@atelierai/uco 1.0.0

package/dist/server/config.js

@@ -0,0 +1,146 @@
+/**
+ * Server configuration — parse CLI args into a ServerConfig object.
+ *
+ * Mirrors the .NET DataArguments parameters.
+ */
+import { DEFAULT_HEARTBEAT_INTERVAL_MS, DEFAULT_PORT, DEFAULT_PLUGIN_TIMEOUT_MS, } from './types.js';
+export const DEFAULT_SERVER_API_VERSION = '2.0.0';
+export const DEFAULT_SERVER_VERSION = '0.2.1-node';
+/**
+ * Parse CLI args into a ServerConfig.
+ * Supports: --port, --listen-host, --allow-lan, --token, --authorization,
+ * --plugin-timeout-ms, --heartbeat-interval-ms, --webhook-url
+ */
+export function parseServerConfig(args, environment = process.env) {
+    const config = {
+        port: DEFAULT_PORT,
+        listenHost: '127.0.0.1',
+        allowLan: false,
+        authorization: 'required',
+        pluginTimeoutMs: DEFAULT_PLUGIN_TIMEOUT_MS,
+        heartbeatIntervalMs: DEFAULT_HEARTBEAT_INTERVAL_MS,
+        serverApiVersion: DEFAULT_SERVER_API_VERSION,
+        serverVersion: DEFAULT_SERVER_VERSION,
+    };
+    let cliToken;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        const next = args[i + 1];
+        switch (arg) {
+            case '--port':
+                if (next) {
+                    config.port = parseInt(next, 10);
+                    i++;
+                }
+                break;
+            case '--listen-host':
+                if (next !== undefined) {
+                    config.listenHost = next;
+                    i++;
+                }
+                break;
+            case '--allow-lan':
+                config.allowLan = true;
+                break;
+            case '--token':
+                if (next !== undefined) {
+                    cliToken = next;
+                    i++;
+                }
+                break;
+            case '--authorization':
+                if (next === 'none' || next === 'required') {
+                    config.authorization = next;
+                    i++;
+                }
+                else {
+                    throw new Error('--authorization must be "none" or "required".');
+                }
+                break;
+            case '--plugin-timeout-ms':
+                if (next) {
+                    config.pluginTimeoutMs = parseInt(next, 10);
+                    i++;
+                }
+                break;
+            case '--heartbeat-interval-ms':
+                if (next) {
+                    config.heartbeatIntervalMs = parseInt(next, 10);
+                    i++;
+                }
+                break;
+            case '--webhook-url':
+                if (next !== undefined) {
+                    config.webhookUrl = next;
+                    i++;
+                }
+                break;
+        }
+    }
+    // The explicit CLI credential always wins over the owned-process channel.
+    config.token = normalizeToken(cliToken ?? environment.UCO_SERVER_TOKEN);
+    return validateServerConfig(config);
+}
+/** Normalize brackets used in URL-form IPv6 literals before socket binding. */
+export function normalizeListenHost(host) {
+    const trimmed = host.trim();
+    return trimmed.startsWith('[') && trimmed.endsWith(']')
+        ? trimmed.slice(1, -1)
+        : trimmed;
+}
+/** Classify loopback without resolving arbitrary DNS names. */
+export function isLoopbackHost(host) {
+    const normalized = normalizeListenHost(host).toLowerCase();
+    if (normalized === 'localhost' || normalized === '::1')
+        return true;
+    const octets = normalized.split('.');
+    return octets.length === 4
+        && octets.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255)
+        && octets[0] === '127';
+}
+/**
+ * Re-check the transport security contract at the public server boundary.
+ * Programmatic callers therefore cannot bypass the CLI parser's validation.
+ */
+export function validateServerConfig(config) {
+    const listenHost = normalizeListenHost(config.listenHost);
+    const token = normalizeToken(config.token);
+    if (listenHost.length === 0) {
+        throw new Error('listenHost must be a non-empty hostname or address.');
+    }
+    if (!Number.isInteger(config.port) || config.port < 0 || config.port > 65535) {
+        throw new Error('port must be an integer between 0 and 65535.');
+    }
+    if (config.authorization !== 'none' && config.authorization !== 'required') {
+        throw new Error('authorization must be "none" or "required".');
+    }
+    if (config.authorization === 'required' && !token) {
+        throw new Error('Bearer authentication is required by default. Supply --token, set UCO_SERVER_TOKEN, ' +
+            'or explicitly select loopback-only --authorization none.');
+    }
+    if (config.authorization === 'none' && token) {
+        throw new Error('A bearer token cannot be combined with --authorization none.');
+    }
+    const loopback = isLoopbackHost(listenHost);
+    if (!loopback && !config.allowLan) {
+        throw new Error(`Non-loopback listen host "${listenHost}" requires explicit --allow-lan.`);
+    }
+    if (!loopback && (config.authorization !== 'required' || !token)) {
+        throw new Error('LAN listening requires bearer authentication and a non-empty token.');
+    }
+    if (config.authorization === 'none' && !loopback) {
+        throw new Error('Unauthenticated mode is restricted to loopback listeners.');
+    }
+    return {
+        ...config,
+        listenHost,
+        ...(token === undefined ? { token: undefined } : { token }),
+    };
+}
+function normalizeToken(value) {
+    if (value === undefined)
+        return undefined;
+    const normalized = value.trim();
+    return normalized.length > 0 ? normalized : undefined;
+}
+//# sourceMappingURL=config.js.map

