@ganintegrity/mcp 1.0.0 → 1.1.1

package/dist/core/define.d.ts

@@ -0,0 +1,80 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { McpErrorMapper } from "./errors/errors.types.ts";
+import type { ToolRegister, ToolRegistration } from "./tool/tool.types.ts";
+/**
+ * Options for {@link defineMcpServer}.
+ *
+ * @public
+ */
+export interface DefineMcpServerOptions {
+    /** MCP server name advertised to clients during initialisation. */
+    name: string;
+    /** MCP server version advertised to clients during initialisation. */
+    version: string;
+    /**
+     * Registration callback. Called **once at define time** with a
+     * `register` object whose `tool(spec)` method captures each tool into
+     * an internal array. Adapters replay the array onto a fresh `McpServer`
+     * per HTTP request.
+     *
+     * Don't put expensive setup in here — it's intended only for
+     * `register.tool(...)` calls.
+     */
+    tools: (register: ToolRegister) => void;
+    /**
+     * Translate a thrown error into an MCP envelope. Return `null` to fall
+     * through to a redacted `INTERNAL_ERROR` envelope. Without a mapper,
+     * every thrown error becomes `INTERNAL_ERROR` with the message redacted.
+     */
+    errorMapper?: McpErrorMapper;
+}
+/**
+ * The serialisable shape adapters consume. Holds the captured tool
+ * registrations alongside the metadata needed to materialise an SDK server
+ * per request. Treat as opaque outside of adapters and tests.
+ *
+ * @public
+ */
+export interface McpDefinition {
+    /** MCP server name, forwarded to the SDK server on each request. */
+    readonly name: string;
+    /** MCP server version, forwarded to the SDK server on each request. */
+    readonly version: string;
+    /**
+     * Captured tool registrations. Adapters pass these through to
+     * `materializeSdkServer`, which replays them onto a fresh SDK server
+     * per request. Typical consumers don't touch this; adapter authors do.
+     */
+    readonly registrations: readonly ToolRegistration[];
+    /** Error mapper carried from the `DefineMcpServerOptions`. */
+    readonly errorMapper?: McpErrorMapper;
+}
+/**
+ * Define an MCP server. Returns an {@link McpDefinition} that adapters
+ * (e.g. `@ganintegrity/mcp/express`'s `createMcpRouter`) materialise into
+ * a real SDK server per request.
+ *
+ * The `tools` callback runs once, here, at define time. The `register`
+ * argument captures each `register.tool(spec)` invocation; the wrapped
+ * handler bakes in ALS-reading, transaction lifecycle, and error mapping
+ * so per-request adapters can replay the registrations onto a fresh
+ * `McpServer` without any extra wiring.
+ *
+ * @public
+ */
+export declare function defineMcpServer(options: DefineMcpServerOptions): McpDefinition;
+/**
+ * Build a fresh SDK `McpServer` from an {@link McpDefinition} and replay
+ * every recorded tool registration onto it.
+ *
+ * Adapters call this once per HTTP request — the SDK's stateless
+ * Streamable-HTTP transport is single-use, which is why registrations
+ * are stored separately and replayed.
+ *
+ * Exposed for tests and advanced consumers writing custom adapters.
+ * Typical consumers don't call this directly.
+ *
+ * @public
+ */
+export declare function materializeSdkServer(mcp: McpDefinition): McpServer;
+//# sourceMappingURL=define.d.ts.map

package/dist/core/define.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define.d.ts","sourceRoot":"","sources":["../../src/core/define.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAG3E;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,KAAK,EAAE,CAAC,QAAQ,EAAE,YAAY,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACpD,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC;CACvC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,sBAAsB,GAC9B,aAAa,CAcf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,aAAa,GAAG,SAAS,CAiBlE"}

