@ganintegrity/mcp 1.0.0 → 1.1.0

package/dist/core/dispatch.js

@@ -0,0 +1,57 @@
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { requestStore } from "./als.js";
+import { materializeSdkServer } from "./define.js";
+/**
+ * Framework-neutral per-request dispatcher.
+ *
+ * Builds the {@link RequestStore} from `scope` + `mcp.errorMapper`,
+ * materialises a fresh SDK `McpServer` (with all tools replayed onto it),
+ * connects a fresh transport, runs `invokeTransport` inside
+ * `requestStore.run(...)` so tool handlers can pull request context from
+ * ALS, and tears server + transport down in `finally`. A failing close is
+ * logged at warn but never re-thrown.
+ *
+ * If `invokeTransport` throws, the error is logged at error level and
+ * `onTransportError` is called so the framework adapter can write a 500
+ * onto its native response object (with whatever headers-sent guard it
+ * uses). The error is otherwise swallowed — this is the request boundary.
+ *
+ * Never throws.
+ */
+export async function dispatchMcpRequest(mcp, logger, scope, invokeTransport, onTransportError) {
+    const { user, postgan, sessionId } = scope;
+    const store = {
+        user,
+        postgan,
+        sessionId,
+        logger: logger.child({
+            sessionId,
+            userId: user.id,
+            company: user.companySubdomainName,
+        }),
+        errorMapper: mcp.errorMapper,
+    };
+    const requestServer = materializeSdkServer(mcp);
+    const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: undefined,
+    });
+    await requestServer.connect(transport);
+    await requestStore.run(store, async () => {
+        try {
+            await invokeTransport(transport);
+        }
+        catch (err) {
+            logger.error({ err, sessionId }, "mcp: transport.handleRequest threw");
+            onTransportError();
+        }
+        finally {
+            await transport.close().catch((closeErr) => {
+                logger.warn({ err: closeErr }, "mcp: transport close failed");
+            });
+            await requestServer.close().catch((closeErr) => {
+                logger.warn({ err: closeErr }, "mcp: server close failed");
+            });
+        }
+    });
+}
+//# sourceMappingURL=dispatch.js.map

package/dist/core/dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../src/core/dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAInG,OAAO,EAAE,YAAY,EAAqB,MAAM,UAAU,CAAC;AAE3D,OAAO,EAAE,oBAAoB,EAAsB,MAAM,aAAa,CAAC;AAavE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAkB,EAClB,MAAc,EACd,KAAoB,EACpB,eAA4E,EAC5E,gBAA4B;IAE5B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC3C,MAAM,KAAK,GAAiB;QAC1B,IAAI;QACJ,OAAO;QACP,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;YACnB,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,OAAO,EAAE,IAAI,CAAC,oBAAoB;SACnC,CAAC;QACF,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC;IAEF,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;QAClD,kBAAkB,EAAE,SAAS;KAC9B,CAAC,CAAC;IACH,MAAM,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEvC,MAAM,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QACvC,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,oCAAoC,CAAC,CAAC;YACvE,gBAAgB,EAAE,CAAC;QACrB,CAAC;gBAAS,CAAC;YACT,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,QAAiB,EAAE,EAAE;gBAClD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,6BAA6B,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,QAAiB,EAAE,EAAE;gBACtD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,0BAA0B,CAAC,CAAC;YAC7D,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/errors/errors.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.types.d.ts","sourceRoot":"","sources":["../../../src/core/errors/errors.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,gFAAgF;IAChF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,YAAY,GAAG,IAAI,CAAC;AAEnE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB"}

package/dist/core/errors/errors.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.types.js","sourceRoot":"","sources":["../../../src/core/errors/errors.types.ts"],"names":[],"mappings":""}

package/dist/core/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,cAAc,mBAAmB,CAAC;AA+D/C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,YAAY,GAAG,IAAI,EAC3B,WAAW,EAAE,OAAO,EACpB,IAAI,EAAE,aAAa,GAClB,cAAc,CAMhB"}

