mcp-use 2.0.0-beta.5 → 2.0.0-beta.6

package/dist/resources.d.ts

@@ -1,4 +1,4 @@
-import type { ReadResourceResult } from "@modelcontextprotocol/server";
+import type { Annotations, MetaObject, ReadResourceResult } from "@modelcontextprotocol/server";
 import type { RequestContext } from "./context.js";
 /** Declares a static resource at a fixed URI. First argument to {@link MCPServer.resource}. */
 export interface ResourceDefinition {
@@ -15,6 +15,16 @@ export interface ResourceDefinition {
      * own `mimeType` on the wire — set it in the callback's result.
      */
     mimeType?: string;
+    /** Standard MCP hints describing the resource's audience and presentation. */
+    annotations?: Annotations;
+    /**
+     * Extension metadata advertised on this resource's `resources/list`
+     * descriptor. Use vendor-namespaced keys for custom data.
+     *
+     * This value is not copied into `resources/read` content entries; content
+     * metadata must be returned by the callback on each entry's own `_meta`.
+     */
+    _meta?: MetaObject;
 }
 /**
  * Resource read callback. Returns the SDK's raw {@link ReadResourceResult};
@@ -40,6 +50,17 @@ export interface ResourceTemplateDefinition {
     description?: string;
     /** MIME type of the content. */
     mimeType?: string;
+    /** Standard MCP hints describing resources produced by this template. */
+    annotations?: Annotations;
+    /**
+     * Extension metadata advertised on this template's
+     * `resources/templates/list` descriptor. Use vendor-namespaced keys for
+     * custom data.
+     *
+     * This value is not copied into `resources/read` content entries; content
+     * metadata must be returned by the callback on each entry's own `_meta`.
+     */
+    _meta?: MetaObject;
 }
 /** Strip a leading RFC 6570 operator (`+`, `#`, `.`, `/`, `;`, `?`, `&`) from a template expression. */
 type StripOperator<E extends string> = E extends `${"+" | "#" | "." | "/" | ";" | "?" | "&"}${infer Rest}` ? Rest : E;

package/dist/resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../src/resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,CAC1B,KAAK,GAAG,KAAK,EACb,QAAQ,SAAS,OAAO,GAAG,KAAK,IAC9B,CACF,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,KACjC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEtD,uHAAuH;AACvH,MAAM,WAAW,0BAA0B;IACzC,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gCAAgC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wGAAwG;AACxG,KAAK,aAAa,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,GAC7C,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,GAAG,MAAM,IAAI,EAAE,GAClB,IAAI,GACJ,CAAC,CAAC;AAEN,0FAA0F;AAC1F,KAAK,aAAa,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,GAAG,GAC7D,IAAI,GACJ,CAAC,SAAS,GAAG,MAAM,IAAI,IAAI,MAAM,EAAE,GACjC,IAAI,GACJ,CAAC,CAAC;AAER,uFAAuF;AACvF,KAAK,cAAc,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,IAAI,MAAM,IAAI,EAAE,GAC3E,aAAa,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,GAC1C,aAAa,CAAC,CAAC,CAAC,CAAC;AAErB,sGAAsG;AACtG,KAAK,wBAAwB,CAAC,CAAC,SAAS,MAAM,IAC5C,CAAC,SAAS,GAAG,MAAM,IAAI,MAAM,IAAI,IAAI,MAAM,IAAI,EAAE,GAC7C,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,GACpE,KAAK,CAAC;AAEZ,uDAAuD;AACvD,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;AAEtD;;;GAGG;AACH,MAAM,MAAM,mBAAmB,CAAC,CAAC,IAAI,CAAC,SAAS;IAC7C,WAAW,EAAE,MAAM,CAAC,SAAS,MAAM,CAAC;CACrC,GACG,MAAM,SAAS,CAAC,GACd,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,GACrC;KAAG,CAAC,IAAI,wBAAwB,CAAC,CAAC,CAAC,GAAG,qBAAqB;CAAE,GAC/D,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;AAE1C,+EAA+E;AAC/E,MAAM,MAAM,wBAAwB,CAClC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAC/C,KAAK,GAAG,KAAK,EACb,QAAQ,SAAS,OAAO,GAAG,KAAK,IAC9B,CACF,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,KACjC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC"}
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../src/resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,kBAAkB,EACnB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,CAC1B,KAAK,GAAG,KAAK,EACb,QAAQ,SAAS,OAAO,GAAG,KAAK,IAC9B,CACF,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,KACjC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEtD,uHAAuH;AACvH,MAAM,WAAW,0BAA0B;IACzC,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gCAAgC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,wGAAwG;AACxG,KAAK,aAAa,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,GAC7C,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,GACH,GAAG,GAAG,MAAM,IAAI,EAAE,GAClB,IAAI,GACJ,CAAC,CAAC;AAEN,0FAA0F;AAC1F,KAAK,aAAa,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,GAAG,GAC7D,IAAI,GACJ,CAAC,SAAS,GAAG,MAAM,IAAI,IAAI,MAAM,EAAE,GACjC,IAAI,GACJ,CAAC,CAAC;AAER,uFAAuF;AACvF,KAAK,cAAc,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,IAAI,MAAM,IAAI,EAAE,GAC3E,aAAa,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,GAC1C,aAAa,CAAC,CAAC,CAAC,CAAC;AAErB,sGAAsG;AACtG,KAAK,wBAAwB,CAAC,CAAC,SAAS,MAAM,IAC5C,CAAC,SAAS,GAAG,MAAM,IAAI,MAAM,IAAI,IAAI,MAAM,IAAI,EAAE,GAC7C,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,GACpE,KAAK,CAAC;AAEZ,uDAAuD;AACvD,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;AAEtD;;;GAGG;AACH,MAAM,MAAM,mBAAmB,CAAC,CAAC,IAAI,CAAC,SAAS;IAC7C,WAAW,EAAE,MAAM,CAAC,SAAS,MAAM,CAAC;CACrC,GACG,MAAM,SAAS,CAAC,GACd,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,GACrC;KAAG,CAAC,IAAI,wBAAwB,CAAC,CAAC,CAAC,GAAG,qBAAqB;CAAE,GAC/D,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;AAE1C,+EAA+E;AAC/E,MAAM,MAAM,wBAAwB,CAClC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAC/C,KAAK,GAAG,KAAK,EACb,QAAQ,SAAS,OAAO,GAAG,KAAK,IAC9B,CACF,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,KACjC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC"}

