@hydradb/mcp 1.2.1 → 1.3.0

package/dist/http-config.d.ts

@@ -0,0 +1,190 @@
+/**
+ * Configuration for the remotely hostable HTTP transport.
+ *
+ * There are two configurations here, and they belong to two different people.
+ *
+ *   - {@link resolveHttpServerConfig} is the OPERATOR's config: the port, the
+ *     bind address, and the Host/Origin allowlists that decide who may reach the
+ *     process at all. It is read once at startup from the environment.
+ *
+ *   - {@link resolveRequestCredentials} is the CALLER's config: which Hydra DB
+ *     account, database and collection a single request runs against. On a
+ *     multi-tenant deployment (one process serving `mcp.hydradb.com` for many
+ *     users) this MUST come per request, from headers, because the process has
+ *     no single tenant of its own. It is resolved fresh on every `/mcp` call.
+ *
+ * The stdio server ({@link file://./index.ts}) has only the second concern and
+ * reads it from the environment via {@link file://./config.ts}; a hosted server
+ * cannot, because one env-configured key would make every user share one
+ * account. So the header path is the substantive new surface, and it falls back
+ * to the environment only to keep the single-tenant self-hosting story (set the
+ * env, expose the port, done) working unchanged.
+ */
+import type { OAuthConfig } from "./oauth.js";
+import { type EnvSource, type GraphConfig } from "./config.js";
+export interface HttpServerConfig {
+    /** TCP port to listen on. */
+    port: number;
+    /**
+     * Interface to bind. Defaults to loopback so an unconfigured server is not
+     * reachable off-box; a hosted deployment sets `0.0.0.0` deliberately.
+     */
+    bindAddress: string;
+    /** CORS allowlist. Empty means no cross-origin browser request is accepted. */
+    allowedOrigins: string[];
+    /** Accepted `Host` headers, lowercased. Loopback + the configured port always. */
+    allowedHosts: Set<string>;
+    /**
+     * Express's `trust proxy` setting. `false` (the default) trusts no
+     * `X-Forwarded-*`, so a direct client cannot spoof its address in the logs;
+     * a deployment behind a known proxy sets `TRUST_PROXY` to a hop count or a
+     * subnet preset so the real client IP is recovered without trusting all hops.
+     */
+    trustProxy: boolean | number | string;
+    /**
+     * OAuth resource-server settings, or absent when OAuth is off. Resolved
+     * from the environment by {@link resolveHttpServerConfig}; tests pass it
+     * directly.
+     */
+    oauth?: OAuthConfig | null;
+}
+export declare const DEFAULT_PORT = 8080;
+export declare const DEFAULT_BIND_ADDRESS = "127.0.0.1";
+/** Split a comma-separated env var into trimmed, non-empty entries. */
+export declare function parseList(value: string | undefined): string[];
+/**
+ * A port, or the default when the value is absent or not a usable port.
+ *
+ * A typo'd `PORT` should not crash startup with a stack trace; it should fall
+ * back and let the startup banner show what it actually bound. Ports outside
+ * 1-65535 fall back for the same reason `parseInt("8080abc")` must not become
+ * `8080` silently — `Number` rejects the trailing garbage that `parseInt` keeps.
+ */
+export declare function parsePort(raw: string | undefined, fallback?: number): number;
+/**
+ * The set of `Host` headers this server answers to.
+ *
+ * Loopback names on the bound port are always included so a local run works with
+ * no configuration. A hosted deployment adds its public hostname(s) via
+ * `ALLOWED_HOSTS`. The bare (portless) loopback names cover clients that omit
+ * the port on the default HTTP/HTTPS port.
+ */
+export declare function buildAllowedHosts(port: number, extra: string[]): Set<string>;
+/**
+ * Interpret `TRUST_PROXY` for Express's `trust proxy` setting.
+ *
+ * Absent → `false` (trust nothing, the safe default). `true`/`false` → boolean.
