@mastra/mcp 2.6.0-alpha.0 → 2.6.0-alpha.2

package/dist/index.js

@@ -27,11 +27,10 @@ import { CLIENT_INFO_META_KEY, PROTOCOL_VERSION_META_KEY, ProtocolError as Proto
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
 import https from "https";
 import { SignalProvider } from "@mastra/core/signals";
-//#region src/client/types.ts
+// src/client/types.ts
 /** The current protocol revision; the one `/mcp` servers speak. */
 const MCP_CLIENT_PROTOCOL_VERSION = "2026-07-28";
-//#endregion
-//#region ../schema-compat/dist/json-schema-traverse-Jrimn_T_.js
+// ../schema-compat/dist/json-schema-traverse-D0CId4oM.js
 var __create$1 = Object.create;
 var __defProp$2 = Object.defineProperty;
 var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
@@ -126,8 +125,7 @@ var require_json_schema_traverse = /* @__PURE__ */ __commonJSMin$1(((exports, mo
 		return str.replace(/~/g, "~0").replace(/\//g, "~1");
 	}
 }));
-//#endregion
-//#region ../schema-compat/dist/esm-DA8owk0L.js
+// ../schema-compat/dist/esm-BG70JlG8.js
 const ignoreOverride$1 = Symbol("Let zodToJsonSchema decide on which parser to use");
 const defaultOptions$1 = {
 	name: void 0,
@@ -1133,8 +1131,7 @@ const zodToJsonSchema$1 = (schema, options) => {
 	return combined;
 };
 var esm_default$1 = zodToJsonSchema$1;
-//#endregion
-//#region ../schema-compat/dist/zod-to-json.js
+// ../schema-compat/dist/zod-to-json.js
 const PATCHED = Symbol("__mastra_patched__");
 /**
 * Recursively patch Zod v4 record schemas that are missing valueType.
@@ -1185,8 +1182,7 @@ function patchRecordSchemas(schema) {
 	if (def.innerType) patchRecordSchemas(def.innerType);
 	return schema;
 }
-//#endregion
-//#region ../schema-compat/dist/standard-schema/adapters/ai-sdk.js
+// ../schema-compat/dist/standard-schema/adapters/ai-sdk.js
 /**
 * Vendor name for AI SDK wrapped schemas.
 */
@@ -1334,8 +1330,7 @@ var AiSdkSchemaWrapper = class {
 function toStandardSchema$4(schema) {
 	return new AiSdkSchemaWrapper(schema);
 }
-//#endregion
-//#region ../schema-compat/dist/json-schema-DcMkkbbI.js
+// ../schema-compat/dist/json-schema-BdCwqjfN.js
 var require_code$1 = /* @__PURE__ */ __commonJSMin$1(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.regexpCode = exports.getEsmExportName = exports.getProperty = exports.safeStringify = exports.stringify = exports.strConcat = exports.addCodeArg = exports.str = exports._ = exports.nil = exports._Code = exports.Name = exports.IDENTIFIER = exports._CodeOrName = void 0;
@@ -4230,6 +4225,38 @@ var require_utils = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 		return output.join("");
 	}
 	/**
+	* Removes dot segments from the path of a relative reference (a path that does
+	* not start with "/") without changing what it resolves to against any base.
+	* Unlike `removeDotSegments`, leading ".." segments that cannot be collapsed
+	* are kept, the result never becomes root-relative, and a result that would be
+	* empty or start with an empty segment is prefixed with "." (an empty path
+	* means "same document" and a leading "//" would introduce an authority).
+	*
+	* @param {string} path
+	* @returns {string}
+	*/
+	function removeDotSegmentsRelative(path) {
+		if (path === "" || path[0] === "/") return removeDotSegments(path);
+		const segments = path.split("/");
+		const last = segments.length - 1;
+		/** @type {string[]} */
+		const output = [];
+		let trailingDirectory = false;
+		for (let i = 0; i <= last; i++) {
+			const segment = segments[i];
+			if (segment === "." || segment === "..") {
+				if (segment === "..") {
+					if (output.length !== 0 && output[output.length - 1] !== "..") output.pop();
+					else output.push("..");
+				}
+				trailingDirectory = i === last;
+			} else output.push(segment);
+		}
+		if (trailingDirectory && output[output.length - 1] !== "..") output.push("");
+		if (output.length === 0 || output[0] === "" || output[0].includes(":")) output.unshift(".");
+		return output.join("/");
+	}
+	/**
 	* Re-escape RFC 3986 gen-delims that must not appear literally in the host.
