brewpage-mcp 1.13.1 → 1.14.0

package/README.md

@@ -17,7 +17,7 @@ Choosing a host? See how BrewPage compares with GitHub Pages, Netlify Drop, Tiin
 ## Quick Start
 
 ```bash
-npx -y brewpage-mcp@1.13.1
+npx -y brewpage-mcp@1.14.0
 ```
 
 Requires Node.js 20 or newer. This starts the stdio server for an MCP client.
@@ -33,7 +33,7 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)
   "mcpServers": {
     "brewpage": {
       "command": "npx",
-      "args": ["-y", "brewpage-mcp@1.13.1"]
+      "args": ["-y", "brewpage-mcp@1.14.0"]
     }
   }
 }
@@ -44,7 +44,7 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)
 Register a project-scoped stdio server:
 
 ```bash
-claude mcp add --transport stdio --scope project brewpage -- npx -y brewpage-mcp@1.13.1
+claude mcp add --transport stdio --scope project brewpage -- npx -y brewpage-mcp@1.14.0
 ```
 
 This writes `.mcp.json` in the project root. Use `--scope user` for user-scoped registration. See the [official Claude Code MCP guide](https://code.claude.com/docs/en/mcp).
@@ -58,7 +58,7 @@ Open **Settings > MCP** and add:
   "mcpServers": {
     "brewpage": {
       "command": "npx",
-      "args": ["-y", "brewpage-mcp@1.13.1"]
+      "args": ["-y", "brewpage-mcp@1.14.0"]
     }
   }
 }
@@ -72,7 +72,7 @@ Open the Cline MCP settings panel and add:
 {
   "brewpage": {
     "command": "npx",
-    "args": ["-y", "brewpage-mcp@1.13.1"]
+    "args": ["-y", "brewpage-mcp@1.14.0"]
   }
 }
 ```
@@ -80,7 +80,7 @@ Open the Cline MCP settings panel and add:
 ### Global Install
 
 ```bash
-npm install -g brewpage-mcp@1.13.1
+npm install -g brewpage-mcp@1.14.0
 brewpage-mcp
 ```
 
@@ -104,14 +104,14 @@ Twenty tools are available. Creation returns an owner token; keep it to modify o
 | `get_kv` | Read a KV value |
 | `update_hosting` | Change eligible delivery mode with owner token and hosting version |
 | `delete_resource` | Delete an HTML page, site, JSON document, KV store or file |
-| `set_visibility` | Hide or show a public publication in gallery & search; link unchanged |
+| `set_visibility` | Hide or show a public publication in the gallery and sitemap; link unchanged |
 | `bind_token` | Add an owner token to your profile (admin token) |
 | `mint_token` | Mint a profile token, shown once (admin token) |
 | `search_gallery` | Browse public content or list owned resources |
 | `get_stats` | Read platform-wide statistics |
 | `get_limits` | Read the current upload limits (`GET /api/limits`) |
 
-All five publish tools accept optional `deliveryMode: "path" | "subdomain"`, sent only as `X-Delivery-Mode`; authored JSON and multipart bodies keep their existing format. Visibility and password protection are separate choices. Omitted namespace still generates an unlisted `priv-<random>` namespace; anyone with an unpassworded unlisted link can read it. `public` grants gallery/search eligibility only; password-protected content remains excluded and unlisted, protected or otherwise ineligible native responses carry `noindex`; eligible public HTML, sites and files may permit indexing.
+All five publish tools accept optional `deliveryMode: "path" | "subdomain"`, sent only as `X-Delivery-Mode`; authored JSON and multipart bodies keep their existing format. Visibility and password protection are separate choices. Omitted namespace is private (a generated `priv-<random>` namespace): unlisted and not indexed; anyone with the link can still open it. `public` lists HTML, sites and files in the gallery and sitemap, so Google, Bing and AI search can find and index them; public pages are served on the brewpage.app domain for the strongest reach (a site always gets its own subdomain). Never put secrets in a public publication. Password-protected publications, JSON and KV are never listed.
 
 The MCP server wraps a subset of the backend-generated public [REST contract](../openapi/openapi.json). TTL inputs take days or a string such as `2w`/`36h` (default 15); the server rounds to whole days and clamps to 1–30 (owner-specific caps and eligible automatic extensions can differ). Use returned `expiresAt`. Every tolerated-input adjustment (TTL clamp, format alias, skipped site member, normalised namespace) comes back in the response `notices` array and is printed as `Notice (code): message`; `secret-detected` and `manage-link-disabled` print as `WARNING (code): message`: relay them to the user. A minted `manageUrl` prints as `MANAGE LINK (private): …`: give it to the user privately, never publish it. A listed public result prints `VISIBILITY: public, listed. Hide: set_visibility listed=false`. `get_page` reads stored rendered HTML or format-specific code/text from the API; it does not call the owner-only original-source endpoint or a browser viewer. `publish_file` uploads from a source URL and does not expose password or TTL inputs.
