@studiometa/productive-mcp 0.10.9 → 0.10.10

package/dist/http.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"http.js","names":[],"sources":["../src/http.ts"],"sourcesContent":["/**\n * HTTP transport handlers for Productive MCP Server\n *\n * This module contains the app/router creation logic for the HTTP transport.\n * The actual server startup is in server.ts.\n */\n\nimport { H3, defineHandler, type H3Event } from 'h3';\n\nimport { parseAuthHeader } from './auth.js';\nimport { executeToolWithCredentials } from './handlers.js';\nimport { INSTRUCTIONS } from './instructions.js';\nimport {\n  oauthMetadataHandler,\n  registerHandler,\n  authorizeGetHandler,\n  authorizePostHandler,\n  tokenHandler,\n} from './oauth.js';\nimport { listResources, listResourceTemplates, readResource } from './resources.js';\nimport { TOOLS } from './tools.js';\nimport { VERSION } from './version.js';\n\n/**\n * JSON-RPC error response\n */\nexport function jsonRpcError(code: number, message: string, id: string | number | null = null) {\n  return {\n    jsonrpc: '2.0',\n    error: { code, message },\n    id,\n  };\n}\n\n/**\n * JSON-RPC success response\n */\nexport function jsonRpcSuccess(result: unknown, id: string | number | null = null) {\n  return {\n    jsonrpc: '2.0',\n    result,\n    id,\n  };\n}\n\n/**\n * Handle the initialize JSON-RPC method\n */\nexport function handleInitialize() {\n  return {\n    protocolVersion: '2024-11-05',\n    serverInfo: {\n      name: 'productive-mcp',\n      version: VERSION,\n    },\n    capabilities: {\n      tools: {},\n      resources: {},\n    },\n    instructions: INSTRUCTIONS,\n  };\n}\n\n/**\n * Handle the tools/list JSON-RPC method\n */\nexport function handleToolsList() {\n  return { tools: TOOLS };\n}\n\n/**\n * Get base URL from event headers\n */\nfunction getBaseUrl(event: H3Event): string {\n  const host = event.req.headers.get('host') || 'localhost:3000';\n  const protocol = event.req.headers.get('x-forwarded-proto') || 'http';\n  return `${protocol}://${host}`;\n}\n\n/**\n * Create the H3 application with all routes\n */\nexport function createHttpApp(): H3 {\n  const app = new H3();\n\n  // OAuth 2.0 endpoints for Claude Desktop integration (MCP auth spec)\n  app.get('/.well-known/oauth-authorization-server', oauthMetadataHandler);\n  app.post('/register', registerHandler); // Dynamic Client Registration (RFC 7591)\n  app.get('/authorize', authorizeGetHandler);\n  app.post('/authorize', authorizePostHandler);\n  app.post('/token', tokenHandler);\n\n  // OAuth Protected Resource Metadata (RFC 9728 / MCP spec 2025-03-26)\n  // This endpoint tells clients where to find the authorization server\n  app.get(\n    '/.well-known/oauth-protected-resource',\n    defineHandler((event) => {\n      const baseUrl = getBaseUrl(event);\n\n      