@rockhopper-co/mcp-server 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -4,6 +4,67 @@ All notable changes to this project are documented here. Follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.0] — 2026-04-24
+
+Adds a **library entry point** so `@rockhopper-co/mcp-server` can be
+consumed programmatically — most notably by the remote MCP gateway
+([`mcp-gateway`](https://github.com/Rockhopper-Co/mcp-gateway)) which
+needs `createServer` and `ApiClient` to wire the Streamable HTTP
+transport. The stdio CLI continues to work exactly as before.
+
+### Added
+- **Library exports.** `import { createServer, ApiClient } from
+  '@rockhopper-co/mcp-server'` now works. The library entry is
+  side-effect free — importing it does NOT read `ROCKHOPPER_TOKEN`,
+  call `process.exit`, or open any transport. Stable surface:
+  - `createServer(apiClient: ApiClient): McpServer`
+  - `ApiClient` (class), `ApiClientConfig` (interface)
+  - All entity types (`Team`, `EnrolledFile`, `FileVersion`, ...)
+- `package.json` `exports` field with explicit subpath conditions for
+  `.` (library) and `./package.json` (so consumers can read the
+  package version). Anything else is intentionally not part of the
+  public API.
+
+### Changed
+- **CLI moved** from `src/index.ts` → `src/cli.ts` so the default
+  entrypoint can be a side-effect-free re-export. The `rockhopper-mcp`
+  bin still works the same; `npx -y @rockhopper-co/mcp-server` still
+  spawns the stdio server. Only difference: `dist/cli.js` is the
+  shebang file now (was `dist/index.js`).
+- `package.json` `bin`, `start`, and `dev` scripts now reference
+  `cli.js` / `cli.ts`.
+- Publish workflow's "Verify bin is executable" step now checks
+  `dist/cli.js`.
+
+### Internal
+- New unit test `lib.exports.test.ts` enforces the side-effect-freedom
+  invariant — fails loud if anyone re-introduces top-level CLI
+  bootstrap into `index.ts` or `lib.ts`.
+- Old `index.bootstrap.test.ts` renamed to `cli.bootstrap.test.ts`
+  with imports adjusted.
+
+## [0.2.1] — 2026-04-24
+
+Publishing-pipeline hardening release. **No runtime or API changes** — the
+package code is byte-equivalent to `0.2.0`. Bumped purely to validate the
+CI/CD changes below on a real publish.
+
+### Changed
+- **npm Trusted Publishing (OIDC).** `publish.yml` no longer uses the
+  long-lived `NPM_TOKEN` secret. The npm CLI exchanges a short-lived
+  GitHub OIDC token for a publishing credential at release time, per
+  https://docs.npmjs.com/trusted-publishers. Provenance attestation is
+  now implied (cannot be disabled).
+- **Canonical GitHub owner casing in `package.json`.** `repository.url`
+  and `bugs.url` now use `Rockhopper-Co` (canonical) instead of
+  `rockhopper-co` (lowercase). npm provenance does an exact string
+  match against the GitHub-canonical owner — the lowercase URL caused
+  E422 on the `0.2.0` first publish attempt before the bootstrap
+  succeeded.
+- **CI: npm CLI auto-upgraded** to >= 11.5.1 in the publish workflow
+  (Node 20 ships with npm 10.x, which doesn't support Trusted
+  Publishing).
+
 ## [0.2.0] — 2026-04-23
 
 First public release on npm as `@rockhopper-co/mcp-server`.

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { ApiClient } from './api-client.js';
+import { createServer } from './server.js';
+const ROCKHOPPER_API_URL = process.env.ROCKHOPPER_API_URL || 'https://api.rockhopper.co';
+const ROCKHOPPER_TOKEN = process.env.ROCKHOPPER_TOKEN;
+if (!ROCKHOPPER_TOKEN) {
+    console.error('Error: ROCKHOPPER_TOKEN environment variable is required.\n' +
+        'Create a Personal Access Token in Rockhopper Settings and set it as ROCKHOPPER_TOKEN.');
+    process.exit(1);
+}
+const apiClient = new ApiClient({
+    baseUrl: ROCKHOPPER_API_URL,
+    token: ROCKHOPPER_TOKEN,
+});
+const server = createServer(apiClient);
+const transport = new StdioServerTransport();
+await server.connect(transport);
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,kBAAkB,GACtB,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,2BAA2B,CAAC;AAChE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AAEtD,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACtB,OAAO,CAAC,KAAK,CACX,6DAA6D;QAC3D,uFAAuF,CAC1F,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC;IAC9B,OAAO,EAAE,kBAAkB;IAC3B,KAAK,EAAE,gBAAgB;CACxB,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AAEvC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC"}

package/dist/index.d.ts

@@ -1,3 +1,11 @@
-#!/usr/bin/env node
-export {};
+/**
+ * Default entry point. Re-exports the public library API from `./lib`.
+ *
+ * The CLI lives at `./cli.js` (the `rockhopper-mcp` bin). Importing
+ * this module is side-effect free; it does NOT start a stdio server.
+ *
+ * @see ./lib.ts for the canonical export list.
+ * @see ./cli.ts for the stdio CLI entrypoint.
+ */
+export * from './lib.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,cAAc,UAAU,CAAC"}

