@sky.ui/mcp 0.0.1

package/dist/post-endpoint-server.js

@@ -0,0 +1,777 @@
+#!/usr/bin/env node
+import { randomUUID, timingSafeEqual } from 'node:crypto';
+import { appendFileSync, existsSync, readFileSync } from 'node:fs';
+import Fastify from 'fastify';
+import cors from '@fastify/cors';
+import rateLimit from '@fastify/rate-limit';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { InMemoryEventStore } from '@modelcontextprotocol/sdk/examples/shared/inMemoryEventStore.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { assertCoreDependencyAvailable, createSkyUiMcpServer } from './server.js';
+import { READ_ONLY_TOOLS } from './read-only-tool-allowlist.js';
+const PORT = Number(process.env.SKY_UI_MCP_POST_PORT || '3001');
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = resolve(__dirname, '..', '..', '..');
+const REQUEST_TIMEOUT_MS = Number(process.env.SKY_UI_MCP_ENDPOINT_TIMEOUT_MS || '20000');
+const API_KEY = process.env.SKY_UI_MCP_API_KEY || '';
+const KEYS_JSON_INLINE = process.env.SKY_UI_MCP_KEYS_JSON || '';
+const KEYS_FILE = process.env.SKY_UI_MCP_KEYS_FILE || '';
+const RATE_LIMIT_MAX = Number(process.env.SKY_UI_MCP_RATE_LIMIT_MAX || '120');
+const RATE_LIMIT_WINDOW = process.env.SKY_UI_MCP_RATE_LIMIT_WINDOW || '1 minute';
+const LOG_REQUESTS = (process.env.SKY_UI_MCP_LOG_REQUESTS || 'true').toLowerCase() !== 'false';
+const CORS_ORIGINS = (process.env.SKY_UI_MCP_CORS_ORIGINS || '')
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+const ALLOW_IPS = (process.env.SKY_UI_MCP_ALLOW_IPS || '')
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+const AUDIT_LOG_PATH = process.env.SKY_UI_MCP_AUDIT_LOG || '';
+const LICENSE_API_URL = (process.env.SKY_UI_LICENSE_API_URL || '').trim();
+/** When `true`, missing/invalid API key yields 401 if keys are configured. Default `false` (no blocking). */
+const REQUIRE_AUTH = (process.env.SKY_UI_MCP_REQUIRE_AUTH || 'false').toLowerCase() === 'true';
+function isSkyAccessToken(value) {
+    return value.startsWith('sk_pt_') || value.startsWith('sk_ci_');
+}
+async function validateSkyAccessToken(token) {
+    if (!LICENSE_API_URL || !isSkyAccessToken(token))
+        return null;
+    try {
+        const base = LICENSE_API_URL.replace(/\/$/, '');
+        const res = await fetch(`${base}/license/validate`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'Content-Type': 'application/json',
+            },
+            body: '{}',
+        });
+        const data = (await res.json());
+        if (data.active && data.userId)
+            return data.userId;
+    }
+    catch (e) {
+        console.error('[sky-ui-mcp] License token validation failed:', e);
+    }
+    return null;
+}
+/** Headers MCP Streamable HTTP clients send on cross-origin browser requests (preflight must allow these). */
+const MCP_CORS_ALLOW_HEADERS = [
+    'accept',
+    'accept-language',
+    'content-type',
+    'mcp-session-id',
+    'mcp-protocol-version',
+    'authorization',
+    'x-api-key',
+    'last-event-id'
+].join(', ');
+let clientPromise = null;
+function currentProcessEnv() {
+    const out = {};
+    for (const [k, v] of Object.entries(process.env)) {
+        if (typeof v === 'string')
+            out[k] = v;
+    }
+    return out;
+}
+function textFromContentBlocks(content) {
+    if (!Array.isArray(content))
+        return '';
+    return content
+        .filter((c) => c && typeof c === 'object' && c.type === 'text')
+        .map((c) => c.text ?? '')
+        .join('\n');
+}
+function resolveMcpServerCli() {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const candidates = [
+        join(here, 'mcp-stdio-entry.js'),
+        join(here, '..', 'dist', 'mcp-stdio-entry.js'),
+        join(here, 'server.js'),
+        join(here, '..', 'dist', 'server.js')
+    ];
