minecraft-bedrock-mcp-server 0.1.0

package/dist/events/subscription-registry.js

@@ -0,0 +1,64 @@
+import { newSubscriptionId } from "../queue/command-id.js";
+/** Creates an empty {@link SubscriptionRegistry}. */
+export function createSubscriptionRegistry(options) {
+    const states = new Map();
+    function snapshot(state) {
+        return {
+            ...state.subscription,
+            buffered: state.buffer.length,
+            lastSequence: state.nextSequence - 1,
+        };
+    }
+    return {
+        create(eventType, filter) {
+            const subscription = {
+                id: newSubscriptionId(),
+                eventType,
+                filter,
+                createdAt: new Date().toISOString(),
+            };
+            states.set(subscription.id, { subscription, buffer: [], nextSequence: 0 });
+            return subscription;
+        },
+        remove(id) {
+            return states.delete(id);
+        },
+        get(id) {
+            return states.get(id)?.subscription;
+        },
+        list() {
+            return [...states.values()].map(snapshot);
+        },
+        ingest(event) {
+            const state = states.get(event.subscription_id);
+            if (state === undefined)
+                return false;
+            state.buffer.push({
+                sequence: state.nextSequence,
+                event_type: event.event_type,
+                occurred_at: event.occurred_at,
+                payload: event.payload,
+            });
+            state.nextSequence += 1;
+            if (state.buffer.length > options.bufferSize) {
+                state.buffer.shift();
+            }
+            options.onIngest?.(event.subscription_id);
+            return true;
+        },
+        poll(id, cursor) {
+            const state = states.get(id);
+            if (state === undefined) {
+                return { events: [], cursor: cursor ?? "0" };
+            }
+            const after = cursor === undefined ? -1 : Number(cursor);
+            const events = state.buffer.filter((event) => event.sequence > after);
+            const last = events.at(-1);
+            return {
+                events,
+                cursor: String(last === undefined ? Math.max(0, after) : last.sequence),
+            };
+        },
+    };
+}
+//# sourceMappingURL=subscription-registry.js.map

package/dist/events/subscription-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscription-registry.js","sourceRoot":"","sources":["../../src/events/subscription-registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAuB,MAAM,wBAAwB,CAAC;AAgEhF,qDAAqD;AACrD,MAAM,UAAU,0BAA0B,CACxC,OAAoC;IAEpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqC,CAAC;IAE5D,SAAS,QAAQ,CAAC,KAAwB;QACxC,OAAO;YACL,GAAG,KAAK,CAAC,YAAY;YACrB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;YAC7B,YAAY,EAAE,KAAK,CAAC,YAAY,GAAG,CAAC;SACrC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,CAAC,SAAS,EAAE,MAAM;YACtB,MAAM,YAAY,GAAiB;gBACjC,EAAE,EAAE,iBAAiB,EAAE;gBACvB,SAAS;gBACT,MAAM;gBACN,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;YAC3E,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,MAAM,CAAC,EAAE;YACP,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;QAED,GAAG,CAAC,EAAE;YACJ,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC;QACtC,CAAC;QAED,IAAI;YACF,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,CAAC,KAAK;YACV,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAChD,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACtC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;gBAChB,QAAQ,EAAE,KAAK,CAAC,YAAY;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;YACH,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;YACxB,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC7C,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YACD,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,MAAM;YACb,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG,EAAE,CAAC;YAC/C,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,OAAO;gBACL,MAAM;gBACN,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;aACxE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/http/app.d.ts

