@mcp-z/mcp-sheets 2.2.0 → 2.3.1

package/README.md

@@ -2,6 +2,8 @@
 
 MCP server for Google Sheets integration with OAuth authentication, spreadsheet management, batch operations, and advanced formatting
 
+Requires Node.js >=20. The examples use `npx`, included with npm, to run this server and `@mcp-z/cli`.
+
 ## Common uses
 
 - Find spreadsheets and sheets
@@ -12,6 +14,11 @@ MCP server for Google Sheets integration with OAuth authentication, spreadsheet
 
 MCP supports stdio and HTTP.
 
+Both the 2025 and 2026-07-28 protocol revisions are served, over either transport, from the same
+server. Your client negotiates whichever it speaks. A 2025 client keeps working with no change,
+and support for it is not being dropped. The 2026-07-28 revision is stateless, so a client speaking
+it sends no `initialize` handshake and carries no session id.
+
 **Stdio**
 ```json
 {
@@ -40,7 +47,7 @@ MCP supports stdio and HTTP.
 }
 ```
 
-`start` is an extension used by `npx @mcp-z/cli up` to launch HTTP servers for you.
+`start` is an extension used by `npx @mcp-z/cli up` to launch HTTP servers for you. The HTTP endpoint is `/mcp`.
 
 ## Create a Google Cloud app
 
@@ -49,10 +56,10 @@ MCP supports stdio and HTTP.
 3. Enable the Google Sheets API.
 4. Create OAuth 2.0 credentials (Desktop app).
 5. Copy the Client ID and Client Secret.
-6. Select your MCP transport (stdio for local and http for remote) and platform
-- For stdio, choose "APIs & Services", + Create client, "Desktop app" type
-- For http, choose "APIs & Services", + Create client, "Web application" type, add your URL (default is http://localhost:3000/oauth/callback based on the --port or PORT)
-- For local hosting, add "http://127.0.0.1" for [Ephemeral redirect URL](https://en.wikipedia.org/wiki/Ephemeral_port)
+6. Select the credential type that matches your transport:
+   - For stdio, choose "Desktop app" under APIs & Services.
+   - For HTTP, choose "Web application" and add your public `/oauth/callback` URL. Local HTTP uses the port configured with `--port` or `PORT`.
+   - For local hosting, add `http://127.0.0.1` for the [ephemeral redirect URL](https://en.wikipedia.org/wiki/Ephemeral_port).
 7. Enable OAuth2 [scopes](https://console.cloud.google.com/auth/scopes): openid https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/drive
 8. Add [test emails](https://console.cloud.google.com/auth/audience)
 
@@ -90,7 +97,7 @@ Example (http) - Create .mcp.json:
   "mcpServers": {
     "sheets": {
       "type": "http",
-      "url": "http://localhost:3000",
+      "url": "http://localhost:3000/mcp",
       "start": {
         "command": "npx",
         "args": ["-y", "@mcp-z/mcp-sheets", "--port=3000"],
@@ -105,7 +112,7 @@ Example (http) - Create .mcp.json:
 
 Local (default): omit REDIRECT_URI → ephemeral loopback. Cloud: set REDIRECT_URI to your public /oauth/callback and expose the service publicly.
 
-Note: start block is a helper in "npx @mcp-z/cli up" for starting an http server from your .mpc.json. See [@mcp-z/cli](https://github.com/mcp-z/cli) for details.
+Note: the `start` block is a helper in `npx @mcp-z/cli up` for starting an HTTP server from your `.mcp.json`. See [@mcp-z/cli](https://github.com/mcp-z/cli) for details.
 
 ### Service account
 
@@ -160,10 +167,10 @@ HTTP only. Requires a public base URL.
 
 ```bash
 # List tools
-mcp-z inspect --servers sheets --tools
+npx -y @mcp-z/cli inspect --servers sheets --tools
 
 # Find a spreadsheet
-mcp-z call sheets spreadsheet-find '{"spreadsheetRef":"Quarterly Report"}'
+npx -y @mcp-z/cli call-tool sheets spreadsheet-find '{"spreadsheetRef":"Quarterly Report"}'
 ```
 
 ## Tools
@@ -206,7 +213,7 @@ mcp-z call sheets spreadsheet-find '{"spreadsheetRef":"Quarterly Report"}'
 
 ## Configuration reference
 
-See `server.json` for all supported environment variables, CLI arguments, and defaults.
+See [`server.json`](https://github.com/mcp-z/mcp-sheets/blob/master/server.json) for all supported environment variables, CLI arguments, and defaults.
 
 ## Storage backends
 
@@ -224,6 +231,6 @@ TOKEN_STORE_URI=redis://localhost:6379 mcp-sheets
 
 A protocol whose adapter is missing fails at startup naming the package to install.
 
-### Documentation
+## Documentation
 
 [API Docs](https://mcp-z.github.io/mcp-sheets)

package/dist/cjs/setup/http.js

@@ -199,6 +199,8 @@ function createHTTPServer(config, overrides) {
                         var mcpServer = new _server.McpServer({
                             name: config.name,
                             version: config.version
+                        }, {
+                            cacheHints: _server.defaultCacheHints
                         });
                         (0, _server.registerTools)(mcpServer, tools);
                         (0, _server.registerResources)(mcpServer, composed.resources);