package/dist/server/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/server/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,6BAA6B,EAC7B,YAAY,EACZ,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AAyBpB,MAAM,CAAC,MAAM,0BAA0B,GAAG,OAAO,CAAC;AAClD,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAEnD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAc,EACd,cAA4D,OAAO,CAAC,GAAG;IAEvE,MAAM,MAAM,GAAiB;QAC3B,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,WAAW;QACvB,QAAQ,EAAE,KAAK;QACf,aAAa,EAAE,UAAU;QACzB,eAAe,EAAE,yBAAyB;QAC1C,mBAAmB,EAAE,6BAA6B;QAClD,gBAAgB,EAAE,0BAA0B;QAC5C,aAAa,EAAE,sBAAsB;KACtC,CAAC;IACF,IAAI,QAA4B,CAAC;IAEjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAEzB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,QAAQ;gBACX,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACjC,CAAC,EAAE,CAAC;gBACN,CAAC;gBACD,MAAM;YACR,KAAK,eAAe;gBAClB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;oBACzB,CAAC,EAAE,CAAC;gBACN,CAAC;gBACD,MAAM;YACR,KAAK,aAAa;gBAChB,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACvB,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,QAAQ,GAAG,IAAI,CAAC;oBAChB,CAAC,EAAE,CAAC;gBACN,CAAC;gBACD,MAAM;YACR,KAAK,iBAAiB;gBACpB,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC3C,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;oBAC5B,CAAC,EAAE,CAAC;gBACN,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBACnE,CAAC;gBACD,MAAM;YACR,KAAK,qBAAqB;gBACxB,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,CAAC,eAAe,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC5C,CAAC,EAAE,CAAC;gBACN,CAAC;gBACD,MAAM;YACR,KAAK,yBAAyB;gBAC5B,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,CAAC,mBAAmB,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAChD,CAAC,EAAE,CAAC;gBACN,CAAC;gBACD,MAAM;YACR,KAAK,eAAe;gBAClB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;oBACzB,CAAC,EAAE,CAAC;gBACN,CAAC;gBACD,MAAM;QACV,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,MAAM,CAAC,KAAK,GAAG,cAAc,CAAC,QAAQ,IAAI,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAExE,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtB,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC;WACrB,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;WACrE,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,IAAI,MAAM,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,sFAAsF;YACtF,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,IAAI,KAAK,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,6BAA6B,UAAU,kCAAkC,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,UAAU;QACV,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAC/C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC"}

