@daniel.stefan/metalink 1.3.1

package/packages/core/dist/server/http.d.ts

@@ -0,0 +1,386 @@
+/**
+ * HTTP Server - Express-based API for MetaLink
+ */
+import { ConfigLoader } from '../config/index.js';
+import { ServerManager } from './manager.js';
+export declare class HttpServer {
+    private app;
+    private server;
+    private serverManager;
+    private configLoader;
+    private config;
+    private eventClients;
+    private metricsPersistence;
+    private metricsAggregator;
+    private sessions;
+    private readonly SESSION_TIMEOUT;
+    private sessionCleanupInterval;
+    private readonly sessionPersistPath;
+    private sseConnections;
+    private sseEventBuffer;
+    private sseEventCounter;
+    private readonly MAX_EVENTS_PER_SESSION;
+    private toolExecutionRateLimiter;
+    private readonly TOOL_RATE_LIMIT_WINDOW_MS;
+    private readonly TOOL_RATE_LIMIT_MAX_CALLS;
+    private discoveryRateLimiter;
+    private readonly DISCOVERY_RATE_LIMIT_WINDOW_MS;
+    private readonly DISCOVERY_RATE_LIMIT_MAX_CALLS;
+    private readonly startTime;
+    constructor(configLoader: ConfigLoader);
+    /**
+     * Get server manager instance
+     */
+    getServerManager(): ServerManager;
+    /**
+     * Pagination support - Encode cursor data to opaque base64 string
+     */
+    private encodeCursor;
+    /**
+     * Pagination support - Decode cursor from base64 string
+     */
+    private decodeCursor;
+    /**
+     * Pagination support - Truncate string to character limit
+     */
+    private truncateToChars;
+    /**
+     * Pagination support - Apply pagination to tool result
+     *
+     * @param result - Tool execution result (any type)
+     * @param params - Pagination parameters from request
+     * @returns Paginated result with metadata
+     */
+    private paginateResult;
+    /**
+     * Setup Express middleware
+     */
+    private setupMiddleware;
+    /**
+     * Authentication middleware
+     */
+    private authMiddleware;
+    /**
+     * Setup API routes
+     */
+    private setupRoutes;
+    /**
+     * SECURITY: Sanitize error messages to prevent credential/path leakage.
+     *
+     * This function removes or masks sensitive information from error messages
+     * before they are sent to clients.
+     *
+     * OWASP Reference: A3:2017-Sensitive Data Exposure
+     *
+     * @param message - Original error message
+     * @returns Sanitized message safe for client exposure
+     */
+    private sanitizeErrorMessage;
+    /**
+     * Setup Server-Sent Events
+     */
+    private setupSSE;
+    /**
+     * Broadcast event to all SSE clients
+     */
+    private broadcastEvent;
+    /**
+     * List all servers
+     */
+    private listServers;
+    /**
+     * List all available servers (including disabled ones)
+     */
+    private listAvailableServers;
+    /**
+     * Enable a server (add to EXPOSE_SERVERS)
+     */
+    private enableServer;
+    /**
+     * Disable a server (remove from EXPOSE_SERVERS)
+     */
+    private disableServer;
+    /**
+     * Start a server
+     */
+    private startServer;
+    /**
+     * Stop a server
+     */
+    private stopServer;
+    /**
+     * Restart a server
+     */
+    private restartServer;
+    /**
+     * Force refresh tools for a server
+     * v1.4.2: Clears cache and re-discovers tools from the MCP server
+     */
+    private refreshServerTools;
+    /**
+     * Get server status
+     */
+    private getServerStatus;
+    /**
+     * Get full server information including configuration and runtime status
+     * v1.1.29: Include tools list and support ?forceDiscovery=true to rediscover
+     */
+    private getServerInfo;
+    /**
+     * Get server tools (stub - Phase 2)
+     */
+    private getServerTools;
+    /**
+     * Execute tool (stub - Phase 2)
+     */
+    private executeTool;
+    /**
+     * Get configuration
+     */
+    private getConfig;
+    /**
+     * Update configuration (stub - Phase 2)
+     */
+    private updateConfig;
+    /**
+     * Health check endpoint
