@revealui/mcp 0.0.0-canary-20260401205250

package/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2025-2026 RevealUI Studio
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

package/LICENSE.commercial

@@ -0,0 +1,111 @@
+RevealUI Commercial License
+Version 1.0, February 2026
+
+Copyright (c) 2025-2026 RevealUI Studio (founder@revealui.com)
+
+TERMS AND CONDITIONS
+
+1. DEFINITIONS
+
+"Software" means the RevealUI source code, documentation, and associated
+files contained in directories and packages designated as commercial,
+including but not limited to: packages/ai, packages/harnesses, and any
+directory named "ee" within the repository.
+
+"License Key" means a valid RevealUI license key obtained through an active
+paid subscription at https://revealui.com.
+
+"Licensee" means the individual or organization that holds a valid License
+Key through an active subscription.
+
+"Production Use" means any use of the Software beyond local development and
+evaluation, including but not limited to: deploying the Software to serve
+end users, integrating the Software into a product or service, or using the
+Software in a revenue-generating capacity.
+
+2. GRANT OF RIGHTS
+
+Subject to the terms of this License and a valid License Key, the Licensee
+is granted a non-exclusive, non-transferable, revocable license to:
+
+  (a) Use the Software for internal development and Production Use.
+  (b) Modify the Software for internal use.
+  (c) Deploy the Software on infrastructure controlled by the Licensee.
+
+Enterprise License holders are additionally granted the right to:
+
+  (d) Deploy the Software in a self-hosted environment.
+  (e) Remove or replace RevealUI branding (white-label).
+  (f) Use the Software for multiple tenants within the Licensee's
+      organization or customer base.
+
+3. RESTRICTIONS
+
+The Licensee SHALL NOT:
+
+  (a) Provide the Software, or any portion of it, to third parties as a
+      hosted or managed service that competes with RevealUI.
+  (b) Redistribute, sublicense, sell, or otherwise transfer the Software
+      or any portion of it to third parties.
+  (c) Remove, alter, or circumvent the license key verification
+      functionality of the Software.
+  (d) Use the Software in Production without a valid License Key.
+  (e) Share, publish, or make the License Key available to unauthorized
+      parties.
+
+4. EVALUATION
+
+The Software may be used for evaluation and local development purposes
+without a License Key. Evaluation use does not grant any rights to
+Production Use.
+
+5. SUBSCRIPTION AND PAYMENT
+
+This License is valid only during the term of an active paid subscription.
+Upon cancellation or expiration of the subscription:
+
+  (a) The License terminates automatically.
+  (b) A grace period of fourteen (14) days is provided for the Licensee
+      to transition away from Production Use.
+  (c) After the grace period, the Licensee must cease all Production Use
+      of the Software.
+
+6. INTELLECTUAL PROPERTY
+
+The Software is and remains the intellectual property of RevealUI Studio.
+This License does not grant any ownership rights. Contributions to
+commercial portions of the Software require a Contributor License Agreement.
+
+7. OPEN SOURCE COMPONENTS
+
+This License applies only to files and directories designated as commercial.
+Files under the MIT License (as indicated in the root LICENSE file) are not
+subject to this commercial license and may be used freely under MIT terms.
+
+8. DISCLAIMER OF WARRANTY
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+
+9. LIMITATION OF LIABILITY
+
+IN NO EVENT SHALL REVEALUI STUDIO BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE, EXCEEDING THE AMOUNT PAID BY THE LICENSEE IN
+THE TWELVE (12) MONTHS PRECEDING THE CLAIM.
+
+10. GOVERNING LAW
+
+This License shall be governed by the laws of the State of California,
+United States of America, without regard to its conflict of law provisions.
+
+11. ENTIRE AGREEMENT
+
+This License constitutes the entire agreement between the parties with
+respect to the commercial portions of the Software and supersedes all
+prior agreements, understandings, and communications.
+
+For licensing inquiries: founder@revealui.com
+For pricing and subscriptions: https://revealui.com/pricing

