@solidcommerce/mcp-server 2.0.0-alpha.0

package/dist/generator/schemaToZod.js

@@ -0,0 +1,277 @@
+// =============================================================================
+// src/generator/schemaToZod.ts
+// Wave: W6 — Stream A
+//
+// Converts a (subset of) OpenAPI 3.0 schema into Zod, in two complementary
+// modes:
+//
+//   1. `schemaToZodSource(...)` — emits a TypeScript source-code string
+//      like `z.object({ id: z.number().int(), label: z.string().optional() })`
+//      that gets baked into the generated foundation tool file. This is the
+//      hot path: 40 tools × N params each.
+//
+//   2. `paramsToZodObject(...)` / `requestBodyToZodSource(...)` —
+//      higher-level helpers that combine path + query + body into the
+//      single object schema each tool's `inputSchema` exposes.
+//
+// Design decisions:
+//   - We do NOT execute Zod here. We *emit* code that does. This keeps the
+//     generator pure (just string assembly) and the runtime tool files
+//     self-contained — the SDK schema stays as plain JSON in vendor/.
+//   - Unsupported features (oneOf, anyOf, allOf with complex composition,
+//     $refs to circular schemas) emit `z.unknown()` with a `// TODO` comment
+//     pointing at the schema name. The brief explicitly requests this.
+//   - Path parameters are always required (per OpenAPI 3.0 spec), even when
+//     the operation forgets the `required: true` flag. We force them.
+// =============================================================================
+const MAX_REF_DEPTH = 6;
+// -----------------------------------------------------------------------------
+// Identifier escaping — we render `z.object({ "weird.key": z.string() })`
+// when the property name isn't a valid JS identifier.
+// -----------------------------------------------------------------------------
+const SAFE_IDENT_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+function quoteKey(key) {
+    if (SAFE_IDENT_RE.test(key))
+        return key;
+    return JSON.stringify(key);
+}
+function jsLiteral(value) {
+    // We only call this on enum values, so primitive types are sufficient.
+    if (typeof value === "string")
+        return JSON.stringify(value);
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    if (value === null)
+        return "null";
+    return JSON.stringify(value);
+}
+// -----------------------------------------------------------------------------
+// Core: schema → Zod source code
+// -----------------------------------------------------------------------------
+/**
+ * Emit a Zod source-code expression for a single OpenAPI schema.
+ * Returns just the expression — no leading whitespace, no trailing semicolon.
+ *
+ * `nullable` and `optional` modifiers are NOT applied here — callers (notably
+ * `objectFromProperties`) decide per-field whether to chain `.optional()` /
+ * `.nullable()` based on the parent's `required[]` array.
+ */
+export function schemaToZodSource(schema, ctx) {
+    if (!schema)
+        return "z.unknown()";
+    const visiting = ctx.visiting ?? [];
+    // 1. $ref — resolve once, with cycle protection.
+    if (schema.$ref) {
+        const refName = stripRefPrefix(schema.$ref);
+        if (refName === null) {
+            return `z.unknown() /* unresolved ref ${JSON.stringify(schema.$ref)} */`;
+        }
+        if (visiting.includes(refName) || visiting.length >= MAX_REF_DEPTH) {
+            return `z.unknown() /* circular or deep ref: ${refName} */`;
+        }
+        const target = ctx.components[refName];
+        if (!target) {
+            return `z.unknown() /* missing schema: ${refName} */`;
+        }
+        return schemaToZodSource(target, {
+            components: ctx.components,
+            visiting: [...visiting, refName],
+        });
+    }
+    // 2. Composition keywords — only allOf with simple object merges is
+    //    supported. oneOf/anyOf with non-trivial branches degrade to unknown.
+    if (schema.oneOf && schema.oneOf.length > 0) {
+        return `z.unknown() /* oneOf with ${schema.oneOf.length} branches not supported */`;
+    }
+    if (schema.anyOf && schema.anyOf.length > 0) {
+        return `z.unknown() /* anyOf with ${schema.anyOf.length} branches not supported */`;
+    }
+    if (schema.allOf && schema.allOf.length > 0) {
+        // Best-effort: if every branch is an object, merge their properties.
