@roarkanalytics/sdk-mcp 4.10.0 → 4.11.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +14 -0
- package/README.md +58 -0
- package/code-tool.js +10 -0
- package/code-tool.js.map +1 -1
- package/code-tool.mjs +10 -0
- package/code-tool.mjs.map +1 -1
- package/http.d.mts.map +1 -1
- package/http.d.ts.map +1 -1
- package/http.js +95 -2
- package/http.js.map +1 -1
- package/http.mjs +95 -2
- package/http.mjs.map +1 -1
- package/oauth.d.mts +70 -0
- package/oauth.d.mts.map +1 -0
- package/oauth.d.ts +70 -0
- package/oauth.d.ts.map +1 -0
- package/oauth.js +101 -0
- package/oauth.js.map +1 -0
- package/oauth.mjs +93 -0
- package/oauth.mjs.map +1 -0
- package/options.d.mts +8 -0
- package/options.d.mts.map +1 -1
- package/options.d.ts +8 -0
- package/options.d.ts.map +1 -1
- package/options.js +26 -0
- package/options.js.map +1 -1
- package/options.mjs +26 -0
- package/options.mjs.map +1 -1
- package/package.json +12 -2
- package/server.d.mts.map +1 -1
- package/server.d.ts.map +1 -1
- package/server.js +2 -1
- package/server.js.map +1 -1
- package/server.mjs +2 -1
- package/server.mjs.map +1 -1
- package/src/code-tool.ts +10 -0
- package/src/http.ts +111 -3
- package/src/oauth.ts +137 -0
- package/src/options.ts +39 -0
- package/src/server.ts +2 -1
- package/src/types.ts +10 -0
- package/types.d.mts +10 -0
- package/types.d.mts.map +1 -1
- package/types.d.ts +10 -0
- package/types.d.ts.map +1 -1
- package/types.js.map +1 -1
- package/types.mjs.map +1 -1
package/oauth.d.mts
ADDED
|
@@ -0,0 +1,70 @@
|
|
|
1
|
+
import { IncomingMessage } from 'node:http';
|
|
2
|
+
import { ClientOptions } from '@roarkanalytics/sdk';
|
|
3
|
+
export type OAuthConfig = {
|
|
4
|
+
/** Authorization server issuer, e.g. https://mcp-oauth.api.roark.ai */
|
|
5
|
+
issuer: string;
|
|
6
|
+
/** Public origin of this resource server, e.g. https://mcp.api.roark.ai; connector URLs are `<base>/mcp/<projectId>`. */
|
|
7
|
+
resourceBaseUrl: string;
|
|
8
|
+
};
|
|
9
|
+
/** Thrown when a request cannot be authorized; carries the WWW-Authenticate value to return. */
|
|
10
|
+
export declare class UnauthorizedError extends Error {
|
|
11
|
+
readonly wwwAuthenticate: string;
|
|
12
|
+
readonly status: 401 | 403;
|
|
13
|
+
constructor(message: string, wwwAuthenticate: string, status?: 401 | 403);
|
|
14
|
+
}
|
|
15
|
+
/**
|
|
16
|
+
* Which connector URL a request arrived on. There are three, and the difference is the whole
|
|
17
|
+
* point of this PR:
|
|
18
|
+
*
|
|
19
|
+
* - `origin` the bare server origin, the legacy `/` transport.
|
|
20
|
+
* - `mcp` the single connector, `<base>/mcp`. No project in the URL: the credential is
|
|
21
|
+
* user-scoped and names a project per request. This is what a person adds to
|
|
22
|
+
* Claude or Cursor once and never revisits.
|
|
23
|
+
* - `project` a pinned connector, `<base>/mcp/<projectId>`. Still supported, and now actually
|
|
24
|
+
* enforced: the project in the path becomes the SDK's project, so a user-scoped
|
|
25
|
+
* credential used on a pinned URL acts only on that project.
|
|
26
|
+
*/
|
|
27
|
+
export type Connector = {
|
|
28
|
+
kind: 'origin';
|
|
29
|
+
} | {
|
|
30
|
+
kind: 'mcp';
|
|
31
|
+
} | {
|
|
32
|
+
kind: 'project';
|
|
33
|
+
projectId: string;
|
|
34
|
+
};
|
|
35
|
+
export declare const ORIGIN_CONNECTOR: Connector;
|
|
36
|
+
/**
|
|
37
|
+
* The resource identifier (RFC 8707) for a request: the connector URL it arrived on. Clients
|
|
38
|
+
* send it back to the authorization server as `resource`, which is how consent learns whether
|
|
39
|
+
* the grant is for one project or for the person.
|
|
40
|
+
*/
|
|
41
|
+
export declare const resourceIdentifier: (config: OAuthConfig, connector?: Connector) => string;
|
|
42
|
+
/**
|
|
43
|
+
* Where this server publishes its Protected Resource Metadata, per resource.
|
|
44
|
+
*
|
|
45
|
+
* RFC 9728 puts the resource's path after the well-known segment, so this is literally the
|
|
46
|
+
* origin, the well-known path, and the connector path, in that order.
|
|
47
|
+
*/
|
|
48
|
+
export declare const protectedResourceMetadataUrl: (config: OAuthConfig, connector?: Connector) => string;
|
|
49
|
+
/** RFC 9728 Protected Resource Metadata document. */
|
|
50
|
+
export declare const protectedResourceMetadata: (config: OAuthConfig, connector?: Connector) => {
|
|
51
|
+
resource: string;
|
|
52
|
+
authorization_servers: string[];
|
|
53
|
+
bearer_methods_supported: string[];
|
|
54
|
+
scopes_supported: string[];
|
|
55
|
+
resource_documentation: string;
|
|
56
|
+
};
|
|
57
|
+
/**
|
|
58
|
+
* Requires a bearer token and hands it to the SDK as-is. Throws
|
|
59
|
+
* {@link UnauthorizedError} (401 + challenge) when it is missing, which is the
|
|
60
|
+
* signal an MCP client needs to start the OAuth flow. Validity is decided by
|
|
61
|
+
* customer-api on each call; an expired or revoked key surfaces there.
|
|
62
|
+
*
|
|
63
|
+
* A pinned connector also fixes the SDK's `project`. This is `project` rather than a
|
|
64
|
+
* `defaultHeaders` entry deliberately: code the model writes inside the execution tool can still
|
|
65
|
+
* call `client.withOptions({ project })` to reach another project the credential covers, which a
|
|
66
|
+
* default header would silently override. On the unpinned `/mcp` connector no project is set at
|
|
67
|
+
* all, and choosing one is the caller's job.
