mcp-trellis 0.1.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +90 -11
- package/dist/adapters/node.d.ts +7 -7
- package/dist/adapters/node.d.ts.map +1 -1
- package/dist/adapters/node.js +34 -28
- package/dist/adapters/node.js.map +1 -1
- package/dist/adapters/origins.d.ts +19 -0
- package/dist/adapters/origins.d.ts.map +1 -0
- package/dist/adapters/origins.js +55 -0
- package/dist/adapters/origins.js.map +1 -0
- package/dist/app.d.ts +8 -0
- package/dist/app.d.ts.map +1 -1
- package/dist/app.js +1 -1
- package/dist/app.js.map +1 -1
- package/dist/audit.d.ts +18 -0
- package/dist/audit.d.ts.map +1 -0
- package/dist/audit.js +34 -0
- package/dist/audit.js.map +1 -0
- package/dist/methods.d.ts +10 -1
- package/dist/methods.d.ts.map +1 -1
- package/dist/methods.js +1 -1
- package/dist/methods.js.map +1 -1
- package/dist/oauth/router.d.ts.map +1 -1
- package/dist/oauth/router.js +12 -3
- package/dist/oauth/router.js.map +1 -1
- package/dist/registry.d.ts.map +1 -1
- package/dist/registry.js +9 -1
- package/dist/registry.js.map +1 -1
- package/dist/server.d.ts +5 -1
- package/dist/server.d.ts.map +1 -1
- package/dist/server.js +2 -1
- package/dist/server.js.map +1 -1
- package/dist/validate.d.ts +14 -0
- package/dist/validate.d.ts.map +1 -1
- package/dist/validate.js +42 -0
- package/dist/validate.js.map +1 -1
- package/package.json +2 -1
package/README.md
CHANGED
|
@@ -310,12 +310,12 @@ The library stays protocol-shaped. Your app plugs in the seams:
|
|
|
310
310
|
|
|
311
311
|
| Port | Role |
|
|
312
312
|
|------|------|
|
|
313
|
-
| `verifyToken(token, req)` | Decode a bearer and return `{ userId, scopes, audience }`, or `null`. **The library compares `audience` against this server's canonical resource** — you cannot forget the check |
|
|
313
|
+
| `verifyToken(token, req)` | Decode a bearer and return `{ userId, scopes, audience, claims? }`, or `null`. **The library compares `audience` against this server's canonical resource** — you cannot forget the check. Optional `claims` are passed to `context` on `principal` |
|
|
314
314
|
| `resolveUser`, `loginUrl`, `mintAccessToken`, `codeSecret` | Same as the OAuth ports below |
|
|
315
315
|
| `clientStore?` | Pre-registered clients; required for confidential clients like Gemini |
|
|
316
316
|
| `refreshAccessToken?` | If set, metadata advertises `refresh_token` |
|
|
317
317
|
| `revokeToken?` | RFC 7009; presence mounts `/revoke` and advertises `revocation_endpoint` |
|
|
318
|
-
| `context?`, `audit?` | Same as the MCP ports below; `context` defaults to an empty object |
|
|
318
|
+
| `context?`, `audit?` | Same as the MCP ports below; `context` defaults to an empty object. Receives `principal.claims` when `verifyToken` set them |
|
|
319
319
|
|
|
320
320
|
### MCP (`createMcpHandler`)
|
|
321
321
|
|
|
@@ -324,9 +324,35 @@ The lower-level handler. Here the audience check is **yours** — prefer
|
|
|
324
324
|
|
|
325
325
|
| Port | Role |
|
|
326
326
|
|------|------|
|
|
327
|
-
| `authenticate(req, method, tool?)` | Return `{ id, scopes }`, or `null` → 401 + `WWW-Authenticate`. **Must reject tokens whose audience is not this server’s canonical resource** (see Threat model) |
|
|
328
|
-
| `context(req, principal)` | Build per-request ctx for tools (DB, env, …) |
|
|
329
|
-
| `audit?(entry)` |
|
|
327
|
+
| `authenticate(req, method, tool?)` | Return `{ id, scopes, claims? }`, or `null` → 401 + `WWW-Authenticate`. **Must reject tokens whose audience is not this server’s canonical resource** (see Threat model) |
|
|
328
|
+
| `context(req, principal)` | Build per-request ctx for tools (DB, env, …). Use `principal?.claims` for tenant / plan / role without re-decoding the bearer |
|
|
329
|
+
| `audit?(entry)` | Opt-in **metrics hook**: pass any function to receive tool results **and** every denial (bad token, missing scope, query-string token). `entry.method` is `""` for transport-level denials made before parsing. Throwing from this port never fails the request. Omit it and the library stays silent |
|
|
330
|
+
|
|
331
|
+
Pass any function to get per-request metrics — do what you want with them
|
|
332
|
+
(DB, APM, admin UI). The library never writes to stdout or a store on its
|
|
333
|
+
own. `consoleAudit` is only a convenience for local / small deploys;
|
|
334
|
+
[`examples/audit-store.ts`](examples/audit-store.ts) shows a ring buffer and
|
|
335
|
+
a DB-shaped sketch:
|
|
336
|
+
|
|
337
|
+
```ts
|
|
338
|
+
import { createMcpApp, consoleAudit } from "mcp-trellis";
|
|
339
|
+
|
|
340
|
+
createMcpApp({ /* … */, audit: consoleAudit });
|
|
341
|
+
|
|
342
|
+
// Or your own sink:
|
|
343
|
+
createMcpApp({
|
|
344
|
+
/* … */,
|
|
345
|
+
audit: (entry) => {
|
|
346
|
+
// entry: { method, tool?, principalId?, ok, error?, durationMs }
|
|
347
|
+
void metrics.record(entry);
|
|
348
|
+
},
|
|
349
|
+
});
|
|
350
|
+
```
|
|
351
|
+
|
|
352
|
+
Failures (denials and tool exceptions) go to `console.error` when using
|
|
353
|
+
`consoleAudit`; everything else to `console.log`. Entries never carry raw
|
|
354
|
+
exceptions or stack traces, so console output is safe. For anything beyond
|
|
355
|
+
stdout, write your own `audit` function — that is the intended production path.
|
|
330
356
|
|
|
331
357
|
`wwwAuthenticate` can be a static object or `(req) => …` when the PRM URL depends on origin.
|
|
332
358
|
|
|
@@ -364,7 +390,14 @@ createToolRegistry(tools, { validateArgs: false }) // default: off, easy adoptio
|
|
|
364
390
|
- Unknown tools and thrown errors become `isError: true` (not transport errors)
|
|
365
391
|
- Thrown exceptions are **redacted** by default (`"Tool execution failed"`); pass `onToolError` to map them. An `onToolError` that itself throws or returns a non-string falls back to the redacted default
|
|
366
392
|
- Duplicate tool names throw at registry construction
|
|
367
|
-
- Turn `validateArgs: true` once clients send schema-valid args
|
|
393
|
+
- Turn `validateArgs: true` once clients send schema-valid args. The evaluated
|
|
394
|
+
subset is `type`, `enum`, `required`, `properties`, `items`, `minimum`,
|
|
395
|
+
`maximum`. Pure metadata (`description`, `title`, `$schema`, `$id`,
|
|
396
|
+
`$comment`, `default`, `examples`, `deprecated`, `readOnly`, `writeOnly`,
|
|
397
|
+
`format`) is allowed and never evaluated. Any other keyword is not
|
|
398
|
+
evaluated — and with `validateArgs: true` `createToolRegistry` throws at
|
|
399
|
+
construction so a schema like `pattern` or `additionalProperties` cannot
|
|
400
|
+
silently look enforced
|
|
368
401
|
|
|
369
402
|
### Wrapping an API as a tool
|
|
370
403
|
|
|
@@ -408,6 +441,49 @@ const getWeather = apiTool({
|
|
|
408
441
|
- `defineTool` alone (without `request`/`respond`) is just the typed-args
|
|
409
442
|
layer over a regular `ToolDef` — use it for anything, not only REST calls.
|
|
410
443
|
|
|
444
|
+
## Multi-tenant (SaaS connectors)
|
|
445
|
+
|
|
446
|
+
Resource-per-tenant already works with **zero library change**.
|
|
447
|
+
`canonicalResource(origin, resourcePath)` is derived per request, and the
|
|
448
|
+
audience check in `createMcpApp` rejects a token minted for another origin
|
|
449
|
+
before any tool runs. Deploy `acme.mcp.example.com` and
|
|
450
|
+
`globex.mcp.example.com` as separate Hosts and cross-tenant token reuse is a
|
|
451
|
+
protocol failure, not an application bug.
|
|
452
|
+
|
|
453
|
+
For the in-tool half, derive the tenant from the request Host (or from the
|
|
454
|
+
verified audience after the library check) in your `context` port — that is
|
|
455
|
+
the isolation key. Optional `claims` from `verifyToken` (plan, role, …) are
|
|
456
|
+
handy metadata on `principal`; they are **not** Host→tenant authorization.
|
|
457
|
+
A forged `claims.tenant_id` with a matching audience must not change which
|
|
458
|
+
tenant's data a tool can see.
