@nyuchi/mzizi-mcp 0.13.0 → 0.15.0

package/dist/generated/skills.js.map

@@ -1 +1 @@
-{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../src/generated/skills.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAC,QAAQ,EAAC,UAAU,EAAC,OAAO,CAAU,CAAA;AAY5E,MAAM,CAAC,MAAM,cAAc,GAA4B;IACrD;QACE,MAAM,EAAE,gBAAgB;QACxB,UAAU,EAAE,UAAU;QACtB,aAAa,EAAE,+wBAA+wB;QAC9xB,UAAU,EAAE,o9sCAAo9sC;QACh+sC,QAAQ,EAAE,0DAA0D;KACrE;IACD;QACE,MAAM,EAAE,aAAa;QACrB,UAAU,EAAE,OAAO;QACnB,aAAa,EAAE,+qCAA+qC;QAC9rC,UAAU,EAAE,u7oDAAu7oD;QACn8oD,QAAQ,EAAE,uDAAuD;KAClE;IACD;QACE,MAAM,EAAE,cAAc;QACtB,UAAU,EAAE,QAAQ;QACpB,aAAa,EAAE,2uBAA2uB;QAC1vB,UAAU,EAAE,041BAA041B;QACt51B,QAAQ,EAAE,wDAAwD;KACnE;IACD;QACE,MAAM,EAAE,eAAe;QACvB,UAAU,EAAE,OAAO;QACnB,aAAa,EAAE,yxBAAyxB;QACxyB,UAAU,EAAE,q1mBAAq1mB;QACj2mB,QAAQ,EAAE,yDAAyD;KACpE;IACD;QACE,MAAM,EAAE,iBAAiB;QACzB,UAAU,EAAE,OAAO;QACnB,aAAa,EAAE,wmBAAwmB;QACvnB,UAAU,EAAE,myOAAmyO;QAC/yO,QAAQ,EAAE,2DAA2D;KACtE;IACD;QACE,MAAM,EAAE,iBAAiB;QACzB,UAAU,EAAE,KAAK;QACjB,aAAa,EAAE,+3BAA+3B;QAC94B,UAAU,EAAE,2uUAA2uU;QACvvU,QAAQ,EAAE,2DAA2D;KACtE;IACD;QACE,MAAM,EAAE,iBAAiB;QACzB,UAAU,EAAE,KAAK;QACjB,aAAa,EAAE,moCAAmoC;QAClpC,UAAU,EAAE,omRAAomR;QAChnR,QAAQ,EAAE,2DAA2D;KACtE;CACO,CAAA;AAEV,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAA"}
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../src/generated/skills.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAC,QAAQ,EAAC,UAAU,EAAC,OAAO,CAAU,CAAA;AAuB5E,MAAM,CAAC,MAAM,cAAc,GAA4B;IACrD;QACE,MAAM,EAAE,gBAAgB;QACxB,UAAU,EAAE,UAAU;QACtB,aAAa,EAAE,u9BAAu9B;QACt+B,UAAU,EAAE,mh4CAAmh4C;QAC/h4C,QAAQ,EAAE,0DAA0D;QACpE,OAAO,EAAE,EAAE;KACZ;IACD;QACE,MAAM,EAAE,aAAa;QACrB,UAAU,EAAE,OAAO;QACnB,aAAa,EAAE,2/BAA2/B;QAC1gC,UAAU,EAAE,0/2DAA0/2D;QACtg3D,QAAQ,EAAE,uDAAuD;QACjE,OAAO,EAAE,EAAE;KACZ;IACD;QACE,MAAM,EAAE,cAAc;QACtB,UAAU,EAAE,QAAQ;QACpB,aAAa,EAAE,4/BAA4/B;QAC3gC,UAAU,EAAE,6/7CAA6/7C;QACzg8C,QAAQ,EAAE,wDAAwD;QAClE,OAAO,EAAE;YACP;gBACE,MAAM,EAAE,mBAAmB;gBAC3B,UAAU,EAAE,UAAU;gBACtB,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,ssQAAssQ;aACltQ;YACD;gBACE,MAAM,EAAE,qBAAqB;gBAC7B,UAAU,EAAE,UAAU;gBACtB,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,m8JAAm8J;aAC/8J;YACD;gBACE,MAAM,EAAE,sBAAsB;gBAC9B,UAAU,EAAE,kBAAkB;gBAC9B,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,qnHAAqnH;aACjoH;YACD;gBACE,MAAM,EAAE,oBAAoB;gBAC5B,UAAU,EAAE,UAAU;gBACtB,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,0hQAA0hQ;aACtiQ;YACD;gBACE,MAAM,EAAE,qBAAqB;gBAC7B,UAAU,EAAE,kBAAkB;gBAC9B,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,knUAAknU;aAC9nU;SACF;KACF;IACD;QACE,MAAM,EAAE,eAAe;QACvB,UAAU,EAAE,QAAQ;QACpB,aAAa,EAAE,07BAA07B;QACz8B,UAAU,EAAE,i6NAAi6N;QAC76N,QAAQ,EAAE,yDAAyD;QACnE,OAAO,EAAE;YACP;gBACE,MAAM,EAAE,mCAAmC;gBAC3C,UAAU,EAAE,WAAW;gBACvB,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,kknEAAkknE;aAC9knE;YACD;gBACE,MAAM,EAAE,6BAA6B;gBACrC,UAAU,EAAE,WAAW;gBACvB,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,0ggEAA0ggE;aACthgE;YACD;gBACE,MAAM,EAAE,uCAAuC;gBAC/C,UAAU,EAAE,eAAe;gBAC3B,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,og5DAAog5D;aAChh5D;YACD;gBACE,MAAM,EAAE,wCAAwC;gBAChD,UAAU,EAAE,eAAe;gBAC3B,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,wl7EAAwl7E;aACpm7E;YACD;gBACE,MAAM,EAAE,kDAAkD;gBAC1D,UAAU,EAAE,WAAW;gBACvB,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,sz5GAAsz5G;aACl05G;YACD;gBACE,MAAM,EAAE,wCAAwC;gBAChD,UAAU,EAAE,eAAe;gBAC3B,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,gjqDAAgjqD;aAC5jqD;YACD;gBACE,MAAM,EAAE,4CAA4C;gBACpD,UAAU,EAAE,eAAe;gBAC3B,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,015BAA015B;aACt25B;YACD;gBACE,MAAM,EAAE,8BAA8B;gBACtC,UAAU,EAAE,WAAW;gBACvB,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,k1ZAAk1Z;aAC91Z;YACD;gBACE,MAAM,EAAE,wBAAwB;gBAChC,UAAU,EAAE,WAAW;gBACvB,OAAO,EAAE,GAAG;gBACZ,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,06BAA06B;aACt7B;YACD;gBACE,MAAM,EAAE,wBAAwB;gBAChC,UAAU,EAAE,WAAW;gBACvB,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,ssEAAssE;aACltE;YACD;gBACE,MAAM,EAAE,qBAAqB;gBAC7B,UAAU,EAAE,cAAc;gBAC1B,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,k7xCAAk7xC;aAC97xC;YACD;gBACE,MAAM,EAAE,qBAAqB;gBAC7B,UAAU,EAAE,eAAe;gBAC3B,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,gpEAAgpE;aAC5pE;YACD;gBACE,MAAM,EAAE,+BAA+B;gBACvC,UAAU,EAAE,eAAe;gBAC3B,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,0qDAA0qD;aACtrD;YACD;gBACE,MAAM,EAAE,gCAAgC;gBACxC,UAAU,EAAE,eAAe;gBAC3B,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,0qDAA0qD;aACtrD;YACD;gBACE,MAAM,EAAE,gCAAgC;gBACxC,UAAU,EAAE,eAAe;gBAC3B,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,y8CAAy8C;aACr9C;YACD;gBACE,MAAM,EAAE,iCAAiC;gBACzC,UAAU,EAAE,eAAe;gBAC3B,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,y8CAAy8C;aACr9C;YACD;gBACE,MAAM,EAAE,YAAY;gBACpB,UAAU,EAAE,eAAe;gBAC3B,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,+5HAA+5H;aAC36H;SACF;KACF;IACD;QACE,MAAM,EAAE,eAAe;QACvB,UAAU,EAAE,OAAO;QACnB,aAAa,EAAE,m1BAAm1B;QACl2B,UAAU,EAAE,2nrBAA2nrB;QACvorB,QAAQ,EAAE,yDAAyD;QACnE,OAAO,EAAE,EAAE;KACZ;IACD;QACE,MAAM,EAAE,oBAAoB;QAC5B,UAAU,EAAE,OAAO;QACnB,aAAa,EAAE,w+BAAw+B;QACv/B,UAAU,EAAE,mgcAAmgc;QAC/gc,QAAQ,EAAE,8DAA8D;QACxE,OAAO,EAAE,EAAE;KACZ;IACD;QACE,MAAM,EAAE,iBAAiB;QACzB,UAAU,EAAE,OAAO;QACnB,aAAa,EAAE,8mBAA8mB;QAC7nB,UAAU,EAAE,43PAA43P;QACx4P,QAAQ,EAAE,2DAA2D;QACrE,OAAO,EAAE,EAAE;KACZ;IACD;QACE,MAAM,EAAE,iBAAiB;QACzB,UAAU,EAAE,KAAK;QACjB,aAAa,EAAE,49BAA49B;QAC3+B,UAAU,EAAE,sgsCAAsgsC;QAClhsC,QAAQ,EAAE,2DAA2D;QACrE,OAAO,EAAE;YACP;gBACE,MAAM,EAAE,YAAY;gBACpB,UAAU,EAAE,oBAAoB;gBAChC,OAAO,EAAE,MAAM;gBACf,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,80xHAA80xH;aAC11xH;SACF;KACF;IACD;QACE,MAAM,EAAE,iBAAiB;QACzB,UAAU,EAAE,KAAK;QACjB,aAAa,EAAE,29BAA29B;QAC1+B,UAAU,EAAE,omRAAomR;QAChnR,QAAQ,EAAE,2DAA2D;QACrE,OAAO,EAAE;YACP;gBACE,MAAM,EAAE,aAAa;gBACrB,UAAU,EAAE,oBAAoB;gBAChC,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,yjaAAyja;aACrka;SACF;KACF;CACO,CAAA;AAEV,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAA"}

