@kwonye/mcpx 0.1.85 → 0.1.87

package/dist/{cli-p2mah4z3.js → cli-7k3vf6tg.js}

@@ -2208,7 +2208,7 @@ async function getOAuthAccessToken(serverName, spec, secrets, options = {}) {
 }
 
 // src/version.ts
-var APP_VERSION = "0.1.85";
+var APP_VERSION = "0.1.87";
 
 // src/core/update.ts
 import fs7 from "node:fs";
@@ -2485,7 +2485,7 @@ import {
   StdioClientTransport,
   getDefaultEnvironment
 } from "@modelcontextprotocol/sdk/client/stdio.js";
-var JSON_RPC_VERSION2 = "2.0";
+import { StreamableHTTPClientTransport, StreamableHTTPError } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 var SERVER_VERSION = APP_VERSION;
 var DEFAULT_UPSTREAM_TIMEOUT_MS = 60000;
 var DEFAULT_CONNECT_TIMEOUT_MS = 1e4;
@@ -2653,10 +2653,7 @@ function parseNamespacedUri(uri) {
   };
 }
 async function callUpstream(upstream, method, params, id, secrets, runtime, passthroughAuthorizationHeader) {
-  if (upstream.spec.transport === "stdio") {
-    return callStdioUpstream(upstream, method, params, secrets, runtime);
-  }
-  return callHttpUpstream(upstream, method, params, id, secrets, passthroughAuthorizationHeader);
+  return callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, false);
 }
 async function getUpstreamTokenCounts(config, secrets, runtime) {
   if (!runtime.tokenCache) {
@@ -2749,75 +2746,110 @@ function buildStdioServerParameters(spec, secrets) {
     env: resolveStdioEnv(spec, secrets)
   };
 }
-async function closeStdioConnection(entry) {
+async function buildHttpHeaders(upstream, secrets, options) {
+  const headers = {};
+  for (const [key, value] of Object.entries(upstream.spec.headers ?? {})) {
+    if (key.toLowerCase() === "authorization" && isOAuthReference(value)) {
+      const oauthServerName = oauthReferenceServerName(value);
+      const accessToken = await getOAuthAccessToken(oauthServerName, upstream.spec, secrets, {
+        forceRefresh: options.forceOAuthRefresh
+      });
+      headers[key] = `Bearer ${accessToken}`;
+    } else {
+      headers[key] = secrets.resolveMaybeSecret(value);
+    }
+  }
+  if (options.passthroughAuthorizationHeader) {
+    headers.Authorization = options.passthroughAuthorizationHeader;
+  }
+  return headers;
+}
+async function closeUpstreamConnection(entry) {
   try {
     const connection = await entry.promise;
     await connection.transport.close();
   } catch {}
 }
-async function reconcileStdioConnections(config, runtime) {
+async function reconcileUpstreamConnections(config, runtime) {
   const activeSpecs = new Map(Object.entries(config.servers).filter(([, spec]) => isServerEnabled(spec)).map(([name, spec]) => [name, specFingerprint(spec)]));
-  const staleNames = [];
-  for (const [name, entry] of runtime.stdioConnections.entries()) {
-    const expectedFingerprint = activeSpecs.get(name);
+  const staleKeys = [];
+  for (const [key, entry] of runtime.upstreamConnections.entries()) {
+    const upstreamName = key.includes(":") ? key.slice(0, key.indexOf(":")) : key;
+    const expectedFingerprint = activeSpecs.get(upstreamName);
     if (!expectedFingerprint || expectedFingerprint !== entry.fingerprint) {
-      staleNames.push(name);
+      staleKeys.push(key);
     }
   }
-  for (const name of staleNames) {
-    const entry = runtime.stdioConnections.get(name);
+  for (const key of staleKeys) {
+    const entry = runtime.upstreamConnections.get(key);
     if (!entry) {
       continue;
     }
-    runtime.stdioConnections.delete(name);
-    await closeStdioConnection(entry);
+    runtime.upstreamConnections.delete(key);
+    await closeUpstreamConnection(entry);
   }
 }
-function invalidateStdioConnection(name, runtime) {
-  const existing = runtime.stdioConnections.get(name);
+function invalidateUpstreamConnection(upstreamName, passthroughAuthorizationHeader, runtime) {
+  const key = passthroughAuthorizationHeader ? `${upstreamName}:passthrough` : upstreamName;
+  const existing = runtime.upstreamConnections.get(key);
   if (!existing) {
     return;
   }
-  runtime.stdioConnections.delete(name);
-  closeStdioConnection(existing);
+  runtime.upstreamConnections.delete(key);
+  closeUpstreamConnection(existing);
 }
-async function getStdioConnection(upstream, secrets, runtime) {
+async function getUpstreamConnection(upstream, secrets, runtime, options = {}) {
