@silkweave/mcp 2.6.0 → 3.0.0

package/build/index.mjs

@@ -1,241 +1,26 @@
-import { intro } from "@clack/prompts";
-import { Client } from "@modelcontextprotocol/sdk/client";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { LoggingMessageNotificationSchema, ProgressNotificationSchema, isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
-import { createCLILogger, createLogger } from "@silkweave/logger";
-import { capitalCase, kebabCase, pascalCase } from "change-case";
-import { Command } from "commander";
-import { randomUUID } from "crypto";
-import { SilkweaveError, createContext, isStreamingAction, runStreamingAction } from "@silkweave/core";
-import { randomUUID as randomUUID$1 } from "node:crypto";
+import { i as authStorage, n as requestFromExtra, r as authMiddleware, t as registerTools } from "./registerTools-DlguElKV.mjs";
+import { a as smartToolResult, i as parseResourceMessage, n as handleToolError, r as jsonToolResult, t as errorToolResult } from "./result-B_9Eo1ey.mjs";
 import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
+import { createContext } from "@silkweave/core";
 import express from "express";
-import { generateProtectedResourceMetadata, validateToken } from "@silkweave/auth";
-import { AsyncLocalStorage } from "node:async_hooks";
+import { generateProtectedResourceMetadata } from "@silkweave/auth";
 import cors from "cors";
 import { readFile, writeFile } from "fs/promises";
-import { InMemoryEventStore } from "@modelcontextprotocol/sdk/examples/shared/inMemoryEventStore.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-//#region src/util/result.ts
-function smartToolResult(data) {
-	const text = typeof data === "string" ? data : JSON.stringify(data);
-	const mimeType = typeof data === "string" ? "text/plain" : "application/json";
-	const ext = typeof data === "string" ? "txt" : "json";
-	if (text.length > 4096) {
-		const uri = `mcp://toolResult/${randomUUID$1()}.${ext}`;
-		const buffer = Buffer.from(text);
-		const blob = buffer.toString("base64");
-		return { content: [{
-			type: "text",
-			text: `Received resource ${uri} with ${buffer.byteLength} bytes`
-		}, {
-			type: "resource",
-			resource: {
-				uri,
-				mimeType,
-				blob
-			}
-		}] };
-	} else return { content: [{
-		type: "text",
-		text
-	}] };
-}
-function jsonToolResult(data, isError = false) {
-	const result = { content: [{
-		type: "text",
-		text: JSON.stringify(data)
-	}] };
-	if (isError) result.isError = true;
-	return result;
-}
-function errorToolResult({ code, name, message }) {
-	return {
-		isError: true,
-		content: [{
-			type: "text",
-			text: JSON.stringify({
-				success: false,
-				code,
-				name,
-				message
-			})
-		}]
-	};
-}
-function handleToolError(error) {
-	if (error instanceof SilkweaveError) return jsonToolResult({
-		success: false,
-		name: error.name,
-		message: error.message,
-		code: error.code
-	}, true);
-	else if (error instanceof Error) {
-		console.error(error);
-		return jsonToolResult({
-			success: false,
-			name: error.name,
-			message: error.message
-		}, true);
-	} else {
-		console.error("Unknown tool error:", error);
-		return jsonToolResult({
-			success: false,
-			name: "Unknown error",
-			message: "An unknown error occurred"
-		}, true);
-	}
-}
-function parseResourceMessage({ resource }) {
-	return "blob" in resource ? Buffer.from(resource.blob, "base64").toString("utf-8") : resource.text;
-}
-//#endregion
-//#region src/adapter/cliProxy.ts
-function coerce(value, type) {
-	if (value === void 0) return;
-	if (type === "number" || type === "integer") {
-		const n = Number(value);
-		return Number.isNaN(n) ? value : n;
-	}
-	return value;
-}
-function addCliOption(command, key, prop) {
-	const flag = kebabCase(key);
-	const description = prop.description;
-	const defaultValue = prop.default;
-	const type = prop.type;
-	if (type === "boolean") {
-		command.option(`--${flag}`, description, defaultValue);
-		command.option(`--no-${flag}`);
-		return;
-	}
-	if (type === "number" || type === "integer") {
-		command.option(`--${flag} <number>`, description, defaultValue);
-		return;
-	}
-	if (type === "string" || prop.enum) {
-		command.option(`--${flag} <string>`, description, defaultValue);
-		return;
-	}
-	if (type === "object" || type === "array") {
-		command.option(`--${flag} <json>`, description ?? "", JSON.parse, defaultValue);
-		return;
-	}
-	throw new Error(`Unsupported JSON Schema type for CLI option "${key}": ${type ?? "undefined"}`);
-}
