mcpose 2.0.2 → 3.0.0

package/dist/sanitizeCatalog.js

@@ -0,0 +1,86 @@
+/**
+ * Egress sanitizer for the tool catalog: `tools/list` forwards upstream
+ * descriptions verbatim into model context, and real upstreams leak org
+ * slugs and internal hostnames there. See ADR-0010.
+ */
+/** Matches http(s) URLs; always stripped regardless of `patterns`. */
+const URL_PATTERN = /\bhttps?:\/\/[^\s"'<>()[\]]+/g;
+/**
+ * Rebuilds a schema node with every string-valued `description` property
+ * sanitized, at any depth through plain objects and arrays. Returns the
+ * original node when nothing changed.
+ */
+function sanitizeSchema(node, sanitize) {
+    if (Array.isArray(node)) {
+        const mapped = node.map((item) => sanitizeSchema(item, sanitize));
+        return mapped.some((item, i) => item !== node[i]) ? mapped : node;
+    }
+    if (node === null || typeof node !== 'object')
+        return node;
+    const entries = Object.entries(node).map(([key, value]) => [
+        key,
+        key === 'description' && typeof value === 'string'
+            ? sanitize(value)
+            : sanitizeSchema(value, sanitize),
+    ]);
+    return entries.some(([key, value]) => value !== node[key])
+        ? Object.fromEntries(entries)
+        : node;
+}
+/**
+ * A {@link ListToolsMiddleware} that sanitizes tool descriptions and every
+ * `description` field nested in `inputSchema` / `outputSchema`. Names,
+ * titles, and schema structure are untouched, because clients route on
+ * them.
+ *
+ * Always strips http(s) URLs; `patterns` adds more. Place it **last** in
+ * `listToolsMiddleware` so it sanitizes the output of other list
+ * middleware and local tools.
+ *
+ * @example
+ * listToolsMiddleware: [
+ *   sanitizeToolDescriptions({
+ *     patterns: ['acme-corp', /\bi-[0-9a-f]{8,17}\b/],
+ *     replacement: '[redacted]',
+ *   }),
+ * ]
+ */
+export function sanitizeToolDescriptions(options = {}) {
+    const replacement = options.replacement ?? '';
+    const patterns = [
+        URL_PATTERN,
+        // Rebuild with exactly one `g` and no `y`: String.replace with a
+        // sticky regex only replaces matches anchored at index 0, so a sticky
+        // pattern would silently leak later occurrences.
+        ...(options.patterns ?? []).map((p) => p instanceof RegExp
+            ? new RegExp(p.source, p.flags.replace(/[gy]/g, '') + 'g')
+            : p),
+    ];
+    // replaceAll treats a string pattern literally and requires the g flag
+    // on a RegExp, which the normalization above guarantees.
+    const sanitize = (text) => patterns.reduce((acc, p) => acc.replaceAll(p, replacement), text);
+    return async (req, next) => {
+        const result = await next(req);
+        const tools = result.tools.map((tool) => {
+            const description = typeof tool.description === 'string'
+                ? sanitize(tool.description)
+                : tool.description;
+            const inputSchema = sanitizeSchema(tool.inputSchema, sanitize);
+            const outputSchema = sanitizeSchema(tool.outputSchema, sanitize);
+            return description === tool.description &&
+                inputSchema === tool.inputSchema &&
+                outputSchema === tool.outputSchema
+                ? tool
+                : {
+                    ...tool,
+                    ...(description === undefined ? {} : { description }),
+                    inputSchema,
+                    ...(outputSchema === undefined ? {} : { outputSchema }),
+                };
+        });
+        return tools.some((tool, i) => tool !== result.tools[i])
+            ? { ...result, tools }
+            : result;
+    };
+}
+//# sourceMappingURL=sanitizeCatalog.js.map

