@privos_ai/app-server 0.1.0

package/dist/runtime.js

@@ -0,0 +1,351 @@
+import { randomUUID } from 'node:crypto';
+import { buildInitializeResult, MCP_UI_MIME, } from './app-descriptor.js';
+import { verifyUserToken, } from './auth/user-token.js';
+import { INTERNAL_ERROR, INVALID_REQUEST, METHOD_NOT_FOUND, SERVER_BUSY, errorResponse, jsonRpcError, normalizeThrownError, resultResponse, } from './protocol/errors.js';
+import { isMcpNotificationMethod, isResultBearingMethod, parseJsonRpcMessage, parseJsonText, } from './protocol/dispatch.js';
+import { estimateJsonBytes, summarizeForLog } from './protocol/logging.js';
+const DEFAULT_MAX_IN_FLIGHT = 32;
+const DEFAULT_REQUEST_TIMEOUT_MS = 60_000;
+const DEFAULT_MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+export const DEFAULT_MAX_MESSAGE_BYTES = 8 * 1024 * 1024;
+export const DEFAULT_MAX_BUFFERED_BYTES = 8 * 1024 * 1024;
+/** Distinguish number `1` from string `"1"` without separator collisions. */
+export function encodeInFlightId(id) {
+    return JSON.stringify([typeof id, id]);
+}
+export class AppServerRuntime {
+    /**
+     * Nested map: sessionScope → set of encodeInFlightId(id).
+     * Avoids String(id) collisions and colon-join ambiguities.
+     */
+    inFlight = new Map();
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    getLimits() {
+        return {
+            maxMessageBytes: this.opts.limits?.maxMessageBytes ?? DEFAULT_MAX_MESSAGE_BYTES,
+            requestTimeoutMs: this.opts.limits?.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS,
+            maxInFlightRequests: this.opts.limits?.maxInFlightRequests ?? DEFAULT_MAX_IN_FLIGHT,
+            maxResponseBytes: this.opts.limits?.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES,
+            maxBufferedBytes: this.opts.limits?.maxBufferedBytes ?? DEFAULT_MAX_BUFFERED_BYTES,
+        };
+    }
+    inFlightCount() {
+        let n = 0;
+        for (const set of this.inFlight.values())
+            n += set.size;
+        return n;
+    }
+    hasInFlight(sessionScope, id) {
+        return this.inFlight.get(sessionScope)?.has(encodeInFlightId(id)) ?? false;
+    }
+    addInFlight(sessionScope, id) {
+        let set = this.inFlight.get(sessionScope);
+        if (!set) {
+            set = new Set();
+            this.inFlight.set(sessionScope, set);
+        }
+        set.add(encodeInFlightId(id));
+    }
+    deleteInFlight(sessionScope, id) {
+        const set = this.inFlight.get(sessionScope);
+        if (!set)
+            return;
+        set.delete(encodeInFlightId(id));
+        if (set.size === 0)
+            this.inFlight.delete(sessionScope);
+    }
+    async resolveDescriptor() {
+        const d = this.opts.descriptor;
+        return typeof d === 'function' ? await d() : d;
+    }
+    async buildContext(input) {
+        const descriptor = await this.resolveDescriptor();
+        const base = {
+            transport: input.transport,
+            requestId: input.requestId,
+            appId: descriptor.id,
+            traceId: input.traceId,
+            sessionScope: input.sessionScope,
+            identityState: 'missing',
+            ...(input.signal ? { signal: input.signal } : {}),
+        };
+        const resolution = input.credentialResolution ?? { kind: 'absent' };
+        if (resolution.kind === 'absent') {
+            return base;
+        }
+        if (resolution.kind === 'error') {
+            // Do not log extractor Error.message — may contain secrets/URLs.
