@ttoss/http-server-mcp 0.27.1 → 0.28.1

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 
 /// <reference types="node" />
-import { CallToolResult, McpServer, McpServer as McpServer$1 } from "@modelcontextprotocol/server";
+import { CallToolResult, McpServer, McpServer as McpServer$1, McpServerFactory, RegisteredResource } from "@modelcontextprotocol/server";
 import { Router } from "@ttoss/http-server";
 import accepts from "accepts";
 import { AsyncLocalStorage } from "async_hooks";
@@ -675,6 +675,197 @@ declare namespace Application {
  */
 declare const getIdentity: <T = unknown>() => T | undefined;
 //#endregion
+//#region src/registerAppResource.d.ts
+/**
+ * Identifier of the MCP Apps extension (`io.modelcontextprotocol/ui`), used as
+ * the key under `capabilities.extensions` on both sides of the handshake.
+ *
+ * A client declares Apps support with it; a server may advertise the same key
+ * so a host can discover the support without inspecting tool metadata:
+ *
+ * ```typescript
+ * new McpServer(
+ *   { name: 'weather', version: '1.0.0' },
+ *   {
+ *     capabilities: {
+ *       extensions: {
+ *         [UI_EXTENSION_ID]: { mimeTypes: [UI_RESOURCE_MIME_TYPE] },
+ *       },
+ *     },
+ *   }
+ * );
+ * ```
+ */
+declare const UI_EXTENSION_ID = "io.modelcontextprotocol/ui";
+/** MIME type every MCP Apps HTML resource is served as. */
+declare const UI_RESOURCE_MIME_TYPE = "text/html;profile=mcp-app";
+/**
+ * Origins an app's view is allowed to reach, mapped by the host onto the
+ * iframe's Content Security Policy. Anything not declared is blocked: an
+ * omitted list is the restrictive default, not "no restriction".
+ */
+interface UiResourceCsp {
+  /** Origins for network requests (`connect-src`). */
+  connectDomains?: string[];
+  /**
+   * Origins for scripts, styles, images, fonts and media (`script-src`,
+   * `style-src`, `img-src`, `font-src`, `media-src`).
+   */
+  resourceDomains?: string[];
+  /** Origins for nested iframes (`frame-src`). */
+  frameDomains?: string[];
+  /** Allowed document base URIs (`base-uri`). */
+  baseUriDomains?: string[];
+}
+/**
+ * Browser capabilities the view asks for. A host *may* grant them, so a view
+ * should feature-detect rather than assume: each key is a request, not a
+ * guarantee.
+ */
+interface UiResourcePermissions {
+  camera?: Record<string, never>;
+  microphone?: Record<string, never>;
+  geolocation?: Record<string, never>;
+  clipboardWrite?: Record<string, never>;
+}
+/** Rendering and security configuration for an app's view (`_meta.ui`). */
+interface UiResourceMeta {
+  /** Origins the view may reach; omitted means none. */
+  csp?: UiResourceCsp;
+  /** Browser capabilities requested for the view. */
+  permissions?: UiResourcePermissions;
+  /**
+   * Dedicated sandbox origin for the view, for cases needing a stable origin
+   * (OAuth callbacks, CORS, API key allowlists). The accepted format is
+   * host-specific; consult the host's documentation rather than deriving one.
+   */
+  domain?: string;
+  /** Whether the host should draw a border and background around the view. */
+  prefersBorder?: boolean;
+}
+/** Who may reach a tool. Defaults to both when left unset. */
+type UiToolVisibility = 'model' | 'app';
+/** Parameters for {@link registerAppResource}. */
+interface RegisterAppResourceParams {
+  /** The `McpServer` instance to register the app resource on. */
+  server: McpServer$1;
+  /** Resource name, as listed by `resources/list`. */
+  name: string;
+  /** Resource URI. Must use the `ui://` scheme. */
+  uri: string;
+  /** What the view does and when a host should render it. */
+  description?: string;
+  /**
+   * The view's HTML5 document, or a builder invoked per `resources/read`.
+   * A builder receives the requested URI so one registration can serve
+   * variants of a document.
+   */
+  html: string | ((args: {
+    uri: URL;
+  }) => string | Promise<string>);
+  /** Rendering and security configuration relayed to the host as `_meta.ui`. */
+  ui?: UiResourceMeta;
+}
+/** Parameters for {@link RegisteredAppResource.toolMeta}. */
+interface ToolMetaParams {
+  /**
+   * Who may reach the tool. Left unset, the spec's default applies — visible
+   * to the model *and* callable by the app.
