@anyknown/mcp 0.2.0 → 0.3.1

package/README.md

@@ -1,65 +1,19 @@
-# anyknown/mcp
+# @anyknown/mcp
 
-The hub: the directory of servers (admin catalogue plus each user's own `own_*` servers), per-user credentials, the tool cache, and the adapters that read and call a server by its `kind`. An `mcp` server is an MCP server (its `tools/list` tools); an `openapi` server is an HTTP API described by an OpenAPI document (each operation is a tool); a `graphql` server is a GraphQL endpoint (each Query and Mutation root field is a tool). Every tool is named `<server_id>/<name>` and goes through the same search, describe and call. The admin catalogue holds only `mcp` servers. The adapters live in `src/portable/` and use only the `fetch` passed to them.
-
-Each server has one `auth`: `none`, `bearer`, `api_key` (a header or query parameter whose name comes with create or from the spec's `apiKey` security scheme), `basic` or `oauth`; `mcp` servers take only `oauth`, `bearer` and `none`. OAuth always uses PKCE and product's `/api/mcp/callback` as the redirect URI:
-
-- `mcp` discovers the authorization server from the 401 challenge's resource metadata (or the server's well-known protected resource URL), identifies itself with a client ID metadata document when the server supports it and dynamic registration otherwise, sends `resource`, and rediscovers on refresh.
-- `openapi` and `graphql` use the user's own OAuth app. The client id and optional client secret come with connect; the authorize and token endpoints and the scopes come with create, or else from the spec's `oauth2` authorization code flow or its `openIdConnect` discovery document, and it is `invalid` when neither has them. The hub sends no `resource`, doesn't check `iss` (there is no issuer to compare), authenticates with `client_secret_basic` when there is a secret, and refreshes against the stored token endpoint without discovery.
-
-It has no public URL. The only way in is product's `MCP` service binding, which calls the `Hub` `WorkerEntrypoint` over RPC (`src/rpc/`). Product owns authentication, scope checks (`mcp:use`, `product:admin`), request validation, activity and the OAuth cookie; the hub trusts the `userId` product passes.
-
-Tokens, API keys, basic credentials and OAuth client secrets are sealed to the user's public key under the server id and opened only through product's `KeyringMcp` entrypoint (`KEYRING`, a service binding to `product` / `product-staging` that exposes only `seal` / `open` for kind `mcp`), so that entrypoint has to be deployed before this worker. The OAuth cookie carries the client id but never the secret; the hub opens the client secret itself when it exchanges the code. Disconnecting or removing a server drops its OAuth client along with its credential. A locked Keyring is `key_locked` (423); a user with no public key yet is `no_user_key` (409).
-
-## Where tools come from
-
-`spec_url` is where the hub reads a server's tools: an `openapi` server's spec URL, a `graphql` server's endpoint (introspection), or `null` when the tools come from an uploaded document (an OpenAPI document or GraphQL SDL). `mcp` servers always have `null` and read `tools/list`.
-
-- `openapi` servers, uploaded `graphql` ones and introspected `graphql` ones with `none`, `bearer`, `api_key` or `basic` are read at create, the last with the credentials sent along with it. The server row, its tools and the sealed credential are written in one batch after the read succeeds; a failed read returns its error and writes nothing. `mcp` servers and introspected `graphql` ones with `oauth` are read after connect, the OAuth ones in the callback once the code is exchanged.
-- Connect, or for OAuth its callback, re-reads servers that have a `spec_url` and `mcp` servers, and a failed re-read doesn't fail it; uploaded ones aren't re-read and return their current tool count. An introspected `graphql` server is the exception: it is read with the new credentials first, and they are stored only when that read succeeds, so a failed connect keeps the old ones.
-- Refresh without `document` re-reads servers that have a `spec_url` and `mcp` servers, and is `invalid` for uploaded ones. Refresh with `document` reads the upload instead, without credentials, so it works before the server is connected; when that read succeeds `spec_url` becomes `null`, whatever it was, and the server reads from uploads from then on. An `mcp` server with `document` is `invalid`.
-- Introspection turned off means uploading SDL. An introspection answer that is a GraphQL response (JSON with `errors` and no `data.__schema`) is `no_introspection` (412) whatever its status; an upstream 401 is `mcp_not_connected` (412); anything else is `mcp_upstream_error` (502). Such a server never gets connected: create writes nothing, connect keeps the old credentials, and the OAuth callback drops the new token while the server row stays. Uploading the SDL with refresh sets `spec_url` to `null`, after which the OAuth callback no longer introspects.
-- Every read stores how many operations or root fields it skipped in `mcp_server.dropped`, even when it found no tools: OpenAPI operations it can't call (a required cookie parameter, a body that is neither JSON nor a form, a body on GET or HEAD), input schemas over 64 KB, and everything past 500 tools.
-- A read that finds no tools writes no tool rows. Otherwise, on the user's own servers (every `openapi` and `graphql` server, and the `mcp` servers they added) the sync upserts the tools it read and deletes the ones that vanished, only rows owned by that user, up to 90 names per statement. Catalogue servers' tools are shared by everyone, so their sync only upserts.
-
-## Outbound fetch
-
-Every request the hub sends goes through `guardedFetch` (`src/guard/`): MCP calls, spec and discovery documents, introspection, API calls, and OAuth discovery, registration, code exchange and refresh. It allows only `https`, refuses `anyknown.com`, `anyknown.app` and their subdomains (`invalid`, 400), and follows redirects itself: up to 3 same-origin hops, checking each one again. A cross-origin redirect, or a fourth one, comes back to the caller as the 3xx, so credentials never reach another origin. Create checks `url` and `spec_url` the same way before it fetches anything, and the OAuth endpoints before it writes anything.
-
-Documents over these sizes are `invalid` (400), whether fetched or uploaded:
-
-| Document                          | Limit  |
-| --------------------------------- | ------ |
-| OpenAPI as JSON (starts with `{`) | 4 MB   |
-| OpenAPI as YAML                   | 512 KB |
-| GraphQL SDL                       | 512 KB |
-| Introspection answer              | 8 MB   |
-
-`openapi` and `graphql` call results keep the first 50 KB of the body and say where they were cut.
-
-## Environments
-
-|            | Worker        | D1            | `PRODUCT_BASE_URL`                 |
-| ---------- | ------------- | ------------- | ---------------------------------- |
-| production | `mcp`         | `mcp`         | `https://app.anyknown.com`         |
-| staging    | `mcp-staging` | `mcp-staging` | `https://staging-app.anyknown.com` |
-
-`PRODUCT_BASE_URL` is product's app host, not the hub's: the OAuth `redirect_uri` (`/api/mcp/callback`) and client id (`/api/mcp/client-metadata`) live there.
-
-## Dev
+TypeScript types for the RPC interface of the anyknown MCP hub, which other Workers call through a service binding. The package ships type declarations only, with no runtime code.
 
 ```sh
-pnpm install
-cp .dev.vars.example .dev.vars
-pnpm dev
+pnpm add -D @anyknown/mcp
 ```
 