+ * An integer → that many hops. Anything else is passed through as an Express
+ * preset or subnet list (e.g. `loopback`, `10.0.0.0/8`), so an operator can name
+ * exactly their proxy without this needing to know the syntax.
+ */
+export declare function parseTrustProxy(raw: string | undefined): boolean | number | string;
+export declare function resolveHttpServerConfig(env?: EnvSource): HttpServerConfig;
+/**
+ * Header names a caller uses to select and authenticate against their tenant.
+ *
+ * Lowercased because Node lowercases incoming header names, and every lookup
+ * here goes through {@link headerValue} which reads them off `req.headers`.
+ *
+ * The API key is read from the standard `Authorization: Bearer <key>` first;
+ * `X-HydraDB-Api-Key` exists only for clients whose MCP config cannot set an
+ * `Authorization` header. Everything else — which database, which collection —
+ * has no standard header, so it takes an `X-HydraDB-*` one.
+ */
+export declare const HEADER_AUTHORIZATION = "authorization";
+export declare const HEADER_API_KEY = "x-hydradb-api-key";
+export declare const HEADER_DATABASE = "x-hydradb-database";
+export declare const HEADER_COLLECTION = "x-hydradb-collection";
+export declare const HEADER_GRAPH_DATABASE = "x-hydradb-graph-database";
+export declare const HEADER_GRAPH_COLLECTION = "x-hydradb-graph-collection";
+/** The request headers this resolver reads. Matches Node's `IncomingHttpHeaders`. */
+export type RequestHeaders = Record<string, string | string[] | undefined>;
+/**
+ * Everything needed to construct a scoped {@link HydraDB} for one request.
+ *
+ * `baseUrl`, `timeoutSeconds` and `maxRetries` are deliberately absent from the
+ * header surface: they are OPERATOR knobs read from the environment, not caller
+ * ones. Letting a caller set `baseUrl` per request would point this server's
+ * outbound calls at a host of the caller's choosing, which is a request-forgery
+ * primitive the tenant selection has no reason to hand out.
+ */
+export interface RequestCredentials {
+    apiKey: string;
+    database: string;
+    collection: string;
+    /** Databases a per-call override may name; absent means any. */
+    allowedDatabases?: string[];
+    /** Collections a per-call override may name; absent means any. */
+    allowedCollections?: string[];
+    baseUrl?: string;
+    timeoutSeconds?: number;
+    maxRetries?: number;
+    graph: GraphConfig;
+}
+/**
+ * Resolution is either credentials or the exact HTTP failure to return.
+ *
+ * The status and message are carried out rather than thrown so the caller can
+ * answer with a JSON-RPC error body at the right code — 401 when nothing
+ * authenticated the request, 400 when it authenticated but named no database —
+ * instead of a generic 500 that tells the client nothing about what to fix.
+ */
+export type CredentialResolution = {
+    ok: true;
+    credentials: RequestCredentials;
+} | {
+    ok: false;
+    status: number;
+    message: string;
+};
+/**
+ * Turn one request's headers (falling back to the environment) into the tenant
+ * credentials for that request.
+ *
+ * The API key and the database resolve TOGETHER, not field-by-field, which is
+ * the security-relevant part:
+ *   - When the key comes from a request header, the request is
+ *     "caller-authenticated" and its database MUST also come from a header. The
+ *     env is NOT consulted for the database, so a caller who sends their own key
+ *     but omits `X-HydraDB-Database` is refused (400) rather than silently run
+ *     against the operator's env database. Likewise the graph scope defaults to
+ *     the request's own database, never the operator's `HYDRADB_GRAPH_DATABASE`.
+ *   - When there is no key header, the request is unauthenticated and falls back
+ *     entirely to the operator's env credentials — the single-tenant self-host
+ *     case, identical to the stdio server. A hosted, multi-tenant process sets
+ *     no tenant env, so such a request is refused (401).