package/dist/cjs/setup/http.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-sheets/src/setup/http.ts"],"sourcesContent":["import { composeMiddleware, connectHttp, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport cors from 'cors';\nimport express from 'express';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createHTTPServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n  const port = config.transport.port;\n  if (!port) throw new Error('Port is required for HTTP transport');\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version });\n    registerTools(mcpServer, tools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  const app = express();\n  app.use(express.json({ limit: '10mb' }));\n\n  // Must mount '/mcp' before any permissive app-level cors(), or that layer answers its\n  // preflight first; pass baseUrl's origin/host below or a public deployment 403s itself.\n  const publicUrl = config.baseUrl ? new URL(config.baseUrl) : undefined;\n  logger.info(`Starting ${config.name} MCP server (http)`);\n  const { close, httpServer } = await connectHttp(buildServer, {\n    logger,\n    app,\n    port,\n    allowedOrigins: publicUrl ? [publicUrl.origin] : undefined,\n    allowedHosts: publicUrl ? [publicUrl.host] : undefined,\n  });\n\n  // The loopback OAuth callback and the DCR discovery/registration endpoints are\n  // meant to be reached from a browser on another origin. Keep cors() for them,\n  // scoped to their own routes - never in front of '/mcp'.\n  if (runtime.deps.oauthAdapters.loopbackRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.loopbackRouter);\n    logger.info('Mounted loopback OAuth callback router');\n  }\n\n  if (runtime.deps.oauthAdapters.dcrRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.dcrRouter);\n    logger.info('Mounted DCR router with OAuth endpoints');\n  }\n\n  logger.info('http transport ready');\n\n  return {\n    httpServer,\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["createHTTPServer","config","overrides","runtime","modules","layers","composed","logger","port","tools","prompts","buildServer","app","publicUrl","close","httpServer","createDefaultRuntime","createDomainModules","middlewareFactories","map","factory","deps","composeMiddleware","transport","Error","oauthAdapters","accountTools","accountPrompts","mcpServer","McpServer","name","version","registerTools","registerResources","resources","registerPrompts","express","use","json","limit","baseUrl","URL","undefined","info","connectHttp","allowedOrigins","origin","allowedHosts","host","loopbackRouter","cors","dcrRouter"],"mappings":";;;;+BAMsBA;;;eAAAA;;;sBANuF;2DAC5F;8DACG;yBAEiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAE9B,SAAeA,iBAAiBC,MAAoB,EAAEC,SAA4B;;YACjFC,SACAC,SACAC,QACAC,UACAC,QACAC,MAGAC,OACAC,SAMAC,aAQAC,KAKAC,WAEwB,MAAtBC,OAAOC;;;;oBA9BC;;wBAAMC,IAAAA,+BAAoB,EAACf,QAAQC;;;oBAA7CC,UAAU;oBACVC,UAAUD,QAAQc,mBAAmB;oBACrCZ,SAASF,QAAQe,mBAAmB,CAACC,GAAG,CAAC,SAACC;+BAAYA,QAAQjB,QAAQkB,IAAI;;oBAC1Ef,WAAWgB,IAAAA,yBAAiB,EAAClB,SAASC;oBACtCE,SAASJ,QAAQkB,IAAI,CAACd,MAAM;oBAC5BC,OAAOP,OAAOsB,SAAS,CAACf,IAAI;oBAClC,IAAI,CAACA,MAAM,MAAM,IAAIgB,MAAM;oBAErBf,QAAQ,AAAC,qBAAGH,SAASG,KAAK,SAAE,qBAAGN,QAAQkB,IAAI,CAACI,aAAa,CAACC,YAAY;oBACtEhB,UAAU,AAAC,qBAAGJ,SAASI,OAAO,SAAE,qBAAGP,QAAQkB,IAAI,CAACI,aAAa,CAACE,cAAc;oBAElF,sFAAsF;oBACtF,yFAAyF;oBACzF,2FAA2F;oBAC3F,4EAA4E;oBACtEhB,cAAc;wBAClB,IAAMiB,YAAY,IAAIC,iBAAS,CAAC;4BAAEC,MAAM7B,OAAO6B,IAAI;4BAAEC,SAAS9B,OAAO8B,OAAO;wBAAC;wBAC7EC,IAAAA,qBAAa,EAACJ,WAAWnB;wBACzBwB,IAAAA,yBAAiB,EAACL,WAAWtB,SAAS4B,SAAS;wBAC/CC,IAAAA,uBAAe,EAACP,WAAWlB;wBAC3B,OAAOkB;oBACT;oBAEMhB,MAAMwB,IAAAA,gBAAO;oBACnBxB,IAAIyB,GAAG,CAACD,gBAAO,CAACE,IAAI,CAAC;wBAAEC,OAAO;oBAAO;oBAErC,sFAAsF;oBACtF,wFAAwF;oBAClF1B,YAAYZ,OAAOuC,OAAO,GAAG,IAAIC,IAAIxC,OAAOuC,OAAO,IAAIE;oBAC7DnC,OAAOoC,IAAI,CAAC,AAAC,YAAuB,OAAZ1C,OAAO6B,IAAI,EAAC;oBACN;;wBAAMc,IAAAA,mBAAW,EAACjC,aAAa;4BAC3DJ,QAAAA;4BACAK,KAAAA;4BACAJ,MAAAA;4BACAqC,gBAAgBhC;gCAAaA,UAAUiC,MAAM;gCAAIJ;4BACjDK,cAAclC;gCAAaA,UAAUmC,IAAI;gCAAIN;wBAC/C;;;oBAN8B,OAAA,eAAtB5B,QAAsB,KAAtBA,OAAOC,aAAe,KAAfA;oBAQf,+EAA+E;oBAC/E,8EAA8E;oBAC9E,yDAAyD;oBACzD,IAAIZ,QAAQkB,IAAI,CAACI,aAAa,CAACwB,cAAc,EAAE;wBAC7CrC,IAAIyB,GAAG,CAAC,KAAKa,IAAAA,aAAI,KAAI/C,QAAQkB,IAAI,CAACI,aAAa,CAACwB,cAAc;wBAC9D1C,OAAOoC,IAAI,CAAC;oBACd;oBAEA,IAAIxC,QAAQkB,IAAI,CAACI,aAAa,CAAC0B,SAAS,EAAE;wBACxCvC,IAAIyB,GAAG,CAAC,KAAKa,IAAAA,aAAI,KAAI/C,QAAQkB,IAAI,CAACI,aAAa,CAAC0B,SAAS;wBACzD5C,OAAOoC,IAAI,CAAC;oBACd;oBAEApC,OAAOoC,IAAI,CAAC;oBAEZ;;wBAAO;4BACL5B,YAAAA;4BACAR,QAAAA;4BACAO,OAAO,SAAPA;;;;;gDACE;;oDAAMA;;;gDAAN;gDACA;;oDAAMX,QAAQW,KAAK;;;gDAAnB;;;;;;gCACF;;wBACF;;;;IACF"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-sheets/src/setup/http.ts"],"sourcesContent":["import { composeMiddleware, connectHttp, defaultCacheHints, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport cors from 'cors';\nimport express from 'express';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createHTTPServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n  const port = config.transport.port;\n  if (!port) throw new Error('Port is required for HTTP transport');\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version }, { cacheHints: defaultCacheHints });\n    registerTools(mcpServer, tools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  const app = express();\n  app.use(express.json({ limit: '10mb' }));\n\n  // Must mount '/mcp' before any permissive app-level cors(), or that layer answers its\n  // preflight first; pass baseUrl's origin/host below or a public deployment 403s itself.\n  const publicUrl = config.baseUrl ? new URL(config.baseUrl) : undefined;\n  logger.info(`Starting ${config.name} MCP server (http)`);\n  const { close, httpServer } = await connectHttp(buildServer, {\n    logger,\n    app,\n    port,\n    allowedOrigins: publicUrl ? [publicUrl.origin] : undefined,\n    allowedHosts: publicUrl ? [publicUrl.host] : undefined,\n  });\n\n  // The loopback OAuth callback and the DCR discovery/registration endpoints are\n  // meant to be reached from a browser on another origin. Keep cors() for them,\n  // scoped to their own routes - never in front of '/mcp'.\n  if (runtime.deps.oauthAdapters.loopbackRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.loopbackRouter);\n    logger.info('Mounted loopback OAuth callback router');\n  }\n\n  if (runtime.deps.oauthAdapters.dcrRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.dcrRouter);\n    logger.info('Mounted DCR router with OAuth endpoints');\n  }\n\n  logger.info('http transport ready');\n\n  return {\n    httpServer,\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["createHTTPServer","config","overrides","runtime","modules","layers","composed","logger","port","tools","prompts","buildServer","app","publicUrl","close","httpServer","createDefaultRuntime","createDomainModules","middlewareFactories","map","factory","deps","composeMiddleware","transport","Error","oauthAdapters","accountTools","accountPrompts","mcpServer","McpServer","name","version","cacheHints","defaultCacheHints","registerTools","registerResources","resources","registerPrompts","express","use","json","limit","baseUrl","URL","undefined","info","connectHttp","allowedOrigins","origin","allowedHosts","host","loopbackRouter","cors","dcrRouter"],"mappings":";;;;+BAMsBA;;;eAAAA;;;sBAN0G;2DAC/G;8DACG;yBAEiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAE9B,SAAeA,iBAAiBC,MAAoB,EAAEC,SAA4B;;YACjFC,SACAC,SACAC,QACAC,UACAC,QACAC,MAGAC,OACAC,SAMAC,aAQAC,KAKAC,WAEwB,MAAtBC,OAAOC;;;;oBA9BC;;wBAAMC,IAAAA,+BAAoB,EAACf,QAAQC;;;oBAA7CC,UAAU;oBACVC,UAAUD,QAAQc,mBAAmB;oBACrCZ,SAASF,QAAQe,mBAAmB,CAACC,GAAG,CAAC,SAACC;+BAAYA,QAAQjB,QAAQkB,IAAI;;oBAC1Ef,WAAWgB,IAAAA,yBAAiB,EAAClB,SAASC;oBACtCE,SAASJ,QAAQkB,IAAI,CAACd,MAAM;oBAC5BC,OAAOP,OAAOsB,SAAS,CAACf,IAAI;oBAClC,IAAI,CAACA,MAAM,MAAM,IAAIgB,MAAM;oBAErBf,QAAQ,AAAC,qBAAGH,SAASG,KAAK,SAAE,qBAAGN,QAAQkB,IAAI,CAACI,aAAa,CAACC,YAAY;oBACtEhB,UAAU,AAAC,qBAAGJ,SAASI,OAAO,SAAE,qBAAGP,QAAQkB,IAAI,CAACI,aAAa,CAACE,cAAc;oBAElF,sFAAsF;oBACtF,yFAAyF;oBACzF,2FAA2F;oBAC3F,4EAA4E;oBACtEhB,cAAc;wBAClB,IAAMiB,YAAY,IAAIC,iBAAS,CAAC;4BAAEC,MAAM7B,OAAO6B,IAAI;4BAAEC,SAAS9B,OAAO8B,OAAO;wBAAC,GAAG;4BAAEC,YAAYC,yBAAiB;wBAAC;wBAChHC,IAAAA,qBAAa,EAACN,WAAWnB;wBACzB0B,IAAAA,yBAAiB,EAACP,WAAWtB,SAAS8B,SAAS;wBAC/CC,IAAAA,uBAAe,EAACT,WAAWlB;wBAC3B,OAAOkB;oBACT;oBAEMhB,MAAM0B,IAAAA,gBAAO;oBACnB1B,IAAI2B,GAAG,CAACD,gBAAO,CAACE,IAAI,CAAC;wBAAEC,OAAO;oBAAO;oBAErC,sFAAsF;oBACtF,wFAAwF;oBAClF5B,YAAYZ,OAAOyC,OAAO,GAAG,IAAIC,IAAI1C,OAAOyC,OAAO,IAAIE;oBAC7DrC,OAAOsC,IAAI,CAAC,AAAC,YAAuB,OAAZ5C,OAAO6B,IAAI,EAAC;oBACN;;wBAAMgB,IAAAA,mBAAW,EAACnC,aAAa;4BAC3DJ,QAAAA;4BACAK,KAAAA;4BACAJ,MAAAA;4BACAuC,gBAAgBlC;gCAAaA,UAAUmC,MAAM;gCAAIJ;4BACjDK,cAAcpC;gCAAaA,UAAUqC,IAAI;gCAAIN;wBAC/C;;;oBAN8B,OAAA,eAAtB9B,QAAsB,KAAtBA,OAAOC,aAAe,KAAfA;oBAQf,+EAA+E;oBAC/E,8EAA8E;oBAC9E,yDAAyD;oBACzD,IAAIZ,QAAQkB,IAAI,CAACI,aAAa,CAAC0B,cAAc,EAAE;wBAC7CvC,IAAI2B,GAAG,CAAC,KAAKa,IAAAA,aAAI,KAAIjD,QAAQkB,IAAI,CAACI,aAAa,CAAC0B,cAAc;wBAC9D5C,OAAOsC,IAAI,CAAC;oBACd;oBAEA,IAAI1C,QAAQkB,IAAI,CAACI,aAAa,CAAC4B,SAAS,EAAE;wBACxCzC,IAAI2B,GAAG,CAAC,KAAKa,IAAAA,aAAI,KAAIjD,QAAQkB,IAAI,CAACI,aAAa,CAAC4B,SAAS;wBACzD9C,OAAOsC,IAAI,CAAC;oBACd;oBAEAtC,OAAOsC,IAAI,CAAC;oBAEZ;;wBAAO;4BACL9B,YAAAA;4BACAR,QAAAA;4BACAO,OAAO,SAAPA;;;;;gDACE;;oDAAMA;;;gDAAN;gDACA;;oDAAMX,QAAQW,KAAK;;;gDAAnB;;;;;;gCACF;;wBACF;;;;IACF"}