+  const { forceOAuthRefresh = false, passthroughAuthorizationHeader } = options;
+  const cacheKey = passthroughAuthorizationHeader ? `${upstream.name}:passthrough` : upstream.name;
   const fingerprint = specFingerprint(upstream.spec);
-  const existing = runtime.stdioConnections.get(upstream.name);
-  if (existing) {
-    if (existing.fingerprint === fingerprint) {
-      return existing.promise;
+  if (!forceOAuthRefresh) {
+    const existing = runtime.upstreamConnections.get(cacheKey);
+    if (existing) {
+      if (existing.fingerprint === fingerprint) {
+        return existing.promise;
+      }
+      runtime.upstreamConnections.delete(cacheKey);
+      closeUpstreamConnection(existing);
     }
-    runtime.stdioConnections.delete(upstream.name);
-    closeStdioConnection(existing);
   }
   const promise = (async () => {
-    const transport = new StdioClientTransport(buildStdioServerParameters(upstream.spec, secrets));
-    const client = new Client({
-      name: "mcpx",
-      version: SERVER_VERSION
-    });
+    let transport;
+    if (upstream.spec.transport === "stdio") {
+      transport = new StdioClientTransport(buildStdioServerParameters(upstream.spec, secrets));
+    } else {
+      const headers = await buildHttpHeaders(upstream, secrets, { forceOAuthRefresh, passthroughAuthorizationHeader });
+      const capturingFetch = async (url, init) => {
+        const response = await fetch(url, init);
+        const wwwAuth = response.headers.get("www-authenticate");
+        if (wwwAuth) {
+          if (!runtime.lastWwwAuthenticate) {
+            runtime.lastWwwAuthenticate = new Map;
+          }
+          runtime.lastWwwAuthenticate.set(upstream.name, wwwAuth);
+        }
+        return response;
+      };
+      transport = new StreamableHTTPClientTransport(new URL2(upstream.spec.url), { requestInit: { headers }, fetch: capturingFetch });
+    }
+    const client = new Client({ name: "mcpx", version: SERVER_VERSION });
     await withTimeout(client.connect(transport), DEFAULT_CONNECT_TIMEOUT_MS, `Upstream ${upstream.name} failed to connect within ${DEFAULT_CONNECT_TIMEOUT_MS}ms.`);
-    return {
-      fingerprint,
-      client,
-      transport
-    };
+    return { fingerprint, client, transport };
   })();
-  runtime.stdioConnections.set(upstream.name, {
-    fingerprint,
-    promise
-  });
+  runtime.upstreamConnections.set(cacheKey, { fingerprint, promise });
   try {
     return await promise;
   } catch (error) {
-    runtime.stdioConnections.delete(upstream.name);
+    runtime.upstreamConnections.delete(cacheKey);
     throw error;
   }
 }
-async function callStdioUpstream(upstream, method, params, secrets, runtime) {
+async function callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, forceOAuthRefresh) {
+  const hasOAuth = upstream.spec.transport === "http" && Object.values(upstream.spec.headers ?? {}).some(isOAuthReference);
   try {
-    const connection = await getStdioConnection(upstream, secrets, runtime);
+    const connection = await getUpstreamConnection(upstream, secrets, runtime, {
+      forceOAuthRefresh,
+      passthroughAuthorizationHeader
+    });
     const timeoutMs = getConfiguredTimeoutMs();
     const timeoutMessage = `Upstream ${upstream.name} timed out after ${timeoutMs}ms for method ${method}.`;
     if (method === "tools/list") {
@@ -2838,161 +2870,17 @@ async function callStdioUpstream(upstream, method, params, secrets, runtime) {
     if (method === "prompts/get") {
       return withTimeout(connection.client.getPrompt(params), timeoutMs, timeoutMessage);
     }
-    throw new Error(`Unsupported stdio passthrough method: ${method}`);
+    throw new Error(`Unsupported method: ${method}`);
   } catch (error) {
-    invalidateStdioConnection(upstream.name, runtime);
-    throw error;
-  }
-}
-async function callHttpUpstream(upstream, method, params, id, secrets, passthroughAuthorizationHeader) {
-  return callHttpUpstreamOnce(upstream, method, params, id, secrets, passthroughAuthorizationHeader, false);
-}
-async function callHttpUpstreamOnce(upstream, method, params, id, secrets, passthroughAuthorizationHeader, forceOAuthRefresh) {
-  const headers = {
-    "content-type": "application/json",
