@n24q02m/mcp-core 0.1.0

package/build/storage/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/storage/resolver.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,MAAM,GAAG,UAAU,GAAG,IAAI,CAAA;AAE7D,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;IACrC,MAAM,EAAE,YAAY,CAAA;CACrB;AAED,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,EAAE,EACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,cAAc,CAAC,CAoCzB"}

package/build/storage/resolver.js

@@ -0,0 +1,37 @@
+import { readConfig } from './config-file.js';
+export async function resolveConfig(serverName, requiredFields, defaults) {
+    // 1. Check env vars -- if ALL required fields present as env vars, use them
+    const envConfig = {};
+    let allEnvPresent = requiredFields.length > 0;
+    for (const field of requiredFields) {
+        const envKey = `MCP_${serverName.toUpperCase().replace(/-/g, '_')}_${field.toUpperCase().replace(/-/g, '_')}`;
+        const value = process.env[envKey];
+        if (value !== undefined && value !== '') {
+            envConfig[field] = value;
+        }
+        else {
+            allEnvPresent = false;
+        }
+    }
+    if (allEnvPresent) {
+        return { config: envConfig, source: 'env' };
+    }
+    // 2. Check config file
+    const fileConfig = await readConfig(serverName);
+    if (fileConfig) {
+        const hasAllRequired = requiredFields.every((f) => f in fileConfig && fileConfig[f] !== '');
+        if (hasAllRequired) {
+            return { config: fileConfig, source: 'file' };
+        }
+    }
+    // 3. Check defaults
+    if (defaults) {
+        const hasAllRequired = requiredFields.every((f) => f in defaults && defaults[f] !== '');
+        if (hasAllRequired) {
+            return { config: { ...defaults }, source: 'defaults' };
+        }
+    }
+    // 4. Nothing found -- trigger relay setup
+    return { config: null, source: null };
+}
+//# sourceMappingURL=resolver.js.map

package/build/storage/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../src/storage/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAS7C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB,EAClB,cAAwB,EACxB,QAAiC;IAEjC,4EAA4E;IAC5E,MAAM,SAAS,GAA2B,EAAE,CAAA;IAC5C,IAAI,aAAa,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,CAAA;IAC7C,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,UAAU,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAA;QAC7G,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,CAAA;QAC1B,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,KAAK,CAAA;QACvB,CAAC;IACH,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAC7C,CAAC;IAED,uBAAuB;IACvB,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAA;IAC/C,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QAC3F,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QACvF,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;QACxD,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;AACvC,CAAC"}

package/build/storage/session-lock.d.ts

@@ -0,0 +1,19 @@
+/**
+ * File-based session lock to prevent duplicate relay sessions.
+ *
+ * When multiple MCP server processes start simultaneously (common in Claude Code),
+ * this lock prevents each from creating a separate relay session (rate limit:
+ * max 10 sessions/IP/10min).
+ *
+ * Lock file location: <config_dir>/mcp/relay-session-<server>.lock
+ */
+export declare function setLockDir(path: string | null): void;
+export interface SessionInfo {
+    sessionId: string;
+    relayUrl: string;
+    createdAt: number;
+}
+export declare function acquireSessionLock(serverName: string, maxAgeMs?: number): Promise<SessionInfo | null>;
+export declare function writeSessionLock(serverName: string, info: SessionInfo): Promise<void>;
+export declare function releaseSessionLock(serverName: string): Promise<void>;
+//# sourceMappingURL=session-lock.d.ts.map

package/build/storage/session-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-lock.d.ts","sourceRoot":"","sources":["../../src/storage/session-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAeH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAEpD;AAUD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAQD,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,QAAQ,SAAqB,GAC5B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CA2C7B;AAED,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB3F;AAED,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS1E"}

