@unchainedshop/api 5.0.0-alpha.2 → 5.0.0-alpha.3

package/lib/fastify/chatHandler.js

@@ -1,89 +1,60 @@
 import generateImageHandler from "../chat/generateImageHandler.js";
 import defaultSystemPrompt from "../chat/defaultSystemPrompt.js";
 import normalizeToolsIndex from "../chat/normalizeToolsIndex.js";
-import { errorHandler } from "../chat/utils.js";
+import { chatErrorStatus, createChatRequestLifecycle, errorHandler, logOptionalPeerLoadError, } from "../chat/utils.js";
+import { buildChatResourceContext } from "../mcp/resources/localization.js";
 import { createLogger } from '@unchainedshop/logger';
 const logger = createLogger('unchained:api:chat');
 let convertToModelMessages;
 let stepCountIs;
 let streamText;
 let createMCPClient;
-let StreamableHTTPClientTransport;
-let Client;
 try {
     const aiTools = await import('ai');
-    const mcpTools = await import('@ai-sdk/mcp');
-    const mcpSDKClientLibrary = await import('@modelcontextprotocol/sdk/client/streamableHttp.js');
-    const mcpSDKClient = await import('@modelcontextprotocol/sdk/client/index.js');
-    StreamableHTTPClientTransport = mcpSDKClientLibrary.StreamableHTTPClientTransport;
-    Client = mcpSDKClient.Client;
     convertToModelMessages = aiTools.convertToModelMessages;
     stepCountIs = aiTools.stepCountIs;
     streamText = aiTools.streamText;
+}
+catch (error) {
+    logOptionalPeerLoadError('ai', error);
+}
+try {
+    const mcpTools = await import('@ai-sdk/mcp');
     createMCPClient = mcpTools.createMCPClient;
 }
-catch {
-    logger.warn(`optional peer npm packages 'ai' and '@ai-sdk/mcp' not installed, chat will not work`);
+catch (error) {
+    logOptionalPeerLoadError('@ai-sdk/mcp', error);
 }
 const setupMCPChatHandler = (chatConfiguration) => {
     if (!chatConfiguration?.model) {
         throw new Error('Model is required');
     }
-    const { tools: additionalTools = {}, unchainedMCPUrl = `${process.env.ROOT_URL}/mcp`, imageGenerationTool, ...restChatConfig } = chatConfiguration;
+    const { tools: additionalTools = {}, unchainedMCPUrl = `${process.env.ROOT_URL}/mcp`, model, imageGenerationTool, abortSignal: configuredAbortSignal, onAbort: configuredOnAbort, onEnd: configuredOnEnd, onFinish: configuredOnFinish, ...restChatConfig } = chatConfiguration;
     const system = chatConfiguration.system ?? defaultSystemPrompt;
     const mcpChatHandler = async (req, res) => {
+        if (req.method === 'OPTIONS') {
+            res.headers({
+                'access-control-allow-credentials': 'true',
+                'access-control-allow-private-network': 'true',
+            });
+            return res.status(200).send();
+        }
         let client;
+        const lifecycle = createChatRequestLifecycle(res.raw, configuredAbortSignal);
         try {
-            if (req.method === 'OPTIONS') {
-                res.headers({
-                    'access-control-allow-credentials': 'true',
-                    'access-control-allow-private-network': 'true',
-                });
-                return res.status(200).send();
-            }
-            const resourceTransport = new StreamableHTTPClientTransport(new URL(unchainedMCPUrl), {
-                requestInit: {
-                    headers: {
-                        Cookie: req.headers.cookie || '',
-                    },
-                },
-            });
-            const sdkClient = new Client({ name: 'unchained-chat-client', version: '1.0.0' });
-            await sdkClient.connect(resourceTransport);
-            const transport = new StreamableHTTPClientTransport(new URL(unchainedMCPUrl), {
-                requestInit: {
+            client = await createMCPClient({
+                transport: {
+                    type: 'http',
+                    url: unchainedMCPUrl,
                     headers: {
                         Cookie: req.headers.cookie || '',
                     },
                 },
+                initializationOptions: { signal: lifecycle.signal },
             });
-            client = await createMCPClient({
-                transport,
-            });
+            lifecycle.setClientClose(() => client.close());