 	* After the URI regex parses, these characters cannot be literal in the host
 	* field, so any that appear after decoding came from percent-encoding and
@@ -4533,6 +4560,7 @@ var require_utils = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 		encodeFragment,
 		escapePreservingEscapes,
 		removeDotSegments,
+		removeDotSegmentsRelative,
 		isIPv4,
 		isUUID,
 		normalizeIPv6,
@@ -4722,18 +4750,24 @@ var require_schemes = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 	};
 }));
 var require_fast_uri = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
-	const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+	const { normalizeIPv6, removeDotSegments, removeDotSegmentsRelative, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
 	const { SCHEMES, getSchemeHandler } = require_schemes();
 	const VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
 	const MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
+	const MALFORMED_HOST_ERROR = "URI host is malformed.";
+	const FORBIDDEN_DOMAIN_HOST_CHARACTER = /[\0-\x20"#/:<>?@[\\\]^`{|}\x7F]/u;
 	/**
+	* RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so the
+	* scheme is validated as-is and never decoded. Decoding would let inert input
+	* such as `%6Aavascript:` become a live `javascript:` scheme.
+	*
 	* @param {string} scheme
 	* @returns {string}
 	*/
-	function decodeValidScheme(scheme) {
-		const decodedScheme = unescape(String(scheme));
-		if (!VALID_SCHEME.test(decodedScheme)) throw new TypeError(MALFORMED_SCHEME_ERROR);
-		return decodedScheme;
+	function validateScheme(scheme) {
+		const stringScheme = String(scheme);
+		if (!VALID_SCHEME.test(stringScheme)) throw new TypeError(MALFORMED_SCHEME_ERROR);
+		return stringScheme;
 	}
 	/**
 	* @template {import('./types/index').URIComponent|string} T
@@ -4761,6 +4795,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 		const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
 		const resolvedHost = resolved.host;
 		const resolvedHostIsIP = resolvedHost !== void 0 && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+		if (hasForbiddenDomainHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP)) throw new Error(MALFORMED_HOST_ERROR);
 		canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
 		const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !/\P{ASCII}/u.test(resolvedHost);
 		if (resolved.error && !encodedASCIIHost) throw new Error(resolved.error);
@@ -4804,10 +4839,11 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 				} else {
 					if (relative.path[0] === "/") target.path = removeDotSegments(relative.path);
 					else {
-						if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative.path;
+						const baseHasAuthority = base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0;
+						if (baseHasAuthority && !base.path) target.path = "/" + relative.path;
 						else if (!base.path) target.path = relative.path;
 						else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative.path;
-						target.path = removeDotSegments(target.path);
+						target.path = base.scheme === void 0 && !baseHasAuthority && target.path[0] !== "/" ? removeDotSegmentsRelative(target.path) : removeDotSegments(target.path);
 					}
 					target.query = relative.query;
 				}
@@ -4855,17 +4891,18 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 		};
 		const options = Object.assign({}, opts);
 		const uriTokens = [];
-		if (component.scheme) component.scheme = decodeValidScheme(component.scheme);
+		if (component.scheme) component.scheme = validateScheme(component.scheme);
 		const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
 		if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
 		const hasAuthority = component.userinfo !== void 0 || component.host !== void 0 || component.port !== void 0;
-		const pathNoScheme = !options.skipEscape && component.scheme === void 0 && !hasAuthority;
+		const schemelessReference = (component.scheme === void 0 || options.reference === "suffix") && !hasAuthority;
+		const pathNoScheme = !options.skipEscape && schemelessReference;
 		if (component.path !== void 0) {
 			if (!options.skipEscape) component.path = serializePathEncoding(component.path, pathNoScheme);
 			else component.path = normalizePercentEncoding(component.path);
 		}
 		if (options.reference !== "suffix" && component.scheme) {
-			component.scheme = decodeValidScheme(component.scheme);
+			component.scheme = validateScheme(component.scheme);
 			uriTokens.push(component.scheme, ":");
 		}
 		const authority = recomposeAuthority(component);
@@ -4876,8 +4913,8 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 		}
 		if (component.path !== void 0) {
 			let s = component.path;
-			if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) s = removeDotSegments(s);
-			if (pathNoScheme) s = serializePathEncoding(s, true);
