@nyuchi/mzizi-mcp 0.15.0 → 0.16.0

package/README.md

@@ -12,7 +12,7 @@ Owned and operated by **Mzizi**.
 ---
 
 **Live at** `https://mcp.mzizi.dev/mcp` (Cloudflare Worker `mzizi-mcp`, version
-0.15.0 — `MZIZI_MCP_VERSION` in `src/server.ts` is what `serverInfo.version`
+0.16.0 — `MZIZI_MCP_VERSION` in `src/server.ts` is what `serverInfo.version`
 reports, and it moves in lockstep with `package.json` and `server.json`).
 
 ## Free, with no gate except Fundi
@@ -302,9 +302,15 @@ call, passing the result through untouched:
   that is not a plain `https` origin is dropped with a logged warning). Clients that send no
   `Origin` (every non-browser client) are not affected. On `/mcp`, CORS echoes an allowed `Origin`
   with `Vary: Origin` and never answers `Access-Control-Allow-Origin: *`. The OAuth provider's own
-  endpoints (`/token`, `/register`, `/.well-known/*`) keep the provider's CORS behaviour, which
-  echoes the caller's `Origin`, and `/catalogue.json` is `*` on purpose. Browser clients hosted on
-  other sites cannot call `/mcp` (`src/origin.ts` is the one list).
+  endpoints follow `src/auth/cors.ts` (0.16.0; the provider's own CORS, which echoed any `Origin`,
+  is replaced): `/.well-known/*` are public discovery documents and answer
+  `Access-Control-Allow-Origin: *` (GET, HEAD, OPTIONS); `/token` and `/register` echo an `Origin`
+  only if it is on the same list as `/mcp` and always send `Vary: Origin`. A listed `Origin`
+  gets `POST, OPTIONS`, `Content-Type, Authorization` and `Access-Control-Max-Age: 600`; an unlisted
+  or `null` `Origin` is still served but gets no `Access-Control-Allow-Origin`, so a browser cannot read
+  the answer; a request with no `Origin` is unaffected. Errors (400, 401, 405, 429, 5xx) carry the
+  same headers. No `Access-Control-Allow-Credentials` anywhere. `/catalogue.json` is `*` on purpose.
+  Browser clients hosted on other sites cannot call `/mcp` (`src/origin.ts` is the one list).
 - **PKCE and token audience:** the authorization-server metadata advertises `S256` only. Audience
   binding applies only to clients that send a `resource` indicator (RFC 8707): such a token is
   refused on a different server or path, but a token for `/mcp` is also accepted on

package/dist/auth/cors.d.ts

@@ -0,0 +1,33 @@
+/**
+ * CORS for the OAuth provider's own endpoints.
+ *
+ * `@cloudflare/workers-oauth-provider` answers every cross-origin request on
+ * `/token`, `/register` and `/.well-known/*` by echoing ANY `Origin` back with
+ * `Allow-Methods: *`, `Allow-Headers: Authorization, *` and a day of preflight
+ * cache. This module takes those answers over: the provider still serves the
+ * request, and its CORS headers are replaced with ours. Its own module, not
+ * `worker.ts`, because the Worker's entry may export only handlers.
+ *
+ *   /.well-known/*       public, credential-less documents: `*`, GET/HEAD only.
+ *   /token, /register    the same allowlist as the `/mcp` Origin gate
+ *                        (`origin.ts`): an allowed `Origin` is echoed with
+ *                        `Vary: Origin`; no `Origin` (every non-browser client)
+ *                        is served without CORS headers; an unlisted or `null`
+ *                        `Origin` is served too, but gets no
+ *                        `Access-Control-Allow-Origin`, so a browser cannot read
+ *                        the answer. Nothing is 403'd: a browser's block is the
+ *                        enforcement, and these endpoints take no cookie.
+ *
+ * Every answer carries the headers, errors included (a browser cannot read a
+ * 400, 401, 405, 429 or 5xx without them). No `Access-Control-Allow-Credentials`.
+ * `/authorize` is a top-level navigation, not a fetch, so it gets none.
+ */
+export type CorsRoute = "discovery" | "endpoint";
+/** Which CORS rule governs `pathname`, or undefined for a path this module leaves alone. */
+export declare function corsRouteFor(pathname: string): CorsRoute | undefined;
+/**
+ * Serve `request` through `next` (the OAuth provider) with the CORS rules above,
+ * or return undefined when the path is not one of ours.
+ */
+export declare function withProviderCors(request: Request, hosts: readonly string[] | undefined, next: () => Promise<Response>): Promise<Response | undefined>;
+//# sourceMappingURL=cors.d.ts.map

