@codemem/mcp 0.47.0-beta.3 → 0.47.0

package/dist/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":";AAEA;;;;;;GAMG;AAGH,OAAO,EAAsC,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAG5E,OAAO,EAAE,WAAW,EAAiB,MAAM,eAAe,CAAC;AAU3D,OAAO,EAGN,KAAK,iBAAiB,EAGtB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAYN,KAAK,qBAAqB,EAC1B,MAAM,YAAY,CAAC;AASpB,eAAO,MAAM,qBAAqB,cAAc,CAAC;AACjD,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAQ3C,eAAO,MAAM,4BAA4B,QAAkB,CAAC;AAC5D,eAAO,MAAM,kCAAkC,QAAgB,CAAC;AAUhE,MAAM,WAAW,qBAAqB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,wBAAgB,+BAA+B,CAC9C,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,SAAS,GACtF,MAAM,GAAG,SAAS,CAQpB;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,iBAAiB,UAAQ,GAAG,MAAM,CAc/F;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,yBAAyB,CACxC,KAAK,qBAA6C,GAChD,OAAO,CAET;AAED,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,YAAY,EAAE,MAAM,GAClB,OAAO,CAWT;AAED,wBAAgB,6BAA6B,CAC5C,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,YAAY,EAAE,MAAM,GAClB,OAAO,CAkBT;AAED,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGzF;AA+BD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAO1E;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,GAAE,qBAA0B,GACjC,OAAO,CAAC,oBAAoB,CAAC,CAmR/B"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":";AAEA;;;;;;GAMG;AAGH,OAAO,EAAsC,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAG5E,OAAO,EAAE,WAAW,EAAiB,MAAM,eAAe,CAAC;AAU3D,OAAO,EAGN,KAAK,iBAAiB,EAGtB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAYN,KAAK,qBAAqB,EAC1B,MAAM,YAAY,CAAC;AASpB,eAAO,MAAM,qBAAqB,cAAc,CAAC;AACjD,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAQ3C,eAAO,MAAM,4BAA4B,QAAkB,CAAC;AAC5D,eAAO,MAAM,kCAAkC,QAAgB,CAAC;AAUhE,MAAM,WAAW,qBAAqB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,wBAAgB,+BAA+B,CAC9C,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,SAAS,GACtF,MAAM,GAAG,SAAS,CAQpB;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,iBAAiB,UAAQ,GAAG,MAAM,CAc/F;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,yBAAyB,CACxC,KAAK,qBAA6C,GAChD,OAAO,CAET;AAED,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,YAAY,EAAE,MAAM,GAClB,OAAO,CAWT;AAED,wBAAgB,6BAA6B,CAC5C,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,YAAY,EAAE,MAAM,GAClB,OAAO,CAkBT;AAED,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGzF;AA+BD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAO1E;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,GAAE,qBAA0B,GACjC,OAAO,CAAC,oBAAoB,CAAC,CAsQ/B"}

package/dist/http.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as e, t } from "./server-C-Z_tmAr.js";
+import { n as e, t } from "./server-igIo9ay0.js";
 import { createHash as n, createHmac as r, createPublicKey as i, randomBytes as a, randomUUID as o, timingSafeEqual as s, verify as c } from "node:crypto";
 import { createServer as l } from "node:http";
 import { isIP as u, isIPv6 as d } from "node:net";
