@mastra/mcp 2.5.0 → 2.6.0-alpha.1

package/dist/index.js

@@ -27,11 +27,10 @@ import { CLIENT_INFO_META_KEY, PROTOCOL_VERSION_META_KEY, ProtocolError as Proto
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
 import https from "https";
 import { SignalProvider } from "@mastra/core/signals";
-//#region src/client/types.ts
+// src/client/types.ts
 /** The current protocol revision; the one `/mcp` servers speak. */
 const MCP_CLIENT_PROTOCOL_VERSION = "2026-07-28";
-//#endregion
-//#region ../schema-compat/dist/json-schema-traverse-Jrimn_T_.js
+// ../schema-compat/dist/json-schema-traverse-D0CId4oM.js
 var __create$1 = Object.create;
 var __defProp$2 = Object.defineProperty;
 var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
@@ -126,8 +125,7 @@ var require_json_schema_traverse = /* @__PURE__ */ __commonJSMin$1(((exports, mo
 		return str.replace(/~/g, "~0").replace(/\//g, "~1");
 	}
 }));
-//#endregion
-//#region ../schema-compat/dist/esm-DA8owk0L.js
+// ../schema-compat/dist/esm-BG70JlG8.js
 const ignoreOverride$1 = Symbol("Let zodToJsonSchema decide on which parser to use");
 const defaultOptions$1 = {
 	name: void 0,
@@ -1133,8 +1131,7 @@ const zodToJsonSchema$1 = (schema, options) => {
 	return combined;
 };
 var esm_default$1 = zodToJsonSchema$1;
-//#endregion
-//#region ../schema-compat/dist/zod-to-json.js
+// ../schema-compat/dist/zod-to-json.js
 const PATCHED = Symbol("__mastra_patched__");
 /**
 * Recursively patch Zod v4 record schemas that are missing valueType.
@@ -1185,8 +1182,7 @@ function patchRecordSchemas(schema) {
 	if (def.innerType) patchRecordSchemas(def.innerType);
 	return schema;
 }
-//#endregion
-//#region ../schema-compat/dist/standard-schema/adapters/ai-sdk.js
+// ../schema-compat/dist/standard-schema/adapters/ai-sdk.js
 /**
 * Vendor name for AI SDK wrapped schemas.
 */
@@ -1334,8 +1330,7 @@ var AiSdkSchemaWrapper = class {
 function toStandardSchema$4(schema) {
 	return new AiSdkSchemaWrapper(schema);
 }
-//#endregion
-//#region ../schema-compat/dist/json-schema-DcMkkbbI.js
+// ../schema-compat/dist/json-schema-BdCwqjfN.js
 var require_code$1 = /* @__PURE__ */ __commonJSMin$1(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.regexpCode = exports.getEsmExportName = exports.getProperty = exports.safeStringify = exports.stringify = exports.strConcat = exports.addCodeArg = exports.str = exports._ = exports.nil = exports._Code = exports.Name = exports.IDENTIFIER = exports._CodeOrName = void 0;
@@ -4230,6 +4225,38 @@ var require_utils = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 		return output.join("");
 	}
 	/**
+	* Removes dot segments from the path of a relative reference (a path that does
+	* not start with "/") without changing what it resolves to against any base.
+	* Unlike `removeDotSegments`, leading ".." segments that cannot be collapsed
+	* are kept, the result never becomes root-relative, and a result that would be
+	* empty or start with an empty segment is prefixed with "." (an empty path
+	* means "same document" and a leading "//" would introduce an authority).
+	*
+	* @param {string} path
+	* @returns {string}
+	*/
+	function removeDotSegmentsRelative(path) {
+		if (path === "" || path[0] === "/") return removeDotSegments(path);
+		const segments = path.split("/");
+		const last = segments.length - 1;
+		/** @type {string[]} */
+		const output = [];
+		let trailingDirectory = false;
+		for (let i = 0; i <= last; i++) {
+			const segment = segments[i];
+			if (segment === "." || segment === "..") {
+				if (segment === "..") {
+					if (output.length !== 0 && output[output.length - 1] !== "..") output.pop();
+					else output.push("..");
+				}
+				trailingDirectory = i === last;
+			} else output.push(segment);
+		}
+		if (trailingDirectory && output[output.length - 1] !== "..") output.push("");
+		if (output.length === 0 || output[0] === "" || output[0].includes(":")) output.unshift(".");
+		return output.join("/");
+	}
+	/**
 	* Re-escape RFC 3986 gen-delims that must not appear literally in the host.
 	* After the URI regex parses, these characters cannot be literal in the host
 	* field, so any that appear after decoding came from percent-encoding and
@@ -4533,6 +4560,7 @@ var require_utils = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 		encodeFragment,
 		escapePreservingEscapes,
 		removeDotSegments,
+		removeDotSegmentsRelative,
 		isIPv4,
 		isUUID,
 		normalizeIPv6,
@@ -4722,18 +4750,24 @@ var require_schemes = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 	};
 }));
 var require_fast_uri = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
-	const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+	const { normalizeIPv6, removeDotSegments, removeDotSegmentsRelative, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
 	const { SCHEMES, getSchemeHandler } = require_schemes();
 	const VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
 	const MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
+	const MALFORMED_HOST_ERROR = "URI host is malformed.";
+	const FORBIDDEN_DOMAIN_HOST_CHARACTER = /[\0-\x20"#/:<>?@[\\\]^`{|}\x7F]/u;
 	/**
+	* RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so the
+	* scheme is validated as-is and never decoded. Decoding would let inert input
+	* such as `%6Aavascript:` become a live `javascript:` scheme.
