@lunora/mcp 1.0.0-alpha.24 → 1.0.0-alpha.241

package/dist/packem_shared/compose.d-BVnP3uAy.d.mts

@@ -0,0 +1,111 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+/**
+ * The MCP wire shapes every tool surface in this package speaks — the
+ * deployment tools (`./tools`), the agent tools (`./agent-tools`), and the
+ * documentation tools (`./docs`).
+ *
+ * They live in their own module (rather than in `./tools`) so a consumer that
+ * only wants the docs surface can import the types without dragging
+ * `@lunora/client` into its bundle. `./tools` re-exports them, so the package's
+ * public API is unchanged.
+ */
+/** A JSON-Schema object describing a tool's arguments, per the MCP spec. */
+interface ToolInputSchema {
+  properties: Record<string, unknown>;
+  required?: ReadonlyArray<string>;
+  type: "object";
+}
+/**
+ * MCP tool annotations — hints a client may use to decide how to present a tool
+ * (badge it read-only, confirm before a destructive call).
+ *
+ * They are hints, not enforcement: this package's actual guarantees are made at
+ * dispatch, where a write tool is refused unless `allowWrites` is set. These
+ * exist so a client can *show* the user what the server already enforces,
+ * instead of every tool looking equally dangerous.
+ */
+interface ToolAnnotations {
+  /** The tool may perform irreversible changes. Only meaningful when `readOnlyHint` is false. */
+  destructiveHint?: boolean;
+  /** Repeating the call with the same arguments has no additional effect. */
+  idempotentHint?: boolean;
+  /** The tool reaches systems beyond this server (the network, external services). */
+  openWorldHint?: boolean;
+  /** The tool does not modify anything. */
+  readOnlyHint?: boolean;
+  /** Human-facing title, shown instead of the raw tool name. */
+  title?: string;
+}
+interface ToolDefinition {
+  annotations?: ToolAnnotations;
+  description: string;
+  inputSchema: ToolInputSchema;
+  name: string;
+  /**
+   * JSON Schema for the tool's `structuredContent`. Optional: a tool that
+   * emits only a text block declares none, and a client that negotiated an
+   * MCP revision older than `2025-06-18` ignores it either way.
+   */
+  outputSchema?: ToolInputSchema;
+}
+/** The MCP `CallToolResult` shape this package's tools return. */
+interface ToolResult {
+  content: {
+    text: string;
+    type: "text";
+  }[];
+  isError?: boolean;
+  /**
+   * The machine-readable result, mirroring the text block. Present only for
+   * tools that declare an `outputSchema`; per the MCP spec it must be a JSON
+   * OBJECT (never a bare array) and must survive `JSON.stringify` — the
+   * transport serializes it, so an un-mapped `bigint` here fails the whole
+   * response rather than one field.
+   */
+  structuredContent?: Record<string, unknown>;
+}
+/** A tool: what to advertise in `ListTools`, and what to run on `CallTool`. */
+interface McpTool {
+  definition: ToolDefinition;
+  handle: (input: Record<string, unknown>) => Promise<ToolResult>;
+}
+/** Name/version pair reported in the MCP `initialize` handshake. */
+interface McpServerInfo {
+  name: string;
+  version: string;
+}
+/** One addressable document a client can list and read directly. */
+interface McpResourceSummary {
+  description?: string;
+  mimeType?: string;
+  name: string;
+  uri: string;
+}
+/**
+ * A set of resources the server exposes alongside its tools.
+ *
+ * Tools are calls a model chooses to make; resources are documents a *client*
+ * can enumerate and attach on its own — the user picking a page to put in
+ * context, without the model having to guess a search query first. The same
+ * corpus is worth offering both ways.
+ */
+interface McpResourceProvider {
+  /** Every resource, for `resources/list`. */
+  list: () => Promise<ReadonlyArray<McpResourceSummary>>;
+  /** One resource's body, or `undefined` when the uri is unknown. */
+  read: (uri: string) => Promise<{
+    mimeType?: string;
+    text: string;
+  } | undefined>;
+}
+/**
+ * Build an MCP `Server` that advertises and dispatches `tools`.
+ *
+ * On duplicate names the FIRST wins, so a caller can layer surfaces in
+ * precedence order without the later list silently shadowing the earlier one.
+ * Thrown errors become `isError` results rather than rejections, per the MCP
+ * convention that a tool failure is output the model can read and react to,
+ * not a protocol-level fault.
+ */
+declare const createToolServer: (info: McpServerInfo, tools: ReadonlyArray<McpTool>, resources?: McpResourceProvider) => Server;
+export { McpServerInfo as M, ToolDefinition as T, McpTool as a, ToolInputSchema as b, ToolResult as c, createToolServer as d, McpResourceProvider as e, McpResourceSummary as f };

