@kieksme/mcp-http-kit 0.0.0-stage → 0.2.0

package/dist/config.d.ts

@@ -0,0 +1,30 @@
+import type { KitConfig } from './types.js';
+declare const LOCAL_HOSTS: Set<string>;
+export type LoadConfigOptions = {
+    /** Default realm for WWW-Authenticate (server package name). */
+    realm?: string;
+    /** Override default MCP path. */
+    defaultPath?: string;
+    /** Override default health path. */
+    defaultHealthPath?: string;
+    /**
+     * Extra health paths (e.g. `['/healthz']`) in addition to the primary path.
+     * Also settable via `MCP_HEALTH_ALIASES` (comma-separated).
+     */
+    healthPathAliases?: string[];
+    /** Override max body size. */
+    maxBodyBytes?: number;
+};
+/** Deduplicate path list while preserving order (primary first). */
+export declare function resolveHealthPaths(primary: string, aliases?: string[]): string[];
+/**
+ * Load kit configuration from the environment.
+ *
+ * Canonical names: `MCP_TRANSPORT`, `PORT` / `MCP_HTTP_PORT`, `MCP_HTTP_HOST`,
+ * `MCP_HTTP_PATH`, `MCP_ALLOWED_HOSTS`, `MCP_ALLOWED_ORIGINS`, `MCP_AUTH_MODE`,
+ * `MCP_AUTH_TOKEN`. Legacy aliases emit warnings but still work.
+ */
+export declare function loadConfig(env?: NodeJS.ProcessEnv, options?: LoadConfigOptions): KitConfig;
+export declare function isLocalhostHostname(hostname: string): boolean;
+export { LOCAL_HOSTS };
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAIV,SAAS,EAEV,MAAM,YAAY,CAAC;AAKpB,QAAA,MAAM,WAAW,aAAsD,CAAC;AAExE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,8BAA8B;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAQF,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,EAAO,GAAG,MAAM,EAAE,CAUpF;AAiJD;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,iBAAsB,GAC9B,SAAS,CAyDX;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/config.js

