@lunora/mcp 1.0.0-alpha.26 → 1.0.0-alpha.261

package/dist/packem_shared/compose.d-DiPnHeQv.d.mts

@@ -0,0 +1,154 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+/**
+ * The MCP wire shapes every tool surface in this package speaks — the
+ * deployment tools (`./tools`), the agent tools (`./agent-tools`), and the
+ * documentation tools (`./docs`).
+ *
+ * They live in their own module (rather than in `./tools`) so a consumer that
+ * only wants the docs surface can import the types without dragging
+ * `@lunora/client` into its bundle. `./tools` re-exports them, so the package's
+ * public API is unchanged.
+ */
+/** A JSON-Schema object describing a tool's arguments, per the MCP spec. */
+interface ToolInputSchema {
+  properties: Record<string, unknown>;
+  required?: ReadonlyArray<string>;
+  type: "object";
+}
+/**
+ * A tool's `outputSchema`. Either a success shape, or the root `anyOf` a composed
+ * tool gets so an error result also validates. The root stays `type: "object"`,
+ * which the MCP SDK requires, so `properties` is absent on that root.
+ */
+interface ToolOutputSchema {
+  $defs?: Record<string, unknown>;
+  additionalProperties?: boolean;
+  anyOf?: ReadonlyArray<object>;
+  definitions?: Record<string, unknown>;
+  properties?: Record<string, unknown>;
+  required?: ReadonlyArray<string>;
+  type: "object";
+}
+/**
+ * Hints every tool carries, whether it reads or writes.
+ */
+interface ToolAnnotationsBase {
+  /** The tool reaches systems beyond this server (the network, external services). */
+  openWorldHint?: boolean;
+  /** Human-facing title, shown instead of the raw tool name. */
+  title?: string;
+}
+/**
+ * A tool that does not modify anything. `destructiveHint` may only be `false`
+ * here, so a read-only tool cannot also claim it is destructive.
+ */
+interface ReadOnlyToolAnnotations extends ToolAnnotationsBase {
+  destructiveHint?: false;
+  idempotentHint?: boolean;
+  readOnlyHint: true;
+}
+/**
+ * A tool that may modify something. Both hints are REQUIRED here: a write that
+ * does not say whether it can destroy data, or whether a retry repeats its
+ * effect, is exactly the omission this type exists to rule out.
+ */
+interface WriteToolAnnotations extends ToolAnnotationsBase {
+  /** The tool may perform irreversible changes. */
+  destructiveHint: boolean;
+  /** Repeating the call with the same arguments has no additional effect. */
+  idempotentHint: boolean;
+  readOnlyHint: false;
+}
+/**
+ * MCP tool annotations — hints a client may use to decide how to present a tool
+ * (badge it read-only, confirm before a destructive call).
+ *
+ * They are hints, not enforcement: this package's actual guarantees are made at
+ * dispatch, where a write tool is refused unless `allowWrites` is set. These
+ * exist so a client can *show* the user what the server already enforces,
+ * instead of every tool looking equally dangerous.
+ *
+ * `readOnlyHint` is required on every tool, so a new tool cannot ship without
+ * declaring its access. See `./tool-annotations.test` for the compile-time proof.
+ */
+type ToolAnnotations = ReadOnlyToolAnnotations | WriteToolAnnotations;
+interface ToolDefinition {
+  /** Required: every tool declares its access (see {@link ToolAnnotations}). */
+  annotations: ToolAnnotations;
+  description: string;
+  inputSchema: ToolInputSchema;
+  name: string;
+  /**
+   * JSON Schema for the tool's `structuredContent`. Optional: a tool that
+   * emits only a text block declares none, and a client that negotiated an
+   * MCP revision older than `2025-06-18` ignores it either way.
+   */
+  outputSchema?: ToolOutputSchema;
+}
+/**
+ * The MCP `CallToolResult` shape this package's tools return.
+ *
+ * A type alias rather than an interface: the SDK's `CallToolResult` has an open
+ * index signature, which only an object-literal type satisfies implicitly.
+ */
+type ToolResult = {
+  content: {
+    text: string;
+    type: "text";
+  }[];
+  isError?: boolean;
+  /**
+   * The machine-readable result, mirroring the text block. Present on success
+   * for tools that declare an `outputSchema`, and on EVERY error result, where
+   * it is `{ code, message }`. Per the MCP spec it must be a JSON OBJECT (never
+   * a bare array) and must survive `JSON.stringify` — the transport serializes
+   * it, so an un-mapped `bigint` here fails the whole response rather than one
+   * field.
+   */
+  structuredContent?: Record<string, unknown>;
+};
+/** A tool: what to advertise in `ListTools`, and what to run on `CallTool`. */
+interface McpTool {
+  definition: ToolDefinition;
+  handle: (input: Record<string, unknown>) => Promise<ToolResult>;
+}
+/** Name/version pair reported in the MCP `initialize` handshake. */
+interface McpServerInfo {
+  name: string;
+  version: string;
+}
+/** One addressable document a client can list and read directly. */
+interface McpResourceSummary {
+  description?: string;
+  mimeType?: string;
+  name: string;
+  uri: string;
+}
+/**
+ * A set of resources the server exposes alongside its tools.
+ *
+ * Tools are calls a model chooses to make; resources are documents a *client*
+ * can enumerate and attach on its own — the user picking a page to put in
+ * context, without the model having to guess a search query first. The same
+ * corpus is worth offering both ways.
+ */
+interface McpResourceProvider {
+  /** Every resource, for `resources/list`. */
+  list: () => Promise<ReadonlyArray<McpResourceSummary>>;
+  /** One resource's body, or `undefined` when the uri is unknown. */
+  read: (uri: string) => Promise<{
+    mimeType?: string;
+    text: string;
+  } | undefined>;
+}
+/**
+ * Build an MCP `Server` that advertises and dispatches `tools`.
+ *
+ * On duplicate names the FIRST wins, so a caller can layer surfaces in
+ * precedence order without the later list silently shadowing the earlier one.
+ * Thrown errors become `isError` results rather than rejections, per the MCP
+ * convention that a tool failure is output the model can read and react to,
+ * not a protocol-level fault.
+ */
+declare const createToolServer: (info: McpServerInfo, tools: ReadonlyArray<McpTool>, resources?: McpResourceProvider) => Server;
+export { McpServerInfo as M, ToolDefinition as T, McpTool as a, ToolInputSchema as b, ToolOutputSchema as c, ToolResult as d, createToolServer as e, McpResourceProvider as f, McpResourceSummary as g, ToolAnnotations as h };

