@revealui/mcp 0.4.0 → 0.5.0

package/dist/author/errors.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Shared error type for the `@revealui/mcp/author` Phase 1.6 stub surface.
+ *
+ * Every stub function in scaffold.ts / test.ts / publish.ts throws this
+ * error with a clear pointer to the tracking issue + the specific module
+ * the call landed in. Consumers who hit this error during integration
+ * work know exactly which sub-API to wire up next.
+ *
+ * Per `feedback_no_risk_too_small_to_fix`: stubs MUST throw rather than
+ * silently no-op. A silent no-op for a function the caller expected to do
+ * work (scaffold files, run a test harness, publish a server) would create
+ * a phantom success that surfaces as missing artifacts downstream.
+ */
+/** Tracking issue for the full author-SDK implementation surface. */
+export declare const AUTHOR_SDK_TRACKING_ISSUE = "https://github.com/RevealUIStudio/revealui-jv/issues/47";
+export declare class AuthorSdkNotImplementedError extends Error {
+    /** The exported function name that was called (e.g. "scaffold"). */
+    readonly fn: string;
+    /** The subpath module the function lives in (e.g. "@revealui/mcp/author/scaffold"). */
+    readonly module: string;
+    constructor(fn: string, module: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/author/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/author/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,qEAAqE;AACrE,eAAO,MAAM,yBAAyB,4DAA4D,CAAC;AAEnG,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,oEAAoE;IACpE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAYvC"}

package/dist/author/errors.js

@@ -0,0 +1,32 @@
+/**
+ * Shared error type for the `@revealui/mcp/author` Phase 1.6 stub surface.
+ *
+ * Every stub function in scaffold.ts / test.ts / publish.ts throws this
+ * error with a clear pointer to the tracking issue + the specific module
+ * the call landed in. Consumers who hit this error during integration
+ * work know exactly which sub-API to wire up next.
+ *
+ * Per `feedback_no_risk_too_small_to_fix`: stubs MUST throw rather than
+ * silently no-op. A silent no-op for a function the caller expected to do
+ * work (scaffold files, run a test harness, publish a server) would create
+ * a phantom success that surfaces as missing artifacts downstream.
+ */
+/** Tracking issue for the full author-SDK implementation surface. */
+export const AUTHOR_SDK_TRACKING_ISSUE = 'https://github.com/RevealUIStudio/revealui-jv/issues/47';
+export class AuthorSdkNotImplementedError extends Error {
+    /** The exported function name that was called (e.g. "scaffold"). */
+    fn;
+    /** The subpath module the function lives in (e.g. "@revealui/mcp/author/scaffold"). */
+    module;
+    constructor(fn, module) {
+        super(`${fn}() is not yet implemented in ${module}. The @revealui/mcp/author ` +
+            'surface is stubbed in Phase 1.6 of the marketplace-extraction lane ' +
+            'to claim the namespace per ADR 2026-05-18-marketplace-home L2 lock; ' +
+            'the concrete implementation lands after the first external venue ' +
+            `requirement surfaces (Risk R8 in the lane plan). Track via ${AUTHOR_SDK_TRACKING_ISSUE}.`);
+        this.name = 'AuthorSdkNotImplementedError';
+        this.fn = fn;
+        this.module = module;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/author/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/author/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,yBAAyB,GAAG,yDAAyD,CAAC;AAEnG,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,oEAAoE;IAC3D,EAAE,CAAS;IACpB,uFAAuF;IAC9E,MAAM,CAAS;IAExB,YAAY,EAAU,EAAE,MAAc;QACpC,KAAK,CACH,GAAG,EAAE,gCAAgC,MAAM,6BAA6B;YACtE,qEAAqE;YACrE,sEAAsE;YACtE,mEAAmE;YACnE,8DAA8D,yBAAyB,GAAG,CAC7F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF"}