|
|
459
|
+
|
|
460
|
+
**Host caveat (API requirement).** On Node, multi-tenant needs a Host-derived
|
|
461
|
+
origin (`trustProxy: true` without a fixed `origin`). That path **requires**
|
|
462
|
+
a non-empty `allowedOrigins` at `asNodeHandler` construction — omit it and
|
|
463
|
+
construction throws. Use exact origins and/or `*.example.com` wildcards for
|
|
464
|
+
**https** subdomains; the **resolved** origin must match or the request
|
|
465
|
+
returns **400** before any OAuth or MCP handling. Loud opt-out:
|
|
466
|
+
`allowedOrigins: ["*"]` (admits any Host — only behind a proxy you trust to
|
|
467
|
+
strip client `X-Forwarded-*`). A fixed `origin` absent from a non-empty list
|
|
468
|
+
fails at construction; with a fixed `origin` the allowlist is optional
|
|
469
|
+
defense-in-depth. Absolute-form request targets are rebased onto that
|
|
470
|
+
validated origin, so a spoofed URL line cannot override it. A fixed `origin`
|
|
471
|
+
is otherwise safe but collapses every tenant onto one resource, so it cannot
|
|
472
|
+
do subdomain-per-tenant.
|
|
473
|
+
|
|
474
|
+
On Cloudflare Workers (or any wildcard route), apply the equivalent
|
|
475
|
+
allowlist check on `new URL(req.url).origin` before calling `app.fetch`
|
|
476
|
+
(`isAllowedOrigin` from `mcp-trellis/node`, or the same module the Worker
|
|
477
|
+
example imports).
|
|
478
|
+
|
|
479
|
+
Typechecked sketch: [`examples/multi-tenant.ts`](examples/multi-tenant.ts)
|
|
480
|
+
(needs a Host matching `*.mcp.example.com` — loopback alone is rejected).
|
|
481
|
+
Shared `codeStore` / revocation shapes: [`examples/stores.ts`](examples/stores.ts)
|
|
482
|
+
(atomic `setIfAbsent` for auth codes; Workers KV alone is not enough).
|
|
483
|
+
`audit` metrics sink (ring + DB sketch): [`examples/audit-store.ts`](examples/audit-store.ts).
|
|
484
|
+
Worker mount: [`examples/cloudflare-worker.ts`](examples/cloudflare-worker.ts)
|
|
485
|
+
(typecheck-only in CI — no wrangler).
|
|
486
|
+
|
|
411
487
|
## Reference
|
|
412
488
|
|
|
413
489
|
### Supported MCP methods
|
|
@@ -495,14 +571,15 @@ against their own `redirectUris` from `clientStore`.
|
|
|
495
571
|
<summary><code>mcp-trellis</code></summary>
|
|
496
572
|
|
|
497
573
|
- `createMcpApp`, `createMcpHandler`, `createToolRegistry`
|
|
574
|
+
- `consoleAudit` — convenience `audit` sink that logs to the console (pass any function for metrics / DB / APM)
|
|
498
575
|
- `defineTool`, `apiTool` — typed, validated tool authoring on top of `ToolDef`
|
|
499
576
|
- `CLIENT_PROFILES`, `DEFAULT_CLIENTS`, `authMethodsFor`, `redirectUrisFor`, `preRegisteredClients`, `hasDynamicClient`
|
|
500
577
|
- `parseBearer`, `timingSafeEqual`, `matchesAny`, `wwwAuthenticateHeader`, `rejectQueryToken`
|
|
501
|
-
- `validateAgainstSchema`, `JSON_SCHEMA_TYPES`
|
|
578
|
+
- `validateAgainstSchema`, `JSON_SCHEMA_TYPES`, `SUPPORTED_SCHEMA_KEYWORDS`, `IGNORED_SCHEMA_KEYWORDS`, `unsupportedKeywords`
|
|
502
579
|
- `rpcResult`, `rpcError`, JSON-RPC error constants
|
|
503
580
|
- `pickProtocolVersion`, `PROTOCOL_VERSIONS`, `DEFAULT_PROTOCOL_VERSION`
|
|
504
581
|
- `jsonResponse`, `emptyResponse`, `optionsResponse`, `corsHeaders`, `methodNotAllowed`
|
|
505
|
-
- Types: `McpApp`, `McpAppOptions`, `McpAppAuth`, `VerifiedToken`, `ClientName`, `ClientProfile`, `McpHandler`, `McpHandlerOptions`, `McpPorts`, `Principal`, `AuditEntry`, `ServerInfo`, `ToolDef`, `ToolHandler`, `ToolResult`, `ToolRegistry`, `JsonSchema`, `StandardSchemaV1`, `DefineToolOptions`, `ApiToolOptions`, `ApiRequest`, …
|
|
582
|
+
- Types: `McpApp`, `McpAppOptions`, `McpAppAuth`, `VerifiedToken`, `ClientName`, `ClientProfile`, `McpHandler`, `McpHandlerOptions`, `McpPorts`, `Principal`, `AuditEntry`, `ServerInfo`, `ToolDef`, `ToolHandler`, `ToolResult`, `ToolRegistry`, `JsonSchema`, `StandardSchemaV1`, `DefineToolOptions`, `ApiToolOptions`, `ApiRequest`, `ClientStore`, `RegisteredClient`, `CodeStore`, `MintAccessTokenInput`, `RefreshAccessTokenInput`, `RevokeTokenInput`, `MintedToken`, `OAuthUser`, …
|
|
506
583
|
|
|
507
584
|
</details>
|
|
508
585
|
|
|
@@ -525,8 +602,8 @@ against their own `redirectUris` from `clientStore`.
|
|
|
525
602
|
<details>
|
|
526
603
|
<summary><code>mcp-trellis/node</code></summary>
|
|
527
604
|
|
|
528
|
-
- `asNodeHandler`, `resolveOrigin`, `toWebRequest`, `sendWebResponse`, `readNodeBody`
|
|
529
|
-
- Types: `NodeRequestLike`, `NodeResponseLike`, `AsNodeHandlerOptions`
|
|
605
|
+
- `asNodeHandler`, `resolveOrigin`, `isAllowedOrigin`, `toWebRequest`, `sendWebResponse`, `readNodeBody`
|
|
606
|
+
- Types: `NodeRequestLike`, `NodeResponseLike`, `ToWebRequestOptions`, `ResolveOriginOptions`, `AsNodeHandlerOptions`, `OriginAllowlistOptions`
|
|
530
607
|
|
|
531
608
|
</details>
|
|
532
609
|
|
|
@@ -551,12 +628,13 @@ This is a **library** threat model, not a third-party audit badge.
|
|
|
551
628
|
| Audience not enforced at the RS | **`createMcpApp` enforces this** — `verifyToken` returns the token's `audience` and the library rejects any mismatch against `canonicalResource(origin, resourcePath)`. With bare `createMcpHandler`, the check is yours. |
|
|
552
629
|
| Open redirect after login | Your login page must validate `next` is same-origin before redirecting |
|
|
553
630
|
| Auth-code replay across instances | Pass a shared `codeStore`; in-memory jti map is process-local only |
|
|
554
|
-
| Origin spoofing on Node | Pass explicit `origin`, or `trustProxy: true` only behind a proxy that strips client `X-Forwarded
|
|
631
|
+
| Origin spoofing on Node | Pass explicit `origin`, or `trustProxy: true` only behind a proxy that strips client `X-Forwarded-*`. Host-derived origin **requires** non-empty `allowedOrigins` on `asNodeHandler` (`["*"]` to opt out loudly) |
|
|
555
632
|
| Scope escalation at authorize | Requested `scope` is validated against the advertised `scopes` and rejected with `invalid_scope`; the grant is bound into the auth code and handed to `mintAccessToken` |
|
|
556
633
|
| Stolen access or refresh token | Host `revokeToken` (denylist or equivalent) that `verifyToken` and `refreshAccessToken` consult. Unknown / wrong-client tokens MUST no-op, not throw. Well-formed authenticated revoke is 200 even if the token is unknown |
|
|
557
634
|
| Stolen confidential-client secret | `clientStore.verifySecret` owns comparison — store hashes, not plaintext. The library never sees or persists credentials |
|
|
558
635
|
| Registration-free DCR | `/register` returns a random `client_id` that is **never stored**; any unknown `client_id` works with an allowlisted `redirect_uri`. Defensible for public clients with PKCE — the model dynamic connectors (Claude, Codex) actually need. Pre-registered clients bypass this entirely, bound to their own `redirectUris` and auth method. CIMD replaces this model |
|
|
559
636
|
| Naming only confidential clients doesn't actually block public ones | `clients: ["gemini"]` (or `allowUnregisteredClients: false`) is **enforced**: DCR unmounted, dropped from AS metadata, unresolved `client_id` rejected with `unauthorized_client` at `authorize` and `invalid_client` at `token` and `revoke` |
|
|
637
|
+
| DCR / token-endpoint abuse | Edge or reverse-proxy rate limiting on `/register` and `/token`. The library does not rate-limit |
|
|
560
638
|
|
|
561
639
|
**Also designed in:** PKCE S256 (timing-safe, length-capped); HMAC auth codes bind `userId`, `clientId`, `redirectUri`, challenge, and `resource`; redirect allowlist + DCR filter; no query-string tokens (`token` and `access_token`); honest `grant_types_supported`; `/token` and `/revoke` omit CORS `*`; audit fires on auth/scope denial as well as tool results.
|
|
562
640
|
|
|
@@ -573,6 +651,7 @@ Explicitly **out** of this package (do not expect parity with full MCP hosts or
|
|
|
573
651
|
- **No embedded product surface** — no token store, sessions, or login UI
|
|
574
652
|
- **No stdio** transport; no batch JSON-RPC arrays
|
|
575
653
|
- **No DPoP, PAR, or `client_credentials`** — this AS is authorization_code (+ optional refresh and revoke)
|
|
654
|
+
- **No rate limiting** — put quotas on `/register` and `/token` at the edge or reverse proxy
|
|
576
655
|
- **No paid external security audit** claimed here — see Threat model above
|
|
577
656
|
|
|
578
657
|
See [docs/ROADMAP.md](docs/ROADMAP.md) for what is next — CIMD and the
|
package/dist/adapters/node.d.ts
CHANGED
|
@@ -2,6 +2,8 @@
|
|
|
2
2
|
* Node HTTP `(req, res)` adapter — Express, Cloud Functions, `http.createServer`, etc.
