@winstonsayno/mcp-gateway 0.0.0-stage → 0.4.0

package/dist/registry/index.js

@@ -0,0 +1,171 @@
+/**
+ * MCP Server Registry
+ * Manages the lifecycle of all registered MCP servers
+ */
+import { EventEmitter } from 'events';
+import { logger } from '../utils/logger.js';
+import { filterTools, isToolAllowed } from '../utils/tool-filter.js';
+export class ServerRegistry extends EventEmitter {
+    healthCheckMs;
+    servers = new Map();
+    health = new Map();
+    tools = new Map(); // serverId -> tools
+    healthCheckInterval;
+    constructor(healthCheckMs = 30_000) {
+        super();
+        this.healthCheckMs = healthCheckMs;
+    }
+    // ─── Registration ───────────────────────────────────────────────────────────
+    register(config) {
+        if (this.servers.has(config.id)) {
+            logger.warn(`Server "${config.id}" is already registered. Overwriting.`);
+        }
+        this.servers.set(config.id, config);
+        this.health.set(config.id, {
+            serverId: config.id,
+            status: 'unknown',
+            lastChecked: new Date(),
+        });
+        logger.info(`Registered MCP server: ${config.id} (${config.name})`);
+        this.emit('registered', config);
+    }
+    unregister(serverId) {
+        if (!this.servers.has(serverId))
+            return false;
+        this.servers.delete(serverId);
+        this.health.delete(serverId);
+        this.tools.delete(serverId);
+        logger.info(`Unregistered MCP server: ${serverId}`);
+        this.emit('unregistered', serverId);
+        return true;
+    }
+    // ─── Queries ────────────────────────────────────────────────────────────────
+    getServer(id) {
+        return this.servers.get(id);
+    }
+    getAllServers() {
+        return Array.from(this.servers.values());
+    }
+    getEnabledServers() {
+        return this.getAllServers().filter((s) => s.enabled !== false);
+    }
+    getServersByTag(tag) {
+        return this.getAllServers().filter((s) => s.tags?.includes(tag));
+    }
+    getHealth(serverId) {
+        return this.health.get(serverId);
+    }
+    getAllHealth() {
+        return Array.from(this.health.values());
+    }
+    // ─── Tool Registry ──────────────────────────────────────────────────────────
+    /**
+     * Store a server's tool list, applying its `tools` allow/deny filter.
+     * Only exposed tools are kept, so discovery, routing and counts never see
+     * filtered ones.
+     */
+    setTools(serverId, all) {
+        const tools = filterTools(all, this.servers.get(serverId)?.tools);
+        if (tools.length !== all.length) {
+            logger.debug(`Server "${serverId}": ${all.length - tools.length} of ${all.length} tools hidden by its tools filter`);
+        }
+        for (const t of tools) {
+            const owners = this.findTools(t.name).filter((o) => o.serverId !== serverId);
+            if (owners.length > 0) {
+                logger.warn(`Tool "${t.name}" is exposed by multiple servers (${[serverId, ...owners.map((o) => o.serverId)].join(', ')}); ` +
+                    'callers must pass "server" to disambiguate');
+            }
+        }
+        this.tools.set(serverId, tools);
+        this.emit('tools-updated', serverId, tools);
+    }
+    /** Whether the server's `tools` filter lets `toolName` through. */
+    isToolExposed(serverId, toolName) {
+        return isToolAllowed(toolName, this.servers.get(serverId)?.tools);
+    }
+    getTools(serverId) {
+        return this.tools.get(serverId) ?? [];
+    }
+    getAllTools() {
+        return Array.from(this.tools.values()).flat();
+    }
+    /** Every server's entry for a tool name (more than one means the name is ambiguous). */
+    findTools(toolName) {
+        const found = [];
+        for (const tools of this.tools.values()) {
+            const t = tools.find((x) => x.name === toolName);
+            if (t)
+                found.push(t);
+        }
+        return found;
+    }
+    findTool(toolName) {
+        for (const tools of this.tools.values()) {
+            const found = tools.find((t) => t.name === toolName);
+            if (found)
+                return found;
+        }
+        return undefined;
+    }
+    // ─── Health Updates ─────────────────────────────────────────────────────────
+    updateHealth(serverId, status, latencyMs, errorMessage, extra = {}) {
+        if (!this.servers.has(serverId))
+            return; // never resurrect an unregistered server
+        const prev = this.health.get(serverId);
+        const updated = {
+            serverId,
+            status,
+            lastChecked: new Date(),
+            latencyMs,
+            errorMessage,
+            toolCount: this.tools.get(serverId)?.length,
+            connectedSince: 'connectedSince' in extra ? extra.connectedSince : prev?.connectedSince,
+            reconnect: 'reconnect' in extra ? extra.reconnect : prev?.reconnect,
+        };
+        if (!updated.connectedSince)
+            delete updated.connectedSince;
+        if (!updated.reconnect)
+            delete updated.reconnect;
+        this.health.set(serverId, updated);
+        if (prev?.status !== status) {
+            logger.info(`Server "${serverId}" status changed: ${prev?.status ?? 'unknown'} → ${status}`);
+            this.emit('health-changed', updated);
+        }
+    }
+    // ─── Lifecycle ──────────────────────────────────────────────────────────────
+    startHealthChecks(checkFn) {
+        this.stopHealthChecks(); // never stack multiple intervals
+        let running = false;
+        this.healthCheckInterval = setInterval(() => {
+            if (running)
+                return; // skip a tick rather than overlap slow checks
+            running = true;
