@agent-vm/mcp-portal 0.0.69 → 0.0.70

package/dist/resolve-agent-identity-FQL02YdW.d.ts

@@ -0,0 +1,81 @@
+import { L as createPortalAgentIdentity, M as PortalAgentIdentity } from "./portal-session-DG2CUjIo.js";
+import { a as PortalCore, y as PortalApprovalCall } from "./portal-core-CZQI7Ob6.js";
+import { McpPortalAgentConfig, McpPortalConfig, ResolvedMcpPortalProfile, SecretValue } from "@agent-vm/config-contracts";
+import { Hono } from "hono";
+
+//#region src/mcp-proxy/portal-http-server.d.ts
+interface PortalHttpAgentIdentity extends PortalAgentIdentity {}
+interface PortalAgentBearerAuth {
+  readonly authorizationHeaderName: string;
+  readonly credentialVersionsByAgent?: Readonly<Record<string, number>>;
+  readonly masterKey: Buffer;
+}
+type PortalHttpAuditEvent = {
+  readonly agentId: string;
+  readonly clientAddress: string;
+  readonly decision: 'allow' | 'deny';
+  readonly kind: 'mcp_proxy_auth';
+  readonly reason?: 'malformed' | 'missing' | 'rate_limited' | 'signature-mismatch' | 'unknown_agent';
+  readonly timeMs: number;
+};
+interface PortalHttpAppOptions {
+  readonly agentBearerAuth: PortalAgentBearerAuth;
+  readonly auditErrorSink?: (error: Error, event: PortalHttpAuditEvent) => Promise<void> | void;
+  readonly auditSink?: (event: PortalHttpAuditEvent) => Promise<void> | void;
+  readonly authFailureLimit?: {
+    readonly maxFailures: number;
+    readonly windowMs: number;
+  };
+  readonly core: PortalCore;
+  readonly onSessionClosed?: (identity: PortalAgentIdentity) => Promise<void> | void;
+  readonly onSessionCloseError?: (error: Error, identity: PortalAgentIdentity) => Promise<void> | void;
+  readonly registeredAgentIds?: readonly string[];
+  readonly resolveAgentIdentity?: (agentId: string) => PortalHttpAgentIdentity | null;
+}
+type PortalHttpApp = Hono & {
+  readonly closePortalSessions: () => Promise<void>;
+};
+declare function createPortalHttpApp(options: PortalHttpAppOptions): PortalHttpApp;
+//#endregion
+//#region src/mcp-proxy/resolve-agent-identity.d.ts
+interface ResolveAgentHmacKeysProps {
+  readonly agents: Readonly<Record<string, McpPortalAgentConfig>>;
+  readonly envKeys: ReadonlyMap<string, Buffer>;
+  readonly resolveSecret: (secret: SecretValue) => Promise<string>;
+}
+interface PortalAgentRuntimeRecord {
+  readonly agentId: string;
+  readonly hmacKey: Buffer;
+  readonly profile: ResolvedMcpPortalProfile;
+  readonly profileName: string;
+}
+interface PortalApprovalAuditEvent {
+  readonly agentId: string;
+  readonly decision: 'allow' | 'deny';
+  readonly kind: 'mcp_portal_approval';
+  readonly reason?: 'approval_token_invalid' | 'approval_token_missing' | 'no_approval_required';
+  readonly timeMs: number;
+  readonly verifierReason?: string;
+}
+declare function resolveAgentHmacKeys(props: ResolveAgentHmacKeysProps): Promise<ReadonlyMap<string, Buffer>>;
+declare function createPortalAgentRuntimeRecords(props: {
+  readonly hmacKeys: ReadonlyMap<string, Buffer>;
+  readonly portalConfig: McpPortalConfig;
+}): ReadonlyMap<string, PortalAgentRuntimeRecord>;
+declare function createPortalHttpAgentResolver(records: ReadonlyMap<string, PortalAgentRuntimeRecord>): (agentId: string) => ReturnType<typeof createPortalAgentIdentity> | null;
+declare function createPortalApprovalVerifier(props: {
+  readonly approvalTokenReplayCacheLimit?: number;
+  readonly auditErrorSink?: (error: Error, event: PortalApprovalAuditEvent) => void;
+  readonly auditSink?: (event: PortalApprovalAuditEvent) => void;
+  readonly records: ReadonlyMap<string, PortalAgentRuntimeRecord>;
+}): (calls: readonly PortalApprovalCall[], agentId: string, token: string | undefined) => {
+  readonly kind: 'allow';
+} | {
+  readonly kind: 'approval_token_invalid';
+  readonly reason: string;
+} | {
+  readonly kind: 'approval_token_missing';
+};
+//#endregion
+export { createPortalApprovalVerifier as a, PortalAgentBearerAuth as c, PortalHttpAppOptions as d, PortalHttpAuditEvent as f, createPortalAgentRuntimeRecords as i, PortalHttpAgentIdentity as l, PortalApprovalAuditEvent as n, createPortalHttpAgentResolver as o, createPortalHttpApp as p, ResolveAgentHmacKeysProps as r, resolveAgentHmacKeys as s, PortalAgentRuntimeRecord as t, PortalHttpApp as u };
+//# sourceMappingURL=resolve-agent-identity-FQL02YdW.d.ts.map

package/dist/resolve-agent-identity-FQL02YdW.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-agent-identity-FQL02YdW.d.ts","names":[],"sources":["../src/mcp-proxy/portal-http-server.ts","../src/mcp-proxy/resolve-agent-identity.ts"],"mappings":";;;;;;UAWiB,uBAAA,SAAgC,mBAAA;AAAA,UAEhC,qBAAA;EAAA,SACP,uBAAA;EAAA,SACA,yBAAA,GAA4B,QAAA,CAAS,MAAA;EAAA,SACrC,SAAA,EAAW,MAAA;AAAA;AAAA,KAGT,oBAAA;EAAA,SACF,OAAA;EAAA,SACA,aAAA;EAAA,SACA,QAAA;EAAA,SACA,IAAA;EAAA,SACA,MAAA;EAAA,SAMA,MAAA;AAAA;AAAA,UAGO,oBAAA;EAAA,SACP,eAAA,EAAiB,qBAAA;EAAA,SACjB,cAAA,IAAkB,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,oBAAA,KAAyB,OAAA;EAAA,SAChE,SAAA,IAAa,KAAA,EAAO,oBAAA,KAAyB,OAAA;EAAA,SAC7C,gBAAA;IAAA,SACC,WAAA;IAAA,SACA,QAAA;EAAA;EAAA,SAED,IAAA,EAAM,UAAA;EAAA,SACN,eAAA,IAAmB,QAAA,EAAU,mBAAA,KAAwB,OAAA;EAAA,SACrD,mBAAA,IACR,KAAA,EAAO,KAAA,EACP,QAAA,EAAU,mBAAA,KACN,OAAA;EAAA,SACI,kBAAA;EAAA,SACA,oBAAA,IAAwB,OAAA,aAAoB,uBAAA;AAAA;AAAA,KAG1C,aAAA,GAAgB,IAAA;EAAA,SAClB,mBAAA,QAA2B,OAAA;AAAA;AAAA,iBAiDrB,mBAAA,CAAoB,OAAA,EAAS,oBAAA,GAAuB,aAAA;;;UCrFnD,yBAAA;EAAA,SACP,MAAA,EAAQ,QAAA,CAAS,MAAA,SAAe,oBAAA;EAAA,SAChC,OAAA,EAAS,WAAA,SAAoB,MAAA;EAAA,SAC7B,aAAA,GAAgB,MAAA,EAAQ,WAAA,KAAgB,OAAA;AAAA;AAAA,UAGjC,wBAAA;EAAA,SACP,OAAA;EAAA,SACA,OAAA,EAAS,MAAA;EAAA,SACT,OAAA,EAAS,wBAAA;EAAA,SACT,WAAA;AAAA;AAAA,UAGO,wBAAA;EAAA,SACP,OAAA;EAAA,SACA,QAAA;EAAA,SACA,IAAA;EAAA,SACA,MAAA;EAAA,SACA,MAAA;EAAA,SACA,cAAA;AAAA;AAAA,iBAuBY,oBAAA,CACrB,KAAA,EAAO,yBAAA,GACL,OAAA,CAAQ,WAAA,SAAoB,MAAA;AAAA,iBAef,+BAAA,CAAgC,KAAA;EAAA,SACtC,QAAA,EAAU,WAAA,SAAoB,MAAA;EAAA,SAC9B,YAAA,EAAc,eAAA;AAAA,IACpB,WAAA,SAAoB,wBAAA;AAAA,iBAiBR,6BAAA,CACf,OAAA,EAAS,WAAA,SAAoB,wBAAA,KAC1B,OAAA,aAAoB,UAAA,QAAkB,yBAAA;AAAA,iBAsC1B,4BAAA,CAA6B,KAAA;EAAA,SACnC,6BAAA;EAAA,SACA,cAAA,IAAkB,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,wBAAA;EAAA,SACvC,SAAA,IAAa,KAAA,EAAO,wBAAA;EAAA,SACpB,OAAA,EAAS,WAAA,SAAoB,wBAAA;AAAA,KAEtC,KAAA,WAAgB,kBAAA,IAChB,OAAA,UACA,KAAA;EAAA,SAEa,IAAA;AAAA;EAAA,SACA,IAAA;EAAA,SAAyC,MAAA;AAAA;EAAA,SACzC,IAAA;AAAA"}

package/dist/serve-command-CnSMUybd.js

@@ -0,0 +1,358 @@
+import { t as createUpstreamMcpClientRuntime } from "./upstream-mcp-client-runtime-JlsfTm7_.js";
+import { i as resolveUpstreamServers, n as createPortalCore } from "./portal-core-Cgu714CL.js";
+import { t as decodePortalMasterKey } from "./agent-bearer-token-DCtpDPCZ.js";
+import { a as createPortalHttpApp, n as createPortalApprovalVerifier, r as createPortalHttpAgentResolver, t as createPortalAgentRuntimeRecords } from "./resolve-agent-identity-DnC_Pmnh.js";
+import { createHmac } from "node:crypto";
+import { loadMcpConfig, loadMcpPortalConfig, resolveMcpPortalProfile } from "@agent-vm/config-contracts";
+import { join } from "node:path";
+import { parseArgs } from "node:util";
+import { createCompositeSecretResolver, createSecretResolver, resolveServiceAccountToken } from "@agent-vm/secrets";
+import { serve } from "@hono/node-server";
+//#region src/bin/secret-value-resolver.ts
+function secretRefFromSecretValue(secret) {
+	if (secret.source === "environment") return {
+		ref: secret.name,
+		source: "environment"
+	};
+	return {
+		ref: secret.ref,
+		source: "1password"
+	};
+}
+async function resolveSecretValue(secret, props) {
+	if (secret.source === "environment") {
+		const value = props.env[secret.name];
+		if (value === void 0 || value.length === 0) throw new Error(`Missing environment secret ${secret.name}.`);
+		return value;
+	}
+	if (props.secretResolver === void 0) throw new Error("Secret with source '1password' requires a configured secret resolver.");
+	return await props.secretResolver.resolve(secretRefFromSecretValue(secret));
+}
+//#endregion
+//#region src/cli/serve-command.ts
+function requirePortalTokenSourceValue(env, name, sourceType) {