package/dist/core/define.js

@@ -0,0 +1,52 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { wrapToolHandler } from "./tool/index.js";
+/**
+ * Define an MCP server. Returns an {@link McpDefinition} that adapters
+ * (e.g. `@ganintegrity/mcp/express`'s `createMcpRouter`) materialise into
+ * a real SDK server per request.
+ *
+ * The `tools` callback runs once, here, at define time. The `register`
+ * argument captures each `register.tool(spec)` invocation; the wrapped
+ * handler bakes in ALS-reading, transaction lifecycle, and error mapping
+ * so per-request adapters can replay the registrations onto a fresh
+ * `McpServer` without any extra wiring.
+ *
+ * @public
+ */
+export function defineMcpServer(options) {
+    const registrations = [];
+    const register = {
+        tool: (spec) => {
+            registrations.push(wrapToolHandler(spec));
+        },
+    };
+    options.tools(register);
+    return {
+        name: options.name,
+        version: options.version,
+        registrations,
+        errorMapper: options.errorMapper,
+    };
+}
+/**
+ * Build a fresh SDK `McpServer` from an {@link McpDefinition} and replay
+ * every recorded tool registration onto it.
+ *
+ * Adapters call this once per HTTP request — the SDK's stateless
+ * Streamable-HTTP transport is single-use, which is why registrations
+ * are stored separately and replayed.
+ *
+ * Exposed for tests and advanced consumers writing custom adapters.
+ * Typical consumers don't call this directly.
+ *
+ * @public
+ */
+export function materializeSdkServer(mcp) {
+    const server = new McpServer({ name: mcp.name, version: mcp.version });
+    const register = server.registerTool.bind(server);
+    for (const reg of mcp.registrations) {
+        register(reg.name, reg.config, reg.handler);
+    }
+    return server;
+}
+//# sourceMappingURL=define.js.map

package/dist/core/define.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define.js","sourceRoot":"","sources":["../../src/core/define.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIpE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAoDlD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,OAA+B;IAE/B,MAAM,aAAa,GAAuB,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAiB;QAC7B,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;YACb,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxB,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,aAAa;QACb,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAkB;IACrD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IASvE,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CACvC,MAAM,CACsB,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QACpC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/dispatch.d.ts

@@ -0,0 +1,35 @@
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import type { Postgan } from "@ganintegrity/postgan";
+import type { Logger } from "pino";
+import type { AuthUser } from "./auth/auth.types.ts";
+import { type McpDefinition } from "./define.ts";
+/**
+ * Per-request scope handed to {@link dispatchMcpRequest}. The framework
+ * adapter pulls these out of its native request shape (Express `req.user` /
+ * `req.postgan` / `req.mcpSessionId`; Koa `ctx.state.*`).
+ */
+interface DispatchScope {
+    user: AuthUser;
+    postgan: Postgan;
+    sessionId?: string;
+}
+/**
+ * Framework-neutral per-request dispatcher.
+ *
+ * Builds the {@link RequestStore} from `scope` + `mcp.errorMapper`,
+ * materialises a fresh SDK `McpServer` (with all tools replayed onto it),
+ * connects a fresh transport, runs `invokeTransport` inside
+ * `requestStore.run(...)` so tool handlers can pull request context from
+ * ALS, and tears server + transport down in `finally`. A failing close is
+ * logged at warn but never re-thrown.
+ *
+ * If `invokeTransport` throws, the error is logged at error level and
+ * `onTransportError` is called so the framework adapter can write a 500
+ * onto its native response object (with whatever headers-sent guard it
+ * uses). The error is otherwise swallowed — this is the request boundary.
+ *
+ * Never throws.
+ */
+export declare function dispatchMcpRequest(mcp: McpDefinition, logger: Logger, scope: DispatchScope, invokeTransport: (transport: StreamableHTTPServerTransport) => Promise<void>, onTransportError: () => void): Promise<void>;
+export {};
+//# sourceMappingURL=dispatch.d.ts.map