-    accept: "application/json, text/event-stream"
-  };
-  for (const [key, value] of Object.entries(upstream.spec.headers ?? {})) {
-    if (key.toLowerCase() === "authorization" && isOAuthReference(value)) {
-      const oauthServerName = oauthReferenceServerName(value);
-      const accessToken = await getOAuthAccessToken(oauthServerName, upstream.spec, secrets, { forceRefresh: forceOAuthRefresh });
-      headers[key] = `Bearer ${accessToken}`;
-    } else {
-      headers[key] = secrets.resolveMaybeSecret(value);
+    invalidateUpstreamConnection(upstream.name, passthroughAuthorizationHeader, runtime);
+    if (!forceOAuthRefresh && hasOAuth && error instanceof StreamableHTTPError && (error.code === 401 || error.code === 403)) {
+      return callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, true);
     }
-  }
-  if (passthroughAuthorizationHeader) {
-    headers.Authorization = passthroughAuthorizationHeader;
-  }
-  const timeoutMs = getConfiguredTimeoutMs();
-  const timeoutController = new AbortController;
-  const timeoutHandle = setTimeout(() => timeoutController.abort(), timeoutMs);
-  let response;
-  try {
-    response = await fetch(upstream.spec.url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify({
-        jsonrpc: JSON_RPC_VERSION2,
-        id,
-        method,
-        params
-      }),
-      signal: timeoutController.signal
-    });
-  } catch (error) {
-    const name = error.name;
-    if (name === "AbortError") {
-      throw new Error(`Upstream ${upstream.name} timed out after ${timeoutMs}ms for method ${method}.`);
+    if (upstream.spec.transport === "http" && error instanceof StreamableHTTPError && error.code) {
+      const wwwAuthenticate = runtime.lastWwwAuthenticate?.get(upstream.name);
+      throw new UpstreamHttpError(upstream.name, error.code, error.message ?? "", wwwAuthenticate);
     }
     throw error;
-  } finally {
-    clearTimeout(timeoutHandle);
-  }
-  if (!response.ok) {
-    const responseText = await response.text();
-    if (!forceOAuthRefresh && (response.status === 401 || response.status === 403) && Object.values(upstream.spec.headers ?? {}).some((value) => isOAuthReference(value))) {
-      return callHttpUpstreamOnce(upstream, method, params, id, secrets, passthroughAuthorizationHeader, true);
-    }
-    throw new UpstreamHttpError(upstream.name, response.status, responseText, response.headers.get("www-authenticate") ?? undefined);
-  }
-  let payload = null;
-  const contentType = response.headers.get("content-type") ?? "";
-  if (contentType.includes("application/json")) {
-    payload = JSON.parse(await response.text());
-  } else if (contentType.includes("text/event-stream")) {
-    payload = await readSseJsonRpcResponse(response, id);
-  } else {
-    try {
-      payload = JSON.parse(await response.text());
-    } catch {
-      payload = null;
-    }
-  }
-  if (!payload) {
-    throw new Error(`Upstream ${upstream.name} response could not be parsed as JSON-RPC payload.`);
-  }
-  if (payload.error) {
-    throw new Error(`Upstream ${upstream.name} error: ${payload.error.message}`);
-  }
-  return payload.result;
-}
-async function readSseJsonRpcResponse(response, expectedId) {
-  if (!response.body) {
-    return null;
-  }
-  const decoder = new TextDecoder;
-  const reader = response.body.getReader();
-  let buffer = "";
-  let dataLines = [];
-  let latestPayload = null;
-  const consumeEvent = () => {
-    if (dataLines.length === 0) {
-      return null;
-    }
-    const combined = dataLines.join(`
-`).trim();
-    dataLines = [];
-    if (!combined || combined === "[DONE]") {
-      return null;
-    }
-    try {
-      const parsed = JSON.parse(combined);
-      latestPayload = parsed;
-      const parsedId = parsed.id ?? null;
-      if (parsedId === expectedId) {
-        return parsed;
-      }
-      return null;
-    } catch {
-      return null;
-    }
-  };
-  try {
-    while (true) {
-      const { value, done } = await reader.read();
-      if (done) {
-        break;
-      }
-      buffer += decoder.decode(value, { stream: true });
-      while (true) {
-        const newlineIndex = buffer.indexOf(`
-`);
-        if (newlineIndex < 0) {
-          break;
-        }
