@ferrlabs/mcp 5.2.4 → 6.0.0

package/dist/index.js

@@ -1,20 +1,25 @@
 #!/usr/bin/env node
-import { startStdioServer } from './transports/stdio.js';
-import { startHttpServer } from './transports/http.js';
-async function main() {
-    const mode = process.env.FERRLABS_MCP_MODE ?? (process.argv.includes('--http') ? 'http' : 'stdio');
-    if (mode === 'http') {
-        const port = Number(process.env.PORT ?? '3000');
-        await startHttpServer({
-            port,
-            host: process.env.HOST,
-            stateless: process.env.FERRLABS_MCP_STATEFUL !== '1',
-        });
-        return;
-    }
-    await startStdioServer();
-}
-main().catch((err) => {
+import { runMcp } from '@ferrlabs/mcp-core';
+import { registerStatsTools } from './tools/stats.js';
+import { registerTokenTools } from './tools/tokens.js';
+import { registerOrgsTools } from './tools/orgs.js';
+import { registerVaultsTools } from './tools/vaults.js';
+import { registerIssuesTools } from './tools/issues.js';
+import { registerSubscriptionsTools } from './tools/subscriptions.js';
+import { registerDocsTools } from './tools/docs.js';
+runMcp({
+    name: 'ferrlabs',
+    version: '5.2.5',
+    register: (server) => {
+        registerStatsTools(server);
+        registerTokenTools(server);
+        registerOrgsTools(server);
+        registerVaultsTools(server);
+        registerIssuesTools(server);
+        registerSubscriptionsTools(server);
+        registerDocsTools(server);
+    },
+}).catch((err) => {
     console.error('ferrlabs-mcp fatal:', err instanceof Error ? err.message : err);
     process.exit(1);
 });

package/dist/tools/issues.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { apiRequest } from './api-client.js';
-import { getToken } from '../auth/index.js';
+import { apiRequest } from '@ferrlabs/mcp-core';
+import { getToken } from '@ferrlabs/mcp-core';
 export function registerIssuesTools(server) {
     server.tool('list_issues', 'List FerrTrack issues for a project (FerrTrack — issue tracker)', {
         org_slug: z.string().min(1).describe('Organization slug'),

package/dist/tools/orgs.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { apiRequest } from './api-client.js';
-import { getToken } from '../auth/index.js';
+import { apiRequest } from '@ferrlabs/mcp-core';
+import { getToken } from '@ferrlabs/mcp-core';
 export function registerOrgsTools(server) {
     server.tool('list_orgs', 'List FerrLabs organizations the authenticated user belongs to', {}, async () => {
         const token = await getToken();

package/dist/tools/stats.js

@@ -1,4 +1,4 @@
-import { apiRequest } from './api-client.js';
+import { apiRequest } from '@ferrlabs/mcp-core';
 export function registerStatsTools(server) {
     server.tool('get_stats', 'Get public FerrLabs usage statistics (releases cut, repos using FerrFlow, commits analyzed)', {}, async () => {
         const stats = await apiRequest('/stats');

package/dist/tools/subscriptions.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { apiRequest } from './api-client.js';
-import { getToken } from '../auth/index.js';
+import { apiRequest } from '@ferrlabs/mcp-core';
+import { getToken } from '@ferrlabs/mcp-core';
 export function registerSubscriptionsTools(server) {
     server.tool('list_subscriptions', 'List FerrLabs product subscriptions for an organization (FerrVault, FerrTrack, FerrGrowth, FerrFleet)', {
         org_slug: z.string().min(1).describe('Organization slug'),

package/dist/tools/tokens.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { apiRequest } from './api-client.js';
-import { getToken } from '../auth/index.js';
+import { apiRequest } from '@ferrlabs/mcp-core';
+import { getToken } from '@ferrlabs/mcp-core';
 export function registerTokenTools(server) {
     server.tool('get_me', 'Get the current authenticated FerrLabs user profile', {}, async () => {
         const token = await getToken();

package/dist/tools/vaults.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { apiRequest } from './api-client.js';
-import { getToken } from '../auth/index.js';
+import { apiRequest } from '@ferrlabs/mcp-core';
+import { getToken } from '@ferrlabs/mcp-core';
 export function registerVaultsTools(server) {
     server.tool('list_vaults', 'List FerrVault vaults inside a project (FerrVault — secrets management)', {
         org_slug: z.string().min(1).describe('Organization slug'),

