@crediolabs/policy-builder-mcp 0.1.18 → 0.2.0

package/README.md

@@ -54,8 +54,11 @@ branch on them.
   non-loopback host; it serves `127.0.0.1`, `::1` or `localhost` unless the
   embedding caller explicitly opts out (`allowExternalHost: true` via the
   programmatic API), because the surface is unauthenticated by design.
-- The on-chain interpreter the policies target is **unaudited**; see the
-  [architecture document](https://github.com/untangledfinance/octogate/blob/main/docs/architecture.md).
+- See the
+  [architecture document](https://github.com/untangledfinance/octogate/blob/main/docs/architecture.md)
+  for what the on-chain interpreter does and does not enforce, and the
+  [repository README](https://github.com/untangledfinance/octogate#readme)
+  for the contracts' audit status.
 
 ## License
 

package/dist/src/schemas.d.ts

@@ -427,18 +427,66 @@ export declare const SynthesizePolicyToolShape: {
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         windowSeconds: z.ZodOptional<z.ZodNumber>;
         validUntilLedger: z.ZodOptional<z.ZodNumber>;
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         windowSeconds: z.ZodOptional<z.ZodNumber>;
         validUntilLedger: z.ZodOptional<z.ZodNumber>;
         limitAmount: z.ZodOptional<z.ZodString>;
         invocationLimit: z.ZodOptional<z.ZodNumber>;
         swapRecipientAllowlist: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        oraclePriceBound: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            asset: z.ZodEffects<z.ZodString, string, string>;
+            operator: z.ZodEnum<["eq", "lt", "lte", "gt", "gte"]>;
+            value: z.ZodString;
+            decimals: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }, {
+            value: string;
+            operator: "eq" | "lt" | "lte" | "gt" | "gte";
+            asset: string;
+            decimals: number;
+        }>, "many">>;
     }, z.ZodTypeAny, "passthrough">>>;
     readonly confidenceOverride: z.ZodOptional<z.ZodObject<{
         threshold: z.ZodNumber;
@@ -1103,6 +1151,17 @@ export declare const RevokePolicyToolShape: {
     readonly rpcUrl: z.ZodOptional<z.ZodString>;
     readonly baseFee: z.ZodOptional<z.ZodNumber>;
 };
+/** Flat ZodRawShape for `merge_policy`: the tightening remedy when two rules
+ *  our interpreter polices can serve the same calls. Two steps, in order. */
+export declare const MergePolicyToolShape: {
+    readonly ruleId: z.ZodNumber;
+    readonly incomingPredicateBlobBase64: z.ZodString;
+    readonly step: z.ZodEnum<["detach", "reinstall"]>;
+    readonly smartAccount: z.ZodOptional<z.ZodString>;
+    readonly sourceAccount: z.ZodOptional<z.ZodString>;
+    readonly rpcUrl: z.ZodOptional<z.ZodString>;
+    readonly baseFee: z.ZodOptional<z.ZodNumber>;
+};
 /** Flat ZodRawShape for `get_interpreter_info`. `verifyLive` triggers an
  *  optional RPC `grammar_version()` call so the caller can verify the
  *  deployed contract matches the pin. */

package/dist/src/schemas.js

@@ -112,6 +112,14 @@ export const RevokePolicyToolShape = {
     ruleId: z.number().int().nonnegative().optional(),
     interpreterAddress: z.string().optional(),
 };
+/** Flat ZodRawShape for `merge_policy`: the tightening remedy when two rules
+ *  our interpreter polices can serve the same calls. Two steps, in order. */
+export const MergePolicyToolShape = {
+    ...SmartAccountToolShape,
+    ruleId: z.number().int().nonnegative(),
+    incomingPredicateBlobBase64: z.string().min(1),
+    step: z.enum(['detach', 'reinstall']),
+};
 /** Flat ZodRawShape for `get_interpreter_info`. `verifyLive` triggers an
  *  optional RPC `grammar_version()` call so the caller can verify the
  *  deployed contract matches the pin. */

