@winstonsayno/mcp-gateway 0.0.0-stage → 0.3.0

package/dist/transport/channel.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Upstream channel abstraction.
+ *
+ * A channel moves raw JSON-RPC messages between the gateway and one upstream
+ * MCP server. It knows nothing about request ids, timeouts or the MCP
+ * handshake — that is the job of the session layer in `proxy/index.ts`, which
+ * is shared by every transport (stdio, SSE, WebSocket, Streamable HTTP).
+ *
+ * Lifecycle: `start()` → any number of `send()` → `close()`.
+ * `onclose` fires once when the channel goes away *unexpectedly* (process
+ * exit, socket close, stream end); it does not fire for `close()`.
+ *
+ * @module transport/channel
+ */
+import type { McpServerConfig } from '../utils/types.js';
+export type JsonRpcId = string | number;
+export interface JsonRpcMessage {
+    jsonrpc: '2.0';
+    id?: JsonRpcId | null;
+    method?: string;
+    params?: unknown;
+    result?: unknown;
+    error?: {
+        code: number;
+        message: string;
+        data?: unknown;
+    };
+}
+export interface UpstreamChannel {
+    /** Short transport name, for logs. */
+    readonly kind: string;
+    /** Open the connection. Resolves once `send()` may be called. */
+    start(): Promise<void>;
+    /** Deliver one message. Rejects when the message could not be handed over. */
+    send(message: JsonRpcMessage): Promise<void>;
+    /** Intentionally close the channel and release every resource. */
+    close(): Promise<void>;
+    /** Called for every message received from the server. */
+    onmessage?: (message: JsonRpcMessage) => void;
+    /** Called once when the channel is lost without `close()` being called. */
+    onclose?: (error: Error) => void;
+    /** Informs HTTP-based channels of the protocol version negotiated in `initialize`. */
+    setProtocolVersion?(version: string): void;
+    /** Called when a request is abandoned (e.g. timed out) so the channel can free per-request resources. */
+    abandon?(id: JsonRpcId): void;
+}
+/** Expand `${VAR}` references against the gateway's own environment. */
+export declare function expandEnv(value: string): string;
+export declare function expandRecord(record: Record<string, string> | undefined): Record<string, string>;
+/** Error message including the `cause` (fetch() hides the real reason there). */
+export declare function errMessage(err: unknown): string;
+/** Parse a JSON value into zero or more JSON-RPC messages (batches are arrays). */
+export declare function toMessages(value: unknown): JsonRpcMessage[];
+export interface ChannelOptions {
+    /** Time allowed for `start()` (connect + handshake prerequisites). */
+    connectTimeoutMs: number;
+    /** Grace period used by the stdio channel between stdin close / SIGTERM / SIGKILL. */
+    killGraceMs: number;
+}
+export type ChannelFactory = (config: McpServerConfig, options: ChannelOptions) => UpstreamChannel;
+//# sourceMappingURL=channel.d.ts.map

package/dist/transport/channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel.d.ts","sourceRoot":"","sources":["../../src/transport/channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAExC,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC3D;AAED,MAAM,WAAW,eAAe;IAC9B,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,8EAA8E;IAC9E,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,kEAAkE;IAClE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC;IAC9C,2EAA2E;IAC3E,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,sFAAsF;IACtF,kBAAkB,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,yGAAyG;IACzG,OAAO,CAAC,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI,CAAC;CAC/B;AAED,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/F;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAM/C;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,EAAE,CAK3D;AAED,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,gBAAgB,EAAE,MAAM,CAAC;IACzB,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,KAAK,eAAe,CAAC"}