|
|
3
3
|
* Bridges duck-typed Node request/response objects to Web `Request`/`Response`.
|
|
4
4
|
*/
|
|
5
|
+
import { isAllowedOrigin, type OriginAllowlistOptions } from "./origins.js";
|
|
6
|
+
export { isAllowedOrigin, type OriginAllowlistOptions };
|
|
5
7
|
export type NodeRequestLike = {
|
|
6
8
|
method?: string;
|
|
7
9
|
url?: string;
|
|
@@ -20,16 +22,14 @@ export type ToWebRequestOptions = {
|
|
|
20
22
|
body?: unknown;
|
|
21
23
|
};
|
|
22
24
|
export type ResolveOriginOptions = {
|
|
23
|
-
/**
|
|
24
|
-
* Trust `X-Forwarded-Host` / `X-Forwarded-Proto`.
|
|
25
|
-
* Uses the **last** forwarded value (rightmost = closest proxy).
|
|
26
|
-
*/
|
|
25
|
+
/** Trust last `X-Forwarded-Host` / `X-Forwarded-Proto` hop. */
|
|
27
26
|
trustProxy?: boolean;
|
|
28
27
|
};
|
|
29
|
-
export type AsNodeHandlerOptions = {
|
|
28
|
+
export type AsNodeHandlerOptions = OriginAllowlistOptions & {
|
|
30
29
|
/**
|
|
31
|
-
* Absolute origin. Required unless `trustProxy: true
|
|
32
|
-
* (
|
|
30
|
+
* Absolute origin. Required unless `trustProxy: true`.
|
|
31
|
+
* When omitted (Host-derived), `allowedOrigins` must be non-empty
|
|
32
|
+
* (`["*"]` to admit any Host).
|
|
33
33
|
*/
|
|
34
34
|
origin?: string;
|
|
35
35
|
trustProxy?: boolean;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/adapters/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;
|
|
1
|
+
{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/adapters/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC5B,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,CAAC;AAExD,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,KAAK,IAAI,CAAC;IAC9E,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,KAAK,IAAI,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,+DAA+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,sBAAsB,GAAG;IAC1D;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AASF,0EAA0E;AAC1E,eAAO,MAAM,aAAa,GACxB,KAAK,eAAe,EACpB,UAAS,oBAAyB,KACjC,MAgBF,CAAC;AAcF,eAAO,MAAM,YAAY,GACvB,KAAK,eAAe,EACpB,SAAS,mBAAmB,KAC3B,OAwBF,CAAC;AAiBF,0EAA0E;AAC1E,eAAO,MAAM,YAAY,GACvB,KAAK,eAAe,KACnB,OAAO,CAAC,OAAO,CAWjB,CAAC;AAEF,eAAO,MAAM,eAAe,GAC1B,KAAK,gBAAgB,EACrB,UAAU,QAAQ,KACjB,OAAO,CAAC,IAAI,CAId,CAAC;AAaF,8DAA8D;AAC9D,eAAO,MAAM,aAAa,GACxB,KAAK;IAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,EACvD,UAAU,oBAAoB,MAyBhB,KAAK,eAAe,EAAE,KAAK,gBAAgB,KAAG,OAAO,CAAC,IAAI,CAezE,CAAC"}
|
package/dist/adapters/node.js
CHANGED
|
@@ -3,8 +3,9 @@
|
|
|
3
3
|
* Bridges duck-typed Node request/response objects to Web `Request`/`Response`.
|
|
4
4
|
*/
|
|
5
5
|
import { INTERNAL_ERROR } from "../http.js";
|
|
6
|
+
import { isAllowedOrigin, } from "./origins.js";
|
|
7
|
+
export { isAllowedOrigin };
|
|
6
8
|
const headerValue = (value) => (Array.isArray(value) ? value[0] : value);
|
|
7
|
-
/** Last comma-separated hop (closest trusted proxy). */
|
|
8
9
|
const lastForwarded = (value) => value?.split(",").pop()?.trim();
|
|
9
10
|
/** Derive origin from Host, or from forwarded headers when trustProxy. */
|
|
10
11
|
export const resolveOrigin = (req, options = {}) => {
|
|
@@ -22,30 +23,20 @@ export const resolveOrigin = (req, options = {}) => {
|
|
|
22
23
|
}
|
|
23
24
|
return `${proto}://${host}`;
|
|
24
25
|
};
|
|
25
|
-
const BODY_BUILDERS = [
|
|
26
|
-
{
|
|
27
|
-
match: (body) => body === undefined || body === null,
|
|
28
|
-
build: () => undefined,
|
|
29
|
-
},
|
|
30
|
-
{
|
|
31
|
-
match: (body) => typeof body === "string",
|
|
32
|
-
build: (body) => body,
|
|
33
|
-
},
|
|
34
|
-
{
|
|
35
|
-
match: (body) => body instanceof Uint8Array,
|
|
36
|
-
build: (body) => {
|
|
37
|
-
const bytes = body;
|
|
38
|
-
return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
|
|
39
|
-
},
|
|
40
|
-
},
|
|
41
|
-
];
|
|
42
26
|
const toBodyInit = (body) => {
|
|
43
|
-
|
|
44
|
-
|
|
27
|
+
if (body === undefined || body === null)
|
|
28
|
+
return undefined;
|
|
29
|
+
if (typeof body === "string")
|
|
30
|
+
return body;
|
|
31
|
+
if (body instanceof Uint8Array) {
|
|
32
|
+
return body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength);
|
|
33
|
+
}
|
|
34
|
+
return JSON.stringify(body);
|
|
45
35
|
};
|
|
46
36
|
export const toWebRequest = (req, options) => {
|
|
47
|
-
|
|
48
|
-
const
|
|
37
|
+
// Never trust an absolute-form request target — rebase onto the validated origin.
|
|
38
|
+
const target = new URL(req.url ?? "/", options.origin);
|
|
39
|
+
const url = `${options.origin}${target.pathname}${target.search}`;
|
|
49
40
|
const headers = new Headers(Object.entries(req.headers)
|
|
50
41
|
.map(([key, value]) => {
|
|
51
42
|
const resolved = headerValue(value);
|
|
@@ -91,25 +82,40 @@ export const sendWebResponse = async (res, response) => {
|
|
|
91
82
|
res.end(new Uint8Array(await response.arrayBuffer()));
|
|
92
83
|
};
|
|
93
84
|
/** Always answer — an unhandled rejection on `http.createServer` hangs the client. */
|
|
94
|
-
const
|
|
95
|
-
res.statusCode =
|
|
85
|
+
const sendJsonError = (res, status, error) => {
|
|
86
|
+
res.statusCode = status;
|
|
96
87
|
res.setHeader("Content-Type", "application/json");
|
|
97
|
-
res.end(JSON.stringify({ error
|
|
88
|
+
res.end(JSON.stringify({ error }));
|
|
98
89
|
};
|
|
99
90
|
/** One-liner: Node `(req, res)` → MCP / OAuth Web handler. */
|
|
100
91
|
export const asNodeHandler = (mcp, options) => {
|
|
101
|
-
|
|
92
|
+
const hostDerived = !options?.origin;
|
|
93
|
+
if (hostDerived && options?.trustProxy !== true) {
|
|
102
94
|
throw new Error("asNodeHandler requires options.origin or options.trustProxy: true");
|
|
103
95
|
}
|
|
96
|
+
// Forgettable Host spoof → AS issuer / PRM / WWW-Authenticate. Require an
|
|
97
|
+
// explicit allowlist whenever origin comes from the request.
