@tryvira/mcp 0.1.12 → 0.1.13

package/dist/index.js

@@ -1,224 +1,224 @@
-// ../runtime/src/mcp-gateway.ts
-import { createHash as createHash2 } from "node:crypto";
-import { isIP } from "node:net";
-
-// ../domain/src/scope-composer.ts
-import { createHash } from "node:crypto";
-function canonical(value) {
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
-  return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
-}
-var digest = (value) => createHash("sha256").update(canonical(value)).digest("hex");
-function assertComposedScopeIntegrity(composed) {
-  const conflictSetDigest = digest(composed.conflicts);
-  if (conflictSetDigest !== composed.conflictSetDigest) throw new Error("SCOPE_CONFLICT_DIGEST_MISMATCH");
-  const compositionDigest = digest({ chain: composed.chain, permissions: composed.permissions, delegationIds: [...composed.delegationIds ?? []].sort(), conflictSetDigest, effectiveRevision: composed.effectiveRevision ?? null, sourceRevisionSetDigest: composed.sourceRevisionSetDigest ?? null, ancestorHardAuthorityDigest: composed.ancestorHardAuthorityDigest ?? null, effectiveProgramDigest: composed.effectiveProgramDigest ?? null });
-  if (compositionDigest !== composed.compositionDigest) throw new Error("SCOPE_COMPOSITION_DIGEST_MISMATCH");
-  return true;
-}
-
-// ../runtime/src/mcp-gateway.ts
-var MCP_PROTOCOL_VERSIONS = ["2026-07-28", "2025-11-25", "2025-03-26"];
-function negotiateMcpProtocolVersion(offered) {
-  const value = String(offered ?? "");
-  return MCP_PROTOCOL_VERSIONS.includes(value) ? value : "2025-03-26";
-}
-function assertPublicMcpHost(hostname) {
-  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local")) throw new Error("MCP_UPSTREAM_PRIVATE_HOST");
-  const version = isIP(host);
-  if (version === 4) {
-    const octets = host.split(".").map(Number);
-    if (octets[0] === 10 || octets[0] === 127 || octets[0] === 0 || octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31 || octets[0] === 192 && octets[1] === 168 || octets[0] === 169 && octets[1] === 254) throw new Error("MCP_UPSTREAM_PRIVATE_HOST");
-  }
-  if (version === 6 && ["::1", "::", "fc", "fd", "fe8", "fe9", "fea", "feb"].some((prefix) => host === prefix || host.startsWith(`${prefix}:`))) throw new Error("MCP_UPSTREAM_PRIVATE_HOST");
-}
-function canonicalMcpJson(value) {
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return `[${value.map(canonicalMcpJson).join(",")}]`;
-  return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalMcpJson(value[key])}`).join(",")}}`;
-}
-function verifyMcpResult(result) {
-  const { provenanceDigest, ...body } = result;
-  const expected = createHash2("sha256").update(canonicalMcpJson(body)).digest("hex");
-  if (provenanceDigest !== expected) throw new Error("MCP_PROVENANCE_DIGEST_INVALID");
-  return true;
-}
-function createMcpCancellationRegistry() {
-  const controllers = /* @__PURE__ */ new Map();
-  return { register(requestId) {
-    if (!requestId.trim()) throw new Error("MCP_REQUEST_ID_REQUIRED");
-    const previous = controllers.get(requestId);
-    previous?.abort();
-    const controller = new AbortController();
-    controllers.set(requestId, controller);
-    return controller.signal;
-  }, cancel(requestId) {
-    const controller = controllers.get(requestId);
-    if (!controller) return false;
-    controller.abort();
-    return true;
-  }, unregister(requestId, signal) {
-    const controller = controllers.get(requestId);
-    if (controller && (!signal || controller.signal === signal)) controllers.delete(requestId);
-  } };
-}
-function combineMcpAbortSignals(...signals) {
-  const active = signals.filter((signal) => Boolean(signal));
-  if (active.length === 0) return void 0;
-  if (active.length === 1) return active[0];