package/dist/packem_shared/compose.d-DiPnHeQv.d.ts

@@ -0,0 +1,154 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+/**
+ * The MCP wire shapes every tool surface in this package speaks — the
+ * deployment tools (`./tools`), the agent tools (`./agent-tools`), and the
+ * documentation tools (`./docs`).
+ *
+ * They live in their own module (rather than in `./tools`) so a consumer that
+ * only wants the docs surface can import the types without dragging
+ * `@lunora/client` into its bundle. `./tools` re-exports them, so the package's
+ * public API is unchanged.
+ */
+/** A JSON-Schema object describing a tool's arguments, per the MCP spec. */
+interface ToolInputSchema {
+  properties: Record<string, unknown>;
+  required?: ReadonlyArray<string>;
+  type: "object";
+}
+/**
+ * A tool's `outputSchema`. Either a success shape, or the root `anyOf` a composed
+ * tool gets so an error result also validates. The root stays `type: "object"`,
+ * which the MCP SDK requires, so `properties` is absent on that root.
+ */
+interface ToolOutputSchema {
+  $defs?: Record<string, unknown>;
+  additionalProperties?: boolean;
+  anyOf?: ReadonlyArray<object>;
+  definitions?: Record<string, unknown>;
+  properties?: Record<string, unknown>;
+  required?: ReadonlyArray<string>;
+  type: "object";
+}
+/**
+ * Hints every tool carries, whether it reads or writes.
+ */
+interface ToolAnnotationsBase {
+  /** The tool reaches systems beyond this server (the network, external services). */
+  openWorldHint?: boolean;
+  /** Human-facing title, shown instead of the raw tool name. */
+  title?: string;
+}
+/**
+ * A tool that does not modify anything. `destructiveHint` may only be `false`
+ * here, so a read-only tool cannot also claim it is destructive.
+ */
+interface ReadOnlyToolAnnotations extends ToolAnnotationsBase {
+  destructiveHint?: false;
+  idempotentHint?: boolean;
+  readOnlyHint: true;
+}
+/**
+ * A tool that may modify something. Both hints are REQUIRED here: a write that
+ * does not say whether it can destroy data, or whether a retry repeats its
+ * effect, is exactly the omission this type exists to rule out.
+ */
+interface WriteToolAnnotations extends ToolAnnotationsBase {
+  /** The tool may perform irreversible changes. */
+  destructiveHint: boolean;
+  /** Repeating the call with the same arguments has no additional effect. */
+  idempotentHint: boolean;
+  readOnlyHint: false;
+}
+/**
+ * MCP tool annotations — hints a client may use to decide how to present a tool
+ * (badge it read-only, confirm before a destructive call).
+ *
+ * They are hints, not enforcement: this package's actual guarantees are made at
+ * dispatch, where a write tool is refused unless `allowWrites` is set. These
+ * exist so a client can *show* the user what the server already enforces,
+ * instead of every tool looking equally dangerous.
+ *
+ * `readOnlyHint` is required on every tool, so a new tool cannot ship without
+ * declaring its access. See `./tool-annotations.test` for the compile-time proof.
+ */
+type ToolAnnotations = ReadOnlyToolAnnotations | WriteToolAnnotations;
+interface ToolDefinition {
+  /** Required: every tool declares its access (see {@link ToolAnnotations}). */
+  annotations: ToolAnnotations;
+  description: string;
+  inputSchema: ToolInputSchema;
+  name: string;
+  /**
+   * JSON Schema for the tool's `structuredContent`. Optional: a tool that
+   * emits only a text block declares none, and a client that negotiated an
+   * MCP revision older than `2025-06-18` ignores it either way.
+   */
+  outputSchema?: ToolOutputSchema;
+}
+/**
+ * The MCP `CallToolResult` shape this package's tools return.
+ *
+ * A type alias rather than an interface: the SDK's `CallToolResult` has an open
+ * index signature, which only an object-literal type satisfies implicitly.
+ */
+type ToolResult = {
+  content: {
+    text: string;
+    type: "text";
+  }[];
+  isError?: boolean;
+  /**
+   * The machine-readable result, mirroring the text block. Present on success
+   * for tools that declare an `outputSchema`, and on EVERY error result, where
+   * it is `{ code, message }`. Per the MCP spec it must be a JSON OBJECT (never
+   * a bare array) and must survive `JSON.stringify` — the transport serializes
+   * it, so an un-mapped `bigint` here fails the whole response rather than one
+   * field.
+   */
+  structuredContent?: Record<string, unknown>;
+};
+/** A tool: what to advertise in `ListTools`, and what to run on `CallTool`. */
+interface McpTool {
+  definition: ToolDefinition;
+  handle: (input: Record<string, unknown>) => Promise<ToolResult>;
+}
+/** Name/version pair reported in the MCP `initialize` handshake. */
+interface McpServerInfo {
+  name: string;
+  version: string;
+}
+/** One addressable document a client can list and read directly. */
+interface McpResourceSummary {
+  description?: string;
+  mimeType?: string;
+  name: string;
+  uri: string;
+}
+/**
+ * A set of resources the server exposes alongside its tools.
+ *
+ * Tools are calls a model chooses to make; resources are documents a *client*
+ * can enumerate and attach on its own — the user picking a page to put in
+ * context, without the model having to guess a search query first. The same
+ * corpus is worth offering both ways.
+ */
+interface McpResourceProvider {
+  /** Every resource, for `resources/list`. */
+  list: () => Promise<ReadonlyArray<McpResourceSummary>>;
+  /** One resource's body, or `undefined` when the uri is unknown. */
+  read: (uri: string) => Promise<{
+    mimeType?: string;
+    text: string;
+  } | undefined>;
+}
+/**
+ * Build an MCP `Server` that advertises and dispatches `tools`.
+ *
+ * On duplicate names the FIRST wins, so a caller can layer surfaces in
+ * precedence order without the later list silently shadowing the earlier one.
+ * Thrown errors become `isError` results rather than rejections, per the MCP
+ * convention that a tool failure is output the model can read and react to,
+ * not a protocol-level fault.
+ */
+declare const createToolServer: (info: McpServerInfo, tools: ReadonlyArray<McpTool>, resources?: McpResourceProvider) => Server;
+export { McpServerInfo as M, ToolDefinition as T, McpTool as a, ToolInputSchema as b, ToolOutputSchema as c, ToolResult as d, createToolServer as e, McpResourceProvider as f, McpResourceSummary as g, ToolAnnotations as h };