 
@@ -141,7 +141,7 @@ update_hosting(type="html", namespace="public", id="aBcDeFgHiJ", ownerToken="tok
 
 Publish HTML or Markdown content to BrewPage. Returns a public URL and owner token. Markdown raw HTML is rendered through an allowlist: scripts, styles, event handlers, forms, frames/embeds and `meta`/`base`/`link` are removed; links allow `http`, `https`, `mailto`, `tel` and relative URLs, images also `data:`; a lone unknown tag such as `<author>` shows as text.
 
-Parameters: `content` (string), `format` (default `HTML`; `HTML`, `MARKDOWN` or an alias the server maps, e.g. `md`), `namespace` (optional -- **omit for unlisted content**; pass `public` only for gallery/search eligibility, except when password-protected), `password` (optional), `ttlDays` (days or a string such as `2w`; default 15; the server clamps to 1--30), `filename` (optional, used as title fallback), `showTopBar` (optional boolean -- adds a toolbar with filename, Download button, and theme toggle), `deliveryMode` (optional).
+Parameters: `content` (string), `format` (default `HTML`; `HTML`, `MARKDOWN` or an alias the server maps, e.g. `md`), `namespace` (optional -- **omit for private, unlisted content**; `public` lists the page in the gallery and sitemap for Google, Bing and AI search, served on the brewpage.app domain; never put secrets there), `password` (optional), `ttlDays` (days or a string such as `2w`; default 15; the server clamps to 1--30), `filename` (optional, used as title fallback), `showTopBar` (optional boolean -- adds a toolbar with filename, Download button, and theme toggle), `deliveryMode` (optional).
 
 The result includes `deliveryModeReason` and a `Delivery notice:` line when the server returns them (see above).
 
@@ -197,7 +197,7 @@ get_page(namespace="public", id="aBcDeFgHiJ")
 
 Upload a file to BrewPage by fetching it from a URL. Returns a public URL and owner token. Supports images, PDFs, video, audio, code files, and archives.
 
-Parameters: `url` (string, the source URL to fetch), `namespace` (optional -- omit to keep the file private/unlisted: reachable only by its link, not in the gallery, not search-indexed; pass `public` only for gallery/search eligibility), `filename` (optional custom filename), `deliveryMode` (optional). This tool does not expose base64, password, or TTL inputs.
+Parameters: `url` (string, the source URL to fetch), `namespace` (optional -- omit to keep the file private: unlisted and not indexed, anyone with the link can open it; `public` lists the file in the gallery and sitemap for Google, Bing and AI search), `filename` (optional custom filename), `deliveryMode` (optional). This tool does not expose base64, password, or TTL inputs.
 
 Example prompt:
 
@@ -217,7 +217,7 @@ Publish a single-page or multi-file HTML site. Pass `entryContent` for a single
 
 Limits (current values from `get_limits`): a request is at most 25 MB; a site at most 200 files, 5 MB per file and 20 MB in total; each path at most 380 characters. System files such as `.DS_Store` and `__MACOSX/` are skipped and never count; files with an unsupported extension or a too-long path are skipped and reported in notices. Entry: `entry`, else root `index.html`, else the shallowest HTML file. A site limit hit answers 400 with a message naming the limit; 413 means the request is over 25 MB, has too many files and form fields, or a file name/path is too long; 422 means no servable file is left.
 
-Parameters: exactly one of `entryContent` (string) or non-empty `files` (array of `{path, content}`), `entry` (optional entry file path, default `index.html`), `namespace` (optional -- omit for unlisted content; `public` grants gallery eligibility except when password-protected), `password` (optional), `ttlDays` (days or a string such as `2w`; default 15; the server clamps to 1--30), `ownerToken` (optional, groups site under an existing owner), `deliveryMode` (optional; fresh sites require `subdomain`).
+Parameters: exactly one of `entryContent` (string) or non-empty `files` (array of `{path, content}`), `entry` (optional entry file path, default `index.html`), `namespace` (optional -- omit for private, unlisted content; `public` lists the site in the gallery and sitemap for Google, Bing and AI search; a site always gets its own subdomain), `password` (optional), `ttlDays` (days or a string such as `2w`; default 15; the server clamps to 1--30), `ownerToken` (optional, groups site under an existing owner), `deliveryMode` (optional; fresh sites require `subdomain`).
 
 Example prompt:
 
@@ -247,7 +247,7 @@ republish_site(namespace="public", id="aBcDeFgHiJ", ownerToken="tok_...", files=
 
 Publish a JSON document to BrewPage. Returns a public URL and owner token. The body may be passed as a JSON string or as a structured object.