package/dist/transport/channel.js

@@ -0,0 +1,38 @@
+/**
+ * Upstream channel abstraction.
+ *
+ * A channel moves raw JSON-RPC messages between the gateway and one upstream
+ * MCP server. It knows nothing about request ids, timeouts or the MCP
+ * handshake — that is the job of the session layer in `proxy/index.ts`, which
+ * is shared by every transport (stdio, SSE, WebSocket, Streamable HTTP).
+ *
+ * Lifecycle: `start()` → any number of `send()` → `close()`.
+ * `onclose` fires once when the channel goes away *unexpectedly* (process
+ * exit, socket close, stream end); it does not fire for `close()`.
+ *
+ * @module transport/channel
+ */
+/** Expand `${VAR}` references against the gateway's own environment. */
+export function expandEnv(value) {
+    return value.replace(/\$\{([^}]+)\}/g, (_, name) => process.env[name] ?? '');
+}
+export function expandRecord(record) {
+    const out = {};
+    for (const [k, v] of Object.entries(record ?? {}))
+        out[k] = expandEnv(v);
+    return out;
+}
+/** Error message including the `cause` (fetch() hides the real reason there). */
+export function errMessage(err) {
+    if (err instanceof Error) {
+        const cause = err.cause;
+        return cause instanceof Error ? `${err.message} (${cause.message})` : err.message;
+    }
+    return String(err);
+}
+/** Parse a JSON value into zero or more JSON-RPC messages (batches are arrays). */
+export function toMessages(value) {
+    const list = Array.isArray(value) ? value : [value];
+    return list.filter((m) => !!m && typeof m === 'object' && m.jsonrpc === '2.0');
+}
+//# sourceMappingURL=channel.js.map

package/dist/transport/channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel.js","sourceRoot":"","sources":["../../src/transport/channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAkCH,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAA0C;IACrE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAI,GAAmC,CAAC,KAAK,CAAC;QACzD,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpF,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC,MAAM,CAChB,CAAC,CAAC,EAAuB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAA2B,CAAC,OAAO,KAAK,KAAK,CAC3G,CAAC;AACJ,CAAC"}

package/dist/transport/sse-parser.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Incremental `text/event-stream` parser (WHATWG HTML §9.2).
+ *
+ * Feed it decoded text chunks of any size; it calls `onEvent` for every
+ * complete event. Parser state survives chunk boundaries, so events, lines
+ * and even CRLF pairs split across TCP chunks are handled.
+ *
+ * @module transport/sse-parser
+ */
+export interface SseEvent {
+    event: string;
+    data: string;
+    id?: string;
+}
+export declare class SseParser {
+    private readonly onEvent;
+    private readonly maxBufferChars;
+    private buffer;
+    private eventType;
+    private dataLines;
+    private lastId;
+    private pendingCR;
+    constructor(onEvent: (event: SseEvent) => void, maxBufferChars?: number);
+    push(chunk: string): void;
+    private line;
+    private dispatch;
+}
+/** Read a fetch() body stream through an SseParser until it ends. */
+export declare function readSseStream(body: ReadableStream<Uint8Array>, onEvent: (event: SseEvent) => void): Promise<void>;
+//# sourceMappingURL=sse-parser.d.ts.map

package/dist/transport/sse-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-parser.d.ts","sourceRoot":"","sources":["../../src/transport/sse-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,SAAS;IAQlB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,cAAc;IARjC,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,SAAS,CAAM;IACvB,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,SAAS,CAAS;gBAGP,OAAO,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,EAClC,cAAc,SAAmB;IAGpD,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAuBzB,OAAO,CAAC,IAAI;IA0BZ,OAAO,CAAC,QAAQ;CAWjB;AAED,qEAAqE;AACrE,wBAAsB,aAAa,CACjC,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,EAChC,OAAO,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,GACjC,OAAO,CAAC,IAAI,CAAC,CAef"}

