@lenso/mcp 0.2.0 → 0.3.0

package/dist/index.js

@@ -1,16 +1,16 @@
 // @bun
 // src/index.ts
-import { Console } from "console";
+import { Console as Console2 } from "console";
 import { join, resolve } from "path";
-import { Writable } from "stream";
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { Writable as Writable2 } from "stream";
+import { Server as Server3 } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport as StdioServerTransport2 } from "@modelcontextprotocol/sdk/server/stdio.js";
 import {
-  CallToolRequestSchema,
-  ErrorCode,
-  ListToolsRequestSchema,
-  McpError,
-  ToolSchema
+  CallToolRequestSchema as CallToolRequestSchema2,
+  ErrorCode as ErrorCode4,
+  ListToolsRequestSchema as ListToolsRequestSchema2,
+  McpError as McpError4,
+  ToolSchema as ToolSchema2
 } from "@modelcontextprotocol/sdk/types.js";
 import { invoke, CliError, diagnostic } from "@lenso/cli";
 import { readApplication } from "@lenso/engine/application";
@@ -19,22 +19,870 @@ import {
   redactOperationDescription,
   validateOperations
 } from "@lenso/engine/operations";
-import { environmentSecrets, redact, stableJson } from "@lenso/engine/diagnostics";
-var serving = false;
-function failure(code, phase, message) {
+import { environmentSecrets as environmentSecrets2, redact as redact2, stableJson } from "@lenso/engine/diagnostics";
+
+// src/borrowed-stdio.ts
+import { Console } from "console";
+import { Writable } from "stream";
+import { finished } from "stream/promises";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  ErrorCode as ErrorCode3,
+  McpError as McpError3,
+  isJSONRPCErrorResponse,
+  isJSONRPCRequest,
+  isJSONRPCResultResponse
+} from "@modelcontextprotocol/sdk/types.js";
+import { environmentSecrets, redact } from "@lenso/engine/diagnostics";
+
+// src/adapter.ts
+import { createAgentTools, createManageAdapter } from "@lenso/manage";
+import {
+  boundedJson
+} from "@lenso/engine/operations";
+import { EngineError } from "@lenso/engine/diagnostics";
+import {
+  ErrorCode,
+  McpError,
+  ToolSchema
+} from "@modelcontextprotocol/sdk/types.js";
+var messages = {
+  "invalid-input": "Input does not satisfy the operation schema.",
+  "input-too-large": "Operation input exceeds the host limit.",
+  "output-too-large": "Operation output exceeds the host limit.",
+  "serialization-failed": "Operation did not return finite JSON.",
+  "confirmation-required": "Required confirmation is unavailable.",
+  "approval-required": "Required approval is unavailable.",
+  "missing-context-binding": "Required operation context is unavailable.",
+  "forbidden-operation": "Operation is not available to this caller.",
+  "unavailable-operation": "Operation is unavailable.",
+  "invocation-failed": "Operation invocation failed.",
+  "request-cancelled": "Request cancelled; external effects may have occurred.",
+  "request-timeout": "Request timed out; work may continue and external effects may have occurred.",
+  "adapter-busy": "Adapter is busy; no request was queued.",
+  "adapter-closed": "Adapter is closed.",
+  UNAUTHORIZED: "Authentication required.",
+  REAUTHENTICATION_REQUIRED: "Reauthentication required.",
+  FORBIDDEN: "Access denied.",
+  SERVICE_UNAVAILABLE: "Service unavailable.",
+  "resource-not-found": "Resource not found.",
+  "not-found": "Resource not found.",
+  forbidden: "Access denied.",
+  "permission-denied": "Access denied.",
+  "authorization-denied": "Access denied.",
+  conflict: "Operation conflicts with current state.",
+  "deduplication-conflict": "Operation conflicts with current state.",
+  "invalid-key": "Invalid operation input.",
+  "invalid-task": "Invalid operation input.",
+  "invalid-options": "Invalid operation input.",
+  "too-large": "Operation exceeds the service limit.",
+  "provider-unavailable": "Service unavailable.",
+  closed: "Service unavailable.",
+  provider: "Provider operation failed.",
+  unsupported: "Operation is unsupported.",
+  aborted: "Request cancelled; external effects may have occurred."