-Product's `pnpm dev` starts this worker alongside it (`-c ../../../mcp/wrangler.jsonc`), so the `MCP` binding resolves locally. `pnpm check` runs typecheck, oxlint and oxfmt; `pnpm test` runs the workerd tests.
+```ts
+import type { McpHubRpc } from "@anyknown/mcp";
 
-## Secrets
+interface Env {
+  MCP: Service<McpHubRpc>;
+}
 
-GitHub Actions needs `CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_ACCOUNT_ID`.
-
-## Deploy
+const result = await env.MCP.search(userId, { q: "calendar" });
+```
 
-Only through GitHub Actions. A push to `main` runs `check.yml`; when it is green its `staging` job migrates `mcp-staging` and deploys `mcp-staging`. Production is the manual `deploy.yml` (environment `production`, `main` only): migrate `mcp`, then deploy `mcp`.
+Working on the hub itself? See [docs/hub.md](docs/hub.md).

package/dist/catalog/types.d.ts

@@ -1,4 +1,4 @@
-import type { UpstreamAuth } from "../portable";
+import type { UpstreamAuth } from "../portable/public-types";
 import type { McpConnectionStatus, McpServerRow, McpToolRow } from "../schema";
 export type CatalogServer = McpServerRow & {
     tool_count: number;

package/dist/portable/public-types.d.ts

@@ -0,0 +1,27 @@
+export type McpKind = "mcp" | "openapi" | "graphql";
+export type UpstreamAuth = {
+    type: "none";
+} | {
+    type: "bearer";
+    token: string;
+} | {
+    type: "api_key";
+    in: "header" | "query";
+    name: string;
+    value: string;
+} | {
+    type: "basic";
+    username: string;
+    password: string;
+};
+export type ToolRow = {
+    server_id: string;
+    name: string;
+    title: string | null;
+    description: string;
+    input_schema: string;
+    annotations: string | null;
+    call: string | null;
+    owner: string | null;
+    updated_at: number;
+};

package/dist/public.d.ts

@@ -1,4 +1,4 @@
-export type { AdminServerItem, ApiKeySettings, CallInput, CompleteOauthInput, ConnectInput, ConnectResult, CreatedServer, CreateServerInput, DescribedItem, HubResult, McpServerRow, OauthSettings, OwnServerInput, SearchInput, ServerItem, ToolHit, ToolItem, Transient, } from "./rpc/types";
+export type { AdminServerItem, ApiKeySettings, CallInput, CompleteOauthInput, ConnectInput, ConnectResult, CreatedServer, CreateServerInput, DescribedItem, HubResult, McpServerRow, OauthSettings, SearchInput, ServerItem, ToolHit, ToolItem, Transient, } from "./rpc/types";
 export type { McpHubRpc } from "./rpc/hub-rpc";
 export type { McpAuth, McpConnectionStatus, McpKind } from "./schema";
 export type { McpErrorCode } from "./errors";

package/dist/rpc/hub-rpc.d.ts

@@ -1,4 +1,4 @@
-import type { AdminServerInput, AdminServerItem, CallInput, CompleteOauthInput, ConnectInput, ConnectResult, CreatedServer, CreateServerInput, DescribedItem, HubResult, McpServerRow, OwnServerInput, SearchInput, ServerItem, ToolHit, ToolItem } from "./types";
+import type { AdminServerInput, AdminServerItem, CallInput, CompleteOauthInput, ConnectInput, ConnectResult, CreatedServer, CreateServerInput, DescribedItem, HubResult, McpServerRow, SearchInput, ServerItem, ToolHit, ToolItem } from "./types";
 export interface McpHubRpc {
     search(userId: string, input: SearchInput): Promise<HubResult<ToolHit[]>>;
     describe(userId: string, tools: string[]): Promise<HubResult<{
@@ -10,7 +10,6 @@ export interface McpHubRpc {
     serverTools(userId: string, serverId: string): Promise<HubResult<{
         items: ToolItem[];
     }>>;
-    addServer(userId: string, input: OwnServerInput): Promise<McpServerRow>;
     createServer(userId: string, input: CreateServerInput): Promise<HubResult<CreatedServer>>;
     connectServer(userId: string, serverId: string, input: ConnectInput): Promise<HubResult<ConnectResult>>;
     completeOauth(userId: string, input: CompleteOauthInput): Promise<HubResult<{

package/dist/rpc/types.d.ts

@@ -20,6 +20,7 @@ export type Transient = {
     token_endpoint: string;
     resource: string;
     client_id: string;
+    client_secret_sealed?: string | null;
     exp: number;
 };
 export type SearchInput = {
@@ -37,6 +38,7 @@ export type DescribedItem = {
     description: string;
     input_schema: unknown;
     annotations: unknown;
+    resource: string | null;
 };
 export type ServerItem = {
     id: string;
@@ -59,11 +61,6 @@ export type ToolItem = {
     description: string;
     annotations: unknown;
 };
-export type OwnServerInput = {
-    name: string;
-    url: string;
-    auth: McpAuth;
-};
 export type ApiKeySettings = {
     in: "header" | "query";
     name: string;