|
|
68
|
+
*/
|
|
69
|
+
export declare const requireBearer: (req: IncomingMessage, config: OAuthConfig, connector?: Connector) => Partial<ClientOptions>;
|
|
70
|
+
//# sourceMappingURL=oauth.d.mts.map
|
package/oauth.d.mts.map
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"oauth.d.mts","sourceRoot":"","sources":["src/oauth.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,MAAM,MAAM,WAAW,GAAG;IACxB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,yHAAyH;IACzH,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,gGAAgG;AAChG,qBAAa,iBAAkB,SAAQ,KAAK;IAGxC,QAAQ,CAAC,eAAe,EAAE,MAAM;IAChC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG;gBAF1B,OAAO,EAAE,MAAM,EACN,eAAe,EAAE,MAAM,EACvB,MAAM,GAAE,GAAG,GAAG,GAAS;CAKnC;AAID;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtG,eAAO,MAAM,gBAAgB,EAAE,SAA8B,CAAC;AAQ9D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,WAAW,EAAE,YAAW,SAA4B,KAAG,MAC9B,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,GACvC,QAAQ,WAAW,EACnB,YAAW,SAA4B,KACtC,MACsG,CAAC;AAE1G,qDAAqD;AACrD,eAAO,MAAM,yBAAyB,GAAI,QAAQ,WAAW,EAAE,YAAW,SAA4B;;;;;;CAMpG,CAAC;AAuBH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa,GACxB,KAAK,eAAe,EACpB,QAAQ,WAAW,EACnB,YAAW,SAA4B,KACtC,OAAO,CAAC,aAAa,CAavB,CAAC"}
|
package/oauth.d.ts
ADDED
|
@@ -0,0 +1,70 @@
|
|
|
1
|
+
import { IncomingMessage } from 'node:http';
|
|
2
|
+
import { ClientOptions } from '@roarkanalytics/sdk';
|
|
3
|
+
export type OAuthConfig = {
|
|
4
|
+
/** Authorization server issuer, e.g. https://mcp-oauth.api.roark.ai */
|
|
5
|
+
issuer: string;
|
|
6
|
+
/** Public origin of this resource server, e.g. https://mcp.api.roark.ai; connector URLs are `<base>/mcp/<projectId>`. */
|
|
7
|
+
resourceBaseUrl: string;
|
|
8
|
+
};
|
|
9
|
+
/** Thrown when a request cannot be authorized; carries the WWW-Authenticate value to return. */
|
|
10
|
+
export declare class UnauthorizedError extends Error {
|
|
11
|
+
readonly wwwAuthenticate: string;
|
|
12
|
+
readonly status: 401 | 403;
|
|
13
|
+
constructor(message: string, wwwAuthenticate: string, status?: 401 | 403);
|
|
14
|
+
}
|
|
15
|
+
/**
|
|
16
|
+
* Which connector URL a request arrived on. There are three, and the difference is the whole
|
|
17
|
+
* point of this PR:
|
|
18
|
+
*
|
|
19
|
+
* - `origin` the bare server origin, the legacy `/` transport.
|
|
20
|
+
* - `mcp` the single connector, `<base>/mcp`. No project in the URL: the credential is
|
|
21
|
+
* user-scoped and names a project per request. This is what a person adds to
|
|
22
|
+
* Claude or Cursor once and never revisits.
|
|
23
|
+
* - `project` a pinned connector, `<base>/mcp/<projectId>`. Still supported, and now actually
|
|
24
|
+
* enforced: the project in the path becomes the SDK's project, so a user-scoped
|
|
25
|
+
* credential used on a pinned URL acts only on that project.
|
|
26
|
+
*/
|
|
27
|
+
export type Connector = {
|
|
28
|
+
kind: 'origin';
|
|
29
|
+
} | {
|
|
30
|
+
kind: 'mcp';
|
|
31
|
+
} | {
|
|
32
|
+
kind: 'project';
|
|
33
|
+
projectId: string;
|
|
34
|
+
};
|
|
35
|
+
export declare const ORIGIN_CONNECTOR: Connector;
|
|
36
|
+
/**
|
|
37
|
+
* The resource identifier (RFC 8707) for a request: the connector URL it arrived on. Clients
|
|
38
|
+
* send it back to the authorization server as `resource`, which is how consent learns whether
|
|
39
|
+
* the grant is for one project or for the person.
|
|
40
|
+
*/
|
|
41
|
+
export declare const resourceIdentifier: (config: OAuthConfig, connector?: Connector) => string;
|
|
42
|
+
/**
|
|
43
|
+
* Where this server publishes its Protected Resource Metadata, per resource.
|
|
44
|
+
*
|
|
45
|
+
* RFC 9728 puts the resource's path after the well-known segment, so this is literally the
|
|
46
|
+
* origin, the well-known path, and the connector path, in that order.
|
|
47
|
+
*/
|
|
48
|
+
export declare const protectedResourceMetadataUrl: (config: OAuthConfig, connector?: Connector) => string;
|
|
49
|
+
/** RFC 9728 Protected Resource Metadata document. */
|
|
50
|
+
export declare const protectedResourceMetadata: (config: OAuthConfig, connector?: Connector) => {
|
|
51
|
+
resource: string;
|
|
52
|
+
authorization_servers: string[];
|
|
53
|
+
bearer_methods_supported: string[];
|
|
54
|
+
scopes_supported: string[];
|
|
55
|
+
resource_documentation: string;
|
|
56
|
+
};
|
|
57
|
+
/**
|
|
58
|
+
* Requires a bearer token and hands it to the SDK as-is. Throws
|
|
59
|
+
* {@link UnauthorizedError} (401 + challenge) when it is missing, which is the
|
|
60
|
+
* signal an MCP client needs to start the OAuth flow. Validity is decided by
|
|
61
|
+
* customer-api on each call; an expired or revoked key surfaces there.
|
|
62
|
+
*
|
|
63
|
+
* A pinned connector also fixes the SDK's `project`. This is `project` rather than a
|
|
64
|
+
* `defaultHeaders` entry deliberately: code the model writes inside the execution tool can still
|
|
65
|
+
* call `client.withOptions({ project })` to reach another project the credential covers, which a
|
|
66
|
+
* default header would silently override. On the unpinned `/mcp` connector no project is set at
|
|
67
|
+
* all, and choosing one is the caller's job.
|
|
68
|
+
*/
|
|
69
|
+
export declare const requireBearer: (req: IncomingMessage, config: OAuthConfig, connector?: Connector) => Partial<ClientOptions>;
|
|
70
|
+
//# sourceMappingURL=oauth.d.ts.map
|
package/oauth.d.ts.map
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["src/oauth.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,MAAM,MAAM,WAAW,GAAG;IACxB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,yHAAyH;IACzH,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,gGAAgG;AAChG,qBAAa,iBAAkB,SAAQ,KAAK;IAGxC,QAAQ,CAAC,eAAe,EAAE,MAAM;IAChC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG;gBAF1B,OAAO,EAAE,MAAM,EACN,eAAe,EAAE,MAAM,EACvB,MAAM,GAAE,GAAG,GAAG,GAAS;CAKnC;AAID;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtG,eAAO,MAAM,gBAAgB,EAAE,SAA8B,CAAC;AAQ9D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,WAAW,EAAE,YAAW,SAA4B,KAAG,MAC9B,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,GACvC,QAAQ,WAAW,EACnB,YAAW,SAA4B,KACtC,MACsG,CAAC;AAE1G,qDAAqD;AACrD,eAAO,MAAM,yBAAyB,GAAI,QAAQ,WAAW,EAAE,YAAW,SAA4B;;;;;;CAMpG,CAAC;AAuBH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa,GACxB,KAAK,eAAe,EACpB,QAAQ,WAAW,EACnB,YAAW,SAA4B,KACtC,OAAO,CAAC,aAAa,CAavB,CAAC"}
|
package/oauth.js
ADDED
|
@@ -0,0 +1,101 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
// Remote OAuth resource-server support.
|
|
3
|
+
//
|
|
4
|
+
// This file is hand-maintained (not generated). It turns the HTTP transport into
|
|
5
|
+
// an MCP OAuth *resource server* (RFC 9728): it advertises Protected Resource
|
|
6
|
+
// Metadata pointing at Roark's authorization server (bern `mcp-oauth`) and
|
|
7
|
+
// answers requests without a bearer with 401 + WWW-Authenticate so clients know
|
|
8
|
+
// where to go. The access token the authorization server issues is a Roark API
|
|
9
|
+
// key (minted at consent with the permissions the user picked, expiring and
|
|
10
|
+
// rotated by the client's refresh token), so it is forwarded to customer-api as
|
|
11
|
+
// the SDK bearer unchanged: customer-api validates it on every call.