+     */
+    private healthCheck;
+    /**
+     * Get MetaLink version
+     */
+    private getVersion;
+    /**
+     * GET /api/v1/metrics - JSON metrics endpoint
+     */
+    private getMetrics;
+    /**
+     * GET /api/v1/metrics/prometheus - Prometheus export endpoint
+     */
+    private getPrometheusMetrics;
+    /**
+     * GET /api/v1/metrics/api - API-level metrics
+     */
+    private getApiMetrics;
+    /**
+     * GET /api/v1/metrics/servers/:name - Server-specific metrics
+     */
+    private getServerMetrics;
+    /**
+     * GET /api/v1/metrics/hourly - Hourly aggregation
+     */
+    private getHourlyMetrics;
+    /**
+     * GET /api/v1/metrics/daily - Daily aggregation
+     */
+    private getDailyMetrics;
+    /**
+     * GET /api/v1/metrics/weekly - Weekly aggregation
+     */
+    private getWeeklyMetrics;
+    /**
+     * GET /api/v1/metrics/errors - Error analytics across all tools
+     */
+    private getErrorAnalytics;
+    /**
+     * GET /api/v1/metrics/errors/:toolName - Per-tool error analytics
+     * Query params: ?serverName=<name> (optional)
+     */
+    private getToolErrorMetrics;
+    /**
+     * GET /api/v1/metrics/tools - Granular tool-specific metrics (Test 187)
+     * Query params:
+     *   ?serverName=<name> - Filter by server
+     *   ?slow=<limit> - Get slowest tools (by p95 latency)
+     *   ?errors=<threshold> - Get tools with high error rates (default: 5%)
+     */
+    private getToolMetrics;
+    /**
+     * Load persisted metrics on startup (Phase 4 - v1.4.0)
+     */
+    private loadPersistedMetrics;
+    /**
+     * Start periodic metrics persistence (Phase 4 - v1.4.0)
+     */
+    private startMetricsPersistence;
+    /**
+     * Track SSE event for Last-Event-ID resumption
+     */
+    private trackSseEvent;
+    /**
+     * Get events for resumption after Last-Event-ID
+     */
+    private getEventsForResumption;
+    private createSession;
+    /**
+     * Get and update session activity with validation logging
+     */
+    private getSession;
+    /**
+     * Clean up expired sessions
+     */
+    private cleanupSessions;
+    /**
+     * Start session cleanup timer
+     */
+    private startSessionCleanup;
+    /**
+     * Stop session cleanup timer
+     */
+    private stopSessionCleanup;
+    /**
+     * Session persistence file format
+     */
+    private readonly SESSION_PERSIST_VERSION;
+    /**
+     * Persist sessions to disk with atomic write (temp file + rename)
+     * Called after session creation and cleanup
+     */
+    private persistSessions;
+    /**
+     * Load sessions from disk on startup
+     * Filters out expired sessions during load
+     */
+    private loadSessions;
+    /**
+     * Handle Streamable HTTP request (MCP 2025-03-26)
+     * Returns tuple of [response, sessionId] for session tracking
+     */
+    private handleStreamableRequest;
+    /**
+     * Handle MCP JSON-RPC requests over HTTP
+     */
+    private handleMcpRequest;
+    /**
+     * Handle JSON-RPC method routing
+     */
+    private handleJsonRpcRequest;
+    /**
+     * Generate execute_tool description
+     * v1.3.x: Simplified - removed "Safe by default" list that caused confusion.
+     * Now relies solely on annotations.safety from search_tools results.
+     */
+    private getExecuteToolDescription;
+    /**
+     * MCP: tools/list - return available tools
+     *
+     * SPEAKEASY-INSPIRED 4-TOOL APPROACH (v1.3.52):
+     * 1. search_tools - Fuzzy search across all servers
+     * 2. describe_tool - Get full schema for specific tool
+     * 3. execute_tool - Execute safe/read-only tools (BLOCKS risky tools)
+     * 4. execute_tool_confirm - Execute risky/write tools (user confirmed)
+     *
+     * Optional: Base server tools (if dynamicToolExposure=true in config)
+     */
+    private mcpListTools;
+    /**
+     * MCP: tools/call - route tool calls
+     *
+     * SECURITY: Includes per-server rate limiting to prevent DOS attacks.
+     * Rate limit: 100 calls per server per minute (configurable).
