@solarisdk/mcp 0.4.5 → 0.4.6

package/dist/browser-tools/auth.js

@@ -169,7 +169,7 @@ export function makeAuthTools(ctx) {
                     });
                 }
                 // ── HOT: rescue the live session ─────────────────────────────────
-                const e = need(sessionId);
+                const e = await need(sessionId);
                 // Try the account's password manager FIRST. If a vault is connected and
                 // this site is configured, the gateway signs in on its own and no human
                 // is involved at all — we never see the credential either way. Only
@@ -279,7 +279,7 @@ export function makeAuthTools(ctx) {
                 profileId: z.string(),
             },
             handler: async (a) => {
-                need(a.sessionId);
+                await need(a.sessionId);
                 const res = await api(cfg, "POST", `/sessions/${encodeURIComponent(a.sessionId)}/save-profile`, { profileId: a.profileId });
                 if (res.status !== 200)
                     await apiError(res, "save profile");
@@ -351,7 +351,7 @@ export function makeAuthTools(ctx) {
                                 "solari_browser_login again for a fresh link.",
                     });
                 }
-                const e = need(sessionId);
+                const e = await need(sessionId);
                 while (Date.now() < deadline) {
                     const q = typeof a.handoffId === "string" && a.handoffId
                         ? `?handoffId=${encodeURIComponent(a.handoffId)}`

package/dist/browser-tools/capture.js

@@ -13,7 +13,7 @@ export function makeCaptureTools(ctx) {
                 format: z.enum(["text", "links", "html"]).optional(),
             },
             handler: async (a) => {
-                const page = await activePage(need(a.sessionId));
+                const page = await activePage(await need(a.sessionId));
                 const fmt = a.format ?? "text";
                 if (fmt === "links") {
                     const all = await page.$$eval("a[href]", (as) => as
@@ -50,7 +50,7 @@ export function makeCaptureTools(ctx) {
                 quality: z.number().min(1).max(100).optional(),
             },
             handler: async (a) => {
-                const page = await activePage(need(a.sessionId));
+                const page = await activePage(await need(a.sessionId));
                 const buf = await page.screenshot({
                     type: "jpeg",
                     quality: a.quality ?? 75,

package/dist/browser-tools/context.d.ts

@@ -72,7 +72,9 @@ export interface BrowserToolCtx {
     deps: BrowserDeps;
     /** deps.fetchApi, hoisted for convenience (matches the old local `api`). */
     api: typeof api;
-    need: (id: string) => BrowserEntry;
+    /** Resolves an id to a live entry, REBUILDING it from the gateway on a
+     *  cache miss (see browser.ts). Async for that reason. */
+    need: (id: string) => Promise<BrowserEntry>;
     /** The newest attached, non-blank page — see browser.ts for the rationale. */
     activePage: (e: BrowserEntry) => Promise<Page>;
     capText: (s: string, what: string) => string;

package/dist/browser-tools/interaction.js

@@ -13,7 +13,7 @@ export function makeInteractionTools(ctx) {
                 y: z.number().optional(),
             },
             handler: async (a) => {
-                const page = await activePage(need(a.sessionId));
+                const page = await activePage(await need(a.sessionId));
                 if (a.selector) {
                     await page.click(a.selector);
                 }
@@ -37,7 +37,7 @@ export function makeInteractionTools(ctx) {
                 pressEnter: z.boolean().optional(),
             },
             handler: async (a) => {
-                const page = await activePage(need(a.sessionId));
+                const page = await activePage(await need(a.sessionId));
                 if (a.selector) {
                     const sel = a.selector;
                     await page.focus(sel);
@@ -60,7 +60,7 @@ export function makeInteractionTools(ctx) {
                 "Chords use '+' (e.g. 'Control+a').",
             inputSchema: { sessionId: z.string(), key: z.string() },
             handler: async (a) => {
-                const page = await activePage(need(a.sessionId));
+                const page = await activePage(await need(a.sessionId));
                 const parts = a.key.split("+").filter(Boolean);
                 const key = parts.pop();
                 for (const m of parts)
@@ -79,7 +79,7 @@ export function makeInteractionTools(ctx) {
             description: "Evaluate a JavaScript expression on the page and return its JSON-serialized result.",
             inputSchema: { sessionId: z.string(), expression: z.string() },
             handler: async (a) => {
-                const page = await activePage(need(a.sessionId));
+                const page = await activePage(await need(a.sessionId));
                 // Pass the expression as a string: puppeteer sends it as a
                 // debugger-originated Runtime.evaluate, which is exempt from the
                 // page's CSP. Wrapping it in eval() inside page context is not.

