@contentrain/mcp 1.3.0 → 1.4.0

package/dist/server/http/index.mjs

@@ -12,7 +12,7 @@ import "../../local-DvP4Y4T-.mjs";
 import "../../detect-DL9mFmaS.mjs";
 import "../../branch-lifecycle-CFVpTpNT.mjs";
 import "../../annotations-Clhbw2lh.mjs";
-import { t as createServer } from "../../server-B1OJrUQ9.mjs";
+import { t as createServer } from "../../server-BkhhtEE2.mjs";
 import "../../validator-B0nNRFeU.mjs";
 import "../../scan-config-jC6XmiqF.mjs";
 import "../../graph-builder-DXv2JEp-.mjs";
@@ -24,26 +24,29 @@ import { randomUUID } from "node:crypto";
 import http from "node:http";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 //#region src/server/http/server.ts
+const MCP_SESSION_HEADER = "mcp-session-id";
 /**
 * Start an HTTP transport for the MCP server on top of the local project.
 *
-* Phase 5.2 scope: stateless, single-endpoint `POST /mcp`. The underlying
-* McpServer is the same one the stdio entry point uses, so every tool
-* registered for stdio is available over HTTP with no duplication. Only
-* the transport swaps out.
+* Stateless, single-endpoint `POST /mcp`. The underlying `McpServer` is
+* the same one the stdio entry point uses, so every tool registered for
+* stdio is available over HTTP with no duplication. Only the transport
+* swaps out.
 *
-* Auth is a simple opaque Bearer token. When `authToken` is supplied, any
-* request without the exact `Authorization: Bearer <token>` header gets
-* a 401 before the MCP transport sees it. Multi-tenant auth (per-project
-* API keys, GitHub App scopes) is Studio's concern — MCP stays minimal.
-*
-* GitHubProvider HTTP routing will land in phase 5.3 together with the
-* tool-handler provider abstraction; today the HTTP server still drives
-* a LocalProvider under the hood.
+* Auth is a simple opaque Bearer token. When `authToken` is supplied,
+* any request without the exact `Authorization: Bearer <token>` header
+* gets a 401 before the MCP transport sees it. Non-local bind addresses
+* should always set this — the `contentrain serve --mcpHttp` CLI hard-
+* errors when it detects a non-localhost bind without a token.
 */
 async function startHttpMcpServer(opts) {
+	const mcp = createServer(opts.projectRoot);
+	const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => randomUUID() });
+	await mcp.connect(transport);
 	return startHttpMcpServerInternal({
-		mcp: createServer(opts.projectRoot),
+		mode: "single",
+		mcp,
+		transport,
 		port: opts.port,
 		host: opts.host,
 		authToken: opts.authToken,
@@ -51,82 +54,190 @@ async function startHttpMcpServer(opts) {
 	});
 }
 /**
-* Variant of {@link startHttpMcpServer} that accepts a pre-built provider
-* (and an optional `projectRoot`). This is the phase-5.3 entry point that
-* lets HTTP-hosted MCP route tool calls to a non-Local provider — e.g. a
-* `GitHubProvider` shared across many projects. Read-only tools work out
-* of the box; write-path tools return `capability_required: localWorktree`
-* when no `projectRoot` is supplied.
+* Variant accepting a pre-built provider or a per-request resolver.
+*
+* **Single-provider mode** (`{ provider }`):
+* All sessions share one `McpServer` backed by the given provider.
+* Good for CI runners, single-tenant deployments, or any case where
+* the backing repository is fixed at boot time.
+*
+* **Multi-tenant mode** (`{ resolveProvider }`):
+* Each session resolves its own provider from the incoming request.
+* The resolver is invoked once per session; subsequent requests with
+* the `Mcp-Session-Id` header reuse the same server + transport pair.
+* Idle sessions are closed after `sessionTtlMs` (default 15m).
