mcp-use 1.6.3-canary.0 → 1.7.0-canary.2

package/dist/src/server/index.js

@@ -1,3 +1,23 @@
+import {
+  getAuth,
+  hasAnyScope,
+  hasScope,
+  oauthAuth0Provider,
+  oauthCustomProvider,
+  oauthKeycloakProvider,
+  oauthSupabaseProvider,
+  oauthWorkOSProvider,
+  requireAnyScope,
+  requireScope
+} from "../../chunk-F4UHAA5L.js";
+import {
+  fsHelpers,
+  generateUUID,
+  getCwd,
+  getEnv,
+  isDeno,
+  pathHelpers
+} from "../../chunk-MTHLLDCX.js";
 import {
   __name
 } from "../../chunk-3GQAWCBQ.js";
@@ -7,15 +27,31 @@ import {
   McpServer as OfficialMcpServer,
   ResourceTemplate
 } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
-import { z } from "zod";
+
+// src/server/context-storage.ts
+import { AsyncLocalStorage } from "async_hooks";
+var requestContextStorage = new AsyncLocalStorage();
+async function runWithContext(context, fn) {
+  return requestContextStorage.run(context, fn);
+}
+__name(runWithContext, "runWithContext");
+function getRequestContext() {
+  return requestContextStorage.getStore();
+}
+__name(getRequestContext, "getRequestContext");
+function hasRequestContext() {
+  return requestContextStorage.getStore() !== void 0;
+}
+__name(hasRequestContext, "hasRequestContext");
 
 // src/server/adapters/mcp-ui-adapter.ts
 import { createUIResource } from "@mcp-ui/server";
-function buildWidgetUrl(widget, props, config) {
+function buildWidgetUrl(widget2, props, config) {
   const url = new URL(
-    `/mcp-use/widgets/${widget}`,
+    `/mcp-use/widgets/${widget2}`,
     `${config.baseUrl}:${config.port}`
   );
   if (props && Object.keys(props).length > 0) {
@@ -55,17 +91,17 @@ function createRemoteDomResource(uri, script, framework = "react", encoding = "t
 }
 __name(createRemoteDomResource, "createRemoteDomResource");
 function createAppsSdkResource(uri, htmlTemplate, metadata) {
-  const resource = {
+  const resource2 = {
     uri,
     mimeType: "text/html+skybridge",
     text: htmlTemplate
   };
   if (metadata && Object.keys(metadata).length > 0) {
-    resource._meta = metadata;
+    resource2._meta = metadata;
   }
   return {
     type: "resource",
-    resource
+    resource: resource2
   };
 }
 __name(createAppsSdkResource, "createAppsSdkResource");
@@ -161,11 +197,10 @@ async function adaptConnectMiddleware(connectMiddleware, middlewarePath) {
     const httpMocks = await import("node-mocks-http");
     createRequest = httpMocks.createRequest;
     createResponse = httpMocks.createResponse;
-  } catch (error) {
-    console.error(
-      "[WIDGETS] node-mocks-http not available. Install connect and node-mocks-http for Vite middleware support."
+  } catch (error2) {
+    throw new Error(
+      "\u274C Widget middleware dependencies not installed!\n\nTo use Connect middleware adapters with MCP widgets, you need to install:\n\n  npm install node-mocks-http\n  # or\n  pnpm add node-mocks-http\n\nThis dependency is automatically included in projects created with 'create-mcp-use-app'."
     );
-    throw error;
   }
   let normalizedPath = middlewarePath;
   if (normalizedPath.endsWith("*")) {
@@ -263,16 +298,16 @@ async function adaptConnectMiddleware(connectMiddleware, middlewarePath) {
 __name(adaptConnectMiddleware, "adaptConnectMiddleware");
 
 // src/server/logging.ts
-var isDeno = typeof globalThis.Deno !== "undefined";
-function getEnv(key) {
-  if (isDeno) {
+var isDeno2 = typeof globalThis.Deno !== "undefined";
+function getEnv2(key) {
+  if (isDeno2) {
     return globalThis.Deno.env.get(key);
   }
   return typeof process !== "undefined" && process.env ? process.env[key] : void 0;
 }
-__name(getEnv, "getEnv");
+__name(getEnv2, "getEnv");
 function isDebugMode() {
-  const debugEnv = getEnv("DEBUG");
+  const debugEnv = getEnv2("DEBUG");
   return debugEnv !== void 0 && debugEnv !== "" && debugEnv !== "0" && debugEnv.toLowerCase() !== "false";
 }
 __name(isDebugMode, "isDebugMode");
@@ -378,7 +413,7 @@ async function requestLogger(c, next) {
       } else {
         console.log("\x1B[33mResponse Body:\x1B[0m (no body)");
       }
-    } catch (error) {
+    } catch (error2) {
       console.log("\x1B[33mResponse Body:\x1B[0m (unable to read)");
     }
     console.log("\x1B[36m" + "=".repeat(80) + "\x1B[0m\n");
@@ -387,90 +422,7 @@ async function requestLogger(c, next) {
 __name(requestLogger, "requestLogger");
 
 // src/server/mcp-server.ts
-function generateUUID() {
-  return globalThis.crypto.randomUUID();
-}
-__name(generateUUID, "generateUUID");
 var TMP_MCP_USE_DIR = ".mcp-use";
-var isDeno2 = typeof globalThis.Deno !== "undefined";
-function getEnv2(key) {
-  if (isDeno2) {
-    return globalThis.Deno.env.get(key);
-  }
-  return process.env[key];
-}
-__name(getEnv2, "getEnv");
-function getCwd() {
-  if (isDeno2) {
-    return globalThis.Deno.cwd();
-  }
-  return process.cwd();
-}
-__name(getCwd, "getCwd");
-var fsHelpers = {
