@dobbyai/mcp-external 1.0.4 → 1.2.0

package/dist/__tests__/gateway-bearer.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * DobbyClient.gatewayBearer Tests
+ *
+ * gatewayBearer() picks the credential for GATEWAY-scoped endpoints (routes
+ * guarded by authenticateGatewayRequest hard-require a gk_* key):
+ * lazy provider (HTTP mode) > static gatewayKey (STDIO) > apiKey (legacy).
+ *
+ * Also proves at the helper level that a gateway fetch helper sends the
+ * RESOLVED key — not the OAuth session token — when a provider is present.
+ */
+export {};
+//# sourceMappingURL=gateway-bearer.test.d.ts.map

package/dist/__tests__/gateway-bearer.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-bearer.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/gateway-bearer.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/__tests__/gateway-bearer.test.js

@@ -0,0 +1,112 @@
+/**
+ * DobbyClient.gatewayBearer Tests
+ *
+ * gatewayBearer() picks the credential for GATEWAY-scoped endpoints (routes
+ * guarded by authenticateGatewayRequest hard-require a gk_* key):
+ * lazy provider (HTTP mode) > static gatewayKey (STDIO) > apiKey (legacy).
+ *
+ * Also proves at the helper level that a gateway fetch helper sends the
+ * RESOLVED key — not the OAuth session token — when a provider is present.
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { createRegistry, toMcpResult } from '@dobbyai/capability-core';
+import { DobbyClient } from '../lib/dobby-client.js';
+// ADR-019: the legacy handleCrewAIHealth is gone — dispatch goes through the
+// 'crewai_health' registry capability. Its handler is a verbatim copy (same
+// callGatewayProxy → gatewayBearer() path), so the same real DobbyClient is
+// passed through ctx and the outgoing-header assertions stay unchanged.
+const registry = createRegistry();
+describe('DobbyClient.gatewayBearer', () => {
+    const base = {
+        apiUrl: 'https://api.test',
+        apiKey: 'sk_live_api_key',
+        tenantId: 'tenant_1',
+    };
+    it('prefers the lazy provider over static gatewayKey and apiKey', async () => {
+        const client = new DobbyClient({
+            ...base,
+            gatewayKey: 'gk_static_key',
+            getGatewayKey: async () => 'gk_tmp_provider_key',
+        });
+        expect(await client.gatewayBearer()).toBe('gk_tmp_provider_key');
+    });
+    it('falls back to the static gatewayKey when the provider resolves undefined', async () => {
+        const client = new DobbyClient({
+            ...base,
+            gatewayKey: 'gk_static_key',
+            getGatewayKey: async () => undefined,
+        });
+        expect(await client.gatewayBearer()).toBe('gk_static_key');
+    });
+    it('uses the static gatewayKey when no provider is configured (STDIO)', async () => {
+        const client = new DobbyClient({ ...base, gatewayKey: 'gk_static_key' });
+        expect(await client.gatewayBearer()).toBe('gk_static_key');
+    });
+    it('falls back to apiKey when neither provider nor static key is configured', async () => {
+        const client = new DobbyClient(base);
+        expect(await client.gatewayBearer()).toBe('sk_live_api_key');
+    });
+    it('invokes a memoized provider only ONCE across two gatewayBearer calls', async () => {
+        // Mirrors the per-session memoization in server.ts:
+        //   sessionGatewayKey ??= resolveSessionGatewayKey(...)
