@wirecat/cli-template 0.8.0 → 0.10.0

package/dist/bundle/chunk-FWVKHD2L.js

@@ -0,0 +1,48 @@
+import { createRequire as __bundleRequire } from "node:module";
+const require = __bundleRequire(import.meta.url);
+import {
+  CliError
+} from "./chunk-EFHLQXG6.js";
+import {
+  __name
+} from "./chunk-ZVVMGPBJ.js";
+
+// node_modules/.pnpm/@wirecat+cli-core@0.469.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_9d12b0091b773232c527328da5835651/node_modules/@wirecat/cli-core/dist/http/public-url.js
+var EXAMPLE = "--public-url https://<name>.ts.net";
+var publicUrlOf = /* @__PURE__ */ __name((given, { missing, reaches, path = false }) => {
+  if (!given)
+    throw new CliError("configuration_error", `${missing} needs the tunnel's address: ${EXAMPLE}`);
+  let url;
+  try {
+    url = new URL(given);
+  } catch {
+    throw new CliError("validation_error", `--public-url is not an address: ${EXAMPLE}`);
+  }
+  if (url.username || url.password)
+    throw new CliError("validation_error", "--public-url must not contain login credentials");
+  const local = url.protocol === "http:" && ["localhost", "127.0.0.1"].includes(url.hostname);
+  if (url.protocol !== "https:" && !local)
+    throw new CliError("validation_error", `--public-url must be https \u2014 ${reaches} through it`);
+  if (url.search || url.hash || !path && url.pathname !== "/")
+    throw new CliError("validation_error", path ? `--public-url is the tunnel's address, or a path of it, without a query: ${EXAMPLE}/tg` : `--public-url is the tunnel's address only, without a path: ${EXAMPLE}`);
+  if (path && !/^(\/[A-Za-z0-9_-][A-Za-z0-9._-]*)*\/?$/.test(url.pathname))
+    throw new CliError("validation_error", "--public-url's path takes letters, digits, dot, dash and underscore: /tg");
+  if (path)
+    url.pathname = url.pathname.replace(/\/+$/, "") || "/";
+  return url;
+}, "publicUrlOf");
+var portOf = /* @__PURE__ */ __name((given, fallback) => {
+  if (given === void 0)
+    return fallback;
+  const port = Number(given);
+  if (!Number.isInteger(port) || port < 1 || port > 65535)
+    throw new CliError("validation_error", "--port takes 1\u201365535");
+  return port;
+}, "portOf");
+var mcpUrlOf = /* @__PURE__ */ __name((publicUrl) => new URL(`${publicUrl.pathname.replace(/\/+$/, "")}/mcp`, publicUrl.origin), "mcpUrlOf");
+
+export {
+  publicUrlOf,
+  portOf,
+  mcpUrlOf
+};

