@pascal-app/mcp 0.2.0

package/dist/tools/vision/analyze-floorplan-image.js

@@ -0,0 +1,146 @@
+import { ErrorCode, McpError } from '@modelcontextprotocol/sdk/types.js';
+import { z } from 'zod';
+/**
+ * Input shape for `analyze_floorplan_image`.
+ *
+ * `image` is either a base64-encoded payload (optionally prefixed with a
+ * `data:image/<mime>;base64,` URL) or an `http(s)` URL which we fetch and
+ * inline as base64 before forwarding to the MCP host via sampling.
+ */
+export const analyzeFloorplanImageInput = {
+    image: z.string().describe('Base64-encoded image or http(s) URL'),
+    scaleHint: z
+        .string()
+        .optional()
+        .describe("Text hint about scale, e.g. '1 cm = 1 m' or 'approximately 80 m²'"),
+};
+export const analyzeFloorplanImageOutput = {
+    walls: z.array(z.object({
+        start: z.tuple([z.number(), z.number()]),
+        end: z.tuple([z.number(), z.number()]),
+        thickness: z.number().optional(),
+    })),
+    rooms: z.array(z.object({
+        name: z.string(),
+        polygon: z.array(z.tuple([z.number(), z.number()])),
+        approximateAreaSqM: z.number().optional(),
+    })),
+    approximateDimensions: z.object({
+        widthM: z.number(),
+        depthM: z.number(),
+    }),
+    confidence: z.number().min(0).max(1),
+};
+const OutputSchema = z.object(analyzeFloorplanImageOutput);
+const SYSTEM_PROMPT = `You are a vision assistant that extracts structured floor-plan data from an image.
+Your ONLY job: return a JSON object that exactly matches this schema — no prose, no markdown fences.
+
+{
+  "walls": [{ "start": [x, z], "end": [x, z], "thickness": number? }, ...],
+  "rooms": [{ "name": string, "polygon": [[x,z], ...], "approximateAreaSqM": number? }, ...],
+  "approximateDimensions": { "widthM": number, "depthM": number },
+  "confidence": number 0..1
+}
+
+Coordinates are in metres. Origin can be the floor plan's centre or bottom-left — be consistent.
+If the image is unclear, lower the confidence score but still produce your best attempt.
+DO NOT wrap the JSON in markdown. DO NOT explain. Just output the raw JSON.`;
+const DATA_URI_RE = /^data:(image\/[a-z0-9.+-]+);base64,(.+)$/i;
+/**
+ * Resolve the `image` input into a sampling-ready image block.
+ *
+ * - `http(s)://` URLs are fetched, base64-encoded, and the mime type sniffed
+ *   from the `content-type` response header.
+ * - `data:image/*;base64,...` URIs are stripped of the prefix; mime type taken
+ *   from the URI itself.
+ * - Otherwise we treat the string as raw base64 and default to `image/jpeg`.
+ */
+async function resolveImageBlock(image) {
+    if (/^https?:\/\//i.test(image)) {
+        // SSRF-safe fetch: blocks loopback / private / link-local / metadata IPs,
+        // caps size at 20 MB, times out at 10s, validates each redirect hop.
+        const { safeFetch } = await import('../../lib/safe-fetch');
+        const res = await safeFetch(image, { accept: 'image/*' });
+        const data = res.buffer.toString('base64');
+        const mimeType = res.contentType ?? 'image/jpeg';
+        return { type: 'image', data, mimeType };
+    }
+    const dataUriMatch = image.match(DATA_URI_RE);
+    if (dataUriMatch) {
+        return {
+            type: 'image',
+            mimeType: dataUriMatch[1],
+            data: dataUriMatch[2],
+        };
+    }
+    return { type: 'image', mimeType: 'image/jpeg', data: image };
+}
+/** Collect all text content blocks returned by the sampling host into one string. */
+function extractText(content) {
+    const blocks = Array.isArray(content) ? content : [content];
+    const texts = [];
+    for (const block of blocks) {
+        if (block && typeof block === 'object' && block.type === 'text') {
+            const t = block.text;
+            if (typeof t === 'string')
+                texts.push(t);
+        }
+    }
+    return texts.join('\n').trim();
+}
+export function registerAnalyzeFloorplanImage(server, _bridge) {
+    server.registerTool('analyze_floorplan_image', {
+        title: 'Analyze floor-plan image',
+        description: 'Defer to the MCP host (via sampling) to extract walls, rooms, and approximate dimensions from a floor-plan image. Requires host support for sampling.',
+        inputSchema: analyzeFloorplanImageInput,
+        outputSchema: analyzeFloorplanImageOutput,
+    }, async ({ image, scaleHint }) => {
+        const caps = server.server.getClientCapabilities();
+        if (!caps?.sampling) {
+            throw new McpError(ErrorCode.InvalidRequest, 'sampling_unavailable');
+        }
+        const imageBlock = await resolveImageBlock(image);
+        const instruction = scaleHint
+            ? `Analyze this floor plan. Scale hint: ${scaleHint}. Return ONLY the JSON described by the system prompt.`
+            : 'Analyze this floor plan. Return ONLY the JSON described by the system prompt.';
+        const response = await server.server.createMessage({
+            systemPrompt: SYSTEM_PROMPT,
+            temperature: 0,
+            maxTokens: 2000,
+            messages: [
+                {
+                    role: 'user',
+                    content: [imageBlock, { type: 'text', text: instruction }],
+                },
+            ],
+        });
+        const text = extractText(response.content);
+        if (!text) {
+            throw new McpError(ErrorCode.InternalError, 'sampling_response_unparseable', {
+                reason: 'no text content returned by host',
+            });
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch (err) {
+            throw new McpError(ErrorCode.InternalError, 'sampling_response_unparseable', {
+                raw: text,
+                reason: err instanceof Error ? err.message : String(err),
+            });
+        }
+        const validation = OutputSchema.safeParse(parsed);
+        if (!validation.success) {
+            throw new McpError(ErrorCode.InternalError, 'sampling_response_invalid', {
+                raw: text,
+                errors: validation.error.issues,
+            });
+        }
+        const payload = validation.data;
+        return {
+            content: [{ type: 'text', text: JSON.stringify(payload) }],
+            structuredContent: payload,
+        };
+    });
+}

