@lunora/mcp 1.0.0-alpha.6 → 1.0.0-alpha.60

package/dist/index.d.mts

@@ -1,30 +1,302 @@
 import { LunoraClient } from '@lunora/client';
+import { T as ToolDefinition, f as ToolResult, e as ToolInputSchema, a as McpFetchHandler, b as McpTool } from "./packem_shared/serve-stateless.d-DX0di_lv.mjs";
+export { type d as McpServerInfo, g as createToolServer, s as serveStateless } from "./packem_shared/serve-stateless.d-DX0di_lv.mjs";
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { Tool } from '@modelcontextprotocol/sdk/types.js';
+import '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
+/** The read-only tool surface: introspection + query. Always exposed. */
+declare const READ_ONLY_TOOL_DEFINITIONS: ReadonlyArray<ToolDefinition>;
+/** The write tool surface (mutations + actions). Exposed ONLY when writes are enabled. */
+declare const WRITE_TOOL_DEFINITIONS: ReadonlyArray<ToolDefinition>;
+/**
+ * The tools this server advertises. When `allowWrites` is false (the default),
+ * only the read-only surface is exposed — the mutation/action tools are omitted
+ * from `ListTools` entirely, so an AI agent can't invoke a write it can't see.
+ */
+declare const toolDefinitions: (allowWrites: boolean) => ReadonlyArray<ToolDefinition>;
+/**
+ * Dispatch a tool call against `client`. Unknown tools and thrown errors are
+ * returned as `isError` results (rather than rejections) so the calling model
+ * sees the failure as tool output, per the MCP convention.
+ *
+ * `allowWrites` gates the mutation/action tools: when false (the default) a call
+ * to a write tool is refused even if the client somehow names it, so the
+ * read-only guarantee holds at dispatch, not just in the advertised tool list.
+ */
+declare const callTool: (client: LunoraClient, name: string, input: Record<string, unknown>, allowWrites?: boolean) => Promise<ToolResult>;
+/**
+ * Agent exposure for the MCP server: a durable `@lunora/agent` run fronted as an
+ * MCP tool an external agent can call. The capability boundary is the MCP-server
+ * process + its token, so WHICH agents are exposed is config on the server (like
+ * `allowWrites`), not on `defineAgent` — keeping `@lunora/agent` codegen
+ * byte-identical.
+ */
+interface McpAgentExposure {
+  /** What the agent does — shown to the calling model, which decides from it. */
+  description: string;
+  /** The agent's export name (its `ctx.agents.<name>` / `AGENT_<NAME>` binding). */
+  name: string;
+  /** Override the model-facing tool name (default `agent_<name>`). */
+  toolName?: string;
+}
+/** The generic status/poll tool advertised alongside the per-agent tools. */
+declare const AGENT_STATUS_TOOL_NAME = "lunora_agent_status";
+/**
+ * The uniform input schema every agent tool advertises. Agents share ONE run
+ * input (`@lunora/agent` has no per-agent validator), so there is nothing to
+ * derive per agent — a single static schema is reused for every agent tool.
+ */
+declare const AGENT_RUN_INPUT_SCHEMA: ToolInputSchema;
+/**
+ * Parse `LUNORA_MCP_AGENTS` — a `;`-separated list of `name:description` pairs,
+ * e.g. `"support:Handles support questions;billing:Billing help"`. The
+ * description may itself contain colons (only the FIRST colon splits). Blank
+ * entries and entries with an empty name/description are skipped.
+ */
+declare const parseAgentsEnv: (raw: string | undefined) => McpAgentExposure[];
+/**
+ * The tools this module advertises. Fail-closed: only the boolean `true` opts
+ * in (an env-plumbed caller could pass a truthy string), and the tools appear
+ * ONLY when at least one agent is exposed — so an agent-free or non-opted-in
+ * server never lists them.
+ */
+declare const agentToolDefinitions: (exposures: ReadonlyArray<McpAgentExposure>, allowAgents: boolean) => ReadonlyArray<ToolDefinition>;
+/** Options threaded into a single agent tool dispatch. */
+interface CallAgentToolOptions {
+  /** Opt-in gate — must be exactly `true` or the call is refused fail-closed. */
+  allowAgents: boolean;
+  /** The exposures advertised by this server. */
+  exposures: ReadonlyArray<McpAgentExposure>;
+  /** Wall-clock budget a single call awaits before returning a pending result. */
+  maxWaitMs?: number;
+  /** Delay between thread-status polls. */
+  pollIntervalMs?: number;
+  /** Test seam replacing the between-poll wait; production uses a real timer. */
+  wait?: (ms: number) => Promise<void>;
+}
+/**
+ * Dispatch an agent tool call: start a durable run via `agents:agentRun`, then
+ * await-with-timeout — poll `agents:agentThread` until terminal (returning the
+ * final answer from `agents:agentMessages`) or, on budget exhaustion, return a
+ * NON-error pending payload the caller resumes with `lunora_agent_status`.
+ *
+ * Fail-closed: refused at dispatch unless `allowAgents === true`, mirroring the
+ * `allowWrites` guard — starting a run is a side effect and must not ride the
+ * read-only default.