|
|
12
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
13
|
+
exports.requireBearer = exports.protectedResourceMetadata = exports.protectedResourceMetadataUrl = exports.resourceIdentifier = exports.ORIGIN_CONNECTOR = exports.UnauthorizedError = void 0;
|
|
14
|
+
/** Thrown when a request cannot be authorized; carries the WWW-Authenticate value to return. */
|
|
15
|
+
class UnauthorizedError extends Error {
|
|
16
|
+
wwwAuthenticate;
|
|
17
|
+
status;
|
|
18
|
+
constructor(message, wwwAuthenticate, status = 401) {
|
|
19
|
+
super(message);
|
|
20
|
+
this.wwwAuthenticate = wwwAuthenticate;
|
|
21
|
+
this.status = status;
|
|
22
|
+
this.name = 'UnauthorizedError';
|
|
23
|
+
}
|
|
24
|
+
}
|
|
25
|
+
exports.UnauthorizedError = UnauthorizedError;
|
|
26
|
+
const stripSlash = (url) => url.replace(/\/+$/, '');
|
|
27
|
+
exports.ORIGIN_CONNECTOR = { kind: 'origin' };
|
|
28
|
+
/** The path a connector is served on, relative to the origin. */
|
|
29
|
+
const connectorPath = (connector) => connector.kind === 'origin' ? ''
|
|
30
|
+
: connector.kind === 'mcp' ? '/mcp'
|
|
31
|
+
: `/mcp/${connector.projectId}`;
|
|
32
|
+
/**
|
|
33
|
+
* The resource identifier (RFC 8707) for a request: the connector URL it arrived on. Clients
|
|
34
|
+
* send it back to the authorization server as `resource`, which is how consent learns whether
|
|
35
|
+
* the grant is for one project or for the person.
|
|
36
|
+
*/
|
|
37
|
+
const resourceIdentifier = (config, connector = exports.ORIGIN_CONNECTOR) => `${stripSlash(config.resourceBaseUrl)}${connectorPath(connector)}`;
|
|
38
|
+
exports.resourceIdentifier = resourceIdentifier;
|
|
39
|
+
/**
|
|
40
|
+
* Where this server publishes its Protected Resource Metadata, per resource.
|
|
41
|
+
*
|
|
42
|
+
* RFC 9728 puts the resource's path after the well-known segment, so this is literally the
|
|
43
|
+
* origin, the well-known path, and the connector path, in that order.
|
|
44
|
+
*/
|
|
45
|
+
const protectedResourceMetadataUrl = (config, connector = exports.ORIGIN_CONNECTOR) => `${stripSlash(config.resourceBaseUrl)}/.well-known/oauth-protected-resource${connectorPath(connector)}`;
|
|
46
|
+
exports.protectedResourceMetadataUrl = protectedResourceMetadataUrl;
|
|
47
|
+
/** RFC 9728 Protected Resource Metadata document. */
|
|
48
|
+
const protectedResourceMetadata = (config, connector = exports.ORIGIN_CONNECTOR) => ({
|
|
49
|
+
resource: (0, exports.resourceIdentifier)(config, connector),
|
|
50
|
+
authorization_servers: [stripSlash(config.issuer)],
|
|
51
|
+
bearer_methods_supported: ['header'],
|
|
52
|
+
scopes_supported: ['mcp'],
|
|
53
|
+
resource_documentation: 'https://docs.roark.ai',
|
|
54
|
+
});
|
|
55
|
+
exports.protectedResourceMetadata = protectedResourceMetadata;
|
|
56
|
+
const bearerChallenge = (config, connector, error, description) => {
|
|
57
|
+
const parts = [`Bearer resource_metadata="${(0, exports.protectedResourceMetadataUrl)(config, connector)}"`];
|
|
58
|
+
if (error)
|
|
59
|
+
parts.push(`error="${error}"`);
|
|
60
|
+
if (description)
|
|
61
|
+
parts.push(`error_description="${description}"`);
|
|
62
|
+
return parts.join(', ');
|
|
63
|
+
};
|
|
64
|
+
const extractBearer = (req) => {
|
|
65
|
+
const header = req.headers.authorization;
|
|
66
|
+
if (!header)
|
|
67
|
+
return undefined;
|
|
68
|
+
const [scheme, ...rest] = header.split(' ');
|
|
69
|
+
if (scheme !== 'Bearer' || rest.length === 0)
|
|
70
|
+
return undefined;
|
|
71
|
+
const token = rest.join(' ').trim();
|
|
72
|
+
return token.length > 0 ? token : undefined;
|
|
73
|
+
};
|
|
74
|
+
/**
|
|
75
|
+
* Requires a bearer token and hands it to the SDK as-is. Throws
|
|
76
|
+
* {@link UnauthorizedError} (401 + challenge) when it is missing, which is the
|
|
77
|
+
* signal an MCP client needs to start the OAuth flow. Validity is decided by
|
|
78
|
+
* customer-api on each call; an expired or revoked key surfaces there.
|
|
79
|
+
*
|
|
80
|
+
* A pinned connector also fixes the SDK's `project`. This is `project` rather than a
|
|
81
|
+
* `defaultHeaders` entry deliberately: code the model writes inside the execution tool can still
|
|
82
|
+
* call `client.withOptions({ project })` to reach another project the credential covers, which a
|
|
83
|
+
* default header would silently override. On the unpinned `/mcp` connector no project is set at
|
|
84
|
+
* all, and choosing one is the caller's job.
|
|
85
|
+
*/
|
|
86
|
+
const requireBearer = (req, config, connector = exports.ORIGIN_CONNECTOR) => {
|
|
87
|
+
const token = extractBearer(req);
|
|
88
|
+
if (!token) {
|
|
89
|
+
throw new UnauthorizedError('Missing bearer token', bearerChallenge(config, connector));
|
|
90
|
+
}
|
|
91
|
+
// Assigned rather than conditionally spread: a spread of `cond && { project }` is not checked
|
|
92
|
+
// against `ClientOptions`, so on an SDK without the option the pin would compile and then
|
|
93
|
+
// silently vanish. This way the dependency is enforced by the build.