+ *
+ * Resolving field-by-field instead would let a caller's key pair with the
+ * operator's database (or graph namespace), mixing two identities into one
+ * request. `baseUrl`/`timeoutSeconds`/`maxRetries` are read from the environment
+ * only — they are the operator's, not the caller's (see {@link RequestCredentials}).
+ */
+/**
+ * An identity established BEFORE the headers are read: what an OAuth access
+ * token was found to stand for.
+ *
+ * It is passed in rather than resolved here because obtaining it is an
+ * asynchronous call to the authorization server, and this resolver is
+ * deliberately synchronous and pure. When present it replaces the header
+ * credentials entirely: the user approved this exact scope on the consent
+ * screen, and nothing in the request may widen it.
+ */
+export interface ResolvedIdentity {
+    apiKey: string;
+    database?: string;
+    collection?: string;
+    /** See IntrospectedToken.allowedDatabases. */
+    allowedDatabases?: string[];
+    /** See IntrospectedToken.allowedCollections. */
+    allowedCollections?: string[];
+}
+export declare function resolveRequestCredentials(headers: RequestHeaders, env?: EnvSource, identity?: ResolvedIdentity): CredentialResolution;
+/** A JSON-RPC error body, so every HTTP failure speaks the protocol's dialect. */
+export declare function jsonRpcError(code: number, message: string): {
+    jsonrpc: "2.0";
+    error: {
+        code: number;
+        message: string;
+    };
+    id: null;
+};

package/dist/http-config.js

@@ -0,0 +1,253 @@
+/**
+ * Configuration for the remotely hostable HTTP transport.
+ *
+ * There are two configurations here, and they belong to two different people.
+ *
+ *   - {@link resolveHttpServerConfig} is the OPERATOR's config: the port, the
+ *     bind address, and the Host/Origin allowlists that decide who may reach the
+ *     process at all. It is read once at startup from the environment.
+ *
+ *   - {@link resolveRequestCredentials} is the CALLER's config: which Hydra DB
+ *     account, database and collection a single request runs against. On a
+ *     multi-tenant deployment (one process serving `mcp.hydradb.com` for many
+ *     users) this MUST come per request, from headers, because the process has
+ *     no single tenant of its own. It is resolved fresh on every `/mcp` call.
+ *
+ * The stdio server ({@link file://./index.ts}) has only the second concern and
+ * reads it from the environment via {@link file://./config.ts}; a hosted server
+ * cannot, because one env-configured key would make every user share one
+ * account. So the header path is the substantive new surface, and it falls back
+ * to the environment only to keep the single-tenant self-hosting story (set the
+ * env, expose the port, done) working unchanged.
+ */
+import { resolveOAuthConfig } from "./oauth.js";
+import { DEFAULT_COLLECTION, nonNegativeInt, positiveInt, readEnv, resolveGraphConfig, } from "./config.js";
+export const DEFAULT_PORT = 8080;
+export const DEFAULT_BIND_ADDRESS = "127.0.0.1";
+/** Split a comma-separated env var into trimmed, non-empty entries. */
+export function parseList(value) {
+    if (!value)
+        return [];
+    return value
+        .split(",")
+        .map((v) => v.trim())
+        .filter((v) => v.length > 0);
+}
+/**
+ * A port, or the default when the value is absent or not a usable port.
+ *
+ * A typo'd `PORT` should not crash startup with a stack trace; it should fall
+ * back and let the startup banner show what it actually bound. Ports outside
+ * 1-65535 fall back for the same reason `parseInt("8080abc")` must not become
+ * `8080` silently — `Number` rejects the trailing garbage that `parseInt` keeps.
+ */
+export function parsePort(raw, fallback = DEFAULT_PORT) {
+    const value = Number(raw);
+    return raw != null && Number.isInteger(value) && value >= 1 && value <= 65535
+        ? value
+        : fallback;
+}
+/**
+ * The set of `Host` headers this server answers to.