+   */
+  visibility?: UiToolVisibility[];
+  /** Further `_meta` entries to merge in, e.g. vendor-namespaced keys. */
+  _meta?: Record<string, unknown>;
+}
+/** An app resource registered by {@link registerAppResource}. */
+interface RegisteredAppResource {
+  /** The URI tools link to. */
+  uri: string;
+  /** The SDK's registration handle, for `update`/`disable`/`remove`. */
+  resource: RegisteredResource;
+  /**
+   * Builds the `_meta` bag that links a tool to this view. Pass it to
+   * `registerTool`, {@link registerToolFromSchema}, or a `GatedToolDef` —
+   * whichever registration path the tool uses.
+   */
+  toolMeta: (params?: ToolMetaParams) => Record<string, unknown>;
+}
+/**
+ * Registers an MCP Apps view: a `ui://` resource a tool result is rendered
+ * with, per the `io.modelcontextprotocol/ui` extension.
+ *
+ * The extension asks nothing of the transport — a view is an ordinary MCP
+ * resource, and the tool linkage is ordinary tool `_meta` — so this is
+ * registration sugar over `registerResource`, not new protocol surface. What
+ * it owns is the part that is easy to get wrong: the `ui://` scheme, the exact
+ * MIME type, `_meta.ui` on both the declaration and the read result, and
+ * writing the deprecated flat linkage key alongside the current one.
+ *
+ * **Register the linkage unconditionally.** The extension's negotiation is
+ * per-request and only reliably readable on the `2026-07-28` revision; in this
+ * package's default stateless 2025-era mode there is no remembered
+ * `initialize` to read a client capability from. Gating registration on that
+ * capability would therefore silently drop the view for every 2025-era client.
+ * A host without Apps support simply ignores `_meta`, so keep each tool's
+ * `content` meaningful on its own and let the text result be the fallback.
+ *
+ * @example
+ * ```typescript
+ * import {
+ *   McpServer,
+ *   registerAppResource,
+ *   UI_EXTENSION_ID,
+ *   UI_RESOURCE_MIME_TYPE,
+ *   z,
+ * } from '@ttoss/http-server-mcp';
+ *
+ * const server = new McpServer(
+ *   { name: 'weather', version: '1.0.0' },
+ *   {
+ *     capabilities: {
+ *       extensions: { [UI_EXTENSION_ID]: { mimeTypes: [UI_RESOURCE_MIME_TYPE] } },
+ *     },
+ *   }
+ * );
+ *
+ * const dashboard = registerAppResource({
+ *   server,
+ *   name: 'weather_dashboard',
+ *   uri: 'ui://weather/dashboard',
+ *   description: 'Interactive weather dashboard',
+ *   html: dashboardHtml,
+ *   ui: {
+ *     csp: { connectDomains: ['https://api.openweathermap.org'] },
+ *     prefersBorder: true,
+ *   },
+ * });
+ *
+ * server.registerTool(
+ *   'get-weather',
+ *   {
+ *     description: 'Get the weather for a location',
+ *     inputSchema: { location: z.string() },
+ *     _meta: dashboard.toolMeta(),
+ *   },
+ *   async ({ location }) => {
+ *     const forecast = await fetchForecast(location);
+ *     return {
+ *       // Text stays meaningful: it is what a host without Apps renders.
+ *       content: [{ type: 'text', text: summarise(forecast) }],
+ *       structuredContent: forecast,
+ *     };
+ *   }
+ * );
+ * ```
+ */
+declare const registerAppResource: ({
+  server,
+  name,
+  uri,
+  description,
+  html,
+  ui
+}: RegisterAppResourceParams) => RegisteredAppResource;
+//#endregion
 //#region src/registerToolFromSchema.d.ts
 /**
  * A plain JSON Schema object (draft-07 compatible) describing the shape of a
@@ -721,6 +912,19 @@ interface RegisterToolFromSchemaParams {
    * @default false
    */
   validateArguments?: boolean;
+  /**
+   * Tool metadata forwarded verbatim on `tools/list`.
+   *
+   * The MCP Apps extension links a tool to the view its result is rendered
+   * with through this field; build the bag with `toolMeta()` from
+   * `registerAppResource` rather than writing the keys by hand.
