InvocationOutcome;
-  durationMs: number;
-  reqBytes?: number;
-  resBytes?: number;
-  /** HTTP request method. Set on `auth_challenge` so probe traffic (GET vs
-   *  POST discovery) is distinguishable; absent on tool-call records. */
-  httpMethod?: string;
-  /** The app end-user that made the call (the access token `sub`), or
-   *  `undefined` when the request is unauthenticated. Not a Lovable identity. */
-  endUserId?: string;
-  /** Caller-visible `isError` text (`tool_error`) or a bounded internal-exception
-   *  summary (`handler_error`). Local log only — never sent to the collector. */
-  errorText?: string;
-}
-/** A per-request telemetry recorder. `emit` logs the invocation and sends it as a
- *  single OTLP POST, awaited so it lands before the request ends. */
-interface MetricsRecorder {
-  emit(ev: InvocationRecord): Promise<void>;
-}
-//#endregion
+import { d as McpDefinition } from "../../types-3CZPz364.js";
+import { t as MetricsRecorder } from "../../base-7cq6HCPO.js";
+import { t as McpRuntimeOptions } from "../../authorize-DNUlPT7k.js";
 //#region src/protocols/mcp/protocol.d.ts
 type McpProtocolHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
 /**

package/dist/protocols/mcp/index.js

@@ -1,2 +1,2 @@
-import { t as createMcpProtocolHandler } from "../../mcp-BLs6_g8i.js";
+import { t as createMcpProtocolHandler } from "../../mcp-Cb5SavFT.js";
 export { createMcpProtocolHandler };

package/dist/protocols/oauth-metadata.cjs

@@ -1,12 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_logger = require("../logger-CN1q-KNn.cjs");
-const require_authorize = require("../authorize-CKMlIxm9.cjs");
+const require_cors = require("../cors-DIQIXIHY.cjs");
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
 	return new Response(JSON.stringify({ error: "not found" }), {
 		status: 404,
 		headers: {
-			...require_authorize.JSON_HEADERS,
+			...require_cors.JSON_HEADERS,
 			"Cache-Control": "no-store"
 		}
 	});
@@ -14,7 +14,7 @@ function notFound() {
 async function buildProtectedResourceMetadata(mcp, auth, request, options, discovery) {
 	const issuer = await discovery.resolveIssuer();
 	const body = {
-		resource: require_authorize.resolveProtectedResource(auth, request, options),
+		resource: require_cors.resolveProtectedResource(auth, request, options),
 		authorization_servers: [issuer],
 		bearer_methods_supported: ["header"],
 		resource_name: auth.resourceName ?? mcp.title,
@@ -24,7 +24,7 @@ async function buildProtectedResourceMetadata(mcp, auth, request, options, disco
 	return body;
 }
 function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
-	const runtime = require_authorize.getOAuthRuntime(mcp, options);
+	const runtime = require_cors.getOAuthRuntime(mcp, options);
 	if (runtime.kind === "configured" && runtime.auth.protectedResourceMetadataUrl === void 0 && runtime.auth.resource === void 0) {
 		if (runtime.options.resourcePath === void 0) throw new Error(`@lovable.dev/mcp-js: auth.resource or a resourcePath is required so the protected-resource metadata doesn't advertise the well-known URL as the resource`);
 		if (runtime.options.trustForwardedHost === true && runtime.options.forwardedHostTrustedByPlatform !== true) require_logger.log.warn("oauth.metadata.host_derived_resource", { detail: "trustForwardedHost is on and auth.resource is unpinned; the advertised resource follows X-Forwarded-Host. Pin auth.resource unless a trusted proxy overwrites that header." });
@@ -35,9 +35,9 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 	const vary = varyHeaders.join(", ");
 	const respond = async (request) => {
 		if (runtime.kind !== "configured" || runtime.auth.protectedResourceMetadataUrl !== void 0) return notFound();
-		if (request.method !== "GET" && request.method !== "HEAD") return require_authorize.methodNotAllowed("GET, HEAD, OPTIONS");
+		if (request.method !== "GET" && request.method !== "HEAD") return require_cors.methodNotAllowed("GET, HEAD, OPTIONS");
 		const headers = {
-			...require_authorize.JSON_HEADERS,
+			...require_cors.JSON_HEADERS,
 			"Cache-Control": "public, max-age=300",
 			Vary: vary
 		};
@@ -49,12 +49,29 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 				...require_logger.describeError(err),
 				outcome: "500 oauth configuration error"
 			});
-			return require_authorize.oauthConfigurationErrorResponse();
+			return require_cors.oauthConfigurationErrorResponse();
 		}
 	};
-	return async (request) => {
-		if (request.method === "OPTIONS") return require_authorize.corsPreflightResponse("GET, HEAD, OPTIONS");
-		return require_authorize.finalizeWireResponse(request, await respond(request));
+	return async (request, recorder = require_cors.createNoopRecorder()) => {
+		const cors = require_cors.evaluateCors(request, mcp.allowedOrigins);
+		if (!cors.ok) {
+			const httpMethod = require_cors.normalizeHttpMethod(request.method);
+			require_logger.log.info("cors.origin_rejected", {
+				origin: request.headers.get("Origin"),
+				httpMethod,
+				route: "oauth-metadata"
+			});
+			await recorder.emit({
+				tool: null,
+				method: "authorize",
+				outcome: "origin_rejected",
+				httpMethod,
+				durationMs: 0
+			});
+			return require_cors.finalizeWireResponse(request, cors.response);
+		}
+		if (request.method === "OPTIONS") return cors.preflight("GET, HEAD, OPTIONS");
+		return require_cors.finalizeWireResponse(request, cors.withHeaders(await respond(request)));
 	};
 }
 //#endregion