package/dist/packem_shared/connectFunctionStdio-BGPvMkc7.mjs

@@ -0,0 +1 @@
+import{StdioServerTransport as e}from"@modelcontextprotocol/sdk/server/stdio.js";import{createFunctionMcpServer as n}from"./createFunctionMcpServer-jgYBPzxQ.mjs";const a=async t=>{const r=n(t);return await r.connect(new e),r};export{a as default};

package/dist/packem_shared/connectStdio-CP2XjVvN.mjs

@@ -0,0 +1 @@
+import{StdioServerTransport as i}from"@modelcontextprotocol/sdk/server/stdio.js";import{readFileSync as a}from"node:fs";import{dirname as n,join as c}from"node:path";import{fileURLToPath as s}from"node:url";import{createLunoraMcpServer as m}from"./createLunoraMcpServer-BOsMehmQ.mjs";const p=()=>{let r=n(s(import.meta.url));for(let e=0;e<8;e+=1){try{const o=JSON.parse(a(c(r,"package.json"),"utf8"));if(o.name==="@lunora/mcp"&&typeof o.version=="string"&&o.version.length>0)return o.version}catch{}const t=n(r);if(t===r)break;r=t}},S=async r=>{const e=p(),t=m(e===void 0?r:{version:e,...r});return await t.connect(new i),t};export{S as default};

package/dist/packem_shared/createAuthedMcpFetchHandler-enQ5a-ys.mjs

@@ -0,0 +1 @@
+import{LunoraError as y}from"@lunora/errors";import{isAgentToolName as S}from"./AGENT_RUN_INPUT_SCHEMA-BGbKIek4.mjs";import{readScreenedBody as g,serveStateless as w}from"./DEFAULT_MAX_REQUEST_BYTES-CbbpkHRK.mjs";import{resolveClient as d,createLunoraMcpServer as T}from"./createLunoraMcpServer-BOsMehmQ.mjs";import{c as M}from"./tool-call-Bs-QeKp6.mjs";import{d as E,s as _,S as k}from"./tools-Bylr9LPQ.mjs";const A=t=>typeof t.scope!="string"?new Set:new Set(t.scope.split(" ").filter(c=>c!=="")),C=(t,c)=>{const o={...t};for(const{flag:s,scope:n}of k)o[s]=t[s]===!0&&c.has(n);return o},I=(t,c,o)=>{const s=new Set,n=c.agents??[];for(const l of t){const e=M(l);if(e===void 0)continue;(E.has(e)||S(e,n))&&s.add(o);const r=_(e,c);r!==void 0&&s.add(r)}return s},N=256,B=t=>{const{maxRequestBytes:c,stepUp:o}=t;if(o!==void 0&&(typeof o.scope!="string"||o.scope===""||typeof o.challenge!="function"))throw new y("MCP_STEP_UP_MISCONFIGURED","createAuthedMcpFetchHandler: `stepUp` needs a non-empty `scope` and a `challenge` function.");const s=typeof t.server=="function"?void 0:d(t.server),n=new Map,l=e=>{if(e.client!==void 0||e.url===void 0||e.token===void 0||e.token.length===0)return d(e);const r=JSON.stringify([e.url,e.token]),i=n.get(r);if(i!==void 0&&i.fetch===e.fetch)return n.delete(r),n.set(r,i),i.client;const f=d(e);return n.delete(r),n.set(r,{client:f,fetch:e.fetch}),n.size>N&&n.delete(n.keys().next().value),f};return t.protect(async(e,r)=>{const i=A(r),f=typeof t.server=="function"?await t.server(r):{...t.server,client:s};let a;if(o!==void 0){const p=await g(e,c);if("response"in p)return p.response;({parsedBody:a}=p);const m=Array.isArray(a)?a:[a],u=[...I(m,f,o.scope)].filter(v=>!i.has(v));if(u.length>0)throw o.challenge(u)}const h=C(typeof t.server=="function"?{...f,client:l(f)}:f,i);return await w(T(h),e,{maxRequestBytes:c,parsedBody:a})})};export{B as createAuthedMcpFetchHandler,A as mcpTokenScopes};