event.res.headers.set('Content-Type', 'application/json');\n      event.res.headers.set('Cache-Control', 'public, max-age=3600');\n\n      return {\n        resource: `${baseUrl}/mcp`,\n        authorization_servers: [baseUrl],\n        scopes_supported: ['productive'],\n        bearer_methods_supported: ['header'],\n      };\n    }),\n  );\n\n  // Health check endpoint\n  app.get(\n    '/',\n    defineHandler(() => {\n      return { status: 'ok', service: 'productive-mcp', version: VERSION };\n    }),\n  );\n\n  app.get(\n    '/health',\n    defineHandler(() => {\n      return { status: 'ok' };\n    }),\n  );\n\n  // MCP endpoint - handles JSON-RPC over HTTP\n  app.post(\n    '/mcp',\n    defineHandler(async (event) => {\n      // Parse authorization header\n      const authHeader = event.req.headers.get('authorization');\n      const credentials = parseAuthHeader(authHeader);\n\n      if (!credentials) {\n        // RFC 6750: Return WWW-Authenticate header to trigger OAuth flow\n        const baseUrl = getBaseUrl(event);\n\n        event.res.headers.set('Content-Type', 'application/json');\n        event.res.headers.set(\n          'WWW-Authenticate',\n          `Bearer resource_metadata=\"${baseUrl}/.well-known/oauth-protected-resource\"`,\n        );\n        event.res.status = 401;\n        return jsonRpcError(\n          -32001,\n          'Authentication required. Provide Bearer token with base64(organizationId:apiToken:userId)',\n        );\n      }\n\n      event.res.headers.set('Content-Type', 'application/json');\n\n      // Parse JSON-RPC request\n      let body: { method?: string; params?: unknown; id?: string | number } | undefined;\n      try {\n        body = await event.req.json();\n      } catch {\n        event.res.status = 400;\n        return jsonRpcError(-32700, 'Parse error: Invalid JSON');\n      }\n\n      if (!body || typeof body !== 'object') {\n        event.res.status = 400;\n        return jsonRpcError(-32700, 'Parse error: Invalid JSON');\n      }\n\n      const { method, params, id } = body;\n\n      try {\n        if (method === 'initialize') {\n          return jsonRpcSuccess(handleInitialize(), id ?? null);\n        }\n\n        if (method === 'tools/list') {\n          return jsonRpcSuccess(handleToolsList(), id ?? null);\n        }\n\n        if (method === 'tools/call') {\n          const { name, arguments: args } = params as {\n            name: string;\n            arguments?: Record<string, unknown>;\n          };\n          const result = await executeToolWithCredentials(name, args || {}, credentials);\n          return jsonRpcSuccess(result, id ?? null);\n        }\n\n        if (method === 'resources/list') {\n          return jsonRpcSuccess({ resources: listResources() }, id ?? null);\n        }\n\n        if (method === 'resources/templates/list') {\n          