package/dist/author/index.d.ts

@@ -0,0 +1,53 @@
+/**
+ * `@revealui/mcp/author` — MCP server author SDK.
+ *
+ * Author tooling for building, testing, and publishing MCP servers. Sub-export
+ * of `@revealui/mcp` per ADR `2026-05-18-marketplace-home.md` L2 lock — the
+ * author SDK stays inside the protocol package because it serves any venue,
+ * not just Studio's revmarket, and bundling it with the protocol preserves
+ * the agnosticism principle.
+ *
+ * ## Status
+ *
+ * **Phase 1.6 (stubs only).** This module ships the namespace + interfaces
+ * + an explicit `AuthorSdkNotImplementedError` per function. The concrete
+ * implementation lands after the first external venue requirement surfaces
+ * (per `docs/lanes/marketplace-extraction/plan.md` Risk R8 — "Phase 1.6
+ * author SDK design constrains future venue plugins; ship stubs only,
+ * flesh out API in a follow-up ADR after first external venue interest").
+ *
+ * ## Subpath imports (preferred)
+ *
+ * Per memory `reference_mcp_barrel_subpath_imports`, prefer the deep
+ * subpaths over this barrel — the top-level `@revealui/mcp` barrel has
+ * launcher side effects; the `/author` barrel does NOT (this file pulls
+ * in pure types + stub functions, no `fs`/`net`/`process` work), but
+ * deep-imports are still tighter for tree-shaking:
+ *
+ * ```ts
+ * import { scaffold } from '@revealui/mcp/author/scaffold';
+ * import { runTestHarness } from '@revealui/mcp/author/test';
+ * import { publish } from '@revealui/mcp/author/publish';
+ * ```
+ *
+ * Barrel form (this file) is provided for ergonomic single-import:
+ *
+ * ```ts
+ * import { scaffold, runTestHarness, publish } from '@revealui/mcp/author';
+ * ```
+ *
+ * ## License
+ *
+ * Same as the parent package (`FSL-1.1-MIT`, converts to MIT after 2 years).
+ * The author SDK serves third-party MCP authors targeting any venue and
+ * intentionally carries the protocol package's license rather than being
+ * gated separately.
+ */
+export { AUTHOR_SDK_TRACKING_ISSUE, AuthorSdkNotImplementedError, } from './errors.js';
+export type { PublishOptions, PublishResult, PublishVenue } from './publish.js';
+export { publish } from './publish.js';
+export type { ScaffoldOptions, ScaffoldResult, ScaffoldTemplate } from './scaffold.js';
+export { scaffold } from './scaffold.js';
+export type { TestHarnessOptions, TestHarnessResult, ToolCallSpec } from './test.js';
+export { runTestHarness } from './test.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/author/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/author/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}

package/dist/author/index.js

@@ -0,0 +1,50 @@
+/**
+ * `@revealui/mcp/author` — MCP server author SDK.
+ *
+ * Author tooling for building, testing, and publishing MCP servers. Sub-export
+ * of `@revealui/mcp` per ADR `2026-05-18-marketplace-home.md` L2 lock — the
+ * author SDK stays inside the protocol package because it serves any venue,
+ * not just Studio's revmarket, and bundling it with the protocol preserves
+ * the agnosticism principle.
+ *
+ * ## Status
+ *
+ * **Phase 1.6 (stubs only).** This module ships the namespace + interfaces
+ * + an explicit `AuthorSdkNotImplementedError` per function. The concrete
+ * implementation lands after the first external venue requirement surfaces
+ * (per `docs/lanes/marketplace-extraction/plan.md` Risk R8 — "Phase 1.6
+ * author SDK design constrains future venue plugins; ship stubs only,
+ * flesh out API in a follow-up ADR after first external venue interest").
+ *
+ * ## Subpath imports (preferred)
+ *
+ * Per memory `reference_mcp_barrel_subpath_imports`, prefer the deep
+ * subpaths over this barrel — the top-level `@revealui/mcp` barrel has
+ * launcher side effects; the `/author` barrel does NOT (this file pulls
+ * in pure types + stub functions, no `fs`/`net`/`process` work), but
+ * deep-imports are still tighter for tree-shaking:
+ *
+ * ```ts
+ * import { scaffold } from '@revealui/mcp/author/scaffold';
+ * import { runTestHarness } from '@revealui/mcp/author/test';
+ * import { publish } from '@revealui/mcp/author/publish';
+ * ```
+ *
+ * Barrel form (this file) is provided for ergonomic single-import:
+ *
+ * ```ts
+ * import { scaffold, runTestHarness, publish } from '@revealui/mcp/author';
+ * ```
+ *
+ * ## License
+ *
+ * Same as the parent package (`FSL-1.1-MIT`, converts to MIT after 2 years).
+ * The author SDK serves third-party MCP authors targeting any venue and
+ * intentionally carries the protocol package's license rather than being
+ * gated separately.
+ */
+export { AUTHOR_SDK_TRACKING_ISSUE, AuthorSdkNotImplementedError, } from './errors.js';
+export { publish } from './publish.js';
+export { scaffold } from './scaffold.js';
+export { runTestHarness } from './test.js';
+//# sourceMappingURL=index.js.map

package/dist/author/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/author/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}