package/dist/server/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Node MCP Server — entry point and public exports.
+ *
+ * Exports createServer(), ServerConfig, and shared types.
+ * Also provides a main() function for the `uco serve` subcommand / bin entry.
+ */
+export { createServer, type ListeningAddress, type McpServerHandle, type OwnedServerRuntime, } from './app.js';
+export { isLoopbackHost, normalizeListenHost, parseServerConfig, validateServerConfig, type ServerConfig, DEFAULT_SERVER_API_VERSION, DEFAULT_SERVER_VERSION, } from './config.js';
+export { ConnectionRegistry } from './ws/registry.js';
+export { PendingTracker } from './ws/pending.js';
+export { McpHub } from './ws/hub.js';
+export { SessionStateStore, type SessionState } from './session/store.js';
+export * as types from './types.js';
+/**
+ * Main entry point for `uco serve` or `bin/server.mjs`.
+ * Parses process.argv and starts the server.
+ */
+export declare function main(argv: string[]): Promise<void>;

package/dist/server/index.js

@@ -0,0 +1,139 @@
+/**
+ * Node MCP Server — entry point and public exports.
+ *
+ * Exports createServer(), ServerConfig, and shared types.
+ * Also provides a main() function for the `uco serve` subcommand / bin entry.
+ */
+export { createServer, } from './app.js';
+export { isLoopbackHost, normalizeListenHost, parseServerConfig, validateServerConfig, DEFAULT_SERVER_API_VERSION, DEFAULT_SERVER_VERSION, } from './config.js';
+export { ConnectionRegistry } from './ws/registry.js';
+export { PendingTracker } from './ws/pending.js';
+export { McpHub } from './ws/hub.js';
+export { SessionStateStore } from './session/store.js';
+export * as types from './types.js';
+import { createServer } from './app.js';
+import { parseServerConfig } from './config.js';
+const OWNED_HANDOFF_ARGUMENT = '--owned-ipc-handoff';
+/**
+ * Main entry point for `uco serve` or `bin/server.mjs`.
+ * Parses process.argv and starts the server.
+ */
+export async function main(argv) {
+    const args = argv.slice(2); // skip node + script
+    const config = parseServerConfig(args);
+    if (args.includes(OWNED_HANDOFF_ARGUMENT)) {
+        const serverInstanceId = process.env.COCLI_SERVER_INSTANCE_ID?.trim();
+        if (!serverInstanceId) {
+            throw new Error('Owned IPC handoff requires COCLI_SERVER_INSTANCE_ID.');
+        }
+        startOwnedIpcChild(config, serverInstanceId);
+        return;
+    }
+    const server = createServer(config);
+    const listening = await server.start();
+    const displayHost = listening.address.includes(':') ? `[${listening.address}]` : listening.address;
+    console.log(`Node MCP Server listening on http://${displayHost}:${listening.port}`);
+    console.log(`  API version:  ${config.serverApiVersion}`);
+    console.log(`  Server version: ${config.serverVersion}`);
+    console.log(`  Auth: ${config.authorization}`);
+    console.log(`  WebSocket hub: ws://${displayHost}:${listening.port}/hub/mcp-server`);
+    console.log(`  REST:  http://${displayHost}:${listening.port}/help`);
+    // Graceful shutdown.
+    const shutdown = async () => {
+        console.log('\nShutting down...');
+        await server.stop();
+        process.exit(0);
+    };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+}
+/**
+ * Keep a handed-off child coupled to its parent until an exact-instance
+ * commit arrives. A precommit child always closes on abort or IPC loss.
+ */
+function startOwnedIpcChild(config, serverInstanceId) {
+    const runtime = { serverInstanceId, phase: 'precommit' };
+    const server = createServer(config, runtime);
+    let attached = false;
+    let closing = false;
+    const send = (message) => {
+        if (!process.connected || process.send === undefined) {
+            throw new Error('The uco parent IPC channel is unavailable.');
+        }
+        process.send(message);
+    };
+    const abort = async (exitCode) => {
+        if (closing || runtime.phase === 'committed')
+            return;
+        closing = true;
+        if (attached)
+            await server.stop();
+        if (process.connected)
+            process.disconnect();
+        process.exit(exitCode);
+    };
+    const shutdown = async (exitCode) => {
+        if (closing)
+            return;
+        closing = true;
+        if (attached)
+            await server.stop();
+        if (process.connected)
+            process.disconnect();
+        process.exit(exitCode);
+    };
+    process.on('message', (raw, handle) => {
+        void (async () => {
+            const message = raw;
+            if (message.serverInstanceId !== serverInstanceId) {
+                await abort(1);
+                return;
+            }
+            if (message.type === 'uco-owned-abort') {
+                await abort(1);
+                return;
+            }
+            if (message.type === 'uco-owned-handoff') {