+			if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) s = schemelessReference && s[0] !== "/" ? removeDotSegmentsRelative(s) : removeDotSegments(s);
+			if (schemelessReference) s = serializePathEncoding(s, true);
 			if (authority === void 0 && s[0] === "/" && s[1] === "/") s = "/%2F" + s.slice(2);
 			uriTokens.push(s);
 		}
@@ -4941,15 +4978,50 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 	* @returns {boolean} whether host conversion failed
 	*/
 	function canonicalizeHost(parsed, options, schemeHandler, isIP) {
-		if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) try {
-			parsed.host = new URL("http://" + parsed.host).hostname;
-		} catch (e) {
-			parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
+		if (hasForbiddenDomainHost(parsed, options, schemeHandler, isIP)) {
+			parsed.error = parsed.error || MALFORMED_HOST_ERROR;
 			return true;
 		}
+		if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+			let url;
+			try {
+				url = new URL("http://" + parsed.host);
+			} catch (e) {
+				parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
+				return true;
+			}
+			if (!isHostOnlyURL(url)) {
+				parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+				return true;
+			}
+			parsed.host = url.hostname;
+		}
 		return false;
 	}
 	/**
+	* Whether a domain host contains an ASCII character that RFC 3986 does not
+	* allow in a reg-name (unreserved, sub-delims, or pct-encoded). Such a host is
+	* rejected instead of being handed to the WHATWG URL parser, which would treat
+	* "@" as a userinfo delimiter (silently dropping the data before it) and strip
+	* TAB, LF, and CR. Non-ASCII characters remain allowed for IDNs.
+	*
+	* @param {import('./types/index').URIComponent} parsed
+	* @param {import('./types/index').Options} options
+	* @param {{ domainHost?: boolean }|undefined} schemeHandler
+	* @param {boolean} isIP
+	* @returns {boolean}
+	*/
+	function hasForbiddenDomainHost(parsed, options, schemeHandler, isIP) {
+		return Boolean(parsed.host && isIP === false && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && FORBIDDEN_DOMAIN_HOST_CHARACTER.test(parsed.host));
+	}
+	/**
+	* @param {URL} url
+	* @returns {boolean}
+	*/
+	function isHostOnlyURL(url) {
+		return url.username === "" && url.password === "" && url.port === "" && url.pathname === "/" && url.search === "" && url.hash === "" && url.hostname !== "";
+	}
+	/**
 	* @param {string} uri
 	* @param {import('./types/index').Options} [opts]
 	* @returns {{ parsed: import('./types/index').URIComponent, malformedAuthorityOrPort: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
@@ -5006,8 +5078,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 			parsed.query = matches[7];
 			parsed.fragment = matches[8];
 			if (parsed.scheme !== void 0) {
-				const decodedScheme = unescape(parsed.scheme);
-				if (VALID_SCHEME.test(decodedScheme)) parsed.scheme = decodedScheme.toLowerCase();
+				if (VALID_SCHEME.test(parsed.scheme)) parsed.scheme = parsed.scheme.toLowerCase();
 				else {
 					parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
 					malformedScheme = true;
@@ -5030,7 +5101,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 					malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
 					parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
 					if (malformedIPLiteral) {
-						parsed.error = parsed.error || "URI host is malformed.";
+						parsed.error = parsed.error || MALFORMED_HOST_ERROR;
 						malformedAuthorityOrPort = true;
 					}
 				} else isIP = true;
@@ -5045,7 +5116,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 			if (uri.indexOf("%") !== -1 && parsed.host !== void 0 && !malformedIPLiteral) {
 				let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
 				if (!isIP) host = normalizePercentEncoding(host.toLowerCase());
-				parsed.host = reescapeHostDelimiters(host, isIP);
+				parsed.host = isIP || options.scheme !== "null" ? reescapeHostDelimiters(host, isIP) : host;
 			}
 			if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
 				if (parsed.path) parsed.path = normalizePathEncoding(parsed.path);
@@ -8291,8 +8362,7 @@ var JsonSchemaWrapper = class {
 function toStandardSchema$3(schema, options) {
 	return new JsonSchemaWrapper(schema, options);
 }
-//#endregion
-//#region ../schema-compat/dist/standard-schema/adapters/zod-v3.js
+// ../schema-compat/dist/standard-schema/adapters/zod-v3.js
 var import_json_schema_traverse$1 = /* @__PURE__ */ __toESM$1(require_json_schema_traverse(), 1);
 /**
 * Target mapping from Standard Schema targets to zod-to-json-schema targets.
@@ -8386,8 +8456,7 @@ function toStandardSchema$2(zodSchema) {
 	});
 	return wrapper;
 }
-//#endregion
-//#region ../schema-compat/dist/schema-CzbEIyhE.js
+// ../schema-compat/dist/schema-Bf12g7KC.js
 /**
 * Supported JSON Schema targets for z.toJSONSchema().
