@mcpolyglot/core 0.1.0 → 0.3.0

package/dist/transports/streamable-http.js

@@ -1,29 +1,31 @@
 import { createServer, } from 'node:http';
-import { timingSafeEqual, randomBytes } from 'node:crypto';
+import { createHash, timingSafeEqual, randomBytes } from 'node:crypto';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { createOAuthVerifier } from './oauth.js';
 export class StreamableHttpTransport {
     kind = 'http';
+    /** Bearer token in use, or `undefined` when running in OAuth mode. */
     bearerToken;
+    authKind;
     host;
     port;
+    auth;
     logger;
-    inner;
+    newServer;
     httpServer;
     constructor(opts) {
         this.host = opts.host;
         this.port = opts.port;
-        this.bearerToken = opts.bearerToken ?? generateToken();
+        this.auth = resolveAuth(opts);
+        this.authKind = this.auth.kind;
+        this.bearerToken = this.auth.kind === 'bearer' ? this.auth.token : undefined;
         this.logger = opts.logger ?? {
             info: (msg, fields) => process.stderr.write(JSON.stringify({ level: 'info', msg, ...(fields ?? {}) }) + '\n'),
             warn: (msg, fields) => process.stderr.write(JSON.stringify({ level: 'warn', msg, ...(fields ?? {}) }) + '\n'),
         };
     }
-    async start(server) {
-        this.inner = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
-        this.inner.onerror = (err) => {
-            this.logger.warn('http.transport.error', { error: err.message });
-        };
-        await server.connect(this.inner);
+    async start(newServer) {
+        this.newServer = newServer;
         this.httpServer = createServer((req, res) => {
             this.handle(req, res).catch((err) => {
                 this.logger.warn('http.handler.error', {
@@ -43,12 +45,23 @@ export class StreamableHttpTransport {
                 resolve();
             });
         });
-        this.logger.info('http.listening', {
+        const fields = {
             host: this.host,
             port: this.port,
+            auth: this.auth.kind,
+        };
+        if (this.auth.kind === 'bearer') {
             // Tokens are sensitive; emit a fingerprint not the token itself.
-            tokenFingerprint: fingerprint(this.bearerToken),
-        });
+            fields.tokenFingerprint = fingerprint(this.auth.token);
+        }
+        else if (this.auth.kind === 'agents') {
+            fields.agents = new Set(this.auth.hashes.map((h) => h.agentId)).size;
+        }
+        else {
+            fields.issuer = this.auth.issuer;
+            fields.audience = this.auth.audience;
+        }
+        this.logger.info('http.listening', fields);
         if (!isLoopback(this.host)) {
             this.logger.warn('http.bound_non_loopback', {
                 host: this.host,
@@ -61,8 +74,7 @@ export class StreamableHttpTransport {
             await new Promise((resolve) => this.httpServer.close(() => resolve()));
             this.httpServer = undefined;
         }
-        await this.inner?.close();
-        this.inner = undefined;
+        this.newServer = undefined;
     }
     async handle(req, res) {
         if (req.method === 'GET' && req.url === '/healthz') {
@@ -71,29 +83,127 @@ export class StreamableHttpTransport {
             res.end(JSON.stringify({ ok: true }));
             return;
         }
-        if (!this.checkAuth(req)) {
+        const authResult = await this.checkAuth(req);
+        if (!authResult.ok) {
             res.statusCode = 401;
-            res.setHeader('WWW-Authenticate', 'Bearer realm="mcpolyglot"');
+            res.setHeader('WWW-Authenticate', wwwAuthenticate(this.auth.kind, authResult.reason));
             res.setHeader('content-type', 'application/json');
-            res.end(JSON.stringify({ error: 'unauthorized' }));
+            res.end(JSON.stringify({ error: 'unauthorized', reason: authResult.reason }));
             return;
         }
-        if (!this.inner) {
+        if (!this.newServer) {
             res.statusCode = 503;
             res.end();
             return;
         }
-        await this.inner.handleRequest(req, res);
+        if (authResult.agentId) {
+            // The SDK hands `req.auth` to request handlers as `extra.authInfo`. No token in it.
+            const auth = { token: '', clientId: authResult.agentId, scopes: [] };
+            req.auth = auth;
+        }
+        // Stateless mode: the SDK allows one request per transport, so each request gets its own
+        // transport + protocol server, torn down when the response closes.
