@fragno-dev/mcp-fragment 0.0.0-stage → 0.0.3

package/dist/node/services.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.js","names":[],"sources":["../../src/services.ts"],"sourcesContent":["import { auth, type OAuthTokens } from \"@modelcontextprotocol/client\";\n\nimport { parseSecretPayload, stringifySecretPayload, type McpClientAuth } from \"./mcp-api\";\nimport type { AuthConfig, McpAuthStatus, McpFragmentConfig } from \"./mcp-types\";\nimport {\n  BufferedOAuthClientProvider,\n  type OAuthProviderChanges,\n  type OAuthProviderSnapshot,\n} from \"./oauth-provider\";\n\n/** A buffered OAuth secret is kept, replaced, or removed because the server rejected it. */\ntype OAuthSecretChange =\n  | { action: \"keep\" }\n  | { action: \"save\"; payload: string }\n  | { action: \"remove\" };\n\nfunction oauthSecretChange(value: unknown, invalidated: boolean | undefined): OAuthSecretChange {\n  if (value) {\n    return { action: \"save\", payload: stringifySecretPayload(value) };\n  }\n  return invalidated ? { action: \"remove\" } : { action: \"keep\" };\n}\n\nexport async function prepareOAuthChanges(changes: OAuthProviderChanges) {\n  return {\n    ...changes,\n    clientChange: oauthSecretChange(changes.clientInformation, changes.clientInvalidated),\n    discoveryChange: oauthSecretChange(changes.discoveryState, changes.discoveryInvalidated),\n  };\n}\n\n/** Applies the client and discovery changes through a write site's own secret writers. */\nexport function writeOAuthSecretChanges(\n  changes: Pick<AuthPersistenceChanges, \"clientChange\" | \"discoveryChange\">,\n  writers: { upsert(kind: string, payload: string): void; remove(kind: string): void },\n) {\n  for (const [kind, change] of [\n    [\"oauth-client\", changes.clientChange],\n    [\"oauth-discovery\", changes.discoveryChange],\n  ] as const) {\n    switch (change.action) {\n      case \"keep\":\n        break;\n      case \"save\":\n        writers.upsert(kind, change.payload);\n        break;\n      case \"remove\":\n        writers.remove(kind);\n        break;\n      default:\n        throw new Error(\"Unknown OAuth secret change.\", { cause: change satisfies never });\n    }\n  }\n}\n\nexport function tokenExpiry(tokens: NonNullable<OAuthProviderChanges[\"tokens\"]>): Date | null {\n  return typeof tokens.expires_in === \"number\"\n    ? new Date(Date.now() + tokens.expires_in * 1000)\n    : null;\n}\n\nexport type AuthPersistenceChanges = Awaited<ReturnType<typeof prepareOAuthChanges>> & {\n  authPayload?: string;\n  authExpiresAt?: Date | null;\n};\n\nexport type McpOperationAuth = McpClientAuth<AuthPersistenceChanges>;\n\nexport type SecretRecord = {\n  id: { toString(): string } | string;\n  kind: string;\n  payload: string;\n  expiresAt?: Date | string | null;\n};\n\n// OAuth payloads hold the creation-time configuration until consent adds tokens and a redirect URI.\ntype StoredAuthPayload =\n  | { type: \"bearer\"; token: string }\n  | (Omit<Extract<AuthConfig, { type: \"oauth\" }>, \"type\"> & {\n      type: \"oauth\";\n      tokens?: OAuthTokens;\n      redirectUri?: string;\n    })\n  | {\n      type: \"client_credentials\";\n      clientId: string;\n      clientSecret: string;\n      scopes?: string[];\n      tokens?: NonNullable<OAuthProviderChanges[\"tokens\"]>;\n    };\n\nfunction secretByKind<TSecret extends { kind: string }>(secrets: TSecret[], kind: string) {\n  return secrets.find((secret) => secret.kind === kind);\n}\n\nconst TOKEN_EXPIRY_SKEW_MS = 30_000;\n\nfunction secretExpiresInFuture(secret: Pick<SecretRecord, \"expiresAt\"> | undefined) {\n  if (!secret?.expiresAt) {\n    return false;\n  }\n  return new Date(secret.expiresAt).getTime() > Date.now() + TOKEN_EXPIRY_SKEW_MS;\n}\n\nfunction secretIsUnexpired(secret: Pick<SecretRecord, \"expiresAt\"> | undefined) {\n  return !secret?.expiresAt || secretExpiresInFuture(secret);\n}\n\n/** Projects stored auth without secrets; whether credentials work can only be learned by using them. */\nexport function projectMcpAuthStatus(args: {\n  authMode: string;\n  authSecret: Pick<SecretRecord, \"payload\" | \"expiresAt\"> | undefined;\n  hasPendingOAuth: boolean;\n}): McpAuthStatus {\n  // Routes write authMode only from authConfigSchema discriminators.\n  const mode = args.authMode as AuthConfig[\"type\"];\n  if (mode === \"none\") {\n    return { mode };\n  }\n  if (mode !== \"oauth\") {\n    return { mode, credentials: args.authSecret ? \"present\" : \"missing\" };\n  }\n  const auth = args.authSecret\n    ? parseSecretPayload<StoredAuthPayload>(args.authSecret.payload)\n    : undefined;\n  const tokens = auth?.type === \"oauth\" ? auth.tokens : undefined;\n  // Matches operation-time resolution: a refresh token renews an expired access token.\n  if (tokens?.access_token && (tokens.refresh_token || secretIsUnexpired(args.authSecret))) {\n    return { mode, state: \"authorized\" };\n  }\n  // Expired tokens without a refresh token are unusable, so a pending link is the actionable state.\n  if (args.hasPendingOAuth) {\n    return { mode, state: \"consent-pending\" };\n  }\n  return { mode, state: tokens?.access_token ? \"expired\" : \"consent-required\" };\n}\n\n/** Whether stored auth can authorize operations without new consent or credentials. */\nexport function isMcpAuthReady(\n  authMode: string,\n  authSecret: Pick<SecretRecord, \"payload\" | \"expiresAt\"> | undefined,\n): boolean {\n  // Pending consent only distinguishes states that are not ready.\n  const status = projectMcpAuthStatus({ authMode, authSecret, hasPendingOAuth: false });\n  switch (status.mode) {\n    case \"none\":\n      return true;\n    case \"oauth\":\n      return status.state === \"authorized\";\n    case \"bearer\":\n    case \"client_credentials\":\n      return status.credentials === \"present\";\n    default:\n      throw new Error(\"Unknown MCP auth mode.\", { cause: status satisfies never });\n  }\n}\n\n/**\n * When stored auth stops authorizing operations because its access token expires without renewal,\n * whether or not that moment has passed. Null when a refresh token renews it or nothing expires.\n */\nexport function mcpAuthReadyUntil(\n  authMode: string,\n  authSecret: Pick<SecretRecord, \"payload\" | \"expiresAt\">,\n): Date | null {\n  if (authMode !== \"oauth\" || !authSecret.expiresAt) {\n    return null;\n  }\n  const auth = parseSecretPayload<StoredAuthPayload>(authSecret.payload);\n  if (auth.type !== \"oauth\" || !auth.tokens?.access_token || auth.tokens.refresh_token) {\n    return null;\n  }\n  return new Date(new Date(authSecret.expiresAt).getTime() - TOKEN_EXPIRY_SKEW_MS);\n}\n\n/**\n * Projects the newest unexpired, unconsumed state; any such state completes the same server.\n * States started before links were retained have no URL and cannot be resumed.\n */\nexport function pendingOAuthLink(\n  state: { authorizationUrl: string | null; expiresAt: Date } | null,\n): { authorizationUrl: string; expiresAt: Date } | null {\n  return state?.authorizationUrl\n    ? { authorizationUrl: state.authorizationUrl, expiresAt: state.expiresAt }\n    : null;\n}\n\n/** Start requests may override the configured client; otherwise the stored configuration applies. */\nexport function resolveOAuthStartClient(\n  secrets: Pick<SecretRecord, \"kind\" | \"payload\">[],\n  input: { scope?: string; clientId?: string; clientSecret?: string },\n) {\n  const authSecret = secretByKind(secrets, \"auth\");\n  const stored = authSecret ? parseSecretPayload<StoredAuthPayload>(authSecret.payload) : undefined;\n  const configured = stored?.type === \"oauth\" ? stored : undefined;\n  return {\n    scope: input.scope ?? configured?.scopes?.join(\" \"),\n    // A client ID and secret belong together; never pair an override with a stored secret.