@questpie/mcp 3.16.0 → 3.17.0

package/dist/mcp-snyVygDQ.mjs

@@ -1,168 +0,0 @@
-import { t as createMcpServer } from "./create-server-DIvtVlma.mjs";
-import { t as mcpPlugin } from "./plugin-BJ6gELRj.mjs";
-import { route } from "questpie";
-import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-
-//#region src/server/mcp-http.ts
-/**
-* Shared MCP Streamable-HTTP handler.
-*
-* `route()` is single-method, so the MCP endpoint's four verbs (POST = JSON-RPC
-* messages, GET = SSE stream, DELETE = session end, OPTIONS = CORS preflight)
-* are registered as separate method-suffixed route files under `routes/`
-* (`mcp.ts` = POST, `mcp.get.ts`, `mcp.delete.ts`, `mcp.options.ts`) per the
-* codegen file convention — NOT method chaining and NOT a hand-written
-* `module.ts`. All four share THIS handler, which dispatches on
-* `request.method` internally because the transport needs one object for every
-* verb on the path.
-*/
-const mcpMeta = {
-	title: "MCP endpoint",
-	description: "Model Context Protocol endpoint for QUESTPIE."
-};
-function appFromRouteContext(ctx) {
-	return ctx.app;
-}
-function executionContextFromRouteContext(ctx) {
-	const routeCtx = { ...ctx };
-	delete routeCtx.app;
-	delete routeCtx.request;
-	return routeCtx;
-}
-function withCors(response, request) {
-	const headers = new Headers(response.headers);
-	const origin = request.headers.get("origin");
-	if (origin) {
-		headers.set("Access-Control-Allow-Origin", origin);
-		headers.set("Vary", "Origin");
-	}
-	headers.set("Access-Control-Allow-Methods", "POST, GET, DELETE, OPTIONS");
-	headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization, x-api-key, Mcp-Session-Id, Last-Event-ID");
-	return new Response(response.body, {
-		status: response.status,
-		statusText: response.statusText,
-		headers
-	});
-}
-/**
-* Build the `WWW-Authenticate` challenge value for an unauthenticated HTTP MCP
-* request. `resource_metadata` points at this app's Protected Resource metadata
-* document (RFC 9728), served beside the MCP route by the core
-* `oauth-protected-resource` route (MO4). An MCP client reads it to discover
-* the authorization server and start the OAuth 2.1 flow.
-*
-* The public origin comes from `app.config.app.url`, while the mount path comes
-* from the actual MCP request. This keeps the canonical external host used for
-* token audience binding, and also preserves adapter base paths such as `/api`.
-*/
-function protectedResourceChallenge(appUrl, requestUrl) {
-	const request = new URL(requestUrl);
-	request.pathname = request.pathname.replace(/\/+$/, "");
-	const metadataPath = new URL(".well-known/oauth-protected-resource", request).pathname;
-	const metadataUrl = new URL(appUrl);
-	metadataUrl.pathname = metadataPath;
-	metadataUrl.search = "";
-	metadataUrl.hash = "";
-	return `Bearer resource_metadata="${metadataUrl.href}"`;
-}
-/**
-* A verified principal is required to reach MCP tool execution over HTTP. The
-* request context resolves one for a cookie/bearer session (`kind: "user"`) or a
-* valid OAuth access token (`kind: "oauth"`); an unauthenticated request has
-* none. Read it structurally — the handler-args type does not surface it.
-*/
-function hasVerifiedPrincipal(ctx) {
-	return Boolean(ctx.principal);
-}
-async function mcpHandler(ctx) {
-	const { request } = ctx;
-	const app = appFromRouteContext(ctx);
-	if (request.method === "OPTIONS") return withCors(new Response(null, { status: 204 }), request);
-	if (!hasVerifiedPrincipal(ctx)) return withCors(new Response(null, {
-		status: 401,
-		headers: { "WWW-Authenticate": protectedResourceChallenge(app.config.app.url, request.url) }
-	}), request);
-	const config = app.state?.config?.mcp ?? {};
-	const server = await createMcpServer(app, {
-		transport: "http",
-		accessMode: "user",
-		request,
-		ctx: executionContextFromRouteContext(ctx)
-	});
-	const transport = new WebStandardStreamableHTTPServerTransport({
-		sessionIdGenerator: void 0,
-		allowedOrigins: config.http?.allowedOrigins,
-		allowedHosts: config.http?.allowedHosts,
-		enableJsonResponse: config.http?.enableJsonResponse ?? true
-	});
-	await server.connect(transport);
-	return withCors(await transport.handleRequest(request), request);
-}
-
-//#endregion
-//#region src/server/modules/mcp/routes/mcp.ts
-var mcp_default$1 = route().post().raw().meta(mcpMeta).handler(mcpHandler);
-
-//#endregion
-//#region src/server/modules/mcp/routes/mcp.delete.ts
-var mcp_delete_default = route().delete().raw().meta(mcpMeta).handler(mcpHandler);
-
-//#endregion
-//#region src/server/modules/mcp/routes/mcp.get.ts
-var mcp_get_default = route().get().raw().meta(mcpMeta).handler(mcpHandler);
-
-//#endregion
-//#region src/server/modules/mcp/routes/mcp.options.ts
-var mcp_options_default = route().options().raw().meta(mcpMeta).handler(mcpHandler);
-
-//#endregion
-//#region src/server/modules/mcp/plugin.ts
-/**
-* MCP module plugin — re-exports the MCP codegen plugin so that module
-* codegen discovers it and embeds it in the generated module definition.