+ */
+declare const callAgentTool: (client: LunoraClient, name: string, input: Record<string, unknown>, options: CallAgentToolOptions) => Promise<ToolResult>;
 interface LunoraMcpServerOptions {
+  /** Wall-clock budget a single agent tool call awaits before returning a pending result. */
+  agentMaxWaitMs?: number;
+  /** Delay between agent thread-status polls. */
+  agentPollIntervalMs?: number;
+  /** The agents this server fronts as MCP tools (see `allowAgents`). */
+  agents?: ReadonlyArray<McpAgentExposure>;
+  /**
+   * Expose the per-agent tools (`agent_<name>` + the generic
+   * `lunora_agent_status`). Defaults to `false`, mirroring `allowWrites`:
+   * starting a durable agent run is a side effect, so the agent tools are
+   * omitted from the advertised list AND refused at dispatch unless explicitly
+   * opted in. Only takes effect together with a non-empty `agents` list.
+   */
+  allowAgents?: boolean;
+  /**
+   * Expose the write tools (`lunora_run_mutation` / `lunora_run_action`).
+   * Defaults to `false`: the server is READ-ONLY unless explicitly opted in,
+   * so a prompt-injected or misaligned agent can't mutate the deployment with
+   * the configured token. When false the write tools are omitted from the
+   * advertised tool list AND refused at dispatch.
+   */
+  allowWrites?: boolean;
+  /**
+   * Pre-built client (test injection). When omitted a `LunoraClient` is
+   * created from `url`/`token`/`fetch`.
+   */
   client?: LunoraClient;
+  /** `fetch` implementation; defaults to the ambient global. */
   fetch?: typeof fetch;
+  /**
+   * Bearer token sent on every RPC. This must be the deployment's **admin
+   * bearer**: the introspection/allowlist path every tool depends on
+   * (`lunora_list_functions`, `lunora_list_tables`, and the `assertRunnable`
+   * precheck that runs before every `run` tool) hits admin-gated
+   * `/_lunora/admin/*` routes, so no scoped/app token works today — it would
+   * 403 (`ADMIN_FORBIDDEN`) on the first tool call. The read-only guarantee is
+   * therefore NOT enforced by the token's scope; it is enforced in-process via
+   * `allowWrites: false` (the default), which omits the write tools from the
+   * advertised list and refuses them at dispatch.
+   */
   token?: string;
+  /** Base URL of the deployed Lunora Worker. Required unless `client` is given. */
   url?: string;
 }
+/**
+ * Build an MCP `Server` whose tools talk to a Lunora deployment. The server is
+ * transport-agnostic — call `.connect(transport)` yourself, or use
+ * `connectStdio` for the common stdio case.
+ *
+ * Tool calls are dispatched through `callTool`, which the deployment reaches
+ * over HTTP RPC. No WebSocket is opened (the tools never subscribe), so this is
+ * safe to run as a short-lived stdio process.
+ */
 declare const createLunoraMcpServer: (options: LunoraMcpServerOptions) => Server;
+/**
+ * Build the server and connect it over stdio — the transport MCP clients use
+ * when they spawn the `lunora-mcp` binary. Resolves once the transport is
+ * connected; the process then stays alive serving requests.
+ */
 declare const connectStdio: (options: LunoraMcpServerOptions) => Promise<Server>;
-interface ToolInputSchema {
-  properties: Record<string, unknown>;
-  required?: ReadonlyArray<string>;
-  type: "object";
+/**
+ * Build a stateless Streamable-HTTP fetch handler for a Lunora MCP server. Each
+ * invocation constructs a fresh proxy server and serves the request through
+ * {@link serveStateless}.
+ */
+declare const createMcpFetchHandler: (options: LunoraMcpServerOptions) => McpFetchHandler;
+/** A Lunora deployment the tools dispatch against. */
+interface LocalDeployment {
+  token?: string;
+  url: string;
 }
-interface ToolDefinition {
+/**
+ * Where the deployment comes from: a fixed value, or a function consulted on
+ * every tool call.
+ *
+ * The resolver form exists because an editor spawns this server when the
+ * project opens — routinely *before* `lunora dev` is running, and it keeps the
+ * process alive across every restart afterwards. A URL captured once at startup
+ * would therefore be absent for the entire first session and stale after the
+ * first restart.
+ */
+type LocalDeploymentSource = (() => LocalDeployment | undefined) | LocalDeployment;
+interface LocalMcpServerOptions {
+  /**
+   * Expose the deployment write tools (`lunora_run_mutation` /
+   * `lunora_run_action`). Defaults to `false` — the same fail-closed default
+   * as the remote server. Locally the blast radius is dev data rather than
+   * production, but a mutation is still a side effect an agent should be
+   * granted deliberately.
+   */
+  allowWrites?: boolean;
+  /**
+   * The Lunora deployment (usually the running dev server) to expose. Omit to
+   * leave the deployment tools out entirely.
