@solvapay/mcp 0.1.0 → 0.2.0

package/dist/fetch/index.js

@@ -0,0 +1,565 @@
+import {
+  applyHideToolsByAudience,
+  buildSolvaPayMcpServer,
+  registerPayableTool
+} from "../chunk-3VDAADZU.js";
+
+// src/fetch/oauth-bridge.ts
+import {
+  getOAuthAuthorizationServerResponse,
+  getOAuthProtectedResourceResponse,
+  resolveOAuthPaths,
+  withoutTrailingSlash as withoutTrailingSlash2
+} from "@solvapay/mcp-core";
+
+// src/fetch/cors.ts
+import { withoutTrailingSlash } from "@solvapay/mcp-core";
+var NATIVE_CLIENT_ORIGIN_REGEX = /^(cursor|vscode|vscode-webview|claude):\/\/.+$/;
+function isNativeClientOrigin(origin) {
+  if (!origin) return false;
+  return NATIVE_CLIENT_ORIGIN_REGEX.test(origin);
+}
+function applyNativeCors(reqHeaders, resHeaders) {
+  const origin = reqHeaders.get("origin");
+  if (!origin) return;
+  if (isNativeClientOrigin(origin)) {
+    resHeaders.set("Access-Control-Allow-Origin", origin);
+    resHeaders.append("Vary", "Origin");
+  }
+}
+function corsPreflight(req) {
+  const reqHeaders = req.headers;
+  const requestedMethod = reqHeaders.get("access-control-request-method") ?? "POST";
+  const requestedHeaders = reqHeaders.get("access-control-request-headers") ?? "authorization, content-type";
+  const headers = new Headers();
+  applyNativeCors(reqHeaders, headers);
+  headers.set("Access-Control-Allow-Methods", `${requestedMethod}, OPTIONS`);
+  headers.set("Access-Control-Allow-Headers", requestedHeaders);
+  headers.set("Access-Control-Max-Age", "600");
+  return new Response(null, { status: 204, headers });
+}
+function authChallenge(req, options) {
+  const {
+    publicBaseUrl,
+    protectedResourcePath = "/.well-known/oauth-protected-resource",
+    jsonRpcId = null
+  } = options;
+  const headers = new Headers();
+  applyNativeCors(req.headers, headers);
+  headers.set("Access-Control-Expose-Headers", "WWW-Authenticate");
+  headers.set(
+    "WWW-Authenticate",
+    `Bearer resource_metadata="${withoutTrailingSlash(publicBaseUrl)}${protectedResourcePath}"`
+  );
+  headers.set("Content-Type", "application/json");
+  const body = {
+    jsonrpc: "2.0",
+    id: jsonRpcId,
+    error: { code: -32001, message: "Unauthorized" }
+  };
+  return new Response(JSON.stringify(body), { status: 401, headers });
+}
+function resolveBearer(req) {
+  const header = req.headers.get("authorization");
+  if (!header) return null;
+  const match = /^\s*Bearer\s+(.+?)\s*$/i.exec(header);
+  return match ? match[1] : null;
+}
+
+// src/fetch/oauth-bridge.ts
+function hasOAuthErrorShape(body) {
+  return body !== null && typeof body === "object" && typeof body.error === "string";
+}
+function extractZodErrors(body) {
+  const errs = body.errors;
+  if (!Array.isArray(errs)) return [];
+  return errs.filter((e) => !!e && typeof e === "object");
+}
+function deriveOAuthErrorCode(status, nestBody) {
+  if (status === 401 || status === 403) return "invalid_client";
+  if (status >= 500) return "server_error";
+  const zodErrors = extractZodErrors(nestBody);
+  const touches = (field) => zodErrors.some((e) => {
+    const path = e.path;
+    return Array.isArray(path) && path.includes(field);
+  });
+  if (touches("grant_type")) {
+    const grantTypeErr = zodErrors.find((e) => {
+      const path = e.path;
+      return Array.isArray(path) && path.includes("grant_type");
+    });
+    const received = grantTypeErr && grantTypeErr.received;
+    if (received !== "undefined" && received !== void 0 && received !== "") {
+      return "unsupported_grant_type";
+    }
+    return "invalid_request";
+  }
+  if (touches("code") || touches("refresh_token")) return "invalid_grant";
+  if (touches("scope")) return "invalid_scope";
+  if (touches("client_id") || touches("client_secret")) return "invalid_client";
+  return "invalid_request";
+}
+function buildErrorDescription(nestBody) {
+  const zodErrors = extractZodErrors(nestBody);
+  if (zodErrors.length > 0) {
+    const parts = zodErrors.map((e) => {