package/dist/packem_shared/createFunctionMcpServer-jgYBPzxQ.mjs

@@ -0,0 +1 @@
+import{LunoraClient as M}from"@lunora/client";import{Server as P}from"@modelcontextprotocol/sdk/server/index.js";import{ListToolsRequestSchema as B,CallToolRequestSchema as H}from"@modelcontextprotocol/sdk/types.js";import{p as W}from"./package-DsZ0-LJz.mjs";import{LunoraError as A}from"@lunora/errors";import{f as q,w as F,e as g,a as C,b as R,o as N,j as K}from"./tool-result-CPDsNNuJ.mjs";import{e as U,r as Y,f as G,g as Q}from"./tools-Bylr9LPQ.mjs";const l=t=>typeof t=="object"&&t!==null&&!Array.isArray(t),L=/^-?\d+$/,$=1024,J=(t,e,r)=>{const{contentEncoding:n,format:o}=t;if(o==="int64"){if(!L.test(e)||e.length>$)throw new A("BAD_REQUEST",`"${r}" must be a decimal integer string of at most ${String($)} digits`);return BigInt(e)}if(n==="base64")try{return q(e).buffer}catch{throw new A("BAD_REQUEST",`"${r}" must be base64`)}return e},V=(t,e)=>{const{type:r}=t;return typeof r!="string"?!0:r==="integer"||r==="number"?typeof e=="number":r==="array"?Array.isArray(e):r==="object"?l(e):r===typeof e},X=/^(?:[\dA-Z+/]{4})*(?:[\dA-Z+/]{2}==|[\dA-Z+/]{3}=)?$/i,Z=(t,e)=>t.format==="int64"&&!L.test(e)?!1:t.contentEncoding!=="base64"||X.test(e),x=(t,e)=>Object.entries(t).every(([r,n])=>!l(n)||!Object.hasOwn(n,"const")||!Object.hasOwn(e,r)?!0:e[r]===n.const),z=(t,e)=>!V(t,e)||Object.hasOwn(t,"const")&&t.const!==e||l(e)&&l(t.properties)&&!x(t.properties,e)?!1:typeof e!="string"||Z(t,e),tt=(t,e)=>{const r=t.filter(n=>l(n)&&z(n,e));return r.length===1?r[0]:void 0},et=(t,e)=>{const{additionalProperties:r,properties:n}=t,o=l(n)&&Object.hasOwn(n,e)?n[e]:r;return l(o)?o:void 0},S=(t,e,r)=>{const{anyOf:n,items:o}=t;if(e===null)return e;if(Array.isArray(n)){const a=tt(n,e);return a===void 0?e:S(a,e,r)}return typeof e=="string"?J(t,e,r):Array.isArray(e)&&l(o)?e.map((a,c)=>S(o,a,`${r}[${c.toString()}]`)):l(e)?Object.fromEntries(Object.entries(e).map(([a,c])=>{const s=et(t,a);return[a,s===void 0?c:S(s,c,`${r}.${a}`)]})):e},O=(t,e)=>S(t,e,"args"),T=t=>t==="action"||t==="mutation",rt=t=>t==="query"||t==="mutation"||t==="action"||t==="stream",k=64,nt=/[^\w-]/g,ot={destructiveHint:!1,idempotentHint:!0,openWorldHint:!0,readOnlyHint:!0},st={destructiveHint:!0,idempotentHint:!1,openWorldHint:!0,readOnlyHint:!1},it={description:"Shard key. Only for a function partitioned with .shardBy(); omit it otherwise.",type:"string"},ct="The first call only proposes the write. Confirm it with confirmed: true and the actionDigest the proposal returns.",at={action:t=>`Runs the action "${t}", which may call external services.`,mutation:t=>`Runs the mutation "${t}", which changes data.`,query:t=>`Runs the query "${t}". Read-only.`,stream:t=>`Runs the stream "${t}", which yields chunks. The result is every chunk, in order. Read-only.`},dt=(t,e)=>{const r=t.description??at[t.kind](t.path);return e?`${r} ${ct}`:r},b=()=>new A("BAD_REQUEST","openRpcSpec must be the OpenRPC document codegen emits (the `openRpcSpec` export of `_generated/openrpc`)"),lt=t=>t.replaceAll(nt,"_"),_=t=>Array.isArray(t)?t.some(e=>_(e)):l(t)&&(t.writeOnly===!0||Object.values(t).some(e=>_(e))),ut=t=>{const{properties:e}=t;return l(e)?Object.entries(e).filter(([,r])=>_(r)).map(([r])=>r):[]},ft=t=>{const e=l(t)&&l(t.schema)?t.schema:void 0,r=e!==void 0&&Object.hasOwn(e,"description")&&Object.keys(e).every(n=>n==="description");return e===void 0||r?{mode:"none"}:e.type==="object"?{mode:"object",schema:{...e,type:"object"}}:{mode:"wrapped",schema:{properties:{result:e},type:"object"}}},mt=t=>{const{params:e}=t,r=Array.isArray(e)?e.find(o=>l(o)&&o.name==="args"):void 0,n=l(r)?r.schema:void 0;return l(n)?n:{properties:{},type:"object"}},ht=t=>{if(!l(t))throw b();const{name:e}=t;if(typeof e!="string")throw b();const r=t["x-lunora-function-kind"];if(!rt(r))return;const n=t["x-lunora-description"];return{argsSchema:mt(t),...typeof n=="string"?{description:n}:{},kind:r,output:r==="stream"?{mode:"none"}:ft(t.result),path:e}},pt=(t,e)=>{const r=lt(t);if(r.length>k)throw new A("BAD_REQUEST",`the MCP tool name for "${t}" is ${r.length.toString()} characters; the limit is ${k.toString()}. Rename the function.`);const n=e.get(r);if(n!==void 0)throw new A("BAD_REQUEST",`"${t}" and "${n}" both map to the MCP tool name "${r}". Rename one of them.`);return e.set(r,t),r},gt=t=>{const{required:e}=t.argsSchema;return Array.isArray(e)&&e.length>0},yt=(t,e)=>({properties:{args:t.argsSchema,shardKey:it,...e?U:{}},required:gt(t)?["args"]:[],type:"object"}),At={additionalProperties:!1,properties:{},type:"object"},St=t=>{if(t.mode==="none")return;const e=F(t.schema);return t.mode==="object"?{...e,anyOf:[...e.anyOf??[],At]}:e},Ot=(t,e)=>{const r=T(e.kind),n=`${e.kind} ${e.path}`,o=r?void 0:St(e.output);return{annotations:r?