+            void Promise.allSettled(this.getEnabledServers().map((server) => checkFn(server.id).catch((err) => {
+                logger.debug(`Health check failed for ${server.id}: ${String(err)}`);
+            }))).finally(() => {
+                running = false;
+            });
+        }, this.healthCheckMs);
+        this.healthCheckInterval.unref();
+    }
+    stopHealthChecks() {
+        if (this.healthCheckInterval) {
+            clearInterval(this.healthCheckInterval);
+            this.healthCheckInterval = undefined;
+        }
+    }
+    // ─── Summary ────────────────────────────────────────────────────────────────
+    getSummary() {
+        const allHealth = this.getAllHealth();
+        return {
+            total: allHealth.length,
+            online: allHealth.filter((h) => h.status === 'online').length,
+            offline: allHealth.filter((h) => h.status === 'offline').length,
+            degraded: allHealth.filter((h) => h.status === 'degraded').length,
+            reconnecting: allHealth.filter((h) => h.status === 'reconnecting').length,
+            unknown: allHealth.filter((h) => h.status === 'unknown').length,
+            totalTools: this.getAllTools().length,
+        };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/registry/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/registry/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAOtC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAErE,MAAM,OAAO,cAAe,SAAQ,YAAY;IAMjB;IALrB,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC7C,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IACzC,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC,CAAC,oBAAoB;IAC3D,mBAAmB,CAAkB;IAE7C,YAA6B,gBAAgB,MAAM;QACjD,KAAK,EAAE,CAAC;QADmB,kBAAa,GAAb,aAAa,CAAS;IAEnD,CAAC;IAED,+EAA+E;IAE/E,QAAQ,CAAC,MAAuB;QAC9B,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,EAAE,uCAAuC,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE;YACzB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,IAAI,IAAI,EAAE;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,UAAU,CAAC,QAAgB;QACzB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IAE/E,SAAS,CAAC,EAAU;QAClB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,aAAa;QACX,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,iBAAiB;QACf,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IACjE,CAAC;IAED,eAAe,CAAC,GAAW;QACzB,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,YAAY;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,+EAA+E;IAE/E;;;;OAIG;IACH,QAAQ,CAAC,QAAgB,EAAE,GAAe;QACxC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;QAClE,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,CAAC,KAAK,CAAC,WAAW,QAAQ,MAAM,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,OAAO,GAAG,CAAC,MAAM,mCAAmC,CAAC,CAAC;QACvH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAC7E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CACT,SAAS,CAAC,CAAC,IAAI,qCAAqC,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;oBAC9G,4CAA4C,CAC/C,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,mEAAmE;IACnE,aAAa,CAAC,QAAgB,EAAE,QAAgB;QAC9C,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;IAED,QAAQ,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,WAAW;QACT,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,wFAAwF;IACxF,SAAS,CAAC,QAAgB;QACxB,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;YACjD,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ,CAAC,QAAgB;QACvB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;YACrD,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,+EAA+E;IAE/E,YAAY,CACV,QAAgB,EAChB,MAAoB,EACpB,SAAkB,EAClB,YAAqB,EACrB,QAA4D,EAAE;QAE9D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,yCAAyC;QAClF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,OAAO,GAAiB;YAC5B,QAAQ;YACR,MAAM;YACN,WAAW,EAAE,IAAI,IAAI,EAAE;YACvB,SAAS;YACT,YAAY;YACZ,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM;YAC3C,cAAc,EAAE,gBAAgB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc;YACvF,SAAS,EAAE,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS;SACpE,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,cAAc;YAAE,OAAO,OAAO,CAAC,cAAc,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC,SAAS,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEnC,IAAI,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,QAAQ,qBAAqB,IAAI,EAAE,MAAM,IAAI,SAAS,MAAM,MAAM,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,+EAA+E;IAE/E,iBAAiB,CAAC,OAA4C;QAC5D,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,iCAAiC;QAC1D,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,mBAAmB,GAAG,WAAW,CAAC,GAAG,EAAE;YAC1C,IAAI,OAAO;gBAAE,OAAO,CAAC,8CAA8C;YACnE,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,OAAO,CAAC,UAAU,CACrB,IAAI,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACtC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACxC,MAAM,CAAC,KAAK,CAAC,2BAA2B,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC,CAAC,CACH,CACF,CAAC,OAAO,CAAC,GAAG,EAAE;gBACb,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACvB,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,gBAAgB;QACd,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,aAAa,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACxC,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC;QACvC,CAAC;IACH,CAAC;IAED,+EAA+E;IAE/E,UAAU;QASR,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,OAAO;YACL,KAAK,EAAE,SAAS,CAAC,MAAM;YACvB,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;YAC7D,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;YAC/D,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM;YACjE,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,MAAM;YACzE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;YAC/D,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM;SACtC,CAAC;IACJ,CAAC;CACF"}