@@ -2851,7 +2851,7 @@ function Un(e) {
 	return t;
 }
 async function Wn(e = {}) {
-	let n = Ln(e.host ?? process.env.CODEMEM_MCP_HTTP_HOST, e.allowUnsafePublic ?? Rn()), r = Un(e.port ?? process.env.CODEMEM_MCP_HTTP_PORT), i = e.publicUrl ?? process.env.CODEMEM_MCP_HTTP_PUBLIC_URL, a = i ? Pt(i) : void 0, o = new p(e.dbPath ?? m()), s = e.oauthAccessTokenStore ? void 0 : kt(e.oauthStatePath), c = s ?? Tt(), u = s ?? Et(), d = e.oauthAccessTokenStore ?? s ?? Dt(), f = an(), g = rn(), x = a !== void 0 || f !== void 0, S = et(e.auditEmitter ?? rt()), C = /* @__PURE__ */ new Set(), ee = nr(), w = null, T = b();
+	let n = Ln(e.host ?? process.env.CODEMEM_MCP_HTTP_HOST, e.allowUnsafePublic ?? Rn()), r = Un(e.port ?? process.env.CODEMEM_MCP_HTTP_PORT), i = e.publicUrl ?? process.env.CODEMEM_MCP_HTTP_PUBLIC_URL, a = i ? Pt(i) : void 0, o = new p(e.dbPath ?? m()), s = e.oauthAccessTokenStore ? void 0 : kt(e.oauthStatePath), c = s ?? Tt(), u = s ?? Et(), d = e.oauthAccessTokenStore ?? s ?? Dt(), f = an(), g = rn(), x = a !== void 0 || f !== void 0, S = et(e.auditEmitter ?? rt()), C = /* @__PURE__ */ new Set(), ee = rr(), w = null, T = b();
 	T.disable("x-powered-by"), T.set("trust proxy", "loopback");
 	let E = l(T);
 	await new Promise((e, t) => {
@@ -2862,7 +2862,7 @@ async function Wn(e = {}) {
 			E.off("error", t), e();
 		});
 	});
-	let D = a?.href ?? tr(E, n), O = new URL(D), k = or(O, $(E)), A = new _n({
+	let D = a?.href ?? nr(E, n), O = new URL(D), k = sr(O, $(E)), A = new _n({
 		clientsStore: c,
 		codeStore: u,
 		tokenStore: d,
@@ -2880,31 +2880,31 @@ async function Wn(e = {}) {
 		legacyHeaders: !1,
 		ipv6Subnet: !1
 	})), T.use((e, t, n) => {
-		let r = $(E), i = cr(e.path);
+		let r = $(E), i = lr(e.path);
 		if (i === "/mcp") {
-			if (Gn(e, r, a)) {
-				if (Yn(e, t, a), e.method === "OPTIONS") {
+			if (Kn(e, r, a)) {
+				if (Xn(e, t, a), e.method === "OPTIONS") {
 					t.status(204).send("");
 					return;
 				}
 				return n();
 			}
-			Zn(e, i, a), t.status(403).type("text/plain").send("Forbidden");
+			Qn(e, i, a), t.status(403).type("text/plain").send("Forbidden");
 			return;
 		}
-		if (sr(i)) {
-			if (qn(e, r, a)) {
-				if (Yn(e, t, a), e.method === "OPTIONS") {
+		if (cr(i)) {
+			if (Jn(e, r, a)) {
+				if (Xn(e, t, a), e.method === "OPTIONS") {
 					t.status(204).send("");
 					return;
 				}
 				return n();
 			}
-			Zn(e, i, a), t.status(403).type("text/plain").send("Forbidden");
+			Qn(e, i, a), t.status(403).type("text/plain").send("Forbidden");
 			return;
 		}
 		n();
-	}), T.use(lr(S)), T.get("/oauth/callback", async (e, t) => {
+	}), T.use(ur(S)), T.get("/oauth/callback", async (e, t) => {
 		let n = e.socket.remoteAddress ?? void 0;
 		if (!f) {
 			S(z("oidc_callback", {
@@ -2930,7 +2930,7 @@ async function Wn(e = {}) {
 			clientId: r.oauthParams.get("client_id") ?? "",
 			redirectUri: r.oauthParams.get("redirect_uri") ?? "",
