@mcpolyglot/core 0.1.0 → 0.3.0

package/dist/server.js

@@ -1,9 +1,9 @@
 import { randomUUID, createHash } from 'node:crypto';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
-import { zodToJsonSchema } from 'zod-to-json-schema';
+import { z } from 'zod';
 import { DEFAULT_SCOPES, } from './tool.js';
-import { McpolyglotError, ScopeError, TimeoutError } from './errors.js';
+import { McpolyglotError, TimeoutError } from './errors.js';
 /**
  * MCP server that wires connectors + security hooks + a transport.
  *
@@ -29,11 +29,12 @@ import { McpolyglotError, ScopeError, TimeoutError } from './errors.js';
  * ```
  */
 export class McpolyglotServer {
-    server;
+    info;
     tools = new Map();
     connectors;
     perEntity;
     scopes;
+    agents;
     security;
     sessionId = randomUUID();
     logger;
@@ -44,38 +45,51 @@ export class McpolyglotServer {
         this.scopes = new Set(opts.scopes ?? DEFAULT_SCOPES);
         this.security = opts.security;
         this.logger = opts.logger ?? makeNoopLogger();
-        this.server = new Server({ name: opts.name ?? 'mcpolyglot', version: opts.version ?? '0.0.1' }, { capabilities: { tools: {} } });
-        this.server.setRequestHandler(ListToolsRequestSchema, async () => ({
-            tools: Array.from(this.tools.values()).map((t) => ({
+        this.agents = new Map((opts.agents ?? []).map((a) => [a.id, { ...a, tools: new Map() }]));
+        this.info = { name: opts.name ?? 'mcpolyglot', version: opts.version ?? '0.0.1' };
+    }
+    /**
+     * A fresh MCP protocol server bound to this instance's tools and pipeline. Stdio makes one;
+     * the stateless HTTP transport makes one per request (the SDK forbids reusing either).
+     */
+    createMcpServer() {
+        const server = new Server(this.info, { capabilities: { tools: {} } });
+        server.setRequestHandler(ListToolsRequestSchema, async (_req, extra) => ({
+            tools: Array.from(this.caller(server, extra).tools.values()).map((t) => ({
                 name: t.name,
                 description: t.description,
-                inputSchema: zodToJsonSchema(t.inputSchema, { target: 'jsonSchema7' }),
+                inputSchema: z.toJSONSchema(t.inputSchema, { target: 'draft-7' }),
             })),
         }));
-        this.server.setRequestHandler(CallToolRequestSchema, async (req) => {
-            const def = this.tools.get(req.params.name);
+        server.setRequestHandler(CallToolRequestSchema, async (req, extra) => {
+            const caller = this.caller(server, extra);
+            const def = caller.tools.get(req.params.name);
             if (!def) {
                 throw new McpolyglotError('tool.not_found', `Unknown tool: ${req.params.name}`);
             }
-            const internal = await this.executeTool(def, req.params.arguments ?? {});
+            const internal = await this.executeTool(def, req.params.arguments ?? {}, caller);
             return toMcpResult(internal);
         });
+        return server;
     }
     async start(transport) {
-        for (const c of this.connectors) {
+        for (const c of this.allConnectors())
             await c.init({ logger: this.logger });
-            for (const tool of c.listPrimitiveTools()) {
-                this.registerTool(tool);
-            }
-            const cfg = this.perEntity[c.id];
-            if (cfg?.enabled) {
-                for (const tool of c.generatePerEntityTools(cfg)) {
-                    this.registerTool(tool);
+        for (const c of this.connectors) {
+            for (const tool of this.toolsOf(c))
+                registerTool(this.tools, tool);
+        }
+        for (const a of this.agents.values()) {
+            for (const c of a.connectors) {
+                for (const tool of this.toolsOf(c)) {
+                    // Agents only see tools their scopes fully cover.
+                    if (tool.scopes.every((s) => a.scopes.includes(s)))
+                        registerTool(a.tools, tool);
                 }
             }
         }
         this.transport = transport;
-        await transport.start(this.server);
+        await transport.start(() => this.createMcpServer());
         this.logger.info('mcpolyglot.started', {
             sessionId: this.sessionId,
             transport: transport.kind,
@@ -84,51 +98,76 @@ export class McpolyglotServer {
     }
     async stop() {
         await this.transport?.stop();
-        for (const c of this.connectors) {
+        for (const c of this.allConnectors()) {
             await c.close();
         }
-        await this.server.close();
     }
-    registerTool(tool) {
-        if (this.tools.has(tool.name)) {
-            throw new McpolyglotError('tool.duplicate', `Duplicate tool name: ${tool.name}`);
+    allConnectors() {
+        return new Set([...this.connectors, ...[...this.agents.values()].flatMap((a) => a.connectors)]);
+    }
+    toolsOf(c) {
+        const cfg = this.perEntity[c.id];
+        return [...c.listPrimitiveTools(), ...(cfg?.enabled ? c.generatePerEntityTools(cfg) : [])];
+    }
+    /**
+     * Who is calling. Only `authInfo` set by our HTTP transport identifies an agent; headers
+     * and clientInfo are client-asserted and only used as an audit label when it's absent.
+     */
+    caller(server, extra) {
+        const agent = extra.authInfo ? this.agents.get(extra.authInfo.clientId) : undefined;
+        if (agent) {
+            return {
+                agentId: agent.id,
+                scopes: new Set(agent.scopes),
+                tools: agent.tools,
+                rateKey: `agent:${agent.id}`,
+            };
         }
-        this.tools.set(tool.name, tool);
+        const header = extra.requestInfo?.headers['x-mcpolyglot-agent'];
+        return {
+            agentId: (Array.isArray(header) ? header[0] : header) ?? server.getClientVersion()?.name,
+            scopes: this.scopes,
+            tools: this.tools,
+            rateKey: this.sessionId,
+        };
     }
     /**
      * Fixed pipeline: scope check → rate limit → timeout → handler →
      * redaction → size cap → untrusted-wrap → audit log → response.
      * Connectors cannot bypass.
      */
-    async executeTool(def, rawArgs) {
+    async executeTool(def, rawArgs, caller) {
+        const { agentId, scopes } = caller;
         const started = Date.now();
         const argsHash = hashArgs(rawArgs);
         let result;
         let errorEntry;
+        let decision = 'allow';
+        let release = undefined;
         try {
             // 1. scope check
-            this.security.hooks.checkScopes(def.name, def.scopes, this.scopes);
+            this.security.hooks.checkScopes(def.name, def.scopes, scopes);
             // 2. rate limit
-            await this.security.hooks.checkRateLimit(def.name, this.sessionId);
+            release = await this.security.hooks.checkRateLimit(def.name, caller.rateKey);
             // 3. timeout
             const ac = new AbortController();
             const timer = setTimeout(() => ac.abort(), this.security.defaultLimits.timeoutMs);
             const ctx = {
                 sessionId: this.sessionId,
-                scopes: this.scopes,
+                scopes,
                 signal: ac.signal,
                 limits: this.security.defaultLimits,
