@burdenoff/mcp-libs 2026.511.1

package/dist/index.cjs

@@ -0,0 +1,1013 @@
+'use strict';
+
+var fs = require('fs');
+var path = require('path');
+var os = require('os');
+var graphqlRequest = require('graphql-request');
+var fetch = require('cross-fetch');
+var mcp_js = require('@modelcontextprotocol/sdk/server/mcp.js');
+var types_js = require('@modelcontextprotocol/sdk/types.js');
+var stdio_js = require('@modelcontextprotocol/sdk/server/stdio.js');
+var crypto = require('crypto');
+var streamableHttp_js = require('@modelcontextprotocol/sdk/server/streamableHttp.js');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var fetch__default = /*#__PURE__*/_interopDefault(fetch);
+
+// src/core/auth/store.ts
+var TOKEN_BUFFER_MS = 5 * 60 * 1e3;
+function createAuthStore(configDir, authFileName2 = "auth.json") {
+  const authFile = path.join(configDir, authFileName2);
+  function ensureConfigDir() {
+    if (!fs.existsSync(configDir)) {
+      fs.mkdirSync(configDir, { recursive: true, mode: 448 });
+    }
+  }
+  function read() {
+    try {
+      if (!fs.existsSync(authFile)) return null;
+      const raw = fs.readFileSync(authFile, "utf8");
+      return JSON.parse(raw);
+    } catch {
+      return null;
+    }
+  }
+  function write(auth) {
+    ensureConfigDir();
+    fs.writeFileSync(authFile, JSON.stringify(auth, null, 2), { encoding: "utf8", mode: 384 });
+    try {
+      fs.chmodSync(authFile, 384);
+    } catch {
+    }
+  }
+  function clear() {
+    try {
+      if (fs.existsSync(authFile)) fs.unlinkSync(authFile);
+    } catch {
+    }
+  }
+  function isTokenExpired() {
+    const auth = read();
+    if (!auth?.expiresAt) return false;
+    return Date.now() >= auth.expiresAt;
+  }
+  function isTokenExpiringSoon() {
+    const auth = read();
+    if (!auth?.expiresAt) return false;
+    return Date.now() + TOKEN_BUFFER_MS >= auth.expiresAt;
+  }
+  function isWorkspaceTokenExpired() {
+    const auth = read();
+    if (!auth?.workspaceTokenExpiresAt) return false;
+    return Date.now() >= auth.workspaceTokenExpiresAt;
+  }
+  function isWorkspaceTokenExpiringSoon() {
+    const auth = read();
+    if (!auth?.workspaceTokenExpiresAt) return false;
+    return Date.now() + TOKEN_BUFFER_MS >= auth.workspaceTokenExpiresAt;
+  }
+  function isAuthenticated() {
+    const auth = read();
+    if (auth?.apiKey) return true;
+    if (!auth?.accessToken) return false;
+    return !isTokenExpired();
+  }
+  return {
+    read,
+    write,
+    clear,
+    isTokenExpired,
+    isTokenExpiringSoon,
+    isWorkspaceTokenExpired,
+    isWorkspaceTokenExpiringSoon,
+    isAuthenticated
+  };
+}
+function envOr(prefix, key, fallback) {
+  if (prefix) {
+    const prefixed = process.env[`${prefix}_${key}`];
+    if (prefixed !== void 0 && prefixed !== "") return prefixed;
+  }
+  const direct = process.env[key];
+  if (direct !== void 0 && direct !== "") return direct;
+  return fallback;
+}
+function createConfigStore(defaults) {
+  const configDir = path.join(os.homedir(), ".config", defaults.configDirName);
+  const configFile = path.join(configDir, "config.json");
+  const envPrefix = defaults.envPrefix ?? defaults.configDirName.toUpperCase().replace(/-/g, "_");
+  function ensureConfigDir() {
+    if (!fs.existsSync(configDir)) {
+      fs.mkdirSync(configDir, { recursive: true, mode: 448 });
+    }
+  }
+  function readPersisted() {
+    try {
+      if (!fs.existsSync(configFile)) return {};
+      const raw = fs.readFileSync(configFile, "utf8");
+      return JSON.parse(raw);
+    } catch {
+      return {};
+    }
+  }
+  function read() {
+    const persisted = readPersisted();
+    const workspaceEndpoint = envOr(envPrefix, "WORKSPACE_ENDPOINT") ?? persisted.workspaceEndpoint ?? defaults.workspaceEndpointDefault;
+    const globalEndpoint = envOr(envPrefix, "GLOBAL_ENDPOINT") ?? persisted.globalEndpoint ?? defaults.globalEndpointDefault;
+    const httpPortRaw = envOr(envPrefix, "HTTP_PORT") ?? envOr(void 0, "PORT") ?? String(defaults.httpPortDefault ?? 3e3);
+    const logLevelRaw = envOr(void 0, "LOG_LEVEL") ?? persisted.logLevel ?? "info";
+    const logFormatRaw = envOr(void 0, "LOG_FORMAT") ?? persisted.logFormat ?? "json";
+    return {
+      workspaceEndpoint,