package/dist/author/publish.d.ts

@@ -0,0 +1,61 @@
+/**
+ * `@revealui/mcp/author/publish` — publish an MCP server to a venue.
+ *
+ * Phase 1.6 stub. The final shape:
+ *
+ * 1. Caller supplies a built package directory (with `package.json` + `dist/`)
+ *    and a venue tag.
+ * 2. Publish validates the package against the venue's manifest rules
+ *    (e.g. revmarket requires a `mcp.json` with declared tool list + auth scopes;
+ *    npm requires only npm's own publish rules).
+ * 3. On a `dryRun: true` call, no upload happens — the call returns the manifest
+ *    that WOULD be sent. On a real call, the package is published and the venue
+ *    returns a URL + ID.
+ *
+ * Venue support is intentionally pluggable. Adding a venue means: extend
+ * `PublishVenue`, add a manifest validator, add an upload adapter. Each venue
+ * gets its own boundary; revmarket-specific KYC / payout-account-linking flows
+ * stay venue-side, not in this generic publisher.
+ */
+/**
+ * Discriminant for the publish target. Add new venues here as adapters land.
+ * - `revmarket` — Studio's MCP marketplace (per ADR `2026-05-18-marketplace-home`).
+ * - `npm` — public npm registry (server is consumed as a library, not via venue).
+ */
+export type PublishVenue = 'revmarket' | 'npm';
+export interface PublishOptions {
+    /** Absolute path to the built package directory (must contain `package.json`). */
+    packageDir: string;
+    /** Which venue to publish to. See `PublishVenue` discriminant. */
+    venue: PublishVenue;
+    /**
+     * When `true`, validate + manifest-build only; do not upload. Returns a
+     * `PublishResult` with `dryRun: true` and a synthetic `url` / `venueId`
+     * marker so consumers can inspect what the live call would do.
+     */
+    dryRun?: boolean;
+    /**
+     * Optional version override. When omitted, the version in the package's
+     * `package.json` is used. Pre-release suffixes (e.g. `0.1.0-rc.1`) are
+     * honored verbatim.
+     */
+    version?: string;
+}
+export interface PublishResult {
+    /** ISO timestamp the publish landed (or would land, for a dry run). */
+    publishedAt: Date;
+    /** Venue-assigned identifier for the published artifact. */
+    venueId: string;
+    /** Canonical URL the artifact is reachable at. */
+    url: string;
+    /** Mirrors the caller's `dryRun` flag. */
+    dryRun: boolean;
+    /** The venue the artifact was published to (mirrors `PublishOptions.venue`). */
+    venue: PublishVenue;
+}
+/**
+ * Phase 1.6 stub — throws `AuthorSdkNotImplementedError`. See module JSDoc
+ * for the concrete-implementation contract.
+ */
+export declare function publish(_opts: PublishOptions): Promise<PublishResult>;
+//# sourceMappingURL=publish.d.ts.map

package/dist/author/publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../src/author/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,KAAK,CAAC;AAE/C,MAAM,WAAW,cAAc;IAC7B,kFAAkF;IAClF,UAAU,EAAE,MAAM,CAAC;IAEnB,kEAAkE;IAClE,KAAK,EAAE,YAAY,CAAC;IAEpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,WAAW,EAAE,IAAI,CAAC;IAElB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAEhB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IAEZ,0CAA0C;IAC1C,MAAM,EAAE,OAAO,CAAC;IAEhB,gFAAgF;IAChF,KAAK,EAAE,YAAY,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAE3E"}

package/dist/author/publish.js

@@ -0,0 +1,28 @@
+/**
+ * `@revealui/mcp/author/publish` — publish an MCP server to a venue.
+ *
+ * Phase 1.6 stub. The final shape:
+ *
+ * 1. Caller supplies a built package directory (with `package.json` + `dist/`)
+ *    and a venue tag.
+ * 2. Publish validates the package against the venue's manifest rules
+ *    (e.g. revmarket requires a `mcp.json` with declared tool list + auth scopes;
+ *    npm requires only npm's own publish rules).
+ * 3. On a `dryRun: true` call, no upload happens — the call returns the manifest
+ *    that WOULD be sent. On a real call, the package is published and the venue
+ *    returns a URL + ID.
+ *
+ * Venue support is intentionally pluggable. Adding a venue means: extend
+ * `PublishVenue`, add a manifest validator, add an upload adapter. Each venue
+ * gets its own boundary; revmarket-specific KYC / payout-account-linking flows
+ * stay venue-side, not in this generic publisher.
+ */
+import { AuthorSdkNotImplementedError } from './errors.js';
+/**
+ * Phase 1.6 stub — throws `AuthorSdkNotImplementedError`. See module JSDoc
+ * for the concrete-implementation contract.
+ */
+export async function publish(_opts) {
+    throw new AuthorSdkNotImplementedError('publish', '@revealui/mcp/author/publish');
+}
+//# sourceMappingURL=publish.js.map

package/dist/author/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../src/author/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAgD3D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAqB;IACjD,MAAM,IAAI,4BAA4B,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;AACpF,CAAC"}