|
|
94
|
+
const options = { bearerToken: token };
|
|
95
|
+
if (connector.kind === 'project') {
|
|
96
|
+
options.project = connector.projectId;
|
|
97
|
+
}
|
|
98
|
+
return options;
|
|
99
|
+
};
|
|
100
|
+
exports.requireBearer = requireBearer;
|
|
101
|
+
//# sourceMappingURL=oauth.js.map
|
package/oauth.js.map
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"oauth.js","sourceRoot":"","sources":["src/oauth.ts"],"names":[],"mappings":";AAAA,wCAAwC;AACxC,EAAE;AACF,iFAAiF;AACjF,8EAA8E;AAC9E,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAChF,qEAAqE;;;AAYrE,gGAAgG;AAChG,MAAa,iBAAkB,SAAQ,KAAK;IAG/B;IACA;IAHX,YACE,OAAe,EACN,eAAuB,EACvB,SAAoB,GAAG;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAiB;QAGhC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AATD,8CASC;AAED,MAAM,UAAU,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAgBvD,QAAA,gBAAgB,GAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAE9D,iEAAiE;AACjE,MAAM,aAAa,GAAG,CAAC,SAAoB,EAAU,EAAE,CACrD,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE;IAChC,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM;QACnC,CAAC,CAAC,QAAQ,SAAS,CAAC,SAAS,EAAE,CAAC;AAElC;;;;GAIG;AACI,MAAM,kBAAkB,GAAG,CAAC,MAAmB,EAAE,YAAuB,wBAAgB,EAAU,EAAE,CACzG,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;AADxD,QAAA,kBAAkB,sBACsC;AAErE;;;;;GAKG;AACI,MAAM,4BAA4B,GAAG,CAC1C,MAAmB,EACnB,YAAuB,wBAAgB,EAC/B,EAAE,CACV,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,wCAAwC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;AAJ7F,QAAA,4BAA4B,gCAIiE;AAE1G,qDAAqD;AAC9C,MAAM,yBAAyB,GAAG,CAAC,MAAmB,EAAE,YAAuB,wBAAgB,EAAE,EAAE,CAAC,CAAC;IAC1G,QAAQ,EAAE,IAAA,0BAAkB,EAAC,MAAM,EAAE,SAAS,CAAC;IAC/C,qBAAqB,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;IACpC,gBAAgB,EAAE,CAAC,KAAK,CAAC;IACzB,sBAAsB,EAAE,uBAAuB;CAChD,CAAC,CAAC;AANU,QAAA,yBAAyB,6BAMnC;AAEH,MAAM,eAAe,GAAG,CACtB,MAAmB,EACnB,SAAoB,EACpB,KAAc,EACd,WAAoB,EACZ,EAAE;IACV,MAAM,KAAK,GAAG,CAAC,6BAA6B,IAAA,oCAA4B,EAAC,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;IAChG,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;IAC1C,IAAI,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,WAAW,GAAG,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,GAAoB,EAAsB,EAAE;IACjE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACI,MAAM,aAAa,GAAG,CAC3B,GAAoB,EACpB,MAAmB,EACnB,YAAuB,wBAAgB,EACf,EAAE;IAC1B,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,EAAE,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,8FAA8F;IAC9F,0FAA0F;IAC1F,qEAAqE;IACrE,MAAM,OAAO,GAA2B,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC/D,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC;IACxC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAjBW,QAAA,aAAa,iBAiBxB"}
|
package/oauth.mjs
ADDED
|
@@ -0,0 +1,93 @@
|
|
|
1
|
+
// Remote OAuth resource-server support.
|
|
2
|
+
//
|
|
3
|
+
// This file is hand-maintained (not generated). It turns the HTTP transport into
|
|
4
|
+
// an MCP OAuth *resource server* (RFC 9728): it advertises Protected Resource
|
|
5
|
+
// Metadata pointing at Roark's authorization server (bern `mcp-oauth`) and
|
|
6
|
+
// answers requests without a bearer with 401 + WWW-Authenticate so clients know
|
|
7
|
+
// where to go. The access token the authorization server issues is a Roark API
|
|
8
|
+
// key (minted at consent with the permissions the user picked, expiring and
|
|
9
|
+
// rotated by the client's refresh token), so it is forwarded to customer-api as
|
|
10
|
+
// the SDK bearer unchanged: customer-api validates it on every call.
|
|
11
|
+
/** Thrown when a request cannot be authorized; carries the WWW-Authenticate value to return. */
|
|
12
|
+
export class UnauthorizedError extends Error {
|
|
13
|
+
wwwAuthenticate;
|
|
14
|
+
status;
|
|
15
|
+
constructor(message, wwwAuthenticate, status = 401) {
|
|
16
|
+
super(message);
|
|
17
|
+
this.wwwAuthenticate = wwwAuthenticate;
|
|
18
|
+
this.status = status;
|
|
19
|
+
this.name = 'UnauthorizedError';
|
|
20
|
+
}
|
|
21
|
+
}
|
|
22
|
+
const stripSlash = (url) => url.replace(/\/+$/, '');
|
|
23
|
+
export const ORIGIN_CONNECTOR = { kind: 'origin' };
|
|
24
|
+
/** The path a connector is served on, relative to the origin. */
|
|
25
|
+
const connectorPath = (connector) => connector.kind === 'origin' ? ''
|
|
26
|
+
: connector.kind === 'mcp' ? '/mcp'
|
|
27
|
+
: `/mcp/${connector.projectId}`;
|
|
28
|
+
/**
|
|
29
|
+
* The resource identifier (RFC 8707) for a request: the connector URL it arrived on. Clients
|
|
30
|
+
* send it back to the authorization server as `resource`, which is how consent learns whether
|
|
31
|
+
* the grant is for one project or for the person.
|
|
32
|
+
*/
|
|
33
|
+
export const resourceIdentifier = (config, connector = ORIGIN_CONNECTOR) => `${stripSlash(config.resourceBaseUrl)}${connectorPath(connector)}`;
|
|
34
|
+
/**
|
|
35
|
+
* Where this server publishes its Protected Resource Metadata, per resource.
|
|
36
|
+
*
|
|
37
|
+
* RFC 9728 puts the resource's path after the well-known segment, so this is literally the
|
|
38
|
+
* origin, the well-known path, and the connector path, in that order.
|
|
39
|
+
*/
|
|
40
|
+
export const protectedResourceMetadataUrl = (config, connector = ORIGIN_CONNECTOR) => `${stripSlash(config.resourceBaseUrl)}/.well-known/oauth-protected-resource${connectorPath(connector)}`;
|
|
41
|
+
/** RFC 9728 Protected Resource Metadata document. */
|
|
42
|
+
export const protectedResourceMetadata = (config, connector = ORIGIN_CONNECTOR) => ({
|
|
43
|
+
resource: resourceIdentifier(config, connector),
|
|
44
|
+
authorization_servers: [stripSlash(config.issuer)],
|
|
45
|
+
bearer_methods_supported: ['header'],
|
|
46
|
+
scopes_supported: ['mcp'],
|
|
47
|
+
resource_documentation: 'https://docs.roark.ai',
|
|
48
|
+
});
|
|
49
|
+
const bearerChallenge = (config, connector, error, description) => {
|
|
50
|
+
const parts = [`Bearer resource_metadata="${protectedResourceMetadataUrl(config, connector)}"`];
|
|
51
|
+
if (error)
|
|
52
|
+
parts.push(`error="${error}"`);
|
|
53
|
+
if (description)
|
|
54
|
+
parts.push(`error_description="${description}"`);
|
|
55
|
+
return parts.join(', ');
|
|
56
|
+
};
|
|
57
|
+
const extractBearer = (req) => {
|
|
58
|
+
const header = req.headers.authorization;
|
|
59
|
+
if (!header)
|
|
60
|
+
return undefined;
|
|
61
|
+
const [scheme, ...rest] = header.split(' ');
|
|
62
|
+
if (scheme !== 'Bearer' || rest.length === 0)
|
|
63
|
+
return undefined;
|
|
64
|
+
const token = rest.join(' ').trim();
|
|
65
|
+
return token.length > 0 ? token : undefined;
|
|
66
|
+
};
|
|
67
|
+
/**
|
|
68
|
+
* Requires a bearer token and hands it to the SDK as-is. Throws
|
|
69
|
+
* {@link UnauthorizedError} (401 + challenge) when it is missing, which is the
|
|
70
|
+
* signal an MCP client needs to start the OAuth flow. Validity is decided by
|
|
71
|
+
* customer-api on each call; an expired or revoked key surfaces there.
|
|
72
|
+
*
|
|
73
|
+
* A pinned connector also fixes the SDK's `project`. This is `project` rather than a
|
|
74
|
+
* `defaultHeaders` entry deliberately: code the model writes inside the execution tool can still
|
|
75
|
+
* call `client.withOptions({ project })` to reach another project the credential covers, which a
|
|
76
|
+
* default header would silently override. On the unpinned `/mcp` connector no project is set at
|
|
77
|
+
* all, and choosing one is the caller's job.