package/dist/core/dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../src/core/dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAGnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEvE;;;;GAIG;AACH,UAAU,aAAa;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,aAAa,EACpB,eAAe,EAAE,CAAC,SAAS,EAAE,6BAA6B,KAAK,OAAO,CAAC,IAAI,CAAC,EAC5E,gBAAgB,EAAE,MAAM,IAAI,GAC3B,OAAO,CAAC,IAAI,CAAC,CAmCf"}

package/dist/core/dispatch.js

@@ -0,0 +1,57 @@
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { requestStore } from "./als.js";
+import { materializeSdkServer } from "./define.js";
+/**
+ * Framework-neutral per-request dispatcher.
+ *
+ * Builds the {@link RequestStore} from `scope` + `mcp.errorMapper`,
+ * materialises a fresh SDK `McpServer` (with all tools replayed onto it),
+ * connects a fresh transport, runs `invokeTransport` inside
+ * `requestStore.run(...)` so tool handlers can pull request context from
+ * ALS, and tears server + transport down in `finally`. A failing close is
+ * logged at warn but never re-thrown.
+ *
+ * If `invokeTransport` throws, the error is logged at error level and
+ * `onTransportError` is called so the framework adapter can write a 500
+ * onto its native response object (with whatever headers-sent guard it
+ * uses). The error is otherwise swallowed — this is the request boundary.
+ *
+ * Never throws.
+ */
+export async function dispatchMcpRequest(mcp, logger, scope, invokeTransport, onTransportError) {
+    const { user, postgan, sessionId } = scope;
+    const store = {
+        user,
+        postgan,
+        sessionId,
+        logger: logger.child({
+            sessionId,
+            userId: user.id,
+            company: user.companySubdomainName,
+        }),
+        errorMapper: mcp.errorMapper,
+    };
+    const requestServer = materializeSdkServer(mcp);
+    const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: undefined,
+    });
+    await requestServer.connect(transport);
+    await requestStore.run(store, async () => {
+        try {
+            await invokeTransport(transport);
+        }
+        catch (err) {
+            logger.error({ err, sessionId }, "mcp: transport.handleRequest threw");
+            onTransportError();
+        }
+        finally {
+            await transport.close().catch((closeErr) => {
+                logger.warn({ err: closeErr }, "mcp: transport close failed");
+            });
+            await requestServer.close().catch((closeErr) => {
+                logger.warn({ err: closeErr }, "mcp: server close failed");
+            });
+        }
+    });
+}
+//# sourceMappingURL=dispatch.js.map

package/dist/core/dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../src/core/dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAInG,OAAO,EAAE,YAAY,EAAqB,MAAM,UAAU,CAAC;AAE3D,OAAO,EAAE,oBAAoB,EAAsB,MAAM,aAAa,CAAC;AAavE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAkB,EAClB,MAAc,EACd,KAAoB,EACpB,eAA4E,EAC5E,gBAA4B;IAE5B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC3C,MAAM,KAAK,GAAiB;QAC1B,IAAI;QACJ,OAAO;QACP,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;YACnB,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,OAAO,EAAE,IAAI,CAAC,oBAAoB;SACnC,CAAC;QACF,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC;IAEF,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;QAClD,kBAAkB,EAAE,SAAS;KAC9B,CAAC,CAAC;IACH,MAAM,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEvC,MAAM,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QACvC,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,oCAAoC,CAAC,CAAC;YACvE,gBAAgB,EAAE,CAAC;QACrB,CAAC;gBAAS,CAAC;YACT,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,QAAiB,EAAE,EAAE;gBAClD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,6BAA6B,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,QAAiB,EAAE,EAAE;gBACtD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,0BAA0B,CAAC,CAAC;YAC7D,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/{errors → core/errors}/errors.types.d.ts