             const defaultUnchainedTools = await client.tools();
-            let resourceContext = '';
-            try {
-                const resources = await sdkClient.listResources();
-                if (resources?.resources) {
-                    const resourceTexts = await Promise.all(resources.resources.map(async (resource) => {
-                        try {
-                            const content = await sdkClient.readResource({ uri: resource.uri });
-                            if (content?.contents?.[0]?.text) {
-                                return `${resource.name}:\n${content.contents[0].text}`;
-                            }
-                        }
-                        catch (e) {
-                            logger.error(`Failed to read resource ${resource.uri}: ${e.message}`);
-                        }
-                        return null;
-                    }));
-                    resourceContext =
-                        '\n\nAVAILABLE SHOP CONFIGURATION:\n' + resourceTexts.filter(Boolean).join('\n\n');
-                }
-            }
-            catch (e) {
-                logger.error(`Failed to fetch MCP resources: ${e.message}`);
-            }
+            const resourceContext = await buildChatResourceContext(req.unchainedContext);
             const tools = {
                 ...defaultUnchainedTools,
                 ...additionalTools,
@@ -92,6 +63,7 @@ const setupMCPChatHandler = (chatConfiguration) => {
                 tools.generateImage = generateImageHandler(req)(imageGenerationTool);
             }
             if (req.method === 'GET') {
+                await lifecycle.close();
                 return res.status(200).send({
                     tools: normalizeToolsIndex(tools),
                     cached: false,
@@ -127,14 +99,28 @@ const setupMCPChatHandler = (chatConfiguration) => {
             const messagesToInclude = normalizedMessages.slice(startIndex);
             const result = streamText({
                 stopWhen: stepCountIs(500),
-                temperature: 0.2,
                 maxRetries: 3,
                 ...restChatConfig,
+                abortSignal: lifecycle.signal,
                 messages: messagesToInclude,
                 system: system + resourceContext,
+                model,
                 tools: cacheControlledTools,
-                onFinish: async () => {
-                    await client?.close();
+                onEnd: async (event) => {
+                    try {
+                        await (configuredOnEnd ?? configuredOnFinish)?.(event);
+                    }
+                    finally {
+                        await lifecycle.close();
+                    }
+                },
+                onAbort: async (event) => {
+                    try {
+                        await configuredOnAbort?.(event);
+                    }
+                    finally {
+                        await lifecycle.close();
+                    }
                 },
                 providerOptions: {
                     anthropic: {
@@ -144,21 +130,26 @@ const setupMCPChatHandler = (chatConfiguration) => {
                     },
                 },
             });
+            void result.finishReason.then(undefined, async () => {
+                await lifecycle.close();
+            });
             return res.send(result.toUIMessageStreamResponse({
                 onError: errorHandler,
             }));
         }
         catch (err) {
             logger.error(err);
-            await client?.close();
-            res.status(500);
+            await lifecycle.close();
+            if (lifecycle.signal.aborted || res.raw.destroyed)
+                return res;
+            res.status(chatErrorStatus(err));
             return res.send({ error: errorHandler(err) });
         }
     };
     return mcpChatHandler;
 };
 export const connectChat = (app, chatConfiguration) => {
-    if (!createMCPClient) {
+    if (!createMCPClient || !streamText) {
         logger.warn('Optional dependencies for AI SDK Chat Handler are not installed. Please install @ai-sdk/mcp and ai packages to use this feature.');
         return;
     }

