draftgo-cli 3.0.33 → 3.0.38

package/src/mcp/hosts.js

@@ -0,0 +1,520 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { exists, ensureDir } = require('../fsx');
+
+const JSON_ENTRY = Object.freeze({
+  command: 'draftgo',
+  args: ['mcp', 'serve'],
+});
+
+const VSCODE_ENTRY = Object.freeze({
+  type: 'stdio',
+  command: 'draftgo',
+  args: ['mcp', 'serve'],
+});
+
+const HOSTS = Object.freeze([
+  { name: 'codex', displayName: 'Codex CLI', path: '.codex/config.toml', format: 'toml', signals: ['.codex', 'AGENTS.md'] },
+  { name: 'claudecode', aliases: ['claude'], displayName: 'Claude Code', path: '.mcp.json', format: 'jsonc', registry: 'mcpServers', signals: ['.claude', 'CLAUDE.md', '.mcp.json'] },
+  { name: 'cursor', displayName: 'Cursor', path: '.cursor/mcp.json', format: 'jsonc', registry: 'mcpServers', signals: ['.cursor'] },
+  { name: 'gemini', displayName: 'Gemini CLI', path: '.gemini/settings.json', format: 'jsonc', registry: 'mcpServers', signals: ['.gemini', 'GEMINI.md'] },
+  { name: 'kiro', displayName: 'Kiro', path: '.kiro/settings/mcp.json', format: 'jsonc', registry: 'mcpServers', signals: ['.kiro'] },
+  { name: 'copilot', aliases: ['github-copilot'], displayName: 'GitHub Copilot', path: '.vscode/mcp.json', format: 'jsonc', registry: 'servers', vscode: true, signals: ['.vscode', '.github/prompts', '.github/copilot-instructions.md'] },
+  { name: 'windsurf', displayName: 'Windsurf', supported: false, reason: 'Windsurf has no supported project-level MCP configuration adapter.', signals: ['.windsurf'] },
+  { name: 'antigravity', displayName: 'Antigravity', supported: false, reason: 'Antigravity has no supported project-level MCP configuration adapter.', signals: ['.agent'] },
+]);
+
+const byName = new Map();
+for (const host of HOSTS) {
+  byName.set(host.name, host);
+  for (const alias of host.aliases || []) byName.set(alias, host);
+}
+
+function stripJsonc(source) {
+  const chars = [...source];
+  let inString = false;
+  let escaped = false;
+  for (let i = 0; i < chars.length; i += 1) {
+    const char = chars[i];
+    const next = chars[i + 1];
+    if (inString) {
+      if (escaped) escaped = false;
+      else if (char === '\\') escaped = true;
+      else if (char === '"') inString = false;
+      continue;
+    }
+    if (char === '"') {
+      inString = true;
+      continue;
+    }
+    if (char === '/' && next === '/') {
+      chars[i] = ' ';
+      chars[i + 1] = ' ';
+      i += 2;
+      while (i < chars.length && chars[i] !== '\n' && chars[i] !== '\r') {
+        chars[i] = ' ';
+        i += 1;
+      }
+      i -= 1;
+      continue;
+    }
+    if (char === '/' && next === '*') {
+      chars[i] = ' ';
+      chars[i + 1] = ' ';
+      i += 2;
+      let closed = false;
+      while (i < chars.length) {
+        if (chars[i] === '*' && chars[i + 1] === '/') {
+          chars[i] = ' ';
+          chars[i + 1] = ' ';
+          i += 1;
+          closed = true;
+          break;
+        }
+        if (chars[i] !== '\n' && chars[i] !== '\r') chars[i] = ' ';
+        i += 1;
+      }
+      if (!closed) throw new Error('Invalid JSONC: unterminated block comment.');
+    }
+  }
+  if (inString) throw new Error('Invalid JSONC: unterminated string.');
+
+  for (let i = 0; i < chars.length; i += 1) {
+    if (chars[i] !== ',') continue;
+    let next = i + 1;
+    while (next < chars.length && /\s/.test(chars[next])) next += 1;
+    if (chars[next] === '}' || chars[next] === ']') chars[i] = ' ';
+  }
+  return chars.join('').replace(/^\ufeff/, '');
+}
+
+function parseJsonc(source, file = 'MCP config') {
+  const text = source.trim() ? source : '{}';