package/package.json

@@ -1,66 +1,41 @@
 {
+  "name": "@ferrlabs/mcp",
+  "version": "6.0.0",
+  "description": "Model Context Protocol server for the FerrLabs platform (orgs, projects, subscriptions, docs, tokens, public stats)",
+  "license": "MPL-2.0",
+  "type": "module",
   "bin": {
     "ferrlabs-mcp": "./dist/index.js"
   },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
-    "zod": "^4.3.6"
-  },
-  "description": "Model Context Protocol server for the FerrLabs ecosystem (FerrFlow, FerrVault, FerrTrack, FerrGrowth, FerrFleet, FerrLens)",
-  "devDependencies": {
-    "@types/node": "^25.5.0",
-    "@vitest/coverage-v8": "^4.1.2",
-    "husky": "^9.1.7",
-    "lint-staged": "^15.2.10",
-    "prettier": "^3.4.2",
-    "tsx": "^4.19.0",
-    "typescript": "^6.0.0",
-    "vitest": "^4.1.2"
-  },
-  "lint-staged": {
-    "*.{ts,tsx,js,jsx,mjs,cjs,json,md,css}": "prettier --write"
-  },
-  "engines": {
-    "node": ">=22.0.0",
-    "pnpm": ">=9.0.0"
-  },
+  "main": "./dist/index.js",
   "files": [
     "dist"
   ],
+  "engines": {
+    "node": ">=22.0.0"
+  },
   "keywords": [
     "mcp",
     "ferrlabs",
-    "ferrflow",
-    "ferrvault",
-    "ferrtrack",
-    "ferrgrowth",
-    "ferrfleet",
-    "ferrlens",
     "model-context-protocol",
     "ai"
   ],
-  "license": "MPL-2.0",
-  "main": "./dist/index.js",
-  "name": "@ferrlabs/mcp",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "zod": "^4.3.6",
+    "@ferrlabs/mcp-core": "^6.0.0"
+  },
   "publishConfig": {
     "access": "public"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/FerrLabs/MCP.git"
+    "url": "https://github.com/FerrLabs/MCP.git",
+    "directory": "packages/mcp"
   },
-  "type": "module",
-  "version": "5.2.4",
   "scripts": {
     "build": "tsc",
-    "ci:local": "pnpm typecheck && pnpm test && pnpm build",
-    "dev": "tsx watch src/index.ts",
-    "format": "prettier --write .",
-    "format:check": "prettier --check .",
-    "smoke": "pnpm build && tsx scripts/smoke.ts",
     "start": "node dist/index.js",
-    "test": "vitest run",
-    "test:coverage": "vitest run --coverage",
     "typecheck": "tsc --noEmit"
   }
 }