-  const controller = new AbortController();
-  const abort = () => controller.abort();
-  for (const signal of active) {
-    if (signal.aborted) {
-      controller.abort();
-      break;
-    }
-    signal.addEventListener("abort", abort, { once: true });
-  }
-  return controller.signal;
-}
-function parseMcpEventStream(body, expectedId) {
-  const payloads = [];
-  for (const event of body.split(/\r?\n\r?\n/)) {
-    const data = [];
-    for (const line of event.split(/\r?\n/)) {
-      if (!line || line.startsWith(":")) continue;
-      const separator = line.indexOf(":");
-      const field = separator < 0 ? line : line.slice(0, separator);
-      if (field !== "data") continue;
-      const value = line.slice(separator + 1).startsWith(" ") ? line.slice(separator + 2) : line.slice(separator + 1);
-      data.push(value);
-    }
-    if (data.length) payloads.push(data.join("\n"));
-  }
-  return payloads;
-}
-async function readMcpResponseBody(response) {
-  if (!response.body) return response.text();
-  const reader = response.body.getReader();
-  const decoder = new TextDecoder();
-  let body = "";
-  try {
-    for (; ; ) {
-      const chunk = await reader.read();
-      body += decoder.decode(chunk.value ?? new Uint8Array(), { stream: !chunk.done });
-      if (chunk.done) return body;
-    }
-  } finally {
-    reader.releaseLock();
-  }
-}
-function parseMcpResponseBody(body, contentType, expectedId) {
-  const payloads = contentType.toLowerCase().includes("text/event-stream") ? parseMcpEventStream(body, expectedId) : [body];
-  let last;
-  for (const payload of payloads) {
-    try {
-      const parsed = JSON.parse(payload);
-      last = parsed;
-    } catch {
-      continue;
-    }
-  }
-  if (!last) return { error: "MCP_UPSTREAM_RESPONSE_INVALID" };
-  if (last.id !== void 0 && String(last.id) !== expectedId) return { error: "MCP_UPSTREAM_RESPONSE_ID_MISMATCH" };
-  return last.error ? { error: last.error.message ?? "MCP_UPSTREAM_ERROR" } : { result: last.result };
-}
-function createRegisteredMcpTransport(input) {
-  const url = new URL(input.endpoint);
-  if (url.protocol !== "https:") throw new Error("MCP_UPSTREAM_HTTPS_REQUIRED");
-  assertPublicMcpHost(url.hostname);
-  if (!input.allowedHosts.includes(url.host)) throw new Error("MCP_UPSTREAM_HOST_NOT_ALLOWED");
-  const fetcher = input.fetcher ?? fetch;
-  const timeoutMs = input.timeoutMs ?? 1e4;
-  if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 6e4) throw new Error("MCP_UPSTREAM_TIMEOUT_INVALID");
-  const protocolVersion = input.protocolVersion ?? "2025-03-26";
-  return { call: async ({ server, tool, arguments: args, signal }) => {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    const abort = () => controller.abort();
-    if (signal?.aborted) controller.abort();
-    else signal?.addEventListener("abort", abort, { once: true });
-    try {
-      const response = await fetcher(url, { method: "POST", headers: { "content-type": "application/json", accept: "application/json, text/event-stream", "mcp-protocol-version": protocolVersion, ...input.headers }, signal: controller.signal, body: JSON.stringify({ jsonrpc: "2.0", id: `${server}:${tool}`, method: "tools/call", params: { name: tool, arguments: args } }) });
-      if (!response.ok) return { error: `MCP_UPSTREAM_HTTP_${response.status}` };
-      return parseMcpResponseBody(await readMcpResponseBody(response), response.headers.get("content-type") ?? "application/json", `${server}:${tool}`);
-    } catch (error) {
-      return { error: error instanceof Error && error.name === "AbortError" ? signal?.aborted ? "MCP_REQUEST_CANCELLED" : "MCP_UPSTREAM_TIMEOUT" : "MCP_UPSTREAM_TRANSPORT_ERROR" };
-    } finally {
-      clearTimeout(timer);
