@embassys/ambassador 0.0.0 → 0.2.6

package/dist/guided-registration.js

@@ -0,0 +1,117 @@
+import { PRODUCTION_AGENT_CAPABILITIES, resolveAgentCapability, } from "./agent-capabilities.js";
+import { createDeliveryProfile, } from "./delivery-profile.js";
+export class GuidedRegistrationError extends Error {
+    code;
+    constructor(code) {
+        super("Guided registration failed");
+        this.code = code;
+        this.name = "GuidedRegistrationError";
+    }
+}
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
+function invalid() {
+    return new GuidedRegistrationError("invalid_arguments");
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function exactKeys(value, required, optional = []) {
+    const allowed = new Set([...required, ...optional]);
+    return (required.every((key) => Object.hasOwn(value, key)) &&
+        Object.keys(value).every((key) => allowed.has(key)));
+}
+function centralArguments(value) {
+    if (typeof value.email !== "string" || value.email.length > 254 || !EMAIL.test(value.email)) {
+        throw invalid();
+    }
+    if (value.display_name !== undefined &&
+        (typeof value.display_name !== "string" ||
+            value.display_name.length < 1 ||
+            value.display_name.length > 128)) {
+        throw invalid();
+    }
+    return {
+        email: value.email,
+        ...(value.display_name === undefined ? {} : { display_name: value.display_name }),
+    };
+}
+function deliveryInput(value) {
+    if (!isRecord(value) || typeof value.mode !== "string")
+        throw invalid();
+    if (value.mode === "direct" && exactKeys(value, ["mode"]))
+        return { mode: "direct" };
+    if (value.mode === "webhook" &&
+        exactKeys(value, ["mode", "url", "secret_env"]) &&
+        typeof value.url === "string" &&
+        typeof value.secret_env === "string") {
+        return { mode: "webhook", url: value.url, secret_env: value.secret_env };
+    }
+    throw invalid();
+}
+export class GuidedRegistration {
+    #registry;
+    #profileStore;
+    #workingDirectory;
+    #environment;
+    #registerCentral;
+    constructor(options) {
+        this.#registry = options.registry ?? PRODUCTION_AGENT_CAPABILITIES;
+        this.#profileStore = options.profileStore;
+        this.#workingDirectory = options.workingDirectory;
+        this.#environment = options.environment;
+        this.#registerCentral = options.registerCentral;
+    }
+    async register(untrustedArguments, clientInfo, signal) {
+        const resolution = resolveAgentCapability(clientInfo, this.#registry);
+        if (resolution.status === "unsupported") {
+            return {
+                status: "unsupported_agent",
+                message: "This MCP client is not supported by this Ambassador version.",
+            };
+        }
+        if (!isRecord(untrustedArguments) ||
+            !exactKeys(untrustedArguments, ["email"], ["display_name", "delivery"])) {
+            throw invalid();
+        }
+        const registration = centralArguments(untrustedArguments);
+        const capability = resolution.profile;
+        const suppliedDelivery = untrustedArguments.delivery === undefined
+            ? undefined
+            : deliveryInput(untrustedArguments.delivery);
+        let delivery;
+        if (suppliedDelivery === undefined) {
+            if (capability.modes.length !== 1 || capability.modes[0] !== "direct") {
+                return {
+                    status: "input_required",
+                    prompt: "How should incoming requests reach this agent?",
+                    required: ["delivery"],
+                    default: "direct",
+                    choices: [
+                        {
+                            value: "direct",
+                            label: `Send directly to this ${capability.displayName} agent`,
+                        },
+                        { value: "webhook", label: "Send to a webhook" },
+                    ],
+                };
+            }
+            delivery = { mode: "direct" };
+        }
+        else {
+            delivery = suppliedDelivery;
+        }
+        if (!capability.modes.includes(delivery.mode))
+            throw invalid();
+        try {
+            const profile = await createDeliveryProfile(capability, delivery, this.#workingDirectory, this.#environment);
+            await this.#profileStore.save(profile);
+            return await this.#registerCentral(registration, signal);
+        }
+        catch (error) {
+            if (error instanceof GuidedRegistrationError)
+                throw error;
+            throw new GuidedRegistrationError("registration_failed");
+        }
+    }
+}
+//# sourceMappingURL=guided-registration.js.map