package/dist/auth/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/auth/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAiBH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,UAAU,CAAC;AAEjD,4FAA4F;AAC5F,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAIpE;AAoDD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACpC,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,GAC5B,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAgB/B"}

package/dist/auth/cors.js

@@ -0,0 +1,110 @@
+/**
+ * CORS for the OAuth provider's own endpoints.
+ *
+ * `@cloudflare/workers-oauth-provider` answers every cross-origin request on
+ * `/token`, `/register` and `/.well-known/*` by echoing ANY `Origin` back with
+ * `Allow-Methods: *`, `Allow-Headers: Authorization, *` and a day of preflight
+ * cache. This module takes those answers over: the provider still serves the
+ * request, and its CORS headers are replaced with ours. Its own module, not
+ * `worker.ts`, because the Worker's entry may export only handlers.
+ *
+ *   /.well-known/*       public, credential-less documents: `*`, GET/HEAD only.
+ *   /token, /register    the same allowlist as the `/mcp` Origin gate
+ *                        (`origin.ts`): an allowed `Origin` is echoed with
+ *                        `Vary: Origin`; no `Origin` (every non-browser client)
+ *                        is served without CORS headers; an unlisted or `null`
+ *                        `Origin` is served too, but gets no
+ *                        `Access-Control-Allow-Origin`, so a browser cannot read
+ *                        the answer. Nothing is 403'd: a browser's block is the
+ *                        enforcement, and these endpoints take no cookie.
+ *
+ * Every answer carries the headers, errors included (a browser cannot read a
+ * 400, 401, 405, 429 or 5xx without them). No `Access-Control-Allow-Credentials`.
+ * `/authorize` is a top-level navigation, not a fetch, so it gets none.
+ */
+import { OAUTH_ENDPOINT_CORS, corsHeadersFor, isAllowedOrigin } from "../origin.js";
+/** Headers the provider sets on its answers; removed before ours go on. */
+const PROVIDER_CORS_HEADERS = [
+    "Access-Control-Allow-Origin",
+    "Access-Control-Allow-Methods",
+    "Access-Control-Allow-Headers",
+    "Access-Control-Max-Age",
+    "Access-Control-Allow-Credentials",
+    "Access-Control-Expose-Headers",
+];
+/** What a browser MCP client sends when it fetches discovery documents (the SDK adds `MCP-Protocol-Version`). */
+const DISCOVERY_ALLOW_HEADERS = "Content-Type, MCP-Protocol-Version";
+/** Which CORS rule governs `pathname`, or undefined for a path this module leaves alone. */
+export function corsRouteFor(pathname) {
+    if (pathname === "/.well-known" || pathname.startsWith("/.well-known/"))
+        return "discovery";
+    if (pathname === "/token" || pathname === "/register")
+        return "endpoint";
+    return undefined;
+}
+/** The CORS headers for `request` on `route`. */
+function headersFor(route, request, hosts) {
+    if (route === "discovery")
+        return { "Access-Control-Allow-Origin": "*" };
+    const origin = request.headers.get("origin");
+    return corsHeadersFor(origin, isAllowedOrigin(origin, hosts), OAUTH_ENDPOINT_CORS);
+}
+function withHeaders(response, extra) {
+    const headers = new Headers(response.headers);
+    for (const name of PROVIDER_CORS_HEADERS)
+        headers.delete(name);
+    for (const [key, value] of Object.entries(extra)) {
+        if (key === "Vary") {
+            if (!/(^|,)\s*origin\s*(,|$)/i.test(headers.get("Vary") ?? ""))
+                headers.append(key, value);
+        }
+        else
+            headers.set(key, value);
+    }
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
+/** The preflight answer: 204, the route's methods and headers, the same origin decision. */
+function preflight(route, request, hosts) {
+    if (route === "discovery") {
+        return new Response(null, {
+            status: 204,
+            headers: {
+                "Access-Control-Allow-Origin": "*",
+                "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS",
+                "Access-Control-Allow-Headers": DISCOVERY_ALLOW_HEADERS,
+                "Access-Control-Max-Age": "600",
+            },
+        });
+    }
+    const origin = request.headers.get("origin");
+    return new Response(null, {
+        status: 204,
+        headers: corsHeadersFor(origin, isAllowedOrigin(origin, hosts), OAUTH_ENDPOINT_CORS),
+    });
+}
+/**
+ * Serve `request` through `next` (the OAuth provider) with the CORS rules above,
+ * or return undefined when the path is not one of ours.
+ */
+export async function withProviderCors(request, hosts, next) {
+    const route = corsRouteFor(new URL(request.url).pathname);
+    if (!route)
+        return undefined;
+    if (request.method === "OPTIONS")
+        return preflight(route, request, hosts);
+    let response;
+    try {
+        response = await next();
+    }
+    catch (error) {
+        // A throw would reach the browser as an opaque network error; answer it.
+        console.error("mzizi-mcp: OAuth provider threw", error);
+        response = Response.json({ error: "server_error", error_description: "Internal error" }, { status: 500 });
+    }
+    return withHeaders(response, headersFor(route, request, hosts));
+}
+//# sourceMappingURL=cors.js.map

