@kya-os/mcp-i-core 1.0.0 → 1.1.1-canary.0

package/dist/utils/cors.d.ts

@@ -0,0 +1,44 @@
+/**
+ * CORS Header Utilities
+ *
+ * Centralized CORS header management for MCP-I services.
+ * Includes Vary: Origin for cache optimization when origin scoping is implemented.
+ */
+/**
+ * Type-safe CORS headers
+ * Compatible with Response headers and HeadersInit
+ */
+export type CORSHeaders = Record<string, string>;
+/**
+ * Standard CORS headers for well-known endpoints (.well-known/*)
+ * Includes Vary: Origin for future cache optimization when origin scoping is added
+ */
+export declare const WELL_KNOWN_CORS_HEADERS: CORSHeaders;
+/**
+ * CORS headers for MCP protocol responses
+ * Includes exposed headers for session management
+ */
+export declare const MCP_CORS_HEADERS: CORSHeaders;
+/**
+ * CORS preflight headers for OPTIONS requests
+ * Comprehensive header allowlist for MCP protocol
+ */
+export declare const PREFLIGHT_CORS_HEADERS: CORSHeaders;
+/**
+ * CORS headers for OAuth endpoints
+ * Includes additional headers required for OAuth 2.0 flows
+ */
+export declare const OAUTH_CORS_HEADERS: CORSHeaders;
+/**
+ * Merge CORS headers with existing headers
+ * Ensures CORS headers take precedence
+ */
+export declare function mergeCORSHeaders(existingHeaders: Record<string, string>, corsHeaders?: CORSHeaders): Record<string, string>;
+/**
+ * Apply CORS headers to an Express Response object
+ * For use with Express middleware
+ */
+export declare function applyCORSHeaders(res: {
+    setHeader: (name: string, value: string) => void;
+}, corsHeaders?: CORSHeaders): void;
+//# sourceMappingURL=cors.d.ts.map

package/dist/utils/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/utils/cors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAGrC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAI9B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAKpC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAMhC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACvC,WAAW,GAAE,WAAqC,GACjD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKxB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE;IAAE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EACzD,WAAW,GAAE,WAA8B,GAC1C,IAAI,CAMN"}

package/dist/utils/cors.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * CORS Header Utilities
+ *
+ * Centralized CORS header management for MCP-I services.
+ * Includes Vary: Origin for cache optimization when origin scoping is implemented.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAUTH_CORS_HEADERS = exports.PREFLIGHT_CORS_HEADERS = exports.MCP_CORS_HEADERS = exports.WELL_KNOWN_CORS_HEADERS = void 0;
+exports.mergeCORSHeaders = mergeCORSHeaders;
+exports.applyCORSHeaders = applyCORSHeaders;
+/**
+ * Standard CORS headers for well-known endpoints (.well-known/*)
+ * Includes Vary: Origin for future cache optimization when origin scoping is added
+ */
+exports.WELL_KNOWN_CORS_HEADERS = {
+    'Access-Control-Allow-Origin': '*',
+    'Vary': 'Origin'
+};
+/**
+ * CORS headers for MCP protocol responses
+ * Includes exposed headers for session management
+ */
+exports.MCP_CORS_HEADERS = {
+    'Access-Control-Allow-Origin': '*',
+    'Access-Control-Expose-Headers': 'mcp-session-id',
+    'Vary': 'Origin'
+};
+/**
+ * CORS preflight headers for OPTIONS requests
+ * Comprehensive header allowlist for MCP protocol
+ */
+exports.PREFLIGHT_CORS_HEADERS = {
+    'Access-Control-Allow-Origin': '*',
+    'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization, mcp-session-id, mcp-protocol-version',
+    'Vary': 'Origin'
+};
+/**
+ * CORS headers for OAuth endpoints
+ * Includes additional headers required for OAuth 2.0 flows
+ */
+exports.OAUTH_CORS_HEADERS = {
+    'Access-Control-Allow-Origin': '*',
+    'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization, Accept, mcp-protocol-version',
+    'Access-Control-Expose-Headers': 'Content-Type',
+    'Vary': 'Origin'
+};
+/**
+ * Merge CORS headers with existing headers
+ * Ensures CORS headers take precedence
+ */
+function mergeCORSHeaders(existingHeaders, corsHeaders = exports.WELL_KNOWN_CORS_HEADERS) {
+    return {
+        ...existingHeaders,
+        ...corsHeaders
+    };
+}
+/**
+ * Apply CORS headers to an Express Response object
+ * For use with Express middleware
+ */
+function applyCORSHeaders(res, corsHeaders = exports.MCP_CORS_HEADERS) {
+    Object.entries(corsHeaders).forEach(([key, value]) => {
+        if (value !== undefined) {
+            res.setHeader(key, value);
+        }
+    });
+}
+//# sourceMappingURL=cors.js.map