package/dist/author/scaffold.d.ts

@@ -0,0 +1,50 @@
+/**
+ * `@revealui/mcp/author/scaffold` — generate an MCP-server project skeleton.
+ *
+ * Phase 1.6 stub. The final shape:
+ *
+ * 1. Caller supplies a target directory, a server name, and a template.
+ * 2. Scaffold writes a `package.json` + `src/index.ts` + `README.md` + a
+ *    `tsconfig.json`, all pre-wired to consume `@modelcontextprotocol/sdk`
+ *    and `@revealui/mcp/contracts` for tool-arg validation.
+ * 3. The generated server is runnable via `pnpm tsx src/index.ts` and
+ *    speaks stdio-MCP out of the box.
+ *
+ * Templates intentionally start small. `minimal` = the smallest runnable
+ * server. `with-auth` = adds JWT-claim plumbing from `@revealui/mcp/auth`.
+ * `with-tools` = sample tools registered via `@revealui/mcp/contracts`.
+ *
+ * Templates do NOT include venue-specific publish manifests — those are the
+ * scope of `@revealui/mcp/author/publish`, which is the per-venue boundary.
+ */
+export type ScaffoldTemplate = 'minimal' | 'with-auth' | 'with-tools';
+export interface ScaffoldOptions {
+    /** Server name (becomes `package.json#name` + the MCP server's announced name). */
+    name: string;
+    /** Absolute path to the directory the project should be scaffolded into. */
+    targetDir: string;
+    /**
+     * Which template to materialize. Defaults to `'minimal'`.
+     * - `minimal` — bare-bones runnable server, no tools registered.
+     * - `with-auth` — adds JWT-claim middleware wiring per `@revealui/mcp/auth`.
+     * - `with-tools` — registers two sample tools (`echo`, `add`) with Zod schemas.
+     */
+    template?: ScaffoldTemplate;
+    /**
+     * If `true`, overwrite existing files in `targetDir`. Defaults to `false`
+     * (the call throws if any target path already exists).
+     */
+    overwrite?: boolean;
+}
+export interface ScaffoldResult {
+    /** Absolute paths of every file the scaffold wrote, in deterministic order. */
+    createdPaths: string[];
+    /** The template that was materialized. */
+    template: ScaffoldTemplate;
+}
+/**
+ * Phase 1.6 stub — throws `AuthorSdkNotImplementedError`. See module JSDoc
+ * for the concrete-implementation contract.
+ */
+export declare function scaffold(_opts: ScaffoldOptions): Promise<ScaffoldResult>;
+//# sourceMappingURL=scaffold.d.ts.map

package/dist/author/scaffold.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../src/author/scaffold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AAEtE,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IAEb,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAE5B;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,YAAY,EAAE,MAAM,EAAE,CAAC;IAEvB,0CAA0C;IAC1C,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAE9E"}

package/dist/author/scaffold.js

@@ -0,0 +1,28 @@
+/**
+ * `@revealui/mcp/author/scaffold` — generate an MCP-server project skeleton.
+ *
+ * Phase 1.6 stub. The final shape:
+ *
+ * 1. Caller supplies a target directory, a server name, and a template.
+ * 2. Scaffold writes a `package.json` + `src/index.ts` + `README.md` + a
+ *    `tsconfig.json`, all pre-wired to consume `@modelcontextprotocol/sdk`
+ *    and `@revealui/mcp/contracts` for tool-arg validation.
+ * 3. The generated server is runnable via `pnpm tsx src/index.ts` and
+ *    speaks stdio-MCP out of the box.
+ *
+ * Templates intentionally start small. `minimal` = the smallest runnable
+ * server. `with-auth` = adds JWT-claim plumbing from `@revealui/mcp/auth`.
+ * `with-tools` = sample tools registered via `@revealui/mcp/contracts`.
+ *
+ * Templates do NOT include venue-specific publish manifests — those are the
+ * scope of `@revealui/mcp/author/publish`, which is the per-venue boundary.
+ */
+import { AuthorSdkNotImplementedError } from './errors.js';
+/**
+ * Phase 1.6 stub — throws `AuthorSdkNotImplementedError`. See module JSDoc
+ * for the concrete-implementation contract.
+ */
+export async function scaffold(_opts) {
+    throw new AuthorSdkNotImplementedError('scaffold', '@revealui/mcp/author/scaffold');
+}
+//# sourceMappingURL=scaffold.js.map

package/dist/author/scaffold.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold.js","sourceRoot":"","sources":["../../src/author/scaffold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAkC3D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAsB;IACnD,MAAM,IAAI,4BAA4B,CAAC,UAAU,EAAE,+BAA+B,CAAC,CAAC;AACtF,CAAC"}

package/dist/author/test.d.ts

@@ -0,0 +1,61 @@
+/**
+ * `@revealui/mcp/author/test` — testing harness for in-development MCP servers.
+ *
+ * Phase 1.6 stub. The final shape:
+ *
+ * 1. Caller points at an MCP-server entry file (typically `dist/index.js`
+ *    from a `scaffold`-generated project).
+ * 2. The harness spawns the server over stdio, runs the supplied tool calls,
+ *    and returns per-call pass/fail with the underlying MCP error payload
+ *    when a call fails.
+ * 3. Authoring loop: `pnpm build && pnpm exec mcp-author test` → fast feedback
+ *    without standing up a real Claude / Cursor client.
+ *
+ * The harness deliberately stays MCP-protocol-shaped (no Studio-specific
+ * assumptions, no revmarket-specific manifest validation) so that authors
+ * targeting any venue can use it. Venue-specific compliance checks live in
+ * the publish step, not here.
+ */
+export interface ToolCallSpec {
+    /** Tool name registered by the server under test. */
+    name: string;
+    /** Arguments to send. Validated by the server's Zod schema on receipt. */
+    args: unknown;
+    /**
+     * Optional assertion on the call's return value. The harness invokes this
+     * after the server responds; throwing inside `expect` records the test as
+     * failed. If omitted, the call counts as passing whenever the server
+     * doesn't return an error.
+     */
+    expect?: (result: unknown) => void | Promise<void>;
+}
+export interface TestHarnessOptions {
+    /** Absolute path to the server entry file (usually `dist/index.js`). */
+    serverPath: string;
+    /** Tool calls to run, in order, against a single long-lived server process. */
+    toolCalls: ToolCallSpec[];
+    /**
+     * Per-call timeout in milliseconds. Defaults to 5000. A call that exceeds
+     * this fails with `{ ok: false, error: 'timeout' }` and the harness moves on.
+     */
+    timeoutMs?: number;
+}
+export interface ToolCallResult {
+    tool: string;
+    ok: boolean;
+    /** Populated when `ok` is `false`; either the MCP error payload or a harness reason. */
+    error?: string;
+    /** Populated when `ok` is `true`; the raw return value the server produced. */
+    result?: unknown;
+}
+export interface TestHarnessResult {
+    passed: number;
+    failed: number;
+    results: ToolCallResult[];
+}
+/**
+ * Phase 1.6 stub — throws `AuthorSdkNotImplementedError`. See module JSDoc
+ * for the concrete-implementation contract.
+ */
+export declare function runTestHarness(_opts: TestHarnessOptions): Promise<TestHarnessResult>;
+//# sourceMappingURL=test.d.ts.map