package/dist/http.d.ts

@@ -11,6 +11,15 @@
 import type { FundiToolContext } from "./fundi-client.js";
 import type { IssueDeskContext } from "./tools.js";
 import type { DocsFederationOptions } from "./docs-federation.js";
+export { originRejection } from "./origin.js";
+/**
+ * Add CORS headers: the caller's `Origin` echoed back when it was allowed (see
+ * `origin.ts`), never `*`. `Vary` is appended to, not replaced. Exported for
+ * tests only.
+ *
+ * @internal
+ */
+export declare function withCors(response: Response, origin: string | null, allowed: boolean): Response;
 export interface HttpHandlerOptions {
     /** When set, expose the fundi trigger tool bound to the signed-in user. */
     fundi?: FundiToolContext;
@@ -25,10 +34,31 @@ export interface HttpHandlerOptions {
     };
     /** Docs federation settings, or `false` for none. Defaults to docs.mzizi.dev. */
     docs?: DocsFederationOptions | false;
+    /**
+     * Browser origins allowed to call the endpoint, by hostname, with the same
+     * scheme and port rules as the default list (see `origin.ts`). Omitted, the
+     * first-party sites and localhost. The Worker passes the default plus
+     * `MZIZI_ALLOWED_ORIGINS`.
+     */
+    allowedOrigins?: readonly string[];
 }
 /**
- * Build a fetch handler that serves the Mzizi MCP over Streamable HTTP.
- * Stateless — each request creates a fresh transport + server pair.
+ * Build a fetch handler that serves the Mzizi MCP over Streamable HTTP, on the
+ * official SDK (v2, `@modelcontextprotocol/server`).
+ *
+ * Stateless either way: every request gets a fresh `McpServer` from the same
+ * factory, with nothing shared between callers.
+ *
+ * - 2026-07-28 traffic (per-request `_meta`, `server/discover`) is served by
+ *   the SDK's `createMcpHandler`.
+ * - 2025-era traffic (`initialize`) is served by the SDK's
+ *   `WebStandardStreamableHTTPServerTransport` with JSON responses, exactly as
+ *   before the migration, routed with the SDK's own `isLegacyRequest` so the
+ *   two legs cannot disagree about which is which. `createMcpHandler`'s
+ *   built-in legacy leg would answer the same requests over SSE; keeping JSON
+ *   keeps every existing client's responses byte-for-byte the same shape.
+ * - GET and DELETE (2025 session operations this server has never offered)
+ *   are answered with 405 rather than holding an SSE stream open.
  */
 export declare function createMziziHttpHandler(options?: HttpHandlerOptions): (request: Request) => Promise<Response>;
 //# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAqCjE,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,gBAAgB,CAAA;IACvB;;;OAGG;IACH,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAA;IAC9B,iFAAiF;IACjF,IAAI,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAA;CACrC;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,kBAAuB,IACxC,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CA0BlE"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAGjE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,CAa9F;AAqBD,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,gBAAgB,CAAA;IACvB;;;OAGG;IACH,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAA;IAC9B,iFAAiF;IACjF,IAAI,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAA;IACpC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAiDD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,kBAAuB,IAcxC,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAsClE"}

