@tool-bridge/server 0.21.1 → 0.23.0

package/dist/chunk-7CTWGTDU.js

@@ -0,0 +1,302 @@
+import {
+  TBError,
+  createEncryptionKeyring
+} from "./chunk-5ICRY3VU.js";
+
+// src/bootstrapState.ts
+import {
+  createHash,
+  randomBytes,
+  randomUUID,
+  timingSafeEqual
+} from "crypto";
+import { chmod, mkdir, readFile, stat, unlink } from "fs/promises";
+import writeFileAtomic from "write-file-atomic";
+import lockfile from "proper-lockfile";
+import { join } from "path";
+import { z } from "zod";
+var stateSchema = z.strictObject({
+  instanceId: z.uuid(),
+  revision: z.number().int().positive(),
+  phase: z.enum(["setup", "installing", "initialized"]),
+  databaseUrl: z.string().optional(),
+  redisUrl: z.string().optional(),
+  internalS3Origin: z.string().optional(),
+  port: z.number().int().min(0).max(65535).default(8787),
+  host: z.string().default("0.0.0.0")
+});
+var BootstrapStateStore = class {
+  constructor(directory) {
+    this.directory = directory;
+  }
+  directory;
+  path(name) {
+    return join(this.directory, name);
+  }
+  async exclusive(run, retries = 0) {
+    await mkdir(this.directory, { recursive: true, mode: 448 });
+    const release = await lockfile.lock(this.directory, {
+      retries,
+      stale: 6e4,
+      update: 1e4
+    }).catch((error) => {
+      if (error.code === "ELOCKED") {
+        throw new TBError("conflict", "another local maintenance operation is running");
+      }
+      throw error;
+    });
+    try {
+      return await run();
+    } finally {
+      await release();
+    }
+  }
+  async read(name) {
+    try {
+      const path = this.path(name);
+      const info = await stat(path);
+      if (process.platform !== "win32" && (info.mode & 63) !== 0) {
+        throw new TBError(
+          "unavailable",
+          "bootstrap files must be readable only by their owner"
+        );
+      }
+      return JSON.parse(await readFile(path, "utf8"));
+    } catch (error) {
+      if (error.code === "ENOENT") return void 0;
+      throw error;
+    }
+  }
+  async write(name, value) {
+    await writeFileAtomic(this.path(name), JSON.stringify(value) + "\n", {
+      mode: 384,
+      fsync: true
+    });
+  }
+  async state() {
+    const value = await this.read("bootstrap.json");
+    return value === void 0 ? void 0 : stateSchema.parse(value);
+  }
+  async initialize() {
+    return this.exclusive(async () => {
+      const current = await this.state();
+      if (current) {
+        if (await this.read("initialized.json"))
+          return { ...current, phase: "initialized" };
+        return current;
+      }
+      if (await this.read("identity.json"))
+        throw new TBError(
+          "unavailable",
+          "bootstrap state requires local recovery"
+        );
+      const state = {
+        instanceId: randomUUID(),
+        revision: 1,
+        phase: "setup",
+        port: 8787,
+        host: "0.0.0.0"
+      };
+      await this.write("identity.json", { instanceId: state.instanceId });
+      await this.write("keys.json", {
+        keyring: createEncryptionKeyring(randomBytes(32).toString("base64url")),
+        storeTokenKeyring: createEncryptionKeyring(
+          randomBytes(32).toString("base64url")
+        ),
+        oauthKey: randomBytes(32).toString("base64url"),
+        adminSk: `tb_sk_${randomBytes(32).toString("base64url")}`
+      });
+      await this.write("bootstrap.json", state);
+      await this.pair(state.instanceId, "setup");
+      return state;
+    }, 5);
+  }
+  async pair(instanceId, mode) {
+    const token = randomBytes(32).toString("base64url");
