mcp-authz 0.4.0 → 0.5.0

package/dist/testing.js

@@ -1,5 +1,5 @@
+import { a as listCatalogue, i as definitionOf, t as INSTRUCTIONS } from "./definitions-CyIy4YSZ.js";
 import { InMemoryTransport } from "@modelcontextprotocol/server";
-import { createHash } from "node:crypto";
 import { Client, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
 //#region src/permissions-module.ts
 /**
@@ -22,29 +22,44 @@ function toPermissionsModule(record) {
 		"} as const;",
 		"",
 		"export type Permission = (typeof PERMISSIONS)[keyof typeof PERMISSIONS];",
-		...fingerprintLines(record),
+		...definitionLines(record),
 		...resourceUriLines(record.resourceUris ?? {}),
 		""
 	].join("\n");
 }
 /**
-* Only emitted when the recorder could produce digests. An OpenAPI document is
+* Only emitted when the recorder could read definitions. An OpenAPI document is
 * already a file in the repository, diffed on the pull request by whoever
-* changed it, so there is nothing for a second baseline to catch.
+* changed it, so there is nothing for a second record to catch.
+*
+* Written out in full rather than as digests, so re-recording shows in review
+* the exact words a server changed, and so `createMcpProxy` can compare without
+* hashing on every listing.
 */
-function fingerprintLines(record) {
-	const fingerprints = record.fingerprints ?? {};
-	if (Object.keys(fingerprints).length === 0) return [];
+function definitionLines(record) {
+	const definitions = record.definitions ?? {};
+	if (Object.keys(definitions).length === 0) return [];
 	return [
 		"",
-		"// What each capability looked like when this was recorded. A separate export",
-		"// because gate() takes the flat map above; this is the baseline CI compares.",
-		"export const FINGERPRINTS = {",
-		...record.names.map((label) => `  ${quote(label)}: ${literal(fingerprints[label] ?? "")},`),
-		"} as const;"
+		"// What each capability said to the model when this was recorded. createMcpProxy()",
+		"// hides one that no longer matches, so a server cannot keep an approved name and",
+		"// change what it tells the model. Re-record to approve a change.",
+		"export const DEFINITIONS = {",
+		...record.names.map((label) => `  ${quote(label)}: ${value(definitions[label] ?? {})},`),
+		...definitions["server:instructions"] ? [`  ${quote(INSTRUCTIONS)}: ${value(definitions[INSTRUCTIONS])},`] : [],
+		"};"
 	];
 }
 /**
+* JSON is a valid object literal except for one key: `"__proto__"` sets the
+* prototype there, dropping that part of a schema. A definition carrying one is
+* written as a parse of its JSON instead, which keeps it.
+*/
+function value(definition) {
+	const json = JSON.stringify(definition, null, 2).replace(/\n/g, "\n  ");
+	return json.includes("\"__proto__\"") ? `JSON.parse(${literal(JSON.stringify(definition))})` : json;
+}
+/**
 * Only emitted when the server has resources, so a tools-only map stays a map.
 * `createMcpProxy` needs this to price a read, which names a URI and never a
 * label; `gate()` never sees it.
@@ -85,19 +100,14 @@ function literal(value) {
 }
 //#endregion
 //#region src/testing.ts
-function digest(parts) {
-	return createHash("sha256").update(JSON.stringify(canonical(parts))).digest("hex").slice(0, 16);
-}
 /**
-* Key order is an accident of how a value was built, so sort it away. Without
-* this an SDK that emitted the same definition in a different order would churn
-* every fingerprint in a snapshot and teach people to ignore the diff.
+* An upstream is recorded in 2026-07-28 and nothing older: the proxy that
+* enforces the record speaks only that, and a record read through another
+* dialect could differ from what the proxy later compares it against. Your own
+* server, connected in process, is recorded in whichever era it offers.
 */
-function canonical(value) {
-	if (Array.isArray(value)) return value.map(canonical);
-	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, inner]) => [key, canonical(inner)]));
-	return value;
-}
+const MODERN = { versionNegotiation: { mode: { pin: "2026-07-28" } } };
+const EITHER = { versionNegotiation: { mode: "auto" } };
 async function recordCapabilities(factory) {
 	const server = await factory();
 	const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