package/dist/protocols/oauth-metadata.d.cts

@@ -1,7 +1,8 @@
-import { c as McpDefinition } from "../types-C0Wgm9zp.cjs";
-import { t as McpRuntimeOptions } from "../authorize-DIYS7zBP.cjs";
+import { d as McpDefinition } from "../types-3CZPz364.cjs";
+import { t as MetricsRecorder } from "../base-CHNFFrMG.cjs";
+import { t as McpRuntimeOptions } from "../authorize-9hTTG-qJ.cjs";
 //#region src/protocols/oauth-metadata.d.ts
-type OAuthProtectedResourceMetadataHandler = (request: Request) => Promise<Response>;
+type OAuthProtectedResourceMetadataHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
 declare function createOAuthProtectedResourceMetadataHandler(mcp: McpDefinition, options?: McpRuntimeOptions): OAuthProtectedResourceMetadataHandler;
 //#endregion
 export { OAuthProtectedResourceMetadataHandler, createOAuthProtectedResourceMetadataHandler };

package/dist/protocols/oauth-metadata.d.ts

@@ -1,7 +1,8 @@
-import { c as McpDefinition } from "../types-C0Wgm9zp.js";
-import { t as McpRuntimeOptions } from "../authorize-CqYsQYfa.js";
+import { d as McpDefinition } from "../types-3CZPz364.js";
+import { t as MetricsRecorder } from "../base-7cq6HCPO.js";
+import { t as McpRuntimeOptions } from "../authorize-DNUlPT7k.js";
 //#region src/protocols/oauth-metadata.d.ts
-type OAuthProtectedResourceMetadataHandler = (request: Request) => Promise<Response>;
+type OAuthProtectedResourceMetadataHandler = (request: Request, recorder?: MetricsRecorder) => Promise<Response>;
 declare function createOAuthProtectedResourceMetadataHandler(mcp: McpDefinition, options?: McpRuntimeOptions): OAuthProtectedResourceMetadataHandler;
 //#endregion
 export { OAuthProtectedResourceMetadataHandler, createOAuthProtectedResourceMetadataHandler };