package/dist/bundle/chunk-FXS3X76A.js

@@ -0,0 +1,193 @@
+import { createRequire as __bundleRequire } from "node:module";
+const require = __bundleRequire(import.meta.url);
+import {
+  listen
+} from "./chunk-MNSD5BX2.js";
+import {
+  ownerLogin
+} from "./chunk-ASMH7JWZ.js";
+import {
+  WebStandardStreamableHTTPServerTransport,
+  createMcpHandler,
+  getOAuthProtectedResourceMetadataUrl,
+  hostHeaderValidationResponse,
+  isLegacyRequest,
+  oauthMetadataResponse,
+  requireBearerAuth
+} from "./chunk-5D4AEUVA.js";
+import {
+  activityRecorder,
+  calledTools,
+  httpActivityFile,
+  httpLock
+} from "./chunk-222FANS2.js";
+import {
+  CliError
+} from "./chunk-EFHLQXG6.js";
+import {
+  __name
+} from "./chunk-ZVVMGPBJ.js";
+
+// node_modules/.pnpm/@wirecat+cli-core@0.469.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_9d12b0091b773232c527328da5835651/node_modules/@wirecat/cli-core/dist/mcp/http/serve.js
+import { randomUUID } from "node:crypto";
+var MCP_PATH = "/mcp";
+var AS_METADATA = "/.well-known/oauth-authorization-server";
+var LOCAL = ["localhost", "127.0.0.1"];
+var MAX_SESSIONS = 20;
+var MAX_LOGIN_BODY = 64 * 1024;
+var SESSION_IDLE_MS = 60 * 60 * 1e3;
+var sessionMissing = /* @__PURE__ */ __name(() => new Response(JSON.stringify({ jsonrpc: "2.0", error: { code: -32001, message: "Session not found" }, id: null }), {
+  status: 404,
+  headers: { "content-type": "application/json" }
+}), "sessionMissing");
+var legacySessions = /* @__PURE__ */ __name((build, now) => {
+  const sessions = /* @__PURE__ */ new Map();
+  const drop = /* @__PURE__ */ __name(async (id) => {
+    const one = sessions.get(id);
+    sessions.delete(id);
+    await one?.close();
+  }, "drop");
+  const handle = /* @__PURE__ */ __name(async (request, auth) => {
+    for (const [id2, one] of sessions)
+      if (now() - one.seen > SESSION_IDLE_MS)
+        await drop(id2);
+    const id = request.headers.get("mcp-session-id");
+    if (id) {
+      const known = sessions.get(id);
+      if (!known || known.clientId !== auth.clientId)
+        return sessionMissing();
+      known.seen = now();
+      return known.transport.handleRequest(request, { authInfo: auth });
+    }
+    const server = build();
+    const transport = new WebStandardStreamableHTTPServerTransport({
+      sessionIdGenerator: /* @__PURE__ */ __name(() => randomUUID(), "sessionIdGenerator"),
+      onsessionclosed: /* @__PURE__ */ __name((closed) => void sessions.delete(closed), "onsessionclosed")
+    });
+    await server.connect(transport);
+    const response = await transport.handleRequest(request, { authInfo: auth });
+    if (!transport.sessionId) {
+      await server.close();
+      return response;
+    }
+    sessions.set(transport.sessionId, { transport, close: /* @__PURE__ */ __name(() => server.close(), "close"), clientId: auth.clientId, seen: now() });
+    while (sessions.size > MAX_SESSIONS)
+      await drop(sessions.keys().next().value);
+    return response;
+  }, "handle");
+  return {
+    handle,
+    close: /* @__PURE__ */ __name(async () => {
+      for (const id of [...sessions.keys()])
+        await drop(id);
+    }, "close")
+  };
+}, "legacySessions");
+var metadataRequest = /* @__PURE__ */ __name((request, path, base) => {
+  const url = new URL(request.url);
+  const inserted = base && path === `${AS_METADATA}${base}`;
+  if (!inserted && url.pathname === path)
+    return request;
+  url.pathname = inserted ? AS_METADATA : path;
+  return new Request(url, { method: request.method, headers: request.headers });
+}, "metadataRequest");
+var toolsIn = /* @__PURE__ */ __name(async (request) => {
+  if (request.method !== "POST")
+    return [];
+  try {
+    return calledTools(await request.clone().json());
+  } catch {
+    return [];
+  }
+}, "toolsIn");
+var serveOverHttp = /* @__PURE__ */ __name(async (build, options) => {
+  const { publicUrl, port, tokenFile, appName, onCode, onError, now, lockFile, version } = options;
+  const lock = lockFile ? httpLock(lockFile, {
+    pid: process.pid,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    port,
+    publicUrl: publicUrl.href,
+    ...version ? { version } : {}
+  }) : void 0;
+  if (lock?.held)
+    throw new CliError("validation_error", `${appName} already serves MCP over HTTP for this profile on port ${lock.held.port} (PID ${lock.held.pid}, since ${lock.held.startedAt})`);
+  const base = publicUrl.pathname === "/" ? "" : publicUrl.pathname.replace(/\/+$/, "");
+  const issuer = new URL(`${publicUrl.origin}${base}`);
+  const resource = new URL(`${base}${MCP_PATH}`, publicUrl.origin);
+  const mcpPath = resource.pathname;
+  const publicPath = /* @__PURE__ */ __name((path) => base && path !== base && !path.startsWith(`${base}/`) && !path.startsWith("/.well-known/") ? `${base}${path}` : path, "publicPath");
+  const login = ownerLogin({
+    issuer,
+    resource,
+    file: tokenFile,
+    appName,
+    onCode: /* @__PURE__ */ __name((code, expires) => {
+      lock?.update({ loginCode: code, loginCodeExpiresAt: expires.toISOString() });
+      onCode(code, expires);
+    }, "onCode"),
+    ...now ? { now } : {}
+  });
+  const insecure = issuer.protocol === "http:" && LOCAL.includes(issuer.hostname);
+  const mcp = createMcpHandler(build, { legacy: "reject", ...onError ? { onerror: onError } : {} });
+  const legacy = legacySessions(build, now ?? Date.now);
+  const bearer = requireBearerAuth({
+    verifier: login.verifier,
+    resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(resource)
+  });
+  const activity = activityRecorder(httpActivityFile(tokenFile), now);
+  const allowedHosts = [.../* @__PURE__ */ new Set([publicUrl.hostname, ...LOCAL])];
+  const allowedOrigins = [publicUrl.origin];
+  const listening = await listen(async (request) => {
+    const refused = hostHeaderValidationResponse(request, allowedHosts);
+    if (refused)
+      return refused;
+    const path = publicPath(new URL(request.url).pathname);
+    const discovery = oauthMetadataResponse(metadataRequest(request, path, base), {
+      oauthMetadata: login.metadata,
+      resourceServerUrl: resource,
+      resourceName: appName,
+      ...insecure ? { dangerouslyAllowInsecureIssuerUrl: true } : {}
+    });
+    if (discovery)
+      return discovery;
+    if (Number(request.headers.get("content-length") ?? 0) > MAX_LOGIN_BODY && path !== mcpPath)
+      return new Response("Request too large", { status: 413 });
+    const origin = request.headers.get("origin");
+    if (origin && !allowedOrigins.includes(origin))
+      return new Response("Origin not allowed", { status: 403 });
+    const answered = await login.handle(request, path);
+    if (answered)
+      return answered;
+    if (path !== mcpPath)
+      return new Response("Not found", { status: 404 });
+    const auth = await bearer(request);
+    if (auth instanceof Response)
+      return auth;
+    activity.record(auth.clientId, await toolsIn(request));
+    return await isLegacyRequest(request) ? legacy.handle(request, auth) : mcp.fetch(request, { authInfo: auth });
+  }, { host: "127.0.0.1", port }).catch((error) => {
+    login.close();
+    lock?.release();
+    throw error;
+  });
+  lock?.update({ listeningAt: (/* @__PURE__ */ new Date()).toISOString() });
+  return {
+    url: listening.url,
+    close: /* @__PURE__ */ __name(async () => {
+      login.close();
+      activity.flush();
+      try {
+        await listening.close();
+        await legacy.close();
+        await mcp.close();
+      } finally {
+        lock?.release();
+      }
+    }, "close")
+  };
+}, "serveOverHttp");
+
+export {
+  MCP_PATH,
+  serveOverHttp
+};