@soulbatical/tetra-core 0.1.24 → 0.1.26

package/dist/index.d.ts

@@ -96,6 +96,8 @@ export { RPCGenerator, DetailRPCGenerator, validateConfig as validateRPCConfig,
 export type { GeneratedSQL, FilterDefinition, RPCGeneratorOptions, DetailRPCGeneratorOptions, ValidationResult as RPCValidationResult, ValidationError as RPCValidationError, AccessLevel, CreatorVisibilityConfig as RPCCreatorVisibilityConfig } from './generators/rpc/index.js';
 export { EmailService, sendMailgunEmail, escapeHtml } from './shared/email/index.js';
 export type { EmailConfig, SendEmailOpts, EmailTemplate, EmailLogEntry, MailgunResponse } from './shared/email/index.js';
+export { addMcpRoutes, addMcpAuthRoutes, addMcpTokenRoutes, addMcpUsageRoutes, getMcpOrganizationId, getMcpTenantContext, runWithMcpTenant, validateMcpApiToken, generateMcpApiToken } from './shared/mcp/index.js';
+export type { McpRoutesConfig, McpAuthRoutesConfig, McpToolDefinition, McpToolResult, McpToolHandler, TenantContext as McpTenantContext } from './shared/mcp/index.js';
 export { createApp } from './core/createApp.js';
 export type { CreateAppConfig } from './core/createApp.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,UAAU,EAAE,uBAAuB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAClY,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AACjF,YAAY,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACjG,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC/J,YAAY,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAG9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,gDAAgD,CAAC;AAG9F,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAC3G,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAGzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,YAAY,EAAE,iBAAiB,IAAI,UAAU,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC3G,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACzE,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AACnH,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAGjE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,wBAAwB,EAAE,WAAW,EAAE,0BAA0B,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC9N,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACvH,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAChJ,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAC5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC9K,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAGjH,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AACtP,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAGjI,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC7D,YAAY,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AACpO,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACtJ,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACpH,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAGzF,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAC1H,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAC;AAGpI,YAAY,EAAE,oBAAoB,EAAE,QAAQ,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAOjL,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGlE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACzH,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,cAAc,EAAE,SAAS,EAAE,mBAAmB,EAAE,cAAc,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAG1U,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,YAAY,EAAE,sBAAsB,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAGpJ,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAC9E,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,YAAY,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAC/G,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGnF,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,cAAc,IAAI,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC5O,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,gBAAgB,IAAI,mBAAmB,EAAE,eAAe,IAAI,kBAAkB,EAAE,WAAW,EAAE,uBAAuB,IAAI,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAGpR,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrF,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAGzH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,UAAU,EAAE,uBAAuB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAClY,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AACjF,YAAY,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACjG,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC/J,YAAY,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAG9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,gDAAgD,CAAC;AAG9F,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAC3G,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAGzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,YAAY,EAAE,iBAAiB,IAAI,UAAU,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC3G,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACzE,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AACnH,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAGjE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,wBAAwB,EAAE,WAAW,EAAE,0BAA0B,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC9N,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACvH,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAChJ,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAC5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC9K,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAGjH,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AACtP,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAGjI,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC7D,YAAY,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AACpO,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACtJ,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACpH,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAGzF,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAC1H,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAC;AAGpI,YAAY,EAAE,oBAAoB,EAAE,QAAQ,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAOjL,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGlE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACzH,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,cAAc,EAAE,SAAS,EAAE,mBAAmB,EAAE,cAAc,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAG1U,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,YAAY,EAAE,sBAAsB,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAGpJ,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAC9E,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,YAAY,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAC/G,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGnF,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,cAAc,IAAI,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC5O,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,gBAAgB,IAAI,mBAAmB,EAAE,eAAe,IAAI,kBAAkB,EAAE,WAAW,EAAE,uBAAuB,IAAI,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAGpR,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrF,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAGzH,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpN,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,IAAI,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGvK,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -90,6 +90,8 @@ export { generateExecSQL, checkExecSQLExists } from './generators/rls-exec-sql.j
 export { RPCGenerator, DetailRPCGenerator, validateConfig as validateRPCConfig, generateAuthCheck, generateAuthWhereClause, generateAuthDeclarations, generateTimestamp, getTableAlias, escapeIdentifier } from './generators/rpc/index.js';
 // ─── Email Module ───────────────────────────────────────────
 export { EmailService, sendMailgunEmail, escapeHtml } from './shared/email/index.js';
+// ─── MCP Online Module ──────────────────────────────────────
+export { addMcpRoutes, addMcpAuthRoutes, addMcpTokenRoutes, addMcpUsageRoutes, getMcpOrganizationId, getMcpTenantContext, runWithMcpTenant, validateMcpApiToken, generateMcpApiToken } from './shared/mcp/index.js';
 // ─── App Bootstrap ──────────────────────────────────────────
 export { createApp } from './core/createApp.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAMtE,+DAA+D;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,gDAAgD,CAAC;AAE9F,+DAA+D;AAC/D,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAE3G,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAEzE,+DAA+D;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAEzE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAEjE,gEAAgE;AAChE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,wBAAwB,EAAE,WAAW,EAAE,0BAA0B,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAE9N,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAChJ,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAC5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAGvE,2CAA2C;AAC3C,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAG9K,mCAAmC;AACnC,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAGtP,+DAA+D;AAC/D,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAEpO,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAGpH,+DAA+D;AAC/D,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAC1H,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAC;AAKpI,gEAAgE;AAChE,wEAAwE;AACxE,uFAAuF;AAEvF,8DAA8D;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,8DAA8D;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAGzH,+DAA+D;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAG9D,gEAAgE;AAChE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE5E,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEnF,sCAAsC;AACtC,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,cAAc,IAAI,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAG5O,+DAA+D;AAC/D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAGrF,+DAA+D;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAMtE,+DAA+D;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,gDAAgD,CAAC;AAE9F,+DAA+D;AAC/D,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAE3G,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAEzE,+DAA+D;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAEzE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAEjE,gEAAgE;AAChE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,wBAAwB,EAAE,WAAW,EAAE,0BAA0B,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAE9N,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAChJ,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAC5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAGvE,2CAA2C;AAC3C,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAG9K,mCAAmC;AACnC,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAGtP,+DAA+D;AAC/D,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAEpO,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAGpH,+DAA+D;AAC/D,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAC1H,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAC;AAKpI,gEAAgE;AAChE,wEAAwE;AACxE,uFAAuF;AAEvF,8DAA8D;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,8DAA8D;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAGzH,+DAA+D;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAG9D,gEAAgE;AAChE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE5E,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEnF,sCAAsC;AACtC,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,cAAc,IAAI,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAG5O,+DAA+D;AAC/D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAGrF,+DAA+D;AAC/D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAGpN,+DAA+D;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/shared/mcp/index.d.ts