@@ -0,0 +1,26 @@
+import { type FastifyInstance } from "fastify";
+import { type Environment } from "../config/environment.js";
+import type { TlsMaterial } from "../config/tls.js";
+import type { SubscriptionRegistry } from "../events/subscription-registry.js";
+import type { SessionManager } from "../mcp/session-manager.js";
+import type { Logger } from "../observability/logger.js";
+import type { Metrics } from "../observability/metrics.js";
+import type { CommandQueue } from "../queue/command-queue.js";
+/** Dependencies required to assemble the HTTP application. */
+export interface AppDependencies {
+    readonly environment: Environment;
+    readonly logger: Logger;
+    readonly queue: CommandQueue;
+    readonly subscriptions: SubscriptionRegistry;
+    readonly sessionManager: SessionManager;
+    /** Present only when `BRIDGE_METRICS_ENABLED` is set. */
+    readonly metrics?: Metrics;
+    readonly tls: TlsMaterial | null;
+}
+/**
+ * Assembles the Fastify application: an unauthenticated health probe, the
+ * agent-token `/bridge` surface, the client-token `/mcp` surface, and — when
+ * enabled — a client-token `/metrics` surface. The caller calls `listen`.
+ */
+export declare function createApp(deps: AppDependencies): FastifyInstance;
+//# sourceMappingURL=app.d.ts.map

package/dist/http/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/http/app.ts"],"names":[],"mappings":"AAEA,OAAgB,EAA0B,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAOhF,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAQ9D,8DAA8D;AAC9D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAC7C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,yDAAyD;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAAC;CAClC;AAgBD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe,CA4EhE"}

package/dist/http/app.js

@@ -0,0 +1,88 @@
+import { createHash, randomUUID } from "node:crypto";
+import Fastify, {} from "fastify";
+import cors from "@fastify/cors";
+import rateLimit from "@fastify/rate-limit";
+import { registerEventRoute } from "../bridge/event-route.js";
+import { registerHandshakeRoute } from "../bridge/handshake-route.js";
+import { registerPollRoute } from "../bridge/poll-route.js";
+import { registerResultRoute } from "../bridge/result-route.js";
+import { corsOrigins } from "../config/environment.js";
+import { registerMcpRoute } from "../mcp/mcp-route.js";
+import { SERVER_VERSION } from "../server-info.js";
+import { bearerAuth } from "./authentication.js";
+import { registerHealthRoute } from "./health-route.js";
+import { registerMetricsRoute } from "./metrics-route.js";
+const CORRELATION_ID_HEADER = "x-correlation-id";
+/** Derives a request correlation id from an inbound header, or mints one. */
+function correlationIdFor(req) {
+    const header = req.headers[CORRELATION_ID_HEADER];
+    if (typeof header === "string" && header.length > 0)
+        return header;
+    return randomUUID();
+}
+/** Per-token rate-limit key: a hash of the bearer header, never the raw token. */
+function rateLimitKey(authorization) {
+    return createHash("sha256")
+        .update(authorization ?? "anonymous")
+        .digest("hex");
+}
+/**
+ * Assembles the Fastify application: an unauthenticated health probe, the
+ * agent-token `/bridge` surface, the client-token `/mcp` surface, and — when
+ * enabled — a client-token `/metrics` surface. The caller calls `listen`.
+ */
+export function createApp(deps) {
+    const { environment, logger, queue, subscriptions, sessionManager, metrics, tls } = deps;
+    // Pin Fastify's logger generic to FastifyBaseLogger so the assembled
+    // instance is the plain FastifyInstance the route helpers accept.
+    const fastifyLogger = logger;
+    const app = Fastify({
+        loggerInstance: fastifyLogger,
+        genReqId: correlationIdFor,
+        bodyLimit: environment.BRIDGE_MAX_BODY_BYTES,
+        trustProxy: environment.BRIDGE_TRUST_PROXY,
+        ...(tls === null ? {} : { https: { cert: tls.cert, key: tls.key } }),
+    });
+    if (metrics !== undefined) {
+        app.addHook("onResponse", (request, reply, done) => {
+            metrics.recordHttpRequest(request.method, reply.statusCode);
+            done();
+        });
+    }
+    const origins = corsOrigins(environment);
+    if (origins !== null) {
+        void app.register(cors, { origin: origins });
+    }
+    // Unauthenticated liveness probe.
+    registerHealthRoute(app, queue);
+    // Bridge surface — the behavior pack, authenticated with the agent token.
+    void app.register((bridge, _opts, done) => {
+        bridge.addHook("onRequest", bearerAuth("agent", environment.BRIDGE_AGENT_TOKEN));
+        registerPollRoute(bridge, queue, environment.BRIDGE_POLL_TIMEOUT_MS);
+        registerResultRoute(bridge, queue);
+        registerEventRoute(bridge, subscriptions);
+        registerHandshakeRoute(bridge, SERVER_VERSION, environment.BRIDGE_POLL_TIMEOUT_MS, subscriptions);
+        done();
+    }, { prefix: "/bridge" });
+    // MCP surface — clients, authenticated with the client token, rate limited.
+    void app.register((mcp, _opts, done) => {
+        mcp.addHook("onRequest", bearerAuth("client", environment.BRIDGE_CLIENT_TOKEN));
+        void mcp.register(rateLimit, {
+            max: environment.BRIDGE_RATE_LIMIT_RPM,
+            timeWindow: "1 minute",
+            keyGenerator: (request) => rateLimitKey(request.headers.authorization),
+        });
+        registerMcpRoute(mcp, sessionManager);
+        done();
+    }, { prefix: "/mcp" });
+    // Metrics surface — Prometheus scrape, authenticated with the client token.
+    if (metrics !== undefined) {
+        void app.register((scope, _opts, done) => {
+            scope.addHook("onRequest", bearerAuth("client", environment.BRIDGE_CLIENT_TOKEN));
+            registerMetricsRoute(scope, metrics);
+            done();
+        }, { prefix: "/metrics" });
+    }
+    return app;
+}
+//# sourceMappingURL=app.js.map

