cdk-serverless 3.2.1 → 3.3.1

package/lib/mcp-auth/mcp/errors.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpProtocolError = exports.McpUnauthorizedError = void 0;
+class McpUnauthorizedError extends Error {
+    constructor(challenge, message = 'Unauthorized') {
+        super(message);
+        this.name = 'McpUnauthorizedError';
+        this.challenge = challenge;
+    }
+}
+exports.McpUnauthorizedError = McpUnauthorizedError;
+class McpProtocolError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.name = 'McpProtocolError';
+        this.code = code;
+    }
+}
+exports.McpProtocolError = McpProtocolError;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3JzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL21jcC1hdXRoL21jcC9lcnJvcnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsTUFBYSxvQkFBcUIsU0FBUSxLQUFLO0lBRTdDLFlBQVksU0FBaUIsRUFBRSxPQUFPLEdBQUcsY0FBYztRQUNyRCxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDZixJQUFJLENBQUMsSUFBSSxHQUFHLHNCQUFzQixDQUFDO1FBQ25DLElBQUksQ0FBQyxTQUFTLEdBQUcsU0FBUyxDQUFDO0lBQzdCLENBQUM7Q0FDRjtBQVBELG9EQU9DO0FBRUQsTUFBYSxnQkFBaUIsU0FBUSxLQUFLO0lBRXpDLFlBQVksSUFBWSxFQUFFLE9BQWU7UUFDdkMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2YsSUFBSSxDQUFDLElBQUksR0FBRyxrQkFBa0IsQ0FBQztRQUMvQixJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQztJQUNuQixDQUFDO0NBQ0Y7QUFQRCw0Q0FPQyIsInNvdXJjZXNDb250ZW50IjpbImV4cG9ydCBjbGFzcyBNY3BVbmF1dGhvcml6ZWRFcnJvciBleHRlbmRzIEVycm9yIHtcbiAgcHVibGljIHJlYWRvbmx5IGNoYWxsZW5nZTogc3RyaW5nO1xuICBjb25zdHJ1Y3RvcihjaGFsbGVuZ2U6IHN0cmluZywgbWVzc2FnZSA9ICdVbmF1dGhvcml6ZWQnKSB7XG4gICAgc3VwZXIobWVzc2FnZSk7XG4gICAgdGhpcy5uYW1lID0gJ01jcFVuYXV0aG9yaXplZEVycm9yJztcbiAgICB0aGlzLmNoYWxsZW5nZSA9IGNoYWxsZW5nZTtcbiAgfVxufVxuXG5leHBvcnQgY2xhc3MgTWNwUHJvdG9jb2xFcnJvciBleHRlbmRzIEVycm9yIHtcbiAgcHVibGljIHJlYWRvbmx5IGNvZGU6IG51bWJlcjtcbiAgY29uc3RydWN0b3IoY29kZTogbnVtYmVyLCBtZXNzYWdlOiBzdHJpbmcpIHtcbiAgICBzdXBlcihtZXNzYWdlKTtcbiAgICB0aGlzLm5hbWUgPSAnTWNwUHJvdG9jb2xFcnJvcic7XG4gICAgdGhpcy5jb2RlID0gY29kZTtcbiAgfVxufVxuIl19

package/lib/mcp-auth/mcp/index.d.ts

@@ -0,0 +1,4 @@
+export * from './errors';
+export * from './jsonrpc';
+export * from './server';
+export * from './types';

package/lib/mcp-auth/mcp/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./errors"), exports);
+__exportStar(require("./jsonrpc"), exports);
+__exportStar(require("./server"), exports);
+__exportStar(require("./types"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbWNwLWF1dGgvbWNwL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSwyQ0FBeUI7QUFDekIsNENBQTBCO0FBQzFCLDJDQUF5QjtBQUN6QiwwQ0FBd0IiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgKiBmcm9tICcuL2Vycm9ycyc7XG5leHBvcnQgKiBmcm9tICcuL2pzb25ycGMnO1xuZXhwb3J0ICogZnJvbSAnLi9zZXJ2ZXInO1xuZXhwb3J0ICogZnJvbSAnLi90eXBlcyc7XG4iXX0=

package/lib/mcp-auth/mcp/jsonrpc.d.ts

@@ -0,0 +1,21 @@
+/** Standard JSON-RPC error codes. */
+export declare const PARSE_ERROR = -32700;
+export declare const INVALID_REQUEST = -32600;
+export declare const METHOD_NOT_FOUND = -32601;
+export declare const INVALID_PARAMS = -32602;
+export declare const INTERNAL_ERROR = -32603;
+export interface JsonRpcRequest {
+    jsonrpc: '2.0';
+    id?: unknown;
+    method: string;
+    params?: unknown;
+}
+/**
+ * Validate and parse a JSON-RPC request from a raw body value.
+ * Throws McpProtocolError if the body is malformed.
+ */
+export declare function parseJsonRpcRequest(body: unknown): JsonRpcRequest;
+/** Build a JSON-RPC success response object. */
+export declare function jsonRpcSuccess(id: unknown, result: unknown): object;
+/** Build a JSON-RPC error response object. */
+export declare function jsonRpcError(id: unknown, code: number, message: string, data?: unknown): object;