@@ -0,0 +1,201 @@
+const DEFAULT_PATH = '/mcp';
+const DEFAULT_HEALTH = '/health';
+const DEFAULT_MAX_BODY = 4 * 1024 * 1024;
+const LOCAL_HOSTS = new Set(['127.0.0.1', 'localhost', '::1', '[::1]']);
+function normalizePath(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return trimmed;
+    return trimmed.startsWith('/') ? trimmed : `/${trimmed}`;
+}
+/** Deduplicate path list while preserving order (primary first). */
+export function resolveHealthPaths(primary, aliases = []) {
+    const seen = new Set();
+    const out = [];
+    for (const entry of [primary, ...aliases]) {
+        const path = normalizePath(entry);
+        if (!path || seen.has(path))
+            continue;
+        seen.add(path);
+        out.push(path);
+    }
+    return out;
+}
+function firstDefined(env, names) {
+    for (const name of names) {
+        const value = env[name];
+        if (value !== undefined && value !== '') {
+            return { value, name };
+        }
+    }
+    return {};
+}
+function splitList(raw) {
+    if (!raw)
+        return [];
+    return raw
+        .split(',')
+        .map(entry => entry.trim())
+        .filter(Boolean);
+}
+function parsePort(raw, label) {
+    const port = Number(raw ?? '3000');
+    if (!Number.isInteger(port) || port < 0 || port > 65535) {
+        throw new Error(`${label} must be an integer 0..65535`);
+    }
+    return port;
+}
+function normalizeHost(host) {
+    return host.trim().toLowerCase();
+}
+function isLocalBind(host) {
+    return LOCAL_HOSTS.has(normalizeHost(host));
+}
+function parseTransport(raw) {
+    const value = (raw ?? 'stdio').trim().toLowerCase();
+    if (value === 'stdio' || value === 'http')
+        return value;
+    throw new Error(`MCP_TRANSPORT must be "stdio" or "http" (got ${JSON.stringify(raw)})`);
+}
+function parseAuthMode(raw) {
+    const value = (raw ?? 'bearer').trim().toLowerCase();
+    if (value === 'bearer' || value === 'oauth' || value === 'none')
+        return value;
+    throw new Error(`MCP_AUTH_MODE must be bearer|oauth|none (got ${JSON.stringify(raw)})`);
+}
+function truthy(raw) {
+    if (!raw)
+        return false;
+    return ['1', 'true', 'yes', 'on'].includes(raw.trim().toLowerCase());
+}
+function parseBearerTokens(env, warnings) {
+    const primary = firstDefined(env, ['MCP_AUTH_TOKEN']);
+    const legacy = firstDefined(env, ['MCP_HTTP_AUTH_TOKEN', 'MCP_SERVER_AUTH_TOKEN']);
+    if (primary.value) {
+        return splitList(primary.value);
+    }
+    if (legacy.value && legacy.name) {
+        warnings.push(`${legacy.name} is deprecated; use MCP_AUTH_TOKEN (comma-separated list for rotation)`);
+        return splitList(legacy.value);
+    }
+    return [];
+}
+function parseOAuthConfig(env) {
+    const resource = env.MCP_OAUTH_RESOURCE?.trim();
+    const authorizationServers = splitList(env.MCP_OAUTH_AUTHORIZATION_SERVERS);
+    if (!resource) {
+        throw new Error('MCP_OAUTH_RESOURCE is required when MCP_AUTH_MODE=oauth');
+    }
+    if (authorizationServers.length === 0) {
+        throw new Error('MCP_OAUTH_AUTHORIZATION_SERVERS is required when MCP_AUTH_MODE=oauth');
+    }
+    const audiences = splitList(env.MCP_OAUTH_AUDIENCES);
+    const requiredScopes = splitList(env.MCP_OAUTH_REQUIRED_SCOPES);
+    const scopesSupported = splitList(env.MCP_OAUTH_SCOPES_SUPPORTED);
+    const jwksUrl = env.MCP_OAUTH_JWKS_URL?.trim();
+    return {
+        mode: 'oauth',
+        resource,
+        authorizationServers,
+        audiences: audiences.length > 0 ? audiences : [resource],
+        requiredScopes,
+        scopesSupported: scopesSupported.length > 0 ? scopesSupported : requiredScopes,
+        ...(jwksUrl ? { jwksUrl } : {}),
+    };
+}
+function parseAuth(env, http, warnings) {
+    const mode = parseAuthMode(env.MCP_AUTH_MODE);
+    if (mode === 'bearer') {
+        const tokens = parseBearerTokens(env, warnings);
+        if (tokens.length === 0) {
+            throw new Error('MCP_AUTH_TOKEN is required when MCP_AUTH_MODE=bearer (generate with: openssl rand -hex 32)');
+        }
+        return { mode: 'bearer', tokens };
+    }
+    if (mode === 'oauth') {
+        return parseOAuthConfig(env);
+    }
+    const allowPublic = truthy(env.MCP_AUTH_ALLOW_NONE);
+    if (!isLocalBind(http.host) && !allowPublic) {
+        throw new Error('MCP_AUTH_MODE=none is only allowed on localhost unless MCP_AUTH_ALLOW_NONE=true (public read-only opt-in)');
+    }
+    return { mode: 'none', allowPublic };
+}
+function parseAllowlists(env, host, warnings) {
+    const hostsRaw = firstDefined(env, ['MCP_ALLOWED_HOSTS', 'MCP_HTTP_ALLOWED_HOSTS']);
+    if (hostsRaw.name === 'MCP_HTTP_ALLOWED_HOSTS') {
+        warnings.push('MCP_HTTP_ALLOWED_HOSTS is deprecated; use MCP_ALLOWED_HOSTS');
+    }
+    const originsRaw = firstDefined(env, ['MCP_ALLOWED_ORIGINS', 'MCP_HTTP_ALLOWED_ORIGINS']);
+    if (originsRaw.name === 'MCP_HTTP_ALLOWED_ORIGINS') {
+        warnings.push('MCP_HTTP_ALLOWED_ORIGINS is deprecated; use MCP_ALLOWED_ORIGINS');
+    }
+    let allowedHosts = splitList(hostsRaw.value).map(normalizeHost);
+    if (allowedHosts.length === 0) {
+        allowedHosts = ['127.0.0.1', 'localhost', '[::1]'];
+    }
+    if (!isLocalBind(host) && !hostsRaw.value) {
+        throw new Error('MCP_ALLOWED_HOSTS is required when binding beyond localhost (comma-separated hostnames clients use)');
+    }
+    const allowedOrigins = splitList(originsRaw.value);
+    return { allowedHosts, allowedOrigins };
+}
+/**
+ * Load kit configuration from the environment.
+ *
+ * Canonical names: `MCP_TRANSPORT`, `PORT` / `MCP_HTTP_PORT`, `MCP_HTTP_HOST`,
+ * `MCP_HTTP_PATH`, `MCP_ALLOWED_HOSTS`, `MCP_ALLOWED_ORIGINS`, `MCP_AUTH_MODE`,
+ * `MCP_AUTH_TOKEN`. Legacy aliases emit warnings but still work.
+ */
+export function loadConfig(env = process.env, options = {}) {
+    const warnings = [];
