@webpieces/mcp-server 0.4.990 → 0.4.991

package/src/WpMcpInMemory.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WpMcpInMemory = void 0;
+const client_1 = require("@modelcontextprotocol/client");
+const server_1 = require("@modelcontextprotocol/server");
+const core_util_1 = require("@webpieces/core-util");
+const core_context_1 = require("@webpieces/core-context");
+const McpToolset_1 = require("./McpToolset");
+/** In-memory MCP has no socket to lose, so its disconnect signal never fires; cancellation is the SDK's. */
+const NEVER_DISCONNECTED = new AbortController().signal;
+/**
+ * One end of the SDK's linked in-memory pair, sending each message as the WIRE would: a JSON copy.
+ * The SDK pair hands the receiver the sender's object itself, so a class-typed schema or a caller's
+ * DTO instance would reach the other side by reference and fail the SDK's plain-JSON validation (or
+ * be mutated across the boundary). The copy is made synchronously inside `send`, so the receiver
+ * still runs in the SENDER's async context — which is what lets the toolset read the caller per request.
+ */
+class McpWireCopyTransport {
+    inner;
+    constructor(inner) {
+        this.inner = inner;
+    }
+    get onmessage() {
+        return this.inner.onmessage;
+    }
+    set onmessage(handler) {
+        this.inner.onmessage = handler;
+    }
+    get onclose() {
+        return this.inner.onclose;
+    }
+    set onclose(handler) {
+        this.inner.onclose = handler;
+    }
+    get onerror() {
+        return this.inner.onerror;
+    }
+    set onerror(handler) {
+        this.inner.onerror = handler;
+    }
+    start() {
+        return this.inner.start();
+    }
+    close() {
+        return this.inner.close();
+    }
+    send(message, options) {
+        return this.inner.send(JSON.parse(JSON.stringify(message)), options);
+    }
+}
+/**
+ * The in-memory transport over an {@link McpToolset}: an official MCP SDK `Client` wired to the
+ * toolset's server through the SDK's linked `InMemoryTransport` pair, for an agent that runs its model
+ * loop in-process and already holds a verified caller in its `RequestContext`.
+ *
+ * ```ts
+ * const client: Client = await WpMcpInMemory.connect(toolset);   // once per process
+ * // ...inside a request whose caller AuthFilter already verified:
+ * const { tools } = await client.listTools();                    // only what THIS caller may see
+ * await client.callTool({ name: 'stores_pause', arguments: { storeId } });
+ * ```
+ *
+ * NO CREDENTIAL. The caller is whoever is trusted in the `RequestContext` of the code calling
+ * `client.listTools()` / `client.callTool()`, READ PER REQUEST and NEVER captured at connect. Apps cache
+ * one client per process, so a connect-time capture would run user B's call as user A. The SDK's
+ * in-memory transport delivers each message synchronously inside the caller's own `send`, so the
+ * toolset's handlers run in the caller's async context; a call made outside any `RequestContext` is
+ * refused rather than run as nobody.
+ *
+ * The caller's scope is the one the tool runs in: a local binding's `InvocationAuthentication` needs
+ * that scope to have completed verified ingress (it did, if an endpoint's `AuthFilter` admitted the
+ * request). That is also why `McpToolset` refuses a SERVICE_ONLY tool: the caller's own service hop
+ * would satisfy it for every model behind it. No tools/list cache hint is sent, so one shared client
+ * never serves user A's list to user B.
