@sonordev/site-kit 4.2.4 → 4.3.1

package/dist/mcp/index.js

@@ -0,0 +1,537 @@
+'use strict';
+
+require('../chunk-SNAQBZPT.js');
+
+// src/mcp/types.ts
+function defineMcpTool(tool) {
+  return tool;
+}
+
+// src/mcp/protocol.ts
+var MCP_PROTOCOL_VERSION_MODERN = "2026-07-28";
+var MCP_PROTOCOL_VERSIONS_LEGACY = ["2025-11-25", "2025-06-18", "2025-03-26"];
+var MCP_SUPPORTED_PROTOCOL_VERSIONS = [
+  MCP_PROTOCOL_VERSION_MODERN,
+  ...MCP_PROTOCOL_VERSIONS_LEGACY
+];
+var META_PROTOCOL_VERSION = "io.modelcontextprotocol/protocolVersion";
+var META_CLIENT_INFO = "io.modelcontextprotocol/clientInfo";
+var META_SERVER_INFO = "io.modelcontextprotocol/serverInfo";
+var JSONRPC_PARSE_ERROR = -32700;
+var JSONRPC_INVALID_REQUEST = -32600;
+var JSONRPC_METHOD_NOT_FOUND = -32601;
+var JSONRPC_INVALID_PARAMS = -32602;
+var MCP_ERROR_HEADER_MISMATCH = -32020;
+var MCP_ERROR_UNSUPPORTED_PROTOCOL_VERSION = -32022;
+var MAX_JSON_TEXT = 6e4;
+function isToolResult(value) {
+  return typeof value === "object" && value !== null && Array.isArray(value.content);
+}
+function toToolResult(value) {
+  if (isToolResult(value)) return value;
+  if (typeof value === "string") {
+    return { content: [{ type: "text", text: value }] };
+  }
+  if (value === void 0 || value === null) {
+    return { content: [{ type: "text", text: "(no result)" }] };
+  }
+  let text;
+  try {
+    text = JSON.stringify(value, null, 2);
+  } catch {
+    text = String(value);
+  }
+  if (text.length > MAX_JSON_TEXT) {
+    text = `${text.slice(0, MAX_JSON_TEXT)}
+\u2026 (truncated)`;
+  }
+  return {
+    content: [{ type: "text", text }],
+    structuredContent: value
+  };
+}
+function toolErrorResult(message) {
+  return { content: [{ type: "text", text: message }], isError: true };
+}
+function toToolDescriptor(tool) {
+  const descriptor = {
+    name: tool.name,
+    description: tool.description,
+    inputSchema: tool.inputSchema
+  };
+  if (tool.title) descriptor.title = tool.title;
+  if (tool.outputSchema) descriptor.outputSchema = tool.outputSchema;
+  if (tool.annotations) descriptor.annotations = tool.annotations;
+  return descriptor;
+}
+function validateArgs(tool, args) {
+  const required = tool.inputSchema.required ?? [];
+  const missing = required.filter((key) => {
+    const value = args[key];
+    return value === void 0 || value === null || value === "";
+  });
+  if (missing.length > 0) {
+    return `Missing required argument${missing.length > 1 ? "s" : ""}: ${missing.join(", ")}.`;
+  }
+  for (const [key, schema] of Object.entries(tool.inputSchema.properties ?? {})) {
+    const value = args[key];
+    if (value === void 0 || value === null) continue;
+    if (schema.enum && !schema.enum.includes(value)) {
+      return `Invalid value for "${key}": ${JSON.stringify(value)}. Expected one of: ${schema.enum.map((v) => JSON.stringify(v)).join(", ")}.`;
+    }
+  }
+  return null;
+}
+function capabilities() {
+  return { tools: { listChanged: false } };
+}
+function serverInfoBlock(info) {
+  return { name: info.name, version: info.version, ...info.title ? { title: info.title } : {} };
+}
+function isSupportedVersion(version) {
+  return MCP_SUPPORTED_PROTOCOL_VERSIONS.includes(version);
+}
+function unsupportedVersionError(id, requested) {
+  return {
+    status: 400,
+    response: {
+      jsonrpc: "2.0",
+      id,
+      error: {
+        code: MCP_ERROR_UNSUPPORTED_PROTOCOL_VERSION,
+        message: "Unsupported protocol version",
+        data: { supported: [...MCP_SUPPORTED_PROTOCOL_VERSIONS], requested }
+      }
+    }
+  };
+}
+function errorOutcome(id, code, message, status, data) {
+  return {
+    status,
+    response: { jsonrpc: "2.0", id, error: { code, message, ...data ? { data } : {} } }
+  };
+}
+async function dispatch(message, options) {
+  const { server } = options;
+  const id = message.id ?? null;
+  const isNotification = message.id === void 0;
+  const params = message.params ?? {};
+  const meta = params._meta ?? {};
+  const bodyVersion = typeof meta[META_PROTOCOL_VERSION] === "string" ? meta[META_PROTOCOL_VERSION] : null;