package/dist/http/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/http/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,OAAO,EAAE,EAAgD,MAAM,SAAS,CAAC;AAChF,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,WAAW,EAAoB,MAAM,0BAA0B,CAAC;AAGzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAKvD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAcjD,6EAA6E;AAC7E,SAAS,gBAAgB,CAAC,GAAoB;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACnE,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,aAAiC;IACrD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,aAAa,IAAI,WAAW,CAAC;SACpC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAqB;IAC7C,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAEzF,qEAAqE;IACrE,kEAAkE;IAClE,MAAM,aAAa,GAAsB,MAAM,CAAC;IAEhD,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,cAAc,EAAE,aAAa;QAC7B,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EAAE,WAAW,CAAC,qBAAqB;QAC5C,UAAU,EAAE,WAAW,CAAC,kBAAkB;QAC1C,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC;KACrE,CAAC,CAAC;IAEH,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACjD,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YAC5D,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,KAAK,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,kCAAkC;IAClC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAEhC,0EAA0E;IAC1E,KAAK,GAAG,CAAC,QAAQ,CACf,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACjF,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,sBAAsB,CAAC,CAAC;QACrE,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACnC,kBAAkB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC1C,sBAAsB,CACpB,MAAM,EACN,cAAc,EACd,WAAW,CAAC,sBAAsB,EAClC,aAAa,CACd,CAAC;QACF,IAAI,EAAE,CAAC;IACT,CAAC,EACD,EAAE,MAAM,EAAE,SAAS,EAAE,CACtB,CAAC;IAEF,4EAA4E;IAC5E,KAAK,GAAG,CAAC,QAAQ,CACf,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACnB,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAChF,KAAK,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE;YAC3B,GAAG,EAAE,WAAW,CAAC,qBAAqB;YACtC,UAAU,EAAE,UAAU;YACtB,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;SACvE,CAAC,CAAC;QACH,gBAAgB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACtC,IAAI,EAAE,CAAC;IACT,CAAC,EACD,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAC;IAEF,4EAA4E;IAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,GAAG,CAAC,QAAQ,CACf,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACrB,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAClF,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACrC,IAAI,EAAE,CAAC;QACT,CAAC,EACD,EAAE,MAAM,EAAE,UAAU,EAAE,CACvB,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/http/authentication.d.ts