package/lib/fastify/index.d.ts

@@ -4,9 +4,15 @@ import type { UnchainedCore } from '@unchainedshop/core';
 import type { FastifyBaseLogger, FastifyInstance, FastifyPluginAsync } from 'fastify';
 import { connectChat } from './chatHandler.ts';
 import type { ChatConfiguration } from '../chat/utils.ts';
+import { type AdminUIThemeConfig } from '@unchainedshop/admin-ui/theme';
+import { type AdminUIPluginConfig } from '../adminUiPlugins.ts';
+export type { AdminUIPluginConfig, AdminUIPluginEntityConfig, AdminUIPluginPageConfig, AdminUIPluginTabConfig, AdminUIPluginWidgetConfig, AdminUIPluginSlotConfig, } from '../adminUiPlugins.ts';
+export type { AdminUIThemeTokens, AdminUIThemeConfig } from '@unchainedshop/admin-ui/theme';
 export interface AdminUIRouterOptions {
-    prefix: string;
+    prefix?: string;
     enabled?: boolean;
+    theme?: AdminUIThemeConfig;
+    plugins?: AdminUIPluginConfig[];
 }
 export declare const unchainedLogger: (prefix: string) => FastifyBaseLogger;
 export declare const connect: (fastify: FastifyInstance, { graphqlHandler, unchainedAPI, }: {

package/lib/fastify/index.js

@@ -6,8 +6,12 @@ import { createLogger } from '@unchainedshop/logger';
 import mcpHandler from "./mcpHandler.js";
 import { connectChat } from "./chatHandler.js";
 import { mountRoutes } from "./mountRoutes.js";
-import { readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { createBackchannelLogoutRoute } from "../handlers/createBackchannelLogoutHandler.js";
+import { generateThemeCSS } from '@unchainedshop/admin-ui/theme';
+import { preparePluginAssets, resolveAdminUIPath } from "../adminUiPlugins.js";
 const resolveUserRemoteAddress = (req, trustProxy = false) => {
     let remoteAddress;
     if (trustProxy) {
@@ -120,9 +124,47 @@ export const connect = async (fastify, { graphqlHandler, unchainedAPI, }, { allo
     }
     mountRoutes(fastify, unchainedAPI, routes);
     if (adminUI) {
+        const adminUIOptions = typeof adminUI === 'object' ? adminUI : undefined;
+        const adminUIPlugins = adminUIOptions?.plugins || [];
+        const themeCSS = generateThemeCSS(adminUIOptions?.theme);
+        const themeHash = createHash('sha256').update(themeCSS).digest('hex').slice(0, 8);
+        const themeEtag = `"${themeHash}"`;
+        fastify.get('/admin-ui-theme.css', async (request, reply) => {
+            if (request.headers['if-none-match'] === themeEtag) {
+                return reply.code(304).send();
+            }
+            return reply
+                .header('Cache-Control', 'public, max-age=0, must-revalidate')
+                .header('ETag', themeEtag)
+                .type('text/css')
+                .send(themeCSS);
+        });
+        const devMode = process.env.NODE_ENV !== 'production';
+        const { routes: pluginRoutes } = preparePluginAssets(adminUIPlugins, fastify.log, {
+            devMode,
+        });
+        for (const [path, asset] of pluginRoutes) {
+            fastify.get(path, async (request, reply) => {
+                if (asset.etag) {
+                    const ifNoneMatch = request.headers['if-none-match'];
+                    if (ifNoneMatch === asset.etag) {
+                        return reply.code(304).send();
+                    }
+                    reply.header('ETag', asset.etag);
+                }
+                const body = typeof asset.content === 'function' ? asset.content() : asset.content;
+                return reply
+                    .header('Cache-Control', asset.cacheControl)
+                    .header('X-Content-Type-Options', 'nosniff')
+                    .header('Access-Control-Allow-Origin', '*')
+                    .type(asset.contentType)
+                    .send(body);
+            });
+        }
         fastify.register(adminUIRouter, {
             enabled: true,
-            prefix: typeof adminUI === 'object' ? adminUI.prefix : '/',
+            prefix: adminUIOptions?.prefix || '/',
+            plugins: adminUIPlugins,
         });
     }
 };
@@ -142,15 +184,6 @@ const fallbackLandingPageHandler = (request, reply) => {
         return reply.status(404).send();
     }
 };
-const resolveAdminUIPath = () => {
-    try {
-        const staticURL = import.meta.resolve('@unchainedshop/admin-ui');
-        return new URL(staticURL).pathname.split('/').slice(0, -1).join('/');
-    }
-    catch {
-        return null;
-    }
-};
 export const adminUIRouter = async (fastify, opts) => {
     try {
         let fastifyStatic;
@@ -164,9 +197,23 @@ export const adminUIRouter = async (fastify, opts) => {
         if (fastifyStatic) {
             const adminUIPath = resolveAdminUIPath();
             if (adminUIPath) {
+                const indexHtml = readFileSync(join(adminUIPath, 'index.html'), 'utf-8');
+                const extHtmlPath = join(adminUIPath, 'ext', '[[...slug]]', 'index.html');
+                const extHtml = existsSync(extHtmlPath) ? readFileSync(extHtmlPath, 'utf-8') : null;
                 await fastify.register(fastifyStatic, {
                     root: adminUIPath,
                     prefix: opts.prefix || '/',
+                    wildcard: false,
+                });
+                fastify.setNotFoundHandler(async (request, reply) => {
+                    if (request.method === 'GET' && !request.url.includes('.')) {
+                        const urlPath = request.url.split('?')[0].replace(/\/+$/, '');
+                        if (extHtml && (urlPath === '/ext' || urlPath.startsWith('/ext/'))) {
+                            return reply.type('text/html').send(extHtml);
+                        }
+                        return reply.type('text/html').send(indexHtml);
+                    }
+                    return reply.code(404).send({ error: 'Not Found' });
                 });
                 return;
             }