+   */
+  deployment?: LocalDeploymentSource;
+  /** Docs site origin backing the documentation tools; `false` omits them. */
+  docs?: false | {
+    baseUrl?: string;
+  };
+  /** Extra tools to compose in, e.g. the CLI's local dev-server tools. */
+  extraTools?: ReadonlyArray<McpTool>;
+  /** `fetch` implementation; defaults to the ambient global. */
+  fetch?: typeof fetch;
+  /** Version reported in the MCP handshake — the host CLI's, not this package's. */
+  version?: string;
+}
+/** Server identity advertised in the MCP `initialize` handshake. */
+declare const LOCAL_SERVER_NAME = "lunora";
+/** Shown when a deployment tool is called and no dev server can be found. */
+declare const NO_DEPLOYMENT_MESSAGE = "no Lunora dev server is running for this project — start one with `lunora dev`, then call this tool again (call lunora_dev_status to check).";
+/**
+ * Assemble the tool list, in the order it is advertised: docs first (the
+ * surface that always works), then the caller's extras, then the deployment
+ * tools. Order also decides precedence — `createToolServer` keeps the first
+ * registration of a duplicated name.
+ *
+ * `clientFor` is the shared client cache built once by
+ * {@link createLocalMcpServer} and threaded into both the tool and resource
+ * surfaces. Exported (and called directly by tests) without going through
+ * `createLocalMcpServer`, so a caller that omits it gets a private,
+ * call-scoped cache — same shape as before this surface was shared, just
+ * without the cross-surface sharing that only matters once a resource
+ * surface exists alongside it.
+ */
+declare const localTools: (options: LocalMcpServerOptions, clientFor?: (deployment: LocalDeployment) => LunoraClient) => ReadonlyArray<McpTool>;
+/** Build the composed local server without connecting a transport. */
+declare const createLocalMcpServer: (options?: LocalMcpServerOptions) => Server;
+/**
+ * Build the composed local server and connect it over stdio — the transport an
+ * MCP client uses when it spawns `lunora mcp serve`. Resolves once connected;
+ * the process then stays alive serving requests.
+ */
+declare const connectLocalStdio: (options?: LocalMcpServerOptions) => Promise<Server>;
+/** A tool handler: receives the call's `arguments` bag, returns an MCP tool result. */
+/**
+ * The x402 vocabulary this module needs, declared here rather than imported.
+ *
+ * The x402 package is an optional peer, and a type import from its `charge`
+ * entry puts its `.d.ts` back into this package's build graph:
+ * a consumer that never installs x402 never builds it either, so the dts bundler
+ * looks for a `dist/` that does not exist and fails. That is not hypothetical —
+ * it broke the docs site build, which runs a filtered build over the docs app and its dependency closure
+ * and therefore never builds x402.
+ *
+ * Declaring them locally is safe because this module never *inspects* a charge
+ * config; it forwards it whole to `createChargeMiddleware`. The index signature
+ * keeps a real charge config assignable as x402 grows fields.
+ */
+/** Mirrors x402's `X402Price` — a decimal string like `"$0.05"`, or a number. */
+type X402Price = number | string;
+/** Mirrors x402's charge config with the per-tool price omitted. */
+interface X402ChargeSettings {
+  /** Network this resource settles on. */
+  readonly network: string;
+  /** Everything else x402 accepts, forwarded untouched. */
+  readonly [key: string]: unknown;
+  /** Payout wallet(s), per network family. */
+  readonly recipient: {
+    readonly evm?: string;
+    readonly svm?: string;
+  };
+}
+type ToolHandler = (arguments_: Record<string, unknown>) => Promise<ToolResult> | ToolResult;
+/** Registration shape for a free tool. */
+interface RegisterToolOptions {
+  /** Optional MCP tool annotations (`readOnlyHint`, `title`, …). */
+  annotations?: Tool["annotations"];
+  /** Human/model-facing description of what the tool does. */
   description: string;
+  /** JSON-Schema object describing the tool's arguments. */
   inputSchema: ToolInputSchema;
+  /** Unique tool name (the MCP `tools/call` `name`). */
   name: string;
 }
-interface ToolResult {
-  content: {
-    text: string;
-    type: "text";
-  }[];
-  isError?: boolean;
+/** Registration shape for a paid tool: a {@link RegisterToolOptions} plus its USD price. */
+interface RegisterPaidToolOptions extends RegisterToolOptions {
+  /** USD price per call (e.g. `"$0.05"`), charged via x402 before dispatch. */
+  price: X402Price;
+}
+/** x402 settlement vocabulary shared by every paid tool (network, recipient, facilitator); price is per-tool. */
+type PaidMcpChargeConfig = X402ChargeSettings;
+/** Config for `createPaidMcpServer`. */
+interface PaidMcpServerConfig {
+  /** The worker-level x402 charge config; each paid tool supplies only its own `price`. */
+  charge: PaidMcpChargeConfig;
+  /** Name/version advertised in the MCP `initialize` handshake. Defaults to `lunora-paid-mcp`. */
+  serverInfo?: {
+    name: string;
+    version: string;
+  };
+}
+/** A paid MCP server: register free/paid tools, then serve over Streamable HTTP. */
+interface PaidMcpServer {
+  /** The Streamable-HTTP fetch handler; gates each paid `tools/call` behind x402. */
+  readonly fetchHandler: McpFetchHandler;
+  /** Register a **paid** tool: its dispatch runs the x402 charge middleware first. */
+  paidTool: (options: RegisterPaidToolOptions, handler: ToolHandler) => void;
+  /** Register a **free** tool (coexists with paid tools on the same server). */
+  tool: (options: RegisterToolOptions, handler: ToolHandler) => void;
 }
-declare const TOOL_DEFINITIONS: ReadonlyArray<ToolDefinition>;
-declare const callTool: (client: LunoraClient, name: string, input: Record<string, unknown>) => Promise<ToolResult>;
-export { type LunoraMcpServerOptions, TOOL_DEFINITIONS, type ToolDefinition, type ToolInputSchema, type ToolResult, callTool, connectStdio, createLunoraMcpServer };
+/**
+ * Create a paid MCP server. Register free tools with `tool()` and priced tools
+ * with `paidTool()` (they coexist), then serve `fetchHandler` over HTTP.