-const defaultFormatter = (message) => {
-	if (message.type === "text" && !message.text.includes("mcp://toolResult/")) return `${message.text}`;
-	else if (message.type === "resource") return parseResourceMessage(message);
-	else return JSON.stringify(message);
-};
-const cliProxy = ({ url, formatter = defaultFormatter }) => {
-	return (options, baseContext) => {
-		const context = baseContext.fork({ adapter: "cliProxy" });
-		const program = new Command().name(options.name).description(options.description).version(options.version).option("-s, --silent", "Silent mode, prevent log messages", false);
-		return {
-			context,
-			start: async () => {
-				const client = new Client({
-					name: options.name,
-					description: options.description,
-					version: options.version
-				});
-				const transport = new StreamableHTTPClientTransport(url);
-				await client.connect(transport);
-				const { tools } = await client.listTools();
-				for (const tool of tools) {
-					const name = kebabCase(tool.name);
-					const command = program.command(name);
-					if (tool.description) command.description(tool.description);
-					const properties = tool.inputSchema.properties ?? {};
-					for (const key of Object.keys(properties)) addCliOption(command, key, properties[key]);
-					command.action(async (args) => {
-						const { silent } = program.opts();
-						const logger = createCLILogger();
-						if (!silent) {
-							intro(`${options.name} - ${tool.name}`);
-							client.setNotificationHandler(LoggingMessageNotificationSchema, ({ params: { level, data } }) => {
-								logger[level](data);
-							});
-							client.setNotificationHandler(ProgressNotificationSchema, ({ params: { progress, total, message } }) => {
-								logger.info({
-									progress,
-									total,
-									message
-								});
-							});
-						}
-						const input = {};
-						for (const key of Object.keys(properties)) {
-							const value = args[key];
-							if (value !== void 0) input[key] = coerce(value, properties[key]?.type);
-						}
-						(await client.callTool({
-							name: tool.name,
-							arguments: input,
-							_meta: {
-								progressToken: randomUUID(),
-								disposition: "json"
-							}
-						})).content.forEach((message, index, messages) => {
-							const text = formatter(message, index, messages);
-							process.stdout.write(`${text}\n`);
-						});
-					});
-				}
-				await program.parseAsync();
-				await transport.close();
-			},
-			stop: async () => {}
-		};
-	};
-};
-//#endregion
-//#region src/handlers/auth.ts
-/**
-* Per-request bearer-token storage used by tool handlers to read the resolved
-* `AuthInfo` for the currently-handled MCP call.
-*/
-const authStorage = new AsyncLocalStorage();
-/**
-* Express middleware that validates the `Authorization: Bearer …` header via
-* the supplied `AuthConfig`. On success the resolved `AuthInfo` is placed in
-* `authStorage` for the duration of the downstream handler - `mcpTransport`'s
-* tool callbacks pick it up to populate the silkweave context's `auth` key.
-*
-* The middleware should NOT be applied to OAuth-discovery / token routes -
-* compose it only on the routes that require an authenticated caller (the MCP
-* transport itself, sideload, etc.).
-*/
-function authMiddleware(auth, context) {
-	return async (req, res, next) => {
-		const result = await validateToken(req.headers.authorization, auth, context.fork({ request: req }));
-		if (result.error) {
-			for (const [key, value] of Object.entries(result.error.headers)) res.header(key, value);
-			res.status(result.error.statusCode).json(result.error.body);
-			return;
-		}
-		if (result.auth) authStorage.run(result.auth, () => {
-			next();
-		});
-		else next();
-	};
-}
-//#endregion
+import { randomUUID } from "crypto";
 //#region src/handlers/cors.ts
 /** Headers required by the MCP protocol that must always be exposed when CORS is in use. */
 const MCP_REQUIRED_HEADERS = [
 	"WWW-Authenticate",
-	"Mcp-Session-Id",
 	"Last-Event-Id",
 	"Mcp-Protocol-Version"
 ];
 /**
 * CORS middleware preconfigured to expose the headers MCP clients need
-* (`Mcp-Session-Id`, `Last-Event-Id`, `Mcp-Protocol-Version`, `WWW-Authenticate`)
-* on top of any user-supplied options.
+* (`Last-Event-Id`, `Mcp-Protocol-Version`, `WWW-Authenticate`) on top of any
+* user-supplied options. (Stateless transport - no `Mcp-Session-Id`.)
 *
 * Pass `false` to disable, omit / pass `true` for permissive defaults, or pass
 * a `CorsOptions` object to override.