+      const path = e.path;
+      const message2 = e.message;
+      const pathStr = Array.isArray(path) ? path.filter((p) => typeof p === "string").join(".") : "";
+      const msgStr = typeof message2 === "string" ? message2 : "";
+      if (pathStr && msgStr) return `${pathStr}: ${msgStr}`;
+      return pathStr || msgStr;
+    }).filter(Boolean);
+    if (parts.length > 0) return parts.join("; ");
+  }
+  const message = nestBody.message;
+  if (typeof message === "string") return message;
+  if (Array.isArray(message)) {
+    const strings = message.filter((m) => typeof m === "string");
+    if (strings.length > 0) return strings.join("; ");
+  }
+  return void 0;
+}
+function toOAuthErrorBody(body, text, status) {
+  if (hasOAuthErrorShape(body)) return body;
+  if (body && typeof body === "object") {
+    const nestBody = body;
+    const error = deriveOAuthErrorCode(status, nestBody);
+    const error_description = buildErrorDescription(nestBody);
+    return error_description ? { error, error_description } : { error };
+  }
+  const fallbackError = status >= 500 ? "server_error" : "invalid_request";
+  const description = typeof text === "string" && text.length > 0 && text.length < 500 ? text : void 0;
+  return description ? { error: fallbackError, error_description: description } : { error: fallbackError };
+}
+async function parseUpstreamJson(response) {
+  const text = await response.text();
+  if (!text) return { body: {}, text: "" };
+  try {
+    return { body: JSON.parse(text), text };
+  } catch {
+    return { body: text, text };
+  }
+}
+function upstreamUnreachable(req) {
+  const headers = new Headers({ "content-type": "application/json" });
+  applyNativeCors(req.headers, headers);
+  return new Response(JSON.stringify({ error: "upstream_unreachable" }), { status: 502, headers });
+}
+function corsResponse(req, response) {
+  const headers = new Headers(response.headers);
+  applyNativeCors(req.headers, headers);
+  return new Response(response.body, { status: response.status, headers });
+}
+function jsonResponse(req, status, body) {
+  const headers = new Headers({ "content-type": "application/json" });
+  applyNativeCors(req.headers, headers);
+  return new Response(JSON.stringify(body), { status, headers });
+}
+function emptyResponse(req, status) {
+  const headers = new Headers();
+  applyNativeCors(req.headers, headers);
+  return new Response(null, { status, headers });
+}
+function pathOf(req) {
+  return new URL(req.url).pathname;
+}
+function queryOf(req) {
+  const search = new URL(req.url).search;
+  return search || "";
+}
+function createProtectedResourceHandler(options) {
+  const path = options.protectedResourcePath ?? "/.well-known/oauth-protected-resource";
+  return async (req) => {
+    if (req.method !== "GET" || pathOf(req) !== path) return null;
+    return jsonResponse(req, 200, getOAuthProtectedResourceResponse(options.publicBaseUrl));
+  };
+}
+function createAuthorizationServerHandler(options) {
+  const path = options.authorizationServerPath ?? "/.well-known/oauth-authorization-server";
+  const resolvedPaths = resolveOAuthPaths(options.paths);
+  return async (req) => {
+    if (req.method !== "GET" || pathOf(req) !== path) return null;
+    if (!options.productRef) {
+      return jsonResponse(req, 500, { error: "SOLVAPAY_PRODUCT_REF missing" });
+    }
+    return jsonResponse(
+      req,
+      200,
+      getOAuthAuthorizationServerResponse({
+        publicBaseUrl: options.publicBaseUrl,
+        paths: resolvedPaths
+      })
+    );
+  };
+}
+function createOpenidNotFoundHandler() {
+  return async (req) => {
+    if (req.method !== "GET" || pathOf(req) !== "/.well-known/openid-configuration") return null;
+    return emptyResponse(req, 404);
+  };
+}
+function createOAuthRegisterHandler(options) {
+  const path = options.path ?? "/oauth/register";
+  const api = withoutTrailingSlash2(options.apiBaseUrl);
