@onvcodes/mcp-server 0.0.0-stage → 1.0.1

package/README.md

@@ -1,3 +1,182 @@
-# Temporary Holding Version
+# @onvcodes/mcp-server
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+ONV 平台的 [MCP (Model Context Protocol)](https://modelcontextprotocol.io) Server。
+把平台的**行情数据、公开 Agent/策略、回测、订阅、AI 生成**等能力暴露为 MCP 工具，
+供 **Claude Desktop / Cursor / Cline** 等 AI Agent 调用。
+
+## 架构：平台工具薄代理
+
+MCP Server **不本地硬编码工具**（避免与平台双套定义漂移），采用运行时动态发现：
+
+```
+MCP Client (Claude / Cursor …)
+   │  Streamable HTTP（远程，推荐）/ SSE（兼容）/ stdio（本地）
+   ▼
+mcp-server（本包）
+   │ ① 启动/会话时   GET {baseUrl}/api/mcp/platform/tools   → 发现工具清单（JSON Schema）
+   │ ② 客户端调用工具 POST {baseUrl}/api/mcp/platform/{tool} body { args }
+   │    凭证按会话透传：Authorization: Bearer > X-Api-Key > 匿名（仅公开工具）
+   ▼
+onv-backend（平台 /api/mcp/platform/*，3 通道鉴权：X-Api-Key / ?at= / Bearer JWT）
+```
+
+- 工具清单与执行端点由 **onv-backend 统一承载**（`backend/routes/platform-mcp.ts`），
+  本服务只是把平台工具翻译成 MCP 协议（zod schema 注册 + 调用转发）。
+- 平台不可达 / 未配置 API Key / 工具端点 404 时，注册一个只读 `__platform_health`
+  兜底工具报告状态（tools/list 不为空，便于排查），正常时**注册全部平台工具**。
+
+## 平台工具（当前 41 个）
+
+`tools/list` 返回 41 个平台工具，按权限分层，并按 4 组展示（`market` / `strategy` / `portfolio` / `account`）：
+
+| 分层 | 数量 | 说明 |
+|------|:---:|------|
+| L0 公开读（无需身份） | 10 | `market_*` · `symbol_search` · `quick_analysis` · `list_agents` · `get_agent` · `plans` · `wallet_balance` |
+| L1 用户读（需 API Key / 登录绑定用户） | 15 | `my_strategies` · `backtest_*` · `subscription_*` · `user_*` · `account_overview` · `positions` · `trade_history` · `credentials` · `risk_config` · `factory_runs` · `dex_quote` |
+| L2 写操作（需授权 scope） | 16 | `run_backtest` · `manage_strategy` · `publish_strategy` · `subscribe_*` · `ai_generate` · `ai_optimize` · `place_order` · `cancel_order` · `close_position` · `flat_all` · `set_risk_config` · `set_breaker` · `reset_breaker` · `dex_swap` · `factory_run` · `close_preview` |
+
+> 每个工具都带 MCP `annotations`：`title`（中文短名）、`readOnlyHint`（读为 true）、
+> `destructiveHint`（写为 true）——满足 Claude Connectors 目录的硬性要求。
+> 展示元数据集中在 [`backend/services/platform-tools/tool-meta.ts`](../backend/services/platform-tools/tool-meta.ts)。
+
+> 工具定义会随平台演进自动更新：改动只发生在 backend 的
+> [`PLATFORM_TOOL_DEFS`](../backend/services/platform-tools/registry.ts)，MCP Server 无需发版。
+> 后端通过 `ENABLE_PLATFORM_TOOLS=true` 开启工具端点（生产已开启）。
+
+## 快速接入（生产，推荐 Streamable HTTP）
+
+生产 MCP Server 已随 onv.codes 统一栈部署（容器 `onv-mcp`，nginx `/mcp` 与 `/mcp/` 反代）：
+
+- **Streamable HTTP 端点（推荐）**：`https://onv.codes/mcp`
+- **SSE 端点（兼容）**：`https://onv.codes/mcp/sse`
+- **鉴权（按会话透传）**：
+  - `Authorization: Bearer <token>`（OAuth / 平台 JWT）
+  - 或 `X-Api-Key: ah_… / ahk_…`（平台 / Agent Key）
+  - 均未提供时按**匿名**处理，只能使用公开工具（行情 / 公开 Agent / 套餐等）；
+    HTTP 入口不接受服务端 env Key 兜底，避免匿名调用方继承真实账户身份
+
+### Claude Desktop
+
+Claude Desktop → Settings → Developer → Edit Config → `claude_desktop_config.json`：
+
+```json
+{
+  "mcpServers": {
+    "onv": {
+      "type": "http",
+      "url": "https://onv.codes/mcp",
+      "headers": {
+        "X-Api-Key": "ah_你的平台APIKey"
+      }
+    }
+  }
+}
+```
+
+保存后重启 Claude Desktop，对话中即可使用 `platform_market_quote`、`platform_list_agents`、
+`platform_run_backtest`、`platform_ai_generate` 等工具。
+
+### Cursor
+
+Cursor → Settings → MCP → Add new MCP server：
+
+- **Type**：HTTP（远程，推荐）
+- **Name**：`onv`
+- **URL**：`https://onv.codes/mcp`
+- **Headers**：`X-Api-Key: ah_你的平台APIKey`
+
+旧版 Cursor 若不支持 HTTP 类型，可退回 SSE：`https://onv.codes/mcp/sse`。
+
+### 其他 MCP 客户端
+