|
|
78
|
+
*/
|
|
79
|
+
export const requireBearer = (req, config, connector = ORIGIN_CONNECTOR) => {
|
|
80
|
+
const token = extractBearer(req);
|
|
81
|
+
if (!token) {
|
|
82
|
+
throw new UnauthorizedError('Missing bearer token', bearerChallenge(config, connector));
|
|
83
|
+
}
|
|
84
|
+
// Assigned rather than conditionally spread: a spread of `cond && { project }` is not checked
|
|
85
|
+
// against `ClientOptions`, so on an SDK without the option the pin would compile and then
|
|
86
|
+
// silently vanish. This way the dependency is enforced by the build.
|
|
87
|
+
const options = { bearerToken: token };
|
|
88
|
+
if (connector.kind === 'project') {
|
|
89
|
+
options.project = connector.projectId;
|
|
90
|
+
}
|
|
91
|
+
return options;
|
|
92
|
+
};
|
|
93
|
+
//# sourceMappingURL=oauth.mjs.map
|
package/oauth.mjs.map
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"oauth.mjs","sourceRoot":"","sources":["src/oauth.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,iFAAiF;AACjF,8EAA8E;AAC9E,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAChF,qEAAqE;AAYrE,gGAAgG;AAChG,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAG/B;IACA;IAHX,YACE,OAAe,EACN,eAAuB,EACvB,SAAoB,GAAG;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAiB;QAGhC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,UAAU,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAgBpE,MAAM,CAAC,MAAM,gBAAgB,GAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAE9D,iEAAiE;AACjE,MAAM,aAAa,GAAG,CAAC,SAAoB,EAAU,EAAE,CACrD,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE;IAChC,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM;QACnC,CAAC,CAAC,QAAQ,SAAS,CAAC,SAAS,EAAE,CAAC;AAElC;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAmB,EAAE,YAAuB,gBAAgB,EAAU,EAAE,CACzG,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;AAErE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,MAAmB,EACnB,YAAuB,gBAAgB,EAC/B,EAAE,CACV,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,wCAAwC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;AAE1G,qDAAqD;AACrD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,MAAmB,EAAE,YAAuB,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAC1G,QAAQ,EAAE,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC;IAC/C,qBAAqB,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;IACpC,gBAAgB,EAAE,CAAC,KAAK,CAAC;IACzB,sBAAsB,EAAE,uBAAuB;CAChD,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CACtB,MAAmB,EACnB,SAAoB,EACpB,KAAc,EACd,WAAoB,EACZ,EAAE;IACV,MAAM,KAAK,GAAG,CAAC,6BAA6B,4BAA4B,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;IAChG,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;IAC1C,IAAI,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,WAAW,GAAG,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,GAAoB,EAAsB,EAAE;IACjE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,GAAoB,EACpB,MAAmB,EACnB,YAAuB,gBAAgB,EACf,EAAE;IAC1B,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,EAAE,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,8FAA8F;IAC9F,0FAA0F;IAC1F,qEAAqE;IACrE,MAAM,OAAO,GAA2B,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC/D,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC;IACxC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC"}
|
package/options.d.mts
CHANGED
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import type { OAuthConfig } from "./oauth.mjs";
|
|
1
2
|
export type CLIOptions = McpOptions & {
|
|
2
3
|
debug: boolean;
|
|
3
4
|
logFormat: 'json' | 'pretty';
|
|
@@ -16,6 +17,13 @@ export type McpOptions = {
|
|
|
16
17
|
codeBlockedMethods?: string[] | undefined;
|
|
17
18
|
codeExecutionMode: McpCodeExecutionMode;
|
|
18
19
|
customInstructionsPath?: string | undefined;
|
|
20
|
+
/**
|
|
21
|
+
* Remote OAuth resource-server config. When set (http transport), every request
|
|
22
|
+
* must carry a bearer and a missing one is answered with a 401 challenge that
|
|
23
|
+
* points at the authorization server; when unset the server keeps the legacy
|
|
24
|
+
* optional-bearer behavior (local stdio + API-key installs).
|
|
25
|
+
*/
|
|
26
|
+
oauth?: OAuthConfig | undefined;
|
|
19
27
|
};
|
|
20
28
|
export type McpCodeExecutionMode = 'stainless-sandbox' | 'local';
|
|
21
29
|
export declare function parseCLIOptions(): CLIOptions;
|
package/options.d.mts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"options.d.mts","sourceRoot":"","sources":["src/options.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"options.d.mts","sourceRoot":"","sources":["src/options.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAgB;AAE3C,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,eAAe,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,cAAc,CAAC,EAAE,eAAe,GAAG,OAAO,GAAG,SAAS,CAAC;IACvD,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC1C,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC1C,iBAAiB,EAAE,oBAAoB,CAAC;IACxC,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GAAG,OAAO,CAAC;AAEjE,wBAAgB,eAAe,IAAI,UAAU,CAmJ5C;AAiCD,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,GAAG,UAAU,CAqBxF"}
|
package/options.d.ts
CHANGED
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import type { OAuthConfig } from "./oauth.js";
|
|
1
2
|
export type CLIOptions = McpOptions & {
|
|
2
3
|
debug: boolean;
|
|
3
4
|
logFormat: 'json' | 'pretty';
|
|
@@ -16,6 +17,13 @@ export type McpOptions = {
|
|
|
16
17
|
codeBlockedMethods?: string[] | undefined;
|
|
17
18
|
codeExecutionMode: McpCodeExecutionMode;
|
|
18
19
|
customInstructionsPath?: string | undefined;
|
|
20
|
+
/**
|
|
21
|
+
* Remote OAuth resource-server config. When set (http transport), every request
|
|
22
|
+
* must carry a bearer and a missing one is answered with a 401 challenge that
|
|
23
|
+
* points at the authorization server; when unset the server keeps the legacy
|
|
24
|
+
* optional-bearer behavior (local stdio + API-key installs).
|
|
25
|
+
*/
|
|
26
|
+
oauth?: OAuthConfig | undefined;
|
|
19
27
|
};
|
|
20
28
|
export type McpCodeExecutionMode = 'stainless-sandbox' | 'local';
|
|
21
29
|
export declare function parseCLIOptions(): CLIOptions;
|
package/options.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["src/options.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["src/options.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAgB;AAE3C,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,eAAe,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,cAAc,CAAC,EAAE,eAAe,GAAG,OAAO,GAAG,SAAS,CAAC;IACvD,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC1C,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC1C,iBAAiB,EAAE,oBAAoB,CAAC;IACxC,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GAAG,OAAO,CAAC;AAEjE,wBAAgB,eAAe,IAAI,UAAU,CAmJ5C;AAiCD,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,GAAG,UAAU,CAqBxF"}
|
package/options.js
CHANGED
|
@@ -88,6 +88,16 @@ function parseCLIOptions() {
|
|
|
88
88
|
choices: ['stdio', 'http'],
|
|
89
89
|
default: 'stdio',
|
|
90
90
|
description: 'What transport to use; stdio for local servers or http for remote servers',
|
|
91
|
+
})
|
|
92
|
+
.option('oauth-issuer', {
|
|
93
|
+
type: 'string',
|
|
94
|
+
default: (0, util_1.readEnv)('MCP_OAUTH_ISSUER'),
|
|
95
|
+
description: 'Authorization server issuer URL. Enables remote OAuth resource-server mode.',
|
|
96
|
+
})
|
|
97
|
+
.option('oauth-resource-base-url', {
|
|
98
|
+
type: 'string',
|
|
99
|
+
default: (0, util_1.readEnv)('MCP_OAUTH_RESOURCE_BASE_URL'),
|
|
100
|
+
description: 'Public base URL of this resource server, used to build metadata and resource URLs.',
|
|
91
101
|
})
|
|
92
102
|
.env('MCP_SERVER')
|
|
93
103
|
.version(true)
|
|
@@ -109,6 +119,9 @@ function parseCLIOptions() {
|
|
|
109
119
|
const logFormat = argv.logFormat ? argv.logFormat
|
|
110
120
|
: process.stderr.isTTY ? 'pretty'
|
|
111
121
|
: 'json';
|
|
122
|
+
// When unset, an http server runs in legacy optional-bearer mode (a static
|
|
123
|
+
// token in the Authorization header). Remote account-based auth needs this set.