{...st,title:n}:{...ot,title:n},description:dt(e,r),inputSchema:yt(e,r),name:t,...o===void 0?{}:{outputSchema:o}}},wt=t=>({argsSchema:t.argsSchema,kind:t.kind,outputMode:t.output.mode,path:t.path,sensitiveArgs:ut(t.argsSchema)}),Et=(t,e)=>{const r=l(t)?t.methods:void 0;if(!Array.isArray(r))throw b();const n=[],o=new Map,a=new Map;for(const c of r){const s=ht(c);if(s===void 0)continue;const i=pt(s.path,a);o.set(i,wt(s)),(!T(s.kind)||e.allowWrites)&&n.push(Ot(i,s))}return{definitions:n,routes:o}},Rt="lunora",j=t=>({__lunoraRef:t}),bt=t=>typeof t.shardKey=="string"&&t.shardKey.length>0?t.shardKey:void 0,D=(t,e)=>t.outputMode==="object"?e===void 0?{...R(e),structuredContent:{}}:N(e):t.outputMode==="wrapped"?N({result:e}):R(e),_t=async(t,e,r,n,o,a,c)=>{const s=e.kind==="action"?"action":"mutation";O(e.argsSchema,o);const i=G(n),f=await Q(t,{args:o,functionPath:e.path,idempotencyKey:i.idempotencyKey,kind:s,shardKey:a,tool:r},i,e.sensitiveArgs,["args","shardKey","idempotencyKey"]);if(f!==void 0)return f;const d=O(e.argsSchema,o),u=e.sensitiveArgs.length===0?j(e.path):{__lunoraRef:e.path,sensitive:!0},m=s==="action"?await t.action(u,d,{shardKey:a,signal:c}):await t.mutation(u,d,{onlineOnly:!0,shardKey:a,signal:c});return D(e,m)},E=1e4,v=16*1024*1024,Tt=async(t,e,r,n,o)=>{const a={__lunoraRef:e.path},c=t.stream(a,r,{maxBuffer:E+1,shardKey:n}),{signal:s,progress:i}=o,f=()=>{c.cancel()};s?.addEventListener("abort",f,{once:!0}),s?.aborted===!0&&f();const d=[];let u=0,m=Promise.resolve(),p;const w=(h,y)=>{m=m.then(()=>p===void 0?i?.(h,y):void 0).catch(I=>{p={error:I},c.cancel()})};try{for await(const h of c){if(d.length===E)return c.cancel(),g("PAYLOAD_TOO_LARGE",`the stream "${e.path}" yielded more than ${E.toString()} chunks, so it was cancelled and no chunks are returned.`);const y=h===void 0?"null":JSON.stringify(h,K);if(u+=y.length,u>v)return c.cancel(),g("PAYLOAD_TOO_LARGE",`the stream "${e.path}" yielded more than ${v.toString()} characters of JSON, so it was cancelled and no chunks are returned.`);d.push(h),i!==void 0&&w(d.length-1,y)}}finally{s?.removeEventListener("abort",f)}if(await m,p!==void 0)throw p.error;return s?.aborted===!0?g("CANCELLED",`the stream "${e.path}" was cancelled before it completed, after ${d.length.toString()} chunk(s).`):R(d)},Nt=async(t,e,r,n,o,a={})=>{const c=e.get(r);if(c===void 0)return g("NOT_FOUND",`unknown tool: ${r}`);if(T(c.kind)&&!o)return g("FORBIDDEN",`tool "${r}" is disabled: this MCP server is read-only. Enable writes with allowWrites.`);try{const s=Y(n.args),i=bt(n);return c.kind==="query"?D(c,await t.query(j(c.path),O(c.argsSchema,s),{shardKey:i,signal:a.signal})):c.kind==="stream"?await Tt(t,c,O(c.argsSchema,s),i,a):await _t(t,c,r,n,s,i,a.signal)}catch(s){return a.signal?.aborted===!0?g("CANCELLED",`the call to "${r}" was cancelled before it completed. A write already sent is not undone.`):C(s)}},$t=t=>{let e;const r=new Set,n=i=>{i.calls===0&&r.delete(i)&&i.client.close()},o=i=>{r.add(i),n(i)},a=()=>{e!==void 0&&(o(e),e=void 0)};return{acquire:()=>{const i=typeof t.url=="function"?t.url():t.url;if(i===void 0||i.length===0){a();return}if(e?.url!==i){a();const u=new M({fetch:t.fetch,url:i,WebSocket:t.WebSocket});t.token!==void 0&&(u.setAuthToken(t.token),u.setWsToken(t.token)),e={calls:0,client:u,url:i}}const f=e;f.calls+=1;let d=!0;return{client:f.client,done:()=>{d&&(d=!1,f.calls-=1,n(f))}}},release:()=>{a();for(const i of r)r.delete(i),i.client.close()}}},Mt=t=>{const e=t.allowWrites??!1,r=()=>typeof t.openRpcSpec=="function"?t.openRpcSpec():t.openRpcSpec,n=d=>({spec:d,tools:Et(d,{allowWrites:e})});let o=n(r());const{acquire:a,release:c}=$t(t),s=new P({name:t.name??Rt,version:t.version??W.version},{capabilities:{tools:{listChanged:!0}}}),i=()=>{let d;try{d=r()}catch(u){return t.onReloadError?.(u),o.tools}if(d!==o.spec)try{o=n(d),s.sendToolListChanged().catch(()=>{})}catch(u){t.onReloadError?.(u),o={spec:d,tools:o.tools}}return o.tools},f=s.close.bind(s);return s.close=async()=>{c(),await f()},s.setRequestHandler(B,()=>({tools:[...i().definitions]})),s.setRequestHandler(H,async(d,u)=>{let m;try{m=a()}catch(h){return C(h)}if(m===void 0)return g("SERVICE_UNAVAILABLE","no Lunora deployment URL is available yet. Start `lunora dev` or set the deployment URL, then call the tool again.");const{progressToken:p}=u._meta??{},w={signal:u.signal,...p===void 0?{}:{progress:async(h,y)=>{await u.sendNotification({method:"notifications/progress",params:{message:y,progress:h,progressToken:p}})}}};try{return await Nt(m.client,i().routes,d.params.name,d.params.arguments??{},e,w)}finally{m.done()}}),s};export{E as MAX_STREAM_CHUNKS,Nt as callFunctionTool,Mt as createFunctionMcpServer};