+        const merged = mergeAllOfObjects(schema.allOf, ctx);
+        if (merged) {
+            return schemaToZodSource(merged, ctx);
+        }
+        return `z.unknown() /* allOf with non-object branches not supported */`;
+    }
+    // 3. Enum — type-aware string/number enums; bool enums collapse to z.boolean().
+    if (schema.enum && schema.enum.length > 0) {
+        if (schema.enum.every((v) => typeof v === "string")) {
+            const literals = schema.enum.map((v) => JSON.stringify(v)).join(", ");
+            return `z.enum([${literals}] as const)`;
+        }
+        // Mixed / numeric enum — fall back to a union of literals.
+        const literals = schema.enum.map((v) => `z.literal(${jsLiteral(v)})`).join(", ");
+        return `z.union([${literals}])`;
+    }
+    // 4. Primitives + arrays + objects.
+    switch (schema.type) {
+        case "string":
+            return stringExpr(schema);
+        case "integer":
+            return "z.number().int()";
+        case "number":
+            return "z.number()";
+        case "boolean":
+            return "z.boolean()";
+        case "array":
+            return `z.array(${schemaToZodSource(schema.items, ctx)})`;
+        case "object":
+            if (schema.properties) {
+                return objectFromProperties(schema.properties, schema.required ?? [], ctx);
+            }
+            return "z.record(z.unknown())";
+        default:
+            // Untyped / freeform — common when a body is `any`.
+            if (schema.properties) {
+                return objectFromProperties(schema.properties, schema.required ?? [], ctx);
+            }
+            return "z.unknown()";
+    }
+}
+function stringExpr(schema) {
+    // Light format hints — date-time gets z.string().datetime(), uuid gets uuid.
+    if (schema.format === "date-time")
+        return "z.string().datetime()";
+    if (schema.format === "uuid")
+        return "z.string().uuid()";
+    if (schema.format === "email")
+        return "z.string().email()";
+    if (schema.format === "uri" || schema.format === "url")
+        return "z.string().url()";
+    return "z.string()";
+}
+function objectFromProperties(properties, required, ctx) {
+    const keys = Object.keys(properties);
+    if (keys.length === 0)
+        return "z.object({})";
+    const lines = [];
+    for (const key of keys) {
+        const propSchema = properties[key];
+        let expr = schemaToZodSource(propSchema, ctx);
+        if (propSchema.nullable === true)
+            expr = `${expr}.nullable()`;
+        if (!required.includes(key))
+            expr = `${expr}.optional()`;
+        if (propSchema.description) {
+            expr = `${expr}.describe(${JSON.stringify(propSchema.description)})`;
+        }
+        lines.push(`  ${quoteKey(key)}: ${expr}`);
+    }
+    return `z.object({\n${lines.join(",\n")}\n})`;
+}
+function mergeAllOfObjects(branches, ctx) {
+    const properties = {};
+    const required = new Set();
+    for (const branch of branches) {
+        let resolved = branch;
+        if (branch.$ref) {
+            const refName = stripRefPrefix(branch.$ref);
+            if (refName === null)
+                return null;
+            const target = ctx.components[refName];
+            if (!target)
+                return null;
+            resolved = target;
+        }
+        if (resolved.type !== "object" && resolved.type !== undefined)
+            return null;
+        if (!resolved.properties)
+            return null;
+        for (const [k, v] of Object.entries(resolved.properties)) {
+            properties[k] = v;
+        }
+        for (const r of resolved.required ?? [])
+            required.add(r);
+    }
+    return { type: "object", properties, required: [...required] };
+}
+function stripRefPrefix(ref) {
+    const prefix = "#/components/schemas/";
+    if (!ref.startsWith(prefix))
+        return null;
+    return ref.slice(prefix.length);
+}
+/**
+ * Build the per-tool inputSchema source. Output shape is always:
+ *
+ *   z.object({
+ *     path?:  z.object({ ... }),  // only if op has any path params
+ *     query?: z.object({ ... }),  // only if op has any query params
+ *     body?:  <body schema>,      // only if op declares a requestBody
+ *   })
+ *
+ * `.optional()` is chained on `path` only when ALL path params are
+ * non-required (rare); on `query` when no query param is required;
+ * on `body` when the requestBody is not declared as required.
