@superblocksteam/mcp-server 2.0.0-SNAPSHOT.12e637302a23edc8

package/dist/entitlement.js

@@ -0,0 +1,246 @@
+import { createHash } from "node:crypto";
+import { ServerApiError, callServerApi } from "./tools/server-api.js";
+const ENTITLED_PLANS = new Set(["ENTERPRISE", "POC"]);
+const PLAN_PATH = "api/v1/public/users/me";
+/**
+ * How long a plan verdict is trusted before the API is asked again.
+ *
+ * A plan is not something that changes between two tool calls, and an upgrade
+ * or downgrade landing within a minute is well inside what anyone notices.
+ */
+const DEFAULT_CACHE_TTL_MS = 60_000;
+/**
+ * How long one caller waits for a plan read before giving up on this call.
+ *
+ * This read gates every Admin tool call, so it must fail long before the
+ * caller does. It had no bound at all, which is how one wedged route took the
+ * whole Admin surface down with it (ENG-5806).
+ *
+ * The read is *not* cancelled at this point — see {@link DEFAULT_READ_TIMEOUT_MS}.
+ */
+const DEFAULT_CALLER_WAIT_MS = 10_000;
+/**
+ * How long the read itself is given, which is deliberately longer than the
+ * caller waits.
+ *
+ * Aborting the read at the caller's deadline would mean an endpoint that
+ * answers slowly rather than never can never fill the cache: every read is
+ * killed just short of succeeding, so the breaker stays open and a recoverable
+ * slowdown becomes a permanent outage — strictly worse than the unbounded read
+ * this replaced, which at least eventually returned. ENG-5805 measures ~20s on
+ * the endpoint this gates on, which is exactly that window.
+ *
+ * So the caller stops waiting at 10s and the read keeps going, filling the
+ * cache for whoever calls next. Matches `DEFAULT_IDENTITY_TIMEOUT_MS` on the
+ * Builder side, for the same reason.
+ */
+const DEFAULT_READ_TIMEOUT_MS = 30_000;
+/** How long later calls fail fast after a plan read failed. */
+const DEFAULT_COOLDOWN_MS = 30_000;
+/**
+ * Whether a failed plan read means the control plane is unhealthy, rather than
+ * that this one credential was rejected.
+ *
+ * The Builder side has always drawn this line (`identityEndpointUnhealthy`);
+ * this side treated every failure as an outage, so a single expired token
+ * opened the breaker and every *other* caller then failed fast for the
+ * cooldown. A 4xx is a definite answer about one caller and must not do that.
+ *
+ * 429 is the exception, as on the Builder side: a shared rate limit is about
+ * the route's capacity, not about this credential.
+ */
+function planEndpointUnhealthy(error) {
+    return !(error instanceof ServerApiError &&
+        error.status < 500 &&
+        error.status !== 429);
+}
+/**
+ * A deadline a caller can stop waiting at without cancelling what it waits on.
+ */
+function callerDeadline(ms) {
+    let timer;
+    const expired = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new PlanCheckUnavailableError()), ms);
+    });
+    return { cancel: () => clearTimeout(timer), expired };
+}
+export class EntitlementError extends Error {
+    plan;
+    constructor(plan) {
+        const planLabel = plan ?? "unknown";
+        super(`The Superblocks MCP server requires an Enterprise or POC plan. ` +
+            `Your organization is on the ${planLabel} plan. ` +
+            `Contact sales to upgrade: https://www.superblocks.com/contact-sales`);
+        this.name = "EntitlementError";
+        this.plan = plan;
+    }
+}
+/**
+ * The plan could not be read, so nothing is known about the entitlement.
+ *
+ * Distinct from {@link EntitlementError}, which is a definite answer that the
+ * org is on the wrong plan. This one means try again; that one means upgrade.