package/dist/author/test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test.d.ts","sourceRoot":"","sources":["../../src/author/test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IAEb,0EAA0E;IAC1E,IAAI,EAAE,OAAO,CAAC;IAEd;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,kBAAkB;IACjC,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IAEnB,+EAA+E;IAC/E,SAAS,EAAE,YAAY,EAAE,CAAC;IAE1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAE1F"}

package/dist/author/test.js

@@ -0,0 +1,27 @@
+/**
+ * `@revealui/mcp/author/test` — testing harness for in-development MCP servers.
+ *
+ * Phase 1.6 stub. The final shape:
+ *
+ * 1. Caller points at an MCP-server entry file (typically `dist/index.js`
+ *    from a `scaffold`-generated project).
+ * 2. The harness spawns the server over stdio, runs the supplied tool calls,
+ *    and returns per-call pass/fail with the underlying MCP error payload
+ *    when a call fails.
+ * 3. Authoring loop: `pnpm build && pnpm exec mcp-author test` → fast feedback
+ *    without standing up a real Claude / Cursor client.
+ *
+ * The harness deliberately stays MCP-protocol-shaped (no Studio-specific
+ * assumptions, no revmarket-specific manifest validation) so that authors
+ * targeting any venue can use it. Venue-specific compliance checks live in
+ * the publish step, not here.
+ */
+import { AuthorSdkNotImplementedError } from './errors.js';
+/**
+ * Phase 1.6 stub — throws `AuthorSdkNotImplementedError`. See module JSDoc
+ * for the concrete-implementation contract.
+ */
+export async function runTestHarness(_opts) {
+    throw new AuthorSdkNotImplementedError('runTestHarness', '@revealui/mcp/author/test');
+}
+//# sourceMappingURL=test.js.map

package/dist/author/test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test.js","sourceRoot":"","sources":["../../src/author/test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AA+C3D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAyB;IAC5D,MAAM,IAAI,4BAA4B,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;AACxF,CAAC"}