+支持「Streamable HTTP + 自定义 header」的客户端填 `https://onv.codes/mcp` 与 `X-Api-Key`；
+仅支持 SSE 的客户端填 `https://onv.codes/mcp/sse`。两者共用同一套工具与鉴权。
+
+## 本地开发
+
+依赖：Node ≥ 18。
+
+```bash
+cd mcp-server
+npm install
+npm run build   # tsup 打包 ESM + CJS + dts 到 dist/
+npm test        # vitest（工具 schema / 注册测试）
+```
+
+启动：
+
+```bash
+# stdio 模式（默认，供 Claude Desktop / Cursor 本地拉起）
+ONV_API_KEY=ah_xxx node dist/server.js
+
+# HTTP 模式（本地 :3002，同时提供 /mcp 与 /sse）
+ONV_API_KEY=ah_xxx node dist/server.js --http
+# => HTTP server listening on http://localhost:3002 (mcp + sse)
+```
+
+### 环境变量
+
+| 变量 | 必填 | 默认值 | 说明 |
+| ---- | ---- | ------ | ---- |
+| `ONV_API_KEY` | - | - | 服务端兜底 Key（`ah_` / `ahk_` 前缀）。**客户端自带凭证时优先用客户端的**；均缺省时仅公开工具可用 |
+| `ONV_BASE_URL` | - | `https://onv.codes` | 平台 API 根地址（内网联调可指 `http://localhost:3100`） |
+| `PORT` | - | `3002` | HTTP 模式监听端口 |
+| `MCP_MESSAGE_PATH` | - | `/message` | SSE 握手事件里的消息投递路径；经 nginx 反代时配置（生产为 `/mcp/message`） |
+
+### Claude Desktop / Cursor 本地 stdio 配置
+
+```json
+{
+  "mcpServers": {
+    "onv": {
+      "command": "node",
+      "args": ["/absolute/path/to/onv/mcp-server/dist/server.js"],
+      "env": {
+        "ONV_API_KEY": "ah_你的平台APIKey",
+        "ONV_BASE_URL": "https://onv.codes"
+      }
+    }
+  }
+}
+```
+
+## API Key 与权限
+
+| Key | 前缀 | 用途 | 写权限 |
+| --- | --- | ---- | ---- |
+| 平台 API Key | `ah_` | 外部应用 / MCP 调用，绑定用户 + permissions | permissions 含工具 scope（如 `backtest:run` / `agents:write`）或 `admin` 才能直执写工具 |
+| Agent API Key | `ahk_` | Agent 身份直调 | scopes 含 `write` / `admin` 才能直执写工具 |
+
+- 读类（L0）无需鉴权即可调用（返回公开数据）。
+- 用户读（L1）与写（L2）工具要求 `X-Api-Key` 能解析到有效用户（无效/吊销返回 401）。
+- 写工具（L2）在 key 有对应 scope 时**直接执行并落审计**；无 scope 返回 403。
+- 对话场景（`?at=` HMAC token）写操作只落 pending，由前端操作卡确认后执行。
+
+## 生产部署（onv.codes 统一栈）
+
+- compose 服务：`apps/onv-core/deploy/docker-compose.onv.yml` 的 `mcp`（:3002，
+  build context `apps/onv`，dockerfile `mcp-server/Dockerfile`）。
+- nginx：`location = /mcp` / `location /mcp/` 反代到 `mcp:3002`（Streamable HTTP 关 buffering + 3600s 读超时）；
+  `location /api/mcp/` 反代到 `onv-backend:3100`（工具发现/调用端点）。
+- 凭据：**按会话透传**，不配置服务端 Key（`MCP_API_KEY` 已从 compose 移除）。
+  `MCP_BASE_URL` 默认 `https://onv.codes`。
+- 后端开关：`ENABLE_PLATFORM_TOOLS=true`（`platform-tools.ts` 灰度门，生产已置 true）。
+
+### 多会话说明
+
+MCP SDK 的 Server 实例同一时刻只能 connect 一个 transport（否则抛 `Already connected`）。
+本服务为**每个会话（Streamable HTTP session / SSE transport）创建独立 McpServer 实例**
+（每次会重新发现工具清单），多客户端并发/重连不会互相影响；凭证也随会话隔离。
+
+## 故障排查
+
+| 现象 | 原因与处理 |
+| --- | --- |
+| `tools/list` 只有 `__platform_health` | 工具发现失败。检查 `ONV_BASE_URL` 可达性、backend `ENABLE_PLATFORM_TOOLS=true`、nginx `/api/mcp/` 反代 |
+| 调用返回 `invalid or revoked api key` | 客户端下发的 `X-Api-Key` / Bearer 无效/已吊销（须 `ah_`/`ahk_` 前缀）；匿名调用用户级工具即为此提示 |
+| 调用返回 404 `unknown platform tool` | 工具清单与端点版本不同步（发现后平台已改名），更新 mcp-server 镜像重连 |
+| POST `/message` 502 | 多为 SSE 会话未建立/已断开时投递（sessionId 过期），客户端应重连重新握手 |
+
+## License
+
+Apache-2.0

package/dist/server.cjs

@@ -0,0 +1,514 @@
+#!/usr/bin/env node
+'use strict';
+
+var mcp_js = require('@modelcontextprotocol/sdk/server/mcp.js');
+var stdio_js = require('@modelcontextprotocol/sdk/server/stdio.js');
+var sse_js = require('@modelcontextprotocol/sdk/server/sse.js');
+var streamableHttp_js = require('@modelcontextprotocol/sdk/server/streamableHttp.js');
+var http = require('http');
+var crypto = require('crypto');
+var zod = require('zod');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var http__default = /*#__PURE__*/_interopDefault(http);