\n    ...(input.clientId\n      ? { clientId: input.clientId, clientSecret: input.clientSecret }\n      : { clientId: configured?.clientId, clientSecret: configured?.clientSecret }),\n  };\n}\n\n/** Clearing OAuth consent keeps the configured client and scopes for the next start. */\nexport function withoutOAuthConsent(payload: string) {\n  const {\n    tokens: _tokens,\n    redirectUri: _redirectUri,\n    ...configuration\n  } = parseSecretPayload<Extract<StoredAuthPayload, { type: \"oauth\" }>>(payload);\n  return stringifySecretPayload(configuration);\n}\n\nasync function parseSecretKind<T>(\n  secrets: Pick<SecretRecord, \"kind\" | \"payload\">[],\n  kind: string,\n): Promise<T | undefined> {\n  const secret = secretByKind(secrets, kind);\n  return secret ? parseSecretPayload<T>(secret.payload) : undefined;\n}\n\nexport async function createOAuthStartSnapshot(args: {\n  config: McpFragmentConfig;\n  server: { id: { toString(): string } | string; endpointUrl: string };\n  secrets: Pick<SecretRecord, \"kind\" | \"payload\">[];\n  stateId: string;\n  redirectUri: string;\n  scope?: string;\n  clientId?: string;\n  clientSecret?: string;\n}): Promise<{\n  authorizationUrl: URL;\n  changes: Awaited<ReturnType<typeof prepareOAuthChanges>>;\n}> {\n  const snapshot: OAuthProviderSnapshot = {\n    serverId: args.server.id.toString(),\n    endpointUrl: args.server.endpointUrl,\n    redirectUrl: args.redirectUri,\n    scope: args.scope,\n    stateId: args.stateId,\n    clientId: args.clientId,\n    clientSecret: args.clientSecret,\n    clientInformation: await parseSecretKind(args.secrets, \"oauth-client\"),\n    discoveryState: await parseSecretKind(args.secrets, \"oauth-discovery\"),\n  };\n  const provider = new BufferedOAuthClientProvider(snapshot);\n  await auth(provider, {\n    serverUrl: snapshot.endpointUrl,\n    scope: args.scope,\n    fetchFn: args.config.fetch,\n  });\n  const authorizationUrl = provider.changes.authorizationUrl;\n  if (!authorizationUrl) {\n    throw new Error(\"OAuth authorization did not produce a redirect URL\");\n  }\n  return { authorizationUrl, changes: await prepareOAuthChanges(provider.changes) };\n}\n\nexport async function createOAuthCallbackSnapshot(args: {\n  config: McpFragmentConfig;\n  stateId: string;\n  code: string;\n  iss: string | undefined;\n  state: {\n    id: { toString(): string } | string;\n    codeVerifier: string;\n    redirectUri: string;\n    scope?: string | null;\n    expiresAt: Date | string;\n    consumedAt?: Date | string | null;\n  };\n  server: { id: { toString(): string } | string; endpointUrl: string };\n  secrets: Pick<SecretRecord, \"kind\" | \"payload\">[];\n}): Promise<AuthPersistenceChanges> {\n  const authPayload = await parseSecretKind<Extract<StoredAuthPayload, { type: \"oauth\" }>>(\n    args.secrets,\n    \"auth\",\n  );\n  const snapshot: OAuthProviderSnapshot = {\n    serverId: args.server.id.toString(),\n    endpointUrl: args.server.endpointUrl,\n    redirectUrl: args.state.redirectUri,\n    scope: args.state.scope ?? undefined,\n    stateId: args.stateId,\n    clientInformation: await parseSecretKind(args.secrets, \"oauth-client\"),\n    tokens: authPayload?.tokens,\n    discoveryState: await parseSecretKind(args.secrets, \"oauth-discovery\"),\n    oauthState: {\n      id: args.state.id.toString(),\n      codeVerifier: args.state.codeVerifier,\n      redirectUri: args.state.redirectUri,\n      scope: args.state.scope ?? undefined,\n      expiresAt: new Date(args.state.expiresAt),\n      consumedAt: args.state.consumedAt ? new Date(args.state.consumedAt) : null,\n    },\n  };\n  const provider = new BufferedOAuthClientProvider(snapshot);\n  await auth(provider, {\n    serverUrl: snapshot.endpointUrl,\n    authorizationCode: args.code,\n    iss: args.iss,\n    scope: snapshot.scope,\n    fetchFn: args.config.fetch,\n  });\n  provider.consumeState();\n  const changes = await prepareOAuthChanges(provider.changes);\n  return {\n    ...changes,\n    ...(changes.tokens\n      ? {\n          // Keep the configured client and scopes so consent can be started again later.\n          authPayload: stringifySecretPayload({\n            ...authPayload,\n            type: \"oauth\",\n            redirectUri: args.state.redirectUri,\n            tokens: changes.tokens,\n          }),\n          authExpiresAt: tokenExpiry(changes.tokens),\n        }\n      : {}),\n  };\n}\n\nconst providerHasChanges = (changes: OAuthProviderChanges) =>\n  Boolean(\n    changes.clientInformation ||\n    changes.discoveryState ||\n    changes.tokens ||\n    changes.tokensInvalidated ||\n    changes.clientInvalidated ||\n    changes.discoveryInvalidated,\n  );\n\nfunction authChangesReader(\n  provider: BufferedOAuthClientProvider,\n  authPayload: Exclude<StoredAuthPayload, { type: \"bearer\" }>,\n) {\n  return async (): Promise<AuthPersistenceChanges | undefined> => {\n    if (!providerHasChanges(provider.changes)) {\n      return undefined;\n    }\n    const tokens = provider.tokens();\n    return {\n      ...(await prepareOAuthChanges(provider.changes)),\n      ...(provider.changes.tokens || provider.changes.tokensInvalidated\n        ? {\n            authPayload: stringifySecretPayload({ ...authPayload, tokens }),\n            authExpiresAt: tokens ? tokenExpiry(tokens) : null,\n          }\n        : {}),\n    };\n  };\n}\n\nexport async function createMcpOperationAuth(args: {\n  config: McpFragmentConfig;\n  server: { id: { toString(): string } | string; endpointUrl: string };\n  secrets: SecretRecord[];\n}): Promise<McpOperationAuth | undefined> {\n  const authSecret = secretByKind(args.secrets, \"auth\");\n  const authPayload = authSecret\n    ? parseSecretPayload<StoredAuthPayload>(authSecret.payload)\n    : undefined;\n  if (!authPayload) {\n    return undefined;\n  }\n  if (authPayload.type === \"bearer\") {\n    return { type: \"bearer\", token: authPayload.token };\n  }\n  if (authPayload.type === \"oauth\") {\n    if (!authPayload.tokens?.access_token) {\n      return undefined;\n    }\n    const clientSecret = secretByKind(args.secrets, \"oauth-client\");\n    const discoverySecret = secretByKind(args.secrets, \"oauth-discovery\");\n    const provider = new BufferedOAuthClientProvider({\n      serverId: args.server.id.toString(),\n      endpointUrl: args.server.endpointUrl,\n      redirectUrl: authPayload.redirectUri,\n      scope: authPayload.tokens.scope,\n      clientInformation: clientSecret ? parseSecretPayload(clientSecret.payload) : undefined,\n      tokens: authPayload.tokens,\n      discoveryState: discoverySecret ? parseSecretPayload(discoverySecret.payload) : undefined,\n    });\n    return {\n      type: \"provider\",\n      provider,\n      readAuthChanges: authChangesReader(provider, authPayload),\n    };\n  }\n\n  const discoverySecret = secretByKind(args.secrets, \"oauth-discovery\");\n  const provider = new BufferedOAuthClientProvider({\n    serverId: args.server.id.toString(),\n    endpointUrl: args.server.endpointUrl,\n    scope: authPayload.scopes?.join(\" \"),\n    clientId: authPayload.clientId,\n    clientSecret: authPayload.clientSecret,\n    tokens: authPayload.tokens,\n    discoveryState: discoverySecret ? parseSecretPayload(discoverySecret.payload) : undefined,\n    flow: \"client_credentials\",\n  });\n  return {\n    type: \"provider\",\n    provider,\n    readAuthChanges: authChangesReader(provider, authPayload),\n  };\n}\n\nexport async function resolveMcpOperationAuth(args: {\n  config: McpFragmentConfig;\n  server: { id: { toString(): string } | string; endpointUrl: string };\n  secrets: SecretRecord[];\n}): Promise<{\n  token?: string;\n  authChanges?: AuthPersistenceChanges;\n}> {\n  const authSecret = secretByKind(args.secrets, \"auth\");\n  const authPayload = authSecret\n    ? parseSecretPayload<StoredAuthPayload>(authSecret.payload)\n    : undefined;\n  if (!authPayload || authPayload.type === \"bearer\") {\n    return { token: authPayload?.token };\n  }\n  if (authPayload.type === \"oauth\") {\n    if (!authPayload.tokens?.access_token) {\n      return {};\n    }\n    if (secretIsUnexpired(authSecret)) {\n      return { token: authPayload.tokens.access_token };\n    }\n    if (!authPayload.tokens.refresh_token) {\n      throw new Error(\"OAuth access token expired and no refresh token is available\");\n    }\n\n    const clientSecret = secretByKind(args.secrets, \"oauth-client\");\n    const discoverySecret = secretByKind(args.secrets, \"oauth-discovery\");\n    const provider = new BufferedOAuthClientProvider({\n      serverId: args.server.id.toString(),\n      endpointUrl: args.server.endpointUrl,\n      redirectUrl: authPayload.redirectUri,\n      scope: authPayload.tokens.scope,\n      clientInformation: clientSecret ? parseSecretPayload(clientSecret.payload) : undefined,\n      tokens: authPayload.tokens,\n      discoveryState: discoverySecret ? parseSecretPayload(discoverySecret.payload) : undefined,\n    });\n    await auth(provider, {\n      serverUrl: args.server.endpointUrl,\n      scope: authPayload.tokens.scope,\n      fetchFn: args.config.fetch,\n    });\n    const tokens = provider.changes.tokens ?? authPayload.tokens;\n    if (!tokens.access_token) {\n      throw new Error(\"OAuth refresh did not return an access token\");\n    }\n    return {\n      token: tokens.access_token,\n      authChanges: {\n        ...(await prepareOAuthChanges(provider.changes)),\n        authPayload: stringifySecretPayload({ ...authPayload, tokens }),\n        authExpiresAt: tokenExpiry(tokens),\n      },\n    };\n  }\n\n  if (authPayload.tokens?.access_token && secretExpiresInFuture(authSecret)) {\n    return { token: authPayload.tokens.access_token };\n  }\n\n  const discoverySecret = secretByKind(args.secrets, \"oauth-discovery\");\n  const provider = new BufferedOAuthClientProvider({\n    serverId: args.server.id.toString(),\n    endpointUrl: args.server.endpointUrl,\n    scope: authPayload.scopes?.join(\" \"),\n    clientId: authPayload.clientId,\n    clientSecret: authPayload.clientSecret,\n    tokens: authPayload.tokens,\n    discoveryState: discoverySecret ? parseSecretPayload(discoverySecret.payload) : undefined,\n    flow: \"client_credentials\",\n  });\n  await auth(provider, {\n    serverUrl: args.server.endpointUrl,\n    scope: authPayload.scopes?.join(\" \"),\n    fetchFn: args.config.fetch,\n  });\n  const tokens = provider.changes.tokens ?? authPayload.tokens;\n  if (!tokens?.access_token) {\n    throw new Error(\"Client credentials flow did not return an access token\");\n  }\n  return {\n    token: tokens.access_token,\n    authChanges: {\n      ...(await prepareOAuthChanges(provider.changes)),\n      authPayload: stringifySecretPayload({ ...authPayload, tokens }),\n      authExpiresAt: tokenExpiry(tokens),\n    },\n  };\n}\n"],"mappings":";;;;AAgBA,SAAS,kBAAkB,OAAgB,aAAqD;CAC9F,IAAI,OACF,OAAO;EAAE,QAAQ;EAAQ,SAAS,uBAAuB,KAAK;CAAE;CAElE,OAAO,cAAc,EAAE,QAAQ,SAAS,IAAI,EAAE,QAAQ,OAAO;AAC/D;AAEA,eAAsB,oBAAoB,SAA+B;CACvE,OAAO;EACL,GAAG;EACH,cAAc,kBAAkB,QAAQ,mBAAmB,QAAQ,iBAAiB;EACpF,iBAAiB,kBAAkB,QAAQ,gBAAgB,QAAQ,oBAAoB;CACzF;AACF;;AAGA,SAAgB,wBACd,SACA,SACA;CACA,KAAK,MAAM,CAAC,MAAM,WAAW,CAC3B,CAAC,gBAAgB,QAAQ,YAAY,GACrC,CAAC,mBAAmB,QAAQ,eAAe,CAC7C,GACE,QAAQ,OAAO,QAAf;EACE,KAAK,QACH;EACF,KAAK;GACH,QAAQ,OAAO,MAAM,OAAO,OAAO;GACnC;EACF,KAAK;GACH,QAAQ,OAAO,IAAI;GACnB;EACF,SACE,MAAM,IAAI,MAAM,gCAAgC,EAAE,OAAO,OAAuB,CAAC;CACrF;AAEJ;AAEA,SAAgB,YAAY,QAAkE;CAC5F,OAAO,OAAO,OAAO,eAAe,WAChC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI,IAC9C;AACN;AAgCA,SAAS,aAA+C,SAAoB,MAAc;CACxF,OAAO,QAAQ,MAAM,WAAW,OAAO,SAAS,IAAI;AACtD;AAEA,MAAM,uBAAuB;AAE7B,SAAS,sBAAsB,QAAqD;CAClF,IAAI,CAAC,QAAQ,WACX,OAAO;CAET,OAAO,IAAI,KAAK,OAAO,SAAS,CAAC,CAAC,QAAQ,IAAI,KAAK,IAAI,IAAI;AAC7D;AAEA,SAAS,kBAAkB,QAAqD;CAC9E,OAAO,CAAC,QAAQ,aAAa,sBAAsB,MAAM;AAC3D;;AAGA,SAAgB,qBAAqB,MAInB;CAEhB,MAAM,OAAO,KAAK;CAClB,IAAI,SAAS,QACX,OAAO,EAAE,KAAK;CAEhB,IAAI,SAAS,SACX,OAAO;EAAE;EAAM,aAAa,KAAK,aAAa,YAAY;CAAU;CAEtE,MAAM,OAAO,KAAK,aACd,mBAAsC,KAAK,WAAW,OAAO,IAC7D,KAAA;CACJ,MAAM,SAAS,MAAM,SAAS,UAAU,KAAK,SAAS,KAAA;CAEtD,IAAI,QAAQ,iBAAiB,OAAO,iBAAiB,kBAAkB,KAAK,UAAU,IACpF,OAAO;EAAE;EAAM,OAAO;CAAa;CAGrC,IAAI,KAAK,iBACP,OAAO;EAAE;EAAM,OAAO;CAAkB;CAE1C,OAAO;EAAE;EAAM,OAAO,QAAQ,eAAe,YAAY;CAAmB;AAC9E;;AAGA,SAAgB,eACd,UACA,YACS;CAET,MAAM,SAAS,qBAAqB;EAAE;EAAU;EAAY,iBAAiB;CAAM,CAAC;CACpF,QAAQ,OAAO,MAAf;EACE,KAAK,QACH,OAAO;EACT,KAAK,SACH,OAAO,OAAO,UAAU;EAC1B,KAAK;EACL,KAAK,sBACH,OAAO,OAAO,gBAAgB;EAChC,SACE,MAAM,IAAI,MAAM,0BAA0B,EAAE,OAAO,OAAuB,CAAC;CAC/E;AACF;;;;;AAMA,SAAgB,kBACd,UACA,YACa;CACb,IAAI,aAAa,WAAW,CAAC,WAAW,WACtC,OAAO;CAET,MAAM,OAAO,mBAAsC,WAAW,OAAO;CACrE,IAAI,KAAK,SAAS,WAAW,CAAC,KAAK,QAAQ,gBAAgB,KAAK,OAAO,eACrE,OAAO;CAET,uBAAO,IAAI,KAAK,IAAI,KAAK,WAAW,SAAS,CAAC,CAAC,QAAQ,IAAI,oBAAoB;AACjF;;;;;AAMA,SAAgB,iBACd,OACsD;CACtD,OAAO,OAAO,mBACV;EAAE,kBAAkB,MAAM;EAAkB,WAAW,MAAM;CAAU,IACvE;AACN;;AAGA,SAAgB,wBACd,SACA,OACA;CACA,MAAM,aAAa,aAAa,SAAS,MAAM;CAC/C,MAAM,SAAS,aAAa,mBAAsC,WAAW,OAAO,IAAI,KAAA;CACxF,MAAM,aAAa,QAAQ,SAAS,UAAU,SAAS,KAAA;CACvD,OAAO;EACL,OAAO,MAAM,SAAS,YAAY,QAAQ,KAAK,GAAG;EAElD,GAAI,MAAM,WACN;GAAE,UAAU,MAAM;GAAU,cAAc,MAAM;EAAa,IAC7D;GAAE,UAAU,YAAY;GAAU,cAAc,YAAY;EAAa;CAC/E;AACF;;AAGA,SAAgB,oBAAoB,SAAiB;CACnD,MAAM,EACJ,QAAQ,SACR,aAAa,cACb,GAAG,kBACD,mBAAkE,OAAO;CAC7E,OAAO,uBAAuB,aAAa;AAC7C;AAEA,eAAe,gBACb,SACA,MACwB;CACxB,MAAM,SAAS,aAAa,SAAS,IAAI;CACzC,OAAO,SAAS,mBAAsB,OAAO,OAAO,IAAI,KAAA;AAC1D;AAEA,eAAsB,yBAAyB,MAY5C;CACD,MAAM,WAAkC;EACtC,UAAU,KAAK,OAAO,GAAG,SAAS;EAClC,aAAa,KAAK,OAAO;EACzB,aAAa,KAAK;EAClB,OAAO,KAAK;EACZ,SAAS,KAAK;EACd,UAAU,KAAK;EACf,cAAc,KAAK;EACnB,mBAAmB,MAAM,gBAAgB,KAAK,SAAS,cAAc;EACrE,gBAAgB,MAAM,gBAAgB,KAAK,SAAS,iBAAiB;CACvE;CACA,MAAM,WAAW,IAAI,4BAA4B,QAAQ;CACzD,MAAM,KAAK,UAAU;EACnB,WAAW,SAAS;EACpB,OAAO,KAAK;EACZ,SAAS,KAAK,OAAO;CACvB,CAAC;CACD,MAAM,mBAAmB,SAAS,QAAQ;CAC1C,IAAI,CAAC,kBACH,MAAM,IAAI,MAAM,oDAAoD;CAEtE,OAAO;EAAE;EAAkB,SAAS,MAAM,oBAAoB,SAAS,OAAO;CAAE;AAClF;AAEA,eAAsB,4BAA4B,MAed;CAClC,MAAM,cAAc,MAAM,gBACxB,KAAK,SACL,MACF;CACA,MAAM,WAAkC;EACtC,UAAU,KAAK,OAAO,GAAG,SAAS;EAClC,aAAa,KAAK,OAAO;EACzB,aAAa,KAAK,MAAM;EACxB,OAAO,KAAK,MAAM,SAAS,KAAA;EAC3B,SAAS,KAAK;EACd,mBAAmB,MAAM,gBAAgB,KAAK,SAAS,cAAc;EACrE,QAAQ,aAAa;EACrB,gBAAgB,MAAM,gBAAgB,KAAK,SAAS,iBAAiB;EACrE,YAAY;GACV,IAAI,KAAK,MAAM,GAAG,SAAS;GAC3B,cAAc,KAAK,MAAM;GACzB,aAAa,KAAK,MAAM;GACxB,OAAO,KAAK,MAAM,SAAS,KAAA;GAC3B,WAAW,IAAI,KAAK,KAAK,MAAM,SAAS;GACxC,YAAY,KAAK,MAAM,aAAa,IAAI,KAAK,KAAK,MAAM,UAAU,IAAI;EACxE;CACF;CACA,MAAM,WAAW,IAAI,4BAA4B,QAAQ;CACzD,MAAM,KAAK,UAAU;EACnB,WAAW,SAAS;EACpB,mBAAmB,KAAK;EACxB,KAAK,