+ */
+class WpMcpInMemory {
+    // webpieces-disable no-function-outside-class -- explicit public factory of a connected SDK client
+    static async connect(toolset) {
+        const pair = server_1.InMemoryTransport.createLinkedPair();
+        const server = toolset.createSdkServer({ name: 'webpieces-mcp-toolset', version: toolset.revision }, { capabilities: { tools: { listChanged: true } } }, async () => {
+            if (!core_context_1.RequestContext.isActive()) {
+                throw new core_util_1.ApiImplementationError('WpMcpInMemory client calls must run inside the RequestContext of a verified caller; ' +
+                    'the in-memory transport reads the caller from it on every request.');
+            }
+            return new McpToolset_1.McpToolRequest(await toolset.authorizedTools(), NEVER_DISCONNECTED);
+        }, (name) => toolset.registry.find(name));
+        await server.connect(new McpWireCopyTransport(pair[1]));
+        const client = new client_1.Client({
+            name: 'webpieces-in-memory-client',
+            version: toolset.revision,
+        });
+        await client.connect(new McpWireCopyTransport(pair[0]));
+        return client;
+    }
+}
+exports.WpMcpInMemory = WpMcpInMemory;
+//# sourceMappingURL=WpMcpInMemory.js.map

package/src/WpMcpInMemory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WpMcpInMemory.js","sourceRoot":"","sources":["../../../../../packages/http/mcp-server/src/WpMcpInMemory.ts"],"names":[],"mappings":";;;AAAA,yDAAsD;AACtD,yDAKsC;AACtC,oDAA8D;AAC9D,0DAAyD;AACzD,6CAA0D;AAG1D,4GAA4G;AAC5G,MAAM,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,oBAAoB;IACO;IAA7B,YAA6B,KAAwB;QAAxB,UAAK,GAAL,KAAK,CAAmB;IAAG,CAAC;IAEzD,IAAI,SAAS;QACT,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;IAChC,CAAC;IAED,IAAI,SAAS,CAAC,OAA+B;QACzC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC;IACnC,CAAC;IAED,IAAI,OAAO;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO,CAAC,OAA6B;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACjC,CAAC;IAED,IAAI,OAAO;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO,CAAC,OAA6B;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACjC,CAAC;IAED,KAAK;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,OAAuB,EAAE,OAA8B;QACxD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAmB,EAAE,OAAO,CAAC,CAAC;IAC3F,CAAC;CACJ;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAa,aAAa;IACtB,mGAAmG;IACnG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAmB;QACpC,MAAM,IAAI,GAAG,0BAAiB,CAAC,gBAAgB,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,CAClC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,EAC5D,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,EAClD,KAAK,IAA6B,EAAE;YAChC,IAAI,CAAC,6BAAc,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC7B,MAAM,IAAI,kCAAsB,CAC5B,sFAAsF;oBAClF,oEAAoE,CAC3E,CAAC;YACN,CAAC;YACD,OAAO,IAAI,2BAAc,CAAC,MAAM,OAAO,CAAC,eAAe,EAAE,EAAE,kBAAkB,CAAC,CAAC;QACnF,CAAC,EACD,CAAC,IAAY,EAAiC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAC/E,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC;YACtB,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,OAAO,CAAC,QAAQ;SAC5B,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AA1BD,sCA0BC","sourcesContent":["import { Client } from '@modelcontextprotocol/client';\nimport {\n    InMemoryTransport,\n    JSONRPCMessage,\n    Transport,\n    TransportSendOptions,\n} from '@modelcontextprotocol/server';\nimport { ApiImplementationError } from '@webpieces/core-util';\nimport { RequestContext } from '@webpieces/core-context';\nimport { McpToolRequest, McpToolset } from './McpToolset';\nimport { RegisteredMcpTool } from './McpToolRegistry';\n\n/** In-memory MCP has no socket to lose, so its disconnect signal never fires; cancellation is the SDK's. */\nconst NEVER_DISCONNECTED = new AbortController().signal;\n\n/**\n * One end of the SDK's linked in-memory pair, sending each message as the WIRE would: a JSON copy.\n * The SDK pair hands the receiver the sender's object itself, so a class-typed schema or a caller's\n * DTO instance would reach the other side by reference and fail the SDK's plain-JSON validation (or\n * be mutated across the boundary). The copy is made synchronously inside `send`, so the receiver\n * still runs in the SENDER's async context — which is what lets the toolset read the caller per request.