package/lib/mcp-auth/mcp/jsonrpc.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERNAL_ERROR = exports.INVALID_PARAMS = exports.METHOD_NOT_FOUND = exports.INVALID_REQUEST = exports.PARSE_ERROR = void 0;
+exports.parseJsonRpcRequest = parseJsonRpcRequest;
+exports.jsonRpcSuccess = jsonRpcSuccess;
+exports.jsonRpcError = jsonRpcError;
+const errors_1 = require("./errors");
+/** Standard JSON-RPC error codes. */
+exports.PARSE_ERROR = -32700;
+exports.INVALID_REQUEST = -32600;
+exports.METHOD_NOT_FOUND = -32601;
+exports.INVALID_PARAMS = -32602;
+exports.INTERNAL_ERROR = -32603;
+/**
+ * Validate and parse a JSON-RPC request from a raw body value.
+ * Throws McpProtocolError if the body is malformed.
+ */
+function parseJsonRpcRequest(body) {
+    if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+        throw new errors_1.McpProtocolError(exports.INVALID_REQUEST, 'Request body must be a JSON object');
+    }
+    const obj = body;
+    if (obj.jsonrpc !== '2.0') {
+        throw new errors_1.McpProtocolError(exports.INVALID_REQUEST, 'Invalid or missing jsonrpc version, must be "2.0"');
+    }
+    if (typeof obj.method !== 'string' || obj.method.length === 0) {
+        throw new errors_1.McpProtocolError(exports.INVALID_REQUEST, 'Missing or invalid method field');
+    }
+    return {
+        jsonrpc: '2.0',
+        id: obj.id,
+        method: obj.method,
+        params: obj.params,
+    };
+}
+/** Build a JSON-RPC success response object. */
+function jsonRpcSuccess(id, result) {
+    return {
+        jsonrpc: '2.0',
+        id: id ?? null,
+        result,
+    };
+}
+/** Build a JSON-RPC error response object. */
+function jsonRpcError(id, code, message, data) {
+    const error = { code, message };
+    if (data !== undefined) {
+        error.data = data;
+    }
+    return {
+        jsonrpc: '2.0',
+        id: id ?? null,
+        error,
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoianNvbnJwYy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9tY3AtYXV0aC9tY3AvanNvbnJwYy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFvQkEsa0RBcUJDO0FBR0Qsd0NBTUM7QUFHRCxvQ0FVQztBQS9ERCxxQ0FBNEM7QUFFNUMscUNBQXFDO0FBQ3hCLFFBQUEsV0FBVyxHQUFHLENBQUMsS0FBSyxDQUFDO0FBQ3JCLFFBQUEsZUFBZSxHQUFHLENBQUMsS0FBSyxDQUFDO0FBQ3pCLFFBQUEsZ0JBQWdCLEdBQUcsQ0FBQyxLQUFLLENBQUM7QUFDMUIsUUFBQSxjQUFjLEdBQUcsQ0FBQyxLQUFLLENBQUM7QUFDeEIsUUFBQSxjQUFjLEdBQUcsQ0FBQyxLQUFLLENBQUM7QUFTckM7OztHQUdHO0FBQ0gsU0FBZ0IsbUJBQW1CLENBQUMsSUFBYTtJQUMvQyxJQUFJLElBQUksS0FBSyxJQUFJLElBQUksT0FBTyxJQUFJLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNyRSxNQUFNLElBQUkseUJBQWdCLENBQUMsdUJBQWUsRUFBRSxvQ0FBb0MsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7SUFFRCxNQUFNLEdBQUcsR0FBRyxJQUErQixDQUFDO0lBRTVDLElBQUksR0FBRyxDQUFDLE9BQU8sS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUMxQixNQUFNLElBQUkseUJBQWdCLENBQUMsdUJBQWUsRUFBRSxtREFBbUQsQ0FBQyxDQUFDO0lBQ25HLENBQUM7SUFFRCxJQUFJLE9BQU8sR0FBRyxDQUFDLE1BQU0sS0FBSyxRQUFRLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDOUQsTUFBTSxJQUFJLHlCQUFnQixDQUFDLHVCQUFlLEVBQUUsaUNBQWlDLENBQUMsQ0FBQztJQUNqRixDQUFDO0lBRUQsT0FBTztRQUNMLE9BQU8sRUFBRSxLQUFLO1FBQ2QsRUFBRSxFQUFFLEdBQUcsQ0FBQyxFQUFFO1FBQ1YsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNO1FBQ2xCLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTTtLQUNuQixDQUFDO0FBQ0osQ0FBQztBQUVELGdEQUFnRDtBQUNoRCxTQUFnQixjQUFjLENBQUMsRUFBVyxFQUFFLE1BQWU7SUFDekQsT0FBTztRQUNMLE9BQU8sRUFBRSxLQUFLO1FBQ2QsRUFBRSxFQUFFLEVBQUUsSUFBSSxJQUFJO1FBQ2QsTUFBTTtLQUNQLENBQUM7QUFDSixDQUFDO0FBRUQsOENBQThDO0FBQzlDLFNBQWdCLFlBQVksQ0FBQyxFQUFXLEVBQUUsSUFBWSxFQUFFLE9BQWUsRUFBRSxJQUFjO0lBQ3JGLE1BQU0sS0FBSyxHQUE0QixFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsQ0FBQztJQUN6RCxJQUFJLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUN2QixLQUFLLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQztJQUNwQixDQUFDO0lBQ0QsT0FBTztRQUNMLE9BQU8sRUFBRSxLQUFLO1FBQ2QsRUFBRSxFQUFFLEVBQUUsSUFBSSxJQUFJO1FBQ2QsS0FBSztLQUNOLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgTWNwUHJvdG9jb2xFcnJvciB9IGZyb20gJy4vZXJyb3JzJztcblxuLyoqIFN0YW5kYXJkIEpTT04tUlBDIGVycm9yIGNvZGVzLiAqL1xuZXhwb3J0IGNvbnN0IFBBUlNFX0VSUk9SID0gLTMyNzAwO1xuZXhwb3J0IGNvbnN0IElOVkFMSURfUkVRVUVTVCA9IC0zMjYwMDtcbmV4cG9ydCBjb25zdCBNRVRIT0RfTk9UX0ZPVU5EID0gLTMyNjAxO1xuZXhwb3J0IGNvbnN0IElOVkFMSURfUEFSQU1TID0gLTMyNjAyO1xuZXhwb3J0IGNvbnN0IElOVEVSTkFMX0VSUk9SID0gLTMyNjAzO1xuXG5leHBvcnQgaW50ZXJmYWNlIEpzb25ScGNSZXF1ZXN0IHtcbiAganNvbnJwYzogJzIuMCc7XG4gIGlkPzogdW5rbm93bjtcbiAgbWV0aG9kOiBzdHJpbmc7XG4gIHBhcmFtcz86IHVua25vd247XG59XG5cbi8qKlxuICogVmFsaWRhdGUgYW5kIHBhcnNlIGEgSlNPTi1SUEMgcmVxdWVzdCBmcm9tIGEgcmF3IGJvZHkgdmFsdWUuXG4gKiBUaHJvd3MgTWNwUHJvdG9jb2xFcnJvciBpZiB0aGUgYm9keSBpcyBtYWxmb3JtZWQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBwYXJzZUpzb25ScGNSZXF1ZXN0KGJvZHk6IHVua25vd24pOiBKc29uUnBjUmVxdWVzdCB7XG4gIGlmIChib2R5ID09PSBudWxsIHx8IHR5cGVvZiBib2R5ICE9PSAnb2JqZWN0JyB8fCBBcnJheS5pc0FycmF5KGJvZHkpKSB7XG4gICAgdGhyb3cgbmV3IE1jcFByb3RvY29sRXJyb3IoSU5WQUxJRF9SRVFVRVNULCAnUmVxdWVzdCBib2R5IG11c3QgYmUgYSBKU09OIG9iamVjdCcpO1xuICB9XG5cbiAgY29uc3Qgb2JqID0gYm9keSBhcyBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPjtcblxuICBpZiAob2JqLmpzb25ycGMgIT09ICcyLjAnKSB7XG4gICAgdGhyb3cgbmV3IE1jcFByb3RvY29sRXJyb3IoSU5WQUxJRF9SRVFVRVNULCAnSW52YWxpZCBvciBtaXNzaW5nIGpzb25ycGMgdmVyc2lvbiwgbXVzdCBiZSBcIjIuMFwiJyk7XG4gIH1cblxuICBpZiAodHlwZW9mIG9iai5tZXRob2QgIT09ICdzdHJpbmcnIHx8IG9iai5tZXRob2QubGVuZ3RoID09PSAwKSB7XG4gICAgdGhyb3cgbmV3IE1jcFByb3RvY29sRXJyb3IoSU5WQUxJRF9SRVFVRVNULCAnTWlzc2luZyBvciBpbnZhbGlkIG1ldGhvZCBmaWVsZCcpO1xuICB9XG5cbiAgcmV0dXJuIHtcbiAgICBqc29ucnBjOiAnMi4wJyxcbiAgICBpZDogb2JqLmlkLFxuICAgIG1ldGhvZDogb2JqLm1ldGhvZCxcbiAgICBwYXJhbXM6IG9iai5wYXJhbXMsXG4gIH07XG59XG5cbi8qKiBCdWlsZCBhIEpTT04tUlBDIHN1Y2Nlc3MgcmVzcG9uc2Ugb2JqZWN0LiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGpzb25ScGNTdWNjZXNzKGlkOiB1bmtub3duLCByZXN1bHQ6IHVua25vd24pOiBvYmplY3Qge1xuICByZXR1cm4ge1xuICAgIGpzb25ycGM6ICcyLjAnLFxuICAgIGlkOiBpZCA/PyBudWxsLFxuICAgIHJlc3VsdCxcbiAgfTtcbn1cblxuLyoqIEJ1aWxkIGEgSlNPTi1SUEMgZXJyb3IgcmVzcG9uc2Ugb2JqZWN0LiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGpzb25ScGNFcnJvcihpZDogdW5rbm93biwgY29kZTogbnVtYmVyLCBtZXNzYWdlOiBzdHJpbmcsIGRhdGE/OiB1bmtub3duKTogb2JqZWN0IHtcbiAgY29uc3QgZXJyb3I6IFJlY29yZDxzdHJpbmcsIHVua25vd24+ID0geyBjb2RlLCBtZXNzYWdlIH07XG4gIGlmIChkYXRhICE9PSB1bmRlZmluZWQpIHtcbiAgICBlcnJvci5kYXRhID0gZGF0YTtcbiAgfVxuICByZXR1cm4ge1xuICAgIGpzb25ycGM6ICcyLjAnLFxuICAgIGlkOiBpZCA/PyBudWxsLFxuICAgIGVycm9yLFxuICB9O1xufVxuIl19

