mcpmake 0.1.0 → 0.2.0

package/dist/cloud/secret-store.d.ts

@@ -1,38 +0,0 @@
-/**
- * High-level secret management for server credentials.
- *
- * Encrypts values with AES-256-GCM via the crypto module.
- * Uses in-memory storage by default; when a Pg Database is provided,
- * persists to the `server_secrets` table instead.
- */
-import type { Database } from './db/index.js';
-export declare class SecretStore {
-    private masterKey;
-    private db;
-    /** In-memory fallback: Map<slug, Map<name, encryptedValue>> */
-    private mem;
-    constructor(masterKey: string, db?: Database | null);
-    /** Attach a Pg database (can be called after construction). */
-    setDatabase(db: Database): void;
-    /**
-     * Store (or overwrite) a secret for a server slug.
-     */
-    storeSecret(slug: string, name: string, value: string): Promise<void>;
-    /**
-     * Retrieve and decrypt a single secret. Returns null if not found.
-     */
-    getSecret(slug: string, name: string): Promise<string | null>;
-    /**
-     * List secret names (not values) for a server.
-     */
-    listSecrets(slug: string): Promise<string[]>;
-    /**
-     * Delete a secret.
-     */
-    deleteSecret(slug: string, name: string): Promise<void>;
-    /**
-     * Get all secrets for a server as a plain env-var map (for container startup).
-     * Values are decrypted.
-     */
-    getSecretsAsEnv(slug: string): Promise<Record<string, string>>;
-}

package/dist/cloud/secret-store.js

@@ -1,103 +0,0 @@
-/**
- * High-level secret management for server credentials.
- *
- * Encrypts values with AES-256-GCM via the crypto module.
- * Uses in-memory storage by default; when a Pg Database is provided,
- * persists to the `server_secrets` table instead.
- */
-import { encrypt, decrypt } from './crypto.js';
-export class SecretStore {
-    masterKey;
-    db;
-    /** In-memory fallback: Map<slug, Map<name, encryptedValue>> */
-    mem = new Map();
-    constructor(masterKey, db) {
-        this.masterKey = masterKey;
-        this.db = db ?? null;
-    }
-    /** Attach a Pg database (can be called after construction). */
-    setDatabase(db) {
-        this.db = db;
-    }
-    /**
-     * Store (or overwrite) a secret for a server slug.
-     */
-    async storeSecret(slug, name, value) {
-        const encryptedValue = encrypt(value, this.masterKey);
-        if (this.db) {
-            await this.db.query(`INSERT INTO server_secrets (slug, name, encrypted_value, updated_at)
-         VALUES ($1, $2, $3, now())
-         ON CONFLICT (slug, name) DO UPDATE
-           SET encrypted_value = EXCLUDED.encrypted_value,
-               updated_at = now()`, [slug, name, encryptedValue]);
-        }
-        else {
-            let slugMap = this.mem.get(slug);
-            if (!slugMap) {
-                slugMap = new Map();
-                this.mem.set(slug, slugMap);
-            }
-            slugMap.set(name, encryptedValue);
-        }
-    }
-    /**
-     * Retrieve and decrypt a single secret. Returns null if not found.
-     */
-    async getSecret(slug, name) {
-        let encryptedValue;
-        if (this.db) {
-            const { rows } = await this.db.query('SELECT encrypted_value FROM server_secrets WHERE slug = $1 AND name = $2', [slug, name]);
-            encryptedValue = rows.length > 0 ? rows[0].encrypted_value : undefined;
-        }
-        else {
-            encryptedValue = this.mem.get(slug)?.get(name);
-        }
-        if (!encryptedValue)
-            return null;
-        return decrypt(encryptedValue, this.masterKey);
-    }
-    /**
-     * List secret names (not values) for a server.
-     */
-    async listSecrets(slug) {
-        if (this.db) {
-            const { rows } = await this.db.query('SELECT name FROM server_secrets WHERE slug = $1 ORDER BY name', [slug]);
-            return rows.map((r) => r.name);
-        }
-        const slugMap = this.mem.get(slug);
-        return slugMap ? [...slugMap.keys()].sort() : [];
-    }
-    /**
-     * Delete a secret.
-     */
-    async deleteSecret(slug, name) {
-        if (this.db) {
-            await this.db.query('DELETE FROM server_secrets WHERE slug = $1 AND name = $2', [slug, name]);
-        }
-        else {
-            this.mem.get(slug)?.delete(name);
-        }
-    }
-    /**
-     * Get all secrets for a server as a plain env-var map (for container startup).
-     * Values are decrypted.
-     */
-    async getSecretsAsEnv(slug) {
-        const result = {};
-        if (this.db) {
-            const { rows } = await this.db.query('SELECT name, encrypted_value FROM server_secrets WHERE slug = $1', [slug]);
-            for (const row of rows) {
-                result[row.name] = decrypt(row.encrypted_value, this.masterKey);
-            }
-        }
-        else {
-            const slugMap = this.mem.get(slug);
-            if (slugMap) {
-                for (const [name, encryptedValue] of slugMap) {
-                    result[name] = decrypt(encryptedValue, this.masterKey);
-                }
-            }
-        }
-        return result;
-    }
-}