+    for (const entry of candidates) {
+        if (existsSync(entry)) {
+            return { command: 'node', args: [entry] };
+        }
+    }
+    return { command: 'npm', args: ['run', 'dev', '-w', '@sky.ui/mcp'] };
+}
+function clientIp(req) {
+    const xff = req.headers['x-forwarded-for'];
+    if (typeof xff === 'string' && xff.trim()) {
+        return xff.split(',')[0].trim();
+    }
+    return req.ip;
+}
+function clientIpFromIncoming(req) {
+    const xff = req.headers['x-forwarded-for'];
+    if (typeof xff === 'string' && xff.trim()) {
+        return xff.split(',')[0].trim();
+    }
+    return req.socket?.remoteAddress ?? '';
+}
+/** Tab-separated: ISO time, IP, status, tool name or `-`, user id / `legacy-key` / `-`. */
+function auditLog(ip, status, tool, userLabel) {
+    if (!AUDIT_LOG_PATH)
+        return;
+    try {
+        const who = userLabel === undefined || userLabel === null || userLabel === '' ? '-' : userLabel;
+        const line = `${new Date().toISOString()}\t${ip}\t${status}\t${tool ?? '-'}\t${who}\n`;
+        appendFileSync(AUDIT_LOG_PATH, line, { encoding: 'utf8' });
+    }
+    catch {
+        /* ignore audit failures */
+    }
+}
+function timingSafeEqualStr(a, b) {
+    try {
+        const ba = Buffer.from(a, 'utf8');
+        const bb = Buffer.from(b, 'utf8');
+        if (ba.length !== bb.length)
+            return false;
+        return timingSafeEqual(ba, bb);
+    }
+    catch {
+        return false;
+    }
+}
+/** Load `apiKey -> userId` entries from `SKY_UI_MCP_KEYS_JSON` and/or `SKY_UI_MCP_KEYS_FILE` (merged). */
+function loadUserApiKeyMap() {
+    const map = new Map();
+    function setPair(userId, apiKey, source) {
+        const uid = userId.trim();
+        const key = apiKey.trim();
+        if (!uid || !key)
+            return;
+        const existing = map.get(key);
+        if (existing !== undefined && existing !== uid) {
+            console.warn(`[sky-ui-mcp] Duplicate API key in ${source}; last user id wins (${uid}).`);
+        }
+        map.set(key, uid);
+    }
+    function consumeParsed(parsed, source) {
+        if (parsed === null || parsed === undefined)
+            return;
+        if (Array.isArray(parsed)) {
+            for (const row of parsed) {
+                if (row && typeof row === 'object') {
+                    const r = row;
+                    const id = r.id ?? r.userId ?? r.user;
+                    const key = r.apiKey ?? r.api_key ?? r.key ?? r.token;
+                    if (typeof id === 'string' && typeof key === 'string')
+                        setPair(id, key, source);
+                }
+            }
+            return;
+        }
+        if (typeof parsed !== 'object')
+            return;
+        const o = parsed;
+        if (Array.isArray(o.users)) {
+            for (const row of o.users) {
+                if (row && typeof row === 'object') {
+                    const r = row;
+                    const id = r.id ?? r.userId ?? r.user;
+                    const key = r.apiKey ?? r.api_key ?? r.key ?? r.token;
+                    if (typeof id === 'string' && typeof key === 'string')
+                        setPair(id, key, source);
+                }
+            }
+        }
+        for (const [k, v] of Object.entries(o)) {
+            if (k === 'users')
+                continue;
+            if (typeof v === 'string')
+                setPair(k, v, source);
+        }
+    }
+    if (KEYS_JSON_INLINE.trim()) {
+        try {
+            consumeParsed(JSON.parse(KEYS_JSON_INLINE), 'SKY_UI_MCP_KEYS_JSON');
+        }
+        catch (e) {
+            console.error('[sky-ui-mcp] Failed to parse SKY_UI_MCP_KEYS_JSON:', e);
+        }
+    }
+    const keysPath = KEYS_FILE.trim();
+    if (keysPath && existsSync(keysPath)) {
