easyeda-mcp-pro 0.3.2 → 0.5.2

package/dist/pcb-constraints/validation.js

@@ -0,0 +1,309 @@
+/**
+ * PCB constraint validation rules.
+ *
+ * Implements constraint checks that operate on {@link PcbConstraintInput}
+ * and produce structured {@link PcbConstraintIssue}s.
+ *
+ * Rules:
+ *  1. Missing board outline (error)
+ *  2. Board outline too small (warning)
+ *  3. Missing layer stackup (warning)
+ *  4. Layer count mismatch between intent and board (error)
+ *  5. Missing mounting holes (warning)
+ *  6. Missing net classes (warning)
+ *  7. Invalid clearance / creepage (error)
+ *  8. Keepout area violations (error)
+ *  9. Missing placement zones (warning)
+ * 10. Missing manufacturing constraints (warning)
+ * 11. Fiducials recommended for SMT (warning)
+ * 12. High-voltage creepage/clearance (error)
+ *
+ * @module
+ */
+import { pcbError, pcbWarning } from './errors.js';
+// ── Rule: missing board outline ────────────────────────────────────────────
+function checkMissingOutline(input) {
+    const issues = [];
+    if (!input.hasOutline) {
+        issues.push(pcbError('PCB_MISSING_OUTLINE', 'Board outline is not defined', {
+            remediationHint: 'Define a board outline with at least 3 polygon points in the PCB intent or board dimensions',
+        }));
+    }
+    return issues;
+}
+// ── Rule: board outline too small ──────────────────────────────────────────
+const MIN_BOARD_DIMENSION_MM = 5;
+function checkOutlineTooSmall(input) {
+    const issues = [];
+    if (input.widthMm && input.widthMm < MIN_BOARD_DIMENSION_MM) {
+        issues.push(pcbWarning('PCB_OUTLINE_TOO_SMALL', `Board width (${input.widthMm}mm) is below recommended minimum of ${MIN_BOARD_DIMENSION_MM}mm`, {
+            remediationHint: 'Verify the board dimensions are correct. Very small boards may be difficult to manufacture.',
+        }));
+    }
+    if (input.heightMm && input.heightMm < MIN_BOARD_DIMENSION_MM) {
+        issues.push(pcbWarning('PCB_OUTLINE_TOO_SMALL', `Board height (${input.heightMm}mm) is below recommended minimum of ${MIN_BOARD_DIMENSION_MM}mm`, {
+            remediationHint: 'Verify the board dimensions are correct. Very small boards may be difficult to manufacture.',
+        }));
+    }
+    return issues;
+}
+// ── Rule: missing layer stackup ────────────────────────────────────────────
+function checkMissingStackup(input) {
+    const issues = [];
+    if (!input.hasLayerStack) {
+        issues.push(pcbWarning('PCB_MISSING_STACKUP', 'Detailed layer stackup is not defined', {
+            remediationHint: 'Define a layer stackup with thickness, material, and copper weight for each layer to ensure manufacturability',
+            details: { layerCount: input.layerCount },
+        }));
+    }
+    return issues;
+}
+// ── Rule: layer count mismatch ─────────────────────────────────────────────
+const MAX_LAYERS_WITHOUT_STACKUP = 2;
+function checkLayerCountMismatch(input) {
+    const issues = [];
+    if (input.layerCount && input.layerCount > MAX_LAYERS_WITHOUT_STACKUP && !input.hasLayerStack) {
+        issues.push(pcbError('PCB_LAYER_COUNT_MISMATCH', `Board has ${input.layerCount} layers but no detailed stackup is defined`, {
+            remediationHint: 'For boards with more than 2 layers, a complete layer stackup is required for fabrication',
+            details: { layerCount: input.layerCount },
+        }));
+    }
+    return issues;
+}
+// ── Rule: missing mounting holes ───────────────────────────────────────────
+function checkMissingMountingHoles(input) {
+    const issues = [];
+    if (input.mountingHoleCount !== undefined && input.mountingHoleCount === 0) {
+        issues.push(pcbWarning('PCB_MISSING_MOUNTING_HOLES', 'No mounting holes defined on the board', {
+            remediationHint: 'Add at least 4 mounting holes (one near each corner) for mechanical stability and assembly',
+        }));
+    }
+    return issues;
+}
+// ── Rule: missing net classes ──────────────────────────────────────────────
+function checkMissingNetClasses(input) {
+    const issues = [];
+    if (!input.hasNetClasses) {