package/dist/packem_shared/compose.d-BVnP3uAy.d.ts

@@ -0,0 +1,111 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+/**
+ * The MCP wire shapes every tool surface in this package speaks — the
+ * deployment tools (`./tools`), the agent tools (`./agent-tools`), and the
+ * documentation tools (`./docs`).
+ *
+ * They live in their own module (rather than in `./tools`) so a consumer that
+ * only wants the docs surface can import the types without dragging
+ * `@lunora/client` into its bundle. `./tools` re-exports them, so the package's
+ * public API is unchanged.
+ */
+/** A JSON-Schema object describing a tool's arguments, per the MCP spec. */
+interface ToolInputSchema {
+  properties: Record<string, unknown>;
+  required?: ReadonlyArray<string>;
+  type: "object";
+}
+/**
+ * MCP tool annotations — hints a client may use to decide how to present a tool
+ * (badge it read-only, confirm before a destructive call).
+ *
+ * They are hints, not enforcement: this package's actual guarantees are made at
+ * dispatch, where a write tool is refused unless `allowWrites` is set. These
+ * exist so a client can *show* the user what the server already enforces,
+ * instead of every tool looking equally dangerous.
+ */
+interface ToolAnnotations {
+  /** The tool may perform irreversible changes. Only meaningful when `readOnlyHint` is false. */
+  destructiveHint?: boolean;
+  /** Repeating the call with the same arguments has no additional effect. */
+  idempotentHint?: boolean;
+  /** The tool reaches systems beyond this server (the network, external services). */
+  openWorldHint?: boolean;
+  /** The tool does not modify anything. */
+  readOnlyHint?: boolean;
+  /** Human-facing title, shown instead of the raw tool name. */
+  title?: string;
+}
+interface ToolDefinition {
+  annotations?: ToolAnnotations;
+  description: string;
+  inputSchema: ToolInputSchema;
+  name: string;
+  /**
+   * JSON Schema for the tool's `structuredContent`. Optional: a tool that
+   * emits only a text block declares none, and a client that negotiated an
+   * MCP revision older than `2025-06-18` ignores it either way.
+   */
+  outputSchema?: ToolInputSchema;
+}
+/** The MCP `CallToolResult` shape this package's tools return. */
+interface ToolResult {
+  content: {
+    text: string;
+    type: "text";
+  }[];
+  isError?: boolean;
+  /**
+   * The machine-readable result, mirroring the text block. Present only for
+   * tools that declare an `outputSchema`; per the MCP spec it must be a JSON
+   * OBJECT (never a bare array) and must survive `JSON.stringify` — the
+   * transport serializes it, so an un-mapped `bigint` here fails the whole
+   * response rather than one field.
+   */
+  structuredContent?: Record<string, unknown>;
+}
+/** A tool: what to advertise in `ListTools`, and what to run on `CallTool`. */
+interface McpTool {
+  definition: ToolDefinition;
+  handle: (input: Record<string, unknown>) => Promise<ToolResult>;
+}
+/** Name/version pair reported in the MCP `initialize` handshake. */
+interface McpServerInfo {
+  name: string;
+  version: string;
+}
+/** One addressable document a client can list and read directly. */
+interface McpResourceSummary {
+  description?: string;
+  mimeType?: string;
+  name: string;
+  uri: string;
+}
+/**
+ * A set of resources the server exposes alongside its tools.
+ *
+ * Tools are calls a model chooses to make; resources are documents a *client*
+ * can enumerate and attach on its own — the user picking a page to put in
+ * context, without the model having to guess a search query first. The same
+ * corpus is worth offering both ways.
+ */
+interface McpResourceProvider {
+  /** Every resource, for `resources/list`. */
+  list: () => Promise<ReadonlyArray<McpResourceSummary>>;
+  /** One resource's body, or `undefined` when the uri is unknown. */
+  read: (uri: string) => Promise<{
+    mimeType?: string;
+    text: string;
+  } | undefined>;
+}
+/**
+ * Build an MCP `Server` that advertises and dispatches `tools`.
+ *
+ * On duplicate names the FIRST wins, so a caller can layer surfaces in
+ * precedence order without the later list silently shadowing the earlier one.
+ * Thrown errors become `isError` results rather than rejections, per the MCP
+ * convention that a tool failure is output the model can read and react to,
+ * not a protocol-level fault.
+ */
+declare const createToolServer: (info: McpServerInfo, tools: ReadonlyArray<McpTool>, resources?: McpResourceProvider) => Server;
+export { McpServerInfo as M, ToolDefinition as T, McpTool as a, ToolInputSchema as b, ToolResult as c, createToolServer as d, McpResourceProvider as e, McpResourceSummary as f };

package/dist/packem_shared/connectStdio-DYI-3vnF.mjs

@@ -0,0 +1 @@
+import{StdioServerTransport as i}from"@modelcontextprotocol/sdk/server/stdio.js";import{readFileSync as a}from"node:fs";import{dirname as n,join as c}from"node:path";import{fileURLToPath as s}from"node:url";import{createLunoraMcpServer as m}from"./createLunoraMcpServer-CQJIwdik.mjs";const p=()=>{let r=n(s(import.meta.url));for(let e=0;e<8;e+=1){try{const o=JSON.parse(a(c(r,"package.json"),"utf8"));if(o.name==="@lunora/mcp"&&typeof o.version=="string"&&o.version.length>0)return o.version}catch{}const t=n(r);if(t===r)break;r=t}},S=async r=>{const e=p(),t=m(e===void 0?r:{version:e,...r});return await t.connect(new i),t};export{S as default};