 * Works with both real Zod v4 and Zod 3.25's v4 compat layer.
@@ -8594,8 +8663,7 @@ function isStandardJSONSchema(value) {
 function isStandardSchemaWithJSON$1(value) {
 	return isStandardSchema(value) && isStandardJSONSchema(value);
 }
-//#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/zod-from-json-schema/0.5.2/938b1a90632b5c19aade6e212477c764befeb6d6e1cdb7cfde7de2557cd03f99/node_modules/zod-from-json-schema/dist/index.mjs
+// ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/zod-from-json-schema/0.5.2/938b1a90632b5c19aade6e212477c764befeb6d6e1cdb7cfde7de2557cd03f99/node_modules/zod-from-json-schema/dist/index.mjs
 var TypeHandler = class {
 	apply(types, schema) {
 		if (!schema.type) return;
@@ -9151,8 +9219,7 @@ function convertJsonSchemaToZod(schema) {
 	for (const handler of refinementHandlers) zodSchema = handler.apply(zodSchema, schema);
 	return zodSchema;
 }
-//#endregion
-//#region ../schema-compat/dist/index.js
+// ../schema-compat/dist/index.js
 var marker$1 = "vercel.ai.error";
 var symbol$1 = Symbol.for(marker$1);
 var _a$1;
@@ -12376,8 +12443,7 @@ function trimStartOfStream() {
 	};
 }
 require_json_schema_traverse();
-//#endregion
-//#region src/shared/events/constants.ts
+// src/shared/events/constants.ts
 /**
 * Wire constants for the MCP Events extension (SEP-3415).
 *
@@ -12433,8 +12499,7 @@ const WEBHOOK_HEADERS = {
 	signature: "webhook-signature",
 	subscriptionId: "x-mcp-subscription-id"
 };
-//#endregion
-//#region src/shared/events/schemas.ts
+// src/shared/events/schemas.ts
 /**
 * Zod schemas for the MCP Events extension (SEP-3415) wire format.
 *
@@ -12640,8 +12705,7 @@ function parseWebhookBody(body) {
 		event: EventOccurrenceSchema.parse(body)
 	};
 }
-//#endregion
-//#region src/shared/events/capability.ts
+// src/shared/events/capability.ts
 /**
 * Read the negotiated events extension settings from a capabilities object.
 * Returns `undefined` when the peer did not advertise the extension (or advertised a malformed entry).
@@ -12657,8 +12721,7 @@ function getEventsCapability(capabilities) {
 	const parsed = EventsCapabilitySchema.safeParse(entry);
 	return parsed.success ? parsed.data : void 0;
 }
-//#endregion
-//#region src/shared/events/webhook.ts
+// src/shared/events/webhook.ts
 /**
 * Standard Webhooks signing and verification for MCP Events webhook delivery (SEP-3415).
 *
@@ -12746,8 +12809,7 @@ function verifyWebhook({ secret, headers, body, toleranceSec = DEFAULT_TOLERANCE
 		reason: "invalid_signature"
 	};
 }
-//#endregion
-//#region src/shared/events/webhook-url.ts
+// src/shared/events/webhook-url.ts
 /**
 * SSRF policy for MCP Events webhook callback URLs (SEP-3415 "Webhook security").
 *
@@ -12917,8 +12979,7 @@ async function resolveAndValidate(url, opts = {}) {
 		family: first.family
 	};
 }
-//#endregion
-//#region src/shared/json-schema-dialect.ts
+// src/shared/json-schema-dialect.ts
 const JSON_SCHEMA_2020_12 = "https://json-schema.org/draft/2020-12/schema";
 const JSON_SCHEMA_2019_09 = /^https?:\/\/json-schema\.org\/draft\/2019-09\/schema#?$/;
 /** Keywords whose value is a subschema (`items` may also be an array of subschemas). */
@@ -13084,8 +13145,7 @@ function rewrite(schema, depth, budget, isRoot = false) {
 	delete out.additionalItems;
 	return out;
 }
-//#endregion
-//#region src/shared/mastra-tool-meta.ts
+// src/shared/mastra-tool-meta.ts
 const MASTRA_META_KEY$1 = "mastra";
 const STRICT_META_KEY = "strict";
 function withMastraToolStrictMeta(meta, strict) {
@@ -13105,8 +13165,7 @@ function getMastraToolStrictMeta(meta) {
 	const strict = mastraMeta[STRICT_META_KEY];
 	return typeof strict === "boolean" ? strict : void 0;
 }
-//#endregion
-//#region src/shared/oauth-types.ts
+// src/shared/oauth-types.ts
 /**
 * Escapes backslashes and double quotes in a string for use in HTTP header quoted-string values.