package/dist/transport/channel.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Upstream channel abstraction.
+ *
+ * A channel moves raw JSON-RPC messages between the gateway and one upstream
+ * MCP server. It knows nothing about request ids, timeouts or the MCP
+ * handshake — that is the job of the session layer in `proxy/index.ts`, which
+ * is shared by every transport (stdio, SSE, WebSocket, Streamable HTTP).
+ *
+ * Lifecycle: `start()` → any number of `send()` → `close()`.
+ * `onclose` fires once when the channel goes away *unexpectedly* (process
+ * exit, socket close, stream end); it does not fire for `close()`.
+ *
+ * @module transport/channel
+ */
+import type { McpServerConfig } from '../utils/types.js';
+export type JsonRpcId = string | number;
+export interface JsonRpcMessage {
+    jsonrpc: '2.0';
+    id?: JsonRpcId | null;
+    method?: string;
+    params?: unknown;
+    result?: unknown;
+    error?: {
+        code: number;
+        message: string;
+        data?: unknown;
+    };
+}
+export interface UpstreamChannel {
+    /** Short transport name, for logs. */
+    readonly kind: string;
+    /** Open the connection. Resolves once `send()` may be called. */
+    start(): Promise<void>;
+    /** Deliver one message. Rejects when the message could not be handed over. */
+    send(message: JsonRpcMessage): Promise<void>;
+    /** Intentionally close the channel and release every resource. */
+    close(): Promise<void>;
+    /** Called for every message received from the server. */
+    onmessage?: (message: JsonRpcMessage) => void;
+    /** Called once when the channel is lost without `close()` being called. */
+    onclose?: (error: Error) => void;
+    /** Informs HTTP-based channels of the protocol version negotiated in `initialize`. */
+    setProtocolVersion?(version: string): void;
+    /** Called when a request is abandoned (e.g. timed out) so the channel can free per-request resources. */
+    abandon?(id: JsonRpcId): void;
+}
+/** Expand `${VAR}` references against the gateway's own environment. */
+export declare function expandEnv(value: string): string;
+export declare function expandRecord(record: Record<string, string> | undefined): Record<string, string>;
+/** Error message including the `cause` (fetch() hides the real reason there). */
+export declare function errMessage(err: unknown): string;
+/** Parse a JSON value into zero or more JSON-RPC messages (batches are arrays). */
+export declare function toMessages(value: unknown): JsonRpcMessage[];
+export interface ChannelOptions {
+    /** Time allowed for `start()` (connect + handshake prerequisites). */
+    connectTimeoutMs: number;
+    /** Grace period used by the stdio channel between stdin close / SIGTERM / SIGKILL. */
+    killGraceMs: number;
+}
+export type ChannelFactory = (config: McpServerConfig, options: ChannelOptions) => UpstreamChannel;
+//# sourceMappingURL=channel.d.ts.map