-* This allows `extractPluginsFromModules` to pick it up automatically at
-* root-app codegen time (so consuming apps get the `mcp-tools` category,
-* `config/mcp.ts` discover, and scaffolds).
-*/
-var plugin_default = mcpPlugin();
-
-//#endregion
-//#region src/server/modules/mcp/.generated/module.ts
-const _module = {
-	name: "questpie-mcp",
-	routes: {
-		mcp: mcp_default$1,
-		"mcp:DELETE": mcp_delete_default,
-		"mcp:GET": mcp_get_default,
-		"mcp:OPTIONS": mcp_options_default
-	},
-	collections: {},
-	globals: {},
-	jobs: {},
-	messages: {},
-	services: {},
-	emails: {},
-	migrations: [],
-	seeds: [],
-	fieldTypes: {},
-	mcpTools: {},
-	plugin: plugin_default
-};
-var module_default = _module;
-
-//#endregion
-//#region src/server/modules/mcp/index.ts
-/**
-* MCP Module
-*
-* Backend module for the QUESTPIE Model Context Protocol endpoint.
-*
-* Exports:
-* - `mcpModule` — static module definition (generated by codegen from file convention)
-* - `McpModule` — type of the static module
-*/
-const mcpModule = module_default;
-var mcp_default = mcpModule;
-
-//#endregion
-export { mcp_default as n, mcpModule as t };

package/dist/stdio-t_9rKayH.d.mts

@@ -1,154 +0,0 @@
-import { AppContext, RequestContext, createContextFactory } from "questpie";
-import { z } from "zod";
-import { CallToolResult, ToolAnnotations } from "@modelcontextprotocol/sdk/types.js";
-import * as _modelcontextprotocol_sdk_server_mcp0 from "@modelcontextprotocol/sdk/server/mcp";
-
-//#region src/server/types.d.ts
-type McpTransportKind = "http" | "stdio";
-type McpAccessMode = "user" | "system";
-interface McpAccessRuleContext {
-  transport: McpTransportKind;
-  accessMode: McpAccessMode;
-  session?: RequestContext["session"];
-  /**
-   * The consented OAuth scopes carried by the caller, when the request was
-   * authenticated by an OAuth access token (`ctx.principal.kind === "oauth"`).
-   * `undefined` for the `user` (first-party) and `system` (stdio/trusted)
-   * principals, which carry no scopes. This is the model input the scope gate
-   * (`scopeGateAllows`) reads when deciding whether a tool is visible/callable.
-   */
-  scopes?: string[];
-  ctx: AppContext & Partial<RequestContext>;
-}
-type McpAccessRule = boolean | ((ctx: McpAccessRuleContext) => boolean | Promise<boolean>);
-/**
- * OAuth scope requirement declaration. A single scope string, a list (all
- * required — AND), or `false` to explicitly require no scope (public even to
- * scoped OAuth callers). `undefined` means "fall back to the default mapping".
- */
-type McpRequiredScopes = string | string[] | false;
-type McpEntityPolicy = boolean | {
-  expose?: boolean;
-  read?: boolean | McpAccessRule;
-  write?: boolean | McpAccessRule;
-  delete?: boolean | McpAccessRule;
-  operations?: Record<string, boolean | McpAccessRule>;
-  /**
-   * Scopes an OAuth caller must hold to reach this entity. Declarable at
-   * the entity level (applies to every operation) and/or per operation via
-   * {@link McpEntityPolicy.operationScopes}. When omitted, the default
-   * operation→scope mapping is derived from the operation kind (e.g.
-   * `collections:<name>:read`). Resolved by `requiredScopesForOperation`
-   * and enforced by the scope gate (`scopeGateAllows`) at both
-   * `tools/list` and `tools/call`.
-   */
-  requiredScopes?: McpRequiredScopes;
-  /**
-   * Per-operation scope requirements, keyed by operation name
-   * (`list`/`get`/`create`/`update`/`delete`/`invoke`/…). Overrides both
-   * {@link McpEntityPolicy.requiredScopes} and the default mapping for the
-   * named operation.