 */
@@ -13165,8 +13224,7 @@ function extractBearerToken(authHeader) {
 	if (authHeader.slice(0, 7).toLowerCase() !== prefix) return void 0;
 	return authHeader.slice(7).trim() || void 0;
 }
-//#endregion
-//#region src/shared/trace-context.ts
+// src/shared/trace-context.ts
 /** `_meta` keys defined by the MCP specification for W3C trace propagation. */
 const TRACEPARENT_META_KEY = "traceparent";
 const TRACESTATE_META_KEY = "tracestate";
@@ -13310,8 +13368,7 @@ function takeServerTraceContext(result) {
 		} } : {}
 	};
 }
-//#endregion
-//#region src/client/events/errors.ts
+// src/client/events/errors.ts
 function eventsError(id, text, details = {}, cause) {
 	return new MastraError({
 		id,
@@ -13343,8 +13400,7 @@ function toTransientError(error, details) {
 	if (error instanceof MastraError) return error;
 	return eventsError("MCP_EVENTS_DELIVERY_INTERRUPTED", `Event delivery interrupted: ${error instanceof Error ? error.message : String(error)}`, details, error);
 }
-//#endregion
-//#region src/client/events/mode.ts
+// src/client/events/mode.ts
 /**
 * Modes this client can drive, most preferred first. Webhook comes first, as the SEP recommends,
 * but only when the caller configured a receiver.
@@ -13405,8 +13461,7 @@ const pollDriver = {
 		}
 	}
 };
-//#endregion
-//#region src/client/events/push-driver.ts
+// src/client/events/push-driver.ts
 /**
 * Delivers a subscription over one `events/stream` request. The session ends when the stream
 * closes, fails, goes silent for `heartbeatTimeoutMs`, or the server terminates it.
@@ -13487,8 +13542,7 @@ const pushDriver = {
 		}
 	}
 };
-//#endregion
-//#region src/client/events/webhook-driver.ts
+// src/client/events/webhook-driver.ts
 const DAY_MS = 864e5;
 const MAX_MARGIN_MS = 6e4;
 const MIN_REFRESH_DELAY_MS = 1e3;
@@ -13684,8 +13738,7 @@ var WebhookShare = class {
 	}
 };
 const sharesByPort = /* @__PURE__ */ new WeakMap();
-//#endregion
-//#region src/client/actions/events.ts
+// src/client/actions/events.ts
 const DRIVERS = {
 	webhook: {
 		mode: "webhook",
@@ -13862,8 +13915,7 @@ var EventClientActions = class {
 		return events;
 	}
 };
-//#endregion
-//#region src/client/actions/progress.ts
+// src/client/actions/progress.ts
 /**
 * Client-side progress actions for handling progress notifications from MCP servers.
 */
@@ -13882,8 +13934,7 @@ var ProgressClientActions = class {
 		this.client.setProgressNotificationHandler(handler);
 	}
 };
-//#endregion
-//#region src/client/actions/prompt.ts
+// src/client/actions/prompt.ts
 /**
 * Client-side prompt actions for interacting with MCP server prompts.
 *
@@ -13988,8 +14039,7 @@ var PromptClientActions = class {
 		await this.client.setPromptListChangedNotificationHandler(handler);
 	}
 };
-//#endregion
-//#region src/client/actions/resource.ts
+// src/client/actions/resource.ts
 /**
 * Client-side resource actions for interacting with MCP server resources.
 *
@@ -14156,8 +14206,7 @@ var ResourceClientActions = class {
 		await this.client.setResourceListChangedNotificationHandler(handler);
 	}
 };
-//#endregion
-//#region src/client/error-utils.ts
+// src/client/error-utils.ts
 /**
 * Whether a failed MCP call is worth one transport reconnect and retry.
 *
@@ -14238,8 +14287,7 @@ function getMCPDiscoveryErrorDetails(error) {
 		...code !== void 0 ? { code } : {}
 	};
 }
-//#endregion
-//#region src/client/events/stream-router.ts
+// src/client/events/stream-router.ts
 /**
 * Routes push-stream notifications for one MCP server to the subscription that owns them.