package/dist/core/errors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/errors/index.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C,SAAS,cAAc,CAAC,MAAoB,EAAE,IAAmB;IAC/D,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf;YACE,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,EACD,iBAAiB,CAClB,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,MAAM,CAAC,IAAI,CACd;YACE,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,EACD,mBAAmB,CACpB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAoB;IAC1C,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACjD,iBAAiB,EAAE;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,GAAY,EACZ,IAAmB;IAEnB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,KAAK,CACf;QACE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAC3C,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,EACD,0BAA0B,CAC3B,CAAC;IACF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iDAAiD,EAAE;SAC1E;QACD,iBAAiB,EAAE;YACjB,IAAI,EAAE,cAAc;YACpB,OAAO;SACR;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA2B,EAC3B,WAAoB,EACpB,IAAmB;IAEnB,IAAI,MAAM,EAAE,CAAC;QACX,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC"}

package/dist/core/test-helpers.d.ts

@@ -0,0 +1,20 @@
+import { vi } from "vitest";
+import type { Logger } from "pino";
+/**
+ * A pino-shaped mock logger. `child()` returns the same logger so assertions
+ * on `logger.error` capture calls from child loggers too — required for
+ * tests that exercise code paths which child the logger before logging.
+ */
+export declare function makeLogger(): Logger;
+export interface MockTransaction {
+    active: boolean;
+    begin: ReturnType<typeof vi.fn>;
+    commit: ReturnType<typeof vi.fn>;
+    rollback: ReturnType<typeof vi.fn>;
+}
+/**
+ * Mock postgan transaction with `commit` / `rollback` flipping `active` to
+ * false to mirror real postgan behaviour.
+ */
+export declare function makeTransaction(): MockTransaction;
+//# sourceMappingURL=test-helpers.d.ts.map

package/dist/core/test-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-helpers.d.ts","sourceRoot":"","sources":["../../src/core/test-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC;;;;GAIG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAanC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACjC,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACpC;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,eAAe,CAYjD"}

package/dist/core/test-helpers.js

@@ -0,0 +1,38 @@
+import { vi } from "vitest";
+/**
+ * A pino-shaped mock logger. `child()` returns the same logger so assertions
+ * on `logger.error` capture calls from child loggers too — required for
+ * tests that exercise code paths which child the logger before logging.
+ */
+export function makeLogger() {
+    const logger = {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn(),
+        fatal: vi.fn(),
+        trace: vi.fn(),
+    };
+    // Cast through `Logger["child"]` because pino's child is generic over a
+    // custom-levels type parameter that vi.fn() can't satisfy directly.
+    logger.child = vi.fn(() => logger);
+    return logger;
+}
+/**
+ * Mock postgan transaction with `commit` / `rollback` flipping `active` to
+ * false to mirror real postgan behaviour.
+ */
+export function makeTransaction() {
+    const tx = {
+        active: true,
+        begin: vi.fn().mockResolvedValue(undefined),
+        commit: vi.fn().mockImplementation(async () => {
+            tx.active = false;
+        }),
+        rollback: vi.fn().mockImplementation(async () => {
+            tx.active = false;
+        }),
+    };
+    return tx;
+}
+//# sourceMappingURL=test-helpers.js.map

package/dist/core/test-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-helpers.js","sourceRoot":"","sources":["../../src/core/test-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG5B;;;;GAIG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,MAAM,GAAoB;QAC9B,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;QACb,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;QACb,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;QACd,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;QACd,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;QACd,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;KACf,CAAC;IACF,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAgB,CAA+B,CAAC;IAC3E,OAAO,MAAgB,CAAC;AAC1B,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,GAAoB;QAC1B,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAC3C,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE;YAC5C,EAAE,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,CAAC,CAAC;QACF,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE;YAC9C,EAAE,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,CAAC,CAAC;KACH,CAAC;IACF,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/core/tool/index.d.ts

@@ -0,0 +1,19 @@
+import type { z } from "zod";
+import type { ToolRegistration, ToolSpec } from "./tool.types.ts";
+/**
+ * Wrap a {@link ToolSpec} into an SDK-shaped {@link ToolRegistration}. The
+ * wrapped handler:
+ *
+ * 1. Reads the active request scope from `requestStore` (ALS).
+ * 2. Opens a fresh `Postgan.Transaction`.
+ * 3. Builds a {@link ToolContext} and invokes the consumer's handler.
+ * 4. Commits on resolve and returns a `CallToolResult` carrying the result
+ *    as both a JSON `text` block and `structuredContent`.
+ * 5. On throw: rolls back the transaction and routes the error through the
+ *    request store's `errorMapper` to build an error envelope.
+ *
+ * Internal — `defineMcpServer`'s `register.tool(spec)` calls this and
+ * pushes the result onto the definition's registration array.
+ */
+export declare function wrapToolHandler<Schema extends z.ZodObject, Output extends Record<string, unknown>>(spec: ToolSpec<Schema, Output>): ToolRegistration;
+//# sourceMappingURL=index.d.ts.map