+            this.log('mcp.caller_extractor_error', {
+                transport: input.transport,
+                reason: 'extractor_failed',
+                traceId: input.traceId,
+            });
+            return { ...base, identityState: 'invalid' };
+        }
+        if (!resolution.credential.token) {
+            return { ...base, identityState: 'invalid' };
+        }
+        if (!this.opts.auth) {
+            return { ...base, identityState: 'invalid' };
+        }
+        const verified = await verifyUserToken(resolution.credential.token, this.opts.auth, resolution.credential.assertedUserId);
+        if (!verified.ok) {
+            return {
+                ...base,
+                identityState: verified.reason === 'missing' ? 'missing' : 'invalid',
+            };
+        }
+        return {
+            ...base,
+            identityState: 'verified',
+            actor: verified.actor,
+            roomId: verified.actor.roomId,
+        };
+    }
+    async dispatchParsed(parsed, context) {
+        if (parsed.kind === 'response') {
+            return { type: 'no_response', reason: 'ignored_response' };
+        }
+        // JSON-RPC: Parse/Invalid Request without a recoverable id → respond with id: null.
+        if (parsed.kind === 'invalid') {
+            const id = parsed.id !== undefined ? parsed.id : null;
+            return { type: 'response', response: errorResponse(id, parsed.error) };
+        }
+        if (parsed.kind === 'notification') {
+            const method = parsed.message.method;
+            if (isMcpNotificationMethod(method)) {
+                this.log('mcp.notification', {
+                    method,
+                    transport: context.transport,
+                    traceId: context.traceId,
+                });
+                return { type: 'no_response', reason: 'notification' };
+            }
+            // Valid method shape but missing id on a result-bearing call —
+            // Hub Streamable HTTP quirk: do not emit a JSON-RPC body (Direct → 202).
+            if (isResultBearingMethod(method)) {
+                this.log('mcp.missing_request_id', {
+                    method,
+                    transport: context.transport,
+                    warning: 'missing_request_id',
+                    traceId: context.traceId,
+                });
+                return { type: 'no_response', reason: 'missing_request_id' };
+            }
+            return { type: 'no_response', reason: 'notification' };
+        }
+        const { message } = parsed;
+        const method = message.method;
+        if (isMcpNotificationMethod(method)) {
+            this.log('mcp.notification_with_id', {
+                method,
+                id: message.id,
+                transport: context.transport,
+                warning: 'notification_with_id',
+                traceId: context.traceId,
+            });
+            return { type: 'protocol_warning', warning: 'notification_with_id' };
+        }
+        if (this.hasInFlight(context.sessionScope, message.id)) {
+            return {
+                type: 'response',
+                response: errorResponse(message.id, jsonRpcError(INVALID_REQUEST, 'Duplicate in-flight JSON-RPC id', {
+                    code: 'DUPLICATE_IN_FLIGHT_ID',
+                })),
+            };
+        }
+        const limits = this.getLimits();
+        if (this.inFlightCount() >= limits.maxInFlightRequests) {
+            return {
+                type: 'response',
+                response: errorResponse(message.id, jsonRpcError(SERVER_BUSY, 'Too many in-flight requests')),
+            };
+        }
+        this.addInFlight(context.sessionScope, message.id);
+        const started = Date.now();
+        const abort = new AbortController();
+        const onParentAbort = () => abort.abort();
+        if (context.signal) {
+            if (context.signal.aborted)
+                abort.abort();
+            else
+                context.signal.addEventListener('abort', onParentAbort, { once: true });
+        }
+        const requestContext = {
+            ...context,
+            signal: abort.signal,
+        };
+        // Keep in-flight until the underlying handler settles (even after timeout response).
+        const work = this.handleRequest(message.method, message.id, message.params, requestContext).finally(() => {
+            this.deleteInFlight(context.sessionScope, message.id);
+            context.signal?.removeEventListener('abort', onParentAbort);
+        });
+        try {
+            const result = await raceWithTimeout(work, abort, limits.requestTimeoutMs);
+            const response = resultResponse(message.id, result);
+            const bytes = estimateJsonBytes(response);
+            if (bytes < 0 || bytes > limits.maxResponseBytes) {
+                return {
+                    type: 'response',
+                    response: errorResponse(message.id, jsonRpcError(INTERNAL_ERROR, 'Response too large', {
+                        code: 'RESPONSE_TOO_LARGE',
+                    })),
+                };
+            }
+            this.log('mcp.request.ok', summarizeForLog({
+                method,
+                toolName: method === 'tools/call' ? toolNameFromParams(message.params) : undefined,
+                id: message.id,
+                durationMs: Date.now() - started,
+                resultBytes: bytes,
+                identityState: context.identityState,
+                transport: context.transport,
+                traceId: context.traceId,
+            }));
+            return { type: 'response', response };
+        }
+        catch (err) {
+            // Swallow late handler rejection after we already timed out / responded.