                 logger: this.logger,
             };
+            // Race the handler against the timer: a handler that ignores `signal` (a sync driver,
+            // a hung socket) must still not hold the call open past the limit.
+            const timedOut = new Promise((_, reject) => ac.signal.addEventListener('abort', () => reject(new TimeoutError(`Tool ${def.name} exceeded ${ctx.limits.timeoutMs}ms`))));
             try {
                 const parsed = def.inputSchema.parse(rawArgs);
-                result = await def.handler(parsed, ctx);
+                result = await Promise.race([def.handler(parsed, ctx), timedOut]);
             }
             finally {
                 clearTimeout(timer);
-                if (ac.signal.aborted && !result) {
-                    throw new TimeoutError(`Tool ${def.name} exceeded ${ctx.limits.timeoutMs}ms`);
-                }
             }
             // 4. redaction
             const redacted = this.security.hooks.redact(def.name, result);
@@ -147,9 +186,12 @@ export class McpolyglotServer {
         catch (err) {
             const e = err;
             errorEntry = { code: e.code ?? 'internal_error', message: e.message };
-            if (err instanceof ScopeError || err instanceof TimeoutError) {
+            decision = err instanceof McpolyglotError && isPolicyRejection(err.code) ? 'deny' : 'error';
+            // Policy rejections (scope, read-only, rate limit, timeout) are tool errors the model
+            // can read and correct, not protocol failures.
+            if (err instanceof McpolyglotError && isPolicyRejection(err.code)) {
                 return {
-                    content: [{ type: 'text', text: e.message }],
+                    content: [{ type: 'text', text: `${err.code}: ${e.message}` }],
                     isError: true,
                     metadata: { durationMs: Date.now() - started },
                 };
@@ -157,12 +199,16 @@ export class McpolyglotServer {
             throw err;
         }
         finally {
+            release?.();
             await this.security.hooks.audit({
                 ts: new Date().toISOString(),
                 sessionId: this.sessionId,
+                ...(agentId ? { agentId } : {}),
                 tool: def.name,
+                decision,
+                ...(errorEntry ? { reason: errorEntry.message } : {}),
                 argsHash,
-                scopes: Array.from(this.scopes),
+                scopes: Array.from(scopes),
                 durationMs: Date.now() - started,
                 rows: result?.metadata?.rows,
                 truncated: result?.metadata?.truncated,
@@ -172,6 +218,9 @@ export class McpolyglotServer {
         }
     }
 }
+function isPolicyRejection(code) {
+    return code.startsWith('forbidden.') || code === 'rate_limited' || code === 'timeout';
+}
 function hashArgs(args) {
     return createHash('sha256')
         .update(JSON.stringify(args ?? {}))
@@ -197,4 +246,10 @@ function makeNoopLogger() {
         error: () => { },
     };
 }
+function registerTool(map, tool) {
+    if (map.has(tool.name)) {
+        throw new McpolyglotError('tool.duplicate', `Duplicate tool name: ${tool.name}`);
+    }
+    map.set(tool.name, tool);
+}
 //# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,OAAO,EAML,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAoExE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,gBAAgB;IACV,MAAM,CAAS;IACf,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC1C,UAAU,CAAc;IACxB,SAAS,CAAkC;IAC3C,MAAM,CAAa;IACnB,QAAQ,CAAmB;IAC3B,SAAS,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,CAAiD;IAChE,SAAS,CAAa;IAE9B,YAAY,IAA6B;QACvC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;QAE9C,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CACtB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,EAAE,EACrE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACjE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjD,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAGpE;aACF,CAAC,CAAC;SACJ,CAAC,CAAC,CAAC;QAEJ,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,iBAAiB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACzE,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAoB;QAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACtC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,kBAAkB,EAAE,EAAE,CAAC;gBAC1C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;gBACjB,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,SAAS,CAAC,IAAI;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;SACvB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAEO,YAAY,CAAC,IAAoB;QACvC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,wBAAwB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW,CAAC,GAAmB,EAAE,OAAgB;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,MAA8B,CAAC;QACnC,IAAI,UAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,iBAAiB;YACjB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAEnE,gBAAgB;YAChB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAEnE,aAAa;YACb,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;YAElF,MAAM,GAAG,GAAgB;gBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa;gBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC;YAEF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC9C,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC1C,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,EAAE,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;oBACjC,MAAM,IAAI,YAAY,CAAC,QAAQ,GAAG,CAAC,IAAI,aAAa,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC;YAED,eAAe;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9D,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAEzB,cAAc;YACd,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CACtC,GAAG,CAAC,IAAI,EACR,MAAM,EACN,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CACrC,CAAC;YAEF,4BAA4B;YAC5B,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAEnD,MAAM,CAAC,QAAQ,GAAG;gBAChB,GAAG,MAAM,CAAC,QAAQ;gBAClB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;aAC9C,CAAC;YAEF,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAAgC,CAAC;YAC3C,UAAU,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACtE,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;gBAC7D,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;oBAC5C,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE;iBAC/C,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;gBAC9B,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ;gBACR,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC/B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI;gBAC5B,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;gBACtC,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB;gBACtD,KAAK,EAAE,UAAU;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,IAAa;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;SAClC,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,oFAAoF;AACpF,SAAS,WAAW,CAAC,CAAa;IAIhC,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YACnE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACzE,CAAC,CAAC;QACF,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc;IACrB,OAAO;QACL,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;QACf,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