+   *
+   * @example
+   * ```typescript
+   * _meta: dashboard.toolMeta({ visibility: ['app'] }),
+   * ```
+   */
+  _meta?: Record<string, unknown>;
   /**
    * Tool handler invoked when the AI client calls the tool.
    * Receives the request arguments, validated against `inputSchema` only when
@@ -744,7 +948,7 @@ interface RegisterToolFromSchemaParams {
  *
  * @param server - The `McpServer` instance to register the tool on.
  * @param params - Tool configuration including name, description, inputSchema,
- *   validateArguments, and handler.
+ *   validateArguments, `_meta`, and handler.
  *
  * @example
  * ```typescript
@@ -801,7 +1005,12 @@ type GatedToolDef = {
    * Each gate receives the full {@link ToolCallContext} (identity + args).
    * Throw to reject the call; return (or resolve) to continue.
    */
-  gates?: Array<(ctx: ToolCallContext) => void | Promise<void>>; /** The tool handler. Receives merged call args + `buildContext` output. */
+  gates?: Array<(ctx: ToolCallContext) => void | Promise<void>>;
+  /**
+   * Tool metadata forwarded verbatim on `tools/list` — how a gated tool links
+   * to an MCP Apps view (`registerAppResource(...).toolMeta()`).
+   */
+  _meta?: Record<string, unknown>; /** The tool handler. Receives merged call args + `buildContext` output. */
   method: (args: Record<string, unknown>) => Promise<unknown>;
 };
 /** Options for {@link createGatedToolRegistrar}. */
@@ -1101,6 +1310,31 @@ interface McpRouterOptions {
    * served statelessly regardless of this option.
    */
   sessionIdGenerator?: () => string;
+  /**
+   * Per-request factory for the `McpServer` serving one `2026-07-28` request.
+   * Set it to serve that revision; without it, requests carrying its
+   * per-request envelope get the unsupported-protocol-version error naming the
+   * 2025-era revisions this endpoint does serve. Register the same tools here
+   * as on `server`, so the two eras cannot drift apart.
+   *
+   * It cannot default to `server`: the negotiated revision is instance state,
+   * so one instance serving both eras is pinned to `2026-07-28` by the first
+   * client to speak it, and every 2025-era request after that is answered
+   * `-32602 … missing the required _meta envelope` at HTTP 200. The SDK's own
+   * serving entries take a factory and call it once per request.
+   *
+   * @example
+   * ```typescript
+   * const buildServer = () => {
+   *   const mcpServer = new McpServer({ name: 'my-server', version: '1.0.0' });
+   *   registerEverything(mcpServer);
+   *   return mcpServer;
+   * };
+   *
+   * createMcpRouter(buildServer(), { createMcpServer: buildServer });
+   * ```
+   */
+  createMcpServer?: McpServerFactory;
   /**
    * Base URL prepended to relative paths passed to `apiCall` (paths starting
    * with `/`). Tool handlers can then call `apiCall('GET', '/resource')` without
@@ -1210,4 +1444,4 @@ interface McpRouterOptions {
  */
 declare const createMcpRouter: (server: McpServer$1, options?: McpRouterOptions) => Router<Application.DefaultState, Application.DefaultContext>;
 //#endregion
-export { ApiCallOptions, CognitoUserPoolConfig, type CreateGatedToolRegistrarOptions, type GatedToolDef, type JsonObjectSchema, McpAuthOptions, McpRouterOptions, McpServer, type RegisterToolFromSchemaParams, type ToolCallContext, type ToolIdentity, apiCall, checkScopes, createGatedToolRegistrar, createMcpRouter, getIdentity, registerToolFromSchema, z };
+export { ApiCallOptions, CognitoUserPoolConfig, type CreateGatedToolRegistrarOptions, type GatedToolDef, type JsonObjectSchema, McpAuthOptions, McpRouterOptions, McpServer, type RegisterAppResourceParams, type RegisterToolFromSchemaParams, type RegisteredAppResource, type ToolCallContext, type ToolIdentity, type ToolMetaParams, UI_EXTENSION_ID, UI_RESOURCE_MIME_TYPE, type UiResourceCsp, type UiResourceMeta, type UiResourcePermissions, type UiToolVisibility, apiCall, checkScopes, createGatedToolRegistrar, createMcpRouter, getIdentity, registerAppResource, registerToolFromSchema, z };

package/dist/index.d.mts

@@ -2,7 +2,7 @@
 /// <reference types="node" />
 import { Router } from "@ttoss/http-server";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { CallToolResult, McpServer, McpServer as McpServer$1 } from "@modelcontextprotocol/server";
+import { CallToolResult, McpServer, McpServer as McpServer$1, McpServerFactory, RegisteredResource } from "@modelcontextprotocol/server";
 import { z } from "zod";
 import accepts from "accepts";
 import { AsyncLocalStorage as AsyncLocalStorage$1 } from "async_hooks";
@@ -676,6 +676,197 @@ declare namespace Application {
  */
 declare const getIdentity: <T = unknown>() => T | undefined;
 //#endregion
+//#region src/registerAppResource.d.ts
+/**
+ * Identifier of the MCP Apps extension (`io.modelcontextprotocol/ui`), used as
+ * the key under `capabilities.extensions` on both sides of the handshake.