package/build/storage/session-lock.js

@@ -0,0 +1,94 @@
+/**
+ * File-based session lock to prevent duplicate relay sessions.
+ *
+ * When multiple MCP server processes start simultaneously (common in Claude Code),
+ * this lock prevents each from creating a separate relay session (rate limit:
+ * max 10 sessions/IP/10min).
+ *
+ * Lock file location: <config_dir>/mcp/relay-session-<server>.lock
+ */
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import envPaths from 'env-paths';
+const paths = envPaths('mcp', { suffix: '' });
+const DEFAULT_LOCK_DIR = paths.config;
+const DEFAULT_MAX_AGE_MS = 600_000;
+// Allow overriding lock directory for testing
+let lockDirOverride = null;
+export function setLockDir(path) {
+    lockDirOverride = path;
+}
+function getLockDir() {
+    return lockDirOverride ?? DEFAULT_LOCK_DIR;
+}
+function lockPath(serverName) {
+    return join(getLockDir(), `relay-session-${serverName}.lock`);
+}
+export async function acquireSessionLock(serverName, maxAgeMs = DEFAULT_MAX_AGE_MS) {
+    const path = lockPath(serverName);
+    try {
+        if (!existsSync(path)) {
+            return null;
+        }
+        const raw = await readFile(path, 'utf-8');
+        const data = JSON.parse(raw);
+        // Validate required fields
+        if (typeof data.session_id !== 'string' ||
+            typeof data.relay_url !== 'string' ||
+            typeof data.created_at !== 'number') {
+            await releaseSessionLock(serverName);
+            return null;
+        }
+        const info = {
+            sessionId: data.session_id,
+            relayUrl: data.relay_url,
+            createdAt: data.created_at
+        };
+        const age = Date.now() - info.createdAt;
+        if (age > maxAgeMs) {
+            // Expired lock: clean up and return null
+            await releaseSessionLock(serverName);
+            return null;
+        }
+        return info;
+    }
+    catch {
+        // Corrupt or unreadable lock file: clean up and return null
+        try {
+            await releaseSessionLock(serverName);
+        }
+        catch {
+            /* ignore cleanup errors */
+        }
+        return null;
+    }
+}
+export async function writeSessionLock(serverName, info) {
+    const path = lockPath(serverName);
+    const dir = dirname(path);
+    if (!existsSync(dir)) {
+        await mkdir(dir, { recursive: true });
+    }
+    const data = {
+        session_id: info.sessionId,
+        relay_url: info.relayUrl,
+        created_at: info.createdAt
+    };
+    // Write atomically via temp file + rename
+    const tmpPath = `${path}.tmp`;
+    await writeFile(tmpPath, JSON.stringify(data), 'utf-8');
+    await rename(tmpPath, path);
+}
+export async function releaseSessionLock(serverName) {
+    const path = lockPath(serverName);
+    try {
+        if (existsSync(path)) {
+            await unlink(path);
+        }
+    }
+    catch {
+        /* ignore errors during cleanup */
+    }
+}
+//# sourceMappingURL=session-lock.js.map

package/build/storage/session-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-lock.js","sourceRoot":"","sources":["../../src/storage/session-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,QAAQ,MAAM,WAAW,CAAA;AAEhC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;AAC7C,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAA;AAErC,MAAM,kBAAkB,GAAG,OAAO,CAAA;AAElC,8CAA8C;AAC9C,IAAI,eAAe,GAAkB,IAAI,CAAA;AAEzC,MAAM,UAAU,UAAU,CAAC,IAAmB;IAC5C,eAAe,GAAG,IAAI,CAAA;AACxB,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,eAAe,IAAI,gBAAgB,CAAA;AAC5C,CAAC;AAED,SAAS,QAAQ,CAAC,UAAkB;IAClC,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,iBAAiB,UAAU,OAAO,CAAC,CAAA;AAC/D,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAkB,EAClB,QAAQ,GAAG,kBAAkB;IAE7B,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;IACjC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAA;QAE/C,2BAA2B;QAC3B,IACE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;YACnC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;YAClC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EACnC,CAAC;YACD,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAA;YACpC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,IAAI,GAAgB;YACxB,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,SAAS,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAA;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAA;QACvC,IAAI,GAAG,GAAG,QAAQ,EAAE,CAAC;YACnB,yCAAyC;YACzC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAA;YACpC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAA;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB,EAAE,IAAiB;IAC1E,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,IAAI,GAAoB;QAC5B,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,UAAU,EAAE,IAAI,CAAC,SAAS;KAC3B,CAAA;IAED,0CAA0C;IAC1C,MAAM,OAAO,GAAG,GAAG,IAAI,MAAM,CAAA;IAC7B,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAA;IACvD,MAAM,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;IACjC,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;AACH,CAAC"}