package/dist/cloud/security.d.ts

@@ -1,26 +0,0 @@
-/**
- * Generate a bearer token for a hosted MCP server.
- * Format: mf_{64 hex chars} (32 random bytes).
- */
-export declare function generateBearerToken(): string;
-/**
- * Hash a bearer token for storage. Never store raw tokens.
- */
-export declare function hashToken(token: string): string;
-/**
- * Verify a bearer token against a stored SHA-256 hash.
- */
-export declare function verifyToken(token: string, hash: string): boolean;
-/**
- * Compute SHA-256 hash of a spec file for dedup / change detection.
- */
-export declare function hashSpec(content: Buffer): string;
-/**
- * Audit generated code in a project directory for dangerous patterns.
- * Scans .ts files, Dockerfile, and package.json.
- * Returns { safe: true } if no dangerous patterns are found.
- */
-export declare function auditGeneratedCode(dir: string): Promise<{
-    safe: boolean;
-    findings: string[];
-}>;

package/dist/cloud/security.js

@@ -1,142 +0,0 @@
-import { randomBytes, createHash } from 'node:crypto';
-import { readdir, readFile } from 'node:fs/promises';
-import { join } from 'node:path';
-const TOKEN_PREFIX = 'mf_';
-/**
- * Generate a bearer token for a hosted MCP server.
- * Format: mf_{64 hex chars} (32 random bytes).
- */
-export function generateBearerToken() {
-    return TOKEN_PREFIX + randomBytes(32).toString('hex');
-}
-/**
- * Hash a bearer token for storage. Never store raw tokens.
- */
-export function hashToken(token) {
-    return createHash('sha256').update(token).digest('hex');
-}
-/**
- * Verify a bearer token against a stored SHA-256 hash.
- */
-export function verifyToken(token, hash) {
-    const computed = hashToken(token);
-    // Constant-time comparison to prevent timing attacks
-    if (computed.length !== hash.length)
-        return false;
-    let diff = 0;
-    for (let i = 0; i < computed.length; i++) {
-        diff |= computed.charCodeAt(i) ^ hash.charCodeAt(i);
-    }
-    return diff === 0;
-}
-/**
- * Compute SHA-256 hash of a spec file for dedup / change detection.
- */
-export function hashSpec(content) {
-    return createHash('sha256').update(content).digest('hex');
-}
-/**
- * Dangerous patterns that must never appear in generated server code.
- * Each entry has a regex to test against file content and a human-readable label.
- */
-const DANGEROUS_PATTERNS = [
-    { pattern: /\bchild_process\b/, label: 'child_process module' },
-    { pattern: /\beval\s*\(/, label: 'eval()' },
-    { pattern: /\bnew\s+Function\s*\(/, label: 'new Function()' },
-    { pattern: /\brequire\s*\(\s*['"]child_process['"]/, label: "require('child_process')" },
-    { pattern: /\bexecSync\b/, label: 'execSync' },
-    { pattern: /\bspawnSync\b/, label: 'spawnSync' },
-    { pattern: /\bexecFileSync\b/, label: 'execFileSync' },
-    { pattern: /\bspawn\s*\(/, label: 'spawn()' },
-    { pattern: /\bexec\s*\(/, label: 'exec()' },
-    { pattern: /\bimport\s*\(\s*['"]/, label: 'dynamic import()' },
-];
-/** Files that legitimately use process.env — skip the process.env check for these. */
-const PROCESS_ENV_ALLOWLIST = new Set(['config.ts', 'index.ts']);
-/** Patterns checked only on tool handler files (not config/index). */
-const TOOL_ONLY_PATTERNS = [
-    { pattern: /\bprocess\.env\b/, label: 'process.env access (use config instead)' },
-    { pattern: /\bfs\s*\./, label: 'direct fs module usage' },
-];
-/** Patterns checked on Dockerfiles. */
-const DOCKERFILE_PATTERNS = [
-    { pattern: /RUN\s+curl\b/, label: 'curl in Dockerfile RUN' },
-    { pattern: /RUN\s+wget\b/, label: 'wget in Dockerfile RUN' },
-    { pattern: /ADD\s+https?:\/\//, label: 'ADD from remote URL in Dockerfile' },
-];
-/**
- * Audit generated code in a project directory for dangerous patterns.