;KAChB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAEnG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAML,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAqG5D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,gBAAgB;IACV,IAAI,CAAoC;IACxC,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC1C,UAAU,CAAc;IACxB,SAAS,CAAkC;IAC3C,MAAM,CAAa;IACnB,MAAM,CAAmE;IACzE,QAAQ,CAAmB;IAC3B,SAAS,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,CAAiD;IAChE,SAAS,CAAa;IAE9B,YAAY,IAA6B;QACvC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAE1F,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;IACpF,CAAC;IAED;;;OAGG;IACK,eAAe;QACrB,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAEtE,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACvE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvE,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAG/D;aACF,CAAC,CAAC;SACJ,CAAC,CAAC,CAAC;QAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,iBAAiB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACjF,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAoB;QAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE;YAAE,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAChC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnC,kDAAkD;oBAClD,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;wBAAE,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,SAAS,CAAC,IAAI;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;SACvB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YACrC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC;IAEO,OAAO,CAAC,CAAY;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,CAAC,kBAAkB,EAAE,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED;;;OAGG;IACK,MAAM,CACZ,MAAc,EACd,KAGC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;gBACL,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,MAAM,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE;aAC7B,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAChE,OAAO;YACL,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,gBAAgB,EAAE,EAAE,IAAI;YACxF,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,SAAS;SACxB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW,CACvB,GAAmB,EACnB,OAAgB,EAChB,MAAc;QAEd,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,MAA8B,CAAC;QACnC,IAAI,UAA+B,CAAC;QACpC,IAAI,QAAQ,GAA2B,OAAO,CAAC;QAC/C,IAAI,OAAO,GAAwB,SAAS,CAAC;QAE7C,IAAI,CAAC;YACH,iBAAiB;YACjB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAE9D,gBAAgB;YAChB,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAE7E,aAAa;YACb,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;YAElF,MAAM,GAAG,GAAgB;gBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM;gBACN,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa;gBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC;YAEF,sFAAsF;YACtF,mEAAmE;YACnE,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAChD,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CACvC,MAAM,CAAC,IAAI,YAAY,CAAC,QAAQ,GAAG,CAAC,IAAI,aAAa,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,CAChF,CACF,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC9C,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;YACpE,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YAED,eAAe;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9D,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAEzB,cAAc;YACd,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CACtC,GAAG,CAAC,IAAI,EACR,MAAM,EACN,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CACrC,CAAC;YAEF,4BAA4B;YAC5B,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAEnD,MAAM,CAAC,QAAQ,GAAG;gBAChB,GAAG,MAAM,CAAC,QAAQ;gBAClB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;aAC9C,CAAC;YAEF,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAAgC,CAAC;YAC3C,UAAU,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACtE,QAAQ,GAAG,GAAG,YAAY,eAAe,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5F,sFAAsF;YACtF,+CAA+C;YAC/C,IAAI,GAAG,YAAY,eAAe,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClE,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC9D,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE;iBAC/C,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;gBAC9B,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ;gBACR,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,QAAQ;gBACR,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC1B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI;gBAC5B,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;gBACtC,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB;gBACtD,KAAK,EAAE,UAAU;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,SAAS,CAAC;AACxF,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;SAClC,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,oFAAoF;AACpF,SAAS,WAAW,CAAC,CAAa;IAIhC,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YACnE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACzE,CAAC,CAAC;QACF,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc;IACrB,OAAO;QACL,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;QACf,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAgC,EAAE,IAAoB;IAC1E,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,wBAAwB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC"}

package/dist/tool.d.ts

@@ -1,4 +1,13 @@
-import type { ZodTypeAny, infer as ZodInfer } from 'zod';
+import type { z } from 'zod';
+/**
+ * Loose Zod schema type used as the default bound on `ToolDefinition` /
+ * `ToolHandler`. We deliberately type the output as `any` so a connector
+ * defining `inputSchema: z.object({ name: z.string() })` can write
+ * `handler: ({ name }) => ...` without an explicit generic — the destructure
+ * remains permissive while runtime parsing still enforces the schema.
+ */
+export type AnyZodSchema = z.ZodType<any>;
+export type ZodInfer<S extends AnyZodSchema> = z.infer<S>;
 /** Every scope mcpolyglot understands. New scopes must be added here so the Zod config schema accepts them. */
 export declare const ALL_SCOPES: readonly ["schema:read", "tables:read", "tables:write", "query:raw", "http:call"];
 /** A capability a tool requires from the calling session. Checked by `ScopeGuard`. */
@@ -55,7 +64,7 @@ export interface ToolExecCtx {
  * Handler signature for a tool. Args are pre-validated against `ToolDefinition.inputSchema`,
  * so the function receives a parsed, typed value — no defensive validation needed.
  */
-export type ToolHandler<S extends ZodTypeAny = ZodTypeAny> = (args: ZodInfer<S>, ctx: ToolExecCtx) => Promise<ToolResult>;
+export type ToolHandler<S extends AnyZodSchema = AnyZodSchema> = (args: ZodInfer<S>, ctx: ToolExecCtx) => Promise<ToolResult>;
 /**
  * The contract every connector returns from `listPrimitiveTools()` /
  * `generatePerEntityTools()`. The `handler` is the only point where the connector
@@ -75,7 +84,7 @@ export type ToolHandler<S extends ZodTypeAny = ZodTypeAny> = (args: ZodInfer<S>,
  * };
  * ```
  */
-export interface ToolDefinition<S extends ZodTypeAny = ZodTypeAny> {
+export interface ToolDefinition<S extends AnyZodSchema = AnyZodSchema> {
     /** Globally-unique tool name. By convention: `<connector.id>.<verb>`. */
     name: string;
     /** Human-readable description shown to the model in `tools/list`. */