package/dist/server.d.ts

@@ -1,5 +1,8 @@
 import { type ServerEventBus } from "@modelcontextprotocol/server";
 import { type ServerConfig } from "./config.js";
+import { type FrameworkHandler } from "./fetch-app.js";
+import { type McpCompleteEventListenerFn, type McpEventListenerFn, type McpMiddlewareFnFor } from "./middleware/mcp-middleware.js";
+import type { NodeRequestHandler } from "./node-bridge.js";
 import type { FromOpenAPIOptions } from "./openapi/types.js";
 import type { InferPromptInput, PromptCallback, PromptDefinition } from "./prompts.js";
 import type { InferTemplateParams, ResourceCallback, ResourceDefinition, ResourceTemplateCallback, ResourceTemplateDefinition } from "./resources.js";
@@ -149,7 +152,52 @@ export declare class MCPServer<TUser = never> {
      */
     getHandler(options?: {
         bus?: ServerEventBus;
-    }): (request: Request) => Promise<Response>;
+    }): FrameworkHandler;
+    /**
+     * Node `(req, res) => void` handler for composing with an existing
+     * `http.Server`. Uses the same internal `toNodeHandler` bridge as
+     * {@link MCPServer.listen}; MCPServer users do not need to import
+     * `mcp-use/node`.
+     *
+     * @example
+     * ```ts
+     * import { createServer } from "node:http";
+     * const httpServer = createServer(await server.getNodeHandler());
+     * httpServer.listen(3000);
+     * ```
+     */
+    getNodeHandler(): Promise<NodeRequestHandler>;
+    /**
+     * Register MCP operation middleware that intercepts JSON-RPC dispatch.
+     *
+     * Patterns use an `mcp:` prefix (for example `mcp:tools/call`, `mcp:*`).
+     * Middleware runs in registration order; call `next()` to continue the chain.
+     *
+     * @example
+     * ```ts
+     * server.use("mcp:tools/call", async (ctx, next) => {
+     *   console.log(`Calling tool: ${ctx.params.name}`);
+     *   return next();
+     * });
+     * ```
+     */
+    use<P extends string>(pattern: `mcp:${P}` | P, handler: McpMiddlewareFnFor<P>): this;
+    /**
+     * Register a read-only MCP observer. Unlike {@link MCPServer.use}, listeners
+     * cannot block, override, or mutate params. Throwing is logged and does not
+     * fail the request.
+     *
+     * Append `:complete` to run after the handler (for example
+     * `mcp:tools/call:complete`).
+     *
+     * @example
+     * ```ts
+     * server.on("mcp:tools/call", (ctx) => {
+     *   metrics.increment("tools.call", { tool: ctx.params.name });
+     * });
+     * ```
+     */
+    on<P extends string>(pattern: `mcp:${P}` | P, handler: P extends `${string}:complete` ? McpCompleteEventListenerFn : McpEventListenerFn): this;
     /**
      * Publish a tools-list change to v2 clients with active subscriptions.
      *