package/README.md

@@ -0,0 +1,263 @@
+# @revealui/mcp
+
+> **Commercial package** — requires a [RevealUI Pro license](https://revealui.com/pro). Free to install and evaluate; a license key is required for production use.
+
+
+**Model Context Protocol (MCP) - Complete Integration Package**
+
+Centralized MCP server infrastructure, configuration, and documentation for RevealUI.
+
+## Overview
+
+This package contains everything MCP-related:
+
+- **7 MCP Servers** - Code validator, Vercel, Stripe, Neon, Supabase, Playwright, Next.js DevTools
+- **Configuration Templates** - For Claude Code / Claude Desktop
+- **Utilities** - Config management, database adapters
+- **Documentation** - Complete guides and per-server docs
+- **Database Migrations** - MCP-related schema
+
+> **Pro Package** — `@revealui/mcp` is available to RevealUI Pro subscribers via GitHub Packages.
+> Install: `pnpm add @revealui/mcp --registry https://npm.pkg.github.com`
+
+## Quick Start
+
+### 1. Install Dependencies
+
+```bash
+# In the monorepo:
+pnpm install
+
+# As an external Pro subscriber:
+pnpm add @revealui/mcp --registry https://npm.pkg.github.com
+```
+
+### 2. Configure MCP Client
+
+```bash
+# Use template for your IDE
+cp packages/mcp/configs/claude-template.json ~/.claude/config.json
+
+# Replace <REPO_PATH> with actual path
+sed -i "s|<REPO_PATH>|$(pwd)|g" ~/.claude/config.json
+```
+
+### 3. Test Server
+
+```bash
+# Test code validator
+tsx packages/mcp/src/servers/code-validator.ts
+# Should start (Ctrl+C to exit)
+```
+
+## Structure
+
+```
+packages/mcp/
+├── src/
+│   ├── servers/          # 7 MCP server implementations
+│   │   ├── code-validator.ts   ← AI code standards enforcer
+│   │   ├── vercel.ts
+│   │   ├── stripe.ts
+│   │   ├── neon.ts
+│   │   ├── supabase.ts
+│   │   ├── playwright.ts
+│   │   └── next-devtools.ts
+│   ├── config/           # Configuration utilities
+│   │   ├── index.ts
+│   │   ├── config.json
+│   │   └── README.md
+│   └── adapters/         # Database adapters
+│       └── db.ts
+├── configs/              # Template configurations
+│   ├── claude-template.json
+│   └── README.md
+├── docs/                 # Complete documentation
+│   ├── INDEX.md          ← Start here
+│   ├── README.md         # Main MCP guide
+│   ├── SETUP.md          # Setup instructions
+│   └── servers/          # Per-server documentation
+│       └── code-validator.md
+├── migrations/           # Database migrations
+│   ├── 0001_add_crdt_columns.sql
+│   └── ...
+└── package.json
+```
+
+## Available MCP Servers
+
+### 1. Code Validator ⭐
+**Status:** ✅ Active and configured
+
+Prevents AI-generated technical debt by validating code before it's written.
+
+- **Rules:** console.log, any types, TODO refs, debugger, skip tests
+- **Integration:** Pre-commit hook + MCP server
+- **Docs:** [docs/servers/code-validator.md](./docs/servers/code-validator.md)
+
+```bash
+tsx packages/mcp/src/servers/code-validator.ts
+```
+
+### 2. Vercel
+**Status:** Available (requires API key)
+
+Deploy and manage Vercel projects.
+
+```bash
+pnpm mcp:vercel
+```
+
+### 3. Stripe
+**Status:** Available (requires API key)
+
+Payment processing and billing operations.
+
+```bash
+pnpm mcp:stripe
+```
+
+### 4. Neon
+**Status:** Available (requires API key)
+
+Database operations and SQL queries.
+
+```bash
+pnpm mcp:neon
+```
+
+### 5. Supabase
+**Status:** Available (requires API key)
+
+Supabase project management and CRUD operations.
+
+```bash
+pnpm mcp:supabase
+```
+
+### 6. Playwright
+**Status:** Available
+
+Browser automation and web scraping.
+
+```bash
+pnpm mcp:playwright
+```
+
+### 7. Next.js DevTools
+**Status:** Available
+
+Next.js 16+ runtime diagnostics and automation.
+
+```bash
+pnpm mcp:next-devtools
+```
+
+## Configuration
+
+All configuration templates are in `configs/`:
+
+- **`claude-template.json`** - Claude Code / Claude Desktop
+
+See [configs/README.md](./configs/README.md) for details.
+
+## Environment Variables
+
+```env
+# Code Validator (no env vars needed)
+
+# Vercel MCP
+VERCEL_API_KEY=vercel_...
+
+# Stripe MCP
+STRIPE_SECRET_KEY=sk_test_...
+
+# Neon MCP
+NEON_API_KEY=neon_...
+
+# Supabase MCP
+SUPABASE_URL=https://....supabase.co
+SUPABASE_ANON_KEY=eyJ...
+SUPABASE_SERVICE_ROLE_KEY=...
+```
+
+## Documentation
+
+📚 **[Complete Documentation Index](./docs/INDEX.md)**
+
+- **[Main Guide](./docs/README.md)** - MCP overview
+- **[Setup Guide](./docs/SETUP.md)** - Configuration steps
+- **[Code Validator](./docs/servers/code-validator.md)** - Validator guide
+
+## Development
+
+```bash
+# Build package
+pnpm build
+
+# Run tests
+pnpm test
+
+# Type check
+pnpm typecheck
+
+# Lint
+pnpm lint
+```
+
+## Package Scripts (Root)
+
+```bash
+# Start individual MCP servers
+pnpm mcp:vercel
+pnpm mcp:stripe
+pnpm mcp:neon
+pnpm mcp:supabase
+pnpm mcp:playwright
+pnpm mcp:next-devtools
+
+# Setup MCP configuration
+pnpm setup:mcp
+```
+
+## Exports
+
+```typescript
+// Config utilities
+import { getMCPConfig } from '@revealui/mcp/config'
+```
+
+## Migration from Old Structure
+
+This package consolidates MCP code from multiple locations:
+
+**Before:**
+- `scripts/mcp/` → Now `src/servers/`
+- `packages/config/src/mcp/` → Now `src/config/`
+- Multiple config files → Now `configs/` templates
+- Scattered docs → Now `docs/`
+
+**After:**
+- Everything in `packages/mcp/` ✅
+
+## Related Documentation
+
+- [Root MCP Guide](../../docs/MCP.md)
+- [Automation Guide](../../docs/AUTOMATION.md) - AI agent integration
+- [Project Overview](../../docs/OVERVIEW.md) - Framework overview
+
+## References
+
+- [Model Context Protocol Specification](https://modelcontextprotocol.io/)
+- [Anthropic MCP Servers](https://github.com/anthropics/mcp-servers)
+- [MCP SDK Documentation](https://github.com/modelcontextprotocol/sdk)
+
+## License
+
+Commercial — see [LICENSE.commercial](../../LICENSE.commercial)
+
+---
+
+**Status:** ✅ Consolidated and Active
+**Servers:** 7 available (1 active, 6 optional)
+**Last Updated:** 2026-03-04