package/dist/tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool.d.ts","sourceRoot":"","sources":["../src/tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,QAAQ,EAAE,MAAM,KAAK,CAAC;AAEzD,+GAA+G;AAC/G,eAAO,MAAM,UAAU,mFAMb,CAAC;AAEX,sFAAsF;AACtF,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhD,8EAA8E;AAC9E,eAAO,MAAM,cAAc,EAAE,SAAS,KAAK,EAAmC,CAAC;AAE/E,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,oGAAoG;AACpG,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,4GAA4G;IAC5G,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,oEAAoE;QACpE,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,kEAAkE;QAClE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,kEAAkE;QAClE,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,sGAAsG;IACtG,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,iGAAiG;IACjG,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE;QACN,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;QAC/D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;QAC9D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;QAC9D,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;KAChE,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,IAAI,CAC3D,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EACjB,GAAG,EAAE,WAAW,KACb,OAAO,CAAC,UAAU,CAAC,CAAC;AAEzB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU;IAC/D,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,mGAAmG;IACnG,WAAW,EAAE,CAAC,CAAC;IACf,8EAA8E;IAC9E,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IACzB,uFAAuF;IACvF,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;CACzB"}
+{"version":3,"file":"tool.d.ts","sourceRoot":"","sources":["../src/tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B;;;;;;GAMG;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC1C,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAE1D,+GAA+G;AAC/G,eAAO,MAAM,UAAU,mFAMb,CAAC;AAEX,sFAAsF;AACtF,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhD,8EAA8E;AAC9E,eAAO,MAAM,cAAc,EAAE,SAAS,KAAK,EAAmC,CAAC;AAE/E,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,oGAAoG;AACpG,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,4GAA4G;IAC5G,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,oEAAoE;QACpE,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,kEAAkE;QAClE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,kEAAkE;QAClE,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,sGAAsG;IACtG,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,iGAAiG;IACjG,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE;QACN,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;QAC/D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;QAC9D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;QAC9D,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;KAChE,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY,IAAI,CAC/D,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EACjB,GAAG,EAAE,WAAW,KACb,OAAO,CAAC,UAAU,CAAC,CAAC;AAEzB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY;IACnE,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,mGAAmG;IACnG,WAAW,EAAE,CAAC,CAAC;IACf,8EAA8E;IAC9E,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IACzB,uFAAuF;IACvF,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;CACzB"}