|
|
124
|
+
const oauth = buildOAuthConfig(argv);
|
|
112
125
|
return {
|
|
113
126
|
...(includeCodeTool !== undefined && { includeCodeTool }),
|
|
114
127
|
...(includeDocsTools !== undefined && { includeDocsTools }),
|
|
@@ -121,12 +134,25 @@ function parseCLIOptions() {
|
|
|
121
134
|
codeBlockedMethods: argv.codeBlockedMethods,
|
|
122
135
|
codeExecutionMode,
|
|
123
136
|
customInstructionsPath: argv.customInstructionsPath,
|
|
137
|
+
...(oauth && { oauth }),
|
|
124
138
|
transport,
|
|
125
139
|
logFormat,
|
|
126
140
|
port: argv.port,
|
|
127
141
|
socket: argv.socket,
|
|
128
142
|
};
|
|
129
143
|
}
|
|
144
|
+
/**
|
|
145
|
+
* Assembles the OAuth resource-server config from CLI/env, or returns undefined
|
|
146
|
+
* when either field is absent (legacy optional-bearer mode). Both the issuer and
|
|
147
|
+
* this server's public base URL are required together.
|
|
148
|
+
*/
|
|
149
|
+
const buildOAuthConfig = (argv) => {
|
|
150
|
+
const { oauthIssuer, oauthResourceBaseUrl } = argv;
|
|
151
|
+
if (!oauthIssuer || !oauthResourceBaseUrl) {
|
|
152
|
+
return undefined;
|
|
153
|
+
}
|
|
154
|
+
return { issuer: oauthIssuer, resourceBaseUrl: oauthResourceBaseUrl };
|
|
155
|
+
};
|
|
130
156
|
const coerceArray = (zodType) => zod_1.default.preprocess((val) => Array.isArray(val) ? val
|
|
131
157
|
: val ? [val]
|
|
132
158
|
: val, zod_1.default.array(zodType).optional());
|
package/options.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"options.js","sourceRoot":"","sources":["src/options.ts"],"names":[],"mappings":";AAAA,sFAAsF;;;;;
|
|
1
|
+
{"version":3,"file":"options.js","sourceRoot":"","sources":["src/options.ts"],"names":[],"mappings":";AAAA,sFAAsF;;;;;AAuCtF,0CAmJC;AAiCD,8CAqBC;AA9OD,4CAAoB;AACpB,kDAA0B;AAC1B,2CAAwC;AACxC,8CAAoB;AACpB,oCAAiC;AAiCjC,SAAgB,eAAe;IAC7B,MAAM,IAAI,GAAG,IAAA,eAAK,EAAC,IAAA,iBAAO,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SACtC,MAAM,CAAC,sBAAsB,EAAE;QAC9B,IAAI,EAAE,SAAS;QACf,WAAW,EACT,+HAA+H;KAClI,CAAC;SACD,MAAM,CAAC,sBAAsB,EAAE;QAC9B,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,IAAI;QACX,WAAW,EACT,oLAAoL;KACvL,CAAC;SACD,MAAM,CAAC,sBAAsB,EAAE;QAC9B,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,IAAI;QACX,WAAW,EACT,oLAAoL;KACvL,CAAC;SACD,MAAM,CAAC,qBAAqB,EAAE;QAC7B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,mBAAmB,EAAE,OAAO,CAAC;QACvC,OAAO,EAAE,OAAO;QAChB,WAAW,EACT,6JAA6J;KAChK,CAAC;SACD,MAAM,CAAC,0BAA0B,EAAE;QAClC,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,gDAAgD;KAC9D,CAAC;SACD,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;SACzE,MAAM,CAAC,UAAU,EAAE;QAClB,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,mGAAmG;KACtG,CAAC;SACD,MAAM,CAAC,kBAAkB,EAAE;QAC1B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC;QACnC,0EAA0E;QAC1E,mEAAmE;QACnE,uEAAuE;QACvE,mEAAmE;QACnE,wEAAwE;QACxE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,OAAO;QAChB,WAAW,EACT,sNAAsN;KACzN,CAAC;SACD,MAAM,CAAC,YAAY,EAAE;QACpB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC3B,WAAW,EAAE,gEAAgE;KAC9E,CAAC;SACD,MAAM,CAAC,UAAU,EAAE;QAClB,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;QACzB,WAAW,EAAE,6BAA6B;KAC3C,CAAC;SACD,MAAM,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,0CAA0C;KACxD,CAAC;SACD,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;SACpG,MAAM,CAAC,mBAAmB,EAAE;QAC3B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAA,cAAO,EAAC,mBAAmB,CAAC;QACrC,WAAW,EACT,2FAA2F;KAC9F,CAAC;SACD,MAAM,CAAC,OAAO,EAAE;QACf,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;QACzB,WAAW,EAAE,4BAA4B;KAC1C,CAAC;SACD,MAAM,CAAC,WAAW,EAAE;QACnB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC1B,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,2EAA2E;KACzF,CAAC;SACD,MAAM,CAAC,cAAc,EAAE;QACtB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAA,cAAO,EAAC,kBAAkB,CAAC;QACpC,WAAW,EAAE,6EAA6E;KAC3F,CAAC;SACD,MAAM,CAAC,yBAAyB,EAAE;QACjC,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAA,cAAO,EAAC,6BAA6B,CAAC;QAC/C,WAAW,EAAE,oFAAoF;KAClG,CAAC;SACD,GAAG,CAAC,YAAY,CAAC;SACjB,OAAO,CAAC,IAAI,CAAC;SACb,IAAI,EAAE,CAAC;IAEV,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAE9B,MAAM,qBAAqB,GAAG,CAAC,QAAyB,EAAE,EAAE,CAC1D,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK;QACxC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YACvC,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,eAAe,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAEvD,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAyC,CAAC;IACzE,iFAAiF;IACjF,gFAAgF;IAChF,kFAAkF;IAClF,IAAI,iBAAiB,KAAK,mBAAmB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,4LAA4L,CAC7L,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAA6B,CAAC;IACrD,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,CAAC,CAAC,CAAE,IAAI,CAAC,SAA+B;QACtD,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;YACjC,CAAC,CAAC,MAAM,CAAC;IAEX,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAErC,OAAO;QACL,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,CAAC;QACzD,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAC3D,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,cAAc,EAAE,IAAI,CAAC,cAAuD;QAC5E,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,iBAAiB;QACjB,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;QACnD,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;QACvB,SAAS;QACT,SAAS;QACT,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC,IAGzB,EAA2B,EAAE;IAC5B,MAAM,EAAE,WAAW,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC;IACnD,IAAI,CAAC,WAAW,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,oBAAoB,EAAE,CAAC;AACxE,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAyB,OAAU,EAAE,EAAE,CACzD,aAAC,CAAC,UAAU,CACV,CAAC,GAAG,EAAE,EAAE,CACN,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG;IACxB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACb,CAAC,CAAC,GAAG,EACP,aAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAC5B,CAAC;AAEJ,MAAM,YAAY,GAAG,aAAC,CAAC,MAAM,CAAC;IAC5B,KAAK,EAAE,WAAW,CAAC,aAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IACvF,QAAQ,EAAE,WAAW,CAAC,aAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qCAAqC,CAAC;IAC/F,IAAI,EAAE,WAAW,CAAC,aAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,4CAA4C,CAAC;CACrF,CAAC,CAAC;AAEH,SAAgB,iBAAiB,CAAC,cAA0B,EAAE,KAAc;IAC1E,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACxE,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAErD,IAAI,QAAQ,GACV,YAAY,CAAC,QAAQ,IAAI,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK;QACxE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;YAC7C,CAAC,CAAC,cAAc,CAAC,eAAe,CAAC;IAEnC,IAAI,SAAS,GACX,YAAY,CAAC,QAAQ,IAAI,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK;QACxE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;YAC7C,CAAC,CAAC,cAAc,CAAC,gBAAgB,CAAC;IAEpC,OAAO;QACL,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;QAC5D,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;QAC/D,iBAAiB,EAAE,cAAc,CAAC,iBAAiB;QACnD,cAAc,EAAE,cAAc,CAAC,cAAc;QAC7C,OAAO,EAAE,cAAc,CAAC,OAAO;KAChC,CAAC;AACJ,CAAC"}