+    await this.write("pairing.json", {
+      instanceId,
+      mode,
+      tokenHash: this.hash(token),
+      expiresAt: Date.now() + 36e5
+    });
+    await writeFileAtomic(this.path("pairing-token"), token + "\n", {
+      mode: 384
+    });
+    return token;
+  }
+  async createLocalPairing(mode) {
+    return this.exclusive(async () => {
+      let state;
+      try {
+        state = await this.state();
+      } catch {
+      }
+      if (!state && mode === "recovery") {
+        const identity = await this.read(
+          "identity.json"
+        );
+        if (!identity || !z.uuid().safeParse(identity.instanceId).success)
+          throw new TBError(
+            "unavailable",
+            "instance identity requires a local backup"
+          );
+        const initialized = await this.read("initialized.json");
+        let keys = await this.read("keys.json");
+        if (!keys && !initialized) {
+          keys = {
+            keyring: createEncryptionKeyring(
+              randomBytes(32).toString("base64url")
+            ),
+            storeTokenKeyring: createEncryptionKeyring(
+              randomBytes(32).toString("base64url")
+            ),
+            oauthKey: randomBytes(32).toString("base64url"),
+            adminSk: `tb_sk_${randomBytes(32).toString("base64url")}`
+          };
+          await this.write("keys.json", keys);
+        }
+        state = {
+          instanceId: identity.instanceId,
+          phase: initialized ? "initialized" : "installing",
+          revision: 1,
+          port: 8787,
+          host: "0.0.0.0"
+        };
+        await this.write("bootstrap.json", state);
+      }
+      if (!state)
+        throw new TBError("unavailable", "bootstrap state unavailable");
+      if (mode === "setup" && (state.phase === "initialized" || await this.read("initialized.json")))
+        throw new TBError("permission_denied", "initial setup is closed");
+      return this.pair(state.instanceId, mode);
+    });
+  }
+  hash(value) {
+    return createHash("sha256").update(value).digest("hex");
+  }
+  async authorize(token, mode) {
+    const state = await this.state();
+    const pair = await this.read("pairing.json");
+    const initialized = await this.read(
+      "initialized.json"
+    );
+    if (!token || !state || !pair || pair.instanceId !== state.instanceId || pair.mode !== mode || pair.expiresAt <= Date.now() || initialized && initialized.instanceId !== state.instanceId || mode === "setup" && (state.phase === "initialized" || initialized !== void 0) || !/^[0-9a-f]{64}$/.test(pair.tokenHash) || !timingSafeEqual(
+      Buffer.from(this.hash(token)),
+      Buffer.from(pair.tokenHash)
+    )) {
+      throw new TBError(
+        "permission_denied",
+        "a valid local pairing credential is required"
+      );
+    }
+    return initialized ? { ...state, phase: "initialized" } : state;
+  }
+  async finish(state) {
+    await this.write("initialized.json", { instanceId: state.instanceId });
+    await this.write("bootstrap.json", {
+      ...state,
+      phase: "initialized",
+      revision: state.revision + 1
+    });
+    await unlink(this.path("pairing.json")).catch(() => {
+    });
+    await unlink(this.path("pairing-token")).catch(() => {
+    });
+  }
+  async defaults() {
+    return this.read(
+      "install-defaults.json"
+    );
+  }
+  async secureDirectory() {
+    await chmod(this.directory, 448);
+  }
+};
+
+// package.json
+var package_default = {
+  name: "@tool-bridge/server",
+  version: "0.23.0",
