@strapi/core 5.46.0 → 5.47.0

package/dist/services/mcp/authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.js","sources":["../../../src/services/mcp/authentication.ts"],"sourcesContent":["import type { Core, Data } from '@strapi/types';\nimport type { Ability } from '@casl/ability';\nimport type { Context } from 'koa';\n\nexport type McpAdminTokenAbility = Ability;\n\nexport type McpAuthFailureReason = 'missing_token' | 'invalid_token';\n\nexport type McpAdminTokenAuthResult =\n  | { authenticated: false; reason: McpAuthFailureReason; error?: Error }\n  | {\n      authenticated: true;\n      credentials: { id: Data.ID };\n      user: { id: Data.ID };\n      ability: McpAdminTokenAbility;\n    };\n\nconst extractBearerToken = (ctx: Context): string | null => {\n  const authorization = ctx.request.header.authorization;\n\n  if (authorization === undefined) {\n    return null;\n  }\n\n  const parts = authorization.split(/\\s+/);\n\n  if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {\n    return null;\n  }\n\n  return parts[1];\n};\n\nexport const createMcpAdminTokenAuthenticator = (strapi: Core.Strapi) => ({\n  async authenticate(ctx: Context): Promise<McpAdminTokenAuthResult> {\n    const token = extractBearerToken(ctx);\n\n    if (token === null) {\n      return { authenticated: false, reason: 'missing_token' };\n    }\n\n    const authResult = (await strapi.admin.services['api-token-admin'].authenticateAdminToken(\n      token\n    )) as McpAdminTokenAuthResult;\n\n    if (authResult.authenticated === false) {\n      return {\n        authenticated: false,\n        reason: 'invalid_token',\n        error: authResult.error,\n      };\n    }\n\n    return {\n      authenticated: true,\n      credentials: { id: authResult.credentials.id },\n      user: { id: authResult.user.id },\n      ability: authResult.ability,\n    };\n  },\n});\n"],"names":["extractBearerToken","ctx","authorization","request","header","undefined","parts","split","toLowerCase","length","createMcpAdminTokenAuthenticator","strapi","authenticate","token","authenticated","reason","authResult","admin","services","authenticateAdminToken","error","credentials","id","user","ability"],"mappings":";;AAiBA,MAAMA,qBAAqB,CAACC,GAAAA,GAAAA;AAC1B,IAAA,MAAMC,gBAAgBD,GAAAA,CAAIE,OAAO,CAACC,MAAM,CAACF,aAAa;AAEtD,IAAA,IAAIA,kBAAkBG,SAAAA,EAAW;QAC/B,OAAO,IAAA;AACT,IAAA;IAEA,MAAMC,KAAAA,GAAQJ,aAAAA,CAAcK,KAAK,CAAC,KAAA,CAAA;IAElC,IAAID,KAAK,CAAC,CAAA,CAAE,CAACE,WAAW,OAAO,QAAA,IAAYF,KAAAA,CAAMG,MAAM,KAAK,CAAA,EAAG;QAC7D,OAAO,IAAA;AACT,IAAA;IAEA,OAAOH,KAAK,CAAC,CAAA,CAAE;AACjB,CAAA;AAEO,MAAMI,gCAAAA,GAAmC,CAACC,MAAAA,IAAyB;AACxE,QAAA,MAAMC,cAAaX,GAAY,EAAA;AAC7B,YAAA,MAAMY,QAAQb,kBAAAA,CAAmBC,GAAAA,CAAAA;AAEjC,YAAA,IAAIY,UAAU,IAAA,EAAM;gBAClB,OAAO;oBAAEC,aAAAA,EAAe,KAAA;oBAAOC,MAAAA,EAAQ;AAAgB,iBAAA;AACzD,YAAA;YAEA,MAAMC,UAAAA,GAAc,MAAML,MAAAA,CAAOM,KAAK,CAACC,QAAQ,CAAC,iBAAA,CAAkB,CAACC,sBAAsB,CACvFN,KAAAA,CAAAA;YAGF,IAAIG,UAAAA,CAAWF,aAAa,KAAK,KAAA,EAAO;gBACtC,OAAO;oBACLA,aAAAA,EAAe,KAAA;oBACfC,MAAAA,EAAQ,eAAA;AACRK,oBAAAA,KAAAA,EAAOJ,WAAWI;AACpB,iBAAA;AACF,YAAA;YAEA,OAAO;gBACLN,aAAAA,EAAe,IAAA;gBACfO,WAAAA,EAAa;oBAAEC,EAAAA,EAAIN,UAAAA,CAAWK,WAAW,CAACC;AAAG,iBAAA;gBAC7CC,IAAAA,EAAM;oBAAED,EAAAA,EAAIN,UAAAA,CAAWO,IAAI,CAACD;AAAG,iBAAA;AAC/BE,gBAAAA,OAAAA,EAASR,WAAWQ;AACtB,aAAA;AACF,QAAA;AACF,KAAA;;;;"}

package/dist/services/mcp/authentication.mjs

@@ -0,0 +1,43 @@
+const extractBearerToken = (ctx)=>{
+    const authorization = ctx.request.header.authorization;
+    if (authorization === undefined) {
+        return null;
+    }
+    const parts = authorization.split(/\s+/);
+    if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {
+        return null;
+    }
+    return parts[1];
+};
+const createMcpAdminTokenAuthenticator = (strapi)=>({
+        async authenticate (ctx) {
+            const token = extractBearerToken(ctx);
+            if (token === null) {
+                return {
+                    authenticated: false,
+                    reason: 'missing_token'
+                };
+            }
+            const authResult = await strapi.admin.services['api-token-admin'].authenticateAdminToken(token);
+            if (authResult.authenticated === false) {
+                return {
+                    authenticated: false,
+                    reason: 'invalid_token',
+                    error: authResult.error
+                };
+            }
+            return {
+                authenticated: true,
+                credentials: {
+                    id: authResult.credentials.id
+                },
+                user: {
+                    id: authResult.user.id
+                },
+                ability: authResult.ability
+            };
+        }
+    });
+
+export { createMcpAdminTokenAuthenticator };
+//# sourceMappingURL=authentication.mjs.map

package/dist/services/mcp/authentication.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.mjs","sources":["../../../src/services/mcp/authentication.ts"],"sourcesContent":["import type { Core, Data } from '@strapi/types';\nimport type { Ability } from '@casl/ability';\nimport type { Context } from 'koa';\n\nexport type McpAdminTokenAbility = Ability;\n\nexport type McpAuthFailureReason = 'missing_token' | 'invalid_token';\n\nexport type McpAdminTokenAuthResult =\n  | { authenticated: false; reason: McpAuthFailureReason; error?: Error }\n  | {\n      authenticated: true;\n      credentials: { id: Data.ID };\n      user: { id: Data.ID };\n      ability: McpAdminTokenAbility;\n    };\n\nconst extractBearerToken = (ctx: Context): string | null => {\n  const authorization = ctx.request.header.authorization;\n\n  if (authorization === undefined) {\n    return null;\n  }\n\n  const parts = authorization.split(/\\s+/);\n\n  if (parts[0].toLowerCase() !== 'bearer' || parts.length !== 2) {\n    return null;\n  }\n\n  return parts[1];\n};\n\nexport const createMcpAdminTokenAuthenticator = (strapi: Core.Strapi) => ({\n  async authenticate(ctx: Context): Promise<McpAdminTokenAuthResult> {\n    const token = extractBearerToken(ctx);\n\n    if (token === null) {\n      return { authenticated: false, reason: 'missing_token' };\n    }\n\n    const authResult = (await strapi.admin.services['api-token-admin'].authenticateAdminToken(\n      token\n    )) as McpAdminTokenAuthResult;\n\n    if (authResult.authenticated === false) {\n      return {\n        authenticated: false,\n        reason: 'invalid_token',\n        error: authResult.error,\n      };\n    }\n\n    return {\n      authenticated: true,\n      credentials: { id: authResult.credentials.id },\n      user: { id: authResult.user.id },\n      ability: authResult.ability,\n    };\n  },\n});\n"],"names":["extractBearerToken","ctx","authorization","request","header","undefined","parts","split","toLowerCase","length","createMcpAdminTokenAuthenticator","strapi","authenticate","token","authenticated","reason","authResult","admin","services","authenticateAdminToken","error","credentials","id","user","ability"],"mappings":"AAiBA,MAAMA,qBAAqB,CAACC,GAAAA,GAAAA;AAC1B,IAAA,MAAMC,gBAAgBD,GAAAA,CAAIE,OAAO,CAACC,MAAM,CAACF,aAAa;AAEtD,IAAA,IAAIA,kBAAkBG,SAAAA,EAAW;QAC/B,OAAO,IAAA;AACT,IAAA;IAEA,MAAMC,KAAAA,GAAQJ,aAAAA,CAAcK,KAAK,CAAC,KAAA,CAAA;IAElC,IAAID,KAAK,CAAC,CAAA,CAAE,CAACE,WAAW,OAAO,QAAA,IAAYF,KAAAA,CAAMG,MAAM,KAAK,CAAA,EAAG;QAC7D,OAAO,IAAA;AACT,IAAA;IAEA,OAAOH,KAAK,CAAC,CAAA,CAAE;AACjB,CAAA;AAEO,MAAMI,gCAAAA,GAAmC,CAACC,MAAAA,IAAyB;AACxE,QAAA,MAAMC,cAAaX,GAAY,EAAA;AAC7B,YAAA,MAAMY,QAAQb,kBAAAA,CAAmBC,GAAAA,CAAAA;AAEjC,YAAA,IAAIY,UAAU,IAAA,EAAM;gBAClB,OAAO;oBAAEC,aAAAA,EAAe,KAAA;oBAAOC,MAAAA,EAAQ;AAAgB,iBAAA;AACzD,YAAA;YAEA,MAAMC,UAAAA,GAAc,MAAML,MAAAA,CAAOM,KAAK,CAACC,QAAQ,CAAC,iBAAA,CAAkB,CAACC,sBAAsB,CACvFN,KAAAA,CAAAA;YAGF,IAAIG,UAAAA,CAAWF,aAAa,KAAK,KAAA,EAAO;gBACtC,OAAO;oBACLA,aAAAA,EAAe,KAAA;oBACfC,MAAAA,EAAQ,eAAA;AACRK,oBAAAA,KAAAA,EAAOJ,WAAWI;AACpB,iBAAA;AACF,YAAA;YAEA,OAAO;gBACLN,aAAAA,EAAe,IAAA;gBACfO,WAAAA,EAAa;oBAAEC,EAAAA,EAAIN,UAAAA,CAAWK,WAAW,CAACC;AAAG,iBAAA;gBAC7CC,IAAAA,EAAM;oBAAED,EAAAA,EAAIN,UAAAA,CAAWO,IAAI,CAACD;AAAG,iBAAA;AAC/BE,gBAAAA,OAAAA,EAASR,WAAWQ;AACtB,aAAA;AACF,QAAA;AACF,KAAA;;;;"}

