enpilink 1.0.2

package/dist/server/index.js

@@ -0,0 +1,14 @@
+export { AdminTokenMissingError, adminAuthMiddleware, adminEnabled, ensureAdminStorage, mountAdmin, readAdminToken, } from "./admin.js";
+export { analyticsEnabled, installAnalytics, mockEnabled, } from "./analytics.js";
+export { InvalidTokenError, mcpAuthMetadataRouter, optionalBearerAuth, requireBearerAuth, } from "./auth.js";
+export { allKeyMeta, BOOTSTRAP_KEYS, bootstrapSchema, configSchema, createConfigRouter, ENV_VARS, isBootstrapKey, isKnownKey, isRuntimeKey, isSecretKey, keyMeta, loadConfigFile, MASKED, RUNTIME_KEYS, resolveConfig, runtimeSchema, SECRET_KEYS, validateRuntimeWrite, } from "./config/index.js";
+export { audio, embeddedResource, image, resourceLink, text, } from "./content-helpers.js";
+export { FileRef } from "./file-ref.js";
+export { getActiveStorage, serverLog } from "./log-sink.js";
+export { generateMockEvents, generateMockLogs, MOCK_SEED, mulberry32, seedMockData, } from "./mock-seed.js";
+export { createObservabilityRouter, percentile, summarize, } from "./observability.js";
+export { createOtelSink, initOtel, otelEnabled, otelEndpoint, } from "./otel.js";
+export { __setBuildManifest, McpServer, normalizeContent, } from "./server.js";
+export { DEFAULT_DB_PATH, DEFAULT_MEMORY_CAP, MemoryStorageAdapter, PostgresStorageAdapter, registerStorageAdapter, resolvePostgresConnectionString, resolveStorageAdapter, SqliteStorageAdapter, } from "./storage/index.js";
+export { viewsDevServer } from "./viewsDevServer.js";
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gBAAgB,EAEhB,gBAAgB,EAChB,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAIL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,UAAU,EACV,cAAc,EAGd,eAAe,EAIf,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,cAAc,EACd,UAAU,EACV,YAAY,EACZ,WAAW,EAEX,OAAO,EACP,cAAc,EACd,MAAM,EAGN,YAAY,EAGZ,aAAa,EACb,aAAa,EACb,WAAW,EACX,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,EACL,gBAAgB,EAChB,KAAK,EACL,YAAY,EACZ,IAAI,GACL,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AASxC,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAU5D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,SAAS,EAET,UAAU,EACV,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EAKzB,UAAU,EAEV,SAAS,GAGV,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,QAAQ,EAER,WAAW,EACX,YAAY,GACb,MAAM,WAAW,CAAC;AAcnB,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EAEpB,sBAAsB,EAEtB,sBAAsB,EACtB,+BAA+B,EAC/B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAW5B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC","sourcesContent":["export {\n  AdminTokenMissingError,\n  adminAuthMiddleware,\n  adminEnabled,\n  ensureAdminStorage,\n  mountAdmin,\n  readAdminToken,\n} from \"./admin.js\";\nexport {\n  analyticsEnabled,\n  type InstallAnalyticsOptions,\n  installAnalytics,\n  mockEnabled,\n} from \"./analytics.js\";\nexport {\n  type AuthInfo,\n  type AuthMetadataOptions,\n  type BearerAuthMiddlewareOptions,\n  InvalidTokenError,\n  mcpAuthMetadataRouter,\n  optionalBearerAuth,\n  requireBearerAuth,\n} from \"./auth.js\";\nexport {\n  allKeyMeta,\n  BOOTSTRAP_KEYS,\n  type BootstrapConfig,\n  type BootstrapKey,\n  bootstrapSchema,\n  type Config,\n  type ConfigKey,\n  type ConfigSource,\n  configSchema,\n  createConfigRouter,\n  ENV_VARS,\n  isBootstrapKey,\n  isKnownKey,\n  isRuntimeKey,\n  isSecretKey,\n  type KeyMeta,\n  keyMeta,\n  loadConfigFile,\n  MASKED,\n  type ResolvedConfig,\n  type ResolvedSetting,\n  RUNTIME_KEYS,\n  type RuntimeConfig,\n  type RuntimeKey,\n  resolveConfig,\n  runtimeSchema,\n  SECRET_KEYS,\n  validateRuntimeWrite,\n} from \"./config/index.js\";\nexport {\n  audio,\n  embeddedResource,\n  image,\n  resourceLink,\n  text,\n} from \"./content-helpers.js\";\nexport { FileRef } from \"./file-ref.js\";\nexport type {\n  AnyToolRegistry,\n  InferTools,\n  ToolInput,\n  ToolNames,\n  ToolOutput,\n  ToolResponseMetadata,\n} from \"./inferUtilityTypes.js\";\nexport { getActiveStorage, serverLog } from \"./log-sink.js\";\nexport type {\n  McpExtra,\n  McpMethodString,\n  McpMiddlewareFilter,\n  McpMiddlewareFn,\n  McpResultFor,\n  McpTypedMiddlewareFn,\n  McpWildcard,\n} from \"./middleware.js\";\nexport {\n  generateMockEvents,\n  generateMockLogs,\n  MOCK_SEED,\n  type MockSeedOptions,\n  mulberry32,\n  seedMockData,\n} from \"./mock-seed.js\";\nexport {\n  createObservabilityRouter,\n  type LatencyBucket,\n  type MethodStat,\n  type ObservabilityDisabled,\n  type ObservabilitySummary,\n  percentile,\n  type SummarizeOptions,\n  summarize,\n  type TimeBucket,\n  type ToolStat,\n} from \"./observability.js\";\nexport {\n  createOtelSink,\n  initOtel,\n  type OtelSink,\n  otelEnabled,\n  otelEndpoint,\n} from \"./otel.js\";\nexport type {\n  HandlerContent,\n  KnownToolMeta,\n  McpServerTypes,\n  SecurityScheme,\n  ToolDef,\n  ToolMeta,\n  ViewConfig,\n  ViewCsp,\n  ViewHostType,\n  ViewName,\n  ViewNameRegistry,\n} from \"./server.js\";\nexport {\n  __setBuildManifest,\n  McpServer,\n  normalizeContent,\n} from \"./server.js\";\nexport {\n  DEFAULT_DB_PATH,\n  DEFAULT_MEMORY_CAP,\n  MemoryStorageAdapter,\n  type PgPoolLike,\n  PostgresStorageAdapter,\n  type PostgresStorageOptions,\n  registerStorageAdapter,\n  resolvePostgresConnectionString,\n  resolveStorageAdapter,\n  SqliteStorageAdapter,\n} from \"./storage/index.js\";\nexport type {\n  AnalyticsEvent,\n  ConfigAuditEntry,\n  EventQuery,\n  LogEntry,\n  LogQuery,\n  StorageAdapter,\n  StorageAdapterFactory,\n  StorageAdapterOptions,\n} from \"./storage/types.js\";\nexport { viewsDevServer } from \"./viewsDevServer.js\";\n"]}