+  const headerVersion = options.headerProtocolVersion || null;
+  if (bodyVersion && headerVersion && bodyVersion !== headerVersion) {
+    return errorOutcome(
+      id,
+      MCP_ERROR_HEADER_MISMATCH,
+      `Header mismatch: MCP-Protocol-Version header value '${headerVersion}' does not match body value '${bodyVersion}'`,
+      400
+    );
+  }
+  const requestedVersion = bodyVersion || headerVersion;
+  if (requestedVersion && !isSupportedVersion(requestedVersion)) {
+    return unsupportedVersionError(id, requestedVersion);
+  }
+  if (options.headerMethod && options.headerMethod !== message.method) {
+    return errorOutcome(
+      id,
+      MCP_ERROR_HEADER_MISMATCH,
+      `Header mismatch: Mcp-Method header value '${options.headerMethod}' does not match body value '${message.method}'`,
+      400
+    );
+  }
+  if (options.headerName) {
+    const bodyName = typeof params.name === "string" ? params.name : typeof params.uri === "string" ? params.uri : null;
+    if (bodyName && options.headerName !== bodyName) {
+      return errorOutcome(
+        id,
+        MCP_ERROR_HEADER_MISMATCH,
+        `Header mismatch: Mcp-Name header value '${options.headerName}' does not match body value '${bodyName}'`,
+        400
+      );
+    }
+  }
+  if (options.strictHeaders && bodyVersion) {
+    if (!headerVersion) {
+      return errorOutcome(
+        id,
+        MCP_ERROR_HEADER_MISMATCH,
+        "Header mismatch: required MCP-Protocol-Version header is missing",
+        400
+      );
+    }
+    if (!options.headerMethod) {
+      return errorOutcome(
+        id,
+        MCP_ERROR_HEADER_MISMATCH,
+        "Header mismatch: required Mcp-Method header is missing",
+        400
+      );
+    }
+  }
+  const negotiated = requestedVersion || MCP_PROTOCOL_VERSION_MODERN;
+  switch (message.method) {
+    // ── Modern discovery (MUST implement) ──────────────────────────────────
+    case "server/discover": {
+      return {
+        status: 200,
+        response: {
+          jsonrpc: "2.0",
+          id,
+          result: {
+            resultType: "complete",
+            supportedVersions: [...MCP_SUPPORTED_PROTOCOL_VERSIONS],
+            capabilities: capabilities(),
+            ...server.info.instructions ? { instructions: server.info.instructions } : {},
+            ttlMs: server.discoverTtlMs ?? 36e5,
+            cacheScope: "public",
+            _meta: { [META_SERVER_INFO]: serverInfoBlock(server.info) }
+          }
+        }
+      };
+    }
+    // ── Legacy handshake ───────────────────────────────────────────────────
+    case "initialize": {
+      const asked = typeof params.protocolVersion === "string" ? params.protocolVersion : "";
+      const agreed = isSupportedVersion(asked) ? asked : MCP_PROTOCOL_VERSIONS_LEGACY[0];
+      return {
+        status: 200,
+        response: {
+          jsonrpc: "2.0",
+          id,
+          result: {
+            protocolVersion: agreed,
+            capabilities: capabilities(),
+            serverInfo: serverInfoBlock(server.info),
+            ...server.info.instructions ? { instructions: server.info.instructions } : {}
+          }
+        }
+      };
+    }
+    case "notifications/initialized":
+    case "initialized":
+      return { status: 202, response: null };
+    case "ping":
+      return { status: 200, response: { jsonrpc: "2.0", id, result: {} } };
+    // ── Tools ──────────────────────────────────────────────────────────────
+    case "tools/list": {
+      const tools = server.tools.filter((t) => t.exposeToHttp !== false).map((t) => toToolDescriptor(t));
+      return { status: 200, response: { jsonrpc: "2.0", id, result: { tools } } };
+    }
+    case "tools/call": {
+      const name = typeof params.name === "string" ? params.name : "";
+      const tool = server.tools.find((t) => t.name === name && t.exposeToHttp !== false);
+      if (!tool) {
+        return errorOutcome(
+          id,
+          JSONRPC_INVALID_PARAMS,
+          `Unknown tool: ${name || "(none)"}`,