+ *
+ * Loopback names on the bound port are always included so a local run works with
+ * no configuration. A hosted deployment adds its public hostname(s) via
+ * `ALLOWED_HOSTS`. The bare (portless) loopback names cover clients that omit
+ * the port on the default HTTP/HTTPS port.
+ */
+export function buildAllowedHosts(port, extra) {
+    return new Set([
+        `localhost:${port}`,
+        `127.0.0.1:${port}`,
+        `[::1]:${port}`,
+        "localhost",
+        "127.0.0.1",
+        "[::1]",
+        ...extra,
+    ].map((h) => h.toLowerCase()));
+}
+/**
+ * Interpret `TRUST_PROXY` for Express's `trust proxy` setting.
+ *
+ * Absent → `false` (trust nothing, the safe default). `true`/`false` → boolean.
+ * An integer → that many hops. Anything else is passed through as an Express
+ * preset or subnet list (e.g. `loopback`, `10.0.0.0/8`), so an operator can name
+ * exactly their proxy without this needing to know the syntax.
+ */
+export function parseTrustProxy(raw) {
+    const value = raw?.trim();
+    if (!value)
+        return false;
+    if (value.toLowerCase() === "true")
+        return true;
+    if (value.toLowerCase() === "false")
+        return false;
+    if (/^\d+$/.test(value))
+        return Number(value);
+    return value;
+}
+export function resolveHttpServerConfig(env = process.env) {
+    const port = parsePort(env.PORT);
+    return {
+        port,
+        bindAddress: env.BIND_ADDRESS?.trim() || DEFAULT_BIND_ADDRESS,
+        allowedOrigins: parseList(env.ALLOWED_ORIGINS),
+        allowedHosts: buildAllowedHosts(port, parseList(env.ALLOWED_HOSTS)),
+        trustProxy: parseTrustProxy(env.TRUST_PROXY),
+        oauth: resolveOAuthConfig(env),
+    };
+}
+// --- Per-request tenant credentials ---
+/**
+ * Header names a caller uses to select and authenticate against their tenant.
+ *
+ * Lowercased because Node lowercases incoming header names, and every lookup
+ * here goes through {@link headerValue} which reads them off `req.headers`.
+ *
+ * The API key is read from the standard `Authorization: Bearer <key>` first;
+ * `X-HydraDB-Api-Key` exists only for clients whose MCP config cannot set an
+ * `Authorization` header. Everything else — which database, which collection —
+ * has no standard header, so it takes an `X-HydraDB-*` one.
+ */
+export const HEADER_AUTHORIZATION = "authorization";
+export const HEADER_API_KEY = "x-hydradb-api-key";
+export const HEADER_DATABASE = "x-hydradb-database";
+export const HEADER_COLLECTION = "x-hydradb-collection";
+export const HEADER_GRAPH_DATABASE = "x-hydradb-graph-database";
+export const HEADER_GRAPH_COLLECTION = "x-hydradb-graph-collection";
+/** One header value, taking the first when a header arrives repeated. */
+function headerValue(headers, name) {
+    const raw = headers[name];
+    const value = Array.isArray(raw) ? raw[0] : raw;
+    const trimmed = value?.trim();
+    return trimmed ? trimmed : undefined;
+}
+/**
+ * The token from an `Authorization` header, accepting `Bearer <token>` or a bare
+ * token. The scheme is matched case-insensitively (RFC 7235 says it is
+ * case-insensitive, and clients send `bearer`, `Bearer` and `BEARER` in the
+ * wild); a bare value is accepted because some MCP hosts drop the scheme.
+ */
+function bearerToken(authorization) {
+    if (!authorization)
+        return undefined;
+    const match = /^\s*Bearer\s+(.+)$/i.exec(authorization);
+    if (match)
+        return match[1].trim() || undefined;
+    return authorization.trim() || undefined;
+}
+export function resolveRequestCredentials(headers, env = process.env, identity) {
+    const headerKey = identity?.apiKey ??