package/dist/server/inferUtilityTypes.d.ts

@@ -0,0 +1,64 @@
+import type { McpServerTypes, ToolDef } from "./server.js";
+/**
+ * Any tool registry shape (includes both views and regular tools).
+ * Used as a constraint for type parameters that accept tool registries.
+ */
+export type AnyToolRegistry = Record<string, ToolDef>;
+/**
+ * Extract the tool registry type from an McpServer instance.
+ * This includes both views (registered via view()) and regular tools (registered via registerTool()).
+ *
+ * Uses the `$types` property pattern for cross-package type inference.
+ * This works across package boundaries because TypeScript uses structural typing
+ * on the shape of `$types`, rather than nominal typing on the McpServer class itself.
+ *
+ * @example
+ * ```ts
+ * type MyTools = InferTools<MyServer>;
+ * // { "search": ToolDef<...>, "calculate": ToolDef<...> }
+ * ```
+ */
+export type InferTools<ServerType> = ServerType extends {
+    $types: McpServerTypes<infer W>;
+} ? W : never;
+type ExtractTool<ServerType, K extends ToolNames<ServerType>> = InferTools<ServerType>[K];
+/**
+ * Get a union of all tool names from an McpServer instance.
+ * This includes both views and regular tools.
+ *
+ * @example
+ * ```ts
+ * type Names = ToolNames<MyServer>;
+ * // "search" | "calculate" | "details"
+ * ```
+ */
+export type ToolNames<ServerType> = keyof InferTools<ServerType> & string;
+/**
+ * Get the input type for a specific tool (view or regular tool).
+ *
+ * @example
+ * ```ts
+ * type SearchInput = ToolInput<MyServer, "search">;
+ * ```
+ */
+export type ToolInput<ServerType, ToolName extends ToolNames<ServerType>> = ExtractTool<ServerType, ToolName>["input"];
+/**
+ * Get the output type for a specific tool (view or regular tool).
+ *
+ * @example
+ * ```ts
+ * type SearchOutput = ToolOutput<MyServer, "search">;
+ * ```
+ */
+export type ToolOutput<ServerType, ToolName extends ToolNames<ServerType>> = ExtractTool<ServerType, ToolName>["output"];
+/**
+ * Get the responseMetadata type for a specific tool (view or regular tool).
+ * This is inferred from the `_meta` property of the tool callback's return value.
+ *
+ * @example
+ * ```ts
+ * type SearchMeta = ToolResponseMetadata<MyServer, "search">;
+ * ```
+ */
+export type ToolResponseMetadata<ServerType, ToolName extends ToolNames<ServerType>> = ExtractTool<ServerType, ToolName>["responseMetadata"];
+export {};

package/dist/server/inferUtilityTypes.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=inferUtilityTypes.js.map

package/dist/server/inferUtilityTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inferUtilityTypes.js","sourceRoot":"","sources":["../../src/server/inferUtilityTypes.ts"],"names":[],"mappings":"","sourcesContent":["import type { McpServerTypes, ToolDef } from \"./server.js\";\n\n/**\n * Any tool registry shape (includes both views and regular tools).\n * Used as a constraint for type parameters that accept tool registries.\n */\nexport type AnyToolRegistry = Record<string, ToolDef>;\n\n/**\n * Extract the tool registry type from an McpServer instance.\n * This includes both views (registered via view()) and regular tools (registered via registerTool()).\n *\n * Uses the `$types` property pattern for cross-package type inference.\n * This works across package boundaries because TypeScript uses structural typing\n * on the shape of `$types`, rather than nominal typing on the McpServer class itself.\n *\n * @example\n * ```ts\n * type MyTools = InferTools<MyServer>;\n * // { \"search\": ToolDef<...>, \"calculate\": ToolDef<...> }\n * ```\n */\nexport type InferTools<ServerType> = ServerType extends {\n  $types: McpServerTypes<infer W>;\n}\n  ? W\n  : never;\ntype ExtractTool<\n  ServerType,\n  K extends ToolNames<ServerType>,\n> = InferTools<ServerType>[K];\n\n/**\n * Get a union of all tool names from an McpServer instance.\n * This includes both views and regular tools.\n *\n * @example\n * ```ts\n * type Names = ToolNames<MyServer>;\n * // \"search\" | \"calculate\" | \"details\"\n * ```\n */\nexport type ToolNames<ServerType> = keyof InferTools<ServerType> & string;\n\n/**\n * Get the input type for a specific tool (view or regular tool).\n *\n * @example\n * ```ts\n * type SearchInput = ToolInput<MyServer, \"search\">;\n * ```\n */\nexport type ToolInput<\n  ServerType,\n  ToolName extends ToolNames<ServerType>,\n> = ExtractTool<ServerType, ToolName>[\"input\"];\n\n/**\n * Get the output type for a specific tool (view or regular tool).\n *\n * @example\n * ```ts\n * type SearchOutput = ToolOutput<MyServer, \"search\">;\n * ```\n */\nexport type ToolOutput<\n  ServerType,\n  ToolName extends ToolNames<ServerType>,\n> = ExtractTool<ServerType, ToolName>[\"output\"];\n\n/**\n * Get the responseMetadata type for a specific tool (view or regular tool).\n * This is inferred from the `_meta` property of the tool callback's return value.\n *\n * @example\n * ```ts\n * type SearchMeta = ToolResponseMetadata<MyServer, \"search\">;\n * ```\n */\nexport type ToolResponseMetadata<\n  ServerType,\n  ToolName extends ToolNames<ServerType>,\n> = ExtractTool<ServerType, ToolName>[\"responseMetadata\"];\n"]}

package/dist/server/log-sink.d.ts

@@ -0,0 +1,16 @@
+import type { LogEntry, StorageAdapter } from "./storage/types.js";
+/** Set the active storage instance (called by `installAnalytics`). */
+export declare function setActiveStorage(storage: StorageAdapter | null): void;
+/**
+ * The active {@link StorageAdapter} for this process, or `null` when analytics
+ * is disabled / before startup. M3's observability API should read from this
+ * (or the equivalent `server.storage` getter) so it sees exactly the data the
+ * server writes.
+ */
+export declare function getActiveStorage(): StorageAdapter | null;
+/**
+ * The framework's server-log hook. Prints to the console as usual AND, when an
+ * active storage is set, mirrors the line to `storage.appendLog` without
+ * blocking and swallowing any error.
+ */
+export declare function serverLog(level: LogEntry["level"], msg: string, data?: unknown): void;

