@mcp-z/mcp-gmail 2.1.1 → 2.2.0

package/dist/cjs/setup/http.d.cts

@@ -1,8 +1,6 @@
-import { McpServer } from '@mcp-z/server';
 import type { RuntimeOverrides, ServerConfig } from '../types.js';
 export declare function createHTTPServer(config: ServerConfig, overrides?: RuntimeOverrides): Promise<{
     httpServer: import("node:http").Server<typeof import("node:http").IncomingMessage, typeof import("node:http").ServerResponse>;
-    mcpServer: McpServer;
     logger: import("@mcp-z/server").Logger;
     close: () => Promise<void>;
 }>;

package/dist/cjs/setup/http.d.ts

@@ -1,8 +1,6 @@
-import { McpServer } from '@mcp-z/server';
 import type { RuntimeOverrides, ServerConfig } from '../types.js';
 export declare function createHTTPServer(config: ServerConfig, overrides?: RuntimeOverrides): Promise<{
     httpServer: import("node:http").Server<typeof import("node:http").IncomingMessage, typeof import("node:http").ServerResponse>;
-    mcpServer: McpServer;
     logger: import("@mcp-z/server").Logger;
     close: () => Promise<void>;
 }>;

package/dist/cjs/setup/http.js

@@ -171,7 +171,7 @@ function _unsupported_iterable_to_array(o, minLen) {
 }
 function createHTTPServer(config, overrides) {
     return _async_to_generator(function() {
-        var runtime, modules, layers, composed, logger, port, tools, filteredTools, prompts, mcpServer, app, publicUrl, _ref, close, httpServer, fileRouter;
+        var runtime, modules, layers, composed, logger, port, tools, filteredTools, prompts, buildServer, app, publicUrl, _ref, close, httpServer, fileRouter;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -195,13 +195,20 @@ function createHTTPServer(config, overrides) {
                     }) // No file storage in DCR (public cloud responsibility)
                      : tools;
                     prompts = _to_consumable_array(composed.prompts).concat(_to_consumable_array(runtime.deps.oauthAdapters.accountPrompts));
-                    mcpServer = new _server.McpServer({
-                        name: config.name,
-                        version: config.version
-                    });
-                    (0, _server.registerTools)(mcpServer, filteredTools);
-                    (0, _server.registerResources)(mcpServer, composed.resources);
-                    (0, _server.registerPrompts)(mcpServer, prompts);
+                    // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the
+                    // negotiated protocol revision on the McpServer instance - its own docs say a negotiated
+                    // session never re-routes a method onto the other era - so one shared instance pins itself
+                    // to whichever revision reaches it first and answers the other with -32601.
+                    buildServer = function buildServer() {
+                        var mcpServer = new _server.McpServer({
+                            name: config.name,
+                            version: config.version
+                        });
+                        (0, _server.registerTools)(mcpServer, filteredTools);
+                        (0, _server.registerResources)(mcpServer, composed.resources);
+                        (0, _server.registerPrompts)(mcpServer, prompts);
+                        return mcpServer;
+                    };
                     app = (0, _express.default)();
                     app.use(_express.default.json({
                         limit: '10mb'
@@ -212,7 +219,7 @@ function createHTTPServer(config, overrides) {
                     logger.info("Starting ".concat(config.name, " MCP server (http)"));
                     return [
                         4,
-                        (0, _server.connectHttp)(mcpServer, {
+                        (0, _server.connectHttp)(buildServer, {
                             logger: logger,
                             app: app,
                             port: port,
@@ -251,7 +258,6 @@ function createHTTPServer(config, overrides) {
                         2,
                         {
                             httpServer: httpServer,
-                            mcpServer: mcpServer,
                             logger: logger,
                             close: function close1() {
                                 return _async_to_generator(function() {