@@ -260,7 +45,7 @@ function mcpCors(corsConfig = true) {
 */
 function protectedResourceMetadata(auth) {
 	if (!auth.resourceUrl || !auth.authorizationServers?.length) throw new Error("@silkweave/mcp protectedResourceMetadata(): auth.resourceUrl and auth.authorizationServers are required");
-	const metadata = generateProtectedResourceMetadata(auth.resourceUrl, auth.authorizationServers);
+	const metadata = generateProtectedResourceMetadata(auth.resourceUrl, auth.authorizationServers, auth.requiredScopes);
 	return (_req, res) => {
 		res.json(metadata);
 	};
@@ -334,85 +119,6 @@ function sideloadResource(options = {}) {
 }
 //#endregion
 //#region src/handlers/transport.ts
-/**
-* Build the generic `request` context value (the same key REST/tRPC populate)
-* from the MCP SDK's `extra.requestInfo`, so transport-agnostic consumers - e.g.
-* `@silkweave/nestjs` `@UseGuards` guards reading
-* `switchToHttp().getRequest().headers` - work over MCP. There is no path
-* `params`/`query` on an MCP call, so those are empty stand-ins for graceful
-* degradation. Returns `undefined` when no HTTP request info is available.
-*/
-function requestFromExtra(requestInfo) {
-	if (!requestInfo) return;
-	return {
-		headers: requestInfo.headers ?? {},
-		url: requestInfo.url?.toString(),
-		params: {},
-		query: {}
-	};
-}
-function registerTools$1(server, actions, context) {
-	for (const action of actions) server.registerTool(pascalCase(action.name), {
-		title: capitalCase(action.name),
-		description: action.description,
-		inputSchema: action.input
-	}, async (input, extra) => {
-		const logger = createLogger({
-			stream: process.stderr,
-			onLog: (level, data) => {
-				extra.sendNotification({
-					method: "notifications/message",
-					params: {
-						level,
-						data
-					}
-				});
-			},
-			onProgress: ({ progress, total, message }) => {
-				if (!extra._meta?.progressToken) return;
-				extra.sendNotification({
-					method: "notifications/progress",
-					params: {
-						progress,
-						total,
-						message,
-						progressToken: extra._meta.progressToken
-					}
-				});
-			}
-		});
-		const currentAuth = authStorage.getStore();
-		const actionContext = context.fork({
-			logger,
-			extra,
-			request: requestFromExtra(extra.requestInfo),
-			...currentAuth ? { auth: currentAuth } : {}
-		});
-		const disposition = extra._meta?.disposition ?? action.disposition;
-		const progressToken = extra._meta?.progressToken;
-		try {
-			let result;
-			if (isStreamingAction(action)) result = await runStreamingAction(action, input, actionContext, progressToken ? async (chunk, index) => {
-				await extra.sendNotification({
-					method: "notifications/progress",
-					params: {
-						progressToken,
-						progress: index + 1,
-						message: JSON.stringify(chunk)
-					}
-				});
-			} : void 0);
-			else result = await action.run(input, actionContext);
-			if (action.toolResult) {
-				const response = action.toolResult(result, actionContext);
-				if (response) return response;
-			}
-			return disposition === "json" ? jsonToolResult(result) : smartToolResult(result);
-		} catch (error) {
-			return handleToolError(error);
-		}
-	});
-}
 function createMcpServer(options, actions, context) {
 	const server = new McpServer({
 		name: options.name,
@@ -422,56 +128,28 @@ function createMcpServer(options, actions, context) {
 		tools: {},
 		logging: {}
 	} });
-	registerTools$1(server, actions, context);
+	registerTools(server, actions, context);
 	return server;
 }
-function createSessionTransport(transports) {
-	const transport = new StreamableHTTPServerTransport({
-		sessionIdGenerator: () => randomUUID(),
-		enableJsonResponse: false,
-		eventStore: new InMemoryEventStore(),
-		onsessioninitialized: (sId) => {
-			transports[sId] = transport;
-		}
-	});
-	transport.onerror = (error) => {
-		console.error(error);
-	};
-	transport.onclose = () => {
-		const sid = transport.sessionId;
-		if (sid && transports[sid]) delete transports[sid];
-	};
-	return transport;
-}
 /**
-* Build the MCP Streamable HTTP transport route handlers.
+* Build the MCP Streamable HTTP transport route handler.
 *
-* Sessions are kept in a per-call closure (one map per `mcpTransport()` call),
-* so the same handler object should be registered for all three transport
-* routes - `POST /mcp`, `GET /mcp`, `DELETE /mcp` - to share session state.
+* Stateless (per the 2026 spec direction): each `POST /mcp` mints a fresh
+* transport + server with `sessionIdGenerator: undefined`, handles exactly that
+* request (streaming progress over SSE when the call carries a `progressToken`),
+* and tears down on response close. No `Mcp-Session-Id`, no session map, no
+* `GET`/`DELETE` reconnect - any request can hit any instance.