@@ -1,4 +1,11 @@
 import type { Logger } from "pino";
+/**
+ * Drives logging behaviour when a tool throws: `"warn"` logs at info level
+ * and treats the error as expected (e.g. validation rejection); `"error"`
+ * logs at error level with the original cause attached.
+ *
+ * @public
+ */
 export type McpToolErrorSeverity = "warn" | "error";
 /**
  * Shape returned by an {@link McpErrorMapper} to describe how a thrown error
@@ -7,6 +14,8 @@ export type McpToolErrorSeverity = "warn" | "error";
  * The library does not define an error *class* — consumers throw whatever
  * type their service already uses, and the mapper translates it into this
  * shape at the tool boundary.
+ *
+ * @public
  */
 export interface McpToolError {
     /** Stable machine-readable code surfaced to the agent. */
@@ -24,11 +33,23 @@ export interface McpToolError {
  * Translate a thrown error into an {@link McpToolError} envelope, or
  * return `null` to fall through to the generic `INTERNAL_ERROR` envelope
  * with a redacted message.
+ *
+ * @public
  */
 export type McpErrorMapper = (err: unknown) => McpToolError | null;
+/**
+ * Context the tool wrapper passes to `toCallToolError` when building the
+ * MCP error envelope. Consumers writing their own tool wrappers populate
+ * this from their request scope.
+ *
+ * @public
+ */
 export interface ToolErrorMeta {
+    /** Tool name — included in error logs. */
     tool: string;
+    /** Forwarded `X-Session-Id` value if present — included in error logs. */
     sessionId?: string;
+    /** Logger to write the error/info entry against. */
     logger: Logger;
 }
 //# sourceMappingURL=errors.types.d.ts.map

package/dist/core/errors/errors.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.types.d.ts","sourceRoot":"","sources":["../../../src/core/errors/errors.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,gFAAgF;IAChF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,YAAY,GAAG,IAAI,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;CAChB"}

package/dist/core/errors/errors.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.types.js","sourceRoot":"","sources":["../../../src/core/errors/errors.types.ts"],"names":[],"mappings":""}

package/dist/{errors → core/errors}/index.d.ts

@@ -3,6 +3,8 @@ import type { McpToolError, ToolErrorMeta } from "./errors.types.ts";
 /**
  * The only code the library itself emits — surfaced in the redacted
  * envelope when a thrown error has no mapping. Consumer codes are theirs.
+ *
+ * @public
  */
 export declare const INTERNAL_ERROR = "INTERNAL_ERROR";
 /**
@@ -22,6 +24,8 @@ export declare const INTERNAL_ERROR = "INTERNAL_ERROR";
  *   error message is **not** surfaced.
  *
  * Never throws (assumes `meta.logger` does not throw).
+ *
+ * @public
  */
 export declare function toCallToolError(mapped: McpToolError | null, originalErr: unknown, meta: ToolErrorMeta): CallToolResult;
 //# sourceMappingURL=index.d.ts.map

package/dist/core/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,cAAc,mBAAmB,CAAC;AA+D/C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,YAAY,GAAG,IAAI,EAC3B,WAAW,EAAE,OAAO,EACpB,IAAI,EAAE,aAAa,GAClB,cAAc,CAMhB"}

package/dist/{errors → core/errors}/index.js

@@ -1,6 +1,8 @@
 /**
  * The only code the library itself emits — surfaced in the redacted
  * envelope when a thrown error has no mapping. Consumer codes are theirs.
+ *
+ * @public
  */
 export const INTERNAL_ERROR = "INTERNAL_ERROR";
 function logMappedError(mapped, meta) {
@@ -67,6 +69,8 @@ function unknownErrorEnvelope(err, meta) {
  *   error message is **not** surfaced.
  *
  * Never throws (assumes `meta.logger` does not throw).
+ *
+ * @public
  */
 export function toCallToolError(mapped, originalErr, meta) {
     if (mapped) {