+                if (attached || !isTransferredServer(handle)) {
+                    send({
+                        type: 'uco-owned-error',
+                        serverInstanceId,
+                        detail: 'The transferred listening handle was missing or invalid.',
+                    });
+                    await abort(1);
+                    return;
+                }
+                try {
+                    await server.startWithHandle(handle);
+                    attached = true;
+                    send({ type: 'uco-owned-attached', serverInstanceId });
+                }
+                catch (error) {
+                    send({
+                        type: 'uco-owned-error',
+                        serverInstanceId,
+                        detail: error instanceof Error ? error.message : String(error),
+                    });
+                    await abort(1);
+                }
+                return;
+            }
+            if (message.type === 'uco-owned-commit') {
+                if (!attached || runtime.phase !== 'precommit') {
+                    await abort(1);
+                    return;
+                }
+                runtime.phase = 'committed';
+                send({ type: 'uco-owned-committed', serverInstanceId });
+            }
+        })().catch(() => void abort(1));
+    });
+    process.once('disconnect', () => { void abort(1); });
+    process.once('SIGINT', () => { void shutdown(0); });
+    process.once('SIGTERM', () => { void shutdown(0); });
+}
+function isTransferredServer(handle) {
+    return typeof handle === 'object' && handle !== null &&
+        'address' in handle && typeof handle.address === 'function';
+}
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,YAAY,GAIb,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EAEpB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAqB,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAEpC,OAAO,EAAE,YAAY,EAA2B,MAAM,UAAU,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGhD,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAarD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAc;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB;IACjD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAEvC,IAAI,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;QACtE,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAEpC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;IAEnG,OAAO,CAAC,GAAG,CAAC,uCAAuC,WAAW,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,yBAAyB,WAAW,IAAI,SAAS,CAAC,IAAI,iBAAiB,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,mBAAmB,WAAW,IAAI,SAAS,CAAC,IAAI,OAAO,CAAC,CAAC;IAErE,qBAAqB;IACrB,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;QACzC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,MAA4C,EAC5C,gBAAwB;IAExB,MAAM,OAAO,GAAuB,EAAE,gBAAgB,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,IAAI,GAAG,CAAC,OAA0B,EAAQ,EAAE;QAChD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,EAAE,QAAgB,EAAiB,EAAE;QACtD,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW;YAAE,OAAO;QACrD,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,QAAQ;YAAE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,UAAU,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAgB,EAAiB,EAAE;QACzD,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,QAAQ;YAAE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,UAAU,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAY,EAAE,MAAe,EAAE,EAAE;QACtD,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,OAAO,GAAG,GAAkC,CAAC;YACnD,IAAI,OAAO,CAAC,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;gBAClD,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;gBACf,OAAO;YACT,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACvC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;gBACf,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACzC,IAAI,QAAQ,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7C,IAAI,CAAC;wBACH,IAAI,EAAE,iBAAiB;wBACvB,gBAAgB;wBAChB,MAAM,EAAE,0DAA0D;qBACnE,CAAC,CAAC;oBACH,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;oBACf,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;oBACrC,QAAQ,GAAG,IAAI,CAAC;oBAChB,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBACzD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC;wBACH,IAAI,EAAE,iBAAiB;wBACvB,gBAAgB;wBAChB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC/D,CAAC,CAAC;oBACH,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjB,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACxC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;oBAC/C,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;oBACf,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC;gBAC5B,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAe;IAC1C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAClD,SAAS,IAAI,MAAM,IAAI,OAAQ,MAAoB,CAAC,OAAO,KAAK,UAAU,CAAC;AAC/E,CAAC"}