 			codeChallenge: r.oauthParams.get("code_challenge") ?? "",
-			scopes: vr(r.oauthParams.get("scope")),
+			scopes: yr(r.oauthParams.get("scope")),
 			...r.oauthParams.get("resource") ? { resource: r.oauthParams.get("resource") ?? void 0 } : {},
 			expiresAt: Date.now() + 3e5
 		});
@@ -2975,7 +2975,7 @@ async function Wn(e = {}) {
 	let j = x ? h({
 		verifier: A,
 		resourceMetadataUrl: te
-	}) : (e, t, n) => n(), M = x ? gr(S, d) : (e, t, n) => n();
+	}) : (e, t, n) => n(), M = x ? _r(S, d) : (e, t, n) => n();
 	return T.post("/mcp", M, j, b.json({ limit: jn }), async (n, r) => {
 		n.auth && S(z("bearer", {
 			outcome: "success",
@@ -2997,37 +2997,39 @@ async function Wn(e = {}) {
 		} finally {
 			C.delete(l), await s.close();
 		}
-	}, ir), T.all("/mcp", (e, t) => {
+	}, ar), T.all("/mcp", (e, t) => {
 		t.setHeader("Allow", "POST"), t.status(405).type("text/plain").send("Method not allowed");
 	}), T.use((e, t) => {
 		t.status(404).type("text/plain").send("Not found");
 	}), {
 		server: E,
 		store: o,
-		url: `http://${er(n)}:${$(E)}/mcp`,
-		close: () => (w ??= (async () => {
-			await Promise.allSettled([...C].map(({ mcpServer: e }) => e.close())), await new Promise((e, t) => {
-				E.close((n) => {
-					if (!n || n.code === "ERR_SERVER_NOT_RUNNING") {
-						e();
-						return;
-					}
-					t(n);
-				}), E.closeAllConnections();
-			}), o.close();
-		})(), w)
+		url: `http://${tr(n)}:${$(E)}/mcp`,
+		close: () => (w ??= Gn(E, C, o), w)
 	};
 }
-function Gn(e, t, n) {
-	return Kn(e, t) ? !0 : n ? $n(e.headers.host, n) && Jn(e.headers.origin, n) : !1;
+async function Gn(e, t, n) {
+	let r = new Promise((t, n) => {
+		e.close((e) => {
+			if (!e || e.code === "ERR_SERVER_NOT_RUNNING") {
+				t();
+				return;
+			}
+			n(e);
+		}), e.closeAllConnections();
+	}), [i] = await Promise.allSettled([r, ...[...t].map(({ mcpServer: e }) => e.close())]);
+	if (await n.closeAsync(), i?.status === "rejected") throw i.reason;
+}
+function Kn(e, t, n) {
+	return qn(e, t) ? !0 : n ? er(e.headers.host, n) && Yn(e.headers.origin, n) : !1;
 }
-function Kn(e, t) {
+function qn(e, t) {
 	return Vn(e.socket.remoteAddress) && zn(e.headers.host, t) && Bn(e.headers.origin, t);
 }
-function qn(e, t, n) {
-	return Kn(e, t) ? !0 : n ? $n(e.headers.host, n) && Jn(e.headers.origin, n) : !1;
+function Jn(e, t, n) {
+	return qn(e, t) ? !0 : n ? er(e.headers.host, n) && Yn(e.headers.origin, n) : !1;
 }
-function Jn(e, t) {
+function Yn(e, t) {
 	if (!e) return !0;
 	try {
 		let n = new URL(e);
@@ -3036,12 +3038,12 @@ function Jn(e, t) {
 		return !1;
 	}
 }
-function Yn(e, t, n) {
+function Xn(e, t, n) {
 	if (!n) return;
-	let r = Xn(e.headers.origin, n);
+	let r = Zn(e.headers.origin, n);
 	r && (t.setHeader("Access-Control-Allow-Origin", r), t.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS"), t.setHeader("Access-Control-Allow-Headers", e.headers["access-control-request-headers"] ?? En), t.setHeader("Access-Control-Max-Age", Dn), t.setHeader("Vary", "Origin"));
