@webpieces/mcp-server 0.4.990 → 0.4.991

package/src/WpMcpServer.js

@@ -1,8 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WpMcpServer = void 0;
-const McpToolPolicy_1 = require("./McpToolPolicy");
-const node_crypto_1 = require("node:crypto");
 const server_1 = require("@modelcontextprotocol/server");
 const node_1 = require("@modelcontextprotocol/node");
 const express_1 = require("express");
@@ -11,153 +9,88 @@ const core_context_1 = require("@webpieces/core-context");
 const http_server_1 = require("@webpieces/http-server");
 const http_routing_1 = require("@webpieces/http-routing");
 const McpAuth_1 = require("./McpAuth");
-const McpApiDispatcher_1 = require("./McpApiDispatcher");
-const core_util_2 = require("@webpieces/core-util");
-const McpToolRegistry_1 = require("./McpToolRegistry");
+const McpDoorAuth_1 = require("./McpDoorAuth");
 const McpToolCallRendering_1 = require("./McpToolCallRendering");
 const McpProtocol_1 = require("./McpProtocol");
+const McpToolset_1 = require("./McpToolset");
 const WpMcpErrorTranslator_1 = require("./WpMcpErrorTranslator");
 const log = core_util_1.LogManager.getLogger('WpMcpServer');
-/**
- * The request DTO the edge `LogApiCall` lines report. These boundaries run BEFORE (or outside) any
- * API dispatch, so there is no contract DTO to log; the step name is the fact worth having.
- */
-class McpSdkOperation {
-    name;
-    toolStage = false;
-    constructor(name) {
-        this.name = name;
-    }
-}
-class McpEdgeRequest {
-    step;
-    constructor(step) {
-        this.step = step;
-    }
-}
-/**
- * `Tool.annotations` exactly as tools/list publishes it: the four hints PLUS the human-readable
- * `title` (#1180). The Claude Connectors Directory checks `annotations.title`; clients on the
- * 2025-06-18+ spec render the top-level `Tool.title`, so both carry the one title — the method's
- * `@summary` JSDoc tag, read from the generated catalog (#1296).
- */
-class McpPublishedToolAnnotations {
-    title;
-    readOnlyHint;
-    destructiveHint;
-    idempotentHint;
-    openWorldHint;
-    constructor(tool) {
-        this.title = tool.title;
-        this.readOnlyHint = tool.annotations.readOnlyHint;
-        this.destructiveHint = tool.annotations.destructiveHint;
-        this.idempotentHint = tool.annotations.idempotentHint;
-        this.openWorldHint = tool.annotations.openWorldHint;
-    }
-}
 /** Body of the 405 answered for every non-POST method at the bound MCP endpoint path. */
 class McpMethodNotAllowedBody {
     error = 'method_not_allowed';
 }
+/** Per-POST state the response-owning ingress needs after `work` failed. */
+class McpPostState {
+    /** Whether a 401 on this POST carries the `mcpOAuth(...)` discovery challenge. */
+    challenge = false;
+}
 /** Facts established once per POST at the bind boundary and handed to the SDK handlers. */
 class McpPostAuthentication {
-    accessToken;
-    credential;
-    disconnectSignal;
-    tools;
-    constructor(accessToken, credential, disconnectSignal, tools) {
-        this.accessToken = accessToken;
-        this.credential = credential;
-        this.disconnectSignal = disconnectSignal;
-        this.tools = tools;
-    }
-}
-/**
- * The official SDK server with Webpieces-owned tools/list and tools/call handlers. It answers
- * `toolInputSchemaJson` from the request-authorized view so the SDK's pre-dispatch SEP-2243
- * `Mcp-Param-*` header validation still runs without registering SDK-side tool callbacks.
- */
-class WpSdkMcpServer extends server_1.McpServer {
-    registry;
-    constructor(info, options, registry) {
-        super(info, options);
-        this.registry = registry;
-    }
-    // webpieces-disable no-any-unknown -- signature is fixed by the SDK's JSON Schema record type
-    toolInputSchemaJson(name) {
-        return this.registry.find(name)?.inputSchema;
+    pass;
+    request;
+    constructor(pass, request) {
+        this.pass = pass;
+        this.request = request;
     }
 }
 /**
- * MCP adapter around the official SDK's request-scoped HTTP handler, serving BOTH wire eras from
- * one tool registry: modern (2026-07-28, per-request `_meta` envelope) and legacy (the 2025-11-25
- * family, negotiated by `initialize`). The SDK routes each request to the leg its shape selects and
- * negotiates the revision; only a revision no era knows is refused. Pinning one era instead made
- * every shipping client unreachable (issue #969), and the MCP lifecycle spec is explicit that a
- * server answers with a revision it supports rather than erroring.
