@solidcommerce/mcp-server 2.0.0-alpha.0

package/dist/transports/streamableHttp.js

@@ -0,0 +1,237 @@
+// =============================================================================
+// src/transports/streamableHttp.ts
+// Phase 0 / Item E-A1 — Streamable HTTP transport (replaces SSE).
+//
+// Why this replaces transports/sse.ts:
+//   SSE was deprecated in the March 2025 MCP spec and Claude UI's Connectors
+//   Directory rejects SSE servers. Streamable HTTP over HTTPS is the required
+//   remote transport. See docs/use_cases.md §1.2.
+//
+// Endpoints (single MCP path handles the JSON-RPC + SSE-upgrade lifecycle):
+//   POST   /mcp      — client → server JSON-RPC. An `initialize` with no
+//                      session header opens a new session; subsequent calls
+//                      carry `Mcp-Session-Id`.
+//   GET    /mcp      — opens the server → client SSE stream for an existing
+//                      session (notifications, sampling, etc.).
+//   DELETE /mcp      — terminates a session.
+//   GET    /healthz  — App Service liveness probe; returns "ok", no MCP touch.
+//
+// Public URL after deploy: https://mcp.solidcommerce.com/mcp
+//   ⚠️ APIM route must be updated from the old /sse + /messages pair to the
+//   single /mcp path. Tracked under E-A1 deployment.
+//
+// Per-session Server model (the key change from SSE):
+//   The old SSE transport shared ONE `Server` instance across every session.
+//   That blocked per-user auth context (flagged in the old sse.ts caveat).
+//   Here each new session gets its OWN `Server` built by `serverFactory()`,
+//   so Phase 0 / E-A3 can bind a per-user OAuth identity to each session's
+//   tool context without cross-session leakage.
+// =============================================================================
+import http from "node:http";
+import { randomUUID } from "node:crypto";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+import express from "express";
+import { ENV_HOST_NAME_OVERRIDE, extractClientInfoName, resolveHostName, } from "../telemetry/hostName.js";
+const DEFAULT_PORT = 8080;
+const MCP_PATH = "/mcp";
+const HEALTH_PATH = "/healthz";
+const SESSION_HEADER = "mcp-session-id";
+/** Max client → server body size. MCP `initialize` is tiny; tool-call args can
+ * be larger (bulk price updates, etc.), so we allow a generous ceiling well
+ * under the per-tool-result 25k-token budget which flows the other direction. */
+const JSON_BODY_LIMIT = "4mb";
+/** Default resolver: every session is service-to-service apiKey identity.
+ * Used when OAuth is not wired (tests, OAuth-disabled deployments). */
+const API_KEY_ONLY_RESOLVER = {
+    resolve: async () => ({
+        ok: true,
+        context: { mode: "apiKey", scopes: [], introspectionDegraded: false },
+    }),
+};
+function resolvePort(override) {
+    if (typeof override === "number")
+        return override;
+    const raw = process.env["PORT"];
+    if (!raw)
+        return DEFAULT_PORT;
+    const n = Number.parseInt(raw, 10);
+    return Number.isFinite(n) && n > 0 ? n : DEFAULT_PORT;
+}
+function readSessionId(req) {
+    const raw = req.headers[SESSION_HEADER];
+    if (typeof raw === "string" && raw.length > 0)
+        return raw;
+    return undefined;
+}
+/**
+ * Start the Streamable HTTP transport. Resolves once the HTTP server is
+ * listening. Returns a handle so callers (and tests) can shut down cleanly;
+ * the production `index.ts` ignores the return value and lets the process run.
+ */
+export async function startStreamableHttpServer(serverFactory, opts = {}) {
+    const authResolver = opts.authResolver ?? API_KEY_ONLY_RESOLVER;
+    const app = express();
+    // POST bodies must be parsed before we can inspect `isInitializeRequest`
+    // and forward the parsed body to `transport.handleRequest`.
+    app.use(express.json({ limit: JSON_BODY_LIMIT }));
+    // App Service liveness probe. Cheap, no auth, no MCP touch.
+    app.get(HEALTH_PATH, (_req, res) => {
+        res.status(200).type("text/plain").send("ok");
+    });
+    // Active sessions, keyed by the SDK-issued session id. Each entry owns a
+    // transport AND the per-session Server bound to it, so close() can tear both
+    // down deterministically.
+    const sessions = new Map();
+    // POST /mcp — client → server JSON-RPC frames.
+    app.post(MCP_PATH, async (req, res) => {
+        const sessionId = readSessionId(req);
+        // Existing session → route to its transport.
+        if (sessionId) {
+            const entry = sessions.get(sessionId);
+            if (!entry) {
+                res.status(404).json(jsonRpcError(-32001, "Unknown session id."));
+                return;
+            }
+            await entry.transport.handleRequest(req, res, req.body);
+            return;
+        }
+        // No session id → must be an `initialize` request to open a new session.