+          400,
+          {
+            available: server.tools.filter((t) => t.exposeToHttp !== false).map((t) => t.name)
+          }
+        );
+      }
+      const args = params.arguments ?? {};
+      const invalid = validateArgs(tool, args);
+      if (invalid) {
+        return {
+          status: 200,
+          response: { jsonrpc: "2.0", id, result: toolErrorResult(invalid) }
+        };
+      }
+      try {
+        const raw = await tool.handler(args, {
+          ...options.context,
+          surface: "http",
+          protocolVersion: negotiated
+        });
+        return { status: 200, response: { jsonrpc: "2.0", id, result: toToolResult(raw) } };
+      } catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        return {
+          status: 200,
+          response: {
+            jsonrpc: "2.0",
+            id,
+            result: toolErrorResult(`Tool "${tool.name}" failed: ${detail}`)
+          }
+        };
+      }
+    }
+    // Declared unsupported rather than left to fall through, so the error names
+    // the reason instead of looking like a typo'd method.
+    case "resources/list":
+      return { status: 200, response: { jsonrpc: "2.0", id, result: { resources: [] } } };
+    case "prompts/list":
+      return { status: 200, response: { jsonrpc: "2.0", id, result: { prompts: [] } } };
+    default: {
+      if (isNotification) return { status: 202, response: null };
+      return errorOutcome(id, JSONRPC_METHOD_NOT_FOUND, `Method not found: ${message.method}`, 404);
+    }
+  }
+}
+
+// src/mcp/serverCard.ts
+var MCP_SERVER_CARD_SCHEMA = "https://static.modelcontextprotocol.io/schemas/v1/server-card.schema.json";
+var MCP_SERVER_CARD_PATH = "/.well-known/mcp-server-card";
+var MCP_SERVER_CARD_LEGACY_PATH = "/.well-known/mcp.json";
+var SITE_KIT_CARD_META_KEY = "io.sonor.site-kit/tools";
+function buildMcpServerCard(options) {
+  const base = options.baseUrl.replace(/\/$/, "");
+  const path = options.mcpPath ?? "/api/mcp";
+  const mcpUrl = `${base}${path.startsWith("/") ? path : `/${path}`}`;
+  const card = {
+    $schema: MCP_SERVER_CARD_SCHEMA,
+    name: options.info.name,
+    version: options.info.version,
+    description: options.info.description,
+    remotes: [
+      {
+        type: "streamable-http",
+        url: mcpUrl,
+        supportedProtocolVersions: [...MCP_SUPPORTED_PROTOCOL_VERSIONS]
+      },
+      ...options.additionalRemotes ?? []
+    ]
+  };
+  if (options.info.title) card.title = options.info.title;
+  if (options.info.websiteUrl || base) card.websiteUrl = options.info.websiteUrl || base;
+  if (options.icons?.length) card.icons = options.icons;
+  const meta = {};
+  if (options.info.instructions) {
+    meta["io.sonor.site-kit/instructions"] = options.info.instructions;
+  }
+  if (options.tools?.length) {
+    meta[SITE_KIT_CARD_META_KEY] = options.tools.filter((t) => t.exposeToHttp !== false).map((t) => ({
+      name: t.name,
+      ...t.title ? { title: t.title } : {},
+      description: t.description,
+      readOnly: t.annotations?.readOnlyHint ?? false
+    }));
+  }
+  if (Object.keys(meta).length > 0) card._meta = meta;
+  return card;
+}
+function validateMcpServerCard(card) {
+  const problems = [];
+  if (card.$schema !== MCP_SERVER_CARD_SCHEMA) {
+    problems.push(`$schema should be "${MCP_SERVER_CARD_SCHEMA}"`);
+  }
+  if (!/^[^/\s]+\/[^/\s]+$/.test(card.name)) {
+    problems.push(
+      `name "${card.name}" must be reverse-DNS with exactly one forward slash, e.g. "io.example/server"`
+    );
+  }
+  if (!/^\d+\.\d+\.\d+(?:[-+].+)?$/.test(card.version)) {
+    problems.push(`version "${card.version}" should be a concrete semver (no ranges)`);
+  }
+  if (!card.description?.trim()) problems.push("description is required");
+  for (const remote of card.remotes ?? []) {
+    if (!/^https:\/\//.test(remote.url) && !/^http:\/\/localhost/.test(remote.url)) {
+      problems.push(`remote url "${remote.url}" must be https (http allowed only on localhost)`);
+    }
+  }
+  return problems;
+}
+
+// src/mcp/handlers.ts