\n */\nclass McpWireCopyTransport implements Transport {\n    constructor(private readonly inner: InMemoryTransport) {}\n\n    get onmessage(): Transport['onmessage'] {\n        return this.inner.onmessage;\n    }\n\n    set onmessage(handler: Transport['onmessage']) {\n        this.inner.onmessage = handler;\n    }\n\n    get onclose(): Transport['onclose'] {\n        return this.inner.onclose;\n    }\n\n    set onclose(handler: Transport['onclose']) {\n        this.inner.onclose = handler;\n    }\n\n    get onerror(): Transport['onerror'] {\n        return this.inner.onerror;\n    }\n\n    set onerror(handler: Transport['onerror']) {\n        this.inner.onerror = handler;\n    }\n\n    start(): Promise<void> {\n        return this.inner.start();\n    }\n\n    close(): Promise<void> {\n        return this.inner.close();\n    }\n\n    send(message: JSONRPCMessage, options?: TransportSendOptions): Promise<void> {\n        return this.inner.send(JSON.parse(JSON.stringify(message)) as JSONRPCMessage, options);\n    }\n}\n\n/**\n * The in-memory transport over an {@link McpToolset}: an official MCP SDK `Client` wired to the\n * toolset's server through the SDK's linked `InMemoryTransport` pair, for an agent that runs its model\n * loop in-process and already holds a verified caller in its `RequestContext`.\n *\n * ```ts\n * const client: Client = await WpMcpInMemory.connect(toolset);   // once per process\n * // ...inside a request whose caller AuthFilter already verified:\n * const { tools } = await client.listTools();                    // only what THIS caller may see\n * await client.callTool({ name: 'stores_pause', arguments: { storeId } });\n * ```\n *\n * NO CREDENTIAL. The caller is whoever is trusted in the `RequestContext` of the code calling\n * `client.listTools()` / `client.callTool()`, READ PER REQUEST and NEVER captured at connect. Apps cache\n * one client per process, so a connect-time capture would run user B's call as user A. The SDK's\n * in-memory transport delivers each message synchronously inside the caller's own `send`, so the\n * toolset's handlers run in the caller's async context; a call made outside any `RequestContext` is\n * refused rather than run as nobody.\n *\n * The caller's scope is the one the tool runs in: a local binding's `InvocationAuthentication` needs\n * that scope to have completed verified ingress (it did, if an endpoint's `AuthFilter` admitted the\n * request). That is also why `McpToolset` refuses a SERVICE_ONLY tool: the caller's own service hop\n * would satisfy it for every model behind it. No tools/list cache hint is sent, so one shared client\n * never serves user A's list to user B.\n */\nexport class WpMcpInMemory {\n    // webpieces-disable no-function-outside-class -- explicit public factory of a connected SDK client\n    static async connect(toolset: McpToolset): Promise<Client> {\n        const pair = InMemoryTransport.createLinkedPair();\n        const server = toolset.createSdkServer(\n            { name: 'webpieces-mcp-toolset', version: toolset.revision },\n            { capabilities: { tools: { listChanged: true } } },\n            async (): Promise<McpToolRequest> => {\n                if (!RequestContext.isActive()) {\n                    throw new ApiImplementationError(\n                        'WpMcpInMemory client calls must run inside the RequestContext of a verified caller; ' +\n                            'the in-memory transport reads the caller from it on every request.',\n                    );\n                }\n                return new McpToolRequest(await toolset.authorizedTools(), NEVER_DISCONNECTED);\n            },\n            (name: string): RegisteredMcpTool | undefined => toolset.registry.find(name),\n        );\n        await server.connect(new McpWireCopyTransport(pair[1]));\n        const client = new Client({\n            name: 'webpieces-in-memory-client',\n            version: toolset.revision,\n        });\n        await client.connect(new McpWireCopyTransport(pair[0]));\n        return client;\n    }\n}\n"]}

package/src/WpMcpRemote.d.ts

@@ -0,0 +1,23 @@
+import { Client } from '@modelcontextprotocol/client';
+import { OidcAuthMethod } from '@webpieces/core-util';
+/** What mints an OIDC ID token for a callee: `GcpOidc` from `@webpieces/gcp-identity` (or a test double). */
+export interface McpIdTokenMinter {
+    mintIdToken(audience: string): Promise<string>;
+}
+/**
+ * The client for the HTTP transport's internal door: an official MCP SDK `Client` that calls another
+ * service's `WpMcpServer` whose `setAuth([...])` admits `oidcSameProject()` / `oidcSvcs([...])`.