+      globalEndpoint,
+      oidcIssuer: envOr(envPrefix, "OIDC_ISSUER") ?? persisted.oidcIssuer,
+      clientId: envOr(envPrefix, "CLIENT_ID") ?? persisted.clientId,
+      accessToken: envOr(envPrefix, "ACCESS_TOKEN"),
+      refreshToken: envOr(envPrefix, "REFRESH_TOKEN"),
+      workspaceToken: envOr(envPrefix, "WORKSPACE_TOKEN"),
+      apiKey: envOr(envPrefix, "API_KEY") ?? envOr(void 0, "MCP_API_KEY"),
+      workspaceId: envOr(envPrefix, "WORKSPACE_ID"),
+      organizationId: envOr(envPrefix, "ORGANIZATION_ID"),
+      host: envOr(void 0, "HOST") ?? envOr(void 0, "MCP_HOST") ?? defaults.hostDefault ?? "127.0.0.1",
+      httpPort: parseInt(httpPortRaw, 10) || (defaults.httpPortDefault ?? 3e3),
+      corsOrigins: envOr(void 0, "CORS_ORIGINS") ?? persisted.corsOrigins ?? "http://127.0.0.1,http://localhost",
+      allowedHosts: envOr(void 0, "ALLOWED_HOSTS") ?? persisted.allowedHosts ?? "127.0.0.1,localhost",
+      logLevel: ["error", "warn", "info", "debug"].includes(logLevelRaw) ? logLevelRaw : "info",
+      logFormat: logFormatRaw === "text" ? "text" : "json"
+    };
+  }
+  function write(patch) {
+    ensureConfigDir();
+    const merged = { ...readPersisted(), ...patch };
+    fs.writeFileSync(configFile, JSON.stringify(merged, null, 2), { encoding: "utf8" });
+    try {
+      fs.chmodSync(configFile, 384);
+    } catch {
+    }
+  }
+  function resolveOIDC() {
+    const config = read();
+    const clientId = config.clientId || defaults.oidcClientId;
+    let oidcIssuer = config.oidcIssuer;
+    if (!oidcIssuer) {
+      const globalEndpoint = config.globalEndpoint;
+      if (globalEndpoint.includes("localhost") || globalEndpoint.includes("127.0.0.1")) {
+        oidcIssuer = globalEndpoint.replace(/\/graphql$/, "").replace(/\/global\/graphql$/, "/global");
+      } else {
+        oidcIssuer = defaults.oidcIssuerProd ?? "https://graphql.burdenoff.com/global";
+      }
+    }
+    return { oidcIssuer, clientId };
+  }
+  return {
+    read,
+    write,
+    path: () => configFile,
+    dir: () => configDir,
+    resolveOIDC
+  };
+}
+async function clientCredentialsFlow(globalEndpoint, clientId, clientSecret, scopes) {
+  const query = `
+    mutation AuthenticateApp($input: AuthenticateAppInput!) {
+      authenticateApp(input: $input) {
+        accessToken tokenType expiresIn scopes
+      }
+    }
+  `;
+  const response = await fetch__default.default(globalEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      query,
+      variables: { input: { clientId, clientSecret, scopes } }
+    })
+  });
+  if (!response.ok) {
+    const text = await response.text().catch(() => "Unknown error");
+    throw new Error(`App authentication failed (${response.status}): ${text}`);
+  }
+  const data = await response.json();
+  if (data.errors?.length) {
+    throw new Error(`App authentication failed: ${data.errors[0]?.message ?? "unknown error"}`);
+  }
+  if (!data.data?.authenticateApp?.accessToken) {
+    throw new Error("App authentication failed: no access token returned");
+  }
+  return data.data.authenticateApp;
+}
+async function issueWorkspaceToken(workspaceEndpoint, authToken, workspaceId, organizationId) {
+  const query = `
+    mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {
+      issueWorkspaceToken(input: $input) {
+        success token expiresAt scopes
+        error { code message }
+      }
+    }
+  `;
+  const response = await fetch__default.default(workspaceEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${authToken}` },
+    body: JSON.stringify({ query, variables: { input: { workspaceId, organizationId } } })
+  });
+  if (!response.ok) {
+    const text = await response.text().catch(() => "Unknown error");
+    throw new Error(`Workspace token request failed (${response.status}): ${text}`);
+  }
+  const data = await response.json();
+  if (data.errors?.length) {
+    throw new Error(`Workspace token failed: ${data.errors[0]?.message ?? "unknown error"}`);
+  }
+  const result = data.data?.issueWorkspaceToken;
+  if (!result?.success || !result.token) {
+    throw new Error(`Workspace token failed: ${result?.error?.message ?? "Unknown error"}`);
+  }
+  return { token: result.token, expiresAt: result.expiresAt ?? "", scopes: result.scopes ?? [] };