package/dist/schema.d.ts

@@ -1,5 +1,4 @@
-import type { McpKind, ToolRow } from "./portable/types";
-export { KINDS } from "./portable/constants";
+import type { McpKind, ToolRow } from "./portable/public-types";
 export type { McpKind };
 export declare const AUTH_KINDS: readonly ["oauth", "bearer", "api_key", "basic", "none"];
 export type McpAuth = (typeof AUTH_KINDS)[number];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anyknown/mcp",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/anyknown-com/mcp.git"

package/dist/client/constants.d.ts

@@ -1,3 +0,0 @@
-export declare const PROTOCOL_VERSION = "2026-07-28";
-export declare const DEFAULT_TIMEOUT_MS = 30000;
-export declare const MAX_TIMEOUT_MS = 120000;

package/dist/client/handshake.d.ts

@@ -1,2 +0,0 @@
-import type { Handshake, Transport } from "./types";
-export declare function handshake(t: Transport): Promise<Handshake>;

package/dist/client/headers-for.d.ts

@@ -1,2 +0,0 @@
-import type { Transport } from "./types";
-export declare function headersFor(t: Transport): Headers;

package/dist/client/index.d.ts

@@ -1,6 +0,0 @@
-export { DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS, PROTOCOL_VERSION } from "./constants";
-export { handshake } from "./handshake";
-export { notify } from "./notify";
-export { parseChallenge } from "./parse-challenge";
-export { rpc } from "./rpc";
-export type { Handshake, RpcResult, Transport } from "./types";

package/dist/client/joined-data-lines.d.ts

@@ -1 +0,0 @@
-export declare function joinedDataLines(block: string): string;

package/dist/client/message-matching-id.d.ts

@@ -1,2 +0,0 @@
-import type { JsonRpcMessage } from "./types";
-export declare function messageMatchingId(raw: string, id: number): JsonRpcMessage | null;

package/dist/client/notify.d.ts

@@ -1,2 +0,0 @@
-import type { Transport } from "./types";
-export declare function notify(t: Transport, method: string): Promise<void>;

package/dist/client/parse-body.d.ts

@@ -1,2 +0,0 @@
-import type { JsonRpcMessage } from "./types";
-export declare function parseBody(response: Response, id: number): Promise<JsonRpcMessage>;

package/dist/client/parse-challenge.d.ts

@@ -1,2 +0,0 @@
-import type { AuthChallenge } from "../errors";
-export declare function parseChallenge(header: string | null): AuthChallenge;

package/dist/client/read-sse.d.ts

@@ -1,2 +0,0 @@
-import type { JsonRpcMessage } from "./types";
-export declare function readSse(response: Response, id: number): Promise<JsonRpcMessage>;

package/dist/client/rpc.d.ts

@@ -1,2 +0,0 @@
-import type { RpcResult, Transport } from "./types";
-export declare function rpc(t: Transport, method: string, params?: Record<string, unknown>): Promise<RpcResult>;

package/dist/client/send.d.ts

@@ -1,2 +0,0 @@
-import type { Transport } from "./types";
-export declare function send(t: Transport, payload: unknown): Promise<Response>;

package/dist/client/types.d.ts

@@ -1,25 +0,0 @@
-export type Transport = {
-    url: string;
-    token?: string | null;
-    sessionId?: string | null;
-    protocolVersion?: string | null;
-    timeoutMs?: number;
-    fetchImpl?: typeof fetch;
-};
-export type RpcResult = {
-    result: unknown;
-    sessionId: string | null;
-};
-export type JsonRpcMessage = {
-    jsonrpc?: string;
-    id?: number | string | null;
-    result?: unknown;
-    error?: {
-        code?: number;
-        message?: string;
-    };
-};
-export type Handshake = {
-    sessionId: string | null;
-    protocolVersion: string | null;
-};

package/dist/portable/apply-auth.d.ts

@@ -1,5 +0,0 @@
-import type { UpstreamAuth } from "./types";
-export declare function applyAuth(auth: UpstreamAuth, target: string | URL, init?: HeadersInit): {
-    url: URL;
-    headers: Headers;
-};

package/dist/portable/args-errors.d.ts

@@ -1,2 +0,0 @@
-import type { OutputUnit } from "@cfworker/json-schema";
-export declare function argsErrors(errors: OutputUnit[]): string;

package/dist/portable/call-tool.d.ts

@@ -1,6 +0,0 @@
-import { type McpSession } from "./mcp";
-import type { CallToolInput } from "./types";
-export declare function callTool(input: CallToolInput): Promise<{
-    result: unknown;
-    session: McpSession;
-}>;

package/dist/portable/constants.d.ts

@@ -1,16 +0,0 @@
-import type { McpSession } from "./mcp/types";
-export declare const KINDS: readonly ["mcp", "openapi", "graphql"];
-export declare const RESULT_TEXT_MAX = 50000;
-export declare const JSON_MAX_BYTES = 4000000;
-export declare const YAML_MAX_BYTES = 512000;
-export declare const SDL_MAX_BYTES = 512000;
-export declare const INTROSPECTION_MAX_BYTES = 8000000;
-export declare const TOOLS_MAX = 500;
-export declare const INPUT_SCHEMA_MAX = 64000;
-export declare const DESCRIPTION_MAX = 1000;
-export declare const TOOL_NAME_MAX = 64;
-export declare const ARG_ERRORS_MAX = 5;
-export declare const SUMMARY_KEYWORDS: Set<string>;
-export declare const DELETE_BATCH = 90;
-export declare const MAX_PAGES = 20;
-export declare const NO_SESSION: McpSession;