+ */
+export class PlanCheckUnavailableError extends Error {
+    constructor(cause) {
+        const detail = cause instanceof Error && cause.message ? `: ${cause.message}` : "";
+        super(`Superblocks could not confirm your organization's plan${detail}. ` +
+            `This is usually transient - try again in a moment.`);
+        this.name = "PlanCheckUnavailableError";
+        this.cause = cause;
+    }
+}
+/**
+ * Reads the plan out of a `/users/me` envelope.
+ *
+ * Returns `{ readable: false }` when the response is not shaped like that
+ * envelope at all, which is a degraded or truncated answer rather than a
+ * statement about billing. Caching that as a definite verdict told the caller
+ * to upgrade their plan for 60s because the control plane was unwell.
+ *
+ * A well-formed envelope whose org genuinely carries no plan *is* a definite
+ * answer, and stays one.
+ */
+function readPlanFromEnvelope(data) {
+    if (data === null || typeof data !== "object") {
+        return { readable: false };
+    }
+    const organizations = data.organizations;
+    // No `organizations` array at all is not a `/users/me` answer. An *empty*
+    // one is: that caller is genuinely in no organization.
+    if (!Array.isArray(organizations)) {
+        return { readable: false };
+    }
+    return { plan: organizations[0]?.billing?.plan, readable: true };
+}
+/**
+ * The plan check that gates every Admin tool call, made cheap and bounded.
+ *
+ * Read straight through it was one uncached, unbounded `GET /users/me` per tool
+ * call, failing closed. So when that route wedged, every Admin tool went with
+ * it -- including `list_integrations`, which needs nothing but plain REST --
+ * and each call waited on the socket rather than on any deadline of its own.
+ *
+ * Same four measures the Builder side needs, for the same reason:
+ *
+ * - **Cache** the verdict, refusals included, so a poll loop reads the plan
+ *   once per TTL instead of once per call.
+ * - **Collapse** concurrent callers onto one read, so a burst does not
+ *   multiply load on a route that is already struggling.
+ * - **Caller deadline**, so a wedged route cannot hold a tool call open. The
+ *   read keeps running past it, so a route that answers slowly rather than
+ *   never still fills the cache instead of being killed just short of
+ *   succeeding on every attempt.
+ * - **Break** after a failed read, so later calls fail fast instead of each
+ *   discovering the same outage the slow way.
+ *
+ * Only a failed *read of an unhealthy endpoint* opens the breaker, and only for
+ * the control plane it failed on. Being on the wrong plan, or presenting a
+ * credential the API rejects, is a definite answer about one caller and must
+ * not fail everyone else fast.
+ */
+export function createPlanEntitlement(options = {}) {
+    const now = options.now ?? Date.now;
+    const cacheTtlMs = options.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS;
+    const callerWaitMs = options.callerWaitMs ?? DEFAULT_CALLER_WAIT_MS;
+    const cooldownMs = options.cooldownMs ?? DEFAULT_COOLDOWN_MS;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_READ_TIMEOUT_MS;
+    // The plan belongs to the org behind the credential, on one control plane.
+    // The credential is hashed so raw tokens are not held as map keys.
+    const verdicts = new Map();
+    const inflight = new Map();
+    // Keyed by control plane, because that is what the breaker is a statement
+    // about. `baseUrl` comes from the tool's own arguments, so one scalar here
+    // let an outage on one control plane fail calls against every other,
+    // healthy one.
+    const failFastUntil = new Map();
+    function cacheKey(baseUrl, token) {
+        return `${baseUrl}\n${createHash("sha256").update(token).digest("hex")}`;
+    }
+    function readPlan(key, baseUrl, token) {
+        const pending = (async () => {
+            try {
+                const data = await callServerApi({
+                    baseUrl,
+                    method: "GET",
+                    path: PLAN_PATH,
+                    timeoutMs,
+                    token,
+                });
+                const envelope = readPlanFromEnvelope(data);
+                if (!envelope.readable) {
+                    // A 200 that is not a `/users/me` envelope means the read did not
+                    // land, so this is an outage, not a verdict. Not cached.