 }
-function Xn(e, t) {
+function Zn(e, t) {
 	if (e) try {
 		let n = new URL(e).origin;
 		if (n === t.origin || Tn.has(n)) return n;
@@ -3049,7 +3051,7 @@ function Xn(e, t) {
 		return;
 	}
 }
-function Zn(e, t, n) {
+function Qn(e, t, n) {
 	console.warn(JSON.stringify({
 		source: "codemem-mcp-http-guard",
 		timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -3057,16 +3059,16 @@ function Zn(e, t, n) {
 		reason: "host_or_origin_mismatch",
 		method: e.method,
 		path: t,
-		host: Qn(e.headers.host),
-		origin: Qn(e.headers.origin),
+		host: $n(e.headers.host),
+		origin: $n(e.headers.origin),
 		expectedOrigin: n?.origin,
 		remoteAddress: e.socket.remoteAddress ?? void 0
 	}));
 }
-function Qn(e) {
+function $n(e) {
 	return !e || e.length <= On ? e : `${e.slice(0, On)}…`;
 }
-function $n(e, t) {
+function er(e, t) {
 	let n = Hn(e);
 	if (!n) return !1;
 	let r = t.port ? Number(t.port) : t.protocol === "https:" ? 443 : 80, i = t.protocol === "https:" ? 443 : 80, a = n.port ?? i;
@@ -3076,16 +3078,16 @@ function $(e) {
 	let t = e.address();
 	return !t || typeof t == "string" ? Cn : t.port;
 }
-function er(e) {
+function tr(e) {
 	return u(e) === 6 ? `[${e}]` : e;
 }
-function tr(e, t) {
-	return `http://${er(t)}:${$(e)}/mcp`;
+function nr(e, t) {
+	return `http://${tr(t)}:${$(e)}/mcp`;
 }
-function nr() {
+function rr() {
 	let t = /* @__PURE__ */ new Map();
 	return (r) => {
-		if (!r.principal) return rr(o());
+		if (!r.principal) return ir(o());
 		for (let [e, n] of t) n.expiresAt <= r.now && t.delete(e);
 		let i = n("sha256").update(JSON.stringify([
 			r.endpoint.href,
@@ -3093,7 +3095,7 @@ function nr() {
 			e(r.requestBody)
 		])).digest("hex"), a = t.get(i);
 		if (a) return a.scopeId;
-		let s = rr(JSON.stringify([i, r.now]));
+		let s = ir(JSON.stringify([i, r.now]));
 		for (t.set(i, {
 			scopeId: s,
 			expiresAt: r.now + Mn
@@ -3105,11 +3107,11 @@ function nr() {
 		return s;
 	};
 }
-function rr(e) {
+function ir(e) {
 	return `mcp-http:${n("sha256").update(e).digest("hex")}`;
 }
-function ir(e, t, n, r) {
-	let i = ar(e);
+function ar(e, t, n, r) {
+	let i = or(e);
 	if (i === null) {
 		r(e);
 		return;
@@ -3123,30 +3125,30 @@ function ir(e, t, n, r) {
 		id: null
 	});
 }
-function ar(e) {
+function or(e) {
 	if (typeof e != "object" || !e) return null;
 	let t = e;
 	return t.type === "entity.too.large" ? 413 : t.type === "entity.parse.failed" ? 400 : null;
 }
-function or(e, t) {
+function sr(e, t) {
 	return e.protocol === "https:" || Z(e.hostname) && Q(e.hostname) !== "::1" ? new URL(e.origin) : new URL(`http://localhost:${t}/`);
 }
-function sr(e) {
+function cr(e) {
 	return e === "/register" || e === "/authorize" || e === "/token" || e === "/revoke" || e === "/oauth/callback" || e === "/.well-known/oauth-authorization-server" || e === "/.well-known/oauth-protected-resource/mcp";
 }
-function cr(e) {
+function lr(e) {