package/dist/server/origin.d.ts

@@ -0,0 +1,3 @@
+import type { IncomingMessage } from 'node:http';
+/** Any non-empty browser Origin is forbidden until uco has an allowlist. */
+export declare function hasForbiddenOrigin(req: IncomingMessage): boolean;

package/dist/server/origin.js

@@ -0,0 +1,8 @@
+/** Any non-empty browser Origin is forbidden until uco has an allowlist. */
+export function hasForbiddenOrigin(req) {
+    const origin = req.headers.origin;
+    if (Array.isArray(origin))
+        return origin.some((value) => value.length > 0);
+    return typeof origin === 'string' && origin.length > 0;
+}
+//# sourceMappingURL=origin.js.map

package/dist/server/origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.js","sourceRoot":"","sources":["../../src/server/origin.ts"],"names":[],"mappings":"AAEA,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,GAAoB;IACrD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3E,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AACzD,CAAC"}

package/dist/server/rest/auth.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Bearer-token auth middleware + session-ID resolution.
+ *
+ * When `token` is configured:
+ *   - REST: validate `Authorization: Bearer {token}` → 401 on mismatch
+ *   - WS: validate `?access_token=` query param or `Authorization` header
+ *
+ * When `token` is empty: all endpoints open (auth=none).
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+export interface AuthOptions {
+    token?: string;
+}
+/**
+ * REST auth middleware. Returns true if the request is authorized, false if
+ * a 401 response was sent.
+ */
+export declare function restAuthMiddleware(req: IncomingMessage, res: ServerResponse, opts: AuthOptions): boolean;
+/**
+ * Extract the session ID from the Mcp-Session-Id header.
+ * Returns the stdio sentinel when the header is absent.
+ */
+export declare function extractSessionId(req: IncomingMessage): string;

package/dist/server/rest/auth.js

@@ -0,0 +1,57 @@
+/**
+ * Bearer-token auth middleware + session-ID resolution.
+ *
+ * When `token` is configured:
+ *   - REST: validate `Authorization: Bearer {token}` → 401 on mismatch
+ *   - WS: validate `?access_token=` query param or `Authorization` header
+ *
+ * When `token` is empty: all endpoints open (auth=none).
+ */
+import { timingSafeEqual } from 'node:crypto';
+import { SESSION_ID_HEADER, STDIO_SESSION_ID } from '../types.js';
+import { sendError } from './context.js';
+/**
+ * REST auth middleware. Returns true if the request is authorized, false if
+ * a 401 response was sent.
+ */
+export function restAuthMiddleware(req, res, opts) {
+    if (!opts.token)
+        return true; // auth=none
+    const auth = req.headers['authorization'];
+    if (!auth) {
+        sendUnauthorized(res, 'Missing Authorization header.');
+        return false;
+    }
+    const match = /^Bearer\s+(.+)$/i.exec(auth);
+    if (!match || !tokensMatch(match[1], opts.token)) {
+        sendUnauthorized(res, 'Invalid or mismatched bearer token.');
+        return false;
+    }
+    return true;
+}
+/**
+ * Extract the session ID from the Mcp-Session-Id header.
+ * Returns the stdio sentinel when the header is absent.
+ */
+export function extractSessionId(req) {
+    const raw = req.headers[SESSION_ID_HEADER];
+    if (typeof raw === 'string' && raw.length > 0)
+        return raw;
+    return STDIO_SESSION_ID;
+}
+function sendUnauthorized(res, message) {
+    sendError(res, 401, 'unauthorized', message, false);
+}
+/**
+ * Constant-time string comparison to mitigate timing attacks on auth tokens.
+ * Returns true when the strings are equal. When lengths differ, returns
+ * false immediately (timingSafeEqual throws on unequal-length buffers).
+ */
+function tokensMatch(a, b) {
+    const aBuf = Buffer.from(a);
+    const bBuf = Buffer.from(b);
+    if (aBuf.length !== bBuf.length)
+        return false;
+    return timingSafeEqual(aBuf, bBuf);
+}
+//# sourceMappingURL=auth.js.map

