test: harden MCP v2 upgrade boundaries

.changeset/static-route-handler.md

@@ -0,0 +1,7 @@
+---
+"mcp-handler": patch
+---
+
+Reject browser requests from unexpected Origin hostnames by default, add `allowedOriginHostnames` for explicit cross-origin access, preserve the HTTP `Allow: POST` header on stateless `405` responses, and isolate synchronous or asynchronous `onEvent` callback failures from MCP requests.
+
+The CLI now supports `src/app`, `--no-install`, and refuses to overwrite an existing route. The published package now includes the documentation linked from the npm README and points its CommonJS declaration export at the generated `dist/index.d.ts` file.

README.md

@@ -57,6 +57,10 @@ export { handler as GET, handler as POST };
 the request pathname, so you can place this handler at any framework route and
 give clients that route's complete URL.
 
+Browser requests with an `Origin` header are restricted to the MCP server's
+public hostname by default. See [Advanced Usage](docs/ADVANCED.md) to allow
+additional browser Origin hostnames.
+
 ## Connecting Clients
 
 If your client supports Streamable HTTP, connect directly:
@@ -114,6 +118,7 @@ See [Authorization](docs/AUTHORIZATION.md) for wiring details.
 - **Framework-agnostic**: Web-standard `Request` and `Response` handler
 - **Framework compatibility**: Next.js, Nuxt/Nitro, SvelteKit, Hono, and other Fetch-compatible frameworks
 - **Dual-era protocol support**: 2026-07-28 (stateless) and 2025-era Streamable HTTP from one handler
+- **Secure browser boundary**: Origin validation with an explicit cross-origin allowlist
 - **TypeScript Support**: Full type definitions included
 
 ## Requirements

docs/ADVANCED.md

@@ -44,10 +44,30 @@ export { handler as GET, handler as POST };
 ```typescript
 interface Config {
   verboseLogs?: boolean; // Enable debug logging
-  onEvent?: (event: McpEvent) => void; // Analytics/debugging callback
+  onEvent?: (event: McpEvent) => void | Promise<void>; // Analytics/debugging callback
+  allowedOriginHostnames?: string[]; // Additional browser Origin hostnames
 }
 ```
 
+Requests with an `Origin` header are accepted when the Origin hostname matches
+the public MCP server hostname. Add hostname-only entries (without a scheme or
+port) to `allowedOriginHostnames` when a browser-based client is hosted on a
+different hostname:
+
+```typescript
+const handler = createMcpHandler(
+  initializeServer,
+  {},
+  {
+    allowedOriginHostnames: ["inspector.example.com"],
+  },
+);
+```
+
+Server-side MCP clients normally omit `Origin` and are unaffected. Event
+callbacks may be synchronous or asynchronous; callback failures are logged
+when `verboseLogs` is enabled and never fail the MCP request.
+
 ## Nuxt Usage
 
 ```typescript

package.json

@@ -14,22 +14,23 @@
     ".": {
       "types": {
         "import": "./dist/index.d.mts",
-        "require": "./dist/index.d.cjs"
+        "require": "./dist/index.d.ts"
       },
       "import": "./dist/index.mjs",
       "require": "./dist/index.js"
     },
     "./next": {
       "types": {
         "import": "./dist/index.d.mts",
-        "require": "./dist/index.d.cjs"
+        "require": "./dist/index.d.ts"
       },
       "import": "./dist/index.mjs",
       "require": "./dist/index.js"
     }
   },
   "files": [
-    "dist"
+    "dist",
+    "docs"
   ],
   "repository": {
     "type": "git",
@@ -41,7 +42,7 @@
   "scripts": {
     "build": "tsup",
     "dev": "tsup --watch",
-    "test": "vitest run",
+    "test": "pnpm build && vitest run",
     "test:watch": "vitest watch",
     "version-packages": "changeset version",
     "changeset": "changeset",
@@ -63,6 +64,7 @@
     "@changesets/cli": "^2.27.12",
     "@modelcontextprotocol/client": "^2.0.0",
     "@modelcontextprotocol/server": "^2.0.0",
+    "@modelcontextprotocol/sdk-v1": "npm:@modelcontextprotocol/sdk@1.26.0",
     "@types/node": "^22.15.8",
     "tsup": "^8.0.0",
     "typescript": "^5.0.0",