package/dist/adapters/db.d.ts

@@ -0,0 +1,46 @@
+/**
+ * DB adapter for MCP.
+ * - `connectPglite()` initializes ElectricSQL/pglite client with CRDT metadata.
+ * - `connectPostgres()` creates a standard Postgres client with Electric metadata.
+ * - `createMcpDbClient()` factory that selects adapter based on config.
+ *
+ * Uses @revealui/contracts as the single source of truth for CRDT operation types.
+ */
+import type { CrdtOperationsInsert, CrdtOperationsRow } from '@revealui/contracts';
+export interface QueryResult<T = Record<string, unknown>> {
+    rows: T[];
+    affectedRows?: number;
+}
+export type McpDbClient = {
+    query: <T = Record<string, unknown>>(sql: string, params?: unknown[]) => Promise<QueryResult<T>>;
+    close: () => Promise<void>;
+};
+/** Re-export contracts CRDT types for consumers */
+export type { CrdtOperationsInsert, CrdtOperationsRow };
+/**
+ * Connect to PGlite (embedded PostgreSQL) for local development/testing.
+ * Uses dynamic import to avoid bundling @electric-sql/pglite when not needed.
+ *
+ * @param options - Optional connection options
+ * @param options.dataDir - Override the default data directory. Use ':memory:' for in-memory.
+ */
+export declare function connectPglite(options?: {
+    dataDir?: string;
+}): Promise<McpDbClient>;
+/**
+ * Connect to PostgreSQL for production use.
+ * Supports Neon, Supabase, and generic PostgreSQL with SSL.
+ */
+export declare function connectPostgres(): Promise<McpDbClient>;
+/**
+ * Factory function that creates an MCP database client based on configuration.
+ * Reads `persistenceDriver` from getMcpConfig() to determine which adapter to use.
+ */
+export declare function createMcpDbClient(): Promise<McpDbClient>;
+declare const _default: {
+    connectPglite: typeof connectPglite;
+    connectPostgres: typeof connectPostgres;
+    createMcpDbClient: typeof createMcpDbClient;
+};
+export default _default;
+//# sourceMappingURL=db.d.ts.map