@@ -0,0 +1,11 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+/** Which bearer token a request scope requires. */
+export type AuthScope = "client" | "agent";
+/**
+ * Builds a Fastify `onRequest` hook that enforces a single bearer token.
+ *
+ * On failure it responds `401` with no body, a `WWW-Authenticate` header, and
+ * a warning log line carrying the source IP — never the token itself.
+ */
+export declare function bearerAuth(scope: AuthScope, expectedToken: string): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+//# sourceMappingURL=authentication.d.ts.map

package/dist/http/authentication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../src/http/authentication.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE5D,mDAAmD;AACnD,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAsB3C;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,IAC7B,SAAS,cAAc,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAWhG"}

package/dist/http/authentication.js

@@ -0,0 +1,36 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+function digest(value) {
+    return createHash("sha256").update(value).digest();
+}
+/**
+ * Constant-time bearer token comparison.
+ *
+ * Both tokens are reduced to fixed-width SHA-256 digests first, so the
+ * comparison time does not leak the provided token's length.
+ */
+function tokensMatch(provided, expected) {
+    return timingSafeEqual(digest(provided), digest(expected));
+}
+function extractBearerToken(header) {
+    const prefix = "Bearer ";
+    if (header === undefined || !header.startsWith(prefix))
+        return undefined;
+    return header.slice(prefix.length);
+}
+/**
+ * Builds a Fastify `onRequest` hook that enforces a single bearer token.
+ *
+ * On failure it responds `401` with no body, a `WWW-Authenticate` header, and
+ * a warning log line carrying the source IP — never the token itself.
+ */
+export function bearerAuth(scope, expectedToken) {
+    return async function authenticate(request, reply) {
+        const token = extractBearerToken(request.headers.authorization);
+        if (token !== undefined && tokensMatch(token, expectedToken)) {
+            return;
+        }
+        request.log.warn({ scope, ip: request.ip, method: request.method, url: request.url }, "rejected unauthenticated request");
+        await reply.code(401).header("WWW-Authenticate", `Bearer realm="${scope}"`).send();
+    };
+}
+//# sourceMappingURL=authentication.js.map

package/dist/http/authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../src/http/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAM1D,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,QAAgB;IACrD,OAAO,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,kBAAkB,CAAC,MAA0B;IACpD,MAAM,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAgB,EAAE,aAAqB;IAChE,OAAO,KAAK,UAAU,YAAY,CAAC,OAAuB,EAAE,KAAmB;QAC7E,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAChE,IAAI,KAAK,KAAK,SAAS,IAAI,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EACnE,kCAAkC,CACnC,CAAC;QACF,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,iBAAiB,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrF,CAAC,CAAC;AACJ,CAAC"}

package/dist/http/health-route.d.ts

@@ -0,0 +1,10 @@
+import type { FastifyInstance } from "fastify";
+import type { CommandQueue } from "../queue/command-queue.js";
+/**
+ * Registers `GET /healthz` — an unauthenticated liveness probe.
+ *
+ * Always returns `200` while the process is responsive; behavior-pack
+ * connectivity is reported in the body as readiness information.
+ */
+export declare function registerHealthRoute(app: FastifyInstance, queue: CommandQueue): void;
+//# sourceMappingURL=health-route.d.ts.map

package/dist/http/health-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health-route.d.ts","sourceRoot":"","sources":["../../src/http/health-route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAUnF"}

package/dist/http/health-route.js

@@ -0,0 +1,18 @@
+/**
+ * Registers `GET /healthz` — an unauthenticated liveness probe.
+ *
+ * Always returns `200` while the process is responsive; behavior-pack
+ * connectivity is reported in the body as readiness information.
+ */
+export function registerHealthRoute(app, queue) {
+    app.get("/healthz", () => {
+        const stats = queue.stats();
+        return {
+            status: "ok",
+            bridge_connected: stats.bridgeConnected,
+            queue_depth: stats.depth,
+            commands_in_flight: stats.inFlight,
+        };
+    });
+}
+//# sourceMappingURL=health-route.js.map

package/dist/http/health-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health-route.js","sourceRoot":"","sources":["../../src/http/health-route.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAoB,EAAE,KAAmB;IAC3E,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5B,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,gBAAgB,EAAE,KAAK,CAAC,eAAe;YACvC,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,kBAAkB,EAAE,KAAK,CAAC,QAAQ;SACnC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/http/metrics-route.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyInstance } from "fastify";
+import type { Metrics } from "../observability/metrics.js";
+/**
+ * Registers `GET /metrics` — the Prometheus scrape endpoint. Mounted only when
+ * `BRIDGE_METRICS_ENABLED` is set.
+ */
+export declare function registerMetricsRoute(app: FastifyInstance, metrics: Metrics): void;
+//# sourceMappingURL=metrics-route.d.ts.map