+        let sessionGatewayKey;
+        const resolve = vi.fn().mockResolvedValue('gk_tmp_once');
+        const client = new DobbyClient({
+            ...base,
+            getGatewayKey: () => (sessionGatewayKey ??= resolve()),
+        });
+        expect(await client.gatewayBearer()).toBe('gk_tmp_once');
+        expect(await client.gatewayBearer()).toBe('gk_tmp_once');
+        expect(resolve).toHaveBeenCalledTimes(1);
+    });
+});
+describe('gateway fetch helpers use gatewayBearer()', () => {
+    afterEach(() => {
+        vi.unstubAllGlobals();
+    });
+    it('crewai callGatewayProxy sends the RESOLVED gk_tmp_, not the OAuth session token', async () => {
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: true,
+            json: () => Promise.resolve({
+                response: { status: 'healthy' },
+                connection: { connection_id: 'conn_1', provider_id: 'crewai', status: 'active' },
+                latency_ms: 5,
+            }),
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        const client = new DobbyClient({
+            apiUrl: 'https://api.test',
+            apiKey: 'dobby_at_session_token',
+            tenantId: 'tenant_1',
+            getGatewayKey: async () => 'gk_tmp_resolved',
+        });
+        const result = toMcpResult(await registry.get('crewai_health').handler({ client }, {}));
+        expect(result.isError).toBeUndefined();
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toBe('https://api.test/api/v1/gateway/agents/proxy');
+        expect(init.headers.Authorization).toBe('Bearer gk_tmp_resolved');
+        // The session token must NOT leak into any header of a gateway call
+        expect(JSON.stringify(init.headers)).not.toContain('dobby_at_session_token');
+    });
+    it('crewai callGatewayProxy keeps sending the gk_ apiKey for genuine gateway-key clients', async () => {
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: true,
+            json: () => Promise.resolve({
+                response: { status: 'healthy' },
+                connection: {},
+                latency_ms: 3,
+            }),
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        const client = new DobbyClient({
+            apiUrl: 'https://api.test',
+            apiKey: 'gk_user_direct',
+            tenantId: 'tenant_1',
+        });
+        await registry.get('crewai_health').handler({ client }, {});
+        const [, init] = fetchMock.mock.calls[0];
+        expect(init.headers.Authorization).toBe('Bearer gk_user_direct');
+    });
+});
+//# sourceMappingURL=gateway-bearer.test.js.map

package/dist/__tests__/gateway-bearer.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-bearer.test.js","sourceRoot":"","sources":["../../src/__tests__/gateway-bearer.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,wEAAwE;AACxE,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;AAElC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,kBAAkB;QAC1B,MAAM,EAAE,iBAAiB;QACzB,QAAQ,EAAE,UAAU;KACrB,CAAC;IAEF,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC;YAC7B,GAAG,IAAI;YACP,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,qBAAqB;SACjD,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC;YAC7B,GAAG,IAAI;YACP,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;SACrC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC;QAEzE,MAAM,CAAC,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;QAErC,MAAM,CAAC,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,oDAAoD;QACpD,wDAAwD;QACxD,IAAI,iBAA0D,CAAC;QAC/D,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC;YAC7B,GAAG,IAAI;YACP,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,iBAAiB,KAAK,OAAO,EAAE,CAAC;SACvD,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACzD,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,gBAAgB,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;YAC1C,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CACT,OAAO,CAAC,OAAO,CAAC;gBACd,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;gBAC/B,UAAU,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAChF,UAAU,EAAE,CAAC;aACd,CAAC;SACL,CAAC,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAElC,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC;YAC7B,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,wBAAwB;YAChC,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,iBAAiB;SAC7C,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,WAAW,CACxB,MAAM,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAC7D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;QAEvC,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAClE,oEAAoE;QACpE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAChD,wBAAwB,CACzB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;YAC1C,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CACT,OAAO,CAAC,OAAO,CAAC;gBACd,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;gBAC/B,UAAU,EAAE,EAAE;gBACd,UAAU,EAAE,CAAC;aACd,CAAC;SACL,CAAC,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAElC,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC;YAC7B,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,UAAU;SACrB,CAAC,CAAC;QAEH,MAAM,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAE7D,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/gateway-key-resolver.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Session Gateway Key Resolver Tests
+ *
+ * resolveSessionGatewayKey exchanges an MCP HTTP session token (dobby_at_* /
+ * sk_live_*) for a tenant+user-bound gk_tmp_* gateway key via the web app's
+ * internal endpoint. It must fail SOFT (return undefined) on every failure
+ * mode, log why exactly once, and never log the session token or the key.