-        let line = buffer.slice(0, newlineIndex);
-        buffer = buffer.slice(newlineIndex + 1);
-        if (line.endsWith("\r")) {
-          line = line.slice(0, -1);
-        }
-        if (line.startsWith("data:")) {
-          dataLines.push(line.slice("data:".length).trimStart());
-          continue;
-        }
-        if (line === "") {
-          const matched = consumeEvent();
-          if (matched) {
-            return matched;
-          }
-        }
-      }
-    }
-    buffer += decoder.decode();
-    if (buffer.length > 0) {
-      let finalLine = buffer;
-      if (finalLine.endsWith("\r")) {
-        finalLine = finalLine.slice(0, -1);
-      }
-      if (finalLine.startsWith("data:")) {
-        dataLines.push(finalLine.slice("data:".length).trimStart());
-      }
-    }
-    return consumeEvent() ?? latestPayload;
-  } finally {
-    try {
-      await reader.cancel();
-    } catch {}
   }
 }
 function authHeaderIsValid(request, expectedToken) {
@@ -3255,7 +3143,7 @@ async function handleRequestObject(request, secrets, runtime, upstreamFilter, cl
   if (upstreamFilter && listUpstreams(config, upstreamFilter).length === 0) {
     return makeError(id, -32602, `Unknown upstream: ${upstreamFilter}`);
   }
-  await reconcileStdioConnections(config, runtime);
+  await reconcileUpstreamConnections(config, runtime);
   if (request.method === "custom/tokenCounts") {
     const result = await getUpstreamTokenCounts(config, secrets, runtime);
     return makeResult(id, result);
@@ -3351,7 +3239,7 @@ async function maybeHandleWellKnownOAuthRequest(request, response, requestUrl, s
 function createGatewayServer(options) {
   const debug = process.env.MCPX_GATEWAY_DEBUG === "1";
   const runtime = {
-    stdioConnections: new Map,
+    upstreamConnections: new Map,
     upstreamErrors: new Map
   };
   const server = http2.createServer(async (request, response) => {
@@ -3517,10 +3405,10 @@ function createGatewayServer(options) {
     }
   });
   server.on("close", () => {
-    for (const entry of runtime.stdioConnections.values()) {
-      closeStdioConnection(entry);
+    for (const entry of runtime.upstreamConnections.values()) {
+      closeUpstreamConnection(entry);
     }
-    runtime.stdioConnections.clear();
+    runtime.upstreamConnections.clear();
   });
   server.listen(options.port, "127.0.0.1");
   return server;

package/dist/{cli-8tdwfb4w.js → cli-t81mwnff.js}

@@ -2485,7 +2485,7 @@ import {
   StdioClientTransport,
   getDefaultEnvironment
 } from "@modelcontextprotocol/sdk/client/stdio.js";
-var JSON_RPC_VERSION2 = "2.0";
+import { StreamableHTTPClientTransport, StreamableHTTPError } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 var SERVER_VERSION = APP_VERSION;
 var DEFAULT_UPSTREAM_TIMEOUT_MS = 60000;
 var DEFAULT_CONNECT_TIMEOUT_MS = 1e4;
@@ -2653,10 +2653,7 @@ function parseNamespacedUri(uri) {
   };
 }
 async function callUpstream(upstream, method, params, id, secrets, runtime, passthroughAuthorizationHeader) {
-  if (upstream.spec.transport === "stdio") {
-    return callStdioUpstream(upstream, method, params, secrets, runtime);
-  }
-  return callHttpUpstream(upstream, method, params, id, secrets, passthroughAuthorizationHeader);
+  return callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, false);
 }
 async function getUpstreamTokenCounts(config, secrets, runtime) {
   if (!runtime.tokenCache) {
@@ -2749,75 +2746,110 @@ function buildStdioServerParameters(spec, secrets) {
     env: resolveStdioEnv(spec, secrets)
   };
 }
-async function closeStdioConnection(entry) {
+async function buildHttpHeaders(upstream, secrets, options) {
+  const headers = {};
+  for (const [key, value] of Object.entries(upstream.spec.headers ?? {})) {
+    if (key.toLowerCase() === "authorization" && isOAuthReference(value)) {
+      const oauthServerName = oauthReferenceServerName(value);
+      const accessToken = await getOAuthAccessToken(oauthServerName, upstream.spec, secrets, {
+        forceRefresh: options.forceOAuthRefresh
+      });
+      headers[key] = `Bearer ${accessToken}`;
+    } else {
+      headers[key] = secrets.resolveMaybeSecret(value);
+    }
+  }
+  if (options.passthroughAuthorizationHeader) {
+    headers.Authorization = options.passthroughAuthorizationHeader;