package/dist/sanitizeCatalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizeCatalog.js","sourceRoot":"","sources":["../src/sanitizeCatalog.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,sEAAsE;AACtE,MAAM,WAAW,GAAG,+BAA+B,CAAC;AAcpD;;;;GAIG;AACH,SAAS,cAAc,CACrB,IAAa,EACb,QAAkC;IAElC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAClE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACzD,GAAG;QACH,GAAG,KAAK,aAAa,IAAI,OAAO,KAAK,KAAK,QAAQ;YAChD,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjB,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC;KACpC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,IAAI,CACjB,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,KAAK,KAAM,IAAgC,CAAC,GAAa,CAAC,CAC7D;QACC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAA2C,EAAE;IAE7C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAmC;QAC/C,WAAW;QACX,iEAAiE;QACjE,sEAAsE;QACtE,iDAAiD;QACjD,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACpC,CAAC,YAAY,MAAM;YACjB,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC;YAC1D,CAAC,CAAC,CAAC,CACN;KACF,CAAC;IACF,uEAAuE;IACvE,yDAAyD;IACzD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE,CACxC,QAAQ,CAAC,MAAM,CAAS,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IAE5E,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACtC,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;gBAClC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC5B,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;YACvB,MAAM,WAAW,GAAG,cAAc,CAChC,IAAI,CAAC,WAAW,EAChB,QAAQ,CACkB,CAAC;YAC7B,MAAM,YAAY,GAAG,cAAc,CACjC,IAAI,CAAC,YAAY,EACjB,QAAQ,CACmB,CAAC;YAC9B,OAAO,WAAW,KAAK,IAAI,CAAC,WAAW;gBACrC,WAAW,KAAK,IAAI,CAAC,WAAW;gBAChC,YAAY,KAAK,IAAI,CAAC,YAAY;gBAClC,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC;oBACE,GAAG,IAAI;oBACP,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;oBACrD,WAAW;oBACX,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;iBACxD,CAAC;QACR,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACtD,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE;YACtB,CAAC,CAAC,MAAM,CAAC;IACb,CAAC,CAAC;AACJ,CAAC"}

package/dist/sessionRegistry.d.ts

@@ -0,0 +1,79 @@
+import type { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { type InitializeRequestParams } from '@modelcontextprotocol/sdk/types.js';
+import type { Identity } from './identity.js';
+/**
+ * Everything another instance needs to take over a session. Plain JSON: an
+ * adapter serializes it as is, so `identity.claims` must survive a JSON
+ * round-trip.
+ */
+export interface SessionRecord {
+    /**
+     * The client's `initialize` params, verbatim. A resuming instance replays
+     * them into a fresh SDK transport, so the rebuilt session negotiates exactly
+     * what the original did: protocol version, client capabilities, clientInfo.
+     */
+    initialize: InitializeRequestParams;
+    /**
+     * The identity `resolveIdentity` produced at initialize. Never re-resolved
+     * on resume; `validateSession` still runs on every routed request.
+     */
+    identity?: Identity;
+    /**
+     * Epoch milliseconds after which the session is dead on every instance.
+     * Fixed at creation from `sessionTtlMs` and absent when that is `Infinity`.
+     * A resuming instance honours the remaining lifetime, not its own TTL.
+     */
+    expiresAt?: number;
+}
+/**
+ * Where `startHttpProxy` keeps its session records when one is supplied. The
+ * local in-memory map stays authoritative for sessions this instance holds;
+ * the registry is consulted only for an id this instance does not know.
+ *
+ * `@mcpose/store-redis` and `@mcpose/store-postgres` ship implementations
+ * alongside their `EventStore`s. Share the event store too, or a resumed
+ * session has a live id and no replay history.
+ */
+export interface SessionRegistry {
+    /**
+     * Persists a record. Awaited before the client learns its session id, so a
+     * rejection fails the initialize with a 500 rather than handing out an id
+     * that no other instance could honour.
+     */
+    set(sessionId: string, record: SessionRecord): Promise<void>;
+    /** `undefined` for an unknown or expired id. */
+    get(sessionId: string): Promise<SessionRecord | undefined>;
+    /**
+     * Called on client DELETE and TTL expiry. Never on server shutdown: a
+     * session that outlives the process is the point of the registry.
+     */
+    delete(sessionId: string): Promise<void>;
+}
+/**
+ * Pulls the `initialize` params out of a POST body the SDK has already
+ * accepted as an initialize request, so a parse failure here is a bug in the
+ * SDK's acceptance, not client input to be tolerated.
+ */
+export declare function initializeParamsOf(body: string): InitializeRequestParams;
+/**
+ * Drives a fresh transport through the SDK's own initialize path with the
+ * stored params, so it accepts `sessionId` on later requests. The SDK cannot
+ * rehydrate a transport and its initialized flag is private, so the public
+ * request path is the one that survives an SDK bump.
+ *
+ * The request never touches a socket: the SDK's Node adapter reads method,
+ * url, headers and the body stream, and the response is captured rather than
+ * written anywhere. `Host` and `Origin` are copied from the request being
+ * resumed so the transport's DNS-rebinding check sees what the client sent.
+ *
+ * @returns the status and body the SDK answered, for the caller to relay if
+ * the transport did not come up.
+ */
+export declare function replayInitialize(transport: StreamableHTTPServerTransport, params: InitializeRequestParams, headers: {
+    host?: string;
+    origin?: string;
+}): Promise<{
+    status: number;
+    body: string;
+}>;
+//# sourceMappingURL=sessionRegistry.d.ts.map