+ *
+ * A client declares Apps support with it; a server may advertise the same key
+ * so a host can discover the support without inspecting tool metadata:
+ *
+ * ```typescript
+ * new McpServer(
+ *   { name: 'weather', version: '1.0.0' },
+ *   {
+ *     capabilities: {
+ *       extensions: {
+ *         [UI_EXTENSION_ID]: { mimeTypes: [UI_RESOURCE_MIME_TYPE] },
+ *       },
+ *     },
+ *   }
+ * );
+ * ```
+ */
+declare const UI_EXTENSION_ID = "io.modelcontextprotocol/ui";
+/** MIME type every MCP Apps HTML resource is served as. */
+declare const UI_RESOURCE_MIME_TYPE = "text/html;profile=mcp-app";
+/**
+ * Origins an app's view is allowed to reach, mapped by the host onto the
+ * iframe's Content Security Policy. Anything not declared is blocked: an
+ * omitted list is the restrictive default, not "no restriction".
+ */
+interface UiResourceCsp {
+  /** Origins for network requests (`connect-src`). */
+  connectDomains?: string[];
+  /**
+   * Origins for scripts, styles, images, fonts and media (`script-src`,
+   * `style-src`, `img-src`, `font-src`, `media-src`).
+   */
+  resourceDomains?: string[];
+  /** Origins for nested iframes (`frame-src`). */
+  frameDomains?: string[];
+  /** Allowed document base URIs (`base-uri`). */
+  baseUriDomains?: string[];
+}
+/**
+ * Browser capabilities the view asks for. A host *may* grant them, so a view
+ * should feature-detect rather than assume: each key is a request, not a
+ * guarantee.
+ */
+interface UiResourcePermissions {
+  camera?: Record<string, never>;
+  microphone?: Record<string, never>;
+  geolocation?: Record<string, never>;
+  clipboardWrite?: Record<string, never>;
+}
+/** Rendering and security configuration for an app's view (`_meta.ui`). */
+interface UiResourceMeta {
+  /** Origins the view may reach; omitted means none. */
+  csp?: UiResourceCsp;
+  /** Browser capabilities requested for the view. */
+  permissions?: UiResourcePermissions;
+  /**
+   * Dedicated sandbox origin for the view, for cases needing a stable origin
+   * (OAuth callbacks, CORS, API key allowlists). The accepted format is
+   * host-specific; consult the host's documentation rather than deriving one.
+   */
+  domain?: string;
+  /** Whether the host should draw a border and background around the view. */
+  prefersBorder?: boolean;
+}
+/** Who may reach a tool. Defaults to both when left unset. */
+type UiToolVisibility = 'model' | 'app';
+/** Parameters for {@link registerAppResource}. */
+interface RegisterAppResourceParams {
+  /** The `McpServer` instance to register the app resource on. */
+  server: McpServer$1;
+  /** Resource name, as listed by `resources/list`. */
+  name: string;
+  /** Resource URI. Must use the `ui://` scheme. */
+  uri: string;
+  /** What the view does and when a host should render it. */
+  description?: string;
+  /**
+   * The view's HTML5 document, or a builder invoked per `resources/read`.
+   * A builder receives the requested URI so one registration can serve
+   * variants of a document.
+   */
+  html: string | ((args: {
+    uri: URL;
+  }) => string | Promise<string>);
+  /** Rendering and security configuration relayed to the host as `_meta.ui`. */
+  ui?: UiResourceMeta;
+}
+/** Parameters for {@link RegisteredAppResource.toolMeta}. */
+interface ToolMetaParams {
+  /**
+   * Who may reach the tool. Left unset, the spec's default applies — visible
+   * to the model *and* callable by the app.