package/lib/mcp-auth/mcp/server.d.ts

@@ -0,0 +1,9 @@
+import type { McpResponse, McpServerOptions } from './types';
+export interface McpServerHandle {
+    handle(body: unknown, headers: Record<string, string | undefined>): Promise<McpResponse>;
+}
+/**
+ * Creates an MCP JSON-RPC server that authenticates callers,
+ * advertises tools, and dispatches tool invocations.
+ */
+export declare function createMcpServer<TPrincipal>(options: McpServerOptions<TPrincipal>): McpServerHandle;

package/lib/mcp-auth/mcp/server.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMcpServer = createMcpServer;
+const errors_1 = require("./errors");
+const jsonrpc_1 = require("./jsonrpc");
+/**
+ * Creates an MCP JSON-RPC server that authenticates callers,
+ * advertises tools, and dispatches tool invocations.
+ */
+function createMcpServer(options) {
+    return { handle };
+    async function handle(body, headers) {
+        // 1. Resolve credentials
+        let principal;
+        try {
+            principal = await options.resolver.resolve(headers);
+        }
+        catch (err) {
+            if (err instanceof errors_1.McpUnauthorizedError) {
+                return {
+                    statusCode: 401,
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'WWW-Authenticate': err.challenge,
+                    },
+                    body: JSON.stringify({ error: err.message }),
+                };
+            }
+            throw err;
+        }
+        // 2. Parse JSON-RPC request
+        let request;
+        try {
+            request = (0, jsonrpc_1.parseJsonRpcRequest)(body);
+        }
+        catch (err) {
+            const code = err.code ?? -32600;
+            const message = err.message ?? 'Invalid request';
+            return jsonResponse(200, (0, jsonrpc_1.jsonRpcError)(null, code, message));
+        }
+        // 3. Dispatch on method
+        const { id, method, params } = request;
+        switch (method) {
+            case 'initialize':
+                return handleInitialize(id, params);
+            case 'notifications/initialized':
+                return { statusCode: 202, headers: { 'Content-Type': 'application/json' }, body: '' };
+            case 'tools/list':
+                return handleToolsList(id, principal);
+            case 'tools/call':
+                return handleToolsCall(id, principal, params);
+            default:
+                return jsonResponse(200, (0, jsonrpc_1.jsonRpcError)(id, jsonrpc_1.METHOD_NOT_FOUND, `Method not found: ${method}`));
+        }
+    }
+    function handleInitialize(id, params) {
+        const clientVersion = params?.protocolVersion;
+        if (!clientVersion || !options.protocolVersions.includes(clientVersion)) {
+            return jsonResponse(200, (0, jsonrpc_1.jsonRpcError)(id, jsonrpc_1.INVALID_PARAMS, `Unsupported protocol version. Supported: ${options.protocolVersions.join(', ')}`));
+        }
+        return jsonResponse(200, (0, jsonrpc_1.jsonRpcSuccess)(id, {
+            protocolVersion: clientVersion,
+            capabilities: { tools: {} },
+            serverInfo: options.serverInfo,
+        }));
+    }
+    async function handleToolsList(id, principal) {
+        const tools = await Promise.all(options.tools.map(async (tool) => {
+            const description = typeof tool.description === 'function'
+                ? await tool.description(principal)
+                : tool.description;
+            return {
+                name: tool.name,
+                description,
+                inputSchema: tool.inputSchema,
+            };
+        }));
+        return jsonResponse(200, (0, jsonrpc_1.jsonRpcSuccess)(id, { tools }));
+    }
+    async function handleToolsCall(id, principal, params) {
+        const p = params;
+        const toolName = p?.name;
+        if (!toolName) {
+            return jsonResponse(200, (0, jsonrpc_1.jsonRpcError)(id, jsonrpc_1.INVALID_PARAMS, 'Missing params.name'));