+        const inner = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+        inner.onerror = (err) => {
+            this.logger.warn('http.transport.error', { error: err.message });
+        };
+        const server = this.newServer();
+        res.on('close', () => {
+            void inner.close();
+            void server.close();
+        });
+        await server.connect(inner);
+        await inner.handleRequest(req, res);
     }
-    checkAuth(req) {
+    async checkAuth(req) {
         const header = req.headers.authorization ?? '';
-        const expected = `Bearer ${this.bearerToken}`;
-        const a = Buffer.from(header);
-        const b = Buffer.from(expected);
-        if (a.length !== b.length)
-            return false;
-        return timingSafeEqual(a, b);
+        if (!header.startsWith('Bearer ')) {
+            return { ok: false, reason: 'missing_bearer' };
+        }
+        const token = header.slice('Bearer '.length);
+        if (this.auth.kind === 'bearer') {
+            const expected = this.auth.token;
+            const a = Buffer.from(token);
+            const b = Buffer.from(expected);
+            if (a.length !== b.length)
+                return { ok: false, reason: 'invalid_token' };
+            return timingSafeEqual(a, b) ? { ok: true } : { ok: false, reason: 'invalid_token' };
+        }
+        if (this.auth.kind === 'agents') {
+            const agentId = matchAgent(this.auth.hashes, token);
+            return agentId ? { ok: true, agentId } : { ok: false, reason: 'invalid_token' };
+        }
+        const result = await this.auth.verifier.verify(token);
+        if (!result.ok) {
+            this.logger.warn('http.oauth.rejected', { reason: result.reason });
+            return { ok: false, reason: result.reason };
+        }
+        return { ok: true };
+    }
+}
+function resolveAuth(opts) {
+    // Back-compat: legacy `bearerToken` arg wins if no `auth` was supplied.
+    if (!opts.auth) {
+        return { kind: 'bearer', token: opts.bearerToken ?? generateToken() };
+    }
+    if (opts.auth.kind === 'agents') {
+        return {
+            kind: 'agents',
+            // Revoked tokens are dropped here, so they fail exactly like unknown ones.
+            hashes: opts.auth.agents.flatMap((a) => a.tokens
+                .filter((t) => !t.revoked)
+                .map((t) => ({ agentId: a.id, hash: Buffer.from(t.hash.toLowerCase(), 'hex') }))),
+        };
+    }
+    if (opts.auth.kind === 'bearer') {
+        return { kind: 'bearer', token: opts.auth.token ?? opts.bearerToken ?? generateToken() };
+    }
+    return {
+        kind: 'oauth',
+        verifier: createOAuthVerifier(opts.auth),
+        issuer: opts.auth.issuer,
+        audience: opts.auth.audience,
+    };
+}
+function wwwAuthenticate(kind, reason) {
+    const errorCode = mapReasonToWwwError(reason);
+    // RFC 6750 §3 — `error` and `error_description` belong on Bearer challenges.
+    if (kind !== 'oauth') {
+        return `Bearer realm="mcpolyglot", error="${errorCode}"`;
+    }
+    return `Bearer realm="mcpolyglot", error="${errorCode}", error_description="${reason}"`;
+}
+function mapReasonToWwwError(reason) {
+    switch (reason) {
+        case 'missing_bearer':
+            return 'invalid_request';
+        case 'token_expired':
+        case 'invalid_token':
+        case 'signature_invalid':
+        case 'unknown_key':
+        case 'claim_validation_failed':
+            return 'invalid_token';
+        default:
+            return 'invalid_token';
+    }
+}
+/** sha256 hex of a bearer token — the only form an agent token is ever stored in. */
+export function hashToken(token) {
+    return createHash('sha256').update(token).digest('hex');
+}
+/**
+ * Compare the token's hash against every stored hash with `timingSafeEqual`, without
+ * stopping at the first match, so timing doesn't reveal which (or whether an) entry hit.