 
-Parameters: `json` (string, object, or array), `namespace` (optional -- omit for unlisted content; `public` grants gallery/search eligibility, except when password-protected), `password` (optional), `ttlDays` (days or a string such as `2w`; default 15; the server clamps to 1--30), `tags` (optional `string[]`), `ownerToken` (optional existing owner), `deliveryMode` (optional).
+Parameters: `json` (string, object, or array), `namespace` (optional -- omit for private content; `public` is the shared public namespace; JSON is never listed or indexed, anyone with the link can open it), `password` (optional), `ttlDays` (days or a string such as `2w`; default 15; the server clamps to 1--30), `tags` (optional `string[]`), `ownerToken` (optional existing owner), `deliveryMode` (optional).
 
 Example prompt:
 
@@ -297,7 +297,7 @@ update_json(namespace="public", id="aBcDeFgHiJ", json={"mode": "dark", "version"
 
 Create a new KV (key/value) entry. Returns a public URL and owner token. The KV entry is addressed by `(namespace, id, key)`; this tool creates the entry and emits the generated `id` along with the owner token.
 
-Parameters: `key` (string), `value` (string), `namespace` (optional -- omit for unlisted content; `public` grants gallery/search eligibility, except when password-protected), `password` (optional), `ttlDays` (days or a string such as `2w`; default 15; the server clamps to 1--30), `tags` (optional `string[]`), `ownerToken` (optional existing owner), `deliveryMode` (optional).
+Parameters: `key` (string), `value` (string), `namespace` (optional -- omit for private content; `public` is the shared public namespace; KV is never listed or indexed, anyone with the link can open it), `password` (optional), `ttlDays` (days or a string such as `2w`; default 15; the server clamps to 1--30), `tags` (optional `string[]`), `ownerToken` (optional existing owner), `deliveryMode` (optional).
 
 Example prompt:
 
@@ -379,7 +379,7 @@ delete_resource(type="html", namespace="public", id="aBcDeFgHiJ", ownerToken="to
 
 ### `set_visibility`
 
-Hide or show a public publication in gallery & search; the link stays the same. Only public, password-free HTML, sites and files can be listed; others answer with a `visibility-not-listable` notice.
+Hide or show a public publication in the gallery and sitemap; the link stays the same. Only public, password-free HTML, sites and files can be listed; others answer with a `visibility-not-listable` notice.
 
 Parameters: `type` (`html` | `site` | `file` | `json` | `kv`), `namespace`, `id`, `listed` (boolean), `ownerToken` (optional).
 
@@ -443,7 +443,7 @@ get_limits()
 |--------------------|------|-------|
 | "Publish this HTML so I can share it" | `publish_html` | `format=HTML`; save `ownerToken` |
 | "Share these meeting notes as a link" | `publish_html` | `format=MARKDOWN`; readable rendered output |
-| "Host this AI-generated artifact" | `publish_html` | `namespace` optional; **private/unlisted by default**; `public` grants gallery/search eligibility except when protected |
+| "Host this AI-generated artifact" | `publish_html` | `namespace` optional; **private/unlisted by default**; `public` lists it in the gallery and sitemap |
 | "Upload this image / PDF / video" | `publish_file` | Fetches from URL; inline preview on short URL |
 | "Deploy this static site" | `publish_site` | Pass `files` array or `entryContent` |
 | "Replace the site I published" | `republish_site` | Owner token; complete bundle replaces all existing files |
@@ -478,6 +478,24 @@ Every publish response includes an **owner token** -- the only credential that a
 | `BREWPAGE_URL` | `https://brewpage.app` | Authorized apex API base URL; never a publication host |
 | `BREWPAGE_OWNER_TOKEN` | unset | Optional default owner token (32 letters/digits) for every call; unset = new token per create |
 
+## Remote HTTP mode
+
+`node dist/http.js` serves stateless MCP Streamable HTTP for a deployment behind a reverse proxy (BrewPage runs it at `https://brewpage.app/mcp`). Docker: the image default is stdio; run `docker run ... <image> node dist/http.js`.
+
+- `POST /mcp` only, JSON responses, no `Mcp-Session-Id`; `GET`/`DELETE /mcp` -> 405. `GET /healthz` for the container healthcheck.
+- Requests with an `Origin` header -> 403 (no browser access). Only peers in `BREWPAGE_TRUSTED_PROXY_CIDRS` are served (others -> 403); the last `X-Forwarded-For` IP goes to the API with `X-Forwarded-Proto`/`X-Forwarded-Host` of the public origin.
+- `publish_file` downloads only from public addresses (every redirect re-checked, at most 3, 20 MiB).
+- Never reads `BREWPAGE_OWNER_TOKEN`; refuses to start when it is set. Pass `ownerToken` per call.