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EASL,KAAK,cAAc,EAGpB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAuBpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAY7D,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EACjB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,0BAA0B,EAE3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACb,eAAe,EACf,YAAY,EACZ,cAAc,EACd,OAAO,EAER,MAAM,YAAY,CAAC;AAGpB,OAAO,EAGL,aAAa,EAUb,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAQ1B,KAAK,QAAQ,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;AAmD9D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,SAAS,CAAC,KAAK,GAAG,KAAK;;IAkClC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,SAAS,CAOzD;IAED;;;;;;;OAOG;IACH,YAAY,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,EAetC;IAED;;;;;;OAMG;IACH,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;;;;;;OAOG;IACH,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,cAAc,EACjC,UAAU,EAAE,CAAC,EACb,QAAQ,EAAE,YAAY,CACpB,cAAc,CAAC,CAAC,CAAC,EACjB,eAAe,CAAC,CAAC,CAAC,EAClB,KAAK,EACL,QAAQ,CAAC,KAAK,CAAC,CAChB,GACA,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAelE;IAED;;;;;;;;;;;;OAYG;IACH,CAAC,aAAa,CAAC,CACb,KAAK,EAAE,aAAa,EACpB,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAChD,IAAI,CAeN;IAED;;;;;;;;;;OAUG;IACH,YAAY,CACV,KAAK,EAAE,aAAa,EACpB,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAChD,IAAI,CAEN;IAED,+DAA+D;IAC/D,QAAQ,CACN,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,GACjD,IAAI,CAIN;IAED;;;;;;;;OAQG;IACH,gBAAgB,CAAC,KAAK,CAAC,CAAC,SAAS,0BAA0B,EACzD,UAAU,EAAE,CAAC,EACb,QAAQ,EAAE,wBAAwB,CAChC,mBAAmB,CAAC,CAAC,CAAC,EACtB,KAAK,EACL,QAAQ,CAAC,KAAK,CAAC,CAChB,GACA,IAAI,CAWN;IAED;;;OAGG;IACH,MAAM,CAAC,CAAC,SAAS,gBAAgB,EAC/B,UAAU,EAAE,CAAC,EACb,QAAQ,EAAE,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,GACpE,IAAI,CAWN;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,UAAU,CACR,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,cAAc,CAAA;KAAO,GACrC,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAGzC;IAED;;;;;;;OAOG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAExC;IAED;;;;;;;OAOG;IACG,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAE1C;IAED;;;;;;;OAOG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED;;;;;;;;;OASG;IACG,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtD;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACG,MAAM,CAAC,IAAI,SAAO,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAiEhE;IAED;;;;;;OAMG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAS3B;CAqmBF"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EASL,KAAK,cAAc,EAGpB,MAAM,8BAA8B,CAAC;AAItC,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAMpE,OAAO,EAUL,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAIL,KAAK,0BAA0B,EAE/B,KAAK,kBAAkB,EAGvB,KAAK,kBAAkB,EAExB,MAAM,gCAAgC,CAAC;AAOxC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAY7D,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EACjB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,0BAA0B,EAE3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACb,eAAe,EACf,YAAY,EACZ,cAAc,EACd,OAAO,EAER,MAAM,YAAY,CAAC;AAGpB,OAAO,EAGL,aAAa,EAUb,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAQ1B,KAAK,QAAQ,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;AAmD9D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,SAAS,CAAC,KAAK,GAAG,KAAK;;IAoClC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,SAAS,CAOzD;IAED;;;;;;;OAOG;IACH,YAAY,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,EAetC;IAED;;;;;;OAMG;IACH,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;;;;;;OAOG;IACH,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,cAAc,EACjC,UAAU,EAAE,CAAC,EACb,QAAQ,EAAE,YAAY,CACpB,cAAc,CAAC,CAAC,CAAC,EACjB,eAAe,CAAC,CAAC,CAAC,EAClB,KAAK,EACL,QAAQ,CAAC,KAAK,CAAC,CAChB,GACA,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAelE;IAED;;;;;;;;;;;;OAYG;IACH,CAAC,aAAa,CAAC,CACb,KAAK,EAAE,aAAa,EACpB,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAChD,IAAI,CAeN;IAED;;;;;;;;;;OAUG;IACH,YAAY,CACV,KAAK,EAAE,aAAa,EACpB,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAChD,IAAI,CAEN;IAED,+DAA+D;IAC/D,QAAQ,CACN,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,GACjD,IAAI,CAIN;IAED;;;;;;;;OAQG;IACH,gBAAgB,CAAC,KAAK,CAAC,CAAC,SAAS,0BAA0B,EACzD,UAAU,EAAE,CAAC,EACb,QAAQ,EAAE,wBAAwB,CAChC,mBAAmB,CAAC,CAAC,CAAC,EACtB,KAAK,EACL,QAAQ,CAAC,KAAK,CAAC,CAChB,GACA,IAAI,CAWN;IAED;;;OAGG;IACH,MAAM,CAAC,CAAC,SAAS,gBAAgB,EAC/B,UAAU,EAAE,CAAC,EACb,QAAQ,EAAE,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,GACpE,IAAI,CAWN;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,UAAU,CAAC,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,cAAc,CAAA;KAAO,GAAG,gBAAgB,CAGnE;IAED;;;;;;;;;;;;OAYG;IACG,cAAc,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAIlD;IAED;;;;;;;;;;;;;OAaG;IACH,GAAG,CAAC,CAAC,SAAS,MAAM,EAClB,OAAO,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EACvB,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAC7B,IAAI,CAON;IAED;;;;;;;;;;;;;;OAcG;IACH,EAAE,CAAC,CAAC,SAAS,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EACvB,OAAO,EAAE,CAAC,SAAS,GAAG,MAAM,WAAW,GACnC,0BAA0B,GAC1B,kBAAkB,GACrB,IAAI,CASN;IAED;;;;;;;OAOG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAExC;IAED;;;;;;;OAOG;IACG,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAE1C;IAED;;;;;;;OAOG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED;;;;;;;;;OASG;IACG,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtD;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACG,MAAM,CAAC,IAAI,SAAO,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAiEhE;IAED;;;;;;OAMG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAS3B;CAswBF"}

package/dist/tools.d.ts

@@ -1,4 +1,4 @@
-import type { CallToolResult, InputRequiredResult, StandardSchemaWithJSON, ToolAnnotations } from "@modelcontextprotocol/server";
+import type { CallToolResult, InputRequiredResult, MetaObject, StandardSchemaWithJSON, ToolAnnotations } from "@modelcontextprotocol/server";
 import type { McpUiResourceCsp } from "@modelcontextprotocol/ext-apps";
 import type { RequestContext } from "./context.js";
 import type { UiPermissions } from "./views/types.js";
@@ -69,6 +69,17 @@ export interface ToolDefinition {
     outputSchema?: StandardSchemaWithJSON;
     /** Behavioral hints for clients (readOnlyHint, destructiveHint, …). */
     annotations?: ToolAnnotations;
+    /**
+     * Extension metadata advertised on this tool's `tools/list` descriptor.
+     *
+     * Use vendor-namespaced keys for custom data. This definition metadata is
+     * distinct from a tool callback result's `_meta`: it describes the tool,
+     * while result `_meta` belongs to one invocation. For view-bound or
+     * visibility-restricted tools, framework-owned MCP Apps keys are derived
+     * from {@link ToolDefinition.view} and {@link ToolDefinition.visibility};
+     * those derived values take precedence over colliding entries here.
+     */
+    _meta?: MetaObject;
     /**
      * Declares who may call or see the tool. Emitted as `_meta.ui.visibility`
      * on `tools/list`. Omitted = host default (callable by the model, visible