package/dist/transport/sse-parser.js

@@ -0,0 +1,107 @@
+/**
+ * Incremental `text/event-stream` parser (WHATWG HTML §9.2).
+ *
+ * Feed it decoded text chunks of any size; it calls `onEvent` for every
+ * complete event. Parser state survives chunk boundaries, so events, lines
+ * and even CRLF pairs split across TCP chunks are handled.
+ *
+ * @module transport/sse-parser
+ */
+export class SseParser {
+    onEvent;
+    maxBufferChars;
+    buffer = '';
+    eventType = '';
+    dataLines = [];
+    lastId;
+    pendingCR = false;
+    constructor(onEvent, maxBufferChars = 16 * 1024 * 1024) {
+        this.onEvent = onEvent;
+        this.maxBufferChars = maxBufferChars;
+    }
+    push(chunk) {
+        if (this.pendingCR && chunk.startsWith('\n'))
+            chunk = chunk.slice(1);
+        this.pendingCR = false;
+        this.buffer += chunk;
+        let start = 0;
+        for (let i = 0; i < this.buffer.length; i++) {
+            const ch = this.buffer[i];
+            if (ch !== '\n' && ch !== '\r')
+                continue;
+            this.line(this.buffer.slice(start, i));
+            if (ch === '\r') {
+                if (i + 1 === this.buffer.length)
+                    this.pendingCR = true;
+                else if (this.buffer[i + 1] === '\n')
+                    i++;
+            }
+            start = i + 1;
+        }
+        this.buffer = this.buffer.slice(start);
+        if (this.buffer.length > this.maxBufferChars) {
+            this.buffer = '';
+            throw new Error(`SSE line exceeded ${this.maxBufferChars} characters`);
+        }
+    }
+    line(line) {
+        if (line === '') {
+            this.dispatch();
+            return;
+        }
+        if (line.startsWith(':'))
+            return; // comment / keep-alive
+        const colon = line.indexOf(':');
+        const field = colon === -1 ? line : line.slice(0, colon);
+        let value = colon === -1 ? '' : line.slice(colon + 1);
+        if (value.startsWith(' '))
+            value = value.slice(1);
+        switch (field) {
+            case 'event':
+                this.eventType = value;
+                break;
+            case 'data':
+                this.dataLines.push(value);
+                break;
+            case 'id':
+                if (!value.includes('\0'))
+                    this.lastId = value;
+                break;
+            default:
+                break; // "retry" and unknown fields are ignored
+        }
+    }
+    dispatch() {
+        if (this.dataLines.length === 0) {
+            this.eventType = '';
+            return;
+        }
+        const event = { event: this.eventType || 'message', data: this.dataLines.join('\n') };
+        if (this.lastId !== undefined)
+            event.id = this.lastId;
+        this.eventType = '';
+        this.dataLines = [];
+        this.onEvent(event);
+    }
+}
+/** Read a fetch() body stream through an SseParser until it ends. */
+export async function readSseStream(body, onEvent) {
+    const parser = new SseParser(onEvent);
+    const decoder = new TextDecoder();
+    const reader = body.getReader();
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            parser.push(decoder.decode(value, { stream: true }));
+        }
+        const tail = decoder.decode();
+        if (tail)
+            parser.push(tail);
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+//# sourceMappingURL=sse-parser.js.map

package/dist/transport/sse-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-parser.js","sourceRoot":"","sources":["../../src/transport/sse-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,MAAM,OAAO,SAAS;IAQD;IACA;IARX,MAAM,GAAG,EAAE,CAAC;IACZ,SAAS,GAAG,EAAE,CAAC;IACf,SAAS,GAAa,EAAE,CAAC;IACzB,MAAM,CAAqB;IAC3B,SAAS,GAAG,KAAK,CAAC;IAE1B,YACmB,OAAkC,EAClC,iBAAiB,EAAE,GAAG,IAAI,GAAG,IAAI;QADjC,YAAO,GAAP,OAAO,CAA2B;QAClC,mBAAc,GAAd,cAAc,CAAmB;IACjD,CAAC;IAEJ,IAAI,CAAC,KAAa;QAChB,IAAI,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QAErB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI;gBAAE,SAAS;YACzC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM;oBAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;qBACnD,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,EAAE,CAAC;YAC5C,CAAC;YACD,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,cAAc,aAAa,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,IAAY;QACvB,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,uBAAuB;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAElD,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,OAAO;gBACV,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;gBACvB,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC3B,MAAM;YACR,KAAK,IAAI;gBACP,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;gBAC/C,MAAM;YACR;gBACE,MAAM,CAAC,yCAAyC;QACpD,CAAC;IACH,CAAC;IAEO,QAAQ;QACd,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAa,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChG,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QACtD,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;CACF;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAgC,EAChC,OAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/transport/sse.d.ts