+ */
+export function buildToolInputSchema(parameters, requestBody, ctx) {
+    const pathParams = parameters.filter((p) => p.in === "path");
+    const queryParams = parameters.filter((p) => p.in === "query");
+    const pathProperties = {};
+    const pathRequired = [];
+    for (const p of pathParams) {
+        const annotated = p.description
+            ? { ...(p.schema ?? {}), description: p.description }
+            : (p.schema ?? {});
+        pathProperties[p.name] = annotated;
+        // Per OpenAPI 3.0, path params are always required even if `required` is
+        // missing on the parameter object. We force them.
+        pathRequired.push(p.name);
+    }
+    const queryProperties = {};
+    const queryRequired = [];
+    for (const p of queryParams) {
+        const annotated = p.description
+            ? { ...(p.schema ?? {}), description: p.description }
+            : (p.schema ?? {});
+        queryProperties[p.name] = annotated;
+        if (p.required === true)
+            queryRequired.push(p.name);
+    }
+    const pathExpr = pathParams.length === 0
+        ? null
+        : objectFromProperties(pathProperties, pathRequired, ctx);
+    const queryExpr = queryParams.length === 0
+        ? null
+        : objectFromProperties(queryProperties, queryRequired, ctx);
+    let bodyExpr = null;
+    let bodyRequired = false;
+    if (requestBody && requestBody.content) {
+        const json = requestBody.content["application/json"] ??
+            requestBody.content["text/json"] ??
+            requestBody.content["application/*+json"];
+        if (json && json.schema) {
+            bodyExpr = schemaToZodSource(json.schema, ctx);
+            bodyRequired = requestBody.required === true;
+        }
+    }
+    // Assemble the top-level object schema source.
+    const fields = [];
+    if (pathExpr) {
+        // Path block is required iff at least one path param exists.
+        fields.push(`  path: ${pathExpr}`);
+    }
+    if (queryExpr) {
+        const allOptional = queryRequired.length === 0;
+        fields.push(`  query: ${queryExpr}${allOptional ? ".optional()" : ""}`);
+    }
+    if (bodyExpr !== null) {
+        fields.push(`  body: ${bodyExpr}${bodyRequired ? "" : ".optional()"}`);
+    }
+    const source = fields.length === 0 ? "z.object({})" : `z.object({\n${fields.join(",\n")}\n})`;
+    return {
+        source,
+        shape: {
+            pathExpr,
+            queryExpr,
+            bodyExpr,
+            hasBody: bodyExpr !== null,
+            bodyRequired,
+            hasRequiredQuery: queryRequired.length > 0,
+            pathParamNames: pathParams.map((p) => p.name),
+            queryParamNames: queryParams.map((p) => p.name),
+        },
+    };
+}
+//# sourceMappingURL=schemaToZod.js.map

package/dist/generator/schemaToZod.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemaToZod.js","sourceRoot":"","sources":["../../src/generator/schemaToZod.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,+BAA+B;AAC/B,sBAAsB;AACtB,EAAE;AACF,2EAA2E;AAC3E,SAAS;AACT,EAAE;AACF,wEAAwE;AACxE,+EAA+E;AAC/E,4EAA4E;AAC5E,2CAA2C;AAC3C,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,+DAA+D;AAC/D,EAAE;AACF,oBAAoB;AACpB,2EAA2E;AAC3E,uEAAuE;AACvE,sEAAsE;AACtE,0EAA0E;AAC1E,6EAA6E;AAC7E,uEAAuE;AACvE,4EAA4E;AAC5E,sEAAsE;AACtE,gFAAgF;AAuChF,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB,gFAAgF;AAChF,0EAA0E;AAC1E,sDAAsD;AACtD,gFAAgF;AAEhF,MAAM,aAAa,GAAG,4BAA4B,CAAC;AAEnD,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACxC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,uEAAuE;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAClF,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,gFAAgF;AAChF,iCAAiC;AACjC,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAiC,EACjC,GAAkB;IAElB,IAAI,CAAC,MAAM;QAAE,OAAO,aAAa,CAAC;IAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;IAEpC,iDAAiD;IACjD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,iCAAiC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3E,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;YACnE,OAAO,wCAAwC,OAAO,KAAK,CAAC;QAC9D,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,kCAAkC,OAAO,KAAK,CAAC;QACxD,CAAC;QACD,OAAO,iBAAiB,CAAC,MAAM,EAAE;YAC/B,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,0EAA0E;IAC1E,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,6BAA6B,MAAM,CAAC,KAAK,CAAC,MAAM,4BAA4B,CAAC;IACtF,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,6BAA6B,MAAM,CAAC,KAAK,CAAC,MAAM,4BAA4B,CAAC;IACtF,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,qEAAqE;QACrE,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,gEAAgE,CAAC;IAC1E,CAAC;IAED,gFAAgF;IAChF,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChF,OAAO,WAAW,QAAQ,aAAa,CAAC;QAC1C,CAAC;QACD,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjF,OAAO,YAAY,QAAQ,IAAI,CAAC;IAClC,CAAC;IAED,oCAAoC;IACpC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,kBAAkB,CAAC;QAC5B,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC;QACtB,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC;QACvB,KAAK,OAAO;YACV,OAAO,WAAW,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC;QAC5D,KAAK,QAAQ;YACX,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,OAAO,oBAAoB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,uBAAuB,CAAC;QACjC;YACE,oDAAoD;YACpD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,OAAO,oBAAoB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,aAAa,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAqB;IACvC,6EAA6E;IAC7E,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,uBAAuB,CAAC;IAClE,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,mBAAmB,CAAC;IACzD,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,oBAAoB,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,kBAAkB,CAAC;IAClF,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,oBAAoB,CAC3B,UAAmD,EACnD,QAA+B,EAC/B,GAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAE,CAAC;QACpC,IAAI,IAAI,GAAG,iBAAiB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,UAAU,CAAC,QAAQ,KAAK,IAAI;YAAE,IAAI,GAAG,GAAG,IAAI,aAAa,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,GAAG,IAAI,aAAa,CAAC;QACzD,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;YAC3B,IAAI,GAAG,GAAG,IAAI,aAAa,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,eAAe,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;AAChD,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAsC,EACtC,GAAkB;IAElB,MAAM,UAAU,GAAkC,EAAE,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,IAAI,QAAQ,GAAG,MAAM,CAAC;QACtB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAClC,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,QAAQ,GAAG,MAAM,CAAC;QACpB,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC3E,IAAI,CAAC,QAAQ,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QACtC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,IAAI,EAAE;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,MAAM,GAAG,uBAAuB,CAAC;IACvC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAyBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAA2C,EAC3C,WAAsC,EACtC,GAAkB;IAElB,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;IAE/D,MAAM,cAAc,GAAkC,EAAE,CAAC;IACzD,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW;YAC7B,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE;YACrD,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACrB,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;QACnC,yEAAyE;QACzE,kDAAkD;QAClD,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,eAAe,GAAkC,EAAE,CAAC;IAC1D,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW;YAC7B,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE;YACrD,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACrB,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;QACpC,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI;YAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GACZ,UAAU,CAAC,MAAM,KAAK,CAAC;QACrB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,oBAAoB,CAAC,cAAc,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,SAAS,GACb,WAAW,CAAC,MAAM,KAAK,CAAC;QACtB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,oBAAoB,CAAC,eAAe,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IAEhE,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,WAAW,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,GACR,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACvC,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC;YAChC,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC5C,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxB,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC/C,YAAY,GAAG,WAAW,CAAC,QAAQ,KAAK,IAAI,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,EAAE,CAAC;QACb,6DAA6D;QAC7D,MAAM,CAAC,IAAI,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,YAAY,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,WAAW,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAEjF,OAAO;QACL,MAAM;QACN,KAAK,EAAE;YACL,QAAQ;YACR,SAAS;YACT,QAAQ;YACR,OAAO,EAAE,QAAQ,KAAK,IAAI;YAC1B,YAAY;YACZ,gBAAgB,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC;YAC1C,cAAc,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7C,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAChD;KACF,CAAC;AACJ,CAAC"}

package/dist/generator/scopeInference.d.ts

@@ -0,0 +1,26 @@
+export type HttpMethodLc = "get" | "post" | "put" | "patch" | "delete";
+interface ScopeAwareOperation {
+    readonly "x-required-scope"?: unknown;
+    readonly "x-required-scopes"?: unknown;
+    readonly "x-scopes"?: unknown;
+}
+/**
+ * Derive a single `<segment>:<resource>:<verb>` scope string from a path
+ * + HTTP method when the OpenAPI operation has no scope extension.