+  }
+  return headers;
+}
+async function closeUpstreamConnection(entry) {
   try {
     const connection = await entry.promise;
     await connection.transport.close();
   } catch {}
 }
-async function reconcileStdioConnections(config, runtime) {
+async function reconcileUpstreamConnections(config, runtime) {
   const activeSpecs = new Map(Object.entries(config.servers).filter(([, spec]) => isServerEnabled(spec)).map(([name, spec]) => [name, specFingerprint(spec)]));
-  const staleNames = [];
-  for (const [name, entry] of runtime.stdioConnections.entries()) {
-    const expectedFingerprint = activeSpecs.get(name);
+  const staleKeys = [];
+  for (const [key, entry] of runtime.upstreamConnections.entries()) {
+    const upstreamName = key.includes(":") ? key.slice(0, key.indexOf(":")) : key;
+    const expectedFingerprint = activeSpecs.get(upstreamName);
     if (!expectedFingerprint || expectedFingerprint !== entry.fingerprint) {
-      staleNames.push(name);
+      staleKeys.push(key);
     }
   }
-  for (const name of staleNames) {
-    const entry = runtime.stdioConnections.get(name);
+  for (const key of staleKeys) {
+    const entry = runtime.upstreamConnections.get(key);
     if (!entry) {
       continue;
     }
-    runtime.stdioConnections.delete(name);
-    await closeStdioConnection(entry);
+    runtime.upstreamConnections.delete(key);
+    await closeUpstreamConnection(entry);
   }
 }
-function invalidateStdioConnection(name, runtime) {
-  const existing = runtime.stdioConnections.get(name);
+function invalidateUpstreamConnection(upstreamName, passthroughAuthorizationHeader, runtime) {
+  const key = passthroughAuthorizationHeader ? `${upstreamName}:passthrough` : upstreamName;
+  const existing = runtime.upstreamConnections.get(key);
   if (!existing) {
     return;
   }
-  runtime.stdioConnections.delete(name);
-  closeStdioConnection(existing);
+  runtime.upstreamConnections.delete(key);
+  closeUpstreamConnection(existing);
 }
-async function getStdioConnection(upstream, secrets, runtime) {
+async function getUpstreamConnection(upstream, secrets, runtime, options = {}) {
+  const { forceOAuthRefresh = false, passthroughAuthorizationHeader } = options;
+  const cacheKey = passthroughAuthorizationHeader ? `${upstream.name}:passthrough` : upstream.name;
   const fingerprint = specFingerprint(upstream.spec);
-  const existing = runtime.stdioConnections.get(upstream.name);
-  if (existing) {
-    if (existing.fingerprint === fingerprint) {
-      return existing.promise;
+  if (!forceOAuthRefresh) {
+    const existing = runtime.upstreamConnections.get(cacheKey);
+    if (existing) {
+      if (existing.fingerprint === fingerprint) {
+        return existing.promise;
+      }
+      runtime.upstreamConnections.delete(cacheKey);
+      closeUpstreamConnection(existing);
     }
-    runtime.stdioConnections.delete(upstream.name);
-    closeStdioConnection(existing);
   }
   const promise = (async () => {
-    const transport = new StdioClientTransport(buildStdioServerParameters(upstream.spec, secrets));
-    const client = new Client({
-      name: "mcpx",
-      version: SERVER_VERSION
-    });
+    let transport;
+    if (upstream.spec.transport === "stdio") {
+      transport = new StdioClientTransport(buildStdioServerParameters(upstream.spec, secrets));
+    } else {
+      const headers = await buildHttpHeaders(upstream, secrets, { forceOAuthRefresh, passthroughAuthorizationHeader });
+      const capturingFetch = async (url, init) => {
+        const response = await fetch(url, init);
+        const wwwAuth = response.headers.get("www-authenticate");
+        if (wwwAuth) {
+          if (!runtime.lastWwwAuthenticate) {
+            runtime.lastWwwAuthenticate = new Map;
+          }
+          runtime.lastWwwAuthenticate.set(upstream.name, wwwAuth);
+        }
+        return response;
+      };
+      transport = new StreamableHTTPClientTransport(new URL2(upstream.spec.url), { requestInit: { headers }, fetch: capturingFetch });
+    }
+    const client = new Client({ name: "mcpx", version: SERVER_VERSION });
     await withTimeout(client.connect(transport), DEFAULT_CONNECT_TIMEOUT_MS, `Upstream ${upstream.name} failed to connect within ${DEFAULT_CONNECT_TIMEOUT_MS}ms.`);