 *
@@ -14362,8 +14410,7 @@ var EventStreamRouter = class {
 		});
 	}
 };
-//#endregion
-//#region src/client/events/subscription.ts
+// src/client/events/subscription.ts
 const DEFAULT_DEDUP_WINDOW = 1e3;
 const DEFAULT_MAX_BUFFERED_EVENTS = 1e3;
 const DEFAULT_RETRY = {
@@ -14736,8 +14783,7 @@ var EventSubscription = class EventSubscription {
 		this.end();
 	}
 };
-//#endregion
-//#region src/client/input-schema-meta-schema.ts
+// src/client/input-schema-meta-schema.ts
 /**
 * Structural JSON Schema meta-schema, used to check that a server-supplied tool input schema is
 * shaped like a JSON Schema before it is handed to a model provider.
@@ -15056,8 +15102,7 @@ function getInputSchemaError(schema) {
 	}
 	return result.valid ? void 0 : result.errorMessage.split("; ").at(-1);
 }
-//#endregion
-//#region src/client/url-policy.ts
+// src/client/url-policy.ts
 /**
 * Redirect status codes the manual redirect loop follows. Other 3xx statuses
 * (e.g. 304) are not redirects and are returned to the caller as-is.
@@ -15222,8 +15267,7 @@ async function fetchFollowingAllowedRedirects(fetchImpl, url, init, allowedHosts
 		currentUrl = nextUrl;
 	}
 }
-//#endregion
-//#region src/client/client.ts
+// src/client/client.ts
 const DEFAULT_SERVER_CONNECT_TIMEOUT_MSEC = 3e3;
 const SUPPORTED_DIALECTS = /* @__PURE__ */ new Set([
 	JSON_SCHEMA_2020_12,
@@ -16548,8 +16592,7 @@ var InternalMastraMCPClient = class extends MastraBase {
 		};
 	}
 };
-//#endregion
-//#region src/client/events/webhook-receiver.ts
+// src/client/events/webhook-receiver.ts
 function respond(status, body) {
 	return body ? new Response(JSON.stringify(body), {
 		status,
@@ -16657,8 +16700,7 @@ async function readBody(request, limit) {
 	}
 	return body;
 }
-//#endregion
-//#region src/client/oauth-callback-server.ts
+// src/client/oauth-callback-server.ts
 /**
 * Loopback OAuth Callback Server for MCP Client
 *
@@ -16870,8 +16912,7 @@ async function createOAuthCallbackServer(options) {
 		}
 	};
 }
-//#endregion
-//#region src/client/oauth-provider.ts
+// src/client/oauth-provider.ts
 /**
 * OAuth Client Provider Implementation for MCP Client
 *
@@ -17220,8 +17261,7 @@ function createSimpleTokenProvider(accessToken, options) {
 		storage
 	});
 }
-//#endregion
-//#region src/client/server-proxy.ts
+// src/client/server-proxy.ts
 /**
 * Wraps a single MCPClient server connection as an `MCPServerBase` so external
 * (non-Mastra) MCP servers connected through MCPClient can be registered in Mastra's
@@ -17340,8 +17380,7 @@ var MCPClientServerProxy = class extends MCPServerBase {
 		};
 	}
 };
-//#endregion
-//#region src/client/configuration.ts
+// src/client/configuration.ts
 const mcpClientInstances = /* @__PURE__ */ new Map();
 /** Reads the shared cache without promising the snapshot shape it was created with. */
 function cachedClient(id) {
@@ -18611,8 +18650,7 @@ onListChanged: async (serverName, handler) => {
 		return {};
 	}
 };
-//#endregion
-//#region src/server/actions.ts
+// src/server/actions.ts
 /** Runtime tool catalogue mutations. Every change is published to listening clients. */
 var ServerToolActions = class {
 	deps;
@@ -18656,8 +18694,7 @@ var ServerPromptActions = class {
 		this.deps.getNotifier()?.promptsChanged();
 	}
 };
-//#endregion
-//#region src/server/events/actions.ts
+// src/server/events/actions.ts
 /**
 * `server.events`: publishes occurrences of the event types configured in `MCPServer`'s `events`.