+  let value;
+  try {
+    value = JSON.parse(stripJsonc(text));
+  } catch (error) {
+    throw new Error(`Invalid ${file}: ${error.message}`);
+  }
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error(`Invalid ${file}: root must be an object.`);
+  }
+  return value;
+}
+
+function skipTrivia(source, offset, limit = source.length) {
+  let index = offset;
+  while (index < limit) {
+    if (/\s/.test(source[index])) {
+      index += 1;
+      continue;
+    }
+    if (source[index] === '/' && source[index + 1] === '/') {
+      index += 2;
+      while (index < limit && source[index] !== '\n' && source[index] !== '\r') index += 1;
+      continue;
+    }
+    if (source[index] === '/' && source[index + 1] === '*') {
+      const end = source.indexOf('*/', index + 2);
+      if (end < 0 || end >= limit) throw new Error('Invalid JSONC block comment.');
+      index = end + 2;
+      continue;
+    }
+    break;
+  }
+  return index;
+}
+
+function scanString(source, offset) {
+  if (source[offset] !== '"') throw new Error('Expected a JSON string.');
+  let escaped = false;
+  for (let index = offset + 1; index < source.length; index += 1) {
+    const char = source[index];
+    if (escaped) escaped = false;
+    else if (char === '\\') escaped = true;
+    else if (char === '"') return index + 1;
+  }
+  throw new Error('Unterminated JSON string.');
+}
+
+function scanComposite(source, offset) {
+  const stack = [source[offset] === '{' ? '}' : ']'];
+  let index = offset + 1;
+  while (index < source.length && stack.length) {
+    const char = source[index];
+    if (char === '"') {
+      index = scanString(source, index);
+      continue;
+    }
+    if (char === '/' && source[index + 1] === '/') {
+      index = skipTrivia(source, index);
+      continue;
+    }
+    if (char === '/' && source[index + 1] === '*') {
+      index = skipTrivia(source, index);
+      continue;
+    }
+    if (char === '{') stack.push('}');
+    else if (char === '[') stack.push(']');
+    else if (char === stack[stack.length - 1]) stack.pop();
+    index += 1;
+  }
+  if (stack.length) throw new Error('Unterminated JSON object or array.');
+  return index;
+}
+
+function scanValue(source, offset, limit = source.length) {
+  const char = source[offset];
+  if (char === '"') return scanString(source, offset);
+  if (char === '{' || char === '[') return scanComposite(source, offset);
+  let index = offset;
+  while (index < limit && source[index] !== ',' && source[index] !== '}' && source[index] !== ']') {
+    if (source[index] === '/' && (source[index + 1] === '/' || source[index + 1] === '*')) break;
+    index += 1;
+  }
+  while (index > offset && /\s/.test(source[index - 1])) index -= 1;
+  return index;
+}
+
+function objectProperties(source, open, close) {
+  const properties = [];
+  let index = open + 1;
+  while (index < close) {
+    index = skipTrivia(source, index, close);
+    if (source[index] === ',') {
+      index += 1;
+      continue;
+    }
+    if (index >= close) break;
+    const propertyStart = index;
+    const keyEnd = scanString(source, index);
+    const key = JSON.parse(source.slice(index, keyEnd));
+    index = skipTrivia(source, keyEnd, close);
+    if (source[index] !== ':') throw new Error('Invalid JSONC object property.');
+    const valueStart = skipTrivia(source, index + 1, close);
+    const valueEnd = scanValue(source, valueStart, close);
+    index = skipTrivia(source, valueEnd, close);
+    const comma = source[index] === ',' ? index : null;
+    properties.push({ key, propertyStart, valueStart, valueEnd, comma });
+    if (comma != null) index = comma + 1;