+- One JSON log line per request on stdout (method, tool, status, outcome, ms); no arguments, tokens or IPs. `SIGTERM` drains for up to 30 s.
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `BREWPAGE_TRUSTED_PROXY_CIDRS` | required | Comma list of reverse-proxy CIDRs or IPs |
+| `BREWPAGE_BACKEND_URL` | `http://brewpage-backend-mcp:8080` | API base URL (internal address) |
+| `BREWPAGE_PUBLIC_ORIGIN` | `https://brewpage.app` | Origin for returned links and forwarded proto/host |
+| `BREWPAGE_MCP_PORT` | `8787` | Listen port |
+| `BREWPAGE_MCP_HOST` | `0.0.0.0` | Listen address |
+
 ## Links
 
 - [brewpage.app](https://brewpage.app) -- Live platform
@@ -491,9 +509,18 @@ Every publish response includes an **owner token** -- the only credential that a
 
 ## Changelog
 
+## 1.14.0 -- 2026-10-26
+
+- Remote mode: `node dist/http.js` serves stateless Streamable HTTP (see [Remote HTTP mode](#remote-http-mode)); stdio is unchanged. `User-Agent: brewpage-mcp/1.14.0` (`(remote)` in HTTP mode).
+
+## 1.13.2 -- 2026-10-25
+
+- `namespace` guidance matches BrewPage 2.1.5: `public` lists HTML, sites and files in the gallery and sitemap for Google, Bing and AI search (pages on the brewpage.app domain, a site on its own subdomain); omitted stays private; JSON and KV are never listed. Private `publish_json`/`publish_kv` results no longer suggest `public` for listing.
+- Old publications (made before 5 October 2026): the 409 hint mentions `republishUrl` only when the server sends it (HTML pages).
+
 ## 1.13.1 -- 2026-10-25
 
-- Old publications (created before the new link format): update tools say they answer `409 OLD_PUBLICATION_READ_ONLY`; that failure adds a hint to publish the content anew and give the user the new URL and owner token.
+- Old publications (made before 5 October 2026): update tools say they answer `409 OLD_PUBLICATION_READ_ONLY`; that failure adds a hint to publish the content anew and give the user the new URL and owner token.
 
 ## 1.13.0 -- 2026-10-25
 

package/dist/http.d.ts

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+export declare function isBlockedSource(address: string): boolean;
+/** SSRF-safe publish_file download: every hop re-checked, at most 3 redirects, one Blob copy. */
+export declare function fetchSourceSafely(url: string, isBlocked?: (address: string) => boolean): Promise<Blob>;

package/dist/http.js

@@ -0,0 +1,438 @@
+#!/usr/bin/env node
+import { createServer as createHttpServer, request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { lookup as dnsLookup } from "node:dns";
+import { BlockList, isIP } from "node:net";
+import { realpathSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { createServer, OWNER_TOKEN_ENV, USER_AGENT } from "./tools.js";
+const MIB = 1024 * 1024;
+/** A 31 MiB tools/call peaked at 375 MiB RSS, 7.9 MiB at 164 MiB; 8 MiB keeps a 320 MiB container safe. */
+const MAX_BODY_BYTES = 8 * MIB;
+const LARGE_BODY_BYTES = 1 * MIB;
+const BODY_TIMEOUT_MS = 10_000;
+const MAX_IN_FLIGHT = 8;
+const MAX_PER_CLIENT = 2;
+/** Heavy = body over 1 MiB or publish_file; each peaks ~100 MiB RSS, two reached 313 MiB, too close to 320 MiB. */
+const MAX_HEAVY_IN_FLIGHT = 1;
+const MAX_SOURCE_BYTES = 20 * MIB;
+const MAX_REDIRECTS = 3;
+const SOURCE_TIMEOUT_MS = 30_000;
+const SOURCE_IDLE_MS = 10_000;
+const DOWNLOADS_PER_WINDOW = 10;
+const DOWNLOAD_WINDOW_MS = 10 * 60_000;
+const MAX_TRACKED_CLIENTS = 10_000;
+const DIAL_RETRY_MS = 30_000;
+const DIAL_RETRY_PAUSE_MS = 500;
+const DRAIN_MS = 30_000;
+const MAX_LOGGED_METHOD = 64;
+const VERSION = USER_AGENT.split("/")[1];
+const REMOTE_USER_AGENT = `${USER_AGENT} (remote)`;
+const PARSE_ERROR = -32700;
+const INVALID_REQUEST = -32600;
+const SERVER_ERROR = -32000;
+/** One JSON line per event on stdout; callers never pass arguments, tokens or IPs. */
+function log(fields) {
+    process.stdout.write(`${JSON.stringify({ ts: new Date().toISOString(), ...fields })}\n`);
+}
+function fail(message) {
+    process.stderr.write(`${JSON.stringify({ ts: new Date().toISOString(), event: "startup_failed", message })}\n`);
+    process.exit(1);
+}
+/** Comma list of CIDRs or bare IPs; empty entries skipped, any invalid entry is fatal. */
+function parseCidrs(raw) {
+    const list = new BlockList();
+    const entries = (raw ?? "").split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+    if (entries.length === 0)
+        fail("BREWPAGE_TRUSTED_PROXY_CIDRS is required: comma list of proxy CIDRs.");
+    for (const entry of entries) {