package/dist/guided-registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guided-registration.js","sourceRoot":"","sources":["../src/guided-registration.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,qBAAqB,GAGtB,MAAM,uBAAuB,CAAC;AAI/B,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAC3B,IAAI;IAAzB,YAAqB,IAAiC;QACpD,KAAK,CAAC,4BAA4B,CAAC,CAAC;oBADjB,IAAI;QAEvB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAkBD,MAAM,KAAK,GAAG,6BAA6B,CAAC;AAE5C,SAAS,OAAO;IACd,OAAO,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAChB,KAA8B,EAC9B,QAA2B,EAC3B,QAAQ,GAAsB,EAAE;IAEhC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;IACpD,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAA8B;IACtD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5F,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;IACD,IACE,KAAK,CAAC,YAAY,KAAK,SAAS;QAChC,CAAC,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;YACrC,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;YAC7B,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,GAAG,CAAC,EAClC,CAAC;QACD,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAsB,EAAE,CAAC;KAC5F,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,OAAO,EAAE,CAAC;IACxE,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACrF,IACE,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAC7B,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,EACpC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;IAC3E,CAAC;IACD,MAAM,OAAO,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,kBAAkB;IACpB,SAAS,CAA6B;IACtC,aAAa,CAAuB;IACpC,iBAAiB,CAAS;IAC1B,YAAY,CAAoB;IAChC,gBAAgB,CAA+C;IAExE,YAAY,OAAkC;QAC5C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,IAAI,6BAA6B,CAAC;QACnE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QAClD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,kBAA2B,EAC3B,UAAuC,EACvC,MAAmB;QAEnB,MAAM,UAAU,GAAG,sBAAsB,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACxC,OAAO;gBACL,MAAM,EAAE,mBAAmB;gBAC3B,OAAO,EAAE,8DAA8D;aACxE,CAAC;QACJ,CAAC;QACD,IACE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAC7B,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC,EACvE,CAAC;YACD,MAAM,OAAO,EAAE,CAAC;QAClB,CAAC;QACD,MAAM,YAAY,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC;QACtC,MAAM,gBAAgB,GACpB,kBAAkB,CAAC,QAAQ,KAAK,SAAS;YACvC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,aAAa,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAEjD,IAAI,QAAuB,CAAC;QAC5B,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACtE,OAAO;oBACL,MAAM,EAAE,gBAAgB;oBACxB,MAAM,EAAE,gDAAgD;oBACxD,QAAQ,EAAE,CAAC,UAAU,CAAC;oBACtB,OAAO,EAAE,QAAQ;oBACjB,OAAO,EAAE;wBACP;4BACE,KAAK,EAAE,QAAQ;4BACf,KAAK,EAAE,yBAAyB,UAAU,CAAC,WAAW,QAAQ;yBAC/D;wBACD,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE;qBACjD;iBACF,CAAC;YACJ,CAAC;YACD,QAAQ,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,gBAAgB,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,OAAO,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,qBAAqB,CACzC,UAAU,EACV,QAAQ,EACR,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,YAAY,CAClB,CAAC;YACF,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAuB;gBAAE,MAAM,KAAK,CAAC;YAC1D,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF"}

package/dist/identity.d.ts

@@ -0,0 +1,20 @@
+import { type CentralCredentialRecord, type LoadedCentralCredential } from "./central-credential.js";
+import type { CredentialStore } from "./credential-store.js";
+export type { CredentialStore } from "./credential-store.js";
+export declare class IdentityError extends Error {
+    readonly code: "already_enrolled" | "not_enrolled" | "verification_busy";
+    constructor(code: "already_enrolled" | "not_enrolled" | "verification_busy");
+}
+export declare class GatewayIdentity {
+    #private;
+    private readonly store;
+    private readonly nowSeconds;
+    private constructor();
+    static open(store: CredentialStore, nowSeconds?: () => number): Promise<GatewayIdentity>;
+    get enrolled(): boolean;
+    credential(): LoadedCentralCredential;
+    enroll<T>(operation: () => Promise<{
+        readonly credential: CentralCredentialRecord;
+        readonly localResult: T;
+    }>): Promise<T>;
+}