package/dist/src/server.js

@@ -10,9 +10,9 @@
 // Stateless: a fresh McpServer is constructed per transport (stdio/HTTP). No
 // shared mutable state across calls; nothing here caches, queues, or holds
 // key material.
-import { runGetInterpreterInfo, runInstallPolicy, runRecordTransaction, runRevokePolicy, runSimulatePolicy, runSynthesizePolicy, runVerifyPolicy, } from '@crediolabs/policy-synth/run';
+import { runGetInterpreterInfo, runInstallPolicy, runMergePolicy, runRecordTransaction, runRevokePolicy, runSimulatePolicy, runSynthesizePolicy, runVerifyPolicy, } from '@crediolabs/policy-synth/run';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { GetInterpreterInfoToolShape, InstallPolicyToolShape, RecordTransactionToolShape, RevokePolicyToolShape, SimulatePolicyToolShape, SynthesizePolicyToolShape, VerifyPolicyToolShape, } from "./schemas.js";
+import { GetInterpreterInfoToolShape, InstallPolicyToolShape, MergePolicyToolShape, RecordTransactionToolShape, RevokePolicyToolShape, SimulatePolicyToolShape, SynthesizePolicyToolShape, VerifyPolicyToolShape, } from "./schemas.js";
 import { mcpResultFromCore } from "./tools/result.js";
 /** Our envelope types `structuredContent` precisely (T / ToolError); the SDK's
  *  CallToolResult widens it to Record<string, unknown>, so the nominal types
@@ -34,5 +34,6 @@ export function registerTools(server) {
     server.tool('verify_policy', 'Run the static minimality check on a proposed PredicateNode against a RecordedTransaction (no conjunct is load-bearing-free). Returns VERIFICATION_FAILED with the dropped-constraint fingerprints when the predicate is over-broad.', VerifyPolicyToolShape, (args) => runVerifyPolicy(args).then(toCallToolResult));
     server.tool('install_policy', 'Build an UNSIGNED Soroban transaction XDR for `account.add_context_rule(...)` that installs a new policy rule on the given smart account. The wallet signs the returned XDR - the signature IS the user-confirmation step (this server is stateless and holds no key material, so there is no two-call confirm pair). Only CALL 1 is emitted; the interpreter `install` follow-up needs the rule id the account assigns in call 1 and is documented in `followUp` in the response.', InstallPolicyToolShape, (args) => runInstallPolicy(args).then(toCallToolResult));
     server.tool('revoke_policy', 'Build an UNSIGNED Soroban transaction XDR for `account.remove_context_rule(ruleId)` that removes a policy rule from the given smart account. The smart account handles uninstalling each attached policy itself. Auth is master-only - the source account MUST be the master signer set; delegated signers cannot uninstall.', RevokePolicyToolShape, (args) => runRevokePolicy(args).then(toCallToolResult));
+    server.tool('merge_policy', "Tighten a rule by replacing its predicate with the conjunction of the installed one and a new one. This is the remedy for the overlap `install_policy` reports between two rules the interpreter polices: because OpenZeppelin enforces only the rule a signer names, adding a second, tighter rule restricts nothing, so the restriction has to become one predicate. TWO transactions, in order: call with step 'detach' to remove the current attachment, wait for it to confirm, then call with step 'reinstall'. Detaching uninstalls the policy, which RESETS every counter on the rule, and the rule is unpoliced in between - both are reported in `warnings`.", MergePolicyToolShape, (args) => runMergePolicy(args).then(toCallToolResult));
     server.tool('get_interpreter_info', 'Read-only fingerprint lookup for the policy interpreter contract: returns the pinned address, grammar version, and wasm sha256 (from the pinned constants + SELF_VERSION). When `verifyLive=true`, performs an additional `grammar_version()` RPC call against the pinned address and reports whether the deployed contract matches the pin - a live mismatch check is more useful than a fabricated audit field.', GetInterpreterInfoToolShape, (args) => runGetInterpreterInfo(args).then(toCallToolResult));
 }