package/dist/cjs/setup/stdio.js

@@ -190,6 +190,8 @@ function createStdioServer(config, overrides) {
                         var mcpServer = new _server.McpServer({
                             name: config.name,
                             version: config.version
+                        }, {
+                            cacheHints: _server.defaultCacheHints
                         });
                         (0, _server.registerTools)(mcpServer, tools);
                         (0, _server.registerResources)(mcpServer, composed.resources);

package/dist/cjs/setup/stdio.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-sheets/src/setup/stdio.ts"],"sourcesContent":["import { composeMiddleware, connectStdio, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createStdioServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version });\n    registerTools(mcpServer, tools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  logger.info(`Starting ${config.name} MCP server (stdio)`);\n  const { close } = await connectStdio(buildServer, { logger });\n  logger.info('stdio transport ready');\n\n  return {\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["createStdioServer","config","overrides","runtime","modules","layers","composed","logger","tools","prompts","buildServer","close","createDefaultRuntime","createDomainModules","middlewareFactories","map","factory","deps","composeMiddleware","oauthAdapters","accountTools","accountPrompts","mcpServer","McpServer","name","version","registerTools","registerResources","resources","registerPrompts","info","connectStdio"],"mappings":";;;;+BAIsBA;;;eAAAA;;;sBAJwF;yBAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAE9B,SAAeA,kBAAkBC,MAAoB,EAAEC,SAA4B;;YAClFC,SACAC,SACAC,QACAC,UACAC,QAEAC,OACAC,SAMAC,aASEC;;;;oBAtBQ;;wBAAMC,IAAAA,+BAAoB,EAACX,QAAQC;;;oBAA7CC,UAAU;oBACVC,UAAUD,QAAQU,mBAAmB;oBACrCR,SAASF,QAAQW,mBAAmB,CAACC,GAAG,CAAC,SAACC;+BAAYA,QAAQb,QAAQc,IAAI;;oBAC1EX,WAAWY,IAAAA,yBAAiB,EAACd,SAASC;oBACtCE,SAASJ,QAAQc,IAAI,CAACV,MAAM;oBAE5BC,QAAQ,AAAC,qBAAGF,SAASE,KAAK,SAAE,qBAAGL,QAAQc,IAAI,CAACE,aAAa,CAACC,YAAY;oBACtEX,UAAU,AAAC,qBAAGH,SAASG,OAAO,SAAE,qBAAGN,QAAQc,IAAI,CAACE,aAAa,CAACE,cAAc;oBAElF,sFAAsF;oBACtF,yFAAyF;oBACzF,2FAA2F;oBAC3F,4EAA4E;oBACtEX,cAAc;wBAClB,IAAMY,YAAY,IAAIC,iBAAS,CAAC;4BAAEC,MAAMvB,OAAOuB,IAAI;4BAAEC,SAASxB,OAAOwB,OAAO;wBAAC;wBAC7EC,IAAAA,qBAAa,EAACJ,WAAWd;wBACzBmB,IAAAA,yBAAiB,EAACL,WAAWhB,SAASsB,SAAS;wBAC/CC,IAAAA,uBAAe,EAACP,WAAWb;wBAC3B,OAAOa;oBACT;oBAEAf,OAAOuB,IAAI,CAAC,AAAC,YAAuB,OAAZ7B,OAAOuB,IAAI,EAAC;oBAClB;;wBAAMO,IAAAA,oBAAY,EAACrB,aAAa;4BAAEH,QAAAA;wBAAO;;;oBAAnDI,QAAU,cAAVA;oBACRJ,OAAOuB,IAAI,CAAC;oBAEZ;;wBAAO;4BACLvB,QAAAA;4BACAI,OAAO,SAAPA;;;;;gDACE;;oDAAMA;;;gDAAN;gDACA;;oDAAMR,QAAQQ,KAAK;;;gDAAnB;;;;;;gCACF;;wBACF;;;;IACF"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-sheets/src/setup/stdio.ts"],"sourcesContent":["import { composeMiddleware, connectStdio, defaultCacheHints, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createStdioServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version }, { cacheHints: defaultCacheHints });\n    registerTools(mcpServer, tools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  logger.info(`Starting ${config.name} MCP server (stdio)`);\n  const { close } = await connectStdio(buildServer, { logger });\n  logger.info('stdio transport ready');\n\n  return {\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["createStdioServer","config","overrides","runtime","modules","layers","composed","logger","tools","prompts","buildServer","close","createDefaultRuntime","createDomainModules","middlewareFactories","map","factory","deps","composeMiddleware","oauthAdapters","accountTools","accountPrompts","mcpServer","McpServer","name","version","cacheHints","defaultCacheHints","registerTools","registerResources","resources","registerPrompts","info","connectStdio"],"mappings":";;;;+BAIsBA;;;eAAAA;;;sBAJ2G;yBAE5F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAE9B,SAAeA,kBAAkBC,MAAoB,EAAEC,SAA4B;;YAClFC,SACAC,SACAC,QACAC,UACAC,QAEAC,OACAC,SAMAC,aASEC;;;;oBAtBQ;;wBAAMC,IAAAA,+BAAoB,EAACX,QAAQC;;;oBAA7CC,UAAU;oBACVC,UAAUD,QAAQU,mBAAmB;oBACrCR,SAASF,QAAQW,mBAAmB,CAACC,GAAG,CAAC,SAACC;+BAAYA,QAAQb,QAAQc,IAAI;;oBAC1EX,WAAWY,IAAAA,yBAAiB,EAACd,SAASC;oBACtCE,SAASJ,QAAQc,IAAI,CAACV,MAAM;oBAE5BC,QAAQ,AAAC,qBAAGF,SAASE,KAAK,SAAE,qBAAGL,QAAQc,IAAI,CAACE,aAAa,CAACC,YAAY;oBACtEX,UAAU,AAAC,qBAAGH,SAASG,OAAO,SAAE,qBAAGN,QAAQc,IAAI,CAACE,aAAa,CAACE,cAAc;oBAElF,sFAAsF;oBACtF,yFAAyF;oBACzF,2FAA2F;oBAC3F,4EAA4E;oBACtEX,cAAc;wBAClB,IAAMY,YAAY,IAAIC,iBAAS,CAAC;4BAAEC,MAAMvB,OAAOuB,IAAI;4BAAEC,SAASxB,OAAOwB,OAAO;wBAAC,GAAG;4BAAEC,YAAYC,yBAAiB;wBAAC;wBAChHC,IAAAA,qBAAa,EAACN,WAAWd;wBACzBqB,IAAAA,yBAAiB,EAACP,WAAWhB,SAASwB,SAAS;wBAC/CC,IAAAA,uBAAe,EAACT,WAAWb;wBAC3B,OAAOa;oBACT;oBAEAf,OAAOyB,IAAI,CAAC,AAAC,YAAuB,OAAZ/B,OAAOuB,IAAI,EAAC;oBAClB;;wBAAMS,IAAAA,oBAAY,EAACvB,aAAa;4BAAEH,QAAAA;wBAAO;;;oBAAnDI,QAAU,cAAVA;oBACRJ,OAAOyB,IAAI,CAAC;oBAEZ;;wBAAO;4BACLzB,QAAAA;4BACAI,OAAO,SAAPA;;;;;gDACE;;oDAAMA;;;gDAAN;gDACA;;oDAAMR,QAAQQ,KAAK;;;gDAAnB;;;;;;gCACF;;wBACF;;;;IACF"}