+ *
+ * ```ts
+ * const client = await WpMcpRemote.connect('https://svc-b.example.com/mcp/user', oidcSameProject(), gcpOidc);
+ * ```
+ *
+ * PER POST, never at connect: each request mints its own OIDC ID token (audience = the callee origin)
+ * and carries the CURRENT `RequestContext`'s trusted keys, so the callee's `@WpAuthorization` judges the
+ * user on whose behalf THIS call is made. Apps cache one client per process, and a connect-time capture
+ * would run user B's call as user A — the same reason the in-memory transport reads the caller per
+ * request. No response is cached, for the same reason.
+ */
+export declare class WpMcpRemote {
+    static connect(url: string, auth: OidcAuthMethod, minter: McpIdTokenMinter): Promise<Client>;
+}

package/src/WpMcpRemote.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WpMcpRemote = void 0;
+const client_1 = require("@modelcontextprotocol/client");
+const core_util_1 = require("@webpieces/core-util");
+const core_context_1 = require("@webpieces/core-context");
+/**
+ * A response cache that stores nothing. A remote MCP server answers tools/list per CALLER (its
+ * `@WpAuthorization` projection) with a `private` cache hint, and one cached client serves many
+ * callers, so a cached list would hand user A's tools to user B. Every request goes to the server.
+ */
+class McpNoResponseCache {
+    get(_key) {
+        return undefined;
+    }
+    set(_key, _entry) {
+        return 0;
+    }
+    delete(_key) {
+        return;
+    }
+    evict(_method) {
+        return;
+    }
+    clear() {
+        return;
+    }
+}
+/**
+ * Per-POST credentials and context for one remote MCP endpoint: mints a fresh OIDC ID token for the
+ * callee's origin (exactly as `http-client-node`'s `OutboundAuthFilter` does) and forwards the CURRENT
+ * `RequestContext`'s transferable keys the way every OIDC hop does — trusted ones included, because an
+ * OIDC destination verifies its caller (`DestinationTrust.forAuthMode`).
+ */
+class McpOidcPost {
+    audience;
+    minter;
+    headers = new core_context_1.RequestContextHeaders();
+    trust;
+    constructor(audience, auth, minter) {
+        this.audience = audience;
+        this.minter = minter;
+        this.trust = core_util_1.DestinationTrust.forAuthMode(auth);
+    }
+    async send(url, init) {
+        const headers = new Headers(init?.headers);
+        if (core_context_1.RequestContext.isActive()) {
+            for (const entry of this.headers.buildOutboundHeaders(this.trust)) {
+                headers.set(entry[0], entry[1]);
+            }
+        }
+        headers.set('Authorization', `Bearer ${await this.minter.mintIdToken(this.audience)}`);
+        // webpieces-disable no-fetch -- the MCP SDK's StreamableHTTPClientTransport is the protocol client; this is only the fetch it is handed, decorated with per-POST OIDC and context headers
+        return fetch(url, { ...init, headers });
+    }
+}
+/**
+ * The client for the HTTP transport's internal door: an official MCP SDK `Client` that calls another
+ * service's `WpMcpServer` whose `setAuth([...])` admits `oidcSameProject()` / `oidcSvcs([...])`.
+ *
+ * ```ts
+ * const client = await WpMcpRemote.connect('https://svc-b.example.com/mcp/user', oidcSameProject(), gcpOidc);
+ * ```
+ *
+ * PER POST, never at connect: each request mints its own OIDC ID token (audience = the callee origin)
+ * and carries the CURRENT `RequestContext`'s trusted keys, so the callee's `@WpAuthorization` judges the
+ * user on whose behalf THIS call is made. Apps cache one client per process, and a connect-time capture
+ * would run user B's call as user A — the same reason the in-memory transport reads the caller per
+ * request. No response is cached, for the same reason.
