better-supabase 0.2.0 → 0.3.0

package/dist/list/index.js

@@ -1,10 +1,11 @@
-//#region src/list/index.ts
+//#region src/list/list-query.ts
 /** Facet value meaning "not set": filters with `is null`. */
 const UNSET = "__unset__";
 const RESERVED = /* @__PURE__ */ new Set([
 	"q",
 	"sort",
 	"page",
+	"after",
 	"size"
 ]);
 function first(value) {
@@ -13,8 +14,9 @@ function first(value) {
 function all(value) {
 	return (typeof value === "string" ? [value] : [...value ?? []]).flatMap((entry) => entry.split(",")).map((entry) => entry.trim()).filter(Boolean);
 }
+const isParamValue = (value) => value === void 0 || typeof value === "string" || Array.isArray(value) && value.every((entry) => typeof entry === "string");
 function isSearchParams(value) {
-	return value instanceof URLSearchParams || !("facets" in value && typeof value.facets === "object");
+	return value instanceof URLSearchParams || !("facets" in value && typeof value.facets === "object") && Object.values(value).every(isParamValue);
 }
 function readRecord(input) {
 	if (!(input instanceof URLSearchParams)) return input;
@@ -47,6 +49,7 @@ function defineListQuery(sb, table, config) {
 	const pageSize = config.pageSize ?? 50;
 	const maxPageSize = config.maxPageSize ?? 200;
 	const maxSearch = config.maxSearchLength ?? 200;
+	const cursor = config.pagination === "cursor";
 	const sortKeys = Object.keys(config.sorts);
 	const facetEntries = Object.entries(config.facets ?? {});
 	for (const [key, column] of facetEntries) {
@@ -96,6 +99,18 @@ function defineListQuery(sb, table, config) {
 			message: "Must be a whole number of at least 1",
 			path: ["page"]
 		});
+		else if (cursor && page !== 1) issues.push({
+			message: "This list pages with `after`, not `page`",
+			path: ["page"]
+		});
+		let after;
+		if (raw.after !== void 0 && raw.after !== "") {
+			if (cursor && typeof raw.after === "string") after = raw.after;
+			else issues.push({
+				message: cursor ? "Must be text" : "This list pages with `page`, not `after`",
+				path: ["after"]
+			});
+		}
 		const size = raw.size === void 0 || raw.size === "" ? pageSize : toInt(raw.size);
 		if (size === void 0 || !Number.isInteger(size) || size < 1 || size > maxPageSize) issues.push({
 			message: `Must be a whole number from 1 to ${String(maxPageSize)}`,
@@ -121,6 +136,7 @@ function defineListQuery(sb, table, config) {
 				...q ? { q } : {},
 				sort,
 				page: page ?? 1,
+				...after ? { after } : {},
 				size: size ?? pageSize,
 				facets: facetValues
 			}
@@ -143,6 +159,7 @@ function defineListQuery(sb, table, config) {
 				q: first(record["q"]),
 				sort: first(record["sort"]),
 				page: first(record["page"]),
+				after: first(record["after"]),
 				size: first(record["size"]),
 				facets: facetValues
 			});
@@ -160,6 +177,7 @@ function defineListQuery(sb, table, config) {
 			q: typed.q,
 			sort: typed.sort,
 			page: typed.page,
+			after: typed.after,
 			size: typed.size,
 			facets: rawFacets
 		});
@@ -195,12 +213,15 @@ function defineListQuery(sb, table, config) {
 	}
 	function args(query) {
 		const filter = where(query);
+		const paging = cursor ? { after: query.after ?? null } : {
+			page: query.page,
+			count: config.count ?? "exact"
+		};
 		return {
 			...filter ? { where: filter } : {},
 			orderBy: config.sorts[query.sort],
-			page: query.page,
 			size: query.size,
-			count: config.count ?? "exact"
+			...paging
 		};
 	}
 	/** Whether a group's value passes the facet's selected values. */
@@ -249,6 +270,10 @@ function defineListQuery(sb, table, config) {
 			serialize: (value) => value
 		},
 		page: intParser,
+		after: {
+			parse: (value) => value || null,
+			serialize: (value) => value
+		},
 		size: intParser,
 		...Object.fromEntries(facets.map((facet) => [facet.key, listParser]))