package/dist/cjs/setup/http.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-gmail/src/setup/http.ts"],"sourcesContent":["import { composeMiddleware, connectHttp, createFileServingRouter, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport cors from 'cors';\nimport express from 'express';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createHTTPServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n  const port = config.transport.port;\n  if (!port) throw new Error('Port is required for HTTP transport');\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const filteredTools =\n    config.auth === 'dcr'\n      ? tools.filter((tool) => tool.name !== 'messages-export-csv') // No file storage in DCR (public cloud responsibility)\n      : tools;\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  const mcpServer = new McpServer({ name: config.name, version: config.version });\n  registerTools(mcpServer, filteredTools);\n  registerResources(mcpServer, composed.resources);\n  registerPrompts(mcpServer, prompts);\n\n  const app = express();\n  app.use(express.json({ limit: '10mb' }));\n\n  // Must mount '/mcp' before any permissive app-level cors(), or that layer answers its\n  // preflight first; pass baseUrl's origin/host below or a public deployment 403s itself.\n  const publicUrl = config.baseUrl ? new URL(config.baseUrl) : undefined;\n  logger.info(`Starting ${config.name} MCP server (http)`);\n  const { close, httpServer } = await connectHttp(mcpServer, {\n    logger,\n    app,\n    port,\n    allowedOrigins: publicUrl ? [publicUrl.origin] : undefined,\n    allowedHosts: publicUrl ? [publicUrl.host] : undefined,\n  });\n\n  // The loopback OAuth callback, the file-export download, and the DCR discovery/\n  // registration endpoints are all meant to be reached from a browser on another\n  // origin. Keep cors() for them, scoped to their own routes - never in front of '/mcp'.\n  if (runtime.deps.oauthAdapters.loopbackRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.loopbackRouter);\n    logger.info('Mounted loopback OAuth callback router');\n  }\n\n  if (config.auth !== 'dcr') {\n    const fileRouter = createFileServingRouter({ resourceStoreUri: config.resourceStoreUri }, { contentType: 'text/csv', contentDisposition: 'attachment' });\n    app.use('/files', cors(), fileRouter);\n  }\n\n  if (runtime.deps.oauthAdapters.dcrRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.dcrRouter);\n    logger.info('Mounted DCR router with OAuth endpoints');\n  }\n\n  logger.info('http transport ready');\n\n  return {\n    httpServer,\n    mcpServer,\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["createHTTPServer","config","overrides","runtime","modules","layers","composed","logger","port","tools","filteredTools","prompts","mcpServer","app","publicUrl","close","httpServer","fileRouter","createDefaultRuntime","createDomainModules","middlewareFactories","map","factory","deps","composeMiddleware","transport","Error","oauthAdapters","accountTools","auth","filter","tool","name","accountPrompts","McpServer","version","registerTools","registerResources","resources","registerPrompts","express","use","json","limit","baseUrl","URL","undefined","info","connectHttp","allowedOrigins","origin","allowedHosts","host","loopbackRouter","cors","createFileServingRouter","resourceStoreUri","contentType","contentDisposition","dcrRouter"],"mappings":";;;;+BAMsBA;;;eAAAA;;;sBANgH;2DACrH;8DACG;yBAEiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAE9B,SAAeA,iBAAiBC,MAAoB,EAAEC,SAA4B;;YACjFC,SACAC,SACAC,QACAC,UACAC,QACAC,MAGAC,OACAC,eAIAC,SAEAC,WAKAC,KAKAC,WAEwB,MAAtBC,OAAOC,YAiBPC;;;;oBA5CQ;;wBAAMC,IAAAA,+BAAoB,EAACjB,QAAQC;;;oBAA7CC,UAAU;oBACVC,UAAUD,QAAQgB,mBAAmB;oBACrCd,SAASF,QAAQiB,mBAAmB,CAACC,GAAG,CAAC,SAACC;+BAAYA,QAAQnB,QAAQoB,IAAI;;oBAC1EjB,WAAWkB,IAAAA,yBAAiB,EAACpB,SAASC;oBACtCE,SAASJ,QAAQoB,IAAI,CAAChB,MAAM;oBAC5BC,OAAOP,OAAOwB,SAAS,CAACjB,IAAI;oBAClC,IAAI,CAACA,MAAM,MAAM,IAAIkB,MAAM;oBAErBjB,QAAQ,AAAC,qBAAGH,SAASG,KAAK,SAAE,qBAAGN,QAAQoB,IAAI,CAACI,aAAa,CAACC,YAAY;oBACtElB,gBACJT,OAAO4B,IAAI,KAAK,QACZpB,MAAMqB,MAAM,CAAC,SAACC;+BAASA,KAAKC,IAAI,KAAK;uBAAuB,uDAAuD;uBACnHvB;oBACAE,UAAU,AAAC,qBAAGL,SAASK,OAAO,SAAE,qBAAGR,QAAQoB,IAAI,CAACI,aAAa,CAACM,cAAc;oBAE5ErB,YAAY,IAAIsB,iBAAS,CAAC;wBAAEF,MAAM/B,OAAO+B,IAAI;wBAAEG,SAASlC,OAAOkC,OAAO;oBAAC;oBAC7EC,IAAAA,qBAAa,EAACxB,WAAWF;oBACzB2B,IAAAA,yBAAiB,EAACzB,WAAWN,SAASgC,SAAS;oBAC/CC,IAAAA,uBAAe,EAAC3B,WAAWD;oBAErBE,MAAM2B,IAAAA,gBAAO;oBACnB3B,IAAI4B,GAAG,CAACD,gBAAO,CAACE,IAAI,CAAC;wBAAEC,OAAO;oBAAO;oBAErC,sFAAsF;oBACtF,wFAAwF;oBAClF7B,YAAYb,OAAO2C,OAAO,GAAG,IAAIC,IAAI5C,OAAO2C,OAAO,IAAIE;oBAC7DvC,OAAOwC,IAAI,CAAC,AAAC,YAAuB,OAAZ9C,OAAO+B,IAAI,EAAC;oBACN;;wBAAMgB,IAAAA,mBAAW,EAACpC,WAAW;4BACzDL,QAAAA;4BACAM,KAAAA;4BACAL,MAAAA;4BACAyC,gBAAgBnC;gCAAaA,UAAUoC,MAAM;gCAAIJ;4BACjDK,cAAcrC;gCAAaA,UAAUsC,IAAI;gCAAIN;wBAC/C;;;oBAN8B,OAAA,eAAtB/B,QAAsB,KAAtBA,OAAOC,aAAe,KAAfA;oBAQf,gFAAgF;oBAChF,+EAA+E;oBAC/E,uFAAuF;oBACvF,IAAIb,QAAQoB,IAAI,CAACI,aAAa,CAAC0B,cAAc,EAAE;wBAC7CxC,IAAI4B,GAAG,CAAC,KAAKa,IAAAA,aAAI,KAAInD,QAAQoB,IAAI,CAACI,aAAa,CAAC0B,cAAc;wBAC9D9C,OAAOwC,IAAI,CAAC;oBACd;oBAEA,IAAI9C,OAAO4B,IAAI,KAAK,OAAO;wBACnBZ,aAAasC,IAAAA,+BAAuB,EAAC;4BAAEC,kBAAkBvD,OAAOuD,gBAAgB;wBAAC,GAAG;4BAAEC,aAAa;4BAAYC,oBAAoB;wBAAa;wBACtJ7C,IAAI4B,GAAG,CAAC,UAAUa,IAAAA,aAAI,KAAIrC;oBAC5B;oBAEA,IAAId,QAAQoB,IAAI,CAACI,aAAa,CAACgC,SAAS,EAAE;wBACxC9C,IAAI4B,GAAG,CAAC,KAAKa,IAAAA,aAAI,KAAInD,QAAQoB,IAAI,CAACI,aAAa,CAACgC,SAAS;wBACzDpD,OAAOwC,IAAI,CAAC;oBACd;oBAEAxC,OAAOwC,IAAI,CAAC;oBAEZ;;wBAAO;4BACL/B,YAAAA;4BACAJ,WAAAA;4BACAL,QAAAA;4BACAQ,OAAO,SAAPA;;;;;gDACE;;oDAAMA;;;gDAAN;gDACA;;oDAAMZ,QAAQY,KAAK;;;gDAAnB;;;;;;gCACF;;wBACF;;;;IACF"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-gmail/src/setup/http.ts"],"sourcesContent":["import { composeMiddleware, connectHttp, createFileServingRouter, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport cors from 'cors';\nimport express from 'express';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createHTTPServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n  const port = config.transport.port;\n  if (!port) throw new Error('Port is required for HTTP transport');\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const filteredTools =\n    config.auth === 'dcr'\n      ? tools.filter((tool) => tool.name !