KAAK;EACV,OAAO,SAAS;EAChB,SAAS,KAAK,OAAO;CACvB,CAAC;CACD,SAAS,aAAa;CACtB,MAAM,UAAU,MAAM,oBAAoB,SAAS,OAAO;CAC1D,OAAO;EACL,GAAG;EACH,GAAI,QAAQ,SACR;GAEE,aAAa,uBAAuB;IAClC,GAAG;IACH,MAAM;IACN,aAAa,KAAK,MAAM;IACxB,QAAQ,QAAQ;GAClB,CAAC;GACD,eAAe,YAAY,QAAQ,MAAM;EAC3C,IACA,CAAC;CACP;AACF;AAEA,MAAM,sBAAsB,YAC1B,QACE,QAAQ,qBACR,QAAQ,kBACR,QAAQ,UACR,QAAQ,qBACR,QAAQ,qBACR,QAAQ,oBACV;AAEF,SAAS,kBACP,UACA,aACA;CACA,OAAO,YAAyD;EAC9D,IAAI,CAAC,mBAAmB,SAAS,OAAO,GACtC;EAEF,MAAM,SAAS,SAAS,OAAO;EAC/B,OAAO;GACL,GAAI,MAAM,oBAAoB,SAAS,OAAO;GAC9C,GAAI,SAAS,QAAQ,UAAU,SAAS,QAAQ,oBAC5C;IACE,aAAa,uBAAuB;KAAE,GAAG;KAAa;IAAO,CAAC;IAC9D,eAAe,SAAS,YAAY,MAAM,IAAI;GAChD,IACA,CAAC;EACP;CACF;AACF;AAEA,eAAsB,uBAAuB,MAIH;CACxC,MAAM,aAAa,aAAa,KAAK,SAAS,MAAM;CACpD,MAAM,cAAc,aAChB,mBAAsC,WAAW,OAAO,IACxD,KAAA;CACJ,IAAI,CAAC,aACH;CAEF,IAAI,YAAY,SAAS,UACvB,OAAO;EAAE,MAAM;EAAU,OAAO,YAAY;CAAM;CAEpD,IAAI,YAAY,SAAS,SAAS;EAChC,IAAI,CAAC,YAAY,QAAQ,cACvB;EAEF,MAAM,eAAe,aAAa,KAAK,SAAS,cAAc;EAC9D,MAAM,kBAAkB,aAAa,KAAK,SAAS,iBAAiB;EACpE,MAAM,WAAW,IAAI,4BAA4B;GAC/C,UAAU,KAAK,OAAO,GAAG,SAAS;GAClC,aAAa,KAAK,OAAO;GACzB,aAAa,YAAY;GACzB,OAAO,YAAY,OAAO;GAC1B,mBAAmB,eAAe,mBAAmB,aAAa,OAAO,IAAI,KAAA;GAC7E,QAAQ,YAAY;GACpB,gBAAgB,kBAAkB,mBAAmB,gBAAgB,OAAO,IAAI,KAAA;EAClF,CAAC;EACD,OAAO;GACL,MAAM;GACN;GACA,iBAAiB,kBAAkB,UAAU,WAAW;EAC1D;CACF;CAEA,MAAM,kBAAkB,aAAa,KAAK,SAAS,iBAAiB;CACpE,MAAM,WAAW,IAAI,4BAA4B;EAC/C,UAAU,KAAK,OAAO,GAAG,SAAS;EAClC,aAAa,KAAK,OAAO;EACzB,OAAO,YAAY,QAAQ,KAAK,GAAG;EACnC,UAAU,YAAY;EACtB,cAAc,YAAY;EAC1B,QAAQ,YAAY;EACpB,gBAAgB,kBAAkB,mBAAmB,gBAAgB,OAAO,IAAI,KAAA;EAChF,MAAM;CACR,CAAC;CACD,OAAO;EACL,MAAM;EACN;EACA,iBAAiB,kBAAkB,UAAU,WAAW;CAC1D;AACF;AAEA,eAAsB,wBAAwB,MAO3C;CACD,MAAM,aAAa,aAAa,KAAK,SAAS,MAAM;CACpD,MAAM,cAAc,aAChB,mBAAsC,WAAW,OAAO,IACxD,KAAA;CACJ,IAAI,CAAC,eAAe,YAAY,SAAS,UACvC,OAAO,EAAE,OAAO,aAAa,MAAM;CAErC,IAAI,YAAY,SAAS,SAAS;EAChC,IAAI,CAAC,YAAY,QAAQ,cACvB,OAAO,CAAC;EAEV,IAAI,kBAAkB,UAAU,GAC9B,OAAO,EAAE,OAAO,YAAY,OAAO,aAAa;EAElD,IAAI,CAAC,YAAY,OAAO,eACtB,MAAM,IAAI,MAAM,8DAA8D;EAGhF,MAAM,eAAe,aAAa,KAAK,SAAS,cAAc;EAC9D,MAAM,kBAAkB,aAAa,KAAK,SAAS,iBAAiB;EACpE,MAAM,WAAW,IAAI,4BAA4B;GAC/C,UAAU,KAAK,OAAO,GAAG,SAAS;GAClC,aAAa,KAAK,OAAO;GACzB,aAAa,YAAY;GACzB,OAAO,YAAY,OAAO;GAC1B,mBAAmB,eAAe,mBAAmB,aAAa,OAAO,IAAI,KAAA;GAC7E,QAAQ,YAAY;GACpB,gBAAgB,kBAAkB,mBAAmB,gBAAgB,OAAO,IAAI,KAAA;EAClF,CAAC;EACD,MAAM,KAAK,UAAU;GACnB,WAAW,KAAK,OAAO;GACvB,OAAO,YAAY,OAAO;GAC1B,SAAS,KAAK,OAAO;EACvB,CAAC;EACD,MAAM,SAAS,SAAS,QAAQ,UAAU,YAAY;EACtD,IAAI,CAAC,OAAO,cACV,MAAM,IAAI,MAAM,8CAA8C;EAEhE,OAAO;GACL,OAAO,OAAO;GACd,aAAa;IACX,GAAI,MAAM,oBAAoB,SAAS,OAAO;IAC9C,aAAa,uBAAuB;KAAE,GAAG;KAAa;IAAO,CAAC;IAC9D,eAAe,YAAY,MAAM;GACnC;EACF;CACF;CAEA,IAAI,YAAY,QAAQ,gBAAgB,sBAAsB,UAAU,GACtE,OAAO,EAAE,OAAO,YAAY,OAAO,aAAa;CAGlD,MAAM,kBAAkB,aAAa,KAAK,SAAS,iBAAiB;CACpE,MAAM,WAAW,IAAI,4BAA4B;EAC/C,UAAU,KAAK,OAAO,GAAG,SAAS;EAClC,aAAa,KAAK,OAAO;EACzB,OAAO,YAAY,QAAQ,KAAK,GAAG;EACnC,UAAU,YAAY;EACtB,cAAc,YAAY;EAC1B,QAAQ,YAAY;EACpB,gBAAgB,kBAAkB,mBAAmB,gBAAgB,OAAO,IAAI,KAAA;EAChF,MAAM;CACR,CAAC;CACD,MAAM,KAAK,UAAU;EACnB,WAAW,KAAK,OAAO;EACvB,OAAO,YAAY,QAAQ,KAAK,GAAG;EACnC,SAAS,KAAK,OAAO;CACvB,CAAC;CACD,MAAM,SAAS,SAAS,QAAQ,UAAU,YAAY;CACtD,IAAI,CAAC,QAAQ,cACX,MAAM,IAAI,MAAM,wDAAwD;CAE1E,OAAO;EACL,OAAO,OAAO;EACd,aAAa;GACX,GAAI,MAAM,oBAAoB,SAAS,OAAO;GAC9C,aAAa,uBAAuB;IAAE,GAAG;IAAa;GAAO,CAAC;GAC9D,eAAe,YAAY,MAAM;EACnC;CACF;AACF"}

package/dist/node/testing/mcp-test-server.d.ts

@@ -0,0 +1,42 @@
+import { CallToolResult, Tool } from "@modelcontextprotocol/server";
+//#region src/testing/mcp-test-server.d.ts
+/** Tools declare raw JSON Schemas so tests can publish any dialect a real server might. */
+export interface TestMcpTool {
+  name: string;
+  title?: string;
+  description?: string;
+  inputSchema: Tool["inputSchema"];
+  outputSchema?: Tool["outputSchema"];
+  call: (args: Record<string, unknown>) => CallToolResult | Promise<CallToolResult>;
+}
+export interface TestMcpServerOptions {
+  /** 2026-07-28 serves stateless requests only; 2025-11-25 serves sessions only. */
+  protocolVersion: "2025-11-25" | "2026-07-28";
+  requiredBearerToken?: string;
+  enableJsonResponse?: boolean;
+  tools?: readonly TestMcpTool[];
+  oauth?: boolean;
+  disableDynamicRegistration?: boolean;
+  requiredClientId?: string;
+  requiredClientSecret?: string;
+  refreshedRefreshToken?: string;
+  omitRefreshTokenOnRefresh?: boolean;
+  /** Consent grants only an access token, which stops working when it expires. */
+  omitRefreshTokenOnConsent?: boolean;
+  failAuthorizedMcpRequests?: boolean;
+}
+/** An in-process streamable HTTP MCP server, with optional OAuth, served from one origin. */
+export interface TestMcpServer {
+  fetch: (request: Request) => Promise<Response>;
+  getMcpRequestCount: () => number;
+  getTokenRequestCount: () => number;
+  /** Rejects every client registered so far, as a server that lost its registrations would. */
+  forgetRegisteredClients: () => void;
+  /** Sets how long access tokens issued from now on last; one hour until changed. */
+  setTokenLifetimeSeconds: (seconds: number) => void;
+  close: () => Promise<void>;
+}
+/** Serves MCP at `<origin>/mcp`; metadata URLs derive from each request's origin. */
+export declare function createTestMcpServer(options?: TestMcpServerOptions): TestMcpServer;
+//#endregion
+//# sourceMappingURL=mcp-test-server.d.ts.map

package/dist/node/testing/mcp-test-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-test-server.d.ts","names":[],"sources":["../../../src/testing/mcp-test-server.ts"],"mappings":";;;iBASiB;EACf;EACA;EACA;EACA,aAAa;EACb,eAAe;EACf,OAAO,MAAM,4BAA4B,iBAAiB,QAAQ;;iBAGnD;;EAEf;EACA;EACA;EACA,iBAAiB;EACjB;EACA;EACA;EACA;EACA;EACA;;EAEA;EACA;;;iBAIe;EACf,QAAQ,SAAS,YAAY,QAAQ;EACrC;EACA;;EAEA;;EAEA,0BAA0B;EAC1B,aAAa;;;wBAgJC,oBACd,UAAS,uBACR"}

package/dist/node/testing/mcp-test-server.js

@@ -0,0 +1,218 @@
+import { Server, WebStandardStreamableHTTPServerTransport, createMcpHandler } from "@modelcontextprotocol/server";
+//#region src/testing/mcp-test-server.ts
+const echoTool = {
+	name: "echo",
+	title: "Echo",
+	description: "Echo a message",
+	inputSchema: {
+		$schema: "http://json-schema.org/draft-07/schema#",
+		type: "object",
+		properties: { text: { type: "string" } },
+		required: ["text"],
+		additionalProperties: false
+	},
+	outputSchema: {
+		$schema: "http://json-schema.org/draft-07/schema#",
+		type: "object",
+		properties: { echoed: { type: "string" } },
+		required: ["echoed"],
+		additionalProperties: false
+	},
+	call: ({ text }) => ({
+		content: [{
+			type: "text",
+			text: String(text)
+		}],
+		structuredContent: { echoed: String(text) }
+	})
+};
+function json(body, status = 200) {
+	return Response.json(body, { status });
+}
+function requestClientId(request, form) {
+	const authorization = request.headers.get("authorization");
+	if (authorization?.startsWith("Basic ")) return atob(authorization.slice(6)).split(":")[0];
+	return form.get("client_id");
+}
+function hasExpectedClientAuth(request, form, options, registeredClients) {
+	if (!options.requiredClientId) return options.disableDynamicRegistration === true || registeredClients.has(requestClientId(request, form) ?? "");
+	const authorization = request.headers.get("authorization");
+	if (authorization?.startsWith("Basic ")) return atob(authorization.slice(6)) === `${options.requiredClientId}:${options.requiredClientSecret ?? ""}`;
+	return form.get("client_id") === options.requiredClientId && form.get("client_secret") === (options.requiredClientSecret ?? "");