 *
@@ -18696,8 +18733,7 @@ var ServerEventActions = class {
 		return this.describe();
 	}
 };
-//#endregion
-//#region src/server/request.ts
+// src/server/request.ts
 const unavailable = (feature, replacement) => () => Promise.reject(/* @__PURE__ */ new Error(`${feature} is not available on a 2026-07-28 server; ${replacement}`));
 /**
 * The `context.mcp` a 2026-07-28 request hands to tools: the 1.x shape, with the
@@ -18810,8 +18846,7 @@ function readContinuation(ctx, requestContext, expected) {
 		resumeData: answer.action === "accept" ? answer.content ?? {} : void 0
 	};
 }
-//#endregion
-//#region src/server/events/ring-buffer.ts
+// src/server/events/ring-buffer.ts
 /**
 * Bounded, in-memory history of one event type's emitted occurrences.
 *
@@ -18912,8 +18947,7 @@ var EventRingBuffer = class {
 		return seq <= this.seq ? seq : void 0;
 	}
 };
-//#endregion
-//#region src/server/events/registry.ts
+// src/server/events/registry.ts
 const DEFAULT_BUFFER_SIZE = 1e3;
 /**
 * Delivery modes advertised for a definition. They are fixed at construction because clients
@@ -19058,8 +19092,7 @@ function toDescriptor(event, convert) {
 	if (payloadSchema) descriptor.payloadSchema = payloadSchema;
 	return descriptor;
 }
-//#endregion
-//#region src/server/events/stream.ts
+// src/server/events/stream.ts
 /**
 * Server side of one push subscription (`events/stream`).
 *
@@ -19170,8 +19203,7 @@ var EventStream = class {
 		}, this.options.heartbeatIntervalMs);
 	}
 };
-//#endregion
-//#region src/server/events/handlers.ts
+// src/server/events/handlers.ts
 const DEFAULT_MAX_EVENTS = 100;
 const DEFAULT_LIST_PAGE_SIZE = 100;
 /**
@@ -19402,8 +19434,7 @@ function decodeListCursor(cursor) {
 	} catch {}
 	throw new ProtocolError$1(ProtocolErrorCode$1.InvalidParams, "Invalid events/list cursor");
 }
-//#endregion
-//#region src/server/events/inspector.ts
+// src/server/events/inspector.ts
 /** Prefix of the `eventId` of occurrences sent with the inspector's `emit`. */
 const TEST_EMIT_EVENT_ID_PREFIX = "mastra-test-";
 let localStreamIds = 0;
@@ -19520,8 +19551,7 @@ function protocolErrorId(code) {
 		default: return;
 	}
 }
-//#endregion
-//#region src/server/events/webhook-store.ts
+// src/server/events/webhook-store.ts
 /**
 * Default {@link WebhookSubscriptionStore}: a process-local map.
 *
@@ -19542,8 +19572,7 @@ var InMemoryWebhookSubscriptionStore = class {
 		return [...this.records.values()].filter((record) => record.name === name);
 	}
 };
-//#endregion
-//#region src/server/events/webhook-transport.ts
+// src/server/events/webhook-transport.ts
 /** Largest response body read from a callback endpoint. Enough for a verification echo. */
 const MAX_RESPONSE_BYTES = 4096;
 /** Maps a non-2xx status to its failure category. */
@@ -19618,8 +19647,7 @@ const nodeWebhookTransport = (request) => new Promise((resolve) => {
 	});
 	req.end(request.body);
 });
-//#endregion
-//#region src/server/events/webhook-dispatcher.ts
+// src/server/events/webhook-dispatcher.ts
 const MINUTE = 6e4;
 const HOUR = 60 * MINUTE;
 const MAX_TIMER_MS = 2147483647;
@@ -20176,8 +20204,7 @@ function echoes(body, challenge) {
 	const b = Buffer.from(challenge);
 	return a.length === b.length && timingSafeEqual(a, b);
 }
-//#endregion
-//#region src/server/server.ts
+// src/server/server.ts
 const EMPTY_OBJECT_SCHEMA = {
 	type: "object",
 	properties: {}
@@ -20850,21 +20877,31 @@ var MCPServer = class extends MCPServerBase {
 			ui: { resourceUri },
 			[RESOURCE_URI_META_KEY]: resourceUri
 		} } : {};
-		if (!tool.outputSchema) return {
-			isError: false,
-			content: [{
-				type: "text",
-				text: typeof value === "string" ? value : JSON.stringify(value)
-			}],
-			...meta
-		};
-		const structuredContent = value;
+		if (!tool.outputSchema) {
+			const text = typeof value === "string" ? value : JSON.stringify(value);
+			return {
+				isError: false,
+				content: text === void 0 ? [] : [{
+					type: "text",
+					text
+				}],
+				...meta
+			};
+		}
+		const text = JSON.stringify(value);
+		if (text === void 0) {
+			this.logger.warn(`Tool '${name}' declares an outputSchema but returned no structured output.`);
+			return {
+				...errorResult$1(`Tool '${name}' declares an outputSchema but returned no output.`),
+				...meta
+			};
+		}
 		return {
 			isError: false,
-			structuredContent,
+			structuredContent: value,
 			content: [{
 				type: "text",
-				text: JSON.stringify(structuredContent)
+				text
 			}],
 			...meta
 		};
@@ -21292,12 +21329,10 @@ function normalizeUiMeta(meta) {
 		[RESOURCE_URI_META_KEY]: resourceUri
 	};
 }
-//#endregion
-//#region src/server/types.ts
+// src/server/types.ts
 /** The only protocol revision `@mastra/mcp` serves. */
 const MCP_PROTOCOL_VERSION = "2026-07-28";
-//#endregion
-//#region src/server/oauth-middleware.ts
+// src/server/oauth-middleware.ts
 /**
 * Creates an OAuth middleware function for protecting MCP server endpoints.