+	*
 	* @param {string} scheme
 	* @returns {string}
 	*/
-	function decodeValidScheme(scheme) {
-		const decodedScheme = unescape(String(scheme));
-		if (!VALID_SCHEME.test(decodedScheme)) throw new TypeError(MALFORMED_SCHEME_ERROR);
-		return decodedScheme;
+	function validateScheme(scheme) {
+		const stringScheme = String(scheme);
+		if (!VALID_SCHEME.test(stringScheme)) throw new TypeError(MALFORMED_SCHEME_ERROR);
+		return stringScheme;
 	}
 	/**
 	* @template {import('./types/index').URIComponent|string} T
@@ -4761,6 +4795,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 		const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
 		const resolvedHost = resolved.host;
 		const resolvedHostIsIP = resolvedHost !== void 0 && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+		if (hasForbiddenDomainHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP)) throw new Error(MALFORMED_HOST_ERROR);
 		canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
 		const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !/\P{ASCII}/u.test(resolvedHost);
 		if (resolved.error && !encodedASCIIHost) throw new Error(resolved.error);
@@ -4804,10 +4839,11 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 				} else {
 					if (relative.path[0] === "/") target.path = removeDotSegments(relative.path);
 					else {
-						if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative.path;
+						const baseHasAuthority = base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0;
+						if (baseHasAuthority && !base.path) target.path = "/" + relative.path;
 						else if (!base.path) target.path = relative.path;
 						else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative.path;
-						target.path = removeDotSegments(target.path);
+						target.path = base.scheme === void 0 && !baseHasAuthority && target.path[0] !== "/" ? removeDotSegmentsRelative(target.path) : removeDotSegments(target.path);
 					}
 					target.query = relative.query;
 				}
@@ -4855,17 +4891,18 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 		};
 		const options = Object.assign({}, opts);
 		const uriTokens = [];
-		if (component.scheme) component.scheme = decodeValidScheme(component.scheme);
+		if (component.scheme) component.scheme = validateScheme(component.scheme);
 		const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
 		if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
 		const hasAuthority = component.userinfo !== void 0 || component.host !== void 0 || component.port !== void 0;
-		const pathNoScheme = !options.skipEscape && component.scheme === void 0 && !hasAuthority;
+		const schemelessReference = (component.scheme === void 0 || options.reference === "suffix") && !hasAuthority;
+		const pathNoScheme = !options.skipEscape && schemelessReference;
 		if (component.path !== void 0) {
 			if (!options.skipEscape) component.path = serializePathEncoding(component.path, pathNoScheme);
 			else component.path = normalizePercentEncoding(component.path);
 		}
 		if (options.reference !== "suffix" && component.scheme) {
-			component.scheme = decodeValidScheme(component.scheme);
+			component.scheme = validateScheme(component.scheme);
 			uriTokens.push(component.scheme, ":");
 		}
 		const authority = recomposeAuthority(component);
@@ -4876,8 +4913,8 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 		}
 		if (component.path !== void 0) {
 			let s = component.path;
-			if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) s = removeDotSegments(s);
-			if (pathNoScheme) s = serializePathEncoding(s, true);
+			if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) s = schemelessReference && s[0] !== "/" ? removeDotSegmentsRelative(s) : removeDotSegments(s);
+			if (schemelessReference) s = serializePathEncoding(s, true);
 			if (authority === void 0 && s[0] === "/" && s[1] === "/") s = "/%2F" + s.slice(2);
 			uriTokens.push(s);
 		}
@@ -4941,15 +4978,50 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 	* @returns {boolean} whether host conversion failed
 	*/
 	function canonicalizeHost(parsed, options, schemeHandler, isIP) {
-		if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) try {
-			parsed.host = new URL("http://" + parsed.host).hostname;
-		} catch (e) {
-			parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
+		if (hasForbiddenDomainHost(parsed, options, schemeHandler, isIP)) {
+			parsed.error = parsed.error || MALFORMED_HOST_ERROR;
 			return true;
 		}
+		if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+			let url;
+			try {
+				url = new URL("http://" + parsed.host);
+			} catch (e) {
+				parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
+				return true;
+			}
+			if (!isHostOnlyURL(url)) {
+				parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+				return true;
+			}
+			parsed.host = url.hostname;
+		}
 		return false;
 	}
 	/**
+	* Whether a domain host contains an ASCII character that RFC 3986 does not
+	* allow in a reg-name (unreserved, sub-delims, or pct-encoded). Such a host is
+	* rejected instead of being handed to the WHATWG URL parser, which would treat
+	* "@" as a userinfo delimiter (silently dropping the data before it) and strip
+	* TAB, LF, and CR. Non-ASCII characters remain allowed for IDNs.
+	*
+	* @param {import('./types/index').URIComponent} parsed
+	* @param {import('./types/index').Options} options
+	* @param {{ domainHost?: boolean }|undefined} schemeHandler
+	* @param {boolean} isIP
+	* @returns {boolean}
+	*/
+	function hasForbiddenDomainHost(parsed, options, schemeHandler, isIP) {
+		return Boolean(parsed.host && isIP === false && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && FORBIDDEN_DOMAIN_HOST_CHARACTER.test(parsed.host));
+	}
+	/**
+	* @param {URL} url
+	* @returns {boolean}
+	*/
+	function isHostOnlyURL(url) {
+		return url.username === "" && url.password === "" && url.port === "" && url.pathname === "/" && url.search === "" && url.hash === "" && url.hostname !== "";
+	}
+	/**
 	* @param {string} uri
 	* @param {import('./types/index').Options} [opts]
 	* @returns {{ parsed: import('./types/index').URIComponent, malformedAuthorityOrPort: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
@@ -5006,8 +5078,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 			parsed.query = matches[7];
 			parsed.fragment = matches[8];
 			if (parsed.scheme !== void 0) {
-				const decodedScheme = unescape(parsed.scheme);
-				if (VALID_SCHEME.test(decodedScheme)) parsed.scheme = decodedScheme.toLowerCase();
+				if (VALID_SCHEME.test(parsed.scheme)) parsed.scheme = parsed.scheme.toLowerCase();
 				else {
 					parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
 					malformedScheme = true;
@@ -5030,7 +5101,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 					malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
 					parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
 					if (malformedIPLiteral) {
-						parsed.error = parsed.error || "URI host is malformed.";
+						parsed.error = parsed.error || MALFORMED_HOST_ERROR;
 						malformedAuthorityOrPort = true;
 					}
 				} else isIP = true;
@@ -5045,7 +5116,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 			if (uri.indexOf("%") !== -1 && parsed.host !== void 0 && !malformedIPLiteral) {
 				let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
 				if (!isIP) host = normalizePercentEncoding(host.toLowerCase());
-				parsed.host = reescapeHostDelimiters(host, isIP);
+				parsed.host = isIP || options.scheme !== "null" ? reescapeHostDelimiters(host, isIP) : host;
 			}
 			if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
 				if (parsed.path) parsed.path = normalizePathEncoding(parsed.path);
@@ -8291,8 +8362,7 @@ var JsonSchemaWrapper = class {
 function toStandardSchema$3(schema, options) {
 	return new JsonSchemaWrapper(schema, options);
 }
-//#endregion
-//#region ../schema-compat/dist/standard-schema/adapters/zod-v3.js
+// ../schema-compat/dist/standard-schema/adapters/zod-v3.js
 var import_json_schema_traverse$1 = /* @__PURE__ */ __toESM$1(require_json_schema_traverse(), 1);
 /**
 * Target mapping from Standard Schema targets to zod-to-json-schema targets.