+var MCP_REQUEST_HEADERS = [
+  "Content-Type",
+  "Accept",
+  "Authorization",
+  "MCP-Protocol-Version",
+  "Mcp-Method",
+  "Mcp-Name",
+  "Mcp-Session-Id",
+  "Last-Event-ID"
+];
+function corsHeaders(origin) {
+  return {
+    "Access-Control-Allow-Origin": origin,
+    "Access-Control-Allow-Methods": "POST, OPTIONS",
+    "Access-Control-Allow-Headers": MCP_REQUEST_HEADERS.join(", "),
+    "Access-Control-Expose-Headers": "MCP-Protocol-Version",
+    "Access-Control-Max-Age": "86400"
+  };
+}
+function decodeHeaderValue(value) {
+  if (!value) return value;
+  const match = /^=\?base64\?(.*)\?=$/.exec(value);
+  if (!match) return value;
+  try {
+    if (typeof atob === "function") {
+      const binary = atob(match[1]);
+      const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0));
+      return new TextDecoder().decode(bytes);
+    }
+    return Buffer.from(match[1], "base64").toString("utf8");
+  } catch {
+    return value;
+  }
+}
+function resolveOrigin(request, allowed) {
+  const origin = request.headers.get("origin");
+  if (!allowed || allowed === "*") return "*";
+  if (!origin) return allowed[0] ?? "*";
+  return allowed.includes(origin) ? origin : null;
+}
+function json(body, status, headers) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "Content-Type": "application/json",
+      "Cache-Control": "no-store",
+      ...headers
+    }
+  });
+}
+function createMcpHandler(options) {
+  const { server } = options;
+  async function POST(request) {
+    const origin = resolveOrigin(request, options.allowedOrigins);
+    if (origin === null) {
+      return json(
+        { jsonrpc: "2.0", error: { code: JSONRPC_INVALID_REQUEST, message: "Origin not allowed" } },
+        403,
+        {}
+      );
+    }
+    const cors = corsHeaders(origin);
+    let payload;
+    try {
+      payload = await request.json();
+    } catch {
+      return json(
+        { jsonrpc: "2.0", id: null, error: { code: JSONRPC_PARSE_ERROR, message: "Parse error" } },
+        400,
+        cors
+      );
+    }
+    const headerProtocolVersion = request.headers.get("mcp-protocol-version");
+    const headerMethod = decodeHeaderValue(request.headers.get("mcp-method"));
+    const headerName = decodeHeaderValue(request.headers.get("mcp-name"));
+    const dispatchOptions = {
+      server,
+      context: {
+        baseUrl: options.baseUrl,
+        request,
+        signal: request.signal
+      },
+      headerProtocolVersion,
+      headerMethod,
+      headerName,
+      strictHeaders: options.strictHeaders
+    };
+    if (Array.isArray(payload)) {
+      const outcomes = await Promise.all(
+        payload.map((m) => dispatch(m, dispatchOptions))
+      );
+      const responses = outcomes.map((o) => o.response).filter(Boolean);
+      if (responses.length === 0) return new Response(null, { status: 202, headers: cors });
+      return json(responses, 200, {
+        ...cors,
+        "MCP-Protocol-Version": headerProtocolVersion || MCP_PROTOCOL_VERSION_MODERN
+      });
+    }
+    const message = payload;
+    if (!message || typeof message !== "object" || typeof message.method !== "string") {
+      const bad = errorOutcome(null, JSONRPC_INVALID_REQUEST, "Invalid Request", 400);
+      return json(bad.response, bad.status, cors);
+    }
+    const outcome = await dispatch(message, dispatchOptions);
+    if (outcome.response === null) {
+      return new Response(null, { status: 202, headers: cors });
+    }
+    return json(outcome.response, outcome.status, {
+      ...cors,
+      "MCP-Protocol-Version": headerProtocolVersion || MCP_PROTOCOL_VERSION_MODERN
+    });
+  }
+  async function methodNotAllowed(request) {
+    const origin = resolveOrigin(request, options.allowedOrigins) ?? "*";
+    return new Response(
+      JSON.stringify({
+        jsonrpc: "2.0",
+        error: {
+          code: JSONRPC_INVALID_REQUEST,
+          message: "This MCP endpoint is stateless and accepts POST only. The GET stream and session teardown were removed in protocol revision 2026-07-28."