package/dist/transport/channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel.d.ts","sourceRoot":"","sources":["../../src/transport/channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAExC,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC3D;AAED,MAAM,WAAW,eAAe;IAC9B,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,8EAA8E;IAC9E,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,kEAAkE;IAClE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC;IAC9C,2EAA2E;IAC3E,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,sFAAsF;IACtF,kBAAkB,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,yGAAyG;IACzG,OAAO,CAAC,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI,CAAC;CAC/B;AAED,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/F;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAM/C;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,EAAE,CAK3D;AAED,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,gBAAgB,EAAE,MAAM,CAAC;IACzB,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,KAAK,eAAe,CAAC"}

package/dist/transport/channel.js

@@ -0,0 +1,38 @@
+/**
+ * Upstream channel abstraction.
+ *
+ * A channel moves raw JSON-RPC messages between the gateway and one upstream
+ * MCP server. It knows nothing about request ids, timeouts or the MCP
+ * handshake — that is the job of the session layer in `proxy/index.ts`, which
+ * is shared by every transport (stdio, SSE, WebSocket, Streamable HTTP).
+ *
+ * Lifecycle: `start()` → any number of `send()` → `close()`.
+ * `onclose` fires once when the channel goes away *unexpectedly* (process
+ * exit, socket close, stream end); it does not fire for `close()`.
+ *
+ * @module transport/channel
+ */
+/** Expand `${VAR}` references against the gateway's own environment. */
+export function expandEnv(value) {
+    return value.replace(/\$\{([^}]+)\}/g, (_, name) => process.env[name] ?? '');
+}
+export function expandRecord(record) {
+    const out = {};
+    for (const [k, v] of Object.entries(record ?? {}))
+        out[k] = expandEnv(v);
+    return out;
+}
+/** Error message including the `cause` (fetch() hides the real reason there). */
+export function errMessage(err) {
+    if (err instanceof Error) {
+        const cause = err.cause;
+        return cause instanceof Error ? `${err.message} (${cause.message})` : err.message;
+    }
+    return String(err);
+}
+/** Parse a JSON value into zero or more JSON-RPC messages (batches are arrays). */
+export function toMessages(value) {
+    const list = Array.isArray(value) ? value : [value];
+    return list.filter((m) => !!m && typeof m === 'object' && m.jsonrpc === '2.0');
+}
+//# sourceMappingURL=channel.js.map

package/dist/transport/channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel.js","sourceRoot":"","sources":["../../src/transport/channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAkCH,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAA0C;IACrE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAI,GAAmC,CAAC,KAAK,CAAC;QACzD,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpF,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC,MAAM,CAChB,CAAC,CAAC,EAAuB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAA2B,CAAC,OAAO,KAAK,KAAK,CAC3G,CAAC;AACJ,CAAC"}