@@ -8386,8 +8456,7 @@ function toStandardSchema$2(zodSchema) {
 	});
 	return wrapper;
 }
-//#endregion
-//#region ../schema-compat/dist/schema-CzbEIyhE.js
+// ../schema-compat/dist/schema-Bf12g7KC.js
 /**
 * Supported JSON Schema targets for z.toJSONSchema().
 * Works with both real Zod v4 and Zod 3.25's v4 compat layer.
@@ -8594,8 +8663,7 @@ function isStandardJSONSchema(value) {
 function isStandardSchemaWithJSON$1(value) {
 	return isStandardSchema(value) && isStandardJSONSchema(value);
 }
-//#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/zod-from-json-schema/0.5.2/938b1a90632b5c19aade6e212477c764befeb6d6e1cdb7cfde7de2557cd03f99/node_modules/zod-from-json-schema/dist/index.mjs
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/zod-from-json-schema/0.5.2/938b1a90632b5c19aade6e212477c764befeb6d6e1cdb7cfde7de2557cd03f99/node_modules/zod-from-json-schema/dist/index.mjs
 var TypeHandler = class {
 	apply(types, schema) {
 		if (!schema.type) return;
@@ -9151,8 +9219,7 @@ function convertJsonSchemaToZod(schema) {
 	for (const handler of refinementHandlers) zodSchema = handler.apply(zodSchema, schema);
 	return zodSchema;
 }
-//#endregion
-//#region ../schema-compat/dist/index.js
+// ../schema-compat/dist/index.js
 var marker$1 = "vercel.ai.error";
 var symbol$1 = Symbol.for(marker$1);
 var _a$1;
@@ -12376,8 +12443,7 @@ function trimStartOfStream() {
 	};
 }
 require_json_schema_traverse();
-//#endregion
-//#region src/shared/events/constants.ts
+// src/shared/events/constants.ts
 /**
 * Wire constants for the MCP Events extension (SEP-3415).
 *
@@ -12433,8 +12499,7 @@ const WEBHOOK_HEADERS = {
 	signature: "webhook-signature",
 	subscriptionId: "x-mcp-subscription-id"
 };
-//#endregion
-//#region src/shared/events/schemas.ts
+// src/shared/events/schemas.ts
 /**
 * Zod schemas for the MCP Events extension (SEP-3415) wire format.
 *
@@ -12640,8 +12705,7 @@ function parseWebhookBody(body) {
 		event: EventOccurrenceSchema.parse(body)
 	};
 }
-//#endregion
-//#region src/shared/events/capability.ts
+// src/shared/events/capability.ts
 /**
 * Read the negotiated events extension settings from a capabilities object.
 * Returns `undefined` when the peer did not advertise the extension (or advertised a malformed entry).
@@ -12657,8 +12721,7 @@ function getEventsCapability(capabilities) {
 	const parsed = EventsCapabilitySchema.safeParse(entry);
 	return parsed.success ? parsed.data : void 0;
 }
-//#endregion
-//#region src/shared/events/webhook.ts
+// src/shared/events/webhook.ts
 /**
 * Standard Webhooks signing and verification for MCP Events webhook delivery (SEP-3415).
 *
@@ -12746,8 +12809,7 @@ function verifyWebhook({ secret, headers, body, toleranceSec = DEFAULT_TOLERANCE
 		reason: "invalid_signature"
 	};
 }
-//#endregion
-//#region src/shared/events/webhook-url.ts
+// src/shared/events/webhook-url.ts
 /**
 * SSRF policy for MCP Events webhook callback URLs (SEP-3415 "Webhook security").
 *
@@ -12917,8 +12979,7 @@ async function resolveAndValidate(url, opts = {}) {
 		family: first.family
 	};
 }
-//#endregion
-//#region src/shared/json-schema-dialect.ts
+// src/shared/json-schema-dialect.ts
 const JSON_SCHEMA_2020_12 = "https://json-schema.org/draft/2020-12/schema";
 const JSON_SCHEMA_2019_09 = /^https?:\/\/json-schema\.org\/draft\/2019-09\/schema#?$/;
 /** Keywords whose value is a subschema (`items` may also be an array of subschemas). */
@@ -12952,6 +13013,89 @@ const SCHEMA_MAP_KEYWORDS$1 = /* @__PURE__ */ new Set([
 const MAX_JSON_SCHEMA_NODES = 1e4;
 var Unconvertible = class extends Error {};
 /**
+* Bounds the work a validator or type generator can be asked to do for an untrusted schema.
+* Only schema-bearing keywords are walked, so deeply nested annotation data such as `default`
+* or `examples` does not count. The counted nodes are returned so callers can also budget
+* across a whole catalogue rather than one schema at a time.
+*
+* The keyword lists are intentionally wider than the conversion sets above: this walk has to
+* reach every position that can carry validation rules, including `dependencies`,
+* `prefixItems`, and `contentSchema`.
+*/
+function jsonSchemaComplexity(schema) {
+	const seen = /* @__PURE__ */ new Set();
+	let nodes = 0;
+	const stack = [{
+		value: schema,
+		depth: 0
+	}];
+	const schemaMapKeywords = [
+		"$defs",
+		"definitions",
+		"properties",
+		"patternProperties",
+		"dependentSchemas",
+		"dependencies"
+	];
+	const schemaArrayKeywords = [
+		"prefixItems",
+		"allOf",
+		"anyOf",
+		"oneOf",
+		"items"
+	];
+	const schemaKeywords = [
+		"additionalProperties",
+		"unevaluatedProperties",
+		"additionalItems",
+		"unevaluatedItems",
+		"items",
+		"contains",
+		"propertyNames",
+		"not",
+		"if",
+		"then",
+		"else",
+		"contentSchema"
+	];
+	while (stack.length > 0) {
+		const { value, depth } = stack.pop();
+		if (value === null || typeof value !== "object" || Array.isArray(value) || seen.has(value)) continue;
+		seen.add(value);
+		nodes += 1;
+		if (depth > 128) return {
+			error: `JSON Schema exceeds the maximum depth of 128`,
+			limit: "depth",
+			nodes
+		};
+		if (nodes > 1e4) return {
+			error: `JSON Schema exceeds the maximum node count of ${MAX_JSON_SCHEMA_NODES}`,
+			limit: "nodes",
+			nodes
+		};
+		const record = value;
+		for (const keyword of schemaMapKeywords) {
+			const schemas = record[keyword];
+			if (schemas && typeof schemas === "object" && !Array.isArray(schemas)) for (const child of Object.values(schemas)) stack.push({
+				value: child,
+				depth: depth + 1
+			});
+		}
+		for (const keyword of schemaArrayKeywords) {
+			const schemas = record[keyword];
+			if (Array.isArray(schemas)) for (const child of schemas) stack.push({
+				value: child,
+				depth: depth + 1
+			});
+		}
+		for (const keyword of schemaKeywords) if (record[keyword] !== void 0) stack.push({
+			value: record[keyword],
+			depth: depth + 1
+		});
+	}
+	return { nodes };
+}
+/**
 * Converts a 2019-09 schema (e.g. from zod v3) into 2020-12 form. Tuples are the
 * only structural difference handled: array-form `items` becomes `prefixItems`,
 * and `additionalItems` becomes `items`.