+ *
+ * The server is **stateless**: `fetchHandler` builds a fresh `Server` per
+ * request (reading the live tool registry), so tools registered before the
+ * first request are all visible. Each priced tool memoises one initialised
+ * `ChargeMiddleware` (keyed by tool name, baking that tool's price and naming
+ * the tool as the challenge `resource`); a failed init is not cached, so a
+ * transient facilitator outage retries on the next call.
+ */
+declare const createPaidMcpServer: (config: PaidMcpServerConfig) => PaidMcpServer;
+export { AGENT_RUN_INPUT_SCHEMA, AGENT_STATUS_TOOL_NAME, type CallAgentToolOptions, LOCAL_SERVER_NAME, type LocalDeployment, type LocalDeploymentSource, type LocalMcpServerOptions, type LunoraMcpServerOptions, type McpAgentExposure, type McpFetchHandler, type McpTool, NO_DEPLOYMENT_MESSAGE, type PaidMcpChargeConfig, type PaidMcpServer, type PaidMcpServerConfig, READ_ONLY_TOOL_DEFINITIONS, type RegisterPaidToolOptions, type RegisterToolOptions, type ToolDefinition, type ToolHandler, type ToolInputSchema, type ToolResult, WRITE_TOOL_DEFINITIONS, agentToolDefinitions, callAgentTool, callTool, connectLocalStdio, connectStdio, createLocalMcpServer, createLunoraMcpServer, createMcpFetchHandler, createPaidMcpServer, localTools, parseAgentsEnv, toolDefinitions };

package/dist/index.d.ts

@@ -1,30 +1,302 @@
 import { LunoraClient } from '@lunora/client';
+import { T as ToolDefinition, f as ToolResult, e as ToolInputSchema, a as McpFetchHandler, b as McpTool } from "./packem_shared/serve-stateless.d-DX0di_lv.js";
+export { type d as McpServerInfo, g as createToolServer, s as serveStateless } from "./packem_shared/serve-stateless.d-DX0di_lv.js";
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { Tool } from '@modelcontextprotocol/sdk/types.js';
+import '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
+/** The read-only tool surface: introspection + query. Always exposed. */
+declare const READ_ONLY_TOOL_DEFINITIONS: ReadonlyArray<ToolDefinition>;
+/** The write tool surface (mutations + actions). Exposed ONLY when writes are enabled. */
+declare const WRITE_TOOL_DEFINITIONS: ReadonlyArray<ToolDefinition>;
+/**
+ * The tools this server advertises. When `allowWrites` is false (the default),
+ * only the read-only surface is exposed — the mutation/action tools are omitted
+ * from `ListTools` entirely, so an AI agent can't invoke a write it can't see.
+ */
+declare const toolDefinitions: (allowWrites: boolean) => ReadonlyArray<ToolDefinition>;
+/**
+ * Dispatch a tool call against `client`. Unknown tools and thrown errors are
+ * returned as `isError` results (rather than rejections) so the calling model
+ * sees the failure as tool output, per the MCP convention.
+ *
+ * `allowWrites` gates the mutation/action tools: when false (the default) a call
+ * to a write tool is refused even if the client somehow names it, so the
+ * read-only guarantee holds at dispatch, not just in the advertised tool list.
+ */
+declare const callTool: (client: LunoraClient, name: string, input: Record<string, unknown>, allowWrites?: boolean) => Promise<ToolResult>;
+/**
+ * Agent exposure for the MCP server: a durable `@lunora/agent` run fronted as an
+ * MCP tool an external agent can call. The capability boundary is the MCP-server
+ * process + its token, so WHICH agents are exposed is config on the server (like
+ * `allowWrites`), not on `defineAgent` — keeping `@lunora/agent` codegen
+ * byte-identical.
+ */
+interface McpAgentExposure {
+  /** What the agent does — shown to the calling model, which decides from it. */
+  description: string;
+  /** The agent's export name (its `ctx.agents.<name>` / `AGENT_<NAME>` binding). */
+  name: string;
+  /** Override the model-facing tool name (default `agent_<name>`). */
+  toolName?: string;
+}
+/** The generic status/poll tool advertised alongside the per-agent tools. */
+declare const AGENT_STATUS_TOOL_NAME = "lunora_agent_status";
+/**
+ * The uniform input schema every agent tool advertises. Agents share ONE run
+ * input (`@lunora/agent` has no per-agent validator), so there is nothing to
+ * derive per agent — a single static schema is reused for every agent tool.
+ */
+declare const AGENT_RUN_INPUT_SCHEMA: ToolInputSchema;
+/**
+ * Parse `LUNORA_MCP_AGENTS` — a `;`-separated list of `name:description` pairs,
+ * e.g. `"support:Handles support questions;billing:Billing help"`. The
+ * description may itself contain colons (only the FIRST colon splits). Blank
+ * entries and entries with an empty name/description are skipped.