package/dist/services/mcp/handlers/handlePost.d.ts

@@ -0,0 +1,4 @@
+import type { Core } from '@strapi/types';
+import type { McpHandlerDependencies } from './types';
+export declare const createPostHandler: (deps: McpHandlerDependencies) => Core.MiddlewareHandler;
+//# sourceMappingURL=handlePost.d.ts.map

package/dist/services/mcp/handlers/handlePost.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlePost.d.ts","sourceRoot":"","sources":["../../../../src/services/mcp/handlers/handlePost.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAS1C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAEtD,eAAO,MAAM,iBAAiB,SAAU,sBAAsB,KAAG,KAAK,iBAuErE,CAAC"}

package/dist/services/mcp/handlers/handlePost.js

@@ -0,0 +1,59 @@
+'use strict';
+
+var streamableHttp_js = require('@modelcontextprotocol/sdk/server/streamableHttp.js');
+var metrics = require('../metrics/metrics.js');
+var sendJsonRpcError = require('../utils/sendJsonRpcError.js');
+var withTimeout = require('../utils/withTimeout.js');
+
+// eslint-disable-next-line import/extensions
+const createPostHandler = (deps)=>{
+    const { strapi, authenticationStrategy, config, createServerWithRegistries, capabilityDefinitions } = deps;
+    return async (ctx)=>{
+        // Opt out of Koa's response phase — the MCP SDK writes directly to ctx.res
+        // (via res.writeHead / res.end / SSE streaming). Without this, Koa's respond()
+        // would also try to write ctx.body to the socket after the handler returns.
+        ctx.respond = false;
+        const req = ctx.req;
+        const res = ctx.res;
+        let hadAuthenticatedMcpRequest = false;
+        try {
+            const authResult = await authenticationStrategy.authenticate(ctx);
+            if (authResult.authenticated === false) {
+                metrics.sendDidNotAuthenticateMcpRequest(strapi, authResult.reason);
+                sendJsonRpcError.sendJsonRpcError(res, 'AUTHENTICATION_REQUIRED');
+                return;
+            }
+            hadAuthenticatedMcpRequest = true;
+            metrics.sendDidUseMcpServer(strapi);
+            const { mcpServer } = createServerWithRegistries({
+                strapi,
+                definitions: capabilityDefinitions,
+                isDevMode: config.isDevMode(),
+                ability: authResult.ability,
+                user: authResult.user
+            });
+            const transport = new streamableHttp_js.StreamableHTTPServerTransport({
+                sessionIdGenerator: undefined
+            });
+            try {
+                await withTimeout.withTimeout(mcpServer.connect(transport), config.connectTimeoutMs, 'mcpServer.connect');
+                const requestBody = ctx.request.body ?? null;
+                await withTimeout.withTimeout(transport.handleRequest(req, res, requestBody), config.requestTimeoutMs, 'transport.handleRequest');
+            } finally{
+                await mcpServer.close();
+            }
+        } catch (error) {
+            strapi.log.error('[MCP] Error handling POST request', {
+                error: error instanceof Error ? error.message : 'Unknown error',
+                stack: error instanceof Error ? error.stack : undefined
+            });
+            sendJsonRpcError.sendJsonRpcError(res, 'INTERNAL_ERROR');
+            if (hadAuthenticatedMcpRequest) {
+                metrics.sendDidNotHandleMcpRequest(strapi, metrics.classifyMcpRequestFailure(error));
+            }
+        }
+    };
+};
+
+exports.createPostHandler = createPostHandler;
+//# sourceMappingURL=handlePost.js.map

package/dist/services/mcp/handlers/handlePost.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlePost.js","sources":["../../../../src/services/mcp/handlers/handlePost.ts"],"sourcesContent":["// eslint-disable-next-line import/extensions\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\nimport type { Core } from '@strapi/types';\nimport {\n  classifyMcpRequestFailure,\n  sendDidNotAuthenticateMcpRequest,\n  sendDidNotHandleMcpRequest,\n  sendDidUseMcpServer,\n} from '../metrics/metrics';\nimport { sendJsonRpcError } from '../utils/sendJsonRpcError';\nimport { withTimeout } from '../utils/withTimeout';\nimport type { McpHandlerDependencies } from './types';\n\nexport const createPostHandler = (deps: McpHandlerDependencies): Core.MiddlewareHandler => {\n  const {\n    strapi,\n    authenticationStrategy,\n    config,\n    createServerWithRegistries,\n    capabilityDefinitions,\n  } = deps;\n\n  return async (ctx) => {\n    // Opt out of Koa's response phase — the MCP SDK writes directly to ctx.res\n    // (via res.writeHead / res.end / SSE streaming). Without this, Koa's respond()\n    // would also try to write ctx.body to the socket after the handler returns.\n    ctx.respond = false;\n    const req = ctx.req;\n    const res = ctx.res;\n\n    let hadAuthenticatedMcpRequest = false;\n\n    try {\n      const authResult = await authenticationStrategy.authenticate(ctx);\n      if (authResult.authenticated === false) {\n        sendDidNotAuthenticateMcpRequest(strapi, authResult.reason);\n        sendJsonRpcError(res, 'AUTHENTICATION_REQUIRED');\n        return;\n      }\n\n      hadAuthenticatedMcpRequest = true;\n      sendDidUseMcpServer(strapi);\n\n      const { mcpServer } = createServerWithRegistries({\n        strapi,\n        definitions: capabilityDefinitions,\n        isDevMode: config.isDevMode(),\n        ability: authResult.ability,\n        user: authResult.user,\n      });\n\n      const transport = new StreamableHTTPServerTransport({\n        sessionIdGenerator: undefined,\n      });\n\n      try {\n        await withTimeout(\n          mcpServer.connect(transport),\n          config.connectTimeoutMs,\n          'mcpServer.connect'\n        );\n\n        const requestBody = ctx.request.body ?? null;\n        await withTimeout(\n          transport.handleRequest(req, res, requestBody),\n          config.requestTimeoutMs,\n          'transport.handleRequest'\n        );\n      } finally {\n        await mcpServer.close();\n      }\n    } catch (error) {\n      strapi.log.error('[MCP] Error handling POST request', {\n        error: error instanceof Error ? error.message : 'Unknown error',\n        stack: error instanceof Error ? error.stack : undefined,\n      });\n\n      sendJsonRpcError(res, 'INTERNAL_ERROR');\n\n      if (hadAuthenticatedMcpRequest) {\n        sendDidNotHandleMcpRequest(strapi, classifyMcpRequestFailure(error));\n      }\n    }\n  };\n};\n"],"names":["createPostHandler","deps","strapi","authenticationStrategy","config","createServerWithRegistries","capabilityDefinitions","ctx","respond","req","res","hadAuthenticatedMcpRequest","authResult","authenticate","authenticated","sendDidNotAuthenticateMcpRequest","reason","sendJsonRpcError","sendDidUseMcpServer","mcpServer","definitions","isDevMode","ability","user","transport","StreamableHTTPServerTransport","sessionIdGenerator","undefined","withTimeout","connect","connectTimeoutMs","requestBody","request","body","handleRequest","requestTimeoutMs","close","error","log","Error","message","stack","sendDidNotHandleMcpRequest","classifyMcpRequestFailure"],"mappings":";;;;;;;AAAA;AAaO,MAAMA,oBAAoB,CAACC,IAAAA,GAAAA;IAChC,MAAM,EACJC,MAAM,EACNC,sBAAsB,EACtBC,MAAM,EACNC,0BAA0B,EAC1BC,qBAAqB,EACtB,GAAGL,IAAAA;AAEJ,IAAA,OAAO,OAAOM,GAAAA,GAAAA;;;;AAIZA,QAAAA,GAAAA,CAAIC,OAAO,GAAG,KAAA;QACd,MAAMC,GAAAA,GAAMF,IAAIE,GAAG;QACnB,MAAMC,GAAAA,GAAMH,IAAIG,GAAG;AAEnB,QAAA,IAAIC,0BAAAA,GAA6B,KAAA;QAEjC,IAAI;AACF,YAAA,MAAMC,UAAAA,GAAa,MAAMT,sBAAAA,CAAuBU,YAAY,CAACN,GAAAA,CAAAA;YAC7D,IAAIK,UAAAA,CAAWE,aAAa,KAAK,KAAA,EAAO;gBACtCC,wCAAAA,CAAiCb,MAAAA,EAAQU,WAAWI,MAAM,CAAA;AAC1DC,gBAAAA,iCAAAA,CAAiBP,GAAAA,EAAK,yBAAA,CAAA;AACtB,gBAAA;AACF,YAAA;YAEAC,0BAAAA,GAA6B,IAAA;YAC7BO,2BAAAA,CAAoBhB,MAAAA,CAAAA;AAEpB,YAAA,MAAM,EAAEiB,SAAS,EAAE,GAAGd,0BAAAA,CAA2B;AAC/CH,gBAAAA,MAAAA;gBACAkB,WAAAA,EAAad,qBAAAA;AACbe,gBAAAA,SAAAA,EAAWjB,OAAOiB,SAAS,EAAA;AAC3BC,gBAAAA,OAAAA,EAASV,WAAWU,OAAO;AAC3BC,gBAAAA,IAAAA,EAAMX,WAAWW;AACnB,aAAA,CAAA;YAEA,MAAMC,SAAAA,GAAY,IAAIC,+CAAAA,CAA8B;gBAClDC,kBAAAA,EAAoBC;AACtB,aAAA,CAAA;YAEA,IAAI;AACF,gBAAA,MAAMC,wBACJT,SAAAA,CAAUU,OAAO,CAACL,SAAAA,CAAAA,EAClBpB,MAAAA,CAAO0B,gBAAgB,EACvB,mBAAA,CAAA;AAGF,gBAAA,MAAMC,WAAAA,GAAcxB,GAAAA,CAAIyB,OAAO,CAACC,IAAI,IAAI,IAAA;gBACxC,MAAML,uBAAAA,CACJJ,UAAUU,aAAa,CAACzB,KAAKC,GAAAA,EAAKqB,WAAAA,CAAAA,EAClC3B,MAAAA,CAAO+B,gBAAgB,EACvB,yBAAA,CAAA;YAEJ,CAAA,QAAU;AACR,gBAAA,MAAMhB,UAAUiB,KAAK,EAAA;AACvB,YAAA;AACF,QAAA,CAAA,CAAE,OAAOC,KAAAA,EAAO;AACdnC,YAAAA,MAAAA,CAAOoC,GAAG,CAACD,KAAK,CAAC,mCAAA,EAAqC;AACpDA,gBAAAA,KAAAA,EAAOA,KAAAA,YAAiBE,KAAAA,GAAQF,KAAAA,CAAMG,OAAO,GAAG,eAAA;AAChDC,gBAAAA,KAAAA,EAAOJ,KAAAA,YAAiBE,KAAAA,GAAQF,KAAAA,CAAMI,KAAK,GAAGd;AAChD,aAAA,CAAA;AAEAV,YAAAA,iCAAAA,CAAiBP,GAAAA,EAAK,gBAAA,CAAA;AAEtB,YAAA,IAAIC,0BAAAA,EAA4B;AAC9B+B,gBAAAA,kCAAAA,CAA2BxC,QAAQyC,iCAAAA,CAA0BN,KAAAA,CAAAA,CAAAA;AAC/D,YAAA;AACF,QAAA;AACF,IAAA,CAAA;AACF;;;;"}