package/dist/sessionRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionRegistry.d.ts","sourceRoot":"","sources":["../src/sessionRegistry.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACxG,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,UAAU,EAAE,uBAAuB,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,gDAAgD;IAChD,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IAC3D;;;OAGG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAQxE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,6BAA6B,EACxC,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA6C3C"}

package/dist/sessionRegistry.js

@@ -0,0 +1,83 @@
+/**
+ * Shared session registry: the transport-level record of live session ids,
+ * so a resume can survive a proxy restart or reach another instance (#155).
+ */
+import * as http from 'node:http';
+import * as net from 'node:net';
+import { isInitializeRequest, } from '@modelcontextprotocol/sdk/types.js';
+/**
+ * Pulls the `initialize` params out of a POST body the SDK has already
+ * accepted as an initialize request, so a parse failure here is a bug in the
+ * SDK's acceptance, not client input to be tolerated.
+ */
+export function initializeParamsOf(body) {
+    const parsed = JSON.parse(body);
+    const messages = Array.isArray(parsed) ? parsed : [parsed];
+    const initialize = messages.find(isInitializeRequest);
+    if (initialize === undefined) {
+        throw new Error('mcpose: initialize request not found in accepted body');
+    }
+    return initialize.params;
+}
+/**
+ * Drives a fresh transport through the SDK's own initialize path with the
+ * stored params, so it accepts `sessionId` on later requests. The SDK cannot
+ * rehydrate a transport and its initialized flag is private, so the public
+ * request path is the one that survives an SDK bump.
+ *
+ * The request never touches a socket: the SDK's Node adapter reads method,
+ * url, headers and the body stream, and the response is captured rather than
+ * written anywhere. `Host` and `Origin` are copied from the request being
+ * resumed so the transport's DNS-rebinding check sees what the client sent.
+ *
+ * @returns the status and body the SDK answered, for the caller to relay if
+ * the transport did not come up.
+ */
+export function replayInitialize(transport, params, headers) {
+    const body = JSON.stringify({
+        jsonrpc: '2.0',
+        id: 0,
+        method: 'initialize',
+        params,
+    });
+    const req = new http.IncomingMessage(new net.Socket());
+    req.method = 'POST';
+    req.url = '/';
+    req.headers = {
+        'content-type': 'application/json',
+        'content-length': String(Buffer.byteLength(body)),
+        accept: 'application/json, text/event-stream',
+        ...(headers.host === undefined ? {} : { host: headers.host }),
+        ...(headers.origin === undefined ? {} : { origin: headers.origin }),
+    };
+    // The SDK's adapter reads the raw header list, not the parsed record.
+    req.rawHeaders = Object.entries(req.headers).flatMap(([name, value]) => [
+        name,
+        String(value),
+    ]);
+    req.push(body);
+    req.push(null);
+    const res = new http.ServerResponse(req);
+    let out = '';
+    const append = (chunk) => {
+        if (typeof chunk === 'string')
+            out += chunk;
+        else if (chunk instanceof Uint8Array)
+            out += Buffer.from(chunk).toString();
+    };
+    // No socket: a real write would buffer forever and report back-pressure,
+    // and 'finish' would never fire. Capture instead.
+    res.write = (chunk) => {
+        append(chunk);
+        return true;
+    };
+    const done = new Promise((resolve) => {
+        res.end = ((chunk) => {
+            append(chunk);
+            resolve({ status: res.statusCode, body: out });
+            return res;
+        });
+    });
+    return transport.handleRequest(req, res).then(() => done);
+}
+//# sourceMappingURL=sessionRegistry.js.map