package/dist/protocols/oauth-metadata.js

@@ -1,5 +1,5 @@
 import { i as log, r as describeError } from "../logger-Ctv5xUSD.js";
-import { a as resolveProtectedResource, d as methodNotAllowed, f as corsPreflightResponse, l as JSON_HEADERS, n as getOAuthRuntime, r as oauthConfigurationErrorResponse, u as finalizeWireResponse } from "../authorize-b3VqTC_7.js";
+import { a as oauthConfigurationErrorResponse, d as JSON_HEADERS, f as finalizeWireResponse, i as normalizeHttpMethod, l as createNoopRecorder, p as methodNotAllowed, r as getOAuthRuntime, s as resolveProtectedResource, t as evaluateCors } from "../cors-5P69YRDK.js";
 //#region src/protocols/oauth-metadata.ts
 function notFound() {
 	return new Response(JSON.stringify({ error: "not found" }), {
@@ -51,9 +51,26 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
 			return oauthConfigurationErrorResponse();
 		}
 	};
-	return async (request) => {
-		if (request.method === "OPTIONS") return corsPreflightResponse("GET, HEAD, OPTIONS");
-		return finalizeWireResponse(request, await respond(request));
+	return async (request, recorder = createNoopRecorder()) => {
+		const cors = evaluateCors(request, mcp.allowedOrigins);
+		if (!cors.ok) {
+			const httpMethod = normalizeHttpMethod(request.method);
+			log.info("cors.origin_rejected", {
+				origin: request.headers.get("Origin"),
+				httpMethod,
+				route: "oauth-metadata"
+			});
+			await recorder.emit({
+				tool: null,
+				method: "authorize",
+				outcome: "origin_rejected",
+				httpMethod,
+				durationMs: 0
+			});
+			return finalizeWireResponse(request, cors.response);
+		}
+		if (request.method === "OPTIONS") return cors.preflight("GET, HEAD, OPTIONS");
+		return finalizeWireResponse(request, cors.withHeaders(await respond(request)));
 	};
 }
 //#endregion

package/dist/schema-CW1jKvio.js

@@ -0,0 +1,65 @@
+import { objectFromShape } from "@modelcontextprotocol/sdk/server/zod-compat.js";
+import { toJsonSchemaCompat } from "@modelcontextprotocol/sdk/server/zod-json-schema-compat.js";
+//#region src/core/schema.ts
+function isZodSchema(definition) {
+	return (typeof definition === "object" || typeof definition === "function") && definition !== null && typeof definition.safeParse === "function";
+}
+function schemaFromDefinition(definition) {
+	return isZodSchema(definition) ? definition : objectFromShape(definition);
+}
+const NON_JSON_ZOD3_OUTPUTS = /* @__PURE__ */ new Set([
+	"ZodBigInt",
+	"ZodDate",
+	"ZodFunction",
+	"ZodMap",
+	"ZodNaN",
+	"ZodPromise",
+	"ZodSet",
+	"ZodSymbol",
+	"ZodUndefined",
+	"ZodVoid"
+]);
+function unsupportedZod3Output(schema, seen = /* @__PURE__ */ new Set()) {
+	if (seen.has(schema)) return void 0;
+	seen.add(schema);
+	const definition = schema._def;
+	if (!definition) return void 0;
+	if (definition.effect?.type === "transform") return "Transforms cannot be represented in JSON Schema";
+	const typeName = definition.typeName;
+	if (typeof typeName === "string" && NON_JSON_ZOD3_OUTPUTS.has(typeName)) return `${typeName} does not produce a JSON value`;
+	const shape = definition.shape;
+	if (typeof shape === "function") {
+		const fields = shape();
+		for (const field of Object.values(fields)) {
+			const issue = unsupportedZod3Output(field, seen);
+			if (issue) return issue;
+		}
+	}
+	const getter = definition.getter;
+	if (typeof getter === "function") {
+		const issue = unsupportedZod3Output(getter(), seen);
+		if (issue) return issue;
+	}
+	for (const value of Object.values(definition)) if (Array.isArray(value)) for (const entry of value) {
+		if (!isZodSchema(entry)) continue;
+		const issue = unsupportedZod3Output(entry, seen);
+		if (issue) return issue;
+	}
+	else if (value && typeof value === "object" && isZodSchema(value)) {
+		const issue = unsupportedZod3Output(value, seen);
+		if (issue) return issue;
+	}
+}
+function jsonSchemaFromDefinition(definition, pipeStrategy) {
+	const schema = schemaFromDefinition(definition);
+	if (pipeStrategy === "output") {
+		const issue = unsupportedZod3Output(schema);
+		if (issue) throw new Error(issue);
+	}
+	return toJsonSchemaCompat(schema, {
+		target: "draft-2020-12",
+		pipeStrategy
+	});
+}
+//#endregion
+export { schemaFromDefinition as n, jsonSchemaFromDefinition as t };