 	};
@@ -261,8 +286,102 @@ function defineListQuery(sb, table, config) {
 		uniqueItems: true
 	});
 	const searchDescription = config.search ? Array.isArray(config.search) ? `Case-insensitive search in ${config.search.join(", ")}.` : "Full-text search (web search syntax)." : void 0;
+	const openapi = [
+		...searchDescription ? [{
+			name: "q",
+			in: "query",
+			required: false,
+			description: searchDescription,
+			schema: {
+				type: "string",
+				maxLength: maxSearch
+			}
+		}] : [],
+		{
+			name: "sort",
+			in: "query",
+			required: false,
+			description: `Ordering. Default \`${config.defaultSort}\`.`,
+			schema: {
+				type: "string",
+				enum: sortKeys,
+				default: config.defaultSort
+			}
+		},
+		cursor ? {
+			name: "after",
+			in: "query",
+			required: false,
+			description: "`nextCursor` of the previous page. Leave it out for the first page.",
+			schema: { type: "string" }
+		} : {
+			name: "page",
+			in: "query",
+			required: false,
+			description: "1-based page number.",
+			schema: {
+				type: "integer",
+				minimum: 1,
+				default: 1
+			}
+		},
+		{
+			name: "size",
+			in: "query",
+			required: false,
+			description: "Page size.",
+			schema: {
+				type: "integer",
+				minimum: 1,
+				maximum: maxPageSize,
+				default: pageSize
+			}
+		},
+		...facets.map((facet) => ({
+			name: facet.key,
+			in: "query",
+			required: false,
+			description: `Filter on ${facet.column}. Comma-separated; any value matches.${facet.nullable ? ` \`${UNSET}\` matches empty.` : ""}`,
+			schema: facetSchema(facet),
+			style: "form",
+			explode: false
+		}))
+	];
+	const jsonSchema = {
+		type: "object",
+		additionalProperties: false,
+		properties: {
+			...searchDescription ? { q: {
+				type: "string",
+				maxLength: maxSearch,
+				description: searchDescription
+			} } : {},
+			sort: {
+				type: "string",
+				enum: sortKeys,
+				default: config.defaultSort
+			},
+			...cursor ? { after: { type: "string" } } : { page: {
+				type: "integer",
+				minimum: 1,
+				default: 1
+			} },
+			size: {
+				type: "integer",
+				minimum: 1,
+				maximum: maxPageSize,
+				default: pageSize
+			},
+			...facets.length > 0 ? { facets: {
+				type: "object",
+				additionalProperties: false,
+				properties: Object.fromEntries(facets.map((facet) => [facet.key, facetSchema(facet)]))
+			} } : {}
+		}
+	};
 	return {
 		table,
+		pagination: config.pagination ?? "offset",
 		defaults,
 		facets,
 		parse,
@@ -279,7 +398,8 @@ function defineListQuery(sb, table, config) {
 			if (query.q) params.set("q", query.q);
 			if (query.sort && query.sort !== config.defaultSort) params.set("sort", query.sort);
 			if (query.page && query.page !== 1) params.set("page", String(query.page));
-			if (query.size && query.size !== pageSize) params.set("size", String(query.size));
+			if (query.after) params.set("after", query.after);
+			if (query.size !== void 0 && query.size > 0 && query.size !== pageSize) params.set("size", String(query.size));
 			for (const facet of facets) {
 				const values = query.facets?.[facet.key];
 				if (values && values.length > 0) params.set(facet.key, values.join(","));
@@ -297,7 +417,7 @@ function defineListQuery(sb, table, config) {
 			const page = repository.paginate({
 				...extra,
 				...base,
-				count: count ?? base["count"],
+				...cursor ? {} : { count: count ?? base["count"] },
 				...combined ? { where: combined } : {}
 			});
 			if (!config.facetCounts) return page;
@@ -317,93 +437,8 @@ function defineListQuery(sb, table, config) {
 				facetCounts: marginals(rows, query)
 			})));
 		},
-		openapi: [
-			...searchDescription ? [{
-				name: "q",
-				in: "query",
-				required: false,
-				description: searchDescription,
-				schema: {
-					type: "string",