-   */
-  operationScopes?: Record<string, McpRequiredScopes>;
-  fields?: {
-    include?: string[];
-    exclude?: string[];
-  };
-  description?: string;
-};
-interface McpCrudDefaults {
-  collections?: {
-    read?: boolean | McpAccessRule;
-    write?: boolean | McpAccessRule;
-    delete?: boolean | McpAccessRule;
-  };
-  globals?: {
-    read?: boolean | McpAccessRule;
-    write?: boolean | McpAccessRule;
-  };
-}
-interface McpCrudConfig {
-  defaults?: McpCrudDefaults;
-  collections?: Record<string, McpEntityPolicy>;
-  globals?: Record<string, McpEntityPolicy>;
-  maxLimit?: number;
-}
-interface McpRoutesConfig {
-  exposeAnnotated?: boolean;
-  routes?: Record<string, McpEntityPolicy>;
-}
-interface McpResourcesConfig {
-  schemas?: boolean;
-  routes?: boolean;
-}
-interface McpTransportConfig {
-  accessMode?: McpAccessMode;
-}
-interface McpHttpConfig extends McpTransportConfig {
-  allowedOrigins?: string[];
-  allowedHosts?: string[];
-  enableJsonResponse?: boolean;
-}
-interface McpStdioConfig extends McpTransportConfig {}
-interface McpConfig {
-  name?: string;
-  version?: string;
-  crud?: McpCrudConfig;
-  routes?: McpRoutesConfig;
-  resources?: McpResourcesConfig;
-  http?: McpHttpConfig;
-  stdio?: McpStdioConfig;
-}
-interface McpExecutionOptions {
-  transport?: McpTransportKind;
-  accessMode?: McpAccessMode;
-  ctx?: AppContext & Partial<RequestContext>;
-  request?: Request;
-  config?: McpConfig;
-}
-interface McpToolHandlerArgs<TInput = unknown> {
-  input: TInput;
-  ctx: AppContext & Partial<RequestContext>;
-  transport: McpTransportKind;
-  accessMode: McpAccessMode;
-  request?: Request;
-}
-interface McpToolConfig<TInputSchema extends z.ZodTypeAny = z.ZodTypeAny, TOutputSchema extends z.ZodTypeAny = z.ZodTypeAny> {
-  title?: string;
-  description?: string;
-  inputSchema?: TInputSchema;
-  outputSchema?: TOutputSchema;
-  annotations?: ToolAnnotations;
-  access?: McpAccessRule;
-  /**
-   * Scopes an OAuth caller must hold to reach this custom tool (all required —
-   * AND). Custom tools have no default mapping (there is no resource/operation
-   * to derive one from), so an omitted value requires no scope. Enforced by the
-   * scope gate (`scopeGateAllows`) at both `tools/list` (hidden) and
-   * `tools/call` (denied); `system`/`user` callers carry no scopes and skip it.
-   */
-  scopes?: McpRequiredScopes;
-  _meta?: Record<string, unknown>;
-}
-interface McpToolDefinition<TInputSchema extends z.ZodTypeAny = z.ZodTypeAny, TOutputSchema extends z.ZodTypeAny = z.ZodTypeAny> {
-  readonly __brand: "mcpTool";
-  readonly name: string;
-  readonly config: McpToolConfig<TInputSchema, TOutputSchema>;
-  readonly handler: (args: McpToolHandlerArgs<z.infer<TInputSchema>>) => CallToolResult | Promise<CallToolResult>;
-}
-declare module "questpie" {
-  interface AppStateConfig {
-    mcp?: McpConfig;
-  }
-  interface ModuleDefinition {
-    mcpTools?: Record<string, McpToolDefinition>;
-  }
-}
-//#endregion
-//#region src/server/runtime.d.ts
-type QuestpieApp = Parameters<typeof createContextFactory>[0];
-//#endregion
-//#region src/server/stdio.d.ts
-declare function startStdioServer(app: QuestpieApp, options?: Omit<McpExecutionOptions, "transport">): Promise<_modelcontextprotocol_sdk_server_mcp0.McpServer>;
-//#endregion
-export { McpToolDefinition as _, McpAccessRuleContext as a, McpCrudDefaults as c, McpHttpConfig as d, McpRequiredScopes as f, McpToolConfig as g, McpStdioConfig as h, McpAccessRule as i, McpEntityPolicy as l, McpRoutesConfig as m, QuestpieApp as n, McpConfig as o, McpResourcesConfig as p, McpAccessMode as r, McpCrudConfig as s, startStdioServer as t, McpExecutionOptions as u, McpToolHandlerArgs as v, McpTransportKind as y };