-  async readFileSync(path, encoding = "utf8") {
-    if (isDeno2) {
-      return await globalThis.Deno.readTextFile(path);
-    }
-    const { readFileSync } = await import("fs");
-    const result = readFileSync(path, encoding);
-    return typeof result === "string" ? result : result.toString(encoding);
-  },
-  async readFile(path) {
-    if (isDeno2) {
-      const data = await globalThis.Deno.readFile(path);
-      return data.buffer;
-    }
-    const { readFileSync } = await import("fs");
-    const buffer = readFileSync(path);
-    return buffer.buffer.slice(
-      buffer.byteOffset,
-      buffer.byteOffset + buffer.byteLength
-    );
-  },
-  async existsSync(path) {
-    if (isDeno2) {
-      try {
-        await globalThis.Deno.stat(path);
-        return true;
-      } catch {
-        return false;
-      }
-    }
-    const { existsSync } = await import("fs");
-    return existsSync(path);
-  },
-  async readdirSync(path) {
-    if (isDeno2) {
-      const entries = [];
-      for await (const entry of globalThis.Deno.readDir(path)) {
-        entries.push(entry.name);
-      }
-      return entries;
-    }
-    const { readdirSync } = await import("fs");
-    return readdirSync(path);
-  }
-};
-var pathHelpers = {
-  join(...paths) {
-    if (isDeno2) {
-      return paths.join("/").replace(/\/+/g, "/");
-    }
-    return paths.join("/").replace(/\/+/g, "/");
-  },
-  relative(from, to) {
-    const fromParts = from.split("/").filter((p) => p);
-    const toParts = to.split("/").filter((p) => p);
-    let i = 0;
-    while (i < fromParts.length && i < toParts.length && fromParts[i] === toParts[i]) {
-      i++;
-    }
-    const upCount = fromParts.length - i;
-    const relativeParts = [...Array(upCount).fill(".."), ...toParts.slice(i)];
-    return relativeParts.join("/");
-  }
-};
 var McpServer = class {
   static {
     __name(this, "McpServer");
@@ -489,6 +441,13 @@ var McpServer = class {
   buildId;
   sessions = /* @__PURE__ */ new Map();
   idleCleanupInterval;
+  oauthProvider;
+  // OAuthProvider from oauth/index.js
+  oauthMiddleware;
+  // Bearer auth middleware
+  oauthConfig;
+  // Store OAuth config for lazy initialization
+  oauthSetupComplete = false;
   /**
    * Creates a new MCP server instance with Hono integration
    *
@@ -527,6 +486,9 @@ var McpServer = class {
       })
     );
     this.app.use("*", requestLogger);
+    if (config.oauth) {
+      this.oauthConfig = config.oauth;
+    }
     return new Proxy(this, {
       get(target, prop) {
         if (prop === "use") {
@@ -586,7 +548,7 @@ var McpServer = class {
     if (this.serverBaseUrl) {
       return this.serverBaseUrl;
     }
-    const mcpUrl = getEnv2("MCP_URL");
+    const mcpUrl = getEnv("MCP_URL");
     if (mcpUrl) {
       return mcpUrl;
     }
@@ -598,7 +560,7 @@ var McpServer = class {
    * @returns Array of URLs to add to CSP resource_domains
    */
   getCSPUrls() {
-    const cspUrlsEnv = getEnv2("CSP_URLS");
+    const cspUrlsEnv = getEnv("CSP_URLS");
     if (!cspUrlsEnv) {
       console.log("[CSP] No CSP_URLS environment variable found");
       return [];
@@ -607,6 +569,42 @@ var McpServer = class {
     console.log("[CSP] Parsed CSP URLs:", urls);
     return urls;
   }
+  /**
+   * Setup OAuth authentication
+   *
+   * Initializes OAuth provider, creates bearer auth middleware,
+   * sets up OAuth routes, and applies auth to /mcp endpoints.
+   *
+   * @private
+   */
+  async setupOAuth(oauthProvider) {
+    if (this.oauthSetupComplete) {
+      return;
+    }
+    const { setupOAuthRoutes, createBearerAuthMiddleware } = await import("../../oauth-U4NNKN4B.js");
+    this.oauthProvider = oauthProvider;
+    console.log(`[OAuth] OAuth provider initialized`);
+    const baseUrl = this.getServerBaseUrl();
+    this.oauthMiddleware = createBearerAuthMiddleware(
+      this.oauthProvider,
+      baseUrl
+    );
+    setupOAuthRoutes(this.app, this.oauthProvider, baseUrl);
+    const mode = this.oauthProvider.getMode?.() || "proxy";
+    if (mode === "direct") {
+      console.log(
+        "[OAuth] Direct mode: Clients will authenticate with provider directly"
+      );
+      console.log("[OAuth] Metadata endpoints: /.well-known/*");
+    } else {
+      console.log(
+        "[OAuth] Proxy mode: Routes at /authorize, /token, /.well-known/*"
+      );
+    }
+    this.app.use("/mcp/*", this.oauthMiddleware);
+    console.log("[OAuth] Bearer authentication enabled on /mcp routes");
+    this.oauthSetupComplete = true;
+  }
   /**
    * Define a static resource that can be accessed by clients
    *
@@ -733,46 +731,22 @@ var McpServer = class {
     this.registeredResources.push(resourceTemplateDefinition.name);
     return this;
   }
-  /**
-   * Define a tool that can be called by clients
-   *
-   * Registers a tool with the MCP server that clients can invoke with parameters.