+ *
+ * Conventions:
+ *   - GET, HEAD          → :read
+ *   - DELETE             → :delete
+ *   - POST, PUT, PATCH   → :write
+ *
+ * Resource is the first non-parameter segment after the segment, falling
+ * back to the segment itself if there's no second token.
+ */
+export declare function inferScopeFromPath(path: string, method: HttpMethodLc): string;
+/**
+ * Top-level entry: returns a single canonical scope string for an operation.
+ * Never throws; falls back to inference when no extension is present.
+ */
+export declare function resolveRequiredScope(operation: ScopeAwareOperation | null | undefined, path: string, method: HttpMethodLc): string;
+export {};
+//# sourceMappingURL=scopeInference.d.ts.map

package/dist/generator/scopeInference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopeInference.d.ts","sourceRoot":"","sources":["../../src/generator/scopeInference.ts"],"names":[],"mappings":"AAsBA,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvE,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAmBD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,YAAY,GACnB,MAAM,CAgBR;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,EACjD,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,YAAY,GACnB,MAAM,CAaR"}

package/dist/generator/scopeInference.js

@@ -0,0 +1,91 @@
+// =============================================================================
+// src/generator/scopeInference.ts
+// Wave: W6 — Stream A
+//
+// Derives the `required_scope` string for one OpenAPI operation, in priority
+// order:
+//
+//   1. `operation['x-required-scope']` (singular, from W6 brief)
+//   2. `operation['x-required-scopes']` (plural — what the W4 snapshot
+//      actually emits; pick the first)
+//   3. `operation['x-scopes']` (alternative spelling — pick the first)
+//   4. Inferred from path + method as `<segment>:<resource>:<verb>` where:
+//        - segment = first path token after `/v1/`
+//        - resource = next non-param token (or "self" if none)
+//        - verb     = read|write|delete (delete) | write (POST/PUT/PATCH) | read (GET)
+//
+// We export the *string* form because that's what the MCP tool surface
+// expects (one canonical scope per tool). When an operation declares multiple
+// scopes (e.g. read+write), we pick the first since W4's auth pipeline
+// authenticates with `any-of` semantics on declared scopes.
+// =============================================================================
+/** Internal helper: coerce extension value to a non-empty trimmed string. */
+function pickFirstScope(value) {
+    if (typeof value === "string") {
+        const t = value.trim();
+        return t.length > 0 ? t : null;
+    }
+    if (Array.isArray(value)) {
+        for (const entry of value) {
+            if (typeof entry === "string") {
+                const t = entry.trim();
+                if (t.length > 0)
+                    return t;
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Derive a single `<segment>:<resource>:<verb>` scope string from a path
+ * + HTTP method when the OpenAPI operation has no scope extension.
+ *
+ * Conventions:
+ *   - GET, HEAD          → :read
+ *   - DELETE             → :delete
+ *   - POST, PUT, PATCH   → :write
+ *
+ * Resource is the first non-parameter segment after the segment, falling
+ * back to the segment itself if there's no second token.
+ */
+export function inferScopeFromPath(path, method) {
+    const stripped = path.replace(/^\/+/, "").replace(/^v1\//, "");
+    const tokens = stripped
+        .split("/")
+        .filter((t) => t.length > 0 && !(t.startsWith("{") && t.endsWith("}")));
+    const segment = tokens[0] ?? "platform";
+    const resource = tokens[1] ?? segment;
+    let verb;
+    if (method === "delete") {
+        verb = "delete";
+    }
+    else if (method === "get") {
+        verb = "read";
+    }
+    else {
+        verb = "write";
+    }
+    return `${segment}:${resource}:${verb}`;
+}
+/**
+ * Top-level entry: returns a single canonical scope string for an operation.
