@peac/mcp-server 0.10.13 → 0.11.2

package/dist/http-transport.d.ts

@@ -0,0 +1,65 @@
+/**
+ * MCP Streamable HTTP transport (DD-119, DD-123)
+ *
+ * Adds HTTP transport alongside stdio. Unprotected mode only (v0.11.0).
+ * Each session gets its own McpServer + transport (CVE-2026-25536 defense).
+ *
+ * Endpoints:
+ *   POST /mcp          JSON-RPC tool calls (requires Mcp-Session-Id after init)
+ *   DELETE /mcp         Terminate session
+ *   GET /health         Health check (no auth)
+ *   GET /.well-known/oauth-protected-resource[/<path>]   PRM (conditional)
+ *   GET /mcp            405 Method Not Allowed
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/**
+ * Trust-proxy configuration for X-Forwarded-For interpretation.
+ *
+ * Presets:
+ * - 'off': never trust forwarded headers (default; safe for direct clients)
+ * - 'loopback': trust only from 127.0.0.0/8 and ::1
+ * - 'linklocal': trust loopback + link-local (169.254.0.0/16, fe80::/10)
+ * - 'private': trust loopback + link-local + RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
+ * - 'all': trust any remote address (DISCOURAGED; use only when behind a fully trusted proxy chain)
+ *
+ * Explicit addresses:
+ * - comma-separated IPs: trust only from listed addresses (e.g., '10.0.0.1,10.0.0.2')
+ *
+ * WARNING: only enable behind a trusted reverse proxy. An attacker can forge
+ * X-Forwarded-For from an untrusted peer to bypass per-IP rate limiting.
+ */
+export type TrustProxyValue = 'off' | 'loopback' | 'linklocal' | 'private' | 'all' | string;
+export interface HttpTransportOptions {
+    /** Port to listen on. Default: 3000 */
+    port?: number;
+    /** Bind address. Default: '127.0.0.1' (localhost only) */
+    host?: string;
+    /** Allowed CORS origins (empty = deny all). */
+    corsOrigins?: string[];
+    /** OAuth authorization server URIs (enables PRM with publicUrl). */
+    authorizationServers?: string[];
+    /** Canonical public URL of this server (required for PRM). */
+    publicUrl?: string;
+    /** Trust X-Forwarded-For for rate limiting. Default: 'off' */
+    trustProxy?: TrustProxyValue;
+    /** Max request body bytes. Default: 1MB */
+    maxRequestBytes?: number;
+    /** Rate limit: requests per minute per session. Default: 100 */
+    rateLimitRpm?: number;
+    /** Session TTL in ms. Default: 30 min */
+    sessionTtlMs?: number;
+    /** Max concurrent sessions. Default: 100 */
+    maxSessions?: number;
+    /** Max sessions per client IP. Default: 10 */
+    maxSessionsPerIp?: number;
+    /** Factory to create new McpServer instances (one per session) */
+    serverFactory: () => McpServer;
+}
+/**
+ * Create and start an HTTP server for MCP Streamable HTTP transport.
+ * Returns a cleanup function to shut everything down.
+ */
+export declare function createHttpTransport(options: HttpTransportOptions): Promise<{
+    cleanup: () => Promise<void>;
+}>;
+//# sourceMappingURL=http-transport.d.ts.map

package/dist/http-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-transport.d.ts","sourceRoot":"","sources":["../src/http-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIzE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,CAAC;AAE5F,MAAM,WAAW,oBAAoB;IACnC,uCAAuC;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,2CAA2C;IAC3C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,aAAa,EAAE,MAAM,SAAS,CAAC;CAChC;AA0FD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CA+X3C"}

package/dist/index.cjs

@@ -1,6 +1,7 @@
 'use strict';
 
 var mcp_js = require('@modelcontextprotocol/sdk/server/mcp.js');
+var kernel = require('@peac/kernel');
 var protocol = require('@peac/protocol');
 var crypto = require('@peac/crypto');
 var promises = require('fs/promises');
@@ -33,7 +34,7 @@ var nodePath__namespace = /*#__PURE__*/_interopNamespace(nodePath);
 