+   */
+  visibility?: UiToolVisibility[];
+  /** Further `_meta` entries to merge in, e.g. vendor-namespaced keys. */
+  _meta?: Record<string, unknown>;
+}
+/** An app resource registered by {@link registerAppResource}. */
+interface RegisteredAppResource {
+  /** The URI tools link to. */
+  uri: string;
+  /** The SDK's registration handle, for `update`/`disable`/`remove`. */
+  resource: RegisteredResource;
+  /**
+   * Builds the `_meta` bag that links a tool to this view. Pass it to
+   * `registerTool`, {@link registerToolFromSchema}, or a `GatedToolDef` —
+   * whichever registration path the tool uses.
+   */
+  toolMeta: (params?: ToolMetaParams) => Record<string, unknown>;
+}
+/**
+ * Registers an MCP Apps view: a `ui://` resource a tool result is rendered
+ * with, per the `io.modelcontextprotocol/ui` extension.
+ *
+ * The extension asks nothing of the transport — a view is an ordinary MCP
+ * resource, and the tool linkage is ordinary tool `_meta` — so this is
+ * registration sugar over `registerResource`, not new protocol surface. What
+ * it owns is the part that is easy to get wrong: the `ui://` scheme, the exact
+ * MIME type, `_meta.ui` on both the declaration and the read result, and
+ * writing the deprecated flat linkage key alongside the current one.
+ *
+ * **Register the linkage unconditionally.** The extension's negotiation is
+ * per-request and only reliably readable on the `2026-07-28` revision; in this
+ * package's default stateless 2025-era mode there is no remembered
+ * `initialize` to read a client capability from. Gating registration on that
+ * capability would therefore silently drop the view for every 2025-era client.
+ * A host without Apps support simply ignores `_meta`, so keep each tool's
+ * `content` meaningful on its own and let the text result be the fallback.
+ *
+ * @example
+ * ```typescript
+ * import {
+ *   McpServer,
+ *   registerAppResource,
+ *   UI_EXTENSION_ID,
+ *   UI_RESOURCE_MIME_TYPE,
+ *   z,
+ * } from '@ttoss/http-server-mcp';
+ *
+ * const server = new McpServer(
+ *   { name: 'weather', version: '1.0.0' },
+ *   {
+ *     capabilities: {
+ *       extensions: { [UI_EXTENSION_ID]: { mimeTypes: [UI_RESOURCE_MIME_TYPE] } },
+ *     },
+ *   }
+ * );
+ *
+ * const dashboard = registerAppResource({
+ *   server,
+ *   name: 'weather_dashboard',
+ *   uri: 'ui://weather/dashboard',
+ *   description: 'Interactive weather dashboard',
+ *   html: dashboardHtml,
+ *   ui: {
+ *     csp: { connectDomains: ['https://api.openweathermap.org'] },
+ *     prefersBorder: true,
+ *   },
+ * });
+ *
+ * server.registerTool(
+ *   'get-weather',
+ *   {
+ *     description: 'Get the weather for a location',
+ *     inputSchema: { location: z.string() },
+ *     _meta: dashboard.toolMeta(),
+ *   },
+ *   async ({ location }) => {
+ *     const forecast = await fetchForecast(location);
+ *     return {
+ *       // Text stays meaningful: it is what a host without Apps renders.
+ *       content: [{ type: 'text', text: summarise(forecast) }],
+ *       structuredContent: forecast,
+ *     };
+ *   }
+ * );
+ * ```
+ */
+declare const registerAppResource: ({
+  server,
+  name,
+  uri,
+  description,
+  html,
+  ui
+}: RegisterAppResourceParams) => RegisteredAppResource;
+//#endregion
 //#region src/registerToolFromSchema.d.ts
 /**
  * A plain JSON Schema object (draft-07 compatible) describing the shape of a
@@ -722,6 +913,19 @@ interface RegisterToolFromSchemaParams {
    * @default false
    */
   validateArguments?: boolean;
+  /**
+   * Tool metadata forwarded verbatim on `tools/list`.
+   *
+   * The MCP Apps extension links a tool to the view its result is rendered
+   * with through this field; build the bag with `toolMeta()` from
+   * `registerAppResource` rather than writing the keys by hand.