== 'messages-export-csv') // No file storage in DCR (public cloud responsibility)\n      : tools;\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version });\n    registerTools(mcpServer, filteredTools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  const app = express();\n  app.use(express.json({ limit: '10mb' }));\n\n  // Must mount '/mcp' before any permissive app-level cors(), or that layer answers its\n  // preflight first; pass baseUrl's origin/host below or a public deployment 403s itself.\n  const publicUrl = config.baseUrl ? new URL(config.baseUrl) : undefined;\n  logger.info(`Starting ${config.name} MCP server (http)`);\n  const { close, httpServer } = await connectHttp(buildServer, {\n    logger,\n    app,\n    port,\n    allowedOrigins: publicUrl ? [publicUrl.origin] : undefined,\n    allowedHosts: publicUrl ? [publicUrl.host] : undefined,\n  });\n\n  // The loopback OAuth callback, the file-export download, and the DCR discovery/\n  // registration endpoints are all meant to be reached from a browser on another\n  // origin. Keep cors() for them, scoped to their own routes - never in front of '/mcp'.\n  if (runtime.deps.oauthAdapters.loopbackRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.loopbackRouter);\n    logger.info('Mounted loopback OAuth callback router');\n  }\n\n  if (config.auth !== 'dcr') {\n    const fileRouter = createFileServingRouter({ resourceStoreUri: config.resourceStoreUri }, { contentType: 'text/csv', contentDisposition: 'attachment' });\n    app.use('/files', cors(), fileRouter);\n  }\n\n  if (runtime.deps.oauthAdapters.dcrRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.dcrRouter);\n    logger.info('Mounted DCR router with OAuth endpoints');\n  }\n\n  logger.info('http transport ready');\n\n  return {\n    httpServer,\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["createHTTPServer","config","overrides","runtime","modules","layers","composed","logger","port","tools","filteredTools","prompts","buildServer","app","publicUrl","close","httpServer","fileRouter","createDefaultRuntime","createDomainModules","middlewareFactories","map","factory","deps","composeMiddleware","transport","Error","oauthAdapters","accountTools","auth","filter","tool","name","accountPrompts","mcpServer","McpServer","version","registerTools","registerResources","resources","registerPrompts","express","use","json","limit","baseUrl","URL","undefined","info","connectHttp","allowedOrigins","origin","allowedHosts","host","loopbackRouter","cors","createFileServingRouter","resourceStoreUri","contentType","contentDisposition","dcrRouter"],"mappings":";;;;+BAMsBA;;;eAAAA;;;sBANgH;2DACrH;8DACG;yBAEiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAE9B,SAAeA,iBAAiBC,MAAoB,EAAEC,SAA4B;;YACjFC,SACAC,SACAC,QACAC,UACAC,QACAC,MAGAC,OACAC,eAIAC,SAMAC,aAQAC,KAKAC,WAEwB,MAAtBC,OAAOC,YAiBPC;;;;oBAnDQ;;wBAAMC,IAAAA,+BAAoB,EAACjB,QAAQC;;;oBAA7CC,UAAU;oBACVC,UAAUD,QAAQgB,mBAAmB;oBACrCd,SAASF,QAAQiB,mBAAmB,CAACC,GAAG,CAAC,SAACC;+BAAYA,QAAQnB,QAAQoB,IAAI;;oBAC1EjB,WAAWkB,IAAAA,yBAAiB,EAACpB,SAASC;oBACtCE,SAASJ,QAAQoB,IAAI,CAAChB,MAAM;oBAC5BC,OAAOP,OAAOwB,SAAS,CAACjB,IAAI;oBAClC,IAAI,CAACA,MAAM,MAAM,IAAIkB,MAAM;oBAErBjB,QAAQ,AAAC,qBAAGH,SAASG,KAAK,SAAE,qBAAGN,QAAQoB,IAAI,CAACI,aAAa,CAACC,YAAY;oBACtElB,gBACJT,OAAO4B,IAAI,KAAK,QACZpB,MAAMqB,MAAM,CAAC,SAACC;+BAASA,KAAKC,IAAI,KAAK;uBAAuB,uDAAuD;uBACnHvB;oBACAE,UAAU,AAAC,qBAAGL,SAASK,OAAO,SAAE,qBAAGR,QAAQoB,IAAI,CAACI,aAAa,CAACM,cAAc;oBAElF,sFAAsF;oBACtF,yFAAyF;oBACzF,2FAA2F;oBAC3F,4EAA4E;oBACtErB,cAAc;wBAClB,IAAMsB,YAAY,IAAIC,iBAAS,CAAC;4BAAEH,MAAM/B,OAAO+B,IAAI;4BAAEI,SAASnC,OAAOmC,OAAO;wBAAC;wBAC7EC,IAAAA,qBAAa,EAACH,WAAWxB;wBACzB4B,IAAAA,yBAAiB,EAACJ,WAAW5B,SAASiC,SAAS;wBAC/CC,IAAAA,uBAAe,EAACN,WAAWvB;wBAC3B,OAAOuB;oBACT;oBAEMrB,MAAM4B,IAAAA,gBAAO;oBACnB5B,IAAI6B,GAAG,CAACD,gBAAO,CAACE,IAAI,CAAC;wBAAEC,OAAO;oBAAO;oBAErC,sFAAsF;oBACtF,wFAAwF;oBAClF9B,YAAYb,OAAO4C,OAAO,GAAG,IAAIC,IAAI7C,OAAO4C,OAAO,IAAIE;oBAC7DxC,OAAOyC,IAAI,CAAC,AAAC,YAAuB,OAAZ/C,OAAO+B,IAAI,EAAC;oBACN;;wBAAMiB,IAAAA,mBAAW,EAACrC,aAAa;4BAC3DL,QAAAA;4BACAM,KAAAA;4BACAL,MAAAA;4BACA0C,gBAAgBpC;gCAAaA,UAAUqC,MAAM;gCAAIJ;4BACjDK,cAActC;gCAAaA,UAAUuC,IAAI;gCAAIN;wBAC/C;;;oBAN8B,OAAA,eAAtBhC,QAAsB,KAAtBA,OAAOC,aAAe,KAAfA;oBAQf,gFAAgF;oBAChF,+EAA+E;oBAC/E,uFAAuF;oBACvF,IAAIb,QAAQoB,IAAI,CAACI,aAAa,CAAC2B,cAAc,EAAE;wBAC7CzC,IAAI6B,GAAG,CAAC,KAAKa,IAAAA,aAAI,KAAIpD,QAAQoB,IAAI,CAACI,aAAa,CAAC2B,cAAc;wBAC9D/C,OAAOyC,IAAI,CAAC;oBACd;oBAEA,IAAI/C,OAAO4B,IAAI,KAAK,OAAO;wBACnBZ,aAAauC,IAAAA,+BAAuB,EAAC;4BAAEC,kBAAkBxD,OAAOwD,gBAAgB;wBAAC,GAAG;4BAAEC,aAAa;4BAAYC,oBAAoB;wBAAa;wBACtJ9C,IAAI6B,GAAG,CAAC,UAAUa,IAAAA,aAAI,KAAItC;oBAC5B;oBAEA,IAAId,QAAQoB,IAAI,CAACI,aAAa,CAACiC,SAAS,EAAE;wBACxC/C,IAAI6B,GAAG,CAAC,KAAKa,IAAAA,aAAI,KAAIpD,QAAQoB,IAAI,CAACI,aAAa,CAACiC,SAAS;wBACzDrD,OAAOyC,IAAI,CAAC;oBACd;oBAEAzC,OAAOyC,IAAI,CAAC;oBAEZ;;wBAAO;4BACLhC,YAAAA;4BACAT,QAAAA;4BACAQ,OAAO,SAAPA;;;;;gDACE;;oDAAMA;;;gDAAN;gDACA;;oDAAMZ,QAAQY,KAAK;;;gDAAnB;;;;;;gCACF;;wBACF;;;;IACF"}