package/dist/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EAChB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAEvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,iHAAiH;AACjH,MAAM,WAAW,cAAc;IAC7B,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC;;;OAGG;IACH,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC,uEAAuE;IACvE,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC7B;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO,CACtB,IAAI,SAAS,MAAM,GAAG,MAAM,EAC5B,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,GAAG,KAAK;IAEd,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,UAAU,CAAC,OAAO,GAAG,KAAK,IAClC,mBAAmB,GACnB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GACtB,cAAc,GAEV,CAAC,cAAc,GAAG;IAAE,iBAAiB,EAAE,OAAO,CAAA;CAAE,CAAC,GACjD,CAAC,cAAc,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,CAAC;AAElD,4EAA4E;AAC5E,MAAM,MAAM,cAAc,CAAC,CAAC,IAAI,CAAC,SAAS;IACxC,WAAW,EAAE,MAAM,CAAC,SAAS,sBAAsB,CAAC;CACrD,GACG,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnE,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,GACrC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACzB,CAAC,SAAS;IACN,MAAM,EAAE,MAAM,CAAC,SAAS,sBAAsB,CAAC;CAChD,GACD,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnE,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,GACrC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACzB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE9B;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,aAAa,GAAG,QAAQ,CAAC,GACzD,sBAAsB,GAAG,SAAS,CAEpC;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,CAAC,SAAS;IACzC,YAAY,EAAE,MAAM,CAAC,SAAS,sBAAsB,CAAC;CACtD,GACG,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,GACrC,KAAK,CAAC;AAEV,oEAAoE;AACpE,MAAM,MAAM,aAAa,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC,SAAS,MAAM,CAAA;CAAE,GACrE,CAAC,GACD,MAAM,CAAC;AAEX;;;;GAIG;AACH,MAAM,MAAM,YAAY,CACtB,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAG,KAAK,EACf,KAAK,GAAG,KAAK,EACb,QAAQ,SAAS,OAAO,GAAG,KAAK,IAC9B,CACF,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,KACjC,UAAU,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,mBAAmB,EACnB,UAAU,EACV,sBAAsB,EACtB,eAAe,EAChB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAEvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,iHAAiH;AACjH,MAAM,WAAW,cAAc;IAC7B,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC;;;OAGG;IACH,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC,uEAAuE;IACvE,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC7B;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO,CACtB,IAAI,SAAS,MAAM,GAAG,MAAM,EAC5B,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,GAAG,KAAK;IAEd,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,UAAU,CAAC,OAAO,GAAG,KAAK,IAClC,mBAAmB,GACnB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GACtB,cAAc,GAEV,CAAC,cAAc,GAAG;IAAE,iBAAiB,EAAE,OAAO,CAAA;CAAE,CAAC,GACjD,CAAC,cAAc,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,CAAC;AAElD,4EAA4E;AAC5E,MAAM,MAAM,cAAc,CAAC,CAAC,IAAI,CAAC,SAAS;IACxC,WAAW,EAAE,MAAM,CAAC,SAAS,sBAAsB,CAAC;CACrD,GACG,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnE,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,GACrC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACzB,CAAC,SAAS;IACN,MAAM,EAAE,MAAM,CAAC,SAAS,sBAAsB,CAAC;CAChD,GACD,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnE,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,GACrC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACzB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE9B;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,aAAa,GAAG,QAAQ,CAAC,GACzD,sBAAsB,GAAG,SAAS,CAEpC;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,CAAC,SAAS;IACzC,YAAY,EAAE,MAAM,CAAC,SAAS,sBAAsB,CAAC;CACtD,GACG,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,GACrC,KAAK,CAAC;AAEV,oEAAoE;AACpE,MAAM,MAAM,aAAa,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC,SAAS,MAAM,CAAA;CAAE,GACrE,CAAC,GACD,MAAM,CAAC;AAEX;;;;GAIG;AACH,MAAM,MAAM,YAAY,CACtB,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAG,KAAK,EACf,KAAK,GAAG,KAAK,EACb,QAAQ,SAAS,OAAO,GAAG,KAAK,IAC9B,CACF,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,KACjC,UAAU,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC"}

package/dist/views/public-route.d.ts

@@ -13,11 +13,15 @@ export declare function resolvePublicFilePath(publicRoot: string, subpath: strin
  * Serve one file from the project's `public/` directory.
  *
  * @param diskPath - Absolute path resolved by {@link resolvePublicFilePath}.
+ * @param options - When `deferCors` is true, omit hardcoded `ACAO: *` so global
+ *   {@link ServerConfig.cors} middleware owns CORS headers.
  * @returns A `Response` with `Cache-Control: public, max-age=0, must-revalidate`
- * and `Access-Control-Allow-Origin: *` so cross-origin sandboxed view iframes
- * can load public files (module scripts and fetches use CORS mode).
+ * and optionally `Access-Control-Allow-Origin: *` so cross-origin sandboxed
+ * view iframes can load public files (module scripts and fetches use CORS mode).
  *
  * @internal
  */
-export declare function servePublicFile(diskPath: string): Promise<Response>;
+export declare function servePublicFile(diskPath: string, options?: {
+    deferCors?: boolean;
+}): Promise<Response>;
 //# sourceMappingURL=public-route.d.ts.map

package/dist/views/public-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-route.d.ts","sourceRoot":"","sources":["../../src/views/public-route.ts"],"names":[],"mappings":"AAkBA;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoBxB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiBzE"}
+{"version":3,"file":"public-route.d.ts","sourceRoot":"","sources":["../../src/views/public-route.ts"],"names":[],"mappings":"AAkBA;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoBxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC,OAAO,CAAC,QAAQ,CAAC,CAmBnB"}

package/dist/views/routes.d.ts

@@ -14,6 +14,7 @@ import type { ViewManifestEntry } from "./types.js";
  */
 export declare function createViewAssetsHandler(basePath: string, views: ReadonlyMap<string, ViewManifestEntry>, options?: {
     projectRoot?: string;
+    deferCors?: boolean;
 }): FetchHandler | undefined;
 /**
  * Fetch handler for public view assets under `${basePath}/_mcp-use/public/`.
@@ -35,6 +36,7 @@ export declare function createViewAssetsHandler(basePath: string, views: Readonl
 export declare function createViewPublicHandler(basePath: string, views: ReadonlyMap<string, ViewManifestEntry>, options?: {
     dev?: boolean;
     projectRoot?: string;
+    deferCors?: boolean;
 }): FetchHandler | undefined;
 /**
  * @deprecated Use {@link createViewPublicHandler}.