-    return {
-      fingerprint,
-      client,
-      transport
-    };
+    return { fingerprint, client, transport };
   })();
-  runtime.stdioConnections.set(upstream.name, {
-    fingerprint,
-    promise
-  });
+  runtime.upstreamConnections.set(cacheKey, { fingerprint, promise });
   try {
     return await promise;
   } catch (error) {
-    runtime.stdioConnections.delete(upstream.name);
+    runtime.upstreamConnections.delete(cacheKey);
     throw error;
   }
 }
-async function callStdioUpstream(upstream, method, params, secrets, runtime) {
+async function callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, forceOAuthRefresh) {
+  const hasOAuth = upstream.spec.transport === "http" && Object.values(upstream.spec.headers ?? {}).some(isOAuthReference);
   try {
-    const connection = await getStdioConnection(upstream, secrets, runtime);
+    const connection = await getUpstreamConnection(upstream, secrets, runtime, {
+      forceOAuthRefresh,
+      passthroughAuthorizationHeader
+    });
     const timeoutMs = getConfiguredTimeoutMs();
     const timeoutMessage = `Upstream ${upstream.name} timed out after ${timeoutMs}ms for method ${method}.`;
     if (method === "tools/list") {
@@ -2838,161 +2870,17 @@ async function callStdioUpstream(upstream, method, params, secrets, runtime) {
     if (method === "prompts/get") {
       return withTimeout(connection.client.getPrompt(params), timeoutMs, timeoutMessage);
     }
-    throw new Error(`Unsupported stdio passthrough method: ${method}`);
+    throw new Error(`Unsupported method: ${method}`);
   } catch (error) {
-    invalidateStdioConnection(upstream.name, runtime);
-    throw error;
-  }
-}
-async function callHttpUpstream(upstream, method, params, id, secrets, passthroughAuthorizationHeader) {
-  return callHttpUpstreamOnce(upstream, method, params, id, secrets, passthroughAuthorizationHeader, false);
-}
-async function callHttpUpstreamOnce(upstream, method, params, id, secrets, passthroughAuthorizationHeader, forceOAuthRefresh) {
-  const headers = {
-    "content-type": "application/json",
-    accept: "application/json, text/event-stream"
-  };
-  for (const [key, value] of Object.entries(upstream.spec.headers ?? {})) {
-    if (key.toLowerCase() === "authorization" && isOAuthReference(value)) {
-      const oauthServerName = oauthReferenceServerName(value);
-      const accessToken = await getOAuthAccessToken(oauthServerName, upstream.spec, secrets, { forceRefresh: forceOAuthRefresh });
-      headers[key] = `Bearer ${accessToken}`;
-    } else {
-      headers[key] = secrets.resolveMaybeSecret(value);
+    invalidateUpstreamConnection(upstream.name, passthroughAuthorizationHeader, runtime);
+    if (!forceOAuthRefresh && hasOAuth && error instanceof StreamableHTTPError && (error.code === 401 || error.code === 403)) {
+      return callUpstreamOnce(upstream, method, params, secrets, runtime, passthroughAuthorizationHeader, true);
     }
-  }
-  if (passthroughAuthorizationHeader) {
-    headers.Authorization = passthroughAuthorizationHeader;
-  }
-  const timeoutMs = getConfiguredTimeoutMs();
-  const timeoutController = new AbortController;
-  const timeoutHandle = setTimeout(() => timeoutController.abort(), timeoutMs);
-  let response;
-  try {
-    response = await fetch(upstream.spec.url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify({
-        jsonrpc: JSON_RPC_VERSION2,
-        id,
-        method,
-        params
-      }),
-      signal: timeoutController.signal
-    });
-  } catch (error) {
-    const name = error.name;
-    if (name === "AbortError") {
-      throw new Error(`Upstream ${upstream.name} timed out after ${timeoutMs}ms for method ${method}.`);
+    if (upstream.spec.transport === "http" && error instanceof StreamableHTTPError && error.code) {
+      const wwwAuthenticate = runtime.lastWwwAuthenticate?.get(upstream.name);
+      throw new UpstreamHttpError(upstream.name, error.code, error.message ?? "", wwwAuthenticate);
     }
     throw error;
-  } finally {
-    clearTimeout(timeoutHandle);
-  }
-  if (!response.ok) {
-    const responseText = await response.text();