package/dist/tools/vision/analyze-room-photo.d.ts

@@ -0,0 +1,29 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import type { SceneOperations } from '../../operations';
+/**
+ * Input shape for `analyze_room_photo`.
+ *
+ * Same image resolution rules as `analyze_floorplan_image`.
+ */
+export declare const analyzeRoomPhotoInput: {
+    image: z.ZodString;
+};
+export declare const analyzeRoomPhotoOutput: {
+    approximateDimensions: z.ZodObject<{
+        widthM: z.ZodNumber;
+        lengthM: z.ZodNumber;
+        heightM: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>;
+    identifiedFixtures: z.ZodArray<z.ZodObject<{
+        type: z.ZodString;
+        approximatePosition: z.ZodOptional<z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>>;
+    }, z.core.$strip>>;
+    identifiedWindows: z.ZodArray<z.ZodObject<{
+        wallLabel: z.ZodOptional<z.ZodString>;
+        approximateWidthM: z.ZodOptional<z.ZodNumber>;
+        approximateHeightM: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+};
+export declare function registerAnalyzeRoomPhoto(server: McpServer, _bridge: SceneOperations): void;
+//# sourceMappingURL=analyze-room-photo.d.ts.map

package/dist/tools/vision/analyze-room-photo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze-room-photo.d.ts","sourceRoot":"","sources":["../../../src/tools/vision/analyze-room-photo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAExE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAEvD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;CAEjC,CAAA;AAED,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;CAmBlC,CAAA;AAoED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,GAAG,IAAI,CAoE1F"}