package/dist/identity.js

@@ -0,0 +1,54 @@
+import { parseCentralCredential, serializeCentralCredential, } from "./central-credential.js";
+export class IdentityError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = "IdentityError";
+    }
+}
+export class GatewayIdentity {
+    store;
+    nowSeconds;
+    #credential;
+    #commitBusy = false;
+    constructor(store, nowSeconds, credential) {
+        this.store = store;
+        this.nowSeconds = nowSeconds;
+        this.#credential = credential;
+    }
+    static async open(store, nowSeconds = () => Date.now() / 1_000) {
+        const stored = await store.load();
+        return new GatewayIdentity(store, nowSeconds, stored === undefined ? undefined : parseCentralCredential(stored, nowSeconds));
+    }
+    get enrolled() {
+        return this.#credential !== undefined;
+    }
+    credential() {
+        if (this.#credential === undefined)
+            throw new IdentityError("not_enrolled");
+        if (this.#credential.token.expiresAt <= Math.floor(this.nowSeconds())) {
+            throw new IdentityError("not_enrolled");
+        }
+        return this.#credential;
+    }
+    async enroll(operation) {
+        if (this.#credential !== undefined)
+            throw new IdentityError("already_enrolled");
+        if (this.#commitBusy)
+            throw new IdentityError("verification_busy");
+        this.#commitBusy = true;
+        try {
+            const result = await operation();
+            const serialized = serializeCentralCredential(result.credential);
+            const loaded = parseCentralCredential(serialized, this.nowSeconds);
+            await this.store.save(serialized);
+            this.#credential = loaded;
+            return result.localResult;
+        }
+        finally {
+            this.#commitBusy = false;
+        }
+    }
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AAKjC,MAAM,OAAO,aAAc,SAAQ,KAAK;IACjB,IAAI;IAAzB,YAAqB,IAA+D;QAClF,KAAK,CAAC,IAAI,CAAC,CAAC;oBADO,IAAI;QAEvB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,eAAe;IAKP,KAAK;IACL,UAAU;IAL7B,WAAW,CAAsC;IACjD,WAAW,GAAG,KAAK,CAAC;IAEpB,YACmB,KAAsB,EACtB,UAAwB,EACzC,UAAoC;qBAFnB,KAAK;0BACL,UAAU;QAG3B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;IAChC,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,IAAI,CACf,KAAsB,EACtB,UAAU,GAAiB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;QAEnD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QAClC,OAAO,IAAI,eAAe,CACxB,KAAK,EACL,UAAU,EACV,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,UAAU,CAAC,CAC9E,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC;IACxC,CAAC;IAED,UAAU;QACR,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,MAAM,IAAI,aAAa,CAAC,cAAc,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,aAAa,CAAC,cAAc,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM,CACV,SAGE;QAEF,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,CAAC,CAAC;QAChF,IAAI,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,aAAa,CAAC,mBAAmB,CAAC,CAAC;QACnE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,0BAA0B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,sBAAsB,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACnE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAClC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC;YAC1B,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;CACF"}

package/dist/local-mcp.d.ts

@@ -0,0 +1,28 @@
+import type { CentralToolDefinition } from "./mcp-contract.js";
+export interface LocalMcpRouter {
+    listTools(): Promise<CentralToolDefinition[]>;
+    callTool(name: string, arguments_: Record<string, unknown>, signal: AbortSignal, clientInfo: LocalMcpClientInfo | undefined): Promise<Record<string, unknown>>;
+}
+export interface LocalMcpClientInfo {
+    readonly name: string;
+    readonly version: string;
+}
+export declare class LocalMcpToolError extends Error {
+    readonly code: string;
+    readonly retryAfterMs?: number | null | undefined;
+    constructor(code: string, retryAfterMs?: number | null | undefined);
+    get data(): Record<string, unknown>;
+}
+export interface LocalMcpServerOptions {
+    port?: number;
+    requestTimeoutMs?: number;
+}
+export declare class LocalMcpServer {
+    #private;
+    private readonly router;
+    constructor(localToken: string, router: LocalMcpRouter, options?: LocalMcpServerOptions);
+    get endpoint(): string;
+    listen(): Promise<void>;
+    sendToolListChanged(): Promise<void>;
+    close(): Promise<void>;
+}