-    if (!forceOAuthRefresh && (response.status === 401 || response.status === 403) && Object.values(upstream.spec.headers ?? {}).some((value) => isOAuthReference(value))) {
-      return callHttpUpstreamOnce(upstream, method, params, id, secrets, passthroughAuthorizationHeader, true);
-    }
-    throw new UpstreamHttpError(upstream.name, response.status, responseText, response.headers.get("www-authenticate") ?? undefined);
-  }
-  let payload = null;
-  const contentType = response.headers.get("content-type") ?? "";
-  if (contentType.includes("application/json")) {
-    payload = JSON.parse(await response.text());
-  } else if (contentType.includes("text/event-stream")) {
-    payload = await readSseJsonRpcResponse(response, id);
-  } else {
-    try {
-      payload = JSON.parse(await response.text());
-    } catch {
-      payload = null;
-    }
-  }
-  if (!payload) {
-    throw new Error(`Upstream ${upstream.name} response could not be parsed as JSON-RPC payload.`);
-  }
-  if (payload.error) {
-    throw new Error(`Upstream ${upstream.name} error: ${payload.error.message}`);
-  }
-  return payload.result;
-}
-async function readSseJsonRpcResponse(response, expectedId) {
-  if (!response.body) {
-    return null;
-  }
-  const decoder = new TextDecoder;
-  const reader = response.body.getReader();
-  let buffer = "";
-  let dataLines = [];
-  let latestPayload = null;
-  const consumeEvent = () => {
-    if (dataLines.length === 0) {
-      return null;
-    }
-    const combined = dataLines.join(`
-`).trim();
-    dataLines = [];
-    if (!combined || combined === "[DONE]") {
-      return null;
-    }
-    try {
-      const parsed = JSON.parse(combined);
-      latestPayload = parsed;
-      const parsedId = parsed.id ?? null;
-      if (parsedId === expectedId) {
-        return parsed;
-      }
-      return null;
-    } catch {
-      return null;
-    }
-  };
-  try {
-    while (true) {
-      const { value, done } = await reader.read();
-      if (done) {
-        break;
-      }
-      buffer += decoder.decode(value, { stream: true });
-      while (true) {
-        const newlineIndex = buffer.indexOf(`
-`);
-        if (newlineIndex < 0) {
-          break;
-        }
-        let line = buffer.slice(0, newlineIndex);
-        buffer = buffer.slice(newlineIndex + 1);
-        if (line.endsWith("\r")) {
-          line = line.slice(0, -1);
-        }
-        if (line.startsWith("data:")) {
-          dataLines.push(line.slice("data:".length).trimStart());
-          continue;
-        }
-        if (line === "") {
-          const matched = consumeEvent();
-          if (matched) {
-            return matched;
-          }
-        }
-      }
-    }
-    buffer += decoder.decode();
-    if (buffer.length > 0) {
-      let finalLine = buffer;
-      if (finalLine.endsWith("\r")) {
-        finalLine = finalLine.slice(0, -1);
-      }
-      if (finalLine.startsWith("data:")) {
-        dataLines.push(finalLine.slice("data:".length).trimStart());
-      }
-    }
-    return consumeEvent() ?? latestPayload;
-  } finally {
-    try {
-      await reader.cancel();
-    } catch {}
   }
 }
 function authHeaderIsValid(request, expectedToken) {
@@ -3255,7 +3143,7 @@ async function handleRequestObject(request, secrets, runtime, upstreamFilter, cl
   if (upstreamFilter && listUpstreams(config, upstreamFilter).length === 0) {
     return makeError(id, -32602, `Unknown upstream: ${upstreamFilter}`);
   }
-  await reconcileStdioConnections(config, runtime);
+  await reconcileUpstreamConnections(config, runtime);
   if (request.method === "custom/tokenCounts") {
     const result = await getUpstreamTokenCounts(config, secrets, runtime);
     return makeResult(id, result);
@@ -3351,7 +3239,7 @@ async function maybeHandleWellKnownOAuthRequest(request, response, requestUrl, s
 function createGatewayServer(options) {
   const debug = process.env.MCPX_GATEWAY_DEBUG === "1";
   const runtime = {
-    stdioConnections: new Map,
+    upstreamConnections: new Map,
     upstreamErrors: new Map
   };
   const server = http2.createServer(async (request, response) => {
@@ -3517,10 +3405,10 @@ function createGatewayServer(options) {
     }
   });
   server.on("close", () => {
-    for (const entry of runtime.stdioConnections.values()) {
-      closeStdioConnection(entry);