package/dist/services/mcp/handlers/handlePost.mjs

@@ -0,0 +1,57 @@
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { sendDidNotAuthenticateMcpRequest, sendDidUseMcpServer, sendDidNotHandleMcpRequest, classifyMcpRequestFailure } from '../metrics/metrics.mjs';
+import { sendJsonRpcError } from '../utils/sendJsonRpcError.mjs';
+import { withTimeout } from '../utils/withTimeout.mjs';
+
+// eslint-disable-next-line import/extensions
+const createPostHandler = (deps)=>{
+    const { strapi, authenticationStrategy, config, createServerWithRegistries, capabilityDefinitions } = deps;
+    return async (ctx)=>{
+        // Opt out of Koa's response phase — the MCP SDK writes directly to ctx.res
+        // (via res.writeHead / res.end / SSE streaming). Without this, Koa's respond()
+        // would also try to write ctx.body to the socket after the handler returns.
+        ctx.respond = false;
+        const req = ctx.req;
+        const res = ctx.res;
+        let hadAuthenticatedMcpRequest = false;
+        try {
+            const authResult = await authenticationStrategy.authenticate(ctx);
+            if (authResult.authenticated === false) {
+                sendDidNotAuthenticateMcpRequest(strapi, authResult.reason);
+                sendJsonRpcError(res, 'AUTHENTICATION_REQUIRED');
+                return;
+            }
+            hadAuthenticatedMcpRequest = true;
+            sendDidUseMcpServer(strapi);
+            const { mcpServer } = createServerWithRegistries({
+                strapi,
+                definitions: capabilityDefinitions,
+                isDevMode: config.isDevMode(),
+                ability: authResult.ability,
+                user: authResult.user
+            });
+            const transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: undefined
+            });
+            try {
+                await withTimeout(mcpServer.connect(transport), config.connectTimeoutMs, 'mcpServer.connect');
+                const requestBody = ctx.request.body ?? null;
+                await withTimeout(transport.handleRequest(req, res, requestBody), config.requestTimeoutMs, 'transport.handleRequest');
+            } finally{
+                await mcpServer.close();
+            }
+        } catch (error) {
+            strapi.log.error('[MCP] Error handling POST request', {
+                error: error instanceof Error ? error.message : 'Unknown error',
+                stack: error instanceof Error ? error.stack : undefined
+            });
+            sendJsonRpcError(res, 'INTERNAL_ERROR');
+            if (hadAuthenticatedMcpRequest) {
+                sendDidNotHandleMcpRequest(strapi, classifyMcpRequestFailure(error));
+            }
+        }
+    };
+};
+
+export { createPostHandler };
+//# sourceMappingURL=handlePost.mjs.map

package/dist/services/mcp/handlers/handlePost.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlePost.mjs","sources":["../../../../src/services/mcp/handlers/handlePost.ts"],"sourcesContent":["// eslint-disable-next-line import/extensions\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\nimport type { Core } from '@strapi/types';\nimport {\n  classifyMcpRequestFailure,\n  sendDidNotAuthenticateMcpRequest,\n  sendDidNotHandleMcpRequest,\n  sendDidUseMcpServer,\n} from '../metrics/metrics';\nimport { sendJsonRpcError } from '../utils/sendJsonRpcError';\nimport { withTimeout } from '../utils/withTimeout';\nimport type { McpHandlerDependencies } from './types';\n\nexport const createPostHandler = (deps: McpHandlerDependencies): Core.MiddlewareHandler => {\n  const {\n    strapi,\n    authenticationStrategy,\n    config,\n    createServerWithRegistries,\n    capabilityDefinitions,\n  } = deps;\n\n  return async (ctx) => {\n    // Opt out of Koa's response phase — the MCP SDK writes directly to ctx.res\n    // (via res.writeHead / res.end / SSE streaming). Without this, Koa's respond()\n    // would also try to write ctx.body to the socket after the handler returns.\n    ctx.respond = false;\n    const req = ctx.req;\n    const res = ctx.res;\n\n    let hadAuthenticatedMcpRequest = false;\n\n    try {\n      const authResult = await authenticationStrategy.authenticate(ctx);\n      if (authResult.authenticated === false) {\n        sendDidNotAuthenticateMcpRequest(strapi, authResult.reason);\n        sendJsonRpcError(res, 'AUTHENTICATION_REQUIRED');\n        return;\n      }\n\n      hadAuthenticatedMcpRequest = true;\n      sendDidUseMcpServer(strapi);\n\n      const { mcpServer } = createServerWithRegistries({\n        strapi,\n        definitions: capabilityDefinitions,\n        isDevMode: config.isDevMode(),\n        ability: authResult.ability,\n        user: authResult.user,\n      });\n\n      const transport = new StreamableHTTPServerTransport({\n        sessionIdGenerator: undefined,\n      });\n\n      try {\n        await withTimeout(\n          mcpServer.connect(transport),\n          config.connectTimeoutMs,\n          'mcpServer.connect'\n        );\n\n        const requestBody = ctx.request.body ?? null;\n        await withTimeout(\n          transport.handleRequest(req, res, requestBody),\n          config.requestTimeoutMs,\n          'transport.handleRequest'\n        );\n      } finally {\n        await mcpServer.close();\n      }\n    } catch (error) {\n      strapi.log.error('[MCP] Error handling POST request', {\n        error: error instanceof Error ? error.message : 'Unknown error',\n        stack: error instanceof Error ? error.stack : undefined,\n      });\n\n      sendJsonRpcError(res, 'INTERNAL_ERROR');\n\n      if (hadAuthenticatedMcpRequest) {\n        sendDidNotHandleMcpRequest(strapi, classifyMcpRequestFailure(error));\n      }\n    }\n  };\n};\n"],"names":["createPostHandler","deps","strapi","authenticationStrategy","config","createServerWithRegistries","capabilityDefinitions","ctx","respond","req","res","hadAuthenticatedMcpRequest","authResult","authenticate","authenticated","sendDidNotAuthenticateMcpRequest","reason","sendJsonRpcError","sendDidUseMcpServer","mcpServer","definitions","isDevMode","ability","user","transport","StreamableHTTPServerTransport","sessionIdGenerator","undefined","withTimeout","connect","connectTimeoutMs","requestBody","request","body","handleRequest","requestTimeoutMs","close","error","log","Error","message","stack","sendDidNotHandleMcpRequest","classifyMcpRequestFailure"],"mappings":";;;;;AAAA;AAaO,MAAMA,oBAAoB,CAACC,IAAAA,GAAAA;IAChC,MAAM,EACJC,MAAM,EACNC,sBAAsB,EACtBC,MAAM,EACNC,0BAA0B,EAC1BC,qBAAqB,EACtB,GAAGL,IAAAA;AAEJ,IAAA,OAAO,OAAOM,GAAAA,GAAAA;;;;AAIZA,QAAAA,GAAAA,CAAIC,OAAO,GAAG,KAAA;QACd,MAAMC,GAAAA,GAAMF,IAAIE,GAAG;QACnB,MAAMC,GAAAA,GAAMH,IAAIG,GAAG;AAEnB,QAAA,IAAIC,0BAAAA,GAA6B,KAAA;QAEjC,IAAI;AACF,YAAA,MAAMC,UAAAA,GAAa,MAAMT,sBAAAA,CAAuBU,YAAY,CAACN,GAAAA,CAAAA;YAC7D,IAAIK,UAAAA,CAAWE,aAAa,KAAK,KAAA,EAAO;gBACtCC,gCAAAA,CAAiCb,MAAAA,EAAQU,WAAWI,MAAM,CAAA;AAC1DC,gBAAAA,gBAAAA,CAAiBP,GAAAA,EAAK,yBAAA,CAAA;AACtB,gBAAA;AACF,YAAA;YAEAC,0BAAAA,GAA6B,IAAA;YAC7BO,mBAAAA,CAAoBhB,MAAAA,CAAAA;AAEpB,YAAA,MAAM,EAAEiB,SAAS,EAAE,GAAGd,0BAAAA,CAA2B;AAC/CH,gBAAAA,MAAAA;gBACAkB,WAAAA,EAAad,qBAAAA;AACbe,gBAAAA,SAAAA,EAAWjB,OAAOiB,SAAS,EAAA;AAC3BC,gBAAAA,OAAAA,EAASV,WAAWU,OAAO;AAC3BC,gBAAAA,IAAAA,EAAMX,WAAWW;AACnB,aAAA,CAAA;YAEA,MAAMC,SAAAA,GAAY,IAAIC,6BAAAA,CAA8B;gBAClDC,kBAAAA,EAAoBC;AACtB,aAAA,CAAA;YAEA,IAAI;AACF,gBAAA,MAAMC,YACJT,SAAAA,CAAUU,OAAO,CAACL,SAAAA,CAAAA,EAClBpB,MAAAA,CAAO0B,gBAAgB,EACvB,mBAAA,CAAA;AAGF,gBAAA,MAAMC,WAAAA,GAAcxB,GAAAA,CAAIyB,OAAO,CAACC,IAAI,IAAI,IAAA;gBACxC,MAAML,WAAAA,CACJJ,UAAUU,aAAa,CAACzB,KAAKC,GAAAA,EAAKqB,WAAAA,CAAAA,EAClC3B,MAAAA,CAAO+B,gBAAgB,EACvB,yBAAA,CAAA;YAEJ,CAAA,QAAU;AACR,gBAAA,MAAMhB,UAAUiB,KAAK,EAAA;AACvB,YAAA;AACF,QAAA,CAAA,CAAE,OAAOC,KAAAA,EAAO;AACdnC,YAAAA,MAAAA,CAAOoC,GAAG,CAACD,KAAK,CAAC,mCAAA,EAAqC;AACpDA,gBAAAA,KAAAA,EAAOA,KAAAA,YAAiBE,KAAAA,GAAQF,KAAAA,CAAMG,OAAO,GAAG,eAAA;AAChDC,gBAAAA,KAAAA,EAAOJ,KAAAA,YAAiBE,KAAAA,GAAQF,KAAAA,CAAMI,KAAK,GAAGd;AAChD,aAAA,CAAA;AAEAV,YAAAA,gBAAAA,CAAiBP,GAAAA,EAAK,gBAAA,CAAA;AAEtB,YAAA,IAAIC,0BAAAA,EAA4B;AAC9B+B,gBAAAA,0BAAAA,CAA2BxC,QAAQyC,yBAAAA,CAA0BN,KAAAA,CAAAA,CAAAA;AAC/D,YAAA;AACF,QAAA;AACF,IAAA,CAAA;AACF;;;;"}