+};
+function positive(value, fallback, min = 1) {
+  const actual = value ?? fallback;
+  if (!Number.isSafeInteger(actual) || actual < min)
+    throw new TypeError("Invalid MCP limit.");
+  return actual;
+}
+function failure(code) {
+  const safe = Object.hasOwn(messages, code) ? code : "invocation-failed";
+  const phase = safe === "invalid-input" || safe === "input-too-large" ? "input" : safe === "output-too-large" || safe === "serialization-failed" ? "output" : "invoke";
+  return {
+    isError: true,
+    content: [
+      { type: "text", text: JSON.stringify({ code: safe, phase, message: messages[safe] }) }
+    ]
+  };
+}
+async function createMcpAdapter(options) {
+  const maxInput = positive(options.maxInputBytes, 256 * 1024);
+  const maxOutput = positive(options.maxOutputBytes, 1024 * 1024, 256);
+  const maxCatalog = positive(options.maxCatalogBytes, 256 * 1024);
+  const maxConcurrent = positive(options.maxConcurrentCalls, 4);
+  const timeout = positive(options.requestTimeoutMs, 30000);
+  const operations = Object.freeze([...options.operations]);
+  const plugins = Object.freeze([...options.plugins]);
+  if ([options.binding, options.canList, options.authorize].some((fn) => typeof fn !== "function"))
+    throw new TypeError("MCP requires trusted binding, catalog and invocation policies.");
+  const canonical = createManageAdapter({
+    running: options.running,
+    plugins,
+    operations,
+    canList: () => true,
+    binding: () => {
+      throw new Error("Metadata adapter cannot invoke.");
+    },
+    maxOutputBytes: maxCatalog
+  });
+  const [catalog, agentTools] = await Promise.all([
+    canonical.catalog(),
+    createAgentTools(canonical)
+  ]);
+  const tools = agentTools.map((item, index) => {
+    const operation = catalog[index];
+    const tool = {
+      name: item.name,
+      title: `${operation.pluginId}.${operation.method}`,
+      description: [
+        item.description,
+        ...operation.outputDescription ? [`Output: ${operation.outputDescription}`] : [],
+        "Cancellation signals reach host bindings. Only cooperative services interrupt; cancellation does not roll back effects."
+      ].join(`
+`),
+      inputSchema: item.inputSchema,
+      _meta: { "lenso/operation": operation },
+      execution: { taskSupport: "forbidden" },
+      annotations: {
+        readOnlyHint: operation.effect === "read",
+        destructiveHint: operation.destructive ?? true,
+        idempotentHint: operation.retry === "safe",
+        openWorldHint: true
+      }
+    };
+    if (!ToolSchema.safeParse(tool).success)
+      throw new TypeError("Operation cannot be represented as an MCP tool.");
+    return tool;
+  });
+  boundedJson({ tools }, maxCatalog);
+  let closed = false;
+  let closePromise;
+  const pending = new Set;
+  const controllers = new Set;
+  function tracked(request, action) {
+    const controller = new AbortController;
+    const signal = AbortSignal.any([request.signal, controller.signal]);
+    controllers.add(controller);
+    let timer;
+    let abort;
+    let timedOut = false;
+    const interrupted = new Promise((_, reject) => {
+      abort = () => reject(new EngineError({
+        code: timedOut ? "request-timeout" : "request-cancelled",
+        phase: "invoke",
+        message: "MCP request interrupted."
+      }));
+      signal.addEventListener("abort", abort, { once: true });
+      if (signal.aborted)
+        abort();
+      timer = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+      }, timeout);
+    });
+    const work = Promise.resolve().then(() => {
+      signal.throwIfAborted();
+      return action({ ...request, signal });
+    });
+    pending.add(work);
+    const cleanup = () => {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", abort);
+      controllers.delete(controller);
+      pending.delete(work);
+    };
+    work.then(cleanup, cleanup);
+    return Promise.race([work, interrupted]);
+  }
+  return Object.freeze({
+    async listTools(request) {
+      if (closed)
+        throw new McpError(ErrorCode.InvalidRequest, "Adapter is closed.");
+      if (pending.size >= maxConcurrent)
+        throw new McpError(ErrorCode.InternalError, "Adapter is busy.");
+      try {
+        return await tracked(request, async (context) => {
+          const visible = [];
+          for (const [index, operation] of operations.entries()) {
+            if (await options.canList(operation, context) === true)
+              visible.push(tools[index]);
+            context.signal.throwIfAborted();
+          }
+          return JSON.parse(boundedJson({ tools: visible }, maxCatalog));
+        });
+      } catch {
+        throw new McpError(ErrorCode.InternalError, "Tool discovery failed or was interrupted.");
+      }
+    },
+    async callTool(name, input, request) {
+      const match = /^operation_(0|[1-9][0-9]*)$/.exec(name);
+      if (!match || !operations[Number(match[1])])
+        throw new McpError(ErrorCode.InvalidParams, "Unknown tool.");
+      if (closed)
+        return failure("adapter-closed");
+      if (pending.size >= maxConcurrent)
+        return failure("adapter-busy");
+      if (request.signal.aborted)
+        return failure("request-cancelled");
+      try {
+        boundedJson(input, maxInput);
+      } catch (error) {
+        return failure(error instanceof EngineError && error.diagnostic.code === "output-too-large" ? "input-too-large" : "invalid-input");
+      }
+      try {
+        const value = await tracked(request, async (context) => {
+          const scoped = createManageAdapter({
+            running: options.running,
+            plugins,
+            operations,
+            maxOutputBytes: maxOutput,
+            canList: async (operation) => {
+              const visible = await options.canList(operation, context);
+              const allowed = visible === true && await options.authorize(operation, context) === true;
+              context.signal.throwIfAborted();
+              return allowed;
+            },
+            binding: async (operation, validated) => {
+              const binding = await options.binding(operation, validated, context);
+              context.signal.throwIfAborted();
+              return {
+                ...binding,