package/dist/cjs/setup/stdio.d.cts

@@ -1,7 +1,5 @@
-import { McpServer } from '@mcp-z/server';
 import type { RuntimeOverrides, ServerConfig } from '../types.js';
 export declare function createStdioServer(config: ServerConfig, overrides?: RuntimeOverrides): Promise<{
-    mcpServer: McpServer;
     logger: import("@mcp-z/server").Logger;
     close: () => Promise<void>;
 }>;

package/dist/cjs/setup/stdio.d.ts

@@ -1,7 +1,5 @@
-import { McpServer } from '@mcp-z/server';
 import type { RuntimeOverrides, ServerConfig } from '../types.js';
 export declare function createStdioServer(config: ServerConfig, overrides?: RuntimeOverrides): Promise<{
-    mcpServer: McpServer;
     logger: import("@mcp-z/server").Logger;
     close: () => Promise<void>;
 }>;

package/dist/cjs/setup/stdio.js

@@ -164,7 +164,7 @@ function _unsupported_iterable_to_array(o, minLen) {
 }
 function createStdioServer(config, overrides) {
     return _async_to_generator(function() {
-        var runtime, modules, layers, composed, logger, tools, filteredTools, prompts, mcpServer, close;
+        var runtime, modules, layers, composed, logger, tools, filteredTools, prompts, buildServer, close;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -186,17 +186,24 @@ function createStdioServer(config, overrides) {
                     }) // No file storage in DCR (public cloud responsibility)
                      : tools;
                     prompts = _to_consumable_array(composed.prompts).concat(_to_consumable_array(runtime.deps.oauthAdapters.accountPrompts));
-                    mcpServer = new _server.McpServer({
-                        name: config.name,
-                        version: config.version
-                    });
-                    (0, _server.registerTools)(mcpServer, filteredTools);
-                    (0, _server.registerResources)(mcpServer, composed.resources);
-                    (0, _server.registerPrompts)(mcpServer, prompts);
+                    // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the
+                    // negotiated protocol revision on the McpServer instance - its own docs say a negotiated
+                    // session never re-routes a method onto the other era - so one shared instance pins itself
+                    // to whichever revision reaches it first and answers the other with -32601.
+                    buildServer = function buildServer() {
+                        var mcpServer = new _server.McpServer({
+                            name: config.name,
+                            version: config.version
+                        });
+                        (0, _server.registerTools)(mcpServer, filteredTools);
+                        (0, _server.registerResources)(mcpServer, composed.resources);
+                        (0, _server.registerPrompts)(mcpServer, prompts);
+                        return mcpServer;
+                    };
                     logger.info("Starting ".concat(config.name, " MCP server (stdio)"));
                     return [
                         4,
-                        (0, _server.connectStdio)(mcpServer, {
+                        (0, _server.connectStdio)(buildServer, {
                             logger: logger
                         })
                     ];
@@ -206,7 +213,6 @@ function createStdioServer(config, overrides) {
                     return [
                         2,
                         {
-                            mcpServer: mcpServer,
                             logger: logger,
                             close: function close1() {
                                 return _async_to_generator(function() {

package/dist/cjs/setup/stdio.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-gmail/src/setup/stdio.ts"],"sourcesContent":["import { composeMiddleware, connectStdio, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createStdioServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const filteredTools =\n    config.auth === 'dcr'\n      ? tools.filter((tool) => tool.name !== 'messages-export-csv') // No file storage in DCR (public cloud responsibility)\n      : tools;\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  const mcpServer = new McpServer({ name: config.name, version: config.version });\n  registerTools(mcpServer, filteredTools);\n  registerResources(mcpServer, composed.resources);\n  registerPrompts(mcpServer, prompts);\n\n  logger.info(`Starting ${config.name} MCP server (stdio)`);\n  const { close } = await connectStdio(mcpServer, { logger });\n  logger.info('stdio transport ready');\n\n  return {\n    mcpServer,\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["createStdioServer","config","overrides","runtime","modules","layers","composed","logger","tools","filteredTools","prompts","mcpServer","close","createDefaultRuntime","createDomainModules","middlewareFactories","map","factory","deps","composeMiddleware","oauthAdapters","accountTools","auth","filter","tool","name","accountPrompts","McpServer","version","registerTools","registerResources","resources","registerPrompts","info","connectStdio"],"mappings":";;;;+BAIsBA;;;eAAAA;;;sBAJwF;yBAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAE9B,SAAeA,kBAAkBC,MAAoB,EAAEC,SAA4B;;YAClFC,SACAC,SACAC,QACAC,UACAC,QAEAC,OACAC,eAIAC,SAEAC,WAMEC;;;;oBAnBQ;;wBAAMC,IAAAA,+BAAoB,EAACZ,QAAQC;;;oBAA7CC,UAAU;oBACVC,UAAUD,QAAQW,mBAAmB;oBACrCT,SAASF,QAAQY,mBAAmB,CAACC,GAAG,CAAC,SAACC;+BAAYA,QAAQd,QAAQe,IAAI;;oBAC1EZ,WAAWa,IAAAA,yBAAiB,EAACf,SAASC;oBACtCE,SAASJ,QAAQe,IAAI,CAACX,MAAM;oBAE5BC,QAAQ,AAAC,qBAAGF,SAASE,KAAK,SAAE,qBAAGL,QAAQe,IAAI,CAACE,aAAa,CAACC,YAAY;oBACtEZ,gBACJR,OAAOqB,IAAI,KAAK,QACZd,MAAMe,MAAM,CAAC,SAACC;+BAASA,KAAKC,IAAI,KAAK;uBAAuB,uDAAuD;uBACnHjB;oBACAE,UAAU,AAAC,qBAAGJ,SAASI,OAAO,SAAE,qBAAGP,QAAQe,IAAI,CAACE,aAAa,CAACM,cAAc;oBAE5Ef,YAAY,IAAIgB,iBAAS,CAAC;wBAAEF,MAAMxB,OAAOwB,IAAI;wBAAEG,SAAS3B,OAAO2B,OAAO;oBAAC;oBAC7EC,IAAAA,qBAAa,EAAClB,WAAWF;oBACzBqB,IAAAA,yBAAiB,EAACnB,WAAWL,SAASyB,SAAS;oBAC/CC,IAAAA,uBAAe,EAACrB,WAAWD;oBAE3BH,OAAO0B,IAAI,CAAC,AAAC,YAAuB,OAAZhC,OAAOwB,IAAI,EAAC;oBAClB;;wBAAMS,IAAAA,oBAAY,EAACvB,WAAW;4BAAEJ,QAAAA;wBAAO;;;oBAAjDK,QAAU,cAAVA;oBACRL,OAAO0B,IAAI,CAAC;oBAEZ;;wBAAO;4BACLtB,WAAAA;4BACAJ,QAAAA;4BACAK,OAAO,SAAPA;;;;;gDACE;;oDAAMA;;;gDAAN;gDACA;;oDAAMT,QAAQS,KAAK;;;gDAAnB;;;;;;gCACF;;wBACF;;;;IACF"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-gmail/src/setup/stdio.ts"],"sourcesContent":["import { composeMiddleware, connectStdio, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createStdioServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const filteredTools =\n    config.auth === 'dcr'\n      ? tools.filter((tool) => tool.name !== 'messages-export-csv') // No file storage in DCR (public cloud responsibility)\n      : tools;\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version });\n    registerTools(mcpServer, filteredTools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  logger.info(`Starting ${config.name} MCP server (stdio)`);\n  const { close } = await connectStdio(buildServer, { logger });\n  logger.info('stdio transport ready');\n\n  return {\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["createStdioServer","config","overrides","runtime","modules","layers","composed","logger","tools","filteredTools","prompts","buildServer","close","createDefaultRuntime","createDomainModules","middlewareFactories","map","factory","deps","composeMiddleware","oauthAdapters","accountTools","auth","filter","tool","name","accountPrompts","mcpServer","McpServer","version","registerTools","registerResources","resources","registerPrompts","info","connectStdio"],"mappings":";;;;+BAIsBA;;;eAAAA;;;sBAJwF;yBAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAE9B,SAAeA,kBAAkBC,MAAoB,EAAEC,SAA4B;;YAClFC,SACAC,SACAC,QACAC,UACAC,QAEAC,OACAC,eAIAC,SAMAC,aASEC;;;;oBA1BQ;;wBAAMC,IAAAA,+BAAoB,EAACZ,QAAQC;;;oBAA7CC,UAAU;oBACVC,UAAUD,QAAQW,mBAAmB;oBACrCT,SAASF,QAAQY,mBAAmB,CAACC,GAAG,CAAC,SAACC;+BAAYA,QAAQd,QAAQe,IAAI;;oBAC1EZ,WAAWa,IAAAA,yBAAiB,EAACf,SAASC;oBACtCE,SAASJ,QAAQe,IAAI,CAACX,MAAM;oBAE5BC,QAAQ,AAAC,qBAAGF,SAASE,KAAK,SAAE,qBAAGL,QAAQe,IAAI,CAACE,aAAa,CAACC,YAAY;oBACtEZ,gBACJR,OAAOqB,IAAI,KAAK,QACZd,MAAMe,MAAM,CAAC,SAACC;+BAASA,KAAKC,IAAI,KAAK;uBAAuB,uDAAuD;uBACnHjB;oBACAE,UAAU,AAAC,qBAAGJ,SAASI,OAAO,SAAE,qBAAGP,QAAQe,IAAI,CAACE,aAAa,CAACM,cAAc;oBAElF,sFAAsF;oBACtF,yFAAyF;oBACzF,2FAA2F;oBAC3F,4EAA4E;oBACtEf,cAAc;wBAClB,IAAMgB,YAAY,IAAIC,iBAAS,CAAC;4BAAEH,MAAMxB,OAAOwB,IAAI;4BAAEI,SAAS5B,OAAO4B,OAAO;wBAAC;wBAC7EC,IAAAA,qBAAa,EAACH,WAAWlB;wBACzBsB,IAAAA,yBAAiB,EAACJ,WAAWrB,SAAS0B,SAAS;wBAC/CC,IAAAA,uBAAe,EAACN,WAAWjB;wBAC3B,OAAOiB;oBACT;oBAEApB,OAAO2B,IAAI,CAAC,AAAC,YAAuB,OAAZjC,OAAOwB,IAAI,EAAC;oBAClB;;wBAAMU,IAAAA,oBAAY,EAACxB,aAAa;4BAAEJ,QAAAA;wBAAO;;;oBAAnDK,QAAU,cAAVA;oBACRL,OAAO2B,IAAI,CAAC;oBAEZ;;wBAAO;4BACL3B,QAAAA;4BACAK,OAAO,SAAPA;;;;;gDACE;;oDAAMA;;;gDAAN;gDACA;;oDAAMT,QAAQS,KAAK;;;gDAAnB;;;;;;gCACF;;wBACF;;;;IACF"}