package/dist/index.d.ts

@@ -27,7 +27,7 @@ export { executePipeline, type PipelineResult, type PipelineStep, type PipelineS
 export { InMemoryRateLimitStore, PGliteRateLimitStore, type RateLimitStore, type WindowEntry, } from './rate-limit-store.js';
 export { DEFAULT_TIER_LIMITS, McpRateLimiter, type McpRateLimiterOptions, type RateLimitConfig, type RateLimitResult, } from './rate-limiter.js';
 export { createMCPAdapter, disposeAllAdapters, generateIdempotencyKey, generateUniqueIdempotencyKey, type IdempotencyStore, MCPAdapter, type MCPConfig, NeonAdapter, StripeAdapter, VercelAdapter, } from './servers/adapter.js';
-export { type ContractCategoryName, type ContractCategorySchemas, type CreateContractsServerOptions, createContractsServer, getContractsCatalog, REGISTERED_CATEGORIES, REVEALCOIN_TOKEN_DEFAULT, validatePayload, } from './servers/factories/contracts.js';
+export { type ContractCategoryName, type ContractCategorySchemas, type CreateContractsServerOptions, createContractsServer, getContractsCatalog, REGISTERED_CATEGORIES, validatePayload, } from './servers/factories/contracts.js';
 export { createRevealuiContentServer, setCredentials as setRevealuiContentCredentials, } from './servers/factories/revealui-content.js';
 export { launchNeonMcp } from './servers/neon.js';
 export { launchNextDevtoolsMcp } from './servers/next-devtools.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EACL,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,WAAW,GACjB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,iBAAiB,EACjB,KAAK,aAAa,EAClB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,0BAA0B,EAC/B,KAAK,gBAAgB,EACrB,kBAAkB,EAClB,SAAS,EACT,KAAK,gBAAgB,EACrB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oCAAoC,EACzC,KAAK,iCAAiC,EACtC,KAAK,8BAA8B,EACnC,KAAK,IAAI,EACT,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,YAAY,EACZ,KAAK,SAAS,IAAI,YAAY,EAC9B,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAChC,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,iBAAiB,EACjB,gCAAgC,EAChC,KAAK,oBAAoB,EACzB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,KAAK,qBAAqB,EAC1B,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,cAAc,GACpB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEjE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,aAAa,EAClB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,aAAa,EACb,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,KAAK,GACX,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,kBAAkB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,gBAAgB,EACrB,UAAU,EACV,KAAK,SAAS,EACd,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,GAChB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,2BAA2B,EAC3B,cAAc,IAAI,6BAA6B,GAChD,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EACL,+BAA+B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,4BAA4B,GAClC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,YAAY,GACb,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EACL,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,WAAW,GACjB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,iBAAiB,EACjB,KAAK,aAAa,EAClB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,0BAA0B,EAC/B,KAAK,gBAAgB,EACrB,kBAAkB,EAClB,SAAS,EACT,KAAK,gBAAgB,EACrB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oCAAoC,EACzC,KAAK,iCAAiC,EACtC,KAAK,8BAA8B,EACnC,KAAK,IAAI,EACT,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,YAAY,EACZ,KAAK,SAAS,IAAI,YAAY,EAC9B,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAChC,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,iBAAiB,EACjB,gCAAgC,EAChC,KAAK,oBAAoB,EACzB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,KAAK,qBAAqB,EAC1B,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,cAAc,GACpB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEjE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,aAAa,EAClB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,aAAa,EACb,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,KAAK,GACX,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,kBAAkB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,gBAAgB,EACrB,UAAU,EACV,KAAK,SAAS,EACd,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,GAChB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,2BAA2B,EAC3B,cAAc,IAAI,6BAA6B,GAChD,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EACL,+BAA+B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,4BAA4B,GAClC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,YAAY,GACb,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -38,7 +38,7 @@ export { DEFAULT_TIER_LIMITS, McpRateLimiter, } from './rate-limiter.js';
 // Adapter framework
 export { createMCPAdapter, disposeAllAdapters, generateIdempotencyKey, generateUniqueIdempotencyKey, MCPAdapter, NeonAdapter, StripeAdapter, VercelAdapter, } from './servers/adapter.js';
 // Contracts introspection server (F8 Phase 1 — protocol-pyramid ADR L2-MCP)
-export { createContractsServer, getContractsCatalog, REGISTERED_CATEGORIES, REVEALCOIN_TOKEN_DEFAULT, validatePayload, } from './servers/factories/contracts.js';
+export { createContractsServer, getContractsCatalog, REGISTERED_CATEGORIES, validatePayload, } from './servers/factories/contracts.js';
 // First-party server factories (Stage 1 PR-1.2 — dual-mode template)
 export { createRevealuiContentServer, setCredentials as setRevealuiContentCredentials, } from './servers/factories/revealui-content.js';
 // Server launchers

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,mBAAmB;AACnB,OAAO,EACL,aAAa,EACb,eAAe,EACf,iBAAiB,GAKlB,MAAM,kBAAkB,CAAC;AAC1B,2DAA2D;AAC3D,OAAO,EACL,iBAAiB,EAEjB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,wFAAwF;AACxF,OAAO,EAiBL,kBAAkB,EAClB,SAAS,EAET,oBAAoB,GAoBrB,MAAM,aAAa,CAAC;AACrB,gBAAgB;AAChB,OAAO,EACL,YAAY,GAGb,MAAM,mBAAmB,CAAC;AAC3B,0CAA0C;AAC1C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAEhC,sBAAsB,EAGtB,uBAAuB,EACvB,gBAAgB,EAGhB,yBAAyB,EACzB,iBAAiB,EACjB,gCAAgC,EAEhC,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,0DAA0D;AAC1D,OAAO,EAEL,aAAa,GAKd,MAAM,iBAAiB,CAAC;AAGzB,kFAAkF;AAClF,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EAEnB,gBAAgB,EAEhB,aAAa,EAKb,aAAa,GAGd,MAAM,YAAY,CAAC;AACpB,yCAAyC;AACzC,OAAO,EACL,eAAe,GAIhB,MAAM,eAAe,CAAC;AACvB,yCAAyC;AACzC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GAGrB,MAAM,uBAAuB,CAAC;AAC/B,2BAA2B;AAC3B,OAAO,EACL,mBAAmB,EACnB,cAAc,GAIf,MAAM,mBAAmB,CAAC;AAC3B,oBAAoB;AACpB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAE5B,UAAU,EAEV,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,4EAA4E;AAC5E,OAAO,EAIL,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,GAChB,MAAM,kCAAkC,CAAC;AAC1C,qEAAqE;AACrE,OAAO,EACL,2BAA2B,EAC3B,cAAc,IAAI,6BAA6B,GAChD,MAAM,yCAAyC,CAAC;AACjD,mBAAmB;AACnB,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,sDAAsD;AACtD,OAAO,EACL,+BAA+B,GAGhC,MAAM,sBAAsB,CAAC;AAC9B,8CAA8C;AAC9C,OAAO,EAIL,YAAY,GACb,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,mBAAmB;AACnB,OAAO,EACL,aAAa,EACb,eAAe,EACf,iBAAiB,GAKlB,MAAM,kBAAkB,CAAC;AAC1B,2DAA2D;AAC3D,OAAO,EACL,iBAAiB,EAEjB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,wFAAwF;AACxF,OAAO,EAiBL,kBAAkB,EAClB,SAAS,EAET,oBAAoB,GAoBrB,MAAM,aAAa,CAAC;AACrB,gBAAgB;AAChB,OAAO,EACL,YAAY,GAGb,MAAM,mBAAmB,CAAC;AAC3B,0CAA0C;AAC1C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAEhC,sBAAsB,EAGtB,uBAAuB,EACvB,gBAAgB,EAGhB,yBAAyB,EACzB,iBAAiB,EACjB,gCAAgC,EAEhC,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,0DAA0D;AAC1D,OAAO,EAEL,aAAa,GAKd,MAAM,iBAAiB,CAAC;AAGzB,kFAAkF;AAClF,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EAEnB,gBAAgB,EAEhB,aAAa,EAKb,aAAa,GAGd,MAAM,YAAY,CAAC;AACpB,yCAAyC;AACzC,OAAO,EACL,eAAe,GAIhB,MAAM,eAAe,CAAC;AACvB,yCAAyC;AACzC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GAGrB,MAAM,uBAAuB,CAAC;AAC/B,2BAA2B;AAC3B,OAAO,EACL,mBAAmB,EACnB,cAAc,GAIf,MAAM,mBAAmB,CAAC;AAC3B,oBAAoB;AACpB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAE5B,UAAU,EAEV,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,4EAA4E;AAC5E,OAAO,EAIL,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,GAChB,MAAM,kCAAkC,CAAC;AAC1C,qEAAqE;AACrE,OAAO,EACL,2BAA2B,EAC3B,cAAc,IAAI,6BAA6B,GAChD,MAAM,yCAAyC,CAAC;AACjD,mBAAmB;AACnB,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,sDAAsD;AACtD,OAAO,EACL,+BAA+B,GAGhC,MAAM,sBAAsB,CAAC;AAC9B,8CAA8C;AAC9C,OAAO,EAIL,YAAY,GACb,MAAM,gBAAgB,CAAC"}