package/dist/http.js

@@ -8,17 +8,28 @@
  * anonymous (the free tier) or signed in (WorkOS AuthKit via the OAuth provider)
  * before it reaches this handler.
  */
-import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { createMcpHandler, isLegacyRequest, WebStandardStreamableHTTPServerTransport, } from "@modelcontextprotocol/server";
+import { corsHeadersFor, forbiddenOrigin, isAllowedOrigin } from "./origin.js";
 import { createMziziMcpServer } from "./server.js";
-const CORS_HEADERS = {
-    "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, MCP-Protocol-Version, MCP-Session-Id, apikey",
-};
-function withCors(response) {
+// Part of the public `./http` export since before 0.14.0; kept (same signature).
+export { originRejection } from "./origin.js";
+/**
+ * Add CORS headers: the caller's `Origin` echoed back when it was allowed (see
+ * `origin.ts`), never `*`. `Vary` is appended to, not replaced. Exported for
+ * tests only.
+ *
+ * @internal
+ */
+export function withCors(response, origin, allowed) {
     const headers = new Headers(response.headers);
-    for (const [key, value] of Object.entries(CORS_HEADERS))
-        headers.set(key, value);
+    for (const [key, value] of Object.entries(corsHeadersFor(origin, allowed))) {
+        if (key === "Vary") {
+            if (!/(^|,)\s*origin\s*(,|$)/i.test(headers.get("Vary") ?? ""))
+                headers.append(key, value);
+        }
+        else
+            headers.set(key, value);
+    }
     return new Response(response.body, {
         status: response.status,
         statusText: response.statusText,
@@ -44,32 +55,102 @@ function isOAuthDiscoveryPath(pathname) {
  * Build a fetch handler that serves the Mzizi MCP over Streamable HTTP.
  * Stateless — each request creates a fresh transport + server pair.
  */
+/** Request bodies are small JSON-RPC calls; 1 MiB is generous. */
+const MAX_REQUEST_BODY = 1024 * 1024;
+const onerror = (error) => console.error("mzizi-mcp:", error.message);
+function serverFor(options) {
+    return createMziziMcpServer({
+        fundi: options.fundi,
+        desk: options.desk,
+        anonymous: options.anonymous,
+        docs: options.docs,
+    });
+}
+const OPTIONS_KEY = "mzizi-mcp/handler-options";
+/** Wrap per-request options as the SDK's pass-through `authInfo`. */
+function carry(options) {
+    return { token: "", clientId: "mzizi-mcp", scopes: [], extra: { [OPTIONS_KEY]: options } };
+}
+let modern;
+/**
+ * One `createMcpHandler` per isolate, not per request: it owns an event bus and
+ * a listen router, and building it on every request cost both each time. The
+ * factory still builds a fresh `McpServer` for every request, from the options
+ * that request carried (anonymous, or the signed-in user's fundi and desk).
+ */
+function modernHandler() {
+    modern ??= createMcpHandler((ctx) => serverFor(ctx.authInfo?.extra?.[OPTIONS_KEY] ?? {}), {
+        legacy: "reject",
+        // "auto": a single JSON body unless a tool emits a message first, which
+        // none here does. ("json" would log a warning on every construction.)
+        maxRequestBodySize: MAX_REQUEST_BODY,
+        onerror,
+    });
+    return modern;
+}
+/**
+ * Build a fetch handler that serves the Mzizi MCP over Streamable HTTP, on the
+ * official SDK (v2, `@modelcontextprotocol/server`).
+ *
+ * Stateless either way: every request gets a fresh `McpServer` from the same
+ * factory, with nothing shared between callers.
+ *
+ * - 2026-07-28 traffic (per-request `_meta`, `server/discover`) is served by
+ *   the SDK's `createMcpHandler`.
+ * - 2025-era traffic (`initialize`) is served by the SDK's
+ *   `WebStandardStreamableHTTPServerTransport` with JSON responses, exactly as
+ *   before the migration, routed with the SDK's own `isLegacyRequest` so the
+ *   two legs cannot disagree about which is which. `createMcpHandler`'s
+ *   built-in legacy leg would answer the same requests over SSE; keeping JSON
+ *   keeps every existing client's responses byte-for-byte the same shape.
+ * - GET and DELETE (2025 session operations this server has never offered)
+ *   are answered with 405 rather than holding an SSE stream open.
+ */
 export function createMziziHttpHandler(options = {}) {
+    const factory = () => serverFor(options);
+    async function serveLegacy(request) {
+        const transport = new WebStandardStreamableHTTPServerTransport({
+            sessionIdGenerator: undefined,
+            enableJsonResponse: true,
+        });
+        const server = await factory();
+        server.server.onerror = onerror;
+        await server.connect(transport);
+        return transport.handleRequest(request);
+    }
     return async function handle(request) {
+        const origin = request.headers.get("origin");
+        const allowed = isAllowedOrigin(origin, options.allowedOrigins);
+        const cors = (response) => withCors(response, origin, allowed);
+        // DNS-rebinding / cross-site defence (Streamable HTTP §Security): a
+        // request whose Origin is present and not on the allowlist is refused with
+        // 403 before anything else, preflight included, and before any server is
+        // built. No Origin header (every non-browser client) passes.
+        if (!allowed)
+            return cors(forbiddenOrigin(origin));
+        // (On the Worker the OAuth provider answers OPTIONS on /mcp itself, so this
+        // branch serves the embedded `./http` export; see the CHANGELOG, #295.)
         if (request.method === "OPTIONS") {
-            return new Response(null, { status: 204, headers: CORS_HEADERS });
+            return cors(new Response(null, { status: 204 }));
         }
         // Answer auth-discovery probes with 404 so compliant MCP clients fall back
-        // to anonymous access. Without this the request reaches the Streamable HTTP
-        // transport, which rejects a discovery GET (no `text/event-stream` Accept)
-        // with a 406 — a response clients can't read as auth metadata, so they
-        // abort the connection instead of connecting unauthenticated.
+        // to anonymous access. Without this the request reaches the MCP handler,