+    const transport = parseTransport(env.MCP_TRANSPORT);
+    const portSource = firstDefined(env, ['PORT', 'MCP_HTTP_PORT']);
+    if (portSource.name === 'MCP_HTTP_PORT' && !env.PORT) {
+        warnings.push('MCP_HTTP_PORT is deprecated as the primary port; prefer PORT (Railway-friendly)');
+    }
+    const host = env.MCP_HTTP_HOST?.trim() || '127.0.0.1';
+    const path = env.MCP_HTTP_PATH?.trim() ||
+        env.MCP_HTTP_ENDPOINT?.trim() ||
+        options.defaultPath ||
+        DEFAULT_PATH;
+    if (env.MCP_HTTP_ENDPOINT && !env.MCP_HTTP_PATH) {
+        warnings.push('MCP_HTTP_ENDPOINT is deprecated; use MCP_HTTP_PATH');
+    }
+    const healthPath = normalizePath(env.MCP_HEALTH_PATH?.trim() ||
+        env.HEALTH_ENDPOINT?.trim() ||
+        options.defaultHealthPath ||
+        DEFAULT_HEALTH);
+    if (env.HEALTH_ENDPOINT && !env.MCP_HEALTH_PATH) {
+        warnings.push('HEALTH_ENDPOINT is deprecated; use MCP_HEALTH_PATH');
+    }
+    const aliasFromEnv = splitList(env.MCP_HEALTH_ALIASES);
+    const aliasFromOptions = options.healthPathAliases ?? [];
+    const healthPaths = resolveHealthPaths(healthPath, [...aliasFromOptions, ...aliasFromEnv]);
+    const { allowedHosts, allowedOrigins } = parseAllowlists(env, host, warnings);
+    const port = parsePort(portSource.value, portSource.name ?? 'PORT');
+    const http = {
+        host,
+        port,
+        path: normalizePath(path),
+        healthPath,
+        healthPaths,
+        allowedHosts,
+        allowedOrigins,
+        maxBodyBytes: options.maxBodyBytes ?? DEFAULT_MAX_BODY,
+        enableSessionMethods: truthy(env.MCP_HTTP_ENABLE_SESSION_METHODS),
+    };
+    const auth = transport === 'http' ? parseAuth(env, http, warnings) : { mode: 'none', allowPublic: true };
+    return {
+        transport,
+        http,
+        auth: transport === 'http' ? auth : { mode: 'none', allowPublic: true },
+        realm: options.realm ?? env.MCP_AUTH_REALM?.trim() ?? 'mcp',
+        warnings,
+    };
+}
+export function isLocalhostHostname(hostname) {
+    return LOCAL_HOSTS.has(normalizeHost(hostname));
+}
+export { LOCAL_HOSTS };
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAQA,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,cAAc,GAAG,SAAS,CAAC;AACjC,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACzC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAkBxE,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;AAC3D,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,UAAoB,EAAE;IACxE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,GAAsB,EAAE,KAAe;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB,EAAE,KAAa;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CAAC,GAAuB;IAC7C,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,IAAI,KAAK,CAAC,gDAAgD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,aAAa,CAAC,GAAuB;IAC5C,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,IAAI,KAAK,CAAC,gDAAgD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,MAAM,CAAC,GAAuB;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAsB,EAAE,QAAkB;IACnE,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAEnF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CACX,GAAG,MAAM,CAAC,IAAI,wEAAwE,CACvF,CAAC;QACF,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAsB;IAC9C,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAChD,MAAM,oBAAoB,GAAG,SAAS,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAChE,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAC/C,OAAO;QACL,IAAI,EAAE,OAAO;QACb,QAAQ;QACR,oBAAoB;QACpB,SAAS,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACxD,cAAc;QACd,eAAe,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc;QAC9E,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAsB,EAAE,IAAsB,EAAE,QAAkB;IACnF,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,2GAA2G,CAC5G,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,eAAe,CACtB,GAAsB,EACtB,IAAY,EACZ,QAAkB;IAElB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACpF,IAAI,QAAQ,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,qBAAqB,EAAE,0BAA0B,CAAC,CAAC,CAAC;IAC1F,IAAI,UAAU,CAAC,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAChE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,YAAY,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACnD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,MAAyB,OAAO,CAAC,GAAG,EACpC,UAA6B,EAAE;IAE/B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAEpD,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IAChE,IAAI,UAAU,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,WAAW,CAAC;IACtD,MAAM,IAAI,GACR,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE;QACzB,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE;QAC7B,OAAO,CAAC,WAAW;QACnB,YAAY,CAAC;IACf,IAAI,GAAG,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAC9B,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE;QACzB,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE;QAC3B,OAAO,CAAC,iBAAiB;QACzB,cAAc,CACjB,CAAC;IACF,IAAI,GAAG,CAAC,eAAe,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACzD,MAAM,WAAW,GAAG,kBAAkB,CAAC,UAAU,EAAE,CAAC,GAAG,gBAAgB,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;IAE3F,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC;IAEpE,MAAM,IAAI,GAAqB;QAC7B,IAAI;QACJ,IAAI;QACJ,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC;QACzB,UAAU;QACV,WAAW;QACX,YAAY;QACZ,cAAc;QACd,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,gBAAgB;QACtD,oBAAoB,EAAE,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC;KAClE,CAAC;IAEF,MAAM,IAAI,GAAG,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAElH,OAAO;QACL,SAAS;QACT,IAAI;QACJ,IAAI,EAAE,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE;QACvE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,KAAK;QAC3D,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAO,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/http/app.d.ts