-      signal?.removeEventListener("abort", abort);
-    }
-  } };
-}
-async function handleMcpJsonRpc(input) {
-  const { request, server, tools, transport } = input;
-  if (request.jsonrpc !== "2.0" || !request.method) throw new Error("MCP_JSONRPC_INVALID");
-  if (request.method === "initialize") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { protocolVersion: "2025-03-26", serverInfo: { name: server, version: "1" }, capabilities: { tools: {}, resources: input.resources ? {} : void 0, prompts: input.prompts ? {} : void 0 } } };
-  if (request.method === "notifications/initialized") return null;
-  if (request.method === "notifications/cancelled") {
-    const requestId2 = String(request.params?.requestId ?? "");
-    input.cancellationRegistry?.cancel(requestId2);
-    return null;
-  }
-  if (request.method === "tools/list") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { tools } };
-  if (request.method === "resources/list") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { resources: input.resources ?? [] } };
-  if (request.method === "prompts/list") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { prompts: input.prompts ?? [] } };
-  if (request.method === "resources/read") {
-    const value = input.readResource ? await input.readResource(String(request.params?.uri ?? "")) : null;
-    return request.id === void 0 ? null : value ? { jsonrpc: "2.0", id: request.id, result: value } : { jsonrpc: "2.0", id: request.id, error: { code: -32602, message: "RESOURCE_NOT_FOUND" } };
-  }
-  if (request.method === "prompts/get") {
-    const value = input.getPrompt ? await input.getPrompt(String(request.params?.name ?? ""), request.params?.arguments ?? {}) : null;
-    return request.id === void 0 ? null : value ? { jsonrpc: "2.0", id: request.id, result: value } : { jsonrpc: "2.0", id: request.id, error: { code: -32602, message: "PROMPT_NOT_FOUND" } };
-  }
-  if (request.method !== "tools/call") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, error: { code: -32601, message: "METHOD_NOT_FOUND" } };
-  const tool = String(request.params?.name ?? "");
-  const definition = tools.find((item) => item.name === tool);
-  if (!definition) return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, error: { code: -32602, message: "TOOL_NOT_FOUND" } };
-  const invocation = { ...input.invocation, server, tool, arguments: request.params?.arguments ?? {} };
-  const authority = definition.effectful ? input.authorize ? await input.authorize({ invocation, definition }) : { allowed: false, decisionDigest: "", reason: "MCP_AUTHORITY_REQUIRED" } : { allowed: true, decisionDigest: "read-only" };
-  if (!authority.allowed) return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, error: { code: -32003, message: authority.reason ?? "MCP_AUTHORITY_DENIED", data: { decisionDigest: authority.decisionDigest } } };
-  const requestId = String(request.id ?? "");
-  const requestSignal = input.cancellationRegistry && requestId ? input.cancellationRegistry.register(requestId) : void 0;
-  try {
-    const result = await invokeMcpTool({ invocation, transport, authority, signal: combineMcpAbortSignals(input.signal, requestSignal) });
-    return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { content: [{ type: "text", text: JSON.stringify(result.result ?? result.error ?? null) }], isError: !result.ok, provenanceDigest: result.provenanceDigest } };
-  } finally {
-    if (requestSignal) input.cancellationRegistry?.unregister(requestId, requestSignal);
-  }
-}
-async function invokeMcpTool(input) {
-  const { invocation, transport } = input;
-  if (!invocation.id || !invocation.server || !invocation.tool || !invocation.receiptId || !invocation.idempotencyKey) throw new Error("MCP_INVOCATION_FIELDS_REQUIRED");