package/dist/portable/fetch-document.d.ts

@@ -1 +0,0 @@
-export declare function fetchDocument(url: string, fetchImpl: typeof fetch, max: number): Promise<string>;

package/dist/portable/graphql/args-schema.d.ts

@@ -1,5 +0,0 @@
-import { type GraphQLArgument, type GraphQLInputField } from "graphql";
-import type { UsedTypes } from "./types";
-type InputValue = GraphQLArgument | GraphQLInputField;
-export declare function argsSchema(values: readonly InputValue[], used: UsedTypes): Record<string, unknown>;
-export {};

package/dist/portable/graphql/call-graphql.d.ts

@@ -1,2 +0,0 @@
-import type { GraphqlCall, ToolResult, Upstream } from "../types";
-export declare function callGraphql(upstream: Upstream, call: GraphqlCall, inputSchema: unknown, args: unknown): Promise<ToolResult>;

package/dist/portable/graphql/constants.d.ts

@@ -1,15 +0,0 @@
-export declare const SCALAR_SCHEMAS: Map<string, Record<string, unknown>>;
-export declare const OPERATION_ANNOTATIONS: {
-    query: {
-        readOnlyHint: boolean;
-        destructiveHint: boolean;
-    };
-    mutation: {
-        readOnlyHint: boolean;
-        destructiveHint: boolean;
-    };
-};
-export declare const GRAPHQL_HEADERS: {
-    "content-type": string;
-    accept: string;
-};

package/dist/portable/graphql/default-selection.d.ts

@@ -1,2 +0,0 @@
-import { type GraphQLOutputType } from "graphql";
-export declare function defaultSelection(type: GraphQLOutputType): string;

package/dist/portable/graphql/field-tool.d.ts

@@ -1,4 +0,0 @@
-import type { GraphQLField } from "graphql";
-import type { UpstreamTool } from "../types";
-import type { GraphqlOperation } from "./types";
-export declare function fieldTool(operation: GraphqlOperation, field: GraphQLField<unknown, unknown>): UpstreamTool | null;

package/dist/portable/graphql/index.d.ts

@@ -1,2 +0,0 @@
-export { callGraphql } from "./call-graphql";
-export { readGraphql } from "./read-graphql";

package/dist/portable/graphql/input-defs.d.ts

@@ -1,2 +0,0 @@
-import type { UsedTypes } from "./types";
-export declare function inputDefs(used: UsedTypes): Record<string, unknown>;

package/dist/portable/graphql/input-schema.d.ts

@@ -1,2 +0,0 @@
-import { type GraphQLField } from "graphql";
-export declare function inputSchema(field: GraphQLField<unknown, unknown>, selection: string): Record<string, unknown>;

package/dist/portable/graphql/introspect.d.ts

@@ -1,3 +0,0 @@
-import { type GraphQLSchema } from "graphql";
-import type { Upstream } from "../types";
-export declare function introspect(upstream: Upstream): Promise<GraphQLSchema>;

package/dist/portable/graphql/introspected-schema.d.ts

@@ -1,2 +0,0 @@
-import { type GraphQLSchema } from "graphql";
-export declare function introspectedSchema(response: Response, text: string): GraphQLSchema;

package/dist/portable/graphql/json-of.d.ts

@@ -1 +0,0 @@
-export declare function jsonOf(text: string): unknown;

package/dist/portable/graphql/or-null.d.ts

@@ -1 +0,0 @@
-export declare function orNull(schema: Record<string, unknown>): Record<string, unknown>;

package/dist/portable/graphql/post-graphql.d.ts

@@ -1,2 +0,0 @@
-import type { Upstream } from "../types";
-export declare function postGraphql(upstream: Upstream, body: unknown): Promise<Response>;

package/dist/portable/graphql/query-document.d.ts

@@ -1,2 +0,0 @@
-import type { GraphqlCall } from "../types";
-export declare function queryDocument(call: GraphqlCall, args: Record<string, unknown>, selection: string): string;

package/dist/portable/graphql/read-graphql.d.ts

@@ -1,6 +0,0 @@
-import type { ReadResult, Upstream } from "../types";
-export declare function readGraphql(source: {
-    document: string;
-} | {
-    introspect: Upstream;
-}): Promise<ReadResult>;

package/dist/portable/graphql/schema.d.ts

@@ -1,14 +0,0 @@
-import type { IntrospectionSchema } from "graphql";
-import { z } from "zod";
-export declare const introspectionAnswerSchema: z.ZodObject<{
-    data: z.ZodObject<{
-        __schema: z.ZodCustom<IntrospectionSchema, IntrospectionSchema>;
-    }, z.core.$strip>;
-}, z.core.$strip>;
-export declare const errorsAnswerSchema: z.ZodObject<{
-    errors: z.ZodArray<z.ZodUnknown>;
-}, z.core.$strip>;
-export declare const failedAnswerSchema: z.ZodObject<{
-    errors: z.ZodArray<z.ZodUnknown>;
-    data: z.ZodOptional<z.ZodNull>;
-}, z.core.$strip>;

package/dist/portable/graphql/sdl-schema.d.ts

@@ -1,2 +0,0 @@
-import { type GraphQLSchema } from "graphql";
-export declare function sdlSchema(document: string): GraphQLSchema;

package/dist/portable/graphql/single-root-field.d.ts

@@ -1,3 +0,0 @@
-import { type FieldNode } from "graphql";
-import type { GraphqlCall } from "../types";
-export declare function singleRootField(query: string, call: GraphqlCall): FieldNode | null;

package/dist/portable/graphql/type-schema.d.ts

@@ -1,3 +0,0 @@
-import { type GraphQLInputType } from "graphql";
-import type { UsedTypes } from "./types";
-export declare function typeSchema(type: GraphQLInputType, used: UsedTypes): Record<string, unknown>;