package/dist/server/log-sink.js

@@ -0,0 +1,66 @@
+/**
+ * Log capture sink (M2) + shared active-storage holder.
+ *
+ * The module keeps a single process-wide reference to the active
+ * {@link StorageAdapter} (set by `installAnalytics` at startup, cleared on
+ * shutdown). This is the in-process handoff the observability API (M3) reads
+ * from — see {@link getActiveStorage} and the `McpServer.storage` getter.
+ *
+ * {@link serverLog} is the minimal, surgical logging hook the framework uses to
+ * mirror its own logs to storage IN ADDITION to printing them. It is cheap,
+ * async (fire-and-forget), and error-swallowing — log capture must never break
+ * or slow the server, and when analytics is OFF there is no active storage so
+ * it is a plain `console.*` call with no extra cost.
+ */
+let activeStorage = null;
+/** Set the active storage instance (called by `installAnalytics`). */
+export function setActiveStorage(storage) {
+    activeStorage = storage;
+}
+/**
+ * The active {@link StorageAdapter} for this process, or `null` when analytics
+ * is disabled / before startup. M3's observability API should read from this
+ * (or the equivalent `server.storage` getter) so it sees exactly the data the
+ * server writes.
+ */
+export function getActiveStorage() {
+    return activeStorage;
+}
+/** Map a log level to the name of the `console` method to print with. */
+const CONSOLE_METHOD = {
+    debug: "debug",
+    info: "info",
+    warning: "warn",
+    error: "error",
+};
+/**
+ * The framework's server-log hook. Prints to the console as usual AND, when an
+ * active storage is set, mirrors the line to `storage.appendLog` without
+ * blocking and swallowing any error.
+ */
+export function serverLog(level, msg, data) {
+    // Resolve the console method by name at call time so test spies / runtime
+    // console replacements are honored (binding the ref at module init would not).
+    const method = CONSOLE_METHOD[level] ?? "log";
+    if (data !== undefined) {
+        console[method](msg, data);
+    }
+    else {
+        console[method](msg);
+    }
+    const storage = activeStorage;
+    if (!storage) {
+        return;
+    }
+    // Fire-and-forget; never block the caller; never throw.
+    void appendSafely(storage, { ts: Date.now(), level, msg, data });
+}
+async function appendSafely(storage, entry) {
+    try {
+        await storage.appendLog(entry);
+    }
+    catch {
+        // Log capture must never break or slow the server.
+    }
+}
+//# sourceMappingURL=log-sink.js.map

package/dist/server/log-sink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-sink.js","sourceRoot":"","sources":["../../src/server/log-sink.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,IAAI,aAAa,GAA0B,IAAI,CAAC;AAEhD,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAAC,OAA8B;IAC7D,aAAa,GAAG,OAAO,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,yEAAyE;AACzE,MAAM,cAAc,GAGhB;IACF,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,MAAM;IACf,KAAK,EAAE,OAAO;CACf,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,KAAwB,EACxB,GAAW,EACX,IAAc;IAEd,0EAA0E;IAC1E,+EAA+E;IAC/E,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;IAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IACD,wDAAwD;IACxD,KAAK,YAAY,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAuB,EACvB,KAAe;IAEf,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;AACH,CAAC","sourcesContent":["import type { LogEntry, StorageAdapter } from \"./storage/types.js\";\n\n/**\n * Log capture sink (M2) + shared active-storage holder.\n *\n * The module keeps a single process-wide reference to the active\n * {@link StorageAdapter} (set by `installAnalytics` at startup, cleared on\n * shutdown). This is the in-process handoff the observability API (M3) reads\n * from — see {@link getActiveStorage} and the `McpServer.storage` getter.\n *\n * {@link serverLog} is the minimal, surgical logging hook the framework uses to\n * mirror its own logs to storage IN ADDITION to printing them. It is cheap,\n * async (fire-and-forget), and error-swallowing — log capture must never break\n * or slow the server, and when analytics is OFF there is no active storage so\n * it is a plain `console.*` call with no extra cost.\n */\n\nlet activeStorage: StorageAdapter | null = null;\n\n/** Set the active storage instance (called by `installAnalytics`). */\nexport function setActiveStorage(storage: StorageAdapter | null): void {\n  activeStorage = storage;\n}\n\n/**\n * The active {@link StorageAdapter} for this process, or `null` when analytics\n * is disabled / before startup. M3's observability API should read from this\n * (or the equivalent `server.storage` getter) so it sees exactly the data the\n * server writes.\n */\nexport function getActiveStorage(): StorageAdapter | null {\n  return activeStorage;\n}\n\n/** Map a log level to the name of the `console` method to print with. */\nconst CONSOLE_METHOD: Record<\n  LogEntry[\"level\"],\n  \"debug\" | \"info\" | \"warn\" | \"error\"\n> = {\n  debug: \"debug\",\n  info: \"info\",\n  warning: \"warn\",\n  error: \"error\",\n};\n\n/**\n * The framework's server-log hook. Prints to the console as usual AND, when an\n * active storage is set, mirrors the line to `storage.appendLog` without\n * blocking and swallowing any error.\n */\nexport function serverLog(\n  level: LogEntry[\"level\"],\n  msg: string,\n  data?: unknown,\n): void {\n  // Resolve the console method by name at call time so test spies / runtime\n  // console replacements are honored (binding the ref at module init would not).\n  const method = CONSOLE_METHOD[level] ?? \"log\";\n  if (data !== undefined) {\n    console[method](msg, data);\n  } else {\n    console[method](msg);\n  }\n\n  const storage = activeStorage;\n  if (!storage) {\n    return;\n  }\n  // Fire-and-forget; never block the caller; never throw.\n  void appendSafely(storage, { ts: Date.now(), level, msg, data });\n}\n\nasync function appendSafely(\n  storage: StorageAdapter,\n  entry: LogEntry,\n): Promise<void> {\n  try {\n    await storage.appendLog(entry);\n  } catch {\n    // Log capture must never break or slow the server.\n  }\n}\n"]}

package/dist/server/metric.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Metrics are removed in enpilink. Upstream emitted a DogStatsD/UDP counter to
+ * a hardcoded vendor IP for every tool call; that coupling is gone.
+ *
+ * The monitoring slot is now filled by the opt-in analytics installer in
+ * `./analytics.ts` (`installAnalytics`), which records `tool_call` events to a
+ * pluggable {@link StorageAdapter} — but ONLY when `ENPILINK_ANALYTICS` is set,
+ * so the default remains zero monitoring middleware and zero network activity.
+ *
+ * This file is retained as a thin re-export for discoverability.
+ */
+export { installAnalytics } from "./analytics.js";

package/dist/server/metric.js

@@ -0,0 +1,13 @@
+/**
+ * Metrics are removed in enpilink. Upstream emitted a DogStatsD/UDP counter to
+ * a hardcoded vendor IP for every tool call; that coupling is gone.
+ *
+ * The monitoring slot is now filled by the opt-in analytics installer in
+ * `./analytics.ts` (`installAnalytics`), which records `tool_call` events to a
+ * pluggable {@link StorageAdapter} — but ONLY when `ENPILINK_ANALYTICS` is set,
+ * so the default remains zero monitoring middleware and zero network activity.
+ *
+ * This file is retained as a thin re-export for discoverability.
+ */
+export { installAnalytics } from "./analytics.js";
+//# sourceMappingURL=metric.js.map