package/lib/fastify/mcpHandler.js

@@ -1,83 +1,32 @@
-import initMCPServer from "../mcp/index.js";
+import { Readable } from 'node:stream';
 import { createLogger } from '@unchainedshop/logger';
+import handleMcpHttpRequest from "../mcp/handleMcpHttpRequest.js";
+import { toWebRequest } from "../mcp/nodeHttpBridge.js";
 const logger = createLogger('unchained:api:mcp');
-let StreamableHTTPServerTransport;
-let isInitializeRequest;
-let McpServer;
-try {
-    const mcpSDKServerLibrary = await import('@modelcontextprotocol/sdk/server/streamableHttp.js');
-    const mcpSDKClient = await import('@modelcontextprotocol/sdk/types.js');
-    const mcpSDKServer = await import('@modelcontextprotocol/sdk/server/mcp.js');
-    StreamableHTTPServerTransport = mcpSDKServerLibrary.StreamableHTTPServerTransport;
-    isInitializeRequest = mcpSDKClient.isInitializeRequest;
-    McpServer = mcpSDKServer.McpServer;
-}
-catch {
-    logger.warn(`optional peer npm package '@modelcontextprotocol/sdk' not installed, mcp will not work`);
-}
-const transports = {};
 const mcpHandler = async (req, res) => {
-    if (!req.unchainedContext.user) {
-        res.status(401);
-        res.header('WWW-Authenticate', `Bearer realm="Unchained MCP", error="invalid_token", resource="${process.env.ROOT_URL || 'http://localhost:4010'}",`);
-        return res.send(JSON.stringify({
-            error: 'invalid_token',
-            resource_metadata: `${process.env.ROOT_URL || 'http://localhost:4010'}/.well-known/oauth-protected-resource`,
-        }));
-    }
     try {
-        if (req.method === 'POST') {
-            const sessionId = req.headers['mcp-session-id'];
-            let transport;
-            if (sessionId && transports[sessionId]) {
-                transport = transports[sessionId];
-            }
-            else if (!sessionId && isInitializeRequest(req.body)) {
-                transport = new StreamableHTTPServerTransport({
-                    sessionIdGenerator: () => crypto.randomUUID(),
-                    onsessioninitialized: (sessionId) => {
-                        transports[sessionId] = transport;
-                    },
-                });
-                transport.onclose = () => {
-                    if (transport.sessionId) {
-                        delete transports[transport.sessionId];
-                    }
-                };
-                const roles = req.unchainedContext.user.roles || [];
-                const server = initMCPServer(new McpServer({
-                    name: 'Unchained MCP Server',
-                    version: '1.0.0',
-                }), req.unchainedContext, roles);
-                await server.connect(transport);
-            }
-            else {
-                return res.status(400).send(JSON.stringify({
-                    jsonrpc: '2.0',
-                    error: {
-                        code: -32000,
-                        message: 'Bad Request: No valid session ID provided',
-                    },
-                    id: null,
-                }));
-            }
-            await transport.handleRequest(req.raw, res.raw, req.body);
-            return res;
-        }
-        else if (req.method === 'GET' || req.method === 'DELETE') {
-            const sessionId = req.headers['mcp-session-id'];
-            if (!sessionId || !transports[sessionId]) {
-                return res.status(400).send('Invalid or missing session ID');
-            }
-            const transport = transports[sessionId];
-            await transport.handleRequest(req.raw, res.raw);
-            return res;
-        }
-        return res.status(405).send('Method Not Allowed');
+        const bodyText = req.method === 'POST' && req.body !== undefined ? JSON.stringify(req.body) : undefined;
+        const response = await handleMcpHttpRequest(req.unchainedContext, toWebRequest(req.raw, res.raw, bodyText), req.method === 'POST' ? req.body : undefined);
+        res.status(response.status);
+        response.headers.forEach((value, key) => {
+            if (key === 'set-cookie')
+                return;
+            res.header(key, value);
+        });
+        const setCookie = response.headers.getSetCookie();
+        if (setCookie.length)
+            res.header('set-cookie', setCookie);
+        if (!response.body)
+            return res.send();
+        return res.send(Readable.fromWeb(response.body));
     }
-    catch (e) {
-        logger.error(e);
-        return res.status(503).send({ name: e.name, code: e.code, message: e.message });
+    catch (error) {
+        logger.error(error);
+        if (!res.sent) {
+            return res.status(500).send({ error: 'Internal Server Error' });
+        }
+        res.raw.destroy();
+        return res;
     }
 };
 export default mcpHandler;