+        try {
+            consumeParsed(JSON.parse(readFileSync(keysPath, 'utf8')), keysPath);
+        }
+        catch (e) {
+            console.error(`[sky-ui-mcp] Failed to read/parse SKY_UI_MCP_KEYS_FILE (${keysPath}):`, e);
+        }
+    }
+    return map;
+}
+const LEGACY_KEY = API_KEY.trim();
+const USER_API_KEYS = loadUserApiKeyMap();
+function authIsRequired() {
+    if (!REQUIRE_AUTH)
+        return false;
+    return LEGACY_KEY.length > 0 || USER_API_KEYS.size > 0 || LICENSE_API_URL.length > 0;
+}
+function resolveProvidedApiKey(provided) {
+    if (LEGACY_KEY.length > 0 && timingSafeEqualStr(provided, LEGACY_KEY)) {
+        return { kind: 'legacy' };
+    }
+    for (const [storedKey, userId] of USER_API_KEYS) {
+        if (timingSafeEqualStr(provided, storedKey)) {
+            return { kind: 'user', userId };
+        }
+    }
+    return null;
+}
+function authModeLabel() {
+    const hasL = LEGACY_KEY.length > 0;
+    const hasU = USER_API_KEYS.size > 0;
+    if (!hasL && !hasU)
+        return 'none';
+    if (hasL && hasU)
+        return 'mixed';
+    if (hasL)
+        return 'legacy';
+    return 'users';
+}
+function userLabelForAudit(req) {
+    const a = req.skyMcpAuth;
+    if (a?.mode === 'user')
+        return a.userId;
+    if (a?.mode === 'legacy')
+        return 'legacy-key';
+    return '-';
+}
+function requestPath(url) {
+    const q = url.indexOf('?');
+    return q === -1 ? url : url.slice(0, q);
+}
+/**
+ * Value for Access-Control-Allow-Origin, or null if this request must not get CORS headers
+ * (browser cross-origin request with disallowed Origin when SKY_UI_MCP_CORS_ORIGINS is set).
+ */
+function resolveAllowedOrigin(req) {
+    const origin = req.headers.origin;
+    if (CORS_ORIGINS.length > 0) {
+        if (typeof origin === 'string' && CORS_ORIGINS.includes(origin))
+            return origin;
+        if (typeof origin !== 'string' || origin.length === 0)
+            return '*';
+        return null;
+    }
+    if (typeof origin === 'string' && origin.length > 0)
+        return origin;
+    return '*';
+}
+function corsHeadersForRequest(req) {
+    const allowed = resolveAllowedOrigin(req);
+    if (allowed === null)
+        return null;
+    const headers = {
+        'Access-Control-Allow-Origin': allowed,
+        'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS',
+        'Access-Control-Allow-Headers': MCP_CORS_ALLOW_HEADERS,
+        'Access-Control-Expose-Headers': 'mcp-session-id, Mcp-Session-Id',
+        Vary: 'Origin',
+        'Access-Control-Max-Age': '86400'
+    };
+    if (allowed !== '*') {
+        headers['Access-Control-Allow-Credentials'] = 'true';
+    }
+    return headers;
+}
+/** Required on `/` because `reply.hijack()` bypasses @fastify/cors for Streamable HTTP. */
+function applyMcpCorsHeaders(req, res) {
+    const h = corsHeadersForRequest(req);
+    if (!h)
+        return;
+    for (const [key, value] of Object.entries(h)) {
+        res.setHeader(key, value);
+    }
+}
+function applyMcpCorsToFastifyReply(request, reply) {
+    const h = corsHeadersForRequest(request.raw);
+    if (!h)
+        return;
+    for (const [key, value] of Object.entries(h)) {
+        reply.header(key, value);
+    }
+}
+const streamableSessions = {};
+function bodyLooksLikeInitialize(parsedBody) {
+    if (parsedBody === undefined)
+        return false;
+    if (isInitializeRequest(parsedBody))
+        return true;
+    if (Array.isArray(parsedBody)) {
+        return parsedBody.some((m) => isInitializeRequest(m));
+    }
+    return false;
+}
+/**
+ * JSON-RPC `tools/call` bodies (single or batch). Used when Streamable HTTP clients POST tool
+ * calls without a valid `mcp-session-id` (session expired, or client skips full handshake).