 	return e.length > 1 ? e.replace(/\/+$/, "") : e;
 }
-function lr(e) {
+function ur(e) {
 	return (t, n, r) => {
 		let i = t.path;
-		if (!ur(i)) return r();
+		if (!dr(i)) return r();
 		let a, o = n.json.bind(n);
 		n.json = ((e) => (a = e, o(e))), n.on("finish", () => {
 			if (i === "/oauth/callback") return;
-			let r = dr(i, t);
+			let r = fr(i, t);
 			if (!r) return;
-			let o = pr(n, a), s = hr(t, a);
+			let o = mr(n, a), s = gr(t, a);
 			e(z(r, {
 				outcome: o ? "denied" : "success",
 				...o ? { reason: o } : {},
@@ -3156,17 +3158,17 @@ function lr(e) {
 		}), r();
 	};
 }
-function ur(e) {
-	return fr(e) !== null;
+function dr(e) {
+	return pr(e) !== null;
 }
-function dr(e, t) {
-	return e === "/token" && t.body?.grant_type === "refresh_token" ? "refresh" : fr(e);
+function fr(e, t) {
+	return e === "/token" && t.body?.grant_type === "refresh_token" ? "refresh" : pr(e);
 }
-function fr(e) {
+function pr(e) {
 	return e === "/register" ? "registration" : e === "/authorize" ? "authorize" : e === "/token" ? "token" : e === "/revoke" ? "revocation" : null;
 }
-function pr(e, t) {
-	let n = mr(t);
+function mr(e, t) {
+	let n = hr(t);
 	if (n) return n;
 	let r = e.getHeader("location");
 	if (typeof r == "string") try {
@@ -3175,15 +3177,15 @@ function pr(e, t) {
 		return;
 	}
 }
-function mr(e) {
+function hr(e) {
 	if (typeof e == "object" && e && "error" in e && typeof e.error == "string") return e.error;
 }
-function hr(e, t) {
+function gr(e, t) {
 	return typeof t == "object" && t && "client_id" in t && typeof t.client_id == "string" ? t.client_id : (typeof e.body?.client_id == "string" ? e.body.client_id : void 0) || (typeof e.query.client_id == "string" ? e.query.client_id : void 0);
 }
-function gr(e, t) {
+function _r(e, t) {
 	return (n, r, i) => {
-		let a = _r(n.headers.authorization, t);
+		let a = vr(n.headers.authorization, t);
 		a && e(z("bearer", {
 			outcome: "denied",
 			reason: a,
@@ -3191,21 +3193,21 @@ function gr(e, t) {
 		})), i();
 	};
 }
-function _r(e, t) {
+function vr(e, t) {
 	if (!e) return "missing_authorization_header";
 	let [n, r, i] = e.trim().split(/\s+/);
 	if (!n || !r || i || n.toLowerCase() !== "bearer") return "malformed_authorization_header";
 	let a = t.verifyToken(r);
 	return a.ok ? null : a.reason;
 }
-function vr(e) {
+function yr(e) {
 	return e?.split(/\s+/).map((e) => e.trim()).filter(Boolean) ?? [];
 }
-function yr() {
+function br() {
 	let e = process.argv[1];
 	return e ? import.meta.url === f(e).href : !1;
 }
-async function br() {
+async function xr() {
 	let e = await Wn();
 	console.error(`codemem MCP HTTP server listening at ${e.url}`);
 	let t = async () => {
@@ -3216,7 +3218,7 @@ async function br() {
 	};
 	process.on("SIGINT", t), process.on("SIGTERM", t);
 }
-yr() && br().catch((e) => {
+br() && xr().catch((e) => {
 	console.error("codemem MCP HTTP server failed to start:", e), process.exit(1);
 });
 //#endregion