+        // which cannot answer a discovery GET with metadata, and clients abort the
+        // connection instead of connecting unauthenticated.
         if (isOAuthDiscoveryPath(new URL(request.url).pathname)) {
-            return withCors(new Response("Not Found", { status: 404 }));
+            return cors(new Response("Not Found", { status: 404 }));
         }
-        const transport = new WebStandardStreamableHTTPServerTransport({
-            sessionIdGenerator: undefined,
-            enableJsonResponse: true,
-        });
-        const server = await createMziziMcpServer({
-            fundi: options.fundi,
-            desk: options.desk,
-            anonymous: options.anonymous,
-            docs: options.docs,
-        });
-        await server.connect(transport);
-        const response = await transport.handleRequest(request);
-        return withCors(response);
+        // Stateless: there is no standalone SSE stream to open and no session to
+        // end, so GET and DELETE are 405 rather than held-open connections.
+        if (request.method !== "POST") {
+            return cors(Response.json({ jsonrpc: "2.0", id: null, error: { code: -32000, message: "Method not allowed. This server is stateless: send every request as a POST." } }, { status: 405, headers: { Allow: "POST, OPTIONS" } }));
+        }
+        if (await isLegacyRequest(request, undefined, { maxRequestBodySize: MAX_REQUEST_BODY })) {
+            return cors(await serveLegacy(request));
+        }
+        // The per-request options ride to the shared handler's factory on authInfo,
+        // which the SDK passes through untouched and never reads itself.
+        return cors(await modernHandler().fetch(request, { authInfo: carry(options) }));
     };
 }
 //# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,wCAAwC,EAAE,MAAM,+DAA+D,CAAA;AACxH,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAKlD,MAAM,YAAY,GAAG;IACnB,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,4BAA4B;IAC5D,8BAA8B,EAAE,4DAA4D;CAC7F,CAAA;AAED,SAAS,QAAQ,CAAC,QAAkB;IAClC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAChF,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAED,2EAA2E;AAC3E,0EAA0E;AAC1E,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,uCAAuC;AACvC,MAAM,wBAAwB,GAAG;IAC/B,uCAAuC;IACvC,yCAAyC;IACzC,mCAAmC;CACpC,CAAA;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO,wBAAwB,CAAC,IAAI,CAClC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CAAA;AACH,CAAC;AAgBD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAA8B,EAAE;IACrE,OAAO,KAAK,UAAU,MAAM,CAAC,OAAgB;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,2EAA2E;QAC3E,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,oBAAoB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,OAAO,QAAQ,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC;YAC7D,kBAAkB,EAAE,SAAS;YAC7B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;YACxC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAA;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC/B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACvD,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC3B,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,wCAAwC,GACzC,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAKlD,iFAAiF;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAkB,EAAE,MAAqB,EAAE,OAAgB;IAClF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QAC3E,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC5F,CAAC;;YACI,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAED,2EAA2E;AAC3E,0EAA0E;AAC1E,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,uCAAuC;AACvC,MAAM,wBAAwB,GAAG;IAC/B,uCAAuC;IACvC,yCAAyC;IACzC,mCAAmC;CACpC,CAAA;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO,wBAAwB,CAAC,IAAI,CAClC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CAAA;AACH,CAAC;AAuBD;;;GAGG;AACH,kEAAkE;AAClE,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAA;AAEpC,MAAM,OAAO,GAAG,CAAC,KAAY,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;AAE5E,SAAS,SAAS,CAAC,OAA2B;IAC5C,OAAO,oBAAoB,CAAC;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,WAAW,GAAG,2BAA2B,CAAA;AAE/C,qEAAqE;AACrE,SAAS,KAAK,CAAC,OAA2B;IACxC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,EAAE,CAAA;AAC5F,CAAC;AAED,IAAI,MAAuD,CAAA;AAE3D;;;;;GAKG;AACH,SAAS,aAAa;IACpB,MAAM,KAAK,gBAAgB,CACzB,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,WAAW,CAAoC,IAAI,EAAE,CAAC,EAChG;QACE,MAAM,EAAE,QAAQ;QAChB,wEAAwE;QACxE,sEAAsE;QACtE,kBAAkB,EAAE,gBAAgB;QACpC,OAAO;KACR,CACF,CAAA;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAA8B,EAAE;IACrE,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IAExC,KAAK,UAAU,WAAW,CAAC,OAAgB;QACzC,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC;YAC7D,kBAAkB,EAAE,SAAS;YAC7B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAA;QAC9B,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAA;QAC/B,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC/B,OAAO,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;IACzC,CAAC;IAED,OAAO,KAAK,UAAU,MAAM,CAAC,OAAgB;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC5C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;QAC/D,MAAM,IAAI,GAAG,CAAC,QAAkB,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;QACxE,oEAAoE;QACpE,2EAA2E;QAC3E,yEAAyE;QACzE,6DAA6D;QAC7D,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAA;QAClD,4EAA4E;QAC5E,wEAAwE;QACxE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QAClD,CAAC;QACD,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,oDAAoD;QACpD,IAAI,oBAAoB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QACzD,CAAC;QACD,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO,IAAI,CACT,QAAQ,CAAC,IAAI,CACX,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,6EAA6E,EAAE,EAAE,EAC7I,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,CACrD,CACF,CAAA;QACH,CAAC;QACD,IAAI,MAAM,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;YACxF,OAAO,IAAI,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,CAAA;QACzC,CAAC;QACD,4EAA4E;QAC5E,iEAAiE;QACjE,OAAO,IAAI,CAAC,MAAM,aAAa,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;IACjF,CAAC,CAAA;AACH,CAAC"}