package/dist/sessionRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionRegistry.js","sourceRoot":"","sources":["../src/sessionRegistry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,OAAO,EACL,mBAAmB,GAEpB,MAAM,oCAAoC,CAAC;AAqD5C;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAwC,EACxC,MAA+B,EAC/B,OAA2C;IAE3C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,CAAC;QACL,MAAM,EAAE,YAAY;QACpB,MAAM;KACP,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;IACpB,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC;IACd,GAAG,CAAC,OAAO,GAAG;QACZ,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,EAAE,qCAAqC;QAC7C,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KACpE,CAAC;IACF,sEAAsE;IACtE,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACtE,IAAI;QACJ,MAAM,CAAC,KAAK,CAAC;KACd,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEf,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,MAAM,MAAM,GAAG,CAAC,KAAc,EAAQ,EAAE;QACtC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,GAAG,IAAI,KAAK,CAAC;aACvC,IAAI,KAAK,YAAY,UAAU;YAAE,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7E,CAAC,CAAC;IACF,yEAAyE;IACzE,kDAAkD;IAClD,GAAG,CAAC,KAAK,GAAG,CAAC,KAAc,EAAE,EAAE;QAC7B,MAAM,CAAC,KAAK,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,OAAO,CAAmC,CAAC,OAAO,EAAE,EAAE;QACrE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,KAAe,EAAE,EAAE;YAC7B,MAAM,CAAC,KAAK,CAAC,CAAC;YACd,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/C,OAAO,GAAG,CAAC;QACb,CAAC,CAAmB,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAC5D,CAAC"}

package/dist/telemetry.d.ts

@@ -1,7 +1,8 @@
 import type { Identity } from './identity.js';
+import type { ProxyIdentity } from './proxyContext.js';
 import type { RejectionReason } from './rejection.js';
 /** Emitted after every tool call (success, error, or rejection). */
-export interface TelemetryEvent {
+export interface ToolCallTelemetryEvent {
     type: 'tool_call';
     requestId: string;
     sessionId?: string;
@@ -11,5 +12,32 @@ export interface TelemetryEvent {
     /** Populated when `outcome` is `'rejected'`. */
     rejectionReason?: RejectionReason;
     identity?: Identity;
+    /** The proxy instance that handled the call (ADR-0012). */
+    proxy?: ProxyIdentity;
 }
+/**
+ * Emitted when one backend of a mesh fails a list call and the proxy
+ * returns the remaining backends' entries instead of failing the whole
+ * list (ADR-0013). Without an `onTelemetry` sink a degraded mesh is
+ * invisible, so an operator running one should wire it.
+ */
+export interface BackendDegradedTelemetryEvent {
+    type: 'backend_degraded';
+    requestId: string;
+    sessionId?: string;
+    /** The backend key whose entries are missing from the response. */
+    backend: string;
+    /** The list call that degraded. */
+    method: 'tools/list' | 'prompts/list' | 'resources/list';
+    /** Whatever the backend threw. */
+    error: unknown;
+    identity?: Identity;
+    /** The proxy instance that handled the call (ADR-0012). */
+    proxy?: ProxyIdentity;
+}
+/**
+ * An observability signal from the proxy, discriminated on `type`. Narrow
+ * on it before reading a member's own fields.
+ */
+export type TelemetryEvent = ToolCallTelemetryEvent | BackendDegradedTelemetryEvent;
 //# sourceMappingURL=telemetry.d.ts.map

package/dist/telemetry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,oEAAoE;AACpE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;IAC1C,gDAAgD;IAChD,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB"}
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,oEAAoE;AACpE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;IAC1C,gDAAgD;IAChD,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,kBAAkB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,MAAM,EAAE,YAAY,GAAG,cAAc,GAAG,gBAAgB,CAAC;IACzD,kCAAkC;IAClC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACxB,sBAAsB,GAAG,6BAA6B,CAAC"}