-					maxLength: maxSearch
-				}
-			}] : [],
-			{
-				name: "sort",
-				in: "query",
-				required: false,
-				description: `Ordering. Default \`${config.defaultSort}\`.`,
-				schema: {
-					type: "string",
-					enum: sortKeys,
-					default: config.defaultSort
-				}
-			},
-			{
-				name: "page",
-				in: "query",
-				required: false,
-				description: "1-based page number.",
-				schema: {
-					type: "integer",
-					minimum: 1,
-					default: 1
-				}
-			},
-			{
-				name: "size",
-				in: "query",
-				required: false,
-				description: "Page size.",
-				schema: {
-					type: "integer",
-					minimum: 1,
-					maximum: maxPageSize,
-					default: pageSize
-				}
-			},
-			...facets.map((facet) => ({
-				name: facet.key,
-				in: "query",
-				required: false,
-				description: `Filter on ${facet.column}. Comma-separated; any value matches.${facet.nullable ? ` \`${UNSET}\` matches empty.` : ""}`,
-				schema: facetSchema(facet),
-				style: "form",
-				explode: false
-			}))
-		],
-		jsonSchema: {
-			type: "object",
-			additionalProperties: false,
-			properties: {
-				...searchDescription ? { q: {
-					type: "string",
-					maxLength: maxSearch,
-					description: searchDescription
-				} } : {},
-				sort: {
-					type: "string",
-					enum: sortKeys,
-					default: config.defaultSort
-				},
-				page: {
-					type: "integer",
-					minimum: 1,
-					default: 1
-				},
-				size: {
-					type: "integer",
-					minimum: 1,
-					maximum: maxPageSize,
-					default: pageSize
-				},
-				...facets.length > 0 ? { facets: {
-					type: "object",
-					additionalProperties: false,
-					properties: Object.fromEntries(facets.map((facet) => [facet.key, facetSchema(facet)]))
-				} } : {}
-			}
-		}
+		openapi,
+		jsonSchema
 	};
 }
 //#endregion

package/dist/{live-DJyZMD6w.d.ts → live-QE3UPbGm.d.ts}

@@ -1,10 +1,11 @@
-import { A as SchemaMeta, N as TableKey, O as Row, n as AnyModels, t as AnyFunctions, x as PermdockTopicPolicy } from "./types-C83v5SQz.js";
-import { b as ValidationIssue, o as Result, p as DbError, t as AsyncResult } from "./result-CTkCZ6JA.js";
-import { Z as QuerySpec, t as BetterSupabase } from "./define-e3zI4_4g.js";
+import { A as SchemaMeta, N as TableKey, O as Row, n as AnyModels, t as AnyFunctions, x as PermdockTopicPolicy } from "./types-DONv9SHN.js";
+import { b as ValidationIssue, o as Result, p as DbError, t as AsyncResult } from "./result-c2OYgCV2.js";
+import { Z as QuerySpec, t as BetterSupabase } from "./define-DUbydmJa.js";
+import { t as PermdockCatalog } from "./permdock-sql-DImJULY-.js";
 import { n as TemplateValues, t as TemplateParams } from "./template-mbvlysOo.js";
 import { RealtimeChannel, SupabaseClient } from "@supabase/supabase-js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
-//#region src/realtime/index.d.ts
+//#region src/realtime/topic.d.ts
 type EventSchemas = Readonly<Record<string, StandardSchemaV1>>;
 interface TopicOptions<E extends EventSchemas> {
   /** Name used for generated policies and functions. Defaults to the template's literal parts. */
@@ -34,9 +35,15 @@ interface TopicOptions<E extends EventSchemas> {
    * The helpers check role and scope only. Use this just for permissions
    * whose grants have no row conditions beyond the scope: for a permission
    * with row conditions (e.g. `authorId = principal.id`) every member of the
-   * scope may join. Leave those to the policies `permdock rls generate` writes.
+   * scope could join. Pass `catalog` to refuse those keys here;
+   * `better-supabase doctor` (BS214) refuses them from the catalog file.
    */
   readonly permdock?: PermdockTopicPolicy;
+  /**
+   * PermDock's `permissions.catalog.json`. With it, a `permdock` policy
+   * naming a permission with `rowConditions: true` throws.