package/dist/limits.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Response-size limits for the list and search tools.
+ *
+ * A tool result is read into a model's context, and the MCP builder guidance is
+ * to keep one under 25,000 characters. Before this cap, `mzizi_list_components`
+ * answered its default call with 146 KB (measured live 2026-11-01, issue #295).
+ *
+ * The cap is met by returning FEWER items, never by cutting text: the page
+ * shrinks, `next_offset` points at the first item left out, and the JSON text
+ * still matches `structuredContent` exactly.
+ */
+/** Characters one list or search result may carry. */
+export declare const CHARACTER_LIMIT = 25000;
+/**
+ * The longest prefix of `items` whose page, `render(prefix)`, serialises under
+ * `limit`, keeping at least one item (a single oversized item is returned whole
+ * rather than as nothing). `render` builds the complete page, pagination fields
+ * included, so what is measured is what is sent.
+ *
+ * A binary search over the prefix length: about log2(n) renders (9 for 400
+ * rows) instead of one per item. The page's size only grows with its length,
+ * so the search is exact.
+ *
+ * bushtrade-mcp carries an identical copy in `src/limits.ts` (the packages
+ * share no code); keep the two the same.
+ */
+export declare function fitToLimit<T, R>(items: T[], render: (page: T[]) => R, limit?: number): {
+    page: T[];
+    result: R;
+    truncated: boolean;
+};
+//# sourceMappingURL=limits.d.ts.map

package/dist/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,sDAAsD;AACtD,eAAO,MAAM,eAAe,QAAS,CAAC;AAEtC;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,CAAC,EAC7B,KAAK,EAAE,CAAC,EAAE,EACV,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,EACxB,KAAK,SAAkB,GACtB;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAa9C"}

package/dist/limits.js

@@ -0,0 +1,44 @@
+/**
+ * Response-size limits for the list and search tools.
+ *
+ * A tool result is read into a model's context, and the MCP builder guidance is
+ * to keep one under 25,000 characters. Before this cap, `mzizi_list_components`
+ * answered its default call with 146 KB (measured live 2026-11-01, issue #295).
+ *
+ * The cap is met by returning FEWER items, never by cutting text: the page
+ * shrinks, `next_offset` points at the first item left out, and the JSON text
+ * still matches `structuredContent` exactly.
+ */
+/** Characters one list or search result may carry. */
+export const CHARACTER_LIMIT = 25_000;
+/**
+ * The longest prefix of `items` whose page, `render(prefix)`, serialises under
+ * `limit`, keeping at least one item (a single oversized item is returned whole
+ * rather than as nothing). `render` builds the complete page, pagination fields
+ * included, so what is measured is what is sent.
+ *
+ * A binary search over the prefix length: about log2(n) renders (9 for 400
+ * rows) instead of one per item. The page's size only grows with its length,
+ * so the search is exact.
+ *
+ * bushtrade-mcp carries an identical copy in `src/limits.ts` (the packages
+ * share no code); keep the two the same.
+ */
+export function fitToLimit(items, render, limit = CHARACTER_LIMIT) {
+    const size = (r) => JSON.stringify(r, null, 2).length;
+    const full = render(items);
+    if (items.length <= 1 || size(full) <= limit)
+        return { page: items, result: full, truncated: false };
+    let lo = 1; // known to be kept (the floor), whether or not it fits
+    let hi = items.length - 1; // the largest length still possible
+    while (lo < hi) {
+        const mid = Math.ceil((lo + hi) / 2);
+        if (size(render(items.slice(0, mid))) <= limit)
+            lo = mid;
+        else
+            hi = mid - 1;
+    }
+    const page = items.slice(0, lo);
+    return { page, result: render(page), truncated: true };
+}
+//# sourceMappingURL=limits.js.map

package/dist/limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,sDAAsD;AACtD,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AAEtC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CACxB,KAAU,EACV,MAAwB,EACxB,KAAK,GAAG,eAAe;IAEvB,MAAM,IAAI,GAAG,CAAC,CAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACrG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,uDAAuD;IACnE,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,oCAAoC;IAC/D,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK;YAAE,EAAE,GAAG,GAAG,CAAC;;YACpD,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACzD,CAAC"}