+        const [address, prefixText] = entry.split("/");
+        const family = isIP(address);
+        const prefix = prefixText === undefined ? (family === 6 ? 128 : 32) : Number(prefixText);
+        const maxPrefix = family === 6 ? 128 : 32;
+        if (family === 0 || !Number.isInteger(prefix) || prefix < 0 || prefix > maxPrefix) {
+            fail(`BREWPAGE_TRUSTED_PROXY_CIDRS: invalid entry ${JSON.stringify(entry)}.`);
+        }
+        list.addSubnet(address, prefix, family === 6 ? "ipv6" : "ipv4");
+    }
+    return list;
+}
+function loadConfig() {
+    if (process.env[OWNER_TOKEN_ENV] !== undefined)
+        fail(`${OWNER_TOKEN_ENV} must not be set in HTTP mode.`);
+    const backendUrl = (process.env.BREWPAGE_BACKEND_URL || "http://brewpage-backend-mcp:8080").replace(/\/+$/, "");
+    const publicOrigin = new URL(process.env.BREWPAGE_PUBLIC_ORIGIN || "https://brewpage.app");
+    const port = Number(process.env.BREWPAGE_MCP_PORT || "8787");
+    if (!Number.isInteger(port) || port < 0 || port > 65535)
+        fail("BREWPAGE_MCP_PORT must be a TCP port.");
+    return {
+        backendUrl,
+        publicOrigin: publicOrigin.origin,
+        forwardedProto: publicOrigin.protocol.replace(/:$/, ""),
+        forwardedHost: publicOrigin.host,
+        trustedProxies: parseCidrs(process.env.BREWPAGE_TRUSTED_PROXY_CIDRS),
+        host: process.env.BREWPAGE_MCP_HOST || "0.0.0.0",
+        port,
+    };
+}
+/** Never-fetch ranges: private, loopback, link-local, CGNAT, ULA, multicast, reserved, SIIT/NAT64/6to4/Teredo.
+ * BlockList matches v4-mapped IPv6 against the v4 rules, so ::ffff:0:0/96 must not be listed (it would block all IPv4). */
+const BLOCKED_SOURCES = new BlockList();
+for (const [network, prefix] of [
+    ["0.0.0.0", 8], ["10.0.0.0", 8], ["100.64.0.0", 10], ["127.0.0.0", 8], ["169.254.0.0", 16], ["172.16.0.0", 12],
+    ["192.0.0.0", 24], ["192.0.2.0", 24], ["192.88.99.0", 24], ["192.168.0.0", 16], ["198.18.0.0", 15],
+    ["198.51.100.0", 24], ["203.0.113.0", 24], ["224.0.0.0", 4], ["240.0.0.0", 4],
+])
+    BLOCKED_SOURCES.addSubnet(network, prefix, "ipv4");
+for (const [network, prefix] of [
+    ["::", 96], ["::ffff:0:0:0", 96], ["64:ff9b::", 96], ["64:ff9b:1::", 48], ["100::", 64], ["2001::", 32],
+    ["2001:db8::", 32], ["2002::", 16], ["fc00::", 7], ["fe80::", 10], ["fec0::", 10], ["ff00::", 8],
+])
+    BLOCKED_SOURCES.addSubnet(network, prefix, "ipv6");
+export function isBlockedSource(address) {
+    const bare = address.replace(/^\[|\]$/g, "").split("%")[0];
+    const family = isIP(bare);
+    if (family === 0)
+        return true;
+    return BLOCKED_SOURCES.check(bare, family === 6 ? "ipv6" : "ipv4");
+}
+const SOURCE_REFUSED = "Source URL refused: private or reserved address.";
+const SOURCE_TOO_LARGE = "Source file over 20 MiB.";
+/** DNS lookup that fails when any resolved address is blocked; runs on every connection. */
+function guardedLookup(isBlocked) {
+    return (hostname, options, callback) => {
+        dnsLookup(hostname, { ...options, all: true }, (error, addresses) => {
+            if (error)
+                return callback(error, "");
+            if (addresses.length === 0 || addresses.some(({ address }) => isBlocked(address)))
+                return callback(new Error(SOURCE_REFUSED), "");
+            if (options.all)
+                return callback(null, addresses);
+            callback(null, addresses[0].address, addresses[0].family);
+        });
+    };
+}
+/** One HTTP(S) hop: literal and resolved addresses checked, non-2xx rejected, body capped; never throws outside the promise. */
+function sourceHop(url, signal, isBlocked) {
+    return new Promise((resolve, reject) => {
+        if (url.protocol !== "http:" && url.protocol !== "https:")
+            return reject(new Error("Source URL refused: only http and https."));
+        const host = url.hostname.replace(/^\[|\]$/g, "");
+        if (isIP(host) !== 0 && isBlocked(host))
+            return reject(new Error(SOURCE_REFUSED));
+        let settled = false;
+        const settle = (action) => {
+            if (settled)
+                return;
+            settled = true;
+            action();
+        };
+        const send = url.protocol === "https:" ? httpsRequest : httpRequest;
+        const req = send(url, { method: "GET", agent: false, lookup: guardedLookup(isBlocked), signal, headers: { "User-Agent": REMOTE_USER_AGENT } }, (res) => {
+            const status = res.statusCode ?? 0;