+ * The HTTP transport over an {@link McpToolset}: one server = one path = one toolset. `/mcp/user` and
+ * `/mcp/admin` are two servers over two toolsets with two profile sets — paths split by WHICH TOOLS,
+ * never by HOW THE CALLER AUTHENTICATES.
  *
- * Error boundaries: HTTP ingress owns pre-SDK replies; one shared SDK callback wrapper owns
- * protocol/list/name-resolution errors and authorized tool-result errors. The SDK writes callback
- * replies, so it cannot safely delegate those failures back to HTTP ingress.
- * `subscriptions/listen` is served entirely by the SDK's listen router, so Webpieces has no handler
- * (and no catch) there. The external bearer is verified exactly once per POST, at the HTTP
- * boundary, before the SDK is involved.
+ * HOW the caller authenticates is `WpMcpServerConfig.setAuth([...])`: an OR-set of the same `@WpAuth`
+ * builders endpoints use plus `mcpOAuth(...)`, classified from unverified surface facts and verified by
+ * exactly ONE verifier ({@link McpDoorAuthenticator}). That establishes the trusted `RequestContext` —
+ * the caller, surface `llm`, and (only from an OIDC / shared-secret hop) the forwarded trusted context —
+ * and the toolset does the rest exactly as it does for the in-memory transport.
+ *
+ * Serves BOTH wire eras from one registry: modern (2026-07-28, per-request `_meta` envelope) and legacy
+ * (the 2025-11-25 family, negotiated by `initialize`). The SDK routes each request to the leg its shape
+ * selects and negotiates the revision; only a revision no era knows is refused. Pinning one era
+ * instead made every shipping client unreachable (issue #969).
  *
- * Before tools/list and tools/call hand an IMPLEMENTATION-kind failure to the translator, they
- * `log.error` it with its stack and the requestId ({@link logImplementationFailure}, #1055). The
- * translator reduces such a failure to "Internal Error" for the caller, so that line is the only place
- * its cause exists.
+ * Error boundaries: HTTP ingress owns pre-SDK replies; the toolset's one SDK callback wrapper owns
+ * protocol/list/name-resolution errors and authorized tool-result errors. The SDK writes callback
+ * replies, so it cannot safely delegate those failures back to HTTP ingress. `subscriptions/listen` is
+ * served entirely by the SDK's listen router. The credential is verified exactly once per POST, at the
+ * HTTP boundary, before the SDK is involved.
  */
 class WpMcpServer {
     config;
+    toolset;
     callerContext = new http_routing_1.AuthenticatedCallerContext();
-    dispatcher = new McpApiDispatcher_1.McpApiDispatcher();
-    /** Classifies a failure exactly as the translator will render it, so the two cannot disagree. */
-    boundary = new core_util_1.ApiErrorBoundary();
-    outputSchemas = new core_util_1.ApiJsonSchemaValidator();
-    /**
-     * These edges have NO filter chain above them — `LogApiFilter` never sees a rejected bearer, a
-     * bad `Origin`, a body express could not parse, or a `tools/list` the SDK renders itself.
-     * Wrapping each in `LogApiCall` is this repo's one line on logging, and it is why
-     * `ApiErrorBoundary` no longer writes a second, barer line of its own.
-     */
-    logApiCall = new core_util_1.LogApiCallImpl(new core_context_1.RequestContextApiCallContext());
     responseWriter = new http_server_1.ExpressResponseWriter();
-    /** tools/call reads `McpRegistry`; every other reply stays framework-owned. See McpErrorTranslator. */
-    translator;
-    registry;
-    toolProfiles = [];
+    translator = new WpMcpErrorTranslator_1.WpMcpErrorTranslator();
+    door;
     handler;
     streamingHandler;
     nodeHandler;
     streamingNodeHandler;
-    revision;
     icons;
-    constructor(config) {
+    constructor(config, toolset) {
         this.config = config;
-        this.translator = new WpMcpErrorTranslator_1.WpMcpErrorTranslator(() => this.challenge());
+        this.toolset = toolset;
     }
     /**
      * Mounts this MCP endpoint on `app`: POST at `options.endpointPath`, plus a 405 (`Allow: POST`)
      * for every other method there.