package/dist/esm/setup/http.d.ts

@@ -1,8 +1,6 @@
-import { McpServer } from '@mcp-z/server';
 import type { RuntimeOverrides, ServerConfig } from '../types.js';
 export declare function createHTTPServer(config: ServerConfig, overrides?: RuntimeOverrides): Promise<{
     httpServer: import("node:http").Server<typeof import("node:http").IncomingMessage, typeof import("node:http").ServerResponse>;
-    mcpServer: McpServer;
     logger: import("@mcp-z/server").Logger;
     close: () => Promise<void>;
 }>;

package/dist/esm/setup/http.js

@@ -20,13 +20,20 @@ export async function createHTTPServer(config, overrides) {
         ...composed.prompts,
         ...runtime.deps.oauthAdapters.accountPrompts
     ];
-    const mcpServer = new McpServer({
-        name: config.name,
-        version: config.version
-    });
-    registerTools(mcpServer, filteredTools);
-    registerResources(mcpServer, composed.resources);
-    registerPrompts(mcpServer, prompts);
+    // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the
+    // negotiated protocol revision on the McpServer instance - its own docs say a negotiated
+    // session never re-routes a method onto the other era - so one shared instance pins itself
+    // to whichever revision reaches it first and answers the other with -32601.
+    const buildServer = ()=>{
+        const mcpServer = new McpServer({
+            name: config.name,
+            version: config.version
+        });
+        registerTools(mcpServer, filteredTools);
+        registerResources(mcpServer, composed.resources);
+        registerPrompts(mcpServer, prompts);
+        return mcpServer;
+    };
     const app = express();
     app.use(express.json({
         limit: '10mb'
@@ -35,7 +42,7 @@ export async function createHTTPServer(config, overrides) {
     // preflight first; pass baseUrl's origin/host below or a public deployment 403s itself.
     const publicUrl = config.baseUrl ? new URL(config.baseUrl) : undefined;
     logger.info(`Starting ${config.name} MCP server (http)`);
-    const { close, httpServer } = await connectHttp(mcpServer, {
+    const { close, httpServer } = await connectHttp(buildServer, {
         logger,
         app,
         port,
@@ -69,7 +76,6 @@ export async function createHTTPServer(config, overrides) {
     logger.info('http transport ready');
     return {
         httpServer,
-        mcpServer,
         logger,
         close: async ()=>{
             await close();