+     * Discovery endpoints (search_tools, describe_tool) have separate rate limiting.
+     */
+    private mcpCallTool;
+    /**
+     * SECURITY: Extract server name from tool call for rate limiting.
+     *
+     * @param name - Tool name (e.g., "execute_tool", "memory-search_nodes")
+     * @param args - Tool arguments
+     * @returns Server name or null for meta-tools without server context
+     */
+    private extractServerNameForRateLimit;
+    /**
+     * SECURITY: Check and enforce per-server rate limiting.
+     *
+     * OWASP Reference: A6:2017-Security Misconfiguration - DOS Prevention
+     *
+     * @param serverName - Name of the server to check rate limit for
+     * @throws Error if rate limit exceeded
+     */
+    private checkToolRateLimit;
+    /**
+     * SECURITY: Check discovery endpoint rate limit (P1 - OWASP DOS Prevention)
+     * Prevents abuse of search_tools and describe_tool endpoints
+     *
+     * @param sessionId - Session ID to track rate limit for
+     * @throws Error if rate limit exceeded
+     */
+    private checkDiscoveryRateLimit;
+    /**
+     * Execute tool call logic (extracted for metrics tracking)
+     */
+    private executeToolCall;
+    /**
+     * Add a new server to the registry
+     */
+    private addServer;
+    /**
+     * Remove a server from the registry
+     */
+    private removeServer;
+    /**
+     * Validate a server configuration without saving
+     */
+    private validateServer;
+    /**
+     * Start the HTTP server
+     * NOTE: This Promise never resolves - it keeps the event loop alive for background mode
+     */
+    listen(port: number, host: string): Promise<void>;
+    /**
+     * Send message via SSE to connected client
+     */
+    private sendSSEMessage;
+    /**
+     * Send notifications/tools/list_changed to all connected SSE clients
+     * Throttled to max 1 notification per second
+     */
+    private lastToolsListNotification;
+    private readonly TOOLS_LIST_NOTIFICATION_THROTTLE_MS;
+    private notifyToolsListChanged;
+    /**
+     * Send response via callback URL (MCP callback protocol for bidirectional communication)
+     */
+    private sendViaCallback;
+    /**
+     * Cleanup
+     */
+    /**
+     * Get all safety rules
+     */
+    private getSafetyRules;
+    /**
+     * Check if a specific tool is safe or risky
+     */
+    private checkToolSafety;
+    /**
+     * Add a safe tool override
+     */
+    private addSafeToolOverride;
+    /**
+     * Add a risky tool override
+     */
+    private addRiskyToolOverride;
+    /**
+     * Add a safe pattern
+     */
+    private addSafePattern;
+    /**
+     * Add a risky pattern
+     */
+    private addRiskyPattern;
+    /**
+     * Remove a rule (tool override or pattern)
+     */
+    private removeRule;
+    /**
+     * Reset safety rules to defaults
+     */
+    private resetSafetyRules;
+    /**
+     * Import safety rules from JSON
+     */
+    private importSafetyRules;
+    cleanup(): Promise<void>;
+}
+//# sourceMappingURL=http.d.ts.map