package/dist/packem_shared/createLunoraMcpServer-BOsMehmQ.mjs

@@ -0,0 +1 @@
+import{LunoraClient as g}from"@lunora/client";import{LunoraError as m}from"@lunora/errors";import{Server as w}from"@modelcontextprotocol/sdk/server/index.js";import{ListToolsRequestSchema as d,CallToolRequestSchema as h}from"@modelcontextprotocol/sdk/types.js";import{p as A}from"./package-DsZ0-LJz.mjs";import{agentToolDefinitions as M,isAgentToolName as T,callAgentTool as R}from"./AGENT_RUN_INPUT_SCHEMA-BGbKIek4.mjs";import{t as k,c as N}from"./tools-Bylr9LPQ.mjs";const E="lunora",L=e=>{if(e.client!==void 0)return e.client;if(e.url===void 0)throw new m("INTERNAL","createLunoraMcpServer requires either a `client` or a `url`");if(e.token===void 0||e.token.length===0)throw new m("UNAUTHENTICATED","createLunoraMcpServer requires a `token` (LUNORA_ADMIN_TOKEN) alongside `url`: every tool reaches admin-gated /_lunora/admin/* routes, so an unauthenticated server can only 403. Writes stay off unless `allowWrites` is set.");const t=new g({fetch:e.fetch,url:e.url});return t.setAuthToken(e.token),t},C=e=>{const t=L(e),n=e.allowWrites??!1,o=e.allowAgents??!1,r=e.agents??[],s=typeof e.token=="string"&&e.token.length>0,i=e.allowObservability===!0&&s,c=e.allowDataReads===!0&&s,a=new w({name:E,version:e.version??A.version},{capabilities:{tools:{}}});return a.setRequestHandler(d,()=>({tools:[...k(n,i,c),...M(r,o)]})),a.setRequestHandler(h,async v=>{const{arguments:f,name:l}=v.params,u=f??{};return T(l,r)?await R(t,l,u,{allowAgents:o,exposures:r,...e.agentMaxWaitMs===void 0?{}:{maxWaitMs:e.agentMaxWaitMs},...e.agentPollIntervalMs===void 0?{}:{pollIntervalMs:e.agentPollIntervalMs}}):await N(t,l,u,n,i,c)}),a};export{C as createLunoraMcpServer,L as resolveClient};

package/dist/packem_shared/createMcpFetchHandler-C_pTZ-1E.mjs

@@ -0,0 +1 @@
+import{serveStateless as c}from"./DEFAULT_MAX_REQUEST_BYTES-CbbpkHRK.mjs";import{DEFAULT_MAX_REQUEST_BYTES as u}from"./DEFAULT_MAX_REQUEST_BYTES-CbbpkHRK.mjs";import{resolveClient as s,createLunoraMcpServer as a}from"./createLunoraMcpServer-BOsMehmQ.mjs";const l=e=>{const r=s(e);return t=>c(a({...e,client:r}),t,{maxRequestBytes:e.maxRequestBytes})};export{u as DEFAULT_MAX_REQUEST_BYTES,l as createMcpFetchHandler,c as serveStateless};

package/dist/packem_shared/createPaidMcpServer-CdDLw3G4.mjs

@@ -0,0 +1 @@
+import{LunoraError as B}from"@lunora/errors";import{Server as E}from"@modelcontextprotocol/sdk/server/index.js";import{CallToolRequestSchema as M,ListToolsRequestSchema as P}from"@modelcontextprotocol/sdk/types.js";import{CfWorkerJsonSchemaValidator as _}from"@modelcontextprotocol/sdk/validation/cfworker";import{m as b}from"./promise-memo-OqVPWoUX.mjs";import{readScreenedBody as x,serveStateless as A}from"./DEFAULT_MAX_REQUEST_BYTES-CbbpkHRK.mjs";import{c as S}from"./tool-call-Bs-QeKp6.mjs";import{e as C,a as F}from"./tool-result-CPDsNNuJ.mjs";let T;const H=()=>(T??=new _,T),N=(t,o,s)=>{const d=t.validate(s);return d.valid?void 0:C("BAD_REQUEST",`invalid arguments for tool "${o}": ${d.errorMessage}`)},V=async()=>{try{return(await import("@lunora/x402/charge")).createChargeMiddleware}catch(t){throw new B("INTERNAL",`paid MCP tools need the optional peer "@lunora/x402" — install it alongside @lunora/mcp to charge for tools (${t instanceof Error?t.message:String(t)})`)}},$={name:"lunora-paid-mcp",version:"0.0.0"},q=()=>Response.json({error:"A JSON-RPC batch may not reference a paid MCP tool; send paid tools/call requests individually."},{status:400}),D=async(t,o,s,d,u)=>{const l={reached:!1},p=new E({name:"lunora-paid-mcp-preflight",version:"0.0.0"},{capabilities:{tools:{}}});p.setRequestHandler(M,v=>{const f=N(d,s,v.params.arguments??{});return l.reached=f===void 0&&v.params.name===s,f??{content:[]}});const h=await A(p,t,{maxRequestBytes:u,parsedBody:o});return l.reached?void 0:h},K=t=>{const o=new Map,s=new Map,d=new Map,u=t.serverInfo??$,l=(e,r,a)=>{if(o.has(e.name))throw new B("BAD_REQUEST",`MCP tool "${e.name}" is already registered.`);const n={annotations:e.annotations,description:e.description,inputSchema:e.inputSchema,name:e.name};o.set(e.name,{definition:n,handler:r,validate:H().getValidator(n.inputSchema)}),a!==void 0&&s.set(e.name,a)},p=()=>{const e=new E(u,{capabilities:{tools:{}}});return e.setRequestHandler(P,()=>({tools:[...o.values()].map(r=>r.definition)})),e.setRequestHandler(M,async r=>{const a=o.get(r.params.name);if(a===void 0)return C("NOT_FOUND",`unknown tool: ${r.params.name}`);const n=r.params.arguments??{},i=N(a,r.params.name,n);if(i!==void 0)return i;try{return await a.handler(n)}catch(m){return F(m)}}),e},h=(e,r)=>b(d,e,async()=>(await V())({...t.charge,price:r},{resource:e}));return{fetchHandler:async(e,r,a)=>{const n=await x(e.clone(),t.maxRequestBytes);if("response"in n)return n.response;const{parsedBody:i}=n,m=()=>A(p(),e,{maxRequestBytes:t.maxRequestBytes,parsedBody:i});if(Array.isArray(i))return i.some(w=>s.has(S(w)??""))?q():m();const c=S(i),y=c===void 0?void 0:s.get(c),R=c===void 0?void 0:o.get(c);if(c===void 0||y===void 0||R===void 0)return m();const g=await D(e,i,c,R,t.maxRequestBytes);if(g!==void 0)return g;const U=await h(c,y),j=typeof a?.waitUntil=="function"?{waitUntil:w=>{a.waitUntil?.(w)}}:void 0;return U.handle(e,m,j)},paidTool:(e,r)=>{l(e,r,e.price)},tool:(e,r)=>{l(e,r)}}};export{K as createPaidMcpServer};