package/dist/esm/setup/http.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-gmail/src/setup/http.ts"],"sourcesContent":["import { composeMiddleware, connectHttp, createFileServingRouter, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport cors from 'cors';\nimport express from 'express';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createHTTPServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n  const port = config.transport.port;\n  if (!port) throw new Error('Port is required for HTTP transport');\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const filteredTools =\n    config.auth === 'dcr'\n      ? tools.filter((tool) => tool.name !== 'messages-export-csv') // No file storage in DCR (public cloud responsibility)\n      : tools;\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  const mcpServer = new McpServer({ name: config.name, version: config.version });\n  registerTools(mcpServer, filteredTools);\n  registerResources(mcpServer, composed.resources);\n  registerPrompts(mcpServer, prompts);\n\n  const app = express();\n  app.use(express.json({ limit: '10mb' }));\n\n  // Must mount '/mcp' before any permissive app-level cors(), or that layer answers its\n  // preflight first; pass baseUrl's origin/host below or a public deployment 403s itself.\n  const publicUrl = config.baseUrl ? new URL(config.baseUrl) : undefined;\n  logger.info(`Starting ${config.name} MCP server (http)`);\n  const { close, httpServer } = await connectHttp(mcpServer, {\n    logger,\n    app,\n    port,\n    allowedOrigins: publicUrl ? [publicUrl.origin] : undefined,\n    allowedHosts: publicUrl ? [publicUrl.host] : undefined,\n  });\n\n  // The loopback OAuth callback, the file-export download, and the DCR discovery/\n  // registration endpoints are all meant to be reached from a browser on another\n  // origin. Keep cors() for them, scoped to their own routes - never in front of '/mcp'.\n  if (runtime.deps.oauthAdapters.loopbackRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.loopbackRouter);\n    logger.info('Mounted loopback OAuth callback router');\n  }\n\n  if (config.auth !== 'dcr') {\n    const fileRouter = createFileServingRouter({ resourceStoreUri: config.resourceStoreUri }, { contentType: 'text/csv', contentDisposition: 'attachment' });\n    app.use('/files', cors(), fileRouter);\n  }\n\n  if (runtime.deps.oauthAdapters.dcrRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.dcrRouter);\n    logger.info('Mounted DCR router with OAuth endpoints');\n  }\n\n  logger.info('http transport ready');\n\n  return {\n    httpServer,\n    mcpServer,\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["composeMiddleware","connectHttp","createFileServingRouter","McpServer","registerPrompts","registerResources","registerTools","cors","express","createDefaultRuntime","createHTTPServer","config","overrides","runtime","modules","createDomainModules","layers","middlewareFactories","map","factory","deps","composed","logger","port","transport","Error","tools","oauthAdapters","accountTools","filteredTools","auth","filter","tool","name","prompts","accountPrompts","mcpServer","version","resources","app","use","json","limit","publicUrl","baseUrl","URL","undefined","info","close","httpServer","allowedOrigins","origin","allowedHosts","host","loopbackRouter","fileRouter","resourceStoreUri","contentType","contentDisposition","dcrRouter"],"mappings":"AAAA,SAASA,iBAAiB,EAAEC,WAAW,EAAEC,uBAAuB,EAAEC,SAAS,EAAEC,eAAe,EAAEC,iBAAiB,EAAEC,aAAa,QAAQ,gBAAgB;AACtJ,OAAOC,UAAU,OAAO;AACxB,OAAOC,aAAa,UAAU;AAE9B,SAASC,oBAAoB,QAAQ,eAAe;AAEpD,OAAO,eAAeC,iBAAiBC,MAAoB,EAAEC,SAA4B;IACvF,MAAMC,UAAU,MAAMJ,qBAAqBE,QAAQC;IACnD,MAAME,UAAUD,QAAQE,mBAAmB;IAC3C,MAAMC,SAASH,QAAQI,mBAAmB,CAACC,GAAG,CAAC,CAACC,UAAYA,QAAQN,QAAQO,IAAI;IAChF,MAAMC,WAAWrB,kBAAkBc,SAASE;IAC5C,MAAMM,SAAST,QAAQO,IAAI,CAACE,MAAM;IAClC,MAAMC,OAAOZ,OAAOa,SAAS,CAACD,IAAI;IAClC,IAAI,CAACA,MAAM,MAAM,IAAIE,MAAM;IAE3B,MAAMC,QAAQ;WAAIL,SAASK,KAAK;WAAKb,QAAQO,IAAI,CAACO,aAAa,CAACC,YAAY;KAAC;IAC7E,MAAMC,gBACJlB,OAAOmB,IAAI,KAAK,QACZJ,MAAMK,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAK,uBAAuB,uDAAuD;OACnHP;IACN,MAAMQ,UAAU;WAAIb,SAASa,OAAO;WAAKrB,QAAQO,IAAI,CAACO,aAAa,CAACQ,cAAc;KAAC;IAEnF,MAAMC,YAAY,IAAIjC,UAAU;QAAE8B,MAAMtB,OAAOsB,IAAI;QAAEI,SAAS1B,OAAO0B,OAAO;IAAC;IAC7E/B,cAAc8B,WAAWP;IACzBxB,kBAAkB+B,WAAWf,SAASiB,SAAS;IAC/ClC,gBAAgBgC,WAAWF;IAE3B,MAAMK,MAAM/B;IACZ+B,IAAIC,GAAG,CAAChC,QAAQiC,IAAI,CAAC;QAAEC,OAAO;IAAO;IAErC,sFAAsF;IACtF,wFAAwF;IACxF,MAAMC,YAAYhC,OAAOiC,OAAO,GAAG,IAAIC,IAAIlC,OAAOiC,OAAO,IAAIE;IAC7DxB,OAAOyB,IAAI,CAAC,CAAC,SAAS,EAAEpC,OAAOsB,IAAI,CAAC,kBAAkB,CAAC;IACvD,MAAM,EAAEe,KAAK,EAAEC,UAAU,EAAE,GAAG,MAAMhD,YAAYmC,WAAW;QACzDd;QACAiB;QACAhB;QACA2B,gBAAgBP,YAAY;YAACA,UAAUQ,MAAM;SAAC,GAAGL;QACjDM,cAAcT,YAAY;YAACA,UAAUU,IAAI;SAAC,GAAGP;IAC/C;IAEA,gFAAgF;IAChF,+EAA+E;IAC/E,uFAAuF;IACvF,IAAIjC,QAAQO,IAAI,CAACO,aAAa,CAAC2B,cAAc,EAAE;QAC7Cf,IAAIC,GAAG,CAAC,KAAKjC,QAAQM,QAAQO,IAAI,CAACO,aAAa,CAAC2B,cAAc;QAC9DhC,OAAOyB,IAAI,CAAC;IACd;IAEA,IAAIpC,OAAOmB,IAAI,KAAK,OAAO;QACzB,MAAMyB,aAAarD,wBAAwB;YAAEsD,kBAAkB7C,OAAO6C,gBAAgB;QAAC,GAAG;YAAEC,aAAa;YAAYC,oBAAoB;QAAa;QACtJnB,IAAIC,GAAG,CAAC,UAAUjC,QAAQgD;IAC5B;IAEA,IAAI1C,QAAQO,IAAI,CAACO,aAAa,CAACgC,SAAS,EAAE;QACxCpB,IAAIC,GAAG,CAAC,KAAKjC,QAAQM,QAAQO,IAAI,CAACO,aAAa,CAACgC,SAAS;QACzDrC,OAAOyB,IAAI,CAAC;IACd;IAEAzB,OAAOyB,IAAI,CAAC;IAEZ,OAAO;QACLE;QACAb;QACAd;QACA0B,OAAO;YACL,MAAMA;YACN,MAAMnC,QAAQmC,KAAK;QACrB;IACF;AACF"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-gmail/src/setup/http.ts"],"sourcesContent":["import { composeMiddleware, connectHttp, createFileServingRouter, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport cors from 'cors';\nimport express from 'express';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createHTTPServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n  const port = config.transport.port;\n  if (!port) throw new Error('Port is required for HTTP transport');\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const filteredTools =\n    config.auth === 'dcr'\n      ? tools.filter((tool) => tool.name !== 'messages-export-csv') // No file storage in DCR (public cloud responsibility)\n      : tools;\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version });\n    registerTools(mcpServer, filteredTools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  const app = express();\n  app.use(express.json({ limit: '10mb' }));\n\n  // Must mount '/mcp' before any permissive app-level cors(), or that layer answers its\n  // preflight first; pass baseUrl's origin/host below or a public deployment 403s itself.\n  const publicUrl = config.baseUrl ? new URL(config.baseUrl) : undefined;\n  logger.info(`Starting ${config.name} MCP server (http)`);\n  const { close, httpServer } = await connectHttp(buildServer, {\n    logger,\n    app,\n    port,\n    allowedOrigins: publicUrl ? [publicUrl.origin] : undefined,\n    allowedHosts: publicUrl ? [publicUrl.host] : undefined,\n  });\n\n  // The loopback OAuth callback, the file-export download, and the DCR discovery/\n  // registration endpoints are all meant to be reached from a browser on another\n  // origin. Keep cors() for them, scoped to their own routes - never in front of '/mcp'.\n  if (runtime.deps.oauthAdapters.loopbackRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.loopbackRouter);\n    logger.info('Mounted loopback OAuth callback router');\n  }\n\n  if (config.auth !== 'dcr') {\n    const fileRouter = createFileServingRouter({ resourceStoreUri: config.resourceStoreUri }, { contentType: 'text/csv', contentDisposition: 'attachment' });\n    app.use('/files', cors(), fileRouter);\n  }\n\n  if (runtime.deps.oauthAdapters.dcrRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.dcrRouter);\n    logger.info('Mounted DCR router with OAuth endpoints');\n  }\n\n  logger.info('http transport ready');\n\n  return {\n    httpServer,\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["composeMiddleware","connectHttp","createFileServingRouter","McpServer","registerPrompts","registerResources","registerTools","cors","express","createDefaultRuntime","createHTTPServer","config","overrides","runtime","modules","createDomainModules","layers","middlewareFactories","map","factory","deps","composed","logger","port","transport","Error","tools","oauthAdapters","accountTools","filteredTools","auth","filter","tool","name","prompts","accountPrompts","buildServer","mcpServer","version","resources","app","use","json","limit","publicUrl","baseUrl","URL","undefined","info","close","httpServer","allowedOrigins","origin","allowedHosts","host","loopbackRouter","fileRouter","resourceStoreUri","contentType","contentDisposition","dcrRouter"],"mappings":"AAAA,SAASA,iBAAiB,EAAEC,WAAW,EAAEC,uBAAuB,EAAEC,SAAS,EAAEC,eAAe,EAAEC,iBAAiB,EAAEC,aAAa,QAAQ,gBAAgB;AACtJ,OAAOC,UAAU,OAAO;AACxB,OAAOC,aAAa,UAAU;AAE9B,SAASC,oBAAoB,QAAQ,eAAe;AAEpD,OAAO,eAAeC,iBAAiBC,MAAoB,EAAEC,SAA4B;IACvF,MAAMC,UAAU,MAAMJ,qBAAqBE,QAAQC;IACnD,MAAME,UAAUD,QAAQE,mBAAmB;IAC3C,MAAMC,SAASH,QAAQI,mBAAmB,CAACC,GAAG,CAAC,CAACC,UAAYA,QAAQN,QAAQO,IAAI;IAChF,MAAMC,WAAWrB,kBAAkBc,SAASE;IAC5C,MAAMM,SAAST,QAAQO,IAAI,CAACE,MAAM;IAClC,MAAMC,OAAOZ,OAAOa,SAAS,CAACD,IAAI;IAClC,IAAI,CAACA,MAAM,MAAM,IAAIE,MAAM;IAE3B,MAAMC,QAAQ;WAAIL,SAASK,KAAK;WAAKb,QAAQO,IAAI,CAACO,aAAa,CAACC,YAAY;KAAC;IAC7E,MAAMC,gBACJlB,OAAOmB,IAAI,KAAK,QACZJ,MAAMK,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAK,uBAAuB,uDAAuD;OACnHP;IACN,MAAMQ,UAAU;WAAIb,SAASa,OAAO;WAAKrB,QAAQO,IAAI,CAACO,aAAa,CAACQ,cAAc;KAAC;IAEnF,sFAAsF;IACtF,yFAAyF;IACzF,2FAA2F;IAC3F,4EAA4E;IAC5E,MAAMC,cAAc;QAClB,MAAMC,YAAY,IAAIlC,UAAU;YAAE8B,MAAMtB,OAAOsB,IAAI;YAAEK,SAAS3B,OAAO2B,OAAO;QAAC;QAC7EhC,cAAc+B,WAAWR;QACzBxB,kBAAkBgC,WAAWhB,SAASkB,SAAS;QAC/CnC,gBAAgBiC,WAAWH;QAC3B,OAAOG;IACT;IAEA,MAAMG,MAAMhC;IACZgC,IAAIC,GAAG,CAACjC,QAAQkC,IAAI,CAAC;QAAEC,OAAO;IAAO;IAErC,sFAAsF;IACtF,wFAAwF;IACxF,MAAMC,YAAYjC,OAAOkC,OAAO,GAAG,IAAIC,IAAInC,OAAOkC,OAAO,IAAIE;IAC7DzB,OAAO0B,IAAI,CAAC,CAAC,SAAS,EAAErC,OAAOsB,IAAI,CAAC,kBAAkB,CAAC;IACvD,MAAM,EAAEgB,KAAK,EAAEC,UAAU,EAAE,GAAG,MAAMjD,YAAYmC,aAAa;QAC3Dd;QACAkB;QACAjB;QACA4B,gBAAgBP,YAAY;YAACA,UAAUQ,MAAM;SAAC,GAAGL;QACjDM,cAAcT,YAAY;YAACA,UAAUU,IAAI;SAAC,GAAGP;IAC/C;IAEA,gFAAgF;IAChF,+EAA+E;IAC/E,uFAAuF;IACvF,IAAIlC,QAAQO,IAAI,CAACO,aAAa,CAAC4B,cAAc,EAAE;QAC7Cf,IAAIC,GAAG,CAAC,KAAKlC,QAAQM,QAAQO,IAAI,CAACO,aAAa,CAAC4B,cAAc;QAC9DjC,OAAO0B,IAAI,CAAC;IACd;IAEA,IAAIrC,OAAOmB,IAAI,KAAK,OAAO;QACzB,MAAM0B,aAAatD,wBAAwB;YAAEuD,kBAAkB9C,OAAO8C,gBAAgB;QAAC,GAAG;YAAEC,aAAa;YAAYC,oBAAoB;QAAa;QACtJnB,IAAIC,GAAG,CAAC,UAAUlC,QAAQiD;IAC5B;IAEA,IAAI3C,QAAQO,IAAI,CAACO,aAAa,CAACiC,SAAS,EAAE;QACxCpB,IAAIC,GAAG,CAAC,KAAKlC,QAAQM,QAAQO,IAAI,CAACO,aAAa,CAACiC,SAAS;QACzDtC,OAAO0B,IAAI,CAAC;IACd;IAEA1B,OAAO0B,IAAI,CAAC;IAEZ,OAAO;QACLE;QACA5B;QACA2B,OAAO;YACL,MAAMA;YACN,MAAMpC,QAAQoC,KAAK;QACrB;IACF;AACF"}