+}
+
+// src/core/gql/client.ts
+var DEFAULT_TIMEOUT = 3e4;
+var MAX_RETRIES = 3;
+var INITIAL_RETRY_DELAY_MS = 1e3;
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function isNetworkOrServerError(error) {
+  if (error instanceof TypeError) return true;
+  if (error && typeof error === "object" && "response" in error) {
+    const resp = error.response;
+    if (resp && typeof resp.status === "number" && resp.status >= 500) return true;
+  }
+  return false;
+}
+function extractGqlErrorMessage(error) {
+  if (error && typeof error === "object" && "response" in error) {
+    const resp = error;
+    const firstError = resp.response?.errors?.[0];
+    if (firstError?.message) return firstError.message;
+    if (resp.message) return resp.message;
+  }
+  if (error instanceof Error) return error.message;
+  return String(error);
+}
+function getHeaders(auth) {
+  const headers = {};
+  if (auth?.apiKey) headers["X-API-Key"] = auth.apiKey;
+  if (auth?.accessToken) headers["Authorization"] = `Bearer ${auth.accessToken}`;
+  if (auth?.organizationId) headers["x-org-id"] = auth.organizationId;
+  return headers;
+}
+function getWorkspaceHeaders(auth) {
+  const headers = getHeaders(auth);
+  if (auth?.workspaceToken) {
+    headers["X-Workspace-Authorization"] = `Bearer ${auth.workspaceToken}`;
+  }
+  if (auth?.workspaceId) headers["x-workspace-id"] = auth.workspaceId;
+  return headers;
+}
+async function executeWithRetry(client, document, variables) {
+  let lastError;
+  for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+    try {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT);
+      try {
+        return await client.request({ document, variables, signal: controller.signal });
+      } finally {
+        clearTimeout(timer);
+      }
+    } catch (error) {
+      lastError = error;
+      if (error && typeof error === "object" && "response" in error) {
+        const resp = error.response;
+        if (resp && typeof resp.status === "number" && resp.status >= 400 && resp.status < 500) {
+          break;
+        }
+      }
+      if (isNetworkOrServerError(error) && attempt < MAX_RETRIES - 1) {
+        const delay = INITIAL_RETRY_DELAY_MS * Math.pow(2, attempt);
+        await sleep(delay);
+        continue;
+      }
+      break;
+    }
+  }
+  throw new Error(extractGqlErrorMessage(lastError));
+}
+function createGqlClients(config, authStore) {
+  let workspaceClient = null;
+  let globalClient = null;
+  function init() {
+    const cfg = config.read();
+    const auth = authStore.read();
+    workspaceClient = new graphqlRequest.GraphQLClient(cfg.workspaceEndpoint);
+    workspaceClient.setHeaders(getWorkspaceHeaders(auth));
+    globalClient = new graphqlRequest.GraphQLClient(cfg.globalEndpoint);
+    globalClient.setHeaders(getHeaders(auth));
+    return { workspace: workspaceClient, global: globalClient };
+  }
+  async function refreshPlatformToken() {
+    const auth = authStore.read();
+    if (!auth) return;
+    if (auth.authMethod === "client_credentials" && auth.clientId && auth.clientSecret) {
+      const cfg2 = config.read();
+      try {
+        const result = await clientCredentialsFlow(
+          cfg2.globalEndpoint,
+          auth.clientId,
+          auth.clientSecret
+        );
+        authStore.write({
+          ...auth,
+          accessToken: result.accessToken,
+          expiresAt: Date.now() + result.expiresIn * 1e3
+        });
+        workspaceClient = null;
+        globalClient = null;
+      } catch {
+      }
+      return;
+    }
+    if (!auth.refreshToken) return;
+    const cfg = config.read();
+    const client = new graphqlRequest.GraphQLClient(cfg.globalEndpoint);
+    client.setHeaders({ Authorization: `Bearer ${auth.accessToken}` });
+    const REFRESH_MUTATION = `
+      mutation RefreshToken($token: String!) {
+        refreshToken(token: $token) { accessToken refreshToken expiresIn }
+      }
+    `;
+    try {
+      const data = await client.request(REFRESH_MUTATION, {
+        token: auth.refreshToken
+      });
+      authStore.write({
+        ...auth,
+        accessToken: data.refreshToken.accessToken,
+        refreshToken: data.refreshToken.refreshToken,
+        expiresAt: Date.now() + data.refreshToken.expiresIn * 1e3