package/dist/tool.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool.js","sourceRoot":"","sources":["../src/tool.ts"],"names":[],"mappings":"AAEA,+GAA+G;AAC/G,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,aAAa;IACb,aAAa;IACb,cAAc;IACd,WAAW;IACX,WAAW;CACH,CAAC;AAKX,8EAA8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAqB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC"}
+{"version":3,"file":"tool.js","sourceRoot":"","sources":["../src/tool.ts"],"names":[],"mappings":"AAaA,+GAA+G;AAC/G,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,aAAa;IACb,aAAa;IACb,cAAc;IACd,WAAW;IACX,WAAW;CACH,CAAC;AAKX,8EAA8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAqB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC"}

package/dist/transport.d.ts

@@ -6,8 +6,11 @@ import type { Server } from '@modelcontextprotocol/sdk/server/index.js';
  */
 export interface Transport {
     readonly kind: 'stdio' | 'http';
-    /** Wire the transport to the MCP server and start accepting traffic. */
-    start(server: Server): Promise<void>;
+    /**
+     * Start accepting traffic. `createServer` returns a fresh MCP server wired to the tool
+     * pipeline; call it once per connection (stdio: once; stateless HTTP: per request).
+     */
+    start(createServer: () => Server): Promise<void>;
     /** Stop accepting traffic and close any underlying sockets. Must be idempotent. */
     stop(): Promise<void>;
 }

package/dist/transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAExE;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IAChC,wEAAwE;IACxE,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,mFAAmF;IACnF,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB"}
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAExE;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IAChC;;;OAGG;IACH,KAAK,CAAC,YAAY,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,mFAAmF;IACnF,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB"}