package/dist/utils/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/utils/cors.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAsDH,4CAQC;AAMD,4CASC;AArED;;;GAGG;AACU,QAAA,uBAAuB,GAAgB;IAClD,6BAA6B,EAAE,GAAG;IAClC,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF;;;GAGG;AACU,QAAA,gBAAgB,GAAgB;IAC3C,6BAA6B,EAAE,GAAG;IAClC,+BAA+B,EAAE,gBAAgB;IACjD,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF;;;GAGG;AACU,QAAA,sBAAsB,GAAgB;IACjD,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAAE,mEAAmE;IACnG,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF;;;GAGG;AACU,QAAA,kBAAkB,GAAgB;IAC7C,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAAE,2DAA2D;IAC3F,+BAA+B,EAAE,cAAc;IAC/C,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF;;;GAGG;AACH,SAAgB,gBAAgB,CAC9B,eAAuC,EACvC,cAA2B,+BAAuB;IAElD,OAAO;QACL,GAAG,eAAe;QAClB,GAAG,WAAW;KACf,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAC9B,GAAyD,EACzD,cAA2B,wBAAgB;IAE3C,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACnD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/utils/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Utility exports
+ */
+export * from './cors';
+//# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,QAAQ,CAAC"}

package/dist/utils/index.js

@@ -0,0 +1,21 @@
+"use strict";
+/**
+ * Utility exports
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./cors"), exports);
+//# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;AAEH,yCAAuB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp-i-core",
-  "version": "1.0.0",
+  "version": "1.1.1-canary.0",
   "description": "Core provider-based architecture for MCP-I framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -19,9 +19,12 @@
   "scripts": {
     "build": "tsc",
     "dev": "tsc --watch",
-    "test": "vitest",
     "lint": "eslint src/**/*.ts",
-    "type-check": "tsc --noEmit"
+    "type-check": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:e2e": "vitest run src/__tests__/delegation-e2e.test.ts",
+    "audit:compliance": "tsx scripts/audit-compliance.ts"
   },
   "keywords": [
     "mcp-i",
@@ -32,16 +35,18 @@
     "core"
   ],
   "dependencies": {
-    "@kya-os/contracts": "^1.2.0",
+    "@kya-os/contracts": "workspace:*",
     "@modelcontextprotocol/sdk": "^1.11.4"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
     "@typescript-eslint/eslint-plugin": "^6.0.0",
     "@typescript-eslint/parser": "^6.0.0",
+    "@vitest/coverage-v8": "^3.2.4",
     "eslint": "^8.0.0",
+    "tsx": "^4.7.0",
     "typescript": "^5.3.0",
-    "vitest": "^1.0.0"
+    "vitest": "^3.2.4"
   },
   "engines": {
     "node": ">=20.0.0"
@@ -56,4 +61,4 @@
     "url": "https://github.com/modelcontextprotocol-identity/mcp-i/issues"
   },
   "homepage": "https://github.com/modelcontextprotocol-identity/mcp-i#readme"
-}
+}