+   */
+  readonly catalog?: PermdockCatalog;
   /** Let clients broadcast on the topic, not only receive. Defaults to `false`. */
   readonly send?: boolean;
   /** Also authorize presence. Defaults to `false`. */
@@ -77,7 +84,10 @@ interface TriggerOptions<M extends AnyModels, T extends keyof M, P extends strin
   readonly values: { readonly [K in TemplateParams<P>]: Extract<keyof Row<M, T>, string>; };
   /** Defaults to all three. */
   readonly events?: readonly ("insert" | "update" | "delete")[];
-  /** Schema for the generated function. Defaults to `public`. */
+  /**
+   * Schema for the generated function. Defaults to `better_supabase`, which
+   * the Data API does not expose.
+   */
   readonly functionSchema?: string;
 }
 interface RowChange<R> {

package/dist/mcp/index.d.ts

@@ -1,13 +1,13 @@
-import { N as TableKey, n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
-import { t as BetterSupabase } from "../define-e3zI4_4g.js";
-import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-Dne1ARSa.js";
-import { i as ResourceRouteOptions } from "../resource-CgZa3YG_.js";
+import { N as TableKey, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
+import { t as BetterSupabase } from "../define-DUbydmJa.js";
+import { d as ServerContext, f as ServerOptions, l as BetterServer, n as GuardOptions } from "../respond-DAkPIdTH.js";
+import { a as ResourceRouteOptions } from "../resource-CwVgiI5q.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
-//#region src/mcp/index.d.ts
+//#region src/mcp/mcp.d.ts
 export declare const MCP_PROTOCOL_VERSION: string;
 type Json = Readonly<Record<string, unknown>>;
 /** MCP tool annotations (hints for clients, not guarantees). */
-export interface ToolAnnotations {
+interface ToolAnnotations {
   readonly title?: string;
   readonly readOnlyHint?: boolean;
   readonly destructiveHint?: boolean;
@@ -15,7 +15,7 @@ export interface ToolAnnotations {
   readonly openWorldHint?: boolean;
 }
 /** A tool as listed by `tools/list`. */
-export interface ToolInfo {
+interface ToolInfo {
   readonly name: string;
   readonly title?: string;
   readonly description?: string;
@@ -23,11 +23,11 @@ export interface ToolInfo {
   readonly outputSchema?: Json;
   readonly annotations?: ToolAnnotations;
 }
-export interface ToolContext<M extends AnyModels, F extends AnyFunctions, E> extends ServerContext<M, F, E> {
+interface ToolContext<M extends AnyModels, F extends AnyFunctions, E> extends ServerContext<M, F, E> {
   readonly request: Request;
   readonly signal: AbortSignal;
 }
-export interface McpTool<M extends AnyModels, F extends AnyFunctions, E> {
+interface McpTool<M extends AnyModels, F extends AnyFunctions, E> {
   readonly info: ToolInfo;
   /** Validates arguments; its output is what `run` receives. */
   readonly input?: StandardSchemaV1;
@@ -36,13 +36,13 @@ export interface McpTool<M extends AnyModels, F extends AnyFunctions, E> {
   run(args: never, ctx: ToolContext<M, F, E>): unknown;
 }
 /** What the `authorize` and `visible` hooks see of a tool. */
-export interface ToolRef {
+interface ToolRef {
   readonly info: ToolInfo;
   /** The tool's `meta`, e.g. a PermDock permission. `undefined` for table tools. */
   readonly meta: unknown;
 }
 /** The outcome of `authorize`. `scopes` turns a refusal into an OAuth challenge. */
-export type ToolDecision = {
+type ToolDecision = {
   readonly allowed: true;
 } | {
   readonly allowed: false;
@@ -50,7 +50,7 @@ export type ToolDecision = {
   /** OAuth scopes the call needs, sent in an `insufficient_scope` challenge. */
   readonly scopes?: readonly string[];
 };
-export interface ToolDefinition<M extends AnyModels, F extends AnyFunctions, E, I> {
+interface ToolDefinition<M extends AnyModels, F extends AnyFunctions, E, I> {
   readonly name: string;
   readonly title?: string;
   readonly description: string;
@@ -66,8 +66,8 @@ export interface ToolDefinition<M extends AnyModels, F extends AnyFunctions, E,
   readonly meta?: unknown;
   run(args: I, ctx: ToolContext<M, F, E>): unknown;
 }
-export type ToolResources<M extends AnyModels> = { readonly [T in TableKey<M>]?: ResourceRouteOptions<M, T> | true; };
-export interface McpOptions<M extends AnyModels, F extends AnyFunctions, E> extends ServerOptions, GuardOptions {
+type ToolResources<M extends AnyModels> = { readonly [T in TableKey<M>]?: ResourceRouteOptions<M, T> | true; };
+interface McpOptions<M extends AnyModels, F extends AnyFunctions, E> extends ServerOptions, GuardOptions {
   readonly name: string;
   readonly version: string;
   readonly title?: string;
@@ -91,6 +91,13 @@ export interface McpOptions<M extends AnyModels, F extends AnyFunctions, E> exte
   readonly scopes?: readonly string[];
   /** Origins allowed to call the server (DNS rebinding protection). Defaults to any. */
   readonly allowedOrigins?: readonly string[];
+  /**
+   * Hostnames the `Host` header may name, without the port (DNS rebinding
+   * protection). List the production, preview and local hosts. Defaults to any.