package/dist/server/metric.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metric.js","sourceRoot":"","sources":["../../src/server/metric.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC","sourcesContent":["/**\n * Metrics are removed in enpilink. Upstream emitted a DogStatsD/UDP counter to\n * a hardcoded vendor IP for every tool call; that coupling is gone.\n *\n * The monitoring slot is now filled by the opt-in analytics installer in\n * `./analytics.ts` (`installAnalytics`), which records `tool_call` events to a\n * pluggable {@link StorageAdapter} — but ONLY when `ENPILINK_ANALYTICS` is set,\n * so the default remains zero monitoring middleware and zero network activity.\n *\n * This file is retained as a thin re-export for discoverability.\n */\nexport { installAnalytics } from \"./analytics.js\";\n"]}

package/dist/server/middleware.d.ts

@@ -0,0 +1,137 @@
+import type { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import type { RequestHandlerExtra } from "@modelcontextprotocol/sdk/shared/protocol.js";
+import type { CallToolResult, CancelTaskResult, ClientNotification, ClientRequest, CompleteResult, EmptyResult, GetPromptResult, GetTaskPayloadResult, GetTaskResult, InitializeResult, ListPromptsResult, ListResourcesResult, ListResourceTemplatesResult, ListTasksResult, ListToolsResult, ReadResourceResult, ServerNotification, ServerRequest, ServerResult } from "@modelcontextprotocol/sdk/types.js";
+/**
+ * The `extra` context object provided by the MCP SDK to request handlers.
+ */
+export type McpExtra = RequestHandlerExtra<ServerRequest, ServerNotification>;
+/**
+ * A single MCP middleware function following the onion model.
+ * Call `next()` to invoke the next middleware or the final handler.
+ * For notifications, `extra` is `undefined` (SDK does not provide extra context)
+ * and `next()` resolves to `undefined`.
+ */
+export type McpMiddlewareFn = (request: {
+    method: string;
+    params: Record<string, unknown>;
+}, extra: McpExtra | undefined, next: () => Promise<unknown>) => Promise<unknown> | unknown;
+/**
+ * MCP methods the server handles (incoming from client).
+ */
+export type McpMethodString = ClientRequest["method"] | ClientNotification["method"];
+/**
+ * Resolve the `params` type for a specific MCP method (request or notification)
+ * from the SDK's typed unions. Falls back to `Record<string, unknown>` for
+ * unknown methods. Used by {@link McpTypedMiddlewareFn} to narrow the request
+ * shape in typed middleware.
+ */
+export type McpRequestParams<M extends string> = Extract<ClientRequest, {
+    method: M;
+}> extends {
+    params: infer P;
+} ? P : Extract<ClientNotification, {
+    method: M;
+}> extends {
+    params: infer P;
+} ? P : Record<string, unknown>;
+/**
+ * Resolve the `extra` arg type for a specific MCP method: {@link McpExtra} for
+ * request methods, `undefined` for notification methods (the SDK does not
+ * pass extra context for notifications).
+ */
+export type McpExtraFor<M extends string> = M extends ClientRequest["method"] ? McpExtra : M extends ClientNotification["method"] ? undefined : McpExtra | undefined;
+/** Maps each MCP request method to its SDK result type. */
+interface McpResultMap {
+    ping: EmptyResult;
+    initialize: InitializeResult;
+    "tools/list": ListToolsResult;
+    "tools/call": CallToolResult;
+    "resources/list": ListResourcesResult;
+    "resources/templates/list": ListResourceTemplatesResult;
+    "resources/read": ReadResourceResult;
+    "resources/subscribe": EmptyResult;
+    "resources/unsubscribe": EmptyResult;
+    "prompts/list": ListPromptsResult;
+    "prompts/get": GetPromptResult;
+    "completion/complete": CompleteResult;
+    "logging/setLevel": EmptyResult;
+    "tasks/get": GetTaskResult;
+    "tasks/result": GetTaskPayloadResult;
+    "tasks/list": ListTasksResult;
+    "tasks/cancel": CancelTaskResult;
+}
+/**
+ * Map an MCP method string to its corresponding result type.
+ * For request methods, resolves to the specific SDK result type.
+ * For wildcard patterns (e.g. `"tools/*"`), resolves to the union of matching result types.
+ * For notification methods, resolves to `undefined`.
+ * For unknown/unmatched methods, falls back to `ServerResult`.
+ */
+export type McpResultFor<M extends string> = M extends keyof McpResultMap ? McpResultMap[M] : M extends `${infer Prefix}/*` ? [McpResultMap[keyof McpResultMap & `${Prefix}/${string}`]] extends [never] ? M extends ToWildcard<ClientNotification["method"]> ? undefined : ServerResult : McpResultMap[keyof McpResultMap & `${Prefix}/${string}`] : M extends ClientNotification["method"] ? undefined : ServerResult;
+/**
+ * Typed middleware function for a specific method. Narrows `request.params`
+ * via {@link McpRequestParams}, `extra` via {@link McpExtraFor}, and the
+ * resolved value of `next()` via {@link McpResultFor}.
+ */
+export type McpTypedMiddlewareFn<M extends string> = (request: {
+    method: M;
+    params: McpRequestParams<M>;
+}, extra: McpExtraFor<M>, next: () => Promise<McpResultFor<M>>) => Promise<unknown> | unknown;
+/** Extracts `"prefix/*"` from `"prefix/anything"` — distributive over unions. */
+type ToWildcard<T extends string> = T extends `${infer Prefix}/${string}` ? `${Prefix}/*` : never;
+/** Wildcard prefixes derived from method strings (e.g. `"tools/*"` from `"tools/call"`). */
+export type McpWildcard = ToWildcard<McpMethodString>;
+/** Category keywords matching all requests or all notifications. */
+type McpCategory = "request" | "notification";
+/**
+ * A single filter pattern for MCP middleware:
+ * - Exact method: `"tools/call"`
+ * - Wildcard: `"tools/*"`
+ * - Category: `"request"` | `"notification"`
+ * - Escape hatch: arbitrary string via `string & {}`
+ */
+type McpMiddlewareFilterPattern = McpMethodString | McpWildcard | McpCategory | (string & {});
+/**
+ * Filter determining which MCP methods a middleware applies to.
+ * A single pattern or an array of patterns (OR logic).
+ */
+export type McpMiddlewareFilter = McpMiddlewareFilterPattern | McpMiddlewareFilterPattern[];
+/**
+ * Internal entry stored for each registered middleware.
+ * `filter: null` means catch-all (matches everything).
+ */
+export type McpMiddlewareEntry = {
+    filter: McpMiddlewareFilter | null;
+    handler: McpMiddlewareFn;
+};
+type HandlerMap = Map<string, (...args: unknown[]) => Promise<unknown>>;
+/**
+ * Extract the TS-private `_requestHandlers` and `_notificationHandlers` maps
+ * from the SDK's `Server` (extends `Protocol`). These are runtime-accessible
+ * but declared `private` in TypeScript.
+ *
+ * Validates with `instanceof Map` so an incompatible SDK version fails fast
+ * instead of silently breaking.
+ */
+export declare function getHandlerMaps(server: Server): {
+    requestHandlers: HandlerMap;
+    notificationHandlers: HandlerMap;
+};
+/**
+ * Check if a single filter pattern matches a given method.
+ *
+ * - Exact: `"tools/call"` matches only `"tools/call"`
+ * - Wildcard: `"tools/*"` matches any method starting with `"tools/"`
+ * - Category `"request"`: matches when `isNotification` is false
+ * - Category `"notification"`: matches when `isNotification` is true
+ */
+export declare function matchesFilter(method: string, filter: string, isNotification: boolean): boolean;
+/**
+ * Build an onion-model middleware chain for a specific method.
+ *
+ * Filters `entries` to those matching `method`, then composes them
+ * so the first registered middleware is the outermost layer.
+ * `next()` is guarded against multiple calls within a single middleware.
+ */
+export declare function buildMiddlewareChain(method: string, isNotification: boolean, originalHandler: (...args: unknown[]) => Promise<unknown>, entries: McpMiddlewareEntry[]): (...args: unknown[]) => Promise<unknown>;
+export {};