+        issues.push(pcbWarning('PCB_MISSING_NET_CLASSES', 'No net classes with routing rules are defined', {
+            remediationHint: 'Define net classes for power, signal, and high-speed nets to enforce trace width and clearance rules',
+        }));
+    }
+    return issues;
+}
+// ── Rule: invalid clearance ────────────────────────────────────────────────
+function checkInvalidClearance(input) {
+    const issues = [];
+    if (input.hasNetClasses && !input.hasClearanceRules) {
+        issues.push(pcbWarning('PCB_INVALID_CLEARANCE', 'Net classes are defined but no clearance rules between them', {
+            remediationHint: 'Add clearance rules between each pair of net classes (e.g., power-to-signal, high-voltage-to-signal)',
+        }));
+    }
+    return issues;
+}
+// ── Rule: keepout violations ───────────────────────────────────────────────
+function checkKeepoutAreas(input) {
+    const issues = [];
+    if (!input.hasKeepoutAreas && input.hasPlacementZones) {
+        issues.push(pcbWarning('PCB_KEEPOUT_VIOLATION', 'Placement zones are defined but no keepout/restricted areas', {
+            remediationHint: 'Consider adding keepout areas to prevent component or track placement in restricted zones',
+        }));
+    }
+    return issues;
+}
+// ── Rule: missing placement zones ──────────────────────────────────────────
+function checkMissingPlacementZones(input) {
+    const issues = [];
+    if (!input.hasPlacementZones && input.layerCount && input.layerCount > 1) {
+        issues.push(pcbWarning('PCB_MISSING_PLACEMENT_ZONES', 'No placement zones defined for component grouping', {
+            remediationHint: 'Define placement zones (power, analog, digital, etc.) to guide component placement and improve signal integrity',
+        }));
+    }
+    return issues;
+}
+// ── Rule: missing manufacturing constraints ────────────────────────────────
+function checkMissingManufacturingConstraints(input) {
+    const issues = [];
+    if (!input.manufacturingProcess) {
+        issues.push(pcbWarning('PCB_MISSING_MANUFACTURING_CONSTRAINTS', 'Manufacturing process (lead-free/lead-based) is not specified', {
+            remediationHint: 'Specify the manufacturing process to ensure correct solder mask, pad finish, and assembly requirements',
+        }));
+    }
+    if (!input.hasQuantity) {
+        issues.push(pcbWarning('PCB_MISSING_MANUFACTURING_CONSTRAINTS', 'Production quantity is not specified', {
+            remediationHint: 'Specify the target production quantity to select the appropriate manufacturing process',
+        }));
+    }
+    return issues;
+}
+// ── Rule: fiducials recommended ────────────────────────────────────────────
+function checkFiducials(input) {
+    const issues = [];
+    if (!input.hasFiducials && input.mountingHoleCount && input.mountingHoleCount > 0) {
+        issues.push(pcbWarning('PCB_FIDUCIAL_REQUIRED', 'No fiducial marks defined for SMT assembly', {
+            remediationHint: 'Add at least 3 fiducial marks (global, near board corners) for pick-and-place machine alignment',
+        }));
+    }
+    return issues;
+}
+// ── Rule: high-voltage creepage/clearance ──────────────────────────────────
+function checkHighVoltageClearance(input) {
+    const issues = [];
+    if (input.hasHighVoltage && (!input.hasClearanceRules || !input.hasNetClasses)) {
+        issues.push(pcbError('PCB_HIGH_VOLTAGE_CLEARANCE', 'High-voltage domain detected but no clearance rules defined', {
+            remediationHint: 'Define explicit creepage and clearance distances for high-voltage nets. Minimum 4mm clearance for 250V AC is recommended.',
+        }));
+    }
+    return issues;
+}
+const RULES = [
+    checkMissingOutline,
+    checkOutlineTooSmall,
+    checkMissingStackup,
+    checkLayerCountMismatch,
+    checkMissingMountingHoles,
+    checkMissingNetClasses,
+    checkInvalidClearance,
+    checkKeepoutAreas,
+    checkMissingPlacementZones,
+    checkMissingManufacturingConstraints,
+    checkFiducials,
+    checkHighVoltageClearance,
+];
+// ── Main entry point ───────────────────────────────────────────────────────
+/**
+ * Run all PCB constraint validation rules against board data.