package/dist/packem_shared/createAuthedMcpFetchHandler-D_SQpDhH.mjs

@@ -0,0 +1 @@
+import{LunoraError as y}from"@lunora/errors";import{isAgentToolName as S}from"./AGENT_RUN_INPUT_SCHEMA-hKbpa3Dg.mjs";import{readScreenedBody as g,serveStateless as w}from"./DEFAULT_MAX_REQUEST_BYTES-CbbpkHRK.mjs";import{resolveClient as d,createLunoraMcpServer as T}from"./createLunoraMcpServer-CQJIwdik.mjs";import{c as M}from"./tool-call-Bs-QeKp6.mjs";import{d as E,s as _,S as k}from"./tools-BOfWz78m.mjs";const A=t=>typeof t.scope!="string"?new Set:new Set(t.scope.split(" ").filter(c=>c!=="")),C=(t,c)=>{const o={...t};for(const{flag:s,scope:n}of k)o[s]=t[s]===!0&&c.has(n);return o},I=(t,c,o)=>{const s=new Set,n=c.agents??[];for(const l of t){const e=M(l);if(e===void 0)continue;(E.has(e)||S(e,n))&&s.add(o);const r=_(e,c);r!==void 0&&s.add(r)}return s},N=256,B=t=>{const{maxRequestBytes:c,stepUp:o}=t;if(o!==void 0&&(typeof o.scope!="string"||o.scope===""||typeof o.challenge!="function"))throw new y("MCP_STEP_UP_MISCONFIGURED","createAuthedMcpFetchHandler: `stepUp` needs a non-empty `scope` and a `challenge` function.");const s=typeof t.server=="function"?void 0:d(t.server),n=new Map,l=e=>{if(e.client!==void 0||e.url===void 0||e.token===void 0||e.token.length===0)return d(e);const r=JSON.stringify([e.url,e.token]),i=n.get(r);if(i!==void 0&&i.fetch===e.fetch)return n.delete(r),n.set(r,i),i.client;const f=d(e);return n.delete(r),n.set(r,{client:f,fetch:e.fetch}),n.size>N&&n.delete(n.keys().next().value),f};return t.protect(async(e,r)=>{const i=A(r),f=typeof t.server=="function"?await t.server(r):{...t.server,client:s};let a;if(o!==void 0){const p=await g(e,c);if("response"in p)return p.response;({parsedBody:a}=p);const m=Array.isArray(a)?a:[a],u=[...I(m,f,o.scope)].filter(v=>!i.has(v));if(u.length>0)throw o.challenge(u)}const h=C(typeof t.server=="function"?{...f,client:l(f)}:f,i);return await w(T(h),e,{maxRequestBytes:c,parsedBody:a})})};export{B as createAuthedMcpFetchHandler,A as mcpTokenScopes};

package/dist/packem_shared/createLunoraMcpServer-CQJIwdik.mjs

@@ -0,0 +1 @@
+import{LunoraClient as f}from"@lunora/client";import{LunoraError as m}from"@lunora/errors";import{Server as w}from"@modelcontextprotocol/sdk/server/index.js";import{ListToolsRequestSchema as d,CallToolRequestSchema as h}from"@modelcontextprotocol/sdk/types.js";import{agentToolDefinitions as A,isAgentToolName as M,callAgentTool as T}from"./AGENT_RUN_INPUT_SCHEMA-hKbpa3Dg.mjs";import{t as R,c as k}from"./tools-BOfWz78m.mjs";var N="1.0.0-alpha.240";const E={version:N},L="lunora",y=e=>{if(e.client!==void 0)return e.client;if(e.url===void 0)throw new m("INTERNAL","createLunoraMcpServer requires either a `client` or a `url`");if(e.token===void 0||e.token.length===0)throw new m("UNAUTHENTICATED","createLunoraMcpServer requires a `token` (LUNORA_ADMIN_TOKEN) alongside `url`: every tool reaches admin-gated /_lunora/admin/* routes, so an unauthenticated server can only 403. Writes stay off unless `allowWrites` is set.");const r=new f({fetch:e.fetch,url:e.url});return r.setAuthToken(e.token),r},C=e=>{const r=y(e),n=e.allowWrites??!1,s=e.allowAgents??!1,t=e.agents??[],o=typeof e.token=="string"&&e.token.length>0,i=e.allowObservability===!0&&o,c=e.allowDataReads===!0&&o,a=new w({name:L,version:e.version??E.version},{capabilities:{tools:{}}});return a.setRequestHandler(d,()=>({tools:[...R(n,i,c),...A(t,s)]})),a.setRequestHandler(h,async v=>{const{arguments:g,name:l}=v.params,u=g??{};return M(l,t)?await T(r,l,u,{allowAgents:s,exposures:t,...e.agentMaxWaitMs===void 0?{}:{maxWaitMs:e.agentMaxWaitMs},...e.agentPollIntervalMs===void 0?{}:{pollIntervalMs:e.agentPollIntervalMs}}):await k(r,l,u,n,i,c)}),a};export{C as createLunoraMcpServer,y as resolveClient};

package/dist/packem_shared/createMcpFetchHandler-TkLzJUNn.mjs

@@ -0,0 +1 @@
+import{serveStateless as c}from"./DEFAULT_MAX_REQUEST_BYTES-CbbpkHRK.mjs";import{DEFAULT_MAX_REQUEST_BYTES as u}from"./DEFAULT_MAX_REQUEST_BYTES-CbbpkHRK.mjs";import{resolveClient as s,createLunoraMcpServer as a}from"./createLunoraMcpServer-CQJIwdik.mjs";const l=e=>{const r=s(e);return t=>c(a({...e,client:r}),t,{maxRequestBytes:e.maxRequestBytes})};export{u as DEFAULT_MAX_REQUEST_BYTES,l as createMcpFetchHandler,c as serveStateless};

