@vendoai/vendo 0.4.0

package/dist/cli/mcp/index.d.ts

@@ -0,0 +1,7 @@
+import { type Output, type TelemetryOptions } from "../shared.js";
+export interface McpOptions {
+    output?: Output;
+    /** Injectable telemetry deps (matches init/doctor). */
+    telemetry?: TelemetryOptions;
+}
+export declare function runMcp(args: string[], options?: McpOptions): Promise<number>;

package/dist/cli/mcp/index.js

@@ -0,0 +1,59 @@
+import { consoleOutput, withCommandRun } from "../shared.js";
+import { runServerJson } from "./server-json.js";
+import { runVerifyDomain } from "./verify-domain.js";
+const HELP = `vendo mcp — MCP registry discovery tooling\n\nUsage:\n  vendo mcp server-json [dir] --domain <domain> --url <public-mcp-url> [--force]\n  vendo mcp verify-domain [dir] --domain <domain> --key-out <path> [--write-well-known <dir>]\n\nCommands:\n  vendo mcp server-json    Generate and validate the official registry server.json\n  vendo mcp verify-domain Generate Ed25519 DNS and HTTP domain-verification material\n`;
+const VALUE_OPTIONS = new Set(["--domain", "--url", "--key-out", "--write-well-known"]);
+function option(args, name) {
+    const exact = args.indexOf(name);
+    if (exact >= 0) {
+        const value = args[exact + 1];
+        return value !== undefined && !value.startsWith("--") ? value : undefined;
+    }
+    return args.find((value) => value.startsWith(`${name}=`))?.slice(name.length + 1);
+}
+function target(args) {
+    for (let index = 0; index < args.length; index += 1) {
+        const value = args[index];
+        if (VALUE_OPTIONS.has(value)) {
+            index += 1;
+            continue;
+        }
+        if (!value.startsWith("--"))
+            return value;
+    }
+    return process.cwd();
+}
+export async function runMcp(args, options = {}) {
+    const output = options.output ?? consoleOutput;
+    const [command, ...commandArgs] = args;
+    if (command === undefined || command === "--help" || command === "-h") {
+        output.log(HELP);
+        return 0;
+    }
+    return withCommandRun({
+        command: "mcp",
+        ...(options.telemetry === undefined ? {} : { telemetry: options.telemetry }),
+    }, async (failure) => {
+        if (command === "server-json") {
+            return runServerJson({
+                targetDir: target(commandArgs),
+                domain: option(commandArgs, "--domain"),
+                url: option(commandArgs, "--url"),
+                force: commandArgs.includes("--force"),
+                output,
+            });
+        }
+        if (command === "verify-domain") {
+            return runVerifyDomain({
+                targetDir: target(commandArgs),
+                domain: option(commandArgs, "--domain"),
+                keyOut: option(commandArgs, "--key-out"),
+                writeWellKnown: option(commandArgs, "--write-well-known"),
+                output,
+            });
+        }
+        failure.failedStep = "unknown-command";
+        output.error(`Unknown mcp command: ${command}\n\n${HELP}`);
+        return 1;
+    });
+}

package/dist/cli/mcp/registry.d.ts

@@ -0,0 +1,9 @@
+export declare const SERVER_SCHEMA_URL = "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json";
+export declare function normalizeDomain(input: string): string;
+export declare function registryNamespace(domain: string): string;
+export declare function packageSlug(name: string): string;
+export declare function remoteUrls(value: unknown): string[];
+/** 10-mcp §5 — validate with the vendored registry schema, then enforce the
+ * registry's domain-namespace rule that JSON Schema cannot express. */
+export declare function validateRegistryServer(value: unknown): string[];
+export declare function sameUrl(left: string, right: string): boolean;