package/dist/transports/oauth.d.ts

@@ -0,0 +1,56 @@
+import { type JWTPayload } from 'jose';
+export interface OAuthVerifierOptions {
+    /** OIDC issuer URL. Required. Token `iss` must match exactly. */
+    issuer: string;
+    /** Expected `aud` claim. Required. */
+    audience: string;
+    /**
+     * JWKS endpoint. If omitted, defaults to `${issuer}/.well-known/jwks.json`,
+     * which matches the convention used by Auth0, Okta, Keycloak, AWS Cognito,
+     * and most other OIDC providers.
+     */
+    jwksUri?: string;
+    /**
+     * Allowed clock skew, in seconds, when checking `exp` / `nbf`. Defaults to 30s
+     * — enough to absorb NTP drift between issuer and verifier without weakening
+     * expiry semantics.
+     */
+    clockToleranceSeconds?: number;
+}
+/** Successful verification carries the subject and the full payload. */
+export interface OAuthVerifyOk {
+    ok: true;
+    sub?: string;
+    payload: JWTPayload;
+}
+/** Failed verification carries a stable reason code suitable for logs / 401s. */
+export interface OAuthVerifyErr {
+    ok: false;
+    /**
+     * Stable, machine-readable reason. Mapped from the `code` jose throws
+     * (e.g. `ERR_JWT_EXPIRED`) so callers can render `error_description`
+     * without leaking stack traces.
+     */
+    reason: string;
+}
+export type OAuthVerifyResult = OAuthVerifyOk | OAuthVerifyErr;
+export interface OAuthVerifier {
+    /** Validate a Bearer token's signature, issuer, audience, and timing. */
+    verify(token: string): Promise<OAuthVerifyResult>;
+}
+/**
+ * Build an OAuth bearer-token verifier backed by a remote JWKS. The JWKS is
+ * fetched on first use and cached / rotated by `jose` automatically (default
+ * 10-minute cooldown, 30-second timeout). Verification enforces:
+ *
+ * - signature against a JWKS-resolved key
+ * - `iss` exact-match
+ * - `aud` exact-match
+ * - `exp` / `nbf` within `clockToleranceSeconds`
+ *
+ * The verifier is intentionally minimal: scope mapping (e.g. translating an
+ * OAuth `scope` claim into the mcpolyglot scope set) is the caller's job, not
+ * the transport's. The transport's only contract is "the bearer is valid".
+ */
+export declare function createOAuthVerifier(opts: OAuthVerifierOptions): OAuthVerifier;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/transports/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/transports/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,KAAK,UAAU,EAAwB,MAAM,MAAM,CAAC;AAE5F,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,IAAI,CAAC;IACT,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,UAAU,CAAC;CACrB;AAED,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,KAAK,CAAC;IACV;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,cAAc,CAAC;AAE/D,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,aAAa,CAmB7E"}

package/dist/transports/oauth.js

@@ -0,0 +1,65 @@
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+/**
+ * Build an OAuth bearer-token verifier backed by a remote JWKS. The JWKS is
+ * fetched on first use and cached / rotated by `jose` automatically (default
+ * 10-minute cooldown, 30-second timeout). Verification enforces:
+ *
+ * - signature against a JWKS-resolved key
+ * - `iss` exact-match
+ * - `aud` exact-match
+ * - `exp` / `nbf` within `clockToleranceSeconds`
+ *
+ * The verifier is intentionally minimal: scope mapping (e.g. translating an
+ * OAuth `scope` claim into the mcpolyglot scope set) is the caller's job, not
+ * the transport's. The transport's only contract is "the bearer is valid".
+ */
+export function createOAuthVerifier(opts) {
+    const jwksUri = opts.jwksUri ?? defaultJwksUri(opts.issuer);
+    const jwks = createRemoteJWKSet(new URL(jwksUri));
+    const clockTolerance = opts.clockToleranceSeconds ?? 30;
+    return {
+        async verify(token) {
+            try {
+                const result = await jwtVerify(token, jwks, {
+                    issuer: opts.issuer,
+                    audience: opts.audience,
+                    clockTolerance,
+                });
+                return { ok: true, sub: result.payload.sub, payload: result.payload };
+            }
+            catch (e) {
+                return { ok: false, reason: classifyError(e) };
+            }
+        },
+    };
+}
+/** Strip a trailing slash from issuer before joining the JWKS path. */
+function defaultJwksUri(issuer) {
+    return `${issuer.replace(/\/$/, '')}/.well-known/jwks.json`;
+}
+/**
+ * Map `jose` errors and other failures to a small, stable set of reason
+ * strings. Anything we don't recognize collapses to `invalid_token` so we
+ * never leak verifier internals into a 401 response.
+ */
+function classifyError(e) {
+    if (typeof e === 'object' && e !== null && 'code' in e) {
+        const code = String(e.code);
+        switch (code) {
+            case 'ERR_JWT_EXPIRED':
+                return 'token_expired';
+            case 'ERR_JWT_CLAIM_VALIDATION_FAILED':
+                return 'claim_validation_failed';
+            case 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED':
+                return 'signature_invalid';
+            case 'ERR_JWKS_NO_MATCHING_KEY':
+                return 'unknown_key';
+            case 'ERR_JWKS_TIMEOUT':
+                return 'jwks_unavailable';
+            default:
+                return 'invalid_token';
+        }
+    }
+    return 'invalid_token';
+}
+//# sourceMappingURL=oauth.js.map