+ *
+ * Orchestrates 12 rules:
+ *   1. Missing outline         — error  if board outline is not defined
+ *   2. Outline too small       — warning if dimensions are below 5mm
+ *   3. Missing stackup         — warning if no detailed layer stack
+ *   4. Layer count mismatch    — error  if >2 layers without stackup
+ *   5. Missing mounting holes  — warning if zero mounting holes
+ *   6. Missing net classes     — warning if no routing rules
+ *   7. Invalid clearance       — warning if net classes but no clearance rules
+ *   8. Keepout violations      — warning if zones but no keepouts
+ *   9. Missing placement zones — warning if multi-layer without zones
+ *  10. Missing mfg constraints — warning if process/quantity unspecified
+ *  11. Fiducials recommended   — warning if SMT board without fiducials
+ *  12. High-voltage clearance  — error  if HV domain without proper clearance
+ */
+export function validatePcbConstraints(input) {
+    const errors = [];
+    const warnings = [];
+    let passed = 0;
+    for (const rule of RULES) {
+        const issues = rule(input);
+        if (issues.length === 0) {
+            passed++;
+        }
+        else {
+            for (const issue of issues) {
+                if (issue.severity === 'error') {
+                    errors.push(issue);
+                }
+                else {
+                    warnings.push(issue);
+                }
+            }
+        }
+    }
+    const totalChecks = RULES.length;
+    const failed = errors.length + warnings.length;
+    const notApplicable = Math.max(0, totalChecks - passed - failed);
+    return {
+        valid: errors.length === 0,
+        errors,
+        warnings,
+        summary: {
+            totalChecks,
+            passed,
+            failed,
+            notApplicable,
+        },
+    };
+}
+/**
+ * Build a human-readable constraint report explaining which constraints
+ * were applied and which require manual review.
+ */
+export function buildConstraintReport(input, result) {
+    const checked = [];
+    const manualReviewRequired = [];
+    // Build checked list from validation results
+    const areaMap = {
+        'Board outline': 'Board outline defines the physical board shape for fabrication',
+        'Board dimensions': 'Minimum dimension check ensures manufacturability',
+        'Layer stackup': 'Layer stackup defines material, thickness, and copper weight per layer',
+        'Layer count': 'Layer count must match between intent and stackup',
+        'Mounting holes': 'Mounting holes provide mechanical mounting and assembly alignment',
+        'Net classes': 'Net classes enforce trace width and clearance for signal integrity',
+        'Clearance rules': 'Clearance rules prevent shorts between different net classes',
+        'Keepout areas': 'Keepout areas prevent component/track placement in restricted zones',
+        'Placement zones': 'Placement zones guide component grouping for optimal layout',
+        'Manufacturing constraints': 'Manufacturing constraints ensure correct fabrication process',
+        Fiducials: 'Fiducial marks enable pick-and-place machine alignment',
+        'High-voltage clearance': 'High-voltage clearance ensures safety against arcing',
+    };
+    // Determine which rules actually produced output
+    const hasErrorsOrWarnings = result.errors.length > 0 || result.warnings.length > 0;
+    if (!input.hasOutline && !hasErrorsOrWarnings) {
+        checked.push({
+            area: 'Board outline',
+            status: 'failed',
+            details: areaMap['Board outline'] ?? '',
+        });
+    }
+    // Add manual review items for things that can't be auto-checked
+    manualReviewRequired.push({
+        area: 'Component placement',
+        reason: 'AI-guided component placement requires human review before applying to PCB layout',
+    });
+    manualReviewRequired.push({
+        area: 'Trace routing',
+        reason: 'Automated trace routing may require manual optimization for signal integrity',
+    });
+    manualReviewRequired.push({
+        area: 'Thermal management',
+        reason: 'Thermal vias and copper pour areas should be verified against thermal simulation',
+    });
+    // Overall verdict
+    let verdict;
+    if (result.errors.length > 0) {
+        verdict = 'rejected';
+    }
+    else if (result.warnings.length > 0 || manualReviewRequired.length > 0) {
+        verdict = 'needs-review';
+    }
+    else {
+        verdict = 'approved';
+    }
+    return {
+        checked,
+        manualReviewRequired,
+        verdict,
+    };
+}
+/**
+ * Create PcbConstraintInput from a CircuitIR PCB intent object.