+ */
+declare const parseAgentsEnv: (raw: string | undefined) => McpAgentExposure[];
+/**
+ * The tools this module advertises. Fail-closed: only the boolean `true` opts
+ * in (an env-plumbed caller could pass a truthy string), and the tools appear
+ * ONLY when at least one agent is exposed — so an agent-free or non-opted-in
+ * server never lists them.
+ */
+declare const agentToolDefinitions: (exposures: ReadonlyArray<McpAgentExposure>, allowAgents: boolean) => ReadonlyArray<ToolDefinition>;
+/** Options threaded into a single agent tool dispatch. */
+interface CallAgentToolOptions {
+  /** Opt-in gate — must be exactly `true` or the call is refused fail-closed. */
+  allowAgents: boolean;
+  /** The exposures advertised by this server. */
+  exposures: ReadonlyArray<McpAgentExposure>;
+  /** Wall-clock budget a single call awaits before returning a pending result. */
+  maxWaitMs?: number;
+  /** Delay between thread-status polls. */
+  pollIntervalMs?: number;
+  /** Test seam replacing the between-poll wait; production uses a real timer. */
+  wait?: (ms: number) => Promise<void>;
+}
+/**
+ * Dispatch an agent tool call: start a durable run via `agents:agentRun`, then
+ * await-with-timeout — poll `agents:agentThread` until terminal (returning the
+ * final answer from `agents:agentMessages`) or, on budget exhaustion, return a
+ * NON-error pending payload the caller resumes with `lunora_agent_status`.
+ *
+ * Fail-closed: refused at dispatch unless `allowAgents === true`, mirroring the
+ * `allowWrites` guard — starting a run is a side effect and must not ride the
+ * read-only default.
+ */
+declare const callAgentTool: (client: LunoraClient, name: string, input: Record<string, unknown>, options: CallAgentToolOptions) => Promise<ToolResult>;
 interface LunoraMcpServerOptions {
+  /** Wall-clock budget a single agent tool call awaits before returning a pending result. */
+  agentMaxWaitMs?: number;
+  /** Delay between agent thread-status polls. */
+  agentPollIntervalMs?: number;
+  /** The agents this server fronts as MCP tools (see `allowAgents`). */
+  agents?: ReadonlyArray<McpAgentExposure>;
+  /**
+   * Expose the per-agent tools (`agent_<name>` + the generic
+   * `lunora_agent_status`). Defaults to `false`, mirroring `allowWrites`:
+   * starting a durable agent run is a side effect, so the agent tools are
+   * omitted from the advertised list AND refused at dispatch unless explicitly
+   * opted in. Only takes effect together with a non-empty `agents` list.
+   */
+  allowAgents?: boolean;
+  /**
+   * Expose the write tools (`lunora_run_mutation` / `lunora_run_action`).
+   * Defaults to `false`: the server is READ-ONLY unless explicitly opted in,
+   * so a prompt-injected or misaligned agent can't mutate the deployment with
+   * the configured token. When false the write tools are omitted from the
+   * advertised tool list AND refused at dispatch.
+   */
+  allowWrites?: boolean;
+  /**
+   * Pre-built client (test injection). When omitted a `LunoraClient` is
+   * created from `url`/`token`/`fetch`.
+   */
   client?: LunoraClient;
+  /** `fetch` implementation; defaults to the ambient global. */
   fetch?: typeof fetch;
+  /**
+   * Bearer token sent on every RPC. This must be the deployment's **admin
+   * bearer**: the introspection/allowlist path every tool depends on
+   * (`lunora_list_functions`, `lunora_list_tables`, and the `assertRunnable`
+   * precheck that runs before every `run` tool) hits admin-gated
+   * `/_lunora/admin/*` routes, so no scoped/app token works today — it would
+   * 403 (`ADMIN_FORBIDDEN`) on the first tool call. The read-only guarantee is
+   * therefore NOT enforced by the token's scope; it is enforced in-process via
+   * `allowWrites: false` (the default), which omits the write tools from the
+   * advertised list and refuses them at dispatch.
+   */
   token?: string;
+  /** Base URL of the deployed Lunora Worker. Required unless `client` is given. */
   url?: string;
 }
+/**
+ * Build an MCP `Server` whose tools talk to a Lunora deployment. The server is
+ * transport-agnostic — call `.connect(transport)` yourself, or use
+ * `connectStdio` for the common stdio case.
+ *
+ * Tool calls are dispatched through `callTool`, which the deployment reaches
+ * over HTTP RPC. No WebSocket is opened (the tools never subscribe), so this is
+ * safe to run as a short-lived stdio process.
+ */
 declare const createLunoraMcpServer: (options: LunoraMcpServerOptions) => Server;
+/**
+ * Build the server and connect it over stdio — the transport MCP clients use
+ * when they spawn the `lunora-mcp` binary. Resolves once the transport is
+ * connected; the process then stays alive serving requests.
+ */
 declare const connectStdio: (options: LunoraMcpServerOptions) => Promise<Server>;
-interface ToolInputSchema {
-  properties: Record<string, unknown>;
-  required?: ReadonlyArray<string>;
-  type: "object";
+/**
+ * Build a stateless Streamable-HTTP fetch handler for a Lunora MCP server. Each
+ * invocation constructs a fresh proxy server and serves the request through
+ * {@link serveStateless}.