+                    throw new PlanCheckUnavailableError(new Error("the plan was missing from the response"));
+                }
+                failFastUntil.delete(baseUrl);
+                verdicts.set(key, {
+                    expiresAt: now() + cacheTtlMs,
+                    plan: envelope.plan,
+                });
+                return envelope.plan;
+            }
+            catch (error) {
+                // Only an unhealthy endpoint opens the breaker. A 4xx is a definite
+                // answer about this one caller, so it must not fail everyone else fast.
+                if (planEndpointUnhealthy(error)) {
+                    failFastUntil.set(baseUrl, now() + cooldownMs);
+                }
+                throw error instanceof PlanCheckUnavailableError
+                    ? error
+                    : new PlanCheckUnavailableError(error);
+            }
+            finally {
+                inflight.delete(key);
+            }
+        })();
+        inflight.set(key, pending);
+        return pending;
+    }
+    return {
+        async assert(baseUrl, token) {
+            const key = cacheKey(baseUrl, token);
+            const cached = verdicts.get(key);
+            if (cached && cached.expiresAt > now()) {
+                assertEntitled(cached.plan);
+                return;
+            }
+            verdicts.delete(key);
+            // A read already running is the one to wait on even while the breaker
+            // is open: it is the probe that will close it.
+            let pending = inflight.get(key);
+            if (!pending) {
+                const openUntil = failFastUntil.get(baseUrl) ?? 0;
+                if (openUntil > now()) {
+                    throw new PlanCheckUnavailableError();
+                }
+                pending = readPlan(key, baseUrl, token);
+            }
+            // Race, rather than await: this caller stops waiting at its own
+            // deadline while the read carries on to fill the cache. Promise.race
+            // also keeps a rejection handler on `pending` for its whole life, so a
+            // read that fails after this caller gave up stays handled.
+            const deadline = callerDeadline(callerWaitMs);
+            try {
+                assertEntitled(await Promise.race([pending, deadline.expired]));
+            }
+            finally {
+                deadline.cancel();
+            }
+        },
+    };
+}
+function assertEntitled(plan) {
+    if (!plan || !ENTITLED_PLANS.has(plan)) {
+        throw new EntitlementError(plan);
+    }
+}
+/**
+ * The process-wide plan check. Sharing one instance is the point: the cache and
+ * the breaker only help if every Admin tool call goes through the same one.
+ */
+const sharedPlanEntitlement = createPlanEntitlement();
+export async function assertEnterprisePlan(baseUrl, token) {
+    return sharedPlanEntitlement.assert(baseUrl, token);
+}
+//# sourceMappingURL=entitlement.js.map

package/dist/entitlement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlement.js","sourceRoot":"","sources":["../src/entitlement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;AAEtD,MAAM,SAAS,GAAG,wBAAwB,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAEtC;;;;;;;;;;;;;;GAcG;AACH,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC,+DAA+D;AAC/D,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,CAAC,CACN,KAAK,YAAY,cAAc;QAC/B,KAAK,CAAC,MAAM,GAAG,GAAG;QAClB,KAAK,CAAC,MAAM,KAAK,GAAG,CACrB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,EAAU;IAIhC,IAAI,KAAgD,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACtD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,yBAAyB,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AACxD,CAAC;AAMD,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAqB;IAElC,YAAY,IAAwB;QAClC,MAAM,SAAS,GAAG,IAAI,IAAI,SAAS,CAAC;QACpC,KAAK,CACH,iEAAiE;YAC/D,+BAA+B,SAAS,SAAS;YACjD,qEAAqE,CACxE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,KAAe;QACzB,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,KAAK,CACH,yDAAyD,MAAM,IAAI;YACjE,oDAAoD,CACvD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAYD;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAC3B,IAAa;IAEb,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IACD,MAAM,aAAa,GAAI,IAAsB,CAAC,aAAa,CAAC;IAC5D,0EAA0E;IAC1E,uDAAuD;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACnE,CAAC;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkC,EAAE;IAEpC