-   * Tools are functions that perform actions, computations, or operations and
-   * return results. They accept structured input parameters and return structured output.
-   *
-   * Supports Apps SDK metadata for ChatGPT integration via the _meta field.
-   *
-   * @param toolDefinition - Configuration object containing tool metadata and handler function
-   * @param toolDefinition.name - Unique identifier for the tool
-   * @param toolDefinition.description - Human-readable description of what the tool does
-   * @param toolDefinition.inputs - Array of input parameter definitions with types and validation
-   * @param toolDefinition.cb - Async callback function that executes the tool logic with provided parameters
-   * @param toolDefinition._meta - Optional metadata for the tool (e.g. Apps SDK metadata)
-   * @returns The server instance for method chaining
-   *
-   * @example
-   * ```typescript
-   * server.tool({
-   *   name: 'calculate',
-   *   description: 'Performs mathematical calculations',
-   *   inputs: [
-   *     { name: 'expression', type: 'string', required: true },
-   *     { name: 'precision', type: 'number', required: false }
-   *   ],
-   *   cb: async ({ expression, precision = 2 }) => {
-   *     const result = eval(expression)
-   *     return { result: Number(result.toFixed(precision)) }
-   *   },
-   *   _meta: {
-   *     'openai/outputTemplate': 'ui://widgets/calculator',
-   *     'openai/toolInvocation/invoking': 'Calculating...',
-   *     'openai/toolInvocation/invoked': 'Calculation complete'
-   *   }
-   * })
-   * ```
-   */
-  tool(toolDefinition) {
-    const inputSchema = this.createParamsSchema(toolDefinition.inputs || []);
+  // Implementation
+  tool(toolDefinition, callback) {
+    const actualCallback = callback || toolDefinition.cb;
+    if (!actualCallback) {
+      throw new Error(
+        `Tool '${toolDefinition.name}' must have either a cb property or a callback parameter`
+      );
+    }
+    let inputSchema;
+    if (toolDefinition.schema) {
+      inputSchema = this.convertZodSchemaToParams(toolDefinition.schema);
+    } else if (toolDefinition.inputs && toolDefinition.inputs.length > 0) {
+      inputSchema = this.createParamsSchema(toolDefinition.inputs);
+    } else {
+      inputSchema = {};
+    }
     this.server.registerTool(
       toolDefinition.name,
       {
@@ -783,101 +757,95 @@ var McpServer = class {
         _meta: toolDefinition._meta
       },
       async (params, extra) => {
+        let requestContext = getRequestContext();
+        if (!requestContext) {
+          for (const [, session] of this.sessions.entries()) {
+            if (session.context) {
+              requestContext = session.context;
+              break;
+            }
+          }
+        }
         const progressToken = extra?._meta?.progressToken;
-        const context = {
-          /**
-           * Request sampling from the client's LLM with automatic progress notifications.
-           *
-           * Progress notifications are sent every 5 seconds (configurable) while waiting
-           * for the sampling response. This prevents client-side timeouts when
-           * resetTimeoutOnProgress is enabled.
-           *
-           * @param params - Sampling parameters (messages, model preferences, etc.)
-           * @param options - Optional configuration
-           * @param options.timeout - Timeout in milliseconds (default: no timeout / Infinity)
-           * @param options.progressIntervalMs - Interval between progress notifications (default: 5000ms)
-           * @param options.onProgress - Optional callback called each time progress is reported
-           * @returns The sampling result from the client's LLM
-           */
-          sample: /* @__PURE__ */ __name(async (sampleParams, options) => {
-            const {
-              timeout,
-              progressIntervalMs = 5e3,
-              onProgress
-            } = options ?? {};
-            let progressCount = 0;
-            let completed = false;
-            let progressInterval = null;
-            if (progressToken && extra?.sendNotification) {
-              progressInterval = setInterval(async () => {
-                if (completed) return;
-                progressCount++;
-                const progressData = {
-                  progress: progressCount,
-                  total: void 0,
-                  message: `Waiting for LLM response... (${progressCount * Math.round(progressIntervalMs / 1e3)}s elapsed)`
-                };
-                if (onProgress) {
-                  try {
-                    onProgress(progressData);
-                  } catch {
-                  }
-                }
+        const enhancedContext = requestContext ? Object.create(requestContext) : {};
+        enhancedContext.sample = async (sampleParams, options) => {
+          const {
+            timeout,
+            progressIntervalMs = 5e3,
+            onProgress
+          } = options ?? {};
+          let progressCount = 0;
+          let completed = false;
+          let progressInterval = null;
+          if (progressToken && extra?.sendNotification) {
+            progressInterval = setInterval(async () => {
+              if (completed) return;
+              progressCount++;
+              const progressData = {
+                progress: progressCount,
+                total: void 0,
+                message: `Waiting for LLM response... (${progressCount * Math.round(progressIntervalMs / 1e3)}s elapsed)`
+              };
+              if (onProgress) {
                 try {
-                  await extra.sendNotification({
-                    method: "notifications/progress",
-                    params: {
-                      progressToken,
-                      progress: progressData.progress,
-                      total: progressData.total,
-                      message: progressData.message
-                    }
-                  });
+                  onProgress(progressData);
                 } catch {
                 }
-              }, progressIntervalMs);
-            }
-            try {
-              const samplePromise = this.createMessage(sampleParams);
-              if (timeout && timeout !== Infinity) {
-                const timeoutPromise = new Promise((_, reject) => {
-                  setTimeout(
-                    () => reject(
-                      new Error(`Sampling timed out after ${timeout}ms`)
-                    ),
-                    timeout
-                  );
-                });
-                return await Promise.race([samplePromise, timeoutPromise]);
               }
-              return await samplePromise;
-            } finally {
-              completed = true;
-              if (progressInterval) {
-                clearInterval(progressInterval);
+              try {
+                await extra.sendNotification({
+                  method: "notifications/progress",
+                  params: {
+                    progressToken,
+                    progress: progressData.progress,
+                    total: progressData.total,
+                    message: progressData.message
+                  }
+                });
+              } catch {
               }
+            }, progressIntervalMs);
+          }
+          try {
+            const samplePromise = this.createMessage(sampleParams);
+            if (timeout && timeout !== Infinity) {
+              const timeoutPromise = new Promise((_, reject) => {
+                setTimeout(
+                  () => reject(new Error(`Sampling timed out after ${timeout}ms`)),
+                  timeout
+                );
+              });
+              return await Promise.race([samplePromise, timeoutPromise]);
             }
-          }, "sample"),
-          /**
-           * Send a progress notification to the client.