@@ -0,0 +1,32 @@
+import { resourceMetadataUrl } from '../auth/oauth.js';
+import type { HealthInfoProvider, KitConfig, ServerFactory } from '../types.js';
+export type McpHttpAppOptions = {
+    createServer: ServerFactory;
+    config: KitConfig;
+    /**
+     * Optional extra fields for the health JSON body.
+     * Merged with `status: "ok"` always winning (cannot be overridden).
+     */
+    getHealthInfo?: HealthInfoProvider;
+};
+export type McpHttpApp = {
+    /** Web-standard fetch handler (framework-agnostic core). */
+    fetch: (request: Request) => Promise<Response>;
+    close: () => Promise<void>;
+};
+/**
+ * Build a framework-agnostic Streamable HTTP app.
+ *
+ * Request order:
+ * 1. GET health — no auth, **before** Host/Origin checks (Railway-friendly)
+ * 2. OAuth protected-resource metadata — no auth, before Host checks
+ * 3. Host/Origin allowlist → 403
+ * 4. MCP path method gate (POST required unless session methods enabled)
+ * 5. Auth → 401
+ * 6. MCP handler (`createMcpHandler`) with `authInfo` pass-through
+ */
+export declare function createMcpHttpApp(options: McpHttpAppOptions): McpHttpApp;
+/** Absolute metadata path for OAuth WWW-Authenticate helpers in tests/docs. */
+export declare function protectedResourceMetadataPath(mcpPath: string): string;
+export { resourceMetadataUrl };
+//# sourceMappingURL=app.d.ts.map