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,oBAAoB,CAAC;IAC9D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;IACpE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAE/D,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgD,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuC,CAAC;IAChE,0EAA0E;IAC1E,2EAA2E;IAC3E,qEAAqE;IACrE,eAAe;IACf,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEhD,SAAS,QAAQ,CAAC,OAAe,EAAE,KAAa;QAC9C,OAAO,GAAG,OAAO,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,SAAS,QAAQ,CACf,GAAW,EACX,OAAe,EACf,KAAa;QAEb,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC;oBAC/B,OAAO;oBACP,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,SAAS;oBACf,SAAS;oBACT,KAAK;iBACN,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;gBAC5C,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;oBACvB,kEAAkE;oBAClE,yDAAyD;oBACzD,MAAM,IAAI,yBAAyB,CACjC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CACpD,CAAC;gBACJ,CAAC;gBACD,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC9B,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE;oBAChB,SAAS,EAAE,GAAG,EAAE,GAAG,UAAU;oBAC7B,IAAI,EAAE,QAAQ,CAAC,IAAI;iBACpB,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC,IAAI,CAAC;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,oEAAoE;gBACpE,wEAAwE;gBACxE,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC;gBACjD,CAAC;gBACD,MAAM,KAAK,YAAY,yBAAyB;oBAC9C,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,IAAI,yBAAyB,CAAC,KAAK,CAAC,CAAC;YAC3C,CAAC;oBAAS,CAAC;gBACT,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,KAAa;YACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,EAAE,CAAC;gBACvC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAErB,sEAAsE;YACtE,+CAA+C;YAC/C,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAClD,IAAI,SAAS,GAAG,GAAG,EAAE,EAAE,CAAC;oBACtB,MAAM,IAAI,yBAAyB,EAAE,CAAC;gBACxC,CAAC;gBACD,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;YAED,gEAAgE;YAChE,qEAAqE;YACrE,uEAAuE;YACvE,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,CAAC;gBACH,cAAc,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAClE,CAAC;oBAAS,CAAC;gBACT,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,qBAAqB,GAAG,qBAAqB,EAAE,CAAC;AAEtD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,KAAa;IAEb,OAAO,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACtD,CAAC"}

package/dist/http.d.ts

@@ -0,0 +1,9 @@
+import { type Profile } from "./tools/index.js";
+export type HttpServerOptions = {
+    profile?: Profile;
+    port?: number;
+    authToken?: string;
+    waitUntilClose?: boolean;
+};
+export declare function startHttpServer(options?: HttpServerOptions): Promise<void>;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAgBA,OAAO,EAGL,KAAK,OAAO,EACb,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAuDF,wBAAsB,eAAe,CACnC,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAuRf"}

package/dist/http.js

@@ -0,0 +1,299 @@
+import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
+import { createServer, } from "node:http";
+import pkg from "../package.json" with { type: "json" };
+import { handleJsonRpc, invalidRequestResponse, isJsonRpcRequest, } from "./jsonrpc.js";
+import { resolveProfile } from "./profile.js";
+import { executeToolCall } from "./tool-call-result.js";
+import { buildToolRegistry, toolDefinitions, } from "./tools/index.js";
+const MAX_BODY_BYTES = 1_000_000;
+function collectBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let totalBytes = 0;
+        let settled = false;
+        const finalizeReject = (error) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            reject(error);
+        };
+        const finalizeResolve = (body) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            resolve(body);
+        };
+        req.on("data", (chunk) => {
+            if (settled) {
+                return;
+            }
+            totalBytes += chunk.length;
+            if (totalBytes > MAX_BODY_BYTES) {
+                req.pause();
+                finalizeReject(new Error("Request body too large"));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on("end", () => {
+            finalizeResolve(Buffer.concat(chunks).toString("utf-8"));
+        });
+        req.on("error", (error) => {
+            finalizeReject(error instanceof Error ? error : new Error(String(error)));
+        });
+    });
+}
+function constantTimeTokenEquals(expected, provided) {
+    // Hash both inputs first so timingSafeEqual always compares fixed-length data.