package/dist/esm/setup/http.js

@@ -1,4 +1,4 @@
-import { composeMiddleware, connectHttp, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';
+import { composeMiddleware, connectHttp, defaultCacheHints, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';
 import cors from 'cors';
 import express from 'express';
 import { createDefaultRuntime } from './runtime.js';
@@ -26,6 +26,8 @@ export async function createHTTPServer(config, overrides) {
         const mcpServer = new McpServer({
             name: config.name,
             version: config.version
+        }, {
+            cacheHints: defaultCacheHints
         });
         registerTools(mcpServer, tools);
         registerResources(mcpServer, composed.resources);

package/dist/esm/setup/http.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-sheets/src/setup/http.ts"],"sourcesContent":["import { composeMiddleware, connectHttp, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport cors from 'cors';\nimport express from 'express';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createHTTPServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n  const port = config.transport.port;\n  if (!port) throw new Error('Port is required for HTTP transport');\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version });\n    registerTools(mcpServer, tools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  const app = express();\n  app.use(express.json({ limit: '10mb' }));\n\n  // Must mount '/mcp' before any permissive app-level cors(), or that layer answers its\n  // preflight first; pass baseUrl's origin/host below or a public deployment 403s itself.\n  const publicUrl = config.baseUrl ? new URL(config.baseUrl) : undefined;\n  logger.info(`Starting ${config.name} MCP server (http)`);\n  const { close, httpServer } = await connectHttp(buildServer, {\n    logger,\n    app,\n    port,\n    allowedOrigins: publicUrl ? [publicUrl.origin] : undefined,\n    allowedHosts: publicUrl ? [publicUrl.host] : undefined,\n  });\n\n  // The loopback OAuth callback and the DCR discovery/registration endpoints are\n  // meant to be reached from a browser on another origin. Keep cors() for them,\n  // scoped to their own routes - never in front of '/mcp'.\n  if (runtime.deps.oauthAdapters.loopbackRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.loopbackRouter);\n    logger.info('Mounted loopback OAuth callback router');\n  }\n\n  if (runtime.deps.oauthAdapters.dcrRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.dcrRouter);\n    logger.info('Mounted DCR router with OAuth endpoints');\n  }\n\n  logger.info('http transport ready');\n\n  return {\n    httpServer,\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["composeMiddleware","connectHttp","McpServer","registerPrompts","registerResources","registerTools","cors","express","createDefaultRuntime","createHTTPServer","config","overrides","runtime","modules","createDomainModules","layers","middlewareFactories","map","factory","deps","composed","logger","port","transport","Error","tools","oauthAdapters","accountTools","prompts","accountPrompts","buildServer","mcpServer","name","version","resources","app","use","json","limit","publicUrl","baseUrl","URL","undefined","info","close","httpServer","allowedOrigins","origin","allowedHosts","host","loopbackRouter","dcrRouter"],"mappings":"AAAA,SAASA,iBAAiB,EAAEC,WAAW,EAAEC,SAAS,EAAEC,eAAe,EAAEC,iBAAiB,EAAEC,aAAa,QAAQ,gBAAgB;AAC7H,OAAOC,UAAU,OAAO;AACxB,OAAOC,aAAa,UAAU;AAE9B,SAASC,oBAAoB,QAAQ,eAAe;AAEpD,OAAO,eAAeC,iBAAiBC,MAAoB,EAAEC,SAA4B;IACvF,MAAMC,UAAU,MAAMJ,qBAAqBE,QAAQC;IACnD,MAAME,UAAUD,QAAQE,mBAAmB;IAC3C,MAAMC,SAASH,QAAQI,mBAAmB,CAACC,GAAG,CAAC,CAACC,UAAYA,QAAQN,QAAQO,IAAI;IAChF,MAAMC,WAAWpB,kBAAkBa,SAASE;IAC5C,MAAMM,SAAST,QAAQO,IAAI,CAACE,MAAM;IAClC,MAAMC,OAAOZ,OAAOa,SAAS,CAACD,IAAI;IAClC,IAAI,CAACA,MAAM,MAAM,IAAIE,MAAM;IAE3B,MAAMC,QAAQ;WAAIL,SAASK,KAAK;WAAKb,QAAQO,IAAI,CAACO,aAAa,CAACC,YAAY;KAAC;IAC7E,MAAMC,UAAU;WAAIR,SAASQ,OAAO;WAAKhB,QAAQO,IAAI,CAACO,aAAa,CAACG,cAAc;KAAC;IAEnF,sFAAsF;IACtF,yFAAyF;IACzF,2FAA2F;IAC3F,4EAA4E;IAC5E,MAAMC,cAAc;QAClB,MAAMC,YAAY,IAAI7B,UAAU;YAAE8B,MAAMtB,OAAOsB,IAAI;YAAEC,SAASvB,OAAOuB,OAAO;QAAC;QAC7E5B,cAAc0B,WAAWN;QACzBrB,kBAAkB2B,WAAWX,SAASc,SAAS;QAC/C/B,gBAAgB4B,WAAWH;QAC3B,OAAOG;IACT;IAEA,MAAMI,MAAM5B;IACZ4B,IAAIC,GAAG,CAAC7B,QAAQ8B,IAAI,CAAC;QAAEC,OAAO;IAAO;IAErC,sFAAsF;IACtF,wFAAwF;IACxF,MAAMC,YAAY7B,OAAO8B,OAAO,GAAG,IAAIC,IAAI/B,OAAO8B,OAAO,IAAIE;IAC7DrB,OAAOsB,IAAI,CAAC,CAAC,SAAS,EAAEjC,OAAOsB,IAAI,CAAC,kBAAkB,CAAC;IACvD,MAAM,EAAEY,KAAK,EAAEC,UAAU,EAAE,GAAG,MAAM5C,YAAY6B,aAAa;QAC3DT;QACAc;QACAb;QACAwB,gBAAgBP,YAAY;YAACA,UAAUQ,MAAM;SAAC,GAAGL;QACjDM,cAAcT,YAAY;YAACA,UAAUU,IAAI;SAAC,GAAGP;IAC/C;IAEA,+EAA+E;IAC/E,8EAA8E;IAC9E,yDAAyD;IACzD,IAAI9B,QAAQO,IAAI,CAACO,aAAa,CAACwB,cAAc,EAAE;QAC7Cf,IAAIC,GAAG,CAAC,KAAK9B,QAAQM,QAAQO,IAAI,CAACO,aAAa,CAACwB,cAAc;QAC9D7B,OAAOsB,IAAI,CAAC;IACd;IAEA,IAAI/B,QAAQO,IAAI,CAACO,aAAa,CAACyB,SAAS,EAAE;QACxChB,IAAIC,GAAG,CAAC,KAAK9B,QAAQM,QAAQO,IAAI,CAACO,aAAa,CAACyB,SAAS;QACzD9B,OAAOsB,IAAI,CAAC;IACd;IAEAtB,OAAOsB,IAAI,CAAC;IAEZ,OAAO;QACLE;QACAxB;QACAuB,OAAO;YACL,MAAMA;YACN,MAAMhC,QAAQgC,KAAK;QACrB;IACF;AACF"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-sheets/src/setup/http.ts"],"sourcesContent":["import { composeMiddleware, connectHttp, defaultCacheHints, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport cors from 'cors';\nimport express from 'express';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createHTTPServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n  const port = config.transport.port;\n  if (!port) throw new Error('Port is required for HTTP transport');\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version }, { cacheHints: defaultCacheHints });\n    registerTools(mcpServer, tools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  const app = express();\n  app.use(express.json({ limit: '10mb' }));\n\n  // Must mount '/mcp' before any permissive app-level cors(), or that layer answers its\n  // preflight first; pass baseUrl's origin/host below or a public deployment 403s itself.\n  const publicUrl = config.baseUrl ? new URL(config.baseUrl) : undefined;\n  logger.info(`Starting ${config.name} MCP server (http)`);\n  const { close, httpServer } = await connectHttp(buildServer, {\n    logger,\n    app,\n    port,\n    allowedOrigins: publicUrl ? [publicUrl.origin] : undefined,\n    allowedHosts: publicUrl ? [publicUrl.host] : undefined,\n  });\n\n  // The loopback OAuth callback and the DCR discovery/registration endpoints are\n  // meant to be reached from a browser on another origin. Keep cors() for them,\n  // scoped to their own routes - never in front of '/mcp'.\n  if (runtime.deps.oauthAdapters.loopbackRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.loopbackRouter);\n    logger.info('Mounted loopback OAuth callback router');\n  }\n\n  if (runtime.deps.oauthAdapters.dcrRouter) {\n    app.use('/', cors(), runtime.deps.oauthAdapters.dcrRouter);\n    logger.info('Mounted DCR router with OAuth endpoints');\n  }\n\n  logger.info('http transport ready');\n\n  return {\n    httpServer,\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["composeMiddleware","connectHttp","defaultCacheHints","McpServer","registerPrompts","registerResources","registerTools","cors","express","createDefaultRuntime","createHTTPServer","config","overrides","runtime","modules","createDomainModules","layers","middlewareFactories","map","factory","deps","composed","logger","port","transport","Error","tools","oauthAdapters","accountTools","prompts","accountPrompts","buildServer","mcpServer","name","version","cacheHints","resources","app","use","json","limit","publicUrl","baseUrl","URL","undefined","info","close","httpServer","allowedOrigins","origin","allowedHosts","host","loopbackRouter","dcrRouter"],"mappings":"AAAA,SAASA,iBAAiB,EAAEC,WAAW,EAAEC,iBAAiB,EAAEC,SAAS,EAAEC,eAAe,EAAEC,iBAAiB,EAAEC,aAAa,QAAQ,gBAAgB;AAChJ,OAAOC,UAAU,OAAO;AACxB,OAAOC,aAAa,UAAU;AAE9B,SAASC,oBAAoB,QAAQ,eAAe;AAEpD,OAAO,eAAeC,iBAAiBC,MAAoB,EAAEC,SAA4B;IACvF,MAAMC,UAAU,MAAMJ,qBAAqBE,QAAQC;IACnD,MAAME,UAAUD,QAAQE,mBAAmB;IAC3C,MAAMC,SAASH,QAAQI,mBAAmB,CAACC,GAAG,CAAC,CAACC,UAAYA,QAAQN,QAAQO,IAAI;IAChF,MAAMC,WAAWrB,kBAAkBc,SAASE;IAC5C,MAAMM,SAAST,QAAQO,IAAI,CAACE,MAAM;IAClC,MAAMC,OAAOZ,OAAOa,SAAS,CAACD,IAAI;IAClC,IAAI,CAACA,MAAM,MAAM,IAAIE,MAAM;IAE3B,MAAMC,QAAQ;WAAIL,SAASK,KAAK;WAAKb,QAAQO,IAAI,CAACO,aAAa,CAACC,YAAY;KAAC;IAC7E,MAAMC,UAAU;WAAIR,SAASQ,OAAO;WAAKhB,QAAQO,IAAI,CAACO,aAAa,CAACG,cAAc;KAAC;IAEnF,sFAAsF;IACtF,yFAAyF;IACzF,2FAA2F;IAC3F,4EAA4E;IAC5E,MAAMC,cAAc;QAClB,MAAMC,YAAY,IAAI7B,UAAU;YAAE8B,MAAMtB,OAAOsB,IAAI;YAAEC,SAASvB,OAAOuB,OAAO;QAAC,GAAG;YAAEC,YAAYjC;QAAkB;QAChHI,cAAc0B,WAAWN;QACzBrB,kBAAkB2B,WAAWX,SAASe,SAAS;QAC/ChC,gBAAgB4B,WAAWH;QAC3B,OAAOG;IACT;IAEA,MAAMK,MAAM7B;IACZ6B,IAAIC,GAAG,CAAC9B,QAAQ+B,IAAI,CAAC;QAAEC,OAAO;IAAO;IAErC,sFAAsF;IACtF,wFAAwF;IACxF,MAAMC,YAAY9B,OAAO+B,OAAO,GAAG,IAAIC,IAAIhC,OAAO+B,OAAO,IAAIE;IAC7DtB,OAAOuB,IAAI,CAAC,CAAC,SAAS,EAAElC,OAAOsB,IAAI,CAAC,kBAAkB,CAAC;IACvD,MAAM,EAAEa,KAAK,EAAEC,UAAU,EAAE,GAAG,MAAM9C,YAAY8B,aAAa;QAC3DT;QACAe;QACAd;QACAyB,gBAAgBP,YAAY;YAACA,UAAUQ,MAAM;SAAC,GAAGL;QACjDM,cAAcT,YAAY;YAACA,UAAUU,IAAI;SAAC,GAAGP;IAC/C;IAEA,+EAA+E;IAC/E,8EAA8E;IAC9E,yDAAyD;IACzD,IAAI/B,QAAQO,IAAI,CAACO,aAAa,CAACyB,cAAc,EAAE;QAC7Cf,IAAIC,GAAG,CAAC,KAAK/B,QAAQM,QAAQO,IAAI,CAACO,aAAa,CAACyB,cAAc;QAC9D9B,OAAOuB,IAAI,CAAC;IACd;IAEA,IAAIhC,QAAQO,IAAI,CAACO,aAAa,CAAC0B,SAAS,EAAE;QACxChB,IAAIC,GAAG,CAAC,KAAK/B,QAAQM,QAAQO,IAAI,CAACO,aAAa,CAAC0B,SAAS;QACzD/B,OAAOuB,IAAI,CAAC;IACd;IAEAvB,OAAOuB,IAAI,CAAC;IAEZ,OAAO;QACLE;QACAzB;QACAwB,OAAO;YACL,MAAMA;YACN,MAAMjC,QAAQiC,KAAK;QACrB;IACF;AACF"}