- * Scans .ts files, Dockerfile, and package.json.
- * Returns { safe: true } if no dangerous patterns are found.
- */
-export async function auditGeneratedCode(dir) {
-    const findings = [];
-    const tsFiles = await collectTsFiles(dir);
-    for (const filePath of tsFiles) {
-        const content = await readFile(filePath, 'utf-8');
-        const relativePath = filePath.slice(dir.length + 1);
-        const fileName = filePath.split('/').pop() ?? '';
-        // Check universal dangerous patterns
-        for (const { pattern, label } of DANGEROUS_PATTERNS) {
-            if (pattern.test(content)) {
-                findings.push(`${relativePath}: contains ${label}`);
-            }
-        }
-        // Check tool-only patterns (skip config.ts and index.ts)
-        if (!PROCESS_ENV_ALLOWLIST.has(fileName)) {
-            for (const { pattern, label } of TOOL_ONLY_PATTERNS) {
-                if (pattern.test(content)) {
-                    findings.push(`${relativePath}: contains ${label}`);
-                }
-            }
-        }
-    }
-    // Audit Dockerfile if present
-    const dockerfilePath = join(dir, 'Dockerfile');
-    try {
-        const dockerfileContent = await readFile(dockerfilePath, 'utf-8');
-        for (const { pattern, label } of DOCKERFILE_PATTERNS) {
-            if (pattern.test(dockerfileContent)) {
-                findings.push(`Dockerfile: contains ${label}`);
-            }
-        }
-    }
-    catch {
-        // No Dockerfile — that's fine for stdio-only projects
-    }
-    // Audit package.json for suspicious scripts
-    const packageJsonPath = join(dir, 'package.json');
-    try {
-        const pkgContent = await readFile(packageJsonPath, 'utf-8');
-        const pkg = JSON.parse(pkgContent);
-        const allowedScripts = new Set(['build', 'start', 'dev', 'test']);
-        if (pkg.scripts) {
-            for (const key of Object.keys(pkg.scripts)) {
-                if (!allowedScripts.has(key)) {
-                    findings.push(`package.json: unexpected script "${key}"`);
-                }
-            }
-        }
-    }
-    catch {
-        // No package.json or invalid JSON
-    }
-    return { safe: findings.length === 0, findings };
-}
-/**
- * Recursively collect all .ts files in a directory.
- */
-async function collectTsFiles(dir) {
-    const result = [];
-    const entries = await readdir(dir, { withFileTypes: true });
-    for (const entry of entries) {
-        const fullPath = join(dir, entry.name);
-        if (entry.isDirectory() && entry.name !== 'node_modules') {
-            result.push(...(await collectTsFiles(fullPath)));
-        }
-        else if (entry.isFile() && entry.name.endsWith('.ts')) {
-            result.push(fullPath);
-        }
-    }
-    return result;
-}

package/dist/cloud/server.d.ts

@@ -1,21 +0,0 @@
-/**
- * Hosting backend HTTP server.
- *
- * A minimal Node.js HTTP server (no Express) that accepts spec uploads,
- * generates MCP servers, and manages Docker container lifecycles.
- *
- * Endpoints:
- *   POST   /api/servers          — Create a new hosted MCP server
- *   GET    /api/servers          — List servers
- *   GET    /api/servers/:slug    — Get server status
- *   DELETE /api/servers/:slug    — Stop and remove server
- *   PUT    /api/servers/:slug    — Re-deploy with updated spec
- *   GET    /api/servers/:slug/logs — Tail container logs (SSE)
- *   GET    /health               — Health check
- */
-import http from 'node:http';
-/**
- * Start the hosting backend server.
- */
-export declare function startServer(port?: number, domain?: string): Promise<http.Server>;
-export declare function handleRequest(req: http.IncomingMessage, res: http.ServerResponse, domain: string): Promise<void>;