package/README.md

@@ -1,119 +0,0 @@
-# FerrLabs MCP Server
-
-[![npm](https://img.shields.io/npm/v/@ferrlabs/mcp)](https://www.npmjs.com/package/@ferrlabs/mcp)
-[![Coverage](https://codecov.io/gh/FerrLabs/MCP/branch/main/graph/badge.svg)](https://codecov.io/gh/FerrLabs/MCP)
-[![License](https://img.shields.io/github/license/FerrLabs/MCP)](LICENSE)
-
-[Model Context Protocol](https://modelcontextprotocol.io) server that lets AI assistants interact with the FerrLabs ecosystem (FerrFlow, FerrVault, FerrTrack, FerrGrowth, FerrFleet, FerrLens) through the unified FerrLabs API. Runs locally via stdio transport.
-
-## Quick Start
-
-Add to your MCP client configuration (Claude Code, Cursor, etc.):
-
-```json
-{
-  "mcpServers": {
-    "ferrlabs": {
-      "command": "npx",
-      "args": ["-y", "@ferrlabs/mcp"]
-    }
-  }
-}
-```
-
-The first time you call a tool that needs auth, the MCP opens `auth.ferrlabs.com` in your default browser (OAuth 2.0 loopback PKCE). After you click Allow, the token is saved locally and reused for future sessions. No env var required.
-
-### CI / scripted / headless use
-
-Bypass the browser dance by injecting a token directly:
-
-```json
-{
-  "mcpServers": {
-    "ferrlabs": {
-      "command": "npx",
-      "args": ["-y", "@ferrlabs/mcp"],
-      "env": { "FERRLABS_API_TOKEN": "fl_..." }
-    }
-  }
-}
-```
-
-Create the token from `app.ferrlabs.com` → Settings → API Tokens. It's forwarded as `x-api-token` to `api.ferrlabs.com`.
-
-## Available Tools
-
-| Tool                 | Scope   | Description                                                                    |
-| -------------------- | ------- | ------------------------------------------------------------------------------ |
-| `get_stats`          | public  | Public usage statistics from `api.ferrlabs.com`                                |
-| `health_check`       | public  | API health status                                                              |
-| `fetch_docs`         | public  | Fetch a page from a product marketing site (ferrflow, ferrvault, ferrtrack, …) |
-| `get_me`             | auth    | Current user profile                                                           |
-| `list_tokens`        | auth    | List your API tokens                                                           |
-| `create_token`       | session | Create a new API token (requires interactive session, not a token)             |
-| `revoke_token`       | auth    | Revoke an API token                                                            |
-| `list_orgs`          | auth    | List FerrLabs organizations you belong to                                      |
-| `list_projects`      | auth    | List projects inside an organization                                           |
-| `list_subscriptions` | auth    | List product subscriptions for an organization                                 |
-| `list_vaults`        | auth    | List FerrVault vaults inside a project                                         |
-| `list_issues`        | auth    | List FerrTrack issues inside a project                                         |
-
-FerrFlow CLI-specific tools (`dry_run`, `validate_config`, `read_config`, `read_changelog`, `list_release_tags`, `record_event`) were removed in v4.0.0 — they required either a local FerrFlow CLI install or HMAC signing the MCP doesn't do. Use the FerrFlow CLI directly or fetch docs via `fetch_docs("ferrflow", "docs/...")`.
-
-## Stack
-
-| Component | Technology                |
-| --------- | ------------------------- |
-| Runtime   | Node.js 22+               |
-| Language  | TypeScript                |
-| MCP SDK   | @modelcontextprotocol/sdk |
-
-## Configuration
-
-| Variable                  | Description                                                                           | Default                                                                   |
-| ------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- |
-| `API_URL`                 | FerrLabs API base URL (no `/v1` suffix — paths are prefixed in code)                  | `https://api.ferrlabs.com`                                                |
-| `FERRLABS_AUTH_URL`       | Auth SPA base URL (where the OAuth browser flow lands)                                | `https://auth.ferrlabs.com`                                               |
-| `FERRLABS_API_TOKEN`      | Pre-provisioned token. Bypasses the OAuth flow. Use for CI / scripted environments.   | —                                                                         |
-| `FERRFLOW_API_TOKEN`      | **Deprecated** — accepted as a fallback for backward compatibility with v3.x.         | —                                                                         |
-| `FERRLABS_MCP_NO_OAUTH`   | Set to `1` to disable the OAuth fallback. Then `FERRLABS_API_TOKEN` becomes required. | unset                                                                     |
-| `FERRLABS_MCP_TOKEN_PATH` | Override the path where the OAuth-acquired token is persisted.                        | `%APPDATA%\ferrlabs\mcp\token.json` / `~/.config/ferrlabs/mcp/token.json` |
-| `FERRLABS_MCP_NO_PERSIST` | Set to `1` to keep the token in memory only (re-auth on every cold start).            | unset                                                                     |
-
-### How auth resolution works
-
-On the first authenticated tool call, the MCP looks for a token in this order:
-
-1. In-memory cache (set during this MCP process's lifetime)
-2. `FERRLABS_API_TOKEN` (or `FERRFLOW_API_TOKEN`) env var
-3. Persisted token file (`FERRLABS_MCP_TOKEN_PATH`)
-4. **OAuth 2.0 loopback PKCE flow** — opens the user's browser, captures the callback on `http://127.0.0.1:54321/cb`, exchanges the code for a session token via `POST /v1/auth/exchange`. Token is persisted to step 3 for future sessions.
-
-If you set `FERRLABS_MCP_NO_OAUTH=1`, step 4 is skipped — useful for CI where opening a browser would hang.
-
-## Smoke test
-
-`pnpm smoke` builds the server, spawns it over stdio, runs the MCP `initialize`/`tools/list` handshake, then calls `health_check` and `get_stats` against the real `api.ferrlabs.com`. Useful to confirm the server boots, registers all tools, and the API is reachable. Exits non-zero on any failure.
-
-```
-[PASS] initialize handshake — serverInfo: ferrlabs@4.0.0
-[PASS] tools/list — 12 tools registered
-[PASS] tools/call health_check — {"status":"ready", ...}
-[PASS] tools/call get_stats — total_releases=N
-
-Smoke: 4/4 OK
-```
-
-## Migrating from `@ferrflow/mcp` v3.x
-
-v4.0.0 renames the package and points the MCP at the unified FerrLabs API. To migrate:
-
-1. Replace `@ferrflow/mcp` with `@ferrlabs/mcp` in your MCP client config.
-2. Rename `FERRFLOW_API_TOKEN` → `FERRLABS_API_TOKEN` (the old name still works for one release).
-3. If you were overriding `API_URL=https://api.ferrflow.com`, drop the override — the default is now `https://api.ferrlabs.com`.
-
-Tokens issued by the legacy FerrFlow-only API are not valid against the unified API. Create a fresh one from `app.ferrlabs.com`.
-
-## License
-
-Mozilla Public License 2.0 — see [LICENSE](LICENSE).

package/dist/auth/__tests__/context.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=context.test.d.ts.map

package/dist/auth/__tests__/context.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"context.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/context.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/context.test.js

@@ -1,29 +0,0 @@
-import { describe, it, expect, beforeEach } from 'vitest';
-describe('per-request bearer token takes precedence over env/persisted', () => {
-    beforeEach(() => {
-        delete process.env.FERRLABS_API_TOKEN;
-        delete process.env.FERRFLOW_API_TOKEN;
-        process.env.FERRLABS_MCP_NO_PERSIST = '1';
-        process.env.FERRLABS_MCP_NO_OAUTH = '1';
-    });
-    it('returns the bearer from AuthContext when set', async () => {
-        const { runWithAuthContext } = await import('../context.js');
-        const { getToken } = await import('../index.js');
-        const result = await runWithAuthContext({ bearerToken: 'fl_req_token' }, () => getToken());
-        expect(result).toBe('fl_req_token');
-    });
-    it('bearer from context wins over FERRLABS_API_TOKEN env', async () => {
-        process.env.FERRLABS_API_TOKEN = 'fl_env';
-        const { runWithAuthContext } = await import('../context.js');
-        const { getToken } = await import('../index.js');
-        const result = await runWithAuthContext({ bearerToken: 'fl_req' }, () => getToken());
-        expect(result).toBe('fl_req');
-    });
-    it('falls back to env when context has no bearer', async () => {
-        process.env.FERRLABS_API_TOKEN = 'fl_env_only';
-        const { runWithAuthContext } = await import('../context.js');
-        const { getToken } = await import('../index.js');
-        const result = await runWithAuthContext({}, () => getToken());
-        expect(result).toBe('fl_env_only');
-    });
-});

package/dist/auth/__tests__/index.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=index.test.d.ts.map

package/dist/auth/__tests__/index.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/index.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/index.test.js

@@ -1,39 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-describe('getToken', () => {
-    const originalEnv = process.env;
-    beforeEach(() => {
-        vi.resetModules();
-        process.env = { ...originalEnv };
-        delete process.env.FERRLABS_API_TOKEN;
-        delete process.env.FERRFLOW_API_TOKEN;
-        delete process.env.FERRLABS_MCP_NO_OAUTH;
-        process.env.FERRLABS_MCP_NO_PERSIST = '1';
-    });
-    afterEach(() => {
-        process.env = originalEnv;
-    });
-    it('returns FERRLABS_API_TOKEN when set, without touching persistence or OAuth', async () => {
-        process.env.FERRLABS_API_TOKEN = 'fl_env_token';
-        const { getToken } = await import('../index.js');
-        expect(await getToken()).toBe('fl_env_token');
-    });
-    it('falls back to FERRFLOW_API_TOKEN (legacy compat)', async () => {
-        process.env.FERRFLOW_API_TOKEN = 'fl_legacy_token';
-        const { getToken } = await import('../index.js');
-        expect(await getToken()).toBe('fl_legacy_token');
-    });
-    it('throws when no token and FERRLABS_MCP_NO_OAUTH=1', async () => {
-        process.env.FERRLABS_MCP_NO_OAUTH = '1';
-        const { getToken } = await import('../index.js');
-        await expect(getToken()).rejects.toThrow(/FERRLABS_API_TOKEN environment variable is required/);
-    });
-    it('caches the token across calls (env path)', async () => {
-        process.env.FERRLABS_API_TOKEN = 'fl_cached';
-        const { getToken } = await import('../index.js');
-        const a = await getToken();
-        process.env.FERRLABS_API_TOKEN = 'fl_changed';
-        const b = await getToken();
-        expect(a).toBe(b);
-        expect(a).toBe('fl_cached');
-    });
-});

package/dist/auth/__tests__/oauth.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=oauth.test.d.ts.map

package/dist/auth/__tests__/oauth.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/oauth.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/oauth.test.js

@@ -1,26 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { generatePkcePair } from '../oauth.js';
-import { createHash } from 'node:crypto';
-describe('generatePkcePair', () => {
-    it('returns a verifier between 43 and 128 chars (RFC 7636)', () => {
-        const { verifier } = generatePkcePair();
-        expect(verifier.length).toBeGreaterThanOrEqual(43);
-        expect(verifier.length).toBeLessThanOrEqual(128);
-    });
-    it('returns a challenge that is SHA-256(verifier) base64url-encoded', () => {
-        const { verifier, challenge } = generatePkcePair();
-        const expected = createHash('sha256').update(verifier).digest('base64url');
-        expect(challenge).toBe(expected);
-    });
-    it('returns different verifier+challenge pairs each call', () => {
-        const a = generatePkcePair();
-        const b = generatePkcePair();
-        expect(a.verifier).not.toBe(b.verifier);
-        expect(a.challenge).not.toBe(b.challenge);
-    });
-    it('returns base64url-encoded values (no +, /, =)', () => {
-        const { verifier, challenge } = generatePkcePair();
-        expect(verifier).toMatch(/^[A-Za-z0-9_-]+$/);
-        expect(challenge).toMatch(/^[A-Za-z0-9_-]+$/);
-    });
-});

package/dist/auth/context.d.ts

@@ -1,9 +0,0 @@
-import { AsyncLocalStorage } from 'node:async_hooks';
-interface AuthContext {
-    bearerToken?: string;
-}
-export declare const authContext: AsyncLocalStorage<AuthContext>;
-export declare function runWithAuthContext<T>(ctx: AuthContext, fn: () => Promise<T>): Promise<T>;
-export declare function getRequestBearerToken(): string | undefined;
-export {};
-//# sourceMappingURL=context.d.ts.map

package/dist/auth/context.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/auth/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,UAAU,WAAW;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,WAAW,gCAAuC,CAAC;AAEhE,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAExF;AAED,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAE1D"}

package/dist/auth/context.js

@@ -1,8 +0,0 @@
-import { AsyncLocalStorage } from 'node:async_hooks';
-export const authContext = new AsyncLocalStorage();
-export function runWithAuthContext(ctx, fn) {
-    return authContext.run(ctx, fn);
-}
-export function getRequestBearerToken() {
-    return authContext.getStore()?.bearerToken;
-}

package/dist/auth/index.d.ts

@@ -1,3 +0,0 @@
-export declare function getToken(): Promise<string>;
-export declare function resetTokenCacheForTesting(): void;
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAOA,wBAAsB,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAuChD;AAED,wBAAgB,yBAAyB,IAAI,IAAI,CAGhD"}

package/dist/auth/index.js

@@ -1,43 +0,0 @@
-import { readPersistedToken, writePersistedToken } from './persistence.js';
-import { runLoopbackOauthFlow } from './oauth.js';
-import { getRequestBearerToken } from './context.js';
-let cached = null;
-let inFlight = null;
-export async function getToken() {
-    const perRequest = getRequestBearerToken();
-    if (perRequest)
-        return perRequest;
-    if (process.env.FERRLABS_MCP_MODE === 'http') {
-        throw new Error('Bearer token required. Send `Authorization: Bearer fl_...` on each request.');
-    }
-    if (cached)
-        return cached;
-    const envToken = process.env.FERRLABS_API_TOKEN ?? process.env.FERRFLOW_API_TOKEN;
-    if (envToken) {
-        cached = envToken;
-        return envToken;
-    }
-    const persisted = await readPersistedToken();
-    if (persisted) {
-        cached = persisted;
-        return persisted;
-    }
-    if (process.env.FERRLABS_MCP_NO_OAUTH === '1') {
-        throw new Error('FERRLABS_API_TOKEN environment variable is required (FERRLABS_MCP_NO_OAUTH=1 disables the OAuth fallback).');
-    }
-    if (!inFlight) {
-        inFlight = (async () => {
-            const { token } = await runLoopbackOauthFlow();
-            await writePersistedToken(token);
-            cached = token;
-            return token;
-        })().finally(() => {
-            inFlight = null;
-        });
-    }
-    return inFlight;
-}
-export function resetTokenCacheForTesting() {
-    cached = null;
-    inFlight = null;
-}

package/dist/auth/oauth.d.ts

@@ -1,12 +0,0 @@
-interface PkcePair {
-    verifier: string;
-    challenge: string;
-}
-export declare function generatePkcePair(): PkcePair;
-export interface RunLoopbackFlowResult {
-    token: string;
-    scope?: string;
-}
-export declare function runLoopbackOauthFlow(): Promise<RunLoopbackFlowResult>;
-export {};
-//# sourceMappingURL=oauth.d.ts.map

package/dist/auth/oauth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAWA,UAAU,QAAQ;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,gBAAgB,IAAI,QAAQ,CAI3C;AA4FD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CA+C3E"}

package/dist/auth/oauth.js

@@ -1,123 +0,0 @@
-import { createHash, randomBytes } from 'node:crypto';
-import { createServer } from 'node:http';
-import { spawn } from 'node:child_process';
-import { platform } from 'node:os';
-const AUTH_BASE = process.env.FERRLABS_AUTH_URL ?? 'https://auth.ferrlabs.com';
-const API_BASE = process.env.API_URL ?? 'https://api.ferrlabs.com';
-const CLIENT_ID = 'mcp';
-const REDIRECT_PORTS = [54321, 54322];
-const AUTH_TIMEOUT_MS = 2 * 60 * 1000;
-export function generatePkcePair() {
-    const verifier = randomBytes(64).toString('base64url');
-    const challenge = createHash('sha256').update(verifier).digest('base64url');
-    return { verifier, challenge };
-}
-function generateState() {
-    return randomBytes(16).toString('base64url');
-}
-function openBrowser(url) {
-    const args = (() => {
-        switch (platform()) {
-            case 'win32':
-                return { cmd: 'rundll32', args: ['url.dll,FileProtocolHandler', url] };
-            case 'darwin':
-                return { cmd: 'open', args: [url] };
-            default:
-                return { cmd: 'xdg-open', args: [url] };
-        }
-    })();
-    const child = spawn(args.cmd, args.args, { detached: true, stdio: 'ignore' });
-    child.on('error', () => {
-        // ignore — caller will time out and surface the URL via error
-    });
-    child.unref();
-}
-function listenForCallback(port, expectedState) {
-    return new Promise((resolve, reject) => {
-        const server = createServer((req, res) => {
-            try {
-                const url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
-                if (url.pathname !== '/cb') {
-                    res.writeHead(404).end('Not found');
-                    return;
-                }
-                const code = url.searchParams.get('code');
-                const state = url.searchParams.get('state');
-                if (!code || !state) {
-                    res.writeHead(400).end('Missing code or state');
-                    return;
-                }
-                if (state !== expectedState) {
-                    res.writeHead(400).end('state mismatch');
-                    reject(new Error('OAuth callback state mismatch (CSRF protection triggered)'));
-                    server.close();
-                    return;
-                }
-                res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', Connection: 'close' });
-                res.end("<!doctype html><html><body style='font-family:sans-serif;padding:2rem;color:#1e293b'><h1>Authorized</h1><p>You can close this tab and return to your terminal.</p></body></html>");
-                setImmediate(() => server.close());
-                resolve({ code, state });
-            }
-            catch (err) {
-                res.writeHead(500).end('Internal error');
-                reject(err instanceof Error ? err : new Error(String(err)));
-            }
-        });
-        server.on('error', reject);
-        server.listen(port, '127.0.0.1');
-    });
-}
-async function exchangeCodeForToken(code, codeVerifier, redirectUri) {
-    const res = await fetch(`${API_BASE}/v1/auth/exchange`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', 'User-Agent': 'ferrlabs-mcp/oauth' },
-        body: JSON.stringify({
-            code,
-            client_id: CLIENT_ID,
-            redirect_uri: redirectUri,
-            code_verifier: codeVerifier,
-        }),
-    });
-    if (!res.ok) {
-        const body = (await res.json().catch(() => ({})));
-        throw new Error(`OAuth exchange failed (HTTP ${res.status}): ${body.error ?? body.message ?? 'unknown'}`);
-    }
-    const data = (await res.json());
-    if (!data.token)
-        throw new Error('OAuth exchange returned no token');
-    return data.token;
-}
-export async function runLoopbackOauthFlow() {
-    const pkce = generatePkcePair();
-    const state = generateState();
-    let port = null;
-    let callbackPromise = null;
-    for (const candidate of REDIRECT_PORTS) {
-        try {
-            callbackPromise = listenForCallback(candidate, state);
-            port = candidate;
-            break;
-        }
-        catch {
-            callbackPromise = null;
-        }
-    }
-    if (port === null || !callbackPromise) {
-        throw new Error(`Could not bind any of the loopback ports (${REDIRECT_PORTS.join(', ')}). Close whatever is using them and retry.`);
-    }
-    const redirectUri = `http://127.0.0.1:${port}/cb`;
-    const authorizeUrl = new URL(`${AUTH_BASE}/authorize`);
-    authorizeUrl.searchParams.set('client_id', CLIENT_ID);
-    authorizeUrl.searchParams.set('redirect_uri', redirectUri);
-    authorizeUrl.searchParams.set('response_type', 'code');
-    authorizeUrl.searchParams.set('code_challenge', pkce.challenge);
-    authorizeUrl.searchParams.set('code_challenge_method', 'S256');
-    authorizeUrl.searchParams.set('state', state);
-    openBrowser(authorizeUrl.toString());
-    const timeoutPromise = new Promise((_, reject) => {
-        setTimeout(() => reject(new Error(`OAuth flow timed out after ${AUTH_TIMEOUT_MS / 1000}s. If your browser didn't open, visit: ${authorizeUrl.toString()}`)), AUTH_TIMEOUT_MS);
-    });
-    const { code } = await Promise.race([callbackPromise, timeoutPromise]);
-    const token = await exchangeCodeForToken(code, pkce.verifier, redirectUri);
-    return { token };
-}

package/dist/auth/persistence.d.ts

@@ -1,4 +0,0 @@
-export declare function readPersistedToken(): Promise<string | null>;
-export declare function writePersistedToken(token: string, scopes?: string[]): Promise<void>;
-export declare function clearPersistedToken(): Promise<void>;
-//# sourceMappingURL=persistence.d.ts.map

package/dist/auth/persistence.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"persistence.d.ts","sourceRoot":"","sources":["../../src/auth/persistence.ts"],"names":[],"mappings":"AAmCA,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYjE;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBzF;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAOzD"}

package/dist/auth/persistence.js

@@ -1,61 +0,0 @@
-import { mkdir, readFile, writeFile, chmod } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
-import { homedir, platform } from 'node:os';
-function defaultTokenPath() {
-    const override = process.env.FERRLABS_MCP_TOKEN_PATH;
-    if (override)
-        return override;
-    const home = homedir();
-    switch (platform()) {
-        case 'win32':
-            return join(process.env.APPDATA ?? join(home, 'AppData', 'Roaming'), 'ferrlabs', 'mcp', 'token.json');
-        case 'darwin':
-            return join(home, 'Library', 'Application Support', 'ferrlabs', 'mcp', 'token.json');
-        default:
-            return join(process.env.XDG_CONFIG_HOME ?? join(home, '.config'), 'ferrlabs', 'mcp', 'token.json');
-    }
-}
-export async function readPersistedToken() {
-    if (process.env.FERRLABS_MCP_NO_PERSIST === '1')
-        return null;
-    try {
-        const raw = await readFile(defaultTokenPath(), 'utf8');
-        const parsed = JSON.parse(raw);
-        if (typeof parsed.token === 'string' && parsed.token.length > 0) {
-            return parsed.token;
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-export async function writePersistedToken(token, scopes) {
-    if (process.env.FERRLABS_MCP_NO_PERSIST === '1')
-        return;
-    const path = defaultTokenPath();
-    await mkdir(dirname(path), { recursive: true });
-    const payload = {
-        token,
-        obtained_at: new Date().toISOString(),
-        scopes,
-    };
-    await writeFile(path, JSON.stringify(payload, null, 2), 'utf8');
-    if (platform() !== 'win32') {
-        try {
-            await chmod(path, 0o600);
-        }
-        catch {
-            // ignore — best effort on platforms that don't support POSIX modes
-        }
-    }
-}
-export async function clearPersistedToken() {
-    const { unlink } = await import('node:fs/promises');
-    try {
-        await unlink(defaultTokenPath());
-    }
-    catch {
-        // ignore
-    }
-}

package/dist/server.d.ts

@@ -1,3 +0,0 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function createMcpServer(): McpServer;
-//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAWpE,wBAAgB,eAAe,IAAI,SAAS,CAU3C"}

package/dist/server.js

@@ -1,20 +0,0 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { registerStatsTools } from './tools/stats.js';
-import { registerTokenTools } from './tools/tokens.js';
-import { registerOrgsTools } from './tools/orgs.js';
-import { registerVaultsTools } from './tools/vaults.js';
-import { registerIssuesTools } from './tools/issues.js';
-import { registerSubscriptionsTools } from './tools/subscriptions.js';
-import { registerDocsTools } from './tools/docs.js';
-const VERSION = '5.1.1';
-export function createMcpServer() {
-    const server = new McpServer({ name: 'ferrlabs', version: VERSION });
-    registerStatsTools(server);
-    registerTokenTools(server);
-    registerOrgsTools(server);
-    registerVaultsTools(server);
-    registerIssuesTools(server);
-    registerSubscriptionsTools(server);
-    registerDocsTools(server);
-    return server;
-}

package/dist/tools/__tests__/api-client.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=api-client.test.d.ts.map

package/dist/tools/__tests__/api-client.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-client.test.d.ts","sourceRoot":"","sources":["../../../src/tools/__tests__/api-client.test.ts"],"names":[],"mappings":""}

package/dist/tools/__tests__/api-client.test.js

@@ -1,49 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { apiRequest } from '../api-client.js';
-const mockFetch = vi.fn();
-vi.stubGlobal('fetch', mockFetch);
-function makeResponse(body, status = 200) {
-    const text = body === undefined ? '' : JSON.stringify(body);
-    return {
-        ok: status >= 200 && status < 300,
-        status,
-        text: () => Promise.resolve(text),
-        json: () => Promise.resolve(body),
-    };
-}
-describe('apiRequest', () => {
-    beforeEach(() => {
-        mockFetch.mockReset();
-    });
-    it('makes a GET request and returns parsed JSON', async () => {
-        mockFetch.mockResolvedValue(makeResponse({ status: 'ok' }));
-        const result = await apiRequest('/health');
-        expect(result).toEqual({ status: 'ok' });
-        expect(mockFetch).toHaveBeenCalledWith(expect.stringContaining('/health'), expect.objectContaining({ method: 'GET' }));
-    });
-    it('includes x-api-token header when token is provided', async () => {
-        mockFetch.mockResolvedValue(makeResponse({ id: 'user-1' }));
-        await apiRequest('/v1/auth/me', { token: 'my-secret-token' });
-        const [, init] = mockFetch.mock.calls[0];
-        expect(init.headers['x-api-token']).toBe('my-secret-token');
-    });
-    it('returns undefined for 204 No Content responses', async () => {
-        mockFetch.mockResolvedValue({ ok: true, status: 204, json: vi.fn() });
-        const result = await apiRequest('/v1/auth/tokens/123', { method: 'DELETE' });
-        expect(result).toBeUndefined();
-    });
-    it('throws an error when the response is not ok', async () => {
-        mockFetch.mockResolvedValue(makeResponse({ error: 'Not found' }, 404));
-        await expect(apiRequest('/missing')).rejects.toThrow('Not found');
-    });
-    it('throws a generic error when response has no error field', async () => {
-        mockFetch.mockResolvedValue(makeResponse({}, 500));
-        await expect(apiRequest('/broken')).rejects.toThrow('API error: HTTP 500');
-    });
-    it('sends a JSON body for POST requests', async () => {
-        mockFetch.mockResolvedValue(makeResponse({ id: 'tok-1' }));
-        await apiRequest('/v1/auth/tokens', { method: 'POST', body: { name: 'ci', scopes: ['*'] } });
-        const [, init] = mockFetch.mock.calls[0];
-        expect(init.body).toBe(JSON.stringify({ name: 'ci', scopes: ['*'] }));
-    });
-});

package/dist/tools/api-client.d.ts

@@ -1,8 +0,0 @@
-interface RequestOptions {
-    method?: string;
-    body?: unknown;
-    token?: string;
-}
-export declare function apiRequest<T>(path: string, options?: RequestOptions): Promise<T>;
-export {};
-//# sourceMappingURL=api-client.d.ts.map

package/dist/tools/api-client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/tools/api-client.ts"],"names":[],"mappings":"AAEA,UAAU,cAAc;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CA0C1F"}