+        }
+      }),
+      {
+        status: 405,
+        headers: {
+          "Content-Type": "application/json",
+          Allow: "POST, OPTIONS",
+          ...corsHeaders(origin)
+        }
+      }
+    );
+  }
+  async function OPTIONS(request) {
+    const origin = resolveOrigin(request, options.allowedOrigins);
+    if (origin === null) return new Response(null, { status: 403 });
+    return new Response(null, { status: 204, headers: corsHeaders(origin) });
+  }
+  return { POST, GET: methodNotAllowed, DELETE: methodNotAllowed, OPTIONS };
+}
+function createMcpServerCardHandler(options) {
+  const card = buildMcpServerCard(options);
+  const body = `${JSON.stringify(card, null, 2)}
+`;
+  const maxAge = options.maxAge ?? 3600;
+  const headers = {
+    "Content-Type": "application/json",
+    "Cache-Control": `public, max-age=${maxAge}`,
+    // The card is a discovery document — it is meant to be fetched by anyone.
+    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Methods": "GET, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type"
+  };
+  return {
+    GET: async () => new Response(body, { status: 200, headers }),
+    OPTIONS: async () => new Response(null, { status: 204, headers })
+  };
+}
+
+// src/mcp/declarative.ts
+function declarativeToolForm(options) {
+  const attributes = {
+    toolname: options.name,
+    tooldescription: options.description
+  };
+  if (options.autoSubmit) attributes.toolautosubmit = "";
+  return attributes;
+}
+function declarativeToolField(description) {
+  return { toolparamdescription: description };
+}
+
+exports.JSONRPC_METHOD_NOT_FOUND = JSONRPC_METHOD_NOT_FOUND;
+exports.MCP_ERROR_HEADER_MISMATCH = MCP_ERROR_HEADER_MISMATCH;
+exports.MCP_ERROR_UNSUPPORTED_PROTOCOL_VERSION = MCP_ERROR_UNSUPPORTED_PROTOCOL_VERSION;
+exports.MCP_PROTOCOL_VERSIONS_LEGACY = MCP_PROTOCOL_VERSIONS_LEGACY;
+exports.MCP_PROTOCOL_VERSION_MODERN = MCP_PROTOCOL_VERSION_MODERN;
+exports.MCP_SERVER_CARD_LEGACY_PATH = MCP_SERVER_CARD_LEGACY_PATH;
+exports.MCP_SERVER_CARD_PATH = MCP_SERVER_CARD_PATH;
+exports.MCP_SERVER_CARD_SCHEMA = MCP_SERVER_CARD_SCHEMA;
+exports.MCP_SUPPORTED_PROTOCOL_VERSIONS = MCP_SUPPORTED_PROTOCOL_VERSIONS;
+exports.META_CLIENT_INFO = META_CLIENT_INFO;
+exports.META_PROTOCOL_VERSION = META_PROTOCOL_VERSION;
+exports.META_SERVER_INFO = META_SERVER_INFO;
+exports.SITE_KIT_CARD_META_KEY = SITE_KIT_CARD_META_KEY;
+exports.buildMcpServerCard = buildMcpServerCard;
+exports.createMcpHandler = createMcpHandler;
+exports.createMcpServerCardHandler = createMcpServerCardHandler;
+exports.declarativeToolField = declarativeToolField;
+exports.declarativeToolForm = declarativeToolForm;
+exports.decodeHeaderValue = decodeHeaderValue;
+exports.defineMcpTool = defineMcpTool;
+exports.dispatch = dispatch;
+exports.isSupportedVersion = isSupportedVersion;
+exports.toToolDescriptor = toToolDescriptor;
+exports.toToolResult = toToolResult;
+exports.toolErrorResult = toolErrorResult;
+exports.validateArgs = validateArgs;
+exports.validateMcpServerCard = validateMcpServerCard;
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map