+                signal: binding.signal ? AbortSignal.any([context.signal, binding.signal]) : context.signal
+              };
+            }
+          });
+          const result = await scoped.invokeEntry(name, input);
+          context.signal.throwIfAborted();
+          return result;
+        });
+        return { content: [{ type: "text", text: boundedJson(value, maxOutput) }] };
+      } catch (error) {
+        return failure(error instanceof EngineError ? error.diagnostic.code : request.signal.aborted ? "request-cancelled" : "invocation-failed");
+      }
+    },
+    close() {
+      if (closePromise)
+        return closePromise;
+      closed = true;
+      for (const controller of controllers)
+        controller.abort();
+      closePromise = Promise.allSettled(pending).then(() => {});
+      return closePromise;
+    }
+  });
+}
+
+// src/protocol.ts
+import {
+  CallToolRequestSchema,
+  CancelledNotificationSchema,
+  ErrorCode as ErrorCode2,
+  ListToolsRequestSchema,
+  McpError as McpError2
+} from "@modelcontextprotocol/sdk/types.js";
+function bindMcpServer(server, adapter, evidence) {
+  const cancellations = new Map;
+  const prepare = (requestId) => {
+    const controller = new AbortController;
+    cancellations.set(requestId, controller);
+    return () => {
+      if (cancellations.get(requestId) === controller)
+        cancellations.delete(requestId);
+    };
+  };
+  const dispatch = async (extra, action) => {
+    const controller = cancellations.get(extra.requestId) ?? new AbortController;
+    cancellations.set(extra.requestId, controller);
+    try {
+      const request = evidence(extra);
+      return await action({
+        ...request,
+        signal: AbortSignal.any([extra.signal, controller.signal])
+      });
+    } finally {
+      cancellations.delete(extra.requestId);
+    }
+  };
+  server.setNotificationHandler(CancelledNotificationSchema, (notification) => {
+    if (notification.params.requestId !== undefined)
+      cancellations.get(notification.params.requestId)?.abort();
+  });
+  server.setRequestHandler(ListToolsRequestSchema, (_request, extra) => dispatch(extra, (context) => adapter.listTools(context)));
+  server.setRequestHandler(CallToolRequestSchema, (request, extra) => {
+    if (request.params.task)
+      throw new McpError2(ErrorCode2.InvalidParams, "Task-augmented calls are not supported.");
+    return dispatch(extra, (context) => adapter.callTool(request.params.name, request.params.arguments ?? {}, context));
+  });
+  return {
+    prepare,
+    finish: (requestId) => {
+      cancellations.delete(requestId);
+    }
+  };
+}
+
+// src/borrowed-stdio.ts
+var stdioOwned = false;
+function acquireStdioOwnership() {
+  if (stdioOwned)
+    throw new TypeError("Only one stdio adapter may own this process.");
+  stdioOwned = true;
+  let released = false;
+  return () => {
+    if (released)
+      return;
+    released = true;
+    stdioOwned = false;
+  };
+}
+async function serveBorrowedStdio(options) {
+  const maxFrame = options.maxFrameBytes ?? 1024 * 1024;
+  if (!Number.isSafeInteger(maxFrame) || maxFrame < 1)
+    throw new TypeError("Invalid MCP limit.");
+  const release = acquireStdioOwnership();
+  const originalConsole = globalThis.console;
+  let identity;
+  const logs = new Writable({
+    write(chunk, _encoding, done) {
+      process.stderr.write(String(redact(chunk.toString(), environmentSecrets())), done);
+    }
+  });
+  let adapter;
+  let server;
+  let transport;
+  let closing = false;
+  let closePromise;
+  const close = () => {
+    if (closePromise)
+      return closePromise;
+    closing = true;
+    closePromise = Promise.resolve().then(async () => {
+      const errors = [];
+      try {
+        try {
+          await adapter?.close();
+        } catch (error) {
+          errors.push(error);
+        }
+        try {
+          await server?.close();
+        } catch (error) {
+          errors.push(error);
+        }
+        try {
+          await transport?.close();
+        } catch (error) {
+          errors.push(error);
+        }
+      } finally {
+        process.stdin.off("end", onEnd);
+        process.off("SIGINT", onEnd);
+        process.off("SIGTERM", onEnd);
+        globalThis.console = originalConsole;
+        try {
+          logs.end();
+          await finished(logs);
+        } catch (error) {
+          errors.push(error);
+        }
+        release();
+      }
+      if (errors.length)
+        throw new AggregateError(errors, "MCP close failed.");
+    });
+    return closePromise;
+  };
+  const onEnd = () => {
+    close().catch(() => {
+      process.exitCode = 1;
+    });
+  };
+  const context = () => {
+    if (closing)
+      throw new McpError3(ErrorCode3.InvalidRequest, "Adapter is shutting down.");
+    return { identity, requestId: crypto.randomUUID() };
+  };
+  try {
+    identity = options.identity;
+    globalThis.console = Object.assign(new Console({ stdout: logs, stderr: logs }), {
+      write(...values) {
+        const text = values.map((value) => typeof value === "string" ? value : Buffer.from(ArrayBuffer.isView(value) ? new Uint8Array(value.buffer, value.byteOffset, value.byteLength) : new Uint8Array(value)).toString()).join("");
+        logs.write(text);
+        return Buffer.byteLength(text);
+      }
+    });
+    for (const level of [
+      "log",
+      "info",
+      "warn",
+      "error",
+      "debug",
+      "dir",
+      "dirxml",
+      "table",
+      "trace"
+    ]) {
+      globalThis.console[level] = (...values) => {
+        const safe = values.map((value) => value instanceof Error ? "[Application error text omitted]" : redact(value, environmentSecrets()));
+        logs.write(`${safe.map((value) => typeof value === "string" ? value : JSON.stringify(value)).join(" ")}
+`);
+      };
+    }
+    globalThis.console.assert = (condition, ...values) => {
+      if (!condition)
+        globalThis.console.error("Assertion failed:", ...values);
+    };
+    adapter = await createMcpAdapter(options);
+    const borrowed = adapter;
+    server = new Server({ name: "lenso", version: "0.2.1" }, { capabilities: { tools: {} } });
+    const protocol = bindMcpServer(server, borrowed, context);
+    server.onerror = () => {
+      process.stderr.write(`MCP protocol error (details omitted).