+ */
+declare const createMcpFetchHandler: (options: LunoraMcpServerOptions) => McpFetchHandler;
+/** A Lunora deployment the tools dispatch against. */
+interface LocalDeployment {
+  token?: string;
+  url: string;
 }
-interface ToolDefinition {
+/**
+ * Where the deployment comes from: a fixed value, or a function consulted on
+ * every tool call.
+ *
+ * The resolver form exists because an editor spawns this server when the
+ * project opens — routinely *before* `lunora dev` is running, and it keeps the
+ * process alive across every restart afterwards. A URL captured once at startup
+ * would therefore be absent for the entire first session and stale after the
+ * first restart.
+ */
+type LocalDeploymentSource = (() => LocalDeployment | undefined) | LocalDeployment;
+interface LocalMcpServerOptions {
+  /**
+   * Expose the deployment write tools (`lunora_run_mutation` /
+   * `lunora_run_action`). Defaults to `false` — the same fail-closed default
+   * as the remote server. Locally the blast radius is dev data rather than
+   * production, but a mutation is still a side effect an agent should be
+   * granted deliberately.
+   */
+  allowWrites?: boolean;
+  /**
+   * The Lunora deployment (usually the running dev server) to expose. Omit to
+   * leave the deployment tools out entirely.
+   */
+  deployment?: LocalDeploymentSource;
+  /** Docs site origin backing the documentation tools; `false` omits them. */
+  docs?: false | {
+    baseUrl?: string;
+  };
+  /** Extra tools to compose in, e.g. the CLI's local dev-server tools. */
+  extraTools?: ReadonlyArray<McpTool>;
+  /** `fetch` implementation; defaults to the ambient global. */
+  fetch?: typeof fetch;
+  /** Version reported in the MCP handshake — the host CLI's, not this package's. */
+  version?: string;
+}
+/** Server identity advertised in the MCP `initialize` handshake. */
+declare const LOCAL_SERVER_NAME = "lunora";
+/** Shown when a deployment tool is called and no dev server can be found. */
+declare const NO_DEPLOYMENT_MESSAGE = "no Lunora dev server is running for this project — start one with `lunora dev`, then call this tool again (call lunora_dev_status to check).";
+/**
+ * Assemble the tool list, in the order it is advertised: docs first (the
+ * surface that always works), then the caller's extras, then the deployment
+ * tools. Order also decides precedence — `createToolServer` keeps the first
+ * registration of a duplicated name.
+ *
+ * `clientFor` is the shared client cache built once by
+ * {@link createLocalMcpServer} and threaded into both the tool and resource
+ * surfaces. Exported (and called directly by tests) without going through
+ * `createLocalMcpServer`, so a caller that omits it gets a private,
+ * call-scoped cache — same shape as before this surface was shared, just
+ * without the cross-surface sharing that only matters once a resource
+ * surface exists alongside it.
+ */
+declare const localTools: (options: LocalMcpServerOptions, clientFor?: (deployment: LocalDeployment) => LunoraClient) => ReadonlyArray<McpTool>;
+/** Build the composed local server without connecting a transport. */
+declare const createLocalMcpServer: (options?: LocalMcpServerOptions) => Server;
+/**
+ * Build the composed local server and connect it over stdio — the transport an
+ * MCP client uses when it spawns `lunora mcp serve`. Resolves once connected;
+ * the process then stays alive serving requests.
+ */
+declare const connectLocalStdio: (options?: LocalMcpServerOptions) => Promise<Server>;
+/** A tool handler: receives the call's `arguments` bag, returns an MCP tool result. */
+/**
+ * The x402 vocabulary this module needs, declared here rather than imported.
+ *
+ * The x402 package is an optional peer, and a type import from its `charge`
+ * entry puts its `.d.ts` back into this package's build graph:
+ * a consumer that never installs x402 never builds it either, so the dts bundler
+ * looks for a `dist/` that does not exist and fails. That is not hypothetical —
+ * it broke the docs site build, which runs a filtered build over the docs app and its dependency closure
+ * and therefore never builds x402.
+ *
+ * Declaring them locally is safe because this module never *inspects* a charge
+ * config; it forwards it whole to `createChargeMiddleware`. The index signature
+ * keeps a real charge config assignable as x402 grows fields.