      *
-     * SINGLE CANONICAL ORIGIN: one server serves exactly one protected resource, so this may be
-     * called only once and `WpMcpServerConfig.setResource(...)`'s path must equal `endpointPath`.
-     * That resource URI is fixed for the lifetime of the process and is never derived from the
-     * request `Host` — a host-derived audience would make the boundary's own audience check compare
-     * two caller-controlled values, which is the confused deputy this check exists to prevent.
-     * Serving a second hostname is a second deployment, not a second audience.
+     * SINGLE CANONICAL ORIGIN: one server serves exactly one resource, so this may be called only once
+     * and `WpMcpServerConfig.setResource(...)`'s path must equal `endpointPath`. That resource URI is
+     * fixed for the lifetime of the process and is never derived from the request `Host` — a
+     * host-derived audience would make the boundary's own audience check compare two caller-controlled
+     * values, which is the confused deputy this check exists to prevent.
      *
-     * The OAuth/discovery half stays app-owned: publish `protectedResourceMetadata()` at
-     * `WpMcpServerConfig.resourceMetadataUrl`, which is where the 401 challenge sends clients.
+     * With `mcpOAuth(...)` in the set, the discovery half stays app-owned: publish
+     * {@link protectedResourceMetadata} at `WpMcpServerConfig.resourceMetadataUrl`, which is where the
+     * 401 challenge sends clients.
      */
     bind(app, options) {
         if (this.handler) {
             throw new Error('WpMcpServer.bind(...) may be called only once; an MCP resource has exactly one ' +
                 'canonical URI, fixed for the lifetime of the process.');
         }
-        // Fail at boot naming the forgotten setter, never on the first request with a 401 the client
-        // answers by re-authenticating (see WpMcpServerConfig).
+        // Fail at boot naming the forgotten setter, never on the first request with a 401.
         this.config.validate();
         const resourcePath = new URL(this.config.resource).pathname;
         if (resourcePath !== options.endpointPath) {
@@ -165,10 +98,8 @@ class WpMcpServer {
                 `'${options.endpointPath}'; the canonical resource URI ` +
                 `'${this.config.resource}' and the bound route are the same endpoint.`);
         }
-        this.toolProfiles = this.config.toolProfiles;
+        this.door = McpDoorAuth_1.McpDoorAuthenticator.create(this.config.auth, this.config.resource, this.config.credentialVerifiers);
         this.icons = this.config.icons;
-        this.registry = new McpToolRegistry_1.McpToolRegistry(options.bindings, options.toolCatalogs, this.config.authorizationService);
-        this.revision = this.calculateRegistryRevision(this.registry);
         this.handler = this.createHandler(options, 'auto');
         this.streamingHandler = this.createHandler(options, 'sse');
         this.nodeHandler = (0, node_1.toNodeHandler)(this.handler, {
@@ -192,8 +123,17 @@ class WpMcpServer {
             res.status(405).json(new McpMethodNotAllowedBody());
         });
     }
+    /**
+     * RFC 9728 metadata for this resource. Only an `mcpOAuth(...)` server has any: it is what a
+     * connector reads at `WpMcpServerConfig.resourceMetadataUrl` to find the authorization server.