package/dist/auth/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/auth/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpF,2EAA2E;AAC3E,MAAM,qBAAqB,GAAG;IAC5B,6BAA6B;IAC7B,8BAA8B;IAC9B,8BAA8B;IAC9B,wBAAwB;IACxB,kCAAkC;IAClC,+BAA+B;CAChC,CAAC;AAEF,iHAAiH;AACjH,MAAM,uBAAuB,GAAG,oCAAoC,CAAC;AAIrE,4FAA4F;AAC5F,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,IAAI,QAAQ,KAAK,cAAc,IAAI,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,WAAW,CAAC;IAC5F,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,UAAU,CAAC;IACzE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iDAAiD;AACjD,SAAS,UAAU,CACjB,KAAgB,EAChB,OAAgB,EAChB,KAAoC;IAEpC,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC;IACzE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,cAAc,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,WAAW,CAAC,QAAkB,EAAE,KAA6B;IACpE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,qBAAqB;QAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7F,CAAC;;YAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,SAAS,SAAS,CAChB,KAAgB,EAChB,OAAgB,EAChB,KAAoC;IAEpC,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC1B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,6BAA6B,EAAE,GAAG;gBAClC,8BAA8B,EAAE,oBAAoB;gBACpD,8BAA8B,EAAE,uBAAuB;gBACvD,wBAAwB,EAAE,KAAK;aAChC;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,cAAc,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,mBAAmB,CAAC;KACrF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,KAAoC,EACpC,IAA6B;IAE7B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1E,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;QACxD,QAAQ,GAAG,QAAQ,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,EAC9D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/origin.d.ts