@@ -0,0 +1,39 @@
+/**
+ * SSE channel — the MCP "HTTP with SSE" transport (protocol 2024-11-05).
+ *
+ *  1. `GET <url>` with `Accept: text/event-stream` opens the server→client stream.
+ *  2. The server's first event is `endpoint`; its data is the URL (usually with a
+ *     `sessionId` query) that client→server messages must be POSTed to.
+ *  3. Every JSON-RPC message from the server arrives as a `message` event.
+ *
+ * Reconnection is *not* done here: an SSE session's server-side state dies with
+ * the stream, so the gateway's supervisor re-runs the full MCP handshake
+ * instead (see `gateway/supervisor.ts`).
+ *
+ * Security: the announced endpoint must have the same origin as the SSE URL, so
+ * a malicious server cannot make the gateway POST its configured headers
+ * (often credentials) to another host. Redirects are not followed for POSTs.
+ *
+ * @module transport/sse
+ */
+import type { McpServerConfig } from '../utils/types.js';
+import { type ChannelOptions, type JsonRpcMessage, type UpstreamChannel } from './channel.js';
+export declare class SseChannel implements UpstreamChannel {
+    private readonly config;
+    private readonly options;
+    readonly kind = "sse";
+    onmessage?: (message: JsonRpcMessage) => void;
+    onclose?: (error: Error) => void;
+    private readonly url;
+    private readonly headers;
+    private readonly abort;
+    private endpoint?;
+    private closed;
+    private lost;
+    constructor(config: McpServerConfig, options: ChannelOptions);
+    start(): Promise<void>;
+    private lose;
+    send(message: JsonRpcMessage): Promise<void>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=sse.d.ts.map

package/dist/transport/sse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../../src/transport/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,EAA4B,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAGxH,qBAAa,UAAW,YAAW,eAAe;IAa9C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAb1B,QAAQ,CAAC,IAAI,SAAS;IACtB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC;IAC9C,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAEjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAM;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyB;IAC/C,OAAO,CAAC,QAAQ,CAAC,CAAM;IACvB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,IAAI,CAAS;gBAGF,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,cAAc;IAOpC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA2E5B,OAAO,CAAC,IAAI;IAQN,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAc5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B"}