package/dist/core/tool/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/tool/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAI7B,OAAO,KAAK,EAAe,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AA6B/E;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAC7B,MAAM,SAAS,CAAC,CAAC,SAAS,EAC1B,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gBAAgB,CA0DlD"}

package/dist/{tool → core/tool}/index.js

@@ -24,35 +24,25 @@ async function withTransaction(postgan, logger, body) {
     }
 }
 /**
- * Register a tool against the MCP server returned by `createMcpServer()`.
- * The wrapper around your handler:
+ * Wrap a {@link ToolSpec} into an SDK-shaped {@link ToolRegistration}. The
+ * wrapped handler:
  *
- * 1. Builds a {@link ToolContext} from the active request scope.
- * 2. Opens a fresh `Postgan.Transaction` before calling your handler.
- * 3. On resolve, commits the transaction and returns a `CallToolResult`
- *    where the handler's return value is surfaced both as a JSON `text`
- *    content block (for non-structured-aware clients) and as
- *    `structuredContent` (for AI-SDK clients).
- * 4. On throw, rolls back the transaction and routes the error through
- *    the consumer's `McpErrorMapper` (passed to `createMcpServer`) to
- *    build an MCP error envelope.
+ * 1. Reads the active request scope from `requestStore` (ALS).
+ * 2. Opens a fresh `Postgan.Transaction`.
+ * 3. Builds a {@link ToolContext} and invokes the consumer's handler.
+ * 4. Commits on resolve and returns a `CallToolResult` carrying the result
+ *    as both a JSON `text` block and `structuredContent`.
+ * 5. On throw: rolls back the transaction and routes the error through the
+ *    request store's `errorMapper` to build an error envelope.
  *
- * Registration itself is synchronous and does not throw. The wrapped handler
- * **may** throw at request time — but only if it is invoked outside an
- * active request scope, which indicates a programming bug (the handler was
- * dispatched without going through `mount()`'s ALS wrapper). Such throws
- * propagate to the SDK transport and surface as an HTTP 500. Errors raised
- * by your own handler logic are caught and never propagate.
+ * Internal — `defineMcpServer`'s `register.tool(spec)` calls this and
+ * pushes the result onto the definition's registration array.
  */
-export function tool(server, spec) {
-    server.registerTool(spec.name, {
-        description: spec.description,
-        inputSchema: spec.inputSchema.shape,
-        ...(spec.annotations ? { annotations: spec.annotations } : {}),
-    }, async (args, extra) => {
+export function wrapToolHandler(spec) {
+    const handler = async (args, extra) => {
         const store = requestStore.getStore();
         if (!store) {
-            // Unreachable: createMcpServer.mount() always wraps tool dispatch in
+            // Unreachable in practice: adapters always wrap dispatch in
             // requestStore.run(). Throw to surface the bug rather than silently
             // returning an error envelope without a logger.
             throw new Error("mcp tool invoked outside request scope");
@@ -83,6 +73,19 @@ export function tool(server, spec) {
                 logger,
             });
         }
-    });
+    };
+    return {
+        name: spec.name,
+        config: {
+            description: spec.description,
+            inputSchema: spec.inputSchema.shape,
+            ...(spec.annotations ? { annotations: spec.annotations } : {}),
+        },
+        // Cast: ToolRegistration intentionally uses loose types because the
+        // SDK's `registerTool` is generically overloaded; the cast at this
+        // boundary lets the wrapped handler's specific signature flow through
+        // unchanged at the SDK call site in `materializeSdkServer`.
+        handler: handler,
+    };
 }
 //# sourceMappingURL=index.js.map