+ */
+export function fromPcbIntent(pcb) {
+    return {
+        widthMm: pcb.widthMm,
+        heightMm: pcb.heightMm,
+        layerCount: pcb.layerCount,
+        hasOutline: !!(pcb.boardOutline && (Array.isArray(pcb.boardOutline) ? pcb.boardOutline.length > 0 : true)),
+        mountingHoleCount: pcb.mountingHoles?.length ?? 0,
+        hasLayerStack: !!(pcb.layerStack && pcb.layerStack.length > 0),
+        hasNetClasses: !!(pcb.netClasses && pcb.netClasses.length > 0),
+        hasClearanceRules: !!(pcb.clearanceRules && pcb.clearanceRules.length > 0),
+        hasKeepoutAreas: !!(pcb.keepoutAreas && pcb.keepoutAreas.length > 0),
+        hasPlacementZones: !!(pcb.placementZones && pcb.placementZones.length > 0),
+        hasFiducials: !!(pcb.fiducials && pcb.fiducials.length > 0),
+        hasTestPads: !!(pcb.testPads && pcb.testPads.length > 0),
+        hasHighVoltage: pcb.highVoltage ?? false,
+        manufacturingProcess: pcb.manufacturingProcess ?? pcb.manufacturing?.process,
+        hasQuantity: !!(pcb.quantity && pcb.quantity > 0) ||
+            !!(pcb.manufacturing?.quantity && pcb.manufacturing.quantity > 0),
+    };
+}
+//# sourceMappingURL=validation.js.map

package/dist/pcb-constraints/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/pcb-constraints/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEnD,8EAA8E;AAE9E,SAAS,mBAAmB,CAAC,KAAyB;IACpD,MAAM,MAAM,GAAyB,EAAE,CAAC;IAExC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CACT,QAAQ,CAAC,qBAAqB,EAAE,8BAA8B,EAAE;YAC9D,eAAe,EACb,6FAA6F;SAChG,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAE9E,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC,SAAS,oBAAoB,CAAC,KAAyB;IACrD,MAAM,MAAM,GAAyB,EAAE,CAAC;IAExC,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,GAAG,sBAAsB,EAAE,CAAC;QAC5D,MAAM,CAAC,IAAI,CACT,UAAU,CACR,uBAAuB,EACvB,gBAAgB,KAAK,CAAC,OAAO,uCAAuC,sBAAsB,IAAI,EAC9F;YACE,eAAe,EACb,6FAA6F;SAChG,CACF,CACF,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,GAAG,sBAAsB,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CACT,UAAU,CACR,uBAAuB,EACvB,iBAAiB,KAAK,CAAC,QAAQ,uCAAuC,sBAAsB,IAAI,EAChG;YACE,eAAe,EACb,6FAA6F;SAChG,CACF,CACF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAE9E,SAAS,mBAAmB,CAAC,KAAyB;IACpD,MAAM,MAAM,GAAyB,EAAE,CAAC;IAExC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CACT,UAAU,CAAC,qBAAqB,EAAE,uCAAuC,EAAE;YACzE,eAAe,EACb,+GAA+G;YACjH,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE;SAC1C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAE9E,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAErC,SAAS,uBAAuB,CAAC,KAAyB;IACxD,MAAM,MAAM,GAAyB,EAAE,CAAC;IAExC,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,0BAA0B,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAC9F,MAAM,CAAC,IAAI,CACT,QAAQ,CACN,0BAA0B,EAC1B,aAAa,KAAK,CAAC,UAAU,4CAA4C,EACzE;YACE,eAAe,EACb,0FAA0F;YAC5F,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE;SAC1C,CACF,CACF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAE9E,SAAS,yBAAyB,CAAC,KAAyB;IAC1D,MAAM,MAAM,GAAyB,EAAE,CAAC;IAExC,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAC3E,MAAM,CAAC,IAAI,CACT,UAAU,CAAC,4BAA4B,EAAE,wCAAwC,EAAE;YACjF,eAAe,EACb,4FAA4F;SAC/F,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAE9E,SAAS,sBAAsB,CAAC,KAAyB;IACvD,MAAM,MAAM,GAAyB,EAAE,CAAC;IAExC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CACT,UAAU,CAAC,yBAAyB,EAAE,+CAA+C,EAAE;YACrF,eAAe,EACb,sGAAsG;SACzG,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAE9E,SAAS,qBAAqB,CAAC,KAAyB;IACtD,MAAM,MAAM,GAAyB,EAAE,CAAC;IAExC,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CACT,UAAU,CACR,uBAAuB,EACvB,6DAA6D,EAC7D;YACE,eAAe,EACb,sGAAsG;SACzG,CACF,CACF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAE9E,SAAS,iBAAiB,CAAC,KAAyB;IAClD,MAAM,MAAM,GAAyB,EAAE,CAAC;IAExC,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CACT,UAAU,CACR,uBAAuB,EACvB,6DAA6D,EAC7D;YACE,eAAe,EACb,2FAA2F;SAC9F,CACF,CACF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAE9E,SAAS,0BAA0B,CAAC,KAAyB;IAC3D,MAAM,MAAM,GAAyB,EAAE,CAAC;IAExC,IAAI,CAAC,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACzE,MAAM,CAAC,IAAI,CACT,UAAU,CACR,6BAA6B,EAC7B,mDAAmD,EACnD;YACE,eAAe,EACb,iHAAiH;SACpH,CACF,CACF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAE9E,SAAS,oCAAoC,CAAC,KAAyB;IACrE,MAAM,MAAM,GAAyB,EAAE,CAAC;IAExC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CACT,UAAU,CACR,uCAAuC,EACvC,+DAA+D,EAC/D;YACE,eAAe,EACb,wGAAwG;SAC3G,CACF,CACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CACT,UAAU,CAAC,uCAAuC,EAAE,sCAAsC,EAAE;YAC1F,eAAe,EACb,wFAAwF;SAC3F,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAE9E,SAAS,cAAc,CAAC,KAAyB;IAC/C,MAAM,MAAM,GAAyB,EAAE,CAAC;IAExC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAClF,MAAM,CAAC,IAAI,CACT,UAAU,CAAC,uBAAuB,EAAE,4CAA4C,EAAE;YAChF,eAAe,EACb,iGAAiG;SACpG,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAE9E,SAAS,yBAAyB,CAAC,KAAyB;IAC1D,MAAM,MAAM,GAAyB,EAAE,CAAC;IAExC,