package/dist/packem_shared/createPaidMcpServer-BH_mly77.mjs

@@ -0,0 +1 @@
+import{LunoraError as x}from"@lunora/errors";import{Server as M}from"@modelcontextprotocol/sdk/server/index.js";import{CallToolRequestSchema as B,ListToolsRequestSchema as P}from"@modelcontextprotocol/sdk/types.js";import{CfWorkerJsonSchemaValidator as b}from"@modelcontextprotocol/sdk/validation/cfworker";import{m as H}from"./promise-memo-OqVPWoUX.mjs";import{readScreenedBody as N,serveStateless as T}from"./DEFAULT_MAX_REQUEST_BYTES-CbbpkHRK.mjs";import{c as S}from"./tool-call-Bs-QeKp6.mjs";let E;const U=()=>(E??=new b,E),C=(r,n,s)=>{const l=r.validate(s);return l.valid?void 0:{content:[{text:`invalid arguments for tool "${n}": ${l.errorMessage}`,type:"text"}],isError:!0}},V=async()=>{try{return(await import("@lunora/x402/charge")).createChargeMiddleware}catch(r){throw new x("INTERNAL",`paid MCP tools need the optional peer "@lunora/x402" — install it alongside @lunora/mcp to charge for tools (${r instanceof Error?r.message:String(r)})`)}},$={name:"lunora-paid-mcp",version:"0.0.0"},q=()=>Response.json({error:"A JSON-RPC batch may not reference a paid MCP tool; send paid tools/call requests individually."},{status:400}),I=async(r,n,s,l,p)=>{const m={reached:!1},u=new M({name:"lunora-paid-mcp-preflight",version:"0.0.0"},{capabilities:{tools:{}}});u.setRequestHandler(B,h=>{const f=C(l,s,h.params.arguments??{});return m.reached=f===void 0&&h.params.name===s,f??{content:[]}});const v=await T(u,r,{maxRequestBytes:p,parsedBody:n});return m.reached?void 0:v},Q=r=>{const n=new Map,s=new Map,l=new Map,p=r.serverInfo??$,m=(e,t,a)=>{if(n.has(e.name))throw new x("BAD_REQUEST",`MCP tool "${e.name}" is already registered.`);const o={description:e.description,inputSchema:e.inputSchema,name:e.name};e.annotations!==void 0&&(o.annotations=e.annotations),n.set(e.name,{definition:o,handler:t,validate:U().getValidator(o.inputSchema)}),a!==void 0&&s.set(e.name,a)},u=()=>{const e=new M(p,{capabilities:{tools:{}}});return e.setRequestHandler(P,()=>({tools:[...n.values()].map(t=>t.definition)})),e.setRequestHandler(B,async t=>{const a=n.get(t.params.name);if(a===void 0)return{content:[{text:`unknown tool: ${t.params.name}`,type:"text"}],isError:!0};const o=t.params.arguments??{},i=C(a,t.params.name,o);if(i!==void 0)return i;try{return await a.handler(o)}catch(c){return{content:[{text:c instanceof Error?c.message:String(c),type:"text"}],isError:!0}}}),e},v=(e,t)=>H(l,e,async()=>(await V())({...r.charge,price:t},{resource:e}));return{fetchHandler:async(e,t,a)=>{const o=await N(e.clone(),r.maxRequestBytes);if("response"in o)return o.response;const{parsedBody:i}=o,c=()=>T(u(),e,{maxRequestBytes:r.maxRequestBytes,parsedBody:i});if(Array.isArray(i))return i.some(w=>s.has(S(w)??""))?q():c();const d=S(i),y=d===void 0?void 0:s.get(d),g=d===void 0?void 0:n.get(d);if(d===void 0||y===void 0||g===void 0)return c();const R=await I(e,i,d,g,r.maxRequestBytes);if(R!==void 0)return R;const A=await v(d,y),j=typeof a?.waitUntil=="function"?{waitUntil:w=>{a.waitUntil?.(w)}}:void 0;return A.handle(e,c,j)},paidTool:(e,t)=>{m(e,t,e.price)},tool:(e,t)=>{m(e,t)}}};export{Q as createPaidMcpServer};

package/dist/packem_shared/createToolServer-BtGuPyMU.mjs

@@ -0,0 +1 @@
+import{Server as l}from"@modelcontextprotocol/sdk/server/index.js";import{ListToolsRequestSchema as d,CallToolRequestSchema as f,ListResourcesRequestSchema as p,ReadResourceRequestSchema as R}from"@modelcontextprotocol/sdk/types.js";const v=(c,u,o)=>{const s=new Map;for(const e of u)s.has(e.definition.name)||s.set(e.definition.name,e);const m=[...s.values()].map(e=>e.definition),r=new l(c,{capabilities:o===void 0?{tools:{}}:{resources:{},tools:{}}});return r.setRequestHandler(d,()=>({tools:m})),r.setRequestHandler(f,async e=>{const{arguments:n,name:t}=e.params,i=s.get(t);if(i===void 0)return{content:[{text:`unknown tool: ${t}`,type:"text"}],isError:!0};try{return await i.handle(n??{})}catch(a){return{content:[{text:a instanceof Error?a.message:String(a),type:"text"}],isError:!0}}}),o!==void 0&&(r.setRequestHandler(p,async()=>({resources:[...await o.list()]})),r.setRequestHandler(R,async e=>{const{uri:n}=e.params,t=await o.read(n);if(t===void 0)throw new Error(`unknown resource: ${n}`);return{contents:[{mimeType:t.mimeType??"text/plain",text:t.text,uri:n}]}})),r};export{v as createToolServer};