package/dist/esm/setup/stdio.d.ts

@@ -1,7 +1,5 @@
-import { McpServer } from '@mcp-z/server';
 import type { RuntimeOverrides, ServerConfig } from '../types.js';
 export declare function createStdioServer(config: ServerConfig, overrides?: RuntimeOverrides): Promise<{
-    mcpServer: McpServer;
     logger: import("@mcp-z/server").Logger;
     close: () => Promise<void>;
 }>;

package/dist/esm/setup/stdio.js

@@ -16,20 +16,26 @@ export async function createStdioServer(config, overrides) {
         ...composed.prompts,
         ...runtime.deps.oauthAdapters.accountPrompts
     ];
-    const mcpServer = new McpServer({
-        name: config.name,
-        version: config.version
-    });
-    registerTools(mcpServer, filteredTools);
-    registerResources(mcpServer, composed.resources);
-    registerPrompts(mcpServer, prompts);
+    // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the
+    // negotiated protocol revision on the McpServer instance - its own docs say a negotiated
+    // session never re-routes a method onto the other era - so one shared instance pins itself
+    // to whichever revision reaches it first and answers the other with -32601.
+    const buildServer = ()=>{
+        const mcpServer = new McpServer({
+            name: config.name,
+            version: config.version
+        });
+        registerTools(mcpServer, filteredTools);
+        registerResources(mcpServer, composed.resources);
+        registerPrompts(mcpServer, prompts);
+        return mcpServer;
+    };
     logger.info(`Starting ${config.name} MCP server (stdio)`);
-    const { close } = await connectStdio(mcpServer, {
+    const { close } = await connectStdio(buildServer, {
         logger
     });
     logger.info('stdio transport ready');
     return {
-        mcpServer,
         logger,
         close: async ()=>{
             await close();