-  if (invocation.authorityDigest !== void 0 && !/^[a-f0-9]{64}$/.test(invocation.authorityDigest)) throw new Error("MCP_AUTHORITY_DIGEST_INVALID");
-  if (invocation.composedScope) {
-    assertComposedScopeIntegrity(invocation.composedScope);
-    if (invocation.authorityDigest !== void 0 && invocation.authorityDigest !== invocation.composedScope.compositionDigest) throw new Error("MCP_AUTHORITY_MISMATCH");
-    if (!invocation.composedScope.serveable) throw new Error("MCP_SCOPE_COMPOSITION_CONFLICT");
-  }
-  if (input.authority && !input.authority.allowed) throw new Error("MCP_AUTHORITY_DENIED");
-  if (!transport || typeof transport.call !== "function") throw new Error("MCP_TRANSPORT_REQUIRED");
-  let response;
-  try {
-    response = await transport.call({ server: invocation.server, tool: invocation.tool, arguments: structuredClone(invocation.arguments), signal: input.signal });
-  } catch {
-    if (input.signal?.aborted) throw new Error("MCP_INVOCATION_CANCELLED");
-    response = { error: "MCP_TRANSPORT_ERROR" };
-  }
-  const argumentsDigest = createHash2("sha256").update(canonicalMcpJson(invocation.arguments)).digest("hex");
-  const body = { invocationId: invocation.id, organizationId: invocation.organizationId, projectId: invocation.projectId, environmentId: invocation.environmentId, server: invocation.server, tool: invocation.tool, receiptId: invocation.receiptId, idempotencyKey: invocation.idempotencyKey, argumentsDigest, authorityDecisionDigest: input.authority?.decisionDigest ?? "not-required", authorityDigest: invocation.authorityDigest ?? null, ok: !response.error, result: response.result, error: response.error };
-  return Object.freeze({ ...body, provenanceDigest: createHash2("sha256").update(canonicalMcpJson(body)).digest("hex") });
-}
-export {
-  MCP_PROTOCOL_VERSIONS,
-  canonicalMcpJson,
-  createMcpCancellationRegistry,
-  createRegisteredMcpTransport,
-  handleMcpJsonRpc,
-  invokeMcpTool,
-  negotiateMcpProtocolVersion,
-  parseMcpEventStream,
-  verifyMcpResult
-};
+// ../runtime/src/mcp-gateway.ts
+import { createHash as createHash2 } from "node:crypto";
+import { isIP } from "node:net";
+
+// ../domain/src/scope-composer.ts
+import { createHash } from "node:crypto";
+function canonical(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
+}
+var digest = (value) => createHash("sha256").update(canonical(value)).digest("hex");
+function assertComposedScopeIntegrity(composed) {
+  const conflictSetDigest = digest(composed.conflicts);
+  if (conflictSetDigest !== composed.conflictSetDigest) throw new Error("SCOPE_CONFLICT_DIGEST_MISMATCH");
+  const compositionDigest = digest({ chain: composed.chain, permissions: composed.permissions, delegationIds: [...composed.delegationIds ?? []].sort(), conflictSetDigest, effectiveRevision: composed.effectiveRevision ?? null, sourceRevisionSetDigest: composed.sourceRevisionSetDigest ?? null, ancestorHardAuthorityDigest: composed.ancestorHardAuthorityDigest ?? null, effectiveProgramDigest: composed.effectiveProgramDigest ?? null });
+  if (compositionDigest !== composed.compositionDigest) throw new Error("SCOPE_COMPOSITION_DIGEST_MISMATCH");
+  return true;
+}
+
+// ../runtime/src/mcp-gateway.ts
+var MCP_PROTOCOL_VERSIONS = ["2026-07-28", "2025-11-25", "2025-03-26"];
+function negotiateMcpProtocolVersion(offered) {
+  const value = String(offered ?? "");
+  return MCP_PROTOCOL_VERSIONS.includes(value) ? value : "2025-03-26";
+}
+function assertPublicMcpHost(hostname) {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local")) throw new Error("MCP_UPSTREAM_PRIVATE_HOST");
+  const version = isIP(host);
+  if (version === 4) {
+    const octets = host.split(".").map(Number);