|
|
98
|
+
if (hostDerived && !options.allowedOrigins?.length) {
|
|
99
|
+
throw new Error('asNodeHandler with Host-derived origin requires options.allowedOrigins (use ["*"] to admit any Host)');
|
|
100
|
+
}
|
|
101
|
+
if (options?.origin &&
|
|
102
|
+
options.allowedOrigins?.length &&
|
|
103
|
+
!isAllowedOrigin(options.origin, options)) {
|
|
104
|
+
throw new Error("asNodeHandler: options.origin is not in options.allowedOrigins");
|
|
105
|
+
}
|
|
104
106
|
return async (req, res) => {
|
|
105
107
|
try {
|
|
106
|
-
const origin = options
|
|
108
|
+
const origin = options?.origin ?? resolveOrigin(req, { trustProxy: true });
|
|
109
|
+
if (!isAllowedOrigin(origin, options)) {
|
|
110
|
+
sendJsonError(res, 400, "origin not allowed");
|
|
111
|
+
return;
|
|
112
|
+
}
|
|
107
113
|
const body = await readNodeBody(req);
|
|
108
114
|
const request = toWebRequest(req, { origin, body });
|
|
109
115
|
await sendWebResponse(res, await mcp.fetch(request));
|
|
110
116
|
}
|
|
111
117
|
catch {
|
|
112
|
-
|
|
118
|
+
sendJsonError(res, 500, INTERNAL_ERROR);
|
|
113
119
|
}
|
|
114
120
|
};
|
|
115
121
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"node.js","sourceRoot":"","sources":["../../src/adapters/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"node.js","sourceRoot":"","sources":["../../src/adapters/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EACL,eAAe,GAEhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,eAAe,EAA+B,CAAC;AAqCxD,MAAM,WAAW,GAAG,CAClB,KAAoC,EAChB,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAEnE,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAsB,EAAE,CACtE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;AAElC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,GAAoB,EACpB,UAAgC,EAAE,EAC1B,EAAE;IACV,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,UAAU;QACtB,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,OAAO;QACzE,CAAC,CAAC,OAAO,CAAC;IACZ,MAAM,IAAI,GAAG,UAAU;QACrB,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAC3D,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/B,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,wDAAwD;YACtD,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC,CAC5C,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,IAAa,EAAwB,EAAE;IACzD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,YAAY,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CACtB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CACnB,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,GAAoB,EACpB,OAA4B,EACnB,EAAE;IACX,kFAAkF;IAClF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,OAAO,CACzB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAA2B,EAAE;QAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAChE,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAClE,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE;QACtB,MAAM;QACN,OAAO;QACP,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;KACvB,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,KAAc,EAAmC,EAAE,CAC1E,OAAQ,KAAqD,EAAE,CAC7D,MAAM,CAAC,aAAa,CACrB,KAAK,UAAU,CAAC;AAEnB,MAAM,YAAY,GAAG,CAAC,MAAoB,EAAc,EAAE;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAC9B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvB,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC;IACnC,CAAC,EAAE,CAAC,CAAC,CAAC;IACN,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAoB,EACF,EAAE;IACpB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IACjE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE5C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAyC,EAAE,CAAC;QACpE,MAAM,CAAC,IAAI,CACT,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,GAAqB,EACrB,QAAkB,EACH,EAAE;IACjB,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACpE,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC,CAAC;AAEF,sFAAsF;AACtF,MAAM,aAAa,GAAG,CACpB,GAAqB,EACrB,MAAc,EACd,KAAa,EACP,EAAE;IACR,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;IACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,GAAuD,EACvD,OAA8B,EAC9B,EAAE;IACF,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;IACrC,IAAI,WAAW,IAAI,OAAO,EAAE,UAAU,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,6DAA6D;IAC7D,IAAI,WAAW,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,IACE,OAAO,EAAE,MAAM;QACf,OAAO,CAAC,cAAc,EAAE,MAAM;QAC9B,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAiB,EAAE;QAC1E,IAAI,CAAC;YACH,MAAM,MAAM,GACV,OAAO,EAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBACtC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC"}
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Origin allowlist for Host-derived Node origins (multi-tenant SaaS).
|
|
3
|
+
* Same predicate shape as redirect allowlisting — not secret comparison.
|
|
4
|
+
*/
|
|
5
|
+
export type OriginAllowlistOptions = {
|
|
6
|
+
/**
|
|
7
|
+
* Exact origins (`https://acme.example.com`) and/or `*.example.com`
|
|
8
|
+
* wildcards. Wildcards match https subdomains only (not the apex, not http).
|
|
9
|
+
* `"*"` admits any origin (loud opt-out).
|
|
10
|
+
*
|
|
11
|
+
* Empty/omitted list → admit all (only safe with a fixed `asNodeHandler`
|
|
12
|
+
* `origin`). Host-derived `asNodeHandler` requires a non-empty list at
|
|
13
|
+
* construction. Resolved origin outside the list → 400; a fixed `origin`
|
|
14
|
+
* absent from a non-empty list throws at construction.
|
|
15
|
+
*/
|
|
16
|
+
allowedOrigins?: string[];
|
|
17
|
+
};
|
|
18
|
+
export declare const isAllowedOrigin: (origin: string, options?: OriginAllowlistOptions) => boolean;
|
|
19
|
+
//# sourceMappingURL=origins.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../../src/adapters/origins.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,sBAAsB,GAAG;IACnC;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,CAAC;AA+CF,eAAO,MAAM,eAAe,GAC1B,QAAQ,MAAM,EACd,UAAS,sBAA2B,KACnC,OAQF,CAAC"}
|
|
@@ -0,0 +1,55 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Origin allowlist for Host-derived Node origins (multi-tenant SaaS).
|
|
3
|
+
* Same predicate shape as redirect allowlisting — not secret comparison.
|
|
4
|
+
*/
|
|
5
|
+
const originOf = (value) => {
|
|
6
|
+
try {
|
|
7
|
+
return new URL(value).origin;
|
|
8
|
+
}
|
|
9
|
+
catch {
|
|
10
|
+
return null;
|
|
11
|
+
}
|
|
12
|
+
};
|
|
13
|
+
const isExactOrigin = (origin, options) => {
|
|
14
|
+
const normalized = originOf(origin);
|
|
15
|
+
if (!normalized)
|
|
16
|
+
return false;
|
|
17
|
+
return Boolean(options.allowedOrigins?.some((entry) => {
|
|
18
|
+
if (entry.startsWith("*."))
|
|
19
|
+
return false;
|
|
20
|
+
return originOf(entry) === normalized;
|
|
21
|
+
}));
|
|
22
|
+
};
|
|
23
|
+
/** `*.example.com` matches `https://acme.example.com`, not the apex, not http. */
|
|
24
|
+
const isWildcardSubdomain = (origin, options) => {
|
|
25
|
+
const patterns = options.allowedOrigins ?? [];
|
|
26
|
+
try {
|
|
27
|
+
const { protocol, hostname } = new URL(origin);
|
|
28
|
+
if (protocol !== "https:")
|
|
29
|
+
return false;
|
|
30
|
+
return patterns.some((entry) => {
|
|
31
|
+
if (!entry.startsWith("*."))
|
|
32
|
+
return false;
|
|
33
|
+
const suffix = entry.slice(1); // ".example.com"
|
|
34
|
+
return hostname.endsWith(suffix) && hostname.length > suffix.length;
|
|
35
|
+
});
|
|
36
|
+
}
|
|
37
|
+
catch {
|
|
38
|
+
return false;
|
|
39
|
+
}
|
|
40
|
+
};
|
|
41
|
+
const ORIGIN_PREDICATES = [
|
|
42
|
+
isExactOrigin,
|
|
43
|
+
isWildcardSubdomain,
|
|
44
|
+
];
|
|
45
|
+
export const isAllowedOrigin = (origin, options = {}) => {
|
|
46
|
+
// Empty/omitted: admit all — callers that derive origin from Host must
|
|
47
|
+
// require a non-empty list before reaching here (see asNodeHandler).
|
|
48
|
+
if (!options.allowedOrigins || options.allowedOrigins.length === 0) {
|
|
49
|
+
return true;
|
|
50
|
+
}
|
|
51
|
+
if (options.allowedOrigins.includes("*"))
|
|
52
|
+
return true;
|
|
53
|
+
return ORIGIN_PREDICATES.some((predicate) => predicate(origin, options));
|
|
54
|
+
};
|
|
55
|
+
//# sourceMappingURL=origins.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"origins.js","sourceRoot":"","sources":["../../src/adapters/origins.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAqBH,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAiB,EAAE;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,aAAa,GAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACzD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,OAAO,CACZ,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACrC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,OAAO,QAAQ,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC;IACxC,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,mBAAmB,GAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC7B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;YAChD,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAsB;IAC3C,aAAa;IACb,mBAAmB;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,MAAc,EACd,UAAkC,EAAE,EAC3B,EAAE;IACX,uEAAuE;IACvE,qEAAqE;IACrE,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3E,CAAC,CAAC"}
|
package/dist/app.d.ts
CHANGED
|
@@ -15,6 +15,8 @@ export type VerifiedToken = {
|
|
|
15
15
|
scopes: string[];
|
|
16
16
|
/** RFC 8707 audience the token was minted for. */
|
|
17
17
|
audience: string;
|
|
18
|
+
/** Optional host claims passed through to `context` via `Principal`. */
|
|
19
|
+
claims?: Record<string, unknown>;
|
|
18
20
|
};
|
|
19
21
|
export type McpAppAuth = {
|
|
20
22
|
/** HMAC secret for signing auth codes. */
|
|
@@ -60,6 +62,12 @@ export type McpAppOptions<TCtx> = {
|
|
|
60
62
|
onToolError?: (exc: unknown) => string;
|
|
61
63
|
/** Per-request context for tools. Defaults to an empty object. */
|
|
62
64
|
context?: (req: Request, principal: Principal | null) => TCtx | Promise<TCtx>;
|
|
65
|
+
/**
|
|
66
|
+
* Opt-in metrics hook — same as `McpPorts.audit`. Pass a function to get
|
|
67
|
+
* per-request entries (tools + denials); omit for silence. The library
|
|
68
|
+
* never stores or prints these itself. See `consoleAudit` or
|
|
69
|
+
* `examples/audit-store.ts`.