+        }
+        const tool = options.tools.find((t) => t.name === toolName);
+        if (!tool) {
+            return jsonResponse(200, (0, jsonrpc_1.jsonRpcError)(id, jsonrpc_1.INVALID_PARAMS, `Unknown tool: ${toolName}`));
+        }
+        try {
+            const result = await tool.invoke(principal, p?.arguments);
+            return jsonResponse(200, (0, jsonrpc_1.jsonRpcSuccess)(id, result));
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : 'Internal error';
+            return jsonResponse(200, (0, jsonrpc_1.jsonRpcError)(id, jsonrpc_1.INTERNAL_ERROR, message));
+        }
+    }
+    function jsonResponse(statusCode, body) {
+        return {
+            statusCode,
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+        };
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL21jcC1hdXRoL21jcC9zZXJ2ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFZQSwwQ0E2R0M7QUF6SEQscUNBQWdEO0FBQ2hELHVDQUFnSTtBQU9oSTs7O0dBR0c7QUFDSCxTQUFnQixlQUFlLENBQWEsT0FBcUM7SUFDL0UsT0FBTyxFQUFFLE1BQU0sRUFBRSxDQUFDO0lBRWxCLEtBQUssVUFBVSxNQUFNLENBQUMsSUFBYSxFQUFFLE9BQTJDO1FBQzlFLHlCQUF5QjtRQUN6QixJQUFJLFNBQXFCLENBQUM7UUFDMUIsSUFBSSxDQUFDO1lBQ0gsU0FBUyxHQUFHLE1BQU0sT0FBTyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDdEQsQ0FBQztRQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7WUFDYixJQUFJLEdBQUcsWUFBWSw2QkFBb0IsRUFBRSxDQUFDO2dCQUN4QyxPQUFPO29CQUNMLFVBQVUsRUFBRSxHQUFHO29CQUNmLE9BQU8sRUFBRTt3QkFDUCxjQUFjLEVBQUUsa0JBQWtCO3dCQUNsQyxrQkFBa0IsRUFBRSxHQUFHLENBQUMsU0FBUztxQkFDbEM7b0JBQ0QsSUFBSSxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxLQUFLLEVBQUUsR0FBRyxDQUFDLE9BQU8sRUFBRSxDQUFDO2lCQUM3QyxDQUFDO1lBQ0osQ0FBQztZQUNELE1BQU0sR0FBRyxDQUFDO1FBQ1osQ0FBQztRQUVELDRCQUE0QjtRQUM1QixJQUFJLE9BQU8sQ0FBQztRQUNaLElBQUksQ0FBQztZQUNILE9BQU8sR0FBRyxJQUFBLDZCQUFtQixFQUFDLElBQUksQ0FBQyxDQUFDO1FBQ3RDLENBQUM7UUFBQyxPQUFPLEdBQVksRUFBRSxDQUFDO1lBQ3RCLE1BQU0sSUFBSSxHQUFJLEdBQXlCLENBQUMsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDO1lBQ3ZELE1BQU0sT0FBTyxHQUFJLEdBQTRCLENBQUMsT0FBTyxJQUFJLGlCQUFpQixDQUFDO1lBQzNFLE9BQU8sWUFBWSxDQUFDLEdBQUcsRUFBRSxJQUFBLHNCQUFZLEVBQUMsSUFBSSxFQUFFLElBQUksRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO1FBQzlELENBQUM7UUFFRCx3QkFBd0I7UUFDeEIsTUFBTSxFQUFFLEVBQUUsRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsT0FBTyxDQUFDO1FBRXZDLFFBQVEsTUFBTSxFQUFFLENBQUM7WUFDZixLQUFLLFlBQVk7Z0JBQ2YsT0FBTyxnQkFBZ0IsQ0FBQyxFQUFFLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDdEMsS0FBSywyQkFBMkI7Z0JBQzlCLE9BQU8sRUFBRSxVQUFVLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxFQUFFLGNBQWMsRUFBRSxrQkFBa0IsRUFBRSxFQUFFLElBQUksRUFBRSxFQUFFLEVBQUUsQ0FBQztZQUN4RixLQUFLLFlBQVk7Z0JBQ2YsT0FBTyxlQUFlLENBQUMsRUFBRSxFQUFFLFNBQVMsQ0FBQyxDQUFDO1lBQ3hDLEtBQUssWUFBWTtnQkFDZixPQUFPLGVBQWUsQ0FBQyxFQUFFLEVBQUUsU0FBUyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQ2hEO2dCQUNFLE9BQU8sWUFBWSxDQUFDLEdBQUcsRUFBRSxJQUFBLHNCQUFZLEVBQUMsRUFBRSxFQUFFLDBCQUFnQixFQUFFLHFCQUFxQixNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDaEcsQ0FBQztJQUNILENBQUM7SUFFRCxTQUFTLGdCQUFnQixDQUFDLEVBQVcsRUFBRSxNQUFlO1FBQ3BELE1BQU0sYUFBYSxHQUFJLE1BQThDLEVBQUUsZUFBcUMsQ0FBQztRQUU3RyxJQUFJLENBQUMsYUFBYSxJQUFJLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUMsRUFBRSxDQUFDO1lBQ3hFLE9BQU8sWUFBWSxDQUFDLEdBQUcsRUFBRSxJQUFBLHNCQUFZLEVBQUMsRUFBRSxFQUFFLHdCQUFjLEVBQUUsNENBQTRDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDaEosQ0FBQztRQUVELE9BQU8sWUFBWSxDQUFDLEdBQUcsRUFBRSxJQUFBLHdCQUFjLEVBQUMsRUFBRSxFQUFFO1lBQzFDLGVBQWUsRUFBRSxhQUFhO1lBQzlCLFlBQVksRUFBRSxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUU7WUFDM0IsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVO1NBQy9CLENBQUMsQ0FBQyxDQUFDO0lBQ04sQ0FBQztJQUVELEtBQUssVUFBVSxlQUFlLENBQUMsRUFBVyxFQUFFLFNBQXFCO1FBQy9ELE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FDN0IsT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLElBQUksRUFBRSxFQUFFO1lBQy9CLE1BQU0sV0FBVyxHQUFHLE9BQU8sSUFBSSxDQUFDLFdBQVcsS0FBSyxVQUFVO2dCQUN4RCxDQUFDLENBQUMsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQztnQkFDbkMsQ0FBQyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUM7WUFDckIsT0FBTztnQkFDTCxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUk7Z0JBQ2YsV0FBVztnQkFDWCxXQUFXLEVBQUUsSUFBSSxDQUFDLFdBQVc7YUFDOUIsQ0FBQztRQUNKLENBQUMsQ0FBQyxDQUNILENBQUM7UUFFRixPQUFPLFlBQVksQ0FBQyxHQUFHLEVBQUUsSUFBQSx3QkFBYyxFQUFDLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBRUQsS0FBSyxVQUFVLGVBQWUsQ0FBQyxFQUFXLEVBQUUsU0FBcUIsRUFBRSxNQUFlO1FBQ2hGLE1BQU0sQ0FBQyxHQUFHLE1BQTZDLENBQUM7UUFDeEQsTUFBTSxRQUFRLEdBQUcsQ0FBQyxFQUFFLElBQTBCLENBQUM7UUFFL0MsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQ2QsT0FBTyxZQUFZLENBQUMsR0FBRyxFQUFFLElBQUEsc0JBQVksRUFBQyxFQUFFLEVBQUUsd0JBQWMsRUFBRSxxQkFBcUIsQ0FBQyxDQUFDLENBQUM7UUFDcEYsQ0FBQztRQUVELE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxLQUFLLFFBQVEsQ0FBQyxDQUFDO1FBQzVELElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNWLE9BQU8sWUFBWSxDQUFDLEdBQUcsRUFBRSxJQUFBLHNCQUFZLEVBQUMsRUFBRSxFQUFFLHdCQUFjLEVBQUUsaUJBQWlCLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUMxRixDQUFDO1FBRUQsSUFBSSxDQUFDO1lBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDLEVBQUUsU0FBUyxDQUFDLENBQUM7WUFDMUQsT0FBTyxZQUFZLENBQUMsR0FBRyxFQUFFLElBQUEsd0JBQWMsRUFBQyxFQUFFLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUN2RCxDQUFDO1FBQUMsT0FBTyxHQUFZLEVBQUUsQ0FBQztZQUN0QixNQUFNLE9BQU8sR0FBRyxHQUFHLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxnQkFBZ0IsQ0FBQztZQUN0RSxPQUFPLFlBQVksQ0FBQyxHQUFHLEVBQUUsSUFBQSxzQkFBWSxFQUFDLEVBQUUsRUFBRSx3QkFBYyxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDdEUsQ0FBQztJQUNILENBQUM7SUFFRCxTQUFTLFlBQVksQ0FBQyxVQUFrQixFQUFFLElBQVk7UUFDcEQsT0FBTztZQUNMLFVBQVU7WUFDVixPQUFPLEVBQUUsRUFBRSxjQUFjLEVBQUUsa0JBQWtCLEVBQUU7WUFDL0MsSUFBSSxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDO1NBQzNCLENBQUM7SUFDSixDQUFDO0FBQ0gsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IE1jcFVuYXV0aG9yaXplZEVycm9yIH0gZnJvbSAnLi9lcnJvcnMnO1xuaW1wb3J0IHsganNvblJwY0Vycm9yLCBqc29uUnBjU3VjY2VzcywgSU5URVJOQUxfRVJST1IsIElOVkFMSURfUEFSQU1TLCBNRVRIT0RfTk9UX0ZPVU5ELCBwYXJzZUpzb25ScGNSZXF1ZXN0IH0gZnJvbSAnLi9qc29ucnBjJztcbmltcG9ydCB0eXBlIHsgTWNwUmVzcG9uc2UsIE1jcFNlcnZlck9wdGlvbnMgfSBmcm9tICcuL3R5cGVzJztcblxuZXhwb3J0IGludGVyZmFjZSBNY3BTZXJ2ZXJIYW5kbGUge1xuICBoYW5kbGUoYm9keTogdW5rbm93biwgaGVhZGVyczogUmVjb3JkPHN0cmluZywgc3RyaW5nIHwgdW5kZWZpbmVkPik6IFByb21pc2U8TWNwUmVzcG9uc2U+O1xufVxuXG4vKipcbiAqIENyZWF0ZXMgYW4gTUNQIEpTT04tUlBDIHNlcnZlciB0aGF0IGF1dGhlbnRpY2F0ZXMgY2FsbGVycyxcbiAqIGFkdmVydGlzZXMgdG9vbHMsIGFuZCBkaXNwYXRjaGVzIHRvb2wgaW52b2NhdGlvbnMuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjcmVhdGVNY3BTZXJ2ZXI8VFByaW5jaXBhbD4ob3B0aW9uczogTWNwU2VydmVyT3B0aW9uczxUUHJpbmNpcGFsPik6IE1jcFNlcnZlckhhbmRsZSB7XG4gIHJldHVybiB7IGhhbmRsZSB9O1xuXG4gIGFzeW5jIGZ1bmN0aW9uIGhhbmRsZShib2R5OiB1bmtub3duLCBoZWFkZXJzOiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmcgfCB1bmRlZmluZWQ+KTogUHJvbWlzZTxNY3BSZXNwb25zZT4ge1xuICAgIC8vIDEuIFJlc29sdmUgY3JlZGVudGlhbHNcbiAgICBsZXQgcHJpbmNpcGFsOiBUUHJpbmNpcGFsO1xuICAgIHRyeSB7XG4gICAgICBwcmluY2lwYWwgPSBhd2FpdCBvcHRpb25zLnJlc29sdmVyLnJlc29sdmUoaGVhZGVycyk7XG4gICAgfSBjYXRjaCAoZXJyKSB7XG4gICAgICBpZiAoZXJyIGluc3RhbmNlb2YgTWNwVW5hdXRob3JpemVkRXJyb3IpIHtcbiAgICAgICAgcmV0dXJuIHtcbiAgICAgICAgICBzdGF0dXNDb2RlOiA0MDEsXG4gICAgICAgICAgaGVhZGVyczoge1xuICAgICAgICAgICAgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyxcbiAgICAgICAgICAgICdXV1ctQXV0aGVudGljYXRlJzogZXJyLmNoYWxsZW5nZSxcbiAgICAgICAgICB9LFxuICAgICAgICAgIGJvZHk6IEpTT04uc3RyaW5naWZ5KHsgZXJyb3I6IGVyci5tZXNzYWdlIH0pLFxuICAgICAgICB9O1xuICAgICAgfVxuICAgICAgdGhyb3cgZXJyO1xuICAgIH1cblxuICAgIC8vIDIuIFBhcnNlIEpTT04tUlBDIHJlcXVlc3RcbiAgICBsZXQgcmVxdWVzdDtcbiAgICB0cnkge1xuICAgICAgcmVxdWVzdCA9IHBhcnNlSnNvblJwY1JlcXVlc3QoYm9keSk7XG4gICAgfSBjYXRjaCAoZXJyOiB1bmtub3duKSB7XG4gICAgICBjb25zdCBjb2RlID0gKGVyciBhcyB7IGNvZGU/OiBudW1iZXIgfSkuY29kZSA/PyAtMzI2MDA7XG4gICAgICBjb25zdCBtZXNzYWdlID0gKGVyciBhcyB7IG1lc3NhZ2U/OiBzdHJpbmcgfSkubWVzc2FnZSA/PyAnSW52YWxpZCByZXF1ZXN0JztcbiAgICAgIHJldHVybiBqc29uUmVzcG9uc2UoMjAwLCBqc29uUnBjRXJyb3IobnVsbCwgY29kZSwgbWVzc2FnZSkpO1xuICAgIH1cblxuICAgIC8vIDMuIERpc3BhdGNoIG9uIG1ldGhvZFxuICAgIGNvbnN0IHsgaWQsIG1ldGhvZCwgcGFyYW1zIH0gPSByZXF1ZXN0O1xuXG4gICAgc3dpdGNoIChtZXRob2QpIHtcbiAgICAgIGNhc2UgJ2luaXRpYWxpemUnOlxuICAgICAgICByZXR1cm4gaGFuZGxlSW5pdGlhbGl6ZShpZCwgcGFyYW1zKTtcbiAgICAgIGNhc2UgJ25vdGlmaWNhdGlvbnMvaW5pdGlhbGl6ZWQnOlxuICAgICAgICByZXR1cm4geyBzdGF0dXNDb2RlOiAyMDIsIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LCBib2R5OiAnJyB9O1xuICAgICAgY2FzZSAndG9vbHMvbGlzdCc6XG4gICAgICAgIHJldHVybiBoYW5kbGVUb29sc0xpc3QoaWQsIHByaW5jaXBhbCk7XG4gICAgICBjYXNlICd0b29scy9jYWxsJzpcbiAgICAgICAgcmV0dXJuIGhhbmRsZVRvb2xzQ2FsbChpZCwgcHJpbmNpcGFsLCBwYXJhbXMpO1xuICAgICAgZGVmYXVsdDpcbiAgICAgICAgcmV0dXJuIGpzb25SZXNwb25zZSgyMDAsIGpzb25ScGNFcnJvcihpZCwgTUVUSE9EX05PVF9GT1VORCwgYE1ldGhvZCBub3QgZm91bmQ6ICR7bWV0aG9kfWApKTtcbiAgICB9XG4gIH1cblxuICBmdW5jdGlvbiBoYW5kbGVJbml0aWFsaXplKGlkOiB1bmtub3duLCBwYXJhbXM6IHVua25vd24pOiBNY3BSZXNwb25zZSB7XG4gICAgY29uc3QgY2xpZW50VmVyc2lvbiA9IChwYXJhbXMgYXMgUmVjb3JkPHN0cmluZywgdW5rbm93bj4gfCB1bmRlZmluZWQpPy5wcm90b2NvbFZlcnNpb24gYXMgc3RyaW5nIHwgdW5kZWZpbmVkO1xuXG4gICAgaWYgKCFjbGllbnRWZXJzaW9uIHx8ICFvcHRpb25zLnByb3RvY29sVmVyc2lvbnMuaW5jbHVkZXMoY2xpZW50VmVyc2lvbikpIHtcbiAgICAgIHJldHVybiBqc29uUmVzcG9uc2UoMjAwLCBqc29uUnBjRXJyb3IoaWQsIElOVkFMSURfUEFSQU1TLCBgVW5zdXBwb3J0ZWQgcHJvdG9jb2wgdmVyc2lvbi4gU3VwcG9ydGVkOiAke29wdGlvbnMucHJvdG9jb2xWZXJzaW9ucy5qb2luKCcsICcpfWApKTtcbiAgICB9XG5cbiAgICByZXR1cm4ganNvblJlc3BvbnNlKDIwMCwganNvblJwY1N1Y2Nlc3MoaWQsIHtcbiAgICAgIHByb3RvY29sVmVyc2lvbjogY2xpZW50VmVyc2lvbixcbiAgICAgIGNhcGFiaWxpdGllczogeyB0b29sczoge30gfSxcbiAgICAgIHNlcnZlckluZm86IG9wdGlvbnMuc2VydmVySW5mbyxcbiAgICB9KSk7XG4gIH1cblxuICBhc3luYyBmdW5jdGlvbiBoYW5kbGVUb29sc0xpc3QoaWQ6IHVua25vd24sIHByaW5jaXBhbDogVFByaW5jaXBhbCk6IFByb21pc2U8TWNwUmVzcG9uc2U+IHtcbiAgICBjb25zdCB0b29scyA9IGF3YWl0IFByb21pc2UuYWxsKFxuICAgICAgb3B0aW9ucy50b29scy5tYXAoYXN5bmMgKHRvb2wpID0+IHtcbiAgICAgICAgY29uc3QgZGVzY3JpcHRpb24gPSB0eXBlb2YgdG9vbC5kZXNjcmlwdGlvbiA9PT0gJ2Z1bmN0aW9uJ1xuICAgICAgICAgID8gYXdhaXQgdG9vbC5kZXNjcmlwdGlvbihwcmluY2lwYWwpXG4gICAgICAgICAgOiB0b29sLmRlc2NyaXB0aW9uO1xuICAgICAgICByZXR1cm4ge1xuICAgICAgICAgIG5hbWU6IHRvb2wubmFtZSxcbiAgICAgICAgICBkZXNjcmlwdGlvbixcbiAgICAgICAgICBpbnB1dFNjaGVtYTogdG9vbC5pbnB1dFNjaGVtYSxcbiAgICAgICAgfTtcbiAgICAgIH0pLFxuICAgICk7XG5cbiAgICByZXR1cm4ganNvblJlc3BvbnNlKDIwMCwganNvblJwY1N1Y2Nlc3MoaWQsIHsgdG9vbHMgfSkpO1xuICB9XG5cbiAgYXN5bmMgZnVuY3Rpb24gaGFuZGxlVG9vbHNDYWxsKGlkOiB1bmtub3duLCBwcmluY2lwYWw6IFRQcmluY2lwYWwsIHBhcmFtczogdW5rbm93bik6IFByb21pc2U8TWNwUmVzcG9uc2U+IHtcbiAgICBjb25zdCBwID0gcGFyYW1zIGFzIFJlY29yZDxzdHJpbmcsIHVua25vd24+IHwgdW5kZWZpbmVkO1xuICAgIGNvbnN0IHRvb2xOYW1lID0gcD8ubmFtZSBhcyBzdHJpbmcgfCB1bmRlZmluZWQ7XG5cbiAgICBpZiAoIXRvb2xOYW1lKSB7XG4gICAgICByZXR1cm4ganNvblJlc3BvbnNlKDIwMCwganNvblJwY0Vycm9yKGlkLCBJTlZBTElEX1BBUkFNUywgJ01pc3NpbmcgcGFyYW1zLm5hbWUnKSk7XG4gICAgfVxuXG4gICAgY29uc3QgdG9vbCA9IG9wdGlvbnMudG9vbHMuZmluZCgodCkgPT4gdC5uYW1lID09PSB0b29sTmFtZSk7XG4gICAgaWYgKCF0b29sKSB7XG4gICAgICByZXR1cm4ganNvblJlc3BvbnNlKDIwMCwganNvblJwY0Vycm9yKGlkLCBJTlZBTElEX1BBUkFNUywgYFVua25vd24gdG9vbDogJHt0b29sTmFtZX1gKSk7XG4gICAgfVxuXG4gICAgdHJ5IHtcbiAgICAgIGNvbnN0IHJlc3VsdCA9IGF3YWl0IHRvb2wuaW52b2tlKHByaW5jaXBhbCwgcD8uYXJndW1lbnRzKTtcbiAgICAgIHJldHVybiBqc29uUmVzcG9uc2UoMjAwLCBqc29uUnBjU3VjY2VzcyhpZCwgcmVzdWx0KSk7XG4gICAgfSBjYXRjaCAoZXJyOiB1bmtub3duKSB7XG4gICAgICBjb25zdCBtZXNzYWdlID0gZXJyIGluc3RhbmNlb2YgRXJyb3IgPyBlcnIubWVzc2FnZSA6ICdJbnRlcm5hbCBlcnJvcic7XG4gICAgICByZXR1cm4ganNvblJlc3BvbnNlKDIwMCwganNvblJwY0Vycm9yKGlkLCBJTlRFUk5BTF9FUlJPUiwgbWVzc2FnZSkpO1xuICAgIH1cbiAgfVxuXG4gIGZ1bmN0aW9uIGpzb25SZXNwb25zZShzdGF0dXNDb2RlOiBudW1iZXIsIGJvZHk6IG9iamVjdCk6IE1jcFJlc3BvbnNlIHtcbiAgICByZXR1cm4ge1xuICAgICAgc3RhdHVzQ29kZSxcbiAgICAgIGhlYWRlcnM6IHsgJ0NvbnRlbnQtVHlwZSc6ICdhcHBsaWNhdGlvbi9qc29uJyB9LFxuICAgICAgYm9keTogSlNPTi5zdHJpbmdpZnkoYm9keSksXG4gICAgfTtcbiAgfVxufVxuIl19