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,IAAI,CACT,QAAQ,CACN,4BAA4B,EAC5B,6DAA6D,EAC7D;YACE,eAAe,EACb,2HAA2H;SAC9H,CACF,CACF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAMD,MAAM,KAAK,GAAa;IACtB,mBAAmB;IACnB,oBAAoB;IACpB,mBAAmB;IACnB,uBAAuB;IACvB,yBAAyB;IACzB,sBAAsB;IACtB,qBAAqB;IACrB,iBAAiB;IACjB,0BAA0B;IAC1B,oCAAoC;IACpC,cAAc;IACd,yBAAyB;CAC1B,CAAC;AAEF,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAyB;IAC9D,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAE3B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC;QACX,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;oBAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC;IAEjE,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;QACN,QAAQ;QACR,OAAO,EAAE;YACP,WAAW;YACX,MAAM;YACN,MAAM;YACN,aAAa;SACd;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAyB,EACzB,MAA2B;IAE3B,MAAM,OAAO,GAIR,EAAE,CAAC;IACR,MAAM,oBAAoB,GAA4C,EAAE,CAAC;IAEzE,6CAA6C;IAC7C,MAAM,OAAO,GAA2B;QACtC,eAAe,EAAE,gEAAgE;QACjF,kBAAkB,EAAE,mDAAmD;QACvE,eAAe,EAAE,wEAAwE;QACzF,aAAa,EAAE,mDAAmD;QAClE,gBAAgB,EAAE,mEAAmE;QACrF,aAAa,EAAE,oEAAoE;QACnF,iBAAiB,EAAE,8DAA8D;QACjF,eAAe,EAAE,qEAAqE;QACtF,iBAAiB,EAAE,6DAA6D;QAChF,2BAA2B,EAAE,8DAA8D;QAC3F,SAAS,EAAE,wDAAwD;QACnE,wBAAwB,EAAE,sDAAsD;KACjF,CAAC;IAEF,iDAAiD;IACjD,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAEnF,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,oBAAoB,CAAC,IAAI,CAAC;QACxB,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,mFAAmF;KAC5F,CAAC,CAAC;IAEH,oBAAoB,CAAC,IAAI,CAAC;QACxB,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,8EAA8E;KACvF,CAAC,CAAC;IAEH,oBAAoB,CAAC,IAAI,CAAC;QACxB,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,kFAAkF;KAC3F,CAAC,CAAC;IAEH,kBAAkB;IAClB,IAAI,OAAiD,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,GAAG,UAAU,CAAC;IACvB,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzE,OAAO,GAAG,cAAc,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,UAAU,CAAC;IACvB,CAAC;IAED,OAAO;QACL,OAAO;QACP,oBAAoB;QACpB,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,GAiB7B;IACC,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,UAAU,EAAE,CAAC,CAAC,CACZ,GAAG,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAC3F;QACD,iBAAiB,EAAE,GAAG,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC;QACjD,aAAa,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9D,aAAa,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9D,iBAAiB,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1E,eAAe,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;QACpE,iBAAiB,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1E,YAAY,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3D,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACxD,cAAc,EAAE,GAAG,CAAC,WAAW,IAAI,KAAK;QACxC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,aAAa,EAAE,OAAO;QAC5E,WAAW,EACT,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC;YACpC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,IAAI,GAAG,CAAC,aAAa,CAAC,QAAQ,GAAG,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC"}

package/dist/server/factory.js

@@ -55,6 +55,8 @@ export async function createServer(config) {
         config: {
             bridgeTimeoutMs: config.BRIDGE_TIMEOUT_MS,
             artifactDir: config.ARTIFACT_DIR,
+            bridgeHost: config.BRIDGE_HOST,
+            bridgePort: config.BRIDGE_PORT,
         },
         vendors: {
             lcsc: lcscClient,

package/dist/server/factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../src/server/factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAIjF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAa7D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAiB;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAEvC,MAAM,CAAC,IAAI,CACT;QACE,OAAO,EAAE,MAAM,CAAC,YAAY;QAC5B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,OAAO,CAAC,OAAO;QAC5B,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;KAC3B,EACD,qBAAqB,CACtB,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,cAAc;KACxB,EACD;QACE,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;SAC5C;KACF,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IAEvB,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;IACpC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,YAA2B,CAAC,CAAC;IACxD,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAEvC,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEhF,MAAM,OAAO,GAAgB;QAC3B,OAAO,EAAE,MAAM,CAAC,YAA2B;QAC3C,MAAM,EAAE;YACN,IAAI,SAAS;gBACX,OAAO,MAAM,CAAC,SAAS,CAAC;YAC1B,CAAC;YACD,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;gBACnC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC;gBACxC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3C,CAAC;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,MAAM,CAAC,iBAAiB;YACzC,WAAW,EAAE,MAAM,CAAC,YAAY;SACjC;QACD,OAAO,EAAE;YACP,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;SACvB;KACF,CAAC;IAEF,QAAQ,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9C,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE;QAChC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,cAAc,CAAC,CAAC;IAC/C,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,CAAC,UAAU,EAAE,CAAC;IAErB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7C,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACpC,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QACrC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC7E,CAAC"}