+ */
+export {};
+//# sourceMappingURL=gateway-key-resolver.test.d.ts.map

package/dist/__tests__/gateway-key-resolver.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-key-resolver.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/gateway-key-resolver.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/__tests__/gateway-key-resolver.test.js

@@ -0,0 +1,125 @@
+/**
+ * Session Gateway Key Resolver Tests
+ *
+ * resolveSessionGatewayKey exchanges an MCP HTTP session token (dobby_at_* /
+ * sk_live_*) for a tenant+user-bound gk_tmp_* gateway key via the web app's
+ * internal endpoint. It must fail SOFT (return undefined) on every failure
+ * mode, log why exactly once, and never log the session token or the key.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { resolveSessionGatewayKey } from '../lib/gateway-key-resolver.js';
+const API_URL = 'https://web.test';
+const SESSION_TOKEN = 'dobby_at_secret_session_token';
+const RESOLVED_KEY = 'gk_tmp_resolved_key_123';
+const INTERNAL_SECRET = 'internal-secret-for-tests';
+describe('resolveSessionGatewayKey', () => {
+    let consoleErrorSpy;
+    beforeEach(() => {
+        vi.stubEnv('INTERNAL_SERVICE_SECRET', INTERNAL_SECRET);
+        consoleErrorSpy = vi
+            .spyOn(console, 'error')
+            .mockImplementation(() => { });
+    });
+    afterEach(() => {
+        vi.unstubAllEnvs();
+        vi.unstubAllGlobals();
+        vi.restoreAllMocks();
+    });
+    it('returns data.gateway_key on 200 — POST carries the session token as Bearer + the internal secret header', async () => {
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: true,
+            json: () => Promise.resolve({
+                success: true,
+                data: {
+                    gateway_key: RESOLVED_KEY,
+                    key_id: 'key_abc',
+                    expires_at: '2026-07-12T12:00:00Z',
+                    scopes: ['agents:read'],
+                },
+            }),
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        const key = await resolveSessionGatewayKey({
+            apiUrl: API_URL,
+            token: SESSION_TOKEN,
+        });
+        expect(key).toBe(RESOLVED_KEY);
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toBe(`${API_URL}/api/v1/internal/mcp/gateway-key`);
+        expect(init.method).toBe('POST');
+        expect(init.headers['x-internal-secret']).toBe(INTERNAL_SECRET);
+        expect(init.headers.Authorization).toBe(`Bearer ${SESSION_TOKEN}`);
+        expect(init.headers['Content-Type']).toBe('application/json');
+        expect(init.body).toBe('{}');
+        // Success path logs nothing
+        expect(consoleErrorSpy).not.toHaveBeenCalled();
+    });
+    it('returns undefined on a non-OK response — logs the HTTP status, never the token', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+            ok: false,
+            status: 401,
+            json: () => Promise.resolve({ error: 'unauthorized', message: 'bad token' }),
+        }));
+        const key = await resolveSessionGatewayKey({
+            apiUrl: API_URL,
+            token: SESSION_TOKEN,
+        });
+        expect(key).toBeUndefined();
+        expect(consoleErrorSpy).toHaveBeenCalledTimes(1);
+        const logged = consoleErrorSpy.mock.calls[0].join(' ');
+        expect(logged).toContain('401');
+        expect(logged).not.toContain(SESSION_TOKEN);
+    });
+    it('returns undefined WITHOUT calling fetch when INTERNAL_SERVICE_SECRET is missing', async () => {
+        vi.stubEnv('INTERNAL_SERVICE_SECRET', '');
+        const fetchMock = vi.fn();
+        vi.stubGlobal('fetch', fetchMock);
+        const key = await resolveSessionGatewayKey({
+            apiUrl: API_URL,
+            token: SESSION_TOKEN,
+        });
+        expect(key).toBeUndefined();
+        expect(fetchMock).not.toHaveBeenCalled();
+        expect(consoleErrorSpy).toHaveBeenCalledTimes(1);
+        expect(consoleErrorSpy.mock.calls[0].join(' ')).toContain('INTERNAL_SERVICE_SECRET');
+    });
+    it('returns undefined on a network error (no retries)', async () => {
+        const fetchMock = vi.fn().mockRejectedValue(new Error('ECONNREFUSED'));
+        vi.stubGlobal('fetch', fetchMock);
+        const key = await resolveSessionGatewayKey({
+            apiUrl: API_URL,
+            token: SESSION_TOKEN,
+        });
+        expect(key).toBeUndefined();
+        expect(fetchMock).toHaveBeenCalledTimes(1); // no retries
+        expect(consoleErrorSpy).toHaveBeenCalledTimes(1);
+        expect(consoleErrorSpy.mock.calls[0].join(' ')).toContain('ECONNREFUSED');
+    });
+    it('returns undefined when the 200 body has no data.gateway_key (malformed body)', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+            ok: true,
+            json: () => Promise.resolve({ success: true, data: {} }),
+        }));
+        const key = await resolveSessionGatewayKey({
+            apiUrl: API_URL,
+            token: SESSION_TOKEN,
+        });
+        expect(key).toBeUndefined();
+        expect(consoleErrorSpy).toHaveBeenCalledTimes(1);
+        expect(consoleErrorSpy.mock.calls[0].join(' ')).toContain('gateway_key');
+    });