-           * Only works if the client requested progress updates for this tool call.
-           */
-          reportProgress: progressToken && extra?.sendNotification ? async (progress, total, message) => {
-            await extra.sendNotification({
-              method: "notifications/progress",
-              params: {
-                progressToken,
-                progress,
-                total,
-                message
-              }
-            });
-          } : void 0
+            return await samplePromise;
+          } finally {
+            completed = true;
+            if (progressInterval) {
+              clearInterval(progressInterval);
+            }
+          }
         };
-        if (toolDefinition.cb.length >= 2) {
-          return await toolDefinition.cb(params, context);
+        enhancedContext.reportProgress = progressToken && extra?.sendNotification ? async (progress, total, message) => {
+          await extra.sendNotification({
+            method: "notifications/progress",
+            params: {
+              progressToken,
+              progress,
+              total,
+              message
+            }
+          });
+        } : void 0;
+        const executeCallback = /* @__PURE__ */ __name(async () => {
+          if (actualCallback.length >= 2) {
+            return await actualCallback(params, enhancedContext);
+          }
+          return await actualCallback(params);
+        }, "executeCallback");
+        if (requestContext) {
+          return await runWithContext(requestContext, executeCallback);
         }
-        return await toolDefinition.cb(params);
+        return await executeCallback();
       }
     );
     this.registeredTools.push(toolDefinition.name);
@@ -925,6 +893,7 @@ var McpServer = class {
         title: promptDefinition.title,
         description: promptDefinition.description ?? "",
         argsSchema
+        // Type assertion for Zod v4 compatibility
       },
       async (params) => {
         return await promptDefinition.cb(params);
@@ -1228,35 +1197,6 @@ var McpServer = class {
     }
     return `ui://widget/${parts.join("-")}${extension}`;
   }
-  /**
-   * Build a complete URL for a widget including query parameters
-   *
-   * Constructs the full URL to access a widget's iframe, encoding any provided
-   * parameters as query string parameters. Complex objects are JSON-stringified
-   * for transmission.
-   *
-   * @private
-   * @param widget - Widget name/identifier
-   * @param params - Parameters to encode in the URL
-   * @returns Complete URL with encoded parameters
-   */
-  buildWidgetUrl(widget, params) {
-    const baseUrl = `http://${this.serverHost}:${this.serverPort}/mcp-use/widgets/${widget}`;
-    if (Object.keys(params).length === 0) {
-      return baseUrl;
-    }
-    const queryParams = new URLSearchParams();
-    for (const [key, value] of Object.entries(params)) {
-      if (value !== void 0 && value !== null) {
-        if (typeof value === "object") {
-          queryParams.append(key, JSON.stringify(value));
-        } else {
-          queryParams.append(key, String(value));
-        }
-      }
-    }
-    return `${baseUrl}?${queryParams.toString()}`;
-  }
   /**
    * Convert widget props definition to tool input schema
    *
@@ -1304,7 +1244,7 @@ var McpServer = class {
    * @returns true if in production mode, false otherwise
    */
   isProductionMode() {
-    return getEnv2("NODE_ENV") === "production";
+    return getEnv("NODE_ENV") === "production";
   }
   /**
    * Read build manifest file
@@ -1315,7 +1255,7 @@ var McpServer = class {
   async readBuildManifest() {
     try {
       const manifestPath = pathHelpers.join(
-        isDeno2 ? "." : getCwd(),
+        isDeno ? "." : getCwd(),
         "dist",
         "mcp-use.json"
       );
@@ -1337,7 +1277,7 @@ var McpServer = class {
    * @returns Promise that resolves when all widgets are mounted
    */
   async mountWidgets(options) {
-    if (this.isProductionMode() || isDeno2) {
+    if (this.isProductionMode() || isDeno) {
       console.log("[WIDGETS] Mounting widgets in production mode");
       await this.mountWidgetsProduction(options);
     } else {
@@ -1365,7 +1305,7 @@ var McpServer = class {
     const srcDir = pathHelpers.join(getCwd(), resourcesDir);
     try {
       await fs.access(srcDir);
-    } catch (error) {
+    } catch (error2) {
       console.log(
         `[WIDGETS] No ${resourcesDir}/ directory found - skipping widget serving`
       );
@@ -1399,7 +1339,7 @@ var McpServer = class {
           }
         }
       }
-    } catch (error) {
+    } catch (error2) {
       console.log(`[WIDGETS] No widgets found in ${resourcesDir}/ directory`);
       return;
     }
@@ -1424,14 +1364,10 @@ var McpServer = class {
         'return import("@tailwindcss/vite")'
       )();
       tailwindcss = tailwindModule.default;
-    } catch (error) {
-      console.error(
-        "[WIDGETS] Dev dependencies not available. Install vite, @vitejs/plugin-react, and @tailwindcss/vite for widget development."