+    const key = "superblocks-mcp-http-auth-compare-v1";
+    const expectedDigest = createHmac("sha256", key).update(expected).digest();
+    const providedDigest = createHmac("sha256", key).update(provided).digest();
+    return timingSafeEqual(expectedDigest, providedDigest);
+}
+export async function startHttpServer(options = {}) {
+    const port = options.port ?? 8484;
+    const profile = options.profile ?? resolveProfile();
+    const waitUntilClose = options.waitUntilClose ?? false;
+    const authToken = options.authToken ?? process.env.SUPERBLOCKS_MCP_HTTP_TOKEN;
+    if (!authToken) {
+        throw new Error("HTTP transport requires auth token. Pass authToken option or set SUPERBLOCKS_MCP_HTTP_TOKEN.");
+    }
+    const registry = buildToolRegistry(toolDefinitions, profile);
+    const jsonRpcOptions = {
+        version: pkg.version,
+        listTools: () => registry.listTools(),
+        executeToolCall: (name, args) => executeToolCall(name, args, registry),
+    };
+    const ALLOWED_ORIGINS = new Set([
+        "http://localhost",
+        "http://127.0.0.1",
+        "https://localhost",
+        "https://127.0.0.1",
+    ]);
+    function corsOrigin(req) {
+        const origin = req.headers.origin;
+        if (!origin)
+            return undefined;
+        try {
+            const { protocol, hostname } = new URL(origin);
+            const base = `${protocol}//${hostname}`;
+            return ALLOWED_ORIGINS.has(base) ? origin : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    function isAuthorized(req) {
+        const authorization = req.headers.authorization;
+        if (!authorization?.startsWith("Bearer ")) {
+            return false;
+        }
+        const providedToken = authorization.slice("Bearer ".length);
+        return constantTimeTokenEquals(authToken, providedToken);
+    }
+    function resolveSessionId(req) {
+        const header = req.headers["mcp-session-id"];
+        if (typeof header === "string" && header.length > 0) {
+            return header;
+        }
+        if (Array.isArray(header) &&
+            typeof header[0] === "string" &&
+            header[0].length > 0) {
+            return header[0];
+        }
+        return randomUUID();
+    }
+    const httpServer = createServer((req, res) => {
+        void (async () => {
+            const requestUrl = new URL(req.url ?? "", "http://127.0.0.1");
+            const allowed = corsOrigin(req);
+            if (allowed) {
+                res.setHeader("Access-Control-Allow-Origin", allowed);
+                res.setHeader("Vary", "Origin");
+                res.setHeader("Access-Control-Allow-Headers", "Authorization, Content-Type, Mcp-Session-Id");
+                res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id");
+                res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+            }
+            if (requestUrl.pathname !== "/mcp") {
+                res.writeHead(404, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Not found" }));
+                return;
+            }
+            if (req.method === "OPTIONS") {
+                if (!allowed) {
+                    res.writeHead(403, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "Origin not allowed" }));
+                    return;
+                }
+                res.writeHead(204);
+                res.end();
+                return;
+            }
+            if (!isAuthorized(req)) {
+                res.writeHead(401, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Unauthorized" }));
+                return;
+            }
+            if (req.method === "POST") {
+                let body;
+                try {
+                    body = await collectBody(req);
+                }
+                catch (error) {
+                    if (error instanceof Error &&
+                        error.message === "Request body too large") {
+                        res.writeHead(413, {
+                            "Content-Type": "application/json",
+                            Connection: "close",
+                        });
+                        res.end(JSON.stringify({ error: "Request body too large" }), () => {
+                            if (!req.destroyed) {
+                                req.destroy();
+                            }
+                        });
+                        return;
+                    }
+                    throw error;
+                }
+                let parsed;
+                try {
+                    parsed = JSON.parse(body);
+                }
+                catch {