+        bearerToken(headerValue(headers, HEADER_AUTHORIZATION)) ??
+        headerValue(headers, HEADER_API_KEY);
+    // Whether the CALLER authenticated this request with their own key decides
+    // whether the operator's env is allowed to supply the rest of the identity.
+    const callerAuthenticated = headerKey != null;
+    const apiKey = 
+    // The env fallback reuses the exact same canonical/legacy alias rules as
+    // the stdio server, so a self-host configured for stdio needs no new vars.
+    headerKey ?? readEnv(env, "HYDRADB_API_KEY", "HYDRA_DB_API_KEY", noopWarn);
+    if (!apiKey) {
+        return {
+            ok: false,
+            status: 401,
+            message: "Missing Hydra DB credentials. Send `Authorization: Bearer <api-key>` " +
+                "(or the `X-HydraDB-Api-Key` header). Get a key at https://app.hydradb.com.",
+        };
+    }
+    // An OAuth identity is what the user approved on the consent screen. No
+    // request header may alter it: the client holding the token could otherwise
+    // re-scope the connection after consent by adding a header. Per-call tool
+    // arguments remain the sanctioned way to name another database, and those
+    // are checked against the grant's allowed list.
+    const headerDatabase = identity ? identity.database : headerValue(headers, HEADER_DATABASE);
+    // A caller-authenticated request takes its database ONLY from the header;
+    // the env database belongs to the operator's identity, not the caller's.
+    const database = callerAuthenticated
+        ? headerDatabase
+        : (headerDatabase ?? readEnv(env, "HYDRADB_DATABASE", "HYDRA_DB_TENANT_ID", noopWarn));
+    if (!database) {
+        return {
+            ok: false,
+            status: 400,
+            message: "Missing Hydra DB database. Send the `X-HydraDB-Database` header naming " +
+                "the database (tenant) this request should run against.",
+        };
+    }
+    // Collection is a partition WITHIN the resolved database, not a cross-tenant
+    // boundary, so an env default is safe for either mode.
+    const collection = (identity ? identity.collection : headerValue(headers, HEADER_COLLECTION)) ??
+        readEnv(env, "HYDRADB_COLLECTION", "HYDRA_DB_SUB_TENANT_ID", noopWarn) ??
+        DEFAULT_COLLECTION;
+    // Operator-owned transport knobs. Same env vars, same parsing as resolveConfig.
+    const baseUrl = readEnv(env, "HYDRADB_BASE_URL", "HYDRA_DB_BASE_URL", noopWarn);
+    const timeoutSeconds = positiveInt(env.HYDRADB_TIMEOUT_SECONDS);
+    const maxRetries = nonNegativeInt(env.HYDRADB_MAX_RETRIES);
+    return {
+        ok: true,
+        credentials: {
+            apiKey,
+            database,
+            collection,
+            ...(identity?.allowedDatabases ? { allowedDatabases: identity.allowedDatabases } : {}),
+            ...(identity?.allowedCollections
+                ? { allowedCollections: identity.allowedCollections }
+                : {}),
+            ...(baseUrl != null ? { baseUrl } : {}),
+            ...(timeoutSeconds != null ? { timeoutSeconds } : {}),
+            ...(maxRetries != null ? { maxRetries } : {}),
+            graph: resolveRequestGraphConfig(
+            // Same rule for the graph namespace: an OAuth connection's graph scope
+            // derives from the approved database, never from a header.
+            identity ? {} : headers, env, database, callerAuthenticated, identity),
+        },
+    };
+}
+/**
+ * Graph scope for one request: the operator's `enabled` flag, but the caller's
+ * database and collection.