+
+// ../packages/sdk-ts/dist/index.js
+var STATUS_CODE = {
+  400: "INVALID_REQUEST",
+  401: "UNAUTHORIZED",
+  403: "FORBIDDEN",
+  404: "NOT_FOUND",
+  405: "METHOD_NOT_ALLOWED",
+  409: "CONFLICT",
+  422: "UNPROCESSABLE_ENTITY",
+  429: "RATE_LIMITED",
+  500: "INTERNAL_ERROR",
+  502: "BAD_GATEWAY",
+  503: "SERVICE_UNAVAILABLE",
+  504: "GATEWAY_TIMEOUT"
+};
+var STATUS_MESSAGE = {
+  400: "Bad Request",
+  401: "Unauthorized",
+  403: "Forbidden",
+  404: "Not Found",
+  405: "Method Not Allowed",
+  409: "Conflict",
+  422: "Unprocessable Entity",
+  429: "Too Many Requests",
+  500: "Internal Server Error",
+  502: "Bad Gateway",
+  503: "Service Unavailable",
+  504: "Gateway Timeout"
+};
+function stringifyDetail(value) {
+  if (typeof value === "string") return value;
+  if (value === void 0 || value === null) return "";
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+var ONVError = class _ONVError extends Error {
+  /** 错误码（string）。 */
+  code;
+  /** HTTP 状态码；网络错误为 0。 */
+  statusCode;
+  /** 详细说明。 */
+  detail;
+  /** 可选的处理建议。 */
+  action;
+  constructor(message, code, statusCode, detail = "", action) {
+    super(message);
+    this.name = "ONVError";
+    this.code = code;
+    this.statusCode = statusCode;
+    this.detail = detail;
+    this.action = action;
+  }
+  /** 是否为网络层错误（fetch 失败 / 超时）。 */
+  get isNetworkError() {
+    return this.code === "NETWORK_ERROR";
+  }
+  /**
+   * 从 HTTP 响应构造错误。
+   * 响应体按 `{ code, detail, action }` 解析（同时兼容 `{ message }`）；
+   * 缺少 code 时按 statusCode 映射（如 404 -> NOT_FOUND）。
+   */
+  static fromHttpResponse(status, body) {
+    const parsed = body && typeof body === "object" ? body : {};
+    const rawCode = parsed.code;
+    const code = typeof rawCode === "string" || typeof rawCode === "number" ? String(rawCode) : STATUS_CODE[status] ?? `HTTP_${status}`;
+    const detail = stringifyDetail(parsed.detail);
+    const action = typeof parsed.action === "string" ? parsed.action : void 0;
+    const message = typeof parsed.message === "string" && parsed.message ? parsed.message : detail ? `HTTP ${status}: ${detail}` : `HTTP ${status} ${STATUS_MESSAGE[status] ?? ""}`.trim();
+    return new _ONVError(message, code, status, detail, action);
+  }
+  /** 网络失败（fetch 抛错 / 超时 / DNS 等）→ code = NETWORK_ERROR, statusCode = 0。 */
+  static networkError(original) {
+    const cause = original instanceof Error ? original : new Error(String(original));
+    return new _ONVError(
+      `Network error: ${cause.message}`,
+      "NETWORK_ERROR",
+      0,
+      cause.message
+    );
+  }
+};
+
+// src/auth.ts
+function headerValue(value) {
+  if (Array.isArray(value)) return value[0]?.trim() ?? "";
+  return (value ?? "").trim();
+}
+function resolveCredential(headers) {
+  const authorization = headerValue(headers.authorization);
+  if (authorization) {
+    const matched = /^Bearer\s+(.+)$/i.exec(authorization);
+    if (matched?.[1]?.trim()) {
+      return { type: "bearer", accessToken: matched[1].trim() };
+    }
+  }
+  const apiKey = headerValue(headers["x-api-key"]);
+  if (apiKey) return { type: "apikey", apiKey };
+  return { type: "anonymous" };
+}
+
+// src/oauth.ts
+function oauthIssuer() {
+  return String(process.env.MCP_OAUTH_ISSUER || "https://onv.codes").replace(/\/+$/, "");
+}
+function resourceIdentifier() {
+  return String(process.env.MCP_RESOURCE_URL || `${oauthIssuer()}/mcp`).replace(/\/+$/, "");