package/dist/packem_shared/observability-tools-D4Z8dGS-.mjs

@@ -0,0 +1 @@
+import{LunoraError as N}from"@lunora/errors";import{ADMIN_FUNCTIONS as l}from"@lunora/shard-engine";const A=e=>{let t="";for(let s=0;s<e.length;s+=32768)t+=String.fromCharCode(...e.subarray(s,s+32768));return btoa(t)},R=e=>{const t=atob(e),r=new Uint8Array(t.length);for(let s=0;s<t.length;s+=1)r[s]=t.codePointAt(s)??0;return r},a="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_",F=e=>{let t="",r=0;const s=e.length-2;for(;r<s;r+=3){const n=e[r]<<16|e[r+1]<<8|e[r+2];t+=a.charAt(n>>18&63)+a.charAt(n>>12&63)+a.charAt(n>>6&63)+a.charAt(n&63)}const o=e.length-r;if(o===1){const n=e[r]<<16;t+=a.charAt(n>>18&63)+a.charAt(n>>12&63)}else if(o===2){const n=e[r]<<16|e[r+1]<<8;t+=a.charAt(n>>18&63)+a.charAt(n>>12&63)+a.charAt(n>>6&63)}return t},$=e=>{const t=e.replaceAll("-","+").replaceAll("_","/"),r=t+"=".repeat((4-t.length%4)%4);return R(r)},b=(e,t)=>{if(typeof t=="bigint")return t.toString();if(t instanceof ArrayBuffer)return A(new Uint8Array(t));if(ArrayBuffer.isView(t)){const r=t;return A(new Uint8Array(r.buffer,r.byteOffset,r.byteLength))}return t},U=e=>JSON.parse(JSON.stringify(e,b)),P=e=>({content:[{text:e===void 0?"null":JSON.stringify(e,b,2),type:"text"}]}),p=e=>({...P(e),structuredContent:U(e)}),J=e=>({content:[{text:e,type:"text"}],isError:!0}),u={destructiveHint:!1,idempotentHint:!0,openWorldHint:!0,readOnlyHint:!0},I=50,w=500,E=["1m","5m","15m","1h"],O=["open","resolved","ignored"],v=["trace","debug","log","info","warn","error","fatal"],g={description:"Shard to read from on a .shardBy()-partitioned deployment. Omit for the default (unsharded) shard — these reads are PER-SHARD, not deployment-wide.",type:"string"},y={description:`Maximum rows to return (default ${I.toString()}, clamped to ${w.toString()}).`,type:"number"},L=e=>{const t=typeof e=="number"?e:Number.NaN;return Number.isFinite(t)?Math.max(1,Math.min(Math.floor(t),w)):I},S=(e,t)=>t.includes(e)?e:void 0,T=e=>typeof e=="string"&&e.length>0?e:void 0,M={properties:{level:{description:`Keep only entries at this severity. One of: ${v.join(", ")}.`,type:"string"},limit:y,shardKey:g},type:"object"},k={properties:{functionPathPrefix:{description:'Keep only Issues whose function path starts with this, e.g. "messages:".',type:"string"},limit:y,shardKey:g,status:{description:`Triage status to keep. One of: ${O.join(", ")}. Default: all.`,type:"string"}},type:"object"},H={properties:{limit:y,shardKey:g},type:"object"},x={properties:{limit:y,range:{description:`Time window to report over. One of: ${E.join(", ")}. Default: 15m.`,type:"string"},shardKey:g},type:"object"},C={properties:{shardKey:g},type:"object"},j={properties:{dropped:{description:"Entries the shard's in-memory ring EVICTED before this read — they are gone and cannot be fetched. Non-zero means `entries` + `total` describe only the newest slice of what the deployment logged.",type:"number"},entries:{description:"Recent log entries, NEWEST FIRST: { level, message, timestamp, functionPath?, fields? }.",type:"array"},total:{description:"Entries still in the ring matching `level`, before `limit` narrowed them. NOT the number of lines logged — see `dropped`.",type:"number"}},required:["dropped","entries","total"],type:"object"},q={properties:{issues:{description:"Grouped error Issues, newest first: { hash, title, count, status, functionPath, lastSeen, … }.",type:"array"}},required:["issues"],type:"object"},B={properties:{advisories:{description:"Schema/query advisories: { id, level, title, detail, … }.",type:"array"},total:{description:"Advisories available before `limit` narrowed them.",type:"number"}},required:["advisories","total"],type:"object"},D={properties:{buckets:{description:"Combined throughput/latency series across the range.",type:"array"},capped:{description:"True when the deployment's tracked-statement cap was reached, so coverage is partial.",type:"boolean"},entries:{description:"Per-statement activity in the range, hottest first.",type:"array"},total:{description:"Statements available before `limit` narrowed them.",type:"number"},trackedStatements:{description:"Distinct statements the deployment is tracking.",type:"number"}},required:["entries","buckets"],type:"object"},G={properties:{migrations:{description:"Every declared migration with its applied/pending state.",type:"array"}},required:["migrations"],type:"object"},K=[{annotations:{...u,title:"Read recent logs"},description:"Read the deployment's recent log entries (newest first) after running a function, to see what it printed and where it failed. In-memory and per-shard: resets when the shard hibernates.",inputSchema:M,name:"lunora_get_logs",outputSchema:j},{annotations:{...u,title:"List grouped error Issues"},description:"List errors grouped into Issues by fingerprint, with occurrence counts and triage status — the first call when asking what is currently broken, rather than reading raw logs.",inputSchema:k,name:"lunora_get_issues",outputSchema:q},{annotations:{...u,title:"List schema and query advisories"},description:"List the deployment's schema/query advisories (missing indexes, unsafe policies, and similar lints) before or after changing the schema.",inputSchema:H,name:"lunora_get_advisories",outputSchema:B},{annotations:{...u,title:"Read query insights"},description:"Read per-statement execution counts and latency over a recent time window, to find which query is slow or hot before optimizing one.",inputSchema:x,name:"lunora_get_query_insights",outputSchema:D},{annotations:{...u,title:"Read migration status"},description:"Read which migrations have been applied and which are pending, to check whether a schema change has actually landed on the deployment.",inputSchema:C,name:"lunora_get_migration_status",outputSchema:G}],z=new Set(K.map(e=>e.name)),h=async(e,t,r,s)=>{const o={__lunoraRef:t};return e.query(o,r,{...s===void 0?{}:{shardKey:s}})},m=(e,t)=>{const r=e?.[t];return Array.isArray(r)?r:[]},W=async(e,t,r)=>{const s=T(r.shardKey),o=L(r.limit);switch(t){case"lunora_get_advisories":{const n=await h(e,l.getAdvisories,{},s),i=m(n,"advisories");return p({advisories:i.slice(0,o),total:i.length})}case"lunora_get_issues":{const n=S(r.status,O),i=T(r.functionPathPrefix),c=await h(e,l.getIssues,{limit:o,...n===void 0?{}:{status:n},...i===void 0?{}:{functionPathPrefix:i}},s);return p({issues:m(c,"issues")})}case"lunora_get_logs":{const n=S(r.level,v),i=await h(e,l.getLogs,{},s),c=m(i,"entries").filter(f=>n===void 0||f.level===n),{dropped:d}=i??{};return p({dropped:typeof d=="number"?d:0,entries:c.slice(0,o),total:c.length})}case"lunora_get_migration_status":{const n=await h(e,l.migrationStatus,{},s);return p({migrations:m(n,"migrations")})}case"lunora_get_query_insights":{const n=S(r.range,E),i=await h(e,l.getQueryInsights,{...n===void 0?{}:{range:n}},s),c=m(i,"entries"),{buckets:d,capped:f,trackedStatements:_}=i??{};return p({buckets:Array.isArray(d)?d:[],capped:f===!0,entries:c.slice(0,o),total:c.length,trackedStatements:typeof _=="number"?_:c.length})}default:throw new N("INTERNAL",`unknown observability tool: ${t}`)}};export{I as D,w as M,K as O,P as a,z as b,W as c,J as e,$ as f,p as o,F as t};