+`);
+    };
+    server.onclose = onEnd;
+    process.stdin.once("end", onEnd);
+    process.on("SIGINT", onEnd);
+    process.on("SIGTERM", onEnd);
+    transport = new StdioServerTransport(process.stdin, process.stdout, {
+      maxBufferSize: maxFrame
+    });
+    await server.connect(transport);
+    const incoming = transport.onmessage;
+    transport.onmessage = (message) => {
+      if (isJSONRPCRequest(message) && (message.method === "tools/list" || message.method === "tools/call"))
+        protocol.prepare(message.id);
+      incoming?.(message);
+    };
+    const send = transport.send.bind(transport);
+    transport.send = async (message) => {
+      try {
+        await send(message);
+      } finally {
+        if ((isJSONRPCResultResponse(message) || isJSONRPCErrorResponse(message)) && message.id !== undefined)
+          protocol.finish(message.id);
+      }
+    };
+    if (process.stdin.readableEnded)
+      onEnd();
+    if (closing) {
+      await close();
+      throw new McpError3(ErrorCode3.InvalidRequest, "Adapter closed during startup.");
+    }
+    return Object.freeze({ close });
+  } catch (error) {
+    try {
+      await close();
+    } catch (closeError) {
+      throw new AggregateError([error, closeError], "MCP startup and close failed.", {
+        cause: closeError
+      });
+    }
+    throw error;
+  }
+}
+// src/http.ts
+import { Server as Server2 } from "@modelcontextprotocol/sdk/server/index.js";
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import {
+  SUPPORTED_PROTOCOL_VERSIONS,
+  isInitializeRequest
+} from "@modelcontextprotocol/sdk/types.js";
+function positive2(value, fallback) {
+  const result = value ?? fallback;
+  if (!Number.isSafeInteger(result) || result < 1)
+    throw new TypeError("Invalid MCP limit.");
+  return result;
+}
+function trustedUrl(value) {
+  const url = new URL(value);
+  const loopback = ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.hash || url.search)
+    throw new TypeError("MCP URLs require HTTPS (HTTP only on loopback), without credentials, query or fragment.");
+  return url;
+}
+function reply(status, code, headers) {
+  return Response.json({ error: code }, { status, headers: { "cache-control": "no-store", ...headers } });
+}
+async function readBody(request, maxBytes, signal) {
+  const declared = request.headers.get("content-length");
+  if (declared && (!/^\d+$/.test(declared) || Number(declared) > maxBytes))
+    throw new RangeError("Body limit.");
+  const reader = request.body?.getReader();
+  if (!reader)
+    throw new SyntaxError("Missing body.");
+  const chunks = [];
+  let size = 0;
+  const abort = () => {
+    reader.cancel().catch(() => {});
+  };
+  signal.addEventListener("abort", abort, { once: true });
+  try {
+    while (true) {
+      signal.throwIfAborted();
+      const { value, done } = await reader.read();
+      signal.throwIfAborted();
+      if (done)
+        break;
+      size += value.byteLength;
+      if (size > maxBytes)
+        throw new RangeError("Body limit.");
+      chunks.push(value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } finally {
+    signal.removeEventListener("abort", abort);
+    reader.cancel().catch(() => {});
+    reader.releaseLock();
+  }
+}
+async function protocolResponse(response, maxBytes, signal) {
+  if (!response.body)
+    return response;
+  const reader = response.body.getReader();
+  const abort = () => {
+    reader.cancel().catch(() => {});
+  };
+  signal.addEventListener("abort", abort, { once: true });
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      signal.throwIfAborted();
+      const { value, done } = await reader.read();
+      signal.throwIfAborted();
+      if (done)
+        break;
+      size += value.byteLength;
+      if (size > maxBytes)
+        return reply(500, "response-too-large");
+      chunks.push(value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    const text = new TextDecoder().decode(bytes);
+    const frames = response.headers.get("content-type")?.startsWith("text/event-stream") ? text.split(`
+`).filter((line) => line.startsWith("data: ")).map((line) => line.slice(6)) : [text];
+    if (frames.length !== 1)
+      return reply(500, "invalid-protocol-response");
+    const payload = JSON.parse(frames[0]);
+    if (payload && typeof payload === "object" && payload.error)
+      payload.error = { code: payload.error.code, message: "MCP request rejected." };
+    const headers = new Headers(response.headers);
+    headers.delete("content-length");
+    headers.set("content-type", "application/json");
+    headers.set("cache-control", "no-store");
+    if (Buffer.byteLength(JSON.stringify(payload)) > maxBytes)
+      return reply(500, "response-too-large");
+    return Response.json(payload, { status: response.status, headers });
+  } finally {
+    signal.removeEventListener("abort", abort);
+    reader.cancel().catch(() => {});
+    reader.releaseLock();
+  }
+}
+async function createHttpMcp(options) {
+  const resource = trustedUrl(options.resource);
+  if (!options.authorizationServers.length)
+    throw new TypeError("An authorization server is required.");
+  const issuers = options.authorizationServers.map((value) => {
+    trustedUrl(value);
+    return value;
+  });