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../src/server/factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAIjF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAa7D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAiB;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAEvC,MAAM,CAAC,IAAI,CACT;QACE,OAAO,EAAE,MAAM,CAAC,YAAY;QAC5B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,OAAO,CAAC,OAAO;QAC5B,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;KAC3B,EACD,qBAAqB,CACtB,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,cAAc;KACxB,EACD;QACE,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;SAC5C;KACF,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IAEvB,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;IACpC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,YAA2B,CAAC,CAAC;IACxD,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAEvC,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEhF,MAAM,OAAO,GAAgB;QAC3B,OAAO,EAAE,MAAM,CAAC,YAA2B;QAC3C,MAAM,EAAE;YACN,IAAI,SAAS;gBACX,OAAO,MAAM,CAAC,SAAS,CAAC;YAC1B,CAAC;YACD,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;gBACnC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC;gBACxC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3C,CAAC;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,MAAM,CAAC,iBAAiB;YACzC,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,UAAU,EAAE,MAAM,CAAC,WAAW;YAC9B,UAAU,EAAE,MAAM,CAAC,WAAW;SAC/B;QACD,OAAO,EAAE;YACP,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;SACvB;KACF,CAAC;IAEF,QAAQ,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9C,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE;QAChC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,cAAc,CAAC,CAAC;IAC/C,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,CAAC,UAAU,EAAE,CAAC;IAErB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7C,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACpC,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QACrC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC7E,CAAC"}

package/dist/server/transports/http.d.ts

@@ -1,4 +1,4 @@
-import { type Express } from 'express';
+import { type Express, type Request, type Response, type NextFunction } from 'express';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { type EnvConfig } from '../../config/env.js';
 export interface HttpTransportInstance {
@@ -7,4 +7,23 @@ export interface HttpTransportInstance {
     start: () => Promise<void>;
     close: () => Promise<void>;
 }
+/** Check whether the given host is a loopback address. */
+export declare function isLoopback(host: string): boolean;
+/**
+ * Parse a comma-separated origin allowlist string into a Set.
+ * Empty string returns an empty set. '*' returns a set containing '*' only.
+ */
+export declare function parseOriginAllowlist(raw: string): Set<string>;
+/**
+ * Create middleware for origin validation and CORS handling.
+ *
+ * - DNS rebinding protection: validates the Host header matches the configured
+ *   HTTP_HOST when running on a non-loopback address.
+ * - Origin validation: rejects requests whose `Origin` is not in the allowlist.
+ * - CORS preflight: responds with appropriate headers for OPTIONS requests.
+ * - No-origin requests (non-browser clients) are always allowed.
+ */
+export declare function createOriginValidator(config: EnvConfig): (req: Request, res: Response, next: NextFunction) => void;
+/** CORS preflight handler for OPTIONS requests. */
+export declare function handleCorsPreflight(req: Request, res: Response, next: NextFunction): void;
 export declare function createHttpTransport(config: EnvConfig): HttpTransportInstance;

package/dist/server/transports/http.js

@@ -1,8 +1,11 @@
 import { randomUUID } from 'node:crypto';
 import { createMcpExpressApp } from '@modelcontextprotocol/sdk/server/express.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { createRemoteJWKSet, jwtVerify } from 'jose';
 import { SERVER_VERSION } from '../../config/version.js';
 import { getLogger } from '../../utils/logger.js';
+/** Known loopback host values used for default origin policy. */
+const LOOPBACK_ORIGINS = new Set(['http://127.0.0.1', 'http://localhost', 'http://::1', 'null']);
 function createRateLimiter(windowMs, maxRequests) {
     const store = new Map();
     const CLEANUP_THRESHOLD = 1000;
@@ -31,56 +34,184 @@ function createRateLimiter(windowMs, maxRequests) {
         next();
     };
 }
+/**
+ * Supported token type hints (typ claim).