 */
 async function startHttpMcpServerWith(opts) {
+	if ("resolveProvider" in opts) return startMultiTenantHttpMcpServer(opts);
+	const mcp = createServer({
+		provider: opts.provider,
+		projectRoot: opts.projectRoot
+	});
+	const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => randomUUID() });
+	await mcp.connect(transport);
 	return startHttpMcpServerInternal({
-		mcp: createServer({
-			provider: opts.provider,
-			projectRoot: opts.projectRoot
-		}),
+		mode: "single",
+		mcp,
+		transport,
 		port: opts.port,
 		host: opts.host,
 		authToken: opts.authToken,
 		path: opts.path
 	});
 }
-async function startHttpMcpServerInternal(input) {
-	const { mcp } = input;
-	const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => randomUUID() });
-	await mcp.connect(transport);
-	const mountPath = input.path ?? "/mcp";
-	const host = input.host ?? "127.0.0.1";
+async function startMultiTenantHttpMcpServer(opts) {
+	const sessions = /* @__PURE__ */ new Map();
+	const ttl = opts.sessionTtlMs ?? 900 * 1e3;
+	const mountPath = opts.path ?? "/mcp";
+	const host = opts.host ?? "127.0.0.1";
+	async function disposeSession(sessionId) {
+		const session = sessions.get(sessionId);
+		if (!session) return;
+		sessions.delete(sessionId);
+		await session.transport.close().catch(() => {});
+		await session.mcp.close().catch(() => {});
+	}
+	const reaper = setInterval(() => {
+		const now = Date.now();
+		for (const [id, session] of sessions) if (now - session.lastUsed > ttl) disposeSession(id);
+	}, Math.min(ttl, 6e4)).unref();
 	const server = http.createServer((req, res) => {
-		handleRequest(req, res, {
-			transport,
+		handleMultiTenantRequest(req, res, {
 			mountPath,
-			authToken: input.authToken
+			authToken: opts.authToken,
+			resolveProvider: opts.resolveProvider,
+			projectRoot: opts.projectRoot,
+			sessions
 		});
 	});
 	await new Promise((resolve, reject) => {
 		server.once("error", reject);
-		server.listen(input.port, host, () => {
+		server.listen(opts.port, host, () => {
 			server.off("error", reject);
 			resolve();
 		});
 	});
 	return {
 		server,
-		mcp,
+		mcp: null,
 		url: `http://${host}:${server.address().port}${mountPath}`,
 		close: async () => {
+			clearInterval(reaper);
 			await new Promise((resolve, reject) => {
 				server.close((err) => err ? reject(err) : resolve());
 			});
-			await transport.close().catch(() => {});
-			await mcp.close().catch(() => {});
+			const ids = [...sessions.keys()];
+			await Promise.all(ids.map((id) => disposeSession(id)));
 		}
 	};
 }
-async function handleRequest(req, res, ctx) {
+async function handleMultiTenantRequest(req, res, ctx) {
+	if (!applyRouteChecks(req, res, {
+		mountPath: ctx.mountPath,
+		authToken: ctx.authToken
+	})) return;
+	const existingSessionId = pickSessionId(req.headers[MCP_SESSION_HEADER]);
+	if (existingSessionId && ctx.sessions.has(existingSessionId)) {
+		const session = ctx.sessions.get(existingSessionId);
+		session.lastUsed = Date.now();
+		try {
+			await session.transport.handleRequest(req, res);
+		} catch (error) {
+			writeInternalError(res, error);
+		}
+		return;
+	}
+	try {
+		const mcp = createServer({
+			provider: await ctx.resolveProvider(req),
+			projectRoot: ctx.projectRoot
+		});
+		const transport = new StreamableHTTPServerTransport({
+			sessionIdGenerator: () => randomUUID(),
+			onsessioninitialized: (sessionId) => {
+				ctx.sessions.set(sessionId, {
+					mcp,
+					transport,
+					lastUsed: Date.now()
+				});
+			}
+		});
+		await mcp.connect(transport);
+		await transport.handleRequest(req, res);
+	} catch (error) {
+		writeInternalError(res, error);
+	}
+}
+function pickSessionId(header) {
+	if (!header) return void 0;
+	return Array.isArray(header) ? header[0] : header;
+}
+function applyRouteChecks(req, res, ctx) {
 	if (req.method !== "POST" && req.method !== "GET" && req.method !== "DELETE") {
 		writeJson(res, 405, { error: "Method Not Allowed" });
-		return;
+		return false;
 	}
 	if (!req.url || !req.url.startsWith(ctx.mountPath)) {
 		writeJson(res, 404, { error: "Not Found" });
-		return;
+		return false;
 	}
 	if (ctx.authToken) {
 		if (req.headers.authorization !== `Bearer ${ctx.authToken}`) {