+ */
+function extractToolsCallRequests(parsedBody) {
+    const parseOne = (msg) => {
+        if (!msg || typeof msg !== 'object')
+            return null;
+        const m = msg;
+        if (m.jsonrpc !== '2.0')
+            return null;
+        if (m.method !== 'tools/call')
+            return null;
+        const params = m.params;
+        if (!params || typeof params !== 'object')
+            return null;
+        const p = params;
+        const name = p.name;
+        if (typeof name !== 'string' || !name.trim())
+            return null;
+        const rawArgs = p.arguments;
+        const args = typeof rawArgs === 'object' && rawArgs !== null && !Array.isArray(rawArgs)
+            ? rawArgs
+            : {};
+        return { id: 'id' in m ? m.id : null, tool: name.trim(), args };
+    };
+    if (parsedBody === undefined || parsedBody === null)
+        return null;
+    if (Array.isArray(parsedBody)) {
+        if (parsedBody.length === 0)
+            return null;
+        const out = [];
+        for (const item of parsedBody) {
+            const one = parseOne(item);
+            if (!one)
+                return null;
+            out.push(one);
+        }
+        return out;
+    }
+    const single = parseOne(parsedBody);
+    return single ? [single] : null;
+}
+async function executeStatelessToolsCallResponses(req, res, toolsCalls) {
+    const ip = clientIpFromIncoming(req);
+    const responses = [];
+    for (const tc of toolsCalls) {
+        const { id, tool, args } = tc;
+        if (!READ_ONLY_TOOLS.has(tool)) {
+            auditLog(ip, 403, tool, '-');
+            responses.push({
+                jsonrpc: '2.0',
+                id,
+                error: {
+                    code: -32602,
+                    message: `Tool "${tool}" is not allowed on this endpoint.`,
+                    data: { allowedTools: [...READ_ONLY_TOOLS].sort() }
+                }
+            });
+            continue;
+        }
+        try {
+            const client = await getClient();
+            const result = await client.callTool({ name: tool, arguments: args });
+            auditLog(ip, 200, tool, '-');
+            responses.push({
+                jsonrpc: '2.0',
+                id,
+                result: {
+                    content: result.content,
+                    ...(typeof result.isError === 'boolean' ? { isError: result.isError } : {})
+                }
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            auditLog(ip, 500, tool, '-');
+            responses.push({
+                jsonrpc: '2.0',
+                id,
+                error: { code: -32603, message: msg }
+            });
+        }
+    }
+    applyMcpCorsHeaders(req, res);
+    res.statusCode = 200;
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    const payload = toolsCalls.length === 1 ? responses[0] : responses;
+    res.end(JSON.stringify(payload));
+}
+async function getClient() {
+    if (!clientPromise) {
+        clientPromise = (async () => {
+            const { command, args } = resolveMcpServerCli();
+            const transport = new StdioClientTransport({
+                command,
+                args,
+                cwd: repoRoot,
+                env: currentProcessEnv(),
+                stderr: 'inherit'
+            });
+            const client = new Client({ name: 'sky-ui-post-endpoint', version: '1.0.0' }, { capabilities: {} });
+            await client.connect(transport);
+            return client;
+        })();
+    }
+    return clientPromise;
+}
+const app = Fastify({
+    logger: false,
+    requestTimeout: REQUEST_TIMEOUT_MS
+});
+function extractProvidedApiKey(headers) {
+    const explicit = headers['x-api-key'];
+    if (typeof explicit === 'string' && explicit.trim())
+        return explicit.trim();
+    const auth = headers.authorization;
+    if (typeof auth === 'string') {
+        const m = /^\s*Bearer\s+(.+?)\s*$/i.exec(auth);
+        if (m?.[1])
+            return m[1].trim();
+    }
+    return null;
+}
+app.addHook('onRequest', async (req, reply) => {
+    req.skyMcpAuth = { mode: 'anonymous', userId: null };
+    if (LOG_REQUESTS) {
+        console.log(`[request:${req.id}] ${req.method} ${req.url}`);
+    }
+    // CORS preflight must not hit API key / IP allowlist (browser sends OPTIONS without your key).
