@orkestrel/mcp 0.0.23 → 0.0.25

package/dist/src/server/index.cjs

@@ -100,6 +100,24 @@ var DEFAULT_MCP_DELIVERY = 1e4;
 //#endregion
 //#region src/server/helpers.ts
 /**
+* Builds the error for a non-success HTTP response that carried no JSON-RPC message.
+*
+* @param response - The response whose status is reported
+* @param type - The response's content type, or an empty string when absent
+* @returns An error naming the HTTP status and unsupported response shape
+*
+* @example
+* ```ts
+* const error = buildResponseError(new Response('', { status: 500 }), '')
+* ```
+*/
+function buildResponseError(response, type) {
+	if (type.includes("application/json")) return /* @__PURE__ */ new Error(`HTTP ${response.status} response contained an application/json body that was not a JSON-RPC message`);
+	if (type.includes("text/event-stream")) return /* @__PURE__ */ new Error(`HTTP ${response.status} response contained a text/event-stream body without a JSON-RPC message`);
+	const shape = type === "" ? "a body without a content type" : `an unsupported '${type}' body`;
+	return /* @__PURE__ */ new Error(`HTTP ${response.status} response contained ${shape}`);
+}
+/**
 * Creates a readable stream from its pull and cancellation behaviours.
 *
 * @param pull - The behaviour that supplies the stream's next chunk
@@ -371,6 +389,14 @@ function extractLines(buffer, chunk) {
 * The completion callback is the writable channel's backpressure boundary. A callback error and
 * a synchronous `write` throw reject the returned promise with the original value.
 *
+* That callback is the ONLY thing that settles the promise: this helper holds no timer and no
+* abort, so an output that neither confirms nor fails the write parks the promise for as long as
+* the caller-owned stream holds the callback. A caller wanting a bound races this promise against
+* one it owns — {@link import('./transports/StdioServerTransport.js').StdioServerTransport}
+* registers such a bound per send and rejects it on `close()`, so closing the transport settles
+* the CALLER's `send` while the abandoned write stays with the stream that still holds its
+* callback, reachable from nothing the transport retains.
+*
 * @param output - The writable stream that receives the line
 * @param line - The complete line to write
 * @returns Resolves when the stream confirms the write; rejects when the write fails
@@ -539,7 +565,7 @@ function inferHeaderIssue(request, reference) {
 		return {
 			header: "MCP-Protocol-Version",
 			reason: "missing",
-			message: `Required MCP-Protocol-Version header is missing; this server offers '${_src_core.MCP_PROTOCOL_VERSION}'.`
+			message: `Required MCP-Protocol-Version header is missing; this server offers '${_src_core.MCP_HANDSHAKE_VERSION}'.`
 		};
 	}
 	const message = reference;
@@ -586,16 +612,20 @@ function inferHeaderIssue(request, reference) {
 *
 * @remarks
 * A supported legacy request is pinned exactly. A modern, malformed, absent, or unsupported
-* request selects the newest supported legacy revision, matching the core initialize result.
+* request selects the newest supported legacy revision. The read is deliberately the SAME one
+* {@link import('@orkestrel/mcp').buildInitializeResult} performs — `isMCPLegacyVersion` over
+* the requested revision — because the session version this pins and the version that result
+* echoes must be the one value. Routing through `inferVersion` cannot do it: that inferer is
+* modern-only, so it answers `undefined` for every legacy offer and the session would pin
+* `2025-11-25` while the handshake echoed `2025-06-18`, which the client's own protocol
+* header then contradicts.
 *
 * @param request - The legacy initialize invocation
 * @returns The negotiated legacy protocol revision
 */
 function inferLegacyVersion(request) {
 	const requested = request.params?.["protocolVersion"];
-	const version = (0, _src_core.inferVersion)((0, _orkestrel_contract.isString)(requested) ? [requested] : []);
-	if (version !== void 0 && (0, _src_core.inferEra)(version) === "legacy") return version;
-	return _src_core.MCP_PROTOCOL_VERSION;
+	return (0, _src_core.isMCPLegacyVersion)(requested) ? requested : _src_core.MCP_HANDSHAKE_VERSION;
 }
 /**
 * Infers the HTTP status for one MCP dispatch outcome without changing its JSON-RPC body.