package/dist/http/metrics-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics-route.d.ts","sourceRoot":"","sources":["../../src/http/metrics-route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAE3D;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAKjF"}

package/dist/http/metrics-route.js

@@ -0,0 +1,11 @@
+/**
+ * Registers `GET /metrics` — the Prometheus scrape endpoint. Mounted only when
+ * `BRIDGE_METRICS_ENABLED` is set.
+ */
+export function registerMetricsRoute(app, metrics) {
+    app.get("/", async (_request, reply) => {
+        const body = await metrics.registry.metrics();
+        return reply.header("content-type", metrics.registry.contentType).send(body);
+    });
+}
+//# sourceMappingURL=metrics-route.js.map

package/dist/http/metrics-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics-route.js","sourceRoot":"","sources":["../../src/http/metrics-route.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAoB,EAAE,OAAgB;IACzE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+import { join } from "node:path";
+import { ConfigError } from "./config/config-error.js";
+import { loadEnvironment } from "./config/environment.js";
+import { loadTlsMaterial } from "./config/tls.js";
+import { createSubscriptionRegistry } from "./events/subscription-registry.js";
+import { createApp } from "./http/app.js";
+import { createMcpServer } from "./mcp/mcp-server-factory.js";
+import { createSessionManager } from "./mcp/session-manager.js";
+import { createLogger } from "./observability/logger.js";
+import { createMetrics } from "./observability/metrics.js";
+import { createCommandQueue } from "./queue/command-queue.js";
+import { createCommandThrottle } from "./queue/command-throttle.js";
+import { createInstrumentedCommandQueue } from "./queue/instrumented-command-queue.js";
+import { SERVER_NAME, SERVER_VERSION } from "./server-info.js";
+import { createStructureFileStore } from "./structures/structure-file-store.js";
+/** Default per-kind command admission rate, protecting the script watchdog. */
+const DEFAULT_THROTTLE = { ratePerSecond: 20, burst: 40 };
+/** Events retained per subscription before the oldest are dropped. */
+const EVENT_BUFFER_SIZE = 512;
+/** Writes a message to stderr and exits non-zero. */
+function fail(message) {
+    process.stderr.write(`${message}\n`);
+    process.exit(1);
+}
+function describeError(error) {
+    if (error instanceof ConfigError)
+        return error.message;
+    return error instanceof Error ? error.message : String(error);
+}
+function loadConfig() {
+    try {
+        return loadEnvironment();
+    }
+    catch (error) {
+        return fail(describeError(error));
+    }
+}
+function loadTls(environment) {
+    try {
+        return loadTlsMaterial(environment);
+    }
+    catch (error) {
+        return fail(describeError(error));
+    }
+}
+async function main() {
+    const environment = loadConfig();
+    const logger = createLogger({
+        level: environment.BRIDGE_LOG_LEVEL,
+        pretty: process.stdout.isTTY === true,
+    });
+    const tls = loadTls(environment);
+    if (tls === null) {
+        logger.warn("TLS is not configured — the bridge is serving plain HTTP. Bearer tokens and " +
+            "world data will cross the network unencrypted. Set BRIDGE_TLS_CERT and " +
+            "BRIDGE_TLS_KEY (see the README for the mkcert workflow), or terminate TLS at a " +
+            "reverse proxy and bind the server to localhost.");
+    }
+    const baseQueue = createCommandQueue({
+        throttle: createCommandThrottle({ defaultPolicy: DEFAULT_THROTTLE }),
+        maxOutstanding: environment.BRIDGE_QUEUE_MAX,
+        livenessWindowMs: environment.BRIDGE_POLL_TIMEOUT_MS * 2,
+    });
+    const subscriptions = createSubscriptionRegistry({ bufferSize: EVENT_BUFFER_SIZE });
+    const structureFiles = createStructureFileStore(join(environment.BRIDGE_BEHAVIOR_PACK_PATH, "structures"));
+    // When metrics are enabled, the queue is wrapped to record command metrics
+    // and the gauges sample the base queue and session manager at scrape time.
+    let metrics;
+    let queue = baseQueue;
+    if (environment.BRIDGE_METRICS_ENABLED) {
+        metrics = createMetrics({
+            queueDepth: () => baseQueue.stats().depth,
+            commandsInFlight: () => baseQueue.stats().inFlight,
+            bridgeConnected: () => baseQueue.stats().bridgeConnected,
+            mcpSessions: () => sessionManager.count(),
+        });