+}
+function protectedResourceMetadataUrl() {
+  return `${oauthIssuer()}/.well-known/oauth-protected-resource`;
+}
+function protectedResourceMetadata() {
+  return {
+    resource: resourceIdentifier(),
+    authorization_servers: [oauthIssuer()],
+    bearer_methods_supported: ["header"],
+    scopes_supported: ["mcp:read", "mcp:write", "mcp:trade", "mcp:backtest"],
+    resource_name: "ONV Platform MCP",
+    resource_documentation: `${oauthIssuer()}/mcp-setup`
+  };
+}
+function oauthChallengeEnabled() {
+  return String(process.env.MCP_OAUTH_CHALLENGE || "").toLowerCase() === "true";
+}
+function hasCredential(headers) {
+  const auth = headers.authorization;
+  const apiKey = headers["x-api-key"];
+  return Boolean((Array.isArray(auth) ? auth[0] : auth) || (Array.isArray(apiKey) ? apiKey[0] : apiKey));
+}
+function sendOAuthChallenge(res) {
+  res.writeHead(401, {
+    "Content-Type": "application/json",
+    "WWW-Authenticate": `Bearer resource_metadata="${protectedResourceMetadataUrl()}"`
+  });
+  res.end(JSON.stringify({
+    jsonrpc: "2.0",
+    error: { code: -32001, message: "Unauthorized: OAuth bearer token required" },
+    id: null
+  }));
+}
+
+// src/config.ts
+function loadConfig(env = process.env) {
+  return {
+    apiKey: env.ONV_API_KEY || void 0,
+    baseUrl: env.ONV_BASE_URL || "https://onv.codes"
+  };
+}
+function jsonSchemaToZod(schema) {
+  const shape = {};
+  if (!schema || typeof schema !== "object") return shape;
+  const props = schema.properties ?? {};
+  const required = Array.isArray(schema.required) ? schema.required : [];
+  for (const [key, p] of Object.entries(props)) {
+    const desc = p?.description ?? "";
+    let zt;
+    switch (p?.type) {
+      case "number":
+        zt = zod.z.number();
+        break;
+      case "boolean":
+        zt = zod.z.boolean();
+        break;
+      case "array":
+        zt = zod.z.array(zod.z.any());
+        break;
+      case "object":
+        zt = zod.z.record(zod.z.string(), zod.z.any());
+        break;
+      default:
+        zt = zod.z.string();
+        break;
+    }
+    let field = required.includes(key) ? zt : zt.optional();
+    if (desc) field = field.describe(desc);
+    shape[key] = field;
+  }
+  return shape;
+}
+async function safeRun(fn) {
+  try {
+    const result = await fn();
+    const text = result === void 0 ? "OK" : JSON.stringify(result, null, 2);
+    return { content: [{ type: "text", text }] };
+  } catch (err) {
+    return {
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(
+            { error: { code: "PROXY_ERROR", message: err?.message || String(err) } },
+            null,
+            2
+          )
+        }
+      ],
+      isError: true
+    };
+  }
+}
+async function discoverTools(config) {
+  try {
+    const res = await fetch(`${config.baseUrl.replace(/\/+$/, "")}/api/mcp/platform/tools`, {
+      signal: AbortSignal.timeout(15e3)
+    });
+    if (!res.ok) return null;
+    const json = await res.json().catch(() => null);
+    return json?.data?.tools ?? null;
+  } catch {
+    return null;
+  }
+}
+var GROUP_LABELS = {
+  market: "\u884C\u60C5",
+  strategy: "\u7B56\u7565",
+  portfolio: "\u6301\u4ED3\u4E0E\u6267\u884C",
+  account: "\u8D26\u6237\u4E0E\u989D\u5EA6"
+};
+function humanizeToolName(name) {
+  return name.replace(/^platform_/, "").replace(/_/g, " ");
+}
+async function registerTools(server, config) {