@@ -13001,8 +13145,7 @@ function rewrite(schema, depth, budget, isRoot = false) {
 	delete out.additionalItems;
 	return out;
 }
-//#endregion
-//#region src/shared/mastra-tool-meta.ts
+// src/shared/mastra-tool-meta.ts
 const MASTRA_META_KEY$1 = "mastra";
 const STRICT_META_KEY = "strict";
 function withMastraToolStrictMeta(meta, strict) {
@@ -13022,8 +13165,7 @@ function getMastraToolStrictMeta(meta) {
 	const strict = mastraMeta[STRICT_META_KEY];
 	return typeof strict === "boolean" ? strict : void 0;
 }
-//#endregion
-//#region src/shared/oauth-types.ts
+// src/shared/oauth-types.ts
 /**
 * Escapes backslashes and double quotes in a string for use in HTTP header quoted-string values.
 */
@@ -13082,8 +13224,7 @@ function extractBearerToken(authHeader) {
 	if (authHeader.slice(0, 7).toLowerCase() !== prefix) return void 0;
 	return authHeader.slice(7).trim() || void 0;
 }
-//#endregion
-//#region src/shared/trace-context.ts
+// src/shared/trace-context.ts
 /** `_meta` keys defined by the MCP specification for W3C trace propagation. */
 const TRACEPARENT_META_KEY = "traceparent";
 const TRACESTATE_META_KEY = "tracestate";
@@ -13227,8 +13368,7 @@ function takeServerTraceContext(result) {
 		} } : {}
 	};
 }
-//#endregion
-//#region src/client/events/errors.ts
+// src/client/events/errors.ts
 function eventsError(id, text, details = {}, cause) {
 	return new MastraError({
 		id,
@@ -13260,8 +13400,7 @@ function toTransientError(error, details) {
 	if (error instanceof MastraError) return error;
 	return eventsError("MCP_EVENTS_DELIVERY_INTERRUPTED", `Event delivery interrupted: ${error instanceof Error ? error.message : String(error)}`, details, error);
 }
-//#endregion
-//#region src/client/events/mode.ts
+// src/client/events/mode.ts
 /**
 * Modes this client can drive, most preferred first. Webhook comes first, as the SEP recommends,
 * but only when the caller configured a receiver.
@@ -13322,8 +13461,7 @@ const pollDriver = {
 		}
 	}
 };
-//#endregion
-//#region src/client/events/push-driver.ts
+// src/client/events/push-driver.ts
 /**
 * Delivers a subscription over one `events/stream` request. The session ends when the stream
 * closes, fails, goes silent for `heartbeatTimeoutMs`, or the server terminates it.
@@ -13404,8 +13542,7 @@ const pushDriver = {
 		}
 	}
 };
-//#endregion
-//#region src/client/events/webhook-driver.ts
+// src/client/events/webhook-driver.ts
 const DAY_MS = 864e5;
 const MAX_MARGIN_MS = 6e4;
 const MIN_REFRESH_DELAY_MS = 1e3;
@@ -13601,8 +13738,7 @@ var WebhookShare = class {
 	}
 };
 const sharesByPort = /* @__PURE__ */ new WeakMap();
-//#endregion
-//#region src/client/actions/events.ts
+// src/client/actions/events.ts
 const DRIVERS = {
 	webhook: {
 		mode: "webhook",
@@ -13779,8 +13915,7 @@ var EventClientActions = class {
 		return events;
 	}
 };
-//#endregion
-//#region src/client/actions/progress.ts
+// src/client/actions/progress.ts
 /**
 * Client-side progress actions for handling progress notifications from MCP servers.
 */
@@ -13799,8 +13934,7 @@ var ProgressClientActions = class {
 		this.client.setProgressNotificationHandler(handler);
 	}
 };
-//#endregion
-//#region src/client/actions/prompt.ts
+// src/client/actions/prompt.ts
 /**
 * Client-side prompt actions for interacting with MCP server prompts.
 *
@@ -13905,8 +14039,7 @@ var PromptClientActions = class {
 		await this.client.setPromptListChangedNotificationHandler(handler);
 	}
 };
-//#endregion
-//#region src/client/actions/resource.ts
+// src/client/actions/resource.ts
 /**
 * Client-side resource actions for interacting with MCP server resources.
 *
@@ -14073,8 +14206,7 @@ var ResourceClientActions = class {
 		await this.client.setResourceListChangedNotificationHandler(handler);
 	}
 };
-//#endregion
-//#region src/client/error-utils.ts
+// src/client/error-utils.ts
 /**
 * Whether a failed MCP call is worth one transport reconnect and retry.
 *
@@ -14155,8 +14287,7 @@ function getMCPDiscoveryErrorDetails(error) {
 		...code !== void 0 ? { code } : {}
 	};
 }
-//#endregion
-//#region src/client/events/stream-router.ts
+// src/client/events/stream-router.ts
 /**
 * Routes push-stream notifications for one MCP server to the subscription that owns them.
 *
@@ -14279,8 +14410,7 @@ var EventStreamRouter = class {
 		});
 	}
 };
-//#endregion
-//#region src/client/events/subscription.ts
+// src/client/events/subscription.ts
 const DEFAULT_DEDUP_WINDOW = 1e3;
 const DEFAULT_MAX_BUFFERED_EVENTS = 1e3;
 const DEFAULT_RETRY = {
@@ -14653,8 +14783,7 @@ var EventSubscription = class EventSubscription {
 		this.end();
 	}
 };
-//#endregion
-//#region src/client/input-schema-meta-schema.ts
+// src/client/input-schema-meta-schema.ts
 /**
 * Structural JSON Schema meta-schema, used to check that a server-supplied tool input schema is
 * shaped like a JSON Schema before it is handed to a model provider.