package/dist/transport/sse-parser.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Incremental `text/event-stream` parser (WHATWG HTML §9.2).
+ *
+ * Feed it decoded text chunks of any size; it calls `onEvent` for every
+ * complete event. Parser state survives chunk boundaries, so events, lines
+ * and even CRLF pairs split across TCP chunks are handled.
+ *
+ * @module transport/sse-parser
+ */
+export interface SseEvent {
+    event: string;
+    data: string;
+    id?: string;
+}
+export declare class SseParser {
+    private readonly onEvent;
+    private readonly maxBufferChars;
+    private buffer;
+    private eventType;
+    private dataLines;
+    private lastId;
+    private pendingCR;
+    constructor(onEvent: (event: SseEvent) => void, maxBufferChars?: number);
+    push(chunk: string): void;
+    private line;
+    private dispatch;
+}
+/** Read a fetch() body stream through an SseParser until it ends. */
+export declare function readSseStream(body: ReadableStream<Uint8Array>, onEvent: (event: SseEvent) => void): Promise<void>;
+//# sourceMappingURL=sse-parser.d.ts.map

package/dist/transport/sse-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-parser.d.ts","sourceRoot":"","sources":["../../src/transport/sse-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,SAAS;IAQlB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,cAAc;IARjC,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,SAAS,CAAM;IACvB,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,SAAS,CAAS;gBAGP,OAAO,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,EAClC,cAAc,SAAmB;IAGpD,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAuBzB,OAAO,CAAC,IAAI;IA0BZ,OAAO,CAAC,QAAQ;CAWjB;AAED,qEAAqE;AACrE,wBAAsB,aAAa,CACjC,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,EAChC,OAAO,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,GACjC,OAAO,CAAC,IAAI,CAAC,CAef"}

package/dist/transport/sse-parser.js

@@ -0,0 +1,107 @@
+/**
+ * Incremental `text/event-stream` parser (WHATWG HTML §9.2).
+ *
+ * Feed it decoded text chunks of any size; it calls `onEvent` for every
+ * complete event. Parser state survives chunk boundaries, so events, lines
+ * and even CRLF pairs split across TCP chunks are handled.
+ *
+ * @module transport/sse-parser
+ */
+export class SseParser {
+    onEvent;
+    maxBufferChars;
+    buffer = '';
+    eventType = '';
+    dataLines = [];
+    lastId;
+    pendingCR = false;
+    constructor(onEvent, maxBufferChars = 16 * 1024 * 1024) {
+        this.onEvent = onEvent;
+        this.maxBufferChars = maxBufferChars;
+    }
+    push(chunk) {
+        if (this.pendingCR && chunk.startsWith('\n'))
+            chunk = chunk.slice(1);
+        this.pendingCR = false;
+        this.buffer += chunk;
+        let start = 0;
+        for (let i = 0; i < this.buffer.length; i++) {
+            const ch = this.buffer[i];
+            if (ch !== '\n' && ch !== '\r')
+                continue;
+            this.line(this.buffer.slice(start, i));
+            if (ch === '\r') {
+                if (i + 1 === this.buffer.length)
+                    this.pendingCR = true;
+                else if (this.buffer[i + 1] === '\n')
+                    i++;
+            }
+            start = i + 1;
+        }
+        this.buffer = this.buffer.slice(start);
+        if (this.buffer.length > this.maxBufferChars) {
+            this.buffer = '';
+            throw new Error(`SSE line exceeded ${this.maxBufferChars} characters`);
+        }
+    }
+    line(line) {
+        if (line === '') {
+            this.dispatch();
+            return;
+        }
+        if (line.startsWith(':'))
+            return; // comment / keep-alive
+        const colon = line.indexOf(':');
+        const field = colon === -1 ? line : line.slice(0, colon);
+        let value = colon === -1 ? '' : line.slice(colon + 1);
+        if (value.startsWith(' '))
+            value = value.slice(1);
+        switch (field) {
+            case 'event':
+                this.eventType = value;
+                break;
+            case 'data':
+                this.dataLines.push(value);
+                break;
+            case 'id':
+                if (!value.includes('\0'))
+                    this.lastId = value;
+                break;
+            default:
+                break; // "retry" and unknown fields are ignored
+        }
+    }
+    dispatch() {
+        if (this.dataLines.length === 0) {
+            this.eventType = '';
+            return;
+        }
+        const event = { event: this.eventType || 'message', data: this.dataLines.join('\n') };
+        if (this.lastId !== undefined)
+            event.id = this.lastId;
+        this.eventType = '';
+        this.dataLines = [];
+        this.onEvent(event);
+    }
+}
+/** Read a fetch() body stream through an SseParser until it ends. */
+export async function readSseStream(body, onEvent) {
+    const parser = new SseParser(onEvent);
+    const decoder = new TextDecoder();
+    const reader = body.getReader();
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            parser.push(decoder.decode(value, { stream: true }));
+        }
+        const tail = decoder.decode();
+        if (tail)
+            parser.push(tail);
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+//# sourceMappingURL=sse-parser.js.map