package/dist/services/mcp/handlers/types.d.ts

@@ -0,0 +1,12 @@
+import type { Core } from '@strapi/types';
+import type { McpConfiguration } from '../internal/McpConfiguration';
+import type { McpCapabilityDefinitions, createMcpServerWithRegistries } from '../internal/McpServerFactory';
+import type { createMcpAdminTokenAuthenticator } from '../authentication';
+export type McpHandlerDependencies = {
+    strapi: Core.Strapi;
+    authenticationStrategy: ReturnType<typeof createMcpAdminTokenAuthenticator>;
+    config: McpConfiguration;
+    createServerWithRegistries: typeof createMcpServerWithRegistries;
+    capabilityDefinitions: McpCapabilityDefinitions;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/services/mcp/handlers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/services/mcp/handlers/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EACV,wBAAwB,EACxB,6BAA6B,EAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,mBAAmB,CAAC;AAE1E,MAAM,MAAM,sBAAsB,GAAG;IACnC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IACpB,sBAAsB,EAAE,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC;IAC5E,MAAM,EAAE,gBAAgB,CAAC;IACzB,0BAA0B,EAAE,OAAO,6BAA6B,CAAC;IACjE,qBAAqB,EAAE,wBAAwB,CAAC;CACjD,CAAC"}

package/dist/services/mcp/index.d.ts

@@ -0,0 +1,6 @@
+import type { Core, Modules } from '@strapi/types';
+/**
+ * Creates an MCP service instance for Strapi Core
+ */
+export declare const createMcpService: (strapi: Core.Strapi) => Modules.MCP.McpService;
+//# sourceMappingURL=index.d.ts.map

package/dist/services/mcp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAYnD;;GAEG;AACH,eAAO,MAAM,gBAAgB,WAAY,KAAK,MAAM,KAAG,QAAQ,GAAG,CAAC,UAsHlE,CAAC"}

package/dist/services/mcp/index.js

@@ -0,0 +1,101 @@
+'use strict';
+
+var authentication = require('./authentication.js');
+var handlePost = require('./handlers/handlePost.js');
+var McpCapabilityDefinitionRegistry = require('./internal/McpCapabilityDefinitionRegistry.js');
+var McpConfiguration = require('./internal/McpConfiguration.js');
+var McpServerFactory = require('./internal/McpServerFactory.js');
+var oauthDiscoveryFallback = require('./middleware/oauthDiscoveryFallback.js');
+var routes = require('./routes.js');
+var metrics = require('./metrics/metrics.js');
+var log = require('./tools/log.js');
+
+/**
+ * Creates an MCP service instance for Strapi Core
+ */ const createMcpService = (strapi)=>{
+    // Initialize configuration
+    const config = new McpConfiguration.McpConfiguration(strapi);
+    const authenticationStrategy = authentication.createMcpAdminTokenAuthenticator(strapi);
+    // Status tracking
+    let serverStatus = 'idle';
+    // Definition registries
+    const toolDefinitions = new McpCapabilityDefinitionRegistry.McpCapabilityDefinitionRegistry('tool');
+    const promptDefinitions = new McpCapabilityDefinitionRegistry.McpCapabilityDefinitionRegistry('prompt');
+    const resourceDefinitions = new McpCapabilityDefinitionRegistry.McpCapabilityDefinitionRegistry('resource');
+    // Prepare handler dependencies
+    const handlerDependencies = {
+        strapi,
+        authenticationStrategy,
+        config,
+        createServerWithRegistries: McpServerFactory.createMcpServerWithRegistries,
+        capabilityDefinitions: {
+            tools: toolDefinitions,
+            prompts: promptDefinitions,
+            resources: resourceDefinitions
+        }
+    };
+    // Create HTTP handlers
+    const handlePost$1 = handlePost.createPostHandler(handlerDependencies);
+    const service = {
+        isEnabled () {
+            return config.isEnabled();
+        },
+        isRunning () {
+            return serverStatus === 'running';
+        },
+        registerTool (tool) {
+            if (serverStatus !== 'idle') {
+                throw new Error('[MCP] Tools must be registered before MCP server starts. Register during plugin register().');
+            }
+            toolDefinitions.define(tool);
+        },
+        registerPrompt (prompt) {
+            if (serverStatus !== 'idle') {
+                throw new Error('[MCP] Prompts must be registered before MCP server starts. Register during plugin register().');
+            }
+            promptDefinitions.define(prompt);
+        },
+        registerResource (resource) {
+            if (serverStatus !== 'idle') {
+                throw new Error('[MCP] Resources must be registered before MCP server starts. Register during plugin register().');
+            }
+            resourceDefinitions.define(resource);
+        },
+        async start () {
+            if (service.isEnabled() === false) {
+                strapi.log.debug('[MCP] Server is disabled');
+                return;
+            }
+            if (serverStatus === 'error') {
+                throw new Error('[MCP] Cannot start server: previous error state');
+            }
+            if (serverStatus !== 'idle') {
+                throw new Error(`[MCP] Server already started or starting (status: ${serverStatus})`);
+            }
+            serverStatus = 'starting';
+            strapi.server.use(oauthDiscoveryFallback.createOAuthDiscoveryFallbackMiddleware());
+            const routes$1 = routes.createMcpRoutes(config, {
+                handlePost: handlePost$1
+            });
+            strapi.server.routes(routes$1);
+            serverStatus = 'running';
+            metrics.sendDidStartMcpServer(strapi, {
+                path: config.path,
+                numberOfTools: toolDefinitions.size,
+                numberOfPrompts: promptDefinitions.size,
+                numberOfResources: resourceDefinitions.size
+            });
+            const baseUrl = strapi.config.get('server.url', 'http://localhost:1337');
+            strapi.log.info(`[MCP] Server available at ${baseUrl}${config.path}`);
+        },
+        async stop () {
+            serverStatus = 'idle';
+            strapi.log.info('[MCP] Service stopped');
+        }
+    };
+    service.registerTool(log.logToolDefinition);
+    return service;
+};
+
+exports.createMcpService = createMcpService;
+//# sourceMappingURL=index.js.map