@@ -10,7 +10,8 @@
  *   - a present `Origin`  allowed only if its host is on the list, otherwise
  *                         403 before any MCP server is built;
  *   - CORS                `Access-Control-Allow-Origin` echoes an allowed
- *                         `Origin` (with `Vary: Origin`). It is never `*`.
+ *                         `Origin` (with `Vary: Origin`). It is never `*`
+ *                         here; the public discovery documents are `*` (`auth/cors.ts`).
  *
  * The list is hostnames. A localhost name matches over `http` or `https` on any
  * port (the MCP Inspector runs at http://localhost:6274). Every other name
@@ -42,14 +43,26 @@ export declare function isAllowedOrigin(origin: string | null, hosts?: readonly
 export declare function forbiddenOrigin(origin: string | null): Response;
 /** A 403 for a present-but-unlisted `Origin`, or undefined when the request may proceed. */
 export declare function originRejection(request: Request, hosts?: readonly string[]): Response | undefined;
+/** What a route's CORS answer advertises beyond the origin decision. */
+export interface CorsPolicy {
+    readonly methods: string;
+    readonly headers: string;
+    /** Seconds a browser may cache a preflight; omitted when not set. */
+    readonly maxAge?: number;
+}
+/** The MCP endpoint (`/mcp`): its methods and the headers a Streamable HTTP client sends. */
+export declare const MCP_CORS: CorsPolicy;
+/** `/token` and `/register`: POST only, a form or JSON body, and client credentials in `Authorization`. */
+export declare const OAUTH_ENDPOINT_CORS: CorsPolicy;
 /**
  * The CORS headers for a request whose `Origin` is `origin`, already judged
  * `allowed`: the origin echoed back, never `*`. No `Origin`, or one that is not
  * allowed, gets no `Access-Control-Allow-Origin`; `Vary: Origin` is always
  * present so a cache cannot hand one origin's answer to another. Merge `Vary`
- * with `Headers.append`, not `set`.
+ * with `Headers.append`, not `set`. No `Access-Control-Allow-Credentials`: no
+ * route reads a cookie cross-origin.
  */
-export declare function corsHeadersFor(origin: string | null, allowed: boolean): Record<string, string>;
+export declare function corsHeadersFor(origin: string | null, allowed: boolean, policy?: CorsPolicy): Record<string, string>;
 /** `corsHeadersFor`, judging the request's own `Origin` against `hosts`. */
 export declare function corsHeaders(request: Request, hosts?: readonly string[]): Record<string, string>;
 //# sourceMappingURL=origin.d.ts.map

package/dist/origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"origin.d.ts","sourceRoot":"","sources":["../src/origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAMjD,CAAA;AAED,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAA8C,CAAA;AAIjG;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE;IAAE,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,MAAM,EAAE,CAsB9F;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,GAAE,SAAS,MAAM,EAA0B,GAAG,OAAO,CAahH;AAED,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,CAK/D;AAED,4FAA4F;AAC5F,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,GAAG,SAAS,CAGjG;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9F;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAG/F"}
+{"version":3,"file":"origin.d.ts","sourceRoot":"","sources":["../src/origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAMjD,CAAA;AAED,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAA8C,CAAA;AAIjG;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE;IAAE,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,MAAM,EAAE,CAsB9F;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,GAAE,SAAS,MAAM,EAA0B,GAAG,OAAO,CAahH;AAED,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,CAK/D;AAED,4FAA4F;AAC5F,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,GAAG,SAAS,CAGjG;AAED,wEAAwE;AACxE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,6FAA6F;AAC7F,eAAO,MAAM,QAAQ,EAAE,UAGtB,CAAA;AAED,2GAA2G;AAC3G,eAAO,MAAM,mBAAmB,EAAE,UAIjC,CAAA;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAE,UAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS7H;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAG/F"}