+  description: "Self-hosted Tool Bridge Node server with PostgreSQL, S3 object storage and WebSocket device channels",
+  type: "module",
+  license: "MIT",
+  main: "src/index.ts",
+  exports: {
+    ".": "./src/index.ts"
+  },
+  bin: {
+    "tool-bridge-server": "./dist/main.js",
+    "tool-bridge-admin": "./dist/admin.js"
+  },
+  files: [
+    "dist"
+  ],
+  engines: {
+    node: ">=22"
+  },
+  publishConfig: {
+    access: "public",
+    main: "./dist/index.js",
+    types: "./dist/index.d.ts",
+    exports: {
+      ".": {
+        types: "./dist/index.d.ts",
+        import: "./dist/index.js"
+      }
+    }
+  },
+  keywords: [
+    "self-hosted",
+    "docker",
+    "mcp",
+    "htbp",
+    "tool-bridge",
+    "agent-tools"
+  ],
+  scripts: {
+    typecheck: "tsc --noEmit",
+    test: "vitest run",
+    build: "tsup",
+    start: "tsx src/main.ts"
+  },
+  dependencies: {
+    "@hono/node-server": "catalog:",
+    "@tool-bridge/dashboard": "workspace:*",
+    hono: "catalog:",
+    ioredis: "^6.0.0",
+    postgres: "^3.4.9",
+    ws: "catalog:",
+    "@aws-sdk/client-s3": "^3.1127.0",
+    "@smithy/node-http-handler": "^4.12.1",
+    "ipaddr.js": "^2.5.0",
+    "write-file-atomic": "^7.0.0",
+    "proper-lockfile": "^4.1.2",
+    zod: "catalog:",
+    commander: "~15.0.0",
+    "p-retry": "^7.1.1",
+    negotiator: "^1.0.0"
+  },
+  devDependencies: {
+    "@tool-bridge/app": "workspace:*",
+    "@tool-bridge/core": "workspace:*",
+    "@tool-bridge/plugins": "workspace:*",
+    "@types/node": "catalog:",
+    "@types/ws": "catalog:",
+    tsup: "catalog:",
+    tsx: "catalog:",
+    vitest: "catalog:",
+    "@types/write-file-atomic": "^4.0.3",
+    "@types/proper-lockfile": "^4.1.4",
+    "@types/negotiator": "^0.6.4"
+  },
+  repository: {
+    type: "git",
+    url: "git+https://github.com/TokenRollAI/tool-bridge.git",
+    directory: "packages/server"
+  }
+};
+
+export {
+  BootstrapStateStore,
+  package_default
+};

package/dist/chunk-BADVCN6K.js

@@ -0,0 +1,378 @@
+import {
+  HEADER_TB_CONTEXT,
+  HEADER_TB_REQUEST_ID,
+  HEADER_TB_UPSTREAM_AUTH,
+  OperationRegistry,
+  RequestDedupe,
+  TBError,
+  decodeCallContext,
+  decodePluginCall,
+  isTBError,
+  parseCredentialValues,
+  toToolResult
+} from "./chunk-5ICRY3VU.js";
+
+// ../plugin-sdk/src/index.ts
+var CONTEXT_HANDLER_VERBS = ["list", "get", "write", "update", "delete", "search"];
+var CAPABILITY_BY_VERB = { search: "search", delete: "delete" };
+var PROTOCOL_VERSION = "plugin/v2";
+function json(value, status = 200) {
+  return new Response(JSON.stringify(value), {
+    status,
+    headers: { "content-type": "application/json; charset=utf-8" }
+  });
+}
+function errorResponse(err) {
+  if (isTBError(err)) return json(err.toJSON(), err.httpStatus);
+  return json(new TBError("internal", "internal plugin error").toJSON(), 500);
+}
+function contextVerbs(handlers) {
+  const verbs = [];
+  for (const verb of CONTEXT_HANDLER_VERBS) {
+    if (typeof handlers[verb] === "function") verbs.push(verb);
+  }
+  return verbs;
+}
+function helpCmds(state) {
+  if (state.kind === "tools") return state.registry.list();
+  if (state.kind === "proxyTools") return [];
+  return contextVerbs(state.handlers).map((name) => ({ name }));
+}
+function createPlugin(opts = {}) {
+  const healthPath = opts.healthPath ?? "/healthz";
+  const exports = /* @__PURE__ */ new Map();
+  const dedupe = new RequestDedupe();
+  const assertFreshId = (id) => {
+    if (id.length === 0) throw new TBError("invalid_argument", "export id must be non-empty");
+    if (exports.has(id)) {
+      throw new TBError("invalid_argument", `export '${id}' is already declared`);