package/dist/services/mcp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../../../src/services/mcp/index.ts"],"sourcesContent":["import type { Core, Modules } from '@strapi/types';\nimport { createMcpAdminTokenAuthenticator } from './authentication';\nimport { createPostHandler } from './handlers/handlePost';\nimport type { McpHandlerDependencies } from './handlers/types';\nimport { McpCapabilityDefinitionRegistry } from './internal/McpCapabilityDefinitionRegistry';\nimport { McpConfiguration } from './internal/McpConfiguration';\nimport { createMcpServerWithRegistries } from './internal/McpServerFactory';\nimport { createOAuthDiscoveryFallbackMiddleware } from './middleware/oauthDiscoveryFallback';\nimport { createMcpRoutes } from './routes';\nimport { sendDidStartMcpServer } from './metrics/metrics';\nimport { logToolDefinition } from './tools/log';\n\n/**\n * Creates an MCP service instance for Strapi Core\n */\nexport const createMcpService = (strapi: Core.Strapi): Modules.MCP.McpService => {\n  // Initialize configuration\n  const config = new McpConfiguration(strapi);\n\n  const authenticationStrategy = createMcpAdminTokenAuthenticator(strapi);\n\n  // Status tracking\n  let serverStatus: Modules.MCP.McpServiceStatus = 'idle';\n\n  // Definition registries\n  const toolDefinitions = new McpCapabilityDefinitionRegistry<\n    'tool',\n    Modules.MCP.McpToolDefinition\n  >('tool');\n\n  const promptDefinitions = new McpCapabilityDefinitionRegistry<\n    'prompt',\n    Modules.MCP.McpPromptDefinition\n  >('prompt');\n\n  const resourceDefinitions = new McpCapabilityDefinitionRegistry<\n    'resource',\n    Modules.MCP.McpResourceDefinition\n  >('resource');\n\n  // Prepare handler dependencies\n  const handlerDependencies: McpHandlerDependencies = {\n    strapi,\n    authenticationStrategy,\n    config,\n    createServerWithRegistries: createMcpServerWithRegistries,\n    capabilityDefinitions: {\n      tools: toolDefinitions,\n      prompts: promptDefinitions,\n      resources: resourceDefinitions,\n    },\n  };\n\n  // Create HTTP handlers\n  const handlePost = createPostHandler(handlerDependencies);\n\n  const service: Modules.MCP.McpService = {\n    isEnabled() {\n      return config.isEnabled();\n    },\n\n    isRunning() {\n      return serverStatus === 'running';\n    },\n\n    registerTool(tool: Modules.MCP.McpToolDefinition) {\n      if (serverStatus !== 'idle') {\n        throw new Error(\n          '[MCP] Tools must be registered before MCP server starts. Register during plugin register().'\n        );\n      }\n\n      toolDefinitions.define(tool);\n    },\n\n    registerPrompt(prompt) {\n      if (serverStatus !== 'idle') {\n        throw new Error(\n          '[MCP] Prompts must be registered before MCP server starts. Register during plugin register().'\n        );\n      }\n      promptDefinitions.define(prompt);\n    },\n\n    registerResource(resource) {\n      if (serverStatus !== 'idle') {\n        throw new Error(\n          '[MCP] Resources must be registered before MCP server starts. Register during plugin register().'\n        );\n      }\n      resourceDefinitions.define(resource);\n    },\n\n    async start() {\n      if (service.isEnabled() === false) {\n        strapi.log.debug('[MCP] Server is disabled');\n        return;\n      }\n      if (serverStatus === 'error') {\n        throw new Error('[MCP] Cannot start server: previous error state');\n      }\n      if (serverStatus !== 'idle') {\n        throw new Error(`[MCP] Server already started or starting (status: ${serverStatus})`);\n      }\n      serverStatus = 'starting';\n\n      strapi.server.use(createOAuthDiscoveryFallbackMiddleware());\n\n      const routes = createMcpRoutes(config, { handlePost });\n      strapi.server.routes(routes);\n\n      serverStatus = 'running';\n\n      sendDidStartMcpServer(strapi, {\n        path: config.path,\n        numberOfTools: toolDefinitions.size,\n        numberOfPrompts: promptDefinitions.size,\n        numberOfResources: resourceDefinitions.size,\n      });\n\n      const baseUrl = strapi.config.get('server.url', 'http://localhost:1337');\n      strapi.log.info(`[MCP] Server available at ${baseUrl}${config.path}`);\n    },\n\n    async stop() {\n      serverStatus = 'idle';\n      strapi.log.info('[MCP] Service stopped');\n    },\n  };\n\n  service.registerTool(logToolDefinition);\n\n  return service;\n};\n"],"names":["createMcpService","strapi","config","McpConfiguration","authenticationStrategy","createMcpAdminTokenAuthenticator","serverStatus","toolDefinitions","McpCapabilityDefinitionRegistry","promptDefinitions","resourceDefinitions","handlerDependencies","createServerWithRegistries","createMcpServerWithRegistries","capabilityDefinitions","tools","prompts","resources","handlePost","createPostHandler","service","isEnabled","isRunning","registerTool","tool","Error","define","registerPrompt","prompt","registerResource","resource","start","log","debug","server","use","createOAuthDiscoveryFallbackMiddleware","routes","createMcpRoutes","sendDidStartMcpServer","path","numberOfTools","size","numberOfPrompts","numberOfResources","baseUrl","get","info","stop","logToolDefinition"],"mappings":";;;;;;;;;;;;AAYA;;IAGO,MAAMA,gBAAAA,GAAmB,CAACC,MAAAA,GAAAA;;IAE/B,MAAMC,MAAAA,GAAS,IAAIC,iCAAAA,CAAiBF,MAAAA,CAAAA;AAEpC,IAAA,MAAMG,yBAAyBC,+CAAAA,CAAiCJ,MAAAA,CAAAA;;AAGhE,IAAA,IAAIK,YAAAA,GAA6C,MAAA;;IAGjD,MAAMC,eAAAA,GAAkB,IAAIC,+DAAAA,CAG1B,MAAA,CAAA;IAEF,MAAMC,iBAAAA,GAAoB,IAAID,+DAAAA,CAG5B,QAAA,CAAA;IAEF,MAAME,mBAAAA,GAAsB,IAAIF,+DAAAA,CAG9B,UAAA,CAAA;;AAGF,IAAA,MAAMG,mBAAAA,GAA8C;AAClDV,QAAAA,MAAAA;AACAG,QAAAA,sBAAAA;AACAF,QAAAA,MAAAA;QACAU,0BAAAA,EAA4BC,8CAAAA;QAC5BC,qBAAAA,EAAuB;YACrBC,KAAAA,EAAOR,eAAAA;YACPS,OAAAA,EAASP,iBAAAA;YACTQ,SAAAA,EAAWP;AACb;AACF,KAAA;;AAGA,IAAA,MAAMQ,eAAaC,4BAAAA,CAAkBR,mBAAAA,CAAAA;AAErC,IAAA,MAAMS,OAAAA,GAAkC;AACtCC,QAAAA,SAAAA,CAAAA,GAAAA;AACE,YAAA,OAAOnB,OAAOmB,SAAS,EAAA;AACzB,QAAA,CAAA;AAEAC,QAAAA,SAAAA,CAAAA,GAAAA;AACE,YAAA,OAAOhB,YAAAA,KAAiB,SAAA;AAC1B,QAAA,CAAA;AAEAiB,QAAAA,YAAAA,CAAAA,CAAaC,IAAmC,EAAA;AAC9C,YAAA,IAAIlB,iBAAiB,MAAA,EAAQ;AAC3B,gBAAA,MAAM,IAAImB,KAAAA,CACR,6FAAA,CAAA;AAEJ,YAAA;AAEAlB,YAAAA,eAAAA,CAAgBmB,MAAM,CAACF,IAAAA,CAAAA;AACzB,QAAA,CAAA;AAEAG,QAAAA,cAAAA,CAAAA,CAAeC,MAAM,EAAA;AACnB,YAAA,IAAItB,iBAAiB,MAAA,EAAQ;AAC3B,gBAAA,MAAM,IAAImB,KAAAA,CACR,+FAAA,CAAA;AAEJ,YAAA;AACAhB,YAAAA,iBAAAA,CAAkBiB,MAAM,CAACE,MAAAA,CAAAA;AAC3B,QAAA,CAAA;AAEAC,QAAAA,gBAAAA,CAAAA,CAAiBC,QAAQ,EAAA;AACvB,YAAA,IAAIxB,iBAAiB,MAAA,EAAQ;AAC3B,gBAAA,MAAM,IAAImB,KAAAA,CACR,iGAAA,CAAA;AAEJ,YAAA;AACAf,YAAAA,mBAAAA,CAAoBgB,MAAM,CAACI,QAAAA,CAAAA;AAC7B,QAAA,CAAA;QAEA,MAAMC,KAAAA,CAAAA,GAAAA;YACJ,IAAIX,OAAAA,CAAQC,SAAS,EAAA,KAAO,KAAA,EAAO;gBACjCpB,MAAAA,CAAO+B,GAAG,CAACC,KAAK,CAAC,0BAAA,CAAA;AACjB,gBAAA;AACF,YAAA;AACA,YAAA,IAAI3B,iBAAiB,OAAA,EAAS;AAC5B,gBAAA,MAAM,IAAImB,KAAAA,CAAM,iDAAA,CAAA;AAClB,YAAA;AACA,YAAA,IAAInB,iBAAiB,MAAA,EAAQ;AAC3B,gBAAA,MAAM,IAAImB,KAAAA,CAAM,CAAC,kDAAkD,EAAEnB,YAAAA,CAAa,CAAC,CAAC,CAAA;AACtF,YAAA;YACAA,YAAAA,GAAe,UAAA;YAEfL,MAAAA,CAAOiC,MAAM,CAACC,GAAG,CAACC,6DAAAA,EAAAA,CAAAA;YAElB,MAAMC,QAAAA,GAASC,uBAAgBpC,MAAAA,EAAQ;AAAEgB,4BAAAA;AAAW,aAAA,CAAA;YACpDjB,MAAAA,CAAOiC,MAAM,CAACG,MAAM,CAACA,QAAAA,CAAAA;YAErB/B,YAAAA,GAAe,SAAA;AAEfiC,YAAAA,6BAAAA,CAAsBtC,MAAAA,EAAQ;AAC5BuC,gBAAAA,IAAAA,EAAMtC,OAAOsC,IAAI;AACjBC,gBAAAA,aAAAA,EAAelC,gBAAgBmC,IAAI;AACnCC,gBAAAA,eAAAA,EAAiBlC,kBAAkBiC,IAAI;AACvCE,gBAAAA,iBAAAA,EAAmBlC,oBAAoBgC;AACzC,aAAA,CAAA;AAEA,YAAA,MAAMG,UAAU5C,MAAAA,CAAOC,MAAM,CAAC4C,GAAG,CAAC,YAAA,EAAc,uBAAA,CAAA;YAChD7C,MAAAA,CAAO+B,GAAG,CAACe,IAAI,CAAC,CAAC,0BAA0B,EAAEF,OAAAA,CAAAA,EAAU3C,MAAAA,CAAOsC,IAAI,CAAA,CAAE,CAAA;AACtE,QAAA,CAAA;QAEA,MAAMQ,IAAAA,CAAAA,GAAAA;YACJ1C,YAAAA,GAAe,MAAA;YACfL,MAAAA,CAAO+B,GAAG,CAACe,IAAI,CAAC,uBAAA,CAAA;AAClB,QAAA;AACF,KAAA;AAEA3B,IAAAA,OAAAA,CAAQG,YAAY,CAAC0B,qBAAAA,CAAAA;IAErB,OAAO7B,OAAAA;AACT;;;;"}