package/dist/esm/setup/stdio.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-gmail/src/setup/stdio.ts"],"sourcesContent":["import { composeMiddleware, connectStdio, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createStdioServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const filteredTools =\n    config.auth === 'dcr'\n      ? tools.filter((tool) => tool.name !== 'messages-export-csv') // No file storage in DCR (public cloud responsibility)\n      : tools;\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  const mcpServer = new McpServer({ name: config.name, version: config.version });\n  registerTools(mcpServer, filteredTools);\n  registerResources(mcpServer, composed.resources);\n  registerPrompts(mcpServer, prompts);\n\n  logger.info(`Starting ${config.name} MCP server (stdio)`);\n  const { close } = await connectStdio(mcpServer, { logger });\n  logger.info('stdio transport ready');\n\n  return {\n    mcpServer,\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["composeMiddleware","connectStdio","McpServer","registerPrompts","registerResources","registerTools","createDefaultRuntime","createStdioServer","config","overrides","runtime","modules","createDomainModules","layers","middlewareFactories","map","factory","deps","composed","logger","tools","oauthAdapters","accountTools","filteredTools","auth","filter","tool","name","prompts","accountPrompts","mcpServer","version","resources","info","close"],"mappings":"AAAA,SAASA,iBAAiB,EAAEC,YAAY,EAAEC,SAAS,EAAEC,eAAe,EAAEC,iBAAiB,EAAEC,aAAa,QAAQ,gBAAgB;AAE9H,SAASC,oBAAoB,QAAQ,eAAe;AAEpD,OAAO,eAAeC,kBAAkBC,MAAoB,EAAEC,SAA4B;IACxF,MAAMC,UAAU,MAAMJ,qBAAqBE,QAAQC;IACnD,MAAME,UAAUD,QAAQE,mBAAmB;IAC3C,MAAMC,SAASH,QAAQI,mBAAmB,CAACC,GAAG,CAAC,CAACC,UAAYA,QAAQN,QAAQO,IAAI;IAChF,MAAMC,WAAWlB,kBAAkBW,SAASE;IAC5C,MAAMM,SAAST,QAAQO,IAAI,CAACE,MAAM;IAElC,MAAMC,QAAQ;WAAIF,SAASE,KAAK;WAAKV,QAAQO,IAAI,CAACI,aAAa,CAACC,YAAY;KAAC;IAC7E,MAAMC,gBACJf,OAAOgB,IAAI,KAAK,QACZJ,MAAMK,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAK,uBAAuB,uDAAuD;OACnHP;IACN,MAAMQ,UAAU;WAAIV,SAASU,OAAO;WAAKlB,QAAQO,IAAI,CAACI,aAAa,CAACQ,cAAc;KAAC;IAEnF,MAAMC,YAAY,IAAI5B,UAAU;QAAEyB,MAAMnB,OAAOmB,IAAI;QAAEI,SAASvB,OAAOuB,OAAO;IAAC;IAC7E1B,cAAcyB,WAAWP;IACzBnB,kBAAkB0B,WAAWZ,SAASc,SAAS;IAC/C7B,gBAAgB2B,WAAWF;IAE3BT,OAAOc,IAAI,CAAC,CAAC,SAAS,EAAEzB,OAAOmB,IAAI,CAAC,mBAAmB,CAAC;IACxD,MAAM,EAAEO,KAAK,EAAE,GAAG,MAAMjC,aAAa6B,WAAW;QAAEX;IAAO;IACzDA,OAAOc,IAAI,CAAC;IAEZ,OAAO;QACLH;QACAX;QACAe,OAAO;YACL,MAAMA;YACN,MAAMxB,QAAQwB,KAAK;QACrB;IACF;AACF"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-gmail/src/setup/stdio.ts"],"sourcesContent":["import { composeMiddleware, connectStdio, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createStdioServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const filteredTools =\n    config.auth === 'dcr'\n      ? tools.filter((tool) => tool.name !== 'messages-export-csv') // No file storage in DCR (public cloud responsibility)\n      : tools;\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version });\n    registerTools(mcpServer, filteredTools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  logger.info(`Starting ${config.name} MCP server (stdio)`);\n  const { close } = await connectStdio(buildServer, { logger });\n  logger.info('stdio transport ready');\n\n  return {\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["composeMiddleware","connectStdio","McpServer","registerPrompts","registerResources","registerTools","createDefaultRuntime","createStdioServer","config","overrides","runtime","modules","createDomainModules","layers","middlewareFactories","map","factory","deps","composed","logger","tools","oauthAdapters","accountTools","filteredTools","auth","filter","tool","name","prompts","accountPrompts","buildServer","mcpServer","version","resources","info","close"],"mappings":"AAAA,SAASA,iBAAiB,EAAEC,YAAY,EAAEC,SAAS,EAAEC,eAAe,EAAEC,iBAAiB,EAAEC,aAAa,QAAQ,gBAAgB;AAE9H,SAASC,oBAAoB,QAAQ,eAAe;AAEpD,OAAO,eAAeC,kBAAkBC,MAAoB,EAAEC,SAA4B;IACxF,MAAMC,UAAU,MAAMJ,qBAAqBE,QAAQC;IACnD,MAAME,UAAUD,QAAQE,mBAAmB;IAC3C,MAAMC,SAASH,QAAQI,mBAAmB,CAACC,GAAG,CAAC,CAACC,UAAYA,QAAQN,QAAQO,IAAI;IAChF,MAAMC,WAAWlB,kBAAkBW,SAASE;IAC5C,MAAMM,SAAST,QAAQO,IAAI,CAACE,MAAM;IAElC,MAAMC,QAAQ;WAAIF,SAASE,KAAK;WAAKV,QAAQO,IAAI,CAACI,aAAa,CAACC,YAAY;KAAC;IAC7E,MAAMC,gBACJf,OAAOgB,IAAI,KAAK,QACZJ,MAAMK,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAK,uBAAuB,uDAAuD;OACnHP;IACN,MAAMQ,UAAU;WAAIV,SAASU,OAAO;WAAKlB,QAAQO,IAAI,CAACI,aAAa,CAACQ,cAAc;KAAC;IAEnF,sFAAsF;IACtF,yFAAyF;IACzF,2FAA2F;IAC3F,4EAA4E;IAC5E,MAAMC,cAAc;QAClB,MAAMC,YAAY,IAAI7B,UAAU;YAAEyB,MAAMnB,OAAOmB,IAAI;YAAEK,SAASxB,OAAOwB,OAAO;QAAC;QAC7E3B,cAAc0B,WAAWR;QACzBnB,kBAAkB2B,WAAWb,SAASe,SAAS;QAC/C9B,gBAAgB4B,WAAWH;QAC3B,OAAOG;IACT;IAEAZ,OAAOe,IAAI,CAAC,CAAC,SAAS,EAAE1B,OAAOmB,IAAI,CAAC,mBAAmB,CAAC;IACxD,MAAM,EAAEQ,KAAK,EAAE,GAAG,MAAMlC,aAAa6B,aAAa;QAAEX;IAAO;IAC3DA,OAAOe,IAAI,CAAC;IAEZ,OAAO;QACLf;QACAgB,OAAO;YACL,MAAMA;YACN,MAAMzB,QAAQyB,KAAK;QACrB;IACF;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-z/mcp-gmail",
-  "version": "2.1.1",
+  "version": "2.2.0",
   "description": "MCP server for Gmail integration with OAuth authentication, message search, batch operations, and Google Sheets export",
   "keywords": [
     "gmail",
@@ -71,7 +71,7 @@
     "@mcp-z/email": "^1.0.0",
     "@mcp-z/oauth": "^2.0.0",
     "@mcp-z/oauth-google": "^2.0.1",
-    "@mcp-z/server": "^2.0.0",
+    "@mcp-z/server": "^2.1.0",
     "cors": "^2.0.0",
     "csv-stringify": "^6.0.0",
     "express": "^5.0.0",