+    else if (index < close) throw new Error('Invalid JSONC object separator.');
+  }
+  return properties;
+}
+
+function lineIndent(source, offset) {
+  const start = source.lastIndexOf('\n', Math.max(0, offset - 1)) + 1;
+  const prefix = source.slice(start, offset);
+  return /^\s*$/.test(prefix) ? prefix.replace(/\r/g, '') : '';
+}
+
+function formatJsonValue(value, propertyIndent, newline) {
+  return JSON.stringify(value, null, 2).replace(/\n/g, `${newline}${propertyIndent}`);
+}
+
+function replaceRange(source, start, end, replacement) {
+  return source.slice(0, start) + replacement + source.slice(end);
+}
+
+function insertObjectProperty(source, open, close, key, value, newline) {
+  const properties = objectProperties(source, open, close);
+  const openingIndent = lineIndent(source, open);
+  const propertyIndent = properties.length
+    ? (lineIndent(source, properties[0].propertyStart) || `${openingIndent}  `)
+    : `${openingIndent}  `;
+  const property = `${JSON.stringify(key)}: ${formatJsonValue(value, propertyIndent, newline)}`;
+  let updated = source;
+  let adjustedClose = close;
+
+  if (properties.length) {
+    const last = properties[properties.length - 1];
+    if (last.comma == null) {
+      updated = replaceRange(updated, last.valueEnd, last.valueEnd, ',');
+      adjustedClose += 1;
+    }
+  }
+
+  const closeLineStart = updated.lastIndexOf('\n', Math.max(0, adjustedClose - 1)) + 1;
+  const closePrefix = updated.slice(closeLineStart, adjustedClose);
+  if (closeLineStart > open && /^\s*$/.test(closePrefix)) {
+    return replaceRange(updated, closeLineStart, closeLineStart, `${propertyIndent}${property}${newline}`);
+  }
+  return replaceRange(
+    updated,
+    adjustedClose,
+    adjustedClose,
+    `${newline}${propertyIndent}${property}${newline}${openingIndent}`,
+  );
+}
+
+function mergeJsoncConfig(source, registry, entry, file = 'MCP config') {
+  const initial = source.trim() ? source : '{\n}\n';
+  const parsed = parseJsonc(initial, file);
+  if (parsed[registry] !== undefined
+      && (!parsed[registry] || typeof parsed[registry] !== 'object' || Array.isArray(parsed[registry]))) {
+    throw new Error(`Invalid ${file}: ${registry} must be an object.`);
+  }
+
+  const newline = initial.includes('\r\n') ? '\r\n' : '\n';
+  const rootOffset = initial.charCodeAt(0) === 0xfeff ? 1 : 0;
+  const rootOpen = skipTrivia(initial, rootOffset);
+  const rootEnd = scanComposite(initial, rootOpen);
+  const rootClose = rootEnd - 1;
+  const rootProperties = objectProperties(initial, rootOpen, rootClose);
+  const registryProperty = rootProperties.find((item) => item.key === registry);
+  let result;
+
+  if (!registryProperty) {
+    result = insertObjectProperty(initial, rootOpen, rootClose, registry, { draftgo: entry }, newline);
+  } else {
+    const registryOpen = registryProperty.valueStart;
+    const registryClose = scanComposite(initial, registryOpen) - 1;
+    const serverProperties = objectProperties(initial, registryOpen, registryClose);
+    const draftgo = serverProperties.find((item) => item.key === 'draftgo');
+    if (draftgo) {
+      const indent = lineIndent(initial, draftgo.propertyStart);
+      result = replaceRange(
+        initial,
+        draftgo.valueStart,
+        draftgo.valueEnd,
+        formatJsonValue(entry, indent, newline),
+      );
+    } else {
+      result = insertObjectProperty(initial, registryOpen, registryClose, 'draftgo', entry, newline);
+    }
+  }
+
+  parseJsonc(result, file);
+  return result.endsWith('\n') || result.endsWith('\r') ? result : `${result}${newline}`;
+}
+
+function canonicalTomlPath(raw) {
