@orkestrel/mcp 0.0.10 → 0.0.12

package/dist/src/server/index.cjs

@@ -145,27 +145,6 @@ function allowsOrigin(request, options) {
 	return options?.origins?.includes(parsed.origin) ?? false;
 }
 /**
-* Whether a modern HTTP request's required standard headers match its JSON-RPC body.
-*
-* @remarks
-* Requires `MCP-Protocol-Version` to equal the reserved `_meta` version and `Mcp-Method`
-* to equal `method`. `Mcp-Name` is required only for `tools/call`, where it must equal
-* `params.name`; discovery and listing requests need no name because none is derivable.
-* Legacy requests return `false` because this predicate models the modern contract only.
-*
-* @param request - The HTTP request carrying the headers
-* @param message - The parsed JSON-RPC request body
-* @returns `true` only when every method-applicable modern header matches
-*/
-function matchesModernHeaders(request, message) {
-	if (!(0, _src_core.isModernRequest)(message)) return false;
-	const version = ((0, _orkestrel_contract.isRecord)(message.params?.["_meta"]) ? message.params["_meta"] : void 0)?.[_src_core.MCP_META_VERSION];
-	if (!(0, _orkestrel_contract.isString)(version) || request.headers.get("mcp-protocol-version") !== version || request.headers.get("mcp-method") !== message.method) return false;
-	if (message.method !== "tools/call") return true;
-	const name = message.params?.["name"];
-	return (0, _orkestrel_contract.isString)(name) && request.headers.get("mcp-name") === name;
-}
-/**
 * Read the request's `mcp-session-id` header — the session id a stateful transport
 * validates, or `undefined` when absent.
 *
@@ -419,6 +398,87 @@ function bridgeMessageTransport(transport) {
 //#endregion
 //#region src/server/inferers.ts
 /**
+* Infer the first required MCP HTTP header that is missing or mismatched.
+*
+* @remarks
+* A modern request derives its protocol, method, and tools/call-only name expectations from
+* the JSON-RPC body. A legacy request body requires a protocol header after initialization,
+* while a supplied legacy session version additionally diagnoses a header that disagrees with
+* the active session. Messages name the expected value but never echo the client-supplied one.
+*
+* @param request - The HTTP request carrying the headers
+* @param reference - The parsed request body, or the active legacy session version
+* @returns The first header issue, or `undefined` when the applicable headers agree
+*
+* @example
+* ```ts
+* const issue = inferHeaderIssue(request, rpcRequest)
+* issue?.header // 'Mcp-Method' when that field is absent or mismatched
+* ```
+*/
+function inferHeaderIssue(request, reference) {
+	const protocol = request.headers.get(MCP_PROTOCOL_VERSION_HEADER);
+	if ((0, _orkestrel_contract.isString)(reference)) {
+		if (protocol === null) return {
+			header: "MCP-Protocol-Version",
+			reason: "missing",
+			message: `Required MCP-Protocol-Version header is missing; the active session uses '${reference}'.`
+		};
+		if (protocol !== reference) return {
+			header: "MCP-Protocol-Version",
+			reason: "mismatched",
+			message: `MCP-Protocol-Version header does not match the active session version '${reference}'.`
+		};
+		return;
+	}
+	if (!(0, _src_core.isModernRequest)(reference)) {
+		if ((0, _src_core.isInitializeRequest)(reference) || protocol !== null) return void 0;
+		return {
+			header: "MCP-Protocol-Version",
+			reason: "missing",
+			message: `Required MCP-Protocol-Version header is missing; this server offers '${_src_core.MCP_PROTOCOL_VERSION}'.`
+		};
+	}
+	const message = reference;
+	const version = ((0, _orkestrel_contract.isRecord)(message.params?.["_meta"]) ? message.params["_meta"] : void 0)?.[_src_core.MCP_META_VERSION];
+	if (!(0, _orkestrel_contract.isString)(version)) return void 0;
+	if (protocol === null) return {
+		header: "MCP-Protocol-Version",
+		reason: "missing",
+		message: `Required MCP-Protocol-Version header is missing; the request body version is '${version}'.`
+	};
+	if (protocol !== version) return {
+		header: "MCP-Protocol-Version",
+		reason: "mismatched",
+		message: `MCP-Protocol-Version header does not match the request body version '${version}'.`
+	};
+	const method = request.headers.get(MCP_METHOD_HEADER);
+	if (method === null) return {
+		header: "Mcp-Method",
+		reason: "missing",
+		message: `Required Mcp-Method header is missing; the request body method is '${message.method}'.`
+	};
+	if (method !== message.method) return {
+		header: "Mcp-Method",
+		reason: "mismatched",
+		message: `Mcp-Method header does not match the request body method '${message.method}'.`
+	};
+	if (message.method !== "tools/call") return void 0;
+	const name = message.params?.["name"];
+	if (!(0, _orkestrel_contract.isString)(name)) return void 0;
+	const header = request.headers.get(MCP_NAME_HEADER);
+	if (header === null) return {
+		header: "Mcp-Name",
+		reason: "missing",
+		message: `Required Mcp-Name header is missing; the request body tool name is '${name}'.`
+	};
+	if (header !== name) return {
+		header: "Mcp-Name",
+		reason: "mismatched",
+		message: `Mcp-Name header does not match the request body tool name '${name}'.`
+	};
+}
+/**
 * Infer the legacy revision an `initialize` request negotiates.