package/dist/origin.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Browser `Origin` policy for the MCP endpoint (Streamable HTTP §Security, and
+ * the fix list in #295, P0 item 1).
+ *
+ * Servers MUST validate `Origin` against DNS rebinding and answer 403 to an
+ * invalid one. The policy:
+ *
+ *   - no `Origin` header  allowed: every non-browser client (the SDKs, curl,
+ *                         Claude, Cursor) sends none;
+ *   - a present `Origin`  allowed only if its host is on the list, otherwise
+ *                         403 before any MCP server is built;
+ *   - CORS                `Access-Control-Allow-Origin` echoes an allowed
+ *                         `Origin` (with `Vary: Origin`). It is never `*`.
+ *
+ * The list is hostnames. A localhost name matches over `http` or `https` on any
+ * port (the MCP Inspector runs at http://localhost:6274). Every other name
+ * matches only over `https` on the default port, exactly: no subdomains, no
+ * `http`, no `:8443`. The same rule applies to a list the caller supplies.
+ */
+/** The first-party sites: this Worker, the site, the docs and the console. */
+export declare const ALLOWED_ORIGIN_HOSTS: readonly string[];
+/** The default list: the first-party sites and localhost. */
+export declare const DEFAULT_ALLOWED_HOSTS: readonly string[];
+/**
+ * The default list plus the extra origins in `MZIZI_ALLOWED_ORIGINS`
+ * (comma-separated `https://host` origins; case and a trailing slash are
+ * tolerated). An entry that is not an `https` origin with no path, port or
+ * credentials is dropped with a `console.warn`, so a typo cannot open the
+ * endpoint wider than named. The result is cached per value, so the Worker pays
+ * for the parse once per isolate, not once per request.
+ */
+export declare function allowedHostsFromEnv(env: {
+    MZIZI_ALLOWED_ORIGINS?: string;
+}): readonly string[];
+/**
+ * True when `origin` may call the endpoint. `null` (no header at all) is
+ * allowed; a header that is present is judged, so an empty value and the opaque
+ * `"null"` are refused like any other unparseable origin.
+ */
+export declare function isAllowedOrigin(origin: string | null, hosts?: readonly string[]): boolean;
+/** The 403 for a present-but-unlisted `Origin` (a JSON-RPC error body, like the SDK's own). */
+export declare function forbiddenOrigin(origin: string | null): Response;
+/** A 403 for a present-but-unlisted `Origin`, or undefined when the request may proceed. */
+export declare function originRejection(request: Request, hosts?: readonly string[]): Response | undefined;
+/**
+ * The CORS headers for a request whose `Origin` is `origin`, already judged
+ * `allowed`: the origin echoed back, never `*`. No `Origin`, or one that is not
+ * allowed, gets no `Access-Control-Allow-Origin`; `Vary: Origin` is always
+ * present so a cache cannot hand one origin's answer to another. Merge `Vary`
+ * with `Headers.append`, not `set`.
+ */
+export declare function corsHeadersFor(origin: string | null, allowed: boolean): Record<string, string>;
+/** `corsHeadersFor`, judging the request's own `Origin` against `hosts`. */
+export declare function corsHeaders(request: Request, hosts?: readonly string[]): Record<string, string>;
+//# sourceMappingURL=origin.d.ts.map

package/dist/origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.d.ts","sourceRoot":"","sources":["../src/origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAMjD,CAAA;AAED,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAA8C,CAAA;AAIjG;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE;IAAE,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,MAAM,EAAE,CAsB9F;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,GAAE,SAAS,MAAM,EAA0B,GAAG,OAAO,CAahH;AAED,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,CAK/D;AAED,4FAA4F;AAC5F,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,GAAG,SAAS,CAGjG;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9F;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAG/F"}

package/dist/origin.js

@@ -0,0 +1,127 @@
+/**
+ * Browser `Origin` policy for the MCP endpoint (Streamable HTTP §Security, and
+ * the fix list in #295, P0 item 1).
+ *
+ * Servers MUST validate `Origin` against DNS rebinding and answer 403 to an
+ * invalid one. The policy:
+ *
+ *   - no `Origin` header  allowed: every non-browser client (the SDKs, curl,
+ *                         Claude, Cursor) sends none;
+ *   - a present `Origin`  allowed only if its host is on the list, otherwise
+ *                         403 before any MCP server is built;
+ *   - CORS                `Access-Control-Allow-Origin` echoes an allowed
+ *                         `Origin` (with `Vary: Origin`). It is never `*`.
+ *
+ * The list is hostnames. A localhost name matches over `http` or `https` on any
+ * port (the MCP Inspector runs at http://localhost:6274). Every other name
+ * matches only over `https` on the default port, exactly: no subdomains, no
+ * `http`, no `:8443`. The same rule applies to a list the caller supplies.
+ */
+import { localhostAllowedOrigins } from "@modelcontextprotocol/server";
+/** Hostnames that count as local development. */
+const LOCAL_HOSTS = localhostAllowedOrigins();
+/** The first-party sites: this Worker, the site, the docs and the console. */
+export const ALLOWED_ORIGIN_HOSTS = [
+    "mzizi.dev",
+    "www.mzizi.dev",
+    "docs.mzizi.dev",
+    "app.mzizi.dev",
+    "mcp.mzizi.dev",
+];
+/** The default list: the first-party sites and localhost. */
+export const DEFAULT_ALLOWED_HOSTS = [...ALLOWED_ORIGIN_HOSTS, ...LOCAL_HOSTS];
+const hostsCache = new Map();
+/**
+ * The default list plus the extra origins in `MZIZI_ALLOWED_ORIGINS`
+ * (comma-separated `https://host` origins; case and a trailing slash are
+ * tolerated). An entry that is not an `https` origin with no path, port or
+ * credentials is dropped with a `console.warn`, so a typo cannot open the
+ * endpoint wider than named. The result is cached per value, so the Worker pays
+ * for the parse once per isolate, not once per request.
+ */
+export function allowedHostsFromEnv(env) {
+    const raw = env.MZIZI_ALLOWED_ORIGINS;
+    if (!raw)
+        return DEFAULT_ALLOWED_HOSTS;
+    const cached = hostsCache.get(raw);
+    if (cached)
+        return cached;
+    const extra = [];
+    for (const entry of raw.split(",")) {
+        const value = entry.trim().replace(/\/$/, "").toLowerCase();
+        if (!value)
+            continue;
+        let host;
+        try {
+            const url = new URL(value);
+            if (url.protocol === "https:" && url.origin === value && url.port === "")
+                host = url.hostname;
+        }
+        catch {
+            // Not an origin: dropped below.
+        }
+        if (host)
+            extra.push(host);
+        else
+            console.warn(`mzizi-mcp: MZIZI_ALLOWED_ORIGINS entry ignored (not a plain https origin): ${entry.trim()}`);
+    }
+    const hosts = [...DEFAULT_ALLOWED_HOSTS, ...extra];
+    hostsCache.set(raw, hosts);
+    return hosts;
+}
+/**
+ * True when `origin` may call the endpoint. `null` (no header at all) is
+ * allowed; a header that is present is judged, so an empty value and the opaque
+ * `"null"` are refused like any other unparseable origin.
+ */
+export function isAllowedOrigin(origin, hosts = DEFAULT_ALLOWED_HOSTS) {
+    if (origin === null)
+        return true;
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        return false;
+    }
+    // An Origin is scheme://host[:port] and nothing else.
+    if (url.origin !== origin)
+        return false;
+    if (!hosts.includes(url.hostname))
+        return false;
+    if (LOCAL_HOSTS.includes(url.hostname))
+        return url.protocol === "http:" || url.protocol === "https:";
+    return url.protocol === "https:" && url.port === "";
+}
+/** The 403 for a present-but-unlisted `Origin` (a JSON-RPC error body, like the SDK's own). */
+export function forbiddenOrigin(origin) {
+    return Response.json({ jsonrpc: "2.0", id: null, error: { code: -32000, message: `Invalid Origin header: ${origin ?? ""}` } }, { status: 403, headers: { Vary: "Origin" } });
+}
+/** A 403 for a present-but-unlisted `Origin`, or undefined when the request may proceed. */
+export function originRejection(request, hosts) {
+    const origin = request.headers.get("origin");
+    return isAllowedOrigin(origin, hosts) ? undefined : forbiddenOrigin(origin);
+}
+/**
+ * The CORS headers for a request whose `Origin` is `origin`, already judged
+ * `allowed`: the origin echoed back, never `*`. No `Origin`, or one that is not
+ * allowed, gets no `Access-Control-Allow-Origin`; `Vary: Origin` is always
+ * present so a cache cannot hand one origin's answer to another. Merge `Vary`
+ * with `Headers.append`, not `set`.
+ */
+export function corsHeadersFor(origin, allowed) {
+    const headers = { Vary: "Origin" };
+    if (origin && allowed) {
+        headers["Access-Control-Allow-Origin"] = origin;
+        headers["Access-Control-Allow-Methods"] = "GET, POST, DELETE, OPTIONS";
+        headers["Access-Control-Allow-Headers"] =
+            "Content-Type, MCP-Protocol-Version, MCP-Session-Id, Mcp-Method, Mcp-Name, apikey";
+    }
+    return headers;
+}
+/** `corsHeadersFor`, judging the request's own `Origin` against `hosts`. */
+export function corsHeaders(request, hosts) {
+    const origin = request.headers.get("origin");
+    return corsHeadersFor(origin, isAllowedOrigin(origin, hosts));
+}
+//# sourceMappingURL=origin.js.map