package/dist/local-mcp.js

@@ -0,0 +1,420 @@
+import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
+import { once } from "node:events";
+import { createServer as createHttpServer, } from "node:http";
+import { toWebRequest } from "@modelcontextprotocol/node";
+import { ProtocolError, Server, WebStandardStreamableHTTPServerTransport, } from "@modelcontextprotocol/server";
+import { serializeLocalToolResult } from "./local-tool-result.js";
+const MAX_REQUEST_BYTES = 1024 * 1024;
+const MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+const MAX_HEADERS_BYTES = 16 * 1024;
+const MAX_SESSIONS = 32;
+const MAX_CONCURRENT_TOOL_CALLS = 8;
+const LOCAL_REQUEST_TIMEOUT_MS = 35_000;
+const PROTOCOL_VERSION = "2025-06-18";
+export class LocalMcpToolError extends Error {
+    code;
+    retryAfterMs;
+    constructor(code, retryAfterMs) {
+        super("Tool call failed");
+        this.code = code;
+        this.retryAfterMs = retryAfterMs;
+        this.name = "LocalMcpToolError";
+    }
+    get data() {
+        return {
+            code: this.code,
+            ...(this.retryAfterMs === undefined ? {} : { retry_after_ms: this.retryAfterMs }),
+        };
+    }
+}
+class RequestBodyTooLarge extends Error {
+}
+class ResponseBodyTooLarge extends Error {
+}
+function safeHttpError(response, status) {
+    if (!response.headersSent) {
+        response.writeHead(status, {
+            "cache-control": "no-store",
+            "content-type": "text/plain; charset=utf-8",
+        });
+    }
+    response.end("Request rejected\n");
+}
+function authenticate(value, expectedDigest) {
+    const actualDigest = createHash("sha256")
+        .update(value ?? "", "utf8")
+        .digest();
+    return timingSafeEqual(actualDigest, expectedDigest);
+}
+function readJsonBody(request) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        let settled = false;
+        request.on("data", (chunk) => {
+            if (settled)
+                return;
+            const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            size += bytes.byteLength;
+            if (size > MAX_REQUEST_BYTES) {
+                settled = true;
+                request.pause();
+                reject(new RequestBodyTooLarge());
+                return;
+            }
+            chunks.push(bytes);
+        });
+        request.once("end", () => {
+            if (settled)
+                return;
+            settled = true;
+            try {
+                resolve(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+            }
+            catch {
+                reject(new Error("Invalid request body"));
+            }
+        });
+        request.once("aborted", () => {
+            if (settled)
+                return;
+            settled = true;
+            reject(new Error("Request aborted"));
+        });
+        request.once("error", () => {
+            if (settled)
+                return;
+            settled = true;
+            reject(new Error("Request failed"));
+        });
+    });
+}
+function isObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isInitializeRequest(value) {
+    return isObject(value) && value.method === "initialize";
+}
+function sessionId(request) {
+    const value = request.headers["mcp-session-id"];
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function responseHeaders(response) {
+    return Object.fromEntries(response.headers.entries());
+}
+async function readBoundedResponse(response) {
+    const declared = response.headers.get("content-length");
+    if (declared !== null && /^\d+$/u.test(declared) && Number(declared) > MAX_RESPONSE_BYTES) {
+        await response.body?.cancel().catch(() => undefined);
+        throw new ResponseBodyTooLarge();
+    }
+    if (response.body === null)
+        return new Uint8Array();
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        while (true) {
+            const item = await reader.read();
+            if (item.done)
+                break;
+            total += item.value.byteLength;
+            if (total > MAX_RESPONSE_BYTES) {
+                await reader.cancel().catch(() => undefined);
+                throw new ResponseBodyTooLarge();
+            }
+            chunks.push(item.value);
+        }
+    }
+    catch (error) {
+        if (error instanceof ResponseBodyTooLarge)
+            throw error;
+        throw new Error("MCP response failed");
+    }
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return bytes;
+}
+async function writeWebResponse(request, response, webResponse) {
+    if (request.method !== "GET") {
+        const bytes = await readBoundedResponse(webResponse);
+        response.writeHead(webResponse.status, responseHeaders(webResponse));
+        response.end(bytes);
+        return;
+    }
+    response.writeHead(webResponse.status, responseHeaders(webResponse));
+    if (webResponse.body === null) {
+        response.end();
+        return;
+    }
+    const reader = webResponse.body.getReader();
+    let total = 0;
+    const cancel = () => {
+        void reader.cancel().catch(() => undefined);