 			writeJson(res, 401, { error: "Unauthorized" });
-			return;
+			return false;
 		}
 	}
+	return true;
+}
+async function startHttpMcpServerInternal(input) {
+	const { mcp, transport } = input;
+	const mountPath = input.path ?? "/mcp";
+	const host = input.host ?? "127.0.0.1";
+	const server = http.createServer((req, res) => {
+		handleRequest(req, res, {
+			transport,
+			mountPath,
+			authToken: input.authToken
+		});
+	});
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(input.port, host, () => {
+			server.off("error", reject);
+			resolve();
+		});
+	});
+	return {
+		server,
+		mcp,
+		url: `http://${host}:${server.address().port}${mountPath}`,
+		close: async () => {
+			await new Promise((resolve, reject) => {
+				server.close((err) => err ? reject(err) : resolve());
+			});
+			await transport.close().catch(() => {});
+			await mcp.close().catch(() => {});
+		}
+	};
+}
+async function handleRequest(req, res, ctx) {
+	if (!applyRouteChecks(req, res, {
+		mountPath: ctx.mountPath,
+		authToken: ctx.authToken
+	})) return;
 	try {
 		await ctx.transport.handleRequest(req, res);
 	} catch (error) {
-		if (!res.headersSent) writeJson(res, 500, {
-			error: "Internal Server Error",
-			message: error instanceof Error ? error.message : String(error)
-		});
+		writeInternalError(res, error);
 	}
 }
+function writeInternalError(res, error) {
+	if (res.headersSent) return;
+	writeJson(res, 500, {
+		error: "Internal Server Error",
+		message: error instanceof Error ? error.message : String(error)
+	});
+}
 function writeJson(res, status, body) {
 	res.writeHead(status, { "Content-Type": "application/json" });
 	res.end(JSON.stringify(body));

package/dist/server/http/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["createMcpServer"],"sources":["../../../src/server/http/server.ts"],"sourcesContent":["import http from 'node:http'\nimport { randomUUID } from 'node:crypto'\nimport type { AddressInfo } from 'node:net'\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'\nimport { createServer as createMcpServer, type ToolProvider } from '../../server.js'\n\nexport interface HttpMcpServerOptions {\n  /** Project root the MCP server operates against (LocalProvider path). */\n  projectRoot: string\n  /** Optional Bearer token — when set, requests must send `Authorization: Bearer <token>`. */\n  authToken?: string\n  /** Mount path for the MCP JSON-RPC endpoint. Defaults to `/mcp`. */\n  path?: string\n}\n\nexport interface HttpMcpServerProviderOptions {\n  /** Pre-built content provider (GitHubProvider, a mock, etc.). */\n  provider: ToolProvider\n  /** Local project root when the provider is a LocalProvider; optional otherwise. */\n  projectRoot?: string\n  /** Optional Bearer token — when set, requests must send `Authorization: Bearer <token>`. */\n  authToken?: string\n  /** Mount path for the MCP JSON-RPC endpoint. Defaults to `/mcp`. */\n  path?: string\n}\n\nexport interface HttpMcpServerHandle {\n  server: http.Server\n  mcp: McpServer\n  url: string\n  close: () => Promise<void>\n}\n\n/**\n * Start an HTTP transport for the MCP server on top of the local project.\n *\n * Phase 5.2 scope: stateless, single-endpoint `POST /mcp`. The underlying\n * McpServer is the same one the stdio entry point uses, so every tool\n * registered for stdio is available over HTTP with no duplication. Only\n * the transport swaps out.\n *\n * Auth is a simple opaque Bearer token. When `authToken` is supplied, any\n * request without the exact `Authorization: Bearer <token>` header gets\n * a 401 before the MCP transport sees it. Multi-tenant auth (per-project\n * API keys, GitHub App scopes) is Studio's concern — MCP stays minimal.\n *\n * GitHubProvider HTTP routing will land in phase 5.3 together with the\n * tool-handler provider abstraction; today the HTTP server still drives\n * a LocalProvider under the hood.