package/dist/tools/vision/analyze-room-photo.js

@@ -0,0 +1,130 @@
+import { ErrorCode, McpError } from '@modelcontextprotocol/sdk/types.js';
+import { z } from 'zod';
+/**
+ * Input shape for `analyze_room_photo`.
+ *
+ * Same image resolution rules as `analyze_floorplan_image`.
+ */
+export const analyzeRoomPhotoInput = {
+    image: z.string().describe('Base64-encoded image or http(s) URL'),
+};
+export const analyzeRoomPhotoOutput = {
+    approximateDimensions: z.object({
+        widthM: z.number(),
+        lengthM: z.number(),
+        heightM: z.number().optional(),
+    }),
+    identifiedFixtures: z.array(z.object({
+        type: z.string(),
+        approximatePosition: z.tuple([z.number(), z.number()]).optional(),
+    })),
+    identifiedWindows: z.array(z.object({
+        wallLabel: z.string().optional(),
+        approximateWidthM: z.number().optional(),
+        approximateHeightM: z.number().optional(),
+    })),
+};
+const OutputSchema = z.object(analyzeRoomPhotoOutput);
+const SYSTEM_PROMPT = `You are a vision assistant that extracts structured room data from a single photograph.
+Your ONLY job: return a JSON object that exactly matches this schema — no prose, no markdown fences.
+
+{
+  "approximateDimensions": { "widthM": number, "lengthM": number, "heightM": number? },
+  "identifiedFixtures": [{ "type": string, "approximatePosition": [x, z]? }, ...],
+  "identifiedWindows": [{ "wallLabel": string?, "approximateWidthM": number?, "approximateHeightM": number? }, ...]
+}
+
+All measurements are in metres. "type" for fixtures is a short noun phrase such as "sofa", "kitchen island", "door".
+If measurements cannot be estimated confidently, omit the optional fields rather than guessing.
+DO NOT wrap the JSON in markdown. DO NOT explain. Just output the raw JSON.`;
+const DATA_URI_RE = /^data:(image\/[a-z0-9.+-]+);base64,(.+)$/i;
+async function resolveImageBlock(image) {
+    if (/^https?:\/\//i.test(image)) {
+        // SSRF-safe fetch (see packages/mcp/src/lib/safe-fetch.ts).
+        const { safeFetch } = await import('../../lib/safe-fetch');
+        const res = await safeFetch(image, { accept: 'image/*' });
+        const data = res.buffer.toString('base64');
+        const mimeType = res.contentType ?? 'image/jpeg';
+        return { type: 'image', data, mimeType };
+    }
+    const dataUriMatch = image.match(DATA_URI_RE);
+    if (dataUriMatch) {
+        return {
+            type: 'image',
+            mimeType: dataUriMatch[1],
+            data: dataUriMatch[2],
+        };
+    }
+    return { type: 'image', mimeType: 'image/jpeg', data: image };
+}
+function extractText(content) {
+    const blocks = Array.isArray(content) ? content : [content];
+    const texts = [];
+    for (const block of blocks) {
+        if (block && typeof block === 'object' && block.type === 'text') {
+            const t = block.text;
+            if (typeof t === 'string')
+                texts.push(t);
+        }
+    }
+    return texts.join('\n').trim();
+}
+export function registerAnalyzeRoomPhoto(server, _bridge) {
+    server.registerTool('analyze_room_photo', {
+        title: 'Analyze room photo',
+        description: 'Defer to the MCP host (via sampling) to extract approximate dimensions, fixtures, and windows from a single-room photograph. Requires host support for sampling.',
+        inputSchema: analyzeRoomPhotoInput,
+        outputSchema: analyzeRoomPhotoOutput,
+    }, async ({ image }) => {
+        const caps = server.server.getClientCapabilities();
+        if (!caps?.sampling) {
+            throw new McpError(ErrorCode.InvalidRequest, 'sampling_unavailable');
+        }
+        const imageBlock = await resolveImageBlock(image);
+        const response = await server.server.createMessage({
+            systemPrompt: SYSTEM_PROMPT,
+            temperature: 0,
+            maxTokens: 2000,
+            messages: [
+                {
+                    role: 'user',
+                    content: [
+                        imageBlock,
+                        {
+                            type: 'text',
+                            text: 'Analyze this room photo. Return ONLY the JSON described by the system prompt.',
+                        },
+                    ],
+                },
+            ],
+        });
+        const text = extractText(response.content);
+        if (!text) {
+            throw new McpError(ErrorCode.InternalError, 'sampling_response_unparseable', {
+                reason: 'no text content returned by host',
+            });
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch (err) {
+            throw new McpError(ErrorCode.InternalError, 'sampling_response_unparseable', {
+                raw: text,
+                reason: err instanceof Error ? err.message : String(err),
+            });
+        }
+        const validation = OutputSchema.safeParse(parsed);
+        if (!validation.success) {
+            throw new McpError(ErrorCode.InternalError, 'sampling_response_invalid', {
+                raw: text,
+                errors: validation.error.issues,
+            });
+        }
+        const payload = validation.data;
+        return {
+            content: [{ type: 'text', text: JSON.stringify(payload) }],
+            structuredContent: payload,
+        };
+    });
+}