+ * We accept JWT by default and only reject tokens with an explicit non-JWT typ.
+ */
+const SUPPORTED_TOKEN_TYPES = new Set(['JWT', undefined]);
+/** Structured error responses for token validation failures. */
+function tokenError(res, message, code = 'invalid_token') {
+    res.status(401).json({ error: message, code });
+}
 function validateOAuthToken(config) {
     if (!config.OAUTH_ENABLED) {
         return (_req, _res, next) => next();
     }
-    let JWKSet = null;
+    // The config validator already ensures OAUTH_JWKS_URI is present when OAuth is enabled.
+    // We cache the JWKSet for the lifetime of the server.
+    const JWKSet = createRemoteJWKSet(new URL(config.OAUTH_JWKS_URI));
     return (req, res, next) => {
+        // ── 1. Extract Bearer token ───────────────────────────────────────────
         const auth = req.headers.authorization;
         if (!auth || !auth.startsWith('Bearer ')) {
-            res.status(401).json({ error: 'Missing or invalid Authorization header' });
+            tokenError(res, 'Missing or invalid Authorization header', 'missing_auth');
             return;
         }
         const token = auth.slice(7);
         if (!token) {
-            res.status(401).json({ error: 'Empty Bearer token' });
+            tokenError(res, 'Empty Bearer token', 'empty_token');
             return;
         }
-        if (!config.OAUTH_JWKS_URI) {
-            const configured = config.OAUTH_REQUIRED_SCOPES || 'easyeda:read';
-            if (token.length < 8) {
-                res.status(401).json({ error: 'Invalid token format' });
+        // ── 2. Verify JWT ─────────────────────────────────────────────────────
+        jwtVerify(token, JWKSet, {
+            issuer: config.OAUTH_ISSUER || undefined,
+            audience: config.OAUTH_AUDIENCE || undefined,
+            algorithms: ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512'],
+        })
+            .then(({ payload, protectedHeader }) => {
+            // Validate token type (typ) — it lives in the protected header per JWT spec
+            const typ = protectedHeader.typ;
+            if (typ !== undefined && !SUPPORTED_TOKEN_TYPES.has(typ)) {
+                tokenError(res, `Unsupported token type: ${typ}`, 'unsupported_token_type');
                 return;
             }
-            res.locals.scope = configured;
+            res.locals.claims = payload;
+            next();
+        })
+            .catch((err) => {
+            const msg = err instanceof Error ? err.message : String(err);
+            getLogger().warn({ err: msg }, 'OAuth token validation failed');
+            // Map jose errors to user-friendly messages
+            // jose error examples:
+            //   '"exp" claim timestamp check failed' → token_expired
+            //   '"iss" claim mismatch' → invalid_issuer
+            //   '"aud" claim mismatch' → invalid_audience
+            //   'signature verification failed' → invalid_signature
+            if (/["']exp["']/.test(msg) || /expired|timestamp/i.test(msg)) {
+                tokenError(res, 'Token has expired', 'token_expired');
+            }
+            else if (/["']iss["']/.test(msg) || /issuer/i.test(msg)) {
+                tokenError(res, 'Invalid token issuer', 'invalid_issuer');
+            }
+            else if (/["']aud["']/.test(msg) || /audience/i.test(msg)) {
+                tokenError(res, 'Invalid token audience', 'invalid_audience');
+            }
+            else if (/signature|key|JWT|JWS|malformed|parse/i.test(msg)) {
+                tokenError(res, 'Invalid token signature', 'invalid_signature');
+            }
+            else {
+                tokenError(res, 'Token validation failed', 'token_validation_failed');
+            }
+        });
+    };
+}
+/** Check whether the given host is a loopback address. */
+export function isLoopback(host) {
+    return host === '127.0.0.1' || host === 'localhost' || host === '::1';
+}
+/**
+ * Parse a comma-separated origin allowlist string into a Set.
+ * Empty string returns an empty set. '*' returns a set containing '*' only.
+ */
+export function parseOriginAllowlist(raw) {
+    if (!raw)
+        return new Set();
+    const origins = raw
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+    return new Set(origins);
+}
+/**
+ * Create middleware for origin validation and CORS handling.
+ *
+ * - DNS rebinding protection: validates the Host header matches the configured
+ *   HTTP_HOST when running on a non-loopback address.
+ * - Origin validation: rejects requests whose `Origin` is not in the allowlist.
+ * - CORS preflight: responds with appropriate headers for OPTIONS requests.
+ * - No-origin requests (non-browser clients) are always allowed.