\n */\nexport async function startHttpMcpServer(\n  opts: HttpMcpServerOptions & { port: number, host?: string },\n): Promise<HttpMcpServerHandle> {\n  return startHttpMcpServerInternal({\n    mcp: createMcpServer(opts.projectRoot),\n    port: opts.port,\n    host: opts.host,\n    authToken: opts.authToken,\n    path: opts.path,\n  })\n}\n\n/**\n * Variant of {@link startHttpMcpServer} that accepts a pre-built provider\n * (and an optional `projectRoot`). This is the phase-5.3 entry point that\n * lets HTTP-hosted MCP route tool calls to a non-Local provider — e.g. a\n * `GitHubProvider` shared across many projects. Read-only tools work out\n * of the box; write-path tools return `capability_required: localWorktree`\n * when no `projectRoot` is supplied.\n */\nexport async function startHttpMcpServerWith(\n  opts: HttpMcpServerProviderOptions & { port: number, host?: string },\n): Promise<HttpMcpServerHandle> {\n  return startHttpMcpServerInternal({\n    mcp: createMcpServer({ provider: opts.provider, projectRoot: opts.projectRoot }),\n    port: opts.port,\n    host: opts.host,\n    authToken: opts.authToken,\n    path: opts.path,\n  })\n}\n\nasync function startHttpMcpServerInternal(input: {\n  mcp: McpServer\n  port: number\n  host?: string\n  authToken?: string\n  path?: string\n}): Promise<HttpMcpServerHandle> {\n  const { mcp } = input\n  const transport = new StreamableHTTPServerTransport({\n    sessionIdGenerator: () => randomUUID(),\n  })\n  await mcp.connect(transport)\n\n  const mountPath = input.path ?? '/mcp'\n  const host = input.host ?? '127.0.0.1'\n\n  const server = http.createServer((req, res) => {\n    void handleRequest(req, res, { transport, mountPath, authToken: input.authToken })\n  })\n\n  await new Promise<void>((resolve, reject) => {\n    server.once('error', reject)\n    server.listen(input.port, host, () => {\n      server.off('error', reject)\n      resolve()\n    })\n  })\n\n  const address = server.address() as AddressInfo\n  const url = `http://${host}:${address.port}${mountPath}`\n\n  return {\n    server,\n    mcp,\n    url,\n    close: async () => {\n      await new Promise<void>((resolve, reject) => {\n        server.close(err => (err ? reject(err) : resolve()))\n      })\n      await transport.close().catch(() => { /* best-effort */ })\n      await mcp.close().catch(() => { /* best-effort */ })\n    },\n  }\n}\n\nasync function handleRequest(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: { transport: StreamableHTTPServerTransport, mountPath: string, authToken?: string },\n): Promise<void> {\n  if (req.method !== 'POST' && req.method !== 'GET' && req.method !== 'DELETE') {\n    writeJson(res, 405, { error: 'Method Not Allowed' })\n    return\n  }\n\n  if (!req.url || !req.url.startsWith(ctx.mountPath)) {\n    writeJson(res, 404, { error: 'Not Found' })\n    return\n  }\n\n  if (ctx.authToken) {\n    const header = req.headers.authorization\n    if (header !== `Bearer ${ctx.authToken}`) {\n      writeJson(res, 401, { error: 'Unauthorized' })\n      return\n    }\n  }\n\n  try {\n    await ctx.transport.handleRequest(req, res)\n  } catch (error) {\n    if (!res.headersSent) {\n      writeJson(res, 500, {\n        error: 'Internal Server Error',\n        message: error instanceof Error ? error.message : String(error),\n      })\n    }\n  }\n}\n\nfunction writeJson(res: http.ServerResponse, status: number, body: unknown): void {\n  res.writeHead(status, { 'Content-Type': 'application/json' })\n  res.end(JSON.stringify(body))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,eAAsB,mBACpB,MAC8B;AAC9B,QAAO,2BAA2B;EAChC,KAAKA,aAAgB,KAAK,YAAY;EACtC,MAAM,KAAK;EACX,MAAM,KAAK;EACX,WAAW,KAAK;EAChB,MAAM,KAAK;EACZ,CAAC;;;;;;;;;;AAWJ,eAAsB,uBACpB,MAC8B;AAC9B,QAAO,2BAA2B;EAChC,KAAKA,aAAgB;GAAE,UAAU,KAAK;GAAU,aAAa,KAAK;GAAa,CAAC;EAChF,MAAM,KAAK;EACX,MAAM,KAAK;EACX,WAAW,KAAK;EAChB,MAAM,KAAK;EACZ,CAAC;;AAGJ,eAAe,2BAA2B,OAMT;CAC/B,MAAM,EAAE,QAAQ;CAChB,MAAM,YAAY,IAAI,8BAA8B,EAClD,0BAA0B,YAAY,EACvC,CAAC;AACF,OAAM,IAAI,QAAQ,UAAU;CAE5B,MAAM,YAAY,MAAM,QAAQ;CAChC,MAAM,OAAO,MAAM,QAAQ;CAE3B,MAAM,SAAS,KAAK,cAAc,KAAK,QAAQ;AACxC,gBAAc,KAAK,KAAK;GAAE;GAAW;GAAW,WAAW,MAAM;GAAW,CAAC;GAClF;AAEF,OAAM,IAAI,SAAe,SAAS,WAAW;AAC3C,SAAO,KAAK,SAAS,OAAO;AAC5B,SAAO,OAAO,MAAM,MAAM,YAAY;AACpC,UAAO,IAAI,SAAS,OAAO;AAC3B,YAAS;IACT;GACF;AAKF,QAAO;EACL;EACA;EACA,KALU,UAAU,KAAK,GADX,OAAO,SAAS,CACM,OAAO;EAM3C,OAAO,YAAY;AACjB,SAAM,IAAI,SAAe,SAAS,WAAW;AAC3C,WAAO,OAAM,QAAQ,MAAM,OAAO,IAAI,GAAG,SAAS,CAAE;KACpD;AACF,SAAM,UAAU,OAAO,CAAC,YAAY,GAAsB;AAC1D,SAAM,IAAI,OAAO,CAAC,YAAY,GAAsB;;EAEvD;;AAGH,eAAe,cACb,KACA,KACA,KACe;AACf,KAAI,IAAI,WAAW,UAAU,IAAI,WAAW,SAAS,IAAI,WAAW,UAAU;AAC5E,YAAU,KAAK,KAAK,EAAE,OAAO,sBAAsB,CAAC;AACpD;;AAGF,KAAI,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,WAAW,IAAI,UAAU,EAAE;AAClD,YAAU,KAAK,KAAK,EAAE,OAAO,aAAa,CAAC;AAC3C;;AAGF,KAAI,IAAI;MACS,IAAI,QAAQ,kBACZ,UAAU,IAAI,aAAa;AACxC,aAAU,KAAK,KAAK,EAAE,OAAO,gBAAgB,CAAC;AAC9C;;;AAIJ,KAAI;AACF,QAAM,IAAI,UAAU,cAAc,KAAK,IAAI;UACpC,OAAO;AACd,MAAI,CAAC,IAAI,YACP,WAAU,KAAK,KAAK;GAClB,OAAO;GACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAChE,CAAC;;;AAKR,SAAS,UAAU,KAA0B,QAAgB,MAAqB;AAChF,KAAI,UAAU,QAAQ,EAAE,gBAAgB,oBAAoB,CAAC;AAC7D,KAAI,IAAI,KAAK,UAAU,KAAK,CAAC"}