+ */
+class WpMcpRemote {
+    // webpieces-disable no-function-outside-class -- explicit public factory of a connected SDK client
+    static async connect(url, auth, minter) {
+        if (!URL.canParse(url))
+            throw new Error(`WpMcpRemote.connect(...) requires an absolute URL, got '${url}'.`);
+        if (auth?.kind !== 'oidc') {
+            throw new Error('WpMcpRemote.connect(...) authenticates with oidcSameProject() or oidcSvcs([...]).');
+        }
+        const endpoint = new URL(url);
+        const post = new McpOidcPost(endpoint.origin, auth, minter);
+        const send = (target, init) => post.send(target, init);
+        const transport = new client_1.StreamableHTTPClientTransport(endpoint, { fetch: send });
+        const client = new client_1.Client({ name: 'webpieces-remote-client', version: '1.0.0' }, { responseCacheStore: new McpNoResponseCache() });
+        await client.connect(transport);
+        return client;
+    }
+}
+exports.WpMcpRemote = WpMcpRemote;
+//# sourceMappingURL=WpMcpRemote.js.map

package/src/WpMcpRemote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WpMcpRemote.js","sourceRoot":"","sources":["../../../../../packages/http/mcp-server/src/WpMcpRemote.ts"],"names":[],"mappings":";;;AAAA,yDAOsC;AACtC,oDAAwE;AACxE,0DAAgF;AAOhF;;;;GAIG;AACH,MAAM,kBAAkB;IACpB,GAAG,CAAC,IAAc;QACd,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,GAAG,CAAC,IAAc,EAAE,MAAc;QAC9B,OAAO,CAAC,CAAC;IACb,CAAC;IAED,MAAM,CAAC,IAAc;QACjB,OAAO;IACX,CAAC;IAED,KAAK,CAAC,OAAe;QACjB,OAAO;IACX,CAAC;IAED,KAAK;QACD,OAAO;IACX,CAAC;CACJ;AAED;;;;;GAKG;AACH,MAAM,WAAW;IAKQ;IAEA;IANJ,OAAO,GAAG,IAAI,oCAAqB,EAAE,CAAC;IACtC,KAAK,CAAmB;IAEzC,YACqB,QAAgB,EACjC,IAAoB,EACH,MAAwB;QAFxB,aAAQ,GAAR,QAAQ,CAAQ;QAEhB,WAAM,GAAN,MAAM,CAAkB;QAEzC,IAAI,CAAC,KAAK,GAAG,4BAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAiB,EAAE,IAAkB;QAC5C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,6BAAc,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC5B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvF,0LAA0L;QAC1L,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5C,CAAC;CACJ;AAED;;;;;;;;;;;;;GAaG;AACH,MAAa,WAAW;IACpB,mGAAmG;IACnG,MAAM,CAAC,KAAK,CAAC,OAAO,CAChB,GAAW,EACX,IAAoB,EACpB,MAAwB;QAExB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,2DAA2D,GAAG,IAAI,CAAC,CAAC;QACxF,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACX,mFAAmF,CACtF,CAAC;QACN,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAc,CAAC,MAAoB,EAAE,IAAkB,EAAqB,EAAE,CACpF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,sCAA6B,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,IAAI,eAAM,CACrB,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,OAAO,EAAE,EACrD,EAAE,kBAAkB,EAAE,IAAI,kBAAkB,EAAE,EAAE,CACnD,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AA1BD,kCA0BC","sourcesContent":["import {\n    CacheEntry,\n    CacheKey,\n    Client,\n    FetchLike,\n    ResponseCacheStore,\n    StreamableHTTPClientTransport,\n} from '@modelcontextprotocol/client';\nimport { DestinationTrust, OidcAuthMethod } from '@webpieces/core-util';\nimport { RequestContext, RequestContextHeaders } from '@webpieces/core-context';\n\n/** What mints an OIDC ID token for a callee: `GcpOidc` from `@webpieces/gcp-identity` (or a test double). */\nexport interface McpIdTokenMinter {\n    mintIdToken(audience: string): Promise<string>;\n}\n\n/**\n * A response cache that stores nothing. A remote MCP server answers tools/list per CALLER (its\n * `@WpAuthorization` projection) with a `private` cache hint, and one cached client serves many\n * callers, so a cached list would hand user A's tools to user B. Every request goes to the server.\n */\nclass McpNoResponseCache implements ResponseCacheStore {\n    get(_key: CacheKey): CacheEntry | undefined {\n        return undefined;\n    }\n\n    set(_key: CacheKey, _entry: object): number {\n        return 0;\n    }\n\n    delete(_key: CacheKey): void {\n        return;\n    }\n\n    evict(_method: string): void {\n        return;\n    }\n\n    clear(): void {\n        return;\n    }\n}\n\n/**\n * Per-POST credentials and context for one remote MCP endpoint: mints a fresh OIDC ID token for the\n * callee's origin (exactly as `http-client-node`'s `OutboundAuthFilter` does) and forwards the CURRENT\n * `RequestContext`'s transferable keys the way every OIDC hop does — trusted ones included, because an\n * OIDC destination verifies its caller (`DestinationTrust.forAuthMode`).