@softure-ai/mcp-access 0.2.3 → 0.2.4

package/CHANGELOG.md

@@ -4,6 +4,15 @@ Newest first. Each version lists what changed for an app that uses `@softure-ai/
 production, the version gets a line `verified in: <app>@<commit>` ([docs/05](../../docs/05-adoption-playbook.md),
 "Definition of done"). Versions before the first one below are described in their GitHub Releases (`mcp-access@x.y.z`).
 
+## 0.2.4
+
+- `stdio/register` works for CommonJS (#571): it resolved `server-only` to a `data:` module, which an ES `import`
+  loads but a CommonJS `require` reads as a file path (`ENOENT … open 'data:text/javascript,…'`), so every `.cjs` file
+  and every script tsx compiles to CommonJS failed. It now resolves the installed `server-only` through its
+  `react-server` condition to the package's empty file, which both loaders open; nothing else resolves differently.
+  Migrate: an app that seeds `require.cache` for `server-only` (with `server-only/empty.js`) in its scripts or its
+  stdio entry drops that shim and keeps only `--import @softure-ai/mcp-access/stdio/register` (`node` or `tsx`).
+
 ## 0.2.3
 
 - OAuth clients now ask for writes (#553): while `allowWrites` is on, the endpoint's `401` challenge names

package/README.md

@@ -204,8 +204,10 @@ claude mcp add acme -e MCP_USER_ID=<account id> -- npx tsx --import @softure-ai/
 - `canWrite` needs `allowWrites: true` here and the app's `allowWrites`. The token id is `"stdio"`.
 - The database opens like a package command's (`database.handle`, else `database.url`) and closes with the
   connection. Messages go to stderr; stdout is the protocol.
-- `@softure-ai/mcp-access/stdio/register` (`--import`) resolves `server-only` to an empty module, so a factory
-  written for Next runs in plain Node. It needs Node 22.15 or later (`module.registerHooks`).
+- `@softure-ai/mcp-access/stdio/register` (`--import`) resolves `server-only` the way Next does (its `react-server`
+  condition, the installed package's empty file), so a factory written for Next runs in plain Node, through a
+  CommonJS `require` (`.cjs`, scripts tsx compiles to CommonJS) as well as an ES `import`. Without `server-only`
+  installed, an ES import gets an empty module. It needs Node 22.15 or later (`module.registerHooks`).
 
 ### Catalog parity
 

package/dist/index.js

@@ -30,7 +30,7 @@ export const MCP_RATE_LIMIT_BUCKETS = {
 export const mcpAccess = defineModule({
     manifest: {
         id: MODULE_ID,
-        version: "0.2.3",
+        version: "0.2.4",
         dependsOn: { security: "^0.2.0", auth: "^0.2.0", jobs: "^0.1.1?", ops: "^0.2.0?" },
         dbSchema: "mcp",
         tables: ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants", "oauth_registration_window"],

package/dist/stdio/register.js

@@ -1,10 +1,21 @@
-// `node --import @softure-ai/mcp-access/stdio/register` (or `tsx --import …`): resolves `server-only` to
-// an empty module, so an MCP server factory written for Next (which marks its files with
-// `import "server-only"`) runs in a plain Node process. Nothing else is resolved differently; unlike
+// `node --import @softure-ai/mcp-access/stdio/register` (or `tsx --import …`): resolves `server-only` the way Next
+// does, through its `react-server` condition, to the installed package's empty file, so an MCP server factory written
+// for Next (which marks its files with `import "server-only"`) runs in a plain Node process. The result is a real
+// file, so a CommonJS `require` loads it as well as an ES `import`. Nothing else is resolved differently; unlike
 // `--conditions=react-server`, React keeps its regular build.
 import { registerHooks } from "node:module";
+// Only when `server-only` is not installed next to the importer: an ES import still loads this.
 const EMPTY_MODULE = "data:text/javascript,export%20%7B%7D%3B";
 registerHooks({
-    resolve: (specifier, context, nextResolve) => (specifier === "server-only" ? { url: EMPTY_MODULE, format: "module", shortCircuit: true } : nextResolve(specifier, context)),
+    resolve: (specifier, context, nextResolve) => {
+        if (specifier !== "server-only")
+            return nextResolve(specifier, context);
+        try {
+            return nextResolve(specifier, { ...context, conditions: [...context.conditions, "react-server"] });
+        }
+        catch {
+            return { url: EMPTY_MODULE, format: "module", shortCircuit: true };
+        }
+    },
 });
 //# sourceMappingURL=register.js.map