+        queue = createInstrumentedCommandQueue(baseQueue, metrics);
+    }
+    const sessionManager = createSessionManager({
+        logger,
+        createServer: () => createMcpServer({
+            queue,
+            subscriptions,
+            structureFiles,
+            logger,
+            commandTimeoutMs: environment.BRIDGE_COMMAND_TIMEOUT_MS,
+        }),
+    });
+    const app = createApp({
+        environment,
+        logger,
+        queue,
+        subscriptions,
+        sessionManager,
+        metrics,
+        tls,
+    });
+    let shuttingDown = false;
+    async function shutdown(signal) {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
+        logger.info({ signal }, "shutting down");
+        queue.close();
+        await sessionManager.closeAll();
+        await app.close();
+        process.exit(0);
+    }
+    for (const signal of ["SIGINT", "SIGTERM"]) {
+        process.once(signal, (received) => {
+            void shutdown(received);
+        });
+    }
+    try {
+        await app.listen({ host: environment.BRIDGE_HOST, port: environment.BRIDGE_PORT });
+    }
+    catch (error) {
+        logger.error({ err: error }, "failed to start the bridge server");
+        process.exit(1);
+    }
+    const scheme = tls === null ? "http" : "https";
+    logger.info({
+        name: SERVER_NAME,
+        version: SERVER_VERSION,
+        address: `${scheme}://${environment.BRIDGE_HOST}:${environment.BRIDGE_PORT}`,
+        metrics: environment.BRIDGE_METRICS_ENABLED,
+    }, "bridge server listening");
+}
+void main().catch((error) => {
+    process.stderr.write(`fatal: ${describeError(error)}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,eAAe,EAAoB,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAoB,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAgB,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAqB,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAEhF,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAW,CAAC;AAEnE,sEAAsE;AACtE,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,qDAAqD;AACrD,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,YAAY,WAAW;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACvD,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,WAAwB;IACvC,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,KAAK,EAAE,WAAW,CAAC,gBAAgB;QACnC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI;KACtC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CACT,8EAA8E;YAC5E,yEAAyE;YACzE,iFAAiF;YACjF,iDAAiD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,kBAAkB,CAAC;QACnC,QAAQ,EAAE,qBAAqB,CAAC,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC;QACpE,cAAc,EAAE,WAAW,CAAC,gBAAgB;QAC5C,gBAAgB,EAAE,WAAW,CAAC,sBAAsB,GAAG,CAAC;KACzD,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,0BAA0B,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACpF,MAAM,cAAc,GAAG,wBAAwB,CAC7C,IAAI,CAAC,WAAW,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAC1D,CAAC;IAEF,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,OAA4B,CAAC;IACjC,IAAI,KAAK,GAAiB,SAAS,CAAC;IACpC,IAAI,WAAW,CAAC,sBAAsB,EAAE,CAAC;QACvC,OAAO,GAAG,aAAa,CAAC;YACtB,UAAU,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK;YACzC,gBAAgB,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ;YAClD,eAAe,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,eAAe;YACxD,WAAW,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE;SAC1C,CAAC,CAAC;QACH,KAAK,GAAG,8BAA8B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,oBAAoB,CAAC;QAC1C,MAAM;QACN,YAAY,EAAE,GAAG,EAAE,CACjB,eAAe,CAAC;YACd,KAAK;YACL,aAAa;YACb,cAAc;YACd,MAAM;YACN,gBAAgB,EAAE,WAAW,CAAC,yBAAyB;SACxD,CAAC;KACL,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,SAAS,CAAC;QACpB,WAAW;QACX,MAAM;QACN,KAAK;QACL,aAAa;QACb,cAAc;QACd,OAAO;QACP,GAAG;KACJ,CAAC,CAAC;IAEH,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,UAAU,QAAQ,CAAC,MAAsB;QAC5C,IAAI,YAAY;YAAE,OAAO;QACzB,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;QACzC,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,cAAc,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;YAChC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,mCAAmC,CAAC,CAAC;QAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/C,MAAM,CAAC,IAAI,CACT;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,cAAc;QACvB,OAAO,EAAE,GAAG,MAAM,MAAM,WAAW,CAAC,WAAW,IAAI,WAAW,CAAC,WAAW,EAAE;QAC5E,OAAO,EAAE,WAAW,CAAC,sBAAsB;KAC5C,EACD,yBAAyB,CAC1B,CAAC;AACJ,CAAC;AAED,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/mcp/mcp-route.d.ts