package/dist/packem_shared/promise-memo-OqVPWoUX.mjs

@@ -0,0 +1 @@
+const d=(e,t)=>{if(e.size<t)return;const o=e.keys().next().value;o!==void 0&&e.delete(o)},r=(e,t,o,s)=>{const n=e.get(t);if(n!==void 0)return n;s!==void 0&&d(e,s);const i=o().catch(c=>{throw e.get(t)===i&&e.delete(t),c});return e.set(t,i),i};export{d as e,r as m};

package/dist/packem_shared/serve-stateless.d-DD5arqFx.d.mts

@@ -0,0 +1,45 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { HandleRequestOptions } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
+/** A Web-Standard fetch handler: takes a `Request`, returns the MCP `Response`. */
+type McpFetchHandler = (request: Request) => Promise<Response>;
+/**
+ * Largest request body served. Every MCP call is a short JSON-RPC message — a
+ * few hundred bytes — so this is orders of magnitude of headroom while still
+ * bounding what a caller can push through the parser.
+ */
+declare const DEFAULT_MAX_REQUEST_BYTES: number;
+/** What {@link serveStateless} accepts on top of the transport's own options. */
+interface ServeStatelessOptions extends HandleRequestOptions {
+  /**
+   * Largest accepted request body, in bytes — enforced while the body streams
+   * in, not after it is buffered. Defaults to
+   * {@link DEFAULT_MAX_REQUEST_BYTES}, which a value that is not a
+   * non-negative safe integer also falls back to (see `resolveLimit`).
+   */
+  maxRequestBytes?: number;
+}
+/**
+ * Drive one request through a fresh **stateless** Streamable-HTTP transport bound
+ * to `server`, then tear both down.
+ *
+ * `sessionIdGenerator: undefined` → stateless (no cross-request session store);
+ * `enableJsonResponse: true` → the whole JSON-RPC response is buffered into the
+ * returned `Response`, so closing the transport/server afterwards can't truncate
+ * an in-flight body. Cleanup is fire-and-forget with swallowed rejections (a
+ * `.catch()`-terminated chain) so it never delays or masks the resolved response.
+ *
+ * The request is screened first ({@link screenRequest}); an oversized body or a
+ * JSON-RPC batch is refused here and no server is ever constructed for it.
+ *
+ * `options.parsedBody` lets a caller hand over a body it already read (e.g. the
+ * paid-tool gate, which peeks the JSON-RPC message to price the call) so the
+ * transport doesn't re-read a consumed stream. It is trusted as already
+ * screened, so read it with {@link readScreenedBody} — anything else hands this
+ * surface an unbounded body.
+ *
+ * Teardown runs in a `finally`: a rejection from `connect` or `handleRequest`
+ * would otherwise skip it and leak a server + transport per failed request,
+ * which on a public endpoint is exactly the request an attacker can repeat.
+ */
+declare const serveStateless: (server: Server, request: Request, options?: ServeStatelessOptions) => Promise<Response>;
+export { DEFAULT_MAX_REQUEST_BYTES as D, McpFetchHandler as M, ServeStatelessOptions as S, serveStateless as s };