+  const base = config.baseUrl.replace(/\/+$/, "");
+  const headers = { "content-type": "application/json" };
+  if (config.accessToken) headers["authorization"] = `Bearer ${config.accessToken}`;
+  else if (config.apiKey) headers["x-api-key"] = config.apiKey;
+  const tools = await discoverTools(config);
+  if (!tools || tools.length === 0) {
+    server.registerTool(
+      "__platform_health",
+      {
+        title: "Platform Health",
+        description: "\u5E73\u53F0 MCP \u7AEF\u70B9\u72B6\u6001\u3002\u5DE5\u5177\u672A\u52A0\u8F7D\u65F6\u7528\u4E8E\u6392\u67E5\uFF1A\u68C0\u67E5 ONV_BASE_URL \u4E0E ONV_API_KEY \u914D\u7F6E\u3002",
+        inputSchema: {}
+      },
+      async () => safeRun(() => ({
+        ok: false,
+        error: "platform tools unavailable",
+        detail: tools === null ? "\u65E0\u6CD5\u4ECE\u5E73\u53F0\u83B7\u53D6\u5DE5\u5177\u6E05\u5355\uFF08\u68C0\u67E5 ONV_BASE_URL \u4E0E\u7F51\u7EDC\uFF09" : "\u5E73\u53F0\u5DE5\u5177\u5217\u8868\u4E3A\u7A7A\uFF08\u68C0\u67E5 ENABLE_PLATFORM_TOOLS / PLATFORM_TOOL_PUBLIC_URL\uFF09",
+        baseUrl: base,
+        hasApiKey: !!config.apiKey
+      }))
+    );
+    return 0;
+  }
+  for (const tool of tools) {
+    const title = tool.title || humanizeToolName(tool.name);
+    const isWrite = tool.mode === "write";
+    const groupLabel = tool.group ? GROUP_LABELS[tool.group] : "";
+    const prefix = groupLabel ? `\u3010${groupLabel}\u3011` : "";
+    const costSuffix = tool.cost?.text ? `\uFF08cost: ${tool.cost.text}\uFF09` : "";
+    const suffix = isWrite ? "\uFF08\u5199\u64CD\u4F5C\uFF0C\u5916\u90E8\u8C03\u7528\u5C06\u4EE5 apikey \u8EAB\u4EFD\u76F4\u63A5\u6267\u884C\uFF09" : "";
+    server.registerTool(
+      tool.name,
+      {
+        title,
+        description: `${prefix}${tool.description ?? ""}${costSuffix}${suffix}`,
+        inputSchema: jsonSchemaToZod(tool.inputSchema),
+        annotations: {
+          title,
+          readOnlyHint: !isWrite,
+          destructiveHint: isWrite
+        }
+      },
+      async (args) => safeRun(async () => {
+        const res = await fetch(`${base}/api/mcp/platform/${encodeURIComponent(tool.name)}`, {
+          method: "POST",
+          headers,
+          body: JSON.stringify({ args: args ?? {} }),
+          signal: AbortSignal.timeout(12e4)
+        });
+        const text = await res.text();
+        let json;
+        try {
+          json = JSON.parse(text);
+        } catch {
+          json = text;
+        }
+        if (!res.ok) {
+          throw new Error(`platform tool failed (HTTP ${res.status}): ${text.slice(0, 500)}`);
+        }
+        return json;
+      })
+    );
+  }
+  return tools.length;
+}
+
+// src/server.ts
+var DEFAULT_PORT = 3002;
+var MAX_BODY_BYTES = 4 * 1024 * 1024;
+function configForCredential(credential) {
+  const base = loadConfig();
+  switch (credential.type) {
+    case "bearer":
+      return { ...base, apiKey: void 0, accessToken: credential.accessToken };
+    case "apikey":
+      return { ...base, apiKey: credential.apiKey, accessToken: void 0 };
+    default:
+      return { ...base, apiKey: void 0, accessToken: void 0 };
+  }
+}
+async function createMcpServer(config = loadConfig()) {
+  const server = new mcp_js.McpServer({
+    name: "onv-mcp-server",
+    version: "1.0.0"
+  });
+  const count = await registerTools(server, config);
+  console.error(