+    it('returns undefined when the 200 body is not JSON at all', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+            ok: true,
+            json: () => Promise.reject(new Error('Unexpected token < in JSON')),
+        }));
+        const key = await resolveSessionGatewayKey({
+            apiUrl: API_URL,
+            token: SESSION_TOKEN,
+        });
+        expect(key).toBeUndefined();
+        expect(consoleErrorSpy).toHaveBeenCalledTimes(1);
+    });
+});
+//# sourceMappingURL=gateway-key-resolver.test.js.map

package/dist/__tests__/gateway-key-resolver.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-key-resolver.test.js","sourceRoot":"","sources":["../../src/__tests__/gateway-key-resolver.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAE1E,MAAM,OAAO,GAAG,kBAAkB,CAAC;AACnC,MAAM,aAAa,GAAG,+BAA+B,CAAC;AACtD,MAAM,YAAY,GAAG,yBAAyB,CAAC;AAC/C,MAAM,eAAe,GAAG,2BAA2B,CAAC;AAEpD,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,IAAI,eAA4C,CAAC;IAEjD,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,OAAO,CAAC,yBAAyB,EAAE,eAAe,CAAC,CAAC;QACvD,eAAe,GAAG,EAAE;aACjB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;aACvB,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,EAAE,CAAC,gBAAgB,EAAE,CAAC;QACtB,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yGAAyG,EAAE,KAAK,IAAI,EAAE;QACvH,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;YAC1C,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CACT,OAAO,CAAC,OAAO,CAAC;gBACd,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,WAAW,EAAE,YAAY;oBACzB,MAAM,EAAE,SAAS;oBACjB,UAAU,EAAE,sBAAsB;oBAClC,MAAM,EAAE,CAAC,aAAa,CAAC;iBACxB;aACF,CAAC;SACL,CAAC,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAElC,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC;YACzC,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,aAAa;SACrB,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/B,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,kCAAkC,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,UAAU,aAAa,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,4BAA4B;QAC5B,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,EAAE,CAAC,UAAU,CACX,OAAO,EACP,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;YACxB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,GAAG,EAAE,CACT,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;SACnE,CAAC,CACH,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC;YACzC,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,aAAa;SACrB,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;QAC5B,MAAM,CAAC,eAAe,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,EAAE,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1B,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAElC,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC;YACzC,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,aAAa;SACrB,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;QAC5B,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACzC,MAAM,CAAC,eAAe,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CACvD,yBAAyB,CAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QACvE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAElC,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC;YACzC,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,aAAa;SACrB,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;QAC5B,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa;QACzD,MAAM,CAAC,eAAe,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,EAAE,CAAC,UAAU,CACX,OAAO,EACP,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;YACxB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;SACzD,CAAC,CACH,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC;YACzC,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,aAAa;SACrB,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;QAC5B,MAAM,CAAC,eAAe,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,EAAE,CAAC,UAAU,CACX,OAAO,EACP,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;YACxB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;SACpE,CAAC,CACH,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC;YACzC,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,aAAa;SACrB,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;QAC5B,MAAM,CAAC,eAAe,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/http-concurrency.test.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Streamable-HTTP concurrency correlation tests
+ *
+ * Regression for the 2026-07-18 customer incident: a burst of concurrent tool
+ * calls on ONE session followed by a retry produced a CROSS-LABELED response —
+ * the list_services payload delivered as the get_task result. Server-side
+ * mechanism: the SDK correlates JSON-RPC responses to HTTP streams by the
+ * CLIENT-chosen request id (`_requestToStreamMapping`) and silently OVERWRITES
+ * the mapping when a second POST on the same session reuses an id that is
+ * still in flight — the first handler's late response is then written to the
+ * SECOND request's SSE stream with a matching id, so the client trusts a
+ * payload that belongs to a different tool call. http-server.ts rejects
+ * in-flight id reuse with an explicit 400 instead.