+  const origins = new Set(options.allowedOrigins.map((value) => {
+    const url = trustedUrl(value);
+    if (url.href !== `${url.origin}/`)
+      throw new TypeError("Allowed origins must be origins.");
+    return url.origin;
+  }));
+  const scopes = [...options.requiredScopes];
+  if (scopes.some((scope) => !/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(scope)))
+    throw new TypeError("Invalid OAuth scope.");
+  if (typeof options.verifyToken !== "function")
+    throw new TypeError("A trusted verifier is required.");
+  const metadataUrl = new URL(`/.well-known/oauth-protected-resource${resource.pathname}`, resource);
+  const metadata = {
+    resource: resource.href,
+    authorization_servers: issuers,
+    scopes_supported: scopes,
+    bearer_methods_supported: ["header"]
+  };
+  const maxFrame = positive2(options.maxFrameBytes, 1024 * 1024);
+  const maxHttp = positive2(options.maxHttpRequests, 32);
+  const maxSessions = positive2(options.maxSessions, 128);
+  const idleMs = positive2(options.sessionIdleMs, 5 * 60000);
+  const timeoutMs = positive2(options.requestTimeoutMs, 30000);
+  const maxResponse = positive2(options.maxResponseBytes, 2 * 1024 * 1024 + 4096);
+  if (maxResponse < 256)
+    throw new TypeError("MCP response budget must fit a safe error.");
+  if (Buffer.byteLength(JSON.stringify(metadata)) > positive2(options.maxCatalogBytes, 256 * 1024))
+    throw new TypeError("MCP metadata exceeds the catalog budget.");
+  const rate = {
+    requests: positive2(options.rateLimit?.requests, 120),
+    windowMs: positive2(options.rateLimit?.windowMs, 60000),
+    maxIdentities: positive2(options.rateLimit?.maxIdentities, 1024)
+  };
+  const adapter = await createMcpAdapter(options);
+  const sessions = new Map;
+  const buckets = new Map;
+  const active = new Set;
+  const controllers = new Set;
+  let closing = false;
+  let reservations = 0;
+  let closePromise;
+  const challenge = (error) => ({
+    "www-authenticate": `Bearer resource_metadata="${metadataUrl.href}", scope="${scopes.join(" ")}"${error ? `, error="${error}"` : ""}`
+  });
+  const retire = async (session) => {
+    if (session.transport.sessionId)
+      sessions.delete(session.transport.sessionId);
+    await session.server.close();
+  };
+  const sweep = async () => {
+    const now = Date.now();
+    for (const [key, bucket] of buckets)
+      if (bucket.reset <= now)
+        buckets.delete(key);
+    for (const session of sessions.values())
+      if (!session.active && now - session.lastUsed > idleMs)
+        await retire(session);
+  };
+  const startSession = async (owner) => {
+    const transport = new WebStandardStreamableHTTPServerTransport({
+      sessionIdGenerator: () => crypto.randomUUID(),
+      enableJsonResponse: false,
+      maxRequestBodySize: maxFrame,
+      keepAliveMs: 0,
+      onsessioninitialized: (id) => {
+        sessions.set(id, session);
+      },
+      onsessionclosed: () => retire(session)
+    });
+    const server = new Server2({ name: "lenso", version: "0.2.1" }, { capabilities: { tools: {} } });
+    const protocol = bindMcpServer(server, adapter, (extra) => {
+      const request = extra.authInfo?.extra?.lenso;
+      if (!request)
+        throw new Error("Missing trusted MCP request context.");
+      return request;
+    });
+    const session = {
+      owner,
+      server,
+      transport,
+      protocol,
+      ids: new Set,
+      lastUsed: Date.now(),
+      active: 0
+    };
+    try {
+      await server.connect(transport);
+      return session;
+    } catch (error) {
+      await server.close();
+      throw error;
+    }
+  };
+  const handle = async (request, controller) => {
+    const url = new URL(request.url);
+    if (url.origin !== resource.origin)
+      return reply(403, "invalid-host");
+    const host = request.headers.get("host");
+    if (host && host !== resource.host)
+      return reply(403, "invalid-host");
+    const origin = request.headers.get("origin");
+    if (origin && !origins.has(origin))
+      return reply(403, "invalid-origin");
+    if (url.pathname === metadataUrl.pathname && request.method === "GET")
+      return Response.json(metadata, { headers: { "cache-control": "no-store" } });
+    if (url.pathname !== resource.pathname || url.search)
+      return reply(404, "not-found");
+    const credential = request.headers.get("authorization");
+    const match = credential?.match(/^Bearer ([\x21-\x7E]+)$/i);
+    if (!match || match[1].length > 8192)
+      return reply(401, "unauthorized", challenge());
+    let identity;
+    try {
+      const verified = await options.verifyToken(match[1], controller.signal);
+      if (!verified || typeof verified.subject !== "string" || !verified.subject || verified.subject.length > 512 || typeof verified.tenant !== "string" || !verified.tenant || verified.tenant.length > 512 || typeof verified.issuer !== "string" || !issuers.includes(verified.issuer) || !Array.isArray(verified.audience) || !verified.audience.includes(resource.href) || !Array.isArray(verified.scopes) || verified.scopes.some((scope) => typeof scope !== "string") || !Number.isFinite(verified.expiresAt) || verified.expiresAt <= Date.now() / 1000)
+        return reply(401, "invalid-token", challenge("invalid_token"));