package/dist/remote-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-client.d.ts","sourceRoot":"","sources":["../src/remote-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,KAAK,kBAAkB,EAAE,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAKL,KAAK,KAAK,EACX,MAAM,YAAY,CAAC;AAYpB;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAc/F;AAMD,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,6BAA8B,SAAQ,KAAK;aAEpC,MAAM,EAAE,MAAM;aACd,MAAM,EAAE,MAAM;gBADd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM;CAQjC;AAeD,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,SAAS,CAAC;IAClB,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAgC/B"}
+{"version":3,"file":"remote-client.d.ts","sourceRoot":"","sources":["../src/remote-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,KAAK,kBAAkB,EAAE,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAKL,KAAK,KAAK,EACX,MAAM,YAAY,CAAC;AAYpB;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAc/F;AAMD,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,6BAA8B,SAAQ,KAAK;aAEpC,MAAM,EAAE,MAAM;aACd,MAAM,EAAE,MAAM;gBADd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM;CAQjC;AAeD,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,SAAS,CAAC;IAClB,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAUD;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAuC/B"}

package/dist/remote-client.js

@@ -19,6 +19,7 @@
  * app can use the same path enumeration + client-construction logic without
  * duplicating admin code.
  */
+import { assertPublicUrl, createSafeFetch } from '@revealui/security/server';
 import { McpClient } from './client.js';
 import { createRevvaultVault, McpOAuthProvider, RevvaultError, } from './oauth.js';
 /**
@@ -83,6 +84,13 @@ const SENTINEL_CLIENT_METADATA = {
     response_types: ['code'],
     token_endpoint_auth_method: 'none',
 };
+/**
+ * Shared SSRF-safe fetch for remote MCP server connections. Validates the
+ * target resolves to a public IP and pins the connection to it (rebind-safe);
+ * refuses redirects. Module-level so connections pool across calls; its guard
+ * is hostname-agnostic, so one instance safely serves every server.
+ */
+const safeFetch = createSafeFetch();
 /**
  * Load OAuth credentials + server URL and return a configured `McpClient`.
  * Throws {@link RemoteServerNotConnectedError} if no meta record exists for
@@ -96,6 +104,11 @@ export async function buildRemoteMcpClient(options) {
     if (!rawMeta)
         throw new RemoteServerNotConnectedError(tenant, server);
     const meta = parseMeta(rawMeta);
+    // SSRF guard: the server URL is operator/tenant-supplied. Reject any URL that
+    // resolves to a private/reserved IP before constructing a transport that will
+    // connect to it. The pinned `safeFetch` below additionally re-validates at
+    // dial time (DNS-rebind protection) and refuses redirects.
+    await assertPublicUrl(meta.serverUrl);
     const provider = new McpOAuthProvider({
         tenant,
         server,
@@ -112,6 +125,7 @@ export async function buildRemoteMcpClient(options) {
             kind: 'streamable-http',
             url: meta.serverUrl,
             authProvider: provider,
+            fetch: safeFetch,
         },
         ...(options.elicitationHandler ? { elicitationHandler: options.elicitationHandler } : {}),
         ...(options.samplingHandler ? { samplingHandler: options.samplingHandler } : {}),