package/dist/core/errors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/errors/index.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C,SAAS,cAAc,CAAC,MAAoB,EAAE,IAAmB;IAC/D,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf;YACE,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,EACD,iBAAiB,CAClB,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,MAAM,CAAC,IAAI,CACd;YACE,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,EACD,mBAAmB,CACpB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAoB;IAC1C,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACjD,iBAAiB,EAAE;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,GAAY,EACZ,IAAmB;IAEnB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,KAAK,CACf;QACE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAC3C,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,EACD,0BAA0B,CAC3B,CAAC;IACF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iDAAiD,EAAE;SAC1E;QACD,iBAAiB,EAAE;YACjB,IAAI,EAAE,cAAc;YACpB,OAAO;SACR;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA2B,EAC3B,WAAoB,EACpB,IAAmB;IAEnB,IAAI,MAAM,EAAE,CAAC;QACX,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC"}

package/dist/core/test-helpers.d.ts

@@ -0,0 +1,20 @@
+import { vi } from "vitest";
+import type { Logger } from "pino";
+/**
+ * A pino-shaped mock logger. `child()` returns the same logger so assertions
+ * on `logger.error` capture calls from child loggers too — required for
+ * tests that exercise code paths which child the logger before logging.
+ */
+export declare function makeLogger(): Logger;
+export interface MockTransaction {
+    active: boolean;
+    begin: ReturnType<typeof vi.fn>;
+    commit: ReturnType<typeof vi.fn>;
+    rollback: ReturnType<typeof vi.fn>;
+}
+/**
+ * Mock postgan transaction with `commit` / `rollback` flipping `active` to
+ * false to mirror real postgan behaviour.
+ */
+export declare function makeTransaction(): MockTransaction;
+//# sourceMappingURL=test-helpers.d.ts.map

package/dist/core/test-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-helpers.d.ts","sourceRoot":"","sources":["../../src/core/test-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC;;;;GAIG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAanC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACjC,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACpC;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,eAAe,CAYjD"}

package/dist/core/test-helpers.js

@@ -0,0 +1,38 @@
+import { vi } from "vitest";
+/**
+ * A pino-shaped mock logger. `child()` returns the same logger so assertions
+ * on `logger.error` capture calls from child loggers too — required for
+ * tests that exercise code paths which child the logger before logging.
+ */
+export function makeLogger() {
+    const logger = {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn(),
+        fatal: vi.fn(),
+        trace: vi.fn(),
+    };
+    // Cast through `Logger["child"]` because pino's child is generic over a
+    // custom-levels type parameter that vi.fn() can't satisfy directly.
+    logger.child = vi.fn(() => logger);
+    return logger;
+}
+/**
+ * Mock postgan transaction with `commit` / `rollback` flipping `active` to
+ * false to mirror real postgan behaviour.
+ */
+export function makeTransaction() {
+    const tx = {
+        active: true,
+        begin: vi.fn().mockResolvedValue(undefined),
+        commit: vi.fn().mockImplementation(async () => {
+            tx.active = false;
+        }),
+        rollback: vi.fn().mockImplementation(async () => {
+            tx.active = false;
+        }),
+    };
+    return tx;
+}
+//# sourceMappingURL=test-helpers.js.map

package/dist/core/test-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-helpers.js","sourceRoot":"","sources":["../../src/core/test-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG5B;;;;GAIG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,MAAM,GAAoB;QAC9B,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;QACb,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;QACb,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;QACd,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;QACd,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;QACd,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;KACf,CAAC;IACF,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAgB,CAA+B,CAAC;IAC3E,OAAO,MAAgB,CAAC;AAC1B,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,GAAoB;QAC1B,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAC3C,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE;YAC5C,EAAE,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,CAAC,CAAC;QACF,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE;YAC9C,EAAE,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,CAAC,CAAC;KACH,CAAC;IACF,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/core/tool/index.d.ts