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "Invalid JSON" }));
+                    return;
+                }
+                const sessionId = resolveSessionId(req);
+                if (Array.isArray(parsed)) {
+                    if (parsed.length === 0) {
+                        res.writeHead(200, {
+                            "Content-Type": "application/json",
+                            "Mcp-Session-Id": sessionId,
+                        });
+                        res.end(JSON.stringify(invalidRequestResponse()));
+                        return;
+                    }
+                    const results = (await Promise.all(parsed.map((r) => isJsonRpcRequest(r)
+                        ? handleJsonRpc(r, jsonRpcOptions)
+                        : Promise.resolve(invalidRequestResponse())))).filter((r) => r !== null);
+                    if (results.length === 0) {
+                        res.writeHead(202);
+                        res.end();
+                    }
+                    else {
+                        res.writeHead(200, {
+                            "Content-Type": "application/json",
+                            "Mcp-Session-Id": sessionId,
+                        });
+                        res.end(JSON.stringify(results));
+                    }
+                }
+                else {
+                    const result = isJsonRpcRequest(parsed)
+                        ? await handleJsonRpc(parsed, jsonRpcOptions)
+                        : invalidRequestResponse();
+                    if (result === null) {
+                        res.writeHead(202);
+                        res.end();
+                    }
+                    else {
+                        res.writeHead(200, {
+                            "Content-Type": "application/json",
+                            "Mcp-Session-Id": sessionId,
+                        });
+                        res.end(JSON.stringify(result));
+                    }
+                }
+                return;
+            }
+            if (req.method === "GET") {
+                // Placeholder SSE endpoint for MCP Streamable HTTP compatibility.
+                // This endpoint currently sends heartbeat frames only.
+                const sessionId = resolveSessionId(req);
+                let closed = false;
+                const cleanup = () => {
+                    if (closed) {
+                        return;
+                    }
+                    closed = true;
+                    clearInterval(heartbeat);
+                    if (!res.writableEnded) {
+                        res.end();
+                    }
+                };
+                res.writeHead(200, {
+                    "Content-Type": "text/event-stream",
+                    "Cache-Control": "no-cache",
+                    Connection: "keep-alive",
+                    "Mcp-Session-Id": sessionId,
+                });
+                res.write(":\n\n");
+                const heartbeat = setInterval(() => {
+                    if (closed || res.destroyed || res.writableEnded) {
+                        cleanup();
+                        return;
+                    }
+                    try {
+                        res.write(":\n\n");
+                    }
+                    catch (error) {
+                        console.error("SSE heartbeat write failed:", error);
+                        cleanup();
+                    }
+                }, 30_000);
+                req.on("close", cleanup);
+                req.on("aborted", cleanup);
+                res.on("close", cleanup);
+                res.on("error", (error) => {
+                    console.error("SSE response stream error:", error);
+                    cleanup();
+                });
+                return;
+            }
+            if (req.method === "DELETE") {
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ok: true }));
+                return;
+            }
+            res.writeHead(405, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Method not allowed" }));
+        })().catch((err) => {
+            console.error("Unhandled error in MCP HTTP handler:", err);
+            if (res.headersSent) {
+                if (!res.writableEnded) {
+                    res.end();
+                }
+                return;
+            }
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Internal server error" }));
+        });
+    });
+    return new Promise((resolve, reject) => {
+        const onRuntimeError = (error) => {
+            console.error("MCP HTTP server runtime error:", error);