package/dist/views/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/views/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAMpD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAC7C,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,YAAY,GAAG,SAAS,CAuC1B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAC7C,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,YAAY,GAAG,SAAS,CAgC1B;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAItC"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/views/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAMpD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAC7C,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GACtD,YAAY,GAAG,SAAS,CA0C1B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAC7C,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GACrE,YAAY,GAAG,SAAS,CAmC1B;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAItC"}

package/dist/views/wire.d.ts

@@ -1,3 +1,4 @@
+import type { MetaObject } from "@modelcontextprotocol/server";
 import type { ViewManifestEntry, ViewResourceFacts } from "./types.js";
 /**
  * Tool declaration `_meta` for `tools/list`.
@@ -5,17 +6,20 @@ import type { ViewManifestEntry, ViewResourceFacts } from "./types.js";
  * When `viewName` is set, emits `ui.resourceUri` plus the legacy flat
  * {@link UI_RESOURCE_URI_META_KEY} key. When `visibility` is set, emits
  * `ui.visibility: [visibility]`. Either may be set independently — a
- * view-less tool can still declare app-only visibility. Returns
- * `undefined` when both are unset so the caller omits `_meta`.
+ * view-less tool can still declare app-only visibility. Returns `undefined`
+ * only when no view, visibility, or existing metadata is provided.
  *
  * @param viewName - Bound view directory / manifest key, or `undefined` when
  * the tool has no view.
  * @param visibility - Optional model/app visibility narrowing from the tool
  * definition's top-level `visibility` field.
+ * @param existingMetadata - Optional author-supplied definition metadata. Other
+ * keys pass through, while framework-owned resource URI and visibility keys
+ * are derived exclusively from `viewName` and `visibility`.
  * @returns Wire metadata for the tool listing, or `undefined` when there is
  * nothing to emit.
  */
-export declare function buildToolUiMeta(viewName: string | undefined, visibility: "model" | "app" | undefined): Record<string, unknown> | undefined;
+export declare function buildToolUiMeta(viewName: string | undefined, visibility: "model" | "app" | undefined, existingMetadata?: MetaObject): MetaObject | undefined;
 /**
  * Tool result `_meta` stamped on every non-error `CallToolResult` from a
  * view-bound tool.

package/dist/views/wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/views/wire.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAevE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,UAAU,EAAE,OAAO,GAAG,KAAK,GAAG,SAAS,GACtC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAkBrC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMzB;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,gFAAgF;IAChF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAqBD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,iBAAiB,GAAG,SAAS,EAC1C,OAAO,CAAC,EAAE,0BAA0B,GACnC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,iBAAiB,GAAG,SAAS,EAC1C,OAAO,CAAC,EAAE,0BAA0B,GACnC;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC,CAQA"}
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/views/wire.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAevE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,UAAU,EAAE,OAAO,GAAG,KAAK,GAAG,SAAS,EACvC,gBAAgB,CAAC,EAAE,UAAU,GAC5B,UAAU,GAAG,SAAS,CA4CxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMzB;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,gFAAgF;IAChF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAqBD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,iBAAiB,GAAG,SAAS,EAC1C,OAAO,CAAC,EAAE,0BAA0B,GACnC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,iBAAiB,GAAG,SAAS,EAC1C,OAAO,CAAC,EAAE,0BAA0B,GACnC;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC,CAQA"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mcp-use",
   "type": "module",
-  "version": "2.0.0-beta.5",
+  "version": "2.0.0-beta.6",
   "description": "MCP framework and CLI built on the official v2 SDK",
   "author": "mcp-use, Inc.",
   "license": "MIT",
@@ -111,7 +111,7 @@
     "vitest": "^4.1.9",
     "zod": "^4.4.3",
     "@mcp-use/client": "2.0.0-beta.1",
-    "mcp-use": "2.0.0-beta.5"
+    "mcp-use": "2.0.0-beta.6"
   },
   "publishConfig": {
     "access": "public"