@@ -14973,8 +15102,7 @@ function getInputSchemaError(schema) {
 	}
 	return result.valid ? void 0 : result.errorMessage.split("; ").at(-1);
 }
-//#endregion
-//#region src/client/url-policy.ts
+// src/client/url-policy.ts
 /**
 * Redirect status codes the manual redirect loop follows. Other 3xx statuses
 * (e.g. 304) are not redirects and are returned to the caller as-is.
@@ -15139,78 +15267,8 @@ async function fetchFollowingAllowedRedirects(fetchImpl, url, init, allowedHosts
 		currentUrl = nextUrl;
 	}
 }
-//#endregion
-//#region src/client/client.ts
+// src/client/client.ts
 const DEFAULT_SERVER_CONNECT_TIMEOUT_MSEC = 3e3;
-/**
-* Bounds the work a validator can be asked to do for an untrusted tool catalogue.
-* Only schema-bearing keywords are walked, so deeply nested annotation data such as
-* `default` or `examples` does not count.
-*/
-function getJsonSchemaComplexityError(schema) {
-	const seen = /* @__PURE__ */ new Set();
-	let nodes = 0;
-	const stack = [{
-		value: schema,
-		depth: 0
-	}];
-	const schemaMapKeywords = [
-		"$defs",
-		"definitions",
-		"properties",
-		"patternProperties",
-		"dependentSchemas",
-		"dependencies"
-	];
-	const schemaArrayKeywords = [
-		"prefixItems",
-		"allOf",
-		"anyOf",
-		"oneOf",
-		"items"
-	];
-	const schemaKeywords = [
-		"additionalProperties",
-		"unevaluatedProperties",
-		"additionalItems",
-		"unevaluatedItems",
-		"items",
-		"contains",
-		"propertyNames",
-		"not",
-		"if",
-		"then",
-		"else",
-		"contentSchema"
-	];
-	while (stack.length > 0) {
-		const { value, depth } = stack.pop();
-		if (value === null || typeof value !== "object" || Array.isArray(value) || seen.has(value)) continue;
-		seen.add(value);
-		nodes += 1;
-		if (depth > 128) return `JSON Schema exceeds the maximum depth of 128`;
-		if (nodes > 1e4) return `JSON Schema exceeds the maximum node count of ${MAX_JSON_SCHEMA_NODES}`;
-		const record = value;
-		for (const keyword of schemaMapKeywords) {
-			const schemas = record[keyword];
-			if (schemas && typeof schemas === "object" && !Array.isArray(schemas)) for (const child of Object.values(schemas)) stack.push({
-				value: child,
-				depth: depth + 1
-			});
-		}
-		for (const keyword of schemaArrayKeywords) {
-			const schemas = record[keyword];
-			if (Array.isArray(schemas)) for (const child of schemas) stack.push({
-				value: child,
-				depth: depth + 1
-			});
-		}
-		for (const keyword of schemaKeywords) if (record[keyword] !== void 0) stack.push({
-			value: record[keyword],
-			depth: depth + 1
-		});
-	}
-}
 const SUPPORTED_DIALECTS = /* @__PURE__ */ new Set([
 	JSON_SCHEMA_2020_12,
 	`${JSON_SCHEMA_2020_12}#`,
@@ -15416,6 +15474,7 @@ var InternalMastraMCPClient = class extends MastraBase {
 	name;
 	client;
 	timeout;
+	processHooks;
 	logHandler;
 	serverLogLevel;
 	enableProgressTracking;
@@ -15452,12 +15511,13 @@ var InternalMastraMCPClient = class extends MastraBase {
 	/**
 	* @internal
 	*/
-	constructor({ name, version = "1.0.0", clientInfo, server, timeout = DEFAULT_REQUEST_TIMEOUT_MSEC, webhook }) {
+	constructor({ name, version = "1.0.0", clientInfo, server, timeout = DEFAULT_REQUEST_TIMEOUT_MSEC, registerProcessHooks = true, webhook }) {
 		super({ name: "MastraMCPClient" });
 		this.webhook = webhook;
 		loadInputSchemaMetaValidator();
 		this.name = name;
 		this.timeout = timeout;
+		this.processHooks = registerProcessHooks;
 		this.logHandler = server.logger;
 		this.serverLogLevel = server.enableServerLogs ?? true ? server.serverLogLevel ?? DEFAULT_SERVER_LOG_LEVEL : void 0;
 		this.serverConfig = server;
@@ -15800,7 +15860,7 @@ var InternalMastraMCPClient = class extends MastraBase {
 				reject(e);
 			}
 		});
-		this.registerProcessHooks();
+		if (this.processHooks) this.registerProcessHooks();
 		return this.isConnected;
 	}
 	/**
@@ -16343,7 +16403,7 @@ var InternalMastraMCPClient = class extends MastraBase {
 	buildToolFromListEntry(tool, serverMeta) {
 		const rawInputSchema = tool.inputSchema;
 		const inputSchema = rawInputSchema && typeof rawInputSchema === "object" && "jsonSchema" in rawInputSchema ? rawInputSchema.jsonSchema : rawInputSchema;
-		const inputSchemaError = getJsonSchemaComplexityError(inputSchema) ?? getInputSchemaError(inputSchema);
+		const inputSchemaError = jsonSchemaComplexity(inputSchema).error ?? getInputSchemaError(inputSchema);
 		if (inputSchemaError) {
 			const details = {
 				serverName: this.name,
@@ -16385,7 +16445,7 @@ var InternalMastraMCPClient = class extends MastraBase {
 				...annotations ? { annotations } : {}
 			} } : {};
 			const outputSchema = tool.outputSchema ? withDefaultDialect("jsonSchema" in tool.outputSchema ? tool.outputSchema.jsonSchema : tool.outputSchema) : void 0;
-			const outputSchemaComplexityError = outputSchema ? getJsonSchemaComplexityError(outputSchema) : void 0;
+			const outputSchemaComplexityError = outputSchema ? jsonSchemaComplexity(outputSchema).error : void 0;
 			let outputValidationSchema;
 			const getOutputValidationSchema = async () => {
 				if (!outputSchema) return void 0;
@@ -16532,8 +16592,7 @@ var InternalMastraMCPClient = class extends MastraBase {
 		};
 	}
 };
-//#endregion
-//#region src/client/events/webhook-receiver.ts
+// src/client/events/webhook-receiver.ts