@@ -0,0 +1,12 @@
+import type { FastifyInstance } from "fastify";
+import type { SessionManager } from "./session-manager.js";
+/**
+ * Registers the MCP Streamable HTTP endpoint (mounted at `/mcp`).
+ *
+ * `POST` carries JSON-RPC messages and opens a session on `initialize`; `GET`
+ * opens the server-to-client SSE stream; `DELETE` terminates a session. The
+ * transport writes responses directly to the raw socket, so each handler
+ * hijacks the Fastify reply.
+ */
+export declare function registerMcpRoute(app: FastifyInstance, sessions: SessionManager): void;
+//# sourceMappingURL=mcp-route.d.ts.map

package/dist/mcp/mcp-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-route.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-route.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAY3D;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAmCrF"}

package/dist/mcp/mcp-route.js

@@ -0,0 +1,49 @@
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+function headerValue(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function sendMissingSession(reply) {
+    return reply
+        .code(400)
+        .send({ error: { code: "INVALID_INPUT", message: "missing or unknown MCP session" } });
+}
+/**
+ * Registers the MCP Streamable HTTP endpoint (mounted at `/mcp`).
+ *
+ * `POST` carries JSON-RPC messages and opens a session on `initialize`; `GET`
+ * opens the server-to-client SSE stream; `DELETE` terminates a session. The
+ * transport writes responses directly to the raw socket, so each handler
+ * hijacks the Fastify reply.
+ */
+export function registerMcpRoute(app, sessions) {
+    app.post("/", async (request, reply) => {
+        const sessionId = headerValue(request.headers["mcp-session-id"]);
+        const existing = sessionId === undefined ? undefined : sessions.get(sessionId);
+        let transport;
+        if (existing !== undefined) {
+            transport = existing;
+        }
+        else if (sessionId === undefined && isInitializeRequest(request.body)) {
+            transport = await sessions.create();
+        }
+        else {
+            return sendMissingSession(reply);
+        }
+        reply.hijack();
+        await transport.handleRequest(request.raw, reply.raw, request.body);
+        return reply;
+    });
+    const streamHandler = async (request, reply) => {
+        const sessionId = headerValue(request.headers["mcp-session-id"]);
+        const transport = sessionId === undefined ? undefined : sessions.get(sessionId);
+        if (transport === undefined) {
+            return sendMissingSession(reply);
+        }
+        reply.hijack();
+        await transport.handleRequest(request.raw, reply.raw);
+        return reply;
+    };
+    app.get("/", streamHandler);
+    app.delete("/", streamHandler);
+}
+//# sourceMappingURL=mcp-route.js.map

package/dist/mcp/mcp-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-route.js","sourceRoot":"","sources":["../../src/mcp/mcp-route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAKzE,SAAS,WAAW,CAAC,KAAoC;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAmB;IAC7C,OAAO,KAAK;SACT,IAAI,CAAC,GAAG,CAAC;SACT,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAoB,EAAE,QAAwB;IAC7E,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACnE,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE/E,IAAI,SAAwC,CAAC;QAC7C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,SAAS,GAAG,QAAQ,CAAC;QACvB,CAAC;aAAM,IAAI,SAAS,KAAK,SAAS,IAAI,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxE,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,KAAK,EACzB,OAAuB,EACvB,KAAmB,EACI,EAAE;QACzB,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACjC,CAAC"}