package/dist/chunk-SFI2T6TE.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/oauth/index.ts","../src/oauth/adapters.ts","../src/fetch-app.ts"],"sourcesContent":["/**\n * OAuth resource-server helpers and provider configuration for mcp-use.\n *\n * @packageDocumentation\n */\nexport {\n  OAuthError,\n  OAuthErrorCode,\n  bearerAuthChallengeResponse,\n  getOAuthProtectedResourceMetadataUrl,\n  oauthMetadataResponse,\n  requireBearerAuth,\n  verifyBearerToken,\n} from \"@modelcontextprotocol/server\";\nexport type {\n  AuthInfo as OAuthAuthInfo,\n  AuthMetadataOptions,\n  BearerAuthOptions,\n  OAuthMetadata,\n  OAuthProtectedResourceMetadata,\n  OAuthTokenVerifier,\n} from \"@modelcontextprotocol/server\";\n\nexport { bearerAuth, oauthMetadata } from \"./adapters.js\";\nexport {\n  oauthCustomProvider,\n  type CustomOAuthProviderOptions,\n  type OAuthExtra,\n  type OAuthProvider,\n  type OAuthResourceOptions,\n} from \"./provider.js\";\n","import {\n  getOAuthProtectedResourceMetadataUrl,\n  oauthMetadataResponse,\n  requireBearerAuth,\n  type AuthInfo,\n} from \"@modelcontextprotocol/server\";\n\nimport { getRequestBag, type FetchMiddleware } from \"../fetch-app.js\";\nimport { getOAuthProviderOptions, wrapOAuthTokenVerifier } from \"./internal.js\";\nimport type { OAuthProvider } from \"./provider.js\";\n\n/**\n * Fetch middleware that requires a bearer token for a canonical resource.\n *\n * @typeParam TUser - Application user type carried by the provider.\n * @param provider - OAuth provider that verifies the bearer token.\n * @param resource - Canonical public MCP endpoint URL.\n */\nexport function bearerAuth<TUser>(\n  provider: OAuthProvider<TUser>,\n  resource: URL\n): FetchMiddleware {\n  const options = getOAuthProviderOptions(provider);\n  const gate = requireBearerAuth({\n    verifier: wrapOAuthTokenVerifier(provider, resource),\n    resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(resource),\n    ...(options.requiredScopes !== undefined && {\n      requiredScopes: [...options.requiredScopes],\n    }),\n  });\n\n  return async (request, next) => {\n    const result = await gate(request);\n    if (result instanceof Response) {\n      return result;\n    }\n    getRequestBag(request).authInfo = result;\n    return next();\n  };\n}\n\n/**\n * Fetch middleware that serves OAuth discovery metadata.\n *\n * @typeParam TUser - Application user type carried by the provider.\n * @param provider - OAuth provider that supplies authorization-server metadata.\n * @param resource - Canonical public MCP endpoint URL.\n */\nexport function oauthMetadata<TUser>(\n  provider: OAuthProvider<TUser>,\n  resource: URL\n): FetchMiddleware {\n  const options = getOAuthProviderOptions(provider);\n  return async (request, next) => {\n    const response = oauthMetadataResponse(request, {\n      oauthMetadata: options.oauthMetadata,\n      resourceServerUrl: resource,\n      ...(options.scopesSupported !== undefined && {\n        scopesSupported: [...options.scopesSupported],\n      }),\n      ...(options.resourceName !== undefined && {\n        resourceName: options.resourceName,\n      }),\n      ...(options.serviceDocumentationUrl !== undefined && {\n        serviceDocumentationUrl: options.serviceDocumentationUrl,\n      }),\n    });\n    if (response !== undefined) {\n      return response;\n    }\n    return next();\n  };\n}\n/**\n * Read verified {@link AuthInfo} from the request bag after {@link bearerAuth}.\n *\n * @param request - Request that passed through bearer auth middleware.\n */\nexport function authInfoFromRequest(request: Request): AuthInfo | undefined {\n  return getRequestBag(request).authInfo;\n}\n","import {\n  hostHeaderValidationResponse,\n  originValidationResponse,\n  type AuthInfo,\n} from \"@modelcontextprotocol/server\";\n\n/** Web-standard request handler. */\nexport type FetchHandler = (request: Request) => Promise<Response>;\n\n/** Onion middleware over a {@link FetchHandler} terminal. */\nexport type FetchMiddleware = (\n  request: Request,\n  next: () => Promise<Response>\n) => Promise<Response>;\n\n/** Per-request values stashed before the MCP handler runs. */\nexport interface RequestBag {\n  /** Parsed JSON body when the JSON middleware ran first. */\n  parsedBody?: unknown;\n  /** Verified OAuth identity forwarded to the SDK handler. */\n  authInfo?: AuthInfo;\n}\n\nconst requestBags = new WeakMap<Request, RequestBag>();\n\n/**\n * Mutable per-request bag; created on first access.\n *\n * @param request - Incoming request whose bag to read or create.\n */\nexport function getRequestBag(request: Request): RequestBag {\n  let bag = requestBags.get(request);\n  if (bag === undefined) {\n    bag = {};\n    requestBags.set(request, bag);\n  }\n  return bag;\n}\n\n/**\n * Compose middleware around a terminal handler (first listed runs outermost).\n *\n * @param terminal - Fallback handler when no middleware short-circuits.\n * @param middlewares - Middleware chain executed before `terminal`.\n */\nexport function composeFetch(\n  terminal: FetchHandler,\n  ...middlewares: FetchMiddleware[]\n): FetchHandler {\n  return async (request: Request): Promise<Response> => {\n    let index = 0;\n    const dispatch = async (): Promise<Response> => {\n      if (index < middlewares.length) {\n        const middleware = middlewares[index]!;\n        index += 1;\n        return middleware(request, dispatch);\n      }\n      return terminal(request);\n    };\n    return dispatch();\n  };\n}\n\n/**\n * Return the pathname of a request URL.\n *\n * @param request - Request whose pathname to read.\n */\nexport function pathnameOf(request: Request): string {\n  return new URL(request.url).pathname;\n}\n\n/**\n * Match a request pathname exactly.