@@ -758,7 +788,9 @@ var HTTPDisconnect = class {
 * Modern requests require matching protocol/method headers and a matching name header only
 * for `tools/call`; mismatch returns HTTP `400` + `-32020`. Headerless `initialize` is
 * accepted, while every other headerless request needs a live legacy session to supply its
-* pinned version. A present origin must occur in `origin.origins` unless validation is
+* pinned version. A legacy-shaped request carrying a protocol header is admitted only for a
+* legacy revision; any other value, the modern revision included, returns HTTP `400` + `-32022`
+* whose `supported` names the legacy revisions this door accepts. A present origin must occur in `origin.origins` unless validation is
 * explicitly delegated upstream. Modern dispatch errors use their protocol status map; legacy
 * errors remain in-band at HTTP `200`. A streamed response composes the fetch-standard request
 * signal with response-body cancellation and supplies the result to every dispatched modern
@@ -813,8 +845,8 @@ function createMCPPostHandler(mcp, options) {
 		const issue = inferHeaderIssue(request, invocation);
 		if (issue !== void 0) return Response.json((0, _src_core.buildJSONRPCError)(id, _src_core.MCP_HEADER_MISMATCH, issue.message), { status: 400 });
 		if (era === "legacy") {
-			if (protocol !== null && !(0, _src_core.isMCPVersion)(protocol)) return Response.json((0, _src_core.buildJSONRPCError)(id, _src_core.MCP_UNSUPPORTED_VERSION, `Unsupported MCP protocol version '${protocol}'`, {
-				supported: _src_core.SUPPORTED_PROTOCOL_VERSIONS,
+			if (protocol !== null && !(0, _src_core.isMCPLegacyVersion)(protocol)) return Response.json((0, _src_core.buildJSONRPCError)(id, _src_core.MCP_UNSUPPORTED_VERSION, `Unsupported MCP protocol version '${protocol}'`, {
+				supported: _src_core.SUPPORTED_LEGACY_PROTOCOL_VERSIONS,
 				requested: protocol
 			}), { status: 400 });
 		}
@@ -882,8 +914,10 @@ function createMCPPostHandler(mcp, options) {
 *   aborted read surfaces on `error` and the `send` reporting it resolves. `close()` is
 *   idempotent (one `close` event per connected lifetime), and `start()` opens the next one.
 * - **Total at the boundary.** Every reply is narrowed (`parseJSONRPCMessage`,
-*   the SSE decoder) — a non-message reply is dropped, never asserted; a `fetch` /
-*   decode failure surfaces on the `error` event rather than escaping `send`.
+*   the SSE decoder). A non-message success reply is dropped, never asserted. A non-success
+*   reply that carries no valid JSON-RPC message rejects `send` with its HTTP status and body
+*   shape. A valid JSON-RPC error body is emitted at any HTTP status. A `fetch` / decode failure
+*   on a success response surfaces on the `error` event rather than escaping `send`.
 * - **Observable.** Owns the `emitter` ({@link MCPClientTransportEventMap}); fires
 *   `message` per decoded reply, `error` on a fault, and `close` on `close()`.
 *
@@ -978,18 +1012,20 @@ var HTTPClientTransport = class {
 	async #deliver(response) {
 		if (response.status === 202) return;
 		const type = response.headers.get("content-type") ?? "";
+		let messages = [];
+		let failure;
 		try {
-			if (type.includes("text/event-stream")) {
-				for (const message of await readEventStream(response)) this.#capture(message);
-				return;
-			}
-			if (type.includes("application/json")) {
+			if (type.includes("text/event-stream")) messages = await readEventStream(response);
+			else if (type.includes("application/json")) {
 				const message = (0, _src_core.parseJSONRPCMessage)(await response.json());
-				if (message !== void 0) this.#capture(message);
+				if (message !== void 0) messages = [message];
 			}
 		} catch (error) {
-			this.#emitter.emit("error", error);
+			failure = { error };
 		}
+		for (const message of messages) this.#capture(message);
+		if (!response.ok && messages.length === 0) throw buildResponseError(response, type);
+		if (failure !== void 0) this.#emitter.emit("error", failure.error);
 	}
 	#capture(message) {
 		if ((0, _src_core.isJSONRPCResponse)(message) && (0, _orkestrel_contract.isRecord)(message.result) && (0, _src_core.isMCPVersion)(message.result["protocolVersion"])) this.#protocol = message.result["protocolVersion"];
@@ -1240,7 +1276,11 @@ var WebSocketServerTransport = class {
 *   event (the reply the {@link import('@orkestrel/mcp').MCPClientInterface} correlates by `id`); a
 *   non-JSON / non-message frame surfaces on `error` and is dropped. The socket's `close`
 *   / `error` bridge to this transport's events.
-* - **Outbound (`send`).** `send(message)` writes one masked text frame.
+* - **Outbound (`send`).** `send(message)` writes one masked text frame. A socket write is not
+*   confirmed, so this transport answers a closed channel from its OWN state: a `send` with no
+*   bound socket — before `start()`, after `close()`, or after the peer ended the socket —
+*   REJECTS with `WebSocket transport is not connected`. It neither drops the message (the
+*   browser face's posture) nor queues it for a connection this transport is not holding.
 * - **`close()`** unsubscribes from the socket, closes it, and fires `close` (idempotent). An
 *   upgrade still on the wire is DESTROYED, so a `close()` during the handshake ends the
 *   transport at once instead of waiting for a peer that may never answer — the suspended
@@ -1456,7 +1496,7 @@ var WebSocketClientTransport = class {
 * ```ts
 * const transport = new StdioClientTransport({ command: 'node', args: ['./server.js'] })
 * const client = new MCPClient({ transport })
-* await client.connect() // start() spawns the child, then the MCP initialize runs over stdio
+* await client.connect() // start() spawns the child, then modern discovery runs over stdio
 * ```
 */
 var StdioClientTransport = class {
@@ -2216,6 +2256,7 @@ exports.WebSocketServerTransport = WebSocketServerTransport;
 exports.acceptsEventStream = acceptsEventStream;
 exports.allowsOrigin = allowsOrigin;
 exports.bridgeMessageTransport = bridgeMessageTransport;
+exports.buildResponseError = buildResponseError;
 exports.createHTTPClientTransport = createHTTPClientTransport;
 exports.createMCPContinuation = createMCPContinuation;
 exports.createMCPPostHandler = createMCPPostHandler;