package/dist/portable/graphql/types.d.ts

@@ -1,9 +0,0 @@
-import type { GraphQLEnumType, GraphQLField, GraphQLInputObjectType } from "graphql";
-import type { GraphqlCall } from "../types";
-export type GraphqlOperation = GraphqlCall["operation"];
-export type RootField = [GraphqlOperation, GraphQLField<unknown, unknown>];
-export type UsedTypes = Map<string, GraphQLEnumType | GraphQLInputObjectType>;
-export type GraphqlArgs = {
-    args?: Record<string, unknown>;
-    selection?: string;
-};

package/dist/portable/index.d.ts

@@ -1,15 +0,0 @@
-export { applyAuth } from "./apply-auth";
-export { callTool } from "./call-tool";
-export { ARG_ERRORS_MAX, DELETE_BATCH, DESCRIPTION_MAX, INPUT_SCHEMA_MAX, INTROSPECTION_MAX_BYTES, JSON_MAX_BYTES, KINDS, MAX_PAGES, NO_SESSION, RESULT_TEXT_MAX, SDL_MAX_BYTES, TOOL_NAME_MAX, TOOLS_MAX, YAML_MAX_BYTES, } from "./constants";
-export { callGraphql, readGraphql } from "./graphql";
-export { callMcpTool, listMcpTools, mcpRequest } from "./mcp";
-export type { McpSession } from "./mcp";
-export { callOpenApi, readOpenApi } from "./openapi";
-export { authorizeUrl, discover, exchangeCode, issuerMismatch, pkce, randomState, refreshTokens, registerClient, } from "./oauth";
-export type { Discovery, Tokens } from "./oauth";
-export { readCapped } from "./read-capped";
-export { readTools } from "./read-tools";
-export { staleToolNames } from "./stale-tool-names";
-export { textResult } from "./text-result";
-export { toolRowsOf } from "./tool-rows-of";
-export type { CallToolInput, GraphqlCall, McpKind, OpenApiCall, ReadResult, ReadToolsInput, SpecDefaults, ToolResult, ToolRow, Upstream, UpstreamAuth, UpstreamTool, } from "./types";

package/dist/portable/mcp/call-mcp-tool.d.ts

@@ -1,6 +0,0 @@
-import type { Upstream } from "../types";
-import type { McpSession } from "./types";
-export declare function callMcpTool(upstream: Upstream, session: McpSession, name: string, args: unknown): Promise<{
-    result: unknown;
-    session: McpSession;
-}>;

package/dist/portable/mcp/index.d.ts

@@ -1,4 +0,0 @@
-export { callMcpTool } from "./call-mcp-tool";
-export { listMcpTools } from "./list-mcp-tools";
-export { mcpRequest } from "./mcp-request";
-export type { McpSession } from "./types";

package/dist/portable/mcp/list-mcp-tools.d.ts

@@ -1,6 +0,0 @@
-import type { Upstream, UpstreamTool } from "../types";
-import type { McpSession } from "./types";
-export declare function listMcpTools(upstream: Upstream, session: McpSession): Promise<{
-    tools: UpstreamTool[];
-    session: McpSession;
-}>;

package/dist/portable/mcp/mcp-request.d.ts

@@ -1,6 +0,0 @@
-import type { Upstream } from "../types";
-import type { McpSession } from "./types";
-export declare function mcpRequest(upstream: Upstream, session: McpSession, method: string, params?: Record<string, unknown>): Promise<{
-    result: unknown;
-    session: McpSession;
-}>;

package/dist/portable/mcp/schema.d.ts

@@ -1,11 +0,0 @@
-import { z } from "zod";
-export declare const toolsListSchema: z.ZodObject<{
-    tools: z.ZodArray<z.ZodObject<{
-        name: z.ZodString;
-        title: z.ZodOptional<z.ZodString>;
-        description: z.ZodOptional<z.ZodString>;
-        inputSchema: z.ZodOptional<z.ZodUnknown>;
-        annotations: z.ZodOptional<z.ZodUnknown>;
-    }, z.core.$strip>>;
-    nextCursor: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;

package/dist/portable/mcp/types.d.ts

@@ -1,4 +0,0 @@
-export type McpSession = {
-    sessionId: string | null;
-    protocolVersion: string | null;
-};

package/dist/portable/oauth/authorize-url.d.ts

@@ -1,7 +0,0 @@
-import type { Discovery } from "./types";
-export declare function authorizeUrl(discovery: Discovery, args: {
-    clientId: string;
-    redirectUri: string;
-    state: string;
-    challenge: string;
-}): string;

package/dist/portable/oauth/b64url.d.ts

@@ -1 +0,0 @@
-export declare const b64url: (bytes: Uint8Array) => string;

package/dist/portable/oauth/client-basic.d.ts

@@ -1 +0,0 @@
-export declare function clientBasic(clientId: string, clientSecret: string | null | undefined): string | null;

package/dist/portable/oauth/constants.d.ts

@@ -1 +0,0 @@
-export declare const TIMEOUT_MS = 10000;

package/dist/portable/oauth/discover.d.ts

@@ -1,3 +0,0 @@
-import { type AuthChallenge } from "../../errors";
-import type { Discovery } from "./types";
-export declare function discover(serverUrl: string, challenge: AuthChallenge | null, fetchImpl?: typeof fetch): Promise<Discovery>;

package/dist/portable/oauth/exchange-code.d.ts

@@ -1,9 +0,0 @@
-import type { Discovery, Tokens } from "./types";
-export declare function exchangeCode(args: {
-    discovery: Discovery;
-    clientId: string;
-    clientSecret?: string | null;
-    redirectUri: string;
-    code: string;
-    verifier: string;
-}, fetchImpl?: typeof fetch): Promise<Tokens>;

package/dist/portable/oauth/get-json.d.ts

@@ -1,2 +0,0 @@
-import type { z } from "zod";
-export declare function getJson<T>(url: string, schema: z.ZodType<T>, fetchImpl: typeof fetch): Promise<T | null>;