+      });
+      workspaceClient = null;
+      globalClient = null;
+    } catch {
+    }
+  }
+  async function refreshWorkspaceToken() {
+    const auth = authStore.read();
+    if (!auth?.accessToken || !auth.workspaceId || !auth.organizationId) return;
+    const cfg = config.read();
+    try {
+      const result = await issueWorkspaceToken(
+        cfg.workspaceEndpoint,
+        auth.accessToken,
+        auth.workspaceId,
+        auth.organizationId
+      );
+      authStore.write({
+        ...auth,
+        workspaceToken: result.token,
+        workspaceTokenExpiresAt: new Date(result.expiresAt).getTime()
+      });
+      workspaceClient = null;
+    } catch {
+    }
+  }
+  async function ensureFreshTokens() {
+    const initial = authStore.read();
+    if (initial?.apiKey) return;
+    if (authStore.isTokenExpiringSoon()) {
+      await refreshPlatformToken();
+    }
+    if (authStore.isWorkspaceTokenExpiringSoon()) {
+      await refreshWorkspaceToken();
+    }
+  }
+  const workspace = {
+    async request(document, variables) {
+      await ensureFreshTokens();
+      const { workspace: ws } = workspaceClient ? { workspace: workspaceClient } : init();
+      ws.setHeaders(getWorkspaceHeaders(authStore.read()));
+      return executeWithRetry(ws, document, variables);
+    }
+  };
+  const global = {
+    async request(document, variables) {
+      const { global: g } = globalClient ? { global: globalClient } : init();
+      g.setHeaders(getHeaders(authStore.read()));
+      return executeWithRetry(g, document, variables);
+    }
+  };
+  const workspaceAuthOnly = {
+    async request(document, variables) {
+      const cfg = config.read();
+      const auth = authStore.read();
+      const client = new graphqlRequest.GraphQLClient(cfg.workspaceEndpoint);
+      client.setHeaders(getHeaders(auth));
+      return executeWithRetry(client, document, variables);
+    }
+  };
+  return {
+    workspace,
+    global,
+    workspaceAuthOnly,
+    reset() {
+      workspaceClient = null;
+      globalClient = null;
+    }
+  };
+}
+
+// src/core/logger.ts
+var LEVEL_RANK = {
+  error: 0,
+  warn: 1,
+  info: 2,
+  debug: 3
+};
+function createLogger(opts = {}) {
+  let level = opts.level ?? process.env.LOG_LEVEL ?? "info";
+  const format = opts.format ?? process.env.LOG_FORMAT ?? "json";
+  function shouldLog(target) {
+    return LEVEL_RANK[target] <= LEVEL_RANK[level];
+  }
+  function formatMessage(target, message, context) {
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    if (format === "json") {
+      return JSON.stringify({ timestamp, level: target, message, ...context });
+    }
+    const contextStr = context ? ` ${JSON.stringify(context)}` : "";
+    return `[${timestamp}] ${target.toUpperCase()}: ${message}${contextStr}`;
+  }
+  function emit(target, message, context) {
+    if (!shouldLog(target)) return;
+    process.stderr.write(formatMessage(target, message, context) + "\n");
+  }
+  return {
+    error(message, context) {
+      emit("error", message, context);
+    },
+    warn(message, context) {
+      emit("warn", message, context);
+    },
+    info(message, context) {
+      emit("info", message, context);
+    },
+    debug(message, context) {
+      emit("debug", message, context);
+    },
+    setLevel(newLevel) {
+      level = newLevel;
+    },
+    getLevel() {
+      return level;
+    }
+  };
+}
+
+// src/core/progress.ts
+function createProgress(serverRef) {
+  return (token, current, total, message) => {
+    if (token === void 0 || token === null) return;
+    const server = serverRef.current;
+    if (!server) return;
+    try {
+      const params = { progressToken: token, progress: current };
+      if (total !== void 0) params.total = total;
+      if (message !== void 0) params.message = message;
+      const inner = server.server ?? server;
+      inner.notification?.({ method: "notifications/progress", params });
+    } catch {
+    }
+  };
+}
+
+// src/core/context.ts
+function inferEnv(workspaceEndpoint) {
+  if (workspaceEndpoint.includes("localhost") || workspaceEndpoint.includes("127.0.0.1")) {
+    return "local";
+  }
+  if (workspaceEndpoint.includes("alpha")) return "alpha";
+  return "prod";
+}