package/dist/src/transports/http.js

@@ -2,8 +2,13 @@
 //
 // Streamable HTTP transport (hosted). Uses the Node http module directly so
 // the package stays thin - no express / hono dep. We run in STATELESS mode
-// (sessionIdGenerator: undefined) so each POST /mcp is its own transaction:
-// this matches the brief's "stateless across calls" invariant.
+// (no `sessionIdGenerator` option), and the SDK 1.26+ requires a FRESH
+// transport per request in stateless mode: reusing one across requests lets
+// concurrent clients share internal message-id state, which is exactly the
+// cross-client data leak GHSA-345p-7cg4-v4c7 warns about. We therefore build
+// a transport inside the request handler, connect it, dispatch the request,
+// then close it (close() resets the McpServer's transport slot so the next
+// request can reconnect cleanly).
 //
 // Single endpoint: POST /mcp (the SDK also accepts GET for SSE streaming, but
 // the T1 surface does not emit server-initiated messages so we omit it).
@@ -34,13 +39,11 @@ export async function startHttpServer(opts) {
     if (!LOOPBACK_HOSTS.has(host) && opts.allowExternalHost !== true) {
         throw new Error(`startHttpServer: refusing to bind host ${host}: the MCP surface is unauthenticated, so only loopback (127.0.0.1, ::1, localhost) is permitted by default. Pass \`allowExternalHost: true\` to opt in to a non-loopback bind.`);
     }
+    // The McpServer is stateless and per-process; we keep ONE instance alive
+    // for the lifetime of the listener, but each request creates + connects a
+    // fresh StreamableHTTPServerTransport (SDK 1.26+ refuses to reuse a
+    // stateless transport across requests).
     const server = createMcpServer();
-    // One transport per server (the SDK reuses the transport for every request
-    // in stateless mode). We connect it once at startup and reuse it.
-    const transport = new StreamableHTTPServerTransport({
-        sessionIdGenerator: undefined,
-    });
-    await server.connect(transport);
     const httpServer = createServer(async (req, res) => {
         if (!req.url) {
             sendJson(res, 400, { error: 'missing url' });
@@ -86,6 +89,20 @@ export async function startHttpServer(opts) {
             });
             return;
         }
+        // One transport per request. Omitting `sessionIdGenerator` selects
+        // stateless mode in SDK 1.26+ (the previous `sessionIdGenerator:
+        // undefined` form is rejected because the option type no longer
+        // includes `undefined` under `exactOptionalPropertyTypes`).
+        //
+        // The cast `as unknown as Transport` is narrowly scoped to the SDK
+        // boundary: the Node wrapper exposes `onclose` via getter/setter with
+        // type `(() => void) | undefined`, while the `Transport` interface
+        // declares `onclose?: () => void`. Under `exactOptionalPropertyTypes:
+        // true` those are not structurally assignable. The runtime contract is
+        // the same (the setter accepts `() => void`), so we cast once here.
+        const transport = new StreamableHTTPServerTransport();
+        const sdkTransport = transport;
+        await server.connect(sdkTransport);
         try {
             // `handleRequest` writes the response and returns once the message has
             // been dispatched. No shared state across calls in stateless mode.
@@ -107,6 +124,14 @@ export async function startHttpServer(opts) {
                 sendJson(res, 500, { error });
             }
         }
+        finally {
+            // Closing the transport fires its `onclose`, which resets
+            // `server._transport` to undefined so the next request can connect
+            // a fresh transport. We swallow the close error: a request that
+            // already wrote its response does not care whether the close path
+            // threw.
+            await transport.close().catch(() => { });
+        }
     });
     await new Promise((resolve, reject) => {
         httpServer.once('error', reject);
@@ -121,7 +146,6 @@ export async function startHttpServer(opts) {
         path,
         close: async () => {
             await new Promise((resolve) => httpServer.close(() => resolve()));
-            await transport.close().catch(() => { });
             await server.close().catch(() => { });
         },
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-builder-mcp",
-  "version": "0.1.18",
+  "version": "0.2.0",
   "license": "MIT",
   "description": "MCP server exposing the OZ policy-synth core (record_transaction + synthesize_policy) over stdio and Streamable HTTP transports.",
   "type": "module",
@@ -37,7 +37,6 @@
       "types": "./dist/src/index.d.ts",
       "bun": "./src/index.ts",
       "import": "./dist/src/index.js",
-      "require": "./dist-cjs/src/index.js",
       "default": "./dist/src/index.js"
     },
     "./package.json": "./package.json"
@@ -47,7 +46,6 @@
   },
   "files": [
     "dist",
-    "dist-cjs",
     "src",
     "!src/**/*.test.ts"
   ],
@@ -56,15 +54,13 @@
   },
   "scripts": {
     "test": "bun test",
-    "build": "tsc -p tsconfig.build.json && tsc -p tsconfig.build.cjs.json && node scripts/write-cjs-package-json.cjs",
-    "build:esm": "tsc -p tsconfig.build.json",
-    "build:cjs": "tsc -p tsconfig.build.cjs.json && node scripts/write-cjs-package-json.cjs",
+    "build": "tsc -p tsconfig.build.json",
     "prepublishOnly": "bun run build && bun test",
     "prepack": "bun run build"
   },
   "dependencies": {
-    "@crediolabs/policy-synth": "0.1.18",
-    "@modelcontextprotocol/sdk": "1.18.1",
+    "@crediolabs/policy-synth": "0.2.0",
+    "@modelcontextprotocol/sdk": "1.26.0",
     "@stellar/stellar-sdk": "14.4.0",
     "zod": "3.25.76"
   },