+  const parts = [];
+  let current = '';
+  let quote = null;
+  for (const char of raw.trim()) {
+    if (quote) {
+      if (char === quote) quote = null;
+      else current += char;
+    } else if (char === '"' || char === "'") {
+      quote = char;
+    } else if (char === '.') {
+      parts.push(current.trim());
+      current = '';
+    } else {
+      current += char;
+    }
+  }
+  parts.push(current.trim());
+  return parts.join('.');
+}
+
+function tomlHeaderPath(line) {
+  const match = line.match(/^\s*\[\[?\s*([^\]]+?)\s*\]\]?\s*(?:#.*)?$/);
+  return match ? canonicalTomlPath(match[1]) : null;
+}
+
+function isDraftGoTomlPath(value) {
+  return value === 'mcp_servers.draftgo' || value.startsWith('mcp_servers.draftgo.');
+}
+
+function assertNoConflictingToml(source, file) {
+  for (const line of source.split(/\r?\n/)) {
+    const code = line.replace(/#.*$/, '').trim();
+    if (!code) continue;
+    if (/^mcp_servers\s*=/.test(code)
+        || /^mcp_servers\s*\.\s*(?:draftgo|"draftgo"|'draftgo')\s*=/.test(code)) {
+      throw new Error(`Invalid ${file}: inline or dotted draftgo MCP definitions are not supported.`);
+    }
+  }
+}
+
+function mergeCodexToml(source, file = '.codex/config.toml') {
+  assertNoConflictingToml(source, file);
+  const newline = source.includes('\r\n') ? '\r\n' : '\n';
+  const output = [];
+  let skip = false;
+  for (const line of source.split(/\r?\n/)) {
+    const header = tomlHeaderPath(line);
+    if (header != null) skip = isDraftGoTomlPath(header);
+    if (!skip) output.push(line);
+  }
+  while (output.length && output[output.length - 1].trim() === '') output.pop();
+  if (output.length) output.push('');
+  output.push(
+    '[mcp_servers.draftgo]',
+    'command = "draftgo"',
+    'args = ["mcp", "serve"]',
+    '',
+  );
+  return output.join(newline);
+}
+
+function writeAtomic(file, content) {
+  ensureDir(path.dirname(file));
+  const suffix = `${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  const temporary = `${file}.tmp-${suffix}`;
+  const backup = `${file}.bak-${suffix}`;
+  let handle;
+  let backedUp = false;
+  let installed = false;
+  try {
+    handle = fs.openSync(temporary, 'wx', 0o600);
+    fs.writeFileSync(handle, content, 'utf8');
+    fs.fsyncSync(handle);
+    fs.closeSync(handle);
+    handle = null;
+    if (exists(file)) {
+      fs.renameSync(file, backup);
+      backedUp = true;
+    }
+    fs.renameSync(temporary, file);
+    installed = true;
+  } catch (error) {
+    if (installed && exists(file)) fs.rmSync(file, { force: true });
+    if (backedUp && exists(backup)) fs.renameSync(backup, file);
+    throw error;
+  } finally {
+    if (handle != null) fs.closeSync(handle);
+    if (exists(temporary)) fs.rmSync(temporary, { force: true });
+  }
+  if (exists(backup)) fs.rmSync(backup, { force: true });
+}
+
+function resolveHost(name) {
+  return byName.get(String(name || '').toLowerCase()) || null;
+}
+
+function resolveHostTargets(input) {
+  const names = (Array.isArray(input) ? input : [input])
+    .filter(Boolean)
+    .flatMap((item) => String(item).split(','))
+    .map((item) => item.trim().toLowerCase())
+    .filter(Boolean);
+  if (names.includes('all')) return { hosts: [...HOSTS], unknown: [] };
+  const hosts = [];
+  const unknown = [];
+  const seen = new Set();
+  for (const name of names) {
+    const host = resolveHost(name);
+    if (!host) {
+      unknown.push(name);
+    } else if (!seen.has(host.name)) {
+      seen.add(host.name);
+      hosts.push(host);
+    }
+  }
+  return { hosts, unknown };
+}
+
+function detectHostTargets(projectDir) {