package/dist/server/middleware.js

@@ -0,0 +1,93 @@
+/**
+ * Extract the TS-private `_requestHandlers` and `_notificationHandlers` maps
+ * from the SDK's `Server` (extends `Protocol`). These are runtime-accessible
+ * but declared `private` in TypeScript.
+ *
+ * Validates with `instanceof Map` so an incompatible SDK version fails fast
+ * instead of silently breaking.
+ */
+export function getHandlerMaps(server) {
+    const obj = server;
+    if (!("_requestHandlers" in obj && obj._requestHandlers instanceof Map) ||
+        !("_notificationHandlers" in obj && obj._notificationHandlers instanceof Map)) {
+        throw new Error("Incompatible MCP SDK version: expected _requestHandlers and _notificationHandlers on Server");
+    }
+    return {
+        requestHandlers: obj._requestHandlers,
+        notificationHandlers: obj._notificationHandlers,
+    };
+}
+/**
+ * Check if a single filter pattern matches a given method.
+ *
+ * - Exact: `"tools/call"` matches only `"tools/call"`
+ * - Wildcard: `"tools/*"` matches any method starting with `"tools/"`
+ * - Category `"request"`: matches when `isNotification` is false
+ * - Category `"notification"`: matches when `isNotification` is true
+ */
+export function matchesFilter(method, filter, isNotification) {
+    if (filter === "request") {
+        return !isNotification;
+    }
+    if (filter === "notification") {
+        return isNotification;
+    }
+    if (filter.endsWith("/*")) {
+        const prefix = filter.slice(0, -1); // "tools/*" → "tools/"
+        return method.startsWith(prefix);
+    }
+    return method === filter;
+}
+function matchesAnyFilter(method, filter, isNotification) {
+    if (filter === null) {
+        return true;
+    }
+    if (typeof filter === "string") {
+        return matchesFilter(method, filter, isNotification);
+    }
+    return filter.some((pattern) => matchesFilter(method, pattern, isNotification));
+}
+/**
+ * Build an onion-model middleware chain for a specific method.
+ *
+ * Filters `entries` to those matching `method`, then composes them
+ * so the first registered middleware is the outermost layer.
+ * `next()` is guarded against multiple calls within a single middleware.
+ */
+export function buildMiddlewareChain(method, isNotification, originalHandler, entries) {
+    const applicable = entries.filter((entry) => matchesAnyFilter(method, entry.filter, isNotification));
+    if (applicable.length === 0) {
+        return originalHandler;
+    }
+    return (...args) => {
+        const rawRequest = args[0];
+        // SDK calls request handlers as handler(request, extra) but
+        // notification handlers as handler(notification) — no extra arg.
+        const extra = isNotification ? undefined : args[1];
+        const mcpRequest = {
+            method,
+            params: rawRequest?.params ?? {},
+        };
+        let index = 0;
+        const executeLayer = () => {
+            const entry = applicable[index++];
+            if (!entry) {
+                if (rawRequest) {
+                    rawRequest.params = mcpRequest.params;
+                }
+                return originalHandler(...args);
+            }
+            let nextCalled = false;
+            const next = () => {
+                if (nextCalled) {
+                    throw new Error(`next() called multiple times in middleware for "${method}"`);
+                }
+                nextCalled = true;
+                return executeLayer();
+            };
+            return Promise.resolve(entry.handler(mcpRequest, extra, next));
+        };
+        return executeLayer();
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/server/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/server/middleware.ts"],"names":[],"mappings":"AAsKA;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,GAAG,GAAW,MAAM,CAAC;IAE3B,IACE,CAAC,CAAC,kBAAkB,IAAI,GAAG,IAAI,GAAG,CAAC,gBAAgB,YAAY,GAAG,CAAC;QACnE,CAAC,CACC,uBAAuB,IAAI,GAAG,IAAI,GAAG,CAAC,qBAAqB,YAAY,GAAG,CAC3E,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,eAAe,EAAE,GAAG,CAAC,gBAA8B;QACnD,oBAAoB,EAAE,GAAG,CAAC,qBAAmC;KAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,MAAc,EACd,cAAuB;IAEvB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CAAC,cAAc,CAAC;IACzB,CAAC;IACD,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB;QAC3D,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,MAAM,KAAK,MAAM,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAc,EACd,MAAkC,EAClC,cAAuB;IAEvB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC7B,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,cAAuB,EACvB,eAAyD,EACzD,OAA6B;IAE7B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1C,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CACvD,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAwC,CAAC;QAClE,4DAA4D;QAC5D,iEAAiE;QACjE,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,CAAc,CAAC;QACjE,MAAM,UAAU,GAAG;YACjB,MAAM;YACN,MAAM,EAAG,UAAU,EAAE,MAAkC,IAAI,EAAE;SAC9D,CAAC;QAEF,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,MAAM,YAAY,GAAG,GAAqB,EAAE;YAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,UAAU,EAAE,CAAC;oBACf,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;gBACxC,CAAC;gBACD,OAAO,eAAe,CAAC,GAAG,IAAI,CAAC,CAAC;YAClC,CAAC;YAED,IAAI,UAAU,GAAG,KAAK,CAAC;YAEvB,MAAM,IAAI,GAAG,GAAqB,EAAE;gBAClC,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,GAAG,CAC7D,CAAC;gBACJ,CAAC;gBACD,UAAU,GAAG,IAAI,CAAC;gBAClB,OAAO,YAAY,EAAE,CAAC;YACxB,CAAC,CAAC;YAEF,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC;QAEF,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { Server } from \"@modelcontextprotocol/sdk/server/index.js\";\nimport type { RequestHandlerExtra } from \"@modelcontextprotocol/sdk/shared/protocol.js\";\nimport type {\n  CallToolResult,\n  CancelTaskResult,\n  ClientNotification,\n  ClientRequest,\n  CompleteResult,\n  EmptyResult,\n  GetPromptResult,\n  GetTaskPayloadResult,\n  GetTaskResult,\n  InitializeResult,\n  ListPromptsResult,\n  ListResourcesResult,\n  ListResourceTemplatesResult,\n  ListTasksResult,\n  ListToolsResult,\n  ReadResourceResult,\n  ServerNotification,\n  ServerRequest,\n  ServerResult,\n} from \"@modelcontextprotocol/sdk/types.js\";\n\n/**\n * The `extra` context object provided by the MCP SDK to request handlers.\n */\nexport type McpExtra = RequestHandlerExtra<ServerRequest, ServerNotification>;\n\n/**\n * A single MCP middleware function following the onion model.\n * Call `next()` to invoke the next middleware or the final handler.\n * For notifications, `extra` is `undefined` (SDK does not provide extra context)\n * and `next()` resolves to `undefined`.\n */\nexport type McpMiddlewareFn = (\n  request: { method: string; params: Record<string, unknown> },\n  extra: McpExtra | undefined,\n  next: () => Promise<unknown>,\n) => Promise<unknown> | unknown;\n\n/**\n * MCP methods the server handles (incoming from client).\n */\nexport type McpMethodString =\n  | ClientRequest[\"method\"]\n  | ClientNotification[\"method\"];\n\n/**\n * Resolve the `params` type for a specific MCP method (request or notification)\n * from the SDK's typed unions. Falls back to `Record<string, unknown>` for\n * unknown methods. Used by {@link McpTypedMiddlewareFn} to narrow the request\n * shape in typed middleware.\n */\nexport type McpRequestParams<M extends string> =\n  Extract<ClientRequest, { method: M }> extends { params: infer P }\n    ? P\n    : Extract<ClientNotification, { method: M }> extends { params: infer P }\n      ? P\n      : Record<string, unknown>;\n\n/**\n * Resolve the `extra` arg type for a specific MCP method: {@link McpExtra} for\n * request methods, `undefined` for notification methods (the SDK does not\n * pass extra context for notifications).