@@ -0,0 +1,48 @@
+/**
+ * MCP Online Module
+ *
+ * Provides everything needed to expose MCP tools over HTTP:
+ * - StreamableHTTP transport with Bearer token auth
+ * - Browser-based login flow for token acquisition
+ * - Token CRUD management
+ * - Usage stats / audit logging
+ * - Tenant isolation via AsyncLocalStorage
+ *
+ * Quick start:
+ * ```typescript
+ * import { addMcpRoutes, addMcpAuthRoutes, addMcpTokenRoutes, addMcpUsageRoutes } from '@soulbatical/tetra-core';
+ * import { Router } from 'express';
+ *
+ * const tokenPrefix = 'myapp_';
+ *
+ * // MCP endpoint (Bearer API token auth)
+ * const mcpRouter = Router();
+ * addMcpRoutes(mcpRouter, { tools, handlers, tokenPrefix });
+ * app.use('/api/mcp', mcpRouter);
+ *
+ * // Browser auth flow (public + JWT)
+ * const mcpAuthRouter = Router();
+ * addMcpAuthRoutes(mcpAuthRouter, { tokenPrefix });
+ * app.use('/api/mcp-auth', mcpAuthRouter);
+ *
+ * // Token management (JWT auth)
+ * const mcpTokensRouter = Router();
+ * addMcpTokenRoutes(mcpTokensRouter, { tokenPrefix });
+ * app.use('/api/mcp-tokens', mcpTokensRouter);
+ *
+ * // Usage stats (JWT auth)
+ * const mcpUsageRouter = Router();
+ * addMcpUsageRoutes(mcpUsageRouter);
+ * app.use('/api/mcp-usage', mcpUsageRouter);
+ * ```
+ *
+ * Database: requires `mcp_api_tokens` and `mcp_audit_log` tables.
+ * See migrations/ directory for SQL.
+ */
+export { addMcpRoutes } from './mcp-routes.js';
+export { addMcpAuthRoutes } from './mcp-auth-routes.js';
+export { addMcpTokenRoutes } from './mcp-tokens-routes.js';
+export { addMcpUsageRoutes } from './mcp-usage-routes.js';
+export { getMcpOrganizationId, getMcpTenantContext, runWithMcpTenant, validateMcpApiToken, generateMcpApiToken } from './tenant-context.js';
+export type { McpRoutesConfig, McpAuthRoutesConfig, McpToolDefinition, McpToolResult, McpToolHandler, TenantContext } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/shared/mcp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/shared/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAG1D,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG5I,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/shared/mcp/index.js