+ * Never throws; falls back to inference when no extension is present.
+ */
+export function resolveRequiredScope(operation, path, method) {
+    if (operation) {
+        // Priority 1: x-required-scope (singular — brief's preferred extension).
+        const single = pickFirstScope(operation["x-required-scope"]);
+        if (single !== null)
+            return single;
+        // Priority 2: x-required-scopes (plural — what the W4 snapshot uses).
+        const plural = pickFirstScope(operation["x-required-scopes"]);
+        if (plural !== null)
+            return plural;
+        // Priority 3: x-scopes (alternate form).
+        const xScopes = pickFirstScope(operation["x-scopes"]);
+        if (xScopes !== null)
+            return xScopes;
+    }
+    return inferScopeFromPath(path, method);
+}
+//# sourceMappingURL=scopeInference.js.map

package/dist/generator/scopeInference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopeInference.js","sourceRoot":"","sources":["../../src/generator/scopeInference.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,kCAAkC;AAClC,sBAAsB;AACtB,EAAE;AACF,6EAA6E;AAC7E,SAAS;AACT,EAAE;AACF,iEAAiE;AACjE,uEAAuE;AACvE,uCAAuC;AACvC,uEAAuE;AACvE,2EAA2E;AAC3E,mDAAmD;AACnD,+DAA+D;AAC/D,uFAAuF;AACvF,EAAE;AACF,uEAAuE;AACvE,8EAA8E;AAC9E,uEAAuE;AACvE,4DAA4D;AAC5D,gFAAgF;AAUhF,6EAA6E;AAC7E,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,MAAoB;IAEpB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,QAAQ;SACpB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;IACtC,IAAI,IAAiC,CAAC;IACtC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,IAAI,GAAG,QAAQ,CAAC;IAClB,CAAC;SAAM,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QAC5B,IAAI,GAAG,MAAM,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,OAAO,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAiD,EACjD,IAAY,EACZ,MAAoB;IAEpB,IAAI,SAAS,EAAE,CAAC;QACd,yEAAyE;QACzE,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC7D,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QACnC,sEAAsE;QACtE,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC9D,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QACnC,yCAAyC;QACzC,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;QACtD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC;IACvC,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,106 @@
+// =============================================================================
+// src/index.ts
+// Wave: W6 — MCP Server entrypoint.
+// Phase 0 / E-A1 — SSE replaced by Streamable HTTP; per-session Server factory.
+//
+// Boots the MCP server:
+//   1. Defines makeServer(): builds a fresh per-session SolidCommerceClient
+//      (apiKey auth) + audit hook + dispatcher-wired MCP Server.
+//   2. Selects transport (--http / SC_MCP_TRANSPORT=http → Streamable HTTP;
+//      else stdio). The legacy "sse" value is accepted as a deprecated alias
+//      so existing App Service config boots Streamable HTTP instead of crashing.
+//   3. stdio  → one Server for the single local session.
+//      http   → makeServer is handed to the transport, which calls it ONCE PER
+//               SESSION so each remote client gets isolated state (prerequisite
+//               for per-user OAuth context in E-A3).
+//
+// Stream A overwrites src/tools/foundation/index.ts; Stream B overwrites
+// src/tools/tasks/index.ts. The merge takes their versions; this file is
+// stable across all three streams.