package/dist/core/tool/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/tool/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,MAAc,EACd,IAA4C;IAE5C,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;YACd,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,WAAoB,EAAE,EAAE;gBACjD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,kCAAkC,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAG7B,IAA8B;IAC9B,MAAM,OAAO,GAAG,KAAK,EACnB,IAAqB,EACrB,KAA6B,EACJ,EAAE;QAC3B,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,4DAA4D;YAC5D,oEAAoE;YACpE,gDAAgD;YAChD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,EAAE,SAAS,CAAC;QACtD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,KAAK,CAAC,OAAO,EACb,MAAM,EACN,CAAC,WAAW,EAAmB,EAAE;gBAC/B,MAAM,GAAG,GAAgB;oBACvB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,WAAW;oBACX,SAAS;oBACT,MAAM;iBACP,CAAC;gBACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACjC,CAAC,CACF,CAAC;YACF,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzD,iBAAiB,EAAE,MAAM;aAC1B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YAChD,OAAO,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS;gBACT,MAAM;aACP,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE;YACN,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK;YACnC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D;QACD,oEAAoE;QACpE,mEAAmE;QACnE,sEAAsE;QACtE,4DAA4D;QAC5D,OAAO,EAAE,OAAiD;KAC3D,CAAC;AACJ,CAAC"}

package/dist/{tool → core/tool}/tool.types.d.ts

@@ -69,4 +69,25 @@ export interface ToolSpec<Schema extends z.ZodObject, Output> {
      */
     handler: (args: z.infer<Schema>, ctx: ToolContext) => Promise<Output>;
 }
+/**
+ * Internal data shape produced by `wrapToolHandler` and held on
+ * `McpDefinition.registrations`. Loose types here — the SDK's
+ * `registerTool` is generically overloaded so `Parameters<>` resolves
+ * unhelpfully; `materializeSdkServer` casts at the boundary.
+ *
+ * Consumers never construct or inspect `ToolRegistration` directly.
+ */
+export interface ToolRegistration {
+    name: string;
+    config: object;
+    handler: (...args: unknown[]) => Promise<unknown>;
+}
+/**
+ * What `defineMcpServer({ tools })` hands to its callback. The single
+ * `tool(spec)` method captures each registration into the underlying
+ * {@link McpDefinition}.
+ */
+export interface ToolRegister {
+    tool<Schema extends z.ZodObject, Output extends Record<string, unknown>>(spec: ToolSpec<Schema, Output>): void;
+}
 //# sourceMappingURL=tool.types.d.ts.map

package/dist/core/tool/tool.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool.types.d.ts","sourceRoot":"","sources":["../../../src/core/tool/tool.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,IAAI,EAAE,QAAQ,CAAC;IACf,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,WAAW,EAAE,kBAAkB,CAAC;IAChC,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mDAAmD;IACnD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,yEAAyE;IACzE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,oFAAoF;IACpF,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ,CAAC,MAAM,SAAS,CAAC,CAAC,SAAS,EAAE,MAAM;IAC1D,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;;;OAKG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACvE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACnD;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,SAAS,CAAC,CAAC,SAAS,EAAE,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,IAAI,CAAC;CACT"}

package/dist/{tool → core/tool}/tool.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool.types.js","sourceRoot":"","sources":["../../src/tool/tool.types.ts"],"names":[],"mappings":""}
+{"version":3,"file":"tool.types.js","sourceRoot":"","sources":["../../../src/core/tool/tool.types.ts"],"names":[],"mappings":""}

package/dist/{auth/index.d.ts → express/auth.d.ts}

@@ -1,11 +1,10 @@
 import type { RequestHandler } from "express";
-import type { McpAuthOptions } from "./auth.types.ts";
+import type { McpAuthOptions } from "../core/auth/auth.types.ts";
 /**
  * Bearer-token auth middleware for the MCP HTTP endpoint.
  *
- * Token sources, in order: `Authorization: Bearer <token>`, then
- * `X-Access-Token`. If neither is present the middleware responds `401` and
- * does not call `next`.
+ * Reads `Authorization: Bearer <token>`. If absent the middleware responds
+ * `401` and does not call `next`.
  *
  * On success it sets:
  * - `req.user` — the resolved {@link AuthUser}
@@ -26,4 +25,4 @@ import type { McpAuthOptions } from "./auth.types.ts";
  * or stack additional middleware).
  */
 export declare function mcpAuth(options: McpAuthOptions): RequestHandler;
-//# sourceMappingURL=index.d.ts.map
+//# sourceMappingURL=auth.d.ts.map

package/dist/express/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/express/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAG/E,OAAO,KAAK,EAAY,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI3E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,CAwB/D"}