\n *\n * @param request - Request to test.\n * @param path - Exact pathname (for example `/mcp`).\n */\nexport function matchesPath(request: Request, path: string): boolean {\n  return pathnameOf(request) === path;\n}\n\n/**\n * Match a request pathname prefix (prefix or `prefix/...`).\n *\n * @param request - Request to test.\n * @param prefix - Path prefix without a trailing wildcard.\n */\nexport function matchesPathPrefix(request: Request, prefix: string): boolean {\n  const pathname = pathnameOf(request);\n  return pathname === prefix || pathname.startsWith(`${prefix}/`);\n}\n\n/**\n * Dispatch to the first matching route handler.\n *\n * @param routes - Ordered route table; first match wins.\n * @param fallback - Handler when nothing matches.\n */\nexport function routeFetch(\n  routes: Array<{\n    match: (request: Request) => boolean;\n    handler: FetchHandler;\n  }>,\n  fallback: FetchHandler = async () =>\n    new Response(\"Not Found\", { status: 404 })\n): FetchHandler {\n  return async (request: Request): Promise<Response> => {\n    for (const route of routes) {\n      if (route.match(request)) {\n        return route.handler(request);\n      }\n    }\n    return fallback(request);\n  };\n}\n\n/**\n * Parse JSON bodies once and stash them in the request bag.\n */\nexport function jsonBodyMiddleware(): FetchMiddleware {\n  return async (request, next) => {\n    const bag = getRequestBag(request);\n    if (bag.parsedBody !== undefined) {\n      return next();\n    }\n    if (\n      !(request.headers.get(\"content-type\") ?? \"\").includes(\"application/json\")\n    ) {\n      return next();\n    }\n    try {\n      bag.parsedBody = await request.clone().json();\n    } catch {\n      return new Response(\"Invalid JSON\", { status: 400 });\n    }\n    return next();\n  };\n}\n\n/**\n * Reject requests whose `Host` header is not on the allowlist.\n *\n * @param hosts - Allowed hostnames (port-agnostic).\n */\nexport function hostValidationMiddleware(hosts: string[]): FetchMiddleware {\n  return async (request, next) => {\n    const rejected = hostHeaderValidationResponse(request, hosts);\n    return rejected ?? next();\n  };\n}\n\n/**\n * Reject requests whose `Origin` header is not on the allowlist.\n *\n * @param origins - Allowed origin hostnames (port-agnostic).\n * @param skipSafeMethods - When true, skip GET/HEAD (view asset GETs).\n */\nexport function originValidationMiddleware(\n  origins: string[],\n  skipSafeMethods = true\n): FetchMiddleware {\n  return async (request, next) => {\n    if (\n      skipSafeMethods &&\n      (request.method === \"GET\" || request.method === \"HEAD\")\n    ) {\n      return next();\n    }\n    const rejected = originValidationResponse(request, origins);\n    return rejected ?? next();\n  };\n}\n"],"mappings":";;;;;;AAKA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,wCAAAA;AAAA,EACA,yBAAAC;AAAA,EACA,qBAAAC;AAAA,EACA;AAAA,OACK;;;ACbP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;;;ACLP;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAmBP,IAAM,cAAc,oBAAI,QAA6B;AAO9C,SAAS,cAAc,SAA8B;AAC1D,MAAI,MAAM,YAAY,IAAI,OAAO;AACjC,MAAI,QAAQ,QAAW;AACrB,UAAM,CAAC;AACP,gBAAY,IAAI,SAAS,GAAG;AAAA,EAC9B;AACA,SAAO;AACT;AAQO,SAAS,aACd,aACG,aACW;AACd,SAAO,OAAO,YAAwC;AACpD,QAAI,QAAQ;AACZ,UAAM,WAAW,YAA+B;AAC9C,UAAI,QAAQ,YAAY,QAAQ;AAC9B,cAAM,aAAa,YAAY,KAAK;AACpC,iBAAS;AACT,eAAO,WAAW,SAAS,QAAQ;AAAA,MACrC;AACA,aAAO,SAAS,OAAO;AAAA,IACzB;AACA,WAAO,SAAS;AAAA,EAClB;AACF;AAOO,SAAS,WAAW,SAA0B;AACnD,SAAO,IAAI,IAAI,QAAQ,GAAG,EAAE;AAC9B;AAQO,SAAS,YAAY,SAAkB,MAAuB;AACnE,SAAO,WAAW,OAAO,MAAM;AACjC;AAQO,SAAS,kBAAkB,SAAkB,QAAyB;AAC3E,QAAM,WAAW,WAAW,OAAO;AACnC,SAAO,aAAa,UAAU,SAAS,WAAW,GAAG,MAAM,GAAG;AAChE;AAQO,SAAS,WACd,QAIA,WAAyB,YACvB,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC,GAC7B;AACd,SAAO,OAAO,YAAwC;AACpD,eAAW,SAAS,QAAQ;AAC1B,UAAI,MAAM,MAAM,OAAO,GAAG;AACxB,eAAO,MAAM,QAAQ,OAAO;AAAA,MAC9B;AAAA,IACF;AACA,WAAO,SAAS,OAAO;AAAA,EACzB;AACF;AAKO,SAAS,qBAAsC;AACpD,SAAO,OAAO,SAAS,SAAS;AAC9B,UAAM,MAAM,cAAc,OAAO;AACjC,QAAI,IAAI,eAAe,QAAW;AAChC,aAAO,KAAK;AAAA,IACd;AACA,QACE,EAAE,QAAQ,QAAQ,IAAI,cAAc,KAAK,IAAI,SAAS,kBAAkB,GACxE;AACA,aAAO,KAAK;AAAA,IACd;AACA,QAAI;AACF,UAAI,aAAa,MAAM,QAAQ,MAAM,EAAE,KAAK;AAAA,IAC9C,QAAQ;AACN,aAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrD;AACA,WAAO,KAAK;AAAA,EACd;AACF;AAOO,SAAS,yBAAyB,OAAkC;AACzE,SAAO,OAAO,SAAS,SAAS;AAC9B,UAAM,WAAW,6BAA6B,SAAS,KAAK;AAC5D,WAAO,YAAY,KAAK;AAAA,EAC1B;AACF;AAQO,SAAS,2BACd,SACA,kBAAkB,MACD;AACjB,SAAO,OAAO,SAAS,SAAS;AAC9B,QACE,oBACC,QAAQ,WAAW,SAAS,QAAQ,WAAW,SAChD;AACA,aAAO,KAAK;AAAA,IACd;AACA,UAAM,WAAW,yBAAyB,SAAS,OAAO;AAC1D,WAAO,YAAY,KAAK;AAAA,EAC1B;AACF;;;AD1JO,SAAS,WACd,UACA,UACiB;AACjB,QAAM,UAAU,wBAAwB,QAAQ;AAChD,QAAM,OAAO,kBAAkB;AAAA,IAC7B,UAAU,uBAAuB,UAAU,QAAQ;AAAA,IACnD,qBAAqB,qCAAqC,QAAQ;AAAA,IAClE,GAAI,QAAQ,mBAAmB,UAAa;AAAA,MAC1C,gBAAgB,CAAC,GAAG,QAAQ,cAAc;AAAA,IAC5C;AAAA,EACF,CAAC;AAED,SAAO,OAAO,SAAS,SAAS;AAC9B,UAAM,SAAS,MAAM,KAAK,OAAO;AACjC,QAAI,kBAAkB,UAAU;AAC9B,aAAO;AAAA,IACT;AACA,kBAAc,OAAO,EAAE,WAAW;AAClC,WAAO,KAAK;AAAA,EACd;AACF;AASO,SAAS,cACd,UACA,UACiB;AACjB,QAAM,UAAU,wBAAwB,QAAQ;AAChD,SAAO,OAAO,SAAS,SAAS;AAC9B,UAAM,WAAW,sBAAsB,SAAS;AAAA,MAC9C,eAAe,QAAQ;AAAA,MACvB,mBAAmB;AAAA,MACnB,GAAI,QAAQ,oBAAoB,UAAa;AAAA,QAC3C,iBAAiB,CAAC,GAAG,QAAQ,eAAe;AAAA,MAC9C;AAAA,MACA,GAAI,QAAQ,iBAAiB,UAAa;AAAA,QACxC,cAAc,QAAQ;AAAA,MACxB;AAAA,MACA,GAAI,QAAQ,4BAA4B,UAAa;AAAA,QACnD,yBAAyB,QAAQ;AAAA,MACnC;AAAA,IACF,CAAC;AACD,QAAI,aAAa,QAAW;AAC1B,aAAO;AAAA,IACT;AACA,WAAO,KAAK;AAAA,EACd;AACF;AAMO,SAAS,oBAAoB,SAAwC;AAC1E,SAAO,cAAc,OAAO,EAAE;AAChC;","names":["getOAuthProtectedResourceMetadataUrl","oauthMetadataResponse","requireBearerAuth"]}