@@ -0,0 +1,49 @@
+/**
+ * MCP Online Module
+ *
+ * Provides everything needed to expose MCP tools over HTTP:
+ * - StreamableHTTP transport with Bearer token auth
+ * - Browser-based login flow for token acquisition
+ * - Token CRUD management
+ * - Usage stats / audit logging
+ * - Tenant isolation via AsyncLocalStorage
+ *
+ * Quick start:
+ * ```typescript
+ * import { addMcpRoutes, addMcpAuthRoutes, addMcpTokenRoutes, addMcpUsageRoutes } from '@soulbatical/tetra-core';
+ * import { Router } from 'express';
+ *
+ * const tokenPrefix = 'myapp_';
+ *
+ * // MCP endpoint (Bearer API token auth)
+ * const mcpRouter = Router();
+ * addMcpRoutes(mcpRouter, { tools, handlers, tokenPrefix });
+ * app.use('/api/mcp', mcpRouter);
+ *
+ * // Browser auth flow (public + JWT)
+ * const mcpAuthRouter = Router();
+ * addMcpAuthRoutes(mcpAuthRouter, { tokenPrefix });
+ * app.use('/api/mcp-auth', mcpAuthRouter);
+ *
+ * // Token management (JWT auth)
+ * const mcpTokensRouter = Router();
+ * addMcpTokenRoutes(mcpTokensRouter, { tokenPrefix });
+ * app.use('/api/mcp-tokens', mcpTokensRouter);
+ *
+ * // Usage stats (JWT auth)
+ * const mcpUsageRouter = Router();
+ * addMcpUsageRoutes(mcpUsageRouter);
+ * app.use('/api/mcp-usage', mcpUsageRouter);
+ * ```
+ *
+ * Database: requires `mcp_api_tokens` and `mcp_audit_log` tables.
+ * See migrations/ directory for SQL.
+ */
+// Routes
+export { addMcpRoutes } from './mcp-routes.js';
+export { addMcpAuthRoutes } from './mcp-auth-routes.js';
+export { addMcpTokenRoutes } from './mcp-tokens-routes.js';
+export { addMcpUsageRoutes } from './mcp-usage-routes.js';
+// Tenant context
+export { getMcpOrganizationId, getMcpTenantContext, runWithMcpTenant, validateMcpApiToken, generateMcpApiToken } from './tenant-context.js';
+//# sourceMappingURL=index.js.map

package/dist/shared/mcp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/shared/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,SAAS;AACT,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,iBAAiB;AACjB,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/shared/mcp/mcp-auth-routes.d.ts