package/src/schemas.ts

@@ -167,6 +167,15 @@ export const RevokePolicyToolShape = {
   interpreterAddress: z.string().optional(),
 } as const
 
+/** Flat ZodRawShape for `merge_policy`: the tightening remedy when two rules
+ *  our interpreter polices can serve the same calls. Two steps, in order. */
+export const MergePolicyToolShape = {
+  ...SmartAccountToolShape,
+  ruleId: z.number().int().nonnegative(),
+  incomingPredicateBlobBase64: z.string().min(1),
+  step: z.enum(['detach', 'reinstall']),
+} as const
+
 /** Flat ZodRawShape for `get_interpreter_info`. `verifyLive` triggers an
  *  optional RPC `grammar_version()` call so the caller can verify the
  *  deployed contract matches the pin. */

package/src/server.ts

@@ -15,6 +15,7 @@ import type { ToolResponse } from '@crediolabs/policy-synth'
 import {
   runGetInterpreterInfo,
   runInstallPolicy,
+  runMergePolicy,
   runRecordTransaction,
   runRevokePolicy,
   runSimulatePolicy,
@@ -26,6 +27,7 @@ import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js'
 import {
   GetInterpreterInfoToolShape,
   InstallPolicyToolShape,
+  MergePolicyToolShape,
   RecordTransactionToolShape,
   RevokePolicyToolShape,
   SimulatePolicyToolShape,
@@ -97,6 +99,13 @@ export function registerTools(server: McpServer): void {
     (args) => runRevokePolicy(args).then(toCallToolResult)
   )
 