+      identity = Object.freeze({
+        ...verified,
+        audience: Object.freeze([...verified.audience]),
+        scopes: Object.freeze([...verified.scopes])
+      });
+    } catch {
+      return reply(401, "invalid-token", challenge("invalid_token"));
+    }
+    if (scopes.some((scope) => !identity.scopes.includes(scope)))
+      return reply(403, "insufficient-scope", challenge("insufficient_scope"));
+    controller.signal.throwIfAborted();
+    await sweep();
+    const owner = JSON.stringify([
+      identity.issuer,
+      identity.subject,
+      identity.tenant,
+      resource.href
+    ]);
+    let bucket = buckets.get(owner);
+    if (!bucket) {
+      if (buckets.size >= rate.maxIdentities)
+        return reply(429, "rate-limit-capacity");
+      bucket = { reset: Date.now() + rate.windowMs, count: 0 };
+      buckets.set(owner, bucket);
+    }
+    if (++bucket.count > rate.requests)
+      return reply(429, "rate-limited", {
+        "retry-after": String(Math.ceil((bucket.reset - Date.now()) / 1000))
+      });
+    const sessionId = request.headers.get("mcp-session-id");
+    let session = sessionId ? sessions.get(sessionId) : undefined;
+    if (sessionId && (!session || session.owner !== owner))
+      return reply(404, "session-not-found");
+    if (request.method === "GET") {
+      const version = request.headers.get("mcp-protocol-version");
+      if (version && !SUPPORTED_PROTOCOL_VERSIONS.includes(version))
+        return reply(400, "unsupported-protocol");
+      return reply(405, "standalone-stream-not-supported", { allow: "POST, DELETE" });
+    }
+    if (request.method !== "POST" && request.method !== "DELETE")
+      return reply(405, "method-not-allowed", { allow: "POST, DELETE" });
+    let body;
+    if (request.method === "POST") {
+      try {
+        body = await readBody(request, maxFrame, controller.signal);
+      } catch (error) {
+        return reply(error instanceof RangeError ? 413 : 400, error instanceof RangeError ? "request-too-large" : "invalid-request");
+      }
+      if (!body || typeof body !== "object" || Array.isArray(body))
+        return reply(400, "invalid-request");
+    }
+    if (!session) {
+      controller.signal.throwIfAborted();
+      if (!isInitializeRequest(body))
+        return reply(400, "session-required");
+      if (sessions.size + reservations >= maxSessions)
+        return reply(503, "session-capacity");
+      reservations++;
+      try {
+        session = await startSession(owner);
+      } catch (error) {
+        reservations--;
+        throw error;
+      }
+    }
+    const id = body && typeof body === "object" && "id" in body ? JSON.stringify(body.id) : undefined;
+    if (id && session.ids.has(id))
+      return reply(409, "duplicate-request");
+    if (id)
+      session.ids.add(id);
+    session.active++;
+    session.lastUsed = Date.now();
+    const selected = session;
+    const release = body && typeof body === "object" && "method" in body && (body.method === "tools/call" || body.method === "tools/list") && "id" in body && (typeof body.id === "string" || typeof body.id === "number") ? session.protocol.prepare(body.id) : () => {};
+    const abort = () => {
+      retire(selected).catch(() => {});
+    };
+    controller.signal.addEventListener("abort", abort, { once: true });
+    try {
+      controller.signal.throwIfAborted();
+      const transportResponse = session.transport.handleRequest(request, {
+        parsedBody: body,
+        authInfo: {
+          token: "",
+          clientId: identity.subject,
+          scopes: [...identity.scopes],
+          expiresAt: identity.expiresAt,
+          resource,
+          extra: { lenso: { identity, requestId: crypto.randomUUID() } }
+        }
+      }).then((response) => protocolResponse(response, maxResponse, controller.signal));
+      let interrupt = () => {};
+      const interrupted = new Promise((resolve) => {
+        interrupt = () => resolve(reply(504, "request-interrupted"));
+        controller.signal.addEventListener("abort", interrupt, { once: true });
+        if (controller.signal.aborted)
+          interrupt();
+      });
+      let response;
+      try {
+        response = await Promise.race([transportResponse, interrupted]);
+      } finally {
+        controller.signal.removeEventListener("abort", interrupt);
+      }
+      if (!session.transport.sessionId)
+        await retire(session);
+      return response;
+    } finally {
+      release();
+      controller.signal.removeEventListener("abort", abort);
+      if (id)
+        selected.ids.delete(id);
+      selected.active--;
+      selected.lastUsed = Date.now();
+      if (!sessionId) {
+        reservations--;
+        if (!selected.transport.sessionId || controller.signal.aborted)
+          await retire(selected);
+      }
+    }
+  };
+  const fetch = (request) => {
+    if (closing)
+      return Promise.resolve(reply(503, "adapter-closed"));
+    if (active.size >= maxHttp)
+      return Promise.resolve(reply(503, "adapter-busy"));
+    const controller = new AbortController;
+    controllers.add(controller);
+    let timer;
+    const interrupted = new Promise((resolve) => {
+      controller.signal.addEventListener("abort", () => resolve(reply(504, "request-interrupted")), { once: true });