+ */
+/** Mirrors x402's `X402Price` — a decimal string like `"$0.05"`, or a number. */
+type X402Price = number | string;
+/** Mirrors x402's charge config with the per-tool price omitted. */
+interface X402ChargeSettings {
+  /** Network this resource settles on. */
+  readonly network: string;
+  /** Everything else x402 accepts, forwarded untouched. */
+  readonly [key: string]: unknown;
+  /** Payout wallet(s), per network family. */
+  readonly recipient: {
+    readonly evm?: string;
+    readonly svm?: string;
+  };
+}
+type ToolHandler = (arguments_: Record<string, unknown>) => Promise<ToolResult> | ToolResult;
+/** Registration shape for a free tool. */
+interface RegisterToolOptions {
+  /** Optional MCP tool annotations (`readOnlyHint`, `title`, …). */
+  annotations?: Tool["annotations"];
+  /** Human/model-facing description of what the tool does. */
   description: string;
+  /** JSON-Schema object describing the tool's arguments. */
   inputSchema: ToolInputSchema;
+  /** Unique tool name (the MCP `tools/call` `name`). */
   name: string;
 }
-interface ToolResult {
-  content: {
-    text: string;
-    type: "text";
-  }[];
-  isError?: boolean;
+/** Registration shape for a paid tool: a {@link RegisterToolOptions} plus its USD price. */
+interface RegisterPaidToolOptions extends RegisterToolOptions {
+  /** USD price per call (e.g. `"$0.05"`), charged via x402 before dispatch. */
+  price: X402Price;
+}
+/** x402 settlement vocabulary shared by every paid tool (network, recipient, facilitator); price is per-tool. */
+type PaidMcpChargeConfig = X402ChargeSettings;
+/** Config for `createPaidMcpServer`. */
+interface PaidMcpServerConfig {
+  /** The worker-level x402 charge config; each paid tool supplies only its own `price`. */
+  charge: PaidMcpChargeConfig;
+  /** Name/version advertised in the MCP `initialize` handshake. Defaults to `lunora-paid-mcp`. */
+  serverInfo?: {
+    name: string;
+    version: string;
+  };
+}
+/** A paid MCP server: register free/paid tools, then serve over Streamable HTTP. */
+interface PaidMcpServer {
+  /** The Streamable-HTTP fetch handler; gates each paid `tools/call` behind x402. */
+  readonly fetchHandler: McpFetchHandler;
+  /** Register a **paid** tool: its dispatch runs the x402 charge middleware first. */
+  paidTool: (options: RegisterPaidToolOptions, handler: ToolHandler) => void;
+  /** Register a **free** tool (coexists with paid tools on the same server). */
+  tool: (options: RegisterToolOptions, handler: ToolHandler) => void;
 }
-declare const TOOL_DEFINITIONS: ReadonlyArray<ToolDefinition>;
-declare const callTool: (client: LunoraClient, name: string, input: Record<string, unknown>) => Promise<ToolResult>;
-export { type LunoraMcpServerOptions, TOOL_DEFINITIONS, type ToolDefinition, type ToolInputSchema, type ToolResult, callTool, connectStdio, createLunoraMcpServer };
+/**
+ * Create a paid MCP server. Register free tools with `tool()` and priced tools
+ * with `paidTool()` (they coexist), then serve `fetchHandler` over HTTP.
+ *
+ * The server is **stateless**: `fetchHandler` builds a fresh `Server` per
+ * request (reading the live tool registry), so tools registered before the
+ * first request are all visible. Each priced tool memoises one initialised
+ * `ChargeMiddleware` (keyed by tool name, baking that tool's price and naming
+ * the tool as the challenge `resource`); a failed init is not cached, so a
+ * transient facilitator outage retries on the next call.
+ */
+declare const createPaidMcpServer: (config: PaidMcpServerConfig) => PaidMcpServer;
+export { AGENT_RUN_INPUT_SCHEMA, AGENT_STATUS_TOOL_NAME, type CallAgentToolOptions, LOCAL_SERVER_NAME, type LocalDeployment, type LocalDeploymentSource, type LocalMcpServerOptions, type LunoraMcpServerOptions, type McpAgentExposure, type McpFetchHandler, type McpTool, NO_DEPLOYMENT_MESSAGE, type PaidMcpChargeConfig, type PaidMcpServer, type PaidMcpServerConfig, READ_ONLY_TOOL_DEFINITIONS, type RegisterPaidToolOptions, type RegisterToolOptions, type ToolDefinition, type ToolHandler, type ToolInputSchema, type ToolResult, WRITE_TOOL_DEFINITIONS, agentToolDefinitions, callAgentTool, callTool, connectLocalStdio, connectStdio, createLocalMcpServer, createLunoraMcpServer, createMcpFetchHandler, createPaidMcpServer, localTools, parseAgentsEnv, toolDefinitions };

package/dist/index.mjs

@@ -1,2 +1 @@
-export { connectStdio, createLunoraMcpServer } from './packem_shared/connectStdio-C_mvQBs2.mjs';
-export { TOOL_DEFINITIONS, callTool } from './packem_shared/TOOL_DEFINITIONS-Dpiu38ji.mjs';