\n */\nclass McpOidcPost {\n    private readonly headers = new RequestContextHeaders();\n    private readonly trust: DestinationTrust;\n\n    constructor(\n        private readonly audience: string,\n        auth: OidcAuthMethod,\n        private readonly minter: McpIdTokenMinter,\n    ) {\n        this.trust = DestinationTrust.forAuthMode(auth);\n    }\n\n    async send(url: string | URL, init?: RequestInit): Promise<Response> {\n        const headers = new Headers(init?.headers);\n        if (RequestContext.isActive()) {\n            for (const entry of this.headers.buildOutboundHeaders(this.trust)) {\n                headers.set(entry[0], entry[1]);\n            }\n        }\n        headers.set('Authorization', `Bearer ${await this.minter.mintIdToken(this.audience)}`);\n        // webpieces-disable no-fetch -- the MCP SDK's StreamableHTTPClientTransport is the protocol client; this is only the fetch it is handed, decorated with per-POST OIDC and context headers\n        return fetch(url, { ...init, headers });\n    }\n}\n\n/**\n * The client for the HTTP transport's internal door: an official MCP SDK `Client` that calls another\n * service's `WpMcpServer` whose `setAuth([...])` admits `oidcSameProject()` / `oidcSvcs([...])`.\n *\n * ```ts\n * const client = await WpMcpRemote.connect('https://svc-b.example.com/mcp/user', oidcSameProject(), gcpOidc);\n * ```\n *\n * PER POST, never at connect: each request mints its own OIDC ID token (audience = the callee origin)\n * and carries the CURRENT `RequestContext`'s trusted keys, so the callee's `@WpAuthorization` judges the\n * user on whose behalf THIS call is made. Apps cache one client per process, and a connect-time capture\n * would run user B's call as user A — the same reason the in-memory transport reads the caller per\n * request. No response is cached, for the same reason.\n */\nexport class WpMcpRemote {\n    // webpieces-disable no-function-outside-class -- explicit public factory of a connected SDK client\n    static async connect(\n        url: string,\n        auth: OidcAuthMethod,\n        minter: McpIdTokenMinter,\n    ): Promise<Client> {\n        if (!URL.canParse(url))\n            throw new Error(`WpMcpRemote.connect(...) requires an absolute URL, got '${url}'.`);\n        if (auth?.kind !== 'oidc') {\n            throw new Error(\n                'WpMcpRemote.connect(...) authenticates with oidcSameProject() or oidcSvcs([...]).',\n            );\n        }\n        const endpoint = new URL(url);\n        const post = new McpOidcPost(endpoint.origin, auth, minter);\n        const send: FetchLike = (target: string | URL, init?: RequestInit): Promise<Response> =>\n            post.send(target, init);\n        const transport = new StreamableHTTPClientTransport(endpoint, { fetch: send });\n        const client = new Client(\n            { name: 'webpieces-remote-client', version: '1.0.0' },\n            { responseCacheStore: new McpNoResponseCache() },\n        );\n        await client.connect(transport);\n        return client;\n    }\n}\n"]}

package/src/WpMcpServer.d.ts

@@ -1,67 +1,61 @@
 import { Express } from 'express';
 import { McpProtectedResourceMetadata, WpMcpServerConfig } from './McpAuth';
 import { McpBindOptions } from './McpBindOptions';
+import { McpToolset } from './McpToolset';
 /**
- * MCP adapter around the official SDK's request-scoped HTTP handler, serving BOTH wire eras from
- * one tool registry: modern (2026-07-28, per-request `_meta` envelope) and legacy (the 2025-11-25
- * family, negotiated by `initialize`). The SDK routes each request to the leg its shape selects and
- * negotiates the revision; only a revision no era knows is refused. Pinning one era instead made
- * every shipping client unreachable (issue #969), and the MCP lifecycle spec is explicit that a
- * server answers with a revision it supports rather than erroring.