package/dist/adapters/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/adapters/db.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGnF,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACtD,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,mDAAmD;AACnD,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,CAAC;AA8BxD;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CA8CxF;AAED;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,WAAW,CAAC,CA+C5D;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,CAS9D;;;;;;AAED,wBAAqE"}

package/dist/adapters/db.js

@@ -0,0 +1,127 @@
+/**
+ * DB adapter for MCP.
+ * - `connectPglite()` initializes ElectricSQL/pglite client with CRDT metadata.
+ * - `connectPostgres()` creates a standard Postgres client with Electric metadata.
+ * - `createMcpDbClient()` factory that selects adapter based on config.
+ *
+ * Uses @revealui/contracts as the single source of truth for CRDT operation types.
+ */
+import { mkdir } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import getMcpConfig from '@revealui/config/mcp';
+import { getSSLConfig } from '@revealui/core/database/ssl-config';
+// CRDT operations table schema for conflict-free replication
+const CRDT_TABLE_SQL = `
+  CREATE TABLE IF NOT EXISTS crdt_operations (
+    id TEXT PRIMARY KEY,
+    document_id TEXT NOT NULL,
+    operation_type TEXT NOT NULL,
+    payload JSONB NOT NULL,
+    vector_clock JSONB NOT NULL,
+    node_id TEXT NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    applied_at TIMESTAMPTZ
+  );
+  CREATE INDEX IF NOT EXISTS idx_crdt_ops_document ON crdt_operations(document_id);
+  CREATE INDEX IF NOT EXISTS idx_crdt_ops_node ON crdt_operations(node_id);
+  CREATE INDEX IF NOT EXISTS idx_crdt_ops_created ON crdt_operations(created_at DESC);
+`;
+/**
+ * Connect to PGlite (embedded PostgreSQL) for local development/testing.
+ * Uses dynamic import to avoid bundling @electric-sql/pglite when not needed.
+ *
+ * @param options - Optional connection options
+ * @param options.dataDir - Override the default data directory. Use ':memory:' for in-memory.
+ */
+export async function connectPglite(options) {
+    const cfg = getMcpConfig();
+    // Determine data directory from options, config, or default
+    // Use ':memory:' for in-memory database (useful for testing)
+    const dataDir = options?.dataDir || cfg.electricDatabaseUrl || '.revealui/mcp/pglite';
+    let db;
+    try {
+        // Ensure directory exists if not in-memory
+        if (dataDir !== ':memory:') {
+            await mkdir(dirname(dataDir), { recursive: true });
+        }
+        const { PGlite } = await import('@electric-sql/pglite');
+        db = new PGlite(dataDir);
+        await db.waitReady;
+    }
+    catch (error) {
+        const err = error;
+        if (err.message?.includes('Cannot find module') || err.message?.includes('MODULE_NOT_FOUND')) {
+            throw new Error('@electric-sql/pglite is not installed. Run: pnpm add -D @electric-sql/pglite');
+        }
+        throw error;
+    }
+    // Create CRDT operations table
+    await db.exec(CRDT_TABLE_SQL);
+    return {
+        async query(sql, params) {
+            const result = await db.query(sql, params);
+            return {
+                rows: result.rows,
+                affectedRows: result.affectedRows,
+            };
+        },
+        async close() {
+            await db.close();
+        },
+    };
+}
+/**
+ * Connect to PostgreSQL for production use.
+ * Supports Neon, Supabase, and generic PostgreSQL with SSL.
+ */
+export async function connectPostgres() {
+    const cfg = getMcpConfig();
+    const connectionString = cfg.electricDatabaseUrl ||
+        process.env.DATABASE_URL ||
+        process.env.POSTGRES_URL ||
+        process.env.SUPABASE_DATABASE_URI;
+    if (!connectionString) {
+        throw new Error('Database connection string not found. Set ELECTRIC_DATABASE_URL, DATABASE_URL, POSTGRES_URL, or SUPABASE_DATABASE_URI.');
+    }
+    const { Pool } = await import('pg');
+    const pool = new Pool({
+        connectionString,
+        ssl: getSSLConfig(connectionString),
+    });
+    // Test connection
+    const client = await pool.connect();
+    try {
+        await client.query('SELECT 1');
+    }
+    finally {
+        client.release();
+    }
+    // Create CRDT operations table
+    await pool.query(CRDT_TABLE_SQL);
+    return {
+        async query(sql, params) {
+            const result = await pool.query(sql, params);
+            return {
+                rows: result.rows,
+                affectedRows: result.rowCount ?? undefined,
+            };
+        },
+        async close() {
+            await pool.end();
+        },
+    };
+}
+/**
+ * Factory function that creates an MCP database client based on configuration.
+ * Reads `persistenceDriver` from getMcpConfig() to determine which adapter to use.
+ */
+export async function createMcpDbClient() {
+    const cfg = getMcpConfig();
+    if (cfg.persistenceDriver === 'postgres') {
+        return connectPostgres();
+    }
+    // Default to pglite for local development
+    return connectPglite();
+}
+export default { connectPglite, connectPostgres, createMcpDbClient };
+//# sourceMappingURL=db.js.map