@@ -105,10 +115,9 @@ async function recordCapabilities(factory) {
 	const client = new Client({
 		name: "mcp-authz-record-capabilities",
 		version: "1.0.0"
-	});
-	await client.connect(clientTransport);
+	}, EITHER);
 	try {
-		return await listFrom(client);
+		return recordFrom(await listCatalogue(client, clientTransport));
 	} finally {
 		await client.close();
 		await server.close();
@@ -130,47 +139,30 @@ async function recordUpstream(url, options = {}) {
 	const client = new Client({
 		name: "mcp-authz-record-capabilities",
 		version: "1.0.0"
-	});
-	await client.connect(transport);
+	}, MODERN);
 	try {
-		return await listFrom(client);
+		return recordFrom(await listCatalogue(client, transport));
 	} finally {
 		await client.close();
 	}
 }
-async function listFrom(client) {
-	{
-		const advertised = client.getServerCapabilities() ?? {};
-		const none = {
-			tools: [],
-			prompts: [],
-			resources: [],
-			resourceTemplates: []
-		};
-		const [tools, prompts, resources, templates] = await Promise.all([
-			advertised.tools ? client.listTools() : none,
-			advertised.prompts ? client.listPrompts() : none,
-			advertised.resources ? client.listResources() : none,
-			advertised.resources ? client.listResourceTemplates() : none
-		]);
-		const labelled = [
-			...tools.tools.map((tool) => [tool.name, tool]),
-			...prompts.prompts.map((prompt) => [`prompt:${prompt.name}`, prompt]),
-			...resources.resources.map((resource) => [`resource:${resource.name}`, resource]),
-			...templates.resourceTemplates.map((template) => [`resource:${template.name}`, template])
-		];
-		const resourceUris = Object.fromEntries([...resources.resources.map((resource) => [`resource:${resource.name}`, resource.uri]), ...templates.resourceTemplates.map((template) => [`resource:${template.name}`, template.uriTemplate])]);
-		const names = labelled.map(([label]) => label).sort();
-		const byLabel = new Map(labelled);
-		return {
-			names,
-			fingerprints: Object.fromEntries(names.map((label) => [label, digest({
-				label,
-				definition: byLabel.get(label)
-			})])),
-			resourceUris
-		};
-	}
+/**
+* The record, built from the listings as the server wrote them, which is what
+* the proxy will compare against later.
+*
+* Built from entries rather than by assignment. A server may advertise a
+* capability called `__proto__`, and `dict['__proto__'] = definition` runs the
+* inherited setter instead of storing anything — losing exactly the record that
+* would have caught that capability changing under you. `fromEntries` defines
+* own properties, while the result stays an ordinary object.
+*/
+function recordFrom(listed) {
+	const names = [...listed.keys()].filter((label) => label !== INSTRUCTIONS).sort();
+	return {
+		names,
+		definitions: Object.fromEntries([...listed].map(([label, item]) => [label, definitionOf(item)])),
+		resourceUris: Object.fromEntries(names.filter((label) => label.startsWith("resource:")).map((label) => [label, String(listed.get(label).uri ?? listed.get(label).uriTemplate)]))
+	};
 }
 //#endregion
 export { UNASSIGNED, recordCapabilities, recordUpstream, toPermissionsModule };

package/dist/{tools-BQE1O-7P.d.ts → tools-C1dZESYK.d.ts}

@@ -241,8 +241,15 @@ type ServerFactory<C> = ((context: C) => McpServer) & {
   permissions: ReadonlyMap<string, string>;
   routePermissions: ReadonlyMap<string, string>;
   permissionForRoute: (kind: Capability, name: string) => string | undefined;
-  /** The registered route name a concrete request name resolves to, template included. */
-  routeNameFor: (kind: Capability, name: string) => string | undefined;
+  /**
+   * Every registration a concrete request name reaches, templates included, in
+   * registration order. More than one when an exact resource and a template
+   * cover the same URI.
+   */
+  routesFor: (kind: Capability, name: string) => {
+    routeName: string;
+    permission: string;
+  }[];
 };
 /**
  * Everything bound to one policy: `permission` accepts only what that policy can

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-authz",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Authorization for MCP servers: OAuth 2.1 resource server, roles/permissions policy, permission-gated tools (2026-07-28)",
   "repository": {
     "type": "git",