@numa-tech/numa 1.20.0 → 1.20.1

package/dist/ai-registry/mcp-runtime.js

@@ -0,0 +1,134 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { resolveBackendUrl } from "../backend.js";
+import { PACKAGE_VERSION } from "../branding.js";
+import { fetchWithKeycloakIdentity } from "../oauth.js";
+import { bridgeMcpTransports } from "./bridge.js";
+import { AiRegistryError } from "./errors.js";
+export function resolveMcpRuntimeEndpoint(config, connection) {
+    if (connection.transport !== "STREAMABLE_HTTP") {
+        throw new AiRegistryError("MCP connection must use a governed Streamable HTTP endpoint.", "ai_registry_mcp_transport_invalid");
+    }
+    try {
+        const url = new URL(resolveBackendUrl({ ...config, allowAbsoluteBackendUrls: true }, {
+            method: "POST",
+            ...(connection.endpoint.startsWith("/") ? { path: connection.endpoint } : { url: connection.endpoint })
+        }));
+        const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+        if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback))
+            throw new Error("HTTPS is required outside loopback");
+        if (url.search || url.hash)
+            throw new Error("Queries and fragments are not allowed");
+        if (!/\/api\/v1\/mcp\/[1-9][0-9]*\/[A-Za-z0-9_.-]+$/u.test(url.pathname))
+            throw new Error("A governed MCP service route is required");
+        return url;
+    }
+    catch {
+        throw new AiRegistryError("MCP endpoint must be the governed route on the configured platform API origin and service path.", "ai_registry_mcp_endpoint_invalid");
+    }
+}
+/** Restrict every SDK request before attaching identity; never follow redirects with a token. */
+export function createMcpRuntimeFetch(config, endpoint, dependencies = {}) {
+    return async (input, init) => {
+        const requested = new URL(String(input));
+        if (requested.href !== endpoint.href) {
+            throw new AiRegistryError("MCP transport attempted to leave its governed endpoint.", "ai_registry_mcp_endpoint_invalid");
+        }
+        const response = await fetchWithKeycloakIdentity(config, endpoint.href, () => ({ ...init, headers: new Headers(init?.headers), redirect: "error" }), dependencies);
+        // Do not propagate a credential-bearing gateway/proxy error body through SDK exceptions.
+        if (!response.ok && !(response.status === 405 && ["GET", "DELETE"].includes(init?.method ?? "GET"))) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new AiRegistryError(`MCP gateway HTTP ${response.status}.`, response.status === 401 ? "login_required" : response.status === 403 ? "ai_registry_mcp_forbidden" : "ai_registry_mcp_upstream_error", response.status, response.headers.get("x-request-id") ?? undefined);
+        }
+        return response;
+    };
+}
+/** Track negotiation for a raw bridge (SDK Client normally performs this itself). */
+export class GovernedMcpTransport {
+    remote;
+    onmessage;
+    onerror;
+    onclose;
+    initializeId;
+    closing;
+    constructor(remote) {
+        this.remote = remote;
+        remote.onmessage = (message) => {
+            if ("id" in message && message.id === this.initializeId && "result" in message
+                && typeof message.result.protocolVersion === "string") {
+                remote.setProtocolVersion(message.result.protocolVersion);
+            }
+            this.onmessage?.(message);
+        };
+        remote.onerror = (error) => { if (!this.closing)
+            this.onerror?.(error); };
+        remote.onclose = () => this.onclose?.();
+    }
+    get sessionId() { return this.remote.sessionId; }
+    start() { return this.remote.start(); }
+    setProtocolVersion(version) { this.remote.setProtocolVersion(version); }
+    send(message, options) {
+        if ("method" in message && message.method === "initialize" && "id" in message)
+            this.initializeId = message.id;
+        return this.remote.send(message, options);
+    }
+    close() {
+        this.closing ??= (async () => {
+            let timer;
+            try {
+                // DELETE is best effort and bounded; a failed cleanup must not hide the actual RPC error.
+                await Promise.race([
+                    this.remote.terminateSession().catch(() => undefined),
+                    new Promise((resolve) => { timer = setTimeout(resolve, 1500); timer.unref(); })
+                ]);
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
+                await this.remote.close();
+            }
+        })();
+        return this.closing;
+    }
+}
+export function createMcpRuntimeTransport(config, connection, dependencies = {}) {
+    const endpoint = resolveMcpRuntimeEndpoint(config, connection);
+    return new GovernedMcpTransport(new StreamableHTTPClientTransport(endpoint, {
+        fetch: createMcpRuntimeFetch(config, endpoint, dependencies)
+    }));
+}
+export async function withMcpRuntimeClient(transport, operation) {
+    const client = new Client({ name: "numa-mcp", version: PACKAGE_VERSION }, { capabilities: {} });
+    try {
+        await client.connect(transport, { timeout: 30_000 });
+        return await operation(client);
+    }
+    finally {
+        await transport.close();
+        await client.close();
+    }
+}
+/** Proxy all MCP frames unchanged: capabilities, pagination, notifications, cancellation and reverse requests. */
+export async function runMcpRuntimeProxy(remote, options = {}) {
+    const stdin = options.stdin ?? process.stdin;
+    const stdout = options.stdout ?? process.stdout;
+    const signals = options.signals ?? process;
+    const local = new StdioServerTransport(stdin, stdout);
+    const finish = () => { void local.close(); };
+    stdin.once("end", finish);
+    stdin.once("close", finish);
+    signals.once("SIGINT", finish);
+    signals.once("SIGTERM", finish);
+    try {
+        await bridgeMcpTransports(local, remote);
+    }
+    finally {
+        stdin.off("end", finish);
+        stdin.off("close", finish);
+        signals.off("SIGINT", finish);
+        signals.off("SIGTERM", finish);
+        await remote.close();
+    }
+}
+//# sourceMappingURL=mcp-runtime.js.map