package/dist/portable/oauth/index.d.ts

@@ -1,11 +0,0 @@
-export { authorizeUrl } from "./authorize-url";
-export { discover } from "./discover";
-export { exchangeCode } from "./exchange-code";
-export { issuerMismatch } from "./issuer-mismatch";
-export { metadataUrls } from "./metadata-urls";
-export { pkce } from "./pkce";
-export { protectedResourceUrl } from "./protected-resource-url";
-export { randomState } from "./random-state";
-export { refreshTokens } from "./refresh-tokens";
-export { registerClient } from "./register-client";
-export type { Discovery, Tokens } from "./types";

package/dist/portable/oauth/issuer-mismatch.d.ts

@@ -1 +0,0 @@
-export declare function issuerMismatch(expected: string, iss: string | null | undefined): boolean;

package/dist/portable/oauth/metadata-urls.d.ts

@@ -1 +0,0 @@
-export declare function metadataUrls(issuer: string): string[];

package/dist/portable/oauth/pick-scope.d.ts

@@ -1,2 +0,0 @@
-import type { AuthChallenge } from "../../errors";
-export declare function pickScope(challenge: AuthChallenge | null, advertised: string[] | undefined): string | null;

package/dist/portable/oauth/pkce.d.ts

@@ -1,4 +0,0 @@
-export declare function pkce(): Promise<{
-    verifier: string;
-    challenge: string;
-}>;

package/dist/portable/oauth/post-token.d.ts

@@ -1,2 +0,0 @@
-import type { Tokens } from "./types";
-export declare function postToken(tokenEndpoint: string, form: URLSearchParams, fetchImpl: typeof fetch, authorization?: string | null): Promise<Tokens>;

package/dist/portable/oauth/protected-resource-url.d.ts

@@ -1 +0,0 @@
-export declare function protectedResourceUrl(resource: string): string;

package/dist/portable/oauth/random-state.d.ts

@@ -1 +0,0 @@
-export declare function randomState(): string;

package/dist/portable/oauth/read-metadata.d.ts

@@ -1,8 +0,0 @@
-export declare function readMetadata(issuer: string, fetchImpl: typeof fetch): Promise<{
-    issuer: string;
-    authorization_endpoint: string;
-    token_endpoint: string;
-    registration_endpoint?: string | undefined;
-    scopes_supported?: string[] | undefined;
-    client_id_metadata_document_supported?: boolean | undefined;
-} | null>;

package/dist/portable/oauth/refresh-tokens.d.ts

@@ -1,7 +0,0 @@
-import type { Discovery, Tokens } from "./types";
-export declare function refreshTokens(args: {
-    discovery: Discovery;
-    clientId: string;
-    clientSecret?: string | null;
-    refreshToken: string;
-}, fetchImpl?: typeof fetch): Promise<Tokens>;

package/dist/portable/oauth/register-client.d.ts

@@ -1,2 +0,0 @@
-import type { Discovery } from "./types";
-export declare function registerClient(metadata: Record<string, unknown>, discovery: Discovery, fetchImpl?: typeof fetch): Promise<string | null>;

package/dist/portable/oauth/schema.d.ts

@@ -1,20 +0,0 @@
-import { z } from "zod";
-export declare const prmSchema: z.ZodObject<{
-    resource: z.ZodOptional<z.ZodString>;
-    authorization_servers: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>;
-export declare const metadataSchema: z.ZodObject<{
-    issuer: z.ZodString;
-    authorization_endpoint: z.ZodString;
-    token_endpoint: z.ZodString;
-    registration_endpoint: z.ZodOptional<z.ZodString>;
-    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    client_id_metadata_document_supported: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$strip>;
-export declare const tokenSchema: z.ZodObject<{
-    access_token: z.ZodString;
-    refresh_token: z.ZodOptional<z.ZodString>;
-    expires_in: z.ZodOptional<z.ZodNumber>;
-    scope: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;

package/dist/portable/oauth/types.d.ts

@@ -1,12 +0,0 @@
-import type { z } from "zod";
-import type { tokenSchema } from "./schema";
-export type Tokens = z.infer<typeof tokenSchema>;
-export type Discovery = {
-    resource: string;
-    issuer: string;
-    authorizationEndpoint: string;
-    tokenEndpoint: string;
-    registrationEndpoint: string | null;
-    scope: string | null;
-    clientIdMetadataSupported: boolean;
-};

package/dist/portable/openapi/annotations-for.d.ts

@@ -1,4 +0,0 @@
-export declare function annotationsFor(method: string): {
-    readOnlyHint: boolean;
-    destructiveHint: boolean;
-};

package/dist/portable/openapi/append-params.d.ts

@@ -1 +0,0 @@
-export declare function appendParams(params: URLSearchParams, values: unknown): void;

package/dist/portable/openapi/call-openapi.d.ts

@@ -1,2 +0,0 @@
-import type { OpenApiCall, ToolResult, Upstream } from "../types";
-export declare function callOpenApi(upstream: Upstream, call: OpenApiCall, inputSchema: unknown, args: unknown): Promise<ToolResult>;

package/dist/portable/openapi/collect-defs.d.ts

@@ -1,2 +0,0 @@
-import type { OpenApiDocument } from "./types";
-export declare function collectDefs(document: OpenApiDocument, used: Set<string>): Record<string, unknown>;

package/dist/portable/openapi/constants.d.ts

@@ -1,6 +0,0 @@
-export declare const OPERATION_METHODS: Set<string>;
-export declare const READ_ONLY_METHODS: Set<string>;
-export declare const BODYLESS_METHODS: Set<string>;
-export declare const BODY_TYPES: readonly [readonly ["application/json", "json"], readonly ["application/x-www-form-urlencoded", "form"]];
-export declare const IGNORED_HEADERS: Set<string>;
-export declare const RESERVED_HEADERS: RegExp;

package/dist/portable/openapi/discovered-oauth.d.ts

@@ -1,2 +0,0 @@
-import type { SpecDefaults } from "../types";
-export declare function discoveredOauth(url: string, fetchImpl: typeof fetch): Promise<SpecDefaults["oauth"] | null>;