+  server.tool(
+    'merge_policy',
+    "Tighten a rule by replacing its predicate with the conjunction of the installed one and a new one. This is the remedy for the overlap `install_policy` reports between two rules the interpreter polices: because OpenZeppelin enforces only the rule a signer names, adding a second, tighter rule restricts nothing, so the restriction has to become one predicate. TWO transactions, in order: call with step 'detach' to remove the current attachment, wait for it to confirm, then call with step 'reinstall'. Detaching uninstalls the policy, which RESETS every counter on the rule, and the rule is unpoliced in between - both are reported in `warnings`.",
+    MergePolicyToolShape,
+    (args) => runMergePolicy(args).then(toCallToolResult)
+  )
+
   server.tool(
     'get_interpreter_info',
     'Read-only fingerprint lookup for the policy interpreter contract: returns the pinned address, grammar version, and wasm sha256 (from the pinned constants + SELF_VERSION). When `verifyLive=true`, performs an additional `grammar_version()` RPC call against the pinned address and reports whether the deployed contract matches the pin - a live mismatch check is more useful than a fabricated audit field.',

package/src/transports/http.ts

@@ -2,8 +2,13 @@
 //
 // Streamable HTTP transport (hosted). Uses the Node http module directly so
 // the package stays thin - no express / hono dep. We run in STATELESS mode
-// (sessionIdGenerator: undefined) so each POST /mcp is its own transaction:
-// this matches the brief's "stateless across calls" invariant.
+// (no `sessionIdGenerator` option), and the SDK 1.26+ requires a FRESH
+// transport per request in stateless mode: reusing one across requests lets
+// concurrent clients share internal message-id state, which is exactly the
+// cross-client data leak GHSA-345p-7cg4-v4c7 warns about. We therefore build
+// a transport inside the request handler, connect it, dispatch the request,
+// then close it (close() resets the McpServer's transport slot so the next
+// request can reconnect cleanly).
 //
 // Single endpoint: POST /mcp (the SDK also accepts GET for SSE streaming, but
 // the T1 surface does not emit server-initiated messages so we omit it).
@@ -22,6 +27,7 @@
 import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http'
 import type { ToolError } from '@crediolabs/policy-synth'
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'
+import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js'
 import { createMcpServer } from '../server.ts'
 
 const LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost'])
@@ -60,13 +66,11 @@ export async function startHttpServer(opts: StartHttpServerOptions): Promise<Run
       `startHttpServer: refusing to bind host ${host}: the MCP surface is unauthenticated, so only loopback (127.0.0.1, ::1, localhost) is permitted by default. Pass \`allowExternalHost: true\` to opt in to a non-loopback bind.`
     )
   }
+  // The McpServer is stateless and per-process; we keep ONE instance alive
+  // for the lifetime of the listener, but each request creates + connects a
+  // fresh StreamableHTTPServerTransport (SDK 1.26+ refuses to reuse a
+  // stateless transport across requests).
   const server = createMcpServer()
-  // One transport per server (the SDK reuses the transport for every request
-  // in stateless mode). We connect it once at startup and reuse it.
-  const transport = new StreamableHTTPServerTransport({
-    sessionIdGenerator: undefined,
-  })
-  await server.connect(transport)
 
   const httpServer: Server = createServer(async (req, res) => {
     if (!req.url) {
@@ -114,6 +118,21 @@ export async function startHttpServer(opts: StartHttpServerOptions): Promise<Run
       return
     }
 
+    // One transport per request. Omitting `sessionIdGenerator` selects
+    // stateless mode in SDK 1.26+ (the previous `sessionIdGenerator:
+    // undefined` form is rejected because the option type no longer
+    // includes `undefined` under `exactOptionalPropertyTypes`).
+    //
+    // The cast `as unknown as Transport` is narrowly scoped to the SDK
+    // boundary: the Node wrapper exposes `onclose` via getter/setter with
+    // type `(() => void) | undefined`, while the `Transport` interface
+    // declares `onclose?: () => void`. Under `exactOptionalPropertyTypes:
+    // true` those are not structurally assignable. The runtime contract is
+    // the same (the setter accepts `() => void`), so we cast once here.
+    const transport = new StreamableHTTPServerTransport()
+    const sdkTransport = transport as unknown as Transport
+    await server.connect(sdkTransport)
+
     try {
       // `handleRequest` writes the response and returns once the message has
       // been dispatched. No shared state across calls in stateless mode.
@@ -132,6 +151,13 @@ export async function startHttpServer(opts: StartHttpServerOptions): Promise<Run
         }
         sendJson(res, 500, { error })
       }
+    } finally {
+      // Closing the transport fires its `onclose`, which resets
+      // `server._transport` to undefined so the next request can connect
+      // a fresh transport. We swallow the close error: a request that
+      // already wrote its response does not care whether the close path
+      // threw.
+      await transport.close().catch(() => {})
     }
   })
 