+  return HOSTS.filter((host) => (host.signals || []).some((signal) => exists(path.join(projectDir, signal))));
+}
+
+function setupHost(projectDir, target) {
+  const host = typeof target === 'string' ? resolveHost(target) : target;
+  if (!host) throw new Error(`Unknown MCP target: ${target}`);
+  if (host.supported === false) {
+    return { host, supported: false, configured: false, reason: host.reason };
+  }
+  const file = path.join(projectDir, host.path);
+  const original = exists(file) ? fs.readFileSync(file, 'utf8') : '';
+  const entry = host.vscode ? VSCODE_ENTRY : JSON_ENTRY;
+  const content = host.format === 'toml'
+    ? mergeCodexToml(original, host.path)
+    : mergeJsoncConfig(original, host.registry, entry, host.path);
+  if (content !== original) writeAtomic(file, content);
+  return { host, supported: true, configured: true, changed: content !== original, path: file };
+}
+
+function setupHosts(projectDir, targets) {
+  const selected = targets && targets.length ? resolveHostTargets(targets) : { hosts: detectHostTargets(projectDir), unknown: [] };
+  if (selected.unknown.length) throw new Error(`Unknown MCP target: ${selected.unknown.join(', ')}`);
+  return selected.hosts.map((host) => setupHost(projectDir, host));
+}
+
+function exactEntry(actual, expected) {
+  if (!actual || typeof actual !== 'object' || Array.isArray(actual)) return false;
+  const actualKeys = Object.keys(actual).sort();
+  const expectedKeys = Object.keys(expected).sort();
+  return JSON.stringify(actualKeys) === JSON.stringify(expectedKeys)
+    && actual.command === expected.command
+    && JSON.stringify(actual.args) === JSON.stringify(expected.args)
+    && (expected.type === undefined || actual.type === expected.type);
+}
+
+function codexStatus(source) {
+  try {
+    assertNoConflictingToml(source, '.codex/config.toml');
+  } catch (error) {
+    return { configured: false, secure: false, error: error.message };
+  }
+  const lines = source.split(/\r?\n/);
+  const blocks = [];
+  let active = null;
+  for (const line of lines) {
+    const header = tomlHeaderPath(line);
+    if (header != null) {
+      active = isDraftGoTomlPath(header) ? [] : null;
+      if (active) blocks.push(active);
+    } else if (active) {
+      active.push(line);
+    }
+  }
+  const body = blocks.flat().join('\n');
+  const command = /^\s*command\s*=\s*"draftgo"\s*(?:#.*)?$/m.test(body);
+  const args = /^\s*args\s*=\s*\[\s*"mcp"\s*,\s*"serve"\s*\]\s*(?:#.*)?$/m.test(body);
+  const forbidden = /^\s*(?:env|cwd|url|server|sat|token|headers?)\b/im.test(body);
+  return { configured: blocks.length === 1 && command && args && !forbidden, secure: !forbidden };
+}
+
+function statusHost(projectDir, target) {
+  const host = typeof target === 'string' ? resolveHost(target) : target;
+  if (!host) throw new Error(`Unknown MCP target: ${target}`);
+  if (host.supported === false) {
+    return { host, supported: false, configured: false, reason: host.reason };
+  }
+  const file = path.join(projectDir, host.path);
+  if (!exists(file)) return { host, supported: true, configured: false, secure: true, path: file };
+  const source = fs.readFileSync(file, 'utf8');
+  if (host.format === 'toml') return { host, supported: true, path: file, ...codexStatus(source) };
+  try {
+    const value = parseJsonc(source, host.path);
+    const registry = value[host.registry];
+    const entry = registry && typeof registry === 'object' && !Array.isArray(registry)
+      ? registry.draftgo
+      : undefined;
+    const expected = host.vscode ? VSCODE_ENTRY : JSON_ENTRY;
+    const configured = exactEntry(entry, expected);