+    for (const entry of runtime.upstreamConnections.values()) {
+      closeUpstreamConnection(entry);
     }
-    runtime.stdioConnections.clear();
+    runtime.upstreamConnections.clear();
   });
   server.listen(options.port, "127.0.0.1");
   return server;

package/dist/cli.js

@@ -38,7 +38,7 @@ import {
   stopDaemon,
   syncAllClients,
   toSecretRef
-} from "./cli-p2mah4z3.js";
+} from "./cli-7k3vf6tg.js";
 import {
   loadConfig,
   loadMergedConfig,

package/dist/core/index.js

@@ -41,7 +41,7 @@ import {
   stopDaemon,
   syncAllClients,
   toSecretRef
-} from "../cli-p2mah4z3.js";
+} from "../cli-7k3vf6tg.js";
 import {
   defaultConfig,
   loadConfig,

package/dist/gateway/server.d.ts

@@ -1,6 +1,7 @@
 import http from "node:http";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { SecretsManager } from "../core/secrets.js";
 import type { McpxConfig, UpstreamTokenCount } from "../types.js";
 interface GatewayServerOptions {
@@ -8,22 +9,23 @@ interface GatewayServerOptions {
     expectedToken: string;
     secrets: SecretsManager;
 }
-interface StdioConnection {
+interface UpstreamConnection {
     fingerprint: string;
     client: Client;
-    transport: StdioClientTransport;
+    transport: StdioClientTransport | StreamableHTTPClientTransport;
 }
-interface StdioConnectionEntry {
+interface UpstreamConnectionEntry {
     fingerprint: string;
-    promise: Promise<StdioConnection>;
+    promise: Promise<UpstreamConnection>;
 }
 interface GatewayRuntimeState {
-    stdioConnections: Map<string, StdioConnectionEntry>;
+    upstreamConnections: Map<string, UpstreamConnectionEntry>;
     tokenCache?: Map<string, {
         fingerprint: string;
         count: UpstreamTokenCount;
     }>;
     upstreamErrors?: Map<string, string>;
+    lastWwwAuthenticate?: Map<string, string>;
 }
 export declare function getUpstreamTokenCounts(config: McpxConfig, secrets: SecretsManager, runtime: GatewayRuntimeState): Promise<Record<string, UpstreamTokenCount>>;
 export declare function createGatewayServer(options: GatewayServerOptions): http.Server;

package/dist/gateway/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/gateway/server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,oBAAoB,EAGrB,MAAM,2CAA2C,CAAC;AAInD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,KAAK,EAIV,UAAU,EAIV,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAarB,UAAU,oBAAoB;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,cAAc,CAAC;CACzB;AAED,UAAU,eAAe;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,oBAAoB,CAAC;CACjC;AAED,UAAU,oBAAoB;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;CACnC;AAED,UAAU,mBAAmB;IAC3B,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,kBAAkB,CAAA;KAAE,CAAC,CAAC;IAC7E,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAsOD,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAgE7C;AAi4BD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAAC,MAAM,CAkM9E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/gateway/server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,oBAAoB,EAGrB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,6BAA6B,EAAuB,MAAM,oDAAoD,CAAC;AAIxH,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,KAAK,EAIV,UAAU,EAIV,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAarB,UAAU,oBAAoB;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,cAAc,CAAC;CACzB;AAED,UAAU,kBAAkB;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,oBAAoB,GAAG,6BAA6B,CAAC;CACjE;AAED,UAAU,uBAAuB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACtC;AAED,UAAU,mBAAmB;IAC3B,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAC1D,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,kBAAkB,CAAA;KAAE,CAAC,CAAC;IAC7E,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AA2ND,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAgE7C;AAuvBD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAAC,MAAM,CAkM9E"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const APP_VERSION = "0.1.85";
+export declare const APP_VERSION = "0.1.87";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kwonye/mcpx",
-  "version": "0.1.85",
+  "version": "0.1.87",
   "description": "HTTP-first MCP gateway and cross-client installer",
   "keywords": [
     "mcp",