package/lib/loaders/cartLoader.d.ts

@@ -0,0 +1,13 @@
+import type { UnchainedCore } from '@unchainedshop/core';
+import type { Order } from '@unchainedshop/core-orders';
+import DataLoader from 'dataloader';
+declare const _default: (unchainedAPI: UnchainedCore) => DataLoader<{
+    userId: string;
+    countryCode?: string;
+    orderNumber?: string;
+}, Order | null, {
+    userId: string;
+    countryCode?: string;
+    orderNumber?: string;
+}>;
+export default _default;

package/lib/loaders/cartLoader.js

@@ -0,0 +1,8 @@
+import DataLoader from 'dataloader';
+export default (unchainedAPI) => new DataLoader(async (queries) => {
+    const userIds = [...new Set(queries.map((q) => q.userId).filter(Boolean))];
+    const carts = await unchainedAPI.modules.orders.findCarts({ userIds });
+    return queries.map((q) => carts.find((cart) => cart.userId === q.userId &&
+        (!q.countryCode || cart.countryCode === q.countryCode) &&
+        (!q.orderNumber || cart.orderNumber === q.orderNumber)) || null);
+});

package/lib/loaders/index.d.ts

@@ -166,6 +166,15 @@ declare const loaders: (unchainedAPI: UnchainedCore) => {
     }, import("@unchainedshop/core-orders").Order, {
         orderId: string;
     }>;
+    cartLoader: import("dataloader")<{
+        userId: string;
+        countryCode?: string;
+        orderNumber?: string;
+    }, import("@unchainedshop/core-orders").Order | null, {
+        userId: string;
+        countryCode?: string;
+        orderNumber?: string;
+    }>;
     quotationLoader: import("dataloader")<{
         quotationId: string;
     }, import("@unchainedshop/core-quotations").Quotation | null, {

package/lib/loaders/index.js

@@ -26,6 +26,7 @@ import deliveryProviderLoader from "./deliveryProviderLoader.js";
 import paymentProviderLoader from "./paymentProviderLoader.js";
 import warehousingProviderLoader from "./warehousingProviderLoader.js";
 import orderLoader from "./orderLoader.js";
+import cartLoader from "./cartLoader.js";
 import quotationLoader from "./quotationLoader.js";
 import tokenExportStatusLoader from "./tokenExportStatusLoader.js";
 const loaders = (unchainedAPI) => {
@@ -58,6 +59,7 @@ const loaders = (unchainedAPI) => {
         paymentProviderLoader: paymentProviderLoader(unchainedAPI),
         warehousingProviderLoader: warehousingProviderLoader(unchainedAPI),
         orderLoader: orderLoader(unchainedAPI),
+        cartLoader: cartLoader(unchainedAPI),
         quotationLoader: quotationLoader(unchainedAPI),
         tokenExportStatusLoader: tokenExportStatusLoader(unchainedAPI),
     };