package/dist/http/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/http/app.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkC,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,KAAK,EACV,kBAAkB,EAClB,SAAS,EAET,aAAa,EACd,MAAM,aAAa,CAAC;AAGrB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,YAAY,EAAE,aAAa,CAAC;IAC5B,MAAM,EAAE,SAAS,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,kBAAkB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,4DAA4D;IAC5D,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/C,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAuBF;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,CA6GvE;AAED,+EAA+E;AAC/E,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGrE;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/http/app.js

@@ -0,0 +1,127 @@
+import { createMcpHandler } from '@modelcontextprotocol/server';
+import { authenticateRequest } from '../auth/index.js';
+import { fromAuthInfo, toAuthInfo } from '../auth/context.js';
+import { buildProtectedResourceMetadata, resourceMetadataUrl } from '../auth/oauth.js';
+import { checkHostAndOrigin } from './host-guard.js';
+function jsonResponse(status, body, headers) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json', ...headers },
+    });
+}
+function textResponse(status, body, headers) {
+    return new Response(body, headers ? { status, headers } : { status });
+}
+function isWellKnownProtectedResource(pathname, mcpPath) {
+    if (pathname === '/.well-known/oauth-protected-resource')
+        return true;
+    const suffix = mcpPath === '/' ? '' : mcpPath.replace(/\/$/, '');
+    return pathname === `/.well-known/oauth-protected-resource${suffix}`;
+}
+/**
+ * Build a framework-agnostic Streamable HTTP app.
+ *
+ * Request order:
+ * 1. GET health — no auth, **before** Host/Origin checks (Railway-friendly)
+ * 2. OAuth protected-resource metadata — no auth, before Host checks
+ * 3. Host/Origin allowlist → 403
+ * 4. MCP path method gate (POST required unless session methods enabled)
+ * 5. Auth → 401
+ * 6. MCP handler (`createMcpHandler`) with `authInfo` pass-through
+ */
+export function createMcpHttpApp(options) {
+    const { createServer, config, getHealthInfo } = options;
+    const { http, auth, realm } = config;
+    const healthPaths = new Set(http.healthPaths);
+    const mcpHandler = createMcpHandler(sdkCtx => {
+        const request = sdkCtx.requestInfo;
+        const context = {
+            auth: fromAuthInfo(sdkCtx.authInfo),
+            headers: request?.headers ?? new Headers(),
+            url: request ? new URL(request.url) : new URL(`http://localhost${http.path}`),
+            era: sdkCtx.era,
+            ...(sdkCtx.authInfo ? { authInfo: sdkCtx.authInfo } : {}),
+        };
+        return createServer(context);
+    }, { maxRequestBodySize: http.maxBodyBytes });
+    const fetch = async (request) => {
+        const url = new URL(request.url);
+        const { pathname } = url;
+        // 1. Health — unauthenticated, no Host gate (load balancers / Railway probes)
+        if (request.method === 'GET' && healthPaths.has(pathname)) {
+            const extra = getHealthInfo ? await getHealthInfo() : {};
+            return jsonResponse(200, { ...extra, status: 'ok' });
+        }
+        // 2. OAuth protected resource metadata (RFC 9728)
+        if (auth.mode === 'oauth' &&
+            request.method === 'GET' &&
+            isWellKnownProtectedResource(pathname, http.path)) {
+            return jsonResponse(200, buildProtectedResourceMetadata(auth), {
+                'cache-control': 'public, max-age=60',
+            });
+        }
+        // 3. Host / Origin allowlist
+        const hostCheck = checkHostAndOrigin({
+            host: request.headers.get('host'),
+            origin: request.headers.get('origin'),
+        }, {
+            allowedHosts: http.allowedHosts,
+            allowedOrigins: http.allowedOrigins,
+        });
+        if (!hostCheck.ok) {
+            return textResponse(403, 'Forbidden');
+        }
+        // Non-MCP paths
+        if (pathname !== http.path) {
+            return textResponse(404, 'Not found');
+        }
+        // 4. Method gate — stateless Streamable HTTP is POST-only by default
+        if (request.method !== 'POST') {
+            if (http.enableSessionMethods &&
+                (request.method === 'GET' || request.method === 'DELETE')) {
+                // fall through to MCP handler
+            }
+            else {
+                return new Response('Method Not Allowed', {
+                    status: 405,
+                    headers: { allow: http.enableSessionMethods ? 'GET, POST, DELETE' : 'POST' },
+                });
+            }
+        }
+        // 5. Auth
+        const authResult = await authenticateRequest({
+            auth,
+            realm,
+            authorizationHeader: request.headers.get('authorization'),
+        });
+        if (!authResult.ok) {
+            const headers = {
+                'www-authenticate': authResult.wwwAuthenticate,
+            };
+            if (authResult.contentType)
+                headers['content-type'] = authResult.contentType;
+            return new Response(authResult.body, { status: authResult.status, headers });
+        }
+        const authInfo = toAuthInfo(authResult.context, config);
+        try {
+            return await mcpHandler.fetch(request, authInfo ? { authInfo } : undefined);
+        }
+        catch (error) {
+            console.error('MCP HTTP request failed:', error instanceof Error ? error.message : error);
+            return textResponse(500, 'Server error');
+        }
+    };
+    return {
+        fetch,
+        close: async () => {
+            await mcpHandler.close();
+        },
+    };
+}
+/** Absolute metadata path for OAuth WWW-Authenticate helpers in tests/docs. */
+export function protectedResourceMetadataPath(mcpPath) {
+    const suffix = mcpPath === '/' ? '' : mcpPath.replace(/\/$/, '');
+    return `/.well-known/oauth-protected-resource${suffix}`;
+}
+export { resourceMetadataUrl };
+//# sourceMappingURL=app.js.map