+{"version":3,"file":"index.mjs","names":["createMcpServer"],"sources":["../../../src/server/http/server.ts"],"sourcesContent":["import http from 'node:http'\nimport { randomUUID } from 'node:crypto'\nimport type { AddressInfo } from 'node:net'\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'\nimport { createServer as createMcpServer, type ToolProvider } from '../../server.js'\n\nexport interface HttpMcpServerOptions {\n  /** Project root the MCP server operates against (LocalProvider path). */\n  projectRoot: string\n  /** Optional Bearer token — when set, requests must send `Authorization: Bearer <token>`. */\n  authToken?: string\n  /** Mount path for the MCP JSON-RPC endpoint. Defaults to `/mcp`. */\n  path?: string\n}\n\nexport interface HttpMcpServerProviderOptions {\n  /** Pre-built content provider (GitHubProvider, a mock, etc.). */\n  provider: ToolProvider\n  /** Local project root when the provider is a LocalProvider; optional otherwise. */\n  projectRoot?: string\n  /** Optional Bearer token — when set, requests must send `Authorization: Bearer <token>`. */\n  authToken?: string\n  /** Mount path for the MCP JSON-RPC endpoint. Defaults to `/mcp`. */\n  path?: string\n}\n\n/**\n * Multi-tenant entry point — one resolver, many providers.\n *\n * Every new MCP session resolves its own `RepoProvider` from the incoming\n * HTTP request (typically via a workspace / project identifier in a\n * header or path segment). The resolver is invoked exactly once per\n * session; follow-up requests carrying the `Mcp-Session-Id` header are\n * routed to the existing `McpServer` + transport pair.\n *\n * Use this for Studio's hosted MCP Cloud or any agent that drives\n * multiple Contentrain projects through a single HTTP endpoint.\n */\nexport interface HttpMcpServerResolverOptions {\n  /**\n   * Per-session provider resolver. Invoked on the first request of a\n   * new session (typically the MCP `initialize` call). Whatever\n   * provider the resolver returns is bound to that session for its\n   * lifetime.\n   */\n  resolveProvider: (req: http.IncomingMessage) => ToolProvider | Promise<ToolProvider>\n  /** Optional fallback project root injected into each resolved session. */\n  projectRoot?: string\n  /** Optional Bearer token — when set, requests must send `Authorization: Bearer <token>`. */\n  authToken?: string\n  /** Mount path for the MCP JSON-RPC endpoint. Defaults to `/mcp`. */\n  path?: string\n  /**\n   * Idle-session TTL in ms. Sessions that haven't received a request\n   * within this window are closed and their providers discarded.\n   * Defaults to 15 minutes.\n   */\n  sessionTtlMs?: number\n}\n\nexport interface HttpMcpServerHandle {\n  server: http.Server\n  /**\n   * The single shared `McpServer` when the server was started with\n   * `{ projectRoot }` or `{ provider }`. **Not set** in multi-tenant\n   * resolver mode — in that mode each session owns its own server and\n   * you should address them through the HTTP endpoint, not directly.\n   */\n  mcp: McpServer | null\n  url: string\n  close: () => Promise<void>\n}\n\nconst MCP_SESSION_HEADER = 'mcp-session-id'\n\n/**\n * Start an HTTP transport for the MCP server on top of the local project.\n *\n * Stateless, single-endpoint `POST /mcp`. The underlying `McpServer` is\n * the same one the stdio entry point uses, so every tool registered for\n * stdio is available over HTTP with no duplication. Only the transport\n * swaps out.