\n */\nexport type McpExtraFor<M extends string> = M extends ClientRequest[\"method\"]\n  ? McpExtra\n  : M extends ClientNotification[\"method\"]\n    ? undefined\n    : McpExtra | undefined;\n\n/** Maps each MCP request method to its SDK result type. */\ninterface McpResultMap {\n  ping: EmptyResult;\n  initialize: InitializeResult;\n  \"tools/list\": ListToolsResult;\n  \"tools/call\": CallToolResult;\n  \"resources/list\": ListResourcesResult;\n  \"resources/templates/list\": ListResourceTemplatesResult;\n  \"resources/read\": ReadResourceResult;\n  \"resources/subscribe\": EmptyResult;\n  \"resources/unsubscribe\": EmptyResult;\n  \"prompts/list\": ListPromptsResult;\n  \"prompts/get\": GetPromptResult;\n  \"completion/complete\": CompleteResult;\n  \"logging/setLevel\": EmptyResult;\n  \"tasks/get\": GetTaskResult;\n  \"tasks/result\": GetTaskPayloadResult;\n  \"tasks/list\": ListTasksResult;\n  \"tasks/cancel\": CancelTaskResult;\n}\n\n/**\n * Map an MCP method string to its corresponding result type.\n * For request methods, resolves to the specific SDK result type.\n * For wildcard patterns (e.g. `\"tools/*\"`), resolves to the union of matching result types.\n * For notification methods, resolves to `undefined`.\n * For unknown/unmatched methods, falls back to `ServerResult`.\n */\nexport type McpResultFor<M extends string> = M extends keyof McpResultMap\n  ? McpResultMap[M]\n  : M extends `${infer Prefix}/*`\n    ? [McpResultMap[keyof McpResultMap & `${Prefix}/${string}`]] extends [never]\n      ? M extends ToWildcard<ClientNotification[\"method\"]>\n        ? undefined\n        : ServerResult\n      : McpResultMap[keyof McpResultMap & `${Prefix}/${string}`]\n    : M extends ClientNotification[\"method\"]\n      ? undefined\n      : ServerResult;\n\n/**\n * Typed middleware function for a specific method. Narrows `request.params`\n * via {@link McpRequestParams}, `extra` via {@link McpExtraFor}, and the\n * resolved value of `next()` via {@link McpResultFor}.\n */\nexport type McpTypedMiddlewareFn<M extends string> = (\n  request: { method: M; params: McpRequestParams<M> },\n  extra: McpExtraFor<M>,\n  next: () => Promise<McpResultFor<M>>,\n) => Promise<unknown> | unknown;\n\n/** Extracts `\"prefix/*\"` from `\"prefix/anything\"` — distributive over unions. */\ntype ToWildcard<T extends string> = T extends `${infer Prefix}/${string}`\n  ? `${Prefix}/*`\n  : never;\n\n/** Wildcard prefixes derived from method strings (e.g. `\"tools/*\"` from `\"tools/call\"`). */\nexport type McpWildcard = ToWildcard<McpMethodString>;\n\n/** Category keywords matching all requests or all notifications. */\ntype McpCategory = \"request\" | \"notification\";\n\n/**\n * A single filter pattern for MCP middleware:\n * - Exact method: `\"tools/call\"`\n * - Wildcard: `\"tools/*\"`\n * - Category: `\"request\"` | `\"notification\"`\n * - Escape hatch: arbitrary string via `string & {}`\n */\ntype McpMiddlewareFilterPattern =\n  | McpMethodString\n  | McpWildcard\n  | McpCategory\n  | (string & {});\n\n/**\n * Filter determining which MCP methods a middleware applies to.\n * A single pattern or an array of patterns (OR logic).\n */\nexport type McpMiddlewareFilter =\n  | McpMiddlewareFilterPattern\n  | McpMiddlewareFilterPattern[];\n\n/**\n * Internal entry stored for each registered middleware.\n * `filter: null` means catch-all (matches everything).\n */\nexport type McpMiddlewareEntry = {\n  filter: McpMiddlewareFilter | null;\n  handler: McpMiddlewareFn;\n};\n\ntype HandlerMap = Map<string, (...args: unknown[]) => Promise<unknown>>;\n\n/**\n * Extract the TS-private `_requestHandlers` and `_notificationHandlers` maps\n * from the SDK's `Server` (extends `Protocol`). These are runtime-accessible\n * but declared `private` in TypeScript.\n *\n * Validates with `instanceof Map` so an incompatible SDK version fails fast\n * instead of silently breaking.\n */\nexport function getHandlerMaps(server: Server) {\n  const obj: object = server;\n\n  if (\n    !(\"_requestHandlers\" in obj && obj._requestHandlers instanceof Map) ||\n    !(\n      \"_notificationHandlers\" in obj && obj._notificationHandlers instanceof Map\n    )\n  ) {\n    throw new Error(\n      \"Incompatible MCP SDK version: expected _requestHandlers and _notificationHandlers on Server\",\n    );\n  }\n\n  return {\n    requestHandlers: obj._requestHandlers as HandlerMap,\n    notificationHandlers: obj._notificationHandlers as HandlerMap,\n  };\n}\n\n/**\n * Check if a single filter pattern matches a given method.\n *\n * - Exact: `\"tools/call\"` matches only `\"tools/call\"`\n * - Wildcard: `\"tools/*\"` matches any method starting with `\"tools/\"`\n * - Category `\"request\"`: matches when `isNotification` is false\n * - Category `\"notification\"`: matches when `isNotification` is true\n */\nexport function matchesFilter(\n  method: string,\n  filter: string,\n  isNotification: boolean,\n): boolean {\n  if (filter === \"request\") {\n    return !isNotification;\n  }\n  if (filter === \"notification\") {\n    return isNotification;\n  }\n  if (filter.endsWith(\"/*\")) {\n    const prefix = filter.slice(0, -1); // \"tools/*\" → \"tools/\"\n    return method.startsWith(prefix);\n  }\n  return method === filter;\n}\n\nfunction matchesAnyFilter(\n  method: string,\n  filter: McpMiddlewareFilter | null,\n  isNotification: boolean,\n): boolean {\n  if (filter === null) {\n    return true;\n  }\n  if (typeof filter === \"string\") {\n    return matchesFilter(method, filter, isNotification);\n  }\n  return filter.some((pattern) =>\n    matchesFilter(method, pattern, isNotification),\n  );\n}\n\n/**\n * Build an onion-model middleware chain for a specific method.\n *\n * Filters `entries` to those matching `method`, then composes them\n * so the first registered middleware is the outermost layer.\n * `next()` is guarded against multiple calls within a single middleware.\n */\nexport function buildMiddlewareChain(\n  method: string,\n  isNotification: boolean,\n  originalHandler: (...args: unknown[]) => Promise<unknown>,\n  entries: McpMiddlewareEntry[],\n) {\n  const applicable = entries.filter((entry) =>\n    matchesAnyFilter(method, entry.filter, isNotification),\n  );\n\n  if (applicable.length === 0) {\n    return originalHandler;\n  }\n\n  return (...args: unknown[]) => {\n    const rawRequest = args[0] as Record<string, unknown> | undefined;\n    // SDK calls request handlers as handler(request, extra) but\n    // notification handlers as handler(notification) — no extra arg.\n    const extra = isNotification ? undefined : (args[1] as McpExtra);\n    const mcpRequest = {\n      method,\n      params: (rawRequest?.params as Record<string, unknown>) ?? {},\n    };\n\n    let index = 0;\n\n    const executeLayer = (): Promise<unknown> => {\n      const entry = applicable[index++];\n      if (!entry) {\n        if (rawRequest) {\n          rawRequest.params = mcpRequest.params;\n        }\n        return originalHandler(...args);\n      }\n\n      let nextCalled = false;\n\n      const next = (): Promise<unknown> => {\n        if (nextCalled) {\n          throw new Error(\n            `next() called multiple times in middleware for \"${method}\"`,\n          );\n        }\n        nextCalled = true;\n        return executeLayer();\n      };\n\n      return Promise.resolve(entry.handler(mcpRequest, extra, next));\n    };\n\n    return executeLayer();\n  };\n}\n"]}