 *
@@ -21542,8 +21577,7 @@ function createIntrospectionValidator(introspectionEndpoint, clientCredentials)
 		}
 	};
 }
-//#endregion
-//#region src/server/events/define-event.ts
+// src/server/events/define-event.ts
 /**
 * Declares an event type for `MCPServer`'s `events` option. An identity helper: it types `match`
 * and `poll` from `inputSchema` and `payloadSchema`.
@@ -21563,8 +21597,7 @@ function createIntrospectionValidator(introspectionEndpoint, clientCredentials)
 function defineEvent(definition) {
 	return definition;
 }
-//#endregion
-//#region src/integrations/events-cursor-store.ts
+// src/integrations/events-cursor-store.ts
 /**
 * Process-local {@link MCPEventCursorStore}. Cursors survive a provider restart within the same
 * process, not a process restart.
@@ -21583,8 +21616,7 @@ var InMemoryMCPEventCursorStore = class {
 		this.#cursors.delete(key);
 	}
 };
-//#endregion
-//#region src/integrations/events-utils.ts
+// src/integrations/events-utils.ts
 function canonicalize(value) {
 	if (Array.isArray(value)) return value.map(canonicalize);
 	if (value !== null && typeof value === "object") {
@@ -21627,8 +21659,7 @@ function formatUntrustedEvent({ header, data, footer }) {
 		...footer ? [footer] : []
 	].join("\n");
 }
-//#endregion
-//#region src/integrations/events-tools.ts
+// src/integrations/events-tools.ts
 function decodeArguments(value) {
 	try {
 		const parsed = JSON.parse(value);
@@ -21736,8 +21767,7 @@ function createMCPEventsTools({ provider, client, servers }) {
 		})
 	};
 }
-//#endregion
-//#region src/integrations/events-signals.ts
+// src/integrations/events-signals.ts
 const GAP_NOTE = "Some events may have been skipped (gap); re-fetch authoritative state with tools if it matters.";
 /**
 * Delivers MCP Events (SEP-3415) occurrences into agent threads as notification signals.
@@ -21990,7 +22020,6 @@ var MCPEventsSignalProvider = class MCPEventsSignalProvider extends SignalProvid
 		else console.warn(`[${this.id}] ${info.key}:`, error);
 	}
 };
-//#endregion
 export { InMemoryMCPEventCursorStore, InMemoryOAuthStorage, InMemoryWebhookSubscriptionStore, InternalMastraMCPClient, MCPClient, MCPClientServerProxy, MCPEventsSignalProvider, MCPOAuthClientProvider, MCPServer, MCP_CALL_TOOL_CONTENT, MCP_CALL_TOOL_META, MCP_CLIENT_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION, ServerEventActions, ServerPromptActions, ServerResourceActions, ServerToolActions, UnauthorizedError, auth, buildDiscoveryUrls, createIntrospectionValidator, createOAuthCallbackServer, createOAuthMiddleware, createSimpleTokenProvider, createStaticTokenValidator, defineEvent, discoverAuthorizationServerMetadata, discoverOAuthMetadata, discoverOAuthProtectedResourceMetadata, exchangeAuthorization, extractBearerToken, extractResourceMetadataUrl, generateProtectedResourceMetadata, generateWWWAuthenticateHeader, getCallbackUrlCandidates, getMcpCallToolContent, getMcpCallToolMeta, parseErrorResponse, refreshAuthorization, selectResourceURL, startAuthorization, traceContextFromMeta, traceContextToMeta };
 
 //# sourceMappingURL=index.js.map