@everfur/cli 0.1.0 → 0.2.1

package/dist/chunk-FC23PLWG.js

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+import { buildServer } from './chunk-XMIERMOW.js';
+import { createServer } from 'http';
+import { timingSafeEqual } from 'crypto';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+
+var DEFAULT_HOST = "127.0.0.1";
+var DEFAULT_PORT = 3100;
+var DEFAULT_PATH = "/mcp";
+var MIN_ACCESS_TOKEN_LENGTH = 32;
+function requireValue(env, name) {
+  const value = env[name]?.trim();
+  if (!value) throw new Error(`${name} is required to run the HTTP MCP server.`);
+  return value;
+}
+function parsePort(raw) {
+  if (raw === void 0 || raw.trim() === "") return DEFAULT_PORT;
+  if (!/^\d+$/.test(raw)) throw new Error("EVERFUR_MCP_HTTP_PORT must be an integer between 0 and 65535.");
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || value < 0 || value > 65535) {
+    throw new Error("EVERFUR_MCP_HTTP_PORT must be an integer between 0 and 65535.");
+  }
+  return value;
+}
+function parsePath(raw) {
+  if (raw === void 0 || raw.trim() === "") return DEFAULT_PATH;
+  const path = raw.trim();
+  if (!path.startsWith("/") || path.includes("?") || path.includes("#")) {
+    throw new Error("EVERFUR_MCP_HTTP_PATH must be an absolute path with no query or fragment.");
+  }
+  return path;
+}
+function isLoopbackHost(host) {
+  const normalized = host.toLowerCase();
+  return normalized === "127.0.0.1" || normalized === "localhost" || normalized === "::1" || normalized === "[::1]";
+}
+function parseCsv(raw, variable) {
+  if (raw === void 0 || raw.trim() === "") return /* @__PURE__ */ new Set();
+  const values = raw.split(",").map((value) => value.trim()).filter(Boolean);
+  if (values.length === 0) throw new Error(`${variable} must contain at least one value when set.`);
+  return new Set(values);
+}
+function hostnameOf(header) {
+  if (!header) return null;
+  try {
+    return new URL(`http://${header}`).hostname.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function safeEquals(presented, expected) {
+  const actual = Buffer.from(presented);
+  const required = Buffer.from(expected);
+  return actual.length === required.length && timingSafeEqual(actual, required);
+}
+function writeJson(res, status, body, headers = {}) {
+  if (res.headersSent) return;
+  res.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store", ...headers });
+  res.end(JSON.stringify(body));
+}
+async function serveStatelessMcp(req, res, mcp, parsedBody) {
+  const transport = new StreamableHTTPServerTransport({
+    enableJsonResponse: true
+  });
+  try {
+    await mcp.connect(transport);
+    await transport.handleRequest(req, res, parsedBody);
+  } catch {
+    if (!res.headersSent) {
+      writeJson(res, 500, { error: "MCP request failed." });
+    }
+  } finally {
+    await transport.close();
+    await mcp.close();
+  }
+}
+function loadRemoteMcpConfig(env) {
+  const host = env["EVERFUR_MCP_HTTP_HOST"]?.trim() || DEFAULT_HOST;
+  const accessToken = requireValue(env, "EVERFUR_MCP_HTTP_ACCESS_TOKEN");
+  if (accessToken.length < MIN_ACCESS_TOKEN_LENGTH) {
+    throw new Error(`EVERFUR_MCP_HTTP_ACCESS_TOKEN must be at least ${MIN_ACCESS_TOKEN_LENGTH} characters.`);
+  }
+  const configuredHosts = parseCsv(env["EVERFUR_MCP_HTTP_ALLOWED_HOSTS"], "EVERFUR_MCP_HTTP_ALLOWED_HOSTS");
+  if (!isLoopbackHost(host) && configuredHosts.size === 0) {
+    throw new Error("EVERFUR_MCP_HTTP_ALLOWED_HOSTS is required when EVERFUR_MCP_HTTP_HOST is not loopback.");
+  }
+  const allowedHosts = configuredHosts.size > 0 ? configuredHosts : /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+  return {
+    env,
+    host,
+    port: parsePort(env["EVERFUR_MCP_HTTP_PORT"]),
+    path: parsePath(env["EVERFUR_MCP_HTTP_PATH"]),
+    accessToken,
+    allowedHosts: new Set([...allowedHosts].map((value) => value.toLowerCase())),
+    allowedOrigins: /* @__PURE__ */ new Set([...parseCsv(env["EVERFUR_MCP_HTTP_ALLOWED_ORIGINS"], "EVERFUR_MCP_HTTP_ALLOWED_ORIGINS")])
+  };
+}
+function requestIsAllowed(req, config) {
+  const requestUrl = new URL(req.url ?? "/", "http://mcp.invalid");
+  if (requestUrl.pathname !== config.path) {
+    return { ok: false, status: 404, message: "Not found." };
+  }
+  if (req.method !== "POST") {
+    return { ok: false, status: 405, message: "Method not allowed.", headers: { allow: "POST" } };
+  }
+  const host = hostnameOf(req.headers.host);
+  if (host === null || !config.allowedHosts.has(host)) {
+    return { ok: false, status: 421, message: "Host is not allowed." };
+  }
+  const origin = req.headers.origin;
+  if (origin !== void 0 && !config.allowedOrigins.has(origin)) {
+    return { ok: false, status: 403, message: "Origin is not allowed." };
+  }
+  const authorization = req.headers.authorization;
+  const token = authorization?.match(/^Bearer ([^\s]+)$/i)?.[1];
+  if (token === void 0 || !safeEquals(token, config.accessToken)) {
+    return { ok: false, status: 401, message: "Authentication required." };
+  }
+  return { ok: true };
+}
+function createRemoteMcpRequestListener(config) {
+  return async (req, res) => {
+    const allowed = requestIsAllowed(req, config);
+    if (allowed.ok === false) {
+      if (allowed.status === 401) res.setHeader("www-authenticate", "Bearer");
+      writeJson(res, allowed.status, { error: allowed.message }, allowed.headers ?? {});
+      return;
+    }
+    await serveStatelessMcp(req, res, buildServer({ env: config.env }));
+  };
+}
+function listen(server, port, host) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(port, host, () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+}
+function close(server) {
+  return new Promise((resolve, reject) => {
+    server.close((error) => error ? reject(error) : resolve());
+  });
+}
+async function startRemoteMcpServer(config) {
+  const server = createServer(createRemoteMcpRequestListener(config));
+  await listen(server, config.port, config.host);
+  const address = server.address();
+  if (address === null || typeof address === "string") {
+    await close(server);
+    throw new Error("The HTTP MCP server did not bind a TCP address.");
+  }
+  const hostname = address.family === "IPv6" ? `[${address.address}]` : address.address;
+  return {
+    url: new URL(`http://${hostname}:${address.port}${config.path}`),
+    close: () => close(server)
+  };
+}
+
+export { close, hostnameOf, listen, loadRemoteMcpConfig, serveStatelessMcp, startRemoteMcpServer, writeJson };