package/dist/express/auth.js

@@ -0,0 +1,47 @@
+import { resolveAuth } from "../core/auth/index.js";
+/**
+ * Bearer-token auth middleware for the MCP HTTP endpoint.
+ *
+ * Reads `Authorization: Bearer <token>`. If absent the middleware responds
+ * `401` and does not call `next`.
+ *
+ * On success it sets:
+ * - `req.user` — the resolved {@link AuthUser}
+ * - `req.headers.company` — `user.companySubdomainName` (for downstream
+ *   middleware that keys off the company header)
+ * - `req.auth` — SDK-shaped `AuthInfo`, surfaced to MCP tool handlers as
+ *   `RequestHandlerExtra.authInfo`
+ * - `req.mcpSessionId` — value of the `X-Session-Id` header if present, used
+ *   for log correlation
+ *
+ * Then calls `next()`.
+ *
+ * **Never throws.** All failures (missing token, `tokenToUser` rejection)
+ * are turned into `401` responses; the middleware does not call `next(err)`.
+ *
+ * Mounted automatically by `createMcpServer`'s `mount()`. Exported in case
+ * you want to compose it differently (e.g. mount under a different router,
+ * or stack additional middleware).
+ */
+export function mcpAuth(options) {
+    return async (req, res, next) => {
+        const result = await resolveAuth(req.headers, options);
+        if (!result.ok) {
+            res.status(result.status).json({ error: result.message });
+            return;
+        }
+        req.user = result.user;
+        req.headers.company = result.user.companySubdomainName;
+        req.auth = {
+            token: result.token,
+            clientId: result.user.id,
+            scopes: [],
+            extra: { user: result.user },
+        };
+        if (result.sessionId) {
+            req.mcpSessionId = result.sessionId;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/express/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/express/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAKpD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,OAAO,CAAC,OAAuB;IAC7C,OAAO,KAAK,EACV,GAAY,EACZ,GAAa,EACb,IAAkB,EACH,EAAE;QACjB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACA,GAAmB,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxC,GAAG,CAAC,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC;QACvD,GAAG,CAAC,IAAI,GAAG;YACT,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;YACxB,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;SAC7B,CAAC;QACF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,GAAG,CAAC,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC;QACtC,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/express/express.types.d.ts

@@ -0,0 +1,35 @@
+import type { Request, RequestHandler } from "express";
+import type { Postgan } from "@ganintegrity/postgan";
+import type { Logger } from "pino";
+import type { AuthUser } from "../core/auth/auth.types.ts";
+/**
+ * Per-service options for {@link createMcpRouter}. The
+ * framework-neutral bits (name, version, tools, errorMapper) live on the
+ * `McpDefinition` argument; this options bag holds only what's specific
+ * to mounting against an Express stack.
+ */
+export interface CreateMcpRouterOptions {
+    /**
+     * Service logger. The library calls `logger.child({ component: "mcp" })`
+     * internally and further childs with `sessionId` / `userId` / `company`
+     * per request and with `tool` / `sessionId` per tool call.
+     */
+    logger: Logger;
+    /**
+     * Resolve a bearer token to a user. The library is neutral about how
+     * tokens are verified — plug in your service's existing JWT/cipher/identity
+     * pipeline. Reject by throwing — the router responds `401`.
+     */
+    tokenToUser: (token: string) => Promise<AuthUser>;
+    /**
+     * Express middleware that attaches a `Postgan` instance to `req.postgan`.
+     * Mounted between auth and the JSON-RPC dispatcher; tools open per-call
+     * transactions against `ctx.postgan`.
+     */
+    setupPostgan: RequestHandler;
+}
+export type ReqWithUserPostgan = Request & {
+    user?: AuthUser;
+    postgan?: Postgan;
+};
+//# sourceMappingURL=express.types.d.ts.map

package/dist/express/express.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.types.d.ts","sourceRoot":"","sources":["../../src/express/express.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD;;;;OAIG;IACH,YAAY,EAAE,cAAc,CAAC;CAC9B;AAED,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG;IACzC,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC"}

package/dist/express/express.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=express.types.js.map

package/dist/express/express.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.types.js","sourceRoot":"","sources":["../../src/express/express.types.ts"],"names":[],"mappings":""}