+    }
+  };
+  function describe() {
+    return {
+      protocolVersion: PROTOCOL_VERSION,
+      exports: [...exports.values()].map((state) => {
+        if (state.kind === "tools" || state.kind === "proxyTools") {
+          return {
+            id: state.id,
+            profile: "tools/v1",
+            ...state.description !== void 0 ? { description: state.description } : {},
+            ...state.auth !== void 0 ? { auth: state.auth } : {},
+            ...state.kind === "tools" && state.credentialProbe !== void 0 ? { credentialProbe: state.credentialProbe } : {},
+            ...state.credentialFields !== void 0 ? { credentialFields: state.credentialFields } : {},
+            ...state.kind === "tools" && state.mountConfigFields !== void 0 ? { mountConfigFields: state.mountConfigFields } : {},
+            ...state.kind === "tools" && state.oauth !== void 0 ? { oauth: state.oauth } : {}
+          };
+        }
+        const methods = contextVerbs(state.handlers);
+        const capabilities = methods.map((verb) => CAPABILITY_BY_VERB[verb]).filter((c) => c !== void 0);
+        return {
+          id: state.id,
+          profile: "context/v1",
+          ...state.description !== void 0 ? { description: state.description } : {},
+          ...state.auth !== void 0 ? { auth: state.auth } : {},
+          methods,
+          ...capabilities.length > 0 ? { capabilities } : {},
+          ...state.mountConfigFields !== void 0 ? { mountConfigFields: state.mountConfigFields } : {}
+        };
+      })
+    };
+  }
+  function help() {
+    return {
+      protocolVersion: PROTOCOL_VERSION,
+      exports: [...exports.values()].map((state) => ({
+        id: state.id,
+        ...state.kind === "proxyTools" ? { dynamic: true } : {},
+        cmds: helpCmds(state)
+      }))
+    };
+  }
+  function assertAuthorized(request, env) {
+    if (env?.TB_PLUGIN_IN_PROCESS === true) {
+      return;
+    }
+    const header = request.headers.get("authorization") ?? "";
+    const presented = header.startsWith("Bearer ") ? header.slice("Bearer ".length) : "";
+    const expected = opts.token?.(env);
+    if (expected === void 0) {
+      const devBypass = env?.TB_PLUGIN_ALLOW_ANY_TOKEN;
+      if (devBypass !== "true") {
+        throw new TBError(
+          "unavailable",
+          "plugin \u672A\u914D\u7F6E PLUGIN_TOKEN:\u751F\u4EA7\u90E8\u7F72\u5FC5\u987B\u914D\u7F6E;\u672C\u5730\u5F00\u53D1\u53EF\u8BBE TB_PLUGIN_ALLOW_ANY_TOKEN=true",
+          { retryable: false }
+        );
+      }
+      if (presented.length === 0) throw TBError.unauthenticated();
+      return;
+    }
+    if (presented !== expected) throw TBError.unauthenticated();
+  }
+  function decodeUpstreamAuth(request) {
+    const raw = request.headers.get(HEADER_TB_UPSTREAM_AUTH);
+    if (raw === null || raw.length === 0) return void 0;
+    const b64 = raw.replaceAll("-", "+").replaceAll("_", "/");
+    const padded = b64.padEnd(b64.length + (4 - b64.length % 4) % 4, "=");
+    try {
+      const bytes = Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+      return new TextDecoder().decode(bytes);
+    } catch {
+      throw new TBError("invalid_argument", `${HEADER_TB_UPSTREAM_AUTH} is not valid base64url`);
+    }
+  }
+  async function dispatchTools(state, method, args, ctx) {
+    switch (method.toLowerCase()) {
+      case "list":
+        return state.registry.list();
+      case "call": {
+        const name = args.name;
+        if (typeof name !== "string") {
+          throw new TBError("invalid_argument", "call requires a string 'name'");
+        }