package/dist/tools/vision/index.d.ts

@@ -0,0 +1,12 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { SceneOperations } from '../../operations';
+/**
+ * Register the vision-input tools that defer to the MCP host's sampling
+ * capability. No vision model is bundled in this package — if the host does
+ * not advertise `sampling` support, calling either tool returns
+ * `sampling_unavailable`.
+ */
+export declare function registerVisionTools(server: McpServer, operations: SceneOperations): void;
+export { analyzeFloorplanImageInput, analyzeFloorplanImageOutput, registerAnalyzeFloorplanImage, } from './analyze-floorplan-image';
+export { analyzeRoomPhotoInput, analyzeRoomPhotoOutput, registerAnalyzeRoomPhoto, } from './analyze-room-photo';
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/vision/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/vision/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAIvD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,GAAG,IAAI,CAGxF;AAED,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA"}

package/dist/tools/vision/index.js

@@ -0,0 +1,14 @@
+import { registerAnalyzeFloorplanImage } from './analyze-floorplan-image';
+import { registerAnalyzeRoomPhoto } from './analyze-room-photo';
+/**
+ * Register the vision-input tools that defer to the MCP host's sampling
+ * capability. No vision model is bundled in this package — if the host does
+ * not advertise `sampling` support, calling either tool returns
+ * `sampling_unavailable`.
+ */
+export function registerVisionTools(server, operations) {
+    registerAnalyzeFloorplanImage(server, operations);
+    registerAnalyzeRoomPhoto(server, operations);
+}
+export { analyzeFloorplanImageInput, analyzeFloorplanImageOutput, registerAnalyzeFloorplanImage, } from './analyze-floorplan-image';
+export { analyzeRoomPhotoInput, analyzeRoomPhotoOutput, registerAnalyzeRoomPhoto, } from './analyze-room-photo';

package/dist/transports/http.d.ts

@@ -0,0 +1,36 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export type HttpTransportHandle = {
+    /** Host interface the server is listening on. */
+    host: string;
+    /** Port the server is actually listening on (useful when caller passed 0). */
+    port: number;
+    /** Gracefully close the HTTP server and the MCP transport. */
+    close(): Promise<void>;
+};
+export type HttpTransportOptions = {
+    /**
+     * Network interface to bind. Defaults to loopback. Binding to a non-loopback
+     * interface requires an auth token.
+     */
+    host?: string;
+    /** Bearer token for HTTP MCP calls. Defaults to PASCAL_MCP_HTTP_TOKEN. */
+    authToken?: string;
+    /** Exact CORS origins allowed to call this transport. Loopback origins are allowed. */
+    allowedOrigins?: string[];
+    /** Per-client request cap per minute. Set <= 0 to disable. */
+    rateLimitPerMinute?: number;
+};
+/**
+ * Attach an `McpServer` to a Streamable HTTP transport bound to a local port.
+ *
+ * Uses the SDK's Node-flavored `StreamableHTTPServerTransport`, which accepts
+ * `IncomingMessage`/`ServerResponse` directly via `handleRequest(req, res)`.
+ * A new session ID is generated per connection (stateful mode).
+ *
+ * Listens on `127.0.0.1:<port>` (pass `0` for an ephemeral port in tests). The
+ * returned handle exposes the actual bound port and a `close()` that stops
+ * the underlying Node HTTP server. To bind a public interface, pass `host` and
+ * configure an auth token.
+ */
+export declare function connectHttp(server: McpServer, port: number, options?: HttpTransportOptions): Promise<HttpTransportHandle>;
+//# sourceMappingURL=http.d.ts.map

package/dist/transports/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/transports/http.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAUxE,MAAM,MAAM,mBAAmB,GAAG;IAChC,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAA;IACZ,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAA;IACZ,8DAA8D;IAC9D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,8DAA8D;IAC9D,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B,CAAA;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAgE9B"}