\n *\n * Auth is a simple opaque Bearer token. When `authToken` is supplied,\n * any request without the exact `Authorization: Bearer <token>` header\n * gets a 401 before the MCP transport sees it. Non-local bind addresses\n * should always set this — the `contentrain serve --mcpHttp` CLI hard-\n * errors when it detects a non-localhost bind without a token.\n */\nexport async function startHttpMcpServer(\n  opts: HttpMcpServerOptions & { port: number, host?: string },\n): Promise<HttpMcpServerHandle> {\n  const mcp = createMcpServer(opts.projectRoot)\n  const transport = new StreamableHTTPServerTransport({\n    sessionIdGenerator: () => randomUUID(),\n  })\n  await mcp.connect(transport)\n\n  return startHttpMcpServerInternal({\n    mode: 'single',\n    mcp,\n    transport,\n    port: opts.port,\n    host: opts.host,\n    authToken: opts.authToken,\n    path: opts.path,\n  })\n}\n\n/**\n * Variant accepting a pre-built provider or a per-request resolver.\n *\n * **Single-provider mode** (`{ provider }`):\n * All sessions share one `McpServer` backed by the given provider.\n * Good for CI runners, single-tenant deployments, or any case where\n * the backing repository is fixed at boot time.\n *\n * **Multi-tenant mode** (`{ resolveProvider }`):\n * Each session resolves its own provider from the incoming request.\n * The resolver is invoked once per session; subsequent requests with\n * the `Mcp-Session-Id` header reuse the same server + transport pair.\n * Idle sessions are closed after `sessionTtlMs` (default 15m).\n */\nexport async function startHttpMcpServerWith(\n  opts: (HttpMcpServerProviderOptions | HttpMcpServerResolverOptions) & { port: number, host?: string },\n): Promise<HttpMcpServerHandle> {\n  if ('resolveProvider' in opts) {\n    return startMultiTenantHttpMcpServer(opts)\n  }\n  const mcp = createMcpServer({ provider: opts.provider, projectRoot: opts.projectRoot })\n  const transport = new StreamableHTTPServerTransport({\n    sessionIdGenerator: () => randomUUID(),\n  })\n  await mcp.connect(transport)\n  return startHttpMcpServerInternal({\n    mode: 'single',\n    mcp,\n    transport,\n    port: opts.port,\n    host: opts.host,\n    authToken: opts.authToken,\n    path: opts.path,\n  })\n}\n\ninterface MultiTenantSession {\n  mcp: McpServer\n  transport: StreamableHTTPServerTransport\n  lastUsed: number\n}\n\nasync function startMultiTenantHttpMcpServer(\n  opts: HttpMcpServerResolverOptions & { port: number, host?: string },\n): Promise<HttpMcpServerHandle> {\n  const sessions = new Map<string, MultiTenantSession>()\n  const ttl = opts.sessionTtlMs ?? 15 * 60 * 1000\n  const mountPath = opts.path ?? '/mcp'\n  const host = opts.host ?? '127.0.0.1'\n\n  async function disposeSession(sessionId: string): Promise<void> {\n    const session = sessions.get(sessionId)\n    if (!session) return\n    sessions.delete(sessionId)\n    await session.transport.close().catch(() => { /* best-effort */ })\n    await session.mcp.close().catch(() => { /* best-effort */ })\n  }\n\n  const reaper = setInterval(() => {\n    const now = Date.now()\n    for (const [id, session] of sessions) {\n      if (now - session.lastUsed > ttl) void disposeSession(id)\n    }\n  }, Math.min(ttl, 60_000)).unref()\n\n  const server = http.createServer((req, res) => {\n    void handleMultiTenantRequest(req, res, {\n      mountPath,\n      authToken: opts.authToken,\n      resolveProvider: opts.resolveProvider,\n      projectRoot: opts.projectRoot,\n      sessions,\n    })\n  })\n\n  await new Promise<void>((resolve, reject) => {\n    server.once('error', reject)\n    server.listen(opts.port, host, () => {\n      server.off('error', reject)\n      resolve()\n    })\n  })\n\n  const address = server.address() as AddressInfo\n  const url = `http://${host}:${address.port}${mountPath}`\n\n  return {\n    server,\n    mcp: null,\n    url,\n    close: async () => {\n      clearInterval(reaper)\n      await new Promise<void>((resolve, reject) => {\n        server.close(err => (err ? reject(err) : resolve()))\n      })\n      const ids = [...sessions.keys()]\n      await Promise.all(ids.map(id => disposeSession(id)))\n    },\n  }\n}\n\nasync function handleMultiTenantRequest(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: {\n    mountPath: string\n    authToken?: string\n    resolveProvider: (req: http.IncomingMessage) => ToolProvider | Promise<ToolProvider>\n    projectRoot?: string\n    sessions: Map<string, MultiTenantSession>\n  },\n): Promise<void> {\n  if (!applyRouteChecks(req, res, { mountPath: ctx.mountPath, authToken: ctx.authToken })) return\n\n  const existingSessionId = pickSessionId(req.headers[MCP_SESSION_HEADER])\n  if (existingSessionId && ctx.sessions.has(existingSessionId)) {\n    const session = ctx.sessions.get(existingSessionId)!