+ *
+ * These tests also pin the SDK-private location of the in-flight map: if an
+ * SDK upgrade moves `_requestToStreamMapping`, the guard silently disarms and
+ * the "rejected with 400" test here fails loudly.
+ */
+export {};
+//# sourceMappingURL=http-concurrency.test.d.ts.map

package/dist/__tests__/http-concurrency.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-concurrency.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/http-concurrency.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/__tests__/http-concurrency.test.js

@@ -0,0 +1,254 @@
+/**
+ * Streamable-HTTP concurrency correlation tests
+ *
+ * Regression for the 2026-07-18 customer incident: a burst of concurrent tool
+ * calls on ONE session followed by a retry produced a CROSS-LABELED response —
+ * the list_services payload delivered as the get_task result. Server-side
+ * mechanism: the SDK correlates JSON-RPC responses to HTTP streams by the
+ * CLIENT-chosen request id (`_requestToStreamMapping`) and silently OVERWRITES
+ * the mapping when a second POST on the same session reuses an id that is
+ * still in flight — the first handler's late response is then written to the
+ * SECOND request's SSE stream with a matching id, so the client trusts a
+ * payload that belongs to a different tool call. http-server.ts rejects
+ * in-flight id reuse with an explicit 400 instead.
+ *
+ * These tests also pin the SDK-private location of the in-flight map: if an
+ * SDK upgrade moves `_requestToStreamMapping`, the guard silently disarms and
+ * the "rejected with 400" test here fails loudly.
+ */
+import { describe, it, expect } from "vitest";
+function deferred() {
+    let resolve;
+    const promise = new Promise((r) => (resolve = r));
+    return { promise, resolve };
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/**
+ * Stub issuer + real HTTP server wired to a minimal MCP server exposing
+ * controllable tools: `echo` (optional delay_ms), `slow_tool` (blocks on the
+ * test-held gate), `fast_tool` (immediate). Every tool echoes back its own
+ * name + the caller's `marker` argument so a response can be traced to the
+ * exact request that produced it.
+ */
+async function withToolServer(run) {
+    const express = (await import("express")).default;
+    const { Server } = await import("@modelcontextprotocol/sdk/server/index.js");
+    const { ListToolsRequestSchema, CallToolRequestSchema } = await import("@modelcontextprotocol/sdk/types.js");
+    const { startHttpServer } = await import("../http-server.js");
+    const issuer = express();
+    issuer.use(express.json());
+    issuer.post("/oauth/token/introspect", (_req, res) => {
+        res.json({
+            active: true,
+            user_id: "pu_conc",
+            org_id: "org_conc",
+            tenant_id: "tenant_conc",
+            scope: "mcp:*",
+            client_id: "key_conc",
+            exp: Math.floor(Date.now() / 1000) + 3600,
+        });
+    });
+    const issuerServer = issuer.listen(0);
+    const issuerPort = issuerServer.address().port;
+    const gate = deferred();
+    const { server, tokenVerifier } = await startHttpServer({
+        port: 0,
+        issuerUrl: `http://127.0.0.1:${issuerPort}`,
+        mcpPublicUrl: "http://127.0.0.1:0",
+        createMcpServer: async () => {
+            const srv = new Server({ name: "conc-server", version: "0.0.0" }, { capabilities: { tools: {} } });
+            srv.setRequestHandler(ListToolsRequestSchema, async () => ({
+                tools: [
+                    {
+                        name: "echo",
+                        description: "echo",
+                        inputSchema: { type: "object" },
+                    },
+                    {
+                        name: "slow_tool",
+                        description: "blocks until the test releases the gate",
+                        inputSchema: { type: "object" },
+                    },
+                    {
+                        name: "fast_tool",
+                        description: "returns immediately",
+                        inputSchema: { type: "object" },
+                    },
+                ],
+            }));