+   */
+  readonly allowedHosts?: readonly string[];
+  /** A page that explains how to connect, published as RFC 9728 `resource_documentation`. */
+  readonly resourceDocumentation?: string;
   /** Custom jsonb types, as in `createOpenApi`. */
   readonly json?: Readonly<Record<string, unknown>>;
   /** Include internal error messages in tool results. Defaults to `NODE_ENV === 'development'`. */
@@ -108,7 +115,7 @@ export interface McpOptions<M extends AnyModels, F extends AnyFunctions, E> exte
    */
   readonly visible?: (ctx: ToolContext<M, F, E>, tool: ToolRef) => boolean | Promise<boolean>;
 }
-export interface BetterMcp<M extends AnyModels, F extends AnyFunctions, E> extends BetterServer<M, F, E> {
+interface BetterMcp<M extends AnyModels, F extends AnyFunctions, E> extends BetterServer<M, F, E> {
   /** Everything in one handler: the MCP endpoint and `/.well-known/oauth-protected-resource`. */
   readonly fetch: (request: Request) => Promise<Response>;
   /** The Streamable HTTP endpoint (POST JSON-RPC). */
@@ -121,7 +128,7 @@ export interface BetterMcp<M extends AnyModels, F extends AnyFunctions, E> exten
   /** Calls a tool directly, e.g. from tests or another transport. */
   call(name: string, args: unknown, ctx: ToolContext<M, F, E>): Promise<ToolResult>;
 }
-export interface ToolResult {
+interface ToolResult {
   readonly content: readonly {
     readonly type: "text";
     readonly text: string;
@@ -139,4 +146,4 @@ export declare function defineTool<M extends AnyModels, F extends AnyFunctions,
  */
 export declare function createMcp<M extends AnyModels, D, F extends AnyFunctions, E>(sb: BetterSupabase<M, D, F, E>, options: McpOptions<M, F, E>): BetterMcp<M, F, E>;
 //#endregion
-export type { GuardOptions, ResourceRouteOptions };
+export type { BetterMcp, GuardOptions, McpOptions, McpTool, ResourceRouteOptions, ToolAnnotations, ToolContext, ToolDecision, ToolDefinition, ToolInfo, ToolRef, ToolResources, ToolResult };

package/dist/mcp/index.js

@@ -1,12 +1,13 @@
 import { n as dbError } from "../errors-Bl3rkOzo.js";
+import { t as base64ToText } from "../base64-CQeB1eSf.js";
 import { t as validate } from "../standard-FUi3Z3-7.js";
-import { o as toProblem } from "../problem-BTkTtRV9.js";
+import { o as toProblem } from "../problem-CGt1ADix.js";
 import { t as SPEC_PINS } from "../spec-pins-C3oc-Tdp.js";
-import { t as buildJsonSchema } from "../json-schema-BpYqkCKf.js";
-import { a as settle, c as withExtra, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-DMcbQwfN.js";
-import { t as defineResource } from "../resource-BHEWmQJK.js";
+import { t as buildJsonSchema } from "../json-schema--aOXAGfU.js";
+import { a as settle, c as withExtra, n as guard, o as createServer, s as extendServer, t as defaultExpose } from "../respond-C44EZAJo.js";
+import { t as defineResource } from "../resource-D30rp0GN.js";
 import { fromSupabaseUrl, unauthorizedResponse } from "@supabase/server/oauth-protected-resource";
-//#region src/mcp/index.ts
+//#region src/mcp/mcp.ts
 const MCP_PROTOCOL_VERSION = SPEC_PINS.mcp;
 const WELL_KNOWN = "/.well-known/oauth-protected-resource";
 /** Revisions before 2026-07-28 open with an `initialize` handshake. */
@@ -16,6 +17,16 @@ const LEGACY_VERSIONS = [
 	"2025-03-26"
 ];
 const SUPPORTED_VERSIONS = [MCP_PROTOCOL_VERSION, ...LEGACY_VERSIONS];