@@ -0,0 +1,26 @@
+/**
+ * MCP Auth Routes — Factory
+ *
+ * Browser-based login flow for MCP token acquisition.
+ *
+ * Flow:
+ * 1. MCP client POST /request → gets request_id + login URL
+ * 2. User opens browser, logs in
+ * 3. Frontend calls POST /approve/:requestId (authenticated)
+ * 4. MCP client polls GET /poll/:requestId → receives API token
+ *
+ * Usage:
+ * ```typescript
+ * import { addMcpAuthRoutes } from '@soulbatical/tetra-core';
+ *
+ * const mcpAuthRouter = Router();
+ * addMcpAuthRoutes(mcpAuthRouter, {
+ *   tokenPrefix: 'vincifox_',
+ * });
+ * app.use('/api/mcp-auth', mcpAuthRouter);
+ * ```
+ */
+import type { Router } from 'express';
+import type { McpAuthRoutesConfig } from './types.js';
+export declare function addMcpAuthRoutes(router: Router, config: McpAuthRoutesConfig): void;
+//# sourceMappingURL=mcp-auth-routes.d.ts.map

package/dist/shared/mcp/mcp-auth-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth-routes.d.ts","sourceRoot":"","sources":["../../../src/shared/mcp/mcp-auth-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AAKzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAiCtD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAwHlF"}