package/dist/origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.js","sourceRoot":"","sources":["../src/origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAEtE,iDAAiD;AACjD,MAAM,WAAW,GAAsB,uBAAuB,EAAE,CAAA;AAEhE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,WAAW;IACX,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,eAAe;CAChB,CAAA;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAsB,CAAC,GAAG,oBAAoB,EAAE,GAAG,WAAW,CAAC,CAAA;AAEjG,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAA;AAEvD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAuC;IACzE,MAAM,GAAG,GAAG,GAAG,CAAC,qBAAqB,CAAA;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,qBAAqB,CAAA;IACtC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QAC3D,IAAI,CAAC,KAAK;YAAE,SAAQ;QACpB,IAAI,IAAwB,CAAA;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;YAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE;gBAAE,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAA;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;;YACrB,OAAO,CAAC,IAAI,CAAC,8EAA8E,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACjH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,qBAAqB,EAAE,GAAG,KAAK,CAAC,CAAA;IAClD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC1B,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAqB,EAAE,QAA2B,qBAAqB;IACrG,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,sDAAsD;IACtD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/C,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAA;IACpG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,CAAA;AACrD,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,0BAA0B,MAAM,IAAI,EAAE,EAAE,EAAE,EAAE,EACxG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAC7C,CAAA;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,OAAgB,EAAE,KAAyB;IACzE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,OAAO,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,OAAgB;IACpE,MAAM,OAAO,GAA2B,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC1D,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;QACtB,OAAO,CAAC,6BAA6B,CAAC,GAAG,MAAM,CAAA;QAC/C,OAAO,CAAC,8BAA8B,CAAC,GAAG,4BAA4B,CAAA;QACtE,OAAO,CAAC,8BAA8B,CAAC;YACrC,kFAAkF,CAAA;IACtF,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,OAAgB,EAAE,KAAyB;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,OAAO,cAAc,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;AAC/D,CAAC"}

package/dist/rate-limit.d.ts

@@ -37,5 +37,5 @@ export declare function clientKey(request: Request): string;
  * The body is a JSON-RPC error so an MCP client can show it, and it names the
  * way past the limit: signing in.
  */
-export declare function limitAnonymous(limiter: RateLimiter | undefined, request: Request): Promise<Response | null>;
+export declare function limitAnonymous(limiter: RateLimiter | undefined, request: Request, allowedHosts?: readonly string[]): Promise<Response | null>;
 //# sourceMappingURL=rate-limit.d.ts.map

package/dist/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,sEAAsE;AACtE,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAChE,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAElD;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,WAAW,GAAG,SAAS,EAChC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAuB1B"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,sEAAsE;AACtE,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAChE,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAElD;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,WAAW,GAAG,SAAS,EAChC,OAAO,EAAE,OAAO,EAChB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAC/B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAuB1B"}

package/dist/rate-limit.js

@@ -16,6 +16,7 @@
  * free tier down with a missing binding, and the limit is a guard, not a gate.
  */
 import { ANONYMOUS_RATE_LIMIT, SIGN_IN_MCP_URL } from "./access.js";
+import { corsHeaders } from "./origin.js";
 /**
  * The key for one client: the connecting IP Cloudflare reports.
  *
@@ -32,7 +33,7 @@ export function clientKey(request) {
  * The body is a JSON-RPC error so an MCP client can show it, and it names the
  * way past the limit: signing in.
  */
-export async function limitAnonymous(limiter, request) {
+export async function limitAnonymous(limiter, request, allowedHosts) {
     if (!limiter)
         return null;
     const { success } = await limiter.limit({ key: clientKey(request) });
@@ -51,7 +52,7 @@ export async function limitAnonymous(limiter, request) {
         headers: {
             "Content-Type": "application/json",
             "Retry-After": String(periodSeconds),
-            "Access-Control-Allow-Origin": "*",
+            ...corsHeaders(request, allowedHosts),
         },
     });
 }