 function respond(status, body) {
 	return body ? new Response(JSON.stringify(body), {
 		status,
@@ -16641,8 +16700,7 @@ async function readBody(request, limit) {
 	}
 	return body;
 }
-//#endregion
-//#region src/client/oauth-callback-server.ts
+// src/client/oauth-callback-server.ts
 /**
 * Loopback OAuth Callback Server for MCP Client
 *
@@ -16854,8 +16912,7 @@ async function createOAuthCallbackServer(options) {
 		}
 	};
 }
-//#endregion
-//#region src/client/oauth-provider.ts
+// src/client/oauth-provider.ts
 /**
 * OAuth Client Provider Implementation for MCP Client
 *
@@ -17204,8 +17261,7 @@ function createSimpleTokenProvider(accessToken, options) {
 		storage
 	});
 }
-//#endregion
-//#region src/client/server-proxy.ts
+// src/client/server-proxy.ts
 /**
 * Wraps a single MCPClient server connection as an `MCPServerBase` so external
 * (non-Mastra) MCP servers connected through MCPClient can be registered in Mastra's
@@ -17324,9 +17380,12 @@ var MCPClientServerProxy = class extends MCPServerBase {
 		};
 	}
 };
-//#endregion
-//#region src/client/configuration.ts
+// src/client/configuration.ts
 const mcpClientInstances = /* @__PURE__ */ new Map();
+/** Reads the shared cache without promising the snapshot shape it was created with. */
+function cachedClient(id) {
+	return mcpClientInstances.get(id);
+}
 const TOOL_DISCOVERY_MAX_ATTEMPTS = 2;
 const LOOPBACK_IPV4 = /^127\.(?:\d{1,3})\.(?:\d{1,3})\.(?:\d{1,3})$/;
 function isLoopbackHostname(hostname) {
@@ -17359,10 +17418,12 @@ function isLoopbackHostname(hostname) {
 * if packaged docs are unavailable.
 */
 var MCPClient = class extends MastraBase {
+	typegen;
 	serverConfigs = {};
 	id;
 	defaultTimeout;
 	defaultClientInfo;
+	registerProcessHooks;
 	webhook;
 	mcpClientsById = /* @__PURE__ */ new Map();
 	disconnectPromise = null;
@@ -17407,6 +17468,7 @@ var MCPClient = class extends MastraBase {
 		super({ name: "MCPClient" });
 		this.defaultTimeout = args.timeout ?? DEFAULT_REQUEST_TIMEOUT_MSEC;
 		this.defaultClientInfo = args.clientInfo && { ...args.clientInfo };
+		this.registerProcessHooks = args.registerProcessHooks ?? true;
 		this.serverConfigs = args.servers;
 		this.webhook = args.webhook && {
 			options: { ...args.webhook },
@@ -17415,16 +17477,13 @@ var MCPClient = class extends MastraBase {
 		this.id = args.id ?? this.makeId();
 		if (args.id) {
 			this.id = args.id;
-			const cached = mcpClientInstances.get(this.id);
-			if (cached && (!equal(cached.serverConfigs, args.servers) || !equal(cached.defaultClientInfo, args.clientInfo))) {
-				const existingInstance = mcpClientInstances.get(this.id);
-				if (existingInstance) {
-					existingInstance.disconnect();
-					mcpClientInstances.delete(this.id);
-				}
+			const cached = cachedClient(this.id);
+			if (cached && (!equal(cached.serverConfigs, args.servers) || !equal(cached.defaultClientInfo, args.clientInfo) || cached.registerProcessHooks !== this.registerProcessHooks || cached.typegen?.outFile !== args.typegen?.outFile)) {
+				cached.disconnect();
+				mcpClientInstances.delete(this.id);
 			}
 		} else this.id = this.makeId();
-		const existingInstance = mcpClientInstances.get(this.id);
+		const existingInstance = cachedClient(this.id);
 		if (existingInstance) {
 			if (!args.id) throw new Error(`MCPClient was initialized multiple times with the same configuration options.
 
@@ -17437,6 +17496,11 @@ To fix this you have three different options:
 `);
 			return existingInstance;
 		}
+		const { typegen } = args;
+		if (typegen !== void 0) {
+			if (!typegen || typeof typegen.outFile !== "string" || !typegen.outFile.trim() || typegen.outFile.includes("\0")) throw new Error("typegen.outFile must be a nonempty file path");
+			this.typegen = Object.freeze({ outFile: typegen.outFile });
+		}
 		mcpClientInstances.set(this.id, this);
 		this.addToInstanceCache();
 		return this;
@@ -17900,9 +17964,10 @@ onListChanged: async (serverName, handler) => {
 		if (!mcpClientInstances.has(this.id)) mcpClientInstances.set(this.id, this);
 	}
 	makeId() {
-		const text = JSON.stringify(this.defaultClientInfo === void 0 ? this.serverConfigs : {
+		const text = JSON.stringify(this.defaultClientInfo === void 0 && this.registerProcessHooks ? this.serverConfigs : {
 			servers: this.serverConfigs,
-			clientInfo: this.defaultClientInfo
+			...this.defaultClientInfo === void 0 ? {} : { clientInfo: this.defaultClientInfo },
+			...this.registerProcessHooks ? {} : { registerProcessHooks: false }
 		}).normalize("NFKC");
 		return createHash("sha256").update("MCPClient").update(text).digest("hex");
 	}
@@ -18143,24 +18208,6 @@ onListChanged: async (serverName, handler) => {
 	async listTools() {
 		return (await this.listToolsWithErrors()).tools;
 	}
-	/**
-	* Retrieves all tools from all configured servers with namespaced names,
-	* along with any per-server errors.
-	*
-	* Like listTools(), but also returns errors for servers that failed to connect
-	* or list tools. This allows callers to report specific failure reasons per server.
-	*
-	* @returns Object with successful `tools`, legacy string `errors`, and structured `errorDetails`.
-	* Transient connection failures are retried once after reconnecting the affected server.