+	const value = env[name]?.trim();
+	if (value === void 0 || value.length === 0) throw new Error(`${name} is required when AGENT_VM_MCP_PORTAL_OP_TOKEN_SOURCE=${sourceType}.`);
+	return value;
+}
+function readPortalOnePasswordTokenSource(env) {
+	const sourceType = env.AGENT_VM_MCP_PORTAL_OP_TOKEN_SOURCE?.trim();
+	if (sourceType === void 0 || sourceType.length === 0) {
+		const configuredEnvVar = env.AGENT_VM_MCP_PORTAL_OP_TOKEN_ENV_VAR?.trim();
+		const envVar = configuredEnvVar === void 0 || configuredEnvVar.length === 0 ? "OP_SERVICE_ACCOUNT_TOKEN" : configuredEnvVar;
+		const token = env[envVar]?.trim();
+		return token === void 0 || token.length === 0 ? null : {
+			envVar,
+			type: "env"
+		};
+	}
+	if (sourceType === "env") return {
+		envVar: requirePortalTokenSourceValue(env, "AGENT_VM_MCP_PORTAL_OP_TOKEN_ENV_VAR", sourceType),
+		type: "env"
+	};
+	if (sourceType === "op-cli") return {
+		ref: requirePortalTokenSourceValue(env, "AGENT_VM_MCP_PORTAL_OP_TOKEN_REF", sourceType),
+		type: "op-cli"
+	};
+	if (sourceType === "keychain") return {
+		account: requirePortalTokenSourceValue(env, "AGENT_VM_MCP_PORTAL_OP_TOKEN_KEYCHAIN_ACCOUNT", sourceType),
+		service: requirePortalTokenSourceValue(env, "AGENT_VM_MCP_PORTAL_OP_TOKEN_KEYCHAIN_SERVICE", sourceType),
+		type: "keychain"
+	};
+	throw new Error(`Unsupported AGENT_VM_MCP_PORTAL_OP_TOKEN_SOURCE "${sourceType}".`);
+}
+async function resolvePortalServiceAccountToken(props) {
+	if (props.tokenSource.type !== "env") return await props.resolveToken(props.tokenSource);
+	const envVar = props.tokenSource.envVar ?? "OP_SERVICE_ACCOUNT_TOKEN";
+	const token = props.env[envVar]?.trim();
+	if (token === void 0 || token.length === 0) throw new Error(`Environment variable ${envVar} is not set`);
+	return token;
+}
+async function createServeSecretResolver(env, dependencies = {}) {
+	const tokenSource = readPortalOnePasswordTokenSource(env);
+	const resolveToken = dependencies.resolveServiceAccountToken ?? resolveServiceAccountToken;
+	const createResolver = dependencies.createOnePasswordSecretResolver ?? createSecretResolver;
+	return createCompositeSecretResolver(tokenSource === null ? null : await createResolver({ serviceAccountToken: await resolvePortalServiceAccountToken({
+		env,
+		resolveToken,
+		tokenSource
+	}) }), env);
+}
+function parsePort(value) {
+	if (value === void 0) return;
+	const port = Number(value);
+	if (!Number.isInteger(port) || port < 0 || port > 65535) throw new Error(`Invalid --port value "${value}".`);
+	return port;
+}
+function parsePortalServerCliArgs(argv) {
+	const parsed = parseArgs({
+		args: [...argv],
+		options: {
+			agent: {
+				multiple: true,
+				type: "string"
+			},
+			"config-dir": { type: "string" },
+			port: {
+				short: "p",
+				type: "string"
+			}
+		},
+		strict: true
+	});
+	const configDir = parsed.values["config-dir"];
+	if (typeof configDir !== "string" || configDir.length === 0) throw new Error("--config-dir <path> is required.");
+	const rawAgentOverrides = parsed.values.agent;
+	const args = {
+		agentOverrides: Array.isArray(rawAgentOverrides) ? rawAgentOverrides : [],
+		configDir
+	};
+	const port = parsePort(parsed.values.port);
+	return port === void 0 ? args : {
+		...args,
+		port
+	};
+}
+function applyAgentOverrides(agents, overrides) {
+	const nextAgents = { ...agents };
+	for (const override of overrides) {
+		const [agentId, profileName, extra] = override.split("=");
+		if (agentId === void 0 || profileName === void 0 || extra !== void 0 || agentId.length === 0 || profileName.length === 0) throw new Error(`Invalid --agent override "${override}". Expected <agentId>=<profile>.`);
+		const existingAgent = nextAgents[agentId];
+		if (existingAgent === void 0) throw new Error(`Cannot override unknown MCP Portal agent "${agentId}".`);
+		nextAgents[agentId] = {
+			...existingAgent,
+			profile: profileName
+		};
+	}
+	return nextAgents;
+}
+function createDeferredPort() {
+	let rejectPort;
+	let resolvePort;
+	return {
+		promise: new Promise((resolve, reject) => {
+			rejectPort = reject;
+			resolvePort = resolve;
+		}),
+		reject: (error) => {
+			if (rejectPort === void 0) throw new Error("MCP Portal port rejector was not initialized.");
+			rejectPort(error);
+		},
+		resolve: (port) => {
+			if (resolvePort === void 0) throw new Error("MCP Portal port resolver was not initialized.");
+			resolvePort(port);
+		}
+	};
+}
+function defaultPortalServerLogger() {
+	return { log: (event) => {
+		process.stderr.write(`${JSON.stringify(event)}\n`);
+	} };
+}
+function handlePortalServerError(props) {
+	props.logger.log({
+		event: "server_error",
+		level: "error",
+		message: props.error.message,
+		...props.error.stack === void 0 ? {} : { stack: props.error.stack }
+	});
+	if (!props.hasListened) props.listeningPort.reject(props.error);
+}
+function closeNodeServer(server) {
+	return new Promise((resolve, reject) => {
+		server.close((error) => {
+			if (error) reject(error);
+			else resolve();
+		});
+	});
+}
+function selectorsFromNamespaceTools(namespaceTools) {
+	return Object.entries(namespaceTools).flatMap(([namespace, toolNames]) => toolNames.map((toolName) => ({
+		namespace,
+		toolName
+	})));
+}
+function buildProfilePolicyMaps(portalConfig) {
+	const enabledNamespacesByAgent = {};
+	const enabledToolsByAgent = {};
+	const hiddenToolsByAgent = {};
+	const profileTtls = [];
+	for (const [agentId, agent] of Object.entries(portalConfig.agents)) {
+		const profile = resolveMcpPortalProfile(portalConfig, agent.profile);
+		enabledNamespacesByAgent[agentId] = profile.enabledNamespaces;
+		enabledToolsByAgent[agentId] = selectorsFromNamespaceTools(profile.enabledToolsByNamespace);
+		hiddenToolsByAgent[agentId] = selectorsFromNamespaceTools(profile.hiddenToolsByNamespace);
+		profileTtls.push(profile.cache.catalogTtlMs);
+	}
+	return {
+		cacheTtlMs: profileTtls.length === 0 ? 6e4 : Math.min(...profileTtls),
+		enabledNamespacesByAgent,
+		enabledToolsByAgent,
+		hiddenToolsByAgent
+	};
+}
+function withAgentOverrides(portalConfig, agentOverrides) {
+	return {
+		...portalConfig,
+		agents: applyAgentOverrides(portalConfig.agents, agentOverrides)
+	};
+}
+function requireProxyConfig(portalConfig) {
+	if (portalConfig.externalAuth === void 0 || portalConfig.mcpProxy === void 0) throw new Error("mcp-proxy startup requires mcp-portal.config.jsonc externalAuth.masterKey and mcpProxy settings.");
+	return {
+		externalAuth: portalConfig.externalAuth,
+		mcpProxy: portalConfig.mcpProxy
+	};
+}
+function deriveApprovalHmacKeysFromMasterKey(props) {
+	return new Map(props.agentIds.map((agentId) => [agentId, createHmac("sha256", props.masterKey).update(`mcp-portal:approval-agent:${agentId}`).digest()]));
+}
+function credentialVersionsByAgent(portalConfig) {
+	return Object.fromEntries(Object.entries(portalConfig.agents).map(([agentId, agent]) => [agentId, agent.credentialVersion]));
+}
+async function startPortalServer(props) {
+	const logger = props.logger ?? defaultPortalServerLogger();
+	const serveFn = props.serveFn ?? serve;
+	let defaultSecretResolverPromise;
+	const getDefaultSecretResolver = () => {
+		defaultSecretResolverPromise ??= createServeSecretResolver(props.env);
+		return defaultSecretResolverPromise;
+	};
+	const resolveSecret = props.resolveSecret ?? (async (secret) => resolveSecretValue(secret, {
+		env: props.env,
+		secretResolver: await getDefaultSecretResolver()
+	}));
+	const mcpConfig = await loadMcpConfig(join(props.args.configDir, "mcp.config.jsonc"));
+	const portalConfig = withAgentOverrides(await loadMcpPortalConfig(join(props.args.configDir, "mcp-portal.config.jsonc")), props.args.agentOverrides);
+	const proxyStartup = requireProxyConfig(portalConfig);
+	const masterKey = decodePortalMasterKey(await resolveSecret(proxyStartup.externalAuth.masterKey));
+	const agentRecords = createPortalAgentRuntimeRecords({
+		hmacKeys: deriveApprovalHmacKeysFromMasterKey({
+			agentIds: Object.keys(portalConfig.agents),
+			masterKey
+		}),
+		portalConfig
+	});
+	const upstreamServers = await resolveUpstreamServers({