+// =============================================================================
+import { attachAuditHook } from "./audit/auditClient.js";
+import { buildClient, buildBearerClient, ENV_API_KEY } from "./auth/apiKey.js";
+import { createIntrospector, createSessionAuthResolver, loadOAuthConfigFromEnv, } from "./auth/oauth.js";
+import { buildMcpServer } from "./server/buildServer.js";
+import { ENV_HOST_NAME_OVERRIDE, resolveHostName } from "./telemetry/hostName.js";
+import { foundationTools } from "./tools/foundation/index.js";
+import { taskTools } from "./tools/tasks/index.js";
+import { startStreamableHttpServer } from "./transports/streamableHttp.js";
+import { startStdioServer } from "./transports/stdio.js";
+function pickTransport(argv) {
+    const explicit = process.env["SC_MCP_TRANSPORT"]?.toLowerCase();
+    if (explicit === "http" || argv.includes("--http"))
+        return "http";
+    // Deprecated alias: SSE was removed in E-A1. Accept the old value so existing
+    // App Service config (SC_MCP_TRANSPORT=sse) still boots — on Streamable HTTP.
+    if (explicit === "sse" || argv.includes("--sse")) {
+        console.error("[mcp-server] WARNING: 'sse' transport was removed (E-A1); booting Streamable HTTP. " +
+            "Update SC_MCP_TRANSPORT to 'http'.");
+        return "http";
+    }
+    return "stdio";
+}
+/**
+ * Build a fresh, fully-wired MCP Server bound to a session's auth identity.
+ * Called once for stdio, and once PER SESSION for Streamable HTTP. Each
+ * invocation mints its own SDK client + audit ref-cell, so concurrent remote
+ * sessions never share a tool-name ref, an auth context, or a token.
+ *
+ *   * oauth  → SDK client carries the user's bearer token (Platform validates).
+ *   * apiKey → SDK client uses the env API key (stdio / Scotty / internal).
+ */
+function makeServer(session) {
+    const { auth, hostName } = session;
+    // For oauth sessions, forward the user's bearer; otherwise the env API key.
+    // buildClient() / buildBearerClient() throw on missing creds — fail fast.
+    const client = auth.mode === "oauth" && auth.token !== undefined
+        ? buildBearerClient(auth.token)
+        : buildClient();
+    // setCurrentToolName is a closure over a ref-cell; the dispatcher (via
+    // buildMcpServer's ctxFactory) flips it on every call. The audit hook also
+    // stamps auth_mode + install_id (E-A3) and host_name (E-A4) on every call.
+    const audit = attachAuditHook(client, { auth, hostName });
+    // Order foundation first (stable, generated) → tasks (curated). Duplicate
+    // names → buildMcpServer throws.
+    const tools = [...foundationTools, ...taskTools];
+    return buildMcpServer({
+        tools,
+        client,
+        setCurrentToolName: audit.setCurrentToolName,
+        auth,
+    });
+}
+async function main() {
+    const transport = pickTransport(process.argv.slice(2));
+    if (transport === "http") {
+        // Wire the per-user OAuth resolver (Phase 0 / E-A3). One introspector
+        // (shared cache + circuit breaker) serves every session.
+        const oauthConfig = loadOAuthConfigFromEnv();
+        const introspector = createIntrospector(oauthConfig);
+        const apiKeyAvailable = (process.env[ENV_API_KEY] ?? "").trim().length > 0;
+        const authResolver = createSessionAuthResolver({
+            config: oauthConfig,
+            introspector,
+            apiKeyAvailable,
+        });
+        console.error(`[mcp-server] oauth ${oauthConfig.enabled ? "enabled" : "disabled"}; ` +
+            `apiKey fallback ${apiKeyAvailable ? "available" : "absent"}`);
+        // The factory is called per-session inside the transport, after auth resolves.
+        await startStreamableHttpServer(makeServer, { authResolver });
+    }
+    else {
+        // stdio: no inbound Authorization header; always service/internal identity.
+        // hostName comes only from an explicit override (clientInfo isn't known
+        // until the post-connect `initialize` over the stdio pipe).