+function isLogger(value) {
+  return !!value && typeof value.debug === "function" && typeof value.info === "function";
+}
+function buildContext(opts) {
+  const config = createConfigStore(opts.defaults);
+  const cfg = config.read();
+  const logger = isLogger(opts.logger) ? opts.logger : createLogger({
+    ...opts.logger,
+    level: cfg.logLevel,
+    format: cfg.logFormat
+  });
+  const auth = createAuthStore(
+    opts.tokenStorePath ? dirOf(opts.tokenStorePath) : config.dir(),
+    authFileName(opts.tokenStorePath)
+  );
+  const existing = auth.read();
+  if (!existing && (cfg.accessToken || cfg.apiKey)) {
+    auth.write({
+      accessToken: cfg.accessToken ?? "",
+      refreshToken: cfg.refreshToken ?? "",
+      ...cfg.workspaceToken ? { workspaceToken: cfg.workspaceToken } : {},
+      ...cfg.workspaceId ? { workspaceId: cfg.workspaceId } : {},
+      ...cfg.organizationId ? { organizationId: cfg.organizationId } : {},
+      ...cfg.apiKey ? { apiKey: cfg.apiKey, authMethod: "api_key" } : {}
+    });
+  }
+  const gql = createGqlClients(config, auth);
+  const env = opts.env ?? inferEnv(cfg.workspaceEndpoint);
+  const serverRef = { current: null };
+  const progress = createProgress(serverRef);
+  return {
+    productName: opts.productName,
+    productVersion: opts.productVersion,
+    serverName: opts.serverName,
+    serverVersion: opts.serverVersion,
+    defaults: opts.defaults,
+    config,
+    auth,
+    gql,
+    logger,
+    progress,
+    env,
+    _internal: { serverRef }
+  };
+}
+function dirOf(p) {
+  const lastSlash = p.lastIndexOf("/");
+  return lastSlash > 0 ? p.slice(0, lastSlash) : p;
+}
+function authFileName(p) {
+  if (!p) return void 0;
+  const lastSlash = p.lastIndexOf("/");
+  return lastSlash >= 0 ? p.slice(lastSlash + 1) : p;
+}
+
+// src/core/errors.ts
+var McpUserError = class extends Error {
+  hint;
+  constructor(message, opts) {
+    super(message);
+    this.name = "McpUserError";
+    this.hint = opts?.hint;
+  }
+};
+var McpAuthError = class extends McpUserError {
+  constructor(message, opts) {
+    super(message, {
+      hint: opts?.hint ?? "Run the auth_login tool to authenticate."
+    });
+    this.name = "McpAuthError";
+  }
+};
+var McpInternalError = class extends Error {
+  cause;
+  constructor(message, cause) {
+    super(message);
+    this.name = "McpInternalError";
+    this.cause = cause;
+  }
+};
+
+// src/core/module.ts
+var MissingDependencyError = class extends McpInternalError {
+  constructor(moduleId, missingDep) {
+    super(
+      `Module '${moduleId}' declares dependency on '${missingDep}', but '${missingDep}' is not in the module list.`
+    );
+    this.name = "MissingDependencyError";
+  }
+};
+var CircularDependencyError = class extends McpInternalError {
+  constructor(cycle) {
+    super(`Circular dependency detected among modules: ${cycle.join(" -> ")}`);
+    this.name = "CircularDependencyError";
+  }
+};
+function sortModules(modules) {
+  const byId = /* @__PURE__ */ new Map();
+  for (const m of modules) {
+    if (byId.has(m.id)) {
+      throw new McpInternalError(`Duplicate module id: '${m.id}'`);
+    }
+    byId.set(m.id, m);
+  }
+  for (const m of modules) {
+    for (const dep of m.dependsOn ?? []) {
+      if (!byId.has(dep)) {
+        throw new MissingDependencyError(m.id, dep);
+      }
+    }
+  }
+  const sorted = [];
+  const visiting = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  function visit(m, path) {
+    if (visited.has(m.id)) return;
+    if (visiting.has(m.id)) {
+      throw new CircularDependencyError([...path, m.id]);
+    }
+    visiting.add(m.id);
+    for (const dep of m.dependsOn ?? []) {
+      const depModule = byId.get(dep);
+      if (depModule) visit(depModule, [...path, m.id]);
+    }
+    visiting.delete(m.id);
+    visited.add(m.id);
+    sorted.push(m);
+  }
+  for (const m of modules) {
+    visit(m, []);
+  }
+  return sorted;
+}
+
+// src/core/capabilities.ts
+function unionCapabilities(caps) {
+  const out = {};
+  for (const cap of caps) {
+    if (!cap) continue;
+    if (cap.resources) {
+      out.resources ??= {};
+      if (cap.resources.subscribe) out.resources.subscribe = true;
+      if (cap.resources.listChanged) out.resources.listChanged = true;