package/lib/locale-context.d.ts

@@ -6,12 +6,10 @@ export interface UnchainedLocaleContext {
     currencyCode: string;
 }
 export type GetHeaderFn = (key: string) => string | string[];
-export declare const resolveDefaultContext: (({ acceptLang, acceptCountry }: {
+export declare const resolveDefaultContext: import("@unchainedshop/utils/lib/memoize-with-ttl.js").MemoizedWithTTL<[{
     acceptLang: any;
     acceptCountry: any;
-}, unchainedAPI: UnchainedCore) => Promise<UnchainedLocaleContext>) & {
-    clear: () => void;
-};
+}, unchainedAPI: UnchainedCore], UnchainedLocaleContext>;
 export declare const getLocaleContext: ({ getHeader, }: {
     getHeader: UnchainedHTTPServerContext["getHeader"];
 }, unchainedAPI: UnchainedCore) => Promise<UnchainedLocaleContext>;

package/lib/locale-context.js

@@ -16,7 +16,8 @@ const uncachedResolveDefaultContext = async ({ acceptLang, acceptCountry }, unch
     };
     return newContext;
 };
-export const resolveDefaultContext = memoizeWithTTL(uncachedResolveDefaultContext, process.env.NODE_ENV === 'production' ? 1000 * 60 : 1, {
+export const resolveDefaultContext = memoizeWithTTL(uncachedResolveDefaultContext, {
+    ttl: process.env.NODE_ENV === 'production' ? 1000 * 60 : 1,
     cacheKey: (args) => {
         const [{ acceptLang, acceptCountry }] = args;
         return `${acceptLang}-${acceptCountry}`;

package/lib/mcp/handleMcpHttpRequest.d.ts

@@ -0,0 +1,2 @@
+import type { Context } from '../context.ts';
+export default function handleMcpHttpRequest(context: Context | undefined, request: Request, parsedBody?: unknown): Promise<Response>;

package/lib/mcp/handleMcpHttpRequest.js

@@ -0,0 +1,83 @@
+import { createLogger } from '@unchainedshop/logger';
+import createMcpServer from "./index.js";
+import { isPeerNotInstalledError } from "../utils/optionalPeerError.js";
+const logger = createLogger('unchained:api:mcp');
+let createMcpHandler;
+let McpServer;
+let hostHeaderValidationResponse;
+let originValidationResponse;
+let localhostAllowedHostnames;
+let localhostAllowedOrigins;
+try {
+    const mcpSDKServer = await import('@modelcontextprotocol/server');
+    createMcpHandler = mcpSDKServer.createMcpHandler;
+    McpServer = mcpSDKServer.McpServer;
+    hostHeaderValidationResponse = mcpSDKServer.hostHeaderValidationResponse;
+    originValidationResponse = mcpSDKServer.originValidationResponse;
+    localhostAllowedHostnames = mcpSDKServer.localhostAllowedHostnames;
+    localhostAllowedOrigins = mcpSDKServer.localhostAllowedOrigins;
+}
+catch (error) {
+    if (isPeerNotInstalledError('@modelcontextprotocol/server', error)) {
+        logger.warn(`optional peer npm package '@modelcontextprotocol/server' not installed, mcp will not work`);
+    }
+    else {
+        logger.error(`failed to load '@modelcontextprotocol/server'`, error);
+    }
+}
+let handler;
+const getHandler = () => {
+    handler ??= createMcpHandler(async ({ authInfo }) => {
+        const { context, roles } = authInfo.extra;
+        return createMcpServer(new McpServer({ name: 'Unchained MCP Server', version: '1.0.0' }), context, roles);
+    });
+    return handler;
+};
+const resourceUrl = () => process.env.ROOT_URL || 'http://localhost:4010';
+const configuredHostname = () => {
+    try {
+        return new URL(resourceUrl()).hostname;
+    }
+    catch {
+        return 'localhost';
+    }
+};
+const allowedHostnames = () => [...new Set([...localhostAllowedHostnames(), configuredHostname()])];
+const allowedOrigins = () => [...new Set([...localhostAllowedOrigins(), configuredHostname()])];
+export default async function handleMcpHttpRequest(context, request, parsedBody) {
+    const user = context?.user;
+    if (!user) {
+        return Response.json({
+            error: 'invalid_token',
+            resource_metadata: `${resourceUrl()}/.well-known/oauth-protected-resource`,
+        }, {
+            status: 401,
+            headers: {
+                'WWW-Authenticate': `Bearer realm="Unchained MCP", error="invalid_token", resource="${resourceUrl()}",`,
+            },
+        });
+    }
+    const roles = user.roles || [];
+    if (!roles.includes('admin')) {
+        return Response.json({ error: 'forbidden', message: 'MCP requires admin privileges' }, { status: 403 });
+    }
+    if (!createMcpHandler) {
+        return Response.json({
+            error: 'unavailable',
+            message: `MCP is enabled but the optional peer npm package '@modelcontextprotocol/server' is not installed`,
+        }, { status: 503 });
+    }
+    const validationFailure = hostHeaderValidationResponse(request, allowedHostnames()) ??
+        originValidationResponse(request, allowedOrigins());
+    if (validationFailure)
+        return validationFailure;
+    return getHandler().fetch(request, {
+        authInfo: {
+            token: 'unchained-context',
+            clientId: user._id,
+            scopes: roles,
+            extra: { context, roles },
+        },
+        parsedBody,
+    });
+}