+    if (req.method === 'OPTIONS') {
+        return;
+    }
+    const pathOnly = requestPath(req.url);
+    if (ALLOW_IPS.length > 0 && pathOnly !== '/health') {
+        const ip = clientIp(req);
+        if (!ALLOW_IPS.includes(ip)) {
+            auditLog(ip, 403, null, '-');
+            return reply.code(403).send({
+                ok: false,
+                code: 'FORBIDDEN_IP',
+                message: 'Client IP not allowed.',
+                error: 'Client IP not allowed.'
+            });
+        }
+    }
+    if (!authIsRequired() || pathOnly === '/health') {
+        return;
+    }
+    const provided = extractProvidedApiKey(req.headers);
+    if (!provided) {
+        auditLog(clientIp(req), 401, null, '-');
+        return reply.code(401).send({
+            ok: false,
+            code: 'UNAUTHORIZED',
+            message: 'Missing or invalid API key.',
+            error: 'Missing or invalid API key.'
+        });
+    }
+    const resolved = resolveProvidedApiKey(provided);
+    if (resolved) {
+        if (resolved.kind === 'legacy') {
+            req.skyMcpAuth = { mode: 'legacy', userId: null };
+        }
+        else {
+            req.skyMcpAuth = { mode: 'user', userId: resolved.userId };
+        }
+        return;
+    }
+    const licenseUserId = await validateSkyAccessToken(provided);
+    if (licenseUserId) {
+        req.skyMcpAuth = { mode: 'user', userId: licenseUserId };
+        return;
+    }
+    auditLog(clientIp(req), 401, null, '-');
+    return reply.code(401).send({
+        ok: false,
+        code: 'UNAUTHORIZED',
+        message: 'Missing or invalid API key.',
+        error: 'Missing or invalid API key.'
+    });
+});
+app.addHook('onResponse', async (req, reply) => {
+    if (LOG_REQUESTS) {
+        console.log(`[response:${req.id}] ${reply.statusCode} ${req.method} ${req.url}`);
+    }
+});
+app.get('/health', async () => ({
+    ok: true,
+    mode: 'read-only',
+    endpoints: {
+        streamableHttp: '/',
+        legacyToolPost: '/tool'
+    },
+    transport: 'fastify',
+    authEnforced: REQUIRE_AUTH,
+    authRequired: authIsRequired(),
+    authMode: authModeLabel(),
+    userKeysLoaded: USER_API_KEYS.size,
+    ipAllowlistActive: ALLOW_IPS.length > 0,
+    corsAllowlistActive: CORS_ORIGINS.length > 0,
+    auditLogActive: AUDIT_LOG_PATH.length > 0
+}));
+app.post('/tool', {
+    schema: {
+        body: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['tool'],
+            properties: {
+                tool: { type: 'string', minLength: 1 },
+                args: { type: 'object', additionalProperties: true }
+            }
+        }
+    }
+}, async (req, reply) => {
+    const ip = clientIp(req);
+    const tool = req.body.tool?.trim();
+    const args = req.body.args ?? {};
+    if (!tool) {
+        auditLog(ip, 400, null, userLabelForAudit(req));
+        return reply.code(400).send({
+            ok: false,
+            code: 'BAD_REQUEST',
+            message: 'Missing `tool` in request body.',
+            error: 'Missing `tool` in request body.'
+        });
+    }
+    if (!READ_ONLY_TOOLS.has(tool)) {
+        auditLog(ip, 403, tool, userLabelForAudit(req));
+        return reply.code(403).send({
+            ok: false,
+            code: 'TOOL_NOT_ALLOWED',
+            message: 'Tool is not allowed by read-only endpoint.',
+            error: 'Tool is not allowed by read-only endpoint.',
+            allowedTools: [...READ_ONLY_TOOLS].sort(),
+            hint: 'If you expected this tool to work, your POST server build is likely stale. Run `npm run build -w @sky.ui/mcp` (or `npm run build:mcp` from the monorepo root) and restart the POST process. Prefer `npm run serve:post -w @sky.ui/mcp` during development so the allowlist always matches source.'
+        });
+    }
+    try {
+        const client = await getClient();
+        const result = await client.callTool({ name: tool, arguments: args });
+        const text = textFromContentBlocks(result.content);
+        let parsed = null;
+        if (text) {
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                parsed = text;
+            }
+        }
+        auditLog(ip, 200, tool, userLabelForAudit(req));
+        // Tool JSON errors use { code, error, ... } from mcp-tool-errors.ts; `data` is the parsed body.