package/dist/cli/mcp/registry.js

@@ -0,0 +1,117 @@
+import Ajv from "ajv";
+import addFormats from "ajv-formats";
+import { isPlainObject as isRecord } from "@vendoai/core";
+import serverSchema from "./server.schema.json" with { type: "json" };
+export const SERVER_SCHEMA_URL = "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json";
+const ajv = new Ajv({ allErrors: true, strict: false });
+addFormats(ajv);
+const validatePinnedSchema = ajv.compile(serverSchema);
+function schemaError(error) {
+    const path = error.instancePath.length > 0 ? error.instancePath : "/";
+    return `${path} ${error.message ?? "is invalid"}`;
+}
+export function normalizeDomain(input) {
+    const domain = input.trim().toLowerCase().replace(/\.$/, "");
+    const label = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
+    if (domain.length > 253 || !new RegExp(`^(?:${label}\\.)+${label}$`).test(domain)) {
+        throw new Error(`Invalid registry domain: ${input}`);
+    }
+    return domain;
+}
+export function registryNamespace(domain) {
+    return normalizeDomain(domain).split(".").reverse().join(".");
+}
+function registryDomain(name) {
+    const parts = name.split("/");
+    if (parts.length !== 2 || parts[0] === undefined || parts[0].length === 0)
+        return null;
+    const domain = parts[0].split(".").reverse().join(".").toLowerCase();
+    try {
+        return normalizeDomain(domain);
+    }
+    catch {
+        return null;
+    }
+}
+export function packageSlug(name) {
+    const unscoped = name.split("/").at(-1) ?? name;
+    const slug = unscoped.toLowerCase()
+        .replace(/[^a-z0-9._-]+/g, "-")
+        .replace(/^[._-]+|[._-]+$/g, "");
+    return slug.length > 0 ? slug : "vendo";
+}
+function urlHost(value) {
+    try {
+        const parsed = new URL(value);
+        if (parsed.protocol !== "https:" && parsed.protocol !== "http:")
+            return null;
+        return parsed.hostname.toLowerCase().replace(/\.$/, "");
+    }
+    catch {
+        return null;
+    }
+}
+function hostMatchesDomain(host, domain) {
+    const normalizedHost = host.toLowerCase().replace(/\.$/, "");
+    const normalizedDomain = normalizeDomain(domain);
+    return normalizedHost === normalizedDomain || normalizedHost.endsWith(`.${normalizedDomain}`);
+}
+export function remoteUrls(value) {
+    if (!isRecord(value) || !Array.isArray(value.remotes))
+        return [];
+    return value.remotes.flatMap((remote) => {
+        if (!isRecord(remote) || remote.type !== "streamable-http" || typeof remote.url !== "string")
+            return [];
+        return [remote.url];
+    });
+}
+/** 10-mcp §5 — validate with the vendored registry schema, then enforce the
+ * registry's domain-namespace rule that JSON Schema cannot express. */
+export function validateRegistryServer(value) {
+    const errors = [];
+    if (!validatePinnedSchema(value))
+        errors.push(...(validatePinnedSchema.errors ?? []).map(schemaError));
+    if (!isRecord(value))
+        return errors;
+    if (value.$schema !== undefined && value.$schema !== SERVER_SCHEMA_URL) {
+        errors.push(`/$schema must be ${SERVER_SCHEMA_URL}`);
+    }
+    const packages = Array.isArray(value.packages) ? value.packages : [];
+    const remotes = Array.isArray(value.remotes) ? value.remotes : [];
+    if (packages.length === 0 && remotes.length === 0) {
+        errors.push("/ must include at least one package or remote");
+    }
+    if (typeof value.name !== "string")
+        return errors;
+    const domain = registryDomain(value.name);
+    if (domain === null) {
+        errors.push("/name must use a reversible domain namespace");
+        return errors;
+    }
+    for (const remote of remotes) {
+        if (!isRecord(remote) || typeof remote.url !== "string")
+            continue;
+        const host = urlHost(remote.url);
+        if (host === null)
+            continue;
+        if (!hostMatchesDomain(host, domain)) {
+            errors.push(`/remotes remote URL must use ${domain} or one of its subdomains`);
+        }
+    }
+    return errors;
+}
+export function sameUrl(left, right) {
+    try {
+        const normalize = (value) => {
+            const url = new URL(value);
+            url.hash = "";
+            if (url.pathname !== "/")
+                url.pathname = url.pathname.replace(/\/$/, "");
+            return url.href;
+        };
+        return normalize(left) === normalize(right);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/cli/mcp/server-json.d.ts