+        const callArgs = args.args ?? {};
+        return await state.registry.call(name, callArgs, ctx);
+      }
+      default:
+        throw new TBError("invalid_argument", `unknown method '${method}' on a tools export`);
+    }
+  }
+  async function dispatchProxyTools(state, method, args, ctx) {
+    switch (method.toLowerCase()) {
+      case "list":
+        return await state.handlers.list(ctx);
+      case "call": {
+        const name = args.name;
+        if (typeof name !== "string" || name === "") {
+          throw new TBError("invalid_argument", "call requires a non-empty string 'name'");
+        }
+        const callArgs = typeof args.args === "object" && args.args !== null ? args.args : {};
+        return toToolResult(await state.handlers.call({ name, args: callArgs }, ctx));
+      }
+      default:
+        throw new TBError("invalid_argument", `unknown method '${method}' on a tools export`);
+    }
+  }
+  async function dispatchContext(state, method, args, ctx) {
+    const handlers = state.handlers;
+    switch (method.toLowerCase()) {
+      case "list":
+        if (handlers.list === void 0) break;
+        return await handlers.list(
+          { path: String(args.path ?? ""), ...args.opts !== void 0 ? { opts: args.opts } : {} },
+          ctx
+        );
+      case "get":
+        if (handlers.get === void 0) break;
+        return await handlers.get({ path: String(args.path ?? "") }, ctx);
+      case "write":
+        if (handlers.write === void 0) break;
+        return await handlers.write(
+          { path: String(args.path ?? ""), entry: args.entry ?? {} },
+          ctx
+        );
+      case "update":
+        if (handlers.update === void 0) break;
+        return await handlers.update(
+          { path: String(args.path ?? ""), patch: args.patch ?? {} },
+          ctx
+        );
+      case "delete":
+        if (handlers.delete === void 0) break;
+        return await handlers.delete({ path: String(args.path ?? "") }, ctx);
+      case "search":
+        if (handlers.search === void 0) break;
+        return await handlers.search(
+          { query: String(args.query ?? ""), ...args.opts !== void 0 ? { opts: args.opts } : {} },
+          ctx
+        );
+      default:
+        throw new TBError("invalid_argument", `unknown method '${method}' on a context export`);
+    }
+    throw new TBError("invalid_argument", `method '${method}' is not implemented by export '${state.id}'`);
+  }
+  async function handleEnvelope(request, env) {
+    assertAuthorized(request, env);
+    const ctxHeader = request.headers.get(HEADER_TB_CONTEXT);
+    if (ctxHeader === null) {
+      throw new TBError("invalid_argument", `missing ${HEADER_TB_CONTEXT}`);
+    }
+    const caller = decodeCallContext(ctxHeader);
+    const call = decodePluginCall(await request.text());
+    const exportId = caller.exportId ?? (exports.size === 1 ? [...exports.keys()][0] : void 0);
+    if (exportId === void 0) {
+      throw new TBError("invalid_argument", "call context carries no exportId and this plugin declares multiple exports");
+    }
+    const state = exports.get(exportId);
+    if (state === void 0) throw new TBError("invalid_argument", `unknown export '${exportId}'`);
+    const upstreamAuth = decodeUpstreamAuth(request);
+    const credentialFields = state.kind === "context" ? void 0 : state.credentialFields;
+    const ctx = {
+      env,
+      caller,
+      exportId,
+      mountPath: caller.mountPath,
+      mountConfig: caller.mountConfig,
+      upstreamAuth,