package/dist/origin.js

@@ -10,7 +10,8 @@
  *   - a present `Origin`  allowed only if its host is on the list, otherwise
  *                         403 before any MCP server is built;
  *   - CORS                `Access-Control-Allow-Origin` echoes an allowed
- *                         `Origin` (with `Vary: Origin`). It is never `*`.
+ *                         `Origin` (with `Vary: Origin`). It is never `*`
+ *                         here; the public discovery documents are `*` (`auth/cors.ts`).
  *
  * The list is hostnames. A localhost name matches over `http` or `https` on any
  * port (the MCP Inspector runs at http://localhost:6274). Every other name
@@ -102,20 +103,33 @@ export function originRejection(request, hosts) {
     const origin = request.headers.get("origin");
     return isAllowedOrigin(origin, hosts) ? undefined : forbiddenOrigin(origin);
 }
+/** The MCP endpoint (`/mcp`): its methods and the headers a Streamable HTTP client sends. */
+export const MCP_CORS = {
+    methods: "GET, POST, DELETE, OPTIONS",
+    headers: "Content-Type, MCP-Protocol-Version, MCP-Session-Id, Mcp-Method, Mcp-Name, apikey",
+};
+/** `/token` and `/register`: POST only, a form or JSON body, and client credentials in `Authorization`. */
+export const OAUTH_ENDPOINT_CORS = {
+    methods: "POST, OPTIONS",
+    headers: "Content-Type, Authorization",
+    maxAge: 600,
+};
 /**
  * The CORS headers for a request whose `Origin` is `origin`, already judged
  * `allowed`: the origin echoed back, never `*`. No `Origin`, or one that is not
  * allowed, gets no `Access-Control-Allow-Origin`; `Vary: Origin` is always
  * present so a cache cannot hand one origin's answer to another. Merge `Vary`
- * with `Headers.append`, not `set`.
+ * with `Headers.append`, not `set`. No `Access-Control-Allow-Credentials`: no
+ * route reads a cookie cross-origin.
  */
-export function corsHeadersFor(origin, allowed) {
+export function corsHeadersFor(origin, allowed, policy = MCP_CORS) {
     const headers = { Vary: "Origin" };
     if (origin && allowed) {
         headers["Access-Control-Allow-Origin"] = origin;
-        headers["Access-Control-Allow-Methods"] = "GET, POST, DELETE, OPTIONS";
-        headers["Access-Control-Allow-Headers"] =
-            "Content-Type, MCP-Protocol-Version, MCP-Session-Id, Mcp-Method, Mcp-Name, apikey";
+        headers["Access-Control-Allow-Methods"] = policy.methods;
+        headers["Access-Control-Allow-Headers"] = policy.headers;
+        if (policy.maxAge !== undefined)
+            headers["Access-Control-Max-Age"] = String(policy.maxAge);
     }
     return headers;
 }