package/dist/services/mcp/index.mjs

@@ -0,0 +1,99 @@
+import { createMcpAdminTokenAuthenticator } from './authentication.mjs';
+import { createPostHandler } from './handlers/handlePost.mjs';
+import { McpCapabilityDefinitionRegistry } from './internal/McpCapabilityDefinitionRegistry.mjs';
+import { McpConfiguration } from './internal/McpConfiguration.mjs';
+import { createMcpServerWithRegistries } from './internal/McpServerFactory.mjs';
+import { createOAuthDiscoveryFallbackMiddleware } from './middleware/oauthDiscoveryFallback.mjs';
+import { createMcpRoutes } from './routes.mjs';
+import { sendDidStartMcpServer } from './metrics/metrics.mjs';
+import { logToolDefinition } from './tools/log.mjs';
+
+/**
+ * Creates an MCP service instance for Strapi Core
+ */ const createMcpService = (strapi)=>{
+    // Initialize configuration
+    const config = new McpConfiguration(strapi);
+    const authenticationStrategy = createMcpAdminTokenAuthenticator(strapi);
+    // Status tracking
+    let serverStatus = 'idle';
+    // Definition registries
+    const toolDefinitions = new McpCapabilityDefinitionRegistry('tool');
+    const promptDefinitions = new McpCapabilityDefinitionRegistry('prompt');
+    const resourceDefinitions = new McpCapabilityDefinitionRegistry('resource');
+    // Prepare handler dependencies
+    const handlerDependencies = {
+        strapi,
+        authenticationStrategy,
+        config,
+        createServerWithRegistries: createMcpServerWithRegistries,
+        capabilityDefinitions: {
+            tools: toolDefinitions,
+            prompts: promptDefinitions,
+            resources: resourceDefinitions
+        }
+    };
+    // Create HTTP handlers
+    const handlePost = createPostHandler(handlerDependencies);
+    const service = {
+        isEnabled () {
+            return config.isEnabled();
+        },
+        isRunning () {
+            return serverStatus === 'running';
+        },
+        registerTool (tool) {
+            if (serverStatus !== 'idle') {
+                throw new Error('[MCP] Tools must be registered before MCP server starts. Register during plugin register().');
+            }
+            toolDefinitions.define(tool);
+        },
+        registerPrompt (prompt) {
+            if (serverStatus !== 'idle') {
+                throw new Error('[MCP] Prompts must be registered before MCP server starts. Register during plugin register().');
+            }
+            promptDefinitions.define(prompt);
+        },
+        registerResource (resource) {
+            if (serverStatus !== 'idle') {
+                throw new Error('[MCP] Resources must be registered before MCP server starts. Register during plugin register().');
+            }
+            resourceDefinitions.define(resource);
+        },
+        async start () {
+            if (service.isEnabled() === false) {
+                strapi.log.debug('[MCP] Server is disabled');
+                return;
+            }
+            if (serverStatus === 'error') {
+                throw new Error('[MCP] Cannot start server: previous error state');
+            }
+            if (serverStatus !== 'idle') {
+                throw new Error(`[MCP] Server already started or starting (status: ${serverStatus})`);
+            }
+            serverStatus = 'starting';
+            strapi.server.use(createOAuthDiscoveryFallbackMiddleware());
+            const routes = createMcpRoutes(config, {
+                handlePost
+            });
+            strapi.server.routes(routes);
+            serverStatus = 'running';
+            sendDidStartMcpServer(strapi, {
+                path: config.path,
+                numberOfTools: toolDefinitions.size,
+                numberOfPrompts: promptDefinitions.size,
+                numberOfResources: resourceDefinitions.size
+            });
+            const baseUrl = strapi.config.get('server.url', 'http://localhost:1337');
+            strapi.log.info(`[MCP] Server available at ${baseUrl}${config.path}`);
+        },
+        async stop () {
+            serverStatus = 'idle';
+            strapi.log.info('[MCP] Service stopped');
+        }
+    };
+    service.registerTool(logToolDefinition);
+    return service;
+};
+
+export { createMcpService };
+//# sourceMappingURL=index.mjs.map