+        const stdioSession = {
+            auth: { mode: "apiKey", scopes: [], introspectionDegraded: false },
+            hostName: resolveHostName({ override: process.env[ENV_HOST_NAME_OVERRIDE] }),
+        };
+        await startStdioServer(makeServer(stdioSession));
+    }
+}
+main().catch((err) => {
+    console.error("[mcp-server] fatal:", err instanceof Error ? err.message : err);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,eAAe;AACf,oCAAoC;AACpC,gFAAgF;AAChF,EAAE;AACF,wBAAwB;AACxB,4EAA4E;AAC5E,iEAAiE;AACjE,4EAA4E;AAC5E,6EAA6E;AAC7E,iFAAiF;AACjF,yDAAyD;AACzD,+EAA+E;AAC/E,gFAAgF;AAChF,qDAAqD;AACrD,EAAE;AACF,yEAAyE;AACzE,yEAAyE;AACzE,mCAAmC;AACnC,gFAAgF;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAKzD,SAAS,aAAa,CAAC,IAAuB;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,CAAC;IAChE,IAAI,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IAClE,8EAA8E;IAC9E,8EAA8E;IAC9E,IAAI,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,KAAK,CACX,qFAAqF;YACnF,oCAAoC,CACvC,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,OAAuB;IACzC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACnC,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,MAAM,GACV,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAC/C,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC/B,CAAC,CAAC,WAAW,EAAE,CAAC;IACpB,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1D,0EAA0E;IAC1E,iCAAiC;IACjC,MAAM,KAAK,GAA8B,CAAC,GAAG,eAAe,EAAE,GAAG,SAAS,CAAC,CAAC;IAC5E,OAAO,cAAc,CAAC;QACpB,KAAK;QACL,MAAM;QACN,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,sEAAsE;QACtE,yDAAyD;QACzD,MAAM,WAAW,GAAG,sBAAsB,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,eAAe,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3E,MAAM,YAAY,GAAG,yBAAyB,CAAC;YAC7C,MAAM,EAAE,WAAW;YACnB,YAAY;YACZ,eAAe;SAChB,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CACX,sBAAsB,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI;YACpE,mBAAmB,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,CAChE,CAAC;QACF,+EAA+E;QAC/E,MAAM,yBAAyB,CAAC,UAAU,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,4EAA4E;QAC5E,wEAAwE;QACxE,4DAA4D;QAC5D,MAAM,YAAY,GAAmB;YACnC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE;YAClE,QAAQ,EAAE,eAAe,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC;SAC7E,CAAC;QACF,MAAM,gBAAgB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/server/buildServer.d.ts

@@ -0,0 +1,35 @@
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import type { SolidCommerceClient } from "@solidcommerce/sdk";
+import type { SessionAuthContext } from "../auth/oauth.js";
+import type { ToolModule } from "../tools/contract.js";
+export declare const SERVER_NAME = "@solidcommerce/mcp-server";
+export interface BuildServerOptions {
+    readonly tools: ReadonlyArray<ToolModule>;
+    readonly client: SolidCommerceClient;
+    /**
+     * Hook into the audit ref-cell. The dispatcher calls this with the tool
+     * name just before invoking `tool.handle`, and again with `null` after.
+     * See src/audit/auditClient.ts.
+     */
+    readonly setCurrentToolName: (name: string | null) => void;
+    /**
+     * Resolved per-session auth identity (Phase 0 / E-A3). Surfaced to every tool
+     * via `ToolContext.auth`. Omit for stdio unit tests → defaults to apiKey.
+     */
+    readonly auth?: SessionAuthContext;
+    /** Override for tests. */
+    readonly version?: string;
+}
+/**
+ * Wire a fully-configured MCP `Server`. Caller is responsible for `connect()`.
+ *
+ * The dispatcher's `ctxFactory` is closed over `client` + `setCurrentToolName`
+ * so each tool invocation:
+ *
+ *   1. Sets the audit ref to the tool name.
+ *   2. Receives a ToolContext { client, toolName }.
+ *   3. The SDK fires onRequest hooks → audit headers go on the wire.
+ *   4. After tool.handle resolves (or throws), the ref is cleared.
+ */
+export declare function buildMcpServer(opts: BuildServerOptions): Server;
+//# sourceMappingURL=buildServer.d.ts.map

package/dist/server/buildServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildServer.d.ts","sourceRoot":"","sources":["../../src/server/buildServer.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAG9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAA6B,MAAM,sBAAsB,CAAC;AAkBlF,eAAO,MAAM,WAAW,8BAA8B,CAAC;AA4BvD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC3D;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;IACnC,0BAA0B;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAqC/D"}