package/dist/stdio/register.js.map

@@ -1 +1 @@
-{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/stdio/register.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,yFAAyF;AACzF,qGAAqG;AACrG,8DAA8D;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAE/D,aAAa,CAAC;IACZ,OAAO,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,SAAS,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;CAC5K,CAAC,CAAC"}
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/stdio/register.ts"],"names":[],"mappings":"AAAA,mHAAmH;AACnH,sHAAsH;AACtH,kHAAkH;AAClH,iHAAiH;AACjH,8DAA8D;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,gGAAgG;AAChG,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAE/D,aAAa,CAAC;IACZ,OAAO,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE;QAC3C,IAAI,SAAS,KAAK,aAAa;YAAE,OAAO,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,SAAS,EAAE,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;CACF,CAAC,CAAC"}

package/module.json

@@ -1,6 +1,6 @@
 {
   "id": "mcp-access",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "dependsOn": { "security": "^0.2.0", "auth": "^0.2.0", "jobs": "^0.1.1?", "ops": "^0.2.0?" },
   "dbSchema": "mcp",
   "tables": ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants", "oauth_registration_window"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softure-ai/mcp-access",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "SOFTURE AI MCP access module: hashed, scoped, expiring access tokens, a rate-limited Bearer endpoint around the app's MCP server factory, and a token page with client setup instructions for Next.js; tool result helpers with a safe error boundary, a stdio entry, a catalog parity check and the softure-mcp prune command.",
   "license": "MIT",
   "type": "module",

package/src/index.ts

@@ -34,7 +34,7 @@ export const MCP_RATE_LIMIT_BUCKETS = {
 export const mcpAccess = defineModule({
   manifest: {
     id: MODULE_ID,
-    version: "0.2.3",
+    version: "0.2.4",
     dependsOn: { security: "^0.2.0", auth: "^0.2.0", jobs: "^0.1.1?", ops: "^0.2.0?" },
     dbSchema: "mcp",
     tables: ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants", "oauth_registration_window"],

package/src/stdio/register.ts

@@ -1,11 +1,20 @@
-// `node --import @softure-ai/mcp-access/stdio/register` (or `tsx --import …`): resolves `server-only` to
-// an empty module, so an MCP server factory written for Next (which marks its files with
-// `import "server-only"`) runs in a plain Node process. Nothing else is resolved differently; unlike
+// `node --import @softure-ai/mcp-access/stdio/register` (or `tsx --import …`): resolves `server-only` the way Next
+// does, through its `react-server` condition, to the installed package's empty file, so an MCP server factory written
+// for Next (which marks its files with `import "server-only"`) runs in a plain Node process. The result is a real
+// file, so a CommonJS `require` loads it as well as an ES `import`. Nothing else is resolved differently; unlike
 // `--conditions=react-server`, React keeps its regular build.
 import { registerHooks } from "node:module";
 
+// Only when `server-only` is not installed next to the importer: an ES import still loads this.
 const EMPTY_MODULE = "data:text/javascript,export%20%7B%7D%3B";
 
 registerHooks({
-  resolve: (specifier, context, nextResolve) => (specifier === "server-only" ? { url: EMPTY_MODULE, format: "module", shortCircuit: true } : nextResolve(specifier, context)),
+  resolve: (specifier, context, nextResolve) => {
+    if (specifier !== "server-only") return nextResolve(specifier, context);
+    try {
+      return nextResolve(specifier, { ...context, conditions: [...context.conditions, "react-server"] });
+    } catch {
+      return { url: EMPTY_MODULE, format: "module", shortCircuit: true };
+    }
+  },
 });