 // src/infra/constants.ts
 var SERVER_NAME = "peac-mcp-server";
-var SERVER_VERSION = "0.10.12";
+var SERVER_VERSION = "0.11.2";
 var MCP_PROTOCOL_VERSION = "2025-11-25";
 var DEFAULT_MAX_JWS_BYTES = 16384;
 var DEFAULT_MAX_RESPONSE_BYTES = 65536;
@@ -747,10 +748,40 @@ async function handleIssue(params) {
     };
   }
 }
+var WINDOWS_RESERVED_NAMES = /* @__PURE__ */ new Set([
+  "con",
+  "prn",
+  "aux",
+  "nul",
+  "com1",
+  "com2",
+  "com3",
+  "com4",
+  "com5",
+  "com6",
+  "com7",
+  "com8",
+  "com9",
+  "lpt1",
+  "lpt2",
+  "lpt3",
+  "lpt4",
+  "lpt5",
+  "lpt6",
+  "lpt7",
+  "lpt8",
+  "lpt9"
+]);
 function assertRelativePath(p) {
   if (!p || p.trim().length === 0) {
     throw new PathTraversalError("Path must not be empty");
   }
+  if (p.includes("\0")) {
+    throw new PathTraversalError("Null bytes are not allowed in paths");
+  }
+  if (p.includes(":")) {
+    throw new PathTraversalError("Colons are not allowed in paths (drive letters, NTFS ADS)");
+  }
   if (nodePath__namespace.isAbsolute(p)) {
     throw new PathTraversalError("Absolute paths are not allowed");
   }
@@ -767,6 +798,14 @@ function assertRelativePath(p) {
   if (p.startsWith(".")) {
     throw new PathTraversalError("Hidden paths (starting with .) are not allowed");
   }
+  if (p.endsWith(".") || p.endsWith(" ")) {
+    throw new PathTraversalError("Trailing dots and spaces are not allowed");
+  }
+  const dotIndex = p.indexOf(".");
+  const baseName = (dotIndex >= 0 ? p.slice(0, dotIndex) : p).toLowerCase();
+  if (WINDOWS_RESERVED_NAMES.has(baseName)) {
+    throw new PathTraversalError(`Windows reserved device name: ${baseName.toUpperCase()}`);
+  }
 }
 function resolveOutputPath(basePath, relativePath) {
   assertRelativePath(relativePath);
@@ -1136,7 +1175,7 @@ var IssueOutputSchema = zod.z.object({
 });
 var BundleInputSchema = zod.z.object({
   receipts: zod.z.array(zod.z.string().max(16384)).min(1).max(256).describe("Receipt JWS strings to bundle (1-256)"),
-  metadata: zod.z.record(zod.z.unknown()).optional().describe("Optional metadata to include in the manifest"),
+  metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional().describe("Optional metadata to include in the manifest"),
   output_path: zod.z.string().max(255).optional().describe("Output directory name (single segment within --bundle-dir)")
 });
 var MetaSchema5 = zod.z.object({
@@ -1192,9 +1231,17 @@ var BUNDLE_TOOL_ANNOTATIONS = {
 };
 var MAX_INPUT_DEPTH = 10;
 function errorCallToolResult(meta, code, message) {
+  const errorDef = kernel.ERRORS[code];
   return {
     content: [{ type: "text", text: message }],
-    structuredContent: { _meta: meta, ok: false, code, message },
+    structuredContent: {
+      _meta: meta,
+      ok: false,
+      code,
+      message,
+      retryable: errorDef?.retryable ?? false,
+      next_action: errorDef?.next_action ?? "none"
+    },
     isError: true
   };
 }
@@ -1405,9 +1452,9 @@ var JwksConfigSchema = zod.z.object({
 var PolicySchema = zod.z.object({
   version: zod.z.literal("1"),
   allow_network: zod.z.boolean().default(false),
-  redaction: RedactionSchema.default({}),
-  tools: zod.z.record(zod.z.string(), ToolPolicySchema).default({}),
-  limits: LimitsSchema.default({}),
+  redaction: RedactionSchema.prefault({}),
+  tools: zod.z.record(zod.z.string(), ToolPolicySchema).prefault({}),
+  limits: LimitsSchema.prefault({}),
   jwks: JwksConfigSchema.optional()
 });
 var DEFAULT_POLICY = {