package/dist/packem_shared/createToolServer-CHAjfuNx.mjs

@@ -0,0 +1 @@
+import{Server as l}from"@modelcontextprotocol/sdk/server/index.js";import{ListToolsRequestSchema as p,CallToolRequestSchema as h,ListResourcesRequestSchema as d,ReadResourceRequestSchema as w}from"@modelcontextprotocol/sdk/types.js";import{w as R,e as f,a as S}from"./tool-result-CPDsNNuJ.mjs";const y=(u,c,s)=>{const a=new Map;for(const e of c)a.has(e.definition.name)||a.set(e.definition.name,e);const i=[...a.values()].map(({definition:e})=>e.outputSchema===void 0?e:{...e,outputSchema:R(e.outputSchema)}),r=new l(u,{capabilities:s===void 0?{tools:{}}:{resources:{},tools:{}}});return r.setRequestHandler(p,()=>({tools:i})),r.setRequestHandler(h,async e=>{const{arguments:o,name:t}=e.params,n=a.get(t);if(n===void 0)return f("NOT_FOUND",`unknown tool: ${t}`);try{return await n.handle(o??{})}catch(m){return S(m)}}),s!==void 0&&(r.setRequestHandler(d,async()=>({resources:[...await s.list()]})),r.setRequestHandler(w,async e=>{const{uri:o}=e.params,t=await s.read(o);if(t===void 0)throw new Error(`unknown resource: ${o}`);return{contents:[{mimeType:t.mimeType??"text/plain",text:t.text,uri:o}]}})),r};export{y as createToolServer};