package/dist/origin.js.map

@@ -1 +1 @@
-{"version":3,"file":"origin.js","sourceRoot":"","sources":["../src/origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAEtE,iDAAiD;AACjD,MAAM,WAAW,GAAsB,uBAAuB,EAAE,CAAA;AAEhE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,WAAW;IACX,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,eAAe;CAChB,CAAA;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAsB,CAAC,GAAG,oBAAoB,EAAE,GAAG,WAAW,CAAC,CAAA;AAEjG,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAA;AAEvD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAuC;IACzE,MAAM,GAAG,GAAG,GAAG,CAAC,qBAAqB,CAAA;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,qBAAqB,CAAA;IACtC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QAC3D,IAAI,CAAC,KAAK;YAAE,SAAQ;QACpB,IAAI,IAAwB,CAAA;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;YAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE;gBAAE,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAA;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;;YACrB,OAAO,CAAC,IAAI,CAAC,8EAA8E,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACjH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,qBAAqB,EAAE,GAAG,KAAK,CAAC,CAAA;IAClD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC1B,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAqB,EAAE,QAA2B,qBAAqB;IACrG,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,sDAAsD;IACtD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/C,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAA;IACpG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,CAAA;AACrD,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,0BAA0B,MAAM,IAAI,EAAE,EAAE,EAAE,EAAE,EACxG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAC7C,CAAA;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,OAAgB,EAAE,KAAyB;IACzE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,OAAO,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,OAAgB;IACpE,MAAM,OAAO,GAA2B,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC1D,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;QACtB,OAAO,CAAC,6BAA6B,CAAC,GAAG,MAAM,CAAA;QAC/C,OAAO,CAAC,8BAA8B,CAAC,GAAG,4BAA4B,CAAA;QACtE,OAAO,CAAC,8BAA8B,CAAC;YACrC,kFAAkF,CAAA;IACtF,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,OAAgB,EAAE,KAAyB;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,OAAO,cAAc,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;AAC/D,CAAC"}
+{"version":3,"file":"origin.js","sourceRoot":"","sources":["../src/origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAEtE,iDAAiD;AACjD,MAAM,WAAW,GAAsB,uBAAuB,EAAE,CAAA;AAEhE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,WAAW;IACX,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,eAAe;CAChB,CAAA;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAsB,CAAC,GAAG,oBAAoB,EAAE,GAAG,WAAW,CAAC,CAAA;AAEjG,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAA;AAEvD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAuC;IACzE,MAAM,GAAG,GAAG,GAAG,CAAC,qBAAqB,CAAA;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,qBAAqB,CAAA;IACtC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QAC3D,IAAI,CAAC,KAAK;YAAE,SAAQ;QACpB,IAAI,IAAwB,CAAA;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;YAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE;gBAAE,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAA;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;;YACrB,OAAO,CAAC,IAAI,CAAC,8EAA8E,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACjH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,qBAAqB,EAAE,GAAG,KAAK,CAAC,CAAA;IAClD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC1B,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAqB,EAAE,QAA2B,qBAAqB;IACrG,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,sDAAsD;IACtD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/C,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAA;IACpG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,CAAA;AACrD,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,0BAA0B,MAAM,IAAI,EAAE,EAAE,EAAE,EAAE,EACxG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAC7C,CAAA;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,OAAgB,EAAE,KAAyB;IACzE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,OAAO,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;AAC7E,CAAC;AAUD,6FAA6F;AAC7F,MAAM,CAAC,MAAM,QAAQ,GAAe;IAClC,OAAO,EAAE,4BAA4B;IACrC,OAAO,EAAE,kFAAkF;CAC5F,CAAA;AAED,2GAA2G;AAC3G,MAAM,CAAC,MAAM,mBAAmB,GAAe;IAC7C,OAAO,EAAE,eAAe;IACxB,OAAO,EAAE,6BAA6B;IACtC,MAAM,EAAE,GAAG;CACZ,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,OAAgB,EAAE,SAAqB,QAAQ;IACnG,MAAM,OAAO,GAA2B,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC1D,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;QACtB,OAAO,CAAC,6BAA6B,CAAC,GAAG,MAAM,CAAA;QAC/C,OAAO,CAAC,8BAA8B,CAAC,GAAG,MAAM,CAAC,OAAO,CAAA;QACxD,OAAO,CAAC,8BAA8B,CAAC,GAAG,MAAM,CAAC,OAAO,CAAA;QACxD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5F,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,OAAgB,EAAE,KAAyB;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,OAAO,cAAc,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;AAC/D,CAAC"}

package/dist/server.d.ts

@@ -17,7 +17,7 @@ import { floorsOf } from "./floors.js";
 import { type DocsFederationOptions } from "./docs-federation.js";
 import type { FundiToolContext } from "./fundi-client.js";
 import { type IssueDeskContext } from "./tools.js";
-export declare const MZIZI_MCP_VERSION = "0.15.0";
+export declare const MZIZI_MCP_VERSION = "0.16.0";
 export type CreateServerOptions = {
     fundi?: FundiToolContext;
     /** The signed-in user's issue desk. See `tools.ts` — absent off the Worker. */

package/dist/server.js

@@ -21,7 +21,7 @@ import { registerDocsTools, DOCS_MCP_URL } from "./docs-federation.js";
 import { registerMziziTools, TOOL_COVERAGE, TOOL_PREFIX } from "./tools.js";
 import { jsonContent } from "./tool-result.js";
 import { accessFor, accessSummary } from "./access.js";
-export const MZIZI_MCP_VERSION = "0.15.0";
+export const MZIZI_MCP_VERSION = "0.16.0";
 /**
  * What this server exposes, computed from what was actually registered.
  *