+    `[onv-mcp] registered ${count} platform tools (baseUrl=${config.baseUrl}, auth=${config.accessToken ? "bearer" : config.apiKey ? "apikey" : "anonymous"})`
+  );
+  return server;
+}
+async function readJsonBody(req) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    const buf = chunk;
+    size += buf.length;
+    if (size > MAX_BODY_BYTES) throw new Error("request body too large");
+    chunks.push(buf);
+  }
+  if (size === 0) return void 0;
+  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+function sendJson(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function applyCors(res) {
+  res.setHeader("Access-Control-Allow-Origin", "*");
+  res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+  res.setHeader(
+    "Access-Control-Allow-Headers",
+    "Content-Type, Authorization, X-Api-Key, Mcp-Session-Id, MCP-Protocol-Version"
+  );
+  res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id");
+}
+async function startHttpServer(port) {
+  const sseTransports = /* @__PURE__ */ new Map();
+  const streamTransports = /* @__PURE__ */ new Map();
+  const httpServer = http__default.default.createServer(async (req, res) => {
+    const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+    if (req.method === "GET" && (url.pathname === "/" || url.pathname === "/health")) {
+      res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end(
+        "ONV MCP Server is running.\nStreamable HTTP: POST/GET/DELETE /mcp\nSSE (legacy):    GET /sse + POST /message\n"
+      );
+      return;
+    }
+    if (req.method === "GET" && (url.pathname === "/.well-known/oauth-protected-resource" || url.pathname === "/.well-known/oauth-protected-resource/mcp")) {
+      res.writeHead(200, {
+        "Content-Type": "application/json",
+        "Cache-Control": "public, max-age=300"
+      });
+      res.end(JSON.stringify(protectedResourceMetadata()));
+      return;
+    }
+    if (url.pathname === "/mcp") {
+      applyCors(res);
+      if (req.method === "OPTIONS") {
+        res.writeHead(204).end();
+        return;
+      }
+      if (oauthChallengeEnabled() && !hasCredential(req.headers)) {
+        sendOAuthChallenge(res);
+        return;
+      }
+      await handleStreamableHttp(req, res, streamTransports);
+      return;
+    }
+    if (req.method === "GET" && url.pathname === "/sse") {
+      if (oauthChallengeEnabled() && !hasCredential(req.headers)) {
+        sendOAuthChallenge(res);
+        return;
+      }
+      const messageEndpoint = process.env.MCP_MESSAGE_PATH || "/message";
+      const transport = new sse_js.SSEServerTransport(messageEndpoint, res);
+      sseTransports.set(transport.sessionId, transport);
+      res.on("close", () => {
+        sseTransports.delete(transport.sessionId);
+      });
+      try {
+        const credential = resolveCredential(req.headers);
+        const sessionServer = await createMcpServer(configForCredential(credential));
+        await sessionServer.connect(transport);
+      } catch (err) {
+        sseTransports.delete(transport.sessionId);
+        const message = err instanceof Error ? err.message : String(err);
+        console.error(`[onv-mcp] session ${transport.sessionId} connect failed: ${message}`);
+        res.destroy();
+      }
+      return;
+    }
+    if (req.method === "POST" && url.pathname === "/message") {
+      const sessionId = url.searchParams.get("sessionId");
+      const transport = sessionId ? sseTransports.get(sessionId) : void 0;
+      if (!transport) {