-	*
-	* @example
-	* ```typescript
-	* const { tools, errors, errorDetails } = await mcp.listToolsWithErrors();
-	* for (const [name, err] of Object.entries(errors)) {
-	*   console.error(`Server ${name} failed: ${err}`, errorDetails[name]);
-	* }
-	* ```
-	*/
 	async listToolsWithErrors(options) {
 		this.addToInstanceCache();
 		const connectedTools = {};
@@ -18216,23 +18263,6 @@ onListChanged: async (serverName, handler) => {
 	async listToolsets() {
 		return (await this.listToolsetsWithErrors()).toolsets;
 	}
-	/**
-	* Returns toolsets organized by server name, along with any per-server errors.
-	*
-	* Like listToolsets(), but also returns errors for servers that failed to connect
-	* or list tools. This allows callers to report specific failure reasons per server.
-	*
-	* @returns Object with successful `toolsets`, legacy string `errors`, and structured `errorDetails`.
-	* Transient connection failures are retried once after reconnecting the affected server.
-	*
-	* @example
-	* ```typescript
-	* const { toolsets, errors, errorDetails } = await mcp.listToolsetsWithErrors();
-	* for (const [name, err] of Object.entries(errors)) {
-	*   console.error(`Server ${name} failed: ${err}`, errorDetails[name]);
-	* }
-	* ```
-	*/
 	async listToolsetsWithErrors(options) {
 		this.addToInstanceCache();
 		const connectedToolsets = {};
@@ -18563,6 +18593,7 @@ onListChanged: async (serverName, handler) => {
 			name,
 			server: config,
 			timeout: config.timeout ?? this.defaultTimeout,
+			registerProcessHooks: this.registerProcessHooks,
 			clientInfo: {
 				name: config.clientInfo?.name ?? this.defaultClientInfo?.name,
 				version: config.clientInfo?.version ?? this.defaultClientInfo?.version
@@ -18619,8 +18650,7 @@ onListChanged: async (serverName, handler) => {
 		return {};
 	}
 };
-//#endregion
-//#region src/server/actions.ts
+// src/server/actions.ts
 /** Runtime tool catalogue mutations. Every change is published to listening clients. */
 var ServerToolActions = class {
 	deps;
@@ -18664,8 +18694,7 @@ var ServerPromptActions = class {
 		this.deps.getNotifier()?.promptsChanged();
 	}
 };
-//#endregion
-//#region src/server/events/actions.ts
+// src/server/events/actions.ts
 /**
 * `server.events`: publishes occurrences of the event types configured in `MCPServer`'s `events`.
 *
@@ -18704,8 +18733,7 @@ var ServerEventActions = class {
 		return this.describe();
 	}
 };
-//#endregion
-//#region src/server/request.ts
+// src/server/request.ts
 const unavailable = (feature, replacement) => () => Promise.reject(/* @__PURE__ */ new Error(`${feature} is not available on a 2026-07-28 server; ${replacement}`));
 /**
 * The `context.mcp` a 2026-07-28 request hands to tools: the 1.x shape, with the
@@ -18818,8 +18846,7 @@ function readContinuation(ctx, requestContext, expected) {
 		resumeData: answer.action === "accept" ? answer.content ?? {} : void 0
 	};
 }
-//#endregion
-//#region src/server/events/ring-buffer.ts
+// src/server/events/ring-buffer.ts
 /**
 * Bounded, in-memory history of one event type's emitted occurrences.
 *
@@ -18920,8 +18947,7 @@ var EventRingBuffer = class {
 		return seq <= this.seq ? seq : void 0;
 	}
 };
-//#endregion
-//#region src/server/events/registry.ts
+// src/server/events/registry.ts
 const DEFAULT_BUFFER_SIZE = 1e3;
 /**
 * Delivery modes advertised for a definition. They are fixed at construction because clients
@@ -19066,8 +19092,7 @@ function toDescriptor(event, convert) {
 	if (payloadSchema) descriptor.payloadSchema = payloadSchema;
 	return descriptor;
 }
-//#endregion
-//#region src/server/events/stream.ts
+// src/server/events/stream.ts
 /**
 * Server side of one push subscription (`events/stream`).
 *
@@ -19178,8 +19203,7 @@ var EventStream = class {
 		}, this.options.heartbeatIntervalMs);
 	}
 };
-//#endregion
-//#region src/server/events/handlers.ts
+// src/server/events/handlers.ts
 const DEFAULT_MAX_EVENTS = 100;
 const DEFAULT_LIST_PAGE_SIZE = 100;
 /**
@@ -19410,8 +19434,7 @@ function decodeListCursor(cursor) {
 	} catch {}
 	throw new ProtocolError$1(ProtocolErrorCode$1.InvalidParams, "Invalid events/list cursor");
 }
-//#endregion
-//#region src/server/events/inspector.ts
+// src/server/events/inspector.ts
 /** Prefix of the `eventId` of occurrences sent with the inspector's `emit`. */
 const TEST_EMIT_EVENT_ID_PREFIX = "mastra-test-";
 let localStreamIds = 0;
@@ -19528,8 +19551,7 @@ function protocolErrorId(code) {
 		default: return;
 	}
 }
-//#endregion
-//#region src/server/events/webhook-store.ts
+// src/server/events/webhook-store.ts
 /**
 * Default {@link WebhookSubscriptionStore}: a process-local map.