+    const text = entry === undefined ? '' : JSON.stringify(entry).toLowerCase();
+    const secure = !/(?:token|sat|authorization|bearer|server|https?:|headers|env|cwd)/.test(text);
+    return { host, supported: true, configured, secure, path: file };
+  } catch (error) {
+    return { host, supported: true, configured: false, secure: false, path: file, error: error.message };
+  }
+}
+
+function statusHosts(projectDir, targets) {
+  const selected = targets && targets.length ? resolveHostTargets(targets) : { hosts: [...HOSTS], unknown: [] };
+  if (selected.unknown.length) throw new Error(`Unknown MCP target: ${selected.unknown.join(', ')}`);
+  return selected.hosts.map((host) => statusHost(projectDir, host));
+}
+
+module.exports = {
+  HOSTS,
+  JSON_ENTRY,
+  VSCODE_ENTRY,
+  detectHostTargets,
+  mergeCodexToml,
+  mergeJsoncConfig,
+  parseJsonc,
+  resolveHost,
+  resolveHostTargets,
+  setupHost,
+  setupHosts,
+  statusHost,
+  statusHosts,
+  writeAtomic,
+};

package/src/mcp/protocol.js

@@ -0,0 +1,173 @@
+'use strict';
+
+const DEFAULT_PROTOCOL_VERSION = '2025-06-18';
+
+class McpHttpError extends Error {
+  constructor(message, { status = 0, rpc = null, code = null } = {}) {
+    super(message);
+    this.name = 'McpHttpError';
+    this.status = status;
+    this.rpc = rpc;
+    this.code = code;
+  }
+}
+
+function redactText(value, secrets = []) {
+  let text = String(value == null ? '' : value);
+  for (const secret of secrets.filter(Boolean)) text = text.split(String(secret)).join('[REDACTED]');
+  text = text.replace(/(authorization\s*[:=]\s*bearer\s+)[^\s,;"']+/ig, '$1[REDACTED]');
+  text = text.replace(/(\"?(?:token|sat)\"?\s*[:=]\s*\"?)[^\s,;"'}]+/ig, '$1[REDACTED]');
+  return text;
+}
+
+function endpointFor(config) {
+  const server = new URL(String(config.server || config.mcp_url));
+  const endpoint = config.mcp_url
+    ? new URL(String(config.mcp_url), server)
+    : new URL(`${server.pathname.replace(/\/+$/, '')}/mcp`, server);
+  if (!['http:', 'https:'].includes(endpoint.protocol) || endpoint.username || endpoint.password) {
+    throw new McpHttpError('DraftGo MCP endpoint must be a credential-free HTTP(S) URL.');
+  }
+  const allowedOrigins = new Set([
+    server.origin,
+    ...((config.mcp_allowed_origins || []).map((value) => new URL(value).origin)),
+  ]);
+  if (!allowedOrigins.has(endpoint.origin)) {
+    throw new McpHttpError('DraftGo MCP endpoint origin is not allowlisted; refusing to send the SAT.');
+  }
+  return endpoint.toString();
+}
+
+function jsonRpcMessages(value) {
+  if (Array.isArray(value)) return value.filter((item) => item && typeof item === 'object');
+  return value && typeof value === 'object' ? [value] : [];
+}
+
+async function parseEventStream(body, onMessage) {
+  if (!body) return [];
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let pending = '';
+  let dataLines = [];
+  const messages = [];
+  const consume = () => {
+    if (!dataLines.length) return;
+    const data = dataLines.join('\n');
+    dataLines = [];
+    if (!data || data === '[DONE]') return;
+    let parsed;
+    try { parsed = JSON.parse(data); } catch {
+      throw new McpHttpError('DraftGo MCP returned invalid JSON in an event stream.');
+    }
+    for (const message of jsonRpcMessages(parsed)) {
+      messages.push(message);
+      if (onMessage) onMessage(message);
+    }
+  };
+  while (true) {
+    const { done, value } = await reader.read();
+    pending += decoder.decode(value || new Uint8Array(), { stream: !done });
+    const lines = pending.split(/\r?\n/);
+    pending = lines.pop() || '';
+    for (const line of lines) {
+      if (!line) consume();