+        res.writeHead(400, { "Content-Type": "text/plain" });
+        res.end("No active SSE transport for sessionId");
+        return;
+      }
+      await transport.handlePostMessage(req, res);
+      return;
+    }
+    res.writeHead(404, { "Content-Type": "text/plain" });
+    res.end("Not Found");
+  });
+  await new Promise((resolve) => httpServer.listen(port, resolve));
+  return httpServer;
+}
+async function handleStreamableHttp(req, res, transports) {
+  const rawSessionId = req.headers["mcp-session-id"];
+  const sessionId = Array.isArray(rawSessionId) ? rawSessionId[0] : rawSessionId;
+  try {
+    let transport = sessionId ? transports.get(sessionId) : void 0;
+    if (!transport) {
+      if (sessionId) {
+        sendJson(res, 404, {
+          jsonrpc: "2.0",
+          error: { code: -32001, message: "Session not found" },
+          id: null
+        });
+        return;
+      }
+      if (req.method !== "POST") {
+        sendJson(res, 400, {
+          jsonrpc: "2.0",
+          error: { code: -32e3, message: "Bad Request: Mcp-Session-Id header is required" },
+          id: null
+        });
+        return;
+      }
+      const body = await readJsonBody(req);
+      if (!body || body.method !== "initialize") {
+        sendJson(res, 400, {
+          jsonrpc: "2.0",
+          error: { code: -32e3, message: "Bad Request: first request must be initialize" },
+          id: null
+        });
+        return;
+      }
+      const credential = resolveCredential(req.headers);
+      const created = new streamableHttp_js.StreamableHTTPServerTransport({
+        sessionIdGenerator: () => crypto.randomUUID(),
+        onsessioninitialized: (id) => {
+          transports.set(id, created);
+        }
+      });
+      created.onclose = () => {
+        if (created.sessionId) transports.delete(created.sessionId);
+      };
+      const sessionServer = await createMcpServer(configForCredential(credential));
+      await sessionServer.connect(created);
+      await created.handleRequest(req, res, body);
+      return;
+    }
+    if (req.method === "POST") {
+      const body = await readJsonBody(req);
+      await transport.handleRequest(req, res, body);
+      return;
+    }
+    await transport.handleRequest(req, res);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`[onv-mcp] streamable http error: ${message}`);
+    if (!res.headersSent) {
+      sendJson(res, 500, {
+        jsonrpc: "2.0",
+        error: { code: -32603, message: "Internal server error" },
+        id: null
+      });
+    }
+  }
+}
+async function main() {
+  const httpMode = process.argv.includes("--sse") || process.argv.includes("--http");
+  if (httpMode) {
+    const port = Number(process.env.PORT ?? DEFAULT_PORT);
+    await startHttpServer(port);
+    console.error(`[onv-mcp] HTTP server listening on http://localhost:${port} (mcp + sse)`);
+  } else {
+    const server = await createMcpServer();
+    const transport = new stdio_js.StdioServerTransport();
+    await server.connect(transport);
+  }
+}
+main().catch((err) => {
+  const message = err instanceof ONVError ? err.message : err instanceof Error ? err.message : String(err);
+  console.error(`[onv-mcp] failed to start: ${message}`);
+  process.exit(1);
+});
+
+exports.createMcpServer = createMcpServer;
+exports.startHttpServer = startHttpServer;
+//# sourceMappingURL=server.cjs.map
+//# sourceMappingURL=server.cjs.map