@@ -0,0 +1,19 @@
+import type { z } from "zod";
+import type { ToolRegistration, ToolSpec } from "./tool.types.ts";
+/**
+ * Wrap a {@link ToolSpec} into an SDK-shaped {@link ToolRegistration}. The
+ * wrapped handler:
+ *
+ * 1. Reads the active request scope from `requestStore` (ALS).
+ * 2. Opens a fresh `Postgan.Transaction`.
+ * 3. Builds a {@link ToolContext} and invokes the consumer's handler.
+ * 4. Commits on resolve and returns a `CallToolResult` carrying the result
+ *    as both a JSON `text` block and `structuredContent`.
+ * 5. On throw: rolls back the transaction and routes the error through the
+ *    request store's `errorMapper` to build an error envelope.
+ *
+ * Internal — `defineMcpServer`'s `register.tool(spec)` calls this and
+ * pushes the result onto the definition's registration array.
+ */
+export declare function wrapToolHandler<Schema extends z.ZodObject, Output extends Record<string, unknown>>(spec: ToolSpec<Schema, Output>): ToolRegistration;
+//# sourceMappingURL=index.d.ts.map

package/dist/core/tool/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/tool/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAI7B,OAAO,KAAK,EAAe,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AA6B/E;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAC7B,MAAM,SAAS,CAAC,CAAC,SAAS,EAC1B,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gBAAgB,CA0DlD"}

package/dist/{tool → core/tool}/index.js

@@ -24,35 +24,25 @@ async function withTransaction(postgan, logger, body) {
     }
 }
 /**
- * Register a tool against the MCP server returned by `createMcpServer()`.
- * The wrapper around your handler:
+ * Wrap a {@link ToolSpec} into an SDK-shaped {@link ToolRegistration}. The
+ * wrapped handler:
  *
- * 1. Builds a {@link ToolContext} from the active request scope.
- * 2. Opens a fresh `Postgan.Transaction` before calling your handler.
- * 3. On resolve, commits the transaction and returns a `CallToolResult`
- *    where the handler's return value is surfaced both as a JSON `text`
- *    content block (for non-structured-aware clients) and as
- *    `structuredContent` (for AI-SDK clients).
- * 4. On throw, rolls back the transaction and routes the error through
- *    the consumer's `McpErrorMapper` (passed to `createMcpServer`) to
- *    build an MCP error envelope.
+ * 1. Reads the active request scope from `requestStore` (ALS).
+ * 2. Opens a fresh `Postgan.Transaction`.
+ * 3. Builds a {@link ToolContext} and invokes the consumer's handler.
+ * 4. Commits on resolve and returns a `CallToolResult` carrying the result
+ *    as both a JSON `text` block and `structuredContent`.
+ * 5. On throw: rolls back the transaction and routes the error through the
+ *    request store's `errorMapper` to build an error envelope.
  *
- * Registration itself is synchronous and does not throw. The wrapped handler
- * **may** throw at request time — but only if it is invoked outside an
- * active request scope, which indicates a programming bug (the handler was
- * dispatched without going through `mount()`'s ALS wrapper). Such throws
- * propagate to the SDK transport and surface as an HTTP 500. Errors raised
- * by your own handler logic are caught and never propagate.
+ * Internal — `defineMcpServer`'s `register.tool(spec)` calls this and
+ * pushes the result onto the definition's registration array.
  */
-export function tool(server, spec) {
-    server.registerTool(spec.name, {
-        description: spec.description,
-        inputSchema: spec.inputSchema.shape,
-        ...(spec.annotations ? { annotations: spec.annotations } : {}),
-    }, async (args, extra) => {
+export function wrapToolHandler(spec) {
+    const handler = async (args, extra) => {
         const store = requestStore.getStore();
         if (!store) {
-            // Unreachable: createMcpServer.mount() always wraps tool dispatch in
+            // Unreachable in practice: adapters always wrap dispatch in
             // requestStore.run(). Throw to surface the bug rather than silently
             // returning an error envelope without a logger.
             throw new Error("mcp tool invoked outside request scope");
@@ -83,6 +73,19 @@ export function tool(server, spec) {
                 logger,
             });
         }
-    });
+    };
+    return {
+        name: spec.name,
+        config: {
+            description: spec.description,
+            inputSchema: spec.inputSchema.shape,
+            ...(spec.annotations ? { annotations: spec.annotations } : {}),
+        },
+        // Cast: ToolRegistration intentionally uses loose types because the
+        // SDK's `registerTool` is generically overloaded; the cast at this
+        // boundary lets the wrapped handler's specific signature flow through
+        // unchanged at the SDK call site in `materializeSdkServer`.
+        handler: handler,
+    };
 }
 //# sourceMappingURL=index.js.map