@@ -0,0 +1,12 @@
+import { type Output } from "../shared.js";
+export interface ServerJsonOptions {
+    targetDir: string;
+    domain?: string;
+    url?: string;
+    force?: boolean;
+    prompt?: (question: string) => Promise<string>;
+    output?: Output;
+}
+/** 10-mcp §5 — generate the official-registry artifact from the same host
+ * package.json identity the door advertises, plus explicit public discovery. */
+export declare function runServerJson(options: ServerJsonOptions): Promise<number>;

package/dist/cli/mcp/server-json.js

@@ -0,0 +1,65 @@
+import { readFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { stdin, stdout } from "node:process";
+import { createInterface } from "node:readline/promises";
+import { consoleOutput, exists, writeText } from "../shared.js";
+import { packageSlug, registryNamespace, SERVER_SCHEMA_URL, validateRegistryServer, } from "./registry.js";
+async function promptOnce(question) {
+    const readline = createInterface({ input: stdin, output: stdout });
+    try {
+        return await readline.question(question);
+    }
+    finally {
+        readline.close();
+    }
+}
+async function hostIdentity(root) {
+    const raw = await readFile(join(root, "package.json"), "utf8");
+    const manifest = JSON.parse(raw);
+    const name = typeof manifest.name === "string" ? manifest.name : "vendo";
+    const version = typeof manifest.version === "string" ? manifest.version : "0.0.0";
+    const description = typeof manifest.description === "string" ? manifest.description : `${name} MCP server`;
+    return {
+        name,
+        version,
+        description,
+        ...(typeof manifest.homepage === "string" ? { websiteUrl: manifest.homepage } : {}),
+    };
+}
+/** 10-mcp §5 — generate the official-registry artifact from the same host
+ * package.json identity the door advertises, plus explicit public discovery. */
+export async function runServerJson(options) {
+    const root = resolve(options.targetDir);
+    const output = options.output ?? consoleOutput;
+    const path = join(root, "server.json");
+    if (!options.force && await exists(path)) {
+        output.error("server.json already exists; pass --force to overwrite it");
+        return 1;
+    }
+    try {
+        const prompt = options.prompt ?? promptOnce;
+        const domain = options.domain ?? await prompt("Registry domain (for example example.com): ");
+        const publicUrl = options.url ?? await prompt("Public MCP URL: ");
+        const identity = await hostIdentity(root);
+        const server = {
+            $schema: SERVER_SCHEMA_URL,
+            name: `${registryNamespace(domain)}/${packageSlug(identity.name)}`,
+            description: identity.description,
+            version: identity.version,
+            remotes: [{ type: "streamable-http", url: publicUrl.trim() }],
+            ...(identity.websiteUrl === undefined ? {} : { websiteUrl: identity.websiteUrl }),
+        };
+        const errors = validateRegistryServer(server);
+        if (errors.length > 0) {
+            output.error(`server.json is invalid:\n${errors.map((error) => `- ${error}`).join("\n")}`);
+            return 1;
+        }
+        await writeText(path, `${JSON.stringify(server, null, 2)}\n`);
+        output.log(`Wrote server.json for ${server.name}`);
+        return 0;
+    }
+    catch (error) {
+        output.error(`Could not generate server.json: ${error instanceof Error ? error.message : "unknown error"}`);
+        return 1;
+    }
+}