package/dist/http/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/http/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAOvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAkBrD,SAAS,YAAY,CACnB,MAAc,EACd,IAAa,EACb,OAAgC;IAEhC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;KAC5D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY,EAAE,OAAgC;IAClF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB,EAAE,OAAe;IACrE,IAAI,QAAQ,KAAK,uCAAuC;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,MAAM,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjE,OAAO,QAAQ,KAAK,wCAAwC,MAAM,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IACxD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG,gBAAgB,CACjC,MAAM,CAAC,EAAE;QACP,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC;QACnC,MAAM,OAAO,GAAmB;YAC9B,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC;YACnC,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,OAAO,EAAE;YAC1C,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,mBAAmB,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7E,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;QACF,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC,EACD,EAAE,kBAAkB,EAAE,IAAI,CAAC,YAAY,EAAE,CAC1C,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,EAAE,OAAgB,EAAqB,EAAE;QAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAEzB,8EAA8E;QAC9E,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,kDAAkD;QAClD,IACE,IAAI,CAAC,IAAI,KAAK,OAAO;YACrB,OAAO,CAAC,MAAM,KAAK,KAAK;YACxB,4BAA4B,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EACjD,CAAC;YACD,OAAO,YAAY,CAAC,GAAG,EAAE,8BAA8B,CAAC,IAAI,CAAC,EAAE;gBAC7D,eAAe,EAAE,oBAAoB;aACtC,CAAC,CAAC;QACL,CAAC;QAED,6BAA6B;QAC7B,MAAM,SAAS,GAAG,kBAAkB,CAClC;YACE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YACjC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;SACtC,EACD;YACE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CACF,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACxC,CAAC;QAED,gBAAgB;QAChB,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC3B,OAAO,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACxC,CAAC;QAED,qEAAqE;QACrE,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,IACE,IAAI,CAAC,oBAAoB;gBACzB,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,EACzD,CAAC;gBACD,8BAA8B;YAChC,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE;oBACxC,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,EAAE;iBAC7E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,UAAU;QACV,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;YAC3C,IAAI;YACJ,KAAK;YACL,mBAAmB,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;SAC1D,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,OAAO,GAA2B;gBACtC,kBAAkB,EAAE,UAAU,CAAC,eAAe;aAC/C,CAAC;YACF,IAAI,UAAU,CAAC,WAAW;gBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC;YAC7E,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAExD,IAAI,CAAC;YACH,OAAO,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,0BAA0B,EAC1B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;YACF,OAAO,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK;QACL,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,MAAM,MAAM,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjE,OAAO,wCAAwC,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/http/host-guard.d.ts

@@ -0,0 +1,22 @@
+export type HostGuardConfig = {
+    allowedHosts: string[];
+    /** Absolute origin allowlist (e.g. `https://app.example.com`). Empty = derive from hosts. */
+    allowedOrigins: string[];
+};
+export type HostGuardResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+declare function normalizeHostname(hostHeader: string | null | undefined): string | undefined;
+/**
+ * DNS-rebinding protection: require Host in the allowlist and Origin (when present)
+ * to match allowed hosts/origins.
+ */
+export declare function checkHostAndOrigin(headers: {
+    host?: string | null;
+    origin?: string | null;
+}, config: HostGuardConfig): HostGuardResult;
+export { normalizeHostname };
+//# sourceMappingURL=host-guard.d.ts.map

package/dist/http/host-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-guard.d.ts","sourceRoot":"","sources":["../../src/http/host-guard.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,6FAA6F;IAC7F,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3E,iBAAS,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CASpF;AAoBD;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACzD,MAAM,EAAE,eAAe,GACtB,eAAe,CAYjB;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/http/host-guard.js