+		config: mcpConfig,
+		resolveSecret
+	});
+	const upstreamRuntime = createUpstreamMcpClientRuntime({
+		additionalRedactionValues: [masterKey.toString("base64url")],
+		onCloseError: (error, context) => {
+			logger.log({
+				agentScopeId: context.agentScopeId,
+				event: "upstream_close_error",
+				level: "warn",
+				message: error.message,
+				...context.namespace === void 0 ? {} : { namespace: context.namespace }
+			});
+		},
+		servers: upstreamServers
+	});
+	const profilePolicyMaps = buildProfilePolicyMaps(portalConfig);
+	const verifyApproval = createPortalApprovalVerifier({
+		auditErrorSink: (error, event) => {
+			logger.log({
+				agentId: event.agentId,
+				event: "mcp_portal_approval_audit_error",
+				level: "warn",
+				message: error.message,
+				timeMs: event.timeMs
+			});
+		},
+		auditSink: (event) => {
+			logger.log({
+				agentId: event.agentId,
+				decision: event.decision,
+				event: "mcp_portal_approval",
+				level: event.decision === "allow" ? "info" : "warn",
+				..."reason" in event ? { reason: event.reason } : {},
+				timeMs: event.timeMs,
+				..."verifierReason" in event ? { verifierReason: event.verifierReason } : {}
+			});
+		},
+		records: agentRecords
+	});
+	const core = createPortalCore({
+		accessPolicy: {
+			defaultPolicy: "deny-all",
+			enabledNamespacesByAgent: profilePolicyMaps.enabledNamespacesByAgent,
+			enabledToolsByAgent: profilePolicyMaps.enabledToolsByAgent,
+			hiddenToolsByAgent: profilePolicyMaps.hiddenToolsByAgent
+		},
+		approval: (calls, identity, approvalToken) => verifyApproval(calls, identity.agentId, approvalToken),
+		catalogTtlMs: profilePolicyMaps.cacheTtlMs,
+		runtime: {
+			...upstreamRuntime,
+			callUpstreamTool: upstreamRuntime.callTool
+		},
+		upstreamNamespaces: upstreamServers.map((server) => server.namespace)
+	});
+	const app = createPortalHttpApp({
+		agentBearerAuth: {
+			authorizationHeaderName: proxyStartup.mcpProxy.auth.headerName,
+			credentialVersionsByAgent: credentialVersionsByAgent(portalConfig),
+			masterKey
+		},
+		auditSink: (event) => {
+			logger.log({
+				agentId: event.agentId,
+				clientAddress: event.clientAddress,
+				decision: event.decision,
+				event: "mcp_proxy_auth",
+				level: event.decision === "allow" ? "info" : "warn",
+				...event.reason === void 0 ? {} : { reason: event.reason },
+				timeMs: event.timeMs
+			});
+		},
+		auditErrorSink: (error, event) => {
+			logger.log({
+				agentId: event.agentId,
+				clientAddress: event.clientAddress,
+				event: "mcp_proxy_auth_audit_error",
+				level: "warn",
+				message: error.message,
+				timeMs: event.timeMs
+			});
+		},
+		core,
+		onSessionClosed: async (identity) => {
+			await core.invalidateSession(identity);
+		},
+		registeredAgentIds: Object.keys(portalConfig.agents),
+		resolveAgentIdentity: createPortalHttpAgentResolver(agentRecords)
+	});
+	const listeningPort = createDeferredPort();
+	let hasListened = false;
+	const server = serveFn({
+		fetch: app.fetch,
+		hostname: proxyStartup.mcpProxy.server.host,
+		port: props.args.port ?? proxyStartup.mcpProxy.server.port
+	}, (info) => {
+		hasListened = true;
+		process.stdout.write(`listening port=${String(info.port)}\n`);
+		listeningPort.resolve(info.port);
+	});
+	server.on("error", (error) => {
+		handlePortalServerError({
+			error,
+			hasListened,
+			listeningPort,
+			logger
+		});
+	});
+	return {
+		close: async () => {
+			await app.closePortalSessions();
+			await core.close();
+			await closeNodeServer(server);
+		},
+		port: await listeningPort.promise
+	};
+}
+//#endregion
+export { handlePortalServerError as a, resolveSecretValue as c, deriveApprovalHmacKeysFromMasterKey as i, buildProfilePolicyMaps as n, parsePortalServerCliArgs as o, createServeSecretResolver as r, startPortalServer as s, applyAgentOverrides as t };
+
+//# sourceMappingURL=serve-command-CnSMUybd.js.map

package/dist/serve-command-CnSMUybd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-command-CnSMUybd.js","names":["createOnePasswordSecretResolver"],"sources":["../src/bin/secret-value-resolver.ts","../src/cli/serve-command.ts"],"sourcesContent":["import type { SecretValue } from '@agent-vm/config-contracts';\nimport type { SecretRef, SecretResolver } from '@agent-vm/secrets';\n\nexport interface ResolveSecretValueProps {\n\treadonly env: Readonly<Record<string, string | undefined>>;\n\treadonly secretResolver?: SecretResolver;\n}\n\nfunction secretRefFromSecretValue(secret: SecretValue): SecretRef {\n\tif (secret.source === 'environment') {\n\t\treturn { ref: secret.name, source: 'environment' };\n\t}\n\treturn { ref: secret.ref, source: '1password' };\n}\n\nexport async function resolveSecretValue(\n\tsecret: SecretValue,\n\tprops: ResolveSecretValueProps,\n): Promise<string> {\n\tif (secret.source === 'environment') {\n\t\tconst value = props.env[secret.name];\n\t\tif (value === undefined || value.length === 0) {\n\t\t\tthrow new Error(`Missing environment secret ${secret.name}.`);\n\t\t}\n\t\treturn value;\n\t}\n\n\tif (props.secretResolver === undefined) {\n\t\tthrow new Error(\"Secret with source '1password' requires a configured secret resolver.\");\n\t}\n\treturn await props.secretResolver.resolve(secretRefFromSecretValue(secret));\n}\n","import { createHmac } from 'node:crypto';\nimport { join } from 'node:path';\nimport { parseArgs } from 'node:util';\n\nimport {\n\tloadMcpConfig,\n\tloadMcpPortalConfig,\n\tresolveMcpPortalProfile,\n\ttype McpPortalAgentConfig,\n\ttype McpPortalConfig,\n\ttype McpPortalExternalAuthConfig,\n\ttype McpPortalProxyConfig,\n\ttype ResolvedMcpPortalProfile,\n\ttype SecretValue,\n} from '@agent-vm/config-contracts';\nimport {\n\tcreateCompositeSecretResolver,\n\tcreateSecretResolver as createOnePasswordSecretResolver,\n\tresolveServiceAccountToken,\n\ttype SecretResolver,\n\ttype TokenSource,\n} from '@agent-vm/secrets';\nimport { serve } from '@hono/node-server';\n\nimport { resolveSecretValue } from '../bin/secret-value-resolver.js';\nimport { createPortalCore } from '../core/portal-core.js';\nimport { resolveUpstreamServers } from '../core/provider-runtime.js';\nimport { createPortalHttpApp, type PortalHttpAuditEvent } from '../mcp-proxy/portal-http-server.js';\nimport {\n\tcreatePortalAgentRuntimeRecords,\n\tcreatePortalApprovalVerifier,\n\tcreatePortalHttpAgentResolver,\n\ttype PortalApprovalAuditEvent,\n} from '../mcp-proxy/resolve-agent-identity.js';\nimport type { PortalToolSelector } from '../portal-access-policy.js';\nimport { decodePortalMasterKey } from '../portal-auth/agent-bearer-token.js';\nimport { createUpstreamMcpClientRuntime } from '../upstream-mcp-client-runtime.js';\n\ntype PortalNodeServer = ReturnType<typeof serve>;\ntype PortalServeFunction = typeof serve;\n\nexport type PortalServerLogEvent =\n\t| {\n\t\t\treadonly event: 'server_error';\n\t\t\treadonly level: 'error';\n\t\t\treadonly message: string;\n\t\t\treadonly stack?: string;\n\t  }\n\t| {\n\t\t\treadonly agentId: string;\n\t\t\treadonly clientAddress: string;\n\t\t\treadonly decision: PortalHttpAuditEvent['decision'];\n\t\t\treadonly event: 'mcp_proxy_auth';\n\t\t\treadonly level: 'info' | 'warn';\n\t\t\treadonly reason?: PortalHttpAuditEvent['reason'];\n\t\t\treadonly timeMs: number;\n\t  }\n\t| {\n\t\t\treadonly agentId: string;\n\t\t\treadonly clientAddress: string;\n\t\t\treadonly event: 'mcp_proxy_auth_audit_error';\n\t\t\treadonly level: 'warn';\n\t\t\treadonly message: string;\n\t\t\treadonly timeMs: number;\n\t  }\n\t| {\n\t\t\treadonly agentId: string;\n\t\t\treadonly decision: PortalApprovalAuditEvent['decision'];\n\t\t\treadonly event: 'mcp_portal_approval';\n\t\t\treadonly level: 'info' | 'warn';\n\t\t\treadonly reason?: PortalApprovalAuditEvent['reason'];\n\t\t\treadonly timeMs: number;\n\t\t\treadonly verifierReason?: string;\n\t  }\n\t| {\n\t\t\treadonly agentId: string;\n\t\t\treadonly event: 'mcp_portal_approval_audit_error';\n\t\t\treadonly level: 'warn';\n\t\t\treadonly message: string;\n\t\t\treadonly timeMs: number;\n\t  }\n\t| {\n\t\t\treadonly agentScopeId: string;\n\t\t\treadonly event: 'upstream_close_error';\n\t\t\treadonly level: 'warn';\n\t\t\treadonly message: string;\n\t\t\treadonly namespace?: string;\n\t  };\n\nexport interface PortalServerLogger {\n\treadonly log: (event: PortalServerLogEvent) => void;\n}\n\nexport interface PortalServerCliArgs {\n\treadonly agentOverrides: readonly string[];\n\treadonly configDir: string;\n\treadonly port?: number;\n}\n\nexport interface StartPortalServerProps {\n\treadonly args: PortalServerCliArgs;\n\treadonly env: Readonly<Record<string, string | undefined>>;\n\treadonly logger?: PortalServerLogger;\n\treadonly resolveSecret?: (secret: SecretValue) => Promise<string>;\n\treadonly serveFn?: PortalServeFunction;\n}\n\nexport interface CreateServeSecretResolverDependencies {\n\treadonly createOnePasswordSecretResolver?: typeof createOnePasswordSecretResolver;\n\treadonly resolveServiceAccountToken?: typeof resolveServiceAccountToken;\n}\n\nfunction requirePortalTokenSourceValue(\n\tenv: Readonly<Record<string, string | undefined>>,\n\tname: string,\n\tsourceType: string,\n): string {\n\tconst value = env[name]?.trim();\n\tif (value === undefined || value.length === 0) {\n\t\tthrow new Error(`${name} is required when AGENT_VM_MCP_PORTAL_OP_TOKEN_SOURCE=${sourceType}.`);\n\t}\n\treturn value;\n}\n\nfunction readPortalOnePasswordTokenSource(\n\tenv: Readonly<Record<string, string | undefined>>,\n): TokenSource | null {\n\tconst sourceType = env.AGENT_VM_MCP_PORTAL_OP_TOKEN_SOURCE?.trim();\n\tif (sourceType === undefined || sourceType.length === 0) {\n\t\tconst configuredEnvVar = env.AGENT_VM_MCP_PORTAL_OP_TOKEN_ENV_VAR?.trim();\n\t\tconst envVar =\n\t\t\tconfiguredEnvVar === undefined || configuredEnvVar.length === 0\n\t\t\t\t? 'OP_SERVICE_ACCOUNT_TOKEN'\n\t\t\t\t: configuredEnvVar;\n\t\tconst token = env[envVar]?.trim();\n\t\treturn token === undefined || token.length === 0 ? null : { envVar, type: 'env' };\n\t}\n\n\tif (sourceType === 'env') {\n\t\treturn {\n\t\t\tenvVar: requirePortalTokenSourceValue(\n\t\t\t\tenv,\n\t\t\t\t'AGENT_VM_MCP_PORTAL_OP_TOKEN_ENV_VAR',\n\t\t\t\tsourceType,\n\t\t\t),\n\t\t\ttype: 'env',\n\t\t};\n\t}\n\tif (sourceType === 'op-cli') {\n\t\treturn {\n\t\t\tref: requirePortalTokenSourceValue(env, 'AGENT_VM_MCP_PORTAL_OP_TOKEN_REF', sourceType),\n\t\t\ttype: 'op-cli',\n\t\t};\n\t}\n\tif (sourceType === 'keychain') {\n\t\treturn {\n\t\t\taccount: requirePortalTokenSourceValue(\n\t\t\t\tenv,\n\t\t\t\t'AGENT_VM_MCP_PORTAL_OP_TOKEN_KEYCHAIN_ACCOUNT',\n\t\t\t\tsourceType,\n\t\t\t),\n\t\t\tservice: requirePortalTokenSourceValue(\n\t\t\t\tenv,\n\t\t\t\t'AGENT_VM_MCP_PORTAL_OP_TOKEN_KEYCHAIN_SERVICE',\n\t\t\t\tsourceType,\n\t\t\t),\n\t\t\ttype: 'keychain',\n\t\t};\n\t}\n\n\tthrow new Error(`Unsupported AGENT_VM_MCP_PORTAL_OP_TOKEN_SOURCE \"${sourceType}\".`);\n}\n\nasync function resolvePortalServiceAccountToken(props: {\n\treadonly env: Readonly<Record<string, string | undefined>>;\n\treadonly resolveToken: typeof resolveServiceAccountToken;\n\treadonly tokenSource: TokenSource;\n}): Promise<string> {\n\tif (props.tokenSource.type !== 'env') {\n\t\treturn await props.resolveToken(props.tokenSource);\n\t}\n\tconst envVar = props.tokenSource.envVar ?? 'OP_SERVICE_ACCOUNT_TOKEN';\n\tconst token = props.env[envVar]?.trim();\n\tif (token === undefined || token.length === 0) {\n\t\tthrow new Error(`Environment variable ${envVar} is not set`);\n\t}\n\treturn token;\n}\n\nexport async function createServeSecretResolver(\n\tenv: Readonly<Record<string, string | undefined>>,\n\tdependencies: CreateServeSecretResolverDependencies = {},\n): Promise<SecretResolver> {\n\tconst tokenSource = readPortalOnePasswordTokenSource(env);\n\tconst resolveToken = dependencies.resolveServiceAccountToken ?? resolveServiceAccountToken;\n\tconst createResolver =\n\t\tdependencies.createOnePasswordSecretResolver ?? createOnePasswordSecretResolver;\n\tconst onePasswordResolver =\n\t\ttokenSource === null\n\t\t\t? null\n\t\t\t: await createResolver({\n\t\t\t\t\tserviceAccountToken: await resolvePortalServiceAccountToken({\n\t\t\t\t\t\tenv,\n\t\t\t\t\t\tresolveToken,\n\t\t\t\t\t\ttokenSource,\n\t\t\t\t\t}),\n\t\t\t\t});\n\treturn createCompositeSecretResolver(onePasswordResolver, env);\n}\n\nexport interface ProfilePolicyMaps {\n\treadonly enabledNamespacesByAgent: Readonly<Record<string, readonly string[]>>;\n\treadonly enabledToolsByAgent: Readonly<Record<string, readonly PortalToolSelector[]>>;\n\treadonly hiddenToolsByAgent: Readonly<Record<string, readonly PortalToolSelector[]>>;\n}\n\nfunction parsePort(value: string | undefined): number | undefined {\n\tif (value === undefined) {\n\t\treturn undefined;\n\t}\n\tconst port = Number(value);\n\tif (!Number.isInteger(port) || port < 0 || port > 65_535) {\n\t\tthrow new Error(`Invalid --port value \"${value}\".`);\n\t}\n\treturn port;\n}\n\nexport function parsePortalServerCliArgs(argv: readonly string[]): PortalServerCliArgs {\n\tconst parsed = parseArgs({\n\t\targs: [...argv],\n\t\toptions: {\n\t\t\tagent: { multiple: true, type: 'string' },\n\t\t\t'config-dir': { type: 'string' },\n\t\t\tport: { short: 'p', type: 'string' },\n\t\t},\n\t\tstrict: true,\n\t});\n\tconst configDir = parsed.values['config-dir'];\n\tif (typeof configDir !== 'string' || configDir.length === 0) {\n\t\tthrow new Error('--config-dir <path> is required.');\n\t}\n\tconst rawAgentOverrides = parsed.values.agent;\n\tconst args = {\n\t\tagentOverrides: Array.isArray(rawAgentOverrides) ? rawAgentOverrides : [],\n\t\tconfigDir,\n\t};\n\tconst port = parsePort(parsed.values.port);\n\treturn port === undefined ? args : { ...args, port };\n}\n\nexport function applyAgentOverrides(\n\tagents: Readonly<Record<string, McpPortalAgentConfig>>,\n\toverrides: readonly string[],\n): Readonly<Record<string, McpPortalAgentConfig>> {\n\tconst nextAgents: Record<string, McpPortalAgentConfig> = { ...agents };\n\tfor (const override of overrides) {\n\t\tconst [agentId, profileName, extra] = override.split('=');\n\t\tif (\n\t\t\tagentId === undefined ||\n\t\t\tprofileName === undefined ||\n\t\t\textra !== undefined ||\n\t\t\tagentId.length === 0 ||\n\t\t\tprofileName.length === 0\n\t\t) {\n\t\t\tthrow new Error(`Invalid --agent override \"${override}\". Expected <agentId>=<profile>.`);\n\t\t}\n\t\tconst existingAgent = nextAgents[agentId];\n\t\tif (existingAgent === undefined) {\n\t\t\tthrow new Error(`Cannot override unknown MCP Portal agent \"${agentId}\".`);\n\t\t}\n\t\tnextAgents[agentId] = { ...existingAgent, profile: profileName };\n\t}\n\treturn nextAgents;\n}\n\nexport interface DeferredPort {\n\treadonly promise: Promise<number>;\n\treadonly reject: (error: Error) => void;\n\treadonly resolve: (port: number) => void;\n}\n\nfunction createDeferredPort(): DeferredPort {\n\tlet rejectPort: ((error: Error) => void) | undefined;\n\tlet resolvePort: ((port: number) => void) | undefined;\n\tconst promise = new Promise<number>((resolve, reject) => {\n\t\trejectPort = reject;\n\t\tresolvePort = resolve;\n\t});\n\treturn {\n\t\tpromise,\n\t\treject: (error) => {\n\t\t\tif (rejectPort === undefined) {\n\t\t\t\tthrow new Error('MCP Portal port rejector was not initialized.');\n\t\t\t}\n\t\t\trejectPort(error);\n\t\t},\n\t\tresolve: (port) => {\n\t\t\tif (resolvePort === undefined) {\n\t\t\t\tthrow new Error('MCP Portal port resolver was not initialized.');\n\t\t\t}\n\t\t\tresolvePort(port);\n\t\t},\n\t};\n}\n\nfunction defaultPortalServerLogger(): PortalServerLogger {\n\treturn {\n\t\tlog: (event) => {\n\t\t\tprocess.stderr.write(`${JSON.stringify(event)}\\n`);\n\t\t},\n\t};\n}\n\nexport function handlePortalServerError(props: {\n\treadonly error: Error;\n\treadonly hasListened: boolean;\n\treadonly listeningPort: DeferredPort;\n\treadonly logger: PortalServerLogger;\n}): void {\n\tprops.logger.log({\n\t\tevent: 'server_error',\n\t\tlevel: 'error',\n\t\tmessage: props.error.message,\n\t\t...