+    };
+    response.once("close", cancel);
+    try {
+        while (!response.destroyed) {
+            const item = await reader.read();
+            if (item.done)
+                break;
+            total += item.value.byteLength;
+            if (total > MAX_RESPONSE_BYTES) {
+                await reader.cancel().catch(() => undefined);
+                break;
+            }
+            if (!response.write(item.value))
+                await once(response, "drain");
+        }
+    }
+    finally {
+        response.off("close", cancel);
+        if (!response.destroyed)
+            response.end();
+    }
+}
+export class LocalMcpServer {
+    router;
+    #http;
+    #expectedAuthorizationDigest;
+    #requestTimeoutMs;
+    #port;
+    #sessions = new Map();
+    #sessionRecords = new Set();
+    #activeToolCalls = 0;
+    #accepting = false;
+    #endpoint;
+    constructor(localToken, router, options = {}) {
+        this.router = router;
+        this.#port = options.port ?? 8787;
+        this.#requestTimeoutMs = options.requestTimeoutMs ?? LOCAL_REQUEST_TIMEOUT_MS;
+        if (!Number.isInteger(this.#port) || this.#port < 0 || this.#port > 65_535) {
+            throw new Error("Invalid MCP listener port");
+        }
+        if (!Number.isFinite(this.#requestTimeoutMs) || this.#requestTimeoutMs <= 0) {
+            throw new Error("Invalid MCP request timeout");
+        }
+        this.#expectedAuthorizationDigest = createHash("sha256")
+            .update(`Bearer ${localToken}`, "utf8")
+            .digest();
+        this.#http = createHttpServer({ maxHeaderSize: MAX_HEADERS_BYTES, requestTimeout: this.#requestTimeoutMs }, (request, response) => {
+            void this.#handleRequest(request, response);
+        });
+    }
+    get endpoint() {
+        if (this.#endpoint === undefined)
+            throw new Error("MCP listener is not bound");
+        return this.#endpoint;
+    }
+    async listen() {
+        if (this.#accepting || this.#endpoint !== undefined) {
+            throw new Error("MCP listener is already bound");
+        }
+        await new Promise((resolve, reject) => {
+            const onError = () => reject(new Error("MCP listener failed to bind"));
+            this.#http.once("error", onError);
+            this.#http.listen(this.#port, "127.0.0.1", () => {
+                this.#http.off("error", onError);
+                resolve();
+            });
+        });
+        const address = this.#http.address();
+        this.#endpoint = `http://127.0.0.1:${address.port}/mcp`;
+        this.#accepting = true;
+    }
+    async sendToolListChanged() {
+        await Promise.all([...this.#sessionRecords].map((record) => record.sdk.sendToolListChanged()));
+    }
+    async close() {
+        this.#accepting = false;
+        const closed = new Promise((resolve) => {
+            if (!this.#http.listening) {
+                resolve();
+                return;
+            }
+            this.#http.close(() => resolve());
+        });
+        await Promise.all([...this.#sessionRecords].map((record) => this.#closeSession(record)));
+        this.#http.closeAllConnections();
+        await closed;
+    }
+    #createSdk() {
+        const sdk = new Server({ name: "ambassador", version: "1" }, {
+            capabilities: { tools: { listChanged: true } },
+            supportedProtocolVersions: [PROTOCOL_VERSION],
+            debouncedNotificationMethods: ["notifications/tools/list_changed"],
+        });
+        sdk.onerror = () => undefined;
+        sdk.setRequestHandler("tools/list", async () => {
+            const tools = await this.router.listTools();
+            return { tools: tools };
+        });
+        sdk.setRequestHandler("tools/call", async (request, context) => {
+            if (this.#activeToolCalls >= MAX_CONCURRENT_TOOL_CALLS) {
+                throw new Error("Tool call capacity reached");
+            }
+            const arguments_ = request.params.arguments;
+            if (arguments_ !== undefined && !isObject(arguments_)) {
+                throw new Error("Invalid tool arguments");
+            }
+            this.#activeToolCalls += 1;
+            try {
+                const signal = AbortSignal.any([
+                    context.mcpReq.signal,
+                    AbortSignal.timeout(this.#requestTimeoutMs),
+                ]);
+                const version = sdk.getClientVersion();
+                const clientInfo = version !== undefined &&
+                    typeof version.name === "string" &&
+                    typeof version.version === "string"
+                    ? { name: version.name, version: version.version }
+                    : undefined;
+                const result = await this.router.callTool(request.params.name, arguments_ ?? {}, signal, clientInfo);
+                const serialized = serializeLocalToolResult(result);
+                return sdk.projectCallToolResult({
+                    content: [{ type: "text", text: serialized }],
+                    structuredContent: result,