package/dist/browser-tools/navigation.js

@@ -8,7 +8,7 @@ export function makeNavigationTools(ctx) {
             description: "Navigate the browser session to a URL. Returns final url, title and HTTP status.",
             inputSchema: { sessionId: z.string(), url: z.string() },
             handler: async (a) => {
-                const page = await activePage(need(a.sessionId));
+                const page = await activePage(await need(a.sessionId));
                 let url = a.url.trim();
                 if (!/^[a-z][a-z0-9+.-]*:/i.test(url))
                     url = `https://${url}`;

package/dist/browser.js

@@ -14,7 +14,7 @@
 import puppeteer from "puppeteer-core";
 import { makeAuthTools } from "./browser-tools/auth.js";
 import { makeCaptureTools } from "./browser-tools/capture.js";
-import { api, MAX_PAGE_TEXT, releaseBrowserSession, } from "./browser-tools/context.js";
+import { api, apiError, CDP_DIAL_ATTEMPTS, MAX_PAGE_TEXT, releaseBrowserSession, } from "./browser-tools/context.js";
 import { makeInteractionTools } from "./browser-tools/interaction.js";
 import { makeNavigationTools } from "./browser-tools/navigation.js";
 import { makeSessionTools } from "./browser-tools/session.js";
@@ -31,10 +31,83 @@ const defaultDeps = {
 };
 export function makeBrowserToolset(cfg, reg, deps = defaultDeps) {
     const apiFn = deps.fetchApi;
-    const need = (id) => {
-        const e = reg.sessions.get(id);
-        if (!e)
+    // Rebuild a BrowserEntry for `id` by asking the gateway for the session and
+    // re-dialling CDP. Symmetric with the VM registry's rehydrate in server.ts,
+    // and necessary for the same reason: the hosted transport is stateless, so a
+    // request can land on a pod that never served the create call. Without this
+    // the browser tools failed 62.5% of the time at 2 replicas (measured on
+    // staging) with `unknown browser sessionId`, while the sandbox tools measured
+    // 0% — one registry had a rebuild path and this one did not.
+    //
+    // ⚠️ UNLIKE CREATE, A FAILURE HERE MUST NOT RELEASE THE SESSION. On create, a
+    // dial failure means the session leaked with an id the model never saw, so
+    // releasing it is correct. Here the id belongs to the caller and the session
+    // may be in active use from another pod — releasing on a transient dial error
+    // would destroy the customer's live session. So we only throw.
+    const rehydrateBrowser = async (id) => {
+        const res = await apiFn(cfg, "GET", `/sessions/${encodeURIComponent(id)}`);
+        if (res.status === 404) {
             throw new Error(`unknown browser sessionId: ${id} (create one with solari_browser_create)`);
+        }
+        if (!res.ok)
+            await apiError(res, "session lookup");
+        const s = (await res.json());
+        // ┌─ CROSS-COMPONENT CONTRACT ────────────────────────────────────────┐
+        // │ A browser session that can no longer be used MUST STOP REPORTING  │
+        // │ status "active" from GET /sessions/{id}.                          │
+        // └───────────────────────────────────────────────────────────────────┘
+        // This file depends on that, and it is enforced NOWHERE ELSE — the
+        // gateway has no test asserting it and no type that carries it.
+        //
+        // Verified behaviour today (staging, 2026-09-21): after DELETE, a lookup
+        // returns 200 { status: "released" } with NO cdpEndpoint. So the endpoint
+        // check below would already refuse it — but only incidentally. Gateway-side
+        // expiry of idle-but-connected sessions is being designed right now; if it
+        // marks a session dead while still echoing its endpoint, this function
+        // hands back a handle to a corpse and the failure surfaces as a confusing
+        // raw CDP error at the call site. It will look like a rehydrate bug and it
+        // will not be one.
+        //
+        // So assert the state we actually care about, rather than relying on a side
+        // effect of the current response shape.
+        if (s.status && s.status !== "active") {
+            throw new Error(`browser session ${id} is ${s.status}; create a new one with solari_browser_create`);
+        }
+        const cdp = s.cdpEndpoint ?? s.wsEndpoint?.replace("/ws/", "/cdp/");
+        if (!cdp)
+            throw new Error(`browser session ${id} has no cdpEndpoint to reconnect to`);
+        let browser;
+        let lastErr;
+        for (let i = 0; i < CDP_DIAL_ATTEMPTS; i++) {
+            try {
+                browser = await deps.connect(cdp);
+                break;
+            }
+            catch (err) {
+                lastErr = err;
+                await new Promise((r) => setTimeout(r, 500 * (i + 1)));
+            }
+        }
+        if (!browser) {
+            throw new Error(`could not reattach to browser session ${id}: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`);
+        }
+        const pages = await browser.pages();
+        const page = pages.find((p) => !p.isClosed()) ?? (await browser.newPage());
+        const entry = {
+            sessionId: id,
+            browser,
+            page,
+            expiresAt: s.expiresAt ?? "",
+            // Not recoverable from the gateway; false is the safe default — it only
+            // gates whether tools mention a recording, never whether one exists.
+            recording: false,
+            cdpEndpoint: cdp,
+        };
+        reg.sessions.set(id, entry);
+        return entry;
+    };
+    const need = async (id) => {
+        const e = reg.sessions.get(id) ?? (await rehydrateBrowser(id));
         // The signed CDP URL is not re-dialable after the session expires, so say
         // so plainly instead of surfacing a raw "Target closed".
         if (e.expiresAt && Date.parse(e.expiresAt) <= Date.now()) {