package/lib/mcp-auth/mcp/types.d.ts

@@ -0,0 +1,32 @@
+export interface McpToolResult {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    isError?: boolean;
+}
+export interface McpToolDefinition<TPrincipal> {
+    name: string;
+    /** Static text, or resolved per-caller (e.g., personalized source hints). */
+    description: string | ((principal: TPrincipal) => Promise<string>);
+    inputSchema: object;
+    invoke(principal: TPrincipal, args: unknown): Promise<McpToolResult>;
+}
+export interface McpCredentialResolver<TPrincipal> {
+    /** Throws McpUnauthorizedError when credentials are missing/invalid. */
+    resolve(headers: Record<string, string | undefined>): Promise<TPrincipal>;
+}
+export interface McpServerOptions<TPrincipal> {
+    serverInfo: {
+        name: string;
+        version: string;
+    };
+    protocolVersions: string[];
+    resolver: McpCredentialResolver<TPrincipal>;
+    tools: Array<McpToolDefinition<TPrincipal>>;
+}
+export interface McpResponse {
+    statusCode: number;
+    headers: Record<string, string>;
+    body: string;
+}

package/lib/mcp-auth/mcp/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbWNwLWF1dGgvbWNwL3R5cGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgaW50ZXJmYWNlIE1jcFRvb2xSZXN1bHQge1xuICBjb250ZW50OiBBcnJheTx7IHR5cGU6ICd0ZXh0JzsgdGV4dDogc3RyaW5nIH0+O1xuICBpc0Vycm9yPzogYm9vbGVhbjtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBNY3BUb29sRGVmaW5pdGlvbjxUUHJpbmNpcGFsPiB7XG4gIG5hbWU6IHN0cmluZztcbiAgLyoqIFN0YXRpYyB0ZXh0LCBvciByZXNvbHZlZCBwZXItY2FsbGVyIChlLmcuLCBwZXJzb25hbGl6ZWQgc291cmNlIGhpbnRzKS4gKi9cbiAgZGVzY3JpcHRpb246IHN0cmluZyB8ICgocHJpbmNpcGFsOiBUUHJpbmNpcGFsKSA9PiBQcm9taXNlPHN0cmluZz4pO1xuICBpbnB1dFNjaGVtYTogb2JqZWN0OyAvLyBKU09OIFNjaGVtYVxuICBpbnZva2UocHJpbmNpcGFsOiBUUHJpbmNpcGFsLCBhcmdzOiB1bmtub3duKTogUHJvbWlzZTxNY3BUb29sUmVzdWx0Pjtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBNY3BDcmVkZW50aWFsUmVzb2x2ZXI8VFByaW5jaXBhbD4ge1xuICAvKiogVGhyb3dzIE1jcFVuYXV0aG9yaXplZEVycm9yIHdoZW4gY3JlZGVudGlhbHMgYXJlIG1pc3NpbmcvaW52YWxpZC4gKi9cbiAgcmVzb2x2ZShoZWFkZXJzOiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmcgfCB1bmRlZmluZWQ+KTogUHJvbWlzZTxUUHJpbmNpcGFsPjtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBNY3BTZXJ2ZXJPcHRpb25zPFRQcmluY2lwYWw+IHtcbiAgc2VydmVySW5mbzogeyBuYW1lOiBzdHJpbmc7IHZlcnNpb246IHN0cmluZyB9O1xuICBwcm90b2NvbFZlcnNpb25zOiBzdHJpbmdbXTsgLy8gU3VwcG9ydGVkIHZlcnNpb25zLCBuZXdlc3QgZmlyc3RcbiAgcmVzb2x2ZXI6IE1jcENyZWRlbnRpYWxSZXNvbHZlcjxUUHJpbmNpcGFsPjtcbiAgdG9vbHM6IEFycmF5PE1jcFRvb2xEZWZpbml0aW9uPFRQcmluY2lwYWw+Pjtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBNY3BSZXNwb25zZSB7XG4gIHN0YXR1c0NvZGU6IG51bWJlcjtcbiAgaGVhZGVyczogUmVjb3JkPHN0cmluZywgc3RyaW5nPjtcbiAgYm9keTogc3RyaW5nO1xufVxuIl19