package/dist/portable/openapi/has-cyclic-alias.d.ts

@@ -1,2 +0,0 @@
-import { type Document } from "yaml";
-export declare function hasCyclicAlias(document: Document): boolean;

package/dist/portable/openapi/index.d.ts

@@ -1,2 +0,0 @@
-export { callOpenApi } from "./call-openapi";
-export { readOpenApi } from "./read-openapi";

package/dist/portable/openapi/input-schema.d.ts

@@ -1,2 +0,0 @@
-import type { OpenApiDocument, Parameter, RequestBody } from "./types";
-export declare function inputSchema(document: OpenApiDocument, parameters: Parameter[], body: RequestBody): Record<string, unknown>;

package/dist/portable/openapi/merged-parameters.d.ts

@@ -1,2 +0,0 @@
-import type { OpenApiDocument, Parameter } from "./types";
-export declare function mergedParameters(document: OpenApiDocument, pathLevel: unknown[], operationLevel: unknown[]): Parameter[];

package/dist/portable/openapi/operation-tool.d.ts

@@ -1,3 +0,0 @@
-import type { UpstreamTool } from "../types";
-import type { OpenApiDocument, OperationSource } from "./types";
-export declare function operationTool(document: OpenApiDocument, source: OperationSource): UpstreamTool | null;

package/dist/portable/openapi/operations-of.d.ts

@@ -1,2 +0,0 @@
-import type { OpenApiDocument, OperationSource } from "./types";
-export declare function operationsOf(document: OpenApiDocument): OperationSource[];

package/dist/portable/openapi/param-group.d.ts

@@ -1,2 +0,0 @@
-import type { ParamGroup, ParamPlace, Parameter } from "./types";
-export declare function paramGroup(parameters: Parameter[], place: ParamPlace): ParamGroup | null;

package/dist/portable/openapi/parse-document.d.ts

@@ -1,2 +0,0 @@
-import type { OpenApiDocument } from "./types";
-export declare function parseDocument(text: string): OpenApiDocument;

package/dist/portable/openapi/path-segment.d.ts

@@ -1 +0,0 @@
-export declare function pathSegment(value: unknown): string;

package/dist/portable/openapi/read-openapi.d.ts

@@ -1,6 +0,0 @@
-import type { ReadResult } from "../types";
-export declare function readOpenApi(source: {
-    spec_url: string;
-} | {
-    document: string;
-}, fetchImpl: typeof fetch): Promise<ReadResult>;

package/dist/portable/openapi/request-body-schema.d.ts

@@ -1,2 +0,0 @@
-import type { OpenApiDocument, RequestBody } from "./types";
-export declare function requestBodySchema(document: OpenApiDocument, requestBody: unknown): RequestBody | null;

package/dist/portable/openapi/request-body.d.ts

@@ -1,5 +0,0 @@
-import type { OpenApiCall } from "../types";
-export declare function requestBody(kind: OpenApiCall["body"], value: unknown): {
-    text: string;
-    type: string;
-} | null;

package/dist/portable/openapi/request-headers.d.ts

@@ -1,2 +0,0 @@
-import type { UpstreamAuth } from "../types";
-export declare function requestHeaders(auth: UpstreamAuth, values?: Record<string, unknown>): Headers;

package/dist/portable/openapi/request-url.d.ts

@@ -1,2 +0,0 @@
-import type { OpenApiArgs } from "./types";
-export declare function requestUrl(base: string, template: string, { path, query }: OpenApiArgs): URL;

package/dist/portable/openapi/resolve-ref.d.ts

@@ -1 +0,0 @@
-export declare function resolveRef(document: unknown, node: unknown): unknown;

package/dist/portable/openapi/rewrite-refs.d.ts

@@ -1 +0,0 @@
-export declare function rewriteRefs(node: unknown, used: Set<string>): unknown;

package/dist/portable/openapi/schema.d.ts

@@ -1,66 +0,0 @@
-import { z } from "zod";
-export declare const documentSchema: z.ZodObject<{
-    paths: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-    components: z.ZodOptional<z.ZodObject<{
-        schemas: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        securitySchemes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    }, z.core.$loose>>;
-}, z.core.$loose>;
-export declare const pathItemObjectSchema: z.ZodObject<{
-    parameters: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
-}, z.core.$loose>;
-export declare const operationObjectSchema: z.ZodObject<{
-    operationId: z.ZodOptional<z.ZodString>;
-    summary: z.ZodOptional<z.ZodString>;
-    description: z.ZodOptional<z.ZodString>;
-    parameters: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
-    requestBody: z.ZodOptional<z.ZodUnknown>;
-}, z.core.$strip>;
-export declare const parameterObjectSchema: z.ZodObject<{
-    name: z.ZodString;
-    in: z.ZodEnum<{
-        cookie: "cookie";
-        header: "header";
-        path: "path";
-        query: "query";
-    }>;
-    required: z.ZodOptional<z.ZodBoolean>;
-    description: z.ZodOptional<z.ZodString>;
-    schema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-}, z.core.$strip>;
-export declare const requestBodyObjectSchema: z.ZodObject<{
-    required: z.ZodOptional<z.ZodBoolean>;
-    content: z.ZodRecord<z.ZodString, z.ZodObject<{
-        schema: z.ZodOptional<z.ZodUnknown>;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-export declare const refObjectSchema: z.ZodObject<{
-    $ref: z.ZodString;
-}, z.core.$strip>;
-export declare const apiKeySchemeSchema: z.ZodObject<{
-    type: z.ZodLiteral<"apiKey">;
-    in: z.ZodEnum<{
-        header: "header";
-        query: "query";
-    }>;
-    name: z.ZodString;
-}, z.core.$strip>;
-export declare const oauth2SchemeSchema: z.ZodObject<{
-    type: z.ZodLiteral<"oauth2">;
-    flows: z.ZodObject<{
-        authorizationCode: z.ZodObject<{
-            authorizationUrl: z.ZodString;
-            tokenUrl: z.ZodString;
-            scopes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        }, z.core.$strip>;
-    }, z.core.$strip>;
-}, z.core.$strip>;
-export declare const openIdSchemeSchema: z.ZodObject<{
-    type: z.ZodLiteral<"openIdConnect">;
-    openIdConnectUrl: z.ZodString;
-}, z.core.$strip>;
-export declare const discoverySchema: z.ZodObject<{
-    authorization_endpoint: z.ZodString;
-    token_endpoint: z.ZodString;
-    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>;