package/dist/transports/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/transports/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAyC,MAAM,MAAM,CAAC;AA8C5F;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA0B;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC;IAExD,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAoB,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;oBAC3D,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,cAAc;iBACf,CAAC,CAAC;gBACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YACxE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,CAAU;IAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,CAAE,CAAuB,CAAC,IAAI,CAAC,CAAC;QACnD,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,iBAAiB;gBACpB,OAAO,eAAe,CAAC;YACzB,KAAK,iCAAiC;gBACpC,OAAO,yBAAyB,CAAC;YACnC,KAAK,uCAAuC;gBAC1C,OAAO,mBAAmB,CAAC;YAC7B,KAAK,0BAA0B;gBAC7B,OAAO,aAAa,CAAC;YACvB,KAAK,kBAAkB;gBACrB,OAAO,kBAAkB,CAAC;YAC5B;gBACE,OAAO,eAAe,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/transports/stdio.d.ts

@@ -3,7 +3,7 @@ import type { Transport } from '../transport.js';
 export declare class StdioTransport implements Transport {
     readonly kind: "stdio";
     private inner?;
-    start(server: Server): Promise<void>;
+    start(createServer: () => Server): Promise<void>;
     stop(): Promise<void>;
 }
 //# sourceMappingURL=stdio.d.ts.map

package/dist/transports/stdio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../src/transports/stdio.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,qBAAa,cAAe,YAAW,SAAS;IAC9C,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAU;IACjC,OAAO,CAAC,KAAK,CAAC,CAAuB;IAE/B,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAI5B"}
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../src/transports/stdio.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,qBAAa,cAAe,YAAW,SAAS;IAC9C,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAU;IACjC,OAAO,CAAC,KAAK,CAAC,CAAuB;IAE/B,KAAK,CAAC,YAAY,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAI5B"}

package/dist/transports/stdio.js

@@ -2,9 +2,9 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 export class StdioTransport {
     kind = 'stdio';
     inner;
-    async start(server) {
+    async start(createServer) {
         this.inner = new StdioServerTransport();
-        await server.connect(this.inner);
+        await createServer().connect(this.inner);
     }
     async stop() {
         await this.inner?.close();

package/dist/transports/stdio.js.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../../src/transports/stdio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAIjF,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,OAAgB,CAAC;IACzB,KAAK,CAAwB;IAErC,KAAK,CAAC,KAAK,CAAC,MAAc;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAC;QACxC,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;CACF"}
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../../src/transports/stdio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAIjF,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,OAAgB,CAAC;IACzB,KAAK,CAAwB;IAErC,KAAK,CAAC,KAAK,CAAC,YAA0B;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAC;QACxC,MAAM,YAAY,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;CACF"}