+                }, undefined);
+            }
+            catch (error) {
+                if (error instanceof LocalMcpToolError) {
+                    throw new ProtocolError(-32_002, "Tool call failed", error.data);
+                }
+                throw new Error("Tool call failed");
+            }
+            finally {
+                this.#activeToolCalls -= 1;
+            }
+        });
+        return sdk;
+    }
+    async #createSession() {
+        if (this.#sessionRecords.size >= MAX_SESSIONS) {
+            throw new Error("MCP session capacity reached");
+        }
+        const sdk = this.#createSdk();
+        let record;
+        const transport = new WebStandardStreamableHTTPServerTransport({
+            sessionIdGenerator: randomUUID,
+            keepAliveMs: 15_000,
+            onsessioninitialized: (id) => {
+                if (this.#sessions.has(id))
+                    throw new Error("Duplicate MCP session");
+                record.id = id;
+                this.#sessions.set(id, record);
+            },
+            onsessionclosed: (id) => {
+                this.#sessions.delete(id);
+                void this.#closeSession(record);
+            },
+        });
+        record = { sdk, transport, closing: false };
+        this.#sessionRecords.add(record);
+        try {
+            await sdk.connect(transport);
+            return record;
+        }
+        catch (error) {
+            this.#sessionRecords.delete(record);
+            await sdk.close().catch(() => undefined);
+            throw error;
+        }
+    }
+    async #closeSession(record) {
+        if (record.closing)
+            return;
+        record.closing = true;
+        if (record.id !== undefined)
+            this.#sessions.delete(record.id);
+        this.#sessionRecords.delete(record);
+        await record.sdk.close().catch(() => undefined);
+    }
+    async #handleRequest(request, response) {
+        if (!this.#accepting) {
+            safeHttpError(response, 503);
+            return;
+        }
+        if (request.url !== "/mcp") {
+            safeHttpError(response, 404);
+            return;
+        }
+        const address = this.#http.address();
+        if (request.headers.host !== `127.0.0.1:${address.port}`) {
+            safeHttpError(response, 421);
+            return;
+        }
+        const origin = request.headers.origin;
+        if (origin !== undefined && origin !== `http://127.0.0.1:${address.port}`) {
+            safeHttpError(response, 403);
+            return;
+        }
+        if (!authenticate(request.headers.authorization, this.#expectedAuthorizationDigest)) {
+            safeHttpError(response, 401);
+            return;
+        }
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.#requestTimeoutMs);
+        const onResponseClose = () => {
+            if (!response.writableEnded)
+                controller.abort();
+        };
+        response.once("close", onResponseClose);
+        let record;
+        let transientSession = false;
+        try {
+            const parsedBody = request.method === "POST" ? await readJsonBody(request) : undefined;
+            if (Array.isArray(parsedBody)) {
+                safeHttpError(response, 400);
+                return;
+            }
+            const id = sessionId(request);
+            if (id === undefined) {
+                if (request.method !== "POST" || !isInitializeRequest(parsedBody)) {
+                    safeHttpError(response, 400);
+                    return;
+                }
+                try {
+                    record = await this.#createSession();
+                    transientSession = true;
+                }
+                catch {
+                    safeHttpError(response, 503);
+                    return;
+                }
+            }
+            else {
+                record = this.#sessions.get(id);
+                if (record === undefined) {
+                    safeHttpError(response, 404);
+                    return;
+                }
+            }
+            const webRequest = await toWebRequest(request, parsedBody, { signal: controller.signal });
+            const webResponse = await record.transport.handleRequest(webRequest, { parsedBody });
+            await writeWebResponse(request, response, webResponse);
+            if (transientSession && record.id === undefined)
+                await this.#closeSession(record);
+        }
+        catch (error) {
+            if (transientSession && record !== undefined && record.id === undefined) {
+                await this.#closeSession(record);
+            }
+            if (error instanceof RequestBodyTooLarge) {
+                request.resume();
+                safeHttpError(response, 413);
+                return;
+            }
+            if (!response.headersSent)
+                safeHttpError(response, 400);
+        }
+        finally {
+            clearTimeout(timeout);
+            response.off("close", onResponseClose);
+        }
+    }
+}
+//# sourceMappingURL=local-mcp.js.map