(props.error.stack === undefined ? {} : { stack: props.error.stack }),\n\t});\n\tif (!props.hasListened) {\n\t\tprops.listeningPort.reject(props.error);\n\t}\n}\n\nfunction closeNodeServer(server: PortalNodeServer): Promise<void> {\n\treturn new Promise<void>((resolve, reject) => {\n\t\tserver.close((error) => {\n\t\t\tif (error) {\n\t\t\t\treject(error);\n\t\t\t} else {\n\t\t\t\tresolve();\n\t\t\t}\n\t\t});\n\t});\n}\n\nfunction selectorsFromNamespaceTools(\n\tnamespaceTools: Readonly<Record<string, readonly string[]>>,\n): readonly PortalToolSelector[] {\n\treturn Object.entries(namespaceTools).flatMap(([namespace, toolNames]) =>\n\t\ttoolNames.map((toolName) => ({ namespace, toolName })),\n\t);\n}\n\nexport function buildProfilePolicyMaps(\n\tportalConfig: McpPortalConfig,\n): ProfilePolicyMaps & { readonly cacheTtlMs: number } {\n\tconst enabledNamespacesByAgent: Record<string, readonly string[]> = {};\n\tconst enabledToolsByAgent: Record<string, readonly PortalToolSelector[]> = {};\n\tconst hiddenToolsByAgent: Record<string, readonly PortalToolSelector[]> = {};\n\tconst profileTtls: number[] = [];\n\n\tfor (const [agentId, agent] of Object.entries(portalConfig.agents)) {\n\t\tconst profile: ResolvedMcpPortalProfile = resolveMcpPortalProfile(portalConfig, agent.profile);\n\t\tenabledNamespacesByAgent[agentId] = profile.enabledNamespaces;\n\t\tenabledToolsByAgent[agentId] = selectorsFromNamespaceTools(profile.enabledToolsByNamespace);\n\t\thiddenToolsByAgent[agentId] = selectorsFromNamespaceTools(profile.hiddenToolsByNamespace);\n\t\tprofileTtls.push(profile.cache.catalogTtlMs);\n\t}\n\n\treturn {\n\t\tcacheTtlMs: profileTtls.length === 0 ? 60_000 : Math.min(...profileTtls),\n\t\tenabledNamespacesByAgent,\n\t\tenabledToolsByAgent,\n\t\thiddenToolsByAgent,\n\t};\n}\n\nfunction withAgentOverrides(\n\tportalConfig: McpPortalConfig,\n\tagentOverrides: readonly string[],\n): McpPortalConfig {\n\treturn {\n\t\t...portalConfig,\n\t\tagents: applyAgentOverrides(portalConfig.agents, agentOverrides),\n\t};\n}\n\nfunction requireProxyConfig(portalConfig: McpPortalConfig): {\n\treadonly externalAuth: McpPortalExternalAuthConfig;\n\treadonly mcpProxy: McpPortalProxyConfig;\n} {\n\tif (portalConfig.externalAuth === undefined || portalConfig.mcpProxy === undefined) {\n\t\tthrow new Error(\n\t\t\t'mcp-proxy startup requires mcp-portal.config.jsonc externalAuth.masterKey and mcpProxy settings.',\n\t\t);\n\t}\n\treturn {\n\t\texternalAuth: portalConfig.externalAuth,\n\t\tmcpProxy: portalConfig.mcpProxy,\n\t};\n}\n\nexport function deriveApprovalHmacKeysFromMasterKey(props: {\n\treadonly agentIds: readonly string[];\n\treadonly masterKey: Buffer;\n}): ReadonlyMap<string, Buffer> {\n\treturn new Map(\n\t\tprops.agentIds.map((agentId) => [\n\t\t\tagentId,\n\t\t\tcreateHmac('sha256', props.masterKey).update(`mcp-portal:approval-agent:${agentId}`).digest(),\n\t\t]),\n\t);\n}\n\nfunction credentialVersionsByAgent(\n\tportalConfig: McpPortalConfig,\n): Readonly<Record<string, number>> {\n\treturn Object.fromEntries(\n\t\tObject.entries(portalConfig.agents).map(([agentId, agent]) => [\n\t\t\tagentId,\n\t\t\tagent.credentialVersion,\n\t\t]),\n\t);\n}\n\nexport async function startPortalServer(\n\tprops: StartPortalServerProps,\n): Promise<{ readonly close: () => Promise<void>; readonly port: number }> {\n\tconst logger = props.logger ?? defaultPortalServerLogger();\n\tconst serveFn = props.serveFn ?? serve;\n\tlet defaultSecretResolverPromise: Promise<SecretResolver> | undefined;\n\tconst getDefaultSecretResolver = (): Promise<SecretResolver> => {\n\t\tdefaultSecretResolverPromise ??= createServeSecretResolver(props.env);\n\t\treturn defaultSecretResolverPromise;\n\t};\n\tconst resolveSecret =\n\t\tprops.resolveSecret ??\n\t\t(async (secret: SecretValue) =>\n\t\t\tresolveSecretValue(secret, {\n\t\t\t\tenv: props.env,\n\t\t\t\tsecretResolver: await getDefaultSecretResolver(),\n\t\t\t}));\n\tconst mcpConfig = await loadMcpConfig(join(props.args.configDir, 'mcp.config.jsonc'));\n\tconst portalConfig = withAgentOverrides(\n\t\tawait loadMcpPortalConfig(join(props.args.configDir, 'mcp-portal.config.jsonc')),\n\t\tprops.args.agentOverrides,\n\t);\n\tconst proxyStartup = requireProxyConfig(portalConfig);\n\tconst masterKey = decodePortalMasterKey(await resolveSecret(proxyStartup.externalAuth.masterKey));\n\tconst hmacKeys = deriveApprovalHmacKeysFromMasterKey({\n\t\tagentIds: Object.keys(portalConfig.agents),\n\t\tmasterKey,\n\t});\n\tconst agentRecords = createPortalAgentRuntimeRecords({ hmacKeys, portalConfig });\n\tconst upstreamServers = await resolveUpstreamServers({ config: mcpConfig, resolveSecret });\n\tconst upstreamRuntime = createUpstreamMcpClientRuntime({\n\t\tadditionalRedactionValues: [masterKey.toString('base64url')],\n\t\tonCloseError: (error, context) => {\n\t\t\tlogger.log({\n\t\t\t\tagentScopeId: context.agentScopeId,\n\t\t\t\tevent: 'upstream_close_error',\n\t\t\t\tlevel: 'warn',\n\t\t\t\tmessage: error.message,\n\t\t\t\t...(context.namespace === undefined ? {} : { namespace: context.namespace }),\n\t\t\t});\n\t\t},\n\t\tservers: upstreamServers,\n\t});\n\tconst profilePolicyMaps = buildProfilePolicyMaps(portalConfig);\n\tconst verifyApproval = createPortalApprovalVerifier({\n\t\tauditErrorSink: (error, event) => {\n\t\t\tlogger.log({\n\t\t\t\tagentId: event.agentId,\n\t\t\t\tevent: 'mcp_portal_approval_audit_error',\n\t\t\t\tlevel: 'warn',\n\t\t\t\tmessage: error.message,\n\t\t\t\ttimeMs: event.timeMs,\n\t\t\t});\n\t\t},\n\t\tauditSink: (event) => {\n\t\t\tlogger.log({\n\t\t\t\tagentId: event.agentId,\n\t\t\t\tdecision: event.decision,\n\t\t\t\tevent: 'mcp_portal_approval',\n\t\t\t\tlevel: event.decision === 'allow' ? 'info' : 'warn',\n\t\t\t\t...('reason' in event ? { reason: event.reason } : {}),\n\t\t\t\ttimeMs: event.timeMs,\n\t\t\t\t...('verifierReason' in event ? { verifierReason: event.verifierReason } : {}),\n\t\t\t});\n\t\t},\n\t\trecords: agentRecords,\n\t});\n\tconst core = createPortalCore({\n\t\taccessPolicy: {\n\t\t\tdefaultPolicy: 'deny-all',\n\t\t\tenabledNamespacesByAgent: profilePolicyMaps.enabledNamespacesByAgent,\n\t\t\tenabledToolsByAgent: profilePolicyMaps.enabledToolsByAgent,\n\t\t\thiddenToolsByAgent: profilePolicyMaps.hiddenToolsByAgent,\n\t\t},\n\t\tapproval: (calls, identity, approvalToken) =>\n\t\t\tverifyApproval(calls, identity.agentId, approvalToken),\n\t\tcatalogTtlMs: profilePolicyMaps.cacheTtlMs,\n\t\truntime: {\n\t\t\t...upstreamRuntime,\n\t\t\tcallUpstreamTool: upstreamRuntime.callTool,\n\t\t},\n\t\tupstreamNamespaces: upstreamServers.map((server) => server.namespace),\n\t});\n\tconst app = createPortalHttpApp({\n\t\tagentBearerAuth: {\n\t\t\tauthorizationHeaderName: proxyStartup.mcpProxy.auth.headerName,\n\t\t\tcredentialVersionsByAgent: credentialVersionsByAgent(portalConfig),\n\t\t\tmasterKey,\n\t\t},\n\t\tauditSink: (event) => {\n\t\t\tlogger.log({\n\t\t\t\tagentId: event.agentId,\n\t\t\t\tclientAddress: event.clientAddress,\n\t\t\t\tdecision: event.decision,\n\t\t\t\tevent: 'mcp_proxy_auth',\n\t\t\t\tlevel: event.decision === 'allow' ? 'info' : 'warn',\n\t\t\t\t...