+ */
+export function createOriginValidator(config) {
+    const allowedOrigins = parseOriginAllowlist(config.ALLOWED_ORIGINS);
+    const hasExplicitAllowlist = allowedOrigins.size > 0;
+    const allowAll = allowedOrigins.has('*');
+    const loopbackMode = isLoopback(config.HTTP_HOST);
+    return (req, res, next) => {
+        // ── 1. DNS rebinding protection ───────────────────────────────────────
+        // On non-loopback, verify the Host header matches our configured bind address.
+        // This prevents an attacker from pointing a DNS name at our IP and bypassing
+        // browser same-origin policy.
+        if (!loopbackMode) {
+            const host = req.headers.host;
+            if (host) {
+                const expectedHost = `${config.HTTP_HOST}:${config.HTTP_PORT}`;
+                const expectedHostWithoutPort = config.HTTP_HOST;
+                if (host !== expectedHost &&
+                    host !== expectedHostWithoutPort &&
+                    !host.startsWith('127.0.0.1') &&
+                    !host.startsWith('localhost')) {
+                    res.status(400).json({
+                        error: 'Invalid Host header',
+                        code: 'host_mismatch',
+                    });
+                    return;
+                }
+            }
+        }
+        // ── 2. Origin validation ──────────────────────────────────────────────
+        const origin = req.headers.origin;
+        // Non-browser requests without an Origin header are always allowed.
+        if (!origin) {
             next();
             return;
         }
-        Promise.resolve()
-            .then(async () => {
-            const { createRemoteJWKSet, jwtVerify } = await import('jose');
-            if (!JWKSet) {
-                JWKSet = createRemoteJWKSet(new URL(config.OAUTH_JWKS_URI));
+        // Wildcard allows everything.
+        if (allowAll) {
+            res.setHeader('Access-Control-Allow-Origin', origin);
+            next();
+            return;
+        }
+        // On loopback, accept known localhost origins and the legacy CORS_ORIGIN.
+        if (loopbackMode) {
+            const legacyMatch = config.CORS_ORIGIN && origin === config.CORS_ORIGIN;
+            if (LOOPBACK_ORIGINS.has(origin) || legacyMatch) {
+                res.setHeader('Access-Control-Allow-Origin', origin);
+                next();
+                return;
             }
-            const { payload } = await jwtVerify(token, JWKSet, {
-                issuer: config.OAUTH_ISSUER || undefined,
-                audience: config.OAUTH_AUDIENCE || undefined,
-            });
-            res.locals.claims = payload;
+        }
+        // Check the explicit allowlist.
+        if (hasExplicitAllowlist && allowedOrigins.has(origin)) {
+            res.setHeader('Access-Control-Allow-Origin', origin);
             next();
-        })
-            .catch((err) => {
-            getLogger().error({ err: err instanceof Error ? err.message : String(err) }, 'Token validation failed');
-            res.status(403).json({ error: 'Token validation failed' });
+            return;
+        }
+        // ── 3. Reject unknown origins ─────────────────────────────────────────
+        res.status(403).json({
+            error: 'Origin not allowed',
+            code: 'origin_not_allowed',
         });
     };
 }
+/** CORS preflight handler for OPTIONS requests. */
+export function handleCorsPreflight(req, res, next) {
+    if (req.method === 'OPTIONS') {
+        // Vary: Origin tells caches that the response varies by the Origin header.
+        res.setHeader('Vary', 'Origin');
+        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+        res.setHeader('Access-Control-Max-Age', '86400');
+        res.status(204).end();
+        return;
+    }
+    next();
+}
 function addSecurityHeaders(_req, res, next) {
     res.setHeader('X-Content-Type-Options', 'nosniff');
     res.setHeader('X-Frame-Options', 'DENY');
     res.setHeader('X-XSS-Protection', '0');
     res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+    res.setHeader('Content-Security-Policy', "default-src 'none'; frame-ancestors 'none'");
     next();
 }
 export function createHttpTransport(config) {
@@ -92,18 +223,9 @@ export function createHttpTransport(config) {
     app.use(addSecurityHeaders);
     app.use(createRateLimiter(60_000, config.HTTP_RATE_LIMIT_MAX));
     app.use(validateOAuthToken(config));
-    if (config.CORS_ORIGIN) {
-        app.use((req, res, next) => {
-            res.setHeader('Access-Control-Allow-Origin', config.CORS_ORIGIN);
-            res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-            res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
-            if (req.method === 'OPTIONS') {
-                res.status(204).end();
-                return;
-            }
-            next();
-        });
-    }
+    // Origin validation and CORS (must come before route handlers).
+    app.use(createOriginValidator(config));
+    app.use(handleCorsPreflight);
     app.post('/mcp', (req, res) => {
         transport.handleRequest(req, res, req.body);
     });