+            const location = res.headers.location;
+            if ([301, 302, 303, 307, 308].includes(status) && location) {
+                res.resume();
+                return settle(() => resolve({ location }));
+            }
+            if (status < 200 || status > 299) {
+                res.destroy();
+                return settle(() => reject(new Error(`Failed to fetch file from URL: ${status}`)));
+            }
+            const tooLarge = () => {
+                res.destroy();
+                settle(() => reject(new Error(SOURCE_TOO_LARGE)));
+            };
+            if (Number(res.headers["content-length"] ?? 0) > MAX_SOURCE_BYTES)
+                return tooLarge();
+            const chunks = [];
+            let size = 0;
+            res.on("data", (chunk) => {
+                size += chunk.length;
+                if (size > MAX_SOURCE_BYTES)
+                    return tooLarge();
+                if (!settled)
+                    chunks.push(chunk);
+            });
+            res.on("error", (error) => settle(() => reject(error)));
+            res.on("end", () => {
+                const contentType = res.headers["content-type"] ?? "";
+                const type = /^[\x20-\x7e]{1,200}$/.test(contentType) ? contentType : "";
+                settle(() => resolve({ blob: new Blob(chunks, { type }) }));
+            });
+        });
+        req.setTimeout(SOURCE_IDLE_MS, () => req.destroy(new Error("Source download timed out.")));
+        req.on("error", (error) => settle(() => reject(error)));
+        req.end();
+    });
+}
+/** SSRF-safe publish_file download: every hop re-checked, at most 3 redirects, one Blob copy. */
+export async function fetchSourceSafely(url, isBlocked = isBlockedSource) {
+    const signal = AbortSignal.timeout(SOURCE_TIMEOUT_MS);
+    let current = new URL(url);
+    for (let hop = 0;; hop++) {
+        const answer = await sourceHop(current, signal, isBlocked);
+        if ("blob" in answer)
+            return answer.blob;
+        if (hop >= MAX_REDIRECTS)
+            throw new Error("Source URL refused: more than 3 redirects.");
+        current = new URL(answer.location, current);
+    }
+}
+/** Fixed-window download budget per client IP; map size bounded by pruning, then clearing. */
+const downloadWindows = new Map();
+function takeDownload(client, now = Date.now()) {
+    let window = downloadWindows.get(client);
+    if (window === undefined || now - window.start >= DOWNLOAD_WINDOW_MS) {
+        if (window === undefined && downloadWindows.size >= MAX_TRACKED_CLIENTS) {
+            for (const [key, value] of downloadWindows)
+                if (now - value.start >= DOWNLOAD_WINDOW_MS)
+                    downloadWindows.delete(key);
+            if (downloadWindows.size >= MAX_TRACKED_CLIENTS)
+                downloadWindows.clear();
+        }
+        window = { start: now, count: 0 };
+        downloadWindows.set(client, window);
+    }
+    if (window.count >= DOWNLOADS_PER_WINDOW)
+        return false;
+    window.count++;
+    return true;
+}
+const DIAL_CODES = new Set(["ECONNREFUSED", "ENOTFOUND", "EAI_AGAIN", "EHOSTUNREACH", "ENETUNREACH"]);
+function isDialFailure(error) {
+    const cause = error?.cause;
+    return DIAL_CODES.has(cause?.code ?? "") || (cause?.errors ?? []).some(({ code }) => DIAL_CODES.has(code ?? ""));
+}
+/** Backend calls retry only connect failures (request never sent) for 30 s, e.g. during a backend restart. */
+const backendFetch = async (input, init) => {
+    const deadline = Date.now() + DIAL_RETRY_MS;
+    for (;;) {
+        try {
+            return await fetch(input, init);
+        }
+        catch (error) {
+            if (!isDialFailure(error) || Date.now() >= deadline)
+                throw error;
+            await new Promise((resolve) => setTimeout(resolve, DIAL_RETRY_PAUSE_MS));
+        }
+    }
+};
+function peerAddress(req) {
+    const raw = req.socket.remoteAddress ?? "";
+    const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(raw);
+    return mapped ? mapped[1] : raw;
+}
+/** Last XFF entry (the proxy replaces the header); only an IP literal is accepted. */
+function clientAddress(req) {
+    const last = (req.headers["x-forwarded-for"] ?? "").toString().split(",").at(-1)?.trim() ?? "";
+    return isIP(last) !== 0 ? last : undefined;
+}
+function rpcError(res, status, code, message, headers = {}) {
+    res.writeHead(status, { "Content-Type": "application/json", ...headers });