package/dist/transport/sse-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-parser.js","sourceRoot":"","sources":["../../src/transport/sse-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,MAAM,OAAO,SAAS;IAQD;IACA;IARX,MAAM,GAAG,EAAE,CAAC;IACZ,SAAS,GAAG,EAAE,CAAC;IACf,SAAS,GAAa,EAAE,CAAC;IACzB,MAAM,CAAqB;IAC3B,SAAS,GAAG,KAAK,CAAC;IAE1B,YACmB,OAAkC,EAClC,iBAAiB,EAAE,GAAG,IAAI,GAAG,IAAI;QADjC,YAAO,GAAP,OAAO,CAA2B;QAClC,mBAAc,GAAd,cAAc,CAAmB;IACjD,CAAC;IAEJ,IAAI,CAAC,KAAa;QAChB,IAAI,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QAErB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI;gBAAE,SAAS;YACzC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM;oBAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;qBACnD,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,EAAE,CAAC;YAC5C,CAAC;YACD,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,cAAc,aAAa,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,IAAY;QACvB,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,uBAAuB;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAElD,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,OAAO;gBACV,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;gBACvB,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC3B,MAAM;YACR,KAAK,IAAI;gBACP,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;gBAC/C,MAAM;YACR;gBACE,MAAM,CAAC,yCAAyC;QACpD,CAAC;IACH,CAAC;IAEO,QAAQ;QACd,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAa,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChG,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QACtD,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;CACF;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAgC,EAChC,OAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/transport/sse.d.ts

@@ -0,0 +1,39 @@
+/**
+ * SSE channel — the MCP "HTTP with SSE" transport (protocol 2024-11-05).
+ *
+ *  1. `GET <url>` with `Accept: text/event-stream` opens the server→client stream.
+ *  2. The server's first event is `endpoint`; its data is the URL (usually with a
+ *     `sessionId` query) that client→server messages must be POSTed to.
+ *  3. Every JSON-RPC message from the server arrives as a `message` event.
+ *
+ * Reconnection is *not* done here: an SSE session's server-side state dies with
+ * the stream, so the gateway's supervisor re-runs the full MCP handshake
+ * instead (see `gateway/supervisor.ts`).
+ *
+ * Security: the announced endpoint must have the same origin as the SSE URL, so
+ * a malicious server cannot make the gateway POST its configured headers
+ * (often credentials) to another host. Redirects are not followed for POSTs.
+ *
+ * @module transport/sse
+ */
+import type { McpServerConfig } from '../utils/types.js';
+import { type ChannelOptions, type JsonRpcMessage, type UpstreamChannel } from './channel.js';
+export declare class SseChannel implements UpstreamChannel {
+    private readonly config;
+    private readonly options;
+    readonly kind = "sse";
+    onmessage?: (message: JsonRpcMessage) => void;
+    onclose?: (error: Error) => void;
+    private readonly url;
+    private readonly headers;
+    private readonly abort;
+    private endpoint?;
+    private closed;
+    private lost;
+    constructor(config: McpServerConfig, options: ChannelOptions);
+    start(): Promise<void>;
+    private lose;
+    send(message: JsonRpcMessage): Promise<void>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=sse.d.ts.map

