smedc-mcp-launcher 0.5.0

package/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 SMEDC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -0,0 +1,18 @@
+# SMEDC MCP Launcher
+
+Official stdio MCP launcher for SMEDC. It reads only `SMEDC_BASE_URL`, which must
+be a canonical HTTPS origin. Browser sign-in uses OAuth Authorization Code with PKCE; credentials
+are never accepted through command arguments, environment variables, or MCP tool inputs.
+
+Commands: `serve`, `self-check`, `logout`, and `--version`.
+
+The `serve` command exposes the authenticated `smedc_get_current_user` tool so an
+employee can confirm the current SMEDC display name, email, and role without exposing
+credentials or accepting a selector for another account.
+
+`self-check` writes one safe JSON object with `ok`, `launcherVersion`, `serviceOrigin`, `platform`,
+`secureStore`, `server`, and `mcp` fields. `logout` always attempts local cleanup and writes
+`remoteRevocationConfirmed` and `localCredentialRemoved` booleans. Neither command writes
+credential contents.
+
+This public package has no npm provenance because the source repository is private.

package/dist/index.d.ts

@@ -0,0 +1,172 @@
+#!/usr/bin/env node
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+
+interface LauncherRuntimeConfig {
+    serviceUrl: string;
+    transport: "stdio";
+}
+interface LauncherRuntimeConfigInput {
+    smedcBaseUrl: string;
+}
+type LauncherRuntimeEnv = Partial<Record<"SMEDC_BASE_URL", string | undefined>>;
+declare function createLauncherRuntimeConfig(input: LauncherRuntimeConfigInput): LauncherRuntimeConfig;
+declare function loadLauncherRuntimeConfig(env?: LauncherRuntimeEnv): LauncherRuntimeConfig;
+
+declare const MCP_LAUNCHER_SERVER_NAME = "smedc-mcp-launcher";
+declare const MCP_LAUNCHER_SERVER_VERSION = "0.5.0";
+declare function createSmedcMcpLauncherServer(config: LauncherRuntimeConfig): McpServer;
+declare function runMcpLauncherStdioServer(config: LauncherRuntimeConfig): Promise<void>;
+
+interface SecureCredentialStore {
+    get(): Promise<string | null>;
+    set(credential: string): Promise<void>;
+    delete(): Promise<void>;
+}
+interface AuthorizationRequest {
+    url: URL;
+    state: string;
+    verifier: string;
+}
+interface LoopbackCallbackServer {
+    redirectUri: URL;
+    waitForResult(): Promise<{
+        received: true;
+    }>;
+    close(): Promise<void>;
+}
+declare function createAuthorizationRequest(input: {
+    authorizationEndpoint: URL;
+    redirectUri: URL;
+    state?: string;
+    verifier?: string;
+}): Promise<AuthorizationRequest>;
+declare function createLoopbackCallbackServer(input: {
+    state: string;
+    timeoutMs?: number;
+}): Promise<LoopbackCallbackServer>;
+declare function redactSecrets(value: unknown): unknown;
+
+type LauncherErrorCode = "AUTHENTICATION_REQUIRED" | "AUTHENTICATION_PENDING" | "SERVICE_UNAVAILABLE" | "FORBIDDEN" | "LAUNCHER_UPGRADE_REQUIRED";
+declare class LauncherTypedError extends Error {
+    readonly code: LauncherErrorCode;
+    constructor(code: LauncherErrorCode);
+}
+interface OAuthTokenClient {
+    refresh(refreshCredential: string): Promise<{
+        accessToken: string;
+        refreshToken: string;
+        expiresAt?: number;
+    }>;
+    revoke(refreshCredential: string): Promise<boolean>;
+}
+interface LauncherLock {
+    acquire(): Promise<() => Promise<void>>;
+}
+declare class LauncherSession {
+    #private;
+    private readonly dependencies;
+    constructor(dependencies: {
+        origin: string;
+        secureStore?: SecureCredentialStore;
+        tokenClient: OAuthTokenClient;
+        lock?: LauncherLock;
+    });
+    ensureAccessToken(): Promise<string>;
+    establish(accessToken: string, refreshCredential: string, expiresAt: number): Promise<void>;
+    logout(): Promise<{
+        remoteRevocationConfirmed: boolean;
+        localCredentialRemoved: boolean;
+    }>;
+    status(): Promise<{
+        authenticated: boolean;
+    }>;
+    invalidate(): Promise<void>;
+    secureStoreAvailable(): Promise<boolean>;