+    }
+    if (cap.prompts) {
+      out.prompts ??= {};
+      if (cap.prompts.listChanged) out.prompts.listChanged = true;
+    }
+    if (cap.tools) {
+      out.tools ??= {};
+      if (cap.tools.listChanged) out.tools.listChanged = true;
+    }
+    if (cap.logging) out.logging = true;
+    if (cap.completions) out.completions = true;
+  }
+  return out;
+}
+function toServerCapabilities(caps) {
+  const out = {};
+  if (caps.tools) out.tools = caps.tools;
+  if (caps.resources) out.resources = caps.resources;
+  if (caps.prompts) out.prompts = caps.prompts;
+  if (caps.logging) out.logging = {};
+  if (caps.completions) out.completions = {};
+  return out;
+}
+
+// src/core/server.ts
+var MCP_TO_LOGGER_LEVEL = {
+  debug: "debug",
+  info: "info",
+  notice: "info",
+  warning: "warn",
+  error: "error",
+  critical: "error",
+  alert: "error",
+  emergency: "error"
+};
+function createMcpServer(ctx, modules, opts) {
+  const sorted = sortModules(modules);
+  const baseCapabilities = { logging: true };
+  const capabilities = unionCapabilities([
+    baseCapabilities,
+    ...sorted.map((m) => m.capabilities),
+    opts.extraCapabilities
+  ]);
+  const server = new mcp_js.McpServer(
+    { name: opts.name, version: opts.version },
+    { capabilities: toServerCapabilities(capabilities) }
+  );
+  ctx._internal.serverRef.current = server;
+  const inner = server.server ?? server;
+  if (typeof inner.setRequestHandler === "function") {
+    inner.setRequestHandler(
+      types_js.SetLevelRequestSchema,
+      async (req) => {
+        const target = MCP_TO_LOGGER_LEVEL[req.params.level] ?? "info";
+        ctx.logger.setLevel(target);
+        ctx.logger.info("MCP logging level set", { level: req.params.level, mapped: target });
+        return {};
+      }
+    );
+  }
+  const tools = [];
+  const resources = [];
+  const prompts = [];
+  const moduleManifest = [];
+  for (const mod of sorted) {
+    try {
+      const reg = mod.register(server, ctx);
+      tools.push(...reg.tools);
+      resources.push(...reg.resources);
+      prompts.push(...reg.prompts);
+      moduleManifest.push({ id: mod.id, version: mod.version });
+      ctx.logger.debug(`Registered module: ${mod.id}`, {
+        tools: reg.tools.length,
+        resources: reg.resources.length,
+        prompts: reg.prompts.length
+      });
+    } catch (error) {
+      ctx.logger.error(`Failed to register module: ${mod.id}`, {
+        error: error instanceof Error ? error.message : String(error)
+      });
+      throw error;
+    }
+  }
+  const manifest = {
+    modules: moduleManifest,
+    tools,
+    resources,
+    prompts
+  };
+  ctx.logger.info(`MCP server ready: ${opts.name}@${opts.version}`, {
+    modules: manifest.modules.length,
+    tools: manifest.tools.length,
+    resources: manifest.resources.length,
+    prompts: manifest.prompts.length
+  });
+  return { server, manifest };
+}
+
+// src/core/result.ts
+function jsonResult(data, structured) {
+  const result = {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+  };
+  if (structured !== void 0) {
+    result.structuredContent = structured;
+  }
+  return result;
+}
+function textResult(text) {
+  return { content: [{ type: "text", text }] };
+}
+function errorResult(message, hint) {
+  const text = hint ? `${message}
+
+Hint: ${hint}` : message;
+  return { content: [{ type: "text", text }], isError: true };
+}
+function registerTool(server, ctx, name, metadata, handler) {
+  const sdkConfig = {
+    title: metadata.title,
+    description: metadata.description,
+    ...metadata.inputSchema ? { inputSchema: metadata.inputSchema } : {}
+  };
+  const wrapped = async (...callbackArgs) => {
+    const hasArgs = callbackArgs.length === 2;
+    const args = hasArgs ? callbackArgs[0] : {};
+    const extra = hasArgs ? callbackArgs[1] : callbackArgs[0];
+    const progressToken = extra?._meta?.progressToken;
+    const meta = progressToken !== void 0 ? { progressToken } : {};
+    try {
+      const result = await handler(args, ctx, meta);
+      if (isToolResult(result)) return result;
+      if (result === void 0) return textResult("OK");
+      return jsonResult(result);
+    } catch (error) {
+      return mapErrorToResult(error, ctx, name);