package/dist/server/rest/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/rest/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAMzC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAoB,EACpB,GAAmB,EACnB,IAAiB;IAEjB,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,YAAY;IAE1C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,gBAAgB,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;QACvD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,gBAAgB,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAoB;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1D,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAmB,EAAE,OAAe;IAC5D,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC"}

package/dist/server/rest/calls.d.ts

@@ -0,0 +1,13 @@
+/**
+ * REST routes: GET /api/calls, GET /api/calls/{callId} (COCli-09).
+ *
+ * Bounded query surface over the durable call-record store so an observed
+ * transport timeout ("result unknown") can be resolved to a terminal state
+ * afterwards, including late completions from NotifyToolRequestCompleted.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { RestContext } from './context.js';
+/** GET /api/calls?limit=&state= — most recent call records. */
+export declare function handleListCalls(req: IncomingMessage, res: ServerResponse, ctx: RestContext): Promise<void>;
+/** GET /api/calls/{callId} — one call record. */
+export declare function handleGetCall(req: IncomingMessage, res: ServerResponse, ctx: RestContext, callId: string): Promise<void>;

package/dist/server/rest/calls.js

@@ -0,0 +1,54 @@
+/**
+ * REST routes: GET /api/calls, GET /api/calls/{callId} (COCli-09).
+ *
+ * Bounded query surface over the durable call-record store so an observed
+ * transport timeout ("result unknown") can be resolved to a terminal state
+ * afterwards, including late completions from NotifyToolRequestCompleted.
+ */
+import { sendJson } from './context.js';
+import { restAuthMiddleware } from './auth.js';
+const VALID_STATES = [
+    'pending', 'processing', 'succeeded', 'failed', 'cancelled', 'abandoned',
+];
+/** GET /api/calls?limit=&state= — most recent call records. */
+export async function handleListCalls(req, res, ctx) {
+    if (!restAuthMiddleware(req, res, { token: ctx.authToken }))
+        return;
+    const url = new URL(req.url ?? '', 'http://localhost');
+    const limitRaw = url.searchParams.get('limit');
+    const stateRaw = url.searchParams.get('state');
+    let limit = 50;
+    if (limitRaw !== null) {
+        const parsed = Number.parseInt(limitRaw, 10);
+        if (!Number.isInteger(parsed) || parsed < 1 || parsed > 200) {
+            sendJson(res, 400, { error: 'limit must be an integer between 1 and 200.' });
+            return;
+        }
+        limit = parsed;
+    }
+    let state;
+    if (stateRaw !== null && stateRaw.length > 0) {
+        if (!VALID_STATES.includes(stateRaw)) {
+            sendJson(res, 400, { error: `state must be one of: ${VALID_STATES.join(', ')}.` });
+            return;
+        }
+        state = stateRaw;
+    }
+    const calls = ctx.callRecords.list({ limit, state });
+    sendJson(res, 200, { count: calls.length, calls });
+}
+/** GET /api/calls/{callId} — one call record. */
+export async function handleGetCall(req, res, ctx, callId) {
+    if (!restAuthMiddleware(req, res, { token: ctx.authToken }))
+        return;
+    const decoded = decodeURIComponent(callId);
+    const record = ctx.callRecords.get(decoded);
+    if (record === undefined) {
+        sendJson(res, 404, {
+            error: `No call record '${decoded}'. Records are bounded (256 entries / 30 minutes) — list recent calls via GET /api/calls.`,
+        });
+        return;
+    }
+    sendJson(res, 200, { call: record });
+}
+//# sourceMappingURL=calls.js.map