package/dist/transports/http.js

@@ -0,0 +1,203 @@
+import { randomUUID, timingSafeEqual } from 'node:crypto';
+import { createServer } from 'node:http';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+const DEFAULT_HOST = '127.0.0.1';
+const DEFAULT_RATE_LIMIT_PER_MINUTE = 120;
+const WINDOW_MS = 60_000;
+const ALLOWED_METHODS = 'GET, POST, DELETE, OPTIONS';
+const ALLOWED_HEADERS = 'authorization, content-type, mcp-session-id, mcp-protocol-version, x-pascal-mcp-token';
+/**
+ * Attach an `McpServer` to a Streamable HTTP transport bound to a local port.
+ *
+ * Uses the SDK's Node-flavored `StreamableHTTPServerTransport`, which accepts
+ * `IncomingMessage`/`ServerResponse` directly via `handleRequest(req, res)`.
+ * A new session ID is generated per connection (stateful mode).
+ *
+ * Listens on `127.0.0.1:<port>` (pass `0` for an ephemeral port in tests). The
+ * returned handle exposes the actual bound port and a `close()` that stops
+ * the underlying Node HTTP server. To bind a public interface, pass `host` and
+ * configure an auth token.
+ */
+export async function connectHttp(server, port, options = {}) {
+    const host = options.host ?? DEFAULT_HOST;
+    const authToken = options.authToken ?? process.env.PASCAL_MCP_HTTP_TOKEN;
+    if (!(isLoopbackHost(host) || authToken)) {
+        throw new Error('HTTP transport on a non-loopback host requires PASCAL_MCP_HTTP_TOKEN or authToken');
+    }
+    const guard = createHttpGuard({
+        authToken,
+        allowedOrigins: options.allowedOrigins ?? envAllowedOrigins(),
+        rateLimitPerMinute: options.rateLimitPerMinute ?? DEFAULT_RATE_LIMIT_PER_MINUTE,
+    });
+    const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: () => randomUUID(),
+    });
+    await server.connect(transport);
+    const httpServer = createServer((req, res) => {
+        if (!guard(req, res))
+            return;
+        transport.handleRequest(req, res).catch((err) => {
+            // Log to stderr; never touch stdout (stdio transport uses it).
+            console.error('[pascal-mcp] http transport error', err);
+            if (!res.writableEnded) {
+                try {
+                    res.writeHead(500).end();
+                }
+                catch {
+                    // Response may already be partially sent; nothing more we can do.
+                }
+            }
+        });
+    });
+    await new Promise((resolve, reject) => {
+        const onError = (err) => {
+            httpServer.off('listening', onListening);
+            reject(err);
+        };
+        const onListening = () => {
+            httpServer.off('error', onError);
+            resolve();
+        };
+        httpServer.once('error', onError);
+        httpServer.once('listening', onListening);
+        httpServer.listen(port, host);
+    });
+    const address = httpServer.address();
+    const boundPort = typeof address === 'object' && address !== null ? address.port : port;
+    return {
+        host,
+        port: boundPort,
+        close: async () => {
+            await new Promise((resolve, reject) => {
+                httpServer.close((err) => {
+                    if (err)
+                        reject(err);
+                    else
+                        resolve();
+                });
+            });
+            await transport.close();
+        },
+    };
+}
+function createHttpGuard(options) {
+    const buckets = new Map();
+    const allowedOrigins = new Set(options.allowedOrigins
+        .map(normalizeOrigin)
+        .filter((origin) => origin !== null));
+    return (req, res) => {
+        const origin = req.headers.origin;
+        if (origin && !isOriginAllowed(origin, req.headers.host, allowedOrigins)) {
+            sendJson(res, 403, { error: 'origin_not_allowed' });
+            return false;
+        }
+        applyCors(req, res, allowedOrigins);
+        if (req.method === 'OPTIONS') {
+            res.writeHead(204).end();
+            return false;
+        }
+        const pathname = req.url ? new URL(req.url, 'http://localhost').pathname : '/';
+        if (pathname !== '/mcp') {
+            sendJson(res, 404, { error: 'not_found' });
+            return false;
+        }
+        if (options.authToken) {
+            const supplied = bearerToken(req) ?? headerValue(req.headers['x-pascal-mcp-token']);
+            if (!(supplied && safeEqual(supplied, options.authToken))) {
+                sendJson(res, 401, { error: 'unauthorized' });
+                return false;
+            }
+        }
+        if (options.rateLimitPerMinute > 0) {
+            const now = Date.now();
+            const key = req.socket.remoteAddress ?? 'unknown';
+            const bucket = buckets.get(key);
+            if (!bucket || bucket.resetAt <= now) {
+                buckets.set(key, { count: 1, resetAt: now + WINDOW_MS });
+            }
+            else {
+                bucket.count++;
+                if (bucket.count > options.rateLimitPerMinute) {
+                    res.setHeader('Retry-After', Math.max(1, Math.ceil((bucket.resetAt - now) / 1000)));
+                    sendJson(res, 429, { error: 'rate_limited' });
+                    return false;
+                }
+            }
+        }
+        return true;
+    };
+}
+function applyCors(req, res, allowedOrigins) {
+    const origin = req.headers.origin;
+    if (origin && isOriginAllowed(origin, req.headers.host, allowedOrigins)) {
+        res.setHeader('Access-Control-Allow-Origin', origin);
+        res.setHeader('Vary', 'Origin');
+    }
+    res.setHeader('Access-Control-Allow-Methods', ALLOWED_METHODS);
+    res.setHeader('Access-Control-Allow-Headers', ALLOWED_HEADERS);
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+}
+function isOriginAllowed(origin, requestHost, allowedOrigins) {
+    const normalized = normalizeOrigin(origin);
+    if (!normalized)
+        return false;
+    const parsed = new URL(normalized);
+    if (isLoopbackHost(parsed.hostname))
+        return true;
+    if (requestHost && normalized === normalizeOrigin(`http://${requestHost}`))
+        return true;
+    if (requestHost && normalized === normalizeOrigin(`https://${requestHost}`))
+        return true;
+    return allowedOrigins.has(normalized);
+}
+function bearerToken(req) {
+    const header = headerValue(req.headers.authorization);
+    if (!header)
+        return null;
+    const match = header.match(/^Bearer\s+(.+)$/i);
+    return match?.[1] ?? null;
+}
+function headerValue(value) {
+    if (Array.isArray(value))
+        return value[0] ?? null;
+    return value ?? null;
+}
+function sendJson(res, status, payload) {
+    if (!res.hasHeader('Content-Type')) {
+        res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    }
+    res.writeHead(status).end(JSON.stringify(payload));
+}
+function safeEqual(a, b) {
+    const aBuffer = Buffer.from(a);
+    const bBuffer = Buffer.from(b);
+    if (aBuffer.length !== bBuffer.length)
+        return false;
+    return timingSafeEqual(aBuffer, bBuffer);
+}
+function envAllowedOrigins() {
+    return (process.env.PASCAL_MCP_HTTP_ORIGINS ?? '')
+        .split(',')
+        .map((origin) => origin.trim())
+        .filter(Boolean);
+}
+function normalizeOrigin(origin) {
+    try {
+        const url = new URL(origin);
+        return `${url.protocol}//${url.host}`.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+function isLoopbackHost(host) {
+    const h = stripPort(host).toLowerCase();
+    return h === 'localhost' || h.endsWith('.localhost') || h === '127.0.0.1' || h === '::1';
+}
+function stripPort(host) {
+    if (host.startsWith('[')) {
+        const end = host.indexOf(']');
+        return end === -1 ? host : host.slice(1, end);
+    }
+    return host.split(':')[0] ?? host;
+}