+      else if (line.startsWith('data:')) dataLines.push(line.slice(5).replace(/^ /, ''));
+    }
+    if (done) break;
+  }
+  if (pending.startsWith('data:')) dataLines.push(pending.slice(5).replace(/^ /, ''));
+  consume();
+  return messages;
+}
+
+async function readLimitedText(response, maxBytes = 65536) {
+  if (!response.body) return '';
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  while (size < maxBytes) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    const chunk = Buffer.from(value);
+    chunks.push(chunk.subarray(0, Math.max(0, maxBytes - size)));
+    size += chunk.length;
+  }
+  return Buffer.concat(chunks).toString('utf8');
+}
+
+async function postJsonRpc(config, message, options = {}) {
+  const token = String(config.token || config.sat || '');
+  const controller = new AbortController();
+  const timeoutMs = Number(options.timeoutMs || config.mcp_timeout_ms || 60000);
+  const timer = setTimeout(() => controller.abort(new Error('MCP request timed out')), timeoutMs);
+  const externalSignal = options.signal;
+  const abort = () => controller.abort(externalSignal.reason);
+  if (externalSignal) {
+    if (externalSignal.aborted) abort();
+    else externalSignal.addEventListener('abort', abort, { once: true });
+  }
+
+  const headers = {
+    Authorization: `Bearer ${token}`,
+    Accept: 'application/json, text/event-stream',
+    'Content-Type': 'application/json',
+    'MCP-Protocol-Version': options.protocolVersion || DEFAULT_PROTOCOL_VERSION,
+  };
+  if (options.sessionId) headers['Mcp-Session-Id'] = options.sessionId;
+
+  let response;
+  try {
+    response = await fetch(endpointFor(config), {
+      method: 'POST',
+      headers,
+      body: JSON.stringify(message),
+      signal: controller.signal,
+    });
+    const sessionId = response.headers.get('mcp-session-id');
+    if (sessionId && options.onSession) options.onSession(sessionId);
+    if (response.status === 202 || response.status === 204) return [];
+
+    const contentType = String(response.headers.get('content-type') || '').toLowerCase();
+    if (!response.ok) {
+      const bodyText = await readLimitedText(response);
+      let rpc = null;
+      try {
+        const parsed = JSON.parse(bodyText);
+        rpc = jsonRpcMessages(parsed)[0] || null;
+      } catch { /* retain a bounded text error */ }
+      const structured = rpc && rpc.error && (rpc.error.message || rpc.error.code);
+      throw new McpHttpError(
+        redactText(structured || bodyText || `MCP HTTP ${response.status}`, [token]),
+        { status: response.status, rpc, code: rpc && rpc.error && rpc.error.code },
+      );
+    }
+
+    if (contentType.includes('text/event-stream')) {
+      return await parseEventStream(response.body, options.onMessage);
+    }
+    const text = await response.text();
+    if (!text.trim()) return [];
+    let parsed;
+    try { parsed = JSON.parse(text); } catch {
+      throw new McpHttpError('DraftGo MCP returned invalid JSON.', { status: response.status });
+    }
+    const messages = jsonRpcMessages(parsed);
+    if (options.onMessage) messages.forEach(options.onMessage);
+    return messages;
+  } catch (error) {
+    if (error instanceof McpHttpError || controller.signal.aborted) throw error;
+    throw new McpHttpError(redactText(error.message || error, [token]), { status: response && response.status });
+  } finally {
+    clearTimeout(timer);
+    if (externalSignal) externalSignal.removeEventListener('abort', abort);
+  }
+}
+
+module.exports = {
+  DEFAULT_PROTOCOL_VERSION,
+  McpHttpError,
+  redactText,
+  endpointFor,
+  postJsonRpc,
+  parseEventStream,
+};