package/dist/transport/sse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../../src/transport/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,EAA4B,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAGxH,qBAAa,UAAW,YAAW,eAAe;IAa9C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAb1B,QAAQ,CAAC,IAAI,SAAS;IACtB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC;IAC9C,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAEjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAM;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyB;IAC/C,OAAO,CAAC,QAAQ,CAAC,CAAM;IACvB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,IAAI,CAAS;gBAGF,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,cAAc;IAOpC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA2E5B,OAAO,CAAC,IAAI;IAQN,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAc5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B"}

package/dist/transport/sse.js

@@ -0,0 +1,142 @@
+/**
+ * SSE channel — the MCP "HTTP with SSE" transport (protocol 2024-11-05).
+ *
+ *  1. `GET <url>` with `Accept: text/event-stream` opens the server→client stream.
+ *  2. The server's first event is `endpoint`; its data is the URL (usually with a
+ *     `sessionId` query) that client→server messages must be POSTed to.
+ *  3. Every JSON-RPC message from the server arrives as a `message` event.
+ *
+ * Reconnection is *not* done here: an SSE session's server-side state dies with
+ * the stream, so the gateway's supervisor re-runs the full MCP handshake
+ * instead (see `gateway/supervisor.ts`).
+ *
+ * Security: the announced endpoint must have the same origin as the SSE URL, so
+ * a malicious server cannot make the gateway POST its configured headers
+ * (often credentials) to another host. Redirects are not followed for POSTs.
+ *
+ * @module transport/sse
+ */
+import { logger } from '../utils/logger.js';
+import { errMessage, expandRecord } from './channel.js';
+import { readSseStream } from './sse-parser.js';
+export class SseChannel {
+    config;
+    options;
+    kind = 'sse';
+    onmessage;
+    onclose;
+    url;
+    headers;
+    abort = new AbortController();
+    endpoint;
+    closed = false;
+    lost = false;
+    constructor(config, options) {
+        this.config = config;
+        this.options = options;
+        if (!config.url)
+            throw new Error(`Server "${config.id}" has no url configured`);
+        this.url = new URL(config.url);
+        this.headers = expandRecord(config.headers);
+    }
+    async start() {
+        let timer;
+        let onEndpoint;
+        let onFail;
+        const ready = new Promise((resolve, reject) => {
+            onEndpoint = resolve;
+            onFail = reject;
+            timer = setTimeout(() => reject(new Error(`SSE server did not announce an endpoint within ${this.options.connectTimeoutMs}ms`)), this.options.connectTimeoutMs);
+        });
+        let res;
+        try {
+            res = await fetch(this.url, {
+                method: 'GET',
+                headers: { ...this.headers, Accept: 'text/event-stream', 'Cache-Control': 'no-cache' },
+                signal: this.abort.signal,
+            });
+        }
+        catch (err) {
+            clearTimeout(timer);
+            throw new Error(`SSE connect to ${this.url.origin}${this.url.pathname} failed: ${errMessage(err)}`);
+        }
+        if (!res.ok || !res.body) {
+            clearTimeout(timer);
+            await res.body?.cancel().catch(() => { });
+            throw new Error(`SSE server returned HTTP ${res.status}`);
+        }
+        const contentType = res.headers.get('content-type') ?? '';
+        if (!contentType.includes('text/event-stream')) {
+            clearTimeout(timer);
+            await res.body.cancel().catch(() => { });
+            throw new Error(`SSE server returned unexpected content-type "${contentType}"`);
+        }
+        // Consume the stream in the background for the lifetime of the channel.
+        readSseStream(res.body, (ev) => {
+            if (ev.event === 'endpoint') {
+                try {
+                    const endpoint = new URL(ev.data.trim(), this.url);
+                    if (endpoint.origin !== this.url.origin) {
+                        throw new Error(`endpoint origin ${endpoint.origin} does not match ${this.url.origin}`);
+                    }
+                    this.endpoint = endpoint;
+                    onEndpoint();
+                }
+                catch (err) {
+                    onFail(new Error(`Invalid SSE endpoint event: ${errMessage(err)}`));
+                }
+                return;
+            }
+            if (ev.event !== 'message')
+                return;
+            let parsed;
+            try {
+                parsed = JSON.parse(ev.data);
+            }
+            catch {
+                logger.debug(`[${this.config.id}] ignoring non-JSON SSE message`);
+                return;
+            }
+            if (parsed && typeof parsed === 'object')
+                this.onmessage?.(parsed);
+        }).then(() => this.lose(new Error('SSE stream ended'), onFail), (err) => this.lose(new Error(`SSE stream error: ${errMessage(err)}`), onFail));
+        try {
+            await ready;
+        }
+        catch (err) {
+            this.abort.abort();
+            throw err;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    lose(err, failStart) {
+        failStart(err); // no-op once start() settled
+        if (this.closed || this.lost)
+            return;
+        this.lost = true;
+        this.abort.abort();
+        this.onclose?.(err);
+    }
+    async send(message) {
+        if (this.closed || this.lost || !this.endpoint)
+            throw new Error('SSE channel is not connected');
+        const res = await fetch(this.endpoint, {
+            method: 'POST',
+            headers: { ...this.headers, 'Content-Type': 'application/json' },
+            body: JSON.stringify(message),
+            redirect: 'error',
+            signal: this.abort.signal,
+        });
+        // Body is informational ("Accepted"); drain it so the socket is reused.
+        await res.text().catch(() => '');
+        if (!res.ok)
+            throw new Error(`POST to SSE endpoint returned HTTP ${res.status}`);
+    }
+    async close() {
+        this.closed = true;
+        this.abort.abort();
+    }
+}
+//# sourceMappingURL=sse.js.map