+    if (octets[0] === 10 || octets[0] === 127 || octets[0] === 0 || octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31 || octets[0] === 192 && octets[1] === 168 || octets[0] === 169 && octets[1] === 254) throw new Error("MCP_UPSTREAM_PRIVATE_HOST");
+  }
+  if (version === 6 && ["::1", "::", "fc", "fd", "fe8", "fe9", "fea", "feb"].some((prefix) => host === prefix || host.startsWith(`${prefix}:`))) throw new Error("MCP_UPSTREAM_PRIVATE_HOST");
+}
+function canonicalMcpJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonicalMcpJson).join(",")}]`;
+  return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalMcpJson(value[key])}`).join(",")}}`;
+}
+function verifyMcpResult(result) {
+  const { provenanceDigest, ...body } = result;
+  const expected = createHash2("sha256").update(canonicalMcpJson(body)).digest("hex");
+  if (provenanceDigest !== expected) throw new Error("MCP_PROVENANCE_DIGEST_INVALID");
+  return true;
+}
+function createMcpCancellationRegistry() {
+  const controllers = /* @__PURE__ */ new Map();
+  return { register(requestId) {
+    if (!requestId.trim()) throw new Error("MCP_REQUEST_ID_REQUIRED");
+    const previous = controllers.get(requestId);
+    previous?.abort();
+    const controller = new AbortController();
+    controllers.set(requestId, controller);
+    return controller.signal;
+  }, cancel(requestId) {
+    const controller = controllers.get(requestId);
+    if (!controller) return false;
+    controller.abort();
+    return true;
+  }, unregister(requestId, signal) {
+    const controller = controllers.get(requestId);
+    if (controller && (!signal || controller.signal === signal)) controllers.delete(requestId);
+  } };
+}
+function combineMcpAbortSignals(...signals) {
+  const active = signals.filter((signal) => Boolean(signal));
+  if (active.length === 0) return void 0;
+  if (active.length === 1) return active[0];
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  for (const signal of active) {
+    if (signal.aborted) {
+      controller.abort();
+      break;
+    }
+    signal.addEventListener("abort", abort, { once: true });
+  }
+  return controller.signal;
+}
+function parseMcpEventStream(body, expectedId) {
+  const payloads = [];
+  for (const event of body.split(/\r?\n\r?\n/)) {
+    const data = [];
+    for (const line of event.split(/\r?\n/)) {
+      if (!line || line.startsWith(":")) continue;
+      const separator = line.indexOf(":");
+      const field = separator < 0 ? line : line.slice(0, separator);
+      if (field !== "data") continue;
+      const value = line.slice(separator + 1).startsWith(" ") ? line.slice(separator + 2) : line.slice(separator + 1);
+      data.push(value);
+    }
+    if (data.length) payloads.push(data.join("\n"));
+  }
+  return payloads;
+}
+async function readMcpResponseBody(response) {
+  if (!response.body) return response.text();
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let body = "";
+  try {
+    for (; ; ) {
+      const chunk = await reader.read();
+      body += decoder.decode(chunk.value ?? new Uint8Array(), { stream: !chunk.done });
+      if (chunk.done) return body;
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
+function parseMcpResponseBody(body, contentType, expectedId) {
+  const payloads = contentType.toLowerCase().includes("text/event-stream") ? parseMcpEventStream(body, expectedId) : [body];
+  let last;
+  for (const payload of payloads) {
+    try {
+      const parsed = JSON.parse(payload);
+      last = parsed;
+    } catch {
+      continue;
+    }
+  }
+  if (!last) return { error: "MCP_UPSTREAM_RESPONSE_INVALID" };
+  if (last.id !== void 0 && String(last.id) !== expectedId) return { error: "MCP_UPSTREAM_RESPONSE_ID_MISMATCH" };
+  return last.error ? { error: last.error.message ?? "MCP_UPSTREAM_ERROR" } : { result: last.result };