+            void work.catch(() => undefined);
+            const error = normalizeThrownError(err, (e) => this.opts.mapAppError?.(e, requestContext));
+            this.log('mcp.request.error', summarizeForLog({
+                method,
+                toolName: method === 'tools/call' ? toolNameFromParams(message.params) : undefined,
+                id: message.id,
+                durationMs: Date.now() - started,
+                errorCode: error.code,
+                identityState: context.identityState,
+                transport: context.transport,
+                traceId: context.traceId,
+            }));
+            return { type: 'response', response: errorResponse(message.id, error) };
+        }
+    }
+    async dispatchObject(raw, context) {
+        return this.dispatchParsed(parseJsonRpcMessage(raw), context);
+    }
+    async dispatchText(text, context) {
+        return this.dispatchParsed(parseJsonText(text), context);
+    }
+    async handleRequest(method, id, params, context) {
+        if (method === 'initialize') {
+            const descriptor = await this.resolveDescriptor();
+            return buildInitializeResult(descriptor, { uiEnabled: Boolean(this.opts.ui) });
+        }
+        if (method === 'resources/read' && this.opts.ui) {
+            const uri = params?.uri;
+            if (uri === this.opts.ui.uri) {
+                const html = await this.opts.ui.renderHtml({ params, context });
+                return {
+                    contents: [
+                        {
+                            uri: this.opts.ui.uri,
+                            mimeType: this.opts.ui.mimeType ?? MCP_UI_MIME,
+                            text: html,
+                        },
+                    ],
+                };
+            }
+        }
+        const applicationMethods = new Set(['tools/list', 'tools/call', 'resources/read']);
+        if (!applicationMethods.has(method)) {
+            throw Object.assign(new Error(`Method not found: ${method}`), {
+                code: METHOD_NOT_FOUND,
+            });
+        }
+        const request = {
+            jsonrpc: '2.0',
+            id,
+            method: method,
+            ...(params !== undefined ? { params } : {}),
+        };
+        return await this.opts.handler(request, context);
+    }
+    log(event, fields) {
+        this.opts.logger?.(event, fields);
+    }
+}
+async function raceWithTimeout(work, abort, ms) {
+    let timer;
+    try {
+        return await Promise.race([
+            work,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => {
+                    abort.abort();
+                    reject(Object.assign(new Error('Request timed out'), {
+                        code: INTERNAL_ERROR,
+                        data: { code: 'REQUEST_TIMEOUT' },
+                    }));
+                }, ms);
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+function toolNameFromParams(params) {
+    if (params && typeof params === 'object' && 'name' in params) {
+        const name = params.name;
+        return typeof name === 'string' ? name : undefined;
+    }
+    return undefined;
+}
+/** Built-in Direct header extractor — never reads body/arguments. */
+export function extractDirectCallerCredential(headers) {
+    const auth = headerValue(headers.authorization);
+    if (!auth?.startsWith('Bearer '))
+        return undefined;
+    const token = auth.slice('Bearer '.length).trim();
+    if (!token)
+        return undefined;
+    const asserted = headerValue(headers['x-mcp-user-id']);
+    return {
+        token,
+        ...(asserted ? { assertedUserId: asserted } : {}),
+        source: 'direct-header',
+    };
+}
+export function relayCallerAuthSurface(message) {
+    const surface = {};
+    if (Object.prototype.hasOwnProperty.call(message, '_meta')) {
+        surface._meta = message._meta;
+    }
+    if (Object.prototype.hasOwnProperty.call(message, 'meta')) {
+        surface.meta = message.meta;
+    }
+    return surface;
+}
+export async function resolveCallerCredential(extract, ingress) {
+    if (!extract)
+        return { kind: 'absent' };
+    try {
+        const credential = await extract(ingress);
+        if (!credential)
+            return { kind: 'absent' };
+        if (typeof credential.token !== 'string' || !credential.token) {
+            return { kind: 'error', message: 'Caller credential missing token' };
+        }
+        return { kind: 'present', credential };
+    }
+    catch (err) {
+        return {
+            kind: 'error',
+            message: err instanceof Error ? err.message : 'Caller credential extractor failed',
+        };
+    }
+}
+export function ephemeralSessionScope(prefix = 'req') {
+    return `${prefix}:${randomUUID()}`;
+}
+function headerValue(value) {
+    if (Array.isArray(value))
+        return value[0];
+    return value;
+}
+//# sourceMappingURL=runtime.js.map