@@ -0,0 +1,46 @@
+function normalizeHostname(hostHeader) {
+    if (!hostHeader)
+        return undefined;
+    // Strip port; handle IPv6 "[::1]:3000"
+    const trimmed = hostHeader.trim().toLowerCase();
+    if (trimmed.startsWith('[')) {
+        const end = trimmed.indexOf(']');
+        if (end !== -1)
+            return trimmed.slice(0, end + 1);
+    }
+    return trimmed.replace(/:\d+$/, '');
+}
+function originAllowed(origin, allowedHosts, allowedOrigins) {
+    if (!origin)
+        return true; // non-browser clients omit Origin
+    if (allowedOrigins.length > 0) {
+        return allowedOrigins.includes(origin);
+    }
+    try {
+        const hostname = new URL(origin).hostname.toLowerCase();
+        const bracketed = hostname.includes(':') ? `[${hostname}]` : hostname;
+        return allowedHosts.includes(hostname) || allowedHosts.includes(bracketed);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * DNS-rebinding protection: require Host in the allowlist and Origin (when present)
+ * to match allowed hosts/origins.
+ */
+export function checkHostAndOrigin(headers, config) {
+    const hostname = normalizeHostname(headers.host ?? null);
+    if (!hostname) {
+        return { ok: false, reason: 'missing Host header' };
+    }
+    if (!config.allowedHosts.includes(hostname)) {
+        return { ok: false, reason: `Host ${hostname} is not allowed` };
+    }
+    if (!originAllowed(headers.origin ?? null, config.allowedHosts, config.allowedOrigins)) {
+        return { ok: false, reason: 'Origin is not allowed' };
+    }
+    return { ok: true };
+}
+export { normalizeHostname };
+//# sourceMappingURL=host-guard.js.map

package/dist/http/host-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-guard.js","sourceRoot":"","sources":["../../src/http/host-guard.ts"],"names":[],"mappings":"AAQA,SAAS,iBAAiB,CAAC,UAAqC;IAC9D,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,uCAAuC;IACvC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,aAAa,CACpB,MAAiC,EACjC,YAAsB,EACtB,cAAwB;IAExB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;IAC5D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;QACtE,OAAO,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAyD,EACzD,MAAuB;IAEvB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,QAAQ,iBAAiB,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACvF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/http/index.d.ts

@@ -0,0 +1,4 @@
+export { createMcpHttpApp, protectedResourceMetadataPath, resourceMetadataUrl, type McpHttpApp, type McpHttpAppOptions, } from './app.js';
+export { checkHostAndOrigin, normalizeHostname, type HostGuardConfig, type HostGuardResult, } from './host-guard.js';
+export { createNodeHttpServer, createNodeRequestListener, handleWithKitApp, type NodeHttpServerOptions, } from './node.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/http/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,6BAA6B,EAC7B,mBAAmB,EACnB,KAAK,UAAU,EACf,KAAK,iBAAiB,GACvB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,qBAAqB,GAC3B,MAAM,WAAW,CAAC"}

package/dist/http/index.js

@@ -0,0 +1,4 @@
+export { createMcpHttpApp, protectedResourceMetadataPath, resourceMetadataUrl, } from './app.js';
+export { checkHostAndOrigin, normalizeHostname, } from './host-guard.js';
+export { createNodeHttpServer, createNodeRequestListener, handleWithKitApp, } from './node.js';
+//# sourceMappingURL=index.js.map

package/dist/http/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,6BAA6B,EAC7B,mBAAmB,GAGpB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAGlB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,gBAAgB,GAEjB,MAAM,WAAW,CAAC"}

package/dist/http/node.d.ts

@@ -0,0 +1,36 @@
+import { type RequestListener, type Server as HttpServer } from 'node:http';
+import { toWebRequest } from '@modelcontextprotocol/node';
+import type { KitConfig } from '../types.js';
+import type { McpHttpApp } from './app.js';
+export type NodeHttpServerOptions = {
+    app: McpHttpApp;
+    config: KitConfig;
+};
+/**
+ * Adapt a kit HTTP app to a Node `http.Server` request listener.
+ * Health/auth/host gates run in the web-standard app; this only bridges I/O.
+ */
+export declare function createNodeRequestListener(options: NodeHttpServerOptions): RequestListener;
+/** Create a listening-ready `node:http` server for the kit app. */
+export declare function createNodeHttpServer(options: NodeHttpServerOptions): HttpServer;
+/**
+ * Fastify preHandler / raw hook helper: convert the Fastify request into a
+ * web `Request`, run the kit app, and send the `Response` back.
+ *
+ * Example:
+ * ```ts
+ * fastify.all('/mcp', async (req, reply) => {
+ *   await handleWithKitApp(app, req.raw, reply.raw, config);
+ * });
+ * ```
+ */
+export type KitNodeResponse = {
+    writeHead: (statusCode: number, headers?: Record<string, string>) => unknown;
+    write: (chunk: string | Uint8Array) => unknown;
+    end: (chunk?: string | Uint8Array) => unknown;
+    on: (event: string, listener: (...args: unknown[]) => void) => unknown;
+    headersSent?: boolean;
+    destroyed?: boolean;
+};
+export declare function handleWithKitApp(app: McpHttpApp, req: Parameters<typeof toWebRequest>[0], res: KitNodeResponse, config: KitConfig, parsedBody?: unknown): Promise<void>;
+//# sourceMappingURL=node.d.ts.map