+     */
     protectedResourceMetadata() {
-        return this.config.protectedResourceMetadata();
+        const oauth = this.config.auth.find((mode) => mode instanceof McpAuth_1.McpOAuthMode);
+        if (oauth === undefined) {
+            throw new Error('WpMcpServer.protectedResourceMetadata() requires mcpOAuth(...) in WpMcpServerConfig.setAuth([...]); ' +
+                'a server without it publishes no OAuth discovery.');
+        }
+        return oauth.protectedResourceMetadata(this.config.resource);
     }
     /** Gracefully closes active listen/request streams; clients must reconnect and refresh lists. */
     async close() {
@@ -204,7 +144,7 @@ class WpMcpServer {
         this.handler?.notify.toolsChanged();
     }
     get registryRevision() {
-        return this.revision;
+        return this.handler ? this.toolset.revision : undefined;
     }
     createHandler(options, responseMode) {
         return (0, server_1.createMcpHandler)((context) => this.buildSdkServer(context, options), {
@@ -221,22 +161,24 @@ class WpMcpServer {
     /** Each HTTP entry uses the same full-request scope and ingress translation seam. */
     async handleHttp(req, res, options) {
         res.setHeader('X-Accel-Buffering', 'no');
-        await this.ingress(req, res, 'serve', () => this.serveExpress(req, res, options));
+        const post = new McpPostState();
+        await this.ingress(req, res, 'serve', post, () => this.serveExpress(req, res, options, post));
     }
     async handleBodyFailure(cause, req, res) {
-        await this.ingress(req, res, 'body', () => this.rejectBody(cause));
+        await this.ingress(req, res, 'body', new McpPostState(), () => this.rejectBody(cause));
     }
-    async ingress(req, res, step, work) {
+    async ingress(req, res, step, post, work) {
         await core_context_1.RequestContext.run(async () => {
             // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- HTTP response-owning ingress boundary, including request publication and correlation failures
             try {
                 new core_context_1.RequestContextHeaders().fillFromRequest(this.toHttpRequest(req));
                 McpToolCallRendering_1.McpCorrelation.stamp(this.correlationOf(req));
-                await this.logEdge(step, work);
+                await this.toolset.logEdge(step, work);
+                // webpieces-disable catch-must-propagate -- the response-owning ingress hands the error WHOLE to the translator, which writes it as this POST's reply; LogApiCall already logged it
             }
             catch (err) {
                 const error = (0, core_util_1.toError)(err);
-                this.writeBoundaryError(res, error);
+                this.writeBoundaryError(res, error, post);
             }
         });
     }
@@ -249,23 +191,20 @@ class WpMcpServer {
      * express writer `ExpressWrapper` uses. A failure after headers were sent can only end the
      * stream.
      */
-    writeBoundaryError(res, error) {
+    writeBoundaryError(res, error, post) {
         if (res.headersSent) {
             res.end();
             return;
         }
-        this.responseWriter.write(res, this.translator.toBearerBoundaryResponse(error));
+        const challenge = post.challenge ? this.challenge() : undefined;
+        this.responseWriter.write(res, this.translator.toBearerBoundaryResponse(error, challenge));
     }
-    /** Run one un-filtered edge step under `LogApiCall`, so its failure gets exactly one log line. */
-    async logEdge(step, work) {
-        return this.logApiCall.execute(new core_util_1.ApiMethodInfo('server', 'McpEndpoint', step, McpProtocol_1.McpProtocol), new McpEdgeRequest(step), work);
-    }
-    async serveExpress(req, res, options) {
+    async serveExpress(req, res, options, post) {
         const origin = req.header('origin');
         if (origin && !options.allowedOrigins.includes(origin)) {
             throw new core_util_1.ApiForbiddenError(`MCP request Origin '${origin}' is not allowed.`);
         }
-        const authentication = await this.authenticate(req);
+        const authentication = await this.authenticate(req, post);
         const request = req;
         request.auth = this.authInfo(authentication);
         const serve = this.hasProgressToken(req.body)
@@ -275,19 +214,25 @@ class WpMcpServer {
             throw new core_util_1.ApiImplementationError('MCP Node handlers are not initialized.');
         await serve(request, res, req.body);
     }
-    /** Verifies the external bearer once for this POST. Handlers never re-verify it. */
-    async authenticate(req) {
-        const match = req.header('authorization')?.match(/^Bearer ([^\s]+)$/i);
-        const token = match?.[1];
-        if (!token)
-            throw new core_util_1.ApiUnauthorizedError('MCP request has no bearer access token.');
-        const credential = await this.config.accessTokenAuthority.verifyAccessToken(token, this.config.resource);
-        this.validateCredential(credential);
-        this.callerContext.publish(credential.caller);
+    /**
+     * Verifies the caller's credential once for this POST — classify, then exactly ONE verifier — and
+     * establishes the trusted context the toolset reads. Handlers never re-verify it.