package/dist/public-route-7IK5D7V7.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/views/public-route.ts"],"sourcesContent":["const PUBLIC_CONTENT_TYPES: Record<string, string> = {\n  \".css\": \"text/css\",\n  \".gif\": \"image/gif\",\n  \".html\": \"text/html\",\n  \".ico\": \"image/x-icon\",\n  \".jpeg\": \"image/jpeg\",\n  \".jpg\": \"image/jpeg\",\n  \".js\": \"application/javascript\",\n  \".json\": \"application/json\",\n  \".map\": \"application/json\",\n  \".png\": \"image/png\",\n  \".svg\": \"image/svg+xml\",\n  \".txt\": \"text/plain\",\n  \".webp\": \"image/webp\",\n  \".woff\": \"font/woff\",\n  \".woff2\": \"font/woff2\",\n};\n\n/**\n * Resolve a request subpath to an on-disk file under `publicRoot`, rejecting\n * path traversal.\n *\n * @param publicRoot - Absolute path to the `public/` directory on disk.\n * @param subpath - Request path after the `/public/` route prefix.\n * @returns Absolute file path when safe and present, otherwise `null`.\n *\n * @internal\n */\nexport async function resolvePublicFilePath(\n  publicRoot: string,\n  subpath: string\n): Promise<string | null> {\n  const { existsSync } = await import(\"node:fs\");\n  const { resolve, sep } = await import(\"node:path\");\n\n  if (subpath === \"\" || subpath.includes(\"..\") || subpath.includes(\"\\\\\")) {\n    return null;\n  }\n  const clean = subpath.replace(/^\\/+/, \"\");\n  if (clean === \"\" || clean.endsWith(\"/\")) {\n    return null;\n  }\n  const root = resolve(publicRoot);\n  const abs = resolve(root, clean);\n  if (abs !== root && !abs.startsWith(root + sep)) {\n    return null;\n  }\n  if (!existsSync(abs)) {\n    return null;\n  }\n  return abs;\n}\n\n/**\n * Serve one file from the project's `public/` directory.\n *\n * @param diskPath - Absolute path resolved by {@link resolvePublicFilePath}.\n * @returns A `Response` with `Cache-Control: public, max-age=0, must-revalidate`\n * and `Access-Control-Allow-Origin: *` so cross-origin sandboxed view iframes\n * can load public files (module scripts and fetches use CORS mode).\n *\n * @internal\n */\nexport async function servePublicFile(diskPath: string): Promise<Response> {\n  const { createReadStream } = await import(\"node:fs\");\n  const { extname } = await import(\"node:path\");\n  const { Readable } = await import(\"node:stream\");\n\n  const ext = extname(diskPath);\n  const contentType = PUBLIC_CONTENT_TYPES[ext] ?? \"application/octet-stream\";\n  const nodeStream = createReadStream(diskPath);\n  const webStream = Readable.toWeb(nodeStream) as ReadableStream;\n  return new Response(webStream, {\n    status: 200,\n    headers: {\n      \"Content-Type\": contentType,\n      \"Cache-Control\": \"public, max-age=0, must-revalidate\",\n      \"Access-Control-Allow-Origin\": \"*\",\n    },\n  });\n}\n"],"mappings":";AAAA,IAAM,uBAA+C;AAAA,EACnD,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,SAAS;AAAA,EACT,UAAU;AACZ;AAYA,eAAsB,sBACpB,YACA,SACwB;AACxB,QAAM,EAAE,WAAW,IAAI,MAAM,OAAO,IAAS;AAC7C,QAAM,EAAE,SAAS,IAAI,IAAI,MAAM,OAAO,MAAW;AAEjD,MAAI,YAAY,MAAM,QAAQ,SAAS,IAAI,KAAK,QAAQ,SAAS,IAAI,GAAG;AACtE,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;AACxC,MAAI,UAAU,MAAM,MAAM,SAAS,GAAG,GAAG;AACvC,WAAO;AAAA,EACT;AACA,QAAM,OAAO,QAAQ,UAAU;AAC/B,QAAM,MAAM,QAAQ,MAAM,KAAK;AAC/B,MAAI,QAAQ,QAAQ,CAAC,IAAI,WAAW,OAAO,GAAG,GAAG;AAC/C,WAAO;AAAA,EACT;AACA,MAAI,CAAC,WAAW,GAAG,GAAG;AACpB,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAYA,eAAsB,gBAAgB,UAAqC;AACzE,QAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,IAAS;AACnD,QAAM,EAAE,QAAQ,IAAI,MAAM,OAAO,MAAW;AAC5C,QAAM,EAAE,SAAS,IAAI,MAAM,OAAO,QAAa;AAE/C,QAAM,MAAM,QAAQ,QAAQ;AAC5B,QAAM,cAAc,qBAAqB,GAAG,KAAK;AACjD,QAAM,aAAa,iBAAiB,QAAQ;AAC5C,QAAM,YAAY,SAAS,MAAM,UAAU;AAC3C,SAAO,IAAI,SAAS,WAAW;AAAA,IAC7B,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,+BAA+B;AAAA,IACjC;AAAA,EACF,CAAC;AACH;","names":[]}