 */
 function mcpTransport(silkweaveOptions, context, actions) {
-	const transports = {};
 	const post = async (req, res) => {
-		const sessionId = req.headers["mcp-session-id"];
 		try {
-			if (sessionId && transports[sessionId]) {
-				await transports[sessionId].handleRequest(req, res, req.body);
-				return;
-			}
-			if (!isInitializeRequest(req.body)) {
-				res.status(404).json({
-					jsonrpc: "2.0",
-					error: {
-						code: -32e3,
-						message: "Session not found"
-					},
-					id: null
-				});
-				return;
-			}
-			const transport = createSessionTransport(transports);
-			await createMcpServer(silkweaveOptions, actions, context).connect(transport);
+			const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
+			const server = createMcpServer(silkweaveOptions, actions, context);
+			res.on("close", () => {
+				transport.close();
+				server.close();
+			});
+			await server.connect(transport);
 			await transport.handleRequest(req, res, req.body);
 		} catch (error) {
 			console.error("Error handling MCP request:", error);
@@ -485,18 +163,7 @@ function mcpTransport(silkweaveOptions, context, actions) {
 			});
 		}
 	};
-	const stream = async (req, res) => {
-		const sessionId = req.headers["mcp-session-id"];
-		if (!sessionId || !transports[sessionId]) {
-			res.status(400).send("Invalid or missing session ID");
-			return;
-		}
-		await transports[sessionId].handleRequest(req, res);
-	};
-	return {
-		post,
-		stream
-	};
+	return { post };
 }
 //#endregion
 //#region src/adapter/http.ts
@@ -542,9 +209,6 @@ function buildMcpExpressApp(silkweaveOptions, context, actions, options) {
 	if (sideloadResources) app.get("/resource/:id", sideloadResource({ resourceDir }));
 	const transport = mcpTransport(silkweaveOptions, context, actions);
 	app.post("/mcp", express.json(), transport.post);
-	app.get("/mcp", transport.stream);
-	app.delete("/mcp", transport.stream);
-	app.get("/mcp/resource/:id", transport.stream);
 	return app;
 }
 /**
@@ -601,60 +265,6 @@ const http = (options) => {
 };
 //#endregion
 //#region src/adapter/stdio.ts
-function registerTools(server, actions, context) {
-	for (const action of actions) server.registerTool(pascalCase(action.name), {
-		title: capitalCase(action.name),
-		description: action.description,
-		inputSchema: action.input
-	}, async (input, extra) => {
-		const logger = createLogger({
-			stream: false,
-			onLog: (level, data) => {
-				extra.sendNotification({
-					method: "notifications/message",
-					params: {
-						level,
-						data
-					}
-				});
-			},
-			onProgress: ({ progress, total, message }) => {
-				if (!extra._meta?.progressToken) return;
-				extra.sendNotification({
-					method: "notifications/progress",
-					params: {
-						progress,
-						total,
-						message,
-						progressToken: extra._meta.progressToken
-					}
-				});
-			}
-		});
-		const actionContext = context.fork({
-			logger,
-			extra
-		});
-		const progressToken = extra._meta?.progressToken;
-		try {
-			let result;
-			if (isStreamingAction(action)) result = await runStreamingAction(action, input, actionContext, progressToken ? async (chunk, index) => {
-				await extra.sendNotification({
-					method: "notifications/progress",
-					params: {
-						progressToken,
-						progress: index + 1,
-						message: JSON.stringify(chunk)
-					}
-				});
-			} : void 0);
-			else result = await action.run(input, actionContext);
-			return action.toolResult?.(result, actionContext) ?? smartToolResult(result);
-		} catch (error) {
-			return handleToolError(error);
-		}
-	});
-}
 const stdio = () => {
 	return (options, baseContext) => {
 		const context = baseContext.fork({ adapter: "stdio" });
@@ -669,7 +279,7 @@ const stdio = () => {
 		return {
 			context,
 			start: async (actions) => {
-				registerTools(server, actions, context);
+				registerTools(server, actions, context, { logStream: false });
 				const transport = new StdioServerTransport();
 				await server.connect(transport);
 			},
@@ -693,6 +303,6 @@ async function createSideloadResource(buffer, { name, contentType }) {
 	return resource;
 }
 //#endregion
-export { MCP_REQUIRED_HEADERS, authMiddleware, authStorage, buildMcpExpressApp, cliProxy, createSideloadResource, errorToolResult, handleToolError, http, jsonToolResult, mcpCors, mcpTransport, oauthRoutes, parseResourceMessage, protectedResourceMetadata, sideloadResource, smartToolResult, startMcpServer, stdio };
+export { MCP_REQUIRED_HEADERS, authMiddleware, authStorage, buildMcpExpressApp, createSideloadResource, errorToolResult, handleToolError, http, jsonToolResult, mcpCors, mcpTransport, oauthRoutes, parseResourceMessage, protectedResourceMetadata, registerTools, requestFromExtra, sideloadResource, smartToolResult, startMcpServer, stdio };
 
 //# sourceMappingURL=index.mjs.map