(event.reason === undefined ? {} : { reason: event.reason }),\n\t\t\t\ttimeMs: event.timeMs,\n\t\t\t});\n\t\t},\n\t\tauditErrorSink: (error, event) => {\n\t\t\tlogger.log({\n\t\t\t\tagentId: event.agentId,\n\t\t\t\tclientAddress: event.clientAddress,\n\t\t\t\tevent: 'mcp_proxy_auth_audit_error',\n\t\t\t\tlevel: 'warn',\n\t\t\t\tmessage: error.message,\n\t\t\t\ttimeMs: event.timeMs,\n\t\t\t});\n\t\t},\n\t\tcore,\n\t\tonSessionClosed: async (identity) => {\n\t\t\tawait core.invalidateSession(identity);\n\t\t},\n\t\tregisteredAgentIds: Object.keys(portalConfig.agents),\n\t\tresolveAgentIdentity: createPortalHttpAgentResolver(agentRecords),\n\t});\n\tconst listeningPort = createDeferredPort();\n\tlet hasListened = false;\n\tconst server = serveFn(\n\t\t{\n\t\t\tfetch: app.fetch,\n\t\t\thostname: proxyStartup.mcpProxy.server.host,\n\t\t\tport: props.args.port ?? proxyStartup.mcpProxy.server.port,\n\t\t},\n\t\t(info) => {\n\t\t\thasListened = true;\n\t\t\tprocess.stdout.write(`listening port=${String(info.port)}\\n`);\n\t\t\tlisteningPort.resolve(info.port);\n\t\t},\n\t);\n\tserver.on('error', (error: Error) => {\n\t\thandlePortalServerError({ error, hasListened, listeningPort, logger });\n\t});\n\tconst port = await listeningPort.promise;\n\n\treturn {\n\t\tclose: async () => {\n\t\t\tawait app.closePortalSessions();\n\t\t\tawait core.close();\n\t\t\tawait closeNodeServer(server);\n\t\t},\n\t\tport,\n\t};\n}\n"],"mappings":";;;;;;;;;;;AAQA,SAAS,yBAAyB,QAAgC;CACjE,IAAI,OAAO,WAAW,eACrB,OAAO;EAAE,KAAK,OAAO;EAAM,QAAQ;EAAe;CAEnD,OAAO;EAAE,KAAK,OAAO;EAAK,QAAQ;EAAa;;AAGhD,eAAsB,mBACrB,QACA,OACkB;CAClB,IAAI,OAAO,WAAW,eAAe;EACpC,MAAM,QAAQ,MAAM,IAAI,OAAO;EAC/B,IAAI,UAAU,KAAA,KAAa,MAAM,WAAW,GAC3C,MAAM,IAAI,MAAM,8BAA8B,OAAO,KAAK,GAAG;EAE9D,OAAO;;CAGR,IAAI,MAAM,mBAAmB,KAAA,GAC5B,MAAM,IAAI,MAAM,wEAAwE;CAEzF,OAAO,MAAM,MAAM,eAAe,QAAQ,yBAAyB,OAAO,CAAC;;;;ACkF5E,SAAS,8BACR,KACA,MACA,YACS;CACT,MAAM,QAAQ,IAAI,OAAO,MAAM;CAC/B,IAAI,UAAU,KAAA,KAAa,MAAM,WAAW,GAC3C,MAAM,IAAI,MAAM,GAAG,KAAK,wDAAwD,WAAW,GAAG;CAE/F,OAAO;;AAGR,SAAS,iCACR,KACqB;CACrB,MAAM,aAAa,IAAI,qCAAqC,MAAM;CAClE,IAAI,eAAe,KAAA,KAAa,WAAW,WAAW,GAAG;EACxD,MAAM,mBAAmB,IAAI,sCAAsC,MAAM;EACzE,MAAM,SACL,qBAAqB,KAAA,KAAa,iBAAiB,WAAW,IAC3D,6BACA;EACJ,MAAM,QAAQ,IAAI,SAAS,MAAM;EACjC,OAAO,UAAU,KAAA,KAAa,MAAM,WAAW,IAAI,OAAO;GAAE;GAAQ,MAAM;GAAO;;CAGlF,IAAI,eAAe,OAClB,OAAO;EACN,QAAQ,8BACP,KACA,wCACA,WACA;EACD,MAAM;EACN;CAEF,IAAI,eAAe,UAClB,OAAO;EACN,KAAK,8BAA8B,KAAK,oCAAoC,WAAW;EACvF,MAAM;EACN;CAEF,IAAI,eAAe,YAClB,OAAO;EACN,SAAS,8BACR,KACA,iDACA,WACA;EACD,SAAS,8BACR,KACA,iDACA,WACA;EACD,MAAM;EACN;CAGF,MAAM,IAAI,MAAM,oDAAoD,WAAW,IAAI;;AAGpF,eAAe,iCAAiC,OAI5B;CACnB,IAAI,MAAM,YAAY,SAAS,OAC9B,OAAO,MAAM,MAAM,aAAa,MAAM,YAAY;CAEnD,MAAM,SAAS,MAAM,YAAY,UAAU;CAC3C,MAAM,QAAQ,MAAM,IAAI,SAAS,MAAM;CACvC,IAAI,UAAU,KAAA,KAAa,MAAM,WAAW,GAC3C,MAAM,IAAI,MAAM,wBAAwB,OAAO,aAAa;CAE7D,OAAO;;AAGR,eAAsB,0BACrB,KACA,eAAsD,EAAE,EAC9B;CAC1B,MAAM,cAAc,iCAAiC,IAAI;CACzD,MAAM,eAAe,aAAa,8BAA8B;CAChE,MAAM,iBACL,aAAa,mCAAmCA;CAWjD,OAAO,8BATN,gBAAgB,OACb,OACA,MAAM,eAAe,EACrB,qBAAqB,MAAM,iCAAiC;EAC3D;EACA;EACA;EACA,CAAC,EACF,CAAC,EACqD,IAAI;;AAS/D,SAAS,UAAU,OAA+C;CACjE,IAAI,UAAU,KAAA,GACb;CAED,MAAM,OAAO,OAAO,MAAM;CAC1B,IAAI,CAAC,OAAO,UAAU,KAAK,IAAI,OAAO,KAAK,OAAO,OACjD,MAAM,IAAI,MAAM,yBAAyB,MAAM,IAAI;CAEpD,OAAO;;AAGR,SAAgB,yBAAyB,MAA8C;CACtF,MAAM,SAAS,UAAU;EACxB,MAAM,CAAC,GAAG,KAAK;EACf,SAAS;GACR,OAAO;IAAE,UAAU;IAAM,MAAM;IAAU;GACzC,cAAc,EAAE,MAAM,UAAU;GAChC,MAAM;IAAE,OAAO;IAAK,MAAM;IAAU;GACpC;EACD,QAAQ;EACR,CAAC;CACF,MAAM,YAAY,OAAO,OAAO;CAChC,IAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GACzD,MAAM,IAAI,MAAM,mCAAmC;CAEpD,MAAM,oBAAoB,OAAO,OAAO;CACxC,MAAM,OAAO;EACZ,gBAAgB,MAAM,QAAQ,kBAAkB,GAAG,oBAAoB,EAAE;EACzE;EACA;CACD,MAAM,OAAO,UAAU,OAAO,OAAO,KAAK;CAC1C,OAAO,SAAS,KAAA,IAAY,OAAO;EAAE,GAAG;EAAM;EAAM;;AAGrD,SAAgB,oBACf,QACA,WACiD;CACjD,MAAM,aAAmD,EAAE,GAAG,QAAQ;CACtE,KAAK,MAAM,YAAY,WAAW;EACjC,MAAM,CAAC,SAAS,aAAa,SAAS,SAAS,MAAM,IAAI;EACzD,IACC,YAAY,KAAA,KACZ,gBAAgB,KAAA,KAChB,UAAU,KAAA,KACV,QAAQ,WAAW,KACnB,YAAY,WAAW,GAEvB,MAAM,IAAI,MAAM,6BAA6B,SAAS,kCAAkC;EAEzF,MAAM,gBAAgB,WAAW;EACjC,IAAI,kBAAkB,KAAA,GACrB,MAAM,IAAI,MAAM,6CAA6C,QAAQ,IAAI;EAE1E,WAAW,WAAW;GAAE,GAAG;GAAe,SAAS;GAAa;;CAEjE,OAAO;;AASR,SAAS,qBAAmC;CAC3C,IAAI;CACJ,IAAI;CAKJ,OAAO;EACN,SAAA,IALmB,SAAiB,SAAS,WAAW;GACxD,aAAa;GACb,cAAc;IAGP;EACP,SAAS,UAAU;GAClB,IAAI,eAAe,KAAA,GAClB,MAAM,IAAI,MAAM,gDAAgD;GAEjE,WAAW,MAAM;;EAElB,UAAU,SAAS;GAClB,IAAI,gBAAgB,KAAA,GACnB,MAAM,IAAI,MAAM,gDAAgD;GAEjE,YAAY,KAAK;;EAElB;;AAGF,SAAS,4BAAgD;CACxD,OAAO,EACN,MAAM,UAAU;EACf,QAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,MAAM,CAAC,IAAI;IAEnD;;AAGF,SAAgB,wBAAwB,OAK/B;CACR,MAAM,OAAO,IAAI;EAChB,OAAO;EACP,OAAO;EACP,SAAS,MAAM,MAAM;EACrB,GAAI,MAAM,MAAM,UAAU,KAAA,IAAY,EAAE,GAAG,EAAE,OAAO,MAAM,MAAM,OAAO;EACvE,CAAC;CACF,IAAI,CAAC,MAAM,aACV,MAAM,cAAc,OAAO,MAAM,MAAM;;AAIzC,SAAS,gBAAgB,QAAyC;CACjE,OAAO,IAAI,SAAe,SAAS,WAAW;EAC7C,OAAO,OAAO,UAAU;GACvB,IAAI,OACH,OAAO,MAAM;QAEb,SAAS;IAET;GACD;;AAGH,SAAS,4BACR,gBACgC;CAChC,OAAO,OAAO,QAAQ,eAAe,CAAC,SAAS,CAAC,WAAW,eAC1D,UAAU,KAAK,cAAc;EAAE;EAAW;EAAU,EAAE,CACtD;;AAGF,SAAgB,uBACf,cACsD;CACtD,MAAM,2BAA8D,EAAE;CACtE,MAAM,sBAAqE,EAAE;CAC7E,MAAM,qBAAoE,EAAE;CAC5E,MAAM,cAAwB,EAAE;CAEhC,KAAK,MAAM,CAAC,SAAS,UAAU,OAAO,QAAQ,aAAa,OAAO,EAAE;EACnE,MAAM,UAAoC,wBAAwB,cAAc,MAAM,QAAQ;EAC9F,yBAAyB,WAAW,QAAQ;EAC5C,oBAAoB,WAAW,4BAA4B,QAAQ,wBAAwB;EAC3F,mBAAmB,WAAW,4BAA4B,QAAQ,uBAAuB;EACzF,YAAY,KAAK,QAAQ,MAAM,aAAa;;CAG7C,OAAO;EACN,YAAY,YAAY,WAAW,IAAI,MAAS,KAAK,IAAI,GAAG,YAAY;EACxE;EACA;EACA;EACA;;AAGF,SAAS,mBACR,cACA,gBACkB;CAClB,OAAO;EACN,GAAG;EACH,QAAQ,oBAAoB,aAAa,QAAQ,eAAe;EAChE;;AAGF,SAAS,mBAAmB,cAG1B;CACD,IAAI,aAAa,iBAAiB,KAAA,KAAa,aAAa,aAAa,KAAA,GACxE,MAAM,IAAI,MACT,mGACA;CAEF,OAAO;EACN,cAAc,aAAa;EAC3B,UAAU,aAAa;EACvB;;AAGF,SAAgB,oCAAoC,OAGpB;CAC/B,OAAO,IAAI,IACV,MAAM,SAAS,KAAK,YAAY,CAC/B,SACA,WAAW,UAAU,MAAM,UAAU,CAAC,OAAO,6BAA6B,UAAU,CAAC,QAAQ,CAC7F,CAAC,CACF;;AAGF,SAAS,0BACR,cACmC;CACnC,OAAO,OAAO,YACb,OAAO,QAAQ,aAAa,OAAO,CAAC,KAAK,CAAC,SAAS,WAAW,CAC7D,SACA,MAAM,kBACN,CAAC,CACF;;AAGF,eAAsB,kBACrB,OAC0E;CAC1E,MAAM,SAAS,MAAM,UAAU,2BAA2B;CAC1D,MAAM,UAAU,MAAM,WAAW;CACjC,IAAI;CACJ,MAAM,iCAA0D;EAC/D,iCAAiC,0BAA0B,MAAM,IAAI;EACrE,OAAO;;CAER,MAAM,gBACL,MAAM,kBACL,OAAO,WACP,mBAAmB,QAAQ;EAC1B,KAAK,MAAM;EACX,gBAAgB,MAAM,0BAA0B;EAChD,CAAC;CACJ,MAAM,YAAY,MAAM,cAAc,KAAK,MAAM,KAAK,WAAW,mBAAmB,CAAC;CACrF,MAAM,eAAe,mBACpB,MAAM,oBAAoB,KAAK,MAAM,KAAK,WAAW,0BAA0B,CAAC,EAChF,MAAM,KAAK,eACX;CACD,MAAM,eAAe,mBAAmB,aAAa;CACrD,MAAM,YAAY,sBAAsB,MAAM,cAAc,aAAa,aAAa,UAAU,CAAC;CAKjG,MAAM,eAAe,gCAAgC;EAAE,UAJtC,oCAAoC;GACpD,UAAU,OAAO,KAAK,aAAa,OAAO;GAC1C;GACA,CAC8D;EAAE;EAAc,CAAC;CAChF,MAAM,kBAAkB,MAAM,uBAAuB;EAAE,QAAQ;EAAW;EAAe,CAAC;CAC1F,MAAM,kBAAkB,+BAA+B;EACtD,2BAA2B,CAAC,UAAU,SAAS,YAAY,CAAC;EAC5D,eAAe,OAAO,YAAY;GACjC,OAAO,IAAI;IACV,cAAc,QAAQ;IACtB,OAAO;IACP,OAAO;IACP,SAAS,MAAM;IACf,GAAI,QAAQ,cAAc,KAAA,IAAY,EAAE,GAAG,EAAE,WAAW,QAAQ,WAAW;IAC3E,CAAC;;EAEH,SAAS;EACT,CAAC;CACF,MAAM,oBAAoB,uBAAuB,aAAa;CAC9D,MAAM,iBAAiB,6BAA6B;EACnD,iBAAiB,OAAO,UAAU;GACjC,OAAO,IAAI;IACV,SAAS,MAAM;IACf,OAAO;IACP,OAAO;IACP,SAAS,MAAM;IACf,QAAQ,MAAM;IACd,CAAC;;EAEH,YAAY,UAAU;GACrB,OAAO,IAAI;IACV,SAAS,MAAM;IACf,UAAU,MAAM;IAChB,OAAO;IACP,OAAO,MAAM,aAAa,UAAU,SAAS;IAC7C,GAAI,YAAY,QAAQ,EAAE,QAAQ,MAAM,QAAQ,GAAG,EAAE;IACrD,QAAQ,MAAM;IACd,GAAI,oBAAoB,QAAQ,EAAE,gBAAgB,MAAM,gBAAgB,GAAG,EAAE;IAC7E,CAAC;;EAEH,SAAS;EACT,CAAC;CACF,MAAM,OAAO,iBAAiB;EAC7B,cAAc;GACb,eAAe;GACf,0BAA0B,kBAAkB;GAC5C,qBAAqB,kBAAkB;GACvC,oBAAoB,kBAAkB;GACtC;EACD,WAAW,OAAO,UAAU,kBAC3B,eAAe,OAAO,SAAS,SAAS,cAAc;EACvD,cAAc,kBAAkB;EAChC,SAAS;GACR,GAAG;GACH,kBAAkB,gBAAgB;GAClC;EACD,oBAAoB,gBAAgB,KAAK,WAAW,OAAO,UAAU;EACrE,CAAC;CACF,MAAM,MAAM,oBAAoB;EAC/B,iBAAiB;GAChB,yBAAyB,aAAa,SAAS,KAAK;GACpD,2BAA2B,0BAA0B,aAAa;GAClE;GACA;EACD,YAAY,UAAU;GACrB,OAAO,IAAI;IACV,SAAS,MAAM;IACf,eAAe,MAAM;IACrB,UAAU,MAAM;IAChB,OAAO;IACP,OAAO,MAAM,aAAa,UAAU,SAAS;IAC7C,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,GAAG,EAAE,QAAQ,MAAM,QAAQ;IAC9D,QAAQ,MAAM;IACd,CAAC;;EAEH,iBAAiB,OAAO,UAAU;GACjC,OAAO,IAAI;IACV,SAAS,MAAM;IACf,eAAe,MAAM;IACrB,OAAO;IACP,OAAO;IACP,SAAS,MAAM;IACf,QAAQ,MAAM;IACd,CAAC;;EAEH;EACA,iBAAiB,OAAO,aAAa;GACpC,MAAM,KAAK,kBAAkB,SAAS;;EAEvC,oBAAoB,OAAO,KAAK,aAAa,OAAO;EACpD,sBAAsB,8BAA8B,aAAa;EACjE,CAAC;CACF,MAAM,gBAAgB,oBAAoB;CAC1C,IAAI,cAAc;CAClB,MAAM,SAAS,QACd;EACC,OAAO,IAAI;EACX,UAAU,aAAa,SAAS,OAAO;EACvC,MAAM,MAAM,KAAK,QAAQ,aAAa,SAAS,OAAO;EACtD,GACA,SAAS;EACT,cAAc;EACd,QAAQ,OAAO,MAAM,kBAAkB,OAAO,KAAK,KAAK,CAAC,IAAI;EAC7D,cAAc,QAAQ,KAAK,KAAK;GAEjC;CACD,OAAO,GAAG,UAAU,UAAiB;EACpC,wBAAwB;GAAE;GAAO;GAAa;GAAe;GAAQ,CAAC;GACrE;CAGF,OAAO;EACN,OAAO,YAAY;GAClB,MAAM,IAAI,qBAAqB;GAC/B,MAAM,KAAK,OAAO;GAClB,MAAM,gBAAgB,OAAO;;EAE9B,MAAA,MARkB,cAAc;EAShC"}

package/dist/testing/fake-upstream-mcp-server.d.ts

@@ -12,8 +12,11 @@ interface StartedFakeUpstreamMcpServer {
   readonly port: number;
   readonly url: string;
 }
+interface FakeUpstreamMcpServerOptions {
+  readonly emitProgress?: boolean;
+}
 declare function createFakeUpstreamTools(): readonly Tool[];
-declare function startFakeUpstreamMcpServer(): Promise<StartedFakeUpstreamMcpServer>;
+declare function startFakeUpstreamMcpServer(options?: FakeUpstreamMcpServerOptions): Promise<StartedFakeUpstreamMcpServer>;
 //#endregion
-export { FakeUpstreamToolCallRecord, StartedFakeUpstreamMcpServer, createFakeUpstreamTools, fakeUpstreamNamespace, startFakeUpstreamMcpServer };