package/dist/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAOpE;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,OAAgB;IACxC,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgC,EAChC,OAAgB;IAEhB,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAAC;IACtD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,IAAI,EAAE,CAAC,KAAK;YACZ,OAAO,EAAE,iDAAiD,KAAK,QAAQ,aAAa,iEAAiE,eAAe,gBAAgB;SACrL;KACF,CAAC,EACF;QACE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC;YACpC,6BAA6B,EAAE,GAAG;SACnC;KACF,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,OAAgB;IACxC,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgC,EAChC,OAAgB,EAChB,YAAgC;IAEhC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAAC;IACtD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,IAAI,EAAE,CAAC,KAAK;YACZ,OAAO,EAAE,iDAAiD,KAAK,QAAQ,aAAa,iEAAiE,eAAe,gBAAgB;SACrL;KACF,CAAC,EACF;QACE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC;YACpC,GAAG,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC;SACtC;KACF,CACF,CAAC;AACJ,CAAC"}

package/dist/registry.d.ts

@@ -63,7 +63,7 @@ export type AstroImpl = {
     }>;
 };
 /**
- * A component's Mzizi Roots (Rust, Dioxus) implementation: the registry's
+ * A component's Mzizi Roots (Rust) implementation: the registry's
  * `/v1/rs/{name}` body, plus the `CONTRACT` clause block its source declares.
  */
 export type RustImpl = {

package/dist/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,MAAM,EAAE,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,CAAC;AAC1C,MAAM,MAAM,IAAI,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAC5G,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;AAErC,yFAAyF;AACzF,MAAM,MAAM,WAAW,GAAG;IACxB,YAAY,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3C,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,4FAA4F;IAC5F,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvC,qDAAqD;IACrD,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC1C,CAAC;AAEF,uFAAuF;AACvF,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;CACpG,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,uFAAuF;IACvF,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,KAAK,YAAY,GAAG;IAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAgBhE,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,qFAAqF;IACrF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,WAAW,GAAG,YAAY,GAAG,gBAAgB,GAAG,SAAS,CAAC;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAKF,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC;AAEzD,wBAAgB,cAAc,CAAC,GAAG,EAAE,WAAW;;6BAtGR,MAAM;sBAAgB,MAAM;;wBA8HtC,MAAM,KAAG,MAAM,GAAG,SAAS;sBAe7B,MAAM;sBAGN,MAAM,KAAG,MAAM,GAAG,SAAS;IAWlD;;;OAGG;mBACY,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC;IAezC,qEAAqE;uBACnD,SAAS,GAAQ,EAAE,CAAC,YAAY,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAqCvF,4DAA4D;uBACzC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;IAY3C;;;;OAIG;kBACW,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;IAWvC,wFAAwF;2BACjE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;IAM/C;;;;;;;;;OASG;+BACwB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;IA+BnD;;;;;OAKG;kBACW,MAAM,mBAAe,EAAE,CAAC;QAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;uBA+ExE,EAAE,CAAC,OAAO,CAAC;IAI9B,mFAAmF;eACxE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;gBAUvB,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;wBAInB,EAAE,CAAC,OAAO,CAAC;2BAIR,EAAE,CAAC,OAAO,CAAC;0BAIZ,EAAE,CAAC,OAAO,CAAC;IAIjC,oGAAoG;4BAC5E,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;IAYhD,kFAAkF;uBAC/D,EAAE,CAAC,OAAO,CAAC;wBAKV,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;EAO/C;AAID;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,QAAQ,CAAC,CAGzD"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,MAAM,EAAE,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,CAAC;AAC1C,MAAM,MAAM,IAAI,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAC5G,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;AAErC,yFAAyF;AACzF,MAAM,MAAM,WAAW,GAAG;IACxB,YAAY,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3C,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,4FAA4F;IAC5F,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvC,qDAAqD;IACrD,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC1C,CAAC;AAEF,uFAAuF;AACvF,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;CACpG,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,uFAAuF;IACvF,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,KAAK,YAAY,GAAG;IAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAgBhE,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,qFAAqF;IACrF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,WAAW,GAAG,YAAY,GAAG,gBAAgB,GAAG,SAAS,CAAC;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAKF,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC;AAEzD,wBAAgB,cAAc,CAAC,GAAG,EAAE,WAAW;;6BAtGR,MAAM;sBAAgB,MAAM;;wBA8HtC,MAAM,KAAG,MAAM,GAAG,SAAS;sBA8B7B,MAAM;sBAGN,MAAM,KAAG,MAAM,GAAG,SAAS;IAWlD;;;OAGG;mBACY,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC;IAezC,qEAAqE;uBACnD,SAAS,GAAQ,EAAE,CAAC,YAAY,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAqCvF,4DAA4D;uBACzC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;IAY3C;;;;OAIG;kBACW,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;IAWvC,wFAAwF;2BACjE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;IAM/C;;;;;;;;;OASG;+BACwB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;IAoCnD;;;;;OAKG;kBACW,MAAM,mBAAe,EAAE,CAAC;QAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;uBAkFxE,EAAE,CAAC,OAAO,CAAC;IAI9B,mFAAmF;eACxE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;gBAUvB,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;wBAInB,EAAE,CAAC,OAAO,CAAC;2BAIR,EAAE,CAAC,OAAO,CAAC;0BAIZ,EAAE,CAAC,OAAO,CAAC;IAIjC,oGAAoG;4BAC5E,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;IAYhD,kFAAkF;uBAC/D,EAAE,CAAC,OAAO,CAAC;wBAKV,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;EAO/C;AAID;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,QAAQ,CAAC,CAGzD"}