package/build/transport/index.d.ts

@@ -0,0 +1,3 @@
+export { type AuthenticatedRequest, OAuthMiddleware, type OAuthMiddlewareOptions } from './oauth-middleware.js';
+export { StreamableHTTPServer, type StreamableHTTPServerOptions } from './streamable-http.js';
+//# sourceMappingURL=index.d.ts.map

package/build/transport/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,oBAAoB,EACzB,eAAe,EACf,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,oBAAoB,EACpB,KAAK,2BAA2B,EACjC,MAAM,sBAAsB,CAAA"}

package/build/transport/index.js

@@ -0,0 +1,3 @@
+export { OAuthMiddleware } from './oauth-middleware.js';
+export { StreamableHTTPServer } from './streamable-http.js';
+//# sourceMappingURL=index.js.map

package/build/transport/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,EAEhB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,oBAAoB,EAErB,MAAM,sBAAsB,CAAA"}

package/build/transport/oauth-middleware.d.ts

@@ -0,0 +1,32 @@
+/**
+ * OAuth 2.1 Bearer token validation middleware for Streamable HTTP.
+ *
+ * Validates `Authorization: Bearer <token>` headers on incoming requests
+ * against a `JWTIssuer`. On missing or invalid token it writes a 401
+ * with `WWW-Authenticate: Bearer resource_metadata="..."` per RFC 6750 +
+ * RFC 9728 (OAuth 2.1 protected resource metadata discovery).
+ *
+ * Success attaches the validated claims to `(req as any).user` so
+ * downstream handlers can read the subject without re-validating.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { JWTIssuer } from '../oauth/jwt-issuer.js';
+export interface OAuthMiddlewareOptions {
+    jwtIssuer: JWTIssuer;
+    resourceMetadataUrl: string;
+}
+export interface AuthenticatedRequest extends IncomingMessage {
+    user?: Record<string, unknown>;
+}
+export declare class OAuthMiddleware {
+    private readonly _issuer;
+    private readonly _resourceMetadataUrl;
+    constructor(options: OAuthMiddlewareOptions);
+    /**
+     * Validate the request. Returns `true` if the request should proceed
+     * (and attaches `req.user` on success). Returns `false` if the
+     * middleware has already written a 401 response.
+     */
+    validate(req: AuthenticatedRequest, res: ServerResponse): Promise<boolean>;
+}
+//# sourceMappingURL=oauth-middleware.d.ts.map

package/build/transport/oauth-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-middleware.d.ts","sourceRoot":"","sources":["../../src/transport/oauth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAEvD,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,SAAS,CAAA;IACpB,mBAAmB,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,oBAAqB,SAAQ,eAAe;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B;AA0BD,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAQ;gBAEjC,OAAO,EAAE,sBAAsB;IAK3C;;;;OAIG;IACG,QAAQ,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;CAejF"}