+      credentials: credentialFields !== void 0 && upstreamAuth !== void 0 ? parseCredentialValues(upstreamAuth, credentialFields) : void 0
+    };
+    const requestId = request.headers.get(HEADER_TB_REQUEST_ID);
+    const run = async () => {
+      if (state.kind === "tools") return await dispatchTools(state, call.tool, call.arguments, ctx);
+      if (state.kind === "proxyTools") {
+        return await dispatchProxyTools(state, call.tool, call.arguments, ctx);
+      }
+      return await dispatchContext(state, call.tool, call.arguments, ctx);
+    };
+    const value = requestId === null ? await run() : await dedupe.run(requestId, run);
+    return json(value ?? null);
+  }
+  const plugin = {
+    tools(id, meta) {
+      assertFreshId(id);
+      const state = {
+        auth: void 0,
+        kind: "tools",
+        id,
+        description: meta?.description,
+        credentialProbe: void 0,
+        credentialFields: void 0,
+        mountConfigFields: void 0,
+        oauth: void 0,
+        registry: new OperationRegistry()
+      };
+      exports.set(id, state);
+      const surface = {
+        auth(config) {
+          if (state.oauth !== void 0 || state.credentialFields !== void 0) {
+            throw new TBError(
+              "invalid_argument",
+              `export '${id}' \u5DF2\u58F0\u660E oauth/credentials(),\u4E0D\u80FD\u518D\u58F0\u660E auth`
+            );
+          }
+          if (config.kind === "none" && state.credentialProbe !== void 0) {
+            throw new TBError(
+              "invalid_argument",
+              `export '${id}' \u5DF2\u58F0\u660E credentialProbe,\u4E0D\u80FD\u518D\u58F0\u660E auth:none`
+            );
+          }
+          state.auth = config;
+          return surface;
+        },
+        register(name, spec, handler) {
+          state.registry.register(name, spec, handler);
+          return surface;
+        },
+        credentials(fields) {
+          if (fields.length === 0) {
+            throw new TBError("invalid_argument", "credentials() \u81F3\u5C11\u8981\u58F0\u660E\u4E00\u4E2A\u5B57\u6BB5");
+          }
+          if (state.oauth !== void 0) {
+            throw new TBError(
+              "invalid_argument",
+              `export '${id}' \u5DF2\u58F0\u660E oauth,\u4E0D\u80FD\u518D\u58F0\u660E credentials()(oauth \u6A21\u5F0F\u4E0B authRef \u6307\u5411\u7684 secret \u56FA\u5B9A\u5B58 clientId/clientSecret)`
+            );
+          }
+          if (state.auth !== void 0) {
+            throw new TBError("invalid_argument", `export '${id}' \u5DF2\u58F0\u660E auth,\u4E0D\u80FD\u518D\u58F0\u660E credentials()`);
+          }
+          state.credentialFields = fields;
+          return surface;
+        },
+        mountConfig(fields) {
+          if (fields.length === 0) {
+            throw new TBError("invalid_argument", "mountConfig() \u81F3\u5C11\u8981\u58F0\u660E\u4E00\u4E2A\u5B57\u6BB5");
+          }
+          state.mountConfigFields = fields;
+          return surface;
+        },
+        oauth(config) {
+          if (state.credentialFields !== void 0) {
+            throw new TBError(
+              "invalid_argument",
+              `export '${id}' \u5DF2\u58F0\u660E credentials(),\u4E0D\u80FD\u518D\u58F0\u660E oauth(oauth \u6A21\u5F0F\u4E0B authRef \u6307\u5411\u7684 secret \u56FA\u5B9A\u5B58 clientId/clientSecret)`
+            );
+          }
+          if (state.auth !== void 0) {
+            throw new TBError("invalid_argument", `export '${id}' \u5DF2\u58F0\u660E auth,\u4E0D\u80FD\u518D\u58F0\u660E oauth`);
+          }
+          if (state.credentialProbe !== void 0) {
+            throw new TBError(