package/dist/testing.d.ts

@@ -2,8 +2,8 @@
  * Test helpers for mcpose middleware. No test framework imports — works in any env.
  * @module mcpose/testing
  */
-import type { CallToolRequest, CallToolResult, ReadResourceResult, Tool, Resource, Prompt, CallToolRequestParams, GetPromptResult, ServerCapabilities } from '@modelcontextprotocol/sdk/types.js';
-import type { ToolMiddleware } from './core.js';
+import type { CallToolRequest, CallToolResult, ListToolsRequest, ListToolsResult, ReadResourceRequest, ReadResourceResult, Tool, Resource, Prompt, CallToolRequestParams, GetPromptResult, ServerCapabilities } from '@modelcontextprotocol/sdk/types.js';
+import type { ListToolsMiddleware, ResourceMiddleware, ToolMiddleware } from './core.js';
 import type { BackendClient } from './backendClient.js';
 import { type ProxyContext } from './proxyContext.js';
 /**
@@ -15,6 +15,22 @@ import { type ProxyContext } from './proxyContext.js';
  * expect(result.content[0]).toMatchObject({ type: 'text' });
  */
 export declare function runToolMiddleware(mw: ToolMiddleware, req: CallToolRequest, next: (req: CallToolRequest) => Promise<CallToolResult>, context?: ProxyContext): Promise<CallToolResult>;
+/**
+ * Runs a `ListToolsMiddleware` with a defaulted `ProxyContext`, so tests
+ * do not pass `undefined as never` for the context argument.
+ *
+ * `ListToolsResult` has no legacy variant, so unlike `runToolMiddleware`
+ * there is nothing to narrow and this never throws on shape.
+ */
+export declare function runListToolsMiddleware(mw: ListToolsMiddleware, req: ListToolsRequest, next: (req: ListToolsRequest) => Promise<ListToolsResult>, context?: ProxyContext): Promise<ListToolsResult>;
+/**
+ * Runs a `ResourceMiddleware` with a defaulted `ProxyContext`.
+ *
+ * `ReadResourceResult` has no legacy variant, so unlike
+ * `runToolMiddleware` there is nothing to narrow and this never throws on
+ * shape.
+ */
+export declare function runResourceMiddleware(mw: ResourceMiddleware, req: ReadResourceRequest, next: (req: ReadResourceRequest) => Promise<ReadResourceResult>, context?: ProxyContext): Promise<ReadResourceResult>;
 /** Config for mock backend client. */
 export interface MockBackendClientOptions {
     /** Default: tools/resources/prompts enabled */

package/dist/testing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EAId,kBAAkB,EAClB,IAAI,EACJ,QAAQ,EACR,MAAM,EACN,qBAAqB,EAGrB,eAAe,EACf,kBAAkB,EACnB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE1E;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,cAAc,EAClB,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,CAAC,EACvD,OAAO,GAAE,YAAmC,GAC3C,OAAO,CAAC,cAAc,CAAC,CAQzB;AAED,sCAAsC;AACtC,MAAM,WAAW,wBAAwB;IACvC,+CAA+C;IAC/C,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,oBAAoB;IACpB,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;IACf;;;OAGG;IACH,gBAAgB,CAAC,EACb,cAAc,GACd,CAAC,CAAC,MAAM,EAAE,qBAAqB,KAAK,cAAc,CAAC,CAAC;IACxD,oBAAoB;IACpB,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,kBAAkB,CAAC;IAC1C,oBAAoB;IACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,iBAAiB,CAAC,EAAE,eAAe,CAAC;CACrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,GAAE,wBAA6B,GACrC,aAAa,CA8Cf"}
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,eAAe,EAGf,mBAAmB,EACnB,kBAAkB,EAClB,IAAI,EACJ,QAAQ,EACR,MAAM,EACN,qBAAqB,EAGrB,eAAe,EACf,kBAAkB,EACnB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,EACV,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACf,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE1E;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,cAAc,EAClB,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,CAAC,EACvD,OAAO,GAAE,YAAmC,GAC3C,OAAO,CAAC,cAAc,CAAC,CAQzB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,mBAAmB,EACvB,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC,EACzD,OAAO,GAAE,YAAmC,GAC3C,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,kBAAkB,EACtB,GAAG,EAAE,mBAAmB,EACxB,IAAI,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,OAAO,CAAC,kBAAkB,CAAC,EAC/D,OAAO,GAAE,YAAmC,GAC3C,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED,sCAAsC;AACtC,MAAM,WAAW,wBAAwB;IACvC,+CAA+C;IAC/C,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,oBAAoB;IACpB,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;IACf;;;OAGG;IACH,gBAAgB,CAAC,EACf,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,qBAAqB,KAAK,cAAc,CAAC,CAAC;IACvE,oBAAoB;IACpB,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,kBAAkB,CAAC;IAC1C,oBAAoB;IACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,iBAAiB,CAAC,EAAE,eAAe,CAAC;CACrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,GAAE,wBAA6B,GACrC,aAAa,CAqDf"}