+      timer = setTimeout(() => controller.abort(), timeoutMs + 1000);
+    });
+    const execution = handle(request, controller).catch(() => reply(500, "mcp-failed"));
+    active.add(execution);
+    execution.finally(() => {
+      active.delete(execution);
+      controllers.delete(controller);
+      clearTimeout(timer);
+    });
+    return Promise.race([execution, interrupted]);
+  };
+  const close = () => {
+    if (closePromise)
+      return closePromise;
+    closing = true;
+    closePromise = (async () => {
+      for (const controller of controllers)
+        controller.abort();
+      await adapter.close();
+      await Promise.all([...sessions.values()].map(retire));
+      await Promise.all(active);
+      buckets.clear();
+    })();
+    return closePromise;
+  };
+  return Object.freeze({ fetch, close });
+}
+
+// src/index.ts
+function failure2(code, phase, message) {
   return new CliError({ code, phase, message });
 }
 function limit(value, fallback) {
   const bytes = value ?? fallback;
   if (!Number.isSafeInteger(bytes) || bytes < 1)
-    throw failure("invalid-arguments", "arguments", "Limits must be positive safe integers.");
+    throw failure2("invalid-arguments", "arguments", "Limits must be positive safe integers.");
   return bytes;
 }
 function result(data, maxBytes) {
   stableJson(data);
-  const text = stableJson(redact(data, environmentSecrets()));
+  const text = stableJson(redact2(data, environmentSecrets2()));
   if (Buffer.byteLength(text) > maxBytes)
-    throw failure("output-too-large", "output", "Operation output exceeds the host limit.");
+    throw failure2("output-too-large", "output", "Operation output exceeds the host limit.");
   return { content: [{ type: "text", text }] };
 }
 var oversizedDiagnostic = stableJson({
@@ -46,14 +894,14 @@ function errorResult(error, maxBytes) {
   let text;
   try {
     const detail = diagnostic(error);
-    text = stableJson(redact(detail, environmentSecrets()));
+    text = stableJson(redact2(detail, environmentSecrets2()));
     if (Buffer.byteLength(text) > maxBytes) {
-      text = stableJson(redact({
+      text = stableJson(redact2({
         code: detail.code,
         phase: detail.phase,
         message: "Diagnostic truncated to the host output limit.",
         truncated: true
-      }, environmentSecrets()));
+      }, environmentSecrets2()));
     }
   } catch {
     text = stableJson({
@@ -67,22 +915,25 @@ function errorResult(error, maxBytes) {
   return { isError: true, content: [{ type: "text", text }] };
 }
 async function serveStdio(options) {
-  if (serving)
-    throw failure("invalid-arguments", "arguments", "Only one stdio adapter may own this process.");
   const root = resolve(options.root);
   const maxInput = limit(options.maxInputBytes, 256 * 1024);
   const maxOutput = limit(options.maxOutputBytes, 1024 * 1024);
   if (maxOutput < Buffer.byteLength(oversizedDiagnostic))
-    throw failure("invalid-arguments", "arguments", "Output limit must fit a bounded diagnostic.");
+    throw failure2("invalid-arguments", "arguments", "Output limit must fit a bounded diagnostic.");
   const maxFrame = limit(options.maxFrameBytes, 1024 * 1024);
-  serving = true;
+  let releaseStdio;
+  try {
+    releaseStdio = acquireStdioOwnership();
+  } catch {
+    throw failure2("invalid-arguments", "arguments", "Only one stdio adapter may own this process.");
+  }
   const originalConsole = globalThis.console;
-  const logs = new Writable({
+  const logs = new Writable2({
     write(chunk, _encoding, done) {
-      process.stderr.write(String(redact(chunk.toString(), environmentSecrets())), done);
+      process.stderr.write(String(redact2(chunk.toString(), environmentSecrets2())), done);
     }
   });
-  globalThis.console = Object.assign(new Console({ stdout: logs, stderr: logs }), {
+  globalThis.console = Object.assign(new Console2({ stdout: logs, stderr: logs }), {
     write(...values) {
       const text = values.map((value) => typeof value === "string" ? value : Buffer.from(ArrayBuffer.isView(value) ? new Uint8Array(value.buffer, value.byteOffset, value.byteLength) : new Uint8Array(value)).toString()).join("");
       logs.write(text);
@@ -101,7 +952,7 @@ async function serveStdio(options) {
     "trace"
   ]) {
     globalThis.console[level] = (...values) => {
-      const safe = values.map((value) => value instanceof Error ? "[Application error text omitted]" : redact(value, environmentSecrets()));
+      const safe = values.map((value) => value instanceof Error ? "[Application error text omitted]" : redact2(value, environmentSecrets2()));
       logs.write(`${safe.map((value) => typeof value === "string" ? value : JSON.stringify(value)).join(" ")}
 `);
     };
@@ -116,7 +967,7 @@ async function serveStdio(options) {
   let closePromise;
   const restore = () => {
     globalThis.console = originalConsole;
-    serving = false;
+    releaseStdio();
   };
   const close = () => {
     if (closePromise)
@@ -149,15 +1000,15 @@ async function serveStdio(options) {
     for (const allowed of options.allow) {
       const key = stableJson([allowed.pluginId, allowed.method]);
       if (seen.has(key))
-        throw failure("duplicate-operation", "discovery", "Duplicate MCP allowlist entry.");