+ * The HTTP transport over an {@link McpToolset}: one server = one path = one toolset. `/mcp/user` and
+ * `/mcp/admin` are two servers over two toolsets with two profile sets — paths split by WHICH TOOLS,
+ * never by HOW THE CALLER AUTHENTICATES.
  *
- * Error boundaries: HTTP ingress owns pre-SDK replies; one shared SDK callback wrapper owns
- * protocol/list/name-resolution errors and authorized tool-result errors. The SDK writes callback
- * replies, so it cannot safely delegate those failures back to HTTP ingress.
- * `subscriptions/listen` is served entirely by the SDK's listen router, so Webpieces has no handler
- * (and no catch) there. The external bearer is verified exactly once per POST, at the HTTP
- * boundary, before the SDK is involved.
+ * HOW the caller authenticates is `WpMcpServerConfig.setAuth([...])`: an OR-set of the same `@WpAuth`
+ * builders endpoints use plus `mcpOAuth(...)`, classified from unverified surface facts and verified by
+ * exactly ONE verifier ({@link McpDoorAuthenticator}). That establishes the trusted `RequestContext` —
+ * the caller, surface `llm`, and (only from an OIDC / shared-secret hop) the forwarded trusted context —
+ * and the toolset does the rest exactly as it does for the in-memory transport.
+ *
+ * Serves BOTH wire eras from one registry: modern (2026-07-28, per-request `_meta` envelope) and legacy
+ * (the 2025-11-25 family, negotiated by `initialize`). The SDK routes each request to the leg its shape
+ * selects and negotiates the revision; only a revision no era knows is refused. Pinning one era
+ * instead made every shipping client unreachable (issue #969).
  *
- * Before tools/list and tools/call hand an IMPLEMENTATION-kind failure to the translator, they
- * `log.error` it with its stack and the requestId ({@link logImplementationFailure}, #1055). The
- * translator reduces such a failure to "Internal Error" for the caller, so that line is the only place
- * its cause exists.
+ * Error boundaries: HTTP ingress owns pre-SDK replies; the toolset's one SDK callback wrapper owns
+ * protocol/list/name-resolution errors and authorized tool-result errors. The SDK writes callback
+ * replies, so it cannot safely delegate those failures back to HTTP ingress. `subscriptions/listen` is
+ * served entirely by the SDK's listen router. The credential is verified exactly once per POST, at the
+ * HTTP boundary, before the SDK is involved.
  */
-export declare class WpMcpServer<TGrant> {
+export declare class WpMcpServer {
     private readonly config;
+    private readonly toolset;
     private readonly callerContext;
-    private readonly dispatcher;
-    /** Classifies a failure exactly as the translator will render it, so the two cannot disagree. */
-    private readonly boundary;
-    private readonly outputSchemas;
-    /**
-     * These edges have NO filter chain above them — `LogApiFilter` never sees a rejected bearer, a
-     * bad `Origin`, a body express could not parse, or a `tools/list` the SDK renders itself.
-     * Wrapping each in `LogApiCall` is this repo's one line on logging, and it is why
-     * `ApiErrorBoundary` no longer writes a second, barer line of its own.
-     */
-    private readonly logApiCall;
     private readonly responseWriter;
-    /** tools/call reads `McpRegistry`; every other reply stays framework-owned. See McpErrorTranslator. */
     private readonly translator;
-    private registry?;
-    private toolProfiles;
+    private door?;
     private handler?;
     private streamingHandler?;
     private nodeHandler?;
     private streamingNodeHandler?;
-    private revision?;
     private icons?;
-    constructor(config: WpMcpServerConfig<TGrant>);
+    constructor(config: WpMcpServerConfig, toolset: McpToolset);
     /**
      * Mounts this MCP endpoint on `app`: POST at `options.endpointPath`, plus a 405 (`Allow: POST`)
      * for every other method there.
      *
-     * SINGLE CANONICAL ORIGIN: one server serves exactly one protected resource, so this may be
-     * called only once and `WpMcpServerConfig.setResource(...)`'s path must equal `endpointPath`.
-     * That resource URI is fixed for the lifetime of the process and is never derived from the
-     * request `Host` — a host-derived audience would make the boundary's own audience check compare
-     * two caller-controlled values, which is the confused deputy this check exists to prevent.
-     * Serving a second hostname is a second deployment, not a second audience.