package/dist/transports/stdio.d.ts

@@ -0,0 +1,14 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/**
+ * Attach an `McpServer` to the stdio transport.
+ *
+ * The server takes ownership of stdin/stdout for JSON-RPC messaging. Callers
+ * must send any operator logging to stderr (not stdout) to avoid corrupting
+ * the protocol stream.
+ *
+ * Resolves once the transport is started. The underlying transport keeps the
+ * process alive as long as stdin is open, so callers typically just `await`
+ * this and then let the event loop run.
+ */
+export declare function connectStdio(server: McpServer): Promise<void>;
+//# sourceMappingURL=stdio.d.ts.map

package/dist/transports/stdio.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../src/transports/stdio.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAGxE;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAGnE"}

package/dist/transports/stdio.js

@@ -0,0 +1,16 @@
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+/**
+ * Attach an `McpServer` to the stdio transport.
+ *
+ * The server takes ownership of stdin/stdout for JSON-RPC messaging. Callers
+ * must send any operator logging to stderr (not stdout) to avoid corrupting
+ * the protocol stream.
+ *
+ * Resolves once the transport is started. The underlying transport keeps the
+ * process alive as long as stdin is open, so callers typically just `await`
+ * this and then let the event loop run.
+ */
+export async function connectStdio(server) {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}