package/dist/adapters/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/adapters/db.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,YAAY,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AA0BlE,6DAA6D;AAC7D,MAAM,cAAc,GAAG;;;;;;;;;;;;;;CActB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA8B;IAChE,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAE3B,4DAA4D;IAC5D,6DAA6D;IAC7D,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,GAAG,CAAC,mBAAmB,IAAI,sBAAsB,CAAC;IAEtF,IAAI,EAAkB,CAAC;IAEvB,IAAI,CAAC;QACH,2CAA2C;QAC3C,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACxD,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAmB,CAAC;QAC3C,MAAM,EAAE,CAAC,SAAS,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAc,CAAC;QAC3B,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,+BAA+B;IAC/B,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAE9B,OAAO;QACL,KAAK,CAAC,KAAK,CACT,GAAW,EACX,MAAkB;YAElB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC3C,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAW;gBACxB,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAE3B,MAAM,gBAAgB,GACpB,GAAG,CAAC,mBAAmB;QACvB,OAAO,CAAC,GAAG,CAAC,YAAY;QACxB,OAAO,CAAC,GAAG,CAAC,YAAY;QACxB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAEpC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,wHAAwH,CACzH,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,gBAAgB;QAChB,GAAG,EAAE,YAAY,CAAC,gBAAgB,CAAC;KACpC,CAAC,CAAC;IAEH,kBAAkB;IAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;IAED,+BAA+B;IAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAEjC,OAAO;QACL,KAAK,CAAC,KAAK,CACT,GAAW,EACX,MAAkB;YAElB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC7C,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAW;gBACxB,YAAY,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS;aAC3C,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAE3B,IAAI,GAAG,CAAC,iBAAiB,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC;IAED,0CAA0C;IAC1C,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC;AAED,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/auth.d.ts

@@ -0,0 +1,42 @@
+/**
+ * MCP Auth Bridge
+ *
+ * JWT claims validation and tool-level authorization for MCP server launchers.
+ * Does NOT verify JWT signatures — that is the transport layer's responsibility.
+ * This module validates the claims structure, expiration, and tier-based ACL.
+ */
+import { z } from '@revealui/contracts';
+/** JWT claims expected from RevealUI auth tokens */
+export declare const McpAuthClaimsSchema: z.ZodObject<{
+    sub: z.ZodString;
+    tier: z.ZodEnum<{
+        free: "free";
+        pro: "pro";
+        max: "max";
+        enterprise: "enterprise";
+    }>;
+    iss: z.ZodOptional<z.ZodString>;
+    iat: z.ZodOptional<z.ZodNumber>;
+    exp: z.ZodOptional<z.ZodNumber>;
+    permissions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type McpAuthClaims = z.infer<typeof McpAuthClaimsSchema>;
+/**
+ * Validate and decode MCP auth claims from a JWT payload.
+ * Does NOT verify signature — that should be done by the transport layer.
+ * This validates the claims structure and expiration.
+ */
+export declare function validateMcpClaims(payload: unknown): {
+    valid: boolean;
+    claims?: McpAuthClaims;
+    error?: string;
+};
+/**
+ * Check if claims authorize a specific tool invocation.
+ * Verifies both tier level and explicit permissions list (if present).
+ */
+export declare function authorizeToolCall(claims: McpAuthClaims, toolName: string, requiredTier?: string): {
+    authorized: boolean;
+    reason?: string;
+};
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAMxC,oDAAoD;AACpD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;iBAO9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMhE;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG;IACnD,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAgBA;AAMD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,MAAe,GAC5B;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAwB1C"}