-      );
-      console.error(
-        "[WIDGETS] For production, use 'mcp-use build' to pre-build widgets."
+    } catch (error2) {
+      throw new Error(
+        "\u274C Widget dependencies not installed!\n\nTo use MCP widgets with resources folder, you need to install the required dependencies:\n\n  npm install vite @vitejs/plugin-react @tailwindcss/vite\n  # or\n  pnpm add vite @vitejs/plugin-react @tailwindcss/vite\n\nThese dependencies are automatically included in projects created with 'create-mcp-use-app'.\nFor production, pre-build your widgets using 'mcp-use build'."
       );
-      return;
     }
     const widgets = entries.map((entry) => {
       return {
@@ -1440,8 +1376,8 @@ var McpServer = class {
         entry: entry.path
       };
     });
-    for (const widget of widgets) {
-      const widgetTempDir = pathHelpers.join(tempDir, widget.name);
+    for (const widget2 of widgets) {
+      const widgetTempDir = pathHelpers.join(tempDir, widget2.name);
       await fs.mkdir(widgetTempDir, { recursive: true });
       const resourcesPath = pathHelpers.join(getCwd(), resourcesDir);
       const relativeResourcesPath = pathHelpers.relative(widgetTempDir, resourcesPath).replace(/\\/g, "/");
@@ -1458,7 +1394,7 @@ var McpServer = class {
       const entryContent = `import React from 'react'
 import { createRoot } from 'react-dom/client'
 import './styles.css'
-import Component from '${widget.entry}'
+import Component from '${widget2.entry}'
 
 const container = document.getElementById('widget-root')
 if (container && Component) {
@@ -1471,11 +1407,11 @@ if (container && Component) {
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width,initial-scale=1" />
-    <title>${widget.name} Widget</title>
+    <title>${widget2.name} Widget</title>
   </head>
   <body>
     <div id="widget-root"></div>
-    <script type="module" src="${baseRoute}/${widget.name}/entry.tsx"></script>
+    <script type="module" src="${baseRoute}/${widget2.name}/entry.tsx"></script>
   </body>
 </html>`;
       await fs.writeFile(
@@ -1565,8 +1501,8 @@ if (container && Component) {
       const widgetMatch = pathname.replace(baseRoute, "").match(/^\/([^/]+)/);
       if (widgetMatch) {
         const widgetName = widgetMatch[1];
-        const widget = widgets.find((w) => w.name === widgetName);
-        if (widget) {
+        const widget2 = widgets.find((w) => w.name === widgetName);
+        if (widget2) {
           const relativePath = pathname.replace(baseRoute, "");
           if (relativePath === `/${widgetName}` || relativePath === `/${widgetName}/`) {
             const newUrl = new URL(c.req.url);
@@ -1617,42 +1553,42 @@ if (container && Component) {
       const message = isAsset ? "Widget asset not found" : "Widget not found";
       return c.text(message, 404);
     });
-    widgets.forEach((widget) => {
+    widgets.forEach((widget2) => {
       console.log(
-        `[WIDGET] ${widget.name} mounted at ${baseRoute}/${widget.name}`
+        `[WIDGET] ${widget2.name} mounted at ${baseRoute}/${widget2.name}`
       );
     });
-    for (const widget of widgets) {
+    for (const widget2 of widgets) {
       const type = "appsSdk";
       let metadata = {};
       let props = {};
-      let description = widget.description;
+      let description = widget2.description;
       try {
-        const mod = await viteServer.ssrLoadModule(widget.entry);
+        const mod = await viteServer.ssrLoadModule(widget2.entry);
         if (mod.widgetMetadata) {
           metadata = mod.widgetMetadata;
-          description = metadata.description || widget.description;
+          description = metadata.description || widget2.description;
           if (metadata.inputs) {
             try {
               props = metadata.inputs.shape || {};
-            } catch (error) {
+            } catch (error2) {
               console.warn(
-                `[WIDGET] Failed to extract props schema for ${widget.name}:`,
-                error
+                `[WIDGET] Failed to extract props schema for ${widget2.name}:`,
+                error2
               );
             }
           }
         }
-      } catch (error) {
+      } catch (error2) {
         console.warn(
-          `[WIDGET] Failed to load metadata for ${widget.name}:`,
-          error
+          `[WIDGET] Failed to load metadata for ${widget2.name}:`,
+          error2
         );
       }
       let html = "";
       try {
         html = await fsHelpers.readFileSync(
-          pathHelpers.join(tempDir, widget.name, "index.html"),
+          pathHelpers.join(tempDir, widget2.name, "index.html"),
           "utf8"
         );
         const mcpUrl = this.getServerBaseUrl();
@@ -1690,25 +1626,25 @@ if (container && Component) {
         html = html.replace(
           /<head[^>]*>/i,
           `<head>
-    <script>window.__getFile = (filename) => { return "${baseUrl}/mcp-use/widgets/${widget.name}/"+filename }; window.__mcpPublicUrl = "${baseUrl}/mcp-use/public";</script>`
+    <script>window.__getFile = (filename) => { return "${baseUrl}/mcp-use/widgets/${widget2.name}/"+filename }; window.__mcpPublicUrl = "${baseUrl}/mcp-use/public";</script>`
         );
-      } catch (error) {
+      } catch (error2) {
         console.error(
-          `Failed to read html template for widget ${widget.name}`,