+     *
+     * Surface `llm` is stamped BEFORE reconciliation, so on a caller-NOT-verified mode (jwt, apiKey,
+     * mcpOAuth) a client that also SENDS `x-wp-surface` must say `llm` or be refused; and again AFTER,
+     * because an OIDC / shared-secret hop admits its forwarded context wholesale, and the model on the
+     * other end of an MCP door is always the surface.
+     */
+    async authenticate(req, post) {
+        const door = this.requireDoor();
+        const doorRequest = new McpDoorAuth_1.McpDoorRequest(this.toHttpRequest(req));
+        post.challenge = door.challengeApplies(doorRequest);
+        const pass = await door.authenticate(doorRequest);
         core_context_1.RequestContext.putTrusted(core_util_1.WebpiecesCoreHeaders.SURFACE, 'llm');
-        this.callerContext.reconcileWireTrust(false);
-        const tools = await McpToolRegistry_1.AuthorizedMcpTools.create(this.requireRegistry(), this.config.authorizationService, this.toolProfiles);
-        return new McpPostAuthentication(token, credential, this.disconnectSignal(req), tools);
+        this.callerContext.reconcileWireTrust(pass.callerVerified);
+        core_context_1.RequestContext.putTrusted(core_util_1.WebpiecesCoreHeaders.SURFACE, 'llm');
+        const tools = await this.toolset.authorizedTools();
+        return new McpPostAuthentication(pass, new McpToolset_1.McpToolRequest(tools, this.disconnectSignal(req)));
     }
     disconnectSignal(req) {
         const disconnected = new AbortController();
@@ -305,18 +250,19 @@ class WpMcpServer {
     }
     buildSdkServer(context, options) {
         // The era is the SDK's to decide and BOTH are served; what is not negotiable is that the
-        // request came through `bind`'s HTTP boundary, which is where the external bearer is
-        // verified. A factory call without it is a wiring mistake, never a client's doing.
+        // request came through `bind`'s HTTP boundary, which is where the credential is verified. A
+        // factory call without it is a wiring mistake, never a client's doing.
         const authentication = context.authInfo?.extra?.['webpiecesAuthentication'];
         if (!(authentication instanceof McpPostAuthentication)) {
             throw new core_util_1.ApiImplementationError('WpMcpServer serves only MCP requests authenticated by its bind boundary.');
         }
-        const server = new WpSdkMcpServer({
+        const view = authentication.request.tools;
+        return this.toolset.createSdkServer({
             name: this.config.name,
             title: this.config.title,
             description: this.config.description,
             websiteUrl: this.config.websiteUrl,
-            version: `${this.config.version}+${this.revision}`,
+            version: `${this.config.version}+${this.toolset.revision}`,
             ...(this.icons === undefined ? {} : { icons: [...this.icons] }),
         }, {
             capabilities: { tools: { listChanged: true } },
@@ -324,165 +270,19 @@ class WpMcpServer {
                 'tools/list': { ttlMs: options.deployment.ttlMs, cacheScope: 'private' },
                 'server/discover': { ttlMs: options.deployment.ttlMs, cacheScope: 'private' },
             },
-        }, authentication.tools);
-        server.server.removeRequestHandler('tools/list');
-        server.server.removeRequestHandler('tools/call');
-        server.server.setRequestHandler('tools/list', async (_request) => this.sdkBoundary(new McpSdkOperation('tools/list'), () => this.logEdge('tools/list', async () => this.listTools(authentication.tools))));
-        server.server.setRequestHandler('tools/call', async (request, sdkContext) => this.handleCallTool(server, request, authentication, sdkContext));
-        return server;
-    }
-    /** ONE SDK callback catch implementation; the SDK intercepts foreign throws itself. */
-    async sdkBoundary(operation, work) {
-        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- shared SDK response boundary, preserving protocol versus tool envelopes
-        try {
-            return await work();
-        }
-        catch (err) {
-            const error = (0, core_util_1.toError)(err);
-            if (error instanceof McpToolPolicy_1.McpToolDeniedError)
-                throw this.translator.unknownTool(error.toolName);
-            if (!operation.toolStage && error instanceof server_1.ProtocolError)
-                throw error;
-            this.logImplementationFailure(operation.name, error);
-            if (operation.toolStage)
-                return this.translator.toToolCallResult(error);
-            this.translator.toListError(error);
-        }
-    }
-    listTools(view) {
-        const tools = view.tools.map((tool) => this.toolDefinition(tool));
-        return { tools };
-    }
-    toolDefinition(tool) {
-        return {
-            name: tool.name,
-            title: tool.title,
-            description: tool.description,
-            inputSchema: tool.inputSchema,
-            outputSchema: tool.outputSchema,
-            annotations: new McpPublishedToolAnnotations(tool),
-            _meta: { webpiecesRegistryRevision: this.revision },
-        };
-    }
-    /**
-     * SDK tool callback: an unknown or hidden tool is a JSON-RPC -32602; every failure after the tool is found
-     * is an `isError: true` result, identically for local and remote bindings.