 *
@@ -19550,8 +19572,7 @@ var InMemoryWebhookSubscriptionStore = class {
 		return [...this.records.values()].filter((record) => record.name === name);
 	}
 };
-//#endregion
-//#region src/server/events/webhook-transport.ts
+// src/server/events/webhook-transport.ts
 /** Largest response body read from a callback endpoint. Enough for a verification echo. */
 const MAX_RESPONSE_BYTES = 4096;
 /** Maps a non-2xx status to its failure category. */
@@ -19626,8 +19647,7 @@ const nodeWebhookTransport = (request) => new Promise((resolve) => {
 	});
 	req.end(request.body);
 });
-//#endregion
-//#region src/server/events/webhook-dispatcher.ts
+// src/server/events/webhook-dispatcher.ts
 const MINUTE = 6e4;
 const HOUR = 60 * MINUTE;
 const MAX_TIMER_MS = 2147483647;
@@ -20184,8 +20204,7 @@ function echoes(body, challenge) {
 	const b = Buffer.from(challenge);
 	return a.length === b.length && timingSafeEqual(a, b);
 }
-//#endregion
-//#region src/server/server.ts
+// src/server/server.ts
 const EMPTY_OBJECT_SCHEMA = {
 	type: "object",
 	properties: {}
@@ -20243,6 +20262,7 @@ var MCPServer = class extends MCPServerBase {
 	eventsOptions;
 	eventsInspector;
 	webhooks;
+	legacy;
 	httpHandler;
 	nodeHandler;
 	stdioHandle;
@@ -20258,6 +20278,7 @@ var MCPServer = class extends MCPServerBase {
 		this.loadAppResources(config.appResources);
 		this.requestStateCodec = this.createRequestStateCodec(config.requestState);
 		this.eventsOptions = config.eventsOptions ?? {};
+		this.legacy = config.legacy ?? "reject";
 		const webhook = this.eventsOptions.webhook;
 		this.eventRegistry = new ServerEventRegistry(config.events, { webhook: webhook !== void 0 });
 		if (webhook && this.eventRegistry.size > 0) this.webhooks = new WebhookDispatcher({
@@ -20787,7 +20808,7 @@ var MCPServer = class extends MCPServerBase {
 						resumeSchema: execution.resumeSchema
 					});
 				}
-				const result = this.toCallToolResult(name, tool, execution.output);
+				const result = server.projectCallToolResult(this.toCallToolResult(name, tool, execution.output), this.toolInfo(name, tool).outputSchema);
 				this.logger.info(`Tool '${name}' finished in ${Date.now() - startedAt}ms.`);
 				return result;
 			} catch (error) {
@@ -21053,7 +21074,7 @@ var MCPServer = class extends MCPServerBase {
 	getNodeHandler() {
 		if (!this.nodeHandler) {
 			this.httpHandler = createMcpHandler(() => this.createServerInstance(), {
-				legacy: "reject",
+				legacy: this.legacy,
 				onerror: (error) => this.logger.error("MCP handler error", { error: error.toString() })
 			});
 			this.nodeHandler = toNodeHandler(this.httpHandler, { onerror: (error) => this.logger.error("MCP Node handler adapter error", { error: error.toString() }) });
@@ -21073,7 +21094,8 @@ var MCPServer = class extends MCPServerBase {
 	}
 	/**
 	* Handles one Streamable HTTP request at `httpPath`. Every request is
-	* self-contained; requests without a 2026-07-28 envelope are rejected.
+	* self-contained; requests without a 2026-07-28 envelope are rejected unless
+	* `legacy: 'stateless'` is configured.
 	*/
 	async startHTTP({ url, httpPath, req, res, options }) {
 		if (url.pathname !== httpPath) {
@@ -21297,12 +21319,10 @@ function normalizeUiMeta(meta) {
 		[RESOURCE_URI_META_KEY]: resourceUri
 	};
 }
-//#endregion
-//#region src/server/types.ts
+// src/server/types.ts
 /** The only protocol revision `@mastra/mcp` serves. */
 const MCP_PROTOCOL_VERSION = "2026-07-28";
-//#endregion
-//#region src/server/oauth-middleware.ts
+// src/server/oauth-middleware.ts
 /**
 * Creates an OAuth middleware function for protecting MCP server endpoints.
 *
@@ -21547,8 +21567,7 @@ function createIntrospectionValidator(introspectionEndpoint, clientCredentials)
 		}
 	};
 }
-//#endregion
-//#region src/server/events/define-event.ts
+// src/server/events/define-event.ts
 /**
 * Declares an event type for `MCPServer`'s `events` option. An identity helper: it types `match`
 * and `poll` from `inputSchema` and `payloadSchema`.
@@ -21568,8 +21587,7 @@ function createIntrospectionValidator(introspectionEndpoint, clientCredentials)
 function defineEvent(definition) {
 	return definition;
 }
-//#endregion
-//#region src/integrations/events-cursor-store.ts
+// src/integrations/events-cursor-store.ts
 /**
 * Process-local {@link MCPEventCursorStore}. Cursors survive a provider restart within the same
 * process, not a process restart.
@@ -21588,8 +21606,7 @@ var InMemoryMCPEventCursorStore = class {
 		this.#cursors.delete(key);
 	}
 };
-//#endregion
-//#region src/integrations/events-utils.ts
+// src/integrations/events-utils.ts
 function canonicalize(value) {
 	if (Array.isArray(value)) return value.map(canonicalize);
 	if (value !== null && typeof value === "object") {
@@ -21632,8 +21649,7 @@ function formatUntrustedEvent({ header, data, footer }) {
 		...footer ? [footer] : []
 	].join("\n");
 }
-//#endregion
-//#region src/integrations/events-tools.ts
+// src/integrations/events-tools.ts
 function decodeArguments(value) {
 	try {
 		const parsed = JSON.parse(value);
@@ -21741,8 +21757,7 @@ function createMCPEventsTools({ provider, client, servers }) {
 		})
 	};
 }
-//#endregion
-//#region src/integrations/events-signals.ts
+// src/integrations/events-signals.ts
 const GAP_NOTE = "Some events may have been skipped (gap); re-fetch authoritative state with tools if it matters.";
 /**
 * Delivers MCP Events (SEP-3415) occurrences into agent threads as notification signals.
@@ -21995,7 +22010,6 @@ var MCPEventsSignalProvider = class MCPEventsSignalProvider extends SignalProvid
 		else console.warn(`[${this.id}] ${info.key}:`, error);
 	}
 };
-//#endregion
 export { InMemoryMCPEventCursorStore, InMemoryOAuthStorage, InMemoryWebhookSubscriptionStore, InternalMastraMCPClient, MCPClient, MCPClientServerProxy, MCPEventsSignalProvider, MCPOAuthClientProvider, MCPServer, MCP_CALL_TOOL_CONTENT, MCP_CALL_TOOL_META, MCP_CLIENT_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION, ServerEventActions, ServerPromptActions, ServerResourceActions, ServerToolActions, UnauthorizedError, auth, buildDiscoveryUrls, createIntrospectionValidator, createOAuthCallbackServer, createOAuthMiddleware, createSimpleTokenProvider, createStaticTokenValidator, defineEvent, discoverAuthorizationServerMetadata, discoverOAuthMetadata, discoverOAuthProtectedResourceMetadata, exchangeAuthorization, extractBearerToken, extractResourceMetadataUrl, generateProtectedResourceMetadata, generateWWWAuthenticateHeader, getCallbackUrlCandidates, getMcpCallToolContent, getMcpCallToolMeta, parseErrorResponse, refreshAuthorization, selectResourceURL, startAuthorization, traceContextFromMeta, traceContextToMeta };
 
 //# sourceMappingURL=index.js.map