+   *
+   * @example
+   * ```typescript
+   * _meta: dashboard.toolMeta({ visibility: ['app'] }),
+   * ```
+   */
+  _meta?: Record<string, unknown>;
   /**
    * Tool handler invoked when the AI client calls the tool.
    * Receives the request arguments, validated against `inputSchema` only when
@@ -745,7 +949,7 @@ interface RegisterToolFromSchemaParams {
  *
  * @param server - The `McpServer` instance to register the tool on.
  * @param params - Tool configuration including name, description, inputSchema,
- *   validateArguments, and handler.
+ *   validateArguments, `_meta`, and handler.
  *
  * @example
  * ```typescript
@@ -802,7 +1006,12 @@ type GatedToolDef = {
    * Each gate receives the full {@link ToolCallContext} (identity + args).
    * Throw to reject the call; return (or resolve) to continue.
    */
-  gates?: Array<(ctx: ToolCallContext) => void | Promise<void>>; /** The tool handler. Receives merged call args + `buildContext` output. */
+  gates?: Array<(ctx: ToolCallContext) => void | Promise<void>>;
+  /**
+   * Tool metadata forwarded verbatim on `tools/list` — how a gated tool links
+   * to an MCP Apps view (`registerAppResource(...).toolMeta()`).
+   */
+  _meta?: Record<string, unknown>; /** The tool handler. Receives merged call args + `buildContext` output. */
   method: (args: Record<string, unknown>) => Promise<unknown>;
 };
 /** Options for {@link createGatedToolRegistrar}. */
@@ -1102,6 +1311,31 @@ interface McpRouterOptions {
    * served statelessly regardless of this option.
    */
   sessionIdGenerator?: () => string;
+  /**
+   * Per-request factory for the `McpServer` serving one `2026-07-28` request.
+   * Set it to serve that revision; without it, requests carrying its
+   * per-request envelope get the unsupported-protocol-version error naming the
+   * 2025-era revisions this endpoint does serve. Register the same tools here
+   * as on `server`, so the two eras cannot drift apart.
+   *
+   * It cannot default to `server`: the negotiated revision is instance state,
+   * so one instance serving both eras is pinned to `2026-07-28` by the first
+   * client to speak it, and every 2025-era request after that is answered
+   * `-32602 … missing the required _meta envelope` at HTTP 200. The SDK's own
+   * serving entries take a factory and call it once per request.
+   *
+   * @example
+   * ```typescript
+   * const buildServer = () => {
+   *   const mcpServer = new McpServer({ name: 'my-server', version: '1.0.0' });
+   *   registerEverything(mcpServer);
+   *   return mcpServer;
+   * };
+   *
+   * createMcpRouter(buildServer(), { createMcpServer: buildServer });
+   * ```
+   */
+  createMcpServer?: McpServerFactory;
   /**
    * Base URL prepended to relative paths passed to `apiCall` (paths starting
    * with `/`). Tool handlers can then call `apiCall('GET', '/resource')` without
@@ -1211,4 +1445,4 @@ interface McpRouterOptions {
  */
 declare const createMcpRouter: (server: McpServer$1, options?: McpRouterOptions) => Router<Application.DefaultState, Application.DefaultContext>;
 //#endregion
-export { ApiCallOptions, CognitoUserPoolConfig, type CreateGatedToolRegistrarOptions, type GatedToolDef, type JsonObjectSchema, McpAuthOptions, McpRouterOptions, McpServer, type RegisterToolFromSchemaParams, type ToolCallContext, type ToolIdentity, apiCall, checkScopes, createGatedToolRegistrar, createMcpRouter, getIdentity, registerToolFromSchema, z };
+export { ApiCallOptions, CognitoUserPoolConfig, type CreateGatedToolRegistrarOptions, type GatedToolDef, type JsonObjectSchema, McpAuthOptions, McpRouterOptions, McpServer, type RegisterAppResourceParams, type RegisterToolFromSchemaParams, type RegisteredAppResource, type ToolCallContext, type ToolIdentity, type ToolMetaParams, UI_EXTENSION_ID, UI_RESOURCE_MIME_TYPE, type UiResourceCsp, type UiResourceMeta, type UiResourcePermissions, type UiToolVisibility, apiCall, checkScopes, createGatedToolRegistrar, createMcpRouter, getIdentity, registerAppResource, registerToolFromSchema, z };