package/dist/mcp/mcp-server-factory.d.ts

@@ -0,0 +1,20 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { SubscriptionRegistry } from "../events/subscription-registry.js";
+import type { Logger } from "../observability/logger.js";
+import type { CommandQueue } from "../queue/command-queue.js";
+import type { StructureFileStore } from "../structures/structure-file-store.js";
+/** Domain services shared by every per-session MCP server. */
+export interface McpServerDependencies {
+    readonly queue: CommandQueue;
+    readonly subscriptions: SubscriptionRegistry;
+    readonly structureFiles: StructureFileStore;
+    readonly logger: Logger;
+    readonly commandTimeoutMs: number;
+}
+/**
+ * Creates an MCP server for a single client session, with the full tool
+ * surface registered. Tool handlers close over the shared domain services; the
+ * per-session `McpServer` instances are otherwise cheap and independent.
+ */
+export declare function createMcpServer(deps: McpServerDependencies): McpServer;
+//# sourceMappingURL=mcp-server-factory.d.ts.map

package/dist/mcp/mcp-server-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server-factory.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-server-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAE9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAIhF,8DAA8D;AAC9D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAC7C,QAAQ,CAAC,cAAc,EAAE,kBAAkB,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,qBAAqB,GAAG,SAAS,CAYtE"}

package/dist/mcp/mcp-server-factory.js

@@ -0,0 +1,23 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { SERVER_NAME, SERVER_VERSION } from "../server-info.js";
+import { allTools } from "../tools/index.js";
+import { registerTools } from "./tool-registry.js";
+/**
+ * Creates an MCP server for a single client session, with the full tool
+ * surface registered. Tool handlers close over the shared domain services; the
+ * per-session `McpServer` instances are otherwise cheap and independent.
+ */
+export function createMcpServer(deps) {
+    const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION });
+    registerTools(server, allTools, (extra) => ({
+        queue: deps.queue,
+        subscriptions: deps.subscriptions,
+        structureFiles: deps.structureFiles,
+        logger: deps.logger,
+        commandTimeoutMs: deps.commandTimeoutMs,
+        correlationId: String(extra.requestId),
+        signal: extra.signal,
+    }));
+    return server;
+}
+//# sourceMappingURL=mcp-server-factory.js.map

package/dist/mcp/mcp-server-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server-factory.js","sourceRoot":"","sources":["../../src/mcp/mcp-server-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIpE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAWnD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAA2B;IACzD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7E,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1C,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QACtC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC,CAAC;IACJ,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/mcp/session-manager.d.ts

@@ -0,0 +1,30 @@
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { Logger } from "../observability/logger.js";
+/**
+ * Tracks live MCP client sessions, each pairing a `StreamableHTTPServerTransport`
+ * with its own `McpServer`.
+ */
+export interface SessionManager {
+    /** Returns the transport for an established session, if one exists. */
+    get(sessionId: string): StreamableHTTPServerTransport | undefined;
+    /**
+     * Creates a transport for a new session and connects a fresh `McpServer` to
+     * it. The caller drives the `initialize` request through the returned
+     * transport; the session registers itself once the transport assigns an id.
+     */
+    create(): Promise<StreamableHTTPServerTransport>;
+    /** Number of established sessions. */
+    count(): number;
+    /** Closes every session — used during graceful shutdown. */
+    closeAll(): Promise<void>;
+}
+/** Configuration for {@link createSessionManager}. */
+export interface SessionManagerOptions {
+    readonly logger: Logger;
+    /** Factory for the per-session `McpServer` (with its tools registered). */
+    readonly createServer: () => McpServer;
+}
+/** Creates an empty {@link SessionManager}. */
+export declare function createSessionManager(options: SessionManagerOptions): SessionManager;
+//# sourceMappingURL=session-manager.d.ts.map