package/dist/packem_shared/function-server.d-ByIkBRXs.d.ts

@@ -0,0 +1,196 @@
+import { LunoraClient } from '@lunora/client';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { b as ToolInputSchema, T as ToolDefinition, d as ToolResult } from "./compose.d-DiPnHeQv.js";
+/**
+ * Agent exposure for the MCP server: a durable `@lunora/agent` run fronted as an
+ * MCP tool an external agent can call. The capability boundary is the MCP-server
+ * process + its token, so WHICH agents are exposed is config on the server (like
+ * `allowWrites`), not on `defineAgent` — keeping `@lunora/agent` codegen
+ * byte-identical.
+ */
+interface McpAgentExposure {
+  /** What the agent does — shown to the calling model, which decides from it. */
+  description: string;
+  /** The agent's export name (its `ctx.agents.<name>` / `AGENT_<NAME>` binding). */
+  name: string;
+  /** Override the model-facing tool name (default `agent_<name>`). */
+  toolName?: string;
+}
+/** The generic status/poll tool advertised alongside the per-agent tools. */
+declare const AGENT_STATUS_TOOL_NAME = "lunora_agent_status";
+/**
+ * The uniform input schema every agent tool advertises. Agents share ONE run
+ * input (`@lunora/agent` has no per-agent validator), so there is nothing to
+ * derive per agent — a single static schema is reused for every agent tool.
+ */
+declare const AGENT_RUN_INPUT_SCHEMA: ToolInputSchema;
+/**
+ * Parse `LUNORA_MCP_AGENTS` — a `;`-separated list of `name:description` pairs,
+ * e.g. `"support:Handles support questions;billing:Billing help"`. The
+ * description may itself contain colons (only the FIRST colon splits). Blank
+ * entries and entries with an empty name/description are skipped.
+ */
+declare const parseAgentsEnv: (raw: string | undefined) => McpAgentExposure[];
+/**
+ * The tools this module advertises. Fail-closed: only the boolean `true` opts
+ * in (an env-plumbed caller could pass a truthy string), and the tools appear
+ * ONLY when at least one agent is exposed — so an agent-free or non-opted-in
+ * server never lists them.
+ */
+declare const agentToolDefinitions: (exposures: ReadonlyArray<McpAgentExposure>, allowAgents: boolean) => ReadonlyArray<ToolDefinition>;
+/** Options threaded into a single agent tool dispatch. */
+interface CallAgentToolOptions {
+  /** Opt-in gate — must be exactly `true` or the call is refused fail-closed. */
+  allowAgents: boolean;
+  /** The exposures advertised by this server. */
+  exposures: ReadonlyArray<McpAgentExposure>;
+  /** Wall-clock budget a single call awaits before returning a pending result. */
+  maxWaitMs?: number;
+  /** Delay between thread-status polls. */
+  pollIntervalMs?: number;
+  /** Test seam replacing the between-poll wait; production uses a real timer. */
+  wait?: (ms: number) => Promise<void>;
+}
+/**
+ * Dispatch an agent tool call: start a durable run via `agents:agentRun`, then
+ * await-with-timeout — poll `agents:agentThread` until terminal (returning the
+ * final answer from `agents:agentMessages`) or, on budget exhaustion, return a
+ * NON-error pending payload the caller resumes with `lunora_agent_status`.
+ *
+ * Fail-closed: refused at dispatch unless `allowAgents === true`, mirroring the
+ * `allowWrites` guard — starting a run is a side effect and must not ride the
+ * read-only default.
+ */
+declare const callAgentTool: (client: LunoraClient, name: string, input: Record<string, unknown>, options: CallAgentToolOptions) => Promise<ToolResult>;
+interface LunoraMcpServerOptions {
+  /** Wall-clock budget a single agent tool call awaits before returning a pending result. */
+  agentMaxWaitMs?: number;
+  /** Delay between agent thread-status polls. */
+  agentPollIntervalMs?: number;
+  /** The agents this server fronts as MCP tools (see `allowAgents`). */
+  agents?: ReadonlyArray<McpAgentExposure>;
+  /**
+   * Expose the per-agent tools (`agent_<name>` + the generic
+   * `lunora_agent_status`). Defaults to `false`, mirroring `allowWrites`:
+   * starting a durable agent run is a side effect, so the agent tools are
+   * omitted from the advertised list AND refused at dispatch unless explicitly
+   * opted in. Only takes effect together with a non-empty `agents` list.
+   */
+  allowAgents?: boolean;
+  /**
+   * Expose `lunora_find_related`, which returns raw table rows read through the
+   * admin writer, so RLS policies and column masks do not apply. Defaults to
+   * `false`, for the same reason as `allowObservability`. Only takes effect
+   * when a `token` resolved. On the OAuth-protected path the verified token must
+   * also carry the data-read scope (see `DATA_READ_SCOPE` in `./tools`).
+   */
+  allowDataReads?: boolean;
+  /**
+   * Expose the observability tools (`lunora_get_logs`, `lunora_get_issues`,
+   * `lunora_get_advisories`, `lunora_get_query_insights`,
+   * `lunora_get_migration_status`). Defaults to `false`, mirroring
+   * `allowWrites`: they are read-only, but every row they return — log lines,
+   * request metadata, grouped error messages — is production user data that
+   * lands in the model's context and therefore at its provider. Holding the
+   * admin bearer is not consent to ship that, so it is a separate opt-in;
+   * without it the tools are omitted from the advertised list AND refused at
+   * dispatch. Only takes effect when a `token` resolved. On the OAuth-protected
+   * path the verified token must also carry the observability scope (see
+   * `OBSERVABILITY_SCOPE` in `./tools`); this option stays the outer gate.
+   */
+  allowObservability?: boolean;
+  /**
+   * Expose the write tools (`lunora_run_mutation` / `lunora_run_action`).
+   * Defaults to `false`: the server is READ-ONLY unless explicitly opted in,
+   * so a prompt-injected or misaligned agent can't mutate the deployment with
+   * the configured token. When false the write tools are omitted from the
+   * advertised tool list AND refused at dispatch.
+   */
+  allowWrites?: boolean;
+  /**
+   * Pre-built client (test injection). When omitted a `LunoraClient` is
+   * created from `url`/`token`/`fetch`.
+   */
+  client?: LunoraClient;
+  /** `fetch` implementation; defaults to the ambient global. */
+  fetch?: typeof fetch;
+  /**
+   * Bearer token sent on every RPC. **Required** alongside `url`, and it must
+   * be the deployment's **admin bearer**: the introspection/allowlist path
+   * every tool depends on (`lunora_list_functions`, `lunora_list_tables`, and
+   * the `assertRunnable` precheck that runs before every `run` tool) hits
+   * admin-gated `/_lunora/admin/*` routes, so no scoped/app token works
+   * today — it would 403 (`ADMIN_FORBIDDEN`) on the first tool call. The
+   * read-only guarantee is therefore NOT enforced by the token's scope; it is
+   * enforced in-process via `allowWrites: false` (the default), which omits
+   * the write tools from the advertised list and refuses them at dispatch.
+   *
+   * Because EVERY tool needs it, omitting it is a misconfiguration rather than
+   * a reduced-capability mode, and `createLunoraMcpServer` says so at
+   * construction instead of advertising a surface that 403s on first use. The
+   * one exception is the `client` injection seam (tests / a pre-authenticated
+   * client), where this server cannot know what the client can reach and so
+   * reads "unknown" fail-closed: the privileged observability tools stay
+   * unadvertised and are refused at dispatch.
+   */
+  token?: string;
+  /** Base URL of the deployed Lunora Worker. Required unless `client` is given. */
+  url?: string;
+  /** Version reported in the `initialize` handshake. Defaults to the version bundled at build time. */
+  version?: string;
+}
+/**
+ * Build an MCP `Server` whose tools talk to a Lunora deployment. The server is
+ * transport-agnostic — call `.connect(transport)` yourself, or use
+ * `connectStdio` for the common stdio case.
+ *
+ * Tool calls are dispatched through `callTool`, which the deployment reaches
+ * over HTTP RPC. No WebSocket is opened (the tools never subscribe), so this is
+ * safe to run as a short-lived stdio process.
+ */
+declare const createLunoraMcpServer: (options: LunoraMcpServerOptions) => Server;
+interface FunctionMcpServerOptions {
+  /**
+   * Advertise and allow mutation and action tools. Off by default. A closed write
+   * is not listed and is refused at dispatch.
+   */
+  allowWrites?: boolean;
+  fetch?: typeof fetch;
+  /** The MCP server name clients show. Defaults to `lunora`. */
+  name?: string;
+  /**
+   * Told when a rewritten document cannot be read or built. The server keeps the tools it
+   * last built, so the error is reported here rather than failing the request.
+   */
+  onReloadError?: (error: unknown) => void;
+  /**
+   * The `openRpcSpec` export of `_generated/openrpc`, or a function returning it. A
+   * function is called on every `tools/list` and `tools/call`, so the tools follow a
+   * document that codegen rewrites while the server runs. Return the same object
+   * while the document is unchanged: a different object rebuilds the tools.
+   */
+  openRpcSpec: unknown;
+  /** The CALLER's bearer. Writes need one: the confirmation digest is keyed by it. */
+  token?: string;
+  /**
+   * The Lunora deployment URL the app talks to. A function is resolved on every
+   * call, so a server started before `lunora dev` picks the URL up once it exists.
+   * `undefined` means no deployment is running yet, and the call says so.
+   */
+  url: string | (() => string | undefined);
+  version?: string;
+  /**
+   * The WebSocket class streams open with. Defaults to the global `WebSocket`, which a
+   * runtime without one (older Node) lacks, so such a host passes its own here.
+   */
+  WebSocket?: typeof WebSocket;
+}
+/**
+ * Build an MCP `Server` with one tool per function in `openRpcSpec`. Transport
+ * agnostic: call `.connect(transport)` yourself.
+ *
+ * Throws at construction when the document is malformed or two functions share a
+ * tool name, so a bad integration fails at startup rather than on the first call.
+ */
+declare const createFunctionMcpServer: (options: FunctionMcpServerOptions) => Server;
+export { AGENT_RUN_INPUT_SCHEMA as A, CallAgentToolOptions as C, FunctionMcpServerOptions as F, LunoraMcpServerOptions as L, McpAgentExposure as M, AGENT_STATUS_TOOL_NAME as a, agentToolDefinitions as b, callAgentTool as c, createFunctionMcpServer as d, createLunoraMcpServer as e, parseAgentsEnv as p };