package/dist/transport/sse.js

@@ -0,0 +1,142 @@
+/**
+ * SSE channel — the MCP "HTTP with SSE" transport (protocol 2024-11-05).
+ *
+ *  1. `GET <url>` with `Accept: text/event-stream` opens the server→client stream.
+ *  2. The server's first event is `endpoint`; its data is the URL (usually with a
+ *     `sessionId` query) that client→server messages must be POSTed to.
+ *  3. Every JSON-RPC message from the server arrives as a `message` event.
+ *
+ * Reconnection is *not* done here: an SSE session's server-side state dies with
+ * the stream, so the gateway's supervisor re-runs the full MCP handshake
+ * instead (see `gateway/supervisor.ts`).
+ *
+ * Security: the announced endpoint must have the same origin as the SSE URL, so
+ * a malicious server cannot make the gateway POST its configured headers
+ * (often credentials) to another host. Redirects are not followed for POSTs.
+ *
+ * @module transport/sse
+ */
+import { logger } from '../utils/logger.js';
+import { errMessage, expandRecord } from './channel.js';
+import { readSseStream } from './sse-parser.js';
+export class SseChannel {
+    config;
+    options;
+    kind = 'sse';
+    onmessage;
+    onclose;
+    url;
+    headers;
+    abort = new AbortController();
+    endpoint;
+    closed = false;
+    lost = false;
+    constructor(config, options) {
+        this.config = config;
+        this.options = options;
+        if (!config.url)
+            throw new Error(`Server "${config.id}" has no url configured`);
+        this.url = new URL(config.url);
+        this.headers = expandRecord(config.headers);
+    }
+    async start() {
+        let timer;
+        let onEndpoint;
+        let onFail;
+        const ready = new Promise((resolve, reject) => {
+            onEndpoint = resolve;
+            onFail = reject;
+            timer = setTimeout(() => reject(new Error(`SSE server did not announce an endpoint within ${this.options.connectTimeoutMs}ms`)), this.options.connectTimeoutMs);
+        });
+        let res;
+        try {
+            res = await fetch(this.url, {
+                method: 'GET',
+                headers: { ...this.headers, Accept: 'text/event-stream', 'Cache-Control': 'no-cache' },
+                signal: this.abort.signal,
+            });
+        }
+        catch (err) {
+            clearTimeout(timer);
+            throw new Error(`SSE connect to ${this.url.origin}${this.url.pathname} failed: ${errMessage(err)}`);
+        }
+        if (!res.ok || !res.body) {
+            clearTimeout(timer);
+            await res.body?.cancel().catch(() => { });
+            throw new Error(`SSE server returned HTTP ${res.status}`);
+        }
+        const contentType = res.headers.get('content-type') ?? '';
+        if (!contentType.includes('text/event-stream')) {
+            clearTimeout(timer);
+            await res.body.cancel().catch(() => { });
+            throw new Error(`SSE server returned unexpected content-type "${contentType}"`);
+        }
+        // Consume the stream in the background for the lifetime of the channel.
+        readSseStream(res.body, (ev) => {
+            if (ev.event === 'endpoint') {
+                try {
+                    const endpoint = new URL(ev.data.trim(), this.url);
+                    if (endpoint.origin !== this.url.origin) {
+                        throw new Error(`endpoint origin ${endpoint.origin} does not match ${this.url.origin}`);
+                    }
+                    this.endpoint = endpoint;
+                    onEndpoint();
+                }
+                catch (err) {
+                    onFail(new Error(`Invalid SSE endpoint event: ${errMessage(err)}`));
+                }
+                return;
+            }
+            if (ev.event !== 'message')
+                return;
+            let parsed;
+            try {
+                parsed = JSON.parse(ev.data);
+            }
+            catch {
+                logger.debug(`[${this.config.id}] ignoring non-JSON SSE message`);
+                return;
+            }
+            if (parsed && typeof parsed === 'object')
+                this.onmessage?.(parsed);
+        }).then(() => this.lose(new Error('SSE stream ended'), onFail), (err) => this.lose(new Error(`SSE stream error: ${errMessage(err)}`), onFail));
+        try {
+            await ready;
+        }
+        catch (err) {
+            this.abort.abort();
+            throw err;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    lose(err, failStart) {
+        failStart(err); // no-op once start() settled
+        if (this.closed || this.lost)
+            return;
+        this.lost = true;
+        this.abort.abort();
+        this.onclose?.(err);
+    }
+    async send(message) {
+        if (this.closed || this.lost || !this.endpoint)
+            throw new Error('SSE channel is not connected');
+        const res = await fetch(this.endpoint, {
+            method: 'POST',
+            headers: { ...this.headers, 'Content-Type': 'application/json' },
+            body: JSON.stringify(message),
+            redirect: 'error',
+            signal: this.abort.signal,
+        });
+        // Body is informational ("Accepted"); drain it so the socket is reused.
+        await res.text().catch(() => '');
+        if (!res.ok)
+            throw new Error(`POST to SSE endpoint returned HTTP ${res.status}`);
+    }
+    async close() {
+        this.closed = true;
+        this.abort.abort();
+    }
+}
+//# sourceMappingURL=sse.js.map

package/dist/transport/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../../src/transport/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAkE,MAAM,cAAc,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,OAAO,UAAU;IAaF;IACA;IAbV,IAAI,GAAG,KAAK,CAAC;IACtB,SAAS,CAAqC;IAC9C,OAAO,CAA0B;IAEhB,GAAG,CAAM;IACT,OAAO,CAAyB;IAChC,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACvC,QAAQ,CAAO;IACf,MAAM,GAAG,KAAK,CAAC;IACf,IAAI,GAAG,KAAK,CAAC;IAErB,YACmB,MAAuB,EACvB,OAAuB;QADvB,WAAM,GAAN,MAAM,CAAiB;QACvB,YAAO,GAAP,OAAO,CAAgB;QAExC,IAAI,CAAC,MAAM,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,KAAiC,CAAC;QACtC,IAAI,UAAuB,CAAC;QAC5B,IAAI,MAA6B,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAClD,UAAU,GAAG,OAAO,CAAC;YACrB,MAAM,GAAG,MAAM,CAAC;YAChB,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kDAAkD,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC,EAC5G,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAC9B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC1B,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,eAAe,EAAE,UAAU,EAAE;gBACtF,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,YAAY,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC/C,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,gDAAgD,WAAW,GAAG,CAAC,CAAC;QAClF,CAAC;QAED,wEAAwE;QACxE,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;YAC7B,IAAI,EAAE,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;wBACxC,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,MAAM,mBAAmB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC1F,CAAC;oBACD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;oBACzB,UAAU,EAAE,CAAC;gBACf,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBACtE,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO;YACnC,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,iCAAiC,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,SAAS,EAAE,CAAC,MAAwB,CAAC,CAAC;QACvF,CAAC,CAAC,CAAC,IAAI,CACL,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,EACtD,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,qBAAqB,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAC9E,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,GAAU,EAAE,SAA6B;QACpD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,6BAA6B;QAC7C,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAuB;QAChC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAChG,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAC7B,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,wEAAwE;QACxE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;CACF"}

package/dist/transport/stdio.d.ts

@@ -0,0 +1,35 @@
+/**
+ * stdio channel — spawns the MCP server as a child process and exchanges
+ * newline-delimited JSON-RPC over its stdin/stdout (MCP stdio transport).
+ *
+ * Carries over the v0.2 / audit fixes:
+ *  - stdout is decoded as a stream so multi-byte UTF-8 split across chunks survives;
+ *  - stream errors (EPIPE on a dead child) never become unhandled 'error' events;
+ *  - spawn errors and unexpected exits are reported once through `onclose`;
+ *  - shutdown follows the MCP spec: close stdin → SIGTERM → SIGKILL, waiting
+ *    for the real exit instead of trusting `proc.killed`;
+ *  - un-terminated stdout is capped.
+ *
+ * @module transport/stdio
+ */
+import type { McpServerConfig } from '../utils/types.js';
+import { type ChannelOptions, type JsonRpcMessage, type UpstreamChannel } from './channel.js';
+export declare class StdioChannel implements UpstreamChannel {
+    private readonly config;
+    private readonly options;
+    readonly kind = "stdio";
+    onmessage?: (message: JsonRpcMessage) => void;
+    onclose?: (error: Error) => void;
+    private proc?;
+    private buffer;
+    private closing;
+    private lost;
+    private exited;
+    constructor(config: McpServerConfig, options: ChannelOptions);
+    start(): Promise<void>;
+    private lose;
+    private drain;
+    send(message: JsonRpcMessage): Promise<void>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=stdio.d.ts.map

package/dist/transport/stdio.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../src/transport/stdio.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,EAA2B,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAIvH,qBAAa,YAAa,YAAW,eAAe;IAYhD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAZ1B,QAAQ,CAAC,IAAI,WAAW;IACxB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC;IAC9C,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAEjC,OAAO,CAAC,IAAI,CAAC,CAAe;IAC5B,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,MAAM,CAAiB;gBAGZ,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,cAAc;IAG1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA2DtB,OAAO,CAAC,IAAI;IAMZ,OAAO,CAAC,KAAK;IAiBP,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CA2B7B"}