-     */
-    async handleCallTool(server, request, authentication, sdkContext) {
-        const name = request.params.name;
-        const operation = new McpSdkOperation(`tools/call ${name}`);
-        return this.sdkBoundary(operation, async () => {
-            McpToolCallRendering_1.McpCorrelation.stamp(new McpToolCallRendering_1.McpCorrelation(sdkContext.mcpReq.id, McpProtocol_1.McpProtocol, name));
-            const tool = authentication.tools.find(name);
-            if (!tool)
-                throw this.translator.unknownTool(name);
-            McpToolCallRendering_1.McpCorrelation.stamp(new McpToolCallRendering_1.McpCorrelation(sdkContext.mcpReq.id, tool.apiClass, name, tool.operation));
-            operation.toolStage = true;
-            const result = await this.callTool(tool, request, authentication, sdkContext);
-            result._meta = this.translator.resultMeta(McpToolCallRendering_1.McpCorrelation.requestId());
-            return server.server.projectCallToolResult(result, tool.outputSchema);
-        });
-    }
-    /**
-     * ONE `log.error` line, with the stack and the requestId, for a failure that is THIS server's bug
-     * — the `implementation` kind, which the translator reduces to "Internal Error" and a requestId
-     * for the caller (#1055).
-     *
-     * `LogApiCall` does not cover this. An MCP output-schema violation is raised AFTER the controller
-     * returned, so the only `LogApiCall` line for that call reads `resp-SUCCESS`; before this line
-     * existed, the requestId support was handed led to a log with no error in it. Where a
-     * `[API-*-resp-FAIL]` line does exist it carries the error's message, not its stack. So this line
-     * is not the bare duplicate `ApiErrorBoundary` stopped writing: it is the one that says WHERE.
-     *
-     * Every other kind (bad-request, end-user, dependency, ...) is a caller's or a downstream's
-     * failure, published to the caller with its own text, and `LogApiCall` already records it.
-     */
-    logImplementationFailure(entryPoint, error) {
-        if (this.boundary.encode(error).kind !== 'implementation')
-            return;
-        log.error(`MCP ${entryPoint} failed with an implementation error requestId=${McpToolCallRendering_1.McpCorrelation.requestId()}`, error);
-    }
-    /** Everything a tool call does. No catch in here: failures propagate to handleCallTool. */
-    async callTool(tool, request, authentication, sdkContext) {
-        const credential = authentication.credential;
-        const invocation = new core_util_2.McpInvocationContext(sdkContext.mcpReq.id, tool.name, credential.subject, credential.principalRoles, AbortSignal.any([sdkContext.mcpReq.signal, authentication.disconnectSignal]), this.progressReporter(sdkContext));
-        const args = (request.params.arguments ?? {});
-        const value = await this.dispatcher.call(tool, args, credential, invocation, this.config.authorizationService);
-        const outputFailure = this.outputSchemas.validate(tool.outputSchema, value);
-        if (outputFailure) {
-            throw new core_util_1.ApiImplementationError(`MCP output schema violation for ${tool.apiClass.name}.${tool.methodName}: ${outputFailure.message}`);
-        }
-        const structured = this.record(value);
-        return {
-            content: [{ type: 'text', text: JSON.stringify(structured) }],
-            structuredContent: structured,
-        };
-    }
-    validateCredential(credential) {
-        const now = Math.floor(Date.now() / 1000);
-        const reject = (reason) => {
-            throw new core_util_1.ApiUnauthorizedError(`MCP access token rejected: ${reason}`);
-        };
-        if (credential.subject.trim() === '')
-            reject('no subject');
-        const stamps = [
-            credential.issuedAtEpochSeconds,
-            credential.expiresAtEpochSeconds,
-            credential.accountValidatedAtEpochSeconds,
-        ];
-        if (!stamps.every(Number.isFinite))
-            reject('security timestamps must be finite');
-        if (credential.resource !== this.config.resource)
