@tangle-network/hub-sdk 1.0.4 → 1.0.6

package/README.md

@@ -132,21 +132,32 @@ Present that approval through the product's decision flow.
 Set `approve: true` only after the caller has authorized that action.
 Automatic capability-token minting remains available when the server returns no concrete approval.
 
-## GitHub OAuth scopes
+## OAuth scopes
 
-Pass the exact scope set when the caller needs GitHub repository selection.
-Platform accepts `read:user`, `repo`, and `read:org` together for this request.
-It rejects a callback if GitHub grants a different set.
-Omitting `requestedScopes` retains the existing default GitHub flow.
-The SDK refuses a start response with different scopes, including responses from an older Platform deployment.
+`requestedScopes` is a provider-generic, non-empty unique subset of the connector
+manifest and the host's optional narrowing. Platform rejects empty, duplicate,
+unknown, or widening requests. The exact set is bound to OAuth state; narrowed
+flows persist a connection only when the provider grants that same set, with no
+missing, narrower, or additional grants. Hosts that do not narrow retain their
+existing defaults and provider-grant fallback.
+
+The SDK refuses a start response with different scopes, including responses from
+an older Platform deployment. GitHub retains its special contract: the exact
+`read:user`, `repo`, and `read:org` set. Gmail can request manifest-declared
+read-only access when the host permits it:
 
 ```ts
 const hub = HubClient.fromEnv();
+await hub.connections.start("gmail", {
+  requestedScopes: ["https://www.googleapis.com/auth/gmail.readonly"],
+});
 await hub.connections.start("github", {
   requestedScopes: ["read:user", "repo", "read:org"],
 });
 ```
 
+Omitting `requestedScopes` retains the host-selected or manifest default.
+
 ## Workflows
 