package/dist/portable/openapi/spec-defaults.d.ts

@@ -1,3 +0,0 @@
-import type { SpecDefaults } from "../types";
-import type { OpenApiDocument } from "./types";
-export declare function specDefaults(document: OpenApiDocument, fetchImpl: typeof fetch): Promise<SpecDefaults>;

package/dist/portable/openapi/tool-name.d.ts

@@ -1 +0,0 @@
-export declare function toolName(operationId: string | undefined, method: string, path: string): string;

package/dist/portable/openapi/types.d.ts

@@ -1,27 +0,0 @@
-import type { z } from "zod";
-import type { OpenApiCall } from "../types";
-import type { documentSchema, parameterObjectSchema } from "./schema";
-export type OpenApiDocument = z.infer<typeof documentSchema>;
-export type Parameter = z.infer<typeof parameterObjectSchema>;
-export type ParamPlace = Exclude<Parameter["in"], "cookie">;
-export type ParamGroup = {
-    schema: unknown;
-    required: boolean;
-};
-export type RequestBody = {
-    kind: OpenApiCall["body"];
-    schema: unknown;
-    required: boolean;
-};
-export type OperationSource = {
-    path: string;
-    method: string;
-    pathParameters: unknown[];
-    operation: unknown;
-};
-export type OpenApiArgs = {
-    path?: Record<string, unknown>;
-    query?: Record<string, unknown>;
-    header?: Record<string, unknown>;
-    body?: unknown;
-};

package/dist/portable/openapi/unique-names.d.ts

@@ -1 +0,0 @@
-export declare function uniqueNames(names: string[]): string[];

package/dist/portable/openapi/yaml-value.d.ts

@@ -1 +0,0 @@
-export declare function yamlValue(text: string): unknown;

package/dist/portable/read-capped.d.ts

@@ -1,4 +0,0 @@
-export declare function readCapped(body: ReadableStream<Uint8Array> | null, max: number): Promise<{
-    text: string;
-    truncated: boolean;
-}>;

package/dist/portable/read-tools.d.ts

@@ -1,2 +0,0 @@
-import type { ReadResult, ReadToolsInput } from "./types";
-export declare function readTools(input: ReadToolsInput): Promise<ReadResult>;

package/dist/portable/stale-tool-names.d.ts

@@ -1,2 +0,0 @@
-import type { UpstreamTool } from "./types";
-export declare function staleToolNames(existing: string[], fresh: Pick<UpstreamTool, "name">[]): string[];

package/dist/portable/text-result.d.ts

@@ -1,5 +0,0 @@
-import type { ToolResult } from "./types";
-export declare function textResult(text: string, { isError, truncated }: {
-    isError: boolean;
-    truncated?: boolean;
-}): ToolResult;

package/dist/portable/tool-rows-of.d.ts

@@ -1,2 +0,0 @@
-import type { ToolRow, UpstreamTool } from "./types";
-export declare function toolRowsOf(serverId: string, owner: string | null, tools: UpstreamTool[], now: number): ToolRow[];

package/dist/portable/types.d.ts

@@ -1,92 +0,0 @@
-import type { KINDS } from "./constants";
-import type { McpSession } from "./mcp/types";
-export type McpKind = (typeof KINDS)[number];
-export type UpstreamAuth = {
-    type: "none";
-} | {
-    type: "bearer";
-    token: string;
-} | {
-    type: "api_key";
-    in: "header" | "query";
-    name: string;
-    value: string;
-} | {
-    type: "basic";
-    username: string;
-    password: string;
-};
-export type Upstream = {
-    url: string;
-    auth: UpstreamAuth;
-    fetch: typeof fetch;
-    timeoutMs?: number;
-};
-export type UpstreamTool = {
-    name: string;
-    title: string | null;
-    description: string;
-    input_schema: unknown;
-    annotations: unknown;
-    call: unknown;
-};
-export type ToolResult = {
-    content: [{
-        type: "text";
-        text: string;
-    }];
-    isError: boolean;
-};
-export type OpenApiCall = {
-    method: string;
-    path: string;
-    body: "json" | "form" | null;
-};
-export type GraphqlCall = {
-    operation: "query" | "mutation";
-    field: string;
-    arg_types: Record<string, string>;
-    selection: string;
-};
-export type SpecDefaults = {
-    api_key?: {
-        in: "header" | "query";
-        name: string;
-    };
-    oauth?: {
-        authorize_url: string;
-        token_url: string;
-        scopes: string[];
-    };
-};
-export type ReadResult = {
-    tools: UpstreamTool[];
-    dropped: number;
-    defaults: SpecDefaults;
-    session: McpSession | null;
-};
-export type ToolRow = {
-    server_id: string;
-    name: string;
-    title: string | null;
-    description: string;
-    input_schema: string;
-    annotations: string | null;
-    call: string | null;
-    owner: string | null;
-    updated_at: number;
-};
-export type ReadToolsInput = {
-    kind: McpKind;
-    upstream: Upstream;
-    session: McpSession;
-    spec_url: string | null;
-    document?: string;
-};
-export type CallToolInput = {
-    kind: McpKind;
-    upstream: Upstream;
-    session: McpSession;
-    tool: Pick<ToolRow, "name" | "input_schema" | "call">;
-    args: unknown;
-};