package/dist/services/mcp/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sources":["../../../src/services/mcp/index.ts"],"sourcesContent":["import type { Core, Modules } from '@strapi/types';\nimport { createMcpAdminTokenAuthenticator } from './authentication';\nimport { createPostHandler } from './handlers/handlePost';\nimport type { McpHandlerDependencies } from './handlers/types';\nimport { McpCapabilityDefinitionRegistry } from './internal/McpCapabilityDefinitionRegistry';\nimport { McpConfiguration } from './internal/McpConfiguration';\nimport { createMcpServerWithRegistries } from './internal/McpServerFactory';\nimport { createOAuthDiscoveryFallbackMiddleware } from './middleware/oauthDiscoveryFallback';\nimport { createMcpRoutes } from './routes';\nimport { sendDidStartMcpServer } from './metrics/metrics';\nimport { logToolDefinition } from './tools/log';\n\n/**\n * Creates an MCP service instance for Strapi Core\n */\nexport const createMcpService = (strapi: Core.Strapi): Modules.MCP.McpService => {\n  // Initialize configuration\n  const config = new McpConfiguration(strapi);\n\n  const authenticationStrategy = createMcpAdminTokenAuthenticator(strapi);\n\n  // Status tracking\n  let serverStatus: Modules.MCP.McpServiceStatus = 'idle';\n\n  // Definition registries\n  const toolDefinitions = new McpCapabilityDefinitionRegistry<\n    'tool',\n    Modules.MCP.McpToolDefinition\n  >('tool');\n\n  const promptDefinitions = new McpCapabilityDefinitionRegistry<\n    'prompt',\n    Modules.MCP.McpPromptDefinition\n  >('prompt');\n\n  const resourceDefinitions = new McpCapabilityDefinitionRegistry<\n    'resource',\n    Modules.MCP.McpResourceDefinition\n  >('resource');\n\n  // Prepare handler dependencies\n  const handlerDependencies: McpHandlerDependencies = {\n    strapi,\n    authenticationStrategy,\n    config,\n    createServerWithRegistries: createMcpServerWithRegistries,\n    capabilityDefinitions: {\n      tools: toolDefinitions,\n      prompts: promptDefinitions,\n      resources: resourceDefinitions,\n    },\n  };\n\n  // Create HTTP handlers\n  const handlePost = createPostHandler(handlerDependencies);\n\n  const service: Modules.MCP.McpService = {\n    isEnabled() {\n      return config.isEnabled();\n    },\n\n    isRunning() {\n      return serverStatus === 'running';\n    },\n\n    registerTool(tool: Modules.MCP.McpToolDefinition) {\n      if (serverStatus !== 'idle') {\n        throw new Error(\n          '[MCP] Tools must be registered before MCP server starts. Register during plugin register().'\n        );\n      }\n\n      toolDefinitions.define(tool);\n    },\n\n    registerPrompt(prompt) {\n      if (serverStatus !== 'idle') {\n        throw new Error(\n          '[MCP] Prompts must be registered before MCP server starts. Register during plugin register().'\n        );\n      }\n      promptDefinitions.define(prompt);\n    },\n\n    registerResource(resource) {\n      if (serverStatus !== 'idle') {\n        throw new Error(\n          '[MCP] Resources must be registered before MCP server starts. Register during plugin register().'\n        );\n      }\n      resourceDefinitions.define(resource);\n    },\n\n    async start() {\n      if (service.isEnabled() === false) {\n        strapi.log.debug('[MCP] Server is disabled');\n        return;\n      }\n      if (serverStatus === 'error') {\n        throw new Error('[MCP] Cannot start server: previous error state');\n      }\n      if (serverStatus !== 'idle') {\n        throw new Error(`[MCP] Server already started or starting (status: ${serverStatus})`);\n      }\n      serverStatus = 'starting';\n\n      strapi.server.use(createOAuthDiscoveryFallbackMiddleware());\n\n      const routes = createMcpRoutes(config, { handlePost });\n      strapi.server.routes(routes);\n\n      serverStatus = 'running';\n\n      sendDidStartMcpServer(strapi, {\n        path: config.path,\n        numberOfTools: toolDefinitions.size,\n        numberOfPrompts: promptDefinitions.size,\n        numberOfResources: resourceDefinitions.size,\n      });\n\n      const baseUrl = strapi.config.get('server.url', 'http://localhost:1337');\n      strapi.log.info(`[MCP] Server available at ${baseUrl}${config.path}`);\n    },\n\n    async stop() {\n      serverStatus = 'idle';\n      strapi.log.info('[MCP] Service stopped');\n    },\n  };\n\n  service.registerTool(logToolDefinition);\n\n  return service;\n};\n"],"names":["createMcpService","strapi","config","McpConfiguration","authenticationStrategy","createMcpAdminTokenAuthenticator","serverStatus","toolDefinitions","McpCapabilityDefinitionRegistry","promptDefinitions","resourceDefinitions","handlerDependencies","createServerWithRegistries","createMcpServerWithRegistries","capabilityDefinitions","tools","prompts","resources","handlePost","createPostHandler","service","isEnabled","isRunning","registerTool","tool","Error","define","registerPrompt","prompt","registerResource","resource","start","log","debug","server","use","createOAuthDiscoveryFallbackMiddleware","routes","createMcpRoutes","sendDidStartMcpServer","path","numberOfTools","size","numberOfPrompts","numberOfResources","baseUrl","get","info","stop","logToolDefinition"],"mappings":";;;;;;;;;;AAYA;;IAGO,MAAMA,gBAAAA,GAAmB,CAACC,MAAAA,GAAAA;;IAE/B,MAAMC,MAAAA,GAAS,IAAIC,gBAAAA,CAAiBF,MAAAA,CAAAA;AAEpC,IAAA,MAAMG,yBAAyBC,gCAAAA,CAAiCJ,MAAAA,CAAAA;;AAGhE,IAAA,IAAIK,YAAAA,GAA6C,MAAA;;IAGjD,MAAMC,eAAAA,GAAkB,IAAIC,+BAAAA,CAG1B,MAAA,CAAA;IAEF,MAAMC,iBAAAA,GAAoB,IAAID,+BAAAA,CAG5B,QAAA,CAAA;IAEF,MAAME,mBAAAA,GAAsB,IAAIF,+BAAAA,CAG9B,UAAA,CAAA;;AAGF,IAAA,MAAMG,mBAAAA,GAA8C;AAClDV,QAAAA,MAAAA;AACAG,QAAAA,sBAAAA;AACAF,QAAAA,MAAAA;QACAU,0BAAAA,EAA4BC,6BAAAA;QAC5BC,qBAAAA,EAAuB;YACrBC,KAAAA,EAAOR,eAAAA;YACPS,OAAAA,EAASP,iBAAAA;YACTQ,SAAAA,EAAWP;AACb;AACF,KAAA;;AAGA,IAAA,MAAMQ,aAAaC,iBAAAA,CAAkBR,mBAAAA,CAAAA;AAErC,IAAA,MAAMS,OAAAA,GAAkC;AACtCC,QAAAA,SAAAA,CAAAA,GAAAA;AACE,YAAA,OAAOnB,OAAOmB,SAAS,EAAA;AACzB,QAAA,CAAA;AAEAC,QAAAA,SAAAA,CAAAA,GAAAA;AACE,YAAA,OAAOhB,YAAAA,KAAiB,SAAA;AAC1B,QAAA,CAAA;AAEAiB,QAAAA,YAAAA,CAAAA,CAAaC,IAAmC,EAAA;AAC9C,YAAA,IAAIlB,iBAAiB,MAAA,EAAQ;AAC3B,gBAAA,MAAM,IAAImB,KAAAA,CACR,6FAAA,CAAA;AAEJ,YAAA;AAEAlB,YAAAA,eAAAA,CAAgBmB,MAAM,CAACF,IAAAA,CAAAA;AACzB,QAAA,CAAA;AAEAG,QAAAA,cAAAA,CAAAA,CAAeC,MAAM,EAAA;AACnB,YAAA,IAAItB,iBAAiB,MAAA,EAAQ;AAC3B,gBAAA,MAAM,IAAImB,KAAAA,CACR,+FAAA,CAAA;AAEJ,YAAA;AACAhB,YAAAA,iBAAAA,CAAkBiB,MAAM,CAACE,MAAAA,CAAAA;AAC3B,QAAA,CAAA;AAEAC,QAAAA,gBAAAA,CAAAA,CAAiBC,QAAQ,EAAA;AACvB,YAAA,IAAIxB,iBAAiB,MAAA,EAAQ;AAC3B,gBAAA,MAAM,IAAImB,KAAAA,CACR,iGAAA,CAAA;AAEJ,YAAA;AACAf,YAAAA,mBAAAA,CAAoBgB,MAAM,CAACI,QAAAA,CAAAA;AAC7B,QAAA,CAAA;QAEA,MAAMC,KAAAA,CAAAA,GAAAA;YACJ,IAAIX,OAAAA,CAAQC,SAAS,EAAA,KAAO,KAAA,EAAO;gBACjCpB,MAAAA,CAAO+B,GAAG,CAACC,KAAK,CAAC,0BAAA,CAAA;AACjB,gBAAA;AACF,YAAA;AACA,YAAA,IAAI3B,iBAAiB,OAAA,EAAS;AAC5B,gBAAA,MAAM,IAAImB,KAAAA,CAAM,iDAAA,CAAA;AAClB,YAAA;AACA,YAAA,IAAInB,iBAAiB,MAAA,EAAQ;AAC3B,gBAAA,MAAM,IAAImB,KAAAA,CAAM,CAAC,kDAAkD,EAAEnB,YAAAA,CAAa,CAAC,CAAC,CAAA;AACtF,YAAA;YACAA,YAAAA,GAAe,UAAA;YAEfL,MAAAA,CAAOiC,MAAM,CAACC,GAAG,CAACC,sCAAAA,EAAAA,CAAAA;YAElB,MAAMC,MAAAA,GAASC,gBAAgBpC,MAAAA,EAAQ;AAAEgB,gBAAAA;AAAW,aAAA,CAAA;YACpDjB,MAAAA,CAAOiC,MAAM,CAACG,MAAM,CAACA,MAAAA,CAAAA;YAErB/B,YAAAA,GAAe,SAAA;AAEfiC,YAAAA,qBAAAA,CAAsBtC,MAAAA,EAAQ;AAC5BuC,gBAAAA,IAAAA,EAAMtC,OAAOsC,IAAI;AACjBC,gBAAAA,aAAAA,EAAelC,gBAAgBmC,IAAI;AACnCC,gBAAAA,eAAAA,EAAiBlC,kBAAkBiC,IAAI;AACvCE,gBAAAA,iBAAAA,EAAmBlC,oBAAoBgC;AACzC,aAAA,CAAA;AAEA,YAAA,MAAMG,UAAU5C,MAAAA,CAAOC,MAAM,CAAC4C,GAAG,CAAC,YAAA,EAAc,uBAAA,CAAA;YAChD7C,MAAAA,CAAO+B,GAAG,CAACe,IAAI,CAAC,CAAC,0BAA0B,EAAEF,OAAAA,CAAAA,EAAU3C,MAAAA,CAAOsC,IAAI,CAAA,CAAE,CAAA;AACtE,QAAA,CAAA;QAEA,MAAMQ,IAAAA,CAAAA,GAAAA;YACJ1C,YAAAA,GAAe,MAAA;YACfL,MAAAA,CAAO+B,GAAG,CAACe,IAAI,CAAC,uBAAA,CAAA;AAClB,QAAA;AACF,KAAA;AAEA3B,IAAAA,OAAAA,CAAQG,YAAY,CAAC0B,iBAAAA,CAAAA;IAErB,OAAO7B,OAAAA;AACT;;;;"}

package/dist/services/mcp/internal/McpCapabilityDefinitionRegistry.d.ts

@@ -0,0 +1,13 @@
+import type { Modules } from '@strapi/types';
+export declare class McpCapabilityDefinitionRegistry<CapabilityName extends 'tool' | 'prompt' | 'resource', Definition extends Modules.MCP.McpCapabilityDefinition> {
+    #private;
+    capability: CapabilityName;
+    constructor(capability: CapabilityName);
+    get size(): number;
+    define(definition: Definition): void;
+    get(name: string): Definition | undefined;
+    delete(name: string): boolean;
+    getAll(): Definition[];
+    forEach(callback: (definition: Definition) => void): void;
+}
+//# sourceMappingURL=McpCapabilityDefinitionRegistry.d.ts.map

package/dist/services/mcp/internal/McpCapabilityDefinitionRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpCapabilityDefinitionRegistry.d.ts","sourceRoot":"","sources":["../../../../src/services/mcp/internal/McpCapabilityDefinitionRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE7C,qBAAa,+BAA+B,CAC1C,cAAc,SAAS,MAAM,GAAG,QAAQ,GAAG,UAAU,EACrD,UAAU,SAAS,OAAO,CAAC,GAAG,CAAC,uBAAuB;;IAEtD,UAAU,EAAE,cAAc,CAAC;gBAIf,UAAU,EAAE,cAAc;IAItC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,MAAM,CAAC,UAAU,EAAE,UAAU;IAuB7B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIzC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI7B,MAAM,IAAI,UAAU,EAAE;IAItB,OAAO,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,UAAU,KAAK,IAAI;CAGnD"}