 `hub.workflows` covers the `/v1/workflows` surface — the same resource the
@@ -420,3 +431,28 @@ const result = await broker.invoke(grant.grantId, connectionId, "github.issues.l
 ```
 
 `invoke` mints a fresh one-use, 60-second broker token and checks its selected scope before execution. The host application must recheck its own current customer enrollment on every call and revoke the app grant when access ends. Do not return broker tokens or application secrets to a browser or persist them in agent profiles.
+
+## Embedded Node MCP hosts
+
+`@tangle-network/hub-sdk/mcp` owns `HubMcpScope`, connection resolution,
+`createHubMcpRoutes`, the HTTP bridge and `lowerProfileConnections`. The root
+client export remains browser/Worker-safe.
+
+Create one scope for the host's lifetime with its existing canonical hash and
+credential-renewal function. Mount `createHubMcpRoutes(scope)` on the host's
+existing listener. `scope.resolveConnectionsToMcp(client, refs, serverForGrant)`
+validates the connections, provider and tool allowlists, rolls back partial
+allocation, and gives the host its native MCP representation. Only a pure
+attach-all request can return an explicitly degraded empty result; required
+connections remain errors. The host surfaces degradation and recovery.
+
+Revoke each resolution's `grantTokens` when its run settles. `scope.close()`
+revokes the remaining grants of that instance and prevents new allocation.
+Other scopes and their borrowed clients remain independent.
+
+The published `@tangle-network/hub-sdk/mcp/stdio` entry reads only
+`TANGLE_HUB_MCP_ENDPOINT`. Launch it through Node with the opaque callback
+endpoint; do not forward the Hub credential. `lowerProfileConnections` keeps
+the authored adapter profile separate from the ephemeral workspace profile.
+Grant endpoints belong to runtime materialization, never persisted authored
+profiles or trace metadata.

package/dist/bridge-D8_lAKaW.js

@@ -0,0 +1,81 @@
+import http from "node:http";
+import https from "node:https";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+//#region src/mcp/bridge.ts
+var HttpHubMcpBridgeClient = class {
+	endpoint;
+	constructor(endpoint) {
+		if (!endpoint || endpoint.trim().length === 0) throw new Error("TANGLE_HUB_MCP_ENDPOINT is required");
+		this.endpoint = endpoint.replace(/\/+$/, "");
+	}
+	async listTools() {
+		return (await requestJson("GET", `${this.endpoint}/tools`)).tools;
+	}
+	async callTool(name, args) {
+		return requestJson("POST", `${this.endpoint}/call`, {
+			name,
+			arguments: args ?? {}
+		});
+	}
+};
+function createHubMcpBridgeServer(client) {
+	const server = new Server({
+		name: "tangle-hub",
+		version: "0.1.0"
+	}, { capabilities: { tools: {} } });
+	server.setRequestHandler(ListToolsRequestSchema, async () => {
+		return { tools: (await client.listTools()).map((tool) => ({
+			name: tool.name,
+			description: tool.description,
+			inputSchema: tool.inputSchema
+		})) };
+	});
+	server.setRequestHandler(CallToolRequestSchema, async (request) => client.callTool(request.params.name, request.params.arguments ?? {}));
+	return server;
+}
+function requestJson(method, url, body) {
+	return new Promise((resolve, reject) => {
+		const parsed = new URL(url);
+		const payload = body ? JSON.stringify(body) : void 0;
+		const request = (parsed.protocol === "https:" ? https : http).request({
+			protocol: parsed.protocol,
+			hostname: parsed.hostname,
+			port: parsed.port,
+			path: `${parsed.pathname}${parsed.search}`,
+			method,
+			rejectUnauthorized: parsed.hostname !== "127.0.0.1",
+			headers: {
+				Accept: "application/json",
+				...payload ? {
+					"Content-Type": "application/json",
+					"Content-Length": Buffer.byteLength(payload).toString()
+				} : {}
+			}
+		}, (response) => {
+			const chunks = [];
+			response.on("data", (chunk) => {
+				chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+			});
+			response.on("end", () => {
+				const text = Buffer.concat(chunks).toString("utf8");
+				if ((response.statusCode ?? 500) >= 400) {
+					reject(new Error(text || `Hub MCP request failed: ${response.statusCode}`));
+					return;
+				}
+				try {
+					resolve(JSON.parse(text));
+				} catch (error) {
+					reject(error);
+				}
+			});
+		});
+		request.on("error", reject);
+		if (payload) request.write(payload);
+		request.end();
+	});
+}
+//#endregion
+export { createHubMcpBridgeServer as n, HttpHubMcpBridgeClient as t };
+
+//# sourceMappingURL=bridge-D8_lAKaW.js.map