package/dist/transport/stdio.js

@@ -0,0 +1,149 @@
+/**
+ * stdio channel — spawns the MCP server as a child process and exchanges
+ * newline-delimited JSON-RPC over its stdin/stdout (MCP stdio transport).
+ *
+ * Carries over the v0.2 / audit fixes:
+ *  - stdout is decoded as a stream so multi-byte UTF-8 split across chunks survives;
+ *  - stream errors (EPIPE on a dead child) never become unhandled 'error' events;
+ *  - spawn errors and unexpected exits are reported once through `onclose`;
+ *  - shutdown follows the MCP spec: close stdin → SIGTERM → SIGKILL, waiting
+ *    for the real exit instead of trusting `proc.killed`;
+ *  - un-terminated stdout is capped.
+ *
+ * @module transport/stdio
+ */
+import { spawn } from 'child_process';
+import { logger } from '../utils/logger.js';
+import { expandEnv, expandRecord } from './channel.js';
+const MAX_BUFFER_CHARS = 16 * 1024 * 1024;
+export class StdioChannel {
+    config;
+    options;
+    kind = 'stdio';
+    onmessage;
+    onclose;
+    proc;
+    buffer = '';
+    closing = false;
+    lost = false;
+    exited;
+    constructor(config, options) {
+        this.config = config;
+        this.options = options;
+    }
+    start() {
+        const { config } = this;
+        if (!config.command)
+            return Promise.reject(new Error(`Server "${config.id}" has no command configured`));
+        // ${VAR} is expanded in args too (the examples pass e.g. ${DATABASE_URL} as an argument).
+        const proc = spawn(config.command, (config.args ?? []).map(expandEnv), {
+            env: { ...process.env, ...expandRecord(config.env) },
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        this.proc = proc;
+        let markExited;
+        this.exited = new Promise((r) => (markExited = r));
+        proc.stdout?.setEncoding('utf8');
+        proc.stdout?.on('data', (chunk) => {
+            this.buffer += chunk;
+            this.drain();
+            if (this.buffer.length > MAX_BUFFER_CHARS) {
+                logger.error(`[${config.id}] stdout line exceeded ${MAX_BUFFER_CHARS} chars; dropping session`);
+                this.buffer = '';
+                this.lose(new Error('MCP server sent an oversized message'));
+                proc.kill('SIGKILL');
+            }
+        });
+        proc.stderr?.on('data', (chunk) => {
+            logger.debug(`[${config.id}] stderr: ${chunk.toString().trim()}`);
+        });
+        const onStreamError = (err) => logger.debug(`[${config.id}] stdio stream error: ${err.message}`);
+        proc.stdin?.on('error', onStreamError);
+        proc.stdout?.on('error', onStreamError);
+        proc.stderr?.on('error', onStreamError);
+        return new Promise((resolve, reject) => {
+            let started = false;
+            proc.once('spawn', () => {
+                started = true;
+                resolve();
+            });
+            proc.on('error', (err) => {
+                logger.error(`[${config.id}] spawn error: ${err.message}`);
+                markExited(); // 'exit' may never fire if spawn failed
+                if (!started) {
+                    started = true;
+                    this.lost = true;
+                    reject(err);
+                    return;
+                }
+                this.lose(err);
+            });
+            proc.on('exit', (code, signal) => {
+                markExited();
+                if (!this.closing)
+                    logger.warn(`Server "${config.id}" exited (code=${code}, signal=${signal})`);
+                this.lose(new Error(`MCP server "${config.id}" exited unexpectedly (code=${code}, signal=${signal})`));
+            });
+        });
+    }
+    lose(err) {
+        if (this.lost || this.closing)
+            return;
+        this.lost = true;
+        this.onclose?.(err);
+    }
+    drain() {
+        if (!this.buffer.includes('\n'))
+            return;
+        const lines = this.buffer.split('\n');
+        this.buffer = lines.pop() ?? '';
+        for (const line of lines) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            let msg;
+            try {
+                msg = JSON.parse(trimmed);
+            }
+            catch {
+                continue; // Non-JSON line (some servers log to stdout) — ignore
+            }
+            if (msg && typeof msg === 'object')
+                this.onmessage?.(msg);
+        }
+    }
+    async send(message) {
+        const stdin = this.proc?.stdin;
+        if (this.lost || this.closing || !stdin || !stdin.writable) {
+            throw new Error(`Server "${this.config.id}" is not writable`);
+        }
+        stdin.write(JSON.stringify(message) + '\n');
+    }
+    async close() {
+        if (this.closing)
+            return;
+        this.closing = true;
+        const proc = this.proc;
+        if (!proc)
+            return;
+        const grace = this.options.killGraceMs;
+        const isRunning = () => proc.exitCode === null && proc.signalCode === null && proc.pid !== undefined;
+        const waitExit = (ms) => Promise.race([this.exited, new Promise((r) => setTimeout(r, ms).unref())]);
+        if (isRunning()) {
+            proc.stdin?.end();
+            await waitExit(Math.min(grace, 500));
+        }
+        if (isRunning()) {
+            proc.kill('SIGTERM');
+            await waitExit(grace);
+        }
+        if (isRunning()) {
+            proc.kill('SIGKILL');
+            await waitExit(grace);
+        }
+        proc.stdin?.destroy();
+        proc.stdout?.destroy();
+        proc.stderr?.destroy();
+    }
+}
+//# sourceMappingURL=stdio.js.map