+        if (!isInitializeRequest(req.body)) {
+            res
+                .status(400)
+                .json(jsonRpcError(-32000, "Bad Request: no session id and not an initialize request."));
+            return;
+        }
+        // Resolve the per-user auth identity from the Authorization header
+        // (Phase 0 / E-A3). A present-but-invalid bearer is a hard 401 — we never
+        // downgrade a bad token to the env API key.
+        let session;
+        try {
+            const resolution = await authResolver.resolve(req.headers.authorization);
+            if (!resolution.ok) {
+                res
+                    .status(resolution.status)
+                    .set("WWW-Authenticate", 'Bearer realm="solidcommerce-mcp", error="invalid_token"')
+                    .json(jsonRpcError(-32001, resolution.error));
+                return;
+            }
+            // Resolve the calling surface (E-A4) from the initialize request's
+            // clientInfo + User-Agent. Best-effort telemetry, never fails the session.
+            const userAgent = typeof req.headers["user-agent"] === "string" ? req.headers["user-agent"] : undefined;
+            const hostName = resolveHostName({
+                clientInfoName: extractClientInfoName(req.body),
+                userAgent,
+                override: process.env[ENV_HOST_NAME_OVERRIDE],
+            });
+            session = { auth: resolution.context, hostName };
+        }
+        catch (err) {
+            // The resolver is built to never throw, but treat an unexpected throw as
+            // a 500 rather than leaking a stack to the client.
+            console.error("[mcp-server] auth resolution threw:", err instanceof Error ? err.message : err);
+            res.status(500).json(jsonRpcError(-32603, "Auth resolution failed."));
+            return;
+        }
+        // New session: build a dedicated Server + transport, wire teardown, connect.
+        const server = serverFactory(session);
+        const transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: () => randomUUID(),
+            onsessioninitialized: (newId) => {
+                sessions.set(newId, { transport, server });
+            },
+            // DNS-rebinding protection defaults off: in prod we sit behind APIM,
+            // which terminates TLS and validates Host/Origin at the edge. E-A5
+            // (rate-limit) and APIM policy own edge security.
+        });
+        transport.onclose = () => {
+            const id = transport.sessionId;
+            if (id)
+                sessions.delete(id);
+        };
+        try {
+            await server.connect(transport);
+        }
+        catch (err) {
+            console.error("[mcp-server] streamable-http connect failed:", err instanceof Error ? err.message : err);
+            const id = transport.sessionId;
+            if (id)
+                sessions.delete(id);
+            if (!res.headersSent) {
+                res.status(500).json(jsonRpcError(-32603, "Failed to initialize session."));
+            }
+            return;
+        }
+        // Hand the initialize request to the freshly-connected transport; it mints
+        // the session id (via sessionIdGenerator) and writes the response.
+        await transport.handleRequest(req, res, req.body);
+    });
+    // GET /mcp — open the server → client SSE notification stream for a session.
+    // DELETE /mcp — terminate a session.
+    const handleExistingSession = async (req, res) => {
+        const sessionId = readSessionId(req);
+        if (!sessionId) {
+            res.status(400).type("text/plain").send("missing Mcp-Session-Id header");
+            return;
+        }
+        const entry = sessions.get(sessionId);
+        if (!entry) {
+            res.status(404).type("text/plain").send("unknown session id");
+            return;
+        }
+        await entry.transport.handleRequest(req, res);
+    };
+    app.get(MCP_PATH, handleExistingSession);
+    app.delete(MCP_PATH, handleExistingSession);
+    const port = resolvePort(opts.port);
+    const httpServer = http.createServer(app);
+    await new Promise((resolve, reject) => {
+        const onError = (err) => {
+            httpServer.removeListener("listening", onListening);
+            reject(err);
+        };
+        const onListening = () => {
+            httpServer.removeListener("error", onError);
+            resolve();
+        };
+        httpServer.once("error", onError);
+        httpServer.once("listening", onListening);
+        httpServer.listen(port);
+    });
+    const actualPort = (() => {
+        const addr = httpServer.address();
+        if (addr && typeof addr === "object")
+            return addr.port;
+        return port;
+    })();
+    console.error(`[mcp-server] streamable-http transport listening on :${actualPort}${MCP_PATH}`);
+    const close = async () => {
+        // Close every session's transport (which flushes its SSE stream) and its
+        // Server, then shut the HTTP server.