package/dist/server/rest/calls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"calls.js","sourceRoot":"","sources":["../../../src/server/rest/calls.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAG/C,MAAM,YAAY,GAA+B;IAC/C,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW;CACzE,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAoB,EACpB,GAAmB,EACnB,GAAgB;IAEhB,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QAAE,OAAO;IAEpE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAE/C,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YAC5D,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,KAAK,GAAG,MAAM,CAAC;IACjB,CAAC;IACD,IAAI,KAAkC,CAAC;IACvC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAA2B,CAAC,EAAE,CAAC;YACxD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,KAAK,GAAG,QAA2B,CAAC;IACtC,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAoB,EACpB,GAAmB,EACnB,GAAgB,EAChB,MAAc;IAEd,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QAAE,OAAO;IAEpE,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACjB,KAAK,EAAE,mBAAmB,OAAO,2FAA2F;SAC7H,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACvC,CAAC"}

package/dist/server/rest/context.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Shared REST handler context — carries all server dependencies
+ * needed by route handlers.
+ */
+import type { ConnectionRegistry } from '../ws/registry.js';
+import type { PendingTracker } from '../ws/pending.js';
+import type { McpHub } from '../ws/hub.js';
+import type { SessionStateStore } from '../session/store.js';
+import type { CallRecordStore } from '../calls/call-record-store.js';
+import type { OwnedServerRuntime } from '../app.js';
+import { type ToolCallContext, type ToolCallStructuredError } from '../../tool-call-control.js';
+export interface RestContext {
+    registry: ConnectionRegistry;
+    pending: PendingTracker;
+    hub: McpHub;
+    sessionStore: SessionStateStore;
+    /** Bounded durable call records (COCli-09); queryable after a timeout. */
+    callRecords: CallRecordStore;
+    pluginTimeoutMs: number;
+    authToken?: string;
+    ownedRuntime?: OwnedServerRuntime;
+}
+/** Helper to send a JSON response with the correct content type. */
+export declare function sendJson(res: import('node:http').ServerResponse, statusCode: number, body: unknown): void;
+export declare function sendError(res: import('node:http').ServerResponse, statusCode: number, code: string, message: string, retryable?: boolean, details?: unknown): void;
+/** Whether a REST body is the explicit `{ arguments, control }` form. */
+export declare function isExplicitToolCallWrapper(body: unknown): boolean;
+/**
+ * Send a stable controlled-call error. Legacy route failures continue to use
+ * the existing string-oriented `{ error: string }` path in their handlers.
+ */
+export declare function sendStructuredToolCallError(res: import('node:http').ServerResponse, error: unknown, context?: Pick<ToolCallContext, 'callId' | 'correlationId'>, fallback?: Partial<ToolCallStructuredError>): void;
+/** Build an abort signal that follows a REST caller while it is in flight. */
+export declare function createRestRequestSignal(req: import('node:http').IncomingMessage, res: import('node:http').ServerResponse): {
+    signal: AbortSignal;
+    dispose: () => void;
+};
+/** Helper to send a plain text response. */
+export declare function sendText(res: import('node:http').ServerResponse, statusCode: number, body: string, contentType?: string): void;
+/** Read and parse a JSON body from the request. Returns null for empty/non-JSON. */
+export declare function readJsonBody(req: import('node:http').IncomingMessage): Promise<unknown>;