|
|
70
|
+
*/
|
|
63
71
|
audit?: (entry: AuditEntry) => void | Promise<void>;
|
|
64
72
|
};
|
|
65
73
|
export type McpApp = {
|
package/dist/app.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAML,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAOtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EACV,WAAW,EACX,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,uBAAuB,EACvB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAsB,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAEjE,6EAA6E;AAC7E,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAML,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAOtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EACV,WAAW,EACX,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,uBAAuB,EACvB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAsB,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAEjE,6EAA6E;AAC7E,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,oEAAoE;IACpE,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzD,wDAAwD;IACxD,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACrD,8DAA8D;IAC9D,eAAe,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE;;;;OAIG;IACH,WAAW,EAAE,CACX,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,OAAO,KACT,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACnC,kBAAkB,CAAC,EAAE,CACnB,KAAK,EAAE,uBAAuB,KAC3B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACjC,8DAA8D;IAC9D,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,IAAI,IAAI;IAChC,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IACvB,IAAI,EAAE,UAAU,CAAC;IACjB,yDAAyD;IACzD,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,+DAA+D;IAC/D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACvC,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG;IACnB,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAChD,CAAC;AAEF,eAAO,MAAM,YAAY,GAAI,IAAI,EAC/B,SAAS,aAAa,CAAC,IAAI,CAAC,KAC3B,MA2FF,CAAC"}
|
package/dist/app.js
CHANGED
|
@@ -35,7 +35,7 @@ export const createMcpApp = (options) => {
|
|
|
35
35
|
const expected = canonicalResource(new URL(req.url).origin, resourcePath);
|
|
36
36
|
if (!resourcesEqual(verified.audience, expected))
|
|
37
37
|
return null;
|
|
38
|
-
return { id: verified.userId, scopes: verified.scopes };
|
|
38
|
+
return { id: verified.userId, scopes: verified.scopes, claims: verified.claims };
|
|
39
39
|
};
|
|
40
40
|
const handler = createMcpHandler({
|
|
41
41
|
registry,
|
package/dist/app.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,cAAc,EACd,eAAe,GAEhB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAU7B,OAAO,EAAE,kBAAkB,EAAgB,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,cAAc,EACd,eAAe,GAEhB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAU7B,OAAO,EAAE,kBAAkB,EAAgB,MAAM,eAAe,CAAC;AA2EjE,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,OAA4B,EACpB,EAAE;IACV,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,GAAG,YAAY,QAAQ,CAAC;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAEvD,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,kBAAkB,CAAO,OAAO,CAAC,KAAK,EAAE;QACvD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,YAAY,GAAG,KAAK,EAAE,GAAY,EAA6B,EAAE;QACrE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC1E,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAE9D,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACnF,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,gBAAgB,CAAO;QACrC,QAAQ;QACR,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACzB,KAAK;YACL,mBAAmB,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,wCAAwC,YAAY,EAAE;SACtG,CAAC;QACF,KAAK,EAAE;YACL,YAAY;YACZ,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAS,CAAC;YAChD,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB;KACF,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,YAAY;QACZ,SAAS;QACT,KAAK;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,wBAAwB,EAAE,cAAc,CAAC,OAAO,CAAC;QACjD,wBAAwB,EAAE,gBAAgB,CAAC,OAAO,CAAC;QACnD,QAAQ,EAAE;YACR,yDAAyD;YACzD,KAAK,EAAE;gBACL,GAAG,eAAe,CAAC,OAAO,CAAC;gBAC3B,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;aACrC;YACD,WAAW,EAAE,KAAK;YAClB,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;SAC7C;QACD,KAAK,EAAE;YACL,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;YACnC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW;YACrC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;YAC/B,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe;YAC7C,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB;YACnD,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW;YACrC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS;YACjC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW;SACtC;KACF,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,OAAgB,EAAqB,EAAE;YACnD,IAAI,CAAC;gBACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBACrD,IAAI,aAAa;oBAAE,OAAO,aAAa,CAAC;gBAExC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;oBACnD,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACtC,CAAC;gBACD,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;gBAC/D,kEAAkE;gBAClE,oCAAoC;gBACpC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}
|
package/dist/audit.d.ts
ADDED
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
import type { AuditEntry } from "./methods.js";
|
|
2
|
+
/**
|
|
3
|
+
* Convenience `audit` sink that logs each entry to the console.
|
|
4
|
+
*
|
|
5
|
+
* The real metrics hook is any function you pass as `audit` — the library
|
|
6
|
+
* never writes to stdout or a store on its own. Use this for local / small
|
|
7
|
+
* deploys; swap in your own function for DB, APM, or an admin feed
|
|
8
|
+
* (see `examples/audit-store.ts`):
|
|
9
|
+
*
|
|
10
|
+
* createMcpApp({ ..., audit: consoleAudit })
|
|
11
|
+
* createMcpApp({ ..., audit: (entry) => { void insert(entry) } })
|
|
12
|
+
*
|
|
13
|
+
* Failures (`ok: false`, including transport-level denials and tool
|
|
14
|
+
* exceptions) go to `console.error`; everything else to `console.log`.
|
|
15
|
+
* Entries never carry raw exceptions or stack traces (see `AuditEntry`).
|
|
16
|
+
*/
|
|
17
|
+
export declare const consoleAudit: (entry: AuditEntry) => void;
|
|
18
|
+
//# sourceMappingURL=audit.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,UAAU,KAAG,IAiBhD,CAAC"}
|
package/dist/audit.js
ADDED
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Convenience `audit` sink that logs each entry to the console.
|
|
3
|
+
*
|
|
4
|
+
* The real metrics hook is any function you pass as `audit` — the library
|
|
5
|
+
* never writes to stdout or a store on its own. Use this for local / small
|
|
6
|
+
* deploys; swap in your own function for DB, APM, or an admin feed
|
|
7
|
+
* (see `examples/audit-store.ts`):
|
|
8
|
+
*
|
|
9
|
+
* createMcpApp({ ..., audit: consoleAudit })
|
|
10
|
+
* createMcpApp({ ..., audit: (entry) => { void insert(entry) } })
|
|
11
|
+
*
|
|
12
|
+
* Failures (`ok: false`, including transport-level denials and tool
|
|
13
|
+
* exceptions) go to `console.error`; everything else to `console.log`.
|
|
14
|
+
* Entries never carry raw exceptions or stack traces (see `AuditEntry`).
|
|
15
|
+
*/
|
|
16
|
+
export const consoleAudit = (entry) => {
|
|
17
|
+
const line = [
|
|
18
|
+
`[mcp-trellis] ${entry.method || "(transport)"}`,
|
|
19
|
+
entry.tool ? `tool=${entry.tool}` : undefined,
|
|
20
|
+
entry.ok ? "ok" : "fail",
|
|
21
|
+
`${entry.durationMs}ms`,
|
|
22
|
+
entry.principalId ? `user=${entry.principalId}` : undefined,
|
|
23
|
+
entry.error ? `error=${entry.error}` : undefined,
|
|
24
|
+
]
|
|
25
|
+
.filter(Boolean)
|
|
26
|
+
.join(" ");
|
|
27
|
+
if (entry.ok) {
|
|
28
|
+
console.log(line);
|
|
29
|
+
}
|
|
30
|
+
else {
|
|
31
|
+
console.error(line);
|
|
32
|
+
}
|
|
33
|
+
};
|
|
34
|
+
//# sourceMappingURL=audit.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAQ,EAAE;IACtD,MAAM,IAAI,GAAG;QACX,iBAAiB,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE;QAChD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC7C,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QACxB,GAAG,KAAK,CAAC,UAAU,IAAI;QACvB,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;QAC3D,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;KACjD;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;IAEb,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;AACH,CAAC,CAAC"}
|
package/dist/methods.d.ts
CHANGED
|
@@ -4,7 +4,10 @@ import { type WwwAuthenticateOptions } from "./auth/bearer.js";
|
|
|
4
4
|
export type Principal = {
|
|
5
5
|
id: string;
|
|
6
6
|
scopes: string[];
|
|
7
|
+
/** Optional host claims from `verifyToken` (tenant, plan, role, …). */
|
|
8
|
+
claims?: Record<string, unknown>;
|
|
7
9
|
};
|
|
10
|
+
/** Per-request metrics emitted through the optional `audit` port. */
|
|
8
11
|
export type AuditEntry = {
|
|
9
12
|
/** JSON-RPC method, or `""` for transport-level rejections made before parsing. */
|
|
10
13
|
method: string;
|
|
@@ -17,6 +20,12 @@ export type AuditEntry = {
|
|
|
17
20
|
export type McpPorts<TCtx> = {
|
|
18
21
|
authenticate: (req: Request, method: string, tool?: string) => Promise<Principal | null>;
|
|
19
22
|
context: (req: Request, principal: Principal | null) => TCtx | Promise<TCtx>;
|
|
23
|
+
/**
|
|
24
|
+
* Opt-in metrics hook. Pass any function to receive each tool result and
|
|
25
|
+
* every denial (bad token, missing scope, query-string token). Omit it and
|
|
26
|
+
* the library stays silent — no stdout, no store. Do what you want with
|
|
27
|
+
* `entry` (DB, APM, admin UI). Throwing never fails the request.
|
|
28
|
+
*/
|
|
20
29
|
audit?: (entry: AuditEntry) => void | Promise<void>;
|
|
21
30
|
};
|
|
22
31
|
export type ServerInfo = {
|
|
@@ -37,7 +46,7 @@ export declare const isNotification: (body: JsonRpcRequest) => boolean;
|
|
|
37
46
|
export declare const resolveWww: <TCtx>(options: McpHandlerOptions<TCtx>, req: Request) => WwwAuthenticateOptions;
|
|
38
47
|
export declare const unauthorized: (www: WwwAuthenticateOptions, message?: string) => Response;
|
|
39
48
|
/**
|
|
40
|
-
* Invoke the audit
|
|
49
|
+
* Invoke the audit metrics hook, swallowing any failure.
|
|
41
50
|
* Telemetry must never turn a served response into a transport error —
|
|
42
51
|
* this is the only call path to `ports.audit`.