+    waitForLogin(promise: Promise<void>): void;
+    private readCredential;
+    private storeCredential;
+    private deleteCredential;
+}
+
+declare const LAUNCHER_BOOTSTRAP_TOOL_NAMES: readonly ["smedc_login", "smedc_logout", "smedc_auth_status"];
+type LauncherBootstrapToolName = (typeof LAUNCHER_BOOTSTRAP_TOOL_NAMES)[number];
+type LauncherBusinessToolName = "smedc_get_current_user" | "smedc_list_skills" | "search_document_evidence" | "list_structured_datasets" | "query_structured_dataset" | "describe_structured_dataset_coverage" | "upload_structured_dataset" | "upload_evidence_document" | "upload_quarantine_certificate" | "query_quarantine_certificates" | "archive_quarantine_certificates" | "get_source_document_download_url" | "get_evidence_document_status" | "get_import_status" | "get_partition_import_status" | "download_structured_partitions";
+type LauncherToolName = LauncherBootstrapToolName | LauncherBusinessToolName;
+interface LauncherToolResult {
+    [key: string]: unknown;
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError: boolean;
+}
+interface LauncherAuthentication {
+    login(): Promise<LauncherLoginResult>;
+    logout(): Promise<{
+        remoteRevocationConfirmed: boolean;
+        localCredentialRemoved: boolean;
+    }>;
+    status(): Promise<{
+        authenticated: boolean;
+    }>;
+    accessToken(): Promise<string>;
+    invalidate(): Promise<void>;
+    selfCheck(): Promise<LauncherSelfCheck>;
+}
+type LauncherLoginResult = {
+    authenticated: true;
+} | {
+    authenticated: false;
+    flow: "device";
+    verificationUri: string;
+    verificationUriComplete: string | null;
+    userCode: string;
+    instanceName: string;
+    instanceHostname: string;
+    openedBrowser: boolean;
+};
+interface LauncherSelfCheck {
+    ok: boolean;
+    launcherVersion: string;
+    serviceOrigin: string;
+    platform: string;
+    secureStore: {
+        available: boolean;
+        durableCredentialPresent: boolean;
+    };
+    server: {
+        reachable: boolean;
+        metadataCompatible: boolean;
+        minimumLauncherVersion: string | null;
+        recommendedLauncherVersion: string | null;
+        recommendedUpdateAvailable: boolean;
+    };
+    mcp: {
+        handshake: "ok" | "not_authenticated" | "unavailable";
+    };
+}
+interface LauncherToolDependencies {
+    config: LauncherRuntimeConfig;
+    auth: LauncherAuthentication;
+    fetchImplementation: typeof fetch;
+}
+interface LauncherToolRegistrar {
+    registerTool(name: string, options: {
+        title: string;
+        description: string;
+        inputSchema: z.ZodRawShape;
+    }, handler: (input: unknown) => Promise<LauncherToolResult>): void;
+}
+declare function createLauncherToolDependencies(input: {
+    config: LauncherRuntimeConfig;
+    auth?: LauncherAuthentication;
+    fetchImplementation?: typeof fetch;
+}): LauncherToolDependencies;
+declare function registerLauncherTools(registrar: LauncherToolRegistrar, dependencies: LauncherToolDependencies): void;
+declare function createLauncherToolHandler(toolName: string, dependencies: LauncherToolDependencies): (input: unknown) => Promise<LauncherToolResult>;
+declare function createOfficialLauncherAuthentication(config: LauncherRuntimeConfig): LauncherAuthentication;
+
+declare function runCommand(): Promise<void>;
+
+export { LAUNCHER_BOOTSTRAP_TOOL_NAMES, type LauncherAuthentication, type LauncherBootstrapToolName, type LauncherBusinessToolName, type LauncherErrorCode, type LauncherRuntimeConfig, type LauncherRuntimeConfigInput, LauncherSession, type LauncherToolDependencies, type LauncherToolName, type LauncherToolRegistrar, type LauncherToolResult, LauncherTypedError, MCP_LAUNCHER_SERVER_NAME, MCP_LAUNCHER_SERVER_VERSION, createAuthorizationRequest, createLauncherRuntimeConfig, createLauncherToolDependencies, createLauncherToolHandler, createLoopbackCallbackServer, createOfficialLauncherAuthentication, createSmedcMcpLauncherServer, loadLauncherRuntimeConfig, redactSecrets, registerLauncherTools, runCommand, runMcpLauncherStdioServer };