package/dist/esm/setup/stdio.js

@@ -1,4 +1,4 @@
-import { composeMiddleware, connectStdio, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';
+import { composeMiddleware, connectStdio, defaultCacheHints, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';
 import { createDefaultRuntime } from './runtime.js';
 export async function createStdioServer(config, overrides) {
     const runtime = await createDefaultRuntime(config, overrides);
@@ -22,6 +22,8 @@ export async function createStdioServer(config, overrides) {
         const mcpServer = new McpServer({
             name: config.name,
             version: config.version
+        }, {
+            cacheHints: defaultCacheHints
         });
         registerTools(mcpServer, tools);
         registerResources(mcpServer, composed.resources);

package/dist/esm/setup/stdio.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-sheets/src/setup/stdio.ts"],"sourcesContent":["import { composeMiddleware, connectStdio, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createStdioServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version });\n    registerTools(mcpServer, tools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  logger.info(`Starting ${config.name} MCP server (stdio)`);\n  const { close } = await connectStdio(buildServer, { logger });\n  logger.info('stdio transport ready');\n\n  return {\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["composeMiddleware","connectStdio","McpServer","registerPrompts","registerResources","registerTools","createDefaultRuntime","createStdioServer","config","overrides","runtime","modules","createDomainModules","layers","middlewareFactories","map","factory","deps","composed","logger","tools","oauthAdapters","accountTools","prompts","accountPrompts","buildServer","mcpServer","name","version","resources","info","close"],"mappings":"AAAA,SAASA,iBAAiB,EAAEC,YAAY,EAAEC,SAAS,EAAEC,eAAe,EAAEC,iBAAiB,EAAEC,aAAa,QAAQ,gBAAgB;AAE9H,SAASC,oBAAoB,QAAQ,eAAe;AAEpD,OAAO,eAAeC,kBAAkBC,MAAoB,EAAEC,SAA4B;IACxF,MAAMC,UAAU,MAAMJ,qBAAqBE,QAAQC;IACnD,MAAME,UAAUD,QAAQE,mBAAmB;IAC3C,MAAMC,SAASH,QAAQI,mBAAmB,CAACC,GAAG,CAAC,CAACC,UAAYA,QAAQN,QAAQO,IAAI;IAChF,MAAMC,WAAWlB,kBAAkBW,SAASE;IAC5C,MAAMM,SAAST,QAAQO,IAAI,CAACE,MAAM;IAElC,MAAMC,QAAQ;WAAIF,SAASE,KAAK;WAAKV,QAAQO,IAAI,CAACI,aAAa,CAACC,YAAY;KAAC;IAC7E,MAAMC,UAAU;WAAIL,SAASK,OAAO;WAAKb,QAAQO,IAAI,CAACI,aAAa,CAACG,cAAc;KAAC;IAEnF,sFAAsF;IACtF,yFAAyF;IACzF,2FAA2F;IAC3F,4EAA4E;IAC5E,MAAMC,cAAc;QAClB,MAAMC,YAAY,IAAIxB,UAAU;YAAEyB,MAAMnB,OAAOmB,IAAI;YAAEC,SAASpB,OAAOoB,OAAO;QAAC;QAC7EvB,cAAcqB,WAAWN;QACzBhB,kBAAkBsB,WAAWR,SAASW,SAAS;QAC/C1B,gBAAgBuB,WAAWH;QAC3B,OAAOG;IACT;IAEAP,OAAOW,IAAI,CAAC,CAAC,SAAS,EAAEtB,OAAOmB,IAAI,CAAC,mBAAmB,CAAC;IACxD,MAAM,EAAEI,KAAK,EAAE,GAAG,MAAM9B,aAAawB,aAAa;QAAEN;IAAO;IAC3DA,OAAOW,IAAI,CAAC;IAEZ,OAAO;QACLX;QACAY,OAAO;YACL,MAAMA;YACN,MAAMrB,QAAQqB,KAAK;QACrB;IACF;AACF"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/mcp-sheets/src/setup/stdio.ts"],"sourcesContent":["import { composeMiddleware, connectStdio, defaultCacheHints, McpServer, registerPrompts, registerResources, registerTools } from '@mcp-z/server';\nimport type { RuntimeOverrides, ServerConfig } from '../types.ts';\nimport { createDefaultRuntime } from './runtime.ts';\n\nexport async function createStdioServer(config: ServerConfig, overrides?: RuntimeOverrides) {\n  const runtime = await createDefaultRuntime(config, overrides);\n  const modules = runtime.createDomainModules();\n  const layers = runtime.middlewareFactories.map((factory) => factory(runtime.deps));\n  const composed = composeMiddleware(modules, layers);\n  const logger = runtime.deps.logger;\n\n  const tools = [...composed.tools, ...runtime.deps.oauthAdapters.accountTools];\n  const prompts = [...composed.prompts, ...runtime.deps.oauthAdapters.accountPrompts];\n\n  // Built per request (HTTP) and per connection (stdio), not shared. The SDK caches the\n  // negotiated protocol revision on the McpServer instance - its own docs say a negotiated\n  // session never re-routes a method onto the other era - so one shared instance pins itself\n  // to whichever revision reaches it first and answers the other with -32601.