package/dist/core/tool/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/tool/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,MAAc,EACd,IAA4C;IAE5C,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;YACd,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,WAAoB,EAAE,EAAE;gBACjD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,kCAAkC,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAG7B,IAA8B;IAC9B,MAAM,OAAO,GAAG,KAAK,EACnB,IAAqB,EACrB,KAA6B,EACJ,EAAE;QAC3B,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,4DAA4D;YAC5D,oEAAoE;YACpE,gDAAgD;YAChD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,EAAE,SAAS,CAAC;QACtD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,KAAK,CAAC,OAAO,EACb,MAAM,EACN,CAAC,WAAW,EAAmB,EAAE;gBAC/B,MAAM,GAAG,GAAgB;oBACvB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,WAAW;oBACX,SAAS;oBACT,MAAM;iBACP,CAAC;gBACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACjC,CAAC,CACF,CAAC;YACF,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzD,iBAAiB,EAAE,MAAM;aAC1B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YAChD,OAAO,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS;gBACT,MAAM;aACP,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE;YACN,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK;YACnC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D;QACD,oEAAoE;QACpE,mEAAmE;QACnE,sEAAsE;QACtE,4DAA4D;QAC5D,OAAO,EAAE,OAAiD;KAC3D,CAAC;AACJ,CAAC"}

package/dist/{tool → core/tool}/tool.types.d.ts

@@ -4,6 +4,8 @@ import type { z } from "zod";
 import type { AuthUser } from "../auth/auth.types.ts";
 /**
  * What every tool handler receives as its second argument.
+ *
+ * @public
  */
 export interface ToolContext {
     /** Authenticated user. Cast to your service's richer type for extra fields. */
@@ -28,6 +30,8 @@ export interface ToolContext {
  *
  * Pick honestly: `readOnlyHint: true` on a tool that mutates is worse than
  * leaving the hint unset.
+ *
+ * @public
  */
 export interface ToolAnnotations {
     /** Human-readable display title (defaults to `name` if omitted). */
@@ -45,9 +49,11 @@ export interface ToolAnnotations {
  * Specification passed to `tool()`. Defines the tool's name, description,
  * input schema, optional annotations, and the handler that executes it.
  *
- * @template Schema  Zod object schema describing the tool's input.
- * @template Output  Plain object the handler returns. Surfaced as both a JSON
+ * @typeParam Schema - Zod object schema describing the tool's input.
+ * @typeParam Output - Plain object the handler returns. Surfaced as both a JSON
  *   `text` content block and as `structuredContent`.
+ *
+ * @public
  */
 export interface ToolSpec<Schema extends z.ZodObject, Output> {
     /** Stable identifier the agent uses to invoke the tool. */
@@ -69,4 +75,34 @@ export interface ToolSpec<Schema extends z.ZodObject, Output> {
      */
     handler: (args: z.infer<Schema>, ctx: ToolContext) => Promise<Output>;
 }
+/**
+ * Captured tool registration held on `McpDefinition.registrations` and
+ * replayed onto a fresh SDK server by {@link materializeSdkServer}.
+ *
+ * Loose types here — the SDK's `registerTool` is generically overloaded so
+ * `Parameters<>` resolves unhelpfully; `materializeSdkServer` casts at the
+ * boundary. Typical consumers don't touch this; surfaced for adapter
+ * authors who walk `McpDefinition.registrations` directly.
+ *
+ * @public
+ */
+export interface ToolRegistration {
+    /** The tool's stable identifier, forwarded to `registerTool` as the first argument. */
+    name: string;
+    /** SDK-shaped registration config (description, input schema, annotations). */
+    config: object;
+    /** Pre-wrapped handler — already wired with ALS, transactions, and error mapping. */
+    handler: (...args: unknown[]) => Promise<unknown>;
+}
+/**
+ * What `defineMcpServer({ tools })` hands to its callback. The single
+ * `tool(spec)` method captures each registration into the underlying
+ * {@link McpDefinition}.
+ *
+ * @public
+ */
+export interface ToolRegister {
+    /** Capture a tool registration. Call once per tool inside the `tools` callback. */
+    tool<Schema extends z.ZodObject, Output extends Record<string, unknown>>(spec: ToolSpec<Schema, Output>): void;
+}
 //# sourceMappingURL=tool.types.d.ts.map