package/dist/express/index.d.ts

@@ -0,0 +1,32 @@
+import { type Router } from "express";
+import type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
+import { mcpAuth } from "./auth.ts";
+import type { McpDefinition } from "../core/define.ts";
+import type { CreateMcpRouterOptions } from "./express.types.ts";
+declare global {
+    namespace Express {
+        interface Request {
+            mcpSessionId?: string;
+            auth?: AuthInfo;
+        }
+    }
+}
+export { mcpAuth };
+export type { CreateMcpRouterOptions } from "./express.types.ts";
+/**
+ * Build an Express router that serves an {@link McpDefinition}. Mount the
+ * returned router on whatever path you like
+ * (`app.use("/mcp", createMcpRouter(mcp, opts))`).
+ *
+ * Each request runs through:
+ *
+ *   `express.json()` → `mcpAuth` → caller's `setupPostgan` → tool dispatch
+ *
+ * Tool handlers run inside an `AsyncLocalStorage` scope, so they pull
+ * `user` / `postgan` / `transaction` / `sessionId` / `logger` from
+ * `ToolContext` without Express objects leaking in.
+ *
+ * Synchronous and never throws.
+ */
+export declare function createMcpRouter(mcp: McpDefinition, options: CreateMcpRouterOptions): Router;
+//# sourceMappingURL=index.d.ts.map

package/dist/express/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/express/index.ts"],"names":[],"mappings":"AAAA,OAAgB,EAA+B,KAAK,MAAM,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAG/E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EACV,sBAAsB,EAEvB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,CAAC,MAAM,CAAC;IAIb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,IAAI,CAAC,EAAE,QAAQ,CAAC;SACjB;KACF;CACF;AAED,OAAO,EAAE,OAAO,EAAE,CAAC;AACnB,YAAY,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AA+BjE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,sBAAsB,GAC9B,MAAM,CAQR"}

package/dist/express/index.js

@@ -0,0 +1,50 @@
+import express, {} from "express";
+import { mcpAuth } from "./auth.js";
+import { dispatchMcpRequest } from "../core/dispatch.js";
+export { mcpAuth };
+/**
+ * Express adapter around {@link dispatchMcpRequest}: pulls `user` /
+ * `postgan` / `mcpSessionId` off the request (set upstream by the auth
+ * middleware and `setupPostgan`), then hands the SDK transport an Express
+ * `req`/`res` pair via the dispatcher's `invokeTransport` callback.
+ */
+function handleMcpRequest(mcp, logger) {
+    return async (req, res) => {
+        const { user, postgan } = req;
+        if (!user || !postgan) {
+            // Defensive: mcpAuth + setupPostgan should have populated both.
+            res.status(401).json({ error: "Unauthenticated" });
+            return;
+        }
+        await dispatchMcpRequest(mcp, logger, { user, postgan, sessionId: req.mcpSessionId }, (transport) => transport.handleRequest(req, res, req.body), () => {
+            if (!res.headersSent) {
+                res.status(500).json({ error: "Internal MCP transport error" });
+            }
+        });
+    };
+}
+/**
+ * Build an Express router that serves an {@link McpDefinition}. Mount the
+ * returned router on whatever path you like
+ * (`app.use("/mcp", createMcpRouter(mcp, opts))`).
+ *
+ * Each request runs through:
+ *
+ *   `express.json()` → `mcpAuth` → caller's `setupPostgan` → tool dispatch
+ *
+ * Tool handlers run inside an `AsyncLocalStorage` scope, so they pull
+ * `user` / `postgan` / `transaction` / `sessionId` / `logger` from
+ * `ToolContext` without Express objects leaking in.
+ *
+ * Synchronous and never throws.
+ */
+export function createMcpRouter(mcp, options) {
+    const mcpLogger = options.logger.child({ component: "mcp" });
+    const router = express.Router();
+    router.use(express.json());
+    router.use(mcpAuth({ tokenToUser: options.tokenToUser, logger: mcpLogger }));
+    router.use(options.setupPostgan);
+    router.post("/", handleMcpRequest(mcp, mcpLogger));
+    return router;
+}
+//# sourceMappingURL=index.js.map