return jsonRpcSuccess({ resourceTemplates: listResourceTemplates() }, id ?? null);\n        }\n\n        if (method === 'resources/read') {\n          const { uri } = (params as { uri: string }) ?? {};\n          if (!uri) {\n            return jsonRpcError(-32602, 'Invalid params: uri is required', id ?? null);\n          }\n          const result = await readResource(uri, credentials);\n          return jsonRpcSuccess(result, id ?? null);\n        }\n\n        // Unknown method\n        return jsonRpcError(-32601, `Method not found: ${method}`, id ?? null);\n      } catch (error) {\n        const message = error instanceof Error ? error.message : String(error);\n        return jsonRpcError(-32603, `Internal error: ${message}`, id ?? null);\n      }\n    }),\n  );\n\n  // SSE endpoint for server-sent events (optional, for streaming responses)\n  app.get(\n    '/mcp/sse',\n    defineHandler(async (event) => {\n      const authHeader = event.req.headers.get('authorization');\n      const credentials = parseAuthHeader(authHeader);\n\n      if (!credentials) {\n        // RFC 6750: Return WWW-Authenticate header to trigger OAuth flow\n        const baseUrl = getBaseUrl(event);\n\n        event.res.headers.set(\n          'WWW-Authenticate',\n          `Bearer resource_metadata=\"${baseUrl}/.well-known/oauth-protected-resource\"`,\n        );\n        event.res.status = 401;\n        return { error: 'Authentication required' };\n      }\n\n      // Node.js-specific SSE: access raw res for streaming\n      const nodeRuntime = event.runtime?.node;\n      const nodeRes = nodeRuntime?.res as import('node:http').ServerResponse | undefined;\n      if (!nodeRes) {\n        event.res.status = 501;\n        return { error: 'SSE requires Node.js runtime' };\n      }\n\n      // Write SSE headers directly to Node.js response (bypassing h3's pipeline)\n      nodeRes.writeHead(200, {\n        'Content-Type': 'text/event-stream',\n        'Cache-Control': 'no-cache',\n        Connection: 'keep-alive',\n      });\n\n      // Generate session ID and send it\n      const sessionId = crypto.randomUUID();\n\n      // Send initial session event\n      nodeRes.write(`event: session\\ndata: ${JSON.stringify({ sessionId })}\\n\\n`);\n\n      // Keep connection alive\n      const keepAlive = setInterval(() => {\n        nodeRes.write(': keepalive\\n\\n');\n      }, 30000);\n\n      // Clean up on close\n      nodeRuntime?.req.on('close', () => {\n        clearInterval(keepAlive);\n      });\n\n      // Don't end the response - keep it open for SSE\n      return new Promise(() => {});\n    }),\n  );\n\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;AA0BA,SAAgB,aAAa,MAAc,SAAiB,KAA6B,MAAM;AAC7F,QAAO;EACL,SAAS;EACT,OAAO;GAAE;GAAM;GAAS;EACxB;EACD;;;;;AAMH,SAAgB,eAAe,QAAiB,KAA6B,MAAM;AACjF,QAAO;EACL,SAAS;EACT;EACA;EACD;;;;;AAMH,SAAgB,mBAAmB;AACjC,QAAO;EACL,iBAAiB;EACjB,YAAY;GACV,MAAM;GACN,SAAS;GACV;EACD,cAAc;GACZ,OAAO,EAAE;GACT,WAAW,EAAE;GACd;EACD,cAAc;EACf;;;;;AAMH,SAAgB,kBAAkB;AAChC,QAAO,EAAE,OAAO,OAAO;;;;;AAMzB,SAAS,WAAW,OAAwB;CAC1C,MAAM,OAAO,MAAM,IAAI,QAAQ,IAAI,OAAO,IAAI;AAE9C,QAAO,GADU,MAAM,IAAI,QAAQ,IAAI,oBAAoB,IAAI,OAC5C,KAAK;;;;;AAM1B,SAAgB,gBAAoB;CAClC,MAAM,MAAM,IAAI,IAAI;AAGpB,KAAI,IAAI,2CAA2C,qBAAqB;AACxE,KAAI,KAAK,aAAa,gBAAgB;AACtC,KAAI,IAAI,cAAc,oBAAoB;AAC1C,KAAI,KAAK,cAAc,qBAAqB;AAC5C,KAAI,KAAK,UAAU,aAAa;AAIhC,KAAI,IACF,yCACA,eAAe,UAAU;EACvB,MAAM,UAAU,WAAW,MAAM;AAEjC,QAAM,IAAI,QAAQ,IAAI,gBAAgB,mBAAmB;AACzD,QAAM,IAAI,QAAQ,IAAI,iBAAiB,uBAAuB;AAE9D,SAAO;GACL,UAAU,GAAG,QAAQ;GACrB,uBAAuB,CAAC,QAAQ;GAChC,kBAAkB,CAAC,aAAa;GAChC,0BAA0B,CAAC,SAAS;GACrC;GACD,CACH;AAGD,KAAI,IACF,KACA,oBAAoB;AAClB,SAAO;GAAE,QAAQ;GAAM,SAAS;GAAkB,SAAS;GAAS;GACpE,CACH;AAED,KAAI,IACF,WACA,oBAAoB;AAClB,SAAO,EAAE,QAAQ,MAAM;GACvB,CACH;AAGD,KAAI,KACF,QACA,cAAc,OAAO,UAAU;EAG7B,MAAM,cAAc,gBADD,MAAM,IAAI,QAAQ,IAAI,gBAAgB,CACV;AAE/C,MAAI,CAAC,aAAa;GAEhB,MAAM,UAAU,WAAW,MAAM;AAEjC,SAAM,IAAI,QAAQ,IAAI,gBAAgB,mBAAmB;AACzD,SAAM,IAAI,QAAQ,IAChB,oBACA,6BAA6B,QAAQ,wCACtC;AACD,SAAM,IAAI,SAAS;AACnB,UAAO,aACL,QACA,4FACD;;AAGH,QAAM,IAAI,QAAQ,IAAI,gBAAgB,mBAAmB;EAGzD,IAAI;AACJ,MAAI;AACF,UAAO,MAAM,MAAM,IAAI,MAAM;UACvB;AACN,SAAM,IAAI,SAAS;AACnB,UAAO,aAAa,QAAQ,4BAA4B;;AAG1D,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,SAAM,IAAI,SAAS;AACnB,UAAO,aAAa,QAAQ,4BAA4B;;EAG1D,MAAM,EAAE,QAAQ,QAAQ,OAAO;AAE/B,MAAI;AACF,OAAI,WAAW,aACb,QAAO,eAAe,kBAAkB,EAAE,MAAM,KAAK;AAGvD,OAAI,WAAW,aACb,QAAO,eAAe,iBAAiB,EAAE,MAAM,KAAK;AAGtD,OAAI,WAAW,cAAc;IAC3B,MAAM,EAAE,MAAM,WAAW,SAAS;AAKlC,WAAO,eADQ,MAAM,2BAA2B,MAAM,QAAQ,EAAE,EAAE,YAAY,EAChD,MAAM,KAAK;;AAG3C,OAAI,WAAW,iBACb,QAAO,eAAe,EAAE,WAAW,eAAe,EAAE,EAAE,MAAM,KAAK;AAGnE,OAAI,WAAW,2BACb,QAAO,eAAe,EAAE,mBAAmB,uBAAuB,EAAE,EAAE,MAAM,KAAK;AAGnF,OAAI,WAAW,kBAAkB;IAC/B,MAAM,EAAE,QAAS,UAA8B,EAAE;AACjD,QAAI,CAAC,IACH,QAAO,aAAa,QAAQ,mCAAmC,MAAM,KAAK;AAG5E,WAAO,eADQ,MAAM,aAAa,KAAK,YAAY,EACrB,MAAM,KAAK;;AAI3C,UAAO,aAAa,QAAQ,qBAAqB,UAAU,MAAM,KAAK;WAC/D,OAAO;AAEd,UAAO,aAAa,QAAQ,mBADZ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,IACZ,MAAM,KAAK;;GAEvE,CACH;AAGD,KAAI,IACF,YACA,cAAc,OAAO,UAAU;AAI7B,MAAI,CAFgB,gBADD,MAAM,IAAI,QAAQ,IAAI,gBAAgB,CACV,EAE7B;GAEhB,MAAM,UAAU,WAAW,MAAM;AAEjC,SAAM,IAAI,QAAQ,IAChB,oBACA,6BAA6B,QAAQ,wCACtC;AACD,SAAM,IAAI,SAAS;AACnB,UAAO,EAAE,OAAO,2BAA2B;;EAI7C,MAAM,cAAc,MAAM,SAAS;EACnC,MAAM,UAAU,aAAa;AAC7B,MAAI,CAAC,SAAS;AACZ,SAAM,IAAI,SAAS;AACnB,UAAO,EAAE,OAAO,gCAAgC;;AAIlD,UAAQ,UAAU,KAAK;GACrB,gBAAgB;GAChB,iBAAiB;GACjB,YAAY;GACb,CAAC;EAGF,MAAM,YAAY,OAAO,YAAY;AAGrC,UAAQ,MAAM,yBAAyB,KAAK,UAAU,EAAE,WAAW,CAAC,CAAC,MAAM;EAG3E,MAAM,YAAY,kBAAkB;AAClC,WAAQ,MAAM,kBAAkB;KAC/B,IAAM;AAGT,eAAa,IAAI,GAAG,eAAe;AACjC,iBAAc,UAAU;IACxB;AAGF,SAAO,IAAI,cAAc,GAAG;GAC5B,CACH;AAED,QAAO"}