|
package/options.mjs
CHANGED
|
@@ -81,6 +81,16 @@ export function parseCLIOptions() {
|
|
|
81
81
|
choices: ['stdio', 'http'],
|
|
82
82
|
default: 'stdio',
|
|
83
83
|
description: 'What transport to use; stdio for local servers or http for remote servers',
|
|
84
|
+
})
|
|
85
|
+
.option('oauth-issuer', {
|
|
86
|
+
type: 'string',
|
|
87
|
+
default: readEnv('MCP_OAUTH_ISSUER'),
|
|
88
|
+
description: 'Authorization server issuer URL. Enables remote OAuth resource-server mode.',
|
|
89
|
+
})
|
|
90
|
+
.option('oauth-resource-base-url', {
|
|
91
|
+
type: 'string',
|
|
92
|
+
default: readEnv('MCP_OAUTH_RESOURCE_BASE_URL'),
|
|
93
|
+
description: 'Public base URL of this resource server, used to build metadata and resource URLs.',
|
|
84
94
|
})
|
|
85
95
|
.env('MCP_SERVER')
|
|
86
96
|
.version(true)
|
|
@@ -102,6 +112,9 @@ export function parseCLIOptions() {
|
|
|
102
112
|
const logFormat = argv.logFormat ? argv.logFormat
|
|
103
113
|
: process.stderr.isTTY ? 'pretty'
|
|
104
114
|
: 'json';
|
|
115
|
+
// When unset, an http server runs in legacy optional-bearer mode (a static
|
|
116
|
+
// token in the Authorization header). Remote account-based auth needs this set.
|
|
117
|
+
const oauth = buildOAuthConfig(argv);
|
|
105
118
|
return {
|
|
106
119
|
...(includeCodeTool !== undefined && { includeCodeTool }),
|
|
107
120
|
...(includeDocsTools !== undefined && { includeDocsTools }),
|
|
@@ -114,12 +127,25 @@ export function parseCLIOptions() {
|
|
|
114
127
|
codeBlockedMethods: argv.codeBlockedMethods,
|
|
115
128
|
codeExecutionMode,
|
|
116
129
|
customInstructionsPath: argv.customInstructionsPath,
|
|
130
|
+
...(oauth && { oauth }),
|
|
117
131
|
transport,
|
|
118
132
|
logFormat,
|
|
119
133
|
port: argv.port,
|
|
120
134
|
socket: argv.socket,
|
|
121
135
|
};
|
|
122
136
|
}
|
|
137
|
+
/**
|
|
138
|
+
* Assembles the OAuth resource-server config from CLI/env, or returns undefined
|
|
139
|
+
* when either field is absent (legacy optional-bearer mode). Both the issuer and
|
|
140
|
+
* this server's public base URL are required together.
|
|
141
|
+
*/
|
|
142
|
+
const buildOAuthConfig = (argv) => {
|
|
143
|
+
const { oauthIssuer, oauthResourceBaseUrl } = argv;
|
|
144
|
+
if (!oauthIssuer || !oauthResourceBaseUrl) {
|
|
145
|
+
return undefined;
|
|
146
|
+
}
|
|
147
|
+
return { issuer: oauthIssuer, resourceBaseUrl: oauthResourceBaseUrl };
|
|
148
|
+
};
|
|
123
149
|
const coerceArray = (zodType) => z.preprocess((val) => Array.isArray(val) ? val
|
|
124
150
|
: val ? [val]
|
|
125
151
|
: val, z.array(zodType).optional());
|
package/options.mjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"options.mjs","sourceRoot":"","sources":["src/options.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,mBAAe;
|
|
1
|
+
{"version":3,"file":"options.mjs","sourceRoot":"","sources":["src/options.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,mBAAe;AAiCjC,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SACtC,MAAM,CAAC,sBAAsB,EAAE;QAC9B,IAAI,EAAE,SAAS;QACf,WAAW,EACT,+HAA+H;KAClI,CAAC;SACD,MAAM,CAAC,sBAAsB,EAAE;QAC9B,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,IAAI;QACX,WAAW,EACT,oLAAoL;KACvL,CAAC;SACD,MAAM,CAAC,sBAAsB,EAAE;QAC9B,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,IAAI;QACX,WAAW,EACT,oLAAoL;KACvL,CAAC;SACD,MAAM,CAAC,qBAAqB,EAAE;QAC7B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,mBAAmB,EAAE,OAAO,CAAC;QACvC,OAAO,EAAE,OAAO;QAChB,WAAW,EACT,6JAA6J;KAChK,CAAC;SACD,MAAM,CAAC,0BAA0B,EAAE;QAClC,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,gDAAgD;KAC9D,CAAC;SACD,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;SACzE,MAAM,CAAC,UAAU,EAAE;QAClB,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,mGAAmG;KACtG,CAAC;SACD,MAAM,CAAC,kBAAkB,EAAE;QAC1B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC;QACnC,0EAA0E;QAC1E,mEAAmE;QACnE,uEAAuE;QACvE,mEAAmE;QACnE,wEAAwE;QACxE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,OAAO;QAChB,WAAW,EACT,sNAAsN;KACzN,CAAC;SACD,MAAM,CAAC,YAAY,EAAE;QACpB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC3B,WAAW,EAAE,gEAAgE;KAC9E,CAAC;SACD,MAAM,CAAC,UAAU,EAAE;QAClB,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;QACzB,WAAW,EAAE,6BAA6B;KAC3C,CAAC;SACD,MAAM,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,0CAA0C;KACxD,CAAC;SACD,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;SACpG,MAAM,CAAC,mBAAmB,EAAE;QAC3B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO,CAAC,mBAAmB,CAAC;QACrC,WAAW,EACT,2FAA2F;KAC9F,CAAC;SACD,MAAM,CAAC,OAAO,EAAE;QACf,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;QACzB,WAAW,EAAE,4BAA4B;KAC1C,CAAC;SACD,MAAM,CAAC,WAAW,EAAE;QACnB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC1B,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,2EAA2E;KACzF,CAAC;SACD,MAAM,CAAC,cAAc,EAAE;QACtB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO,CAAC,kBAAkB,CAAC;QACpC,WAAW,EAAE,6EAA6E;KAC3F,CAAC;SACD,MAAM,CAAC,yBAAyB,EAAE;QACjC,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO,CAAC,6BAA6B,CAAC;QAC/C,WAAW,EAAE,oFAAoF;KAClG,CAAC;SACD,GAAG,CAAC,YAAY,CAAC;SACjB,OAAO,CAAC,IAAI,CAAC;SACb,IAAI,EAAE,CAAC;IAEV,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAE9B,MAAM,qBAAqB,GAAG,CAAC,QAAyB,EAAE,EAAE,CAC1D,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK;QACxC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YACvC,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,eAAe,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAEvD,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAyC,CAAC;IACzE,iFAAiF;IACjF,gFAAgF;IAChF,kFAAkF;IAClF,IAAI,iBAAiB,KAAK,mBAAmB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,4LAA4L,CAC7L,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAA6B,CAAC;IACrD,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,CAAC,CAAC,CAAE,IAAI,CAAC,SAA+B;QACtD,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;YACjC,CAAC,CAAC,MAAM,CAAC;IAEX,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAErC,OAAO;QACL,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,CAAC;QACzD,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAC3D,