package/dist/remote-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote-client.js","sourceRoot":"","sources":["../src/remote-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAA2B,SAAS,EAAwB,MAAM,aAAa,CAAC;AACvF,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAEhB,aAAa,GAEd,MAAM,YAAY,CAAC;AAEpB;;;GAGG;AACH,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAE3C,8EAA8E;AAC9E,sCAAsC;AACtC,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAY,EAAE,QAAgB;IAC1E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,aAAa,CAAC,qDAAqD,QAAQ,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,GAAG,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAaD,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAEpC;IACA;IAFlB,YACkB,MAAc,EACd,MAAc;QAE9B,KAAK,CACH,+BAA+B,MAAM,IAAI,MAAM,IAAI;YACjD,2CAA2C,CAC9C,CAAC;QANc,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QAM9B,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,wBAAwB,GAAwB;IACpD,aAAa,EAAE,CAAC,yBAAyB,CAAC;IAC1C,WAAW,EAAE,oBAAoB;IACjC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;IACpD,cAAc,EAAE,CAAC,MAAM,CAAC;IACxB,0BAA0B,EAAE,MAAM;CACnC,CAAC;AAiCF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAoC;IAEpC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;IAErD,MAAM,QAAQ,GAAG,OAAO,MAAM,IAAI,MAAM,OAAO,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAEhC,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC;QACpC,MAAM;QACN,MAAM;QACN,KAAK;QACL,WAAW,EAAE,yBAAyB;QACtC,cAAc,EAAE,wBAAwB;KACzC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,UAAU,EAAE;YACV,IAAI,EAAE,OAAO,CAAC,UAAU,IAAI,UAAU;YACtC,OAAO,EAAE,OAAO,CAAC,aAAa,IAAI,OAAO;SAC1C;QACD,SAAS,EAAE;YACT,IAAI,EAAE,iBAAiB;YACvB,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,YAAY,EAAE,QAAQ;SACvB;QACD,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjF,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA8B,CAAC;IAC5D,IACE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAA0B,CAAC;AACpC,CAAC"}
+{"version":3,"file":"remote-client.js","sourceRoot":"","sources":["../src/remote-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAA2B,SAAS,EAAwB,MAAM,aAAa,CAAC;AACvF,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAEhB,aAAa,GAEd,MAAM,YAAY,CAAC;AAEpB;;;GAGG;AACH,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAE3C,8EAA8E;AAC9E,sCAAsC;AACtC,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAY,EAAE,QAAgB;IAC1E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,aAAa,CAAC,qDAAqD,QAAQ,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,GAAG,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAaD,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAEpC;IACA;IAFlB,YACkB,MAAc,EACd,MAAc;QAE9B,KAAK,CACH,+BAA+B,MAAM,IAAI,MAAM,IAAI;YACjD,2CAA2C,CAC9C,CAAC;QANc,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QAM9B,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,wBAAwB,GAAwB;IACpD,aAAa,EAAE,CAAC,yBAAyB,CAAC;IAC1C,WAAW,EAAE,oBAAoB;IACjC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;IACpD,cAAc,EAAE,CAAC,MAAM,CAAC;IACxB,0BAA0B,EAAE,MAAM;CACnC,CAAC;AAiCF;;;;;GAKG;AACH,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;AAEpC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAoC;IAEpC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;IAErD,MAAM,QAAQ,GAAG,OAAO,MAAM,IAAI,MAAM,OAAO,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAEhC,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,2DAA2D;IAC3D,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEtC,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC;QACpC,MAAM;QACN,MAAM;QACN,KAAK;QACL,WAAW,EAAE,yBAAyB;QACtC,cAAc,EAAE,wBAAwB;KACzC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,UAAU,EAAE;YACV,IAAI,EAAE,OAAO,CAAC,UAAU,IAAI,UAAU;YACtC,OAAO,EAAE,OAAO,CAAC,aAAa,IAAI,OAAO;SAC1C;QACD,SAAS,EAAE;YACT,IAAI,EAAE,iBAAiB;YACvB,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,YAAY,EAAE,QAAQ;YACtB,KAAK,EAAE,SAAS;SACjB;QACD,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjF,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA8B,CAAC;IAC5D,IACE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAA0B,CAAC;AACpC,CAAC"}

package/dist/servers/adapter.js

@@ -12,7 +12,7 @@
 import { randomBytes } from 'node:crypto';
 import { registerCleanupHandler } from '@revealui/core/monitoring';
 import { logger as coreLogger } from '@revealui/core/observability/logger';
-import { assertPublicUrl } from '@revealui/security';
+import { assertPublicUrl } from '@revealui/security/server';
 export var McpErrorCode;
 (function (McpErrorCode) {
     McpErrorCode["VALIDATION_ERROR"] = "VALIDATION_ERROR";