+        throw failure2("duplicate-operation", "discovery", "Duplicate MCP allowlist entry.");
       seen.add(key);
       const ref = selected.find((item) => item.plugin.id === allowed.pluginId && item.method === allowed.method);
       const operation = ref ? redactOperationDescription(describeOperation(ref, configPath)) : undefined;
       if (!operation)
-        throw failure("unknown-operation", "discovery", "MCP allowlist operation is not declared.");
+        throw failure2("unknown-operation", "discovery", "MCP allowlist operation is not declared.");
       const schema = operation.inputSchema;
       if (!schema || schema.type !== "object")
-        throw failure("unsupported-input-schema", "discovery", "MCP tools require a convertible object input schema.");
+        throw failure2("unsupported-input-schema", "discovery", "MCP tools require a convertible object input schema.");
       stableJson(schema);
       const name = `operation_${tools.length}`;
       const tool = {
@@ -179,38 +1030,38 @@ async function serveStdio(options) {
           openWorldHint: true
         }
       };
-      if (!ToolSchema.safeParse(tool).success)
-        throw failure("unsupported-input-schema", "discovery", "Operation schema cannot be represented as an MCP tool.");
+      if (!ToolSchema2.safeParse(tool).success)
+        throw failure2("unsupported-input-schema", "discovery", "Operation schema cannot be represented as an MCP tool.");
       tools.push(tool);
       bindings.set(name, { pluginId: allowed.pluginId, method: allowed.method });
     }
-    server = new Server({ name: "lenso", version: "0.1.0" }, { capabilities: { tools: {} } });
-    server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools }));
-    server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+    server = new Server3({ name: "lenso", version: "0.1.0" }, { capabilities: { tools: {} } });
+    server.setRequestHandler(ListToolsRequestSchema2, async () => ({ tools }));
+    server.setRequestHandler(CallToolRequestSchema2, async (request, extra) => {
       const binding = bindings.get(request.params.name);
       if (!binding)
-        throw new McpError(ErrorCode.InvalidParams, "Tool is not allowlisted.", {
+        throw new McpError4(ErrorCode4.InvalidParams, "Tool is not allowlisted.", {
           code: "unknown-operation"
         });
       if (request.params.task)
-        throw new McpError(ErrorCode.InvalidParams, "Task-augmented calls are not supported.");
+        throw new McpError4(ErrorCode4.InvalidParams, "Task-augmented calls are not supported.");
       if (closing)
-        return errorResult(failure("adapter-closed", "invoke", "Adapter is shutting down."), maxOutput);
+        return errorResult(failure2("adapter-closed", "invoke", "Adapter is shutting down."), maxOutput);
       if (active)
-        return errorResult(failure("adapter-busy", "invoke", "One operation is already running; no request was queued."), maxOutput);
+        return errorResult(failure2("adapter-busy", "invoke", "One operation is already running; no request was queued."), maxOutput);
       const execute = async () => {
         try {
           if (extra.signal.aborted)
-            throw failure("request-cancelled", "invoke", "Request cancelled before invocation.");
+            throw failure2("request-cancelled", "invoke", "Request cancelled before invocation.");
           const input = request.params.arguments ?? {};
           if (Buffer.byteLength(stableJson(input)) > maxInput)
-            throw failure("input-too-large", "input", "Operation input exceeds the host limit.");
+            throw failure2("input-too-large", "input", "Operation input exceeds the host limit.");
           const data = await invoke({ ...app, operations: selected, operationBinding: undefined }, binding.pluginId, binding.method, input, async (operation, validatedInput, running) => ({
             ...options.binding ? await options.binding(operation, validatedInput, running) : {},
             maxOutputBytes: maxOutput
           }));
           if (extra.signal.aborted)
-            throw failure("request-cancelled", "invoke", "Request cancelled; operation may have completed. Cleanup was awaited.");
+            throw failure2("request-cancelled", "invoke", "Request cancelled; operation may have completed. Cleanup was awaited.");
           return result(data, maxOutput);
         } catch (error) {
           return errorResult(error, maxOutput);
@@ -231,13 +1082,22 @@ async function serveStdio(options) {
     process.stdin.once("end", onEnd);
     process.on("SIGINT", onEnd);
     process.on("SIGTERM", onEnd);
-    await server.connect(new StdioServerTransport(process.stdin, process.stdout, { maxBufferSize: maxFrame }));
+    await server.connect(new StdioServerTransport2(process.stdin, process.stdout, { maxBufferSize: maxFrame }));
     return { close };
   } catch (error) {
-    await close();
+    try {
+      await close();
+    } catch (closeError) {
+      throw new AggregateError([error, closeError], "MCP startup and close failed.", {
+        cause: closeError
+      });
+    }
     throw error;
   }
 }
 export {
+  createHttpMcp,
+  createMcpAdapter,
+  serveBorrowedStdio,
   serveStdio
 };