package/lib/mcp/index.d.ts

@@ -1,3 +1,3 @@
-import type { McpServer as McpServerType } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { McpServer as McpServerType } from '@modelcontextprotocol/server';
 import type { Context } from '../context.ts';
 export default function createMcpServer(server: McpServerType, context: Context, roles: any): McpServerType;

package/lib/mcp/nodeHttpBridge.d.ts

@@ -0,0 +1,3 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+export declare function toWebRequest(req: IncomingMessage, res: ServerResponse, bodyText?: string): Request;
+export declare function sendWebResponse(res: ServerResponse, response: Response): Promise<void>;

package/lib/mcp/nodeHttpBridge.js

@@ -0,0 +1,64 @@
+import { Readable, pipeline } from 'node:stream';
+export function toWebRequest(req, res, bodyText) {
+    const controller = new AbortController();
+    res.once('close', () => {
+        if (!res.writableFinished)
+            controller.abort();
+    });
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(req.headers)) {
+        if (Array.isArray(value)) {
+            for (const entry of value)
+                headers.append(key, entry);
+        }
+        else if (value != null) {
+            headers.set(key, value);
+        }
+    }
+    if (bodyText !== undefined)
+        headers.delete('content-length');
+    let url;
+    try {
+        url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
+    }
+    catch {
+        try {
+            url = new URL(req.url || '/', 'http://localhost');
+        }
+        catch {
+            url = new URL('http://localhost/');
+        }
+    }
+    return new Request(url, {
+        method: req.method,
+        headers,
+        body: bodyText,
+        signal: controller.signal,
+    });
+}
+export async function sendWebResponse(res, response) {
+    if (res.destroyed || res.writableEnded) {
+        await response.body?.cancel().catch(() => undefined);
+        return;
+    }
+    const headers = {};
+    response.headers.forEach((value, key) => {
+        headers[key] = key === 'set-cookie' ? response.headers.getSetCookie() : value;
+    });
+    res.writeHead(response.status, headers);
+    if (!response.body) {
+        res.end();
+        return;
+    }
+    const nodeStream = Readable.fromWeb(response.body);
+    await new Promise((resolve, reject) => {
+        pipeline(nodeStream, res, (error) => {
+            if (!error || error.code === 'ERR_STREAM_PREMATURE_CLOSE') {
+                resolve();
+            }
+            else {
+                reject(error);
+            }
+        });
+    });
+}