|
|
43
52
|
*/
|
package/dist/methods.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../src/methods.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,cAAc,EAGpB,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../src/methods.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,cAAc,EAGpB,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,UAAU,GAAG;IACvB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,QAAQ,CAAC,IAAI,IAAI;IAC3B,YAAY,EAAE,CACZ,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,KACV,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC/B,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,IAAI,IAAI;IACpC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;IAC7B,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,EACX,sBAAsB,GACtB,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,sBAAsB,CAAC,CAAC;IAC/C,2EAA2E;IAC3E,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,sBAAsB,aAKjC,CAAC;AAUH,eAAO,MAAM,cAAc,GAAI,MAAM,cAAc,KAAG,OACQ,CAAC;AAE/D,eAAO,MAAM,UAAU,GAAI,IAAI,EAC7B,SAAS,iBAAiB,CAAC,IAAI,CAAC,EAChC,KAAK,OAAO,KACX,sBAG0B,CAAC;AAE9B,eAAO,MAAM,YAAY,GACvB,KAAK,sBAAsB,EAC3B,gBAAwB,KACvB,QAGC,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,SAAS,GAAU,IAAI,EAClC,SAAS,iBAAiB,CAAC,IAAI,CAAC,EAChC,OAAO,UAAU,KAChB,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF,eAAO,MAAM,QAAQ,GACnB,WAAW,SAAS,EACpB,OAAO,MAAM,GAAG,SAAS,KACxB,OAGF,CAAC;AAoEF,eAAO,MAAM,WAAW,GAAU,IAAI,EAAE,OAAO;IAC7C,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACjC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC5B,KAAG,OAAO,CAAC,QAAQ,CAsCnB,CAAC"}
|
package/dist/methods.js
CHANGED
|
@@ -21,7 +21,7 @@ export const unauthorized = (www, message = "Unauthorized") => jsonResponse(rpcE
|
|
|
21
21
|
"WWW-Authenticate": wwwAuthenticateHeader(www),
|
|
22
22
|
});
|
|
23
23
|
/**
|
|
24
|
-
* Invoke the audit
|
|
24
|
+
* Invoke the audit metrics hook, swallowing any failure.
|
|
25
25
|
* Telemetry must never turn a served response into a transport error —
|
|
26
26
|
* this is the only call path to `ports.audit`.
|
|
27
27
|
*/
|
package/dist/methods.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"methods.js","sourceRoot":"","sources":["../src/methods.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EAGpB,QAAQ,EACR,SAAS,GACV,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EACL,qBAAqB,GAEtB,MAAM,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"methods.js","sourceRoot":"","sources":["../src/methods.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EAGpB,QAAQ,EACR,SAAS,GACV,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EACL,qBAAqB,GAEtB,MAAM,kBAAkB,CAAC;AAqD1B,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IAC5C,YAAY;IACZ,MAAM;IACN,2BAA2B;IAC3B,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAA6C;IACxE,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC;IAC7E,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,aAAa;IACvC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,IAAI,IAAI;CACzE,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAoB,EAAW,EAAE,CAC9D,uBAAuB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,OAAgC,EAChC,GAAY,EACY,EAAE,CAC1B,OAAO,OAAO,CAAC,eAAe,KAAK,UAAU;IAC3C,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC;IAC9B,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;AAE9B,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,GAA2B,EAC3B,OAAO,GAAG,cAAc,EACd,EAAE,CACZ,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE;IAC/D,kBAAkB,EAAE,qBAAqB,CAAC,GAAG,CAAC;CAC/C,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAC5B,OAAgC,EAChC,KAAiB,EACF,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,SAAoB,EACpB,KAAyB,EAChB,EAAE;IACX,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5E,CAAC,CAAC;AAWF,MAAM,OAAO,GAAG;IACd,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAC1C,YAAY,CACV,SAAS,CAAC,EAAE,EAAE;QACZ,eAAe,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;QACjD,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE;KACzC,CAAC,CACH;IAEH,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAEvD,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CACtC,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAEjE,YAAY,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC;QACjC,MAAM,IAAI,GACR,OAAO,KAAK,IAAI;YAChB,OAAO,OAAO,KAAK,QAAQ;YAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACrB,CAAC,CAAE,OAAmC;YACtC,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,SAAS,CAAC,OAAO,EAAE;gBACvB,MAAM,EAAE,YAAY;gBACpB,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,SAAS,EAAE,EAAE;gBAC1B,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,eAAe;gBACtB,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;YACH,OAAO,YAAY,CACjB,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,EACxB,kBAAkB,IAAI,CAAC,KAAK,EAAE,CAC/B,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,SAAS,CAAC,OAAO,EAAE;YACvB,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,IAAI;YACV,WAAW,EAAE,SAAS,EAAE,EAAE;YAC1B,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO;YACnB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS;YAC3D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SACjC,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;CACmD,CAAC;AAEvD,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAQ,KAKvC,EAAqB,EAAE;IACtB,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,2EAA2E;IAC3E,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IAClD,MAAM,QAAQ,GACZ,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAExE,MAAM,QAAQ,GACZ,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IACnE,IAAI,SAAS,GAAqB,IAAI,CAAC;IAEvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,SAAS,CAAC,OAAO,EAAE;gBACvB,MAAM;gBACN,IAAI,EAAE,QAAQ;gBACd,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,cAAc;gBACrB,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAI,OAAsD,CACrE,MAAM,CACP,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS;YAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;QACrD,OAAO,YAAY,CACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,wBAAwB,EAAE,qBAAqB,MAAM,EAAE,CAAC,CAC3E,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxD,OAAO,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7D,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,YAAY,CAAC;AAMpB,YAAY,EACV,SAAS,EACT,WAAW,EACX,UAAU,EACV,kBAAkB,GACnB,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,YAAY,CAAC;AAMpB,YAAY,EACV,SAAS,EACT,WAAW,EACX,UAAU,EACV,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAsDpB,MAAM,MAAM,WAAW,GAAG;IACxB,6EAA6E;IAC7E,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CAC3D,CAAC;AAIF,eAAO,MAAM,iBAAiB,GAC5B,SAAS,kBAAkB,KAC1B,WA4DF,CAAC;AAEF,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,EACX,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,YAAY,EACZ,aAAa,EACb,2BAA2B,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,WAAW,EACX,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AACxD,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,gBAAgB,EAChB,WAAW,EACX,gBAAgB,GACjB,MAAM,YAAY,CAAC"}
|
package/dist/oauth/router.js
CHANGED
|
@@ -28,14 +28,23 @@ const handleRegister = async (request, options) => {
|
|
|
28
28
|
catch {
|
|
29
29
|
redirectUris = [];
|
|
30
30
|
}
|
|
31
|
-
|
|
32
|
-
|
|
31
|
+
// No redirect_uris in the body: fall back to the Claude callback only if
|
|
32
|
+
// this server's own allowlist actually accepts it — never advertise a
|
|
33
|
+
// redirect_uri that `/authorize` would go on to reject (e.g. `clients`
|
|
34
|
+
// without `"claude"`, where `createMcpApp` sets `allowClaude: false`).
|
|
35
|
+
if (!suppliedRedirectUris && isAllowedRedirectUri(CLAUDE_CALLBACK, options.redirect)) {
|
|
36
|
+
redirectUris = [CLAUDE_CALLBACK];
|
|
37
|
+
}
|
|
38
|
+
if (redirectUris.length === 0) {
|
|
39
|
+
return oauthError(OAUTH_ERRORS.invalidRedirectUri, 400, suppliedRedirectUris
|
|
40
|
+
? "no allowed redirect_uris"
|
|
41
|
+
: "redirect_uris required — this server has no default redirect_uri");
|
|
33
42
|
}
|
|
34
43
|
return jsonResponse({
|
|
35
44
|
client_id: newClientId(),
|
|
36
45
|
client_id_issued_at: Math.floor(Date.now() / 1000),
|
|
37
46
|
token_endpoint_auth_method: "none",
|
|
38
|
-
redirect_uris: redirectUris
|
|
47
|
+
redirect_uris: redirectUris,
|
|
39
48
|
grant_types: [GRANT_TYPES.authorizationCode],
|
|
40
49
|
response_types: ["code"],
|
|
41
50
|
});
|
package/dist/oauth/router.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,UAAU,EACV,0BAA0B,GAE3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AASjD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEpC,MAAM,cAAc,GAAG,KAAK,EAC1B,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,IAAI,YAAY,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,oBAAoB,GAAG,IAAI,CAAC;YAC5B,YAAY,GAAG,GAAG;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;iBACrB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,IAAI,oBAAoB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,UAAU,EACV,0BAA0B,GAE3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AASjD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEpC,MAAM,cAAc,GAAG,KAAK,EAC1B,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,IAAI,YAAY,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,oBAAoB,GAAG,IAAI,CAAC;YAC5B,YAAY,GAAG,GAAG;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;iBACrB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,CAAC,oBAAoB,IAAI,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrF,YAAY,GAAG,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,UAAU,CACf,YAAY,CAAC,kBAAkB,EAC/B,GAAG,EACH,oBAAoB;YAClB,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,kEAAkE,CACvE,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC;QAClB,SAAS,EAAE,WAAW,EAAE;QACxB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,0BAA0B,EAAE,MAAM;QAClC,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC;QAC5C,cAAc,EAAE,CAAC,MAAM,CAAC;KACzB,CAAC,CAAC;AACL,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,OAA2B,EACd,EAAE;IACf,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IAEpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,uCAAuC;QACvC,wCAAwC,YAAY,EAAE;KACvD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,yCAAyC;QACzC,0CAA0C,YAAY,EAAE;KACzD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAiC;QAC3C,GAAG,CAAC,0BAA0B,CAAC,OAAO,CAAC;YACrC,CAAC,CAAC;gBACE,CAAC,GAAG,SAAS,WAAW,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAC9C,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;aACnC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,SAAS,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1E,CAAC,GAAG,SAAS,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;QAClE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;YAC3B,CAAC,CAAC;gBACE,CAAC,GAAG,SAAS,SAAS,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAC5C,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;aACjC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,KAAK,EAAE,OAAgB,EAA4B,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAE3C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE;oBACpD,QAAQ;oBACR,OAAO;oBACP,YAAY;oBACZ,SAAS;iBACV,CAAC,CAAC;gBACH,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;gBAExB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,iEAAiE;gBACjE,4DAA4D;gBAC5D,OAAO,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,GAGZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,YAAY,EACZ,aAAa,EACb,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,WAAW,EACX,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAmB,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC"}
|
package/dist/registry.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,WAAW,CAAC,IAAI,IAAI,CAC9B,GAAG,EAAE,IAAI,EACT,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,GAAG,UAAU,GAAG,MAAM,CAAC;AAExD,MAAM,MAAM,OAAO,CAAC,IAAI,IAAI;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,YAAY,CAAC,IAAI,IAAI;IAC/B,IAAI,EAAE,MAAM,aAAa,EAAE,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IACjD,IAAI,EAAE,CACJ,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,IAAI,EACT,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,UAAU,CAAC,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,mEAAmE;IACnE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;CACxC,CAAC;AAoCF,eAAO,MAAM,kBAAkB,GAAI,IAAI,EACrC,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,EACtB,UAAS,eAAoB,KAC5B,YAAY,CAAC,IAAI,
|
|
1
|
+
{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,WAAW,CAAC,IAAI,IAAI,CAC9B,GAAG,EAAE,IAAI,EACT,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,GAAG,UAAU,GAAG,MAAM,CAAC;AAExD,MAAM,MAAM,OAAO,CAAC,IAAI,IAAI;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,YAAY,CAAC,IAAI,IAAI;IAC/B,IAAI,EAAE,MAAM,aAAa,EAAE,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IACjD,IAAI,EAAE,CACJ,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,IAAI,EACT,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,UAAU,CAAC,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,mEAAmE;IACnE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;CACxC,CAAC;AAoCF,eAAO,MAAM,kBAAkB,GAAI,IAAI,EACrC,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,EACtB,UAAS,eAAoB,KAC5B,YAAY,CAAC,IAAI,CA+CnB,CAAC"}
|
package/dist/registry.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { validateAgainstSchema } from "./validate.js";
|
|
1
|
+
import { unsupportedKeywords, validateAgainstSchema } from "./validate.js";
|
|
2
2
|
const DEFAULT_TOOL_ERROR = "Tool execution failed";
|
|
3
3
|
/**
|
|
4
4
|
* Map a tool exception to client-visible text.