+            srv.setRequestHandler(CallToolRequestSchema, async (req) => {
+                const name = req.params.name;
+                const args = (req.params.arguments ?? {});
+                if (name === "slow_tool")
+                    await gate.promise;
+                if (name === "echo" && typeof args.delay_ms === "number") {
+                    await sleep(args.delay_ms);
+                }
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({ tool: name, marker: args.marker ?? null }),
+                        },
+                    ],
+                };
+            });
+            return srv;
+        },
+    });
+    const mcpPort = server.address().port;
+    const mcpUrl = `http://127.0.0.1:${mcpPort}/mcp`;
+    const baseHeaders = {
+        Authorization: "Bearer sk_live_conc_test",
+        "Content-Type": "application/json",
+        Accept: "application/json, text/event-stream",
+    };
+    const initRes = await fetch(mcpUrl, {
+        method: "POST",
+        headers: baseHeaders,
+        body: JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "initialize",
+            params: {
+                protocolVersion: "2025-03-26",
+                capabilities: {},
+                clientInfo: { name: "conc-probe", version: "0" },
+            },
+        }),
+    });
+    expect(initRes.status).toBe(200);
+    const sessionId = initRes.headers.get("mcp-session-id");
+    expect(sessionId).toBeTruthy();
+    await initRes.text(); // drain the initialize SSE stream
+    try {
+        await run({
+            mcpUrl,
+            headers: { ...baseHeaders, "Mcp-Session-Id": sessionId },
+            gate,
+        });
+    }
+    finally {
+        gate.resolve(); // never leave a handler blocked across tests
+        tokenVerifier.clearCache();
+        server.close();
+        issuerServer.close();
+    }
+}
+/** Extract the LAST JSON-RPC message from an SSE response body. */
+function parseSse(text) {
+    const dataLines = text.split("\n").filter((l) => l.startsWith("data: "));
+    expect(dataLines.length).toBeGreaterThan(0);
+    return JSON.parse(dataLines[dataLines.length - 1].slice(6));
+}
+function callBody(id, tool, args = {}) {
+    return JSON.stringify({
+        jsonrpc: "2.0",
+        id,
+        method: "tools/call",
+        params: { name: tool, arguments: args },
+    });
+}
+describe("Streamable-HTTP concurrent request/response correlation", () => {
+    it("N concurrent tools/call on ONE session — each response arrives on its own request's stream with matching id AND payload", async () => {
+        await withToolServer(async ({ mcpUrl, headers }) => {
+            // Inverted delays: the FIRST request finishes LAST, forcing fully
+            // out-of-order completion across the shared transport.
+            const delays = [250, 200, 150, 100, 0];
+            const results = await Promise.all(delays.map((delay_ms, i) => fetch(mcpUrl, {
+                method: "POST",
+                headers,
+                body: callBody(10 + i, "echo", { marker: `m${i}`, delay_ms }),
+            }).then(async (res) => ({
+                i,
+                status: res.status,
+                text: await res.text(),
+            }))));
+            for (const { i, status, text } of results) {
+                expect(status).toBe(200);
+                const msg = parseSse(text);
+                // The JSON-RPC id must match the request THIS stream carried…
+                expect(msg.id).toBe(10 + i);
+                // …and the payload must come from THIS request's handler invocation.
+                const payload = JSON.parse(msg.result.content[0].text);
+                expect(payload.tool).toBe("echo");
+                expect(payload.marker).toBe(`m${i}`);
+            }
+        });
+    });
+    it("reusing an IN-FLIGHT JSON-RPC id on the same session is rejected with 400 — never cross-delivered", async () => {
+        await withToolServer(async ({ mcpUrl, headers, gate }) => {
+            // First call blocks server-side; fetch resolves once SSE headers arrive,
+            // which happens strictly AFTER the SDK registered id→stream — so the
+            // collision below is deterministic, no sleeps needed.