package/dist/core/tool/tool.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool.types.d.ts","sourceRoot":"","sources":["../../../src/core/tool/tool.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,IAAI,EAAE,QAAQ,CAAC;IACf,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,WAAW,EAAE,kBAAkB,CAAC;IAChC,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mDAAmD;IACnD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,yEAAyE;IACzE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,oFAAoF;IACpF,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,QAAQ,CAAC,MAAM,SAAS,CAAC,CAAC,SAAS,EAAE,MAAM;IAC1D,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;;;OAKG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACvE;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACnD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,IAAI,CAAC,MAAM,SAAS,CAAC,CAAC,SAAS,EAAE,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,IAAI,CAAC;CACT"}

package/dist/{tool → core/tool}/tool.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool.types.js","sourceRoot":"","sources":["../../src/tool/tool.types.ts"],"names":[],"mappings":""}
+{"version":3,"file":"tool.types.js","sourceRoot":"","sources":["../../../src/core/tool/tool.types.ts"],"names":[],"mappings":""}

package/dist/{auth/index.d.ts → express/auth.d.ts}

@@ -1,14 +1,13 @@
 import type { RequestHandler } from "express";
-import type { McpAuthOptions } from "./auth.types.ts";
+import type { McpAuthOptions } from "../core/auth/auth.types.ts";
 /**
  * Bearer-token auth middleware for the MCP HTTP endpoint.
  *
- * Token sources, in order: `Authorization: Bearer <token>`, then
- * `X-Access-Token`. If neither is present the middleware responds `401` and
- * does not call `next`.
+ * Reads `Authorization: Bearer <token>`. If absent the middleware responds
+ * `401` and does not call `next`.
  *
  * On success it sets:
- * - `req.user` — the resolved {@link AuthUser}
+ * - `req.user` — the resolved `AuthUser` (re-export from `@ganintegrity/mcp`)
  * - `req.headers.company` — `user.companySubdomainName` (for downstream
  *   middleware that keys off the company header)
  * - `req.auth` — SDK-shaped `AuthInfo`, surfaced to MCP tool handlers as
@@ -21,9 +20,11 @@ import type { McpAuthOptions } from "./auth.types.ts";
  * **Never throws.** All failures (missing token, `tokenToUser` rejection)
  * are turned into `401` responses; the middleware does not call `next(err)`.
  *
- * Mounted automatically by `createMcpServer`'s `mount()`. Exported in case
- * you want to compose it differently (e.g. mount under a different router,
- * or stack additional middleware).
+ * Mounted automatically by {@link createMcpRouter}. Exported in case you
+ * want to compose it differently (e.g. mount under a different router, or
+ * stack additional middleware).
+ *
+ * @public
  */
 export declare function mcpAuth(options: McpAuthOptions): RequestHandler;
-//# sourceMappingURL=index.d.ts.map
+//# sourceMappingURL=auth.d.ts.map

package/dist/express/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/express/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAG/E,OAAO,KAAK,EAAY,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI3E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,CAwB/D"}