+        return reply.send({
+            ok: !result.isError,
+            tool,
+            data: parsed,
+            rawText: text,
+            isError: !!result.isError
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        auditLog(ip, 500, tool, userLabelForAudit(req));
+        return reply.code(500).send({
+            ok: false,
+            code: 'INTERNAL_ERROR',
+            message: msg,
+            error: msg
+        });
+    }
+});
+async function handleStreamablePost(req, res, parsedBody, sessionId) {
+    try {
+        let transport;
+        if (sessionId && streamableSessions[sessionId]) {
+            transport = streamableSessions[sessionId].transport;
+            await transport.handleRequest(req, res, parsedBody);
+            return;
+        }
+        const toolsCalls = extractToolsCallRequests(parsedBody);
+        if (toolsCalls !== null && toolsCalls.length > 0) {
+            await executeStatelessToolsCallResponses(req, res, toolsCalls);
+            return;
+        }
+        if (!sessionId && bodyLooksLikeInitialize(parsedBody)) {
+            const eventStore = new InMemoryEventStore();
+            const mcpServer = createSkyUiMcpServer();
+            let boundSessionId;
+            transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: () => randomUUID(),
+                eventStore,
+                onsessioninitialized: (sid) => {
+                    boundSessionId = sid;
+                    if (transport) {
+                        streamableSessions[sid] = { transport, server: mcpServer };
+                    }
+                }
+            });
+            // Drop session registry only — do not call mcpServer.close() here. Transport close
+            // already fired this handler; mcpServer.close() would call transport.close() again
+            // and recurse until stack overflow (see MCP SDK protocol.connect onclose wrapping).
+            transport.onclose = () => {
+                const sid = boundSessionId;
+                boundSessionId = undefined;
+                if (sid && streamableSessions[sid]) {
+                    delete streamableSessions[sid];
+                }
+            };
+            await mcpServer.connect(transport);
+            await transport.handleRequest(req, res, parsedBody);
+            return;
+        }
+        applyMcpCorsHeaders(req, res);
+        res.statusCode = 400;
+        res.setHeader('Content-Type', 'application/json; charset=utf-8');
+        const hint = parsedBody === undefined
+            ? 'Missing JSON body. First POST to / must be an MCP initialize JSON-RPC message, or send Mcp-Session-Id for an existing session.'
+            : 'No Mcp-Session-Id (or unknown session), and the body is not an MCP initialize request. Send initialize first, then reuse the session id from the response; or use POST /tool with { "tool", "args" } for simple tool calls without MCP session.';
+        res.end(JSON.stringify({
+            jsonrpc: '2.0',
+            error: {
+                code: -32000,
+                message: `Bad Request: No valid session ID provided. ${hint}`
+            },
+            id: null
+        }));
+    }
+    catch (err) {
+        console.error('Streamable MCP POST error:', err);
+        if (!res.headersSent) {
+            applyMcpCorsHeaders(req, res);
+            res.statusCode = 500;
+            res.setHeader('Content-Type', 'application/json; charset=utf-8');
+            res.end(JSON.stringify({
+                jsonrpc: '2.0',
+                error: { code: -32603, message: 'Internal server error' },
+                id: null
+            }));
+        }
+    }
+}
+async function handleStreamableGetDelete(req, res, sessionId, method) {
+    try {
+        if (!sessionId || !streamableSessions[sessionId]) {
+            applyMcpCorsHeaders(req, res);
+            res.statusCode = 400;
+            res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+            res.end('Invalid or missing session ID');
+            return;
+        }
+        const transport = streamableSessions[sessionId].transport;
+        await transport.handleRequest(req, res);
+    }
+    catch (err) {