package/dist/shared/mcp/mcp-auth-routes.js

@@ -0,0 +1,138 @@
+/**
+ * MCP Auth Routes — Factory
+ *
+ * Browser-based login flow for MCP token acquisition.
+ *
+ * Flow:
+ * 1. MCP client POST /request → gets request_id + login URL
+ * 2. User opens browser, logs in
+ * 3. Frontend calls POST /approve/:requestId (authenticated)
+ * 4. MCP client polls GET /poll/:requestId → receives API token
+ *
+ * Usage:
+ * ```typescript
+ * import { addMcpAuthRoutes } from '@soulbatical/tetra-core';
+ *
+ * const mcpAuthRouter = Router();
+ * addMcpAuthRoutes(mcpAuthRouter, {
+ *   tokenPrefix: 'vincifox_',
+ * });
+ * app.use('/api/mcp-auth', mcpAuthRouter);
+ * ```
+ */
+import { randomUUID } from 'node:crypto';
+import { authenticateToken } from '../../middleware/authMiddleware.js';
+import { systemDB } from '../../core/systemDb.js';
+import { generateMcpApiToken } from './tenant-context.js';
+// In-memory store (short-lived, <5min)
+const pendingRequests = new Map();
+// Cleanup expired every 30s
+setInterval(() => {
+    const now = Date.now();
+    for (const [id, req] of pendingRequests) {
+        if (now - req.createdAt > 600_000) { // 10min hard limit
+            pendingRequests.delete(id);
+        }
+    }
+}, 30_000).unref();
+function getOrgId(req) {
+    const user = req.user;
+    return user?.activeOrganizationId || user?.active_organization_id || user?.organizationId || null;
+}
+function paramStr(value) {
+    return Array.isArray(value) ? value[0] : value || '';
+}
+export function addMcpAuthRoutes(router, config) {
+    const { tokenPrefix, frontendApprovalPath = '/app/settings/api-tokens', defaultDeviceName = 'Claude Code', expirySeconds = 300, } = config;
+    const frontendUrl = config.frontendUrl || process.env.FRONTEND_URL || 'http://localhost:3000';
+    const db = systemDB('mcp-auth');
+    // POST /request — Create pending auth request
+    router.post('/request', (req, res) => {
+        const { device_name } = req.body || {};
+        const requestId = randomUUID();
+        pendingRequests.set(requestId, {
+            requestId,
+            deviceName: device_name || defaultDeviceName,
+            createdAt: Date.now(),
+        });
+        res.json({
+            request_id: requestId,
+            login_url: `${frontendUrl}${frontendApprovalPath}?mcp_auth=${requestId}`,
+            expires_in: expirySeconds,
+        });
+    });
+    // GET /status/:requestId — Check if request is valid (for frontend)
+    router.get('/status/:requestId', (req, res) => {
+        const requestId = paramStr(req.params.requestId);
+        const pending = pendingRequests.get(requestId);
+        if (!pending) {
+            res.status(404).json({ error: 'Auth request not found or expired' });
+            return;
+        }
+        const expiryMs = expirySeconds * 1000;
+        res.json({
+            status: pending.approved ? 'approved' : 'pending',
+            device_name: pending.deviceName,
+            expires_in: Math.max(0, Math.ceil((pending.createdAt + expiryMs - Date.now()) / 1000)),
+        });
+    });
+    // POST /approve/:requestId — Approve and generate token (requires JWT)
+    router.post('/approve/:requestId', authenticateToken, async (req, res) => {
+        try {
+            const requestId = paramStr(req.params.requestId);
+            const user = req.user;
+            const pending = pendingRequests.get(requestId);
+            if (!pending) {
+                res.status(404).json({ error: 'Auth request not found or expired' });
+                return;
+            }
+            if (pending.approved) {
+                res.status(409).json({ error: 'Already approved' });
+                return;
+            }
+            const organizationId = getOrgId(req);
+            if (!organizationId) {
+                res.status(400).json({ error: 'No active organization' });
+                return;
+            }
+            // Generate API token
+            const tokenName = `${pending.deviceName} (${new Date().toISOString().slice(0, 10)})`;
+            const token = await generateMcpApiToken(organizationId, tokenName, tokenPrefix, user.id);
+            // Get org name for display
+            const { data: org } = await db
+                .from('organizations')
+                .select('name')
+                .eq('id', organizationId)
+                .single();
+            pending.apiToken = token;
+            pending.organizationName = org?.name || 'Unknown';
+            pending.approved = true;
+            res.json({ success: true, organization: org?.name });
+        }
+        catch (err) {
+            res.status(500).json({ error: 'Internal server error' });
+        }
+    });
+    // GET /poll/:requestId — Poll for token (MCP client side)
+    router.get('/poll/:requestId', (req, res) => {
+        const requestId = paramStr(req.params.requestId);
+        const pending = pendingRequests.get(requestId);
+        if (!pending) {
+            res.status(404).json({ error: 'Auth request not found or expired' });
+            return;
+        }
+        if (!pending.approved) {
+            res.json({ status: 'pending' });
+            return;
+        }
+        // Return token and clean up (one-time retrieval)
+        const result = {
+            status: 'approved',
+            api_token: pending.apiToken,
+            organization: pending.organizationName,
+        };
+        pendingRequests.delete(requestId);
+        res.json(result);
+    });
+}
+//# sourceMappingURL=mcp-auth-routes.js.map