+ *
+ * The graph database defaults to the request's OWN database, so a caller that
+ * names only `X-HydraDB-Database` gets a coherent graph scope without a second
+ * header. The operator's `HYDRADB_GRAPH_DATABASE` is honoured as that default
+ * ONLY for an unauthenticated (env-credential) request — for a caller-
+ * authenticated one it would pin every tenant to the operator's single graph
+ * namespace, the mixing this resolver exists to prevent. Header overrides always
+ * win, letting a caller address a graph in a different namespace than their
+ * memory database — which, because the two are genuinely separate stores, is a
+ * real need.
+ */
+function resolveRequestGraphConfig(headers, env, database, callerAuthenticated, identity) {
+    // For a caller-authenticated request the fallback database is the request's
+    // own, so `resolveGraphConfig`'s env default is deliberately not consulted.
+    const base = resolveGraphConfig(env, database);
+    const defaultDatabase = callerAuthenticated ? database : base.database;
+    return {
+        enabled: base.enabled,
+        database: headerValue(headers, HEADER_GRAPH_DATABASE) ?? defaultDatabase,
+        // For an OAuth connection the graph collection defaults to the one the
+        // user approved, NOT the operator's `HYDRADB_GRAPH_COLLECTION`. On a
+        // hosted process that environment value is one namespace shared by every
+        // tenant, so inheriting it would run one user's graph calls somewhere
+        // they never approved and everyone else can reach.
+        collection: identity?.collection ??
+            headerValue(headers, HEADER_GRAPH_COLLECTION) ??
+            base.collection,
+    };
+}
+/**
+ * Credential resolution must not emit deprecation warnings.
+ *
+ * `readEnv` warns once per process when a legacy alias is used. On the header
+ * path the env is only a fallback and is read on EVERY request; routing its
+ * warning through the process-wide dedupe would still fire on the first request
+ * and, worse, tie a per-request code path to shared mutable warning state. The
+ * stdio/startup path already surfaces any legacy-alias warning, so silence here
+ * drops nothing.
+ */
+function noopWarn() { }
+/** A JSON-RPC error body, so every HTTP failure speaks the protocol's dialect. */
+export function jsonRpcError(code, message) {
+    return { jsonrpc: "2.0", error: { code, message }, id: null };
+}
+//# sourceMappingURL=http-config.js.map

package/dist/http-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-config.js","sourceRoot":"","sources":["../src/http-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EACN,kBAAkB,EAGlB,cAAc,EACd,WAAW,EACX,OAAO,EACP,kBAAkB,GAClB,MAAM,aAAa,CAAC;AA+BrB,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAEhD,uEAAuE;AACvE,MAAM,UAAU,SAAS,CAAC,KAAyB;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,GAAuB,EAAE,QAAQ,GAAG,YAAY;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,GAAG,IAAI,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,KAAM;QAC7E,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,QAAQ,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAe;IAC9D,OAAO,IAAI,GAAG,CACb;QACC,aAAa,IAAI,EAAE;QACnB,aAAa,IAAI,EAAE;QACnB,SAAS,IAAI,EAAE;QACf,WAAW;QACX,WAAW;QACX,OAAO;QACP,GAAG,KAAK;KACR,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAC7B,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,GAAuB;IACtD,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAiB,OAAO,CAAC,GAAG;IACnE,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO;QACN,IAAI;QACJ,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,oBAAoB;QAC7D,cAAc,EAAE,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC;QAC9C,YAAY,EAAE,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACnE,UAAU,EAAE,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC;QAC5C,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC;KAC9B,CAAC;AACH,CAAC;AAED,yCAAyC;AAEzC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAC;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,CAAC;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AACxD,MAAM,CAAC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,4BAA4B,CAAC;AAwCpE,yEAAyE;AACzE,SAAS,WAAW,CAAC,