package/build/transport/oauth-middleware.js

@@ -0,0 +1,62 @@
+/**
+ * OAuth 2.1 Bearer token validation middleware for Streamable HTTP.
+ *
+ * Validates `Authorization: Bearer <token>` headers on incoming requests
+ * against a `JWTIssuer`. On missing or invalid token it writes a 401
+ * with `WWW-Authenticate: Bearer resource_metadata="..."` per RFC 6750 +
+ * RFC 9728 (OAuth 2.1 protected resource metadata discovery).
+ *
+ * Success attaches the validated claims to `(req as any).user` so
+ * downstream handlers can read the subject without re-validating.
+ */
+function writeChallenge(res, resourceMetadataUrl, error) {
+    const params = [`resource_metadata="${resourceMetadataUrl}"`];
+    if (error)
+        params.push(`error="${error}"`);
+    res.writeHead(401, {
+        'WWW-Authenticate': `Bearer ${params.join(', ')}`,
+        'Content-Type': 'application/json'
+    });
+    res.end(JSON.stringify({
+        error: error ?? 'unauthorized',
+        error_description: error ? 'The access token is missing or invalid' : 'Authentication required'
+    }));
+}
+function extractBearerToken(authHeader) {
+    if (!authHeader)
+        return null;
+    const trimmed = authHeader.trim();
+    const match = trimmed.match(/^Bearer\s+(.+)$/i);
+    if (!match)
+        return null;
+    const token = match[1]?.trim() ?? '';
+    return token.length > 0 ? token : null;
+}
+export class OAuthMiddleware {
+    constructor(options) {
+        this._issuer = options.jwtIssuer;
+        this._resourceMetadataUrl = options.resourceMetadataUrl;
+    }
+    /**
+     * Validate the request. Returns `true` if the request should proceed
+     * (and attaches `req.user` on success). Returns `false` if the
+     * middleware has already written a 401 response.
+     */
+    async validate(req, res) {
+        const token = extractBearerToken(req.headers.authorization);
+        if (!token) {
+            writeChallenge(res, this._resourceMetadataUrl);
+            return false;
+        }
+        try {
+            const claims = await this._issuer.verifyAccessToken(token);
+            req.user = claims;
+            return true;
+        }
+        catch {
+            writeChallenge(res, this._resourceMetadataUrl, 'invalid_token');
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=oauth-middleware.js.map

package/build/transport/oauth-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-middleware.js","sourceRoot":"","sources":["../../src/transport/oauth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAeH,SAAS,cAAc,CAAC,GAAmB,EAAE,mBAA2B,EAAE,KAAc;IACtF,MAAM,MAAM,GAAG,CAAC,sBAAsB,mBAAmB,GAAG,CAAC,CAAA;IAC7D,IAAI,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAA;IAC1C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,kBAAkB,EAAE,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACjD,cAAc,EAAE,kBAAkB;KACnC,CAAC,CAAA;IACF,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,KAAK,IAAI,cAAc;QAC9B,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,yBAAyB;KAChG,CAAC,CACH,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,UAA8B;IACxD,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAC5B,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAA;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACxC,CAAC;AAED,MAAM,OAAO,eAAe;IAI1B,YAAY,OAA+B;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAA;IACzD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,GAAyB,EAAE,GAAmB;QAC3D,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAA;YAC9C,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;YAC1D,GAAG,CAAC,IAAI,GAAG,MAAM,CAAA;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAA;YAC/D,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;CACF"}