+    res.end(JSON.stringify({ jsonrpc: "2.0", error: { code, message }, id: null }));
+}
+/** Reads at most `limit` bytes within `timeoutMs`; never rejects. */
+function readBody(req, limit, timeoutMs) {
+    return new Promise((resolve) => {
+        const chunks = [];
+        let size = 0;
+        let done = false;
+        const finish = (value) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            resolve(value);
+        };
+        const timer = setTimeout(() => finish("timeout"), timeoutMs);
+        req.on("data", (chunk) => {
+            size += chunk.length;
+            if (size > limit)
+                return finish("too_large");
+            if (!done)
+                chunks.push(chunk);
+        });
+        req.on("end", () => finish(Buffer.concat(chunks)));
+        req.on("error", () => finish("aborted"));
+        req.on("close", () => finish("aborted"));
+    });
+}
+/** Tool names from an in-memory handshake; logs name only these. */
+async function registeredToolNames() {
+    const [clientSide, serverSide] = InMemoryTransport.createLinkedPair();
+    const server = createServer({ baseUrl: "http://127.0.0.1:9" });
+    const client = new Client({ name: "startup", version: VERSION });
+    await server.connect(serverSide);
+    await client.connect(clientSide);
+    const { tools } = await client.listTools();
+    await client.close();
+    await server.close();
+    return new Set(tools.map(({ name }) => name));
+}
+async function main() {
+    const config = loadConfig();
+    const toolNames = await registeredToolNames();
+    const perClient = new Map();
+    let inFlight = 0;
+    let heavyInFlight = 0;
+    let draining = false;
+    async function handleMcp(req, res, entry) {
+        if (req.headers.origin !== undefined)
+            return rpcError(res, 403, SERVER_ERROR, "Origin not allowed.");
+        const peer = peerAddress(req);
+        if (isIP(peer) === 0 || !config.trustedProxies.check(peer, isIP(peer) === 6 ? "ipv6" : "ipv4")) {
+            return rpcError(res, 403, SERVER_ERROR, "Forbidden.");
+        }
+        if (req.method !== "POST")
+            return rpcError(res, 405, SERVER_ERROR, "Method not allowed.", { Allow: "POST" });
+        const client = clientAddress(req);
+        if (client === undefined)
+            return rpcError(res, 400, SERVER_ERROR, "Missing client address.");
+        if (draining)
+            return rpcError(res, 503, SERVER_ERROR, "Shutting down.", { "Retry-After": "5" });
+        const declared = Number(req.headers["content-length"]);
+        if (declared > MAX_BODY_BYTES)
+            return rpcError(res, 413, SERVER_ERROR, "Request body over 8 MiB.");
+        const busy = () => rpcError(res, 503, SERVER_ERROR, "Busy, retry shortly.", { "Retry-After": "1" });
+        let heavy = !(Number.isFinite(declared) && declared <= LARGE_BODY_BYTES);
+        if (inFlight >= MAX_IN_FLIGHT || (perClient.get(client) ?? 0) >= MAX_PER_CLIENT || (heavy && heavyInFlight >= MAX_HEAVY_IN_FLIGHT)) {
+            return busy();
+        }
+        inFlight++;
+        perClient.set(client, (perClient.get(client) ?? 0) + 1);
+        if (heavy)
+            heavyInFlight++;
+        res.once("close", () => {
+            inFlight--;
+            const left = (perClient.get(client) ?? 1) - 1;
+            if (left > 0)
+                perClient.set(client, left);
+            else
+                perClient.delete(client);
+            if (heavy)
+                heavyInFlight--;
+        });
+        const body = await readBody(req, MAX_BODY_BYTES, BODY_TIMEOUT_MS);
+        if (!(body instanceof Buffer)) {
+            if (body === "aborted")
+                return;
+            res.once("finish", () => req.socket.destroy());
+            return body === "timeout"
+                ? rpcError(res, 408, SERVER_ERROR, "Request body too slow.", { Connection: "close" })
+                : rpcError(res, 413, SERVER_ERROR, "Request body over 8 MiB.", { Connection: "close" });
+        }
+        let message;
+        try {
+            message = JSON.parse(body.toString("utf8"));
+        }
+        catch {
+            return rpcError(res, 400, PARSE_ERROR, "Parse error.");
+        }
+        if (Array.isArray(message))
+            return rpcError(res, 400, INVALID_REQUEST, "Batch requests are not supported.");
+        if (message === null || typeof message !== "object")
+            return rpcError(res, 400, INVALID_REQUEST, "Invalid Request.");
+        const rpc = message;