package/dist/http/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/http/node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1F,OAAO,EAAiB,YAAY,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,MAAM,MAAM,qBAAqB,GAAG;IAClC,GAAG,EAAE,UAAU,CAAC;IAChB,MAAM,EAAE,SAAS,CAAC;CACnB,CAAC;AAUF;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,qBAAqB,GAAG,eAAe,CAgDzF;AAED,mEAAmE;AACnE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,UAAU,CAE/E;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC;IAC7E,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,KAAK,OAAO,CAAC;IAC/C,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,KAAK,OAAO,CAAC;IAC9C,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,KAAK,OAAO,CAAC;IACvE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,EACvC,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,SAAS,EACjB,UAAU,CAAC,EAAE,OAAO,GACnB,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/dist/http/node.js

@@ -0,0 +1,74 @@
+import { createServer } from 'node:http';
+import { toNodeHandler, toWebRequest } from '@modelcontextprotocol/node';
+function headersToRecord(headers) {
+    const out = {};
+    headers.forEach((value, key) => {
+        out[key] = value;
+    });
+    return out;
+}
+/**
+ * Adapt a kit HTTP app to a Node `http.Server` request listener.
+ * Health/auth/host gates run in the web-standard app; this only bridges I/O.
+ */
+export function createNodeRequestListener(options) {
+    const { app, config } = options;
+    const nodeHandler = toNodeHandler({
+        fetch: request => app.fetch(request),
+    }, { maxRequestBodySize: config.http.maxBodyBytes });
+    return (req, res) => {
+        // For non-MCP paths (health, well-known, 403/404/401) we still go through
+        // toWebRequest + app.fetch so Host/health ordering stays in one place.
+        // toNodeHandler also works, but health probes with weird Host headers must
+        // hit app.fetch before any Host rejection — app.fetch already does that.
+        void (async () => {
+            try {
+                const urlPath = req.url ?? '/';
+                const pathname = urlPath.split('?')[0] ?? '/';
+                const isHealth = req.method === 'GET' && config.http.healthPaths.includes(pathname);
+                const isWellKnown = req.method === 'GET' && pathname.startsWith('/.well-known/oauth-protected-resource');
+                // Cast: Node's IncomingMessage is structurally compatible; EOPT disagrees on optionals.
+                const nodeReq = req;
+                if (isHealth || isWellKnown || pathname !== config.http.path) {
+                    const webRequest = await toWebRequest(nodeReq, undefined, {
+                        maxRequestBodySize: config.http.maxBodyBytes,
+                    });
+                    const response = await app.fetch(webRequest);
+                    res.writeHead(response.status, headersToRecord(response.headers));
+                    const buf = Buffer.from(await response.arrayBuffer());
+                    res.end(buf);
+                    return;
+                }
+                await nodeHandler(nodeReq, res);
+            }
+            catch (error) {
+                console.error('Node HTTP adapter failed:', error instanceof Error ? error.message : error);
+                if (!res.headersSent) {
+                    res.writeHead(500).end('Server error');
+                }
+            }
+        })();
+    };
+}
+/** Create a listening-ready `node:http` server for the kit app. */
+export function createNodeHttpServer(options) {
+    return createServer(createNodeRequestListener(options));
+}
+export async function handleWithKitApp(app, req, res, config, parsedBody) {
+    // Prefer streaming-capable Node adapter for the MCP path.
+    const pathname = new URL(req.url ?? '/', 'http://localhost').pathname;
+    if (pathname === config.http.path) {
+        const nodeHandler = toNodeHandler({ fetch: request => app.fetch(request) }, { maxRequestBodySize: config.http.maxBodyBytes });
+        await nodeHandler(req, res, parsedBody);
+        return;
+    }
+    const webRequest = await toWebRequest(req, parsedBody, {
+        maxRequestBodySize: config.http.maxBodyBytes,
+    });
+    const response = await app.fetch(webRequest);
+    if (res.headersSent)
+        return;
+    res.writeHead(response.status, headersToRecord(response.headers));
+    res.end(Buffer.from(await response.arrayBuffer()));
+}
+//# sourceMappingURL=node.js.map