package/dist/transports/streamable-http.d.ts

@@ -1,9 +1,44 @@
 import type { Server as McpServer } from '@modelcontextprotocol/sdk/server/index.js';
 import type { Transport } from '../transport.js';
+import { type OAuthVerifierOptions } from './oauth.js';
+/** Bearer-token mode: a fixed shared secret on the `Authorization` header. */
+export interface BearerAuthOptions {
+    kind: 'bearer';
+    /** Pre-shared bearer token. Auto-generated if omitted. */
+    token?: string;
+}
+/** OAuth mode: signature + claim verification against a JWKS. */
+export interface OAuthAuthOptions extends OAuthVerifierOptions {
+    kind: 'oauth';
+}
+/**
+ * Per-agent tokens: each bearer token is sha256-hashed and matched against the agents'
+ * stored hashes. The matched agent id reaches request handlers as `authInfo.clientId`.
+ */
+export interface AgentsAuthOptions {
+    kind: 'agents';
+    agents: ReadonlyArray<{
+        id: string;
+        tokens: ReadonlyArray<{
+            hash: string;
+            revoked?: boolean;
+        }>;
+    }>;
+}
+export type HttpAuthOptions = BearerAuthOptions | OAuthAuthOptions | AgentsAuthOptions;
 export interface StreamableHttpTransportOptions {
     host: string;
     port: number;
-    /** Bearer token required on the Authorization header. Auto-generated if omitted. */
+    /**
+     * Auth strategy. Defaults to `{ kind: 'bearer' }` (auto-generated token)
+     * for back-compat with the original API.
+     */
+    auth?: HttpAuthOptions;
+    /**
+     * @deprecated Pass `auth: { kind: 'bearer', token }` instead. Retained so
+     * existing callers (and the CLI's `--http` flag without OAuth config)
+     * keep working unchanged.
+     */
     bearerToken?: string;
     /** Where to log server startup banner / auth-failure events. Stderr by default. */
     logger?: {
@@ -13,16 +48,29 @@ export interface StreamableHttpTransportOptions {
 }
 export declare class StreamableHttpTransport implements Transport {
     readonly kind: "http";
-    readonly bearerToken: string;
+    /** Bearer token in use, or `undefined` when running in OAuth mode. */
+    readonly bearerToken: string | undefined;
+    readonly authKind: 'bearer' | 'oauth' | 'agents';
     private readonly host;
     private readonly port;
+    private readonly auth;
     private readonly logger;
-    private inner?;
+    private newServer?;
     private httpServer?;
     constructor(opts: StreamableHttpTransportOptions);
-    start(server: McpServer): Promise<void>;
+    start(newServer: () => McpServer): Promise<void>;
     stop(): Promise<void>;
     private handle;
     private checkAuth;
 }
+/** sha256 hex of a bearer token — the only form an agent token is ever stored in. */
+export declare function hashToken(token: string): string;
+/**
+ * Compare the token's hash against every stored hash with `timingSafeEqual`, without
+ * stopping at the first match, so timing doesn't reveal which (or whether an) entry hit.
+ */
+export declare function matchAgent(hashes: readonly {
+    agentId: string;
+    hash: Buffer;
+}[], token: string): string | undefined;
 //# sourceMappingURL=streamable-http.d.ts.map

package/dist/transports/streamable-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"streamable-http.d.ts","sourceRoot":"","sources":["../../src/transports/streamable-http.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;QAC9D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;KAC/D,CAAC;CACH;AAED,qBAAa,uBAAwB,YAAW,SAAS;IACvD,QAAQ,CAAC,IAAI,EAAG,MAAM,CAAU;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwD;IAC/E,OAAO,CAAC,KAAK,CAAC,CAAgC;IAC9C,OAAO,CAAC,UAAU,CAAC,CAAa;gBAEpB,IAAI,EAAE,8BAA8B;IAY1C,KAAK,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA0CvC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YASb,MAAM;IAwBpB,OAAO,CAAC,SAAS;CAQlB"}
+{"version":3,"file":"streamable-http.d.ts","sourceRoot":"","sources":["../../src/transports/streamable-http.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAA2C,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEhG,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,QAAQ,CAAC;IACf,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,iEAAiE;AACjE,MAAM,WAAW,gBAAiB,SAAQ,oBAAoB;IAC5D,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;QACpB,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,aAAa,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;KAC5D,CAAC,CAAC;CACJ;AAED,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAEvF,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;QAC9D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;KAC/D,CAAC;CACH;AAOD,qBAAa,uBAAwB,YAAW,SAAS;IACvD,QAAQ,CAAC,IAAI,EAAG,MAAM,CAAU;IAChC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;IACjD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwD;IAC/E,OAAO,CAAC,SAAS,CAAC,CAAkB;IACpC,OAAO,CAAC,UAAU,CAAC,CAAa;gBAEpB,IAAI,EAAE,8BAA8B;IAc1C,KAAK,CAAC,SAAS,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAgDhD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAQb,MAAM;YA0CN,SAAS;CA6BxB;AAqDD,qFAAqF;AACrF,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,SAAS;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,EACpD,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CASpB"}