package/build/transport/streamable-http.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Streamable HTTP 2025-11-25 transport wrapper for mcp-core TypeScript.
+ *
+ * Thin convenience wrapper around `@modelcontextprotocol/sdk`'s
+ * `StreamableHTTPServerTransport` that pairs it with an `McpServer`
+ * instance and an optional OAuth Bearer validation middleware.
+ *
+ * The SDK already implements the full 2025-11-25 transport spec
+ * (session management, SSE streaming, stateful / stateless modes),
+ * so this wrapper focuses on the mcp-core ergonomics:
+ *
+ *  - one-call `connect()` that wires server <-> transport
+ *  - `handleRequest(req, res)` that applies the OAuth middleware
+ *    first and short-circuits with 401 on missing / invalid token
+ *  - explicit `host` / `port` properties for lifecycle management
+ *    (the actual port bind is left to the caller's http.Server)
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StreamableHTTPServerTransport, type StreamableHTTPServerTransportOptions } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import type { OAuthMiddleware } from './oauth-middleware.js';
+export interface StreamableHTTPServerOptions {
+    /** MCP server instance that handles requests */
+    server: McpServer;
+    /** Host to advertise (used for logging / display only) */
+    host?: string;
+    /** Port to advertise (used for logging / display only) */
+    port: number;
+    /** Optional OAuth middleware for Bearer token validation */
+    oauthMiddleware?: OAuthMiddleware;
+    /** Transport options forwarded to StreamableHTTPServerTransport */
+    transportOptions?: StreamableHTTPServerTransportOptions;
+}
+export declare class StreamableHTTPServer {
+    readonly host: string;
+    readonly port: number;
+    private readonly _server;
+    private readonly _oauth?;
+    private readonly _transport;
+    private _connected;
+    constructor(options: StreamableHTTPServerOptions);
+    /** Connect the MCP server to the transport. Call once before handleRequest. */
+    connect(): Promise<void>;
+    /**
+     * Handle an incoming HTTP request. Applies OAuth validation first if
+     * configured, then delegates to the SDK transport.
+     */
+    handleRequest(req: IncomingMessage, res: ServerResponse, parsedBody?: unknown): Promise<void>;
+    /** Expose the underlying transport for advanced use cases. */
+    get transport(): StreamableHTTPServerTransport;
+    /** Close the transport and drain any active sessions. */
+    close(): Promise<void>;
+}
+//# sourceMappingURL=streamable-http.d.ts.map

package/build/transport/streamable-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"streamable-http.d.ts","sourceRoot":"","sources":["../../src/transport/streamable-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AACxE,OAAO,EACL,6BAA6B,EAC7B,KAAK,oCAAoC,EAC1C,MAAM,oDAAoD,CAAA;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAE5D,MAAM,WAAW,2BAA2B;IAC1C,gDAAgD;IAChD,MAAM,EAAE,SAAS,CAAA;IACjB,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAA;IACZ,4DAA4D;IAC5D,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,oCAAoC,CAAA;CACxD;AAED,qBAAa,oBAAoB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D,OAAO,CAAC,UAAU,CAAQ;gBAEd,OAAO,EAAE,2BAA2B;IAQhD,+EAA+E;IACzE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAM9B;;;OAGG;IACG,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAQnG,8DAA8D;IAC9D,IAAI,SAAS,IAAI,6BAA6B,CAE7C;IAED,yDAAyD;IACnD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B"}

package/build/transport/streamable-http.js

@@ -0,0 +1,57 @@
+/**
+ * Streamable HTTP 2025-11-25 transport wrapper for mcp-core TypeScript.
+ *
+ * Thin convenience wrapper around `@modelcontextprotocol/sdk`'s
+ * `StreamableHTTPServerTransport` that pairs it with an `McpServer`
+ * instance and an optional OAuth Bearer validation middleware.
+ *
+ * The SDK already implements the full 2025-11-25 transport spec
+ * (session management, SSE streaming, stateful / stateless modes),
+ * so this wrapper focuses on the mcp-core ergonomics:
+ *
+ *  - one-call `connect()` that wires server <-> transport
+ *  - `handleRequest(req, res)` that applies the OAuth middleware
+ *    first and short-circuits with 401 on missing / invalid token
+ *  - explicit `host` / `port` properties for lifecycle management
+ *    (the actual port bind is left to the caller's http.Server)
+ */
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+export class StreamableHTTPServer {
+    constructor(options) {
+        this._connected = false;
+        this._server = options.server;
+        this.host = options.host ?? '127.0.0.1';
+        this.port = options.port;
+        this._oauth = options.oauthMiddleware;
+        this._transport = new StreamableHTTPServerTransport(options.transportOptions ?? { sessionIdGenerator: undefined });
+    }
+    /** Connect the MCP server to the transport. Call once before handleRequest. */
+    async connect() {
+        if (this._connected)
+            return;
+        await this._server.connect(this._transport);
+        this._connected = true;
+    }
+    /**
+     * Handle an incoming HTTP request. Applies OAuth validation first if
+     * configured, then delegates to the SDK transport.
+     */
+    async handleRequest(req, res, parsedBody) {
+        if (this._oauth) {
+            const allowed = await this._oauth.validate(req, res);
+            if (!allowed)
+                return;
+        }
+        await this._transport.handleRequest(req, res, parsedBody);
+    }
+    /** Expose the underlying transport for advanced use cases. */
+    get transport() {
+        return this._transport;
+    }
+    /** Close the transport and drain any active sessions. */
+    async close() {
+        await this._transport.close();
+        this._connected = false;
+    }
+}
+//# sourceMappingURL=streamable-http.js.map