|
|
@@ -33,6 +33,14 @@ export const createToolRegistry = (tools, options = {}) => {
|
|
|
33
33
|
if (byName.size !== tools.length) {
|
|
34
34
|
throw new Error("duplicate tool names in registry");
|
|
35
35
|
}
|
|
36
|
+
if (options.validateArgs) {
|
|
37
|
+
const violations = tools.flatMap((tool) => unsupportedKeywords(tool.inputSchema).map((path) => `${tool.name}: unsupported JSON Schema keyword at ${path}`));
|
|
38
|
+
if (violations.length > 0) {
|
|
39
|
+
throw new Error(`validateArgs: true but inputSchema uses unsupported keywords:\n` +
|
|
40
|
+
violations.join("\n") +
|
|
41
|
+
"\nRemove the keyword, enforce it in the handler, or set validateArgs: false");
|
|
42
|
+
}
|
|
43
|
+
}
|
|
36
44
|
return {
|
|
37
45
|
list: () => tools.map(({ name, description, inputSchema }) => ({
|
|
38
46
|
name,
|
package/dist/registry.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AA8C3E,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CACvB,GAAY,EACZ,WAA2C,EACnC,EAAE;IACV,IAAI,CAAC,WAAW;QAAE,OAAO,kBAAkB,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YACpD,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,kBAAkB,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,GAAwB,EAAc,EAAE;IAC5D,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,OAAe,EAAc,EAAE,CAAC,CAAC;IACpD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC1C,OAAO,EAAE,IAAI;CACd,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,KAAsB,EACtB,UAA2B,EAAE,EACT,EAAE;IACtB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACxC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CACvC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,wCAAwC,IAAI,EAAE,CACrE,CACF,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,iEAAiE;gBAC/D,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;gBACrB,6EAA6E,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CACT,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YACjD,IAAI;YACJ,WAAW;YACX,WAAW;SACZ,CAAC,CAAC;QAEL,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QAE/B,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI;gBAAE,OAAO,WAAW,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;YAEvD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,CAAC;gBACH,OAAO,YAAY,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,WAAW,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}
|
package/dist/server.d.ts
CHANGED
|
@@ -1,11 +1,15 @@
|
|
|
1
1
|
export { createMcpApp, type McpApp, type McpAppOptions, type McpAppAuth, type VerifiedToken, } from "./app.js";
|
|
2
|
+
/** Auth-port types used by `McpAppAuth` — annotate extracted stores/callbacks. */
|
|
3
|
+
export type { ClientStore, RegisteredClient, MintAccessTokenInput, RefreshAccessTokenInput, RevokeTokenInput, MintedToken, OAuthUser, } from "./oauth/types.js";
|
|
4
|
+
export type { CodeStore } from "./oauth/codes.js";
|
|
2
5
|
export { CLIENT_PROFILES, DEFAULT_CLIENTS, authMethodsFor, redirectUrisFor, preRegisteredClients, hasDynamicClient, type ClientName, type ClientProfile, } from "./clients.js";
|
|
3
6
|
export { createMcpHandler, type McpHandler, type McpHandlerOptions, type McpPorts, type Principal, type AuditEntry, type ServerInfo, } from "./dispatch.js";
|
|
7
|
+
export { consoleAudit } from "./audit.js";
|
|
4
8
|
export { createToolRegistry, type ToolDef, type ToolHandler, type ToolResult, type ToolRegistry, type ToolListEntry, type RegistryOptions, } from "./registry.js";
|
|
5
9
|
export { defineTool, apiTool, type StandardSchemaV1, type DefineToolOptions, type ApiToolOptions, type ApiRequest, } from "./tools.js";
|
|
6
10
|
export { rpcResult, rpcError, JSONRPC_PARSE_ERROR, JSONRPC_INVALID_REQUEST, JSONRPC_METHOD_NOT_FOUND, JSONRPC_INVALID_PARAMS, JSONRPC_INTERNAL_ERROR, JSONRPC_UNAUTHORIZED, type JsonRpcId, type JsonRpcRequest, type JsonRpcResponse, } from "./jsonrpc.js";
|
|
7
11
|
export { pickProtocolVersion, PROTOCOL_VERSIONS, DEFAULT_PROTOCOL_VERSION, } from "./protocol.js";
|
|
8
12
|
export { parseBearer, timingSafeEqual, matchesAny, wwwAuthenticateHeader, rejectQueryToken, type WwwAuthenticateOptions, } from "./auth/bearer.js";
|
|
9
|
-
export { validateAgainstSchema, JSON_SCHEMA_TYPES, type JsonSchema } from "./validate.js";
|
|
13
|
+
export { validateAgainstSchema, JSON_SCHEMA_TYPES, SUPPORTED_SCHEMA_KEYWORDS, IGNORED_SCHEMA_KEYWORDS, unsupportedKeywords, type JsonSchema, } from "./validate.js";
|
|
10
14
|
export { jsonResponse, emptyResponse, optionsResponse, corsHeaders, methodNotAllowed, } from "./http.js";
|
|
11
15
|
//# sourceMappingURL=server.d.ts.map
|
package/dist/server.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,aAAa,GACnB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,eAAe,EACf,eAAe,EACf,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,UAAU,GAChB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,kBAAkB,EAClB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,UAAU,EACV,OAAO,EACP,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,SAAS,EACT,QAAQ,EACR,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,WAAW,EACX,eAAe,EACf,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,
|
|
1
|
+
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,aAAa,GACnB,MAAM,UAAU,CAAC;AAElB,kFAAkF;AAClF,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,gBAAgB,EAChB,WAAW,EACX,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EACL,eAAe,EACf,eAAe,EACf,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,UAAU,GAChB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,EACL,kBAAkB,EAClB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,UAAU,EACV,OAAO,EACP,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,SAAS,EACT,QAAQ,EACR,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,WAAW,EACX,eAAe,EACf,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,UAAU,GAChB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,eAAe,EACf,WAAW,EACX,gBAAgB,GACjB,MAAM,WAAW,CAAC"}
|
package/dist/server.js
CHANGED
|
@@ -1,11 +1,12 @@
|
|
|
1
1
|
export { createMcpApp, } from "./app.js";
|
|
2
2
|
export { CLIENT_PROFILES, DEFAULT_CLIENTS, authMethodsFor, redirectUrisFor, preRegisteredClients, hasDynamicClient, } from "./clients.js";
|
|
3
3
|
export { createMcpHandler, } from "./dispatch.js";
|
|
4
|
+
export { consoleAudit } from "./audit.js";
|
|
4
5
|
export { createToolRegistry, } from "./registry.js";
|
|
5
6
|
export { defineTool, apiTool, } from "./tools.js";
|
|
6
7
|
export { rpcResult, rpcError, JSONRPC_PARSE_ERROR, JSONRPC_INVALID_REQUEST, JSONRPC_METHOD_NOT_FOUND, JSONRPC_INVALID_PARAMS, JSONRPC_INTERNAL_ERROR, JSONRPC_UNAUTHORIZED, } from "./jsonrpc.js";
|
|
7
8
|
export { pickProtocolVersion, PROTOCOL_VERSIONS, DEFAULT_PROTOCOL_VERSION, } from "./protocol.js";
|
|
8
9
|
export { parseBearer, timingSafeEqual, matchesAny, wwwAuthenticateHeader, rejectQueryToken, } from "./auth/bearer.js";
|
|
9
|
-
export { validateAgainstSchema, JSON_SCHEMA_TYPES } from "./validate.js";
|
|
10
|
+
export { validateAgainstSchema, JSON_SCHEMA_TYPES, SUPPORTED_SCHEMA_KEYWORDS, IGNORED_SCHEMA_KEYWORDS, unsupportedKeywords, } from "./validate.js";
|
|
10
11
|
export { jsonResponse, emptyResponse, optionsResponse, corsHeaders, methodNotAllowed, } from "./http.js";
|
|
11
12
|
//# sourceMappingURL=server.js.map
|
package/dist/server.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAKb,MAAM,UAAU,CAAC;
|
|
1
|
+
{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAKb,MAAM,UAAU,CAAC;AAclB,OAAO,EACL,eAAe,EACf,eAAe,EACf,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,gBAAgB,GAGjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,GAOjB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,EACL,kBAAkB,GAOnB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,UAAU,EACV,OAAO,GAKR,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,SAAS,EACT,QAAQ,EACR,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,GAIrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,WAAW,EACX,eAAe,EACf,UAAU,EACV,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,GAEpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,eAAe,EACf,WAAW,EACX,gBAAgB,GACjB,MAAM,WAAW,CAAC"}
|
package/dist/validate.d.ts
CHANGED
|
@@ -7,8 +7,22 @@ export type JsonSchema = {
|
|
|
7
7
|
minimum?: number;
|
|
8
8
|
maximum?: number;
|
|
9
9
|
description?: string;
|
|
10
|
+
title?: string;
|
|
10
11
|
[key: string]: unknown;
|
|
11
12
|
};
|
|
13
|
+
/** Keywords `validateAgainstSchema` actually evaluates. */
|
|
14
|
+
export declare const SUPPORTED_SCHEMA_KEYWORDS: ReadonlySet<string>;
|
|
15
|
+
/**
|
|
16
|
+
* Allowed on inputSchema but never evaluated (tools/list / generator metadata).