package/dist/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACN,qBAAqB,EACrB,WAAW,GAEX,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGN,eAAe,GACf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACN,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,cAAc,GACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,GACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA8D3E,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,0BAA0B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACnD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACzD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1D,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,EAAa;IAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,CAAU,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,OAAO,gBAAgB;IAC5B;;;OAGG;IACc,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC1C,IAAI,CAA0B;IAE/C,YAAY,IAA6B;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,SAAS;QAUR,OAAO;YACN,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,IAAI,yBAAyB;YAC/E,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,IAAI,0BAA0B;YAClF,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,IAAI,qBAAqB;YACnF,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,IAAI,0BAA0B;YAClF,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,IAAI,0BAA0B;SAClF,CAAC;IACH,CAAC;IAEO,aAAa;QACpB,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC;QACxD,OAAO,CAAC,CAAC;IACV,CAAC;IAEO,WAAW,CAAC,YAAoB,EAAE,EAAa;QACtD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC;IAC5E,CAAC;IAEO,WAAW,CAAC,YAAoB,EAAE,EAAa;QACtD,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IAEO,cAAc,CAAC,YAAoB,EAAE,EAAa;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,iBAAiB;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/B,OAAO,OAAO,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAQlB;QACA,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClD,MAAM,IAAI,GAAoB;YAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,UAAU,CAAC,EAAE;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa,EAAE,SAAS;YACxB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC;QAEF,MAAM,UAAU,GAAG,KAAK,CAAC,oBAAoB,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAEpE,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACjC,iEAAiE;YACjE,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE;gBACtC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,kBAAkB;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;aACtB,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;QAC9C,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAClC,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;QAC9C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CACrC,UAAU,CAAC,UAAU,CAAC,KAAK,EAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,UAAU,CAAC,UAAU,CAAC,cAAc,CACpC,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO;gBACN,GAAG,IAAI;gBACP,aAAa,EAAE,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;aACpE,CAAC;QACH,CAAC;QAED,OAAO;YACN,GAAG,IAAI;YACP,aAAa,EAAE,UAAU;YACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;SAC7B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CACnB,MAAqB,EACrB,OAAwB;QAExB,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAC5D,CAAC;QAED,oFAAoF;QACpF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YACrC,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE;oBAC5B,MAAM;oBACN,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;iBACxB,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YACxD,CAAC;YAED,+DAA+D;YAC/D,yEAAyE;YACzE,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE;oBAClC,MAAM;oBACN,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO,EAAE,oBAAoB;oBAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;iBACxB,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YAC9D,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE9B,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE;gBACpC,MAAM;gBACN,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,sBAAsB;gBAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;QACtE,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YACxD,OAAO;gBACN,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,aAAa,CACtB,OAAO,CAAC,EAAE,EACV,YAAY,CAAC,eAAe,EAAE,iCAAiC,EAAE;oBAChE,IAAI,EAAE,wBAAwB;iBAC9B,CAAC,CACF;aACD,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,aAAa,EAAE,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;YACxD,OAAO;gBACN,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,aAAa,CACtB,OAAO,CAAC,EAAE,EACV,YAAY,CAAC,WAAW,EAAE,6BAA6B,CAAC,CACxD;aACD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;;gBACrC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,cAAc,GAAoB;YACvC,GAAG,OAAO;YACV,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC;QAEF,qFAAqF;QACrF,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAC9B,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,MAAM,EACd,cAAc,CACd,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACtD,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAE3E,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAClD,OAAO;oBACN,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,aAAa,CACtB,OAAO,CAAC,EAAE,EACV,YAAY,CAAC,cAAc,EAAE,oBAAoB,EAAE;wBAClD,IAAI,