+        for (const [, entry] of sessions) {
+            try {
+                await entry.transport.close();
+            }
+            catch {
+                // best-effort
+            }
+            try {
+                await entry.server.close();
+            }
+            catch {
+                // best-effort
+            }
+        }
+        sessions.clear();
+        await new Promise((resolve) => {
+            httpServer.close(() => resolve());
+        });
+    };
+    return { httpServer, port: actualPort, close };
+}
+/** Minimal JSON-RPC error envelope for transport-level rejections (before the
+ * SDK transport takes over). `id: null` per JSON-RPC for unattributable errors. */
+function jsonRpcError(code, message) {
+    return { jsonrpc: "2.0", error: { code, message }, id: null };
+}
+//# sourceMappingURL=streamableHttp.js.map

package/dist/transports/streamableHttp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"streamableHttp.js","sourceRoot":"","sources":["../../src/transports/streamableHttp.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,mCAAmC;AACnC,kEAAkE;AAClE,EAAE;AACF,uCAAuC;AACvC,6EAA6E;AAC7E,8EAA8E;AAC9E,kDAAkD;AAClD,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,+CAA+C;AAC/C,4EAA4E;AAC5E,gEAAgE;AAChE,6CAA6C;AAC7C,+EAA+E;AAC/E,EAAE;AACF,6DAA6D;AAC7D,4EAA4E;AAC5E,qDAAqD;AACrD,EAAE;AACF,sDAAsD;AACtD,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,gDAAgD;AAChD,gFAAgF;AAEhF,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,OAAwC,MAAM,SAAS,CAAC;AAI/D,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAElC,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC;AACxB,MAAM,WAAW,GAAG,UAAU,CAAC;AAC/B,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC;;iFAEiF;AACjF,MAAM,eAAe,GAAG,KAAK,CAAC;AAqB9B;uEACuE;AACvE,MAAM,qBAAqB,GAAwB;IACjD,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACpB,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE;KACtE,CAAC;CACH,CAAC;AAQF,SAAS,WAAW,CAAC,QAAiB;IACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,YAAY,CAAC;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,aAA4B,EAC5B,OAAyC,EAAE;IAE3C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,qBAAqB,CAAC;IAChE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,yEAAyE;IACzE,4DAA4D;IAC5D,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;IAElD,4DAA4D;IAC5D,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,6EAA6E;IAC7E,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IAEJ,+CAA+C;IAC/C,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAErC,6CAA6C;QAC7C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,yEAAyE;QACzE,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,2DAA2D,CAAC,CAAC,CAAC;YAC3F,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,0EAA0E;QAC1E,4CAA4C;QAC5C,IAAI,OAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACzE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;gBACnB,GAAG;qBACA,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;qBACzB,GAAG,CAAC,kBAAkB,EAAE,yDAAyD,CAAC;qBAClF,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,mEAAmE;YACnE,2EAA2E;YAC3E,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,MAAM,QAAQ,GAAG,eAAe,CAAC;gBAC/B,cAAc,EAAE,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC/C,SAAS;gBACT,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;aAC9C,CAAC,CAAC;YACH,OAAO,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,mDAAmD;YACnD,OAAO,CAAC,KAAK,CACX,qCAAqC,EACrC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACzC,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,6EAA6E;QAC7E,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;YACtC,oBAAoB,EAAE,CAAC,KAAa,EAAQ,EAAE;gBAC5C,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7C,CAAC;YACD,qEAAqE;YACrE,mEAAmE;YACnE,kDAAkD;SACnD,CAAC,CAAC;QAEH,SAAS,CAAC,OAAO,GAAG,GAAS,EAAE;YAC7B,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,CAAC;YAC/B,IAAI,EAAE;gBAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,8CAA8C,EAC9C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACzC,CAAC;YACF,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,CAAC;YAC/B,IAAI,EAAE;gBAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO;QACT,CAAC;QAED,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,qCAAqC;IACrC,MAAM,qBAAqB,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QACjF,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IACzC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IAE5C,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAE1C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE;YACnC,UAAU,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YACpD,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,GAAS,EAAE;YAC7B,UAAU,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5C,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC1C,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;QACvB,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,CAAC,KAAK,CAAC,wDAAwD,UAAU,GAAG,QAAQ,EAAE,CAAC,CAAC;IAE/F,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;QACtC,yEAAyE;QACzE,qCAAqC;QACrC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AACjD,CAAC;AAED;mFACmF;AACnF,SAAS,YAAY,CAAC,IAAY,EAAE,OAAe;IAKjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AAChE,CAAC"}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@solidcommerce/mcp-server",
+  "version": "2.0.0-alpha.0",
+  "description": "Official Model Context Protocol (MCP) server for the Solid Commerce Platform API.",
+  "license": "UNLICENSED",
+  "private": false,
+  "type": "module",
+  "bin": {
+    "solidcommerce-mcp": "bin/solidcommerce-mcp.js"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "vendor/openapi.snapshot.json",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "clean": "rm -rf dist",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
+    "typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.test.json",
+    "regen-foundation-tools": "tsx src/generator/fromOpenApi.ts"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "1.18.0",
+    "@solidcommerce/sdk": "file:vendor/solidcommerce-sdk-2.0.0-alpha.0.tgz",
+    "express": "4.21.2",
+    "zod": "3.24.1",
+    "zod-to-json-schema": "3.24.1"
+  },
+  "devDependencies": {
+    "@modelcontextprotocol/inspector": "0.17.5",
+    "@types/express": "5.0.0",
+    "@types/node": "22.10.5",
+    "@typescript-eslint/eslint-plugin": "8.20.0",
+    "@typescript-eslint/parser": "8.20.0",
+    "eslint": "9.18.0",
+    "tsx": "4.19.2",
+    "typescript": "5.7.3",
+    "vitest": "2.1.8"
+  }
+}