package/dist/ai-registry/mcp-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-runtime.js","sourceRoot":"","sources":["../../src/ai-registry/mcp-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAGjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAE,yBAAyB,EAAkC,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAQ9C,MAAM,UAAU,yBAAyB,CAAC,MAAkB,EAAE,UAAgC;IAC5F,IAAI,UAAU,CAAC,SAAS,KAAK,iBAAiB,EAAE,CAAC;QAC/C,MAAM,IAAI,eAAe,CAAC,8DAA8D,EAAE,mCAAmC,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,EAAE;YACnF,MAAM,EAAE,MAAM;YACd,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;SACxG,CAAC,CAAC,CAAC;QACJ,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAChI,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACrF,IAAI,CAAC,gDAAgD,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACtI,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,iGAAiG,EAAE,kCAAkC,CAAC,CAAC;IACnK,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,qBAAqB,CACnC,MAAkB,EAClB,QAAa,EACb,YAAY,GAA8B,EAAE;IAE5C,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,IAAI,eAAe,CAAC,yDAAyD,EAAE,kCAAkC,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EACpE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7F,yFAAyF;QACzF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;YACpG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM,IAAI,eAAe,CAAC,oBAAoB,QAAQ,CAAC,MAAM,GAAG,EAC9D,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,gCAAgC,EACrI,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,OAAO,oBAAoB;IAMF,MAAM;IALnC,SAAS,CAA0B;IACnC,OAAO,CAAwB;IAC/B,OAAO,CAAwB;IACvB,YAAY,CAAa;IACzB,OAAO,CAAiB;IAChC,YAA6B,MAAqC;sBAArC,MAAM;QACjC,MAAM,CAAC,SAAS,GAAG,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,IAAI,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,YAAY,IAAI,QAAQ,IAAI,OAAO;mBACzE,OAAO,OAAO,CAAC,MAAM,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;gBACxD,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC,CAAC;QACF,MAAM,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,SAAS,KAAyB,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACrE,KAAK,KAAoB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACtD,kBAAkB,CAAC,OAAe,IAAU,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,OAAuB,EAAE,OAA8B;QAC1D,IAAI,QAAQ,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,IAAI,IAAI,IAAI,OAAO;YAAE,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK;QACH,IAAI,CAAC,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;YAC3B,IAAI,KAAgD,CAAC;YACrD,IAAI,CAAC;gBACH,0FAA0F;gBAC1F,MAAM,OAAO,CAAC,IAAI,CAAC;oBACjB,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;oBACrD,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;iBACtF,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,IAAI,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC/B,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;CACF;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAkB,EAAE,UAAgC,EAC5F,YAAY,GAA8B,EAAE;IAC5C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/D,OAAO,IAAI,oBAAoB,CAAC,IAAI,6BAA6B,CAAC,QAAQ,EAAE;QAC1E,KAAK,EAAE,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC;KAC7D,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAI,SAAoB,EAAE,SAAyC;IAC3G,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;IAChG,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,OAAO,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,kHAAkH;AAClH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAiB,EAAE,OAAO,GAI/D,EAAE;IACJ,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,GAAS,EAAE,GAAG,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5B,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/ai-registry/mcp-stdio.d.ts

@@ -0,0 +1,2 @@
+/** Recognize stdio mode before Commander/profile startup can fail. */
+export declare function isMcpStdioInvocation(args: readonly string[]): boolean;

package/dist/ai-registry/mcp-stdio.js

@@ -0,0 +1,18 @@
+/** Recognize stdio mode before Commander/profile startup can fail. */
+export function isMcpStdioInvocation(args) {
+    const words = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--issuer") {
+            index += 1;
+            continue;
+        }
+        if (["--json", "-j", "--debug"].includes(arg) || arg.startsWith("--issuer="))
+            continue;
+        words.push(arg);
+        if (words.length === 2)
+            break;
+    }
+    return words[0] === "mcp" && ["proxy", "bridge"].includes(words[1] ?? "");
+}
+//# sourceMappingURL=mcp-stdio.js.map

package/dist/ai-registry/mcp-stdio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-stdio.js","sourceRoot":"","sources":["../../src/ai-registry/mcp-stdio.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QACzB,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YAAC,KAAK,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QACvF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;IAChC,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5E,CAAC"}