+}
+function createMcpProtocolServer(tools) {
+	const server = new Server({
+		name: "fragno-test-mcp-server",
+		version: "1.0.0"
+	}, { capabilities: tools.length > 0 ? { tools: {} } : {} });
+	if (tools.length > 0) {
+		server.setRequestHandler("tools/list", () => ({ tools: tools.map(({ call: _call, ...tool }) => tool) }));
+		server.setRequestHandler("tools/call", async ({ params }) => {
+			const tool = tools.find((candidate) => candidate.name === params.name);
+			if (!tool) return {
+				isError: true,
+				content: [{
+					type: "text",
+					text: `Tool ${params.name} not found`
+				}]
+			};
+			return server.projectCallToolResult(await tool.call(params.arguments ?? {}), tool.outputSchema);
+		});
+	}
+	return server;
+}
+async function handleToken(request, options, registeredClients, tokenLifetimeSeconds) {
+	const form = new URLSearchParams(await request.text());
+	if (!hasExpectedClientAuth(request, form, options, registeredClients)) return json({ error: "invalid_client" }, 401);
+	const grantType = form.get("grant_type");
+	if (grantType === "client_credentials") return json({
+		access_token: options.requiredBearerToken ?? "client-credentials-access-token",
+		token_type: "Bearer",
+		expires_in: tokenLifetimeSeconds,
+		scope: form.get("scope") ?? "tools"
+	});
+	if (grantType === "refresh_token") {
+		if (form.get("refresh_token") !== "oauth-refresh-token") return json({ error: "invalid_grant" }, 400);
+		return json({
+			access_token: options.requiredBearerToken ?? "oauth-access-token",
+			...options.omitRefreshTokenOnRefresh ? {} : { refresh_token: options.refreshedRefreshToken ?? "oauth-refresh-token" },
+			token_type: "Bearer",
+			expires_in: tokenLifetimeSeconds,
+			scope: "tools"
+		});
+	}
+	if (grantType !== "authorization_code" || form.get("code") !== "valid-code") return json({ error: "invalid_grant" }, 400);
+	if (!form.get("code_verifier")) return json({ error: "invalid_request" }, 400);
+	return json({
+		access_token: options.requiredBearerToken ?? "oauth-access-token",
+		...options.omitRefreshTokenOnConsent ? {} : { refresh_token: "oauth-refresh-token" },
+		token_type: "Bearer",
+		expires_in: tokenLifetimeSeconds,
+		scope: "tools"
+	});
+}
+/** Serves MCP at `<origin>/mcp`; metadata URLs derive from each request's origin. */
+function createTestMcpServer(options = { protocolVersion: "2026-07-28" }) {
+	const tools = options.tools ?? [echoTool];
+	const modernHandler = createMcpHandler(() => createMcpProtocolServer(tools), {
+		legacy: "reject",
+		responseMode: options.enableJsonResponse ? "auto" : "sse"
+	});
+	const sessions = /* @__PURE__ */ new Map();
+	let mcpRequestCount = 0;
+	let tokenRequestCount = 0;
+	let registrationCount = 0;
+	let tokenLifetimeSeconds = 3600;
+	const registeredClients = /* @__PURE__ */ new Set();
+	async function createSession() {
+		const server = createMcpProtocolServer(tools);
+		const transport = new WebStandardStreamableHTTPServerTransport({
+			sessionIdGenerator: () => crypto.randomUUID(),
+			onsessioninitialized: (sessionId) => {
+				sessions.set(sessionId, {
+					server,
+					transport
+				});
+			},
+			enableJsonResponse: options.enableJsonResponse ?? false
+		});
+		await server.connect(transport);
+		return {
+			server,
+			transport
+		};
+	}
+	async function handle(request) {
+		const url = new URL(request.url);
+		const baseUrl = url.origin;
+		if (options.oauth && url.pathname.startsWith("/.well-known/oauth-protected-resource")) return json({
+			resource: `${baseUrl}/mcp`,
+			authorization_servers: [baseUrl],
+			scopes_supported: ["tools"]
+		});
+		if (options.oauth && url.pathname === "/.well-known/oauth-authorization-server") return json({
+			issuer: baseUrl,
+			authorization_response_iss_parameter_supported: true,
+			authorization_endpoint: `${baseUrl}/authorize`,
+			token_endpoint: `${baseUrl}/token`,
+			...options.disableDynamicRegistration ? {} : { registration_endpoint: `${baseUrl}/register` },
+			response_types_supported: ["code"],
+			grant_types_supported: [
+				"authorization_code",
+				"refresh_token",
+				"client_credentials"
+			],
+			token_endpoint_auth_methods_supported: ["client_secret_post", "none"],
+			code_challenge_methods_supported: ["S256"]
+		});
+		if (options.oauth && !options.disableDynamicRegistration && url.pathname === "/register" && request.method === "POST") {
+			const rawBody = await request.text();
+			const metadata = rawBody ? JSON.parse(rawBody) : {};
+			registrationCount += 1;
+			const clientId = `test-client-${registrationCount}`;
+			registeredClients.add(clientId);
+			return json({
+				...metadata,
+				client_id: clientId,
+				client_secret: "test-secret"
+			});
+		}
+		if (options.oauth && url.pathname === "/authorize") {
+			const redirectUri = url.searchParams.get("redirect_uri");
+			if (!redirectUri) return new Response("Missing redirect_uri", { status: 400 });
+			if (!options.disableDynamicRegistration && !options.requiredClientId && !registeredClients.has(url.searchParams.get("client_id") ?? "")) return new Response("Unknown client", { status: 400 });
+			const redirect = new URL(redirectUri);
+			redirect.searchParams.set("code", "valid-code");
+			redirect.searchParams.set("iss", baseUrl);
+			const state = url.searchParams.get("state");
+			if (state) redirect.searchParams.set("state", state);
+			return new Response(null, {
+				status: 302,
+				headers: { Location: redirect.toString() }
+			});
+		}
+		if (options.oauth && url.pathname === "/token" && request.method === "POST") {
+			tokenRequestCount += 1;
+			return await handleToken(request, options, registeredClients, tokenLifetimeSeconds);
+		}
+		if (url.pathname !== "/mcp") return new Response("Not found", { status: 404 });
+		mcpRequestCount += 1;
+		if (options.requiredBearerToken && request.headers.get("authorization") !== `Bearer ${options.requiredBearerToken}`) return new Response("Unauthorized", {
+			status: 401,
+			headers: options.oauth ? { "WWW-Authenticate": `Bearer resource_metadata="${baseUrl}/.well-known/oauth-protected-resource/mcp"` } : {}
+		});
+		if (options.failAuthorizedMcpRequests) return new Response("MCP operation failed", { status: 500 });
+		if (options.protocolVersion === "2026-07-28") return await modernHandler.fetch(request);
+		const sessionId = request.headers.get("mcp-session-id");
+		return await ((sessionId ? sessions.get(sessionId) : void 0) ?? await createSession()).transport.handleRequest(request);
+	}
+	return {
+		fetch: async (request) => {
+			try {
+				return await handle(request);
+			} catch (error) {
+				return new Response(error instanceof Error ? error.message : "MCP transport error", { status: 500 });
+			}
+		},
+		getMcpRequestCount: () => mcpRequestCount,
+		getTokenRequestCount: () => tokenRequestCount,
+		forgetRegisteredClients: () => {
+			registeredClients.clear();
+		},
+		setTokenLifetimeSeconds: (seconds) => {
+			tokenLifetimeSeconds = seconds;
+		},
+		close: async () => {
+			await modernHandler.close();
+			for (const session of sessions.values()) {
+				await session.server.close();
+				await session.transport.close();
+			}
+			sessions.clear();
+		}
+	};
+}
+//#endregion
+export { createTestMcpServer };
+
+//# sourceMappingURL=mcp-test-server.js.map