@@ -149,7 +175,6 @@ export async function startHttpServer(opts: StartHttpServerOptions): Promise<Run
     path,
     close: async () => {
       await new Promise<void>((resolve) => httpServer.close(() => resolve()))
-      await transport.close().catch(() => {})
       await server.close().catch(() => {})
     },
   }

package/dist-cjs/package.json

@@ -1,3 +0,0 @@
-{
-  "type": "commonjs"
-}

package/dist-cjs/src/index.d.ts

@@ -1,7 +0,0 @@
-export { type RunRecordTransactionInput, type RunSynthesizePolicyInput, runRecordTransaction, runSynthesizePolicy, } from '@crediolabs/policy-synth/run';
-export { RecordTransactionToolShape, SynthesizePolicyToolShape, } from './schemas.ts';
-export { createMcpServer, registerTools } from './server.ts';
-export type { McpToolError, McpToolResult } from './tools/result.ts';
-export { mcpErrorFromCore, mcpResultFromCore } from './tools/result.ts';
-export { startHttpServer } from './transports/http.ts';
-export { startStdioServer } from './transports/stdio.ts';

package/dist-cjs/src/index.js

@@ -1,20 +0,0 @@
-"use strict";
-// packages/policy-builder-mcp/src/index.ts - public re-exports for the MCP server package.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.startStdioServer = exports.startHttpServer = exports.mcpResultFromCore = exports.mcpErrorFromCore = exports.registerTools = exports.createMcpServer = exports.SynthesizePolicyToolShape = exports.RecordTransactionToolShape = exports.runSynthesizePolicy = exports.runRecordTransaction = void 0;
-var run_1 = require("@crediolabs/policy-synth/run");
-Object.defineProperty(exports, "runRecordTransaction", { enumerable: true, get: function () { return run_1.runRecordTransaction; } });
-Object.defineProperty(exports, "runSynthesizePolicy", { enumerable: true, get: function () { return run_1.runSynthesizePolicy; } });
-var schemas_ts_1 = require("./schemas.js");
-Object.defineProperty(exports, "RecordTransactionToolShape", { enumerable: true, get: function () { return schemas_ts_1.RecordTransactionToolShape; } });
-Object.defineProperty(exports, "SynthesizePolicyToolShape", { enumerable: true, get: function () { return schemas_ts_1.SynthesizePolicyToolShape; } });
-var server_ts_1 = require("./server.js");
-Object.defineProperty(exports, "createMcpServer", { enumerable: true, get: function () { return server_ts_1.createMcpServer; } });
-Object.defineProperty(exports, "registerTools", { enumerable: true, get: function () { return server_ts_1.registerTools; } });
-var result_ts_1 = require("./tools/result.js");
-Object.defineProperty(exports, "mcpErrorFromCore", { enumerable: true, get: function () { return result_ts_1.mcpErrorFromCore; } });
-Object.defineProperty(exports, "mcpResultFromCore", { enumerable: true, get: function () { return result_ts_1.mcpResultFromCore; } });
-var http_ts_1 = require("./transports/http.js");
-Object.defineProperty(exports, "startHttpServer", { enumerable: true, get: function () { return http_ts_1.startHttpServer; } });
-var stdio_ts_1 = require("./transports/stdio.js");
-Object.defineProperty(exports, "startStdioServer", { enumerable: true, get: function () { return stdio_ts_1.startStdioServer; } });