EAAE,oBAAoB;qBAC1B,CAAC,CACF;iBACD,CAAC;YACH,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,eAAe,CAAC;gBAC1C,MAAM;gBACN,QAAQ,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;gBAClF,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,WAAW,EAAE,KAAK;gBAClB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;aACxB,CAAC,CAAC,CAAC;YAEJ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,yEAAyE;YACzE,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAEjC,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAC7C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC,CAC1C,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,eAAe,CAAC;gBAC7C,MAAM;gBACN,QAAQ,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;gBAClF,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,SAAS,EAAE,KAAK,CAAC,IAAI;gBACrB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;aACxB,CAAC,CAAC,CAAC;YACJ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;QACzE,CAAC;IACF,CAAC;IAED,KAAK,CAAC,cAAc,CACnB,GAAY,EACZ,OAAwB;QAExB,OAAO,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,YAAY,CACjB,IAAY,EACZ,OAAwB;QAExB,OAAO,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,aAAa,CAC1B,MAAc,EACd,EAAa,EACb,MAAe,EACf,OAAwB;QAExB,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAClD,OAAO,qBAAqB,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,MAAM,KAAK,gBAAgB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,GAAG,GAAI,MAAkC,EAAE,GAAG,CAAC;YACrD,IAAI,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;gBAChE,OAAO;oBACN,QAAQ,EAAE;wBACT;4BACC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG;4BACrB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,IAAI,WAAW;4BAC9C,IAAI,EAAE,IAAI;yBACV;qBACD;iBACD,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,MAAM,EAAE,CAAC,EAAE;gBAC7D,IAAI,EAAE,gBAAgB;aACtB,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAA0B;YACtC,OAAO,EAAE,KAAK;YACd,EAAE;YACF,MAAM,EAAE,MAAyC;YACjD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAC;QACF,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAEO,GAAG,CAAC,KAAa,EAAE,MAA+B;QACzD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;CACD;AAED,KAAK,UAAU,eAAe,CAC7B,IAAgB,EAChB,KAAsB,EACtB,EAAU;IAEV,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACzB,IAAI;YACJ,IAAI,OAAO,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC5B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACvB,KAAK,CAAC,KAAK,EAAE,CAAC;oBACd,MAAM,CACL,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,EAAE;wBAC7C,IAAI,EAAE,cAAc;wBACpB,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;qBACjC,CAAC,CACF,CAAC;gBACH,CAAC,EAAE,EAAE,CAAC,CAAC;YACR,CAAC,CAAC;SACF,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe;IAC1C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAI,MAA6B,CAAC,IAAI,CAAC;QACjD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,6BAA6B,CAAC,OAI7C;IACA,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IACvD,OAAO;QACN,KAAK;QACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,EAAE,eAAe;KACvB,CAAC;AACH,CAAC;AAWD,MAAM,UAAU,sBAAsB,CACrC,OAAgC;IAEhC,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC7B,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAwD,EACxD,OAAiB;IAEjB,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACxC,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC3C,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC/D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO;YACN,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,oCAAoC;SAClF,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAM,GAAG,KAAK;IACnD,OAAO,GAAG,MAAM,IAAI,UAAU,EAAE,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,KAAoC;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC;AACd,CAAC"}

package/package.json

@@ -0,0 +1,64 @@
+{
+  "name": "@privos_ai/app-server",
+  "version": "0.1.0",
+  "description": "Business-agnostic PrivOS MCP App server runtime — Direct HTTP + Relay WebSocket",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./auth": {
+      "types": "./dist/auth/user-token.d.ts",
+      "import": "./dist/auth/user-token.js"
+    },
+    "./direct": {
+      "types": "./dist/direct/express-router.d.ts",
+      "import": "./dist/direct/express-router.js"
+    },
+    "./direct/http-ingress": {
+      "types": "./dist/direct/http-ingress.d.ts",
+      "import": "./dist/direct/http-ingress.js"
+    },
+    "./relay": {
+      "types": "./dist/relay/relay-client.d.ts",
+      "import": "./dist/relay/relay-client.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepack": "npm run build",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "pack:check": "npm pack --dry-run"
+  },
+  "peerDependencies": {
+    "express": "^4.18.0 || ^5.0.0"
+  },
+  "dependencies": {
+    "jose": "^5.9.6",
+    "ws": "^8.18.0"
+  },
+  "devDependencies": {
+    "@types/express": "^4.17.25",
+    "@types/node": "^22.10.0",
+    "@types/supertest": "^7.2.0",
+    "@types/ws": "^8.18.1",
+    "express": "^4.22.2",
+    "supertest": "^7.2.0",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.10"
+  },
+  "license": "MIT"
+}