package/dist/node/testing/mcp-test-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-test-server.js","names":[],"sources":["../../../src/testing/mcp-test-server.ts"],"sourcesContent":["import {\n  createMcpHandler,\n  Server,\n  WebStandardStreamableHTTPServerTransport,\n  type CallToolResult,\n  type Tool,\n} from \"@modelcontextprotocol/server\";\n\n/** Tools declare raw JSON Schemas so tests can publish any dialect a real server might. */\nexport interface TestMcpTool {\n  name: string;\n  title?: string;\n  description?: string;\n  inputSchema: Tool[\"inputSchema\"];\n  outputSchema?: Tool[\"outputSchema\"];\n  call: (args: Record<string, unknown>) => CallToolResult | Promise<CallToolResult>;\n}\n\nexport interface TestMcpServerOptions {\n  /** 2026-07-28 serves stateless requests only; 2025-11-25 serves sessions only. */\n  protocolVersion: \"2025-11-25\" | \"2026-07-28\";\n  requiredBearerToken?: string;\n  enableJsonResponse?: boolean;\n  tools?: readonly TestMcpTool[];\n  oauth?: boolean;\n  disableDynamicRegistration?: boolean;\n  requiredClientId?: string;\n  requiredClientSecret?: string;\n  refreshedRefreshToken?: string;\n  omitRefreshTokenOnRefresh?: boolean;\n  /** Consent grants only an access token, which stops working when it expires. */\n  omitRefreshTokenOnConsent?: boolean;\n  failAuthorizedMcpRequests?: boolean;\n}\n\n/** An in-process streamable HTTP MCP server, with optional OAuth, served from one origin. */\nexport interface TestMcpServer {\n  fetch: (request: Request) => Promise<Response>;\n  getMcpRequestCount: () => number;\n  getTokenRequestCount: () => number;\n  /** Rejects every client registered so far, as a server that lost its registrations would. */\n  forgetRegisteredClients: () => void;\n  /** Sets how long access tokens issued from now on last; one hour until changed. */\n  setTokenLifetimeSeconds: (seconds: number) => void;\n  close: () => Promise<void>;\n}\n\n// Servers built on the v1 SDK emit draft-07 schemas; this echo tool publishes the same dialect.\nconst echoTool: TestMcpTool = {\n  name: \"echo\",\n  title: \"Echo\",\n  description: \"Echo a message\",\n  inputSchema: {\n    $schema: \"http://json-schema.org/draft-07/schema#\",\n    type: \"object\",\n    properties: { text: { type: \"string\" } },\n    required: [\"text\"],\n    additionalProperties: false,\n  },\n  outputSchema: {\n    $schema: \"http://json-schema.org/draft-07/schema#\",\n    type: \"object\",\n    properties: { echoed: { type: \"string\" } },\n    required: [\"echoed\"],\n    additionalProperties: false,\n  },\n  call: ({ text }) => ({\n    content: [{ type: \"text\", text: String(text) }],\n    structuredContent: { echoed: String(text) },\n  }),\n};\n\nfunction json(body: unknown, status = 200) {\n  return Response.json(body, { status });\n}\n\nfunction requestClientId(request: Request, form: URLSearchParams) {\n  const authorization = request.headers.get(\"authorization\");\n  if (authorization?.startsWith(\"Basic \")) {\n    return atob(authorization.slice(\"Basic \".length)).split(\":\")[0];\n  }\n  return form.get(\"client_id\");\n}\n\nfunction hasExpectedClientAuth(\n  request: Request,\n  form: URLSearchParams,\n  options: TestMcpServerOptions,\n  registeredClients: ReadonlySet<string>,\n) {\n  if (!options.requiredClientId) {\n    // Registered clients authenticate only while the server still knows them.\n    return (\n      options.disableDynamicRegistration === true ||\n      registeredClients.has(requestClientId(request, form) ?? \"\")\n    );\n  }\n  const authorization = request.headers.get(\"authorization\");\n  if (authorization?.startsWith(\"Basic \")) {\n    return (\n      atob(authorization.slice(\"Basic \".length)) ===\n      `${options.requiredClientId}:${options.requiredClientSecret ?? \"\"}`\n    );\n  }\n  return (\n    form.get(\"client_id\") === options.requiredClientId &&\n    form.get(\"client_secret\") === (options.requiredClientSecret ?? \"\")\n  );\n}\n\nfunction createMcpProtocolServer(tools: readonly TestMcpTool[]) {\n  // oxlint-disable-next-line typescript/no-deprecated -- Raw JSON Schemas need the low-level server.\n  const server = new Server(\n    { name: \"fragno-test-mcp-server\", version: \"1.0.0\" },\n    { capabilities: tools.length > 0 ? { tools: {} } : {} },\n  );\n  if (tools.length > 0) {\n    server.setRequestHandler(\"tools/list\", () => ({\n      tools: tools.map(({ call: _call, ...tool }) => tool),\n    }));\n    server.setRequestHandler(\"tools/call\", async ({ params }) => {\n      const tool = tools.find((candidate) => candidate.name === params.name);\n      if (!tool) {\n        // Mirrors McpServer: an unknown tool is a tool error, not a protocol failure.\n        return {\n          isError: true,\n          content: [{ type: \"text\", text: `Tool ${params.name} not found` }],\n        };\n      }\n      // Low-level handlers project results themselves to match the negotiated protocol's wire shape.\n      return server.projectCallToolResult(\n        await tool.call(params.arguments ?? {}),\n        tool.outputSchema,\n      );\n    });\n  }\n  return server;\n}\n\nasync function handleToken(\n  request: Request,\n  options: TestMcpServerOptions,\n  registeredClients: ReadonlySet<string>,\n  tokenLifetimeSeconds: number,\n) {\n  const form = new URLSearchParams(await request.text());\n  if (!hasExpectedClientAuth(request, form, options, registeredClients)) {\n    return json({ error: \"invalid_client\" }, 401);\n  }\n  const grantType = form.get(\"grant_type\");\n  if (grantType === \"client_credentials\") {\n    return json({\n      access_token: options.requiredBearerToken ?? \"client-credentials-access-token\",\n      token_type: \"Bearer\",\n      expires_in: tokenLifetimeSeconds,\n      scope: form.get(\"scope\") ?? \"tools\",\n    });\n  }\n  if (grantType === \"refresh_token\") {\n    if (form.get(\"refresh_token\") !== \"oauth-refresh-token\") {\n      return json({ error: \"invalid_grant\" }, 400);\n    }\n    return json({\n      access_token: options.requiredBearerToken ?? \"oauth-access-token\",\n      ...(options.omitRefreshTokenOnRefresh\n        ? {}\n        : { refresh_token: options.refreshedRefreshToken ?? \"oauth-refresh-token\" }),\n      token_type: \"Bearer\",\n      expires_in: tokenLifetimeSeconds,\n      scope: \"tools\",\n    });\n  }\n  if (grantType !== \"authorization_code\" || form.get(\"code\") !== \"valid-code\") {\n    return json({ error: \"invalid_grant\" }, 400);\n  }\n  if (!form.get(\"code_verifier\")) {\n    return json({ error: \"invalid_request\" }, 400);\n  }\n  return json({\n    access_token: options.requiredBearerToken ?? \"oauth-access-token\",\n    ...(options.omitRefreshTokenOnConsent ? {} : { refresh_token: \"oauth-refresh-token\" }),\n    token_type: \"Bearer\",\n    expires_in: tokenLifetimeSeconds,\n    scope: \"tools\",\n  });\n}\n\n/** Serves MCP at `<origin>/mcp`; metadata URLs derive from each request's origin. */\nexport function createTestMcpServer(\n  options: TestMcpServerOptions = { protocolVersion: \"2026-07-28\" },\n): TestMcpServer {\n  const tools = options.tools ?? [echoTool];\n  const modernHandler = createMcpHandler(() => createMcpProtocolServer(tools), {\n    legacy: \"reject\",\n    responseMode: options.enableJsonResponse ? \"auto\" : \"sse\",\n  });\n  const sessions = new Map<\n    string,\n    {\n      // oxlint-disable-next-line typescript/no-deprecated -- See createMcpProtocolServer.