+              "invalid_argument",
+              `export '${id}' \u5DF2\u58F0\u660E credentialProbe,\u4E0D\u80FD\u518D\u58F0\u660E oauth(\u51ED\u8BC1\u53EF\u7528\u6027\u7531\u6388\u6743\u6D41\u7A0B\u672C\u8EAB\u8BC1\u660E;\u62FF client \u51ED\u8BC1\u53BB\u8C03\u63A2\u9488\u65E2\u8BC1\u660E\u4E0D\u4E86\u4EC0\u4E48,\u53C8\u4F1A\u628A clientSecret \u9001\u8FDB\u63D2\u4EF6)`
+            );
+          }
+          state.oauth = config;
+          return surface;
+        },
+        probeCredentialWith(name) {
+          if (!state.registry.list().some((tool) => tool.name === name)) {
+            throw new TBError(
+              "invalid_argument",
+              `credentialProbe '${name}' \u4E0D\u662F export '${id}' \u5DF2\u6CE8\u518C\u7684\u5DE5\u5177`
+            );
+          }
+          if (state.oauth !== void 0) {
+            throw new TBError(
+              "invalid_argument",
+              `export '${id}' \u5DF2\u58F0\u660E oauth,\u4E0D\u80FD\u518D\u58F0\u660E credentialProbe(\u51ED\u8BC1\u53EF\u7528\u6027\u7531\u6388\u6743\u6D41\u7A0B\u672C\u8EAB\u8BC1\u660E;\u62FF client \u51ED\u8BC1\u53BB\u8C03\u63A2\u9488\u65E2\u8BC1\u660E\u4E0D\u4E86\u4EC0\u4E48,\u53C8\u4F1A\u628A clientSecret \u9001\u8FDB\u63D2\u4EF6)`
+            );
+          }
+          if (state.auth?.kind === "none") {
+            throw new TBError("invalid_argument", `export '${id}' \u58F0\u660E auth:none,\u4E0D\u80FD\u518D\u58F0\u660E credentialProbe`);
+          }
+          state.credentialProbe = name;
+          return surface;
+        }
+      };
+      return surface;
+    },
+    proxyTools(id, handlers) {
+      assertFreshId(id);
+      if (handlers.auth !== void 0 && handlers.credentialFields !== void 0) {
+        throw new TBError("invalid_argument", `export '${id}' \u7684 auth \u4E0D\u80FD\u4E0E credentialFields \u540C\u65F6\u58F0\u660E`);
+      }
+      exports.set(id, {
+        auth: handlers.auth,
+        kind: "proxyTools",
+        id,
+        description: handlers.description,
+        credentialFields: handlers.credentialFields,
+        handlers
+      });
+      return plugin;
+    },
+    context(id, handlers) {
+      assertFreshId(id);
+      exports.set(id, {
+        auth: handlers.auth,
+        kind: "context",
+        id,
+        description: handlers.description,
+        handlers,
+        mountConfigFields: handlers.mountConfigFields
+      });
+      return plugin;
+    },
+    async fetch(request, env) {
+      try {
+        const url = new URL(request.url);
+        if (request.method === "GET") {
+          if (url.pathname === healthPath) return json({ healthy: true });
+          if (url.pathname === "/~describe") return json(describe());
+          if (url.pathname === "/~help") return json(help());
+          throw TBError.notFound("no such path");
+        }
+        if (request.method !== "POST") throw TBError.notFound("no such path");
+        return await handleEnvelope(request, env);
+      } catch (err) {
+        return errorResponse(err);
+      }
+    }
+  };
+  return plugin;
+}
+
+export {
+  createPlugin
+};

package/dist/{chunk-XYBU3WZH.js → chunk-TDAWLMDE.js}

@@ -1,6 +1,6 @@
 import {
   createProviderHttpClient
-} from "./chunk-E6JCVKW6.js";
+} from "./chunk-VWRUGUSU.js";
 import {
   asJsonObject,
   trimmedText
@@ -8,10 +8,10 @@ import {
 import {
   requireApiKey,
   upstreamError
-} from "./chunk-ATK45BXV.js";
+} from "./chunk-WJHG6OK7.js";
 import {
   TBError
-} from "./chunk-UZM2RXZH.js";
+} from "./chunk-5ICRY3VU.js";
 
 // ../plugins/src/_runtime/authedClient.ts
 function extractErrorMessage(payload, keys) {