package/dist/packem_shared/serve-stateless.d-DD5arqFx.d.ts

@@ -0,0 +1,45 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { HandleRequestOptions } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
+/** A Web-Standard fetch handler: takes a `Request`, returns the MCP `Response`. */
+type McpFetchHandler = (request: Request) => Promise<Response>;
+/**
+ * Largest request body served. Every MCP call is a short JSON-RPC message — a
+ * few hundred bytes — so this is orders of magnitude of headroom while still
+ * bounding what a caller can push through the parser.
+ */
+declare const DEFAULT_MAX_REQUEST_BYTES: number;
+/** What {@link serveStateless} accepts on top of the transport's own options. */
+interface ServeStatelessOptions extends HandleRequestOptions {
+  /**
+   * Largest accepted request body, in bytes — enforced while the body streams
+   * in, not after it is buffered. Defaults to
+   * {@link DEFAULT_MAX_REQUEST_BYTES}, which a value that is not a
+   * non-negative safe integer also falls back to (see `resolveLimit`).
+   */
+  maxRequestBytes?: number;
+}
+/**
+ * Drive one request through a fresh **stateless** Streamable-HTTP transport bound
+ * to `server`, then tear both down.
+ *
+ * `sessionIdGenerator: undefined` → stateless (no cross-request session store);
+ * `enableJsonResponse: true` → the whole JSON-RPC response is buffered into the
+ * returned `Response`, so closing the transport/server afterwards can't truncate
+ * an in-flight body. Cleanup is fire-and-forget with swallowed rejections (a
+ * `.catch()`-terminated chain) so it never delays or masks the resolved response.
+ *
+ * The request is screened first ({@link screenRequest}); an oversized body or a
+ * JSON-RPC batch is refused here and no server is ever constructed for it.
+ *
+ * `options.parsedBody` lets a caller hand over a body it already read (e.g. the
+ * paid-tool gate, which peeks the JSON-RPC message to price the call) so the
+ * transport doesn't re-read a consumed stream. It is trusted as already
+ * screened, so read it with {@link readScreenedBody} — anything else hands this
+ * surface an unbounded body.
+ *
+ * Teardown runs in a `finally`: a rejection from `connect` or `handleRequest`
+ * would otherwise skip it and leak a server + transport per failed request,
+ * which on a public endpoint is exactly the request an attacker can repeat.
+ */
+declare const serveStateless: (server: Server, request: Request, options?: ServeStatelessOptions) => Promise<Response>;
+export { DEFAULT_MAX_REQUEST_BYTES as D, McpFetchHandler as M, ServeStatelessOptions as S, serveStateless as s };