package/dist/testing.js

@@ -15,6 +15,26 @@ export async function runToolMiddleware(mw, req, next, context = createProxyCont
     }
     return result;
 }
+/**
+ * Runs a `ListToolsMiddleware` with a defaulted `ProxyContext`, so tests
+ * do not pass `undefined as never` for the context argument.
+ *
+ * `ListToolsResult` has no legacy variant, so unlike `runToolMiddleware`
+ * there is nothing to narrow and this never throws on shape.
+ */
+export async function runListToolsMiddleware(mw, req, next, context = createProxyContext()) {
+    return mw(req, next, context);
+}
+/**
+ * Runs a `ResourceMiddleware` with a defaulted `ProxyContext`.
+ *
+ * `ReadResourceResult` has no legacy variant, so unlike
+ * `runToolMiddleware` there is nothing to narrow and this never throws on
+ * shape.
+ */
+export async function runResourceMiddleware(mw, req, next, context = createProxyContext()) {
+    return mw(req, next, context);
+}
 /**
  * Creates an in-memory `BackendClient` for unit tests. No process/network.
  *
@@ -31,27 +51,29 @@ export function createMockBackendClient(options = {}) {
         resources: {},
         prompts: {},
     };
+    // Fixtures are cloned per call so a mutating middleware cannot corrupt
+    // them across calls.
     return {
-        getServerCapabilities: () => capabilities,
+        getServerCapabilities: () => structuredClone(capabilities),
         listTools: async () => ({
-            tools: options.tools ?? [],
+            tools: structuredClone(options.tools ?? []),
         }),
         callTool: async (params) => {
             const resp = options.callToolResponse;
             if (typeof resp === 'function')
                 return resp(params);
-            return resp ?? { content: [{ type: 'text', text: 'mock response' }] };
+            return structuredClone(resp ?? { content: [{ type: 'text', text: 'mock response' }] });
         },
         listResources: async () => ({
-            resources: options.resources ?? [],
+            resources: structuredClone(options.resources ?? []),
         }),
-        readResource: async (_params) => options.readResourceResponse ?? {
+        readResource: async (_params) => structuredClone(options.readResourceResponse ?? {
             contents: [{ uri: '', text: 'mock resource' }],
-        },
+        }),
         listPrompts: async () => ({
-            prompts: options.prompts ?? [],
+            prompts: structuredClone(options.prompts ?? []),
         }),
-        getPrompt: async (_params) => options.getPromptResponse ?? { messages: [] },
+        getPrompt: async (_params) => structuredClone(options.getPromptResponse ?? { messages: [] }),
         setNotificationHandler: () => undefined,
         removeNotificationHandler: () => undefined,
         close: async () => undefined,