+  const upstream = `${api}/v1/customer/auth/register?product_ref=${encodeURIComponent(options.productRef)}`;
+  return async (req) => {
+    if (pathOf(req) !== path) return null;
+    if (req.method === "OPTIONS") return corsPreflight(req);
+    if (req.method !== "POST") return null;
+    const body = await req.text();
+    try {
+      const upstreamResponse = await fetch(upstream, {
+        method: "POST",
+        headers: { "content-type": req.headers.get("content-type") ?? "application/json" },
+        body
+      });
+      return corsResponse(req, upstreamResponse);
+    } catch {
+      return upstreamUnreachable(req);
+    }
+  };
+}
+function createOAuthAuthorizeHandler(options) {
+  const path = options.path ?? "/oauth/authorize";
+  const api = withoutTrailingSlash2(options.apiBaseUrl);
+  return async (req) => {
+    if (pathOf(req) !== path) return null;
+    if (req.method === "OPTIONS") return corsPreflight(req);
+    if (req.method !== "GET") return null;
+    const query = queryOf(req);
+    const location = `${api}/v1/customer/auth/authorize${query}`;
+    const headers = new Headers({ Location: location });
+    applyNativeCors(req.headers, headers);
+    return new Response(null, { status: 302, headers });
+  };
+}
+async function proxyFormEndpoint(req, upstreamUrl, normalizeErrors) {
+  const rawBody = await req.text();
+  const contentType = req.headers.get("content-type") ?? "application/x-www-form-urlencoded";
+  const headers = { "content-type": contentType };
+  const authorization = req.headers.get("authorization");
+  if (authorization) headers.authorization = authorization;
+  try {
+    const upstreamResponse = await fetch(upstreamUrl, {
+      method: "POST",
+      headers,
+      body: rawBody
+    });
+    if (!normalizeErrors || upstreamResponse.ok || upstreamResponse.status === 204) {
+      return corsResponse(req, upstreamResponse);
+    }
+    const { body, text } = await parseUpstreamJson(upstreamResponse);
+    const normalized = toOAuthErrorBody(body, text, upstreamResponse.status);
+    return jsonResponse(req, upstreamResponse.status, normalized);
+  } catch {
+    return upstreamUnreachable(req);
+  }
+}
+function createOAuthTokenHandler(options) {
+  const path = options.path ?? "/oauth/token";
+  const upstream = `${withoutTrailingSlash2(options.apiBaseUrl)}/v1/customer/auth/token`;
+  return async (req) => {
+    if (pathOf(req) !== path) return null;
+    if (req.method === "OPTIONS") return corsPreflight(req);
+    if (req.method !== "POST") return null;
+    return proxyFormEndpoint(
+      req,
+      upstream,
+      /* normalizeErrors */
+      true
+    );
+  };
+}
+function createOAuthRevokeHandler(options) {
+  const path = options.path ?? "/oauth/revoke";
+  const upstream = `${withoutTrailingSlash2(options.apiBaseUrl)}/v1/customer/auth/revoke`;
+  return async (req) => {
+    if (pathOf(req) !== path) return null;
+    if (req.method === "OPTIONS") return corsPreflight(req);
+    if (req.method !== "POST") return null;
+    return proxyFormEndpoint(
+      req,
+      upstream,
+      /* normalizeErrors */
+      true
+    );
+  };
+}
+function createOAuthFetchRouter(options) {
+  const paths = resolveOAuthPaths(options.oauthPaths);
+  const handlers = [
+    createOpenidNotFoundHandler(),
+    createProtectedResourceHandler({
+      publicBaseUrl: options.publicBaseUrl,
+      protectedResourcePath: options.protectedResourcePath
+    }),
+    createAuthorizationServerHandler({
+      publicBaseUrl: options.publicBaseUrl,
+      authorizationServerPath: options.authorizationServerPath,
+      paths,
+      productRef: options.productRef
+    }),
+    createOAuthRegisterHandler({
+      apiBaseUrl: options.apiBaseUrl,
+      productRef: options.productRef,
+      path: paths.register
+    }),
+    createOAuthAuthorizeHandler({ apiBaseUrl: options.apiBaseUrl, path: paths.authorize }),
+    createOAuthTokenHandler({ apiBaseUrl: options.apiBaseUrl, path: paths.token }),