package/dist/http.js

@@ -1,20 +1,66 @@
 #!/usr/bin/env node
 // solari-mcp over Streamable HTTP — the hosted, multi-tenant variant.
 //
-// One deployment serves every customer: each MCP session is bound to the
-// slr_live_ API key presented in the Authorization header at initialize time,
-// and gets its own McpServer + tool registries. Subsequent requests are routed
-// by the mcp-session-id header and must present the same key (sessions are a
-// tenant boundary, not just a transport detail).
+// One deployment serves every customer. The transport is STATELESS: there is no
+// mcp-session-id and no per-conversation server state, so ANY POD CAN SERVE ANY
+// REQUEST and the deployment scales horizontally.
+//
+// WHY (2026-09-21). This used to key a live McpServer + transport by the
+// mcp-session-id header into a process-local Map. That made the connector
+// single-replica by construction: measured on staging, at 2 replicas 23 of 50
+// follow-up calls returned 404 "unknown mcp-session-id" (46%), and the MCP
+// client does not recover from a 404 — its _sessionId is cleared only by an
+// explicit terminateSession(), so the conversation dies rather than reconnects.
+//
+// Affinity cannot fix it: the MCP client SDK never stores or sends cookies, so
+// GENERATED_COOKIE affinity is inert, and GCPBackendPolicy cannot express
+// HEADER_FIELD affinity on mcp-session-id (no consistentHash/httpHeaderName).
+// Rebuilding a session in place under the client's id is also impossible — a
+// fresh transport given a non-initialize request answers
+// 400 "Bad Request: Server not initialized".
+//
+// What makes stateless safe here: the GATEWAY is the source of truth for every
+// sandbox/desktop, the client already carries every id, and this server emits
+// NO server-initiated notifications (asserted by a test), so nothing depends on
+// a long-lived SSE stream. Tool state is therefore a cache, rebuilt on demand
+// (server.ts `need()`).
+//
+// PER-TENANT CACHE + THE BRIDGE SWEEP. We still keep one pair of tool
+// registries per API key, for two reasons: warm handles (otherwise every call
+// re-attaches from the gateway), and — more importantly — SOMETHING HAS TO
+// RELEASE ABANDONED RESOURCES. Models rarely call the close tools, so
+// abandonment is the normal end of a conversation, and a browser session holds
+// a concurrency-limited pool slot until min(plan maxSessionMinutes, the pool's
+// SESSION_TTL_MS default of 24h) — 24h on professional and enterprise, i.e. up
+// to 48x this sweep's interval. The 210s ORPHAN_GRACE_MS does not help: it only
+// reaps sessions that never connected, and an MCP browser session does connect.
+//
+// 🪤 LIMITATION, BY DESIGN: a pod sweeps only the tenants IT has served. If a
+// pod dies, its tenants' browser sessions leak until that 24h backstop. This is
+// a BRIDGE. The durable fix is for the browser gateway to expire
+// idle-but-connected sessions itself, which fixes every client and not just
+// MCP — see the follow-up issue; do not let this sweep become the reason that
+// never happens.
 //
 //   PORT                 listen port (default 8080)
 //   SOLARI_BASE_URL      sandbox/desktop gateway (default https://api.getsolari.com)
 //   SOLARI_BROWSER_URL   browser gateway (default = SOLARI_BASE_URL)
-//   SESSION_IDLE_MS      evict MCP sessions idle longer than this (default 30 min)
-//   MAX_SESSIONS         global cap on live MCP sessions (default 500)
-//   MAX_SESSIONS_PER_KEY per-API-key cap (default 20)
+//   SESSION_IDLE_MS      release a tenant's resources after this much idleness
+//                        (default 30 min) — the bridge sweep above
+//   MAX_SESSIONS         cap on live tenants (distinct API keys) on this pod
+//   TENANT_IDLE_SWEEP    set to "single-replica-only" to enable the destructive
+//                        idle sweep. Valid ONLY at replicas: 1 — see the sweep.