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,cAAc,EAAE,IAAI,CAAC,cAAuD;QAC5E,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,iBAAiB;QACjB,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;QACnD,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;QACvB,SAAS;QACT,SAAS;QACT,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC,IAGzB,EAA2B,EAAE;IAC5B,MAAM,EAAE,WAAW,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC;IACnD,IAAI,CAAC,WAAW,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,oBAAoB,EAAE,CAAC;AACxE,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAyB,OAAU,EAAE,EAAE,CACzD,CAAC,CAAC,UAAU,CACV,CAAC,GAAG,EAAE,EAAE,CACN,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG;IACxB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACb,CAAC,CAAC,GAAG,EACP,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAC5B,CAAC;AAEJ,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IACvF,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qCAAqC,CAAC;IAC/F,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,4CAA4C,CAAC;CACrF,CAAC,CAAC;AAEH,MAAM,UAAU,iBAAiB,CAAC,cAA0B,EAAE,KAAc;IAC1E,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACxE,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAErD,IAAI,QAAQ,GACV,YAAY,CAAC,QAAQ,IAAI,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK;QACxE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;YAC7C,CAAC,CAAC,cAAc,CAAC,eAAe,CAAC;IAEnC,IAAI,SAAS,GACX,YAAY,CAAC,QAAQ,IAAI,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK;QACxE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;YAC7C,CAAC,CAAC,cAAc,CAAC,gBAAgB,CAAC;IAEpC,OAAO;QACL,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;QAC5D,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;QAC/D,iBAAiB,EAAE,cAAc,CAAC,iBAAiB;QACnD,cAAc,EAAE,cAAc,CAAC,cAAc;QAC7C,OAAO,EAAE,cAAc,CAAC,OAAO;KAChC,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@roarkanalytics/sdk-mcp",
|
|
3
|
-
"version": "4.
|
|
3
|
+
"version": "4.11.1",
|
|
4
4
|
"description": "The official MCP Server for the Roark API",
|
|
5
5
|
"author": "Roark <james@roark.ai>",
|
|
6
6
|
"types": "./index.d.ts",
|
|
@@ -27,7 +27,7 @@
|
|
|
27
27
|
"tsn": "ts-node -r tsconfig-paths/register"
|
|
28
28
|
},
|
|
29
29
|
"dependencies": {
|
|
30
|
-
"@roarkanalytics/sdk": "^4.
|
|
30
|
+
"@roarkanalytics/sdk": "^4.15.0",
|
|
31
31
|
"ajv": "^8.18.0",
|
|
32
32
|
"@cloudflare/cabidela": "^0.2.4",
|
|
33
33
|
"@hono/node-server": "^1.19.10",
|
|
@@ -182,6 +182,16 @@
|
|
|
182
182
|
"./methods.mjs": {
|
|
183
183
|
"default": "./methods.mjs"
|
|
184
184
|
},
|
|
185
|
+
"./oauth": {
|
|
186
|
+
"import": "./oauth.mjs",
|
|
187
|
+
"require": "./oauth.js"
|
|
188
|
+
},
|
|
189
|
+
"./oauth.js": {
|
|
190
|
+
"default": "./oauth.js"
|
|
191
|
+
},
|
|
192
|
+
"./oauth.mjs": {
|
|
193
|
+
"default": "./oauth.mjs"
|
|
194
|
+
},
|
|
185
195
|
"./options": {
|
|
186
196
|
"import": "./options.mjs",
|
|
187
197
|
"require": "./options.js"
|
package/server.d.mts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.d.mts","sourceRoot":"","sources":["src/server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMpE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKpD,OAAO,EAAE,eAAe,EAAE,gCAA4B;AAEtD,OAAO,EAAE,UAAU,EAAE,sBAAkB;AAEvC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAgB;AAEtF,eAAO,MAAM,YAAY,GAAU,8CAGhC;IACD,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C,uBAUE,CAAC;AAwBJ,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,GAAG,SAAS,KAAG,OAAO,CAAC,eAAe,CAWxF,CAAC;AAEF;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE;IAC1C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACxD,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,aAAa,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CAC/D,
|
|
1
|
+
{"version":3,"file":"server.d.mts","sourceRoot":"","sources":["src/server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMpE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKpD,OAAO,EAAE,eAAe,EAAE,gCAA4B;AAEtD,OAAO,EAAE,UAAU,EAAE,sBAAkB;AAEvC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAgB;AAEtF,eAAO,MAAM,YAAY,GAAU,8CAGhC;IACD,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C,uBAUE,CAAC;AAwBJ,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,GAAG,SAAS,KAAG,OAAO,CAAC,eAAe,CAWxF,CAAC;AAEF;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE;IAC1C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACxD,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,aAAa,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CAC/D,iBAyHA;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,EAAE,CAe3D;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,EACnC,OAAO,EACP,UAAU,EACV,IAAI,GACL,EAAE;IACD,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAC3C,GAAG,OAAO,CAAC,cAAc,CAAC,CAE1B"}
|
package/server.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["src/server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMpE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKpD,OAAO,EAAE,eAAe,EAAE,+BAA4B;AAEtD,OAAO,EAAE,UAAU,EAAE,qBAAkB;AAEvC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,OAAO,EAAE,mBAAgB;AAEtF,eAAO,MAAM,YAAY,GAAU,8CAGhC;IACD,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C,uBAUE,CAAC;AAwBJ,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,GAAG,SAAS,KAAG,OAAO,CAAC,eAAe,CAWxF,CAAC;AAEF;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE;IAC1C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACxD,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,aAAa,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CAC/D,
|
|
1
|
+
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["src/server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMpE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKpD,OAAO,EAAE,eAAe,EAAE,+BAA4B;AAEtD,OAAO,EAAE,UAAU,EAAE,qBAAkB;AAEvC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,OAAO,EAAE,mBAAgB;AAEtF,eAAO,MAAM,YAAY,GAAU,8CAGhC;IACD,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C,uBAUE,CAAC;AAwBJ,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,GAAG,SAAS,KAAG,OAAO,CAAC,eAAe,CAWxF,CAAC;AAEF;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE;IAC1C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACxD,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,aAAa,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CAC/D,iBAyHA;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,EAAE,CAe3D;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,EACnC,OAAO,EACP,UAAU,EACV,IAAI,GACL,EAAE;IACD,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAC3C,GAAG,OAAO,CAAC,cAAc,CAAC,CAE1B"}
|