+            const firstRes = await fetch(mcpUrl, {
+                method: "POST",
+                headers,
+                body: callBody(7, "slow_tool", { marker: "original" }),
+            });
+            expect(firstRes.status).toBe(200);
+            const firstTextP = firstRes.text();
+            // A second POST reusing the in-flight id — the retry-after-reconnect
+            // shape from the 2026-07-18 incident. Must be rejected loudly, not
+            // spliced into the first request's correlation slot.
+            const second = await fetch(mcpUrl, {
+                method: "POST",
+                headers,
+                body: callBody(7, "fast_tool", { marker: "retry" }),
+            });
+            expect(second.status).toBe(400);
+            const err = (await second.json());
+            expect(err.error.message).toContain("already in flight");
+            // The original request still completes normally with ITS OWN payload.
+            gate.resolve();
+            const msg = parseSse(await firstTextP);
+            expect(msg.id).toBe(7);
+            const payload = JSON.parse(msg.result.content[0].text);
+            expect(payload.tool).toBe("slow_tool");
+            expect(payload.marker).toBe("original");
+        });
+    });
+    it("reusing an id AFTER its request completed is allowed (mapping is cleaned on completion)", async () => {
+        // Deliberate minimal guard: only the dangerous in-flight subset is
+        // rejected, so clients that reset id counters between turns keep working.
+        await withToolServer(async ({ mcpUrl, headers }) => {
+            for (const marker of ["first", "second"]) {
+                const res = await fetch(mcpUrl, {
+                    method: "POST",
+                    headers,
+                    body: callBody(42, "fast_tool", { marker }),
+                });
+                expect(res.status).toBe(200);
+                const msg = parseSse(await res.text());
+                expect(msg.id).toBe(42);
+                expect(JSON.parse(msg.result.content[0].text).marker).toBe(marker);
+            }
+        });
+    });
+    it("duplicate ids WITHIN one batch POST are rejected with 400", async () => {
+        await withToolServer(async ({ mcpUrl, headers }) => {
+            const res = await fetch(mcpUrl, {
+                method: "POST",
+                headers,
+                body: JSON.stringify([
+                    {
+                        jsonrpc: "2.0",
+                        id: 9,
+                        method: "tools/call",
+                        params: { name: "fast_tool", arguments: { marker: "a" } },
+                    },
+                    {
+                        jsonrpc: "2.0",
+                        id: 9,
+                        method: "tools/call",
+                        params: { name: "fast_tool", arguments: { marker: "b" } },
+                    },
+                ]),
+            });
+            expect(res.status).toBe(400);
+            const err = (await res.json());
+            expect(err.error.message).toContain("already in flight");
+        });
+    });
+});
+//# sourceMappingURL=http-concurrency.test.js.map

package/dist/__tests__/http-concurrency.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-concurrency.test.js","sourceRoot":"","sources":["../../src/__tests__/http-concurrency.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAG9C,SAAS,QAAQ;IACf,IAAI,OAAoB,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AASpE;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAAC,GAAgC;IAC5D,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IAClD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,2CAA2C,CAAC,CAAC;IAC7E,MAAM,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,GACrD,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAC;IACrD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAE9D,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;IACzB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3B,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnD,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,aAAa;YACxB,KAAK,EAAE,OAAO;YACd,SAAS,EAAE,UAAU;YACrB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;SAC1C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,UAAU,GAAI,YAAY,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAErE,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IAExB,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,eAAe,CAAC;QACtD,IAAI,EAAE,CAAC;QACP,SAAS,EAAE,oBAAoB,UAAU,EAAE;QAC3C,YAAY,EAAE,oBAAoB;QAClC,eAAe,EAAE,KAAK,IAAI,EAAE;YAC1B,MAAM,GAAG,GAAG,IAAI,MAAM,CACpB,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,EACzC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;YACF,GAAG,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBACzD,KAAK,EAAE;oBACL;wBACE,IAAI,EAAE,MAAM;wBACZ,WAAW,EAAE,MAAM;wBACnB,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qBAChC;oBACD;wBACE,IAAI,EAAE,WAAW;wBACjB,WAAW,EAAE,yCAAyC;wBACtD,