+ */
+export function matchAgent(hashes, token) {
+    const candidate = createHash('sha256').update(token).digest();
+    let found;
+    for (const h of hashes) {
+        if (h.hash.length === candidate.length && timingSafeEqual(h.hash, candidate)) {
+            found ??= h.agentId;
+        }
     }
+    return found;
 }
 function generateToken() {
     return randomBytes(24).toString('base64url');

package/dist/transports/streamable-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"streamable-http.js","sourceRoot":"","sources":["../../src/transports/streamable-http.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAIb,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAgBnG,MAAM,OAAO,uBAAuB;IACzB,IAAI,GAAG,MAAe,CAAC;IACvB,WAAW,CAAS;IACZ,IAAI,CAAS;IACb,IAAI,CAAS;IACb,MAAM,CAAwD;IACvE,KAAK,CAAiC;IACtC,UAAU,CAAc;IAEhC,YAAY,IAAoC;QAC9C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,aAAa,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI;YAC3B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;YACxF,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;SACzF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAAiB;QAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,EAAE,EAAE;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEjC,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE;oBACrC,KAAK,EAAG,GAAa,CAAC,OAAO;oBAC7B,KAAK,EAAG,GAAa,CAAC,KAAK;iBAC5B,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,UAAW,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,UAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;gBACjD,IAAI,CAAC,UAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACtC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,iEAAiE;YACjE,gBAAgB,EAAE,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBAC1C,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,cAAc,EAAE,qCAAqC;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,UAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9E,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC9B,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB;QAC5D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YACnD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,2BAA2B,CAAC,CAAC;YAC/D,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAEO,SAAS,CAAC,GAAoB;QACpC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;CACF;AAED,SAAS,aAAa;IACpB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,gEAAgE;IAChE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;AACxE,CAAC"}
+{"version":3,"file":"streamable-http.js","sourceRoot":"","sources":["../../src/transports/streamable-http.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAIb,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAInG,OAAO,EAAE,mBAAmB,EAAiD,MAAM,YAAY,CAAC;AAsDhG,MAAM,OAAO,uBAAuB;IACzB,IAAI,GAAG,MAAe,CAAC;IAChC,sEAAsE;IAC7D,WAAW,CAAqB;IAChC,QAAQ,CAAgC;IAChC,IAAI,CAAS;IACb,IAAI,CAAS;IACb,IAAI,CAAe;IACnB,MAAM,CAAwD;IACvE,SAAS,CAAmB;IAC5B,UAAU,CAAc;IAEhC,YAAY,IAAoC;QAC9C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI;YAC3B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;YACxF,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;SACzF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAA0B;QACpC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAE3B,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE;oBACrC,KAAK,EAAG,GAAa,CAAC,OAAO;oBAC7B,KAAK,EAAG,GAAa,CAAC,KAAK;iBAC5B,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,UAAW,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,UAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;gBACjD,IAAI,CAAC,UAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACtC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAA4B;YACtC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;SACrB,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAChC,iEAAiE;YACjE,MAAM,CAAC,gBAAgB,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YACjC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAE3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBAC1C,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,cAAc,EAAE,qCAAqC;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,UAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9E,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB;QAC5D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YACnD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YACtF,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,oFAAoF;YACpF,MAAM,IAAI,GAAa,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC9E,GAA6C,CAAC,IAAI,GAAG,IAAI,CAAC;QAC7D,CAAC;QACD,yFAAyF;QACzF,mEAAmE;QACnE,MAAM,KAAK,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;QACnF,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,EAAE,EAAE;YACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,GAAoB;QAEpB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAE7C,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YACzE,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACvF,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAClF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF;AAED,SAAS,WAAW,CAAC,IAAoC;IACvD,wEAAwE;IACxE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,IAAI,aAAa,EAAE,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,2EAA2E;YAC3E,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACrC,CAAC,CAAC,MAAM;iBACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;iBACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CACnF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,IAAI,aAAa,EAAE,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QACxC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;QACxB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAA0B,EAAE,MAAc;IACjE,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9C,6EAA6E;IAC7E,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO,qCAAqC,SAAS,GAAG,CAAC;IAC3D,CAAC;IACD,OAAO,qCAAqC,SAAS,yBAAyB,MAAM,GAAG,CAAC;AAC1F,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc;IACzC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,gBAAgB;YACnB,OAAO,iBAAiB,CAAC;QAC3B,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe,CAAC;QACrB,KAAK,mBAAmB,CAAC;QACzB,KAAK,aAAa,CAAC;QACnB,KAAK,yBAAyB;YAC5B,OAAO,eAAe,CAAC;QACzB;YACE,OAAO,eAAe,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,MAAoD,EACpD,KAAa;IAEb,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9D,IAAI,KAAyB,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7E,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,gEAAgE;IAChE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;AACxE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcpolyglot/core",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Core runtime for mcpolyglot: Connector interface, server, transports, and the non-bypassable security pipeline.",
   "license": "MIT",
   "repository": {
@@ -29,9 +29,9 @@
     "dist"
   ],
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "zod": "^3.23.8",
-    "zod-to-json-schema": "^3.23.5"
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "jose": "^6.2.12",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",