package/dist/index.js

@@ -1,19 +1,11 @@
-#!/usr/bin/env node
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { ApiClient } from './api-client.js';
-import { createServer } from './server.js';
-const ROCKHOPPER_API_URL = process.env.ROCKHOPPER_API_URL || 'https://api.rockhopper.co';
-const ROCKHOPPER_TOKEN = process.env.ROCKHOPPER_TOKEN;
-if (!ROCKHOPPER_TOKEN) {
-    console.error('Error: ROCKHOPPER_TOKEN environment variable is required.\n' +
-        'Create a Personal Access Token in Rockhopper Settings and set it as ROCKHOPPER_TOKEN.');
-    process.exit(1);
-}
-const apiClient = new ApiClient({
-    baseUrl: ROCKHOPPER_API_URL,
-    token: ROCKHOPPER_TOKEN,
-});
-const server = createServer(apiClient);
-const transport = new StdioServerTransport();
-await server.connect(transport);
+/**
+ * Default entry point. Re-exports the public library API from `./lib`.
+ *
+ * The CLI lives at `./cli.js` (the `rockhopper-mcp` bin). Importing
+ * this module is side-effect free; it does NOT start a stdio server.
+ *
+ * @see ./lib.ts for the canonical export list.
+ * @see ./cli.ts for the stdio CLI entrypoint.
+ */
+export * from './lib.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,kBAAkB,GACtB,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,2BAA2B,CAAC;AAChE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AAEtD,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACtB,OAAO,CAAC,KAAK,CACX,6DAA6D;QAC3D,uFAAuF,CAC1F,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC;IAC9B,OAAO,EAAE,kBAAkB;IAC3B,KAAK,EAAE,gBAAgB;CACxB,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AAEvC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,cAAc,UAAU,CAAC"}

package/dist/lib.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Library entry point for `@rockhopper-co/mcp-server`.
+ *
+ * This file is **side-effect free** — importing the package as a library
+ * (e.g. from the remote MCP gateway) gives you the building blocks
+ * (`createServer`, `ApiClient`, types) without spawning a stdio server
+ * or reading `ROCKHOPPER_TOKEN` from the environment.
+ *
+ * The CLI entry (the `rockhopper-mcp` bin) is `./cli.js` — running it
+ * directly is what spins up the stdio transport. Library consumers
+ * should never import `./cli.js`; they should compose `createServer`
+ * with their own transport (HTTP, in-memory, etc.).
+ *
+ * Stable API surface (semver-bound):
+ *   - `createServer(apiClient): McpServer`
+ *   - `ApiClient` (class) and `ApiClientConfig` (interface)
+ *   - All `types` (Team, EnrolledFile, FileVersion, ...)
+ */
+export { createServer } from './server.js';
+export { ApiClient, type ApiClientConfig } from './api-client.js';
+export * from './types.js';
+//# sourceMappingURL=lib.d.ts.map

package/dist/lib.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lib.d.ts","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClE,cAAc,YAAY,CAAC"}

package/dist/lib.js

@@ -0,0 +1,22 @@
+/**
+ * Library entry point for `@rockhopper-co/mcp-server`.
+ *
+ * This file is **side-effect free** — importing the package as a library
+ * (e.g. from the remote MCP gateway) gives you the building blocks
+ * (`createServer`, `ApiClient`, types) without spawning a stdio server
+ * or reading `ROCKHOPPER_TOKEN` from the environment.
+ *
+ * The CLI entry (the `rockhopper-mcp` bin) is `./cli.js` — running it
+ * directly is what spins up the stdio transport. Library consumers
+ * should never import `./cli.js`; they should compose `createServer`
+ * with their own transport (HTTP, in-memory, etc.).
+ *
+ * Stable API surface (semver-bound):
+ *   - `createServer(apiClient): McpServer`
+ *   - `ApiClient` (class) and `ApiClientConfig` (interface)
+ *   - All `types` (Team, EnrolledFile, FileVersion, ...)
+ */
+export { createServer } from './server.js';
+export { ApiClient } from './api-client.js';
+export * from './types.js';
+//# sourceMappingURL=lib.js.map

package/dist/lib.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lib.js","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAwB,MAAM,iBAAiB,CAAC;AAClE,cAAc,YAAY,CAAC"}

package/package.json

@@ -1,12 +1,19 @@
 {
   "name": "@rockhopper-co/mcp-server",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Rockhopper MCP server — expose file metadata, versions, reviews, and comments to AI tools",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
   "bin": {
-    "rockhopper-mcp": "dist/index.js"
+    "rockhopper-mcp": "dist/cli.js"
   },
   "files": [
     "dist",
@@ -16,8 +23,8 @@
   ],
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "start": "node dist/index.js",
-    "dev": "tsx watch src/index.ts",
+    "start": "node dist/cli.js",
+    "dev": "tsx watch src/cli.ts",
     "lint": "eslint src/",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",