package/dist/server/middleware.test-d.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/middleware.test-d.js

@@ -0,0 +1,75 @@
+import { expectTypeOf, test } from "vitest";
+const server = null;
+test("request category narrows extra and next() result", () => {
+    server.mcpMiddleware("request", async (_request, extra, next) => {
+        expectTypeOf(extra).toEqualTypeOf();
+        extra.signal;
+        const result = await next();
+        expectTypeOf(result).toEqualTypeOf();
+        return result;
+    });
+});
+test("notification category narrows extra and next() result", () => {
+    server.mcpMiddleware("notification", async (_request, extra, next) => {
+        expectTypeOf(extra).toEqualTypeOf();
+        // @ts-expect-error extra is undefined, cannot access .signal
+        extra.signal;
+        const result = await next();
+        expectTypeOf(result).toEqualTypeOf();
+    });
+});
+test("exact method tools/call narrows params, extra, and next() result", () => {
+    server.mcpMiddleware("tools/call", async (request, extra, next) => {
+        expectTypeOf(request.params.name).toBeString();
+        expectTypeOf(extra).toEqualTypeOf();
+        const result = await next();
+        expectTypeOf(result).toEqualTypeOf();
+        return result;
+    });
+});
+test("exact method tools/list narrows next() to ListToolsResult", () => {
+    server.mcpMiddleware("tools/list", async (_request, _extra, next) => {
+        const result = await next();
+        expectTypeOf(result).toEqualTypeOf();
+        return result;
+    });
+});
+test("exact notification method narrows extra and next() result", () => {
+    server.mcpMiddleware("notifications/initialized", async (_request, extra, next) => {
+        expectTypeOf(extra).toEqualTypeOf();
+        // @ts-expect-error extra is undefined
+        extra.signal;
+        const result = await next();
+        expectTypeOf(result).toEqualTypeOf();
+    });
+});
+test("McpTypedMiddlewareFn narrows params, extra, and next() per method", () => {
+    expectTypeOf().toBeString();
+    expectTypeOf().toEqualTypeOf();
+    expectTypeOf().toEqualTypeOf();
+    expectTypeOf().toEqualTypeOf();
+    expectTypeOf().toEqualTypeOf();
+});
+test("McpResultFor maps methods to correct result types", () => {
+    expectTypeOf().toEqualTypeOf();
+    expectTypeOf().toEqualTypeOf();
+    expectTypeOf().toEqualTypeOf();
+});
+test("wildcard tools/* narrows next() to union of tools result types", () => {
+    server.mcpMiddleware("tools/*", async (_request, _extra, next) => {
+        const result = await next();
+        expectTypeOf(result).toEqualTypeOf();
+        return result;
+    });
+});
+test("McpResultFor resolves wildcards to union of matching result types", () => {
+    expectTypeOf().toEqualTypeOf();
+});
+test("catch-all middleware has no narrowing on extra or params", () => {
+    server.mcpMiddleware((_request, extra, next) => {
+        expectTypeOf(extra).toEqualTypeOf();
+        expectTypeOf(_request.params).toEqualTypeOf();
+        return next();
+    });
+});
+//# sourceMappingURL=middleware.test-d.js.map

