@tangle-network/hub-sdk 1.0.3 → 1.0.5

package/README.md

@@ -420,3 +420,28 @@ const result = await broker.invoke(grant.grantId, connectionId, "github.issues.l
 ```
 
 `invoke` mints a fresh one-use, 60-second broker token and checks its selected scope before execution. The host application must recheck its own current customer enrollment on every call and revoke the app grant when access ends. Do not return broker tokens or application secrets to a browser or persist them in agent profiles.
+
+## Embedded Node MCP hosts
+
+`@tangle-network/hub-sdk/mcp` owns `HubMcpScope`, connection resolution,
+`createHubMcpRoutes`, the HTTP bridge and `lowerProfileConnections`. The root
+client export remains browser/Worker-safe.
+
+Create one scope for the host's lifetime with its existing canonical hash and
+credential-renewal function. Mount `createHubMcpRoutes(scope)` on the host's
+existing listener. `scope.resolveConnectionsToMcp(client, refs, serverForGrant)`
+validates the connections, provider and tool allowlists, rolls back partial
+allocation, and gives the host its native MCP representation. Only a pure
+attach-all request can return an explicitly degraded empty result; required
+connections remain errors. The host surfaces degradation and recovery.
+
+Revoke each resolution's `grantTokens` when its run settles. `scope.close()`
+revokes the remaining grants of that instance and prevents new allocation.
+Other scopes and their borrowed clients remain independent.
+
+The published `@tangle-network/hub-sdk/mcp/stdio` entry reads only
+`TANGLE_HUB_MCP_ENDPOINT`. Launch it through Node with the opaque callback
+endpoint; do not forward the Hub credential. `lowerProfileConnections` keeps
+the authored adapter profile separate from the ephemeral workspace profile.
+Grant endpoints belong to runtime materialization, never persisted authored
+profiles or trace metadata.

package/dist/bridge-D8_lAKaW.js

@@ -0,0 +1,81 @@
+import http from "node:http";
+import https from "node:https";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+//#region src/mcp/bridge.ts
+var HttpHubMcpBridgeClient = class {
+	endpoint;
+	constructor(endpoint) {
+		if (!endpoint || endpoint.trim().length === 0) throw new Error("TANGLE_HUB_MCP_ENDPOINT is required");
+		this.endpoint = endpoint.replace(/\/+$/, "");
+	}
+	async listTools() {
+		return (await requestJson("GET", `${this.endpoint}/tools`)).tools;
+	}
+	async callTool(name, args) {
+		return requestJson("POST", `${this.endpoint}/call`, {
+			name,
+			arguments: args ?? {}
+		});
+	}
+};
+function createHubMcpBridgeServer(client) {
+	const server = new Server({
+		name: "tangle-hub",
+		version: "0.1.0"
+	}, { capabilities: { tools: {} } });
+	server.setRequestHandler(ListToolsRequestSchema, async () => {
+		return { tools: (await client.listTools()).map((tool) => ({
+			name: tool.name,
+			description: tool.description,
+			inputSchema: tool.inputSchema
+		})) };
+	});
+	server.setRequestHandler(CallToolRequestSchema, async (request) => client.callTool(request.params.name, request.params.arguments ?? {}));
+	return server;
+}
+function requestJson(method, url, body) {
+	return new Promise((resolve, reject) => {
+		const parsed = new URL(url);
+		const payload = body ? JSON.stringify(body) : void 0;