package/dist/packem_shared/server.d-D3rejkVc.d.mts

@@ -0,0 +1,152 @@
+import { LunoraClient } from '@lunora/client';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { b as ToolInputSchema, T as ToolDefinition, c as ToolResult } from "./compose.d-BVnP3uAy.mjs";
+/**
+ * Agent exposure for the MCP server: a durable `@lunora/agent` run fronted as an
+ * MCP tool an external agent can call. The capability boundary is the MCP-server
+ * process + its token, so WHICH agents are exposed is config on the server (like
+ * `allowWrites`), not on `defineAgent` — keeping `@lunora/agent` codegen
+ * byte-identical.
+ */
+interface McpAgentExposure {
+  /** What the agent does — shown to the calling model, which decides from it. */
+  description: string;
+  /** The agent's export name (its `ctx.agents.<name>` / `AGENT_<NAME>` binding). */
+  name: string;
+  /** Override the model-facing tool name (default `agent_<name>`). */
+  toolName?: string;
+}
+/** The generic status/poll tool advertised alongside the per-agent tools. */
+declare const AGENT_STATUS_TOOL_NAME = "lunora_agent_status";
+/**
+ * The uniform input schema every agent tool advertises. Agents share ONE run
+ * input (`@lunora/agent` has no per-agent validator), so there is nothing to
+ * derive per agent — a single static schema is reused for every agent tool.
+ */
+declare const AGENT_RUN_INPUT_SCHEMA: ToolInputSchema;
+/**
+ * Parse `LUNORA_MCP_AGENTS` — a `;`-separated list of `name:description` pairs,
+ * e.g. `"support:Handles support questions;billing:Billing help"`. The
+ * description may itself contain colons (only the FIRST colon splits). Blank
+ * entries and entries with an empty name/description are skipped.
+ */
+declare const parseAgentsEnv: (raw: string | undefined) => McpAgentExposure[];
+/**
+ * The tools this module advertises. Fail-closed: only the boolean `true` opts
+ * in (an env-plumbed caller could pass a truthy string), and the tools appear
+ * ONLY when at least one agent is exposed — so an agent-free or non-opted-in
+ * server never lists them.
+ */
+declare const agentToolDefinitions: (exposures: ReadonlyArray<McpAgentExposure>, allowAgents: boolean) => ReadonlyArray<ToolDefinition>;
+/** Options threaded into a single agent tool dispatch. */
+interface CallAgentToolOptions {
+  /** Opt-in gate — must be exactly `true` or the call is refused fail-closed. */
+  allowAgents: boolean;
+  /** The exposures advertised by this server. */
+  exposures: ReadonlyArray<McpAgentExposure>;
+  /** Wall-clock budget a single call awaits before returning a pending result. */
+  maxWaitMs?: number;
+  /** Delay between thread-status polls. */
+  pollIntervalMs?: number;
+  /** Test seam replacing the between-poll wait; production uses a real timer. */
+  wait?: (ms: number) => Promise<void>;
+}
+/**
+ * Dispatch an agent tool call: start a durable run via `agents:agentRun`, then
+ * await-with-timeout — poll `agents:agentThread` until terminal (returning the
+ * final answer from `agents:agentMessages`) or, on budget exhaustion, return a
+ * NON-error pending payload the caller resumes with `lunora_agent_status`.
+ *
+ * Fail-closed: refused at dispatch unless `allowAgents === true`, mirroring the
+ * `allowWrites` guard — starting a run is a side effect and must not ride the
+ * read-only default.
+ */
+declare const callAgentTool: (client: LunoraClient, name: string, input: Record<string, unknown>, options: CallAgentToolOptions) => Promise<ToolResult>;
+interface LunoraMcpServerOptions {
+  /** Wall-clock budget a single agent tool call awaits before returning a pending result. */
+  agentMaxWaitMs?: number;
+  /** Delay between agent thread-status polls. */
+  agentPollIntervalMs?: number;
+  /** The agents this server fronts as MCP tools (see `allowAgents`). */
+  agents?: ReadonlyArray<McpAgentExposure>;
+  /**
+   * Expose the per-agent tools (`agent_<name>` + the generic
+   * `lunora_agent_status`). Defaults to `false`, mirroring `allowWrites`:
+   * starting a durable agent run is a side effect, so the agent tools are
+   * omitted from the advertised list AND refused at dispatch unless explicitly
+   * opted in. Only takes effect together with a non-empty `agents` list.
+   */
+  allowAgents?: boolean;
+  /**
+   * Expose `lunora_find_related`, which returns raw table rows read through the
+   * admin writer, so RLS policies and column masks do not apply. Defaults to
+   * `false`, for the same reason as `allowObservability`. Only takes effect
+   * when a `token` resolved. On the OAuth-protected path the verified token must
+   * also carry the data-read scope (see `DATA_READ_SCOPE` in `./tools`).
+   */
+  allowDataReads?: boolean;
+  /**
+   * Expose the observability tools (`lunora_get_logs`, `lunora_get_issues`,
+   * `lunora_get_advisories`, `lunora_get_query_insights`,
+   * `lunora_get_migration_status`). Defaults to `false`, mirroring
+   * `allowWrites`: they are read-only, but every row they return — log lines,
+   * request metadata, grouped error messages — is production user data that
+   * lands in the model's context and therefore at its provider. Holding the
+   * admin bearer is not consent to ship that, so it is a separate opt-in;
+   * without it the tools are omitted from the advertised list AND refused at
+   * dispatch. Only takes effect when a `token` resolved. On the OAuth-protected
+   * path the verified token must also carry the observability scope (see
+   * `OBSERVABILITY_SCOPE` in `./tools`); this option stays the outer gate.
+   */
+  allowObservability?: boolean;
+  /**
+   * Expose the write tools (`lunora_run_mutation` / `lunora_run_action`).
+   * Defaults to `false`: the server is READ-ONLY unless explicitly opted in,
+   * so a prompt-injected or misaligned agent can't mutate the deployment with
+   * the configured token. When false the write tools are omitted from the
+   * advertised tool list AND refused at dispatch.
+   */
+  allowWrites?: boolean;
+  /**
+   * Pre-built client (test injection). When omitted a `LunoraClient` is
+   * created from `url`/`token`/`fetch`.
+   */
+  client?: LunoraClient;
+  /** `fetch` implementation; defaults to the ambient global. */
+  fetch?: typeof fetch;
+  /**
+   * Bearer token sent on every RPC. **Required** alongside `url`, and it must
+   * be the deployment's **admin bearer**: the introspection/allowlist path
+   * every tool depends on (`lunora_list_functions`, `lunora_list_tables`, and
+   * the `assertRunnable` precheck that runs before every `run` tool) hits
+   * admin-gated `/_lunora/admin/*` routes, so no scoped/app token works
+   * today — it would 403 (`ADMIN_FORBIDDEN`) on the first tool call. The
+   * read-only guarantee is therefore NOT enforced by the token's scope; it is
+   * enforced in-process via `allowWrites: false` (the default), which omits
+   * the write tools from the advertised list and refuses them at dispatch.
+   *
+   * Because EVERY tool needs it, omitting it is a misconfiguration rather than
+   * a reduced-capability mode, and `createLunoraMcpServer` says so at
+   * construction instead of advertising a surface that 403s on first use. The
+   * one exception is the `client` injection seam (tests / a pre-authenticated
+   * client), where this server cannot know what the client can reach and so
+   * reads "unknown" fail-closed: the privileged observability tools stay
+   * unadvertised and are refused at dispatch.
+   */
+  token?: string;
+  /** Base URL of the deployed Lunora Worker. Required unless `client` is given. */
+  url?: string;
+  /** Version reported in the `initialize` handshake. Defaults to the version bundled at build time. */
+  version?: string;
+}
+/**
+ * Build an MCP `Server` whose tools talk to a Lunora deployment. The server is
+ * transport-agnostic — call `.connect(transport)` yourself, or use
+ * `connectStdio` for the common stdio case.
+ *
+ * Tool calls are dispatched through `callTool`, which the deployment reaches
+ * over HTTP RPC. No WebSocket is opened (the tools never subscribe), so this is
+ * safe to run as a short-lived stdio process.
+ */
+declare const createLunoraMcpServer: (options: LunoraMcpServerOptions) => Server;
+export { AGENT_RUN_INPUT_SCHEMA as A, CallAgentToolOptions as C, LunoraMcpServerOptions as L, McpAgentExposure as M, AGENT_STATUS_TOOL_NAME as a, agentToolDefinitions as b, callAgentTool as c, createLunoraMcpServer as d, parseAgentsEnv as p };