-            reject('resource mismatch');
-        if (!this.config.authorizationServers.includes(credential.issuer)) {
-            reject('issuer is not trusted');
-        }
-        if (credential.issuedAtEpochSeconds > now || credential.expiresAtEpochSeconds <= now) {
-            reject('outside its valid time window');
-        }
-        const lifetime = credential.expiresAtEpochSeconds - credential.issuedAtEpochSeconds;
-        if (lifetime > McpAuth_1.MAX_MCP_ACCESS_TOKEN_LIFETIME_SECONDS)
-            reject('lifetime exceeds 30 days');
-        for (const scope of this.config.requiredScopes) {
-            if (!credential.scopes.includes(scope))
-                reject(`missing required scope '${scope}'`);
-        }
-        const validatedAge = now - credential.accountValidatedAtEpochSeconds;
-        if (credential.accountValidatedAtEpochSeconds > now ||
-            validatedAge > this.config.maxAccountValidationAgeSeconds) {
-            reject('account authorization state is not fresh enough for dispatch');
-        }
+        }, async () => authentication.request, (name) => view.find(name));
     }
     authInfo(authentication) {
-        const credential = authentication.credential;
+        const pass = authentication.pass;
         return {
-            token: authentication.accessToken,
-            clientId: credential.subject,
-            scopes: [...credential.scopes],
-            expiresAt: credential.expiresAtEpochSeconds,
-            resource: new URL(credential.resource),
+            token: pass.token,
+            clientId: pass.subject,
+            scopes: [...pass.scopes],
+            expiresAt: pass.expiresAtEpochSeconds,
+            resource: new URL(this.config.resource),
             extra: { webpiecesAuthentication: authentication },
         };
     }
-    progressReporter(context) {
-        const token = context.mcpReq._meta?.progressToken;
-        if (token === undefined)
-            return undefined;
-        return async (progress, total, message) => {
-            await context.mcpReq.notify({
-                method: 'notifications/progress',
-                params: this.progressParams(token, progress, total, message),
-            });
-        };
-    }
-    progressParams(progressToken, progress, total, message) {
-        const params = { progressToken, progress };
-        if (total !== undefined)
-            params['total'] = total;
-        if (message !== undefined)
-            params['message'] = message;
-        return params;
-    }
     /** What the raw POST body tells us before the SDK has parsed anything: the id, and the tool. */
     correlationOf(req) {
         const body = this.bodyObject(req.body);
@@ -513,36 +313,10 @@ class WpMcpServer {
         }
         return new core_context_1.HttpRequest(req.method, req.originalUrl || req.path, headers);
     }
-    calculateRegistryRevision(registry) {
-        const surface = registry.tools.map((tool) => [
-            tool.name,
-            tool.title,
-            tool.description,
-            tool.inputSchema,
-            tool.outputSchema,
-            tool.annotations,
-            tool.profiles,
-        ]);
-        return (0, node_crypto_1.createHash)('sha256')
-            .update(JSON.stringify([this.toolProfiles, surface]))
-            .digest('hex')
-            .slice(0, 12);
-    }
-    requireRegistry() {
-        if (!this.registry)
+    requireDoor() {
+        if (!this.door)
             throw new Error('Call WpMcpServer.bind(...) before serving requests.');
-        return this.registry;
-    }
-    record(value) {
-        const jsonValue = JSON.stringify(value);
-        if (jsonValue === undefined) {
-            throw new core_util_1.ApiImplementationError('MCP structured content is not JSON serializable.');
-        }
-        const parsed = JSON.parse(jsonValue);
-        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
-            return { value: parsed };
-        }
-        return parsed;
+        return this.door;
     }
 }
 exports.WpMcpServer = WpMcpServer;