-          error
+          `Failed to read html template for widget ${widget2.name}`,
+          error2
         );
       }
       const mcp_connect_domain = this.getServerBaseUrl() ? new URL(this.getServerBaseUrl() || "").origin : null;
       this.uiResource({
-        name: widget.name,
-        title: metadata.title || widget.name,
+        name: widget2.name,
+        title: metadata.title || widget2.name,
         description,
         type,
         props,
         _meta: {
           "mcp-use/widget": {
-            name: widget.name,
-            title: metadata.title || widget.name,
+            name: widget2.name,
+            title: metadata.title || widget2.name,
             description,
             type,
             props,
@@ -1720,8 +1656,8 @@ if (container && Component) {
         htmlTemplate: html,
         appsSdkMetadata: {
           "openai/widgetDescription": description,
-          "openai/toolInvocation/invoking": `Loading ${widget.name}...`,
-          "openai/toolInvocation/invoked": `${widget.name} ready`,
+          "openai/toolInvocation/invoking": `Loading ${widget2.name}...`,
+          "openai/toolInvocation/invoked": `${widget2.name} ready`,
           "openai/widgetAccessible": true,
           "openai/resultCanProduceWidget": true,
           ...metadata.appsSdkMetadata || {},
@@ -1760,7 +1696,7 @@ if (container && Component) {
   async mountWidgetsProduction(options) {
     const baseRoute = options?.baseRoute || "/mcp-use/widgets";
     const widgetsDir = pathHelpers.join(
-      isDeno2 ? "." : getCwd(),
+      isDeno ? "." : getCwd(),
       "dist",
       "resources",
       "widgets"
@@ -1794,10 +1730,10 @@ if (container && Component) {
       } else {
         console.log("[WIDGETS] No widgets found in manifest");
       }
-    } catch (error) {
+    } catch (error2) {
       console.log(
         "[WIDGETS] Could not read manifest file, falling back to directory listing:",
-        error
+        error2
       );
       try {
         const allEntries = await fsHelpers.readdirSync(widgetsDir);
@@ -1862,10 +1798,10 @@ if (container && Component) {
     <script>window.__getFile = (filename) => { return "${baseUrl}/mcp-use/widgets/${widgetName}/"+filename }; window.__mcpPublicUrl = "${baseUrl}/mcp-use/public";</script>`
           );
         }
-      } catch (error) {
+      } catch (error2) {
         console.error(
           `[WIDGET] Failed to read ${widgetName}/index.html:`,
-          error
+          error2
         );
         continue;
       }
@@ -1992,7 +1928,7 @@ if (container && Component) {
       if (closeOldSessionId && this.sessions.has(closeOldSessionId)) {
         try {
           this.sessions.get(closeOldSessionId).transport.close();
-        } catch (error) {
+        } catch (error2) {
         }
         this.sessions.delete(closeOldSessionId);
       }
@@ -2123,7 +2059,7 @@ if (container && Component) {
           if (now - session.lastAccessedAt > idleTimeoutMs) {
             try {
               session.transport.close();
-            } catch (error) {
+            } catch (error2) {
             }
             this.sessions.delete(sessionId);
           }
@@ -2221,7 +2157,7 @@ if (container && Component) {
         getResponse: /* @__PURE__ */ __name(() => {
           if (ended) {
             if (responseBody.length > 0) {
-              const body = isDeno2 ? Buffer.concat(responseBody) : Buffer.concat(responseBody);
+              const body = isDeno ? Buffer.concat(responseBody) : Buffer.concat(responseBody);
               return new Response(body, {
                 status: statusCode,
                 headers
@@ -2279,19 +2215,23 @@ if (container && Component) {
           }
         }
         if (sessionId && this.sessions.has(sessionId)) {
-          this.sessions.get(sessionId).lastAccessedAt = Date.now();
+          const session = this.sessions.get(sessionId);
+          session.lastAccessedAt = Date.now();
+          session.context = c;
         }
         if (expressRes._closeHandler) {
           c.req.raw.signal?.addEventListener("abort", () => {
             transport.close();
           });
         }
-        await this.waitForRequestComplete(
-          transport,
-          expressReq,
-          expressRes,
-          expressReq.body
-        );
+        await runWithContext(c, async () => {
+          await this.waitForRequestComplete(
+            transport,
+            expressReq,
+            expressRes,
+            expressReq.body
+          );
+        });
         const response = getResponse();
         if (response) {
           return response;
@@ -2529,12 +2469,15 @@ if (container && Component) {
     console.log("");
   }
   async listen(port) {
-    const portEnv = getEnv2("PORT");
+    const portEnv = getEnv("PORT");
     this.serverPort = port || (portEnv ? parseInt(portEnv, 10) : 3001);
-    const hostEnv = getEnv2("HOST");
+    const hostEnv = getEnv("HOST");
     if (hostEnv) {
       this.serverHost = hostEnv;
     }
+    if (this.oauthConfig && !this.oauthSetupComplete) {
+      await this.setupOAuth(this.oauthConfig);
+    }
     await this.mountWidgets({
       baseRoute: "/mcp-use/widgets",
       resourcesDir: "resources"
@@ -2542,7 +2485,7 @@ if (container && Component) {
     await this.mountMcp();
     await this.mountInspector();