+}
+function createRegisteredMcpTransport(input) {
+  const url = new URL(input.endpoint);
+  if (url.protocol !== "https:") throw new Error("MCP_UPSTREAM_HTTPS_REQUIRED");
+  assertPublicMcpHost(url.hostname);
+  if (!input.allowedHosts.includes(url.host)) throw new Error("MCP_UPSTREAM_HOST_NOT_ALLOWED");
+  const fetcher = input.fetcher ?? fetch;
+  const timeoutMs = input.timeoutMs ?? 1e4;
+  if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 6e4) throw new Error("MCP_UPSTREAM_TIMEOUT_INVALID");
+  const protocolVersion = input.protocolVersion ?? "2025-03-26";
+  return { call: async ({ server, tool, arguments: args, signal }) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    const abort = () => controller.abort();
+    if (signal?.aborted) controller.abort();
+    else signal?.addEventListener("abort", abort, { once: true });
+    try {
+      const response = await fetcher(url, { method: "POST", headers: { "content-type": "application/json", accept: "application/json, text/event-stream", "mcp-protocol-version": protocolVersion, ...input.headers }, signal: controller.signal, body: JSON.stringify({ jsonrpc: "2.0", id: `${server}:${tool}`, method: "tools/call", params: { name: tool, arguments: args } }) });
+      if (!response.ok) return { error: `MCP_UPSTREAM_HTTP_${response.status}` };
+      return parseMcpResponseBody(await readMcpResponseBody(response), response.headers.get("content-type") ?? "application/json", `${server}:${tool}`);
+    } catch (error) {
+      return { error: error instanceof Error && error.name === "AbortError" ? signal?.aborted ? "MCP_REQUEST_CANCELLED" : "MCP_UPSTREAM_TIMEOUT" : "MCP_UPSTREAM_TRANSPORT_ERROR" };
+    } finally {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+    }
+  } };
+}
+async function handleMcpJsonRpc(input) {
+  const { request, server, tools, transport } = input;
+  if (request.jsonrpc !== "2.0" || !request.method) throw new Error("MCP_JSONRPC_INVALID");
+  if (request.method === "initialize") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { protocolVersion: "2025-03-26", serverInfo: { name: server, version: "1" }, capabilities: { tools: {}, resources: input.resources ? {} : void 0, prompts: input.prompts ? {} : void 0 } } };
+  if (request.method === "notifications/initialized") return null;
+  if (request.method === "notifications/cancelled") {
+    const requestId2 = String(request.params?.requestId ?? "");
+    input.cancellationRegistry?.cancel(requestId2);
+    return null;
+  }
+  if (request.method === "tools/list") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { tools } };
+  if (request.method === "resources/list") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { resources: input.resources ?? [] } };
+  if (request.method === "prompts/list") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { prompts: input.prompts ?? [] } };
+  if (request.method === "resources/read") {
+    const value = input.readResource ? await input.readResource(String(request.params?.uri ?? "")) : null;
+    return request.id === void 0 ? null : value ? { jsonrpc: "2.0", id: request.id, result: value } : { jsonrpc: "2.0", id: request.id, error: { code: -32602, message: "RESOURCE_NOT_FOUND" } };
+  }
+  if (request.method === "prompts/get") {
+    const value = input.getPrompt ? await input.getPrompt(String(request.params?.name ?? ""), request.params?.arguments ?? {}) : null;
+    return request.id === void 0 ? null : value ? { jsonrpc: "2.0", id: request.id, result: value } : { jsonrpc: "2.0", id: request.id, error: { code: -32602, message: "PROMPT_NOT_FOUND" } };
+  }
+  if (request.method !== "tools/call") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, error: { code: -32601, message: "METHOD_NOT_FOUND" } };