package/dist/worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAMnC,YAAY,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAMnC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;;mBASpB,OAAO,OAAO,GAAG,OAAO,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC;;AADnF,wBAqBgC"}
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAOnC,YAAY,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAMnC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;;mBASpB,OAAO,OAAO,GAAG,OAAO,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC;;AADnF,wBAyBgC"}

package/dist/worker.js

@@ -32,6 +32,7 @@ import { limitAnonymous } from "./rate-limit.js";
 import { isAnonymousMcpRequest, isProviderApiPath } from "./auth/front.js";
 import { PROVIDER_OPTIONS } from "./auth/provider-options.js";
 import { allowedHostsFromEnv, originRejection } from "./origin.js";
+import { withProviderCors } from "./auth/cors.js";
 // The per-user issue desk. Exported here because Cloudflare resolves a Durable
 // Object class off the Worker's entry module, and `wrangler.toml` names this
 // file — an unexported class fails the deploy with "class not found", which
@@ -51,7 +52,7 @@ export default {
         // on its API route, which is why the signed-in front needs the gate here
         // too, and it matches the provider's own prefix rule (any path starting
         // with `/mcp`), so `/mcpx` and `/mcp%2Fsignin` cannot slip past. OAuth's own endpoints (`/token`, `/register`, `/authorize`,
-        // `/.well-known/*`) are untouched.
+        // `/.well-known/*`) are not Origin-gated; a refused Origin there only loses CORS (auth/cors.ts).
         if (isProviderApiPath(new URL(request.url).pathname)) {
             const rejected = originRejection(request, hosts);
             if (rejected)
@@ -63,6 +64,11 @@ export default {
                 return limited;
             return serveAnonymous(request, env, hosts);
         }
+        // `/token`, `/register` and `/.well-known/*` are served by the provider, but
+        // its CORS (any Origin echoed) is replaced with ours (auth/cors.ts).
+        const cors = await withProviderCors(request, hosts, () => oauth.fetch(request, env, ctx));
+        if (cors)
+            return cors;
         return oauth.fetch(request, env, ctx);
     },
 };

package/dist/worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,aAAa,MAAM,oCAAoC,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAEzE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAIlE,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,qDAAqD;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC;IAC9B,GAAG,gBAAgB;IACnB,UAAU,EAAE,aAAsB;IAClC,cAAc,EAAE,cAAuB;CACxC,CAAC,CAAA;AAEF,eAAe;IACb,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAQ,EAAE,GAAqB;QAC3D,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;QACtC,uEAAuE;QACvE,yEAAyE;QACzE,4EAA4E;QAC5E,yEAAyE;QACzE,wEAAwE;QACxE,6HAA6H;QAC7H,mCAAmC;QACnC,IAAI,iBAAiB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAChD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAA;QAC/B,CAAC;QACD,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;YACzE,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAA;YAC3B,OAAO,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QAC5C,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;CAC6B,CAAA"}
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,aAAa,MAAM,oCAAoC,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAEzE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAIjD,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,qDAAqD;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC;IAC9B,GAAG,gBAAgB;IACnB,UAAU,EAAE,aAAsB;IAClC,cAAc,EAAE,cAAuB;CACxC,CAAC,CAAA;AAEF,eAAe;IACb,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAQ,EAAE,GAAqB;QAC3D,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;QACtC,uEAAuE;QACvE,yEAAyE;QACzE,4EAA4E;QAC5E,yEAAyE;QACzE,wEAAwE;QACxE,6HAA6H;QAC7H,iGAAiG;QACjG,IAAI,iBAAiB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAChD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAA;QAC/B,CAAC;QACD,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;YACzE,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAA;YAC3B,OAAO,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QAC5C,CAAC;QACD,6EAA6E;QAC7E,qEAAqE;QACrE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACzF,IAAI,IAAI;YAAE,OAAO,IAAI,CAAA;QACrB,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;CAC6B,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nyuchi/mzizi-mcp",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "publishConfig": {
     "access": "public"
   },