     this.logRegisteredItems();
-    if (isDeno2) {
+    if (isDeno) {
       const corsHeaders = {
         "Access-Control-Allow-Origin": "*",
         "Access-Control-Allow-Headers": "authorization, x-client-info, apikey, content-type"
@@ -2643,6 +2586,9 @@ if (container && Component) {
    * ```
    */
   async getHandler(options) {
+    if (this.oauthConfig && !this.oauthSetupComplete) {
+      await this.setupOAuth(this.oauthConfig);
+    }
     console.log("[MCP] Mounting widgets");
     await this.mountWidgets({
       baseRoute: "/mcp-use/widgets",
@@ -2746,10 +2692,10 @@ if (container && Component) {
     for (const [sessionId, session] of this.sessions.entries()) {
       try {
         await session.transport.send(notification);
-      } catch (error) {
+      } catch (error2) {
         console.warn(
           `[MCP] Failed to send notification to session ${sessionId}:`,
-          error
+          error2
         );
       }
     }
@@ -2794,10 +2740,10 @@ if (container && Component) {
     try {
       await session.transport.send(notification);
       return true;
-    } catch (error) {
+    } catch (error2) {
       console.warn(
         `[MCP] Failed to send notification to session ${sessionId}:`,
-        error
+        error2
       );
       return false;
     }
@@ -2865,10 +2811,10 @@ if (container && Component) {
         return response.roots;
       }
       return [];
-    } catch (error) {
+    } catch (error2) {
       console.warn(
         `[MCP] Failed to list roots from session ${sessionId}:`,
-        error
+        error2
       );
       return null;
     }
@@ -2946,14 +2892,14 @@ if (container && Component) {
    */
   setupWidgetRoutes() {
     this.app.get("/mcp-use/widgets/:widget/assets/*", async (c) => {
-      const widget = c.req.param("widget");
+      const widget2 = c.req.param("widget");
       const assetFile = c.req.path.split("/assets/")[1];
       const assetPath = pathHelpers.join(
         getCwd(),
         "dist",
         "resources",
         "widgets",
-        widget,
+        widget2,
         "assets",
         assetFile
       );
@@ -2982,10 +2928,10 @@ if (container && Component) {
       );
       try {
         const widgets = await fsHelpers.readdirSync(widgetsDir);
-        for (const widget of widgets) {
+        for (const widget2 of widgets) {
           const assetPath = pathHelpers.join(
             widgetsDir,
-            widget,
+            widget2,
             "assets",
             assetFile
           );
@@ -3005,13 +2951,13 @@ if (container && Component) {
       }
     });
     this.app.get("/mcp-use/widgets/:widget", async (c) => {
-      const widget = c.req.param("widget");
+      const widget2 = c.req.param("widget");
       const filePath = pathHelpers.join(
         getCwd(),
         "dist",
         "resources",
         "widgets",
-        widget,
+        widget2,
         "index.html"
       );
       try {
@@ -3028,7 +2974,7 @@ if (container && Component) {
         html = html.replace(
           /<head[^>]*>/i,
           `<head>
-    <script>window.__getFile = (filename) => { return "${baseUrl}/mcp-use/widgets/${widget}/"+filename }</script>`
+    <script>window.__getFile = (filename) => { return "${baseUrl}/mcp-use/widgets/${widget2}/"+filename }</script>`
         );
         return c.html(html);
       } catch {
@@ -3055,28 +3001,21 @@ if (container && Component) {
     });
   }
   /**
-   * Create input schema for resource templates
+   * Convert a Zod object schema to the internal Record<string, z.ZodSchema> format
    *
-   * Parses a URI template string to extract parameter names and generates a Zod
-   * validation schema for those parameters. Used internally for validating resource
-   * template parameters before processing requests.
-   *
-   * @param uriTemplate - URI template string with parameter placeholders (e.g., "/users/{id}/posts/{postId}")
-   * @returns Object mapping parameter names to Zod string schemas
-   *
-   * @example
-   * ```typescript
-   * const schema = this.createInputSchema("/users/{id}/posts/{postId}")
-   * // Returns: { id: z.string(), postId: z.string() }
-   * ```
+   * @param zodSchema - Zod object schema to convert
+   * @returns Object mapping parameter names to Zod validation schemas
    */
-  createInputSchema(uriTemplate) {
-    const params = this.extractTemplateParams(uriTemplate);
-    const schema = {};
-    params.forEach((param) => {
-      schema[param] = z.string();
-    });
-    return schema;
+  convertZodSchemaToParams(zodSchema) {
+    if (!(zodSchema instanceof z.ZodObject)) {
+      throw new Error("schema must be a Zod object schema (z.object({...}))");
+    }
+    const shape = zodSchema.shape;
+    const params = {};
+    for (const [key, value] of Object.entries(shape)) {
+      params[key] = value;
+    }
+    return params;
   }
   /**
    * Create input schema for tools
@@ -3130,75 +3069,6 @@ if (container && Component) {
     });
     return schema;
   }
-  /**
-   * Create arguments schema for prompts
-   *
-   * Converts prompt argument definitions into Zod validation schemas for runtime validation.
-   * Supports common data types (string, number, boolean, object, array) and optional
-   * parameters. Used internally when registering prompt templates with the MCP server.