package/dist/services/mcp/internal/McpCapabilityDefinitionRegistry.js

@@ -0,0 +1,53 @@
+'use strict';
+
+function _class_private_field_loose_base(receiver, privateKey) {
+    if (!Object.prototype.hasOwnProperty.call(receiver, privateKey)) {
+        throw new TypeError("attempted to use private field on non-instance");
+    }
+    return receiver;
+}
+var id = 0;
+function _class_private_field_loose_key(name) {
+    return "__private_" + id++ + "_" + name;
+}
+var _definitions = /*#__PURE__*/ _class_private_field_loose_key("_definitions");
+class McpCapabilityDefinitionRegistry {
+    get size() {
+        return _class_private_field_loose_base(this, _definitions)[_definitions].size;
+    }
+    define(definition) {
+        const existing = _class_private_field_loose_base(this, _definitions)[_definitions].get(definition.name);
+        if (existing !== undefined) {
+            throw new Error(`[MCP] ${this.capability} with name "${definition.name}" is already registered. Names must be unique.`);
+        }
+        if (definition.devModeOnly !== true) {
+            if (definition.auth === undefined || definition.auth.policies.length === 0 || definition.auth.policies.some((p)=>p.action === '')) {
+                throw new Error(`[MCP] ${this.capability} with name "${definition.name}" must declare auth policies or be devModeOnly.`);
+            }
+        }
+        _class_private_field_loose_base(this, _definitions)[_definitions].set(definition.name, definition);
+    }
+    get(name) {
+        return _class_private_field_loose_base(this, _definitions)[_definitions].get(name);
+    }
+    delete(name) {
+        return _class_private_field_loose_base(this, _definitions)[_definitions].delete(name);
+    }
+    getAll() {
+        return Array.from(_class_private_field_loose_base(this, _definitions)[_definitions].values());
+    }
+    forEach(callback) {
+        _class_private_field_loose_base(this, _definitions)[_definitions].forEach(callback);
+    }
+    constructor(capability){
+        Object.defineProperty(this, _definitions, {
+            writable: true,
+            value: void 0
+        });
+        _class_private_field_loose_base(this, _definitions)[_definitions] = new Map();
+        this.capability = capability;
+    }
+}
+
+exports.McpCapabilityDefinitionRegistry = McpCapabilityDefinitionRegistry;
+//# sourceMappingURL=McpCapabilityDefinitionRegistry.js.map

package/dist/services/mcp/internal/McpCapabilityDefinitionRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpCapabilityDefinitionRegistry.js","sources":["../../../../src/services/mcp/internal/McpCapabilityDefinitionRegistry.ts"],"sourcesContent":["import type { Modules } from '@strapi/types';\n\nexport class McpCapabilityDefinitionRegistry<\n  CapabilityName extends 'tool' | 'prompt' | 'resource',\n  Definition extends Modules.MCP.McpCapabilityDefinition,\n> {\n  capability: CapabilityName;\n\n  #definitions = new Map<string, Definition>();\n\n  constructor(capability: CapabilityName) {\n    this.capability = capability;\n  }\n\n  get size(): number {\n    return this.#definitions.size;\n  }\n\n  define(definition: Definition) {\n    const existing = this.#definitions.get(definition.name);\n    if (existing !== undefined) {\n      throw new Error(\n        `[MCP] ${this.capability} with name \"${definition.name}\" is already registered. Names must be unique.`\n      );\n    }\n\n    if (definition.devModeOnly !== true) {\n      if (\n        definition.auth === undefined ||\n        definition.auth.policies.length === 0 ||\n        definition.auth.policies.some((p) => p.action === '')\n      ) {\n        throw new Error(\n          `[MCP] ${this.capability} with name \"${definition.name}\" must declare auth policies or be devModeOnly.`\n        );\n      }\n    }\n\n    this.#definitions.set(definition.name, definition);\n  }\n\n  get(name: string): Definition | undefined {\n    return this.#definitions.get(name);\n  }\n\n  delete(name: string): boolean {\n    return this.#definitions.delete(name);\n  }\n\n  getAll(): Definition[] {\n    return Array.from(this.#definitions.values());\n  }\n\n  forEach(callback: (definition: Definition) => void) {\n    this.#definitions.forEach(callback);\n  }\n}\n"],"names":["McpCapabilityDefinitionRegistry","size","define","definition","existing","get","name","undefined","Error","capability","devModeOnly","auth","policies","length","some","p","action","set","delete","getAll","Array","from","values","forEach","callback","Map"],"mappings":";;;;;;;;;;;;AAQE,IAAA,YAAA,iBAAA,8BAAA,CAAA,cAAA,CAAA;AANK,MAAMA,+BAAAA,CAAAA;AAYX,IAAA,IAAIC,IAAAA,GAAe;AACjB,QAAA,OAAO,+BAAA,CAAA,IAAI,EAAC,YAAA,CAAA,CAAA,cAAaA,IAAI;AAC/B,IAAA;AAEAC,IAAAA,MAAAA,CAAOC,UAAsB,EAAE;QAC7B,MAAMC,QAAAA,GAAW,gCAAA,IAAI,EAAC,cAAA,YAAA,CAAA,CAAaC,GAAG,CAACF,UAAAA,CAAWG,IAAI,CAAA;AACtD,QAAA,IAAIF,aAAaG,SAAAA,EAAW;AAC1B,YAAA,MAAM,IAAIC,KAAAA,CACR,CAAC,MAAM,EAAE,IAAI,CAACC,UAAU,CAAC,YAAY,EAAEN,UAAAA,CAAWG,IAAI,CAAC,8CAA8C,CAAC,CAAA;AAE1G,QAAA;QAEA,IAAIH,UAAAA,CAAWO,WAAW,KAAK,IAAA,EAAM;YACnC,IACEP,UAAAA,CAAWQ,IAAI,KAAKJ,SAAAA,IACpBJ,UAAAA,CAAWQ,IAAI,CAACC,QAAQ,CAACC,MAAM,KAAK,CAAA,IACpCV,WAAWQ,IAAI,CAACC,QAAQ,CAACE,IAAI,CAAC,CAACC,CAAAA,GAAMA,CAAAA,CAAEC,MAAM,KAAK,EAAA,CAAA,EAClD;AACA,gBAAA,MAAM,IAAIR,KAAAA,CACR,CAAC,MAAM,EAAE,IAAI,CAACC,UAAU,CAAC,YAAY,EAAEN,UAAAA,CAAWG,IAAI,CAAC,+CAA+C,CAAC,CAAA;AAE3G,YAAA;AACF,QAAA;QAEA,+BAAA,CAAA,IAAI,EAAC,YAAA,CAAA,CAAA,YAAA,CAAA,CAAaW,GAAG,CAACd,UAAAA,CAAWG,IAAI,EAAEH,UAAAA,CAAAA;AACzC,IAAA;AAEAE,IAAAA,GAAAA,CAAIC,IAAY,EAA0B;AACxC,QAAA,OAAO,gCAAA,IAAI,EAAC,YAAA,CAAA,CAAA,YAAA,CAAA,CAAaD,GAAG,CAACC,IAAAA,CAAAA;AAC/B,IAAA;AAEAY,IAAAA,MAAAA,CAAOZ,IAAY,EAAW;AAC5B,QAAA,OAAO,gCAAA,IAAI,EAAC,YAAA,CAAA,CAAA,YAAA,CAAA,CAAaY,MAAM,CAACZ,IAAAA,CAAAA;AAClC,IAAA;IAEAa,MAAAA,GAAuB;QACrB,OAAOC,KAAAA,CAAMC,IAAI,CAAC,+BAAA,CAAA,IAAI,EAAC,YAAA,CAAA,CAAA,cAAaC,MAAM,EAAA,CAAA;AAC5C,IAAA;AAEAC,IAAAA,OAAAA,CAAQC,QAA0C,EAAE;AAClD,QAAA,+BAAA,CAAA,IAAI,EAAC,YAAA,CAAA,CAAA,YAAA,CAAA,CAAaD,OAAO,CAACC,QAAAA,CAAAA;AAC5B,IAAA;AA7CA,IAAA,WAAA,CAAYf,UAA0B,CAAE;QAFxC,MAAA,CAAA,cAAA,CAAA,IAAA,EAAA,YAAA,EAAA;;mBAAA;;AAAA,QAAA,+BAAA,CAAA,IAAA,EAAA,YAAA,CAAA,CAAA,gBAAe,IAAIgB,GAAAA,EAAAA;QAGjB,IAAI,CAAChB,UAAU,GAAGA,UAAAA;AACpB,IAAA;AA4CF;;;;"}

package/dist/services/mcp/internal/McpCapabilityDefinitionRegistry.mjs

@@ -0,0 +1,51 @@
+function _class_private_field_loose_base(receiver, privateKey) {
+    if (!Object.prototype.hasOwnProperty.call(receiver, privateKey)) {
+        throw new TypeError("attempted to use private field on non-instance");
+    }
+    return receiver;
+}
+var id = 0;
+function _class_private_field_loose_key(name) {
+    return "__private_" + id++ + "_" + name;
+}
+var _definitions = /*#__PURE__*/ _class_private_field_loose_key("_definitions");
+class McpCapabilityDefinitionRegistry {
+    get size() {
+        return _class_private_field_loose_base(this, _definitions)[_definitions].size;
+    }
+    define(definition) {
+        const existing = _class_private_field_loose_base(this, _definitions)[_definitions].get(definition.name);
+        if (existing !== undefined) {
+            throw new Error(`[MCP] ${this.capability} with name "${definition.name}" is already registered. Names must be unique.`);
+        }
+        if (definition.devModeOnly !== true) {
+            if (definition.auth === undefined || definition.auth.policies.length === 0 || definition.auth.policies.some((p)=>p.action === '')) {
+                throw new Error(`[MCP] ${this.capability} with name "${definition.name}" must declare auth policies or be devModeOnly.`);
+            }
+        }
+        _class_private_field_loose_base(this, _definitions)[_definitions].set(definition.name, definition);
+    }
+    get(name) {
+        return _class_private_field_loose_base(this, _definitions)[_definitions].get(name);
+    }
+    delete(name) {
+        return _class_private_field_loose_base(this, _definitions)[_definitions].delete(name);
+    }
+    getAll() {
+        return Array.from(_class_private_field_loose_base(this, _definitions)[_definitions].values());
+    }
+    forEach(callback) {
+        _class_private_field_loose_base(this, _definitions)[_definitions].forEach(callback);
+    }
+    constructor(capability){
+        Object.defineProperty(this, _definitions, {
+            writable: true,
+            value: void 0
+        });
+        _class_private_field_loose_base(this, _definitions)[_definitions] = new Map();
+        this.capability = capability;
+    }
+}
+
+export { McpCapabilityDefinitionRegistry };
+//# sourceMappingURL=McpCapabilityDefinitionRegistry.mjs.map