package/dist/server/middleware.test-d.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.test-d.js","sourceRoot":"","sources":["../../src/server/middleware.test-d.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAQ5C,MAAM,MAAM,GAAG,IAA4B,CAAC;AAE5C,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAC5D,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC9D,YAAY,CAAC,KAAK,CAAC,CAAC,aAAa,EAAY,CAAC;QAC9C,KAAK,CAAC,MAAM,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;QAC5B,YAAY,CAAC,MAAM,CAAC,CAAC,aAAa,EAAgB,CAAC;QACnD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACjE,MAAM,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACnE,YAAY,CAAC,KAAK,CAAC,CAAC,aAAa,EAAa,CAAC;QAC/C,6DAA6D;QAC7D,KAAK,CAAC,MAAM,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;QAC5B,YAAY,CAAC,MAAM,CAAC,CAAC,aAAa,EAAa,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAC5E,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAChE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QAC/C,YAAY,CAAC,KAAK,CAAC,CAAC,aAAa,EAAY,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;QAC5B,YAAY,CAAC,MAAM,CAAC,CAAC,aAAa,EAAkB,CAAC;QACrD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2DAA2D,EAAE,GAAG,EAAE;IACrE,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAClE,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;QAC5B,YAAY,CAAC,MAAM,CAAC,CAAC,aAAa,EAAmB,CAAC;QACtD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2DAA2D,EAAE,GAAG,EAAE;IACrE,MAAM,CAAC,aAAa,CAClB,2BAA2B,EAC3B,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC9B,YAAY,CAAC,KAAK,CAAC,CAAC,aAAa,EAAa,CAAC;QAC/C,sCAAsC;QACtC,KAAK,CAAC,MAAM,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;QAC5B,YAAY,CAAC,MAAM,CAAC,CAAC,aAAa,EAAa,CAAC;IAClD,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mEAAmE,EAAE,GAAG,EAAE;IAC7E,YAAY,EAET,CAAC,UAAU,EAAE,CAAC;IACjB,YAAY,EAET,CAAC,aAAa,EAAY,CAAC;IAC9B,YAAY,EAET,CAAC,aAAa,EAAa,CAAC;IAC/B,YAAY,EAET,CAAC,aAAa,EAA4B,CAAC;IAC9C,YAAY,EAET,CAAC,aAAa,EAAsB,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mDAAmD,EAAE,GAAG,EAAE;IAC7D,YAAY,EAA8B,CAAC,aAAa,EAAmB,CAAC;IAC5E,YAAY,EAA8B,CAAC,aAAa,EAAkB,CAAC;IAC3E,YAAY,EAET,CAAC,aAAa,EAAa,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;IAC1E,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;QAC5B,YAAY,CAAC,MAAM,CAAC,CAAC,aAAa,EAAoC,CAAC;QACvE,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mEAAmE,EAAE,GAAG,EAAE;IAC7E,YAAY,EAA2B,CAAC,aAAa,EAElD,CAAC;AACN,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;IACpE,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC7C,YAAY,CAAC,KAAK,CAAC,CAAC,aAAa,EAAwB,CAAC;QAC1D,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,aAAa,EAA2B,CAAC;QACvE,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import type {\n  CallToolResult,\n  ListToolsResult,\n  ServerResult,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport { expectTypeOf, test } from \"vitest\";\nimport type {\n  McpExtra,\n  McpResultFor,\n  McpTypedMiddlewareFn,\n} from \"./middleware.js\";\nimport type { McpServer } from \"./server.js\";\n\nconst server = null as unknown as McpServer;\n\ntest(\"request category narrows extra and next() result\", () => {\n  server.mcpMiddleware(\"request\", async (_request, extra, next) => {\n    expectTypeOf(extra).toEqualTypeOf<McpExtra>();\n    extra.signal;\n    const result = await next();\n    expectTypeOf(result).toEqualTypeOf<ServerResult>();\n    return result;\n  });\n});\n\ntest(\"notification category narrows extra and next() result\", () => {\n  server.mcpMiddleware(\"notification\", async (_request, extra, next) => {\n    expectTypeOf(extra).toEqualTypeOf<undefined>();\n    // @ts-expect-error extra is undefined, cannot access .signal\n    extra.signal;\n    const result = await next();\n    expectTypeOf(result).toEqualTypeOf<undefined>();\n  });\n});\n\ntest(\"exact method tools/call narrows params, extra, and next() result\", () => {\n  server.mcpMiddleware(\"tools/call\", async (request, extra, next) => {\n    expectTypeOf(request.params.name).toBeString();\n    expectTypeOf(extra).toEqualTypeOf<McpExtra>();\n    const result = await next();\n    expectTypeOf(result).toEqualTypeOf<CallToolResult>();\n    return result;\n  });\n});\n\ntest(\"exact method tools/list narrows next() to ListToolsResult\", () => {\n  server.mcpMiddleware(\"tools/list\", async (_request, _extra, next) => {\n    const result = await next();\n    expectTypeOf(result).toEqualTypeOf<ListToolsResult>();\n    return result;\n  });\n});\n\ntest(\"exact notification method narrows extra and next() result\", () => {\n  server.mcpMiddleware(\n    \"notifications/initialized\",\n    async (_request, extra, next) => {\n      expectTypeOf(extra).toEqualTypeOf<undefined>();\n      // @ts-expect-error extra is undefined\n      extra.signal;\n      const result = await next();\n      expectTypeOf(result).toEqualTypeOf<undefined>();\n    },\n  );\n});\n\ntest(\"McpTypedMiddlewareFn narrows params, extra, and next() per method\", () => {\n  expectTypeOf<\n    Parameters<McpTypedMiddlewareFn<\"tools/call\">>[0][\"params\"][\"name\"]\n  >().toBeString();\n  expectTypeOf<\n    Parameters<McpTypedMiddlewareFn<\"tools/call\">>[1]\n  >().toEqualTypeOf<McpExtra>();\n  expectTypeOf<\n    Parameters<McpTypedMiddlewareFn<\"notifications/initialized\">>[1]\n  >().toEqualTypeOf<undefined>();\n  expectTypeOf<\n    ReturnType<Parameters<McpTypedMiddlewareFn<\"tools/list\">>[2]>\n  >().toEqualTypeOf<Promise<ListToolsResult>>();\n  expectTypeOf<\n    ReturnType<Parameters<McpTypedMiddlewareFn<\"notifications/initialized\">>[2]>\n  >().toEqualTypeOf<Promise<undefined>>();\n});\n\ntest(\"McpResultFor maps methods to correct result types\", () => {\n  expectTypeOf<McpResultFor<\"tools/list\">>().toEqualTypeOf<ListToolsResult>();\n  expectTypeOf<McpResultFor<\"tools/call\">>().toEqualTypeOf<CallToolResult>();\n  expectTypeOf<\n    McpResultFor<\"notifications/initialized\">\n  >().toEqualTypeOf<undefined>();\n});\n\ntest(\"wildcard tools/* narrows next() to union of tools result types\", () => {\n  server.mcpMiddleware(\"tools/*\", async (_request, _extra, next) => {\n    const result = await next();\n    expectTypeOf(result).toEqualTypeOf<ListToolsResult | CallToolResult>();\n    return result;\n  });\n});\n\ntest(\"McpResultFor resolves wildcards to union of matching result types\", () => {\n  expectTypeOf<McpResultFor<\"tools/*\">>().toEqualTypeOf<\n    ListToolsResult | CallToolResult\n  >();\n});\n\ntest(\"catch-all middleware has no narrowing on extra or params\", () => {\n  server.mcpMiddleware((_request, extra, next) => {\n    expectTypeOf(extra).toEqualTypeOf<McpExtra | undefined>();\n    expectTypeOf(_request.params).toEqualTypeOf<Record<string, unknown>>();\n    return next();\n  });\n});\n"]}

package/dist/server/middleware.test.d.ts

@@ -0,0 +1 @@
+export {};