+    createOAuthRevokeHandler({ apiBaseUrl: options.apiBaseUrl, path: paths.revoke })
+  ];
+  return async (req) => {
+    for (const handler of handlers) {
+      const response = await handler(req);
+      if (response) return response;
+    }
+    return null;
+  };
+}
+
+// src/fetch/handler.ts
+import {
+  buildAuthInfoFromBearer,
+  McpBearerAuthError
+} from "@solvapay/mcp-core";
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+function defaultSessionIdGenerator() {
+  const c = globalThis.crypto;
+  if (c?.randomUUID) return c.randomUUID();
+  return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (ch) => {
+    const r = Math.floor(Math.random() * 16);
+    const v = ch === "x" ? r : r & 3 | 8;
+    return v.toString(16);
+  });
+}
+function getJsonRpcId(body) {
+  if (body && typeof body === "object" && "id" in body) {
+    const id = body.id;
+    return id ?? null;
+  }
+  return null;
+}
+async function readJsonRpcId(req) {
+  try {
+    const clone = req.clone();
+    const body = await clone.json();
+    return getJsonRpcId(body);
+  } catch {
+    return null;
+  }
+}
+function createSolvaPayMcpFetchHandler(options) {
+  const {
+    server,
+    publicBaseUrl,
+    apiBaseUrl,
+    productRef,
+    mcpPath = "/mcp",
+    requireAuth = true,
+    authInfo,
+    protectedResourcePath,
+    authorizationServerPath,
+    oauthPaths,
+    mode = "sse-stateful",
+    buildTransport,
+    sessionIdGenerator
+  } = options;
+  const oauthRouter = createOAuthFetchRouter({
+    publicBaseUrl,
+    apiBaseUrl,
+    productRef,
+    protectedResourcePath,
+    authorizationServerPath,
+    oauthPaths
+  });
+  const makeTransport = () => {
+    if (buildTransport) return buildTransport();
+    if (mode === "json-stateless") {
+      return new WebStandardStreamableHTTPServerTransport({
+        sessionIdGenerator: void 0,
+        enableJsonResponse: true
+      });
+    }
+    if (mode === "sse-stateless") {
+      return new WebStandardStreamableHTTPServerTransport({
+        sessionIdGenerator: void 0
+      });
+    }
+    return new WebStandardStreamableHTTPServerTransport({
+      sessionIdGenerator: sessionIdGenerator ?? defaultSessionIdGenerator
+    });
+  };
+  let serverMutex = Promise.resolve();
+  return async (req) => {
+    const url = new URL(req.url);
+    const pathname = url.pathname;
+    if (req.method === "OPTIONS" && pathname === mcpPath) {
+      return corsPreflight(req);
+    }
+    const oauthResponse = await oauthRouter(req);
+    if (oauthResponse) return oauthResponse;
+    if (pathname !== mcpPath) {
+      return new Response("not_found", { status: 404 });
+    }
+    if (req.method && req.method !== "POST" && req.method !== "OPTIONS") {
+      const headers = new Headers({ Allow: "POST, OPTIONS" });
+      applyNativeCors(req.headers, headers);
+      return new Response(null, { status: 405, headers });
+    }
+    const authHeader = req.headers.get("authorization");
+    let resolvedAuthInfo = null;
+    if (authHeader || requireAuth) {
+      try {
+        resolvedAuthInfo = buildAuthInfoFromBearer(authHeader, authInfo);
+        if (!resolvedAuthInfo) {
+          throw new McpBearerAuthError("Missing bearer token");
+        }
+      } catch {
+        const jsonRpcId = await readJsonRpcId(req);
+        return authChallenge(req, {
+          publicBaseUrl,
+          protectedResourcePath,
+          jsonRpcId
+        });
+      }
+    }
+    const previous = serverMutex;
+    let releaseMutex = () => {
+    };
+    serverMutex = new Promise((resolve) => {
+      releaseMutex = resolve;
+    });
+    await previous;
+    const transport = makeTransport();
+    try {
+      await server.connect(transport);
+      const response = await transport.handleRequest(
+        req,
+        resolvedAuthInfo ? {
+          // `AuthInfo` from the SDK is structurally identical to our
+          // envelope — cast away the brand so the types line up.