package/llm.md

@@ -343,6 +343,220 @@ describe('Integration Tests', () => {
 });
 ```
 
+## MCP Auth
+
+MCP Auth is a service-agnostic OAuth façade for the [Model Context Protocol](https://spec.modelcontextprotocol.io). It adds OAuth 2.0 discovery, authorization, token exchange, and dynamic client registration endpoints to your API so MCP clients (Claude, ChatGPT, etc.) can authenticate via standard OAuth flows.
+
+### Using with RestApi
+
+The easiest way is via the `mcpAuth` prop on `RestApiProps`. It supports two mutually exclusive modes:
+
+#### Cognito Mode
+
+```typescript
+const api = new RestApi(this, 'Api', {
+  apiName: 'MyApi',
+  stageName: 'dev',
+  definitionFileName: 'openapi.yaml',
+  authentication: auth,
+  domainName: 'example.com',
+  apiHostname: 'api',
+  cors: true,
+  mcpAuth: {
+    cognito: {
+      auth: cognitoAuthentication, // CognitoAuthentication construct
+      authDomain: 'auth.example.com', // Cognito hosted/custom domain
+    },
+    serverInfo: { name: 'my-mcp-server', version: '1.0.0' },
+  },
+});
+```
+
+A dedicated user pool client (auth code + PKCE) is created automatically with callback URLs for known MCP clients.
+
+#### Generic Mode
+
+```typescript
+const api = new RestApi(this, 'Api', {
+  // ...
+  mcpAuth: {
+    generic: {
+      authorizeEndpoint: 'https://auth.example.com/oauth2/authorize',
+      tokenEndpoint: 'https://auth.example.com/oauth2/token',
+      clientId: 'my-pre-provisioned-client-id',
+    },
+    serverInfo: { name: 'my-mcp-server', version: '1.0.0' },
+  },
+});
+```
+
+#### McpAuthOptions
+
+| Property | Default | Description |
+|----------|---------|-------------|
+| `cognito` | — | Cognito-specific config (mutually exclusive with `generic`) |
+| `generic` | — | Any OAuth2 provider config (mutually exclusive with `cognito`) |
+| `serverInfo` | *required* | `{ name, version }` returned in MCP `initialize` response |
+| `allowedRedirectUris` | Claude + ChatGPT callbacks | URIs allowed for dynamic client registration |
+| `protocolVersions` | `['2025-11-25', '2025-03-26', '2024-11-05']` | Supported MCP protocol versions |
+| `scopes` | `['openid', 'email', 'profile']` | OAuth scopes advertised in discovery |
+| `stripParameters` | `['resource']` | Params stripped before proxying to upstream |
+| `lambdaOptions` | — | Lambda config for MCP auth handlers |
+
+### Auto-Injected Endpoints
+
+When `mcpAuth` is configured, 5 anonymous paths are added to the OpenAPI spec:
+
+| Method | Path | RFC | Purpose |
+|--------|------|-----|---------|
+| GET | `/.well-known/oauth-protected-resource` | RFC 9728 | Resource metadata discovery |
+| GET | `/.well-known/oauth-authorization-server` | RFC 8414 | Authorization server metadata |
+| GET | `/oauth/authorize` | — | Proxies to upstream authorize endpoint |
+| POST | `/oauth/token` | — | Proxies to upstream token endpoint |
+| POST | `/oauth/register` | RFC 7591 | Dynamic client registration |
+
+All endpoints bypass the API authorizer (`security: []`). The API domain is derived from the RestApi's own domain configuration.
+
+### Standalone Constructs
+
+For use outside `RestApi` (e.g., with HTTP API or custom integration):
+
+#### McpCognitoAuth
+
+Convenience wrapper that creates a Cognito client + the generic `McpAuth`:
+
+```typescript
+import { McpCognitoAuth } from 'cdk-serverless/constructs';
+
+const mcpAuth = new McpCognitoAuth(this, 'McpAuth', {
+  auth: cognitoAuthentication,
+  apiDomain: 'api.example.com',
+  authDomain: 'auth.example.com',
+  serverInfo: { name: 'my-mcp-server', version: '1.0.0' },
+  stageName: 'dev',
+});
+
+// Access the underlying McpAuth and user pool client
+mcpAuth.mcpAuth.functions;      // Lambda functions for each endpoint
+mcpAuth.mcpAuth.mcpEnvVars;     // Env vars to inject into your MCP handler
+mcpAuth.userPoolClient;          // The created Cognito client
+```
+
+#### McpAuth
+
+Service-agnostic construct for any OAuth2 provider:
+
+```typescript
+import { McpAuth } from 'cdk-serverless/constructs';
+
+const mcpAuth = new McpAuth(this, 'McpAuth', {
+  apiDomain: 'api.example.com',
+  authorizeEndpoint: 'https://auth.example.com/oauth2/authorize',
+  tokenEndpoint: 'https://auth.example.com/oauth2/token',
+  allowedRedirectUris: ['https://claude.ai/oauth/callback'],
+  clientId: 'my-client-id',
+  serverInfo: { name: 'my-mcp-server', version: '1.0.0' },
+  stageName: 'dev',
+});
+
+// Wire functions into your own API Gateway
+mcpAuth.functions.protectedResource; // GET /.well-known/oauth-protected-resource
+mcpAuth.functions.authorizationServer; // GET /.well-known/oauth-authorization-server
+mcpAuth.functions.authorize;          // GET /oauth/authorize
+mcpAuth.functions.token;              // POST /oauth/token
+mcpAuth.functions.register;           // POST /oauth/register
+
+// Inject env vars into your MCP RPC handler Lambda
+mcpAuth.mcpEnvVars; // { MCP_API_DOMAIN, MCP_AUTHORIZE_ENDPOINT, ... }
+```
+
+### Runtime Module (`src/mcp-auth/`)
+
+The `mcp-auth` package provides runtime utilities for building MCP tool servers:
+
+#### MCP JSON-RPC Server
+
+```typescript
+import { createMcpServer } from 'cdk-serverless/mcp-auth';
+
+interface MyPrincipal {
+  userId: string;
+  email: string;
+}
+
+const server = createMcpServer<MyPrincipal>({
+  serverInfo: { name: 'my-server', version: '1.0.0' },
+  protocolVersions: ['2025-11-25', '2025-03-26', '2024-11-05'],
+  resolver: {
+    async resolve(headers) {
+      // Validate Bearer token, return principal or throw McpUnauthorizedError
+      const token = headers.authorization?.replace('Bearer ', '');
+      if (!token) throw new McpUnauthorizedError('Missing token', 'Bearer');
+      return verifyToken(token);
+    },
+  },
+  tools: [
+    {
+      name: 'get_items',
+      description: 'List items for the authenticated user',
+      inputSchema: { type: 'object', properties: { limit: { type: 'number' } } },
+      async invoke(principal, args) {
+        const items = await getItemsForUser(principal.userId);
+        return { content: [{ type: 'text', text: JSON.stringify(items) }] };
+      },
+    },
+  ],
+});
+
+// In your Lambda handler:
+export const handler = async (event: APIGatewayProxyEvent) => {
+  const body = JSON.parse(event.body ?? '{}');
+  const headers = event.headers as Record<string, string | undefined>;
+  const response = await server.handle(body, headers);
+  return response;
+};
+```
+
+#### Key Types
+
+```typescript
+// Tool definition — register tools with the server
+interface McpToolDefinition<TPrincipal> {
+  name: string;
+  description: string | ((principal: TPrincipal) => Promise<string>);
+  inputSchema: object; // JSON Schema
+  invoke(principal: TPrincipal, args: unknown): Promise<McpToolResult>;
+}
+
+// Credential resolver — authenticate incoming requests
+interface McpCredentialResolver<TPrincipal> {
+  resolve(headers: Record<string, string | undefined>): Promise<TPrincipal>;
+}
+
+// Server options
+interface McpServerOptions<TPrincipal> {
+  serverInfo: { name: string; version: string };
+  protocolVersions: string[];
+  resolver: McpCredentialResolver<TPrincipal>;
+  tools: Array<McpToolDefinition<TPrincipal>>;
+}
+
+// Runtime config (read from Lambda env vars)
+interface McpAuthConfig {
+  apiDomain: string;
+  authorizeEndpoint: string;
+  tokenEndpoint: string;
+  allowedRedirectUris: string[];
+  clientId: string;
+  serverInfo: { name: string; version: string };
+  protocolVersions: string[];
+  scopes?: string[];
+  stripParameters?: string[];
+}
+```
+
+The server handles the JSON-RPC protocol (`initialize`, `notifications/initialized`, `tools/list`, `tools/call`), credential resolution via the `McpCredentialResolver`, and per-tool dispatch with typed principals.
+
 ## Common Workflows
 
 ### Creating a New Serverless Project

package/package.json

@@ -99,7 +99,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "3.2.1",
+  "version": "3.3.1",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [