@fragno-dev/mcp-fragment 0.0.0-stage → 0.0.3

package/LICENSE.md

@@ -0,0 +1,16 @@
+Copyright 2025 - present "ReJot Nederland B.V.", and individual contributors.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the “Software”), to deal in the Software without restriction,
+including without limitation the rights to use, copy, modify, merge, publish, distribute,
+sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT
+NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
+OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,313 @@
-# Temporary Holding Version
+# mcp-fragment
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A DB-backed Fragno fragment for calling MCP tools over Streamable HTTP.
+
+This fragment is a client for one or more remote MCP servers. It stores server configuration and
+auth state in the fragment database, then connects to MCP servers per operation to list tools or
+call a tool. It supports MCP **tools** only; prompts, resources, roots, sampling, and elicitation
+are out of scope for this package.
+
+## Protocol support
+
+The fragment supports MCP **2026-07-28** using the official TypeScript SDK v2 client. Each operation
+discovers the server's protocol automatically; older servers fall back to the initialization-based
+protocol (including **2025-11-25**). Both JSON and SSE responses over Streamable HTTP are supported.
+It does not implement the separate legacy HTTP+SSE transport.
+
+Tool listing follows all cursor pages before replacing the cached tool list. Tool metadata,
+including output schemas and icons, is preserved. `McpTool` mirrors the protocol's tool definition,
+including the required `inputSchema`. Structured tool results may be objects, arrays, primitives, or
+`null`; protocol-only result envelopes are handled by the SDK.
+
+Protocol support does not enable optional MCP features outside this package's tools-only scope, such
+as elicitation, sampling, subscriptions, or the tasks extension.
+
+## Usage
+
+```ts
+import { createMcpFragment } from "@fragno-dev/mcp-fragment";
+
+const oauthRedirectUri = "https://app.example.com/mcp/oauth/callback";
+const fragment = createMcpFragment(
+  {
+    // Optional SSRF/tenant allow-list hook.
+    allowedEndpointUrls: (url) => url.protocol === "https:",
+    // OAuth start is denied unless the callback is explicitly allowed.
+    allowedOAuthRedirectUris: (url) => url.toString() === oauthRedirectUri,
+  },
+  {
+    databaseAdapter: yourDatabaseAdapter,
+  },
+);
+```
+
+## Hooks
+
+Hooks are durable: they run after the transaction that triggered them commits, and are retried on
+failure.
+
+- `onServerReadinessChanged` receives `{ serverId, ready }` when a write changes whether stored auth
+  can authorize operations: on creation, and afterwards whenever credentials, consent, or tokens
+  flip readiness, including tokens the server rejects during an operation. Expiry without a write
+  does not trigger it.
+- `onServerConfigurationChanged` receives `{ serverId, current: { tools } }` when a refresh finds a
+  different tool list.
+- `onServerConfigurationDeleted` receives `{ serverId }` when a server is deleted.
+
+## CLI
+
+The package ships a small local CLI for trying remote MCP servers from disk-backed SQLite storage.
+It runs the MCP fragment locally, migrates the SQLite database on startup when needed, and stores
+data under `~/.fragno/mcp-fragment` by default.
+
+```bash
+# Terminal 1: start the local fragment server.
+fragno-mcp serve
+
+# From this repository, run the same command through pnpm:
+pnpm --filter @fragno-dev/mcp-fragment cli -- serve
+
+# Terminal 2: register a remote Streamable HTTP MCP server.
+fragno-mcp add my-tools https://mcp.example.com/mcp
+
+# Start OAuth for that server. Keep `serve` running so it can handle the callback.
+fragno-mcp oauth my-tools --scope tools
+
+# Check auth state.
+fragno-mcp status my-tools
+
+# Retrieve the remote MCP tools.
+fragno-mcp tools my-tools
+```
+
+Defaults:
+
+- local base URL: `http://127.0.0.1:3927`
+- fragment mount route: `/api/mcp-fragment`
+- SQLite data directory: `~/.fragno/mcp-fragment`
+
+Useful options:
+
+```bash
+fragno-mcp serve --port 4000 --data-dir ./mcp-data
+fragno-mcp oauth my-tools --client-id ... --client-secret ... --no-open
+fragno-mcp tools my-tools --json
+```
+
+For `add`, the CLI registers the server with `auth: { type: "none" }`; run `oauth` afterwards for
+OAuth-backed servers. Keep `fragno-mcp serve` running while authorizing so the remote OAuth provider
+can redirect back to `/api/mcp-fragment/oauth/callback`.
+
+## Client helpers
+
+```ts
+import { createMcpFragmentClients } from "@fragno-dev/mcp-fragment";
+
+const mcp = createMcpFragmentClients({ baseUrl: "/mcp" });
+
+// Hooks
+mcp.useServers;
+mcp.useServer;
+
+// Mutators
+mcp.createServer;
+mcp.refreshServer;
+mcp.setToken;
+mcp.startOAuth;
+mcp.deleteAuth;
+mcp.callTool;
+```
+
+## Routes
+
+Server management:
+
+- `POST /servers` - register an MCP server.
+- `GET /servers` - list registered servers.
+- `GET /servers/:slug` - get one registered server.
+- `DELETE /servers/:slug` - delete a server and its auth/cache state.
+
+Auth:
+
+- `GET /servers/:slug/auth/status` - report auth mode and whether usable auth is stored.
+- `POST /servers/:slug/auth/token` - store or replace a bearer token.
+- `POST /servers/:slug/auth/start` - start OAuth authorization-code + PKCE with an explicit
+  `redirectUri` query parameter.
+- `GET /oauth/callback` - complete OAuth authorization-code + PKCE.
+- `DELETE /servers/:slug/auth` - delete auth state and switch the server to `none` auth.
+
+Tools:
+
+- `POST /servers/:slug/refresh` - connect to the MCP server, refresh cached tools, and return live
+  diagnostics.
+- `POST /servers/:slug/tools/execute` - connect to the MCP server and call one tool.
+
+## Registering servers
+
+No auth:
+
+```ts
+await mcp.createServer.mutate({
+  slug: "local-tools",
+  endpointUrl: "https://mcp.example.com/mcp",
+  auth: { type: "none" },
+});
+```
+
+Bearer token auth:
+
+```ts
+await mcp.createServer.mutate({
+  slug: "private-tools",
+  endpointUrl: "https://mcp.example.com/mcp",
+  auth: { type: "bearer", token: "..." },
+});
+
+// Later replacement:
+await mcp.setToken.mutate({ token: "new-token" }, { pathParams: { slug: "private-tools" } });
+```
+
+Client credentials auth:
+
+```ts
+await mcp.createServer.mutate({
+  slug: "machine-tools",
+  endpointUrl: "https://mcp.example.com/mcp",
+  auth: {
+    type: "client_credentials",
+    clientId: "...",
+    clientSecret: "...",
+    scopes: ["tools"],
+  },
+});
+```
+
+The fragment acquires an access token before the first tool operation, stores it with its expiry,
+and reuses it until it is close to expiring.
+
+OAuth auth:
+
+```ts
+await mcp.createServer.mutate({
+  slug: "oauth-tools",
+  endpointUrl: "https://mcp.example.com/mcp",
+  auth: { type: "oauth" },
+});
+```
+
+## OAuth flow
+
+The OAuth flow uses the official MCP TypeScript SDK auth APIs with a fragment-owned DB-backed
+`OAuthClientProvider`.
+
+### 1. Start authorization
+
+Call `POST /servers/:slug/auth/start`:
+
+```ts
+const start = await mcp.startOAuth.mutate(
+  {
+    // Optional OAuth scope string.
+    scope: "tools",
+    // Optional static/pre-registered OAuth client. Persisted for the callback.
+    clientId: "...",
+    clientSecret: "...",
+  },
+  {
+    pathParams: { slug: "oauth-tools" },
+    query: { redirectUri: oauthRedirectUri },
+  },
+);
+
+window.location.href = start.authorizationUrl;
+```
+
+The route:
+
+1. Loads the MCP server by slug.
+2. Creates a DB-backed SDK `OAuthClientProvider` for that server.
+3. Calls the SDK `auth(...)` helper.
+4. Lets the SDK discover OAuth protected-resource metadata and authorization-server metadata.
+5. Lets the SDK perform dynamic client registration when required.
+6. Generates PKCE verifier/challenge and an authorization URL.
+7. Stores the OAuth state, PKCE verifier, validated redirect URI, requested scope, discovery state,
+   and client information in the fragment DB/secret tables.
+8. Returns `{ authorizationUrl, state }`.
+
+### 2. User authorizes with the OAuth server
+
+Redirect the browser to `authorizationUrl`. The OAuth server eventually redirects back to the
+fragment callback URL with `code` and `state` query parameters.
+
+### 3. Complete callback
+
+The mounted fragment handles:
+
+```http
+GET /oauth/callback?code=...&state=...&iss=...
+```
+
+The callback route:
+
+1. Validates that `code` and `state` exist.
+2. Loads the pending one-time OAuth state from the DB.
+3. Rejects missing, expired, or already consumed states.
+4. Recreates the DB-backed SDK `OAuthClientProvider` for the matching server.
+5. Calls SDK `auth(...)` with the authorization code and callback `iss` parameter. The SDK rejects
+   an issuer mismatch before token exchange, and requires `iss` when the authorization server
+   advertises support for it. Custom callback forwarding must preserve `iss` alongside `code` and
+   `state`.
+6. Lets the SDK exchange the code + PKCE verifier for tokens.
+7. Stores access token, refresh token, token type, scope, and expiry in stored secret payloads.
+8. Marks the OAuth state as consumed only after successful token exchange.
+9. Returns `{ authenticated: true, mode: "oauth" }`.
+
+### 4. Tool operations use stored OAuth tokens
+
+After callback completion, `POST /servers/:slug/refresh` and `POST /servers/:slug/tools/execute`
+read the stored OAuth token payload from the DB and send the access token as a bearer token when
+connecting to the MCP server.
+
+The fragment still connects per operation. MCP 2026-07-28 is sessionless. When connecting to an
+older server, MCP session IDs are used only inside a single operation by the SDK transport and are
+not stored or reused across requests. OAuth credentials retain the SDK's issuer binding, and OAuth
+discovery state persists across requests.
+
+## Calling tools
+
+```ts
+const refresh = await mcp.refreshServer.mutate({}, { pathParams: { slug: "oauth-tools" } });
+const tools = refresh.tools;
+
+const result = await mcp.callTool.mutate(
+  {
+    name: "echo",
+    arguments: { text: "hello" },
+    timeoutMs: 10_000,
+  },
+  { pathParams: { slug: "oauth-tools" } },
+);
+```
+
+## Security notes
+
+- Always provide `allowedEndpointUrls` in production to prevent SSRF.
+- Auth payloads and OAuth state are serialized as JSON in the fragment database, not encrypted by
+  this package. Integrators must provide encrypted-at-rest storage and appropriate access controls
+  to keep refresh tokens and other credentials confidential.
+- OAuth state is one-time use and expires after 10 minutes.
+- Deleting a server deletes stored auth, pending OAuth state, and cached tools.
+- `DELETE /servers/:slug/auth` deletes auth state and switches that server back to `none` auth.
+
+## Build
+
+```bash
+pnpm run types:check
+pnpm run build
+```
+
+## Test
+
+```bash
+pnpm run test
+```

package/bin/run.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { run } from "../dist/cli/cli.js";
+
+const exitCode = await run(process.argv);
+if (typeof exitCode === "number") {
+  process.exitCode = exitCode;
+}

package/dist/browser/client/react.d.ts

@@ -0,0 +1,253 @@
+import { a as FragnoClientRequestError, c as InferOr, d as MaybeExtractPathParamsOrWiden, f as QueryParamsHint, i as ReadableAtom, l as ExtractPathParamsOrWiden, o as NonGetHTTPMethod, r as FetcherValue, s as FragnoPublicClientConfig, u as HasPathParams } from "../client-BCzNDSlW.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region ../fragno/dist/client/react.d.ts
+//#region src/client/react.d.ts
+type FragnoReactHook<_TMethod extends "GET", TPath extends string, TOutputSchema extends StandardSchemaV1, TErrorCode extends string, TQueryParameters extends string> = (args?: {
+  path?: MaybeExtractPathParamsOrWiden<TPath, string | ReadableAtom<string>>;
+  query?: QueryParamsHint<TQueryParameters, string | ReadableAtom<string>>;
+}) => FetcherValue<StandardSchemaV1.InferOutput<TOutputSchema>, FragnoClientRequestError<NonNullable<TErrorCode>>> & {
+  refetch: () => void;
+};
+type FragnoReactMutator<_TMethod extends NonGetHTTPMethod, TPath extends string, TInputSchema extends StandardSchemaV1 | undefined, TOutputSchema extends StandardSchemaV1 | undefined, TErrorCode extends string, TQueryParameters extends string> = () => {
+  mutate: ({ body, path, query }: {
+    body?: InferOr<TInputSchema, undefined>;
+    path?: HasPathParams<TPath> extends true ? ExtractPathParamsOrWiden<TPath, string | ReadableAtom<string>> : undefined;
+    query?: QueryParamsHint<TQueryParameters, string | ReadableAtom<string>>;
+  }) => Promise<InferOr<TOutputSchema, undefined>>;
+  loading?: boolean | undefined;
+  error?: FragnoClientRequestError<NonNullable<TErrorCode>[number]> | undefined;
+  data?: InferOr<TOutputSchema, undefined> | undefined;
+};
+//#endregion
+//#region src/client/react.d.ts
+export declare function createMcpFragmentClient(config?: FragnoPublicClientConfig): {
+  useServers: FragnoReactHook<"GET", "/servers", import("zod").ZodObject<{
+    servers: import("zod").ZodArray<import("zod").ZodObject<{
+      slug: import("zod").ZodString;
+      name: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+      endpointUrl: import("zod").ZodString;
+      authMode: import("zod").ZodString;
+      cache: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodObject<{
+        protocolVersion: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+        serverInfo: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodUnknown>>;
+        capabilities: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodUnknown>>;
+        tools: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodArray<import("zod").ZodObject<{
+          name: import("zod").ZodString;
+          title: import("zod").ZodOptional<import("zod").ZodString>;
+          description: import("zod").ZodOptional<import("zod").ZodString>;
+          inputSchema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
+          outputSchema: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+          annotations: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+          _meta: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+        }, import("zod/v4/core").$loose>>>>;
+        updatedAt: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodDate]>>;
+      }, import("zod/v4/core").$strip>>>;
+    }, import("zod/v4/core").$strip>>;
+  }, import("zod/v4/core").$strip>, string, string>;
+  useServer: FragnoReactHook<"GET", "/servers/:slug", import("zod").ZodObject<{
+    slug: import("zod").ZodString;
+    name: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+    endpointUrl: import("zod").ZodString;
+    authMode: import("zod").ZodString;
+    cache: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodObject<{
+      protocolVersion: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+      serverInfo: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodUnknown>>;
+      capabilities: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodUnknown>>;
+      tools: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodArray<import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        title: import("zod").ZodOptional<import("zod").ZodString>;
+        description: import("zod").ZodOptional<import("zod").ZodString>;
+        inputSchema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
+        outputSchema: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+        annotations: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+        _meta: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+      }, import("zod/v4/core").$loose>>>>;
+      updatedAt: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodDate]>>;
+    }, import("zod/v4/core").$strip>>>;
+  }, import("zod/v4/core").$strip>, "SERVER_NOT_FOUND", string>;
+  createServer: FragnoReactMutator<NonGetHTTPMethod, "/servers", import("@standard-schema/spec").StandardSchemaV1<unknown, unknown> | import("zod").ZodObject<{
+    slug: import("zod").ZodString;
+    name: import("zod").ZodOptional<import("zod").ZodString>;
+    endpointUrl: import("zod").ZodURL;
+    auth: import("zod").ZodDefault<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+      type: import("zod").ZodLiteral<"none">;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+      type: import("zod").ZodLiteral<"bearer">;
+      token: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+      type: import("zod").ZodLiteral<"client_credentials">;
+      clientId: import("zod").ZodString;
+      clientSecret: import("zod").ZodString;
+      scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+      type: import("zod").ZodLiteral<"oauth">;
+      clientId: import("zod").ZodOptional<import("zod").ZodString>;
+      clientSecret: import("zod").ZodOptional<import("zod").ZodString>;
+      scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+    }, import("zod/v4/core").$strip>], "type">>;
+  }, import("zod/v4/core").$strip> | undefined, import("zod").ZodObject<{
+    slug: import("zod").ZodString;
+    name: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+    endpointUrl: import("zod").ZodString;
+    authMode: import("zod").ZodString;
+    cache: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodObject<{
+      protocolVersion: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+      serverInfo: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodUnknown>>;
+      capabilities: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodUnknown>>;
+      tools: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodArray<import("zod").ZodObject<{
+        name: import("zod").ZodString;
+        title: import("zod").ZodOptional<import("zod").ZodString>;
+        description: import("zod").ZodOptional<import("zod").ZodString>;
+        inputSchema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
+        outputSchema: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+        annotations: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+        _meta: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+      }, import("zod/v4/core").$loose>>>>;
+      updatedAt: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodDate]>>;
+    }, import("zod/v4/core").$strip>>>;
+  }, import("zod/v4/core").$strip> | import("zod").ZodObject<{
+    servers: import("zod").ZodArray<import("zod").ZodObject<{
+      slug: import("zod").ZodString;
+      name: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+      endpointUrl: import("zod").ZodString;
+      authMode: import("zod").ZodString;
+      cache: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodObject<{
+        protocolVersion: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+        serverInfo: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodUnknown>>;
+        capabilities: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodUnknown>>;
+        tools: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodArray<import("zod").ZodObject<{
+          name: import("zod").ZodString;
+          title: import("zod").ZodOptional<import("zod").ZodString>;
+          description: import("zod").ZodOptional<import("zod").ZodString>;
+          inputSchema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
+          outputSchema: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+          annotations: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+          _meta: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+        }, import("zod/v4/core").$loose>>>>;
+        updatedAt: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodDate]>>;
+      }, import("zod/v4/core").$strip>>>;
+    }, import("zod/v4/core").$strip>>;
+  }, import("zod/v4/core").$strip> | undefined, string, string>;
+  refreshServer: FragnoReactMutator<NonGetHTTPMethod, "/servers/:slug/refresh", import("@standard-schema/spec").StandardSchemaV1<unknown, unknown> | undefined, import("zod").ZodObject<{
+    ok: import("zod").ZodBoolean;
+    tools: import("zod").ZodArray<import("zod").ZodObject<{
+      name: import("zod").ZodString;
+      title: import("zod").ZodOptional<import("zod").ZodString>;
+      description: import("zod").ZodOptional<import("zod").ZodString>;
+      inputSchema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
+      outputSchema: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+      annotations: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+      _meta: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+    }, import("zod/v4/core").$loose>>;
+    stage: import("zod").ZodNullable<import("zod").ZodEnum<{
+      auth: "auth";
+      list_tools: "list_tools";
+    }>>;
+    checkedAt: import("zod").ZodString;
+    server: import("zod").ZodObject<{
+      name: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+      endpointUrl: import("zod").ZodString;
+      authMode: import("zod").ZodString;
+      slug: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    auth: import("zod").ZodObject<{
+      authenticated: import("zod").ZodBoolean;
+      mode: import("zod").ZodString;
+      tokenPresent: import("zod").ZodBoolean;
+      expiresAt: import("zod").ZodNullable<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodDate]>>;
+      expired: import("zod").ZodNullable<import("zod").ZodBoolean>;
+      scopes: import("zod").ZodObject<{
+        requested: import("zod").ZodNullable<import("zod").ZodArray<import("zod").ZodString>>;
+        granted: import("zod").ZodNullable<import("zod").ZodArray<import("zod").ZodString>>;
+        missing: import("zod").ZodNullable<import("zod").ZodArray<import("zod").ZodString>>;
+        raw: import("zod").ZodNullable<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>;
+    live: import("zod").ZodObject<{
+      reachable: import("zod").ZodBoolean;
+      listToolsOk: import("zod").ZodBoolean;
+      toolCount: import("zod").ZodNullable<import("zod").ZodNumber>;
+      protocolVersion: import("zod").ZodNullable<import("zod").ZodString>;
+      serverInfo: import("zod").ZodNullable<import("zod").ZodUnknown>;
+      capabilities: import("zod").ZodNullable<import("zod").ZodUnknown>;
+    }, import("zod/v4/core").$strip>;
+    cache: import("zod").ZodObject<{
+      presentBeforeCheck: import("zod").ZodBoolean;
+      previousToolCount: import("zod").ZodNullable<import("zod").ZodNumber>;
+      updatedToolCount: import("zod").ZodNullable<import("zod").ZodNumber>;
+    }, import("zod/v4/core").$strip>;
+    error: import("zod").ZodNullable<import("zod").ZodObject<{
+      code: import("zod").ZodString;
+      message: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>>;
+  }, import("zod/v4/core").$strip> | undefined, "SERVER_NOT_FOUND", string>;
+  callTool: FragnoReactMutator<NonGetHTTPMethod, "/servers/:slug/tools/execute", import("zod").ZodObject<{
+    name: import("zod").ZodString;
+    arguments: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+    timeoutMs: import("zod").ZodOptional<import("zod").ZodNumber>;
+  }, import("zod/v4/core").$strip> | undefined, import("zod").ZodObject<{
+    isError: import("zod").ZodBoolean;
+    content: import("zod").ZodArray<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+    structuredContent: import("zod").ZodUnknown;
+  }, import("zod/v4/core").$strip> | undefined, "SERVER_NOT_FOUND" | "MCP_ERROR", string>;
+  setToken: FragnoReactMutator<NonGetHTTPMethod, "/servers/:slug/auth/token", import("zod").ZodObject<{
+    token: import("zod").ZodString;
+  }, import("zod/v4/core").$strip> | undefined, import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+    mode: import("zod").ZodLiteral<"none">;
+  }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    mode: import("zod").ZodLiteral<"bearer">;
+    credentials: import("zod").ZodEnum<{
+      present: "present";
+      missing: "missing";
+    }>;
+  }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    mode: import("zod").ZodLiteral<"client_credentials">;
+    credentials: import("zod").ZodEnum<{
+      present: "present";
+      missing: "missing";
+    }>;
+  }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    mode: import("zod").ZodLiteral<"oauth">;
+    state: import("zod").ZodEnum<{
+      "consent-required": "consent-required";
+      "consent-pending": "consent-pending";
+      authorized: "authorized";
+      expired: "expired";
+    }>;
+  }, import("zod/v4/core").$strip>], "mode"> | undefined, "SERVER_NOT_FOUND", string>;
+  startOAuth: FragnoReactMutator<NonGetHTTPMethod, "/servers/:slug/auth/start", import("zod").ZodObject<{
+    scope: import("zod").ZodOptional<import("zod").ZodString>;
+    clientId: import("zod").ZodOptional<import("zod").ZodString>;
+    clientSecret: import("zod").ZodOptional<import("zod").ZodString>;
+    discardTokens: import("zod").ZodDefault<import("zod").ZodBoolean>;
+  }, import("zod/v4/core").$strip> | undefined, import("zod").ZodObject<{
+    authorizationUrl: import("zod").ZodString;
+    state: import("zod").ZodString;
+  }, import("zod/v4/core").$strip> | undefined, "SERVER_NOT_FOUND" | "INVALID_OAUTH_REDIRECT_URI" | "OAUTH_REDIRECT_URI_NOT_ALLOWED" | "OAUTH_ERROR", string>;
+  deleteAuth: FragnoReactMutator<NonGetHTTPMethod, "/servers/:slug/auth", import("@standard-schema/spec").StandardSchemaV1<unknown, unknown> | undefined, import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+    mode: import("zod").ZodLiteral<"none">;
+  }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    mode: import("zod").ZodLiteral<"bearer">;
+    credentials: import("zod").ZodEnum<{
+      present: "present";
+      missing: "missing";
+    }>;
+  }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    mode: import("zod").ZodLiteral<"client_credentials">;
+    credentials: import("zod").ZodEnum<{
+      present: "present";
+      missing: "missing";
+    }>;
+  }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    mode: import("zod").ZodLiteral<"oauth">;
+    state: import("zod").ZodEnum<{
+      "consent-required": "consent-required";
+      "consent-pending": "consent-pending";
+      authorized: "authorized";
+      expired: "expired";
+    }>;
+  }, import("zod/v4/core").$strip>], "mode"> | undefined, "SERVER_NOT_FOUND", string>;
+};
+//#endregion
+export {};
+//# sourceMappingURL=react.d.ts.map

package/dist/browser/client/react.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.d.ts","names":["_$_fragno_dev_core_react0.FragnoReactHook","_$_fragno_dev_core_api0.NonGetHTTPMethod","_$_fragno_dev_core_react0.FragnoReactMutator"],"sources":["../../../../fragno/dist/client/react.d.ts","../../../src/client/react.ts"],"mappings":";;;;KASK,gBAAgB,wBAAwB,sBAAsB,sBAAsB,kBAAkB,2BAA2B,oCAAoC;EACxK,OAAO,8BAA8B,gBAAgB;EACrD,QAAQ,gBAAgB,2BAA2B;MAC/C,aAAa,iBAAiB,YAAY,gBAAgB,yBAAyB,YAAY;EACnG;;KAEG,mBAAmB,iBAAiB,kBAAkB,sBAAsB,qBAAqB,8BAA8B,sBAAsB,8BAA8B,2BAA2B;EACjN,WAAW,MAAM,MAAM;IACrB,OAAO,QAAQ;IACf,OAAO,cAAc,sBAAsB,yBAAyB,gBAAgB;IACpF,QAAQ,gBAAgB,2BAA2B;QAC/C,QAAQ,QAAQ;EACtB;EACA,QAAQ,yBAAyB,YAAY;EAC7C,OAAO,QAAQ;;;;wBClBD,wBAAwB,SAAQ;cAAAA"}