package/dist/shared/mcp/mcp-auth-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth-routes.js","sourceRoot":"","sources":["../../../src/shared/mcp/mcp-auth-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAY1D,uCAAuC;AACvC,MAAM,eAAe,GAAG,IAAI,GAAG,EAA8B,CAAC;AAE9D,4BAA4B;AAC5B,WAAW,CAAC,GAAG,EAAE;IACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,eAAe,EAAE,CAAC;QACxC,IAAI,GAAG,GAAG,GAAG,CAAC,SAAS,GAAG,OAAO,EAAE,CAAC,CAAC,mBAAmB;YACtD,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;AACH,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;AAEnB,SAAS,QAAQ,CAAC,GAAY;IAC5B,MAAM,IAAI,GAAI,GAAW,CAAC,IAAI,CAAC;IAC/B,OAAO,IAAI,EAAE,oBAAoB,IAAI,IAAI,EAAE,sBAAsB,IAAI,IAAI,EAAE,cAAc,IAAI,IAAI,CAAC;AACpG,CAAC;AAED,SAAS,QAAQ,CAAC,KAAoC;IACpD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAA2B;IAC1E,MAAM,EACJ,WAAW,EACX,oBAAoB,GAAG,0BAA0B,EACjD,iBAAiB,GAAG,aAAa,EACjC,aAAa,GAAG,GAAG,GACpB,GAAG,MAAM,CAAC;IAEX,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,uBAAuB,CAAC;IAC9F,MAAM,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEhC,8CAA8C;IAC9C,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACtD,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAE/B,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE;YAC7B,SAAS;YACT,UAAU,EAAE,WAAW,IAAI,iBAAiB;YAC5C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC;YACP,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,GAAG,WAAW,GAAG,oBAAoB,aAAa,SAAS,EAAE;YACxE,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/D,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,aAAa,GAAG,IAAI,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACjD,WAAW,EAAE,OAAO,CAAC,UAAU;YAC/B,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;SACvF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACpC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,IAAI,GAAI,GAAW,CAAC,IAAI,CAAC;YAE/B,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YAED,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YAED,qBAAqB;YACrB,MAAM,SAAS,GAAG,GAAG,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;YACrF,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAEzF,2BAA2B;YAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE;iBAC3B,IAAI,CAAC,eAAe,CAAC;iBACrB,MAAM,CAAC,MAAM,CAAC;iBACd,EAAE,CAAC,IAAI,EAAE,cAAc,CAAC;iBACxB,MAAM,EAAE,CAAC;YAEZ,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;YACzB,OAAO,CAAC,gBAAgB,GAAG,GAAG,EAAE,IAAI,IAAI,SAAS,CAAC;YAClD,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YAExB,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CACF,CAAC;IAEF,0DAA0D;IAC1D,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QAED,iDAAiD;QACjD,MAAM,MAAM,GAAG;YACb,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,YAAY,EAAE,OAAO,CAAC,gBAAgB;SACvC,CAAC;QAEF,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/shared/mcp/mcp-routes.d.ts

@@ -0,0 +1,29 @@
+/**
+ * MCP StreamableHTTP Routes — Factory
+ *
+ * Creates an Express router that exposes MCP tools over HTTP
+ * with Bearer token authentication, rate limiting, and audit logging.
+ *
+ * Usage:
+ * ```typescript
+ * import { addMcpRoutes } from '@soulbatical/tetra-core';
+ *
+ * const mcpRouter = Router();
+ * addMcpRoutes(mcpRouter, {
+ *   tools: myToolDefinitions,
+ *   handlers: myToolHandlers,
+ *   tokenPrefix: 'vincifox_',
+ * });
+ * app.use('/api/mcp', mcpRouter);
+ * ```
+ */
+import type { Router } from 'express';
+import type { McpRoutesConfig } from './types.js';
+/**
+ * Add MCP StreamableHTTP routes to a router.
+ *
+ * The router handles POST (JSON-RPC requests), GET (SSE), and DELETE (cleanup).
+ * Authentication is via Bearer token in the Authorization header.
+ */
+export declare function addMcpRoutes(router: Router, config: McpRoutesConfig): void;
+//# sourceMappingURL=mcp-routes.d.ts.map

package/dist/shared/mcp/mcp-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-routes.d.ts","sourceRoot":"","sources":["../../../src/shared/mcp/mcp-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AAIzD,OAAO,KAAK,EAAE,eAAe,EAAiB,MAAM,YAAY,CAAC;AA8CjE;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAuI1E"}