\n      server: Server;\n      transport: WebStandardStreamableHTTPServerTransport;\n    }\n  >();\n  let mcpRequestCount = 0;\n  let tokenRequestCount = 0;\n  let registrationCount = 0;\n  let tokenLifetimeSeconds = 3600;\n  const registeredClients = new Set<string>();\n\n  async function createSession() {\n    const server = createMcpProtocolServer(tools);\n    const transport = new WebStandardStreamableHTTPServerTransport({\n      sessionIdGenerator: () => crypto.randomUUID(),\n      onsessioninitialized: (sessionId) => {\n        sessions.set(sessionId, { server, transport });\n      },\n      enableJsonResponse: options.enableJsonResponse ?? false,\n    });\n    await server.connect(transport);\n    return { server, transport };\n  }\n\n  async function handle(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    const baseUrl = url.origin;\n\n    if (options.oauth && url.pathname.startsWith(\"/.well-known/oauth-protected-resource\")) {\n      return json({\n        resource: `${baseUrl}/mcp`,\n        authorization_servers: [baseUrl],\n        scopes_supported: [\"tools\"],\n      });\n    }\n    if (options.oauth && url.pathname === \"/.well-known/oauth-authorization-server\") {\n      return json({\n        issuer: baseUrl,\n        authorization_response_iss_parameter_supported: true,\n        authorization_endpoint: `${baseUrl}/authorize`,\n        token_endpoint: `${baseUrl}/token`,\n        ...(options.disableDynamicRegistration\n          ? {}\n          : { registration_endpoint: `${baseUrl}/register` }),\n        response_types_supported: [\"code\"],\n        grant_types_supported: [\"authorization_code\", \"refresh_token\", \"client_credentials\"],\n        token_endpoint_auth_methods_supported: [\"client_secret_post\", \"none\"],\n        code_challenge_methods_supported: [\"S256\"],\n      });\n    }\n    if (\n      options.oauth &&\n      !options.disableDynamicRegistration &&\n      url.pathname === \"/register\" &&\n      request.method === \"POST\"\n    ) {\n      const rawBody = await request.text();\n      const metadata = rawBody ? (JSON.parse(rawBody) as Record<string, unknown>) : {};\n      registrationCount += 1;\n      const clientId = `test-client-${registrationCount}`;\n      registeredClients.add(clientId);\n      return json({ ...metadata, client_id: clientId, client_secret: \"test-secret\" });\n    }\n    if (options.oauth && url.pathname === \"/authorize\") {\n      // Consent is immediate: the redirect carries a fixed code and the caller's state.\n      const redirectUri = url.searchParams.get(\"redirect_uri\");\n      if (!redirectUri) {\n        return new Response(\"Missing redirect_uri\", { status: 400 });\n      }\n      if (\n        !options.disableDynamicRegistration &&\n        !options.requiredClientId &&\n        !registeredClients.has(url.searchParams.get(\"client_id\") ?? \"\")\n      ) {\n        return new Response(\"Unknown client\", { status: 400 });\n      }\n      const redirect = new URL(redirectUri);\n      redirect.searchParams.set(\"code\", \"valid-code\");\n      redirect.searchParams.set(\"iss\", baseUrl);\n      const state = url.searchParams.get(\"state\");\n      if (state) {\n        redirect.searchParams.set(\"state\", state);\n      }\n      return new Response(null, { status: 302, headers: { Location: redirect.toString() } });\n    }\n    if (options.oauth && url.pathname === \"/token\" && request.method === \"POST\") {\n      tokenRequestCount += 1;\n      return await handleToken(request, options, registeredClients, tokenLifetimeSeconds);\n    }\n    if (url.pathname !== \"/mcp\") {\n      return new Response(\"Not found\", { status: 404 });\n    }\n\n    mcpRequestCount += 1;\n    if (\n      options.requiredBearerToken &&\n      request.headers.get(\"authorization\") !== `Bearer ${options.requiredBearerToken}`\n    ) {\n      return new Response(\"Unauthorized\", {\n        status: 401,\n        headers: options.oauth\n          ? {\n              \"WWW-Authenticate\": `Bearer resource_metadata=\"${baseUrl}/.well-known/oauth-protected-resource/mcp\"`,\n            }\n          : {},\n      });\n    }\n    if (options.failAuthorizedMcpRequests) {\n      return new Response(\"MCP operation failed\", { status: 500 });\n    }\n    if (options.protocolVersion === \"2026-07-28\") {\n      return await modernHandler.fetch(request);\n    }\n    const sessionId = request.headers.get(\"mcp-session-id\");\n    const session = (sessionId ? sessions.get(sessionId) : undefined) ?? (await createSession());\n    return await session.transport.handleRequest(request);\n  }\n\n  return {\n    fetch: async (request) => {\n      try {\n        return await handle(request);\n      } catch (error) {\n        return new Response(error instanceof Error ? error.message : \"MCP transport error\", {\n          status: 500,\n        });\n      }\n    },\n    getMcpRequestCount: () => mcpRequestCount,\n    getTokenRequestCount: () => tokenRequestCount,\n    forgetRegisteredClients: () => {\n      registeredClients.clear();\n    },\n    setTokenLifetimeSeconds: (seconds) => {\n      tokenLifetimeSeconds = seconds;\n    },\n    close: async () => {\n      await modernHandler.close();\n      for (const session of sessions.values()) {\n        await session.server.close();\n        await session.transport.close();\n      }\n      sessions.clear();\n    },\n  };\n}\n"],"mappings":";;AAgDA,MAAM,WAAwB;CAC5B,MAAM;CACN,OAAO;CACP,aAAa;CACb,aAAa;EACX,SAAS;EACT,MAAM;EACN,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE;EACvC,UAAU,CAAC,MAAM;EACjB,sBAAsB;CACxB;CACA,cAAc;EACZ,SAAS;EACT,MAAM;EACN,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,EAAE;EACzC,UAAU,CAAC,QAAQ;EACnB,sBAAsB;CACxB;CACA,OAAO,EAAE,YAAY;EACnB,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,OAAO,IAAI;EAAE,CAAC;EAC9C,mBAAmB,EAAE,QAAQ,OAAO,IAAI,EAAE;CAC5C;AACF;AAEA,SAAS,KAAK,MAAe,SAAS,KAAK;CACzC,OAAO,SAAS,KAAK,MAAM,EAAE,OAAO,CAAC;AACvC;AAEA,SAAS,gBAAgB,SAAkB,MAAuB;CAChE,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,eAAe;CACzD,IAAI,eAAe,WAAW,QAAQ,GACpC,OAAO,KAAK,cAAc,MAAM,CAAe,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;CAE/D,OAAO,KAAK,IAAI,WAAW;AAC7B;AAEA,SAAS,sBACP,SACA,MACA,SACA,mBACA;CACA,IAAI,CAAC,QAAQ,kBAEX,OACE,QAAQ,+BAA+B,QACvC,kBAAkB,IAAI,gBAAgB,SAAS,IAAI,KAAK,EAAE;CAG9D,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,eAAe;CACzD,IAAI,eAAe,WAAW,QAAQ,GACpC,OACE,KAAK,cAAc,MAAM,CAAe,CAAC,MACzC,GAAG,QAAQ,iBAAiB,GAAG,QAAQ,wBAAwB;CAGnE,OACE,KAAK,IAAI,WAAW,MAAM,QAAQ,oBAClC,KAAK,IAAI,eAAe,OAAO,QAAQ,wBAAwB;AAEnE;AAEA,SAAS,wBAAwB,OAA+B;CAE9D,MAAM,SAAS,IAAI,OACjB;EAAE,MAAM;EAA0B,SAAS;CAAQ,GACnD,EAAE,cAAc,MAAM,SAAS,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,CACxD;CACA,IAAI,MAAM,SAAS,GAAG;EACpB,OAAO,kBAAkB,qBAAqB,EAC5C,OAAO,MAAM,KAAK,EAAE,MAAM,OAAO,GAAG,WAAW,IAAI,EACrD,EAAE;EACF,OAAO,kBAAkB,cAAc,OAAO,EAAE,aAAa;GAC3D,MAAM,OAAO,MAAM,MAAM,cAAc,UAAU,SAAS,OAAO,IAAI;GACrE,IAAI,CAAC,MAEH,OAAO;IACL,SAAS;IACT,SAAS,CAAC;KAAE,MAAM;KAAQ,MAAM,QAAQ,OAAO,KAAK;IAAY,CAAC;GACnE;GAGF,OAAO,OAAO,sBACZ,MAAM,KAAK,KAAK,OAAO,aAAa,CAAC,CAAC,GACtC,KAAK,YACP;EACF,CAAC;CACH;CACA,OAAO;AACT;AAEA,eAAe,YACb,SACA,SACA,mBACA,sBACA;CACA,MAAM,OAAO,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC;CACrD,IAAI,CAAC,sBAAsB,SAAS,MAAM,SAAS,iBAAiB,GAClE,OAAO,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;CAE9C,MAAM,YAAY,KAAK,IAAI,YAAY;CACvC,IAAI,cAAc,sBAChB,OAAO,KAAK;EACV,cAAc,QAAQ,uBAAuB;EAC7C,YAAY;EACZ,YAAY;EACZ,OAAO,KAAK,IAAI,OAAO,KAAK;CAC9B,CAAC;CAEH,IAAI,cAAc,iBAAiB;EACjC,IAAI,KAAK,IAAI,eAAe,MAAM,uBAChC,OAAO,KAAK,EAAE,OAAO,gBAAgB,GAAG,GAAG;EAE7C,OAAO,KAAK;GACV,cAAc,QAAQ,uBAAuB;GAC7C,GAAI,QAAQ,4BACR,CAAC,IACD,EAAE,eAAe,QAAQ,yBAAyB,sBAAsB;GAC5E,YAAY;GACZ,YAAY;GACZ,OAAO;EACT,CAAC;CACH;CACA,IAAI,cAAc,wBAAwB,KAAK,IAAI,MAAM,MAAM,cAC7D,OAAO,KAAK,EAAE,OAAO,gBAAgB,GAAG,GAAG;CAE7C,IAAI,CAAC,KAAK,IAAI,eAAe,GAC3B,OAAO,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;CAE/C,OAAO,KAAK;EACV,cAAc,QAAQ,uBAAuB;EAC7C,GAAI,QAAQ,4BAA4B,CAAC,IAAI,EAAE,eAAe,sBAAsB;EACpF,YAAY;EACZ,YAAY;EACZ,OAAO;CACT,CAAC;AACH;;AAGA,SAAgB,oBACd,UAAgC,EAAE,iBAAiB,aAAa,GACjD;CACf,MAAM,QAAQ,QAAQ,SAAS,CAAC,QAAQ;CACxC,MAAM,gBAAgB,uBAAuB,wBAAwB,KAAK,GAAG;EAC3E,QAAQ;EACR,cAAc,QAAQ,qBAAqB,SAAS;CACtD,CAAC;CACD,MAAM,2BAAW,IAAI,IAOnB;CACF,IAAI,kBAAkB;CACtB,IAAI,oBAAoB;CACxB,IAAI,oBAAoB;CACxB,IAAI,uBAAuB;CAC3B,MAAM,oCAAoB,IAAI,IAAY;CAE1C,eAAe,gBAAgB;EAC7B,MAAM,SAAS,wBAAwB,KAAK;EAC5C,MAAM,YAAY,IAAI,yCAAyC;GAC7D,0BAA0B,OAAO,WAAW;GAC5C,uBAAuB,cAAc;IACnC,SAAS,IAAI,WAAW;KAAE;KAAQ;IAAU,CAAC;GAC/C;GACA,oBAAoB,QAAQ,sBAAsB;EACpD,CAAC;EACD,MAAM,OAAO,QAAQ,SAAS;EAC9B,OAAO;GAAE;GAAQ;EAAU;CAC7B;CAEA,eAAe,OAAO,SAAqC;EACzD,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAC/B,MAAM,UAAU,IAAI;EAEpB,IAAI,QAAQ,SAAS,IAAI,SAAS,WAAW,uCAAuC,GAClF,OAAO,KAAK;GACV,UAAU,GAAG,QAAQ;GACrB,uBAAuB,CAAC,OAAO;GAC/B,kBAAkB,CAAC,OAAO;EAC5B,CAAC;EAEH,IAAI,QAAQ,SAAS,IAAI,aAAa,2CACpC,OAAO,KAAK;GACV,QAAQ;GACR,gDAAgD;GAChD,wBAAwB,GAAG,QAAQ;GACnC,gBAAgB,GAAG,QAAQ;GAC3B,GAAI,QAAQ,6BACR,CAAC,IACD,EAAE,uBAAuB,GAAG,QAAQ,WAAW;GACnD,0BAA0B,CAAC,MAAM;GACjC,uBAAuB;IAAC;IAAsB;IAAiB;GAAoB;GACnF,uCAAuC,CAAC,sBAAsB,MAAM;GACpE,kCAAkC,CAAC,MAAM;EAC3C,CAAC;EAEH,IACE,QAAQ,SACR,CAAC,QAAQ,8BACT,IAAI,aAAa,eACjB,QAAQ,WAAW,QACnB;GACA,MAAM,UAAU,MAAM,QAAQ,KAAK;GACnC,MAAM,WAAW,UAAW,KAAK,MAAM,OAAO,IAAgC,CAAC;GAC/E,qBAAqB;GACrB,MAAM,WAAW,eAAe;GAChC,kBAAkB,IAAI,QAAQ;GAC9B,OAAO,KAAK;IAAE,GAAG;IAAU,WAAW;IAAU,eAAe;GAAc,CAAC;EAChF;EACA,IAAI,QAAQ,SAAS,IAAI,aAAa,cAAc;GAElD,MAAM,cAAc,IAAI,aAAa,IAAI,cAAc;GACvD,IAAI,CAAC,aACH,OAAO,IAAI,SAAS,wBAAwB,EAAE,QAAQ,IAAI,CAAC;GAE7D,IACE,CAAC,QAAQ,8BACT,CAAC,QAAQ,oBACT,CAAC,kBAAkB,IAAI,IAAI,aAAa,IAAI,WAAW,KAAK,EAAE,GAE9D,OAAO,IAAI,SAAS,kBAAkB,EAAE,QAAQ,IAAI,CAAC;GAEvD,MAAM,WAAW,IAAI,IAAI,WAAW;GACpC,SAAS,aAAa,IAAI,QAAQ,YAAY;GAC9C,SAAS,aAAa,IAAI,OAAO,OAAO;GACxC,MAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;GAC1C,IAAI,OACF,SAAS,aAAa,IAAI,SAAS,KAAK;GAE1C,OAAO,IAAI,SAAS,MAAM;IAAE,QAAQ;IAAK,SAAS,EAAE,UAAU,SAAS,SAAS,EAAE;GAAE,CAAC;EACvF;EACA,IAAI,QAAQ,SAAS,IAAI,aAAa,YAAY,QAAQ,WAAW,QAAQ;GAC3E,qBAAqB;GACrB,OAAO,MAAM,YAAY,SAAS,SAAS,mBAAmB,oBAAoB;EACpF;EACA,IAAI,IAAI,aAAa,QACnB,OAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;EAGlD,mBAAmB;EACnB,IACE,QAAQ,uBACR,QAAQ,QAAQ,IAAI,eAAe,MAAM,UAAU,QAAQ,uBAE3D,OAAO,IAAI,SAAS,gBAAgB;GAClC,QAAQ;GACR,SAAS,QAAQ,QACb,EACE,oBAAoB,6BAA6B,QAAQ,4CAC3D,IACA,CAAC;EACP,CAAC;EAEH,IAAI,QAAQ,2BACV,OAAO,IAAI,SAAS,wBAAwB,EAAE,QAAQ,IAAI,CAAC;EAE7D,IAAI,QAAQ,oBAAoB,cAC9B,OAAO,MAAM,cAAc,MAAM,OAAO;EAE1C,MAAM,YAAY,QAAQ,QAAQ,IAAI,gBAAgB;EAEtD,OAAO,QADU,YAAY,SAAS,IAAI,SAAS,IAAI,KAAA,MAAe,MAAM,cAAc,EAAA,CACrE,UAAU,cAAc,OAAO;CACtD;CAEA,OAAO;EACL,OAAO,OAAO,YAAY;GACxB,IAAI;IACF,OAAO,MAAM,OAAO,OAAO;GAC7B,SAAS,OAAO;IACd,OAAO,IAAI,SAAS,iBAAiB,QAAQ,MAAM,UAAU,uBAAuB,EAClF,QAAQ,IACV,CAAC;GACH;EACF;EACA,0BAA0B;EAC1B,4BAA4B;EAC5B,+BAA+B;GAC7B,kBAAkB,MAAM;EAC1B;EACA,0BAA0B,YAAY;GACpC,uBAAuB;EACzB;EACA,OAAO,YAAY;GACjB,MAAM,cAAc,MAAM;GAC1B,KAAK,MAAM,WAAW,SAAS,OAAO,GAAG;IACvC,MAAM,QAAQ,OAAO,MAAM;IAC3B,MAAM,QAAQ,UAAU,MAAM;GAChC;GACA,SAAS,MAAM;EACjB;CACF;AACF"}

package/package.json

@@ -1,6 +1,133 @@
 {
   "name": "@fragno-dev/mcp-fragment",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.0.3",
+  "description": "A Fragno fragment",
+  "keywords": [
+    "fragno",
+    "react",
+    "solidjs",
+    "svelte",
+    "typescript",
+    "vue"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/rejot-dev/fragno.git",
+    "directory": "packages/mcp-fragment"
+  },
+  "bin": {
+    "fragno-mcp": "./bin/run.js"
+  },
+  "files": [
+    "dist",
+    "bin"
+  ],
+  "type": "module",
+  "main": "./dist/node/index.js",
+  "module": "./dist/node/index.js",
+  "types": "./dist/node/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/node/index.d.ts",
+      "default": "./dist/node/index.js"
+    },
+    "./cli": {
+      "types": "./dist/cli/cli.d.ts",
+      "default": "./dist/cli/cli.js"
+    },
+    "./definition": {
+      "types": "./dist/node/definition.d.ts",
+      "default": "./dist/node/definition.js"
+    },
+    "./dist/node/definition.js": {
+      "types": "./dist/node/definition.d.ts",
+      "default": "./dist/node/definition.js"
+    },
+    "./routes": {
+      "types": "./dist/node/routes.d.ts",
+      "default": "./dist/node/routes.js"
+    },
+    "./dist/node/routes.js": {
+      "types": "./dist/node/routes.d.ts",
+      "default": "./dist/node/routes.js"
+    },
+    "./schema": {
+      "types": "./dist/node/schema.d.ts",
+      "default": "./dist/node/schema.js"
+    },
+    "./dist/node/schema.js": {
+      "types": "./dist/node/schema.d.ts",
+      "default": "./dist/node/schema.js"
+    },
+    "./types": {
+      "types": "./dist/node/mcp-types.d.ts",
+      "default": "./dist/node/mcp-types.js"
+    },
+    "./dist/node/mcp-types.js": {
+      "types": "./dist/node/mcp-types.d.ts",
+      "default": "./dist/node/mcp-types.js"
+    },
+    "./testing": {
+      "types": "./dist/node/testing/mcp-test-server.d.ts",
+      "default": "./dist/node/testing/mcp-test-server.js"
+    },
+    "./react": {
+      "types": "./dist/browser/client/react.d.ts",
+      "default": "./dist/browser/client/react.js"
+    },
+    "./vue": {
+      "types": "./dist/browser/client/vue.d.ts",
+      "default": "./dist/browser/client/vue.js"
+    },
+    "./svelte": {
+      "types": "./dist/browser/client/svelte.d.ts",
+      "default": "./dist/browser/client/svelte.js"
+    },
+    "./solid": {
+      "types": "./dist/browser/client/solid.d.ts",
+      "default": "./dist/browser/client/solid.js"
+    },
+    "./vanilla": {
+      "types": "./dist/browser/client/vanilla.d.ts",
+      "default": "./dist/browser/client/vanilla.js"
+    }
+  },
+  "dependencies": {
+    "@modelcontextprotocol/client": "2.3.1",
+    "@modelcontextprotocol/server": "2.3.1",
+    "@standard-schema/spec": "^1.1.0",
+    "zod": "^4.6.7",
+    "@fragno-dev/core": "0.2.2",
+    "@fragno-dev/db": "0.4.1",
+    "@fragno-dev/node": "0.0.9"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.5",
+    "@vitest/coverage-istanbul": "^5.0.4",
+    "tsdown": "^0.23.1",
+    "vitest": "^5.0.4",
+    "@fragno-dev/test": "2.0.2",
+    "@fragno-dev/unplugin-fragno": "0.0.9",
+    "@fragno-private/typescript-config": "0.0.1",
+    "@fragno-dev/cli": "0.2.3",
+    "@fragno-private/vitest-config": "0.0.0"
+  },
+  "peerDependencies": {
+    "react": ">=18.0.0",
+    "solid-js": ">=1.0.0",
+    "svelte": ">=4.0.0",
+    "typescript": "npm:@typescript/typescript6@^6.0.2",
+    "vue": ">=3.0.0"
+  },
+  "scripts": {
+    "types:check": "tsc --noEmit",
+    "build": "tsdown",
+    "cli": "tsx src/cli/cli.ts",
+    "test": "vitest run",
+    "test:watch": "vitest --watch",
+    "format:package": "node ../../scripts/run-package-quality.mjs format",
+    "format:check:package": "node ../../scripts/run-package-quality.mjs format:check",
+    "lint:package": "node ../../scripts/run-package-quality.mjs lint",
+    "lint:fix:package": "node ../../scripts/run-package-quality.mjs lint:fix"
+  }
 }