package/dist/transport/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../../src/transport/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAkE,MAAM,cAAc,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,OAAO,UAAU;IAaF;IACA;IAbV,IAAI,GAAG,KAAK,CAAC;IACtB,SAAS,CAAqC;IAC9C,OAAO,CAA0B;IAEhB,GAAG,CAAM;IACT,OAAO,CAAyB;IAChC,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACvC,QAAQ,CAAO;IACf,MAAM,GAAG,KAAK,CAAC;IACf,IAAI,GAAG,KAAK,CAAC;IAErB,YACmB,MAAuB,EACvB,OAAuB;QADvB,WAAM,GAAN,MAAM,CAAiB;QACvB,YAAO,GAAP,OAAO,CAAgB;QAExC,IAAI,CAAC,MAAM,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,KAAiC,CAAC;QACtC,IAAI,UAAuB,CAAC;QAC5B,IAAI,MAA6B,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAClD,UAAU,GAAG,OAAO,CAAC;YACrB,MAAM,GAAG,MAAM,CAAC;YAChB,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kDAAkD,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC,EAC5G,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAC9B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC1B,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,eAAe,EAAE,UAAU,EAAE;gBACtF,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,YAAY,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC/C,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,gDAAgD,WAAW,GAAG,CAAC,CAAC;QAClF,CAAC;QAED,wEAAwE;QACxE,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;YAC7B,IAAI,EAAE,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;wBACxC,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,MAAM,mBAAmB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC1F,CAAC;oBACD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;oBACzB,UAAU,EAAE,CAAC;gBACf,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBACtE,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO;YACnC,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,iCAAiC,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,SAAS,EAAE,CAAC,MAAwB,CAAC,CAAC;QACvF,CAAC,CAAC,CAAC,IAAI,CACL,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,EACtD,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,qBAAqB,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAC9E,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,GAAU,EAAE,SAA6B;QACpD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,6BAA6B;QAC7C,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAuB;QAChC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAChG,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAC7B,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,wEAAwE;QACxE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;CACF"}