+        console.error(`Streamable MCP ${method} error:`, err);
+        if (!res.headersSent) {
+            applyMcpCorsHeaders(req, res);
+            res.statusCode = 500;
+            res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+            res.end(method === 'DELETE' ? 'Error processing session termination' : 'Internal server error');
+        }
+    }
+}
+app.options('/', async (request, reply) => {
+    const headers = corsHeadersForRequest(request.raw);
+    if (!headers) {
+        return reply.code(403).send({ ok: false, code: 'CORS_FORBIDDEN', message: 'Origin not allowed.' });
+    }
+    applyMcpCorsToFastifyReply(request, reply);
+    return reply.code(204).send();
+});
+app.route({
+    method: ['GET', 'POST', 'DELETE'],
+    url: '/',
+    handler: async (request, reply) => {
+        reply.hijack();
+        const rawReq = request.raw;
+        const rawRes = reply.raw;
+        applyMcpCorsHeaders(rawReq, rawRes);
+        const sessionHeader = request.headers['mcp-session-id'];
+        const sessionId = typeof sessionHeader === 'string' ? sessionHeader.trim() : undefined;
+        const method = request.method;
+        if (method === 'POST') {
+            await handleStreamablePost(rawReq, rawRes, request.body, sessionId);
+            return;
+        }
+        if (method === 'GET') {
+            await handleStreamableGetDelete(rawReq, rawRes, sessionId, 'GET');
+            return;
+        }
+        if (method === 'DELETE') {
+            await handleStreamableGetDelete(rawReq, rawRes, sessionId, 'DELETE');
+        }
+    }
+});
+app.setNotFoundHandler(async (_req, reply) => {
+    return reply.code(404).send({
+        ok: false,
+        code: 'NOT_FOUND',
+        message: 'Not found',
+        error: 'Not found'
+    });
+});
+async function main() {
+    assertCoreDependencyAvailable();
+    await app.register(cors, {
+        origin: CORS_ORIGINS.length > 0 ? CORS_ORIGINS : true,
+        methods: ['GET', 'POST', 'DELETE', 'OPTIONS']
+    });
+    await app.register(rateLimit, {
+        max: RATE_LIMIT_MAX,
+        timeWindow: RATE_LIMIT_WINDOW,
+        allowList: (req) => req.method === 'OPTIONS',
+        keyGenerator: (req) => {
+            const a = req.skyMcpAuth;
+            if (a?.mode === 'user' && a.userId)
+                return `uid:${a.userId}`;
+            if (a?.mode === 'legacy')
+                return 'legacy-key';
+            return clientIp(req);
+        },
+        errorResponseBuilder: (_req, context) => ({
+            ok: false,
+            code: 'RATE_LIMITED',
+            message: 'Rate limit exceeded.',
+            error: 'Rate limit exceeded.',
+            details: {
+                max: context.max,
+                after: context.after
+            }
+        })
+    });
+    await app.listen({ port: PORT, host: '0.0.0.0' });
+    console.log(`Sky UI MCP POST endpoint listening on http://localhost:${PORT} (network: http://<your-lan-ip>:${PORT})`);
+    console.log('MCP Streamable HTTP: GET/POST/DELETE / (same origin as Cursor streamable_http)');
+    console.log('Browser UIs on another host/port: set SKY_UI_MCP_CORS_ORIGINS=http://YOUR_UI:PORT (comma-separated). Hijacked / uses manual CORS headers.');
+    console.log('Read-only tool endpoint: POST /tool (Fastify)');
+    if (REQUIRE_AUTH && authIsRequired()) {
+        console.log('Auth enforced: provide x-api-key or Authorization: Bearer <token>');
+        console.log(`Auth mode: ${authModeLabel()} (legacy key: ${LEGACY_KEY.length > 0 ? 'yes' : 'no'}, user keys: ${USER_API_KEYS.size})`);
+    }
+    else if (LEGACY_KEY.length > 0 || USER_API_KEYS.size > 0) {
+        console.log('API keys are configured but SKY_UI_MCP_REQUIRE_AUTH is not true — requests are not blocked. Set SKY_UI_MCP_REQUIRE_AUTH=true to enforce.');
+    }
+    if (CORS_ORIGINS.length) {
+        console.log(`CORS allowlist: ${CORS_ORIGINS.join(', ')}`);
+    }
+    if (ALLOW_IPS.length) {
+        console.log(`IP allowlist: ${ALLOW_IPS.join(', ')}`);
+    }
+    if (AUDIT_LOG_PATH) {
+        console.log(`Audit log: ${AUDIT_LOG_PATH}`);
+    }
+}
+main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});
+//# sourceMappingURL=post-endpoint-server.js.map