\n  const buildServer = () => {\n    const mcpServer = new McpServer({ name: config.name, version: config.version }, { cacheHints: defaultCacheHints });\n    registerTools(mcpServer, tools);\n    registerResources(mcpServer, composed.resources);\n    registerPrompts(mcpServer, prompts);\n    return mcpServer;\n  };\n\n  logger.info(`Starting ${config.name} MCP server (stdio)`);\n  const { close } = await connectStdio(buildServer, { logger });\n  logger.info('stdio transport ready');\n\n  return {\n    logger,\n    close: async () => {\n      await close();\n      await runtime.close();\n    },\n  };\n}\n"],"names":["composeMiddleware","connectStdio","defaultCacheHints","McpServer","registerPrompts","registerResources","registerTools","createDefaultRuntime","createStdioServer","config","overrides","runtime","modules","createDomainModules","layers","middlewareFactories","map","factory","deps","composed","logger","tools","oauthAdapters","accountTools","prompts","accountPrompts","buildServer","mcpServer","name","version","cacheHints","resources","info","close"],"mappings":"AAAA,SAASA,iBAAiB,EAAEC,YAAY,EAAEC,iBAAiB,EAAEC,SAAS,EAAEC,eAAe,EAAEC,iBAAiB,EAAEC,aAAa,QAAQ,gBAAgB;AAEjJ,SAASC,oBAAoB,QAAQ,eAAe;AAEpD,OAAO,eAAeC,kBAAkBC,MAAoB,EAAEC,SAA4B;IACxF,MAAMC,UAAU,MAAMJ,qBAAqBE,QAAQC;IACnD,MAAME,UAAUD,QAAQE,mBAAmB;IAC3C,MAAMC,SAASH,QAAQI,mBAAmB,CAACC,GAAG,CAAC,CAACC,UAAYA,QAAQN,QAAQO,IAAI;IAChF,MAAMC,WAAWnB,kBAAkBY,SAASE;IAC5C,MAAMM,SAAST,QAAQO,IAAI,CAACE,MAAM;IAElC,MAAMC,QAAQ;WAAIF,SAASE,KAAK;WAAKV,QAAQO,IAAI,CAACI,aAAa,CAACC,YAAY;KAAC;IAC7E,MAAMC,UAAU;WAAIL,SAASK,OAAO;WAAKb,QAAQO,IAAI,CAACI,aAAa,CAACG,cAAc;KAAC;IAEnF,sFAAsF;IACtF,yFAAyF;IACzF,2FAA2F;IAC3F,4EAA4E;IAC5E,MAAMC,cAAc;QAClB,MAAMC,YAAY,IAAIxB,UAAU;YAAEyB,MAAMnB,OAAOmB,IAAI;YAAEC,SAASpB,OAAOoB,OAAO;QAAC,GAAG;YAAEC,YAAY5B;QAAkB;QAChHI,cAAcqB,WAAWN;QACzBhB,kBAAkBsB,WAAWR,SAASY,SAAS;QAC/C3B,gBAAgBuB,WAAWH;QAC3B,OAAOG;IACT;IAEAP,OAAOY,IAAI,CAAC,CAAC,SAAS,EAAEvB,OAAOmB,IAAI,CAAC,mBAAmB,CAAC;IACxD,MAAM,EAAEK,KAAK,EAAE,GAAG,MAAMhC,aAAayB,aAAa;QAAEN;IAAO;IAC3DA,OAAOY,IAAI,CAAC;IAEZ,OAAO;QACLZ;QACAa,OAAO;YACL,MAAMA;YACN,MAAMtB,QAAQsB,KAAK;QACrB;IACF;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-z/mcp-sheets",
-  "version": "2.2.0",
+  "version": "2.3.1",
   "description": "MCP server for Google Sheets integration with OAuth authentication, spreadsheet management, batch operations, and advanced formatting",
   "keywords": [
     "sheets",
@@ -66,11 +66,11 @@
     "version": "tsds version"
   },
   "dependencies": {
-    "@googleapis/drive": "^22.0.0",
-    "@googleapis/sheets": "^14.0.0",
+    "@googleapis/drive": "^25.0.0",
+    "@googleapis/sheets": "^17.0.0",
     "@mcp-z/oauth": "^2.0.0",
     "@mcp-z/oauth-google": "^2.0.1",
-    "@mcp-z/server": "^2.1.0",
+    "@mcp-z/server": "^2.2.0",
     "cors": "^2.0.0",
     "csv-parse": "^7.0.2",
     "express": "^5.0.0",
@@ -87,7 +87,6 @@
     "@types/express": "^5.0.6",
     "@types/mocha": "^10.0.10",
     "@types/node": "^26.2.0",
-    "dotenv": "^17.2.3",
     "fs-remove-compat": "^1.0.4",
     "get-port": "5.1.1",
     "keyv": "^5.0.0",