+    }
+  };
+  server.registerTool(name, sdkConfig, wrapped);
+}
+function isToolResult(value) {
+  return !!value && typeof value === "object" && "content" in value && Array.isArray(value.content);
+}
+function mapErrorToResult(error, ctx, toolName) {
+  if (error instanceof McpAuthError) {
+    ctx.logger.warn(`${toolName}: auth required`, { message: error.message });
+    return errorResult(error.message, error.hint);
+  }
+  if (error instanceof McpUserError) {
+    ctx.logger.info(`${toolName}: user error`, { message: error.message });
+    return errorResult(error.message, error.hint);
+  }
+  if (error instanceof McpInternalError) {
+    ctx.logger.error(`${toolName}: internal error`, {
+      message: error.message,
+      cause: stringifyCause(error.cause)
+    });
+    return errorResult(`Internal error in ${toolName}.`);
+  }
+  const message = error instanceof Error ? error.message : String(error);
+  ctx.logger.error(`${toolName}: unhandled error`, { message });
+  return errorResult(`${toolName}: ${message}`);
+}
+function stringifyCause(cause) {
+  if (cause === void 0 || cause === null) return void 0;
+  if (cause instanceof Error) return cause.message;
+  try {
+    return JSON.stringify(cause);
+  } catch {
+    return String(cause);
+  }
+}
+
+// src/core/tool-name.ts
+var MAX_TOOL_NAME_LENGTH = 63;
+function assertSafeName(name, kind) {
+  if (name.length > MAX_TOOL_NAME_LENGTH) {
+    throw new McpInternalError(
+      `Tool name '${name}' exceeds ${MAX_TOOL_NAME_LENGTH} characters (some MCP clients truncate at 64).`
+    );
+  }
+  return name;
+}
+function mcpToolName(productName, ...parts) {
+  if (!productName) {
+    throw new McpInternalError("mcpToolName: productName is required");
+  }
+  const name = [productName, ...parts].filter(Boolean).join("_");
+  return assertSafeName(name);
+}
+function mcpResourceUri(productName, ...parts) {
+  if (!productName) {
+    throw new McpInternalError("mcpResourceUri: productName is required");
+  }
+  return `${productName}://${parts.filter(Boolean).join("/")}`;
+}
+function mcpPromptName(productName, ...parts) {
+  if (!productName) {
+    throw new McpInternalError("mcpPromptName: productName is required");
+  }
+  return [productName, ...parts].filter(Boolean).join("-");
+}
+async function startStdioServer(server, ctx, _opts = {}) {
+  ctx.logger.info("Starting MCP server with stdio transport", {
+    name: ctx.serverName,
+    version: ctx.serverVersion
+  });
+  const transport = new stdio_js.StdioServerTransport();
+  await server.connect(transport);
+  ctx.logger.info("MCP stdio server started");
+}
+
+// src/transports/security.ts
+var SESSION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function parseCorsOrigins(origins) {
+  if (Array.isArray(origins)) return origins;
+  const value = origins?.trim();
+  if (!value || value === "*") {
+    return ["http://127.0.0.1", "http://localhost"];
+  }
+  return value.split(",").map((origin) => origin.trim()).filter(Boolean);
+}
+function isAuthorizedRequest(req, apiKey) {
+  return req.headers.authorization === `Bearer ${apiKey}` || req.headers["x-api-key"] === apiKey;
+}
+function requireAuthorizedRequest(req, res, apiKey) {
+  if (!apiKey) {
+    res.status(503).json({ error: "Transport authentication is not configured" });
+    return false;
+  }
+  if (!isAuthorizedRequest(req, apiKey)) {
+    res.status(401).json({ error: "Unauthorized" });
+    return false;
+  }
+  return true;
+}
+function isValidSessionId(sessionId) {
+  return SESSION_ID_PATTERN.test(sessionId);
+}
+
+// src/transports/http.ts
+async function createHttpApp(ctx, createServerFn, options = {}) {
+  const expressMod = await import('express');
+  const corsMod = await import('cors');
+  const express = expressMod.default ?? expressMod;
+  const cors = corsMod.default ?? corsMod;
+  const cfg = ctx.config.read();
+  const app = express();
+  app.use(express.json());
+  if (options.enableCors !== false) {
+    const corsOrigins = options.corsOrigins ?? cfg.corsOrigins;
+    app.use(
+      cors({
+        origin: parseCorsOrigins(corsOrigins),
+        exposedHeaders: ["Mcp-Session-Id"],
+        allowedHeaders: ["Content-Type", "Authorization", "X-API-Key", "mcp-session-id"]
+      })