+     * SINGLE CANONICAL ORIGIN: one server serves exactly one resource, so this may be called only once
+     * and `WpMcpServerConfig.setResource(...)`'s path must equal `endpointPath`. That resource URI is
+     * fixed for the lifetime of the process and is never derived from the request `Host` — a
+     * host-derived audience would make the boundary's own audience check compare two caller-controlled
+     * values, which is the confused deputy this check exists to prevent.
      *
-     * The OAuth/discovery half stays app-owned: publish `protectedResourceMetadata()` at
-     * `WpMcpServerConfig.resourceMetadataUrl`, which is where the 401 challenge sends clients.
+     * With `mcpOAuth(...)` in the set, the discovery half stays app-owned: publish
+     * {@link protectedResourceMetadata} at `WpMcpServerConfig.resourceMetadataUrl`, which is where the
+     * 401 challenge sends clients.
      */
     bind(app: Express, options: McpBindOptions): void;
+    /**
+     * RFC 9728 metadata for this resource. Only an `mcpOAuth(...)` server has any: it is what a
+     * connector reads at `WpMcpServerConfig.resourceMetadataUrl` to find the authorization server.
+     */
     protectedResourceMetadata(): McpProtectedResourceMetadata;
     /** Gracefully closes active listen/request streams; clients must reconnect and refresh lists. */
     close(): Promise<void>;
@@ -81,50 +75,25 @@ export declare class WpMcpServer<TGrant> {
      * stream.
      */
     private writeBoundaryError;
-    /** Run one un-filtered edge step under `LogApiCall`, so its failure gets exactly one log line. */
-    private logEdge;
     private serveExpress;
-    /** Verifies the external bearer once for this POST. Handlers never re-verify it. */
-    private authenticate;
-    private disconnectSignal;
-    private buildSdkServer;
-    /** ONE SDK callback catch implementation; the SDK intercepts foreign throws itself. */
-    private sdkBoundary;
-    private listTools;
-    private toolDefinition;
-    /**
-     * SDK tool callback: an unknown or hidden tool is a JSON-RPC -32602; every failure after the tool is found
-     * is an `isError: true` result, identically for local and remote bindings.
-     */
-    private handleCallTool;
     /**
-     * ONE `log.error` line, with the stack and the requestId, for a failure that is THIS server's bug
-     * — the `implementation` kind, which the translator reduces to "Internal Error" and a requestId
-     * for the caller (#1055).
+     * Verifies the caller's credential once for this POST — classify, then exactly ONE verifier — and
+     * establishes the trusted context the toolset reads. Handlers never re-verify it.
      *
-     * `LogApiCall` does not cover this. An MCP output-schema violation is raised AFTER the controller
-     * returned, so the only `LogApiCall` line for that call reads `resp-SUCCESS`; before this line
-     * existed, the requestId support was handed led to a log with no error in it. Where a
-     * `[API-*-resp-FAIL]` line does exist it carries the error's message, not its stack. So this line
-     * is not the bare duplicate `ApiErrorBoundary` stopped writing: it is the one that says WHERE.
-     *
-     * Every other kind (bad-request, end-user, dependency, ...) is a caller's or a downstream's
-     * failure, published to the caller with its own text, and `LogApiCall` already records it.
+     * Surface `llm` is stamped BEFORE reconciliation, so on a caller-NOT-verified mode (jwt, apiKey,
+     * mcpOAuth) a client that also SENDS `x-wp-surface` must say `llm` or be refused; and again AFTER,
+     * because an OIDC / shared-secret hop admits its forwarded context wholesale, and the model on the
+     * other end of an MCP door is always the surface.
      */
-    private logImplementationFailure;
-    /** Everything a tool call does. No catch in here: failures propagate to handleCallTool. */
-    private callTool;
-    private validateCredential;
+    private authenticate;
+    private disconnectSignal;
+    private buildSdkServer;
     private authInfo;
-    private progressReporter;
-    private progressParams;
     /** What the raw POST body tells us before the SDK has parsed anything: the id, and the tool. */
     private correlationOf;
     private challenge;
     private bodyObject;
     private hasProgressToken;
     private toHttpRequest;
-    private calculateRegistryRevision;
-    private requireRegistry;
-    private record;
+    private requireDoor;
 }