+		const request = (parsed.protocol === "https:" ? https : http).request({
+			protocol: parsed.protocol,
+			hostname: parsed.hostname,
+			port: parsed.port,
+			path: `${parsed.pathname}${parsed.search}`,
+			method,
+			rejectUnauthorized: parsed.hostname !== "127.0.0.1",
+			headers: {
+				Accept: "application/json",
+				...payload ? {
+					"Content-Type": "application/json",
+					"Content-Length": Buffer.byteLength(payload).toString()
+				} : {}
+			}
+		}, (response) => {
+			const chunks = [];
+			response.on("data", (chunk) => {
+				chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+			});
+			response.on("end", () => {
+				const text = Buffer.concat(chunks).toString("utf8");
+				if ((response.statusCode ?? 500) >= 400) {
+					reject(new Error(text || `Hub MCP request failed: ${response.statusCode}`));
+					return;
+				}
+				try {
+					resolve(JSON.parse(text));
+				} catch (error) {
+					reject(error);
+				}
+			});
+		});
+		request.on("error", reject);
+		if (payload) request.write(payload);
+		request.end();
+	});
+}
+//#endregion
+export { createHubMcpBridgeServer as n, HttpHubMcpBridgeClient as t };
+
+//# sourceMappingURL=bridge-D8_lAKaW.js.map

package/dist/bridge-D8_lAKaW.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-D8_lAKaW.js","names":[],"sources":["../src/mcp/bridge.ts"],"sourcesContent":["import http from \"node:http\";\nimport https from \"node:https\";\nimport { Server } from \"@modelcontextprotocol/sdk/server/index.js\";\nimport {\n  CallToolRequestSchema,\n  ListToolsRequestSchema,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport type { HubMcpToolDescriptor, HubMcpToolResult } from \"./tools.js\";\n\ntype JsonObject = Record<string, unknown>;\n\ninterface HubMcpBridgeClient {\n  listTools(): Promise<HubMcpToolDescriptor[]>;\n  callTool(name: string, args: unknown): Promise<HubMcpToolResult>;\n}\n\nexport class HttpHubMcpBridgeClient implements HubMcpBridgeClient {\n  private readonly endpoint: string;\n\n  constructor(endpoint: string) {\n    if (!endpoint || endpoint.trim().length === 0) {\n      throw new Error(\"TANGLE_HUB_MCP_ENDPOINT is required\");\n    }\n    this.endpoint = endpoint.replace(/\\/+$/, \"\");\n  }\n\n  async listTools(): Promise<HubMcpToolDescriptor[]> {\n    const response = await requestJson<{ tools: HubMcpToolDescriptor[] }>(\n      \"GET\",\n      `${this.endpoint}/tools`,\n    );\n    return response.tools;\n  }\n\n  async callTool(name: string, args: unknown): Promise<HubMcpToolResult> {\n    return requestJson<HubMcpToolResult>(\"POST\", `${this.endpoint}/call`, {\n      name,\n      arguments: args ?? {},\n    });\n  }\n}\n\nexport function createHubMcpBridgeServer(client: HubMcpBridgeClient): Server {\n  const server = new Server(\n    { name: \"tangle-hub\", version: \"0.1.0\" },\n    { capabilities: { tools: {} } },\n  );\n\n  server.setRequestHandler(ListToolsRequestSchema, async () => {\n    const tools = await client.listTools();\n    return {\n      tools: tools.map((tool) => ({\n        name: tool.name,\n        description: tool.description,\n        inputSchema: tool.inputSchema,\n      })),\n    };\n  });\n\n  server.setRequestHandler(CallToolRequestSchema, async (request) =>\n    client.callTool(request.params.name, request.params.arguments ?? {}),\n  );\n\n  return server;\n}\n\nfunction requestJson<T>(\n  method: \"GET\" | \"POST\",\n  url: string,\n  body?: JsonObject,\n) {\n  return new Promise<T>((resolve, reject) => {\n    const parsed = new URL(url);\n    const payload = body ? JSON.stringify(body) : undefined;\n    const transport = parsed.protocol === \"https:\" ? https : http;\n    const request = transport.request(\n      {\n        protocol: parsed.protocol,\n        hostname: parsed.hostname,\n        port: parsed.port,\n        path: `${parsed.pathname}${parsed.search}`,\n        method,\n        rejectUnauthorized: parsed.hostname !== \"127.0.0.1\",\n        headers: {\n          Accept: \"application/json\",\n          ...(payload\n            ? {\n                \"Content-Type\": \"application/json\",\n                \"Content-Length\": Buffer.byteLength(payload).toString(),\n              }\n            : {}),\n        },\n      },\n      (response) => {\n        const chunks: Buffer[] = [];\n        response.on(\"data\", (chunk) => {\n          chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n        });\n        response.on(\"end\", () => {\n          const text = Buffer.concat(chunks).toString(\"utf8\");\n          if ((response.statusCode ?? 500) >= 400) {\n            reject(\n              new Error(\n                text || `Hub MCP request failed: ${response.statusCode}`,\n              ),\n            );\n            return;\n          }\n          try {\n            resolve(JSON.parse(text) as T);\n          } catch (error) {\n            reject(error);\n          }\n        });\n      },\n    );\n    request.on(\"error\", reject);\n    if (payload) request.write(payload);\n    request.end();\n  });\n}\n"],"mappings":";;;;;AAgBA,IAAa,yBAAb,MAAkE;CAChE;CAEA,YAAY,UAAkB;AAC5B,MAAI,CAAC,YAAY,SAAS,MAAM,CAAC,WAAW,EAC1C,OAAM,IAAI,MAAM,sCAAsC;AAExD,OAAK,WAAW,SAAS,QAAQ,QAAQ,GAAG;;CAG9C,MAAM,YAA6C;AAKjD,UAAO,MAJgB,YACrB,OACA,GAAG,KAAK,SAAS,QAClB,EACe;;CAGlB,MAAM,SAAS,MAAc,MAA0C;AACrE,SAAO,YAA8B,QAAQ,GAAG,KAAK,SAAS,QAAQ;GACpE;GACA,WAAW,QAAQ,EAAE;GACtB,CAAC;;;AAIN,SAAgB,yBAAyB,QAAoC;CAC3E,MAAM,SAAS,IAAI,OACjB;EAAE,MAAM;EAAc,SAAS;EAAS,EACxC,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,EAAE,CAChC;AAED,QAAO,kBAAkB,wBAAwB,YAAY;AAE3D,SAAO,EACL,QAAO,MAFW,OAAO,WAAW,EAEvB,KAAK,UAAU;GAC1B,MAAM,KAAK;GACX,aAAa,KAAK;GAClB,aAAa,KAAK;GACnB,EAAE,EACJ;GACD;AAEF,QAAO,kBAAkB,uBAAuB,OAAO,YACrD,OAAO,SAAS,QAAQ,OAAO,MAAM,QAAQ,OAAO,aAAa,EAAE,CAAC,CACrE;AAED,QAAO;;AAGT,SAAS,YACP,QACA,KACA,MACA;AACA,QAAO,IAAI,SAAY,SAAS,WAAW;EACzC,MAAM,SAAS,IAAI,IAAI,IAAI;EAC3B,MAAM,UAAU,OAAO,KAAK,UAAU,KAAK,GAAG,KAAA;EAE9C,MAAM,WADY,OAAO,aAAa,WAAW,QAAQ,MAC/B,QACxB;GACE,UAAU,OAAO;GACjB,UAAU,OAAO;GACjB,MAAM,OAAO;GACb,MAAM,GAAG,OAAO,WAAW,OAAO;GAClC;GACA,oBAAoB,OAAO,aAAa;GACxC,SAAS;IACP,QAAQ;IACR,GAAI,UACA;KACE,gBAAgB;KAChB,kBAAkB,OAAO,WAAW,QAAQ,CAAC,UAAU;KACxD,GACD,EAAE;IACP;GACF,GACA,aAAa;GACZ,MAAM,SAAmB,EAAE;AAC3B,YAAS,GAAG,SAAS,UAAU;AAC7B,WAAO,KAAK,OAAO,SAAS,MAAM,GAAG,QAAQ,OAAO,KAAK,MAAM,CAAC;KAChE;AACF,YAAS,GAAG,aAAa;IACvB,MAAM,OAAO,OAAO,OAAO,OAAO,CAAC,SAAS,OAAO;AACnD,SAAK,SAAS,cAAc,QAAQ,KAAK;AACvC,YACE,IAAI,MACF,QAAQ,2BAA2B,SAAS,aAC7C,CACF;AACD;;AAEF,QAAI;AACF,aAAQ,KAAK,MAAM,KAAK,CAAM;aACvB,OAAO;AACd,YAAO,MAAM;;KAEf;IAEL;AACD,UAAQ,GAAG,SAAS,OAAO;AAC3B,MAAI,QAAS,SAAQ,MAAM,QAAQ;AACnC,UAAQ,KAAK;GACb"}