 *
 * @remarks
@@ -590,9 +650,10 @@ function createMCPPostHandler(mcp, options) {
 		const protocol = request.headers.get(MCP_PROTOCOL_VERSION_HEADER);
 		if (era === "modern") {
 			if ((0, _src_core.parseRequestContext)(rpcRequest) === void 0) return Response.json((0, _src_core.buildJSONRPCError)(id, _src_core.JSONRPC_INVALID_PARAMS, "Invalid params: malformed modern request metadata"), { status: 400 });
-			if (!matchesModernHeaders(request, rpcRequest)) return Response.json((0, _src_core.buildJSONRPCError)(id, _src_core.MCP_HEADER_MISMATCH, "MCP request headers do not match the request body"), { status: 400 });
-		} else {
-			if (protocol === null && !(0, _src_core.isInitializeRequest)(rpcRequest)) return Response.json((0, _src_core.buildJSONRPCError)(id, _src_core.MCP_HEADER_MISMATCH, "MCP request headers do not match the request body"), { status: 400 });
+		}
+		const issue = inferHeaderIssue(request, rpcRequest);
+		if (issue !== void 0) return Response.json((0, _src_core.buildJSONRPCError)(id, _src_core.MCP_HEADER_MISMATCH, issue.message), { status: 400 });
+		if (era === "legacy") {
 			if (protocol !== null && !(0, _src_core.isMCPVersion)(protocol)) return Response.json((0, _src_core.buildJSONRPCError)(id, _src_core.MCP_UNSUPPORTED_VERSION, `Unsupported MCP protocol version '${protocol}'`, {
 				supported: _src_core.SUPPORTED_PROTOCOL_VERSIONS,
 				requested: protocol
@@ -1691,11 +1752,11 @@ function createMCPSession(options) {
 		if (!Reflect.set(context.state, "session", entry.session)) throw new Error("MCP session state is not writable");
 		const headers = new Headers(request.headers);
 		if (parsed === void 0 || !(0, _src_core.isInitializeRequest)(parsed)) {
-			const protocol = headers.get(MCP_PROTOCOL_VERSION_HEADER);
-			if (protocol === null) headers.set(MCP_PROTOCOL_VERSION_HEADER, entry.version);
-			else if (protocol !== entry.version) {
+			const issue = inferHeaderIssue(request, entry.version);
+			if (issue?.reason === "missing") headers.set(MCP_PROTOCOL_VERSION_HEADER, entry.version);
+			else if (issue !== void 0) {
 				const requestId = parsed !== void 0 && "method" in parsed ? parsed.id ?? null : null;
-				return Response.json((0, _src_core.buildJSONRPCError)(requestId, _src_core.MCP_HEADER_MISMATCH, "MCP protocol version does not match the active session"), { status: 400 });
+				return Response.json((0, _src_core.buildJSONRPCError)(requestId, _src_core.MCP_HEADER_MISMATCH, issue.message), { status: 400 });
 			}
 		}
 		const response = await next(new Request(context.url, {
@@ -1746,9 +1807,9 @@ exports.createWebSocketServer = createWebSocketServer;
 exports.decodeEvent = decodeEvent;
 exports.dispatchLines = dispatchLines;
 exports.extractLines = extractLines;
+exports.inferHeaderIssue = inferHeaderIssue;
 exports.inferLegacyVersion = inferLegacyVersion;
 exports.inferStatus = inferStatus;
-exports.matchesModernHeaders = matchesModernHeaders;
 exports.readEventStream = readEventStream;
 exports.readLastEventId = readLastEventId;
 exports.readSessionHeader = readSessionHeader;