/**
 * @fileoverview Builds the SEP-1649 MCP Server Card served at
 * `/.well-known/mcp.json`. Machine-readable discovery document so clients
 * can learn a server's capabilities, endpoints, and auth requirements
 * before initiating a full `initialize` handshake.
 *
 * Sibling of the `/mcp` status JSON (bespoke, back-compat) and `/` landing page
 * (human HTML) — all three are pure functions of the same `ServerManifest`.
 *
 * @see https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1649
 * @module src/mcp-server/transports/http/serverCard
 */
import { logger } from '../../../utils/internal/logger.js';
import { requestContextService } from '../../../utils/internal/requestContext.js';
/**
 * Build the SEP-1649 Server Card from the manifest + request origin.
 * Pure — same inputs produce the same output.
 */
export function buildServerCard(manifest, origin) {
    const streamableEndpoint = `${origin.replace(/\/$/, '')}${manifest.transport.endpointPath}`;
    const card = {
        mcp_version: manifest.protocol.latestVersion,
        server_name: manifest.server.name,
        server_version: manifest.server.version,
        ...(manifest.server.description && { server_description: manifest.server.description }),
        endpoints: {
            ...(manifest.transport.type === 'http' && { streamable_http: streamableEndpoint }),
        },
        capabilities: {
            tools: manifest.capabilities.tools,
            resources: manifest.capabilities.resources,
            prompts: manifest.capabilities.prompts,
            logging: manifest.capabilities.logging,
        },
        authentication: buildAuthSection(manifest),
        ...(manifest.extensions && { extensions: manifest.extensions }),
        ...(manifest.server.homepage && { documentation: manifest.server.homepage }),
        generated_at: manifest.builtAt,
    };
    return card;
}
function buildAuthSection(manifest) {
    switch (manifest.auth.mode) {
        case 'oauth':
            return {
                required: true,
                type: 'oauth',
                ...(manifest.auth.oauthIssuer && { authorization_servers: [manifest.auth.oauthIssuer] }),
                ...(manifest.auth.oauthAudience && { audience: manifest.auth.oauthAudience }),
                ...(manifest.auth.resourceIdentifier && {
                    resource_identifier: manifest.auth.resourceIdentifier,
                }),
                ...(manifest.auth.jwksUri && { jwks_uri: manifest.auth.jwksUri }),
            };
        case 'jwt':
            return {
                required: true,
                type: 'jwt',
                ...(manifest.auth.resourceIdentifier && {
                    resource_identifier: manifest.auth.resourceIdentifier,
                }),
            };
        default:
            return { required: false, type: 'none' };
    }
}
/**
 * Hono route handler for `GET /.well-known/mcp.json`.
 * Sets SEP-1649-recommended headers: `Content-Type`, `X-Content-Type-Options`,
 * `Cache-Control`, CORS.
 */
export function createServerCardHandler(manifest) {
    return (c) => {
        const context = requestContextService.createRequestContext({
            operation: 'serverCardHandler',
        });
        const origin = manifest.transport.publicUrl ?? new URL(c.req.url).origin;
        const card = buildServerCard(manifest, origin);
        logger.debug('Serving SEP-1649 Server Card.', {
            ...context,
            origin,
            authMode: manifest.auth.mode,
        });
        c.header('Content-Type', 'application/json; charset=utf-8');
        c.header('X-Content-Type-Options', 'nosniff');
        c.header('Cache-Control', 'public, max-age=3600');
        c.header('Access-Control-Allow-Origin', '*');
        return c.json(card);
    };
}
//# sourceMappingURL=serverCard.js.map