OAAuB,EAAE,IAAY;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,aAAiC;IACrD,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACxD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IAC/C,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;AAC1C,CAAC;AA4CD,MAAM,UAAU,yBAAyB,CACxC,OAAuB,EACvB,MAAiB,OAAO,CAAC,GAAG,EAC5B,QAA2B;IAE3B,MAAM,SAAS,GACd,QAAQ,EAAE,MAAM;QAChB,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QACvD,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACtC,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,mBAAmB,GAAG,SAAS,IAAI,IAAI,CAAC;IAE9C,MAAM,MAAM;IACX,yEAAyE;IACzE,2EAA2E;IAC3E,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,OAAO,EACN,uEAAuE;gBACvE,4EAA4E;SAC7E,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,gDAAgD;IAChD,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC5F,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,QAAQ,GAAG,mBAAmB;QACnC,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,OAAO,EACN,yEAAyE;gBACzE,wDAAwD;SACzD,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,uDAAuD;IACvD,MAAM,UAAU,GACf,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,QAAQ,CAAC;QACtE,kBAAkB,CAAC;IAEpB,gFAAgF;IAChF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IAChF,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAE3D,OAAO;QACN,EAAE,EAAE,IAAI;QACR,WAAW,EAAE;YACZ,MAAM;YACN,QAAQ;YACR,UAAU;YACV,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,QAAQ,EAAE,kBAAkB;gBAC/B,CAAC,CAAC,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,EAAE;gBACrD,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,KAAK,EAAE,yBAAyB;YAC/B,uEAAuE;YACvE,2DAA2D;YAC3D,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EACvB,GAAG,EACH,QAAQ,EACR,mBAAmB,EACnB,QAAQ,CACR;SACD;KACD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,yBAAyB,CACjC,OAAuB,EACvB,GAAc,EACd,QAAgB,EAChB,mBAA4B,EAC5B,QAA2B;IAE3B,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAG,mBAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IACvE,OAAO;QACN,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,WAAW,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,eAAe;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,yEAAyE;QACzE,sEAAsE;QACtE,mDAAmD;QACnD,UAAU,EACT,QAAQ,EAAE,UAAU;YACpB,WAAW,CAAC,OAAO,EAAE,uBAAuB,CAAC;YAC7C,IAAI,CAAC,UAAU;KAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,QAAQ,KAAU,CAAC;AAE5B,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAe;IAKzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AAC/D,CAAC"}

package/dist/http.d.ts

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+/**
+ * The remotely hostable HTTP transport.
+ *
+ * This is the server behind a URL like `https://mcp.hydradb.com/mcp`: instead of
+ * every user installing and spawning the stdio binary ({@link file://./index.ts}),
+ * one process answers MCP over HTTP and each user points their client at the URL.
+ *
+ * It reuses the whole tool surface unchanged — {@link createHydraDBServer} builds
+ * exactly the same server the stdio path does. The only things this file adds are
+ * the ones a network endpoint needs and a pipe does not: a Host/Origin
+ * allowlist, CORS, and PER-REQUEST tenant credentials (see
+ * {@link file://./http-config.ts}), because one hosted process has no single
+ * ambient account to run as.
+ *
+ * Sessions are stateless: MCP's Protocol object binds to one transport, so a
+ * shared process serving many independent callers builds a fresh server +
+ * transport per request and tears it down when the response closes. That is the
+ * transport's documented stateless mode (`sessionIdGenerator: undefined`).
+ */
+import { type Express } from "express";
+import { buildAllowedHosts, type HttpServerConfig, parseList, parsePort, resolveHttpServerConfig } from "./http-config.js";
+/**
+ * Build the Express app for the HTTP transport.
+ *
+ * Exported (and taking its config as an argument rather than reading the
+ * environment) so tests exercise the exact wiring production runs, against an
+ * arbitrary allowlist, with no process-global state.
+ */
+export declare function createHttpApp(config: HttpServerConfig): Express;
+export { buildAllowedHosts, parseList, parsePort, resolveHttpServerConfig };