+import{AGENT_RUN_INPUT_SCHEMA as r,AGENT_STATUS_TOOL_NAME as t,agentToolDefinitions as c,callAgentTool as T,parseAgentsEnv as a}from"./packem_shared/AGENT_RUN_INPUT_SCHEMA-ihZg6vIZ.mjs";import{createToolServer as E}from"./packem_shared/createToolServer-CP5bNUcS.mjs";import{createMcpFetchHandler as _}from"./packem_shared/createMcpFetchHandler-DjvXAX80.mjs";import{LOCAL_SERVER_NAME as p,NO_DEPLOYMENT_MESSAGE as N,connectLocalStdio as O,createLocalMcpServer as A,localTools as f}from"./packem_shared/LOCAL_SERVER_NAME-BoQv1iu8.mjs";import{createPaidMcpServer as i}from"./packem_shared/createPaidMcpServer-CwdcSPpN.mjs";import{connectStdio as m,createLunoraMcpServer as s}from"./packem_shared/connectStdio-Dt-DqEgA.mjs";import{READ_ONLY_TOOL_DEFINITIONS as I,WRITE_TOOL_DEFINITIONS as v,callTool as D,toolDefinitions as R}from"./packem_shared/READ_ONLY_TOOL_DEFINITIONS-48jMcpI-.mjs";import{serveStateless as g}from"./packem_shared/serveStateless-BqoRk-xU.mjs";export{r as AGENT_RUN_INPUT_SCHEMA,t as AGENT_STATUS_TOOL_NAME,p as LOCAL_SERVER_NAME,N as NO_DEPLOYMENT_MESSAGE,I as READ_ONLY_TOOL_DEFINITIONS,v as WRITE_TOOL_DEFINITIONS,c as agentToolDefinitions,T as callAgentTool,D as callTool,O as connectLocalStdio,m as connectStdio,A as createLocalMcpServer,s as createLunoraMcpServer,_ as createMcpFetchHandler,i as createPaidMcpServer,E as createToolServer,f as localTools,a as parseAgentsEnv,g as serveStateless,R as toolDefinitions};

package/dist/packem_shared/AGENT_RUN_INPUT_SCHEMA-ihZg6vIZ.mjs

@@ -0,0 +1 @@
+const N="agents:agentRun",w="agents:agentThread",S="agents:agentMessages",p="lunora_agent_status",_=new Set(["cancelled","error","idle"]),E=6e4,M=600,k={properties:{prompt:{description:"The task or message for the agent.",type:"string"},threadKey:{description:"Reuse to continue a conversation; omit to start a new thread.",type:"string"},title:{description:"Optional thread title (first run only).",type:"string"}},required:["prompt"],type:"object"},O={properties:{threadKey:{description:"The thread key returned by an agent tool call.",type:"string"}},required:["threadKey"],type:"object"},y=t=>t.toolName??`agent_${t.name}`,I=t=>{if(t===void 0)return[];const n=[];for(const e of t.split(";")){const r=e.trim();if(r.length===0)continue;const a=r.indexOf(":");if(a<=0)continue;const s=r.slice(0,a).trim(),o=r.slice(a+1).trim();s.length===0||o.length===0||n.push({description:o,name:s})}return n},L=(t,n)=>n!==!0||t.length===0?[]:[...t.map(e=>({description:`${e.description} Starts a durable agent run and returns its final answer.`,inputSchema:k,name:y(e)})),{description:"Check the status of a durable agent run (and its answer if finished) by its threadKey.",inputSchema:O,name:p}],P=(t,n)=>t===p||n.some(e=>y(e)===t),q=()=>`mcp-${crypto.randomUUID()}`,c=t=>({__lunoraRef:t}),U=async t=>{await new Promise(n=>{setTimeout(n,t)})},d=t=>({content:[{text:JSON.stringify(t,void 0,2),type:"text"}]}),i=t=>({content:[{text:t,type:"text"}],isError:!0}),l=(t,n)=>{const e=t[n];return typeof e=="string"&&e.length>0?e:void 0},C=t=>{for(let n=t.length-1;n>=0;n-=1){const e=t[n],r=e?.toolCalls,a=Array.isArray(r)&&r.length>0;if(e?.role==="assistant"&&!a)return typeof e.content=="string"?e.content:""}return""},A=t=>t!==null&&typeof t=="object"&&typeof t.status=="string"?t.status:"unknown",v=async(t,n,e,r)=>{const a=await t.query(c(S),{key:n});if(e==="error"){const s=r!==null&&typeof r=="object"?r.error:void 0;return d({error:typeof s=="string"?s:"the agent run failed",status:e,threadKey:n})}return d({status:e,text:C(a),threadKey:n})},R=async(t,n)=>{const e=l(n,"threadKey");if(e===void 0)return i('"threadKey" is required and must be a non-empty string');const r=await t.query(c(w),{key:e}),a=A(r);return _.has(a)?v(t,e,a,r):d({status:a==="unknown"?"running":a,threadKey:e})},$=async(t,n,e,r)=>{try{if(r.allowAgents!==!0)return i(`tool "${n}" is disabled: agent tools are off. Enable them with the LUNORA_MCP_ALLOW_AGENTS env var.`);if(n===p)return await R(t,e);const a=r.exposures.find(u=>y(u)===n);if(a===void 0)return i(`agent tool "${n}" is not exposed by this MCP server`);const s=l(e,"prompt");if(s===void 0)return i('"prompt" is required and must be a non-empty string');const o=l(e,"threadKey")??q(),h=l(e,"title"),{id:T}=await t.mutation(c(N),{agent:a.name,input:s,threadKey:o,...h===void 0?{}:{title:h}}),g=r.pollIntervalMs??M,b=r.maxWaitMs??E,K=r.wait??U,x=Math.max(1,Math.ceil(b/g));for(let u=0;u<x;u+=1){const f=await t.query(c(w),{key:o}),m=A(f);if(_.has(m))return await v(t,o,m,f);await K(g)}return d({hint:"call lunora_agent_status with this threadKey to poll for the answer",runId:T,status:"running",threadKey:o})}catch(a){const s=a instanceof Error?a.message:String(a);return i(s)}};export{k as AGENT_RUN_INPUT_SCHEMA,p as AGENT_STATUS_TOOL_NAME,L as agentToolDefinitions,$ as callAgentTool,C as finalAnswer,P as isAgentToolName,I as parseAgentsEnv};