package/dist/tools/api-client.js

@@ -1,37 +0,0 @@
-const API_URL = process.env.API_URL ?? 'https://api.ferrlabs.com';
-export async function apiRequest(path, options = {}) {
-    const { method = 'GET', body, token } = options;
-    const headers = {
-        'Content-Type': 'application/json',
-        'User-Agent': 'ferrlabs-mcp/4.0.0',
-    };
-    if (token) {
-        headers['x-api-token'] = token;
-        headers['Authorization'] = `Bearer ${token}`;
-    }
-    const res = await fetch(`${API_URL}${path}`, {
-        method,
-        headers,
-        body: body ? JSON.stringify(body) : undefined,
-    });
-    if (res.status === 204) {
-        return undefined;
-    }
-    const raw = await res.text();
-    let data = undefined;
-    if (raw) {
-        try {
-            data = JSON.parse(raw);
-        }
-        catch {
-            throw new Error(`API non-JSON response (HTTP ${res.status}): ${raw.slice(0, 200)}`);
-        }
-    }
-    if (!res.ok) {
-        const errMsg = data?.error ??
-            data?.message ??
-            `API error: HTTP ${res.status}`;
-        throw new Error(errMsg);
-    }
-    return data;
-}

package/dist/transports/http.d.ts

@@ -1,7 +0,0 @@
-export interface HttpServerOptions {
-    port: number;
-    host?: string;
-    stateless?: boolean;
-}
-export declare function startHttpServer(opts: HttpServerOptions): Promise<void>;
-//# sourceMappingURL=http.d.ts.map

package/dist/transports/http.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/transports/http.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAoBD,wBAAsB,eAAe,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0D5E"}

package/dist/transports/http.js

@@ -1,89 +0,0 @@
-import { createServer } from 'node:http';
-import { randomUUID } from 'node:crypto';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { createMcpServer } from '../server.js';
-import { runWithAuthContext } from '../auth/context.js';
-function extractBearer(req) {
-    const header = req.headers['authorization'];
-    if (typeof header !== 'string')
-        return undefined;
-    const match = /^Bearer\s+(.+)$/i.exec(header);
-    return match?.[1];
-}
-async function readJsonBody(req) {
-    if (req.method !== 'POST')
-        return undefined;
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        req.on('data', (c) => chunks.push(c));
-        req.on('end', () => {
-            const raw = Buffer.concat(chunks).toString('utf8');
-            if (!raw)
-                return resolve(undefined);
-            try {
-                resolve(JSON.parse(raw));
-            }
-            catch (err) {
-                reject(err);
-            }
-        });
-        req.on('error', reject);
-    });
-}
-export async function startHttpServer(opts) {
-    const { port, host = '0.0.0.0', stateless = true } = opts;
-    const transports = new Map();
-    async function handleMcpRequest(req, res) {
-        const sessionId = req.headers['mcp-session-id'] ?? undefined;
-        let transport = sessionId ? transports.get(sessionId) : undefined;
-        if (!transport) {
-            transport = new StreamableHTTPServerTransport({
-                sessionIdGenerator: stateless ? undefined : randomUUID,
-                onsessioninitialized: stateless
-                    ? undefined
-                    : (newSessionId) => {
-                        if (transport)
-                            transports.set(newSessionId, transport);
-                    },
-            });
-            transport.onclose = () => {
-                if (sessionId)
-                    transports.delete(sessionId);
-            };
-            const server = createMcpServer();
-            await server.connect(transport);
-        }
-        const body = await readJsonBody(req);
-        const bearerToken = extractBearer(req);
-        await runWithAuthContext({ bearerToken }, () => transport.handleRequest(req, res, body));
-    }
-    const httpServer = createServer((req, res) => {
-        const url = req.url ?? '/';
-        if (url === '/health' || url === '/livez' || url === '/readyz') {
-            res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ status: 'ok', service: 'ferrlabs-mcp' }));
-            return;
-        }
-        if (url === '/mcp' || url.startsWith('/mcp?')) {
-            handleMcpRequest(req, res).catch((err) => {
-                if (!res.headersSent) {
-                    res.writeHead(500, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }));
-                }
-                else {
-                    res.end();
-                }
-            });
-            return;
-        }
-        res.writeHead(404, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: 'Not found' }));
-    });
-    await new Promise((resolve, reject) => {
-        httpServer.once('error', reject);
-        httpServer.listen(port, host, () => {
-            console.error(`ferrlabs-mcp HTTP transport listening on http://${host}:${port}/mcp`);
-            resolve();
-        });
-    });
-}

package/dist/transports/stdio.d.ts

@@ -1,2 +0,0 @@
-export declare function startStdioServer(): Promise<void>;
-//# sourceMappingURL=stdio.d.ts.map

package/dist/transports/stdio.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../src/transports/stdio.ts"],"names":[],"mappings":"AAGA,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAItD"}

package/dist/transports/stdio.js

@@ -1,7 +0,0 @@
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { createMcpServer } from '../server.js';
-export async function startStdioServer() {
-    const server = createMcpServer();
-    const transport = new StdioServerTransport();
-    await server.connect(transport);
-}