+    );
+  }
+  const transports = {};
+  const apiKey = options.apiKey ?? cfg.apiKey;
+  app.post("/mcp", async (req, res) => {
+    if (!requireAuthorizedRequest(req, res, apiKey)) return;
+    try {
+      const sessionId = req.headers["mcp-session-id"];
+      let transport;
+      if (sessionId && !isValidSessionId(sessionId)) {
+        res.status(400).json({
+          jsonrpc: "2.0",
+          error: { code: -32e3, message: "Bad Request: Invalid session ID provided" },
+          id: null
+        });
+        return;
+      }
+      if (sessionId && transports[sessionId]) {
+        transport = transports[sessionId];
+      } else if (!sessionId && types_js.isInitializeRequest(req.body)) {
+        transport = new streamableHttp_js.StreamableHTTPServerTransport({
+          sessionIdGenerator: () => crypto.randomUUID(),
+          onsessioninitialized: (sid) => {
+            transports[sid] = transport;
+            ctx.logger.info("New MCP session initialized", { sessionId: sid });
+          },
+          enableDnsRebindingProtection: options.enableDnsRebindingProtection ?? true,
+          allowedHosts: options.allowedHosts ?? cfg.allowedHosts.split(",")
+        });
+        transport.onclose = () => {
+          if (transport.sessionId) {
+            delete transports[transport.sessionId];
+            ctx.logger.info("MCP session closed", { sessionId: transport.sessionId });
+          }
+        };
+        const server = createServerFn();
+        await server.connect(transport);
+      } else {
+        res.status(400).json({
+          jsonrpc: "2.0",
+          error: { code: -32e3, message: "Bad Request: No valid session ID provided" },
+          id: null
+        });
+        return;
+      }
+      await transport.handleRequest(req, res, req.body);
+    } catch (error) {
+      ctx.logger.error("Error handling MCP request", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+      if (!res.headersSent) {
+        res.status(500).json({
+          jsonrpc: "2.0",
+          error: { code: -32603, message: "Internal server error" },
+          id: null
+        });
+      }
+    }
+  });
+  const handleSessionRequest = async (req, res) => {
+    if (!requireAuthorizedRequest(req, res, apiKey)) return;
+    const sessionId = req.headers["mcp-session-id"];
+    if (!sessionId || !isValidSessionId(sessionId) || !transports[sessionId]) {
+      res.status(400).send("Invalid or missing session ID");
+      return;
+    }
+    await transports[sessionId].handleRequest(req, res);
+  };
+  app.get("/mcp", handleSessionRequest);
+  app.delete("/mcp", handleSessionRequest);
+  app.get("/health", (_req, res) => {
+    res.json({
+      status: "healthy",
+      server: ctx.serverName,
+      version: ctx.serverVersion,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      uptime: process.uptime(),
+      activeSessions: Object.keys(transports).length
+    });
+  });
+  return app;
+}
+async function startHttpServer(ctx, createServerFn, options = {}) {
+  const cfg = ctx.config.read();
+  const port = options.port ?? cfg.httpPort;
+  const host = options.host ?? cfg.host;
+  ctx.logger.info("Starting MCP server with HTTP transport", {
+    port,
+    host,
+    name: ctx.serverName,
+    version: ctx.serverVersion
+  });
+  const app = await createHttpApp(ctx, createServerFn, options);
+  await new Promise((resolve, reject) => {
+    const server = app.listen(port, host, (err) => {
+      if (err) reject(err);
+      else {
+        ctx.logger.info("MCP HTTP server started", { port, host });
+        resolve();
+      }
+    });
+    server.on("error", reject);
+  });
+}
+
+exports.McpAuthError = McpAuthError;
+exports.McpInternalError = McpInternalError;
+exports.McpUserError = McpUserError;
+exports.buildContext = buildContext;
+exports.createMcpServer = createMcpServer;
+exports.errorResult = errorResult;
+exports.jsonResult = jsonResult;
+exports.mcpPromptName = mcpPromptName;
+exports.mcpResourceUri = mcpResourceUri;
+exports.mcpToolName = mcpToolName;
+exports.registerTool = registerTool;
+exports.startHttpServer = startHttpServer;
+exports.startStdioServer = startStdioServer;
+exports.textResult = textResult;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map