+/** The `Host` header's hostname is in the list; a missing or malformed header is not. */
+function hostAllowed(request, allowed) {
+	const host = request.headers.get("host");
+	if (!host) return false;
+	try {
+		return allowed.includes(new URL(`http://${host}`).hostname);
+	} catch {
+		return false;
+	}
+}
 /** A custom tool. Pass it in `createMcp({ tools: [...] })`. */
 function defineTool(definition) {
 	if (!/^[A-Za-z0-9_.-]{1,64}$/.test(definition.name)) throw new TypeError(`Invalid tool name "${definition.name}": use 1-64 letters, digits, "_", "-" or "."`);
@@ -67,15 +78,15 @@ const ANNOTATIONS = {
 		openWorldHint: false
 	}
 };
-function pageSchema(max) {
+function pageSchema(max, cursor) {
 	return {
 		type: "object",
 		properties: {
-			page: {
+			...cursor ? { after: { type: "string" } } : { page: {
 				type: "integer",
 				minimum: 1,
 				default: 1
-			},
+			} },
 			size: {
 				type: "integer",
 				minimum: 1,
@@ -99,7 +110,23 @@ function tableTools(resource, defs) {
 		required: [keyParam, ...Object.keys(more)],
 		additionalProperties: false
 	});
-	const page = {
+	const cursor = resource.pagination === "cursor";
+	const page = cursor ? {
+		type: "object",
+		properties: {
+			items: {
+				type: "array",
+				items: row
+			},
+			nextCursor: { type: ["string", "null"] },
+			hasMore: { type: "boolean" }
+		},
+		required: [
+			"items",
+			"nextCursor",
+			"hasMore"
+		]
+	} : {
 		type: "object",
 		properties: {
 			items: {
@@ -126,7 +153,7 @@ function tableTools(resource, defs) {
 	};
 	for (const operation of resource.operations) switch (operation) {
 		case "list": {
-			const { $schema: _, ...listSchema } = resource.list?.jsonSchema ?? pageSchema(resource.maxPageSize);
+			const { $schema: _, ...listSchema } = resource.list?.jsonSchema ?? pageSchema(resource.maxPageSize, cursor);
 			add("list", `List ${table} rows visible to the caller, one page at a time.`, listSchema, page);
 			break;
 		}
@@ -174,7 +201,7 @@ function headerName(value) {
 	const encoded = /^=\?base64\?(.*)\?=$/.exec(value)?.[1];
 	if (encoded === void 0) return value;
 	try {
-		return new TextDecoder().decode(Uint8Array.from(atob(encoded), (char) => char.charCodeAt(0)));
+		return base64ToText(encoded);
 	} catch {
 		return value;
 	}
@@ -352,6 +379,7 @@ function createMcp(sb, options) {
 	const handler = async (request) => {
 		const origin = request.headers.get("origin");
 		if (origin && options.allowedOrigins && !options.allowedOrigins.includes(origin)) return rpcError(null, INVALID_REQUEST, "Origin not allowed", 403);
+		if (options.allowedHosts && !hostAllowed(request, options.allowedHosts)) return rpcError(null, INVALID_REQUEST, "Host not allowed", 403);
 		if (request.method !== "POST") return new Response(null, {
 			status: 405,
 			headers: { allow: "POST" }
@@ -432,7 +460,8 @@ function createMcp(sb, options) {
 		resource: resourceOf(request),
 		authorization_servers: [...authorizationServers()],
 		bearer_methods_supported: ["header"],
-		...scopes.length > 0 ? { scopes_supported: scopes } : {}
+		...scopes.length > 0 ? { scopes_supported: scopes } : {},
+		...options.resourceDocumentation === void 0 ? {} : { resource_documentation: options.resourceDocumentation }
 	}, { headers: { "access-control-allow-origin": "*" } });
 	const mcp = extendServer(server, {
 		get tools() {