package/packages/core/dist/server/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/server/http.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,OAAO,EAAkB,YAAY,EAAqD,MAAM,oBAAoB,CAAC;AACrH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AA4G7C,qBAAa,UAAU;IACrB,OAAO,CAAC,GAAG,CAAU;IACrB,OAAO,CAAC,MAAM,CAAa;IAC3B,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,YAAY,CAA4B;IAGhD,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,OAAO,CAAC,iBAAiB,CAAoB;IAG7C,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuB;IACvD,OAAO,CAAC,sBAAsB,CAA+B;IAC7D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAG5C,OAAO,CAAC,cAAc,CAAoC;IAG1D,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAO;IAI9C,OAAO,CAAC,wBAAwB,CAAgE;IAChG,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IACnD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAO;IAIjD,OAAO,CAAC,oBAAoB,CAAgE;IAC5F,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAS;IACxD,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAO;IAGtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;gBAEpC,YAAY,EAAE,YAAY;IA4CtC;;OAEG;IACH,gBAAgB,IAAI,aAAa;IAIjC;;OAEG;IACH,OAAO,CAAC,YAAY;IAIpB;;OAEG;IACH,OAAO,CAAC,YAAY;IASpB;;OAEG;IACH,OAAO,CAAC,eAAe;IAgBvB;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAyEtB;;OAEG;IACH,OAAO,CAAC,eAAe;IAoJvB;;OAEG;IACH,OAAO,CAAC,cAAc;IAkCtB;;OAEG;IACH,OAAO,CAAC,WAAW;IAgJnB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,oBAAoB;IAgD5B;;OAEG;IACH,OAAO,CAAC,QAAQ;IA6DhB;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;OAEG;YACW,WAAW;IAuCzB;;OAEG;YACW,oBAAoB;IA6ClC;;OAEG;YACW,YAAY;IA6B1B;;OAEG;YACW,aAAa;IAwB3B;;OAEG;YACW,WAAW;IAsBzB;;OAEG;YACW,UAAU;IAgBxB;;OAEG;YACW,aAAa;IAsB3B;;;OAGG;YACW,kBAAkB;IA0BhC;;OAEG;YACW,eAAe;IAsC7B;;;OAGG;YACW,aAAa;IA6E3B;;OAEG;YACW,cAAc;IAoB5B;;OAEG;YACW,WAAW;IA6BzB;;OAEG;YACW,SAAS;IAWvB;;OAEG;YACW,YAAY;IA0B1B;;OAEG;YACW,WAAW;IAyFzB;;OAEG;YACW,UAAU;IAYxB;;OAEG;YACW,UAAU;IAgBxB;;OAEG;YACW,oBAAoB;IASlC;;OAEG;YACW,aAAa;IAU3B;;OAEG;YACW,gBAAgB;IAkB9B;;OAEG;YACW,gBAAgB;IAmB9B;;OAEG;YACW,eAAe;IAmB7B;;OAEG;YACW,gBAAgB;IAmB9B;;OAEG;YACW,iBAAiB;IAW/B;;;OAGG;YACW,mBAAmB;IAsBjC;;;;;;OAMG;YACW,cAAc;IAkC5B;;OAEG;YACW,oBAAoB;IAelC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAiB/B;;OAEG;IACH,OAAO,CAAC,aAAa;IAuBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAQ9B,OAAO,CAAC,aAAa;IAqBrB;;OAEG;IACH,OAAO,CAAC,UAAU;IAYlB;;OAEG;IACH,OAAO,CAAC,eAAe;IAkBvB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAS3B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAK;IAE7C;;;OAGG;IACH,OAAO,CAAC,eAAe;IAgCvB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAgDpB;;;OAGG;YACW,uBAAuB;IAiPrC;;OAEG;YACW,gBAAgB;IAuY9B;;OAEG;YACW,oBAAoB;IAqHlC;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IAMjC;;;;;;;;;;OAUG;YACW,YAAY;IAmM1B;;;;;;OAMG;YACW,WAAW;IAgFzB;;;;;;OAMG;IACH,OAAO,CAAC,6BAA6B;IAsBrC;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IAkC1B;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAkC/B;;OAEG;YACW,eAAe;IAulC7B;;OAEG;YACW,SAAS;IA8CvB;;OAEG;YACW,YAAY;IA0D1B;;OAEG;YACW,cAAc;IA6B5B;;;OAGG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBvD;;OAEG;IACH,OAAO,CAAC,cAAc;IAYtB;;;OAGG;IACH,OAAO,CAAC,yBAAyB,CAAK;IACtC,OAAO,CAAC,QAAQ,CAAC,mCAAmC,CAAQ;IAE5D,OAAO,CAAC,sBAAsB;IAgC9B;;OAEG;YACW,eAAe;IAgC7B;;OAEG;IAEH;;OAEG;YACW,cAAc;IA0B5B;;OAEG;YACW,eAAe;IA4B7B;;OAEG;YACW,mBAAmB;IAmCjC;;OAEG;YACW,oBAAoB;IAmClC;;OAEG;YACW,cAAc;IAoC5B;;OAEG;YACW,eAAe;IAoC7B;;OAEG;YACW,UAAU;IA0DxB;;OAEG;YACW,gBAAgB;IAwB9B;;OAEG;YACW,iBAAiB;IAgFzB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAiC/B"}