+        };
+        const onError = (error) => reject(error);
+        httpServer.once("error", onError);
+        httpServer.listen(port, "127.0.0.1", () => {
+            httpServer.off("error", onError);
+            httpServer.on("error", onRuntimeError);
+            console.error(`superblocks-mcp HTTP server started on http://127.0.0.1:${port}/mcp (profile: ${profile}, tools: ${registry.listTools().length})`);
+            if (!waitUntilClose) {
+                resolve();
+                return;
+            }
+            httpServer.once("close", () => {
+                httpServer.off("error", onRuntimeError);
+                resolve();
+            });
+            httpServer.once("error", (error) => {
+                reject(error);
+            });
+        });
+    });
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EACL,YAAY,GAGb,MAAM,WAAW,CAAC;AAEnB,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AACxD,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,gBAAgB,GAEjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,iBAAiB,EACjB,eAAe,GAEhB,MAAM,kBAAkB,CAAC;AAS1B,MAAM,cAAc,GAAG,SAAS,CAAC;AAEjC,SAAS,WAAW,CAAC,GAAoB;IACvC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,cAAc,GAAG,CAAC,KAAY,EAAE,EAAE;YACtC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC;QAEF,MAAM,eAAe,GAAG,CAAC,IAAY,EAAE,EAAE;YACvC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC;QAEF,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;YAC3B,IAAI,UAAU,GAAG,cAAc,EAAE,CAAC;gBAChC,GAAG,CAAC,KAAK,EAAE,CAAC;gBACZ,cAAc,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACxB,cAAc,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB,EAAE,QAAgB;IACjE,+EAA+E;IAC/E,MAAM,GAAG,GAAG,sCAAsC,CAAC;IACnD,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3E,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3E,OAAO,eAAe,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAA6B,EAAE;IAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;IACpD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC9E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,cAAc,GAAG;QACrB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE;QACrC,eAAe,EAAE,CAAC,IAAY,EAAE,IAAa,EAAE,EAAE,CAC/C,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;KACxC,CAAC;IAEF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;QAC9B,kBAAkB;QAClB,kBAAkB;QAClB,mBAAmB;QACnB,mBAAmB;KACpB,CAAC,CAAC;IAEH,SAAS,UAAU,CAAC,GAAoB;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,GAAG,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,SAAS,YAAY,CAAC,GAAoB;QACxC,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAChD,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC5D,OAAO,uBAAuB,CAAC,SAAU,EAAE,aAAa,CAAC,CAAC;IAC5D,CAAC;IAED,SAAS,gBAAgB,CAAC,GAAoB;QAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IACE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrB,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ;YAC7B,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EACpB,CAAC;YACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,UAAU,GAAG,YAAY,CAC7B,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;QAC5C,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,OAAO,EAAE,CAAC;gBACZ,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;gBACtD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAChC,GAAG,CAAC,SAAS,CACX,8BAA8B,EAC9B,6CAA6C,CAC9C,CAAC;gBACF,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,gBAAgB,CAAC,CAAC;gBACjE,GAAG,CAAC,SAAS,CACX,8BAA8B,EAC9B,4BAA4B,CAC7B,CAAC;YACJ,CAAC;YAED,IAAI,UAAU,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACnC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;oBACzD,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YAED,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1B,IAAI,IAAY,CAAC;gBACjB,IAAI,CAAC;oBACH,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IACE,KAAK,YAAY,KAAK;wBACtB,KAAK,CAAC,OAAO,KAAK,wBAAwB,EAC1C,CAAC;wBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;4BACjB,cAAc,EAAE,kBAAkB;4BAClC,UAAU,EAAE,OAAO;yBACpB,CAAC,CAAC;wBACH,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,EACnD,GAAG,EAAE;4BACH,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;gCACnB,GAAG,CAAC,OAAO,EAAE,CAAC;4BAChB,CAAC;wBACH,CAAC,CACF,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,IAAI,MAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;oBACnD,OAAO;gBACT,CAAC;gBAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBAExC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACxB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;4BACjB,cAAc,EAAE,kBAAkB;4BAClC,gBAAgB,EAAE,SAAS;yBAC5B,CAAC,CAAC;wBACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;wBAClD,OAAO;oBACT,CAAC;oBACD,MAAM,OAAO,GAAG,CACd,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CACxB,gBAAgB,CAAC,CAAC,CAAC;wBACjB,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,cAAc,CAAC;wBAClC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAC9C,CACF,CACF,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;oBAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;oBACZ,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;4BACjB,cAAc,EAAE,kBAAkB;4BAClC,gBAAgB,EAAE,SAAS;yBAC5B,CAAC,CAAC;wBACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;oBACnC,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC;wBACrC,CAAC,CAAC,MAAM,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC;wBAC7C,CAAC,CAAC,sBAAsB,EAAE,CAAC;oBAC7B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;wBACpB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;oBACZ,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;4BACjB,cAAc,EAAE,kBAAkB;4BAClC,gBAAgB,EAAE,SAAS;yBAC5B,CAAC,CAAC;wBACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;oBAClC,CAAC;gBACH,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACzB,kEAAkE;gBAClE,uDAAuD;gBACvD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACxC,IAAI,MAAM,GAAG,KAAK,CAAC;gBACnB,MAAM,OAAO,GAAG,GAAG,EAAE;oBACnB,IAAI,MAAM,EAAE,CAAC;wBACX,OAAO;oBACT,CAAC;oBACD,MAAM,GAAG,IAAI,CAAC;oBACd,aAAa,CAAC,SAAS,CAAC,CAAC;oBACzB,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;wBACvB,GAAG,CAAC,GAAG,EAAE,CAAC;oBACZ,CAAC;gBACH,CAAC,CAAC;gBAEF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,cAAc,EAAE,mBAAmB;oBACnC,eAAe,EAAE,UAAU;oBAC3B,UAAU,EAAE,YAAY;oBACxB,gBAAgB,EAAE,SAAS;iBAC5B,CAAC,CAAC;gBACH,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAEnB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;oBACjC,IAAI,MAAM,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;wBACjD,OAAO,EAAE,CAAC;wBACV,OAAO;oBACT,CAAC;oBACD,IAAI,CAAC;wBACH,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACrB,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;wBACpD,OAAO,EAAE,CAAC;oBACZ,CAAC;gBACH,CAAC,EAAE,MAAM,CAAC,CAAC;gBACX,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACzB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC3B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACzB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;oBACxB,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;oBACnD,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;QAC3D,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;YAC3D,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACpB,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;oBACvB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,CAAC;gBACD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,cAAc,GAAG,CAAC,KAAY,EAAE,EAAE;YACtC,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,KAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChD,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;YACxC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YACvC,OAAO,CAAC,KAAK,CACX,2DAA2D,IAAI,kBAAkB,OAAO,YAAY,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,GAAG,CACnI,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC5B,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;gBACxC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;gBACxC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import { type Profile } from "./tools/index.js";
+export { resolveProfile } from "./profile.js";
+export { executeToolCall } from "./tool-call-result.js";
+export { buildToolRegistry, toolDefinitions } from "./tools/index.js";
+export { getPluginConfigurationSchema } from "./tools/plugin-configuration-schema.js";
+export type { Profile, ToolRegistry } from "./tools/registry.js";
+export { getAuthContext, runWithAuthContext } from "./auth/context.js";
+export { handleJsonRpc, invalidRequestResponse, isJsonRpcRequest, type HandleJsonRpcOptions, type JsonRpcRequest, type JsonRpcResponse, } from "./jsonrpc.js";
+export { MCP_SERVER_VERSION } from "./version.js";
+export type ServerOptions = {
+    profile?: Profile;
+};
+export declare const MCP_SERVE_DEPRECATION_NOTICE = "superblocks-mcp is deprecated. Prefer: superblocks mcp setup --client claude (stdio MCP as the logged-in CLI user)";
+export declare function startServer(options?: ServerOptions): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAiBA,OAAO,EAGL,KAAK,OAAO,EACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,eAAO,MAAM,4BAA4B,uHAC6E,CAAC;AAEvH,wBAAsB,WAAW,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiC5E"}