\n    session.lastUsed = Date.now()\n    try {\n      await session.transport.handleRequest(req, res)\n    } catch (error) {\n      writeInternalError(res, error)\n    }\n    return\n  }\n\n  try {\n    const provider = await ctx.resolveProvider(req)\n    const mcp = createMcpServer({ provider, projectRoot: ctx.projectRoot })\n    const transport = new StreamableHTTPServerTransport({\n      sessionIdGenerator: () => randomUUID(),\n      onsessioninitialized: (sessionId: string) => {\n        ctx.sessions.set(sessionId, { mcp, transport, lastUsed: Date.now() })\n      },\n    })\n    await mcp.connect(transport)\n    await transport.handleRequest(req, res)\n  } catch (error) {\n    writeInternalError(res, error)\n  }\n}\n\nfunction pickSessionId(header: string | string[] | undefined): string | undefined {\n  if (!header) return undefined\n  return Array.isArray(header) ? header[0] : header\n}\n\nfunction applyRouteChecks(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: { mountPath: string, authToken?: string },\n): boolean {\n  if (req.method !== 'POST' && req.method !== 'GET' && req.method !== 'DELETE') {\n    writeJson(res, 405, { error: 'Method Not Allowed' })\n    return false\n  }\n  if (!req.url || !req.url.startsWith(ctx.mountPath)) {\n    writeJson(res, 404, { error: 'Not Found' })\n    return false\n  }\n  if (ctx.authToken) {\n    const header = req.headers.authorization\n    if (header !== `Bearer ${ctx.authToken}`) {\n      writeJson(res, 401, { error: 'Unauthorized' })\n      return false\n    }\n  }\n  return true\n}\n\nasync function startHttpMcpServerInternal(input: {\n  mode: 'single'\n  mcp: McpServer\n  transport: StreamableHTTPServerTransport\n  port: number\n  host?: string\n  authToken?: string\n  path?: string\n}): Promise<HttpMcpServerHandle> {\n  const { mcp, transport } = input\n  const mountPath = input.path ?? '/mcp'\n  const host = input.host ?? '127.0.0.1'\n\n  const server = http.createServer((req, res) => {\n    void handleRequest(req, res, { transport, mountPath, authToken: input.authToken })\n  })\n\n  await new Promise<void>((resolve, reject) => {\n    server.once('error', reject)\n    server.listen(input.port, host, () => {\n      server.off('error', reject)\n      resolve()\n    })\n  })\n\n  const address = server.address() as AddressInfo\n  const url = `http://${host}:${address.port}${mountPath}`\n\n  return {\n    server,\n    mcp,\n    url,\n    close: async () => {\n      await new Promise<void>((resolve, reject) => {\n        server.close(err => (err ? reject(err) : resolve()))\n      })\n      await transport.close().catch(() => { /* best-effort */ })\n      await mcp.close().catch(() => { /* best-effort */ })\n    },\n  }\n}\n\nasync function handleRequest(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: { transport: StreamableHTTPServerTransport, mountPath: string, authToken?: string },\n): Promise<void> {\n  if (!applyRouteChecks(req, res, { mountPath: ctx.mountPath, authToken: ctx.authToken })) return\n\n  try {\n    await ctx.transport.handleRequest(req, res)\n  } catch (error) {\n    writeInternalError(res, error)\n  }\n}\n\nfunction writeInternalError(res: http.ServerResponse, error: unknown): void {\n  if (res.headersSent) return\n  writeJson(res, 500, {\n    error: 'Internal Server Error',\n    message: error instanceof Error ? error.message : String(error),\n  })\n}\n\nfunction writeJson(res: http.ServerResponse, status: number, body: unknown): void {\n  res.writeHead(status, { 'Content-Type': 'application/json' })\n  