package/dist/express/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/express/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAA4C,MAAM,SAAS,CAAC;AAI5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAmBzD,OAAO,EAAE,OAAO,EAAE,CAAC;AAGnB;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAkB,EAAE,MAAc;IAC1D,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QAC1D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,GAAyB,CAAC;QACpD,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACtB,gEAAgE;YAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,MAAM,kBAAkB,CACtB,GAAG,EACH,MAAM,EACN,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,YAAY,EAAE,EAC9C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAC1D,GAAG,EAAE;YACH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAkB,EAClB,OAA+B;IAE/B,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACjC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -1,20 +1,15 @@
-import type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
-declare global {
-    namespace Express {
-        interface Request {
-            mcpSessionId?: string;
-            auth?: AuthInfo;
-        }
-    }
-}
-export { createMcpServer } from "./server/index.ts";
-export type { CreateMcpServerOptions, CreateMcpServerResult, } from "./server/server.types.ts";
-export { tool } from "./tool/index.ts";
-export type { ToolSpec, ToolAnnotations, ToolContext, } from "./tool/tool.types.ts";
+/**
+ * Framework-neutral entry. Tool definitions, error envelope plumbing, and
+ * the types every adapter shares live here. Bootstrap files importing the
+ * adapter factory should reach for a per-framework subpath
+ * (`@ganintegrity/mcp/express`); tool files import from this root.
+ */
+export { defineMcpServer, materializeSdkServer } from "./core/define.ts";
+export type { DefineMcpServerOptions, McpDefinition } from "./core/define.ts";
+export type { ToolSpec, ToolAnnotations, ToolContext, ToolRegister, } from "./core/tool/tool.types.ts";
 export type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-export { mcpAuth } from "./auth/index.ts";
-export type { McpAuthOptions, AuthUser } from "./auth/auth.types.ts";
-export { INTERNAL_ERROR, toCallToolError } from "./errors/index.ts";
-export type { McpErrorMapper, McpToolError, McpToolErrorSeverity, ToolErrorMeta, } from "./errors/errors.types.ts";
-export type { RequestStore } from "./als.ts";
+export type { AuthUser, McpAuthOptions } from "./core/auth/auth.types.ts";
+export { INTERNAL_ERROR, toCallToolError } from "./core/errors/index.ts";
+export type { McpErrorMapper, McpToolError, McpToolErrorSeverity, ToolErrorMeta, } from "./core/errors/errors.types.ts";
+export type { RequestStore } from "./core/als.ts";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAE/E,OAAO,CAAC,MAAM,CAAC;IAIb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,IAAI,CAAC,EAAE,QAAQ,CAAC;SACjB;KACF;CACF;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,YAAY,EACV,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,YAAY,EACV,QAAQ,EACR,eAAe,EACf,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpE,YAAY,EACV,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACzE,YAAY,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE9E,YAAY,EACV,QAAQ,EACR,eAAe,EACf,WAAW,EACX,YAAY,GACb,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE1E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzE,YAAY,EACV,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,GACd,MAAM,+BAA+B,CAAC;AAEvC,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -1,5 +1,9 @@
-export { createMcpServer } from "./server/index.js";
-export { tool } from "./tool/index.js";
-export { mcpAuth } from "./auth/index.js";
-export { INTERNAL_ERROR, toCallToolError } from "./errors/index.js";
+/**
+ * Framework-neutral entry. Tool definitions, error envelope plumbing, and
+ * the types every adapter shares live here. Bootstrap files importing the
+ * adapter factory should reach for a per-framework subpath
+ * (`@ganintegrity/mcp/express`); tool files import from this root.
+ */
+export { defineMcpServer, materializeSdkServer } from "./core/define.js";
+export { INTERNAL_ERROR, toCallToolError } from "./core/errors/index.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAMpD,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AASvC,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAG1C,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAczE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ganintegrity/mcp",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Provides tooling to scaffold an MCP server",
   "type": "module",
   "main": "./dist/index.js",
@@ -9,6 +9,10 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./express": {
+      "types": "./dist/express/index.d.ts",
+      "default": "./dist/express/index.js"
     }
   },
   "files": [

package/dist/als.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"als.d.ts","sourceRoot":"","sources":["../src/als.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;CAC9B;AAED,eAAO,MAAM,YAAY,iCAAwC,CAAC"}

package/dist/als.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"als.js","sourceRoot":"","sources":["../src/als.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAyBrD,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,iBAAiB,EAAgB,CAAC"}

package/dist/auth/auth.types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.types.d.ts","sourceRoot":"","sources":["../../src/auth/auth.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;;OAOG;IACH,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB"}

package/dist/auth/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,KAAK,EAAY,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAmChE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,CAwB/D"}