package/dist/bridge-D8_lAKaW.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-D8_lAKaW.js","names":[],"sources":["../src/mcp/bridge.ts"],"sourcesContent":["import http from \"node:http\";\nimport https from \"node:https\";\nimport { Server } from \"@modelcontextprotocol/sdk/server/index.js\";\nimport {\n  CallToolRequestSchema,\n  ListToolsRequestSchema,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport type { HubMcpToolDescriptor, HubMcpToolResult } from \"./tools.js\";\n\ntype JsonObject = Record<string, unknown>;\n\ninterface HubMcpBridgeClient {\n  listTools(): Promise<HubMcpToolDescriptor[]>;\n  callTool(name: string, args: unknown): Promise<HubMcpToolResult>;\n}\n\nexport class HttpHubMcpBridgeClient implements HubMcpBridgeClient {\n  private readonly endpoint: string;\n\n  constructor(endpoint: string) {\n    if (!endpoint || endpoint.trim().length === 0) {\n      throw new Error(\"TANGLE_HUB_MCP_ENDPOINT is required\");\n    }\n    this.endpoint = endpoint.replace(/\\/+$/, \"\");\n  }\n\n  async listTools(): Promise<HubMcpToolDescriptor[]> {\n    const response = await requestJson<{ tools: HubMcpToolDescriptor[] }>(\n      \"GET\",\n      `${this.endpoint}/tools`,\n    );\n    return response.tools;\n  }\n\n  async callTool(name: string, args: unknown): Promise<HubMcpToolResult> {\n    return requestJson<HubMcpToolResult>(\"POST\", `${this.endpoint}/call`, {\n      name,\n      arguments: args ?? {},\n    });\n  }\n}\n\nexport function createHubMcpBridgeServer(client: HubMcpBridgeClient): Server {\n  const server = new Server(\n    { name: \"tangle-hub\", version: \"0.1.0\" },\n    { capabilities: { tools: {} } },\n  );\n\n  server.setRequestHandler(ListToolsRequestSchema, async () => {\n    const tools = await client.listTools();\n    return {\n      tools: tools.map((tool) => ({\n        name: tool.name,\n        description: tool.description,\n        inputSchema: tool.inputSchema,\n      })),\n    };\n  });\n\n  server.setRequestHandler(CallToolRequestSchema, async (request) =>\n    client.callTool(request.params.name, request.params.arguments ?? {}),\n  );\n\n  return server;\n}\n\nfunction requestJson<T>(\n  method: \"GET\" | \"POST\",\n  url: string,\n  body?: JsonObject,\n) {\n  return new Promise<T>((resolve, reject) => {\n    const parsed = new URL(url);\n    const payload = body ? JSON.stringify(body) : undefined;\n    const transport = parsed.protocol === \"https:\" ? https : http;\n    const request = transport.request(\n      {\n        protocol: parsed.protocol,\n        hostname: parsed.hostname,\n        port: parsed.port,\n        path: `${parsed.pathname}${parsed.search}`,\n        method,\n        rejectUnauthorized: parsed.hostname !== \"127.0.0.1\",\n        headers: {\n          Accept: \"application/json\",\n          ...(payload\n            ? {\n                \"Content-Type\": \"application/json\",\n                \"Content-Length\": Buffer.byteLength(payload).toString(),\n              }\n            : {}),\n        },\n      },\n      (response) => {\n        const chunks: Buffer[] = [];\n        response.on(\"data\", (chunk) => {\n          chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n        });\n        response.on(\"end\", () => {\n          const text = Buffer.concat(chunks).toString(\"utf8\");\n          if ((response.statusCode ?? 500) >= 400) {\n            reject(\n              new Error(\n                text || `Hub MCP request failed: ${response.statusCode}`,\n              ),\n            );\n            return;\n          }\n          try {\n            resolve(JSON.parse(text) as T);\n          } catch (error) {\n            reject(error);\n          }\n        });\n      },\n    );\n    request.on(\"error\", reject);\n    if (payload) request.write(payload);\n    request.end();\n  });\n}\n"],"mappings":";;;;;AAgBA,IAAa,yBAAb,MAAkE;CAChE;CAEA,YAAY,UAAkB;AAC5B,MAAI,CAAC,YAAY,SAAS,MAAM,CAAC,WAAW,EAC1C,OAAM,IAAI,MAAM,sCAAsC;AAExD,OAAK,WAAW,SAAS,QAAQ,QAAQ,GAAG;;CAG9C,MAAM,YAA6C;AAKjD,UAAO,MAJgB,YACrB,OACA,GAAG,KAAK,SAAS,QAClB,EACe;;CAGlB,MAAM,SAAS,MAAc,MAA0C;AACrE,SAAO,YAA8B,QAAQ,GAAG,KAAK,SAAS,QAAQ;GACpE;GACA,WAAW,QAAQ,EAAE;GACtB,CAAC;;;AAIN,SAAgB,yBAAyB,QAAoC;CAC3E,MAAM,SAAS,IAAI,OACjB;EAAE,MAAM;EAAc,SAAS;EAAS,EACxC,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,EAAE,CAChC;AAED,QAAO,kBAAkB,wBAAwB,YAAY;AAE3D,SAAO,EACL,QAAO,MAFW,OAAO,WAAW,EAEvB,KAAK,UAAU;GAC1B,MAAM,KAAK;GACX,aAAa,KAAK;GAClB,aAAa,KAAK;GACnB,EAAE,EACJ;GACD;AAEF,QAAO,kBAAkB,uBAAuB,OAAO,YACrD,OAAO,SAAS,QAAQ,OAAO,MAAM,QAAQ,OAAO,aAAa,EAAE,CAAC,CACrE;AAED,QAAO;;AAGT,SAAS,YACP,QACA,KACA,MACA;AACA,QAAO,IAAI,SAAY,SAAS,WAAW;EACzC,MAAM,SAAS,IAAI,IAAI,IAAI;EAC3B,MAAM,UAAU,OAAO,KAAK,UAAU,KAAK,GAAG,KAAA;EAE9C,MAAM,WADY,OAAO,aAAa,WAAW,QAAQ,MAC/B,QACxB;GACE,UAAU,OAAO;GACjB,UAAU,OAAO;GACjB,MAAM,OAAO;GACb,MAAM,GAAG,OAAO,WAAW,OAAO;GAClC;GACA,oBAAoB,OAAO,aAAa;GACxC,SAAS;IACP,QAAQ;IACR,GAAI,UACA;KACE,gBAAgB;KAChB,kBAAkB,OAAO,WAAW,QAAQ,CAAC,UAAU;KACxD,GACD,EAAE;IACP;GACF,GACA,aAAa;GACZ,MAAM,SAAmB,EAAE;AAC3B,YAAS,GAAG,SAAS,UAAU;AAC7B,WAAO,KAAK,OAAO,SAAS,MAAM,GAAG,QAAQ,OAAO,KAAK,MAAM,CAAC;KAChE;AACF,YAAS,GAAG,aAAa;IACvB,MAAM,OAAO,OAAO,OAAO,OAAO,CAAC,SAAS,OAAO;AACnD,SAAK,SAAS,cAAc,QAAQ,KAAK;AACvC,YACE,IAAI,MACF,QAAQ,2BAA2B,SAAS,aAC7C,CACF;AACD;;AAEF,QAAI;AACF,aAAQ,KAAK,MAAM,KAAK,CAAM;aACvB,OAAO;AACd,YAAO,MAAM;;KAEf;IAEL;AACD,UAAQ,GAAG,SAAS,OAAO;AAC3B,MAAI,QAAS,SAAQ,MAAM,QAAQ;AACnC,UAAQ,KAAK;GACb"}