+export { FakeUpstreamMcpServerOptions, FakeUpstreamToolCallRecord, StartedFakeUpstreamMcpServer, createFakeUpstreamTools, fakeUpstreamNamespace, startFakeUpstreamMcpServer };
 //# sourceMappingURL=fake-upstream-mcp-server.d.ts.map

package/dist/testing/fake-upstream-mcp-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-upstream-mcp-server.d.ts","names":[],"sources":["../../src/testing/fake-upstream-mcp-server.ts"],"mappings":";;;cAWa,qBAAA;AAAA,UAEI,0BAAA;EAAA,SACP,cAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,4BAAA;EAAA,SACP,KAAA,WAAgB,0BAAA;EAAA,SAChB,KAAA,QAAa,OAAA;EAAA,SACb,IAAA;EAAA,SACA,GAAA;AAAA;AAAA,iBA4CM,uBAAA,CAAA,YAAoC,IAAA;AAAA,iBA2B9B,0BAAA,CAAA,GAA8B,OAAA,CAAQ,4BAAA"}
+{"version":3,"file":"fake-upstream-mcp-server.d.ts","names":[],"sources":["../../src/testing/fake-upstream-mcp-server.ts"],"mappings":";;;cAWa,qBAAA;AAAA,UAEI,0BAAA;EAAA,SACP,cAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,4BAAA;EAAA,SACP,KAAA,WAAgB,0BAAA;EAAA,SAChB,KAAA,QAAa,OAAA;EAAA,SACb,IAAA;EAAA,SACA,GAAA;AAAA;AAAA,UAGO,4BAAA;EAAA,SACP,YAAA;AAAA;AAAA,iBA4CM,uBAAA,CAAA,YAAoC,IAAA;AAAA,iBA2B9B,0BAAA,CACrB,OAAA,GAAS,4BAAA,GACP,OAAA,CAAQ,4BAAA"}

package/dist/testing/fake-upstream-mcp-server.js

@@ -1,8 +1,8 @@
-import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 import { Hono } from "hono";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 import { serve } from "@hono/node-server";
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 //#region src/testing/fake-upstream-mcp-server.ts
 const fakeUpstreamNamespace = "upstream-mock";
 function isObjectRecord(value) {
@@ -75,7 +75,7 @@ function createFakeUpstreamTools() {
 		name: "write_thing"
 	}];
 }
-async function startFakeUpstreamMcpServer() {
+async function startFakeUpstreamMcpServer(options = {}) {
 	const calls = [];
 	const tools = createFakeUpstreamTools();
 	const toolsByName = new Map(tools.map((tool) => [tool.name, tool]));
@@ -87,7 +87,7 @@ async function startFakeUpstreamMcpServer() {
 			version: "1.0.0"
 		}, { capabilities: { tools: { listChanged: false } } });
 		server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools }));
-		server.setRequestHandler(CallToolRequestSchema, async (request) => {
+		server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
 			const tool = toolsByName.get(request.params.name);
 			if (tool === void 0) return {
 				content: [{
@@ -96,6 +96,16 @@ async function startFakeUpstreamMcpServer() {
 				}],
 				isError: true
 			};
+			const progressToken = extra["_meta"]?.progressToken;
+			if (options.emitProgress === true && progressToken !== void 0) await extra.sendNotification({
+				method: "notifications/progress",
+				params: {
+					message: "fake upstream half done",
+					progress: 1,
+					progressToken,
+					total: 2
+				}
+			});
 			const argumentsValue = isObjectRecord(request.params.arguments) ? request.params.arguments : {};
 			calls.push({
 				argumentsValue,

package/dist/testing/fake-upstream-mcp-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"fake-upstream-mcp-server.js","names":[],"sources":["../../src/testing/fake-upstream-mcp-server.ts"],"sourcesContent":["import { serve, type ServerType } from '@hono/node-server';\nimport { Server } from '@modelcontextprotocol/sdk/server/index.js';\nimport { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';\nimport {\n\tCallToolRequestSchema,\n\tListToolsRequestSchema,\n\ttype CallToolResult,\n\ttype Tool,\n} from '@modelcontextprotocol/sdk/types.js';\nimport { Hono } from 'hono';\n\nexport const fakeUpstreamNamespace = 'upstream-mock';\n\nexport interface FakeUpstreamToolCallRecord {\n\treadonly argumentsValue: unknown;\n\treadonly name: string;\n}\n\nexport interface StartedFakeUpstreamMcpServer {\n\treadonly calls: readonly FakeUpstreamToolCallRecord[];\n\treadonly close: () => Promise<void>;\n\treadonly port: number;\n\treadonly url: string;\n}\n\ninterface StartedHonoServer {\n\treadonly port: number;\n\treadonly server: ServerType;\n}\n\nfunction isObjectRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nasync function closeServer(server: ServerType): Promise<void> {\n\tawait new Promise<void>((resolve, reject) => {\n\t\tserver.close((error) => {\n\t\t\tif (error) {\n\t\t\t\treject(error);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tresolve();\n\t\t});\n\t});\n}\n\nasync function serveHonoOnOpenPort(app: Hono): Promise<StartedHonoServer> {\n\treturn await new Promise<StartedHonoServer>((resolve) => {\n\t\tconst server = serve({ fetch: app.fetch, hostname: '127.0.0.1', port: 0 }, (info) => {\n\t\t\tresolve({ port: info.port, server });\n\t\t});\n\t});\n}\n\nfunction createToolResult(name: string, argumentsValue: unknown): CallToolResult {\n\treturn {\n\t\tcontent: [\n\t\t\t{\n\t\t\t\ttext: JSON.stringify({ arguments: argumentsValue, name, ok: true }),\n\t\t\t\ttype: 'text',\n\t\t\t},\n\t\t],\n\t\tstructuredContent: { name, ok: true },\n\t};\n}\n\nexport function createFakeUpstreamTools(): readonly Tool[] {\n\treturn [\n\t\t{\n\t\t\tannotations: { destructiveHint: false, readOnlyHint: true },\n\t\t\tdescription: 'Reads a mock record.',\n\t\t\tinputSchema: {\n\t\t\t\tadditionalProperties: false,\n\t\t\t\tproperties: { title: { type: 'string' } },\n\t\t\t\trequired: ['title'],\n\t\t\t\ttype: 'object',\n\t\t\t},\n\t\t\tname: 'read_thing',\n\t\t},\n\t\t{\n\t\t\tannotations: { destructiveHint: true },\n\t\t\tdescription: 'Writes a mock record.',\n\t\t\tinputSchema: {\n\t\t\t\tadditionalProperties: false,\n\t\t\t\tproperties: { title: { type: 'string' } },\n\t\t\t\trequired: ['title'],\n\t\t\t\ttype: 'object',\n\t\t\t},\n\t\t\tname: 'write_thing',\n\t\t},\n\t] satisfies readonly Tool[];\n}\n\nexport async function startFakeUpstreamMcpServer(): Promise<StartedFakeUpstreamMcpServer> {\n\tconst calls: FakeUpstreamToolCallRecord[] = [];\n\tconst tools = createFakeUpstreamTools();\n\tconst toolsByName = new Map(tools.map((tool) => [tool.name, tool]));\n\tconst app = new Hono();\n\n\tapp.all('/mcp', async (context) => {\n\t\tconst transport = new WebStandardStreamableHTTPServerTransport();\n\t\tconst server = new Server(\n\t\t\t{ name: 'portal-upstream-fixture', version: '1.0.0' },\n\t\t\t{ capabilities: { tools: { listChanged: false } } },\n\t\t);\n\n\t\tserver.setRequestHandler(ListToolsRequestSchema, async () => ({ tools }));\n\t\tserver.setRequestHandler(CallToolRequestSchema, async (request) => {\n\t\t\tconst tool = toolsByName.get(request.params.name);\n\t\t\tif (tool === undefined) {\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ text: `Unknown tool ${request.params.name}`, type: 'text' }],\n\t\t\t\t\tisError: true,\n\t\t\t\t};\n\t\t\t}\n\t\t\tconst argumentsValue = isObjectRecord(request.params.arguments)\n\t\t\t\t? request.params.arguments\n\t\t\t\t: {};\n\t\t\tcalls.push({ argumentsValue, name: tool.name });\n\t\t\treturn createToolResult(tool.name, argumentsValue);\n\t\t});\n\n\t\tawait server.connect(transport);\n\t\treturn await transport.handleRequest(context.req.raw);\n\t});\n\n\tconst startedServer = await serveHonoOnOpenPort(app);\n\treturn {\n\t\tcalls,\n\t\tclose: async () => {\n\t\t\tawait closeServer(startedServer.server);\n\t\t},\n\t\tport: startedServer.port,\n\t\turl: `http://127.0.0.1:${String(startedServer.port)}/mcp`,\n\t};\n}\n"],"mappings":";;;;;;AAWA,MAAa,wBAAwB;AAmBrC,SAAS,eAAe,OAAkD;CACzE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,eAAe,YAAY,QAAmC;CAC7D,MAAM,IAAI,SAAe,SAAS,WAAW;EAC5C,OAAO,OAAO,UAAU;GACvB,IAAI,OAAO;IACV,OAAO,MAAM;IACb;;GAED,SAAS;IACR;GACD;;AAGH,eAAe,oBAAoB,KAAuC;CACzE,OAAO,MAAM,IAAI,SAA4B,YAAY;EACxD,MAAM,SAAS,MAAM;GAAE,OAAO,IAAI;GAAO,UAAU;GAAa,MAAM;GAAG,GAAG,SAAS;GACpF,QAAQ;IAAE,MAAM,KAAK;IAAM;IAAQ,CAAC;IACnC;GACD;;AAGH,SAAS,iBAAiB,MAAc,gBAAyC;CAChF,OAAO;EACN,SAAS,CACR;GACC,MAAM,KAAK,UAAU;IAAE,WAAW;IAAgB;IAAM,IAAI;IAAM,CAAC;GACnE,MAAM;GACN,CACD;EACD,mBAAmB;GAAE;GAAM,IAAI;GAAM;EACrC;;AAGF,SAAgB,0BAA2C;CAC1D,OAAO,CACN;EACC,aAAa;GAAE,iBAAiB;GAAO,cAAc;GAAM;EAC3D,aAAa;EACb,aAAa;GACZ,sBAAsB;GACtB,YAAY,EAAE,OAAO,EAAE,MAAM,UAAU,EAAE;GACzC,UAAU,CAAC,QAAQ;GACnB,MAAM;GACN;EACD,MAAM;EACN,EACD;EACC,aAAa,EAAE,iBAAiB,MAAM;EACtC,aAAa;EACb,aAAa;GACZ,sBAAsB;GACtB,YAAY,EAAE,OAAO,EAAE,MAAM,UAAU,EAAE;GACzC,UAAU,CAAC,QAAQ;GACnB,MAAM;GACN;EACD,MAAM;EACN,CACD;;AAGF,eAAsB,6BAAoE;CACzF,MAAM,QAAsC,EAAE;CAC9C,MAAM,QAAQ,yBAAyB;CACvC,MAAM,cAAc,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC,KAAK,MAAM,KAAK,CAAC,CAAC;CACnE,MAAM,MAAM,IAAI,MAAM;CAEtB,IAAI,IAAI,QAAQ,OAAO,YAAY;EAClC,MAAM,YAAY,IAAI,0CAA0C;EAChE,MAAM,SAAS,IAAI,OAClB;GAAE,MAAM;GAA2B,SAAS;GAAS,EACrD,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,OAAO,EAAE,EAAE,CACnD;EAED,OAAO,kBAAkB,wBAAwB,aAAa,EAAE,OAAO,EAAE;EACzE,OAAO,kBAAkB,uBAAuB,OAAO,YAAY;GAClE,MAAM,OAAO,YAAY,IAAI,QAAQ,OAAO,KAAK;GACjD,IAAI,SAAS,KAAA,GACZ,OAAO;IACN,SAAS,CAAC;KAAE,MAAM,gBAAgB,QAAQ,OAAO;KAAQ,MAAM;KAAQ,CAAC;IACxE,SAAS;IACT;GAEF,MAAM,iBAAiB,eAAe,QAAQ,OAAO,UAAU,GAC5D,QAAQ,OAAO,YACf,EAAE;GACL,MAAM,KAAK;IAAE;IAAgB,MAAM,KAAK;IAAM,CAAC;GAC/C,OAAO,iBAAiB,KAAK,MAAM,eAAe;IACjD;EAEF,MAAM,OAAO,QAAQ,UAAU;EAC/B,OAAO,MAAM,UAAU,cAAc,QAAQ,IAAI,IAAI;GACpD;CAEF,MAAM,gBAAgB,MAAM,oBAAoB,IAAI;CACpD,OAAO;EACN;EACA,OAAO,YAAY;GAClB,MAAM,YAAY,cAAc,OAAO;;EAExC,MAAM,cAAc;EACpB,KAAK,oBAAoB,OAAO,cAAc,KAAK,CAAC;EACpD"}
