@questpie/mcp 3.3.0 → 3.15.0

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as requiredScopesForOperation, i as normalizeRequiredScopes, n as mcpTool, o as scopeGateAllows, r as defaultOperationScope, s as scopesFromContext, t as createMcpServer } from "./create-server-DIvtVlma.mjs";
-import { n as mcp_default, t as mcpModule } from "./mcp-DapXh3Mk.mjs";
+import { n as mcp_default, t as mcpModule } from "./mcp-snyVygDQ.mjs";
 import { t as mcpPlugin } from "./plugin-BJ6gELRj.mjs";
 import { t as startStdioServer } from "./stdio-qyQFVEyU.mjs";
 

package/dist/{mcp-DapXh3Mk.mjs → mcp-snyVygDQ.mjs}

@@ -47,18 +47,23 @@ function withCors(response, request) {
 /**
 * Build the `WWW-Authenticate` challenge value for an unauthenticated HTTP MCP
 * request. `resource_metadata` points at this app's Protected Resource metadata
-* document (RFC 9728), served at the server root by the core `oauth-protected-
-* resource` route (MO4). An MCP client reads it to discover the authorization
-* server and start the OAuth 2.1 flow.
+* document (RFC 9728), served beside the MCP route by the core
+* `oauth-protected-resource` route (MO4). An MCP client reads it to discover
+* the authorization server and start the OAuth 2.1 flow.
 *
-* The origin is derived from `app.config.app.url` — the same base MO2/MO6 use to
-* bind and verify token audience — so the advertised metadata URL always matches
-* where discovery actually lives. `new URL(...).origin` strips any path/query and
-* yields a bare `scheme://host[:port]`, so an app URL with a subpath still
-* produces a root-mounted metadata URL.
+* The public origin comes from `app.config.app.url`, while the mount path comes
+* from the actual MCP request. This keeps the canonical external host used for
+* token audience binding, and also preserves adapter base paths such as `/api`.
 */
-function protectedResourceChallenge(appUrl) {
-	return `Bearer resource_metadata="${new URL(appUrl).origin}/.well-known/oauth-protected-resource"`;
+function protectedResourceChallenge(appUrl, requestUrl) {
+	const request = new URL(requestUrl);
+	request.pathname = request.pathname.replace(/\/+$/, "");
+	const metadataPath = new URL(".well-known/oauth-protected-resource", request).pathname;
+	const metadataUrl = new URL(appUrl);
+	metadataUrl.pathname = metadataPath;
+	metadataUrl.search = "";
+	metadataUrl.hash = "";
+	return `Bearer resource_metadata="${metadataUrl.href}"`;
 }
 /**
 * A verified principal is required to reach MCP tool execution over HTTP. The
@@ -75,7 +80,7 @@ async function mcpHandler(ctx) {
 	if (request.method === "OPTIONS") return withCors(new Response(null, { status: 204 }), request);
 	if (!hasVerifiedPrincipal(ctx)) return withCors(new Response(null, {
 		status: 401,
-		headers: { "WWW-Authenticate": protectedResourceChallenge(app.config.app.url) }
+		headers: { "WWW-Authenticate": protectedResourceChallenge(app.config.app.url, request.url) }
 	}), request);
 	const config = app.state?.config?.mcp ?? {};
 	const server = await createMcpServer(app, {

package/dist/modules/mcp.mjs

@@ -1,3 +1,3 @@
-import { t as mcpModule } from "../mcp-DapXh3Mk.mjs";
+import { t as mcpModule } from "../mcp-snyVygDQ.mjs";
 
 export { mcpModule };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@questpie/mcp",
-	"version": "3.3.0",
+	"version": "3.15.0",
 	"repository": {
 		"type": "git",
 		"url": "https://github.com/questpie/questpie.git",
@@ -16,20 +16,20 @@
 	"types": "./dist/index.d.mts",
 	"exports": {
 		".": {
-			"types": "./src/exports/index.ts",
-			"default": "./src/exports/index.ts"
+			"types": "./dist/index.d.mts",
+			"default": "./dist/index.mjs"
 		},
 		"./modules/mcp": {
-			"types": "./src/exports/modules/mcp.ts",
-			"default": "./src/exports/modules/mcp.ts"
+			"types": "./dist/modules/mcp.d.mts",
+			"default": "./dist/modules/mcp.mjs"
 		},
 		"./plugin": {
-			"types": "./src/exports/plugin.ts",
-			"default": "./src/exports/plugin.ts"
+			"types": "./dist/plugin.d.mts",
+			"default": "./dist/plugin.mjs"
 		},
 		"./stdio": {
-			"types": "./src/exports/stdio.ts",
-			"default": "./src/exports/stdio.ts"
+			"types": "./dist/stdio.d.mts",
+			"default": "./dist/stdio.mjs"
 		},
 		"./package.json": {
 			"types": "./package.json",
@@ -68,7 +68,7 @@
 	},
 	"dependencies": {
 		"@modelcontextprotocol/sdk": "^1.29.0",
-		"questpie": "workspace:*",
+		"questpie": "^3.15.0",
 		"zod": "^4.2.1"
 	},
 	"devDependencies": {