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qBAChC;oBACD;wBACE,IAAI,EAAE,WAAW;wBACjB,WAAW,EAAE,qBAAqB;wBAClC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qBAChC;iBACF;aACF,CAAC,CAAC,CAAC;YACJ,GAAG,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACzD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC7B,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC;gBACrE,IAAI,IAAI,KAAK,WAAW;oBAAE,MAAM,IAAI,CAAC,OAAO,CAAC;gBAC7C,IAAI,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACzD,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC7B,CAAC;gBACD,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;yBAClE;qBACF;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC,CAAC;IACH,MAAM,OAAO,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAC5D,MAAM,MAAM,GAAG,oBAAoB,OAAO,MAAM,CAAC;IAEjD,MAAM,WAAW,GAAG;QAClB,aAAa,EAAE,0BAA0B;QACzC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,qCAAqC;KAC9C,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;QAClC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,CAAC;YACL,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE;gBACN,eAAe,EAAE,YAAY;gBAC7B,YAAY,EAAE,EAAE;gBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE;aACjD;SACF,CAAC;KACH,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACxD,MAAM,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC;IAC/B,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,kCAAkC;IAExD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC;YACR,MAAM;YACN,OAAO,EAAE,EAAE,GAAG,WAAW,EAAE,gBAAgB,EAAE,SAAU,EAAE;YACzD,IAAI;SACL,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,6CAA6C;QAC7D,aAAa,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,SAAS,QAAQ,CAAC,IAAY;IAI5B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,QAAQ,CACf,EAAU,EACV,IAAY,EACZ,OAAgC,EAAE;IAElC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,KAAK;QACd,EAAE;QACF,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;KACxC,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACvE,EAAE,CAAC,yHAAyH,EAAE,KAAK,IAAI,EAAE;QACvI,MAAM,cAAc,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;YACjD,kEAAkE;YAClE,uDAAuD;YACvD,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,CACzB,KAAK,CAAC,MAAM,EAAE;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC;aAC9D,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBACtB,CAAC;gBACD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE;aACvB,CAAC,CAAC,CACJ,CACF,CAAC;YACF,KAAK,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;gBAC1C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC3B,8DAA8D;gBAC9D,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC5B,qEAAqE;gBACrE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACvD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAClC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mGAAmG,EAAE,KAAK,IAAI,EAAE;QACjH,MAAM,cAAc,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;YACvD,yEAAyE;YACzE,qEAAqE;YACrE,sDAAsD;YACtD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;gBACnC,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;aACvD,CAAC,CAAC;YACH,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEnC,qEAAqE;YACrE,mEAAmE;YACnE,qDAAqD;YACrD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;gBACjC,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAmC,CAAC;YACpE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;YAEzD,sEAAsE;YACtE,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,UAAU,CAAC,CAAC;YACvC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACvC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,mEAAmE;QACnE,0EAA0E;QAC1E,MAAM,cAAc,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;YACjD,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACzC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;oBAC9B,MAAM,EAAE,MAAM;oBACd,OAAO;oBACP,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC;iBAC5C,CAAC,CAAC;gBACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBACvC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,cAAc,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;YACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;gBAC9B,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB;wBACE,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,CAAC;wBACL,MAAM,EAAE,YAAY;wBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;qBAC1D;oBACD;wBACE,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,CAAC;wBACL,MAAM,EAAE,YAAY;wBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;qBAC1D;iBACF,CAAC;aACH,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmC,CAAC;YACjE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/integration/protocol.test.d.ts

@@ -0,0 +1,8 @@
+/**
+ * MCP Protocol Compliance Tests
+ *
+ * Verifies JSON-RPC 2.0 compliance and MCP protocol adherence
+ * for the Dobby MCP server.
+ */
+export {};
+//# sourceMappingURL=protocol.test.d.ts.map

package/dist/__tests__/integration/protocol.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/integration/protocol.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}