+//   MAX_SESSIONS_PER_KEY cap on live VM+browser handles per key on this pod.
+//                        REINTERPRETED 2026-09-21: it used to cap concurrent
+//                        MCP conversations, which no longer exist. Both caps
+//                        are PER POD and deliberately not divided by replica
+//                        count — dividing breaks silently the moment someone
+//                        scales. Safe because neither is authoritative: the
+//                        gateway enforces per-org concurrency in Postgres and
+//                        the console gates spend at admission. This is
+//                        defence-in-depth against a runaway client.
 import { createServer } from "node:http";
-import { createHash, randomUUID } from "node:crypto";
+import { createHash } from "node:crypto";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { buildServerParts, closeAllVmSessions } from "./server.js";
 import { releaseAllBrowserSessions } from "./browser.js";
@@ -25,9 +71,16 @@ const MAX_PER_KEY = Number(process.env.MAX_SESSIONS_PER_KEY ?? 20);
 const MAX_BODY_BYTES = 4 * 1024 * 1024;
 const DESKTOP_URL = process.env.SOLARI_BASE_URL ?? "https://api.getsolari.com";
 const BROWSER_URL = process.env.SOLARI_BROWSER_URL ?? DESKTOP_URL;
-const sessions = new Map();
+// Keyed by API-key hash, NOT by mcp-session-id: one tenant per customer key on
+// this pod, holding the warm handle cache the sweep is responsible for.
+const tenants = new Map();
 const hash = (key) => createHash("sha256").update(key).digest("hex");
-const countForKey = (h) => [...sessions.values()].filter((s) => s.keyHash === h).length;
+// Live cloud handles this pod holds for a key — the thing worth bounding now
+// that MCP conversations are not a countable resource.
+const handlesForKey = (h) => {
+    const t = tenants.get(h);
+    return t ? t.vmReg.sessions.size + t.browserReg.sessions.size : 0;
+};
 // Cheap upfront key validation (the gateways are the real authority; this just
 // gives a clean 401 at connect time instead of failures on the first tool
 // call). Results are cached both ways and coalesced per key so a reconnect
@@ -105,33 +158,55 @@ async function readBody(req) {
         return undefined;
     return JSON.parse(raw);
 }
-async function evict(id, why) {
-    const s = sessions.get(id);
-    if (!s)
+async function releaseTenant(keyHash, why) {
+    const t = tenants.get(keyHash);
+    if (!t)
         return;
-    sessions.delete(id);
-    // Actually RELEASE the customer's cloud resources. Browser sessions hold a
-    // concurrency-limited pool slot until their hard TTL, and an open VM control
-    // channel pins the VM "active" so it never idle-pauses — both bill until we
-    // let go, and abandoning the MCP session is the normal end-of-conversation
-    // path (models rarely call the close tools).
+    tenants.delete(keyHash);
+    // Actually RELEASE the customer's cloud resources. A browser session holds a
+    // concurrency-limited pool slot, and an open VM control channel pins the VM
+    // "active" so it never idle-pauses — both bill until we let go, and
+    // abandoning the conversation is the normal end-of-conversation path (models
+    // rarely call the close tools).
     await Promise.allSettled([
-        releaseAllBrowserSessions(s.browserCfg, s.browserReg),
-        closeAllVmSessions(s.vmReg),
+        releaseAllBrowserSessions(t.browserCfg, t.browserReg),
+        closeAllVmSessions(t.vmReg),
     ]);
-    try {
-        await s.transport.close();
-    }
-    catch {
-        /* already closed */
-    }
-    console.error(`mcp session ${id} evicted (${why})`);
+    console.error(`mcp tenant ${keyHash.slice(0, 8)} released (${why})`);
+}
+// THE BRIDGE SWEEP (see the header). Without it nothing frees an abandoned
+// browser session before the pool's 24h backstop.