-   *
-   * @param inputs - Array of argument definitions with name, type, and optional flag
-   * @returns Object mapping argument names to Zod validation schemas
-   *
-   * @example
-   * ```typescript
-   * const schema = this.createPromptArgsSchema([
-   *   { name: 'topic', type: 'string', required: true },
-   *   { name: 'style', type: 'string', required: false }
-   * ])
-   * // Returns: { topic: z.string(), style: z.string().optional() }
-   * ```
-   */
-  createPromptArgsSchema(inputs) {
-    const schema = {};
-    inputs.forEach((input) => {
-      let zodType;
-      switch (input.type) {
-        case "string":
-          zodType = z.string();
-          break;
-        case "number":
-          zodType = z.number();
-          break;
-        case "boolean":
-          zodType = z.boolean();
-          break;
-        case "object":
-          zodType = z.object({});
-          break;
-        case "array":
-          zodType = z.array(z.any());
-          break;
-        default:
-          zodType = z.any();
-      }
-      if (!input.required) {
-        zodType = zodType.optional();
-      }
-      schema[input.name] = zodType;
-    });
-    return schema;
-  }
-  /**
-   * Extract parameter names from URI template
-   *
-   * Parses a URI template string to extract parameter names enclosed in curly braces.
-   * Used internally to identify dynamic parameters in resource templates and generate
-   * appropriate validation schemas.
-   *
-   * @param uriTemplate - URI template string with parameter placeholders (e.g., "/users/{id}/posts/{postId}")
-   * @returns Array of parameter names found in the template
-   *
-   * @example
-   * ```typescript
-   * const params = this.extractTemplateParams("/users/{id}/posts/{postId}")
-   * // Returns: ["id", "postId"]
-   * ```
-   */
-  extractTemplateParams(uriTemplate) {
-    const matches = uriTemplate.match(/\{([^}]+)\}/g);
-    return matches ? matches.map((match) => match.slice(1, -1)) : [];
-  }
   /**
    * Parse parameter values from a URI based on a template
    *
@@ -3241,19 +3111,155 @@ function createMCPServer(name, config = {}) {
     host: config.host,
     baseUrl: config.baseUrl,
     allowedOrigins: config.allowedOrigins,
-    sessionIdleTimeoutMs: config.sessionIdleTimeoutMs
+    sessionIdleTimeoutMs: config.sessionIdleTimeoutMs,
+    autoCreateSessionOnInvalidId: config.autoCreateSessionOnInvalidId,
+    oauth: config.oauth
   });
   return instance;
 }
 __name(createMCPServer, "createMCPServer");
+
+// src/server/utils/response-helpers.ts
+function text(content) {
+  return {
+    content: [
+      {
+        type: "text",
+        text: content
+      }
+    ]
+  };
+}
+__name(text, "text");
+function image(data, mimeType = "image/png") {
+  return {
+    content: [
+      {
+        type: "image",
+        data,
+        mimeType
+      }
+    ]
+  };
+}
+__name(image, "image");
+function resource(uri, mimeType, text2) {
+  const resourceContent = {
+    type: "resource",
+    resource: {
+      uri,
+      ...mimeType && { mimeType },
+      ...text2 && { text: text2 }
+    }
+  };
+  return {
+    content: [resourceContent]
+  };
+}
+__name(resource, "resource");
+function error(message) {
+  return {
+    isError: true,
+    content: [
+      {
+        type: "text",
+        text: message
+      }
+    ]
+  };
+}
+__name(error, "error");
+function object(data) {
+  return Array.isArray(data) ? array(data) : {
+    content: [
+      {
+        type: "text",
+        text: JSON.stringify(data, null, 2)
+      }
+    ],
+    structuredContent: data
+  };
+}
+__name(object, "object");
+function array(data) {
+  return {
+    content: [
+      {
+        type: "text",
+        text: JSON.stringify(data, null, 2)
+      }
+    ],
+    structuredContent: { data }
+  };
+}
+__name(array, "array");
+function widget(config) {
+  const {
+    name,
+    data,
+    message,
+    invoking,
+    invoked,
+    widgetAccessible = true,
+    resultCanProduceWidget = true,
+    buildId
+  } = config;
+  const randomId = Math.random().toString(36).substring(2, 15);
+  const buildIdPart = buildId ? `-${buildId}` : "";
+  const uniqueUri = `ui://widget/${name}${buildIdPart}-${randomId}.html`;
+  const metadata = {
+    "openai/outputTemplate": uniqueUri,
+    "openai/widgetAccessible": widgetAccessible,
+    "openai/resultCanProduceWidget": resultCanProduceWidget
+  };
+  if (invoking) {
+    metadata["openai/toolInvocation/invoking"] = invoking;
+  }
+  if (invoked) {
+    metadata["openai/toolInvocation/invoked"] = invoked;
+  }
+  const displayMessage = message || `Displaying ${name}`;
+  return {
+    _meta: metadata,
+    content: [
+      {
+        type: "text",
+        text: displayMessage
+      }
+    ],
+    // structuredContent will be injected as window.openai.toolOutput by Apps SDK
+    structuredContent: data
+  };
+}
+__name(widget, "widget");
 export {
   adaptConnectMiddleware,
   adaptMiddleware,
+  array,
   buildWidgetUrl,
   createExternalUrlResource,
   createMCPServer,
   createRawHtmlResource,
   createRemoteDomResource,
   createUIResourceFromDefinition,
-  isExpressMiddleware
+  error,
+  getAuth,
+  getRequestContext,
+  hasAnyScope,
+  hasRequestContext,
+  hasScope,
+  image,
+  isExpressMiddleware,
+  oauthAuth0Provider,
+  oauthCustomProvider,
+  oauthKeycloakProvider,
+  oauthSupabaseProvider,
+  oauthWorkOSProvider,
+  object,
+  requireAnyScope,
+  requireScope,
+  resource,
+  runWithContext,
+  text,
+  widget
 };