|
|
17
|
+
* Semantically-enforcing keywords (`pattern`, `additionalProperties`, …) are
|
|
18
|
+
* not ignored — with `validateArgs: true` they throw at construction.
|
|
19
|
+
*/
|
|
20
|
+
export declare const IGNORED_SCHEMA_KEYWORDS: ReadonlySet<string>;
|
|
21
|
+
/**
|
|
22
|
+
* Paths of keywords outside the evaluated subset, e.g. `args.properties.code.pattern`.
|
|
23
|
+
* Walks nested `properties` / `items`.
|
|
24
|
+
*/
|
|
25
|
+
export declare const unsupportedKeywords: (schema: JsonSchema, path?: string) => string[];
|
|
12
26
|
export declare const JSON_SCHEMA_TYPES: {
|
|
13
27
|
readonly string: "string";
|
|
14
28
|
readonly number: "number";
|
package/dist/validate.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;CAQpB,CAAC;AA8GX,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,GAChC,OAAO,OAAO,EACd,QAAQ,UAAU,KACjB,MAAM,EAAyC,CAAC"}
|
|
1
|
+
{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,2DAA2D;AAC3D,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAQxD,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAYtD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC9B,QAAQ,UAAU,EAClB,aAAa,KACZ,MAAM,EAcR,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;CAQpB,CAAC;AA8GX,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,GAChC,OAAO,OAAO,EACd,QAAQ,UAAU,KACjB,MAAM,EAAyC,CAAC"}
|
package/dist/validate.js
CHANGED
|
@@ -1,3 +1,45 @@
|
|
|
1
|
+
/** Keywords `validateAgainstSchema` actually evaluates. */
|
|
2
|
+
export const SUPPORTED_SCHEMA_KEYWORDS = new Set([
|
|
3
|
+
"type",
|
|
4
|
+
"enum",
|
|
5
|
+
"required",
|
|
6
|
+
"properties",
|
|
7
|
+
"items",
|
|
8
|
+
"minimum",
|
|
9
|
+
"maximum",
|
|
10
|
+
]);
|
|
11
|
+
/**
|
|
12
|
+
* Allowed on inputSchema but never evaluated (tools/list / generator metadata).
|
|
13
|
+
* Semantically-enforcing keywords (`pattern`, `additionalProperties`, …) are
|
|
14
|
+
* not ignored — with `validateArgs: true` they throw at construction.
|
|
15
|
+
*/
|
|
16
|
+
export const IGNORED_SCHEMA_KEYWORDS = new Set([
|
|
17
|
+
"description",
|
|
18
|
+
"title",
|
|
19
|
+
"$schema",
|
|
20
|
+
"$id",
|
|
21
|
+
"$comment",
|
|
22
|
+
"default",
|
|
23
|
+
"examples",
|
|
24
|
+
"deprecated",
|
|
25
|
+
"readOnly",
|
|
26
|
+
"writeOnly",
|
|
27
|
+
"format",
|
|
28
|
+
]);
|
|
29
|
+
/**
|
|
30
|
+
* Paths of keywords outside the evaluated subset, e.g. `args.properties.code.pattern`.
|
|
31
|
+
* Walks nested `properties` / `items`.
|
|
32
|
+
*/
|
|
33
|
+
export const unsupportedKeywords = (schema, path = "args") => {
|
|
34
|
+
const local = Object.keys(schema).flatMap((key) => SUPPORTED_SCHEMA_KEYWORDS.has(key) || IGNORED_SCHEMA_KEYWORDS.has(key)
|
|
35
|
+
? []
|
|
36
|
+
: [`${path}.${key}`]);
|
|
37
|
+
const fromProperties = Object.entries(schema.properties ?? {}).flatMap(([key, child]) => unsupportedKeywords(child, `${path}.properties.${key}`));
|
|
38
|
+
const fromItems = schema.items
|
|
39
|
+
? unsupportedKeywords(schema.items, `${path}.items`)
|
|
40
|
+
: [];
|
|
41
|
+
return [...local, ...fromProperties, ...fromItems];
|
|
42
|
+
};
|
|
1
43
|
export const JSON_SCHEMA_TYPES = {
|
|
2
44
|
string: "string",
|
|
3
45
|
number: "number",
|
package/dist/validate.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAaA,2DAA2D;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IACpE,MAAM;IACN,MAAM;IACN,UAAU;IACV,YAAY;IACZ,OAAO;IACP,SAAS;IACT,SAAS;CACV,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAClE,aAAa;IACb,OAAO;IACP,SAAS;IACT,KAAK;IACL,UAAU;IACV,SAAS;IACT,UAAU;IACV,YAAY;IACZ,UAAU;IACV,WAAW;IACX,QAAQ;CACT,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,MAAkB,EAClB,IAAI,GAAG,MAAM,EACH,EAAE;IACZ,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAChD,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC;QACpE,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CACvB,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CACpE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,mBAAmB,CAAC,KAAK,EAAE,GAAG,IAAI,eAAe,GAAG,EAAE,CAAC,CAC1D,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK;QAC5B,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAC;QACpD,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,CAAC,GAAG,KAAK,EAAE,GAAG,cAAc,EAAE,GAAG,SAAS,CAAC,CAAC;AACrD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;CACJ,CAAC;AAQX,MAAM,aAAa,GAAG,CAAC,KAAc,EAAU,EAAE;IAC/C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC;IAClD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC;IACzD,OAAO,OAAO,KAAK,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,aAAa,GAGf;IACF,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAC7C,MAAM,KAAK,iBAAiB,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;CACjE,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,KAAc,EACd,MAAkB,EAClB,IAAY,EACF,EAAE;IACZ,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,OAAO,GACX,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC;IACxE,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,cAAc,MAAM,CAAC,IAAI,SAAS,MAAM,EAAE,CAAC,CAAC;AAC5E,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CACjB,KAAc,EACd,MAAkB,EAClB,IAAY,EACF,EAAE;IACZ,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3D,OAAO,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF,MAAM,YAAY,GAIb;IACH;QACE,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK;QACtC,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,mBAAmB,KAAK,EAAE;KAC5D;IACD;QACE,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK;QACtC,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,mBAAmB,KAAK,EAAE;KAC5D;CACF,CAAC;AAEF,MAAM,WAAW,GAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3D,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,YAAY,GAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IACxD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,cAAc,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;SAC3C,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC;SACjC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,GAAG,YAAY,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;SAC3D,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,MAAM,CAAC;SAChC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,CAC7B,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CACxD,CAAC;IACJ,OAAO,CAAC,GAAG,cAAc,EAAE,GAAG,cAAc,CAAC,CAAC;AAChD,CAAC,CAAC;AAEF,MAAM,WAAW,GAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACpC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,KAAM,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CACxD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,aAAa,GAAgC;IACjD,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,YAAY;IACxC,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,WAAW;IACtC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,WAAW;IACvC,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,WAAW;CACzC,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,KAAc,EACd,MAAkB,EAClB,IAAY,EACF,EAAE;IACZ,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IAC7C,OAAO;QACL,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC;QAClC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;KACnE,CAAC;AACJ,CAAC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,KAAc,EACd,MAAkB,EACR,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "mcp-trellis",
|
|
3
|
-
"version": "0.1
|
|
3
|
+
"version": "0.2.1",
|
|
4
4
|
"description": "Zero-dependency MCP server + OAuth 2.1 authorization server in one package, for Claude, Gemini, and Codex connectors",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "MIT",
|
|
@@ -27,6 +27,7 @@
|
|
|
27
27
|
"authorization-server",
|
|
28
28
|
"connector"
|
|
29
29
|
],
|
|
30
|
+
"types": "./dist/server.d.ts",
|
|
30
31
|
"exports": {
|
|
31
32
|
".": {
|
|
32
33
|
"types": "./dist/server.d.ts",
|