package/dist/transport/stdio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../../src/transport/stdio.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,KAAK,EAAqB,MAAM,eAAe,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAkE,MAAM,cAAc,CAAC;AAEvH,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C,MAAM,OAAO,YAAY;IAYJ;IACA;IAZV,IAAI,GAAG,OAAO,CAAC;IACxB,SAAS,CAAqC;IAC9C,OAAO,CAA0B;IAEzB,IAAI,CAAgB;IACpB,MAAM,GAAG,EAAE,CAAC;IACZ,OAAO,GAAG,KAAK,CAAC;IAChB,IAAI,GAAG,KAAK,CAAC;IACb,MAAM,CAAiB;IAE/B,YACmB,MAAuB,EACvB,OAAuB;QADvB,WAAM,GAAN,MAAM,CAAiB;QACvB,YAAO,GAAP,OAAO,CAAgB;IACvC,CAAC;IAEJ,KAAK;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,MAAM,CAAC,EAAE,6BAA6B,CAAC,CAAC,CAAC;QAEzG,0FAA0F;QAC1F,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;YACrE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YACpD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QAEjB,IAAI,UAAuB,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;QAEzD,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;YACrB,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;gBAC1C,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,EAAE,0BAA0B,gBAAgB,0BAA0B,CAAC,CAAC;gBAChG,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;gBACjB,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC;gBAC7D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,EAAE,aAAa,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,CAAC,GAAU,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,EAAE,yBAAyB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxG,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAExC,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACtB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,EAAE,kBAAkB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3D,UAAU,EAAE,CAAC,CAAC,wCAAwC;gBACtD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,GAAG,IAAI,CAAC;oBACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;oBACjB,MAAM,CAAC,GAAG,CAAC,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBAC/B,UAAU,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,OAAO;oBAAE,MAAM,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,EAAE,kBAAkB,IAAI,YAAY,MAAM,GAAG,CAAC,CAAC;gBAChG,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,eAAe,MAAM,CAAC,EAAE,+BAA+B,IAAI,YAAY,MAAM,GAAG,CAAC,CAAC,CAAC;YACzG,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,IAAI,CAAC,GAAU;QACrB,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAEO,KAAK;QACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,sDAAsD;YAClE,CAAC;YACD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,IAAI,CAAC,SAAS,EAAE,CAAC,GAAqB,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAuB;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;QAC/B,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAChE,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QACvC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;QACrG,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE,CAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAEnF,IAAI,SAAS,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;YAClB,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,SAAS,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrB,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,SAAS,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrB,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;IACzB,CAAC;CACF"}