+{"version":3,"file":"fake-upstream-mcp-server.js","names":[],"sources":["../../src/testing/fake-upstream-mcp-server.ts"],"sourcesContent":["import { serve, type ServerType } from '@hono/node-server';\nimport { Server } from '@modelcontextprotocol/sdk/server/index.js';\nimport { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';\nimport {\n\tCallToolRequestSchema,\n\tListToolsRequestSchema,\n\ttype CallToolResult,\n\ttype Tool,\n} from '@modelcontextprotocol/sdk/types.js';\nimport { Hono } from 'hono';\n\nexport const fakeUpstreamNamespace = 'upstream-mock';\n\nexport interface FakeUpstreamToolCallRecord {\n\treadonly argumentsValue: unknown;\n\treadonly name: string;\n}\n\nexport interface StartedFakeUpstreamMcpServer {\n\treadonly calls: readonly FakeUpstreamToolCallRecord[];\n\treadonly close: () => Promise<void>;\n\treadonly port: number;\n\treadonly url: string;\n}\n\nexport interface FakeUpstreamMcpServerOptions {\n\treadonly emitProgress?: boolean;\n}\n\ninterface StartedHonoServer {\n\treadonly port: number;\n\treadonly server: ServerType;\n}\n\nfunction isObjectRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nasync function closeServer(server: ServerType): Promise<void> {\n\tawait new Promise<void>((resolve, reject) => {\n\t\tserver.close((error) => {\n\t\t\tif (error) {\n\t\t\t\treject(error);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tresolve();\n\t\t});\n\t});\n}\n\nasync function serveHonoOnOpenPort(app: Hono): Promise<StartedHonoServer> {\n\treturn await new Promise<StartedHonoServer>((resolve) => {\n\t\tconst server = serve({ fetch: app.fetch, hostname: '127.0.0.1', port: 0 }, (info) => {\n\t\t\tresolve({ port: info.port, server });\n\t\t});\n\t});\n}\n\nfunction createToolResult(name: string, argumentsValue: unknown): CallToolResult {\n\treturn {\n\t\tcontent: [\n\t\t\t{\n\t\t\t\ttext: JSON.stringify({ arguments: argumentsValue, name, ok: true }),\n\t\t\t\ttype: 'text',\n\t\t\t},\n\t\t],\n\t\tstructuredContent: { name, ok: true },\n\t};\n}\n\nexport function createFakeUpstreamTools(): readonly Tool[] {\n\treturn [\n\t\t{\n\t\t\tannotations: { destructiveHint: false, readOnlyHint: true },\n\t\t\tdescription: 'Reads a mock record.',\n\t\t\tinputSchema: {\n\t\t\t\tadditionalProperties: false,\n\t\t\t\tproperties: { title: { type: 'string' } },\n\t\t\t\trequired: ['title'],\n\t\t\t\ttype: 'object',\n\t\t\t},\n\t\t\tname: 'read_thing',\n\t\t},\n\t\t{\n\t\t\tannotations: { destructiveHint: true },\n\t\t\tdescription: 'Writes a mock record.',\n\t\t\tinputSchema: {\n\t\t\t\tadditionalProperties: false,\n\t\t\t\tproperties: { title: { type: 'string' } },\n\t\t\t\trequired: ['title'],\n\t\t\t\ttype: 'object',\n\t\t\t},\n\t\t\tname: 'write_thing',\n\t\t},\n\t] satisfies readonly Tool[];\n}\n\nexport async function startFakeUpstreamMcpServer(\n\toptions: FakeUpstreamMcpServerOptions = {},\n): Promise<StartedFakeUpstreamMcpServer> {\n\tconst calls: FakeUpstreamToolCallRecord[] = [];\n\tconst tools = createFakeUpstreamTools();\n\tconst toolsByName = new Map(tools.map((tool) => [tool.name, tool]));\n\tconst app = new Hono();\n\n\tapp.all('/mcp', async (context) => {\n\t\tconst transport = new WebStandardStreamableHTTPServerTransport();\n\t\tconst server = new Server(\n\t\t\t{ name: 'portal-upstream-fixture', version: '1.0.0' },\n\t\t\t{ capabilities: { tools: { listChanged: false } } },\n\t\t);\n\n\t\tserver.setRequestHandler(ListToolsRequestSchema, async () => ({ tools }));\n\t\tserver.setRequestHandler(CallToolRequestSchema, async (request, extra) => {\n\t\t\tconst tool = toolsByName.get(request.params.name);\n\t\t\tif (tool === undefined) {\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ text: `Unknown tool ${request.params.name}`, type: 'text' }],\n\t\t\t\t\tisError: true,\n\t\t\t\t};\n\t\t\t}\n\t\t\tconst progressToken = extra['_meta']?.progressToken;\n\t\t\tif (options.emitProgress === true && progressToken !== undefined) {\n\t\t\t\tawait extra.sendNotification({\n\t\t\t\t\tmethod: 'notifications/progress',\n\t\t\t\t\tparams: {\n\t\t\t\t\t\tmessage: 'fake upstream half done',\n\t\t\t\t\t\tprogress: 1,\n\t\t\t\t\t\tprogressToken,\n\t\t\t\t\t\ttotal: 2,\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t}\n\t\t\tconst argumentsValue = isObjectRecord(request.params.arguments)\n\t\t\t\t? request.params.arguments\n\t\t\t\t: {};\n\t\t\tcalls.push({ argumentsValue, name: tool.name });\n\t\t\treturn createToolResult(tool.name, argumentsValue);\n\t\t});\n\n\t\tawait server.connect(transport);\n\t\treturn await transport.handleRequest(context.req.raw);\n\t});\n\n\tconst startedServer = await serveHonoOnOpenPort(app);\n\treturn {\n\t\tcalls,\n\t\tclose: async () => {\n\t\t\tawait closeServer(startedServer.server);\n\t\t},\n\t\tport: startedServer.port,\n\t\turl: `http://127.0.0.1:${String(startedServer.port)}/mcp`,\n\t};\n}\n"],"mappings":";;;;;;AAWA,MAAa,wBAAwB;AAuBrC,SAAS,eAAe,OAAkD;CACzE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,eAAe,YAAY,QAAmC;CAC7D,MAAM,IAAI,SAAe,SAAS,WAAW;EAC5C,OAAO,OAAO,UAAU;GACvB,IAAI,OAAO;IACV,OAAO,MAAM;IACb;;GAED,SAAS;IACR;GACD;;AAGH,eAAe,oBAAoB,KAAuC;CACzE,OAAO,MAAM,IAAI,SAA4B,YAAY;EACxD,MAAM,SAAS,MAAM;GAAE,OAAO,IAAI;GAAO,UAAU;GAAa,MAAM;GAAG,GAAG,SAAS;GACpF,QAAQ;IAAE,MAAM,KAAK;IAAM;IAAQ,CAAC;IACnC;GACD;;AAGH,SAAS,iBAAiB,MAAc,gBAAyC;CAChF,OAAO;EACN,SAAS,CACR;GACC,MAAM,KAAK,UAAU;IAAE,WAAW;IAAgB;IAAM,IAAI;IAAM,CAAC;GACnE,MAAM;GACN,CACD;EACD,mBAAmB;GAAE;GAAM,IAAI;GAAM;EACrC;;AAGF,SAAgB,0BAA2C;CAC1D,OAAO,CACN;EACC,aAAa;GAAE,iBAAiB;GAAO,cAAc;GAAM;EAC3D,aAAa;EACb,aAAa;GACZ,sBAAsB;GACtB,YAAY,EAAE,OAAO,EAAE,MAAM,UAAU,EAAE;GACzC,UAAU,CAAC,QAAQ;GACnB,MAAM;GACN;EACD,MAAM;EACN,EACD;EACC,aAAa,EAAE,iBAAiB,MAAM;EACtC,aAAa;EACb,aAAa;GACZ,sBAAsB;GACtB,YAAY,EAAE,OAAO,EAAE,MAAM,UAAU,EAAE;GACzC,UAAU,CAAC,QAAQ;GACnB,MAAM;GACN;EACD,MAAM;EACN,CACD;;AAGF,eAAsB,2BACrB,UAAwC,EAAE,EACF;CACxC,MAAM,QAAsC,EAAE;CAC9C,MAAM,QAAQ,yBAAyB;CACvC,MAAM,cAAc,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC,KAAK,MAAM,KAAK,CAAC,CAAC;CACnE,MAAM,MAAM,IAAI,MAAM;CAEtB,IAAI,IAAI,QAAQ,OAAO,YAAY;EAClC,MAAM,YAAY,IAAI,0CAA0C;EAChE,MAAM,SAAS,IAAI,OAClB;GAAE,MAAM;GAA2B,SAAS;GAAS,EACrD,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,OAAO,EAAE,EAAE,CACnD;EAED,OAAO,kBAAkB,wBAAwB,aAAa,EAAE,OAAO,EAAE;EACzE,OAAO,kBAAkB,uBAAuB,OAAO,SAAS,UAAU;GACzE,MAAM,OAAO,YAAY,IAAI,QAAQ,OAAO,KAAK;GACjD,IAAI,SAAS,KAAA,GACZ,OAAO;IACN,SAAS,CAAC;KAAE,MAAM,gBAAgB,QAAQ,OAAO;KAAQ,MAAM;KAAQ,CAAC;IACxE,SAAS;IACT;GAEF,MAAM,gBAAgB,MAAM,UAAU;GACtC,IAAI,QAAQ,iBAAiB,QAAQ,kBAAkB,KAAA,GACtD,MAAM,MAAM,iBAAiB;IAC5B,QAAQ;IACR,QAAQ;KACP,SAAS;KACT,UAAU;KACV;KACA,OAAO;KACP;IACD,CAAC;GAEH,MAAM,iBAAiB,eAAe,QAAQ,OAAO,UAAU,GAC5D,QAAQ,OAAO,YACf,EAAE;GACL,MAAM,KAAK;IAAE;IAAgB,MAAM,KAAK;IAAM,CAAC;GAC/C,OAAO,iBAAiB,KAAK,MAAM,eAAe;IACjD;EAEF,MAAM,OAAO,QAAQ,UAAU;EAC/B,OAAO,MAAM,UAAU,cAAc,QAAQ,IAAI,IAAI;GACpD;CAEF,MAAM,gBAAgB,MAAM,oBAAoB,IAAI;CACpD,OAAO;EACN;EACA,OAAO,YAAY;GAClB,MAAM,YAAY,cAAc,OAAO;;EAExC,MAAM,cAAc;EACpB,KAAK,oBAAoB,OAAO,cAAc,KAAK,CAAC;EACpD"}