+//
+// 🚨 DESTRUCTIVE, AND ONLY SOUND AT ONE REPLICA — so it is OFF unless the
+// deployment says otherwise. The idle clock is per-pod but DELETE /sessions/{id}
+// is global: at 2 replicas, a pod that stops seeing a key's traffic for
+// IDLE_MS will tear down every browser session that key holds, including ones
+// another pod is actively driving. The pod has no signal for "a peer is using
+// this" (the gateway reports status:active but no lastActivityAt), and it cannot
+// discover its peer count either — the default KSA gets 403 on its own Service
+// endpoints, and a guard that reads 403 as "0 peers, I am alone" would automate
+// the hazard instead of preventing it.
+//
+// So the switch is explicit configuration, set in the SAME overlay hunk as
+// `replicas:` and under the same comment. That does not prevent the mistake, but
+// it puts the two coupled settings three lines apart in one diff rather than in
+// two different systems. Default OFF means a deployment that forgets the flag
+// leaks to the 24h backstop — the safe direction.
+//
+// RELEASE CONDITION for removing all of this: gateway-side expiry of
+// idle-but-connected browser sessions, which fixes every client, not just MCP.
+const SWEEP_ENABLED = process.env.TENANT_IDLE_SWEEP === "single-replica-only";
+if (!SWEEP_ENABLED) {
+    console.error("solari-mcp: tenant idle sweep DISABLED (TENANT_IDLE_SWEEP != single-replica-only). " +
+        "Abandoned browser sessions will hold a pool slot until the gateway's 24h backstop.");
 }
 const idleSweep = setInterval(() => {
+    if (!SWEEP_ENABLED)
+        return;
     const now = Date.now();
-    for (const [id, s] of sessions)
-        if (now - s.lastSeen > IDLE_MS)
-            void evict(id, "idle");
+    for (const [h, t] of tenants)
+        if (now - t.lastSeen > IDLE_MS)
+            void releaseTenant(h, "idle");
 }, 60_000);
 idleSweep.unref();
 async function handleMcp(req, res) {
@@ -140,25 +215,11 @@ async function handleMcp(req, res) {
         json(res, 401, { error: "Authorization: Bearer slr_live_… required" });
         return;
     }
-    const sid = req.headers["mcp-session-id"];
-    if (sid) {
-        const s = sessions.get(sid);
-        if (!s) {
-            json(res, 404, { error: "unknown mcp-session-id (session may have been evicted)" });
-            return;
-        }
-        if (s.keyHash !== hash(key)) {
-            json(res, 403, { error: "mcp-session-id belongs to a different API key" });
-            return;
-        }
-        s.lastSeen = Date.now();
-        const body = req.method === "POST" ? await readBody(req) : undefined;
-        await s.transport.handleRequest(req, res, body);
-        return;
-    }
-    // No session id → must be a POST initialize.
+    // Stateless: every request is self-contained, so every request presents the
+    // key and every request is authenticated. There is no "first request" to
+    // privilege and no session to hijack — the key IS the tenant boundary.
     if (req.method !== "POST") {
-        json(res, 400, { error: "mcp-session-id header required" });
+        json(res, 405, { error: "POST /mcp only (this transport is stateless)" });
         return;
     }
     if (!(await validateKey(key))) {
@@ -166,38 +227,52 @@ async function handleMcp(req, res) {
         return;
     }
     const keyHash = hash(key);
-    if (sessions.size >= MAX_SESSIONS) {
-        json(res, 503, { error: "server at session capacity, retry shortly" });
-        return;
+    let tenant = tenants.get(keyHash);
+    if (!tenant) {
+        if (tenants.size >= MAX_SESSIONS) {
+            json(res, 503, { error: "server at capacity, retry shortly" });
+            return;
+        }
+        const parts = buildServerParts(undefined, { apiKey: key, baseUrl: BROWSER_URL });
+        tenant = {
+            browserReg: parts.browserReg,