package/build/transport/streamable-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"streamable-http.js","sourceRoot":"","sources":["../../src/transport/streamable-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EACL,6BAA6B,EAE9B,MAAM,oDAAoD,CAAA;AAiB3D,MAAM,OAAO,oBAAoB;IAQ/B,YAAY,OAAoC;QAFxC,eAAU,GAAG,KAAK,CAAA;QAGxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAA;QAC7B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAA;QACvC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,eAAe,CAAA;QACrC,IAAI,CAAC,UAAU,GAAG,IAAI,6BAA6B,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAA;IACpH,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,UAAU;YAAE,OAAM;QAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,GAAoB,EAAE,GAAmB,EAAE,UAAoB;QACjF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YACpD,IAAI,CAAC,OAAO;gBAAE,OAAM;QACtB,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;IAC3D,CAAC;IAED,8DAA8D;IAC9D,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;QAC7B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAA;IACzB,CAAC;CACF"}

package/package.json

@@ -0,0 +1,88 @@
+{
+  "name": "@n24q02m/mcp-core",
+  "version": "0.1.0",
+  "description": "Unified MCP Streamable HTTP 2025-11-25 transport, OAuth 2.1 AS, lifecycle, install",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "streamable-http",
+    "oauth21",
+    "transport"
+  ],
+  "author": {
+    "name": "n24q02m",
+    "url": "https://github.com/n24q02m"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/n24q02m/mcp-core.git",
+    "directory": "packages/core-ts"
+  },
+  "homepage": "https://github.com/n24q02m/mcp-core",
+  "bugs": {
+    "url": "https://github.com/n24q02m/mcp-core/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "build/index.js",
+  "types": "build/index.d.ts",
+  "files": [
+    "build/",
+    "README.md",
+    "LICENSE"
+  ],
+  "exports": {
+    ".": {
+      "import": "./build/index.js",
+      "types": "./build/index.d.ts"
+    },
+    "./crypto": {
+      "import": "./build/crypto/index.js",
+      "types": "./build/crypto/index.d.ts"
+    },
+    "./storage": {
+      "import": "./build/storage/resolver.js",
+      "types": "./build/storage/resolver.d.ts"
+    },
+    "./relay": {
+      "import": "./build/relay/client.js",
+      "types": "./build/relay/client.d.ts"
+    },
+    "./schema": {
+      "import": "./build/schema/types.js",
+      "types": "./build/schema/types.d.ts"
+    },
+    "./oauth": {
+      "import": "./build/oauth/index.js",
+      "types": "./build/oauth/index.d.ts"
+    }
+  },
+  "scripts": {
+    "build": "tsc --build tsconfig.build.json",
+    "test": "vitest --passWithNoTests",
+    "test:coverage": "vitest --coverage --passWithNoTests",
+    "check": "biome check . && bun run type-check",
+    "type-check": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "better-sqlite3": "^12.8.0",
+    "env-paths": "^3.0.0",
+    "jose": "^6.2.2"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.4.10",
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/node": "^24.12.2",
+    "@vitest/coverage-v8": "^4.1.3",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.3"
+  },
+  "engines": {
+    "node": ">=24.14.1"
+  },
+  "packageManager": "bun@1.2.21"
+}