package/dist/testing.js.map

@@ -1 +1 @@
-{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,EAAE,kBAAkB,EAAqB,MAAM,mBAAmB,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAkB,EAClB,GAAoB,EACpB,IAAuD,EACvD,UAAwB,kBAAkB,EAAE;IAE5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAyBD;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAoC,EAAE;IAEtC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI;QAC3C,KAAK,EAAE,EAAE;QACT,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,EAAE;KACZ,CAAC;IAEF,OAAO;QACL,qBAAqB,EAAE,GAAuB,EAAE,CAAC,YAAY;QAE7D,SAAS,EAAE,KAAK,IAA8B,EAAE,CAAC,CAAC;YAChD,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;SAC3B,CAAC;QAEF,QAAQ,EAAE,KAAK,EACb,MAA6B,EACJ,EAAE;YAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC;YACtC,IAAI,OAAO,IAAI,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;YACpD,OAAO,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QACxE,CAAC;QAED,aAAa,EAAE,KAAK,IAAkC,EAAE,CAAC,CAAC;YACxD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE;SACnC,CAAC;QAEF,YAAY,EAAE,KAAK,EACjB,OAAkC,EACL,EAAE,CAC/B,OAAO,CAAC,oBAAoB,IAAI;YAC9B,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;SAC/C;QAEH,WAAW,EAAE,KAAK,IAAgC,EAAE,CAAC,CAAC;YACpD,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;SAC/B,CAAC;QAEF,SAAS,EAAE,KAAK,EACd,OAA+B,EACL,EAAE,CAC5B,OAAO,CAAC,iBAAiB,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;QAE/C,sBAAsB,EAAE,GAAG,EAAE,CAAC,SAAS;QACvC,yBAAyB,EAAE,GAAG,EAAE,CAAC,SAAS;QAC1C,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;KACD,CAAC;AAChC,CAAC"}
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAO3C,OAAO,EAAE,kBAAkB,EAAqB,MAAM,mBAAmB,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAkB,EAClB,GAAoB,EACpB,IAAuD,EACvD,UAAwB,kBAAkB,EAAE;IAE5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,EAAuB,EACvB,GAAqB,EACrB,IAAyD,EACzD,UAAwB,kBAAkB,EAAE;IAE5C,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAsB,EACtB,GAAwB,EACxB,IAA+D,EAC/D,UAAwB,kBAAkB,EAAE;IAE5C,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAChC,CAAC;AAwBD;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAoC,EAAE;IAEtC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI;QAC3C,KAAK,EAAE,EAAE;QACT,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,EAAE;KACZ,CAAC;IAEF,uEAAuE;IACvE,qBAAqB;IACrB,OAAO;QACL,qBAAqB,EAAE,GAAuB,EAAE,CAC9C,eAAe,CAAC,YAAY,CAAC;QAE/B,SAAS,EAAE,KAAK,IAA8B,EAAE,CAAC,CAAC;YAChD,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;SAC5C,CAAC;QAEF,QAAQ,EAAE,KAAK,EACb,MAA6B,EACJ,EAAE;YAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC;YACtC,IAAI,OAAO,IAAI,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;YACpD,OAAO,eAAe,CACpB,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,CAC/D,CAAC;QACJ,CAAC;QAED,aAAa,EAAE,KAAK,IAAkC,EAAE,CAAC,CAAC;YACxD,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;SACpD,CAAC;QAEF,YAAY,EAAE,KAAK,EACjB,OAAkC,EACL,EAAE,CAC/B,eAAe,CACb,OAAO,CAAC,oBAAoB,IAAI;YAC9B,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;SAC/C,CACF;QAEH,WAAW,EAAE,KAAK,IAAgC,EAAE,CAAC,CAAC;YACpD,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;SAChD,CAAC;QAEF,SAAS,EAAE,KAAK,EACd,OAA+B,EACL,EAAE,CAC5B,eAAe,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAEhE,sBAAsB,EAAE,GAAG,EAAE,CAAC,SAAS;QACvC,yBAAyB,EAAE,GAAG,EAAE,CAAC,SAAS;QAC1C,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;KACD,CAAC;AAChC,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The mcpose library version, inlined so it survives bundling (a
+ * `createRequire('../package.json')` lookup breaks when consumers bundle
+ * the package). Kept in sync with package.json by `version.test.ts`.
+ */
+export declare const VERSION = "3.0.0";
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,OAAO,UAAU,CAAC"}