+  const tool = String(request.params?.name ?? "");
+  const definition = tools.find((item) => item.name === tool);
+  if (!definition) return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, error: { code: -32602, message: "TOOL_NOT_FOUND" } };
+  const invocation = { ...input.invocation, server, tool, arguments: request.params?.arguments ?? {} };
+  const authority = definition.effectful ? input.authorize ? await input.authorize({ invocation, definition }) : { allowed: false, decisionDigest: "", reason: "MCP_AUTHORITY_REQUIRED" } : { allowed: true, decisionDigest: "read-only" };
+  if (!authority.allowed) return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, error: { code: -32003, message: authority.reason ?? "MCP_AUTHORITY_DENIED", data: { decisionDigest: authority.decisionDigest } } };
+  const requestId = String(request.id ?? "");
+  const requestSignal = input.cancellationRegistry && requestId ? input.cancellationRegistry.register(requestId) : void 0;
+  try {
+    const result = await invokeMcpTool({ invocation, transport, authority, signal: combineMcpAbortSignals(input.signal, requestSignal) });
+    return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { content: [{ type: "text", text: JSON.stringify(result.result ?? result.error ?? null) }], isError: !result.ok, provenanceDigest: result.provenanceDigest } };
+  } finally {
+    if (requestSignal) input.cancellationRegistry?.unregister(requestId, requestSignal);
+  }
+}
+async function invokeMcpTool(input) {
+  const { invocation, transport } = input;
+  if (!invocation.id || !invocation.server || !invocation.tool || !invocation.receiptId || !invocation.idempotencyKey) throw new Error("MCP_INVOCATION_FIELDS_REQUIRED");
+  if (invocation.authorityDigest !== void 0 && !/^[a-f0-9]{64}$/.test(invocation.authorityDigest)) throw new Error("MCP_AUTHORITY_DIGEST_INVALID");
+  if (invocation.composedScope) {
+    assertComposedScopeIntegrity(invocation.composedScope);
+    if (invocation.authorityDigest !== void 0 && invocation.authorityDigest !== invocation.composedScope.compositionDigest) throw new Error("MCP_AUTHORITY_MISMATCH");
+    if (!invocation.composedScope.serveable) throw new Error("MCP_SCOPE_COMPOSITION_CONFLICT");
+  }
+  if (input.authority && !input.authority.allowed) throw new Error("MCP_AUTHORITY_DENIED");
+  if (!transport || typeof transport.call !== "function") throw new Error("MCP_TRANSPORT_REQUIRED");
+  let response;
+  try {
+    response = await transport.call({ server: invocation.server, tool: invocation.tool, arguments: structuredClone(invocation.arguments), signal: input.signal });
+  } catch {
+    if (input.signal?.aborted) throw new Error("MCP_INVOCATION_CANCELLED");
+    response = { error: "MCP_TRANSPORT_ERROR" };
+  }
+  const argumentsDigest = createHash2("sha256").update(canonicalMcpJson(invocation.arguments)).digest("hex");
+  const body = { invocationId: invocation.id, organizationId: invocation.organizationId, projectId: invocation.projectId, environmentId: invocation.environmentId, server: invocation.server, tool: invocation.tool, receiptId: invocation.receiptId, idempotencyKey: invocation.idempotencyKey, argumentsDigest, authorityDecisionDigest: input.authority?.decisionDigest ?? "not-required", authorityDigest: invocation.authorityDigest ?? null, ok: !response.error, result: response.result, error: response.error };
+  return Object.freeze({ ...body, provenanceDigest: createHash2("sha256").update(canonicalMcpJson(body)).digest("hex") });
+}
+export {
+  MCP_PROTOCOL_VERSIONS,
+  canonicalMcpJson,
+  createMcpCancellationRegistry,
+  createRegisteredMcpTransport,
+  handleMcpJsonRpc,
+  invokeMcpTool,
+  negotiateMcpProtocolVersion,
+  parseMcpEventStream,
+  verifyMcpResult
+};