+        const toolName = rpc.method === "tools/call" ? rpc.params?.name : undefined;
+        entry.method = typeof rpc.method === "string" ? rpc.method.slice(0, MAX_LOGGED_METHOD) : null;
+        entry.tool = rpc.method === "tools/call" ? (typeof toolName === "string" && toolNames.has(toolName) ? toolName : "unknown") : null;
+        if (toolName === "publish_file" && !heavy) {
+            if (heavyInFlight >= MAX_HEAVY_IN_FLIGHT)
+                return busy();
+            heavy = true;
+            heavyInFlight++;
+        }
+        const server = createServer({
+            baseUrl: config.backendUrl,
+            publicOrigin: config.publicOrigin,
+            userAgent: REMOTE_USER_AGENT,
+            headers: { "X-Forwarded-For": client, "X-Forwarded-Proto": config.forwardedProto, "X-Forwarded-Host": config.forwardedHost },
+            fetchSource: (url) => takeDownload(client)
+                ? fetchSourceSafely(url)
+                : Promise.reject(new Error("Download limit reached for this address; try again in a few minutes.")),
+            fetch: backendFetch,
+        });
+        const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
+        const send = transport.send.bind(transport);
+        transport.send = (outgoing, options) => {
+            if ("error" in outgoing)
+                entry.outcome = "rpc_error";
+            else if ("result" in outgoing && outgoing.result.isError === true)
+                entry.outcome = "tool_error";
+            return send(outgoing, options);
+        };
+        res.once("close", () => {
+            void transport.close();
+            void server.close();
+        });
+        await server.connect(transport);
+        await transport.handleRequest(req, res, message);
+    }
+    function handle(req, res, entry) {
+        const path = (req.url ?? "/").split("?")[0];
+        if (path === "/healthz") {
+            res.writeHead(draining ? 503 : 200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ status: draining ? "draining" : "ok", version: VERSION }));
+            return;
+        }
+        if (path !== "/mcp")
+            return rpcError(res, 404, SERVER_ERROR, "Not found.");
+        handleMcp(req, res, entry).catch((error) => {
+            entry.outcome = "exception";
+            log({ event: "request_failed", message: error instanceof Error ? error.message : String(error) });
+            if (!res.headersSent)
+                rpcError(res, 500, SERVER_ERROR, "Internal error.");
+            else
+                res.end();
+        });
+    }
+    const httpServer = createHttpServer((req, res) => {
+        const started = performance.now();
+        const entry = { http: req.method ?? "", method: null, tool: null, status: 0, outcome: null, ms: 0 };
+        const logged = !(req.url ?? "").startsWith("/healthz");
+        res.once("close", () => {
+            if (!logged)
+                return;
+            entry.status = res.statusCode;
+            entry.outcome ??= res.statusCode < 400 ? "ok" : `http_${res.statusCode}`;
+            entry.ms = Math.round(performance.now() - started);
+            log(entry);
+        });
+        try {
+            handle(req, res, entry);
+        }
+        catch (error) {
+            entry.outcome = "exception";
+            log({ event: "request_failed", message: error instanceof Error ? error.message : String(error) });
+            if (!res.headersSent)
+                rpcError(res, 500, SERVER_ERROR, "Internal error.");
+        }
+    });
+    httpServer.requestTimeout = 120_000;
+    const shutdown = () => {
+        if (draining)
+            return;
+        draining = true;
+        log({ event: "draining", inFlight });
+        httpServer.close(() => process.exit(0));
+        httpServer.closeIdleConnections();
+        setTimeout(() => {
+            httpServer.closeAllConnections();
+            process.exit(0);
+        }, DRAIN_MS).unref();
+    };
+    process.on("SIGTERM", shutdown);
+    process.on("SIGINT", shutdown);
+    httpServer.listen(config.port, config.host, () => {
+        const address = httpServer.address();
+        log({ event: "listening", port: typeof address === "object" && address !== null ? address.port : config.port, version: VERSION });
+    });
+}
+/** Runs only as the entry script; tests import the address guard and the source fetcher. */
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
+    main().catch((error) => fail(error instanceof Error ? error.message : String(error)));
+}