package/dist/version.js

@@ -0,0 +1,7 @@
+/**
+ * The mcpose library version, inlined so it survives bundling (a
+ * `createRequire('../package.json')` lookup breaks when consumers bundle
+ * the package). Kept in sync with package.json by `version.test.ts`.
+ */
+export const VERSION = '3.0.0';
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcpose",
-  "version": "2.0.2",
+  "version": "3.0.0",
   "description": "The audit and governance layer for MCP",
   "type": "module",
   "main": "./dist/index.js",
@@ -13,9 +13,15 @@
     "./testing": {
       "types": "./dist/testing.d.ts",
       "default": "./dist/testing.js"
-    }
+    },
+    "./package.json": "./package.json"
   },
-  "files": ["dist", "README.md"],
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "src",
+    "README.md"
+  ],
   "keywords": [
     "mcp",
     "middleware",
@@ -29,24 +35,34 @@
   ],
   "author": "Amir Gorji",
   "license": "MIT",
+  "homepage": "https://github.com/amir-gorji/mcpose#readme",
+  "bugs": {
+    "url": "https://github.com/amir-gorji/mcpose/issues"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/amir-gorji/mcpose.git",
     "directory": "packages/core"
   },
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "ts:ci": "tsc --noEmit",
-    "test": "vitest run --passWithNoTests",
-    "prepublishOnly": "pnpm run ts:ci && pnpm run test && pnpm run build"
+  "engines": {
+    "node": ">=20"
   },
   "peerDependencies": {
-    "@modelcontextprotocol/sdk": ">=1.0.0"
+    "@modelcontextprotocol/sdk": "^1.17.0"
   },
   "devDependencies": {
-    "@modelcontextprotocol/sdk": "^1.26.0",
-    "@types/node": "^22.0.0",
-    "typescript": "^5.0.0",
-    "vitest": "^3.0.0"
+    "@modelcontextprotocol/sdk": "1.30.0",
+    "@stryker-mutator/core": "10.0.0",
+    "@stryker-mutator/vitest-runner": "10.0.0",
+    "@types/node": "^26.5.1",
+    "@vitest/coverage-v8": "5.0.1",
+    "typescript": "6.0.3",
+    "vitest": "5.0.1"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "ts:ci": "tsc --noEmit",
+    "test": "vitest run --coverage",
+    "mutation": "stryker run"
   }
-}
+}

package/src/__tests__/_helpers.ts

@@ -0,0 +1,64 @@
+import * as http from 'node:http';
+import { vi } from 'vitest';
+import type { BackendClient } from '../backendClient.js';
+import type { ServerCapabilities } from '@modelcontextprotocol/sdk/types.js';
+
+/** Minimal mocked BackendClient suitable for HTTP integration tests. */
+export function makeMockBackend(
+  overrides: Partial<{
+    capabilities: ServerCapabilities;
+  }> = {},
+): BackendClient {
+  return {
+    getServerCapabilities: vi
+      .fn()
+      .mockReturnValue(
+        overrides.capabilities ?? { tools: {}, resources: {}, prompts: {} },
+      ),
+    listTools: vi.fn().mockResolvedValue({ tools: [] }),
+    callTool: vi.fn().mockResolvedValue({ content: [] }),
+    listResources: vi.fn().mockResolvedValue({ resources: [] }),
+    readResource: vi.fn().mockResolvedValue({ contents: [] }),
+    listPrompts: vi.fn().mockResolvedValue({ prompts: [] }),
+    getPrompt: vi.fn().mockResolvedValue({ messages: [] }),
+    setNotificationHandler: vi.fn(),
+    removeNotificationHandler: vi.fn(),
+    close: vi.fn().mockResolvedValue(undefined),
+  } as unknown as BackendClient;
+}
+
+export function getPort(server: http.Server): number {
+  const addr = server.address();
+  if (!addr || typeof addr === 'string') throw new Error('Unexpected address');
+  return addr.port;
+}
+
+export function closeServer(server: http.Server): Promise<void> {
+  return new Promise<void>((resolve) => server.close(() => resolve()));
+}
+
+/**
+ * POST over a dedicated connection (`agent: false`), bypassing fetch's
+ * keep-alive pool. Under fake timers, undici (Node >= 24) hangs when it
+ * reuses a pooled connection whose idle window spans faked time — any
+ * request sent after `vi.advanceTimersByTimeAsync()` must use this instead
+ * of `fetch`.
+ */
+export function postOnFreshConnection(
+  url: string,
+  headers: Record<string, string>,
+  body: string,
+): Promise<number> {
+  return new Promise<number>((resolve, reject) => {
+    const req = http.request(
+      url,
+      { method: 'POST', agent: false, headers },
+      (res) => {
+        res.resume();
+        resolve(res.statusCode ?? 0);
+      },
+    );
+    req.on('error', reject);
+    req.end(body);
+  });
+}