+            browserCfg: parts.browserCfg,
+            vmReg: parts.vmReg,
+            lastSeen: Date.now(),
+        };
+        tenants.set(keyHash, tenant);
     }
-    if (countForKey(keyHash) >= MAX_PER_KEY) {
-        json(res, 429, { error: `too many concurrent MCP sessions for this API key (max ${MAX_PER_KEY})` });
+    if (handlesForKey(keyHash) > MAX_PER_KEY) {
+        json(res, 429, {
+            error: `too many concurrent Solari sessions for this API key (max ${MAX_PER_KEY})`,
+        });
         return;
     }
+    tenant.lastSeen = Date.now();
     const body = await readBody(req);
-    const parts = buildServerParts(undefined, { apiKey: key, baseUrl: BROWSER_URL });
-    const transport = new StreamableHTTPServerTransport({
-        sessionIdGenerator: randomUUID,
-        onsessioninitialized: (id) => {
-            sessions.set(id, {
-                transport,
-                browserReg: parts.browserReg,
-                browserCfg: parts.browserCfg,
-                vmReg: parts.vmReg,
-                keyHash,
-                lastSeen: Date.now(),
-            });
-            console.error(`mcp session ${id} started (key ${keyHash.slice(0, 8)})`);
-        },
-        onsessionclosed: (id) => void evict(id, "client closed"),
-    });
+    // A fresh McpServer + stateless transport per request, reusing this tenant's
+    // registries so warm handles survive and the sweep has something to release.
+    const parts = buildServerParts(undefined, { apiKey: key, baseUrl: BROWSER_URL }, { browserReg: tenant.browserReg, vmReg: tenant.vmReg });
+    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
     await parts.server.connect(transport);
-    await transport.handleRequest(req, res, body);
+    try {
+        await transport.handleRequest(req, res, body);
+    }
+    finally {
+        // Close the per-request transport only. The tenant's registries — and the
+        // customer's live VMs and browser sessions — deliberately outlive it.
+        try {
+            await transport.close();
+        }
+        catch {
+            /* already closed */
+        }
+    }
 }
 const httpServer = createServer((req, res) => {
     const url = req.url?.split("?")[0];
     if (url === "/health" || url === "/healthz") {
-        json(res, 200, { ok: true, sessions: sessions.size });
+        json(res, 200, { ok: true, tenants: tenants.size, stateless: true });
         return;
     }
     if (url === "/mcp") {
@@ -223,13 +298,13 @@ async function shutdown(sig) {
     if (shuttingDown)
         return;
     shuttingDown = true;
-    console.error(`solari-mcp: ${sig} — draining ${sessions.size} session(s)`);
+    console.error(`solari-mcp: ${sig} — draining ${tenants.size} tenant(s)`);
     httpServer.close();
     clearInterval(idleSweep);
     // Release every tenant's cloud resources; without this an ECS rollout leaks
     // one pool slot + one pinned VM per live conversation.
     await Promise.race([
-        Promise.allSettled([...sessions.keys()].map((id) => evict(id, sig))),
+        Promise.allSettled([...tenants.keys()].map((h) => releaseTenant(h, sig))),
         new Promise((r) => setTimeout(r, 20_000)),
     ]);
     process.exit(0);

package/dist/server.d.ts

@@ -46,7 +46,10 @@ export interface ServerParts {
  * (not kill) so the customer keeps their VM and its own idle policy applies.
  */
 export declare function closeAllVmSessions(reg: Registry): Promise<void>;
-export declare function buildServerParts(client?: SolariClient, browserCfg?: BrowserConfig): ServerParts;
+export declare function buildServerParts(client?: SolariClient, browserCfg?: BrowserConfig, regs?: {
+    browserReg?: BrowserRegistry;
+    vmReg?: Registry;
+}): ServerParts;
 export declare function buildServer(client?: SolariClient, browserCfg?: BrowserConfig): McpServer;
 export declare function main(): Promise<void>;
 export {};