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          authInfo: resolvedAuthInfo
+        } : void 0
+      );
+      const merged = new Headers(response.headers);
+      applyNativeCors(req.headers, merged);
+      return new Response(response.body, { status: response.status, headers: merged });
+    } catch (error) {
+      const headers = new Headers({ "content-type": "application/json" });
+      applyNativeCors(req.headers, headers);
+      const jsonRpcId = await readJsonRpcId(req);
+      return new Response(
+        JSON.stringify({
+          jsonrpc: "2.0",
+          id: jsonRpcId,
+          error: {
+            code: -32603,
+            message: error instanceof Error ? error.message : "internal_error"
+          }
+        }),
+        { status: 500, headers }
+      );
+    } finally {
+      await transport.close().catch(() => {
+      });
+      releaseMutex();
+    }
+  };
+}
+
+// src/fetch/createSolvaPayMcpFetch.ts
+function createSolvaPayMcpFetch(options) {
+  const {
+    // Descriptor options.
+    solvaPay,
+    productRef,
+    resourceUri,
+    htmlPath,
+    readHtml,
+    publicBaseUrl,
+    views,
+    csp,
+    getCustomerRef,
+    onToolCall,
+    onToolResult,
+    branding,
+    // Server / registration options.
+    additionalTools,
+    hideToolsByAudience,
+    registerPrompts = true,
+    registerDocsResources = true,
+    serverName,
+    serverVersion = "1.0.0",
+    // Handler options — everything in
+    // `CreateSolvaPayMcpFetchHandlerOptions` except `server`.
+    ...handlerRest
+  } = options;
+  const { server, descriptors } = buildSolvaPayMcpServer({
+    solvaPay,
+    productRef,
+    resourceUri,
+    ...htmlPath !== void 0 ? { htmlPath } : {},
+    ...readHtml !== void 0 ? { readHtml } : {},
+    publicBaseUrl,
+    ...views !== void 0 ? { views } : {},
+    ...csp !== void 0 ? { csp } : {},
+    ...getCustomerRef !== void 0 ? { getCustomerRef } : {},
+    ...onToolCall !== void 0 ? { onToolCall } : {},
+    ...onToolResult !== void 0 ? { onToolResult } : {},
+    ...branding !== void 0 ? { branding } : {},
+    registerPrompts,
+    registerDocsResources,
+    ...serverName !== void 0 ? { serverName } : {},
+    serverVersion
+  });
+  if (additionalTools) {
+    const registerPayable = (name, opts) => {
+      registerPayableTool(server, name, {
+        solvaPay,
+        ...opts,
+        product: opts.product ?? productRef,
+        buildBootstrap: opts.buildBootstrap ?? descriptors.buildBootstrapPayload
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      });
+    };
+    additionalTools({ server, solvaPay, resourceUri, productRef, registerPayable });
+  }
+  applyHideToolsByAudience(server, hideToolsByAudience);
+  return createSolvaPayMcpFetchHandler({
+    server,
+    publicBaseUrl,
+    productRef,
+    ...handlerRest
+  });
+}
+
+// src/fetch/index.ts
+import {
+  getOAuthAuthorizationServerResponse as getOAuthAuthorizationServerResponse2,
+  getOAuthProtectedResourceResponse as getOAuthProtectedResourceResponse2,
+  buildAuthInfoFromBearer as buildAuthInfoFromBearer2,
+  McpBearerAuthError as McpBearerAuthError2
+} from "@solvapay/mcp-core";
+export {
+  McpBearerAuthError2 as McpBearerAuthError,
+  applyNativeCors,
+  authChallenge,
+  buildAuthInfoFromBearer2 as buildAuthInfoFromBearer,
+  corsPreflight,
+  createAuthorizationServerHandler,
+  createOAuthAuthorizeHandler,
+  createOAuthFetchRouter,
+  createOAuthRegisterHandler,
+  createOAuthRevokeHandler,
+  createOAuthTokenHandler,
+  createOpenidNotFoundHandler,
+  createProtectedResourceHandler,
+  createSolvaPayMcpFetch,
+  createSolvaPayMcpFetchHandler,
+  getOAuthAuthorizationServerResponse2 as getOAuthAuthorizationServerResponse,
+  getOAuthProtectedResourceResponse2 as getOAuthProtectedResourceResponse,
+  isNativeClientOrigin,
+  resolveBearer
+};