res.end(JSON.stringify(body))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA0EA,MAAM,qBAAqB;;;;;;;;;;;;;;;AAgB3B,eAAsB,mBACpB,MAC8B;CAC9B,MAAM,MAAMA,aAAgB,KAAK,YAAY;CAC7C,MAAM,YAAY,IAAI,8BAA8B,EAClD,0BAA0B,YAAY,EACvC,CAAC;AACF,OAAM,IAAI,QAAQ,UAAU;AAE5B,QAAO,2BAA2B;EAChC,MAAM;EACN;EACA;EACA,MAAM,KAAK;EACX,MAAM,KAAK;EACX,WAAW,KAAK;EAChB,MAAM,KAAK;EACZ,CAAC;;;;;;;;;;;;;;;;AAiBJ,eAAsB,uBACpB,MAC8B;AAC9B,KAAI,qBAAqB,KACvB,QAAO,8BAA8B,KAAK;CAE5C,MAAM,MAAMA,aAAgB;EAAE,UAAU,KAAK;EAAU,aAAa,KAAK;EAAa,CAAC;CACvF,MAAM,YAAY,IAAI,8BAA8B,EAClD,0BAA0B,YAAY,EACvC,CAAC;AACF,OAAM,IAAI,QAAQ,UAAU;AAC5B,QAAO,2BAA2B;EAChC,MAAM;EACN;EACA;EACA,MAAM,KAAK;EACX,MAAM,KAAK;EACX,WAAW,KAAK;EAChB,MAAM,KAAK;EACZ,CAAC;;AASJ,eAAe,8BACb,MAC8B;CAC9B,MAAM,2BAAW,IAAI,KAAiC;CACtD,MAAM,MAAM,KAAK,gBAAgB,MAAU;CAC3C,MAAM,YAAY,KAAK,QAAQ;CAC/B,MAAM,OAAO,KAAK,QAAQ;CAE1B,eAAe,eAAe,WAAkC;EAC9D,MAAM,UAAU,SAAS,IAAI,UAAU;AACvC,MAAI,CAAC,QAAS;AACd,WAAS,OAAO,UAAU;AAC1B,QAAM,QAAQ,UAAU,OAAO,CAAC,YAAY,GAAsB;AAClE,QAAM,QAAQ,IAAI,OAAO,CAAC,YAAY,GAAsB;;CAG9D,MAAM,SAAS,kBAAkB;EAC/B,MAAM,MAAM,KAAK,KAAK;AACtB,OAAK,MAAM,CAAC,IAAI,YAAY,SAC1B,KAAI,MAAM,QAAQ,WAAW,IAAU,gBAAe,GAAG;IAE1D,KAAK,IAAI,KAAK,IAAO,CAAC,CAAC,OAAO;CAEjC,MAAM,SAAS,KAAK,cAAc,KAAK,QAAQ;AACxC,2BAAyB,KAAK,KAAK;GACtC;GACA,WAAW,KAAK;GAChB,iBAAiB,KAAK;GACtB,aAAa,KAAK;GAClB;GACD,CAAC;GACF;AAEF,OAAM,IAAI,SAAe,SAAS,WAAW;AAC3C,SAAO,KAAK,SAAS,OAAO;AAC5B,SAAO,OAAO,KAAK,MAAM,YAAY;AACnC,UAAO,IAAI,SAAS,OAAO;AAC3B,YAAS;IACT;GACF;AAKF,QAAO;EACL;EACA,KAAK;EACL,KALU,UAAU,KAAK,GADX,OAAO,SAAS,CACM,OAAO;EAM3C,OAAO,YAAY;AACjB,iBAAc,OAAO;AACrB,SAAM,IAAI,SAAe,SAAS,WAAW;AAC3C,WAAO,OAAM,QAAQ,MAAM,OAAO,IAAI,GAAG,SAAS,CAAE;KACpD;GACF,MAAM,MAAM,CAAC,GAAG,SAAS,MAAM,CAAC;AAChC,SAAM,QAAQ,IAAI,IAAI,KAAI,OAAM,eAAe,GAAG,CAAC,CAAC;;EAEvD;;AAGH,eAAe,yBACb,KACA,KACA,KAOe;AACf,KAAI,CAAC,iBAAiB,KAAK,KAAK;EAAE,WAAW,IAAI;EAAW,WAAW,IAAI;EAAW,CAAC,CAAE;CAEzF,MAAM,oBAAoB,cAAc,IAAI,QAAQ,oBAAoB;AACxE,KAAI,qBAAqB,IAAI,SAAS,IAAI,kBAAkB,EAAE;EAC5D,MAAM,UAAU,IAAI,SAAS,IAAI,kBAAkB;AACnD,UAAQ,WAAW,KAAK,KAAK;AAC7B,MAAI;AACF,SAAM,QAAQ,UAAU,cAAc,KAAK,IAAI;WACxC,OAAO;AACd,sBAAmB,KAAK,MAAM;;AAEhC;;AAGF,KAAI;EAEF,MAAM,MAAMA,aAAgB;GAAE,UADb,MAAM,IAAI,gBAAgB,IAAI;GACP,aAAa,IAAI;GAAa,CAAC;EACvE,MAAM,YAAY,IAAI,8BAA8B;GAClD,0BAA0B,YAAY;GACtC,uBAAuB,cAAsB;AAC3C,QAAI,SAAS,IAAI,WAAW;KAAE;KAAK;KAAW,UAAU,KAAK,KAAK;KAAE,CAAC;;GAExE,CAAC;AACF,QAAM,IAAI,QAAQ,UAAU;AAC5B,QAAM,UAAU,cAAc,KAAK,IAAI;UAChC,OAAO;AACd,qBAAmB,KAAK,MAAM;;;AAIlC,SAAS,cAAc,QAA2D;AAChF,KAAI,CAAC,OAAQ,QAAO,KAAA;AACpB,QAAO,MAAM,QAAQ,OAAO,GAAG,OAAO,KAAK;;AAG7C,SAAS,iBACP,KACA,KACA,KACS;AACT,KAAI,IAAI,WAAW,UAAU,IAAI,WAAW,SAAS,IAAI,WAAW,UAAU;AAC5E,YAAU,KAAK,KAAK,EAAE,OAAO,sBAAsB,CAAC;AACpD,SAAO;;AAET,KAAI,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,WAAW,IAAI,UAAU,EAAE;AAClD,YAAU,KAAK,KAAK,EAAE,OAAO,aAAa,CAAC;AAC3C,SAAO;;AAET,KAAI,IAAI;MACS,IAAI,QAAQ,kBACZ,UAAU,IAAI,aAAa;AACxC,aAAU,KAAK,KAAK,EAAE,OAAO,gBAAgB,CAAC;AAC9C,UAAO;;;AAGX,QAAO;;AAGT,eAAe,2BAA2B,OAQT;CAC/B,MAAM,EAAE,KAAK,cAAc;CAC3B,MAAM,YAAY,MAAM,QAAQ;CAChC,MAAM,OAAO,MAAM,QAAQ;CAE3B,MAAM,SAAS,KAAK,cAAc,KAAK,QAAQ;AACxC,gBAAc,KAAK,KAAK;GAAE;GAAW;GAAW,WAAW,MAAM;GAAW,CAAC;GAClF;AAEF,OAAM,IAAI,SAAe,SAAS,WAAW;AAC3C,SAAO,KAAK,SAAS,OAAO;AAC5B,SAAO,OAAO,MAAM,MAAM,YAAY;AACpC,UAAO,IAAI,SAAS,OAAO;AAC3B,YAAS;IACT;GACF;AAKF,QAAO;EACL;EACA;EACA,KALU,UAAU,KAAK,GADX,OAAO,SAAS,CACM,OAAO;EAM3C,OAAO,YAAY;AACjB,SAAM,IAAI,SAAe,SAAS,WAAW;AAC3C,WAAO,OAAM,QAAQ,MAAM,OAAO,IAAI,GAAG,SAAS,CAAE;KACpD;AACF,SAAM,UAAU,OAAO,CAAC,YAAY,GAAsB;AAC1D,SAAM,IAAI,OAAO,CAAC,YAAY,GAAsB;;EAEvD;;AAGH,eAAe,cACb,KACA,KACA,KACe;AACf,KAAI,CAAC,iBAAiB,KAAK,KAAK;EAAE,WAAW,IAAI;EAAW,WAAW,IAAI;EAAW,CAAC,CAAE;AAEzF,KAAI;AACF,QAAM,IAAI,UAAU,cAAc,KAAK,IAAI;UACpC,OAAO;AACd,qBAAmB,KAAK,MAAM;;;AAIlC,SAAS,mBAAmB,KAA0B,OAAsB;AAC1E,KAAI,IAAI,YAAa;AACrB,WAAU,KAAK,KAAK;EAClB,OAAO;EACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;EAChE,CAAC;;AAGJ,SAAS,UAAU,KAA0B,QAAgB,MAAqB;AAChF,KAAI,UAAU,QAAQ,EAAE,gBAAgB,oBAAoB,CAAC;AAC7D,KAAI,IAAI,KAAK,UAAU,KAAK,CAAC"}

package/dist/{server-B1OJrUQ9.mjs → server-BkhhtEE2.mjs}

@@ -2122,7 +2122,7 @@ function registerDoctorTools(server, _provider, projectRoot) {
 }
 //#endregion
 //#region package.json
-var version = "1.3.0";
+var version = "1.4.0";
 //#endregion
 //#region src/server.ts
 function createServer(input) {
@@ -2163,4 +2163,4 @@ function resolveServerContext(input) {
 //#endregion
 export { createServer as t };
 
-//# sourceMappingURL=server-B1OJrUQ9.mjs.map
+//# sourceMappingURL=server-BkhhtEE2.mjs.map