package/dist/shared/mcp/mcp-routes.js

@@ -0,0 +1,168 @@
+/**
+ * MCP StreamableHTTP Routes — Factory
+ *
+ * Creates an Express router that exposes MCP tools over HTTP
+ * with Bearer token authentication, rate limiting, and audit logging.
+ *
+ * Usage:
+ * ```typescript
+ * import { addMcpRoutes } from '@soulbatical/tetra-core';
+ *
+ * const mcpRouter = Router();
+ * addMcpRoutes(mcpRouter, {
+ *   tools: myToolDefinitions,
+ *   handlers: myToolHandlers,
+ *   tokenPrefix: 'vincifox_',
+ * });
+ * app.use('/api/mcp', mcpRouter);
+ * ```
+ */
+import { createLogger } from '../../utils/logger.js';
+import { systemDB } from '../../core/systemDb.js';
+import { validateMcpApiToken, runWithMcpTenant } from './tenant-context.js';
+const logger = createLogger('mcp:routes');
+const rateBuckets = new Map();
+// Clean up expired buckets every 5 min
+setInterval(() => {
+    const now = Date.now();
+    for (const [key, bucket] of rateBuckets) {
+        if (now > bucket.resetAt) {
+            rateBuckets.delete(key);
+        }
+    }
+}, 5 * 60 * 1000).unref();
+function checkRateLimit(tokenId, max, windowMs) {
+    const now = Date.now();
+    let bucket = rateBuckets.get(tokenId);
+    if (!bucket || now > bucket.resetAt) {
+        bucket = { count: 0, resetAt: now + windowMs };
+        rateBuckets.set(tokenId, bucket);
+    }
+    bucket.count++;
+    const remaining = Math.max(0, max - bucket.count);
+    return {
+        allowed: bucket.count <= max,
+        remaining,
+        resetAt: bucket.resetAt,
+    };
+}
+/**
+ * Add MCP StreamableHTTP routes to a router.
+ *
+ * The router handles POST (JSON-RPC requests), GET (SSE), and DELETE (cleanup).
+ * Authentication is via Bearer token in the Authorization header.
+ */
+export function addMcpRoutes(router, config) {
+    const { tools, handlers, tokenPrefix, rateLimitMax = 100, rateLimitWindowMs = 15 * 60 * 1000, enableAuditLog = true, } = config;
+    const db = enableAuditLog ? systemDB('mcp-audit') : null;
+    // Audit logging (fire-and-forget)
+    function logToolCall(tokenId, organizationId, toolName) {
+        if (!db)
+            return;
+        db.from('mcp_audit_log')
+            .insert({ token_id: tokenId, organization_id: organizationId, tool_name: toolName })
+            .then(() => { });
+    }
+    // Auth helper
+    async function authenticateRequest(req, res) {
+        const authHeader = req.headers.authorization;
+        if (!authHeader || !authHeader.startsWith('Bearer ')) {
+            res.status(401).json({ error: 'Missing or invalid Authorization header' });
+            return null;
+        }
+        const token = authHeader.substring(7);
+        try {
+            return await validateMcpApiToken(token, tokenPrefix);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Authentication failed';
+            res.status(401).json({ error: message });
+            return null;
+        }
+    }
+    // Lazy import MCP SDK (peer dependency)
+    let mcpSdkLoaded = false;
+    let Server;
+    let StreamableHTTPServerTransport;
+    let CallToolRequestSchema;
+    let ListToolsRequestSchema;
+    async function ensureMcpSdk() {
+        if (mcpSdkLoaded)
+            return;
+        const serverMod = await import('@modelcontextprotocol/sdk/server/index.js');
+        const transportMod = await import('@modelcontextprotocol/sdk/server/streamableHttp.js');
+        const typesMod = await import('@modelcontextprotocol/sdk/types.js');
+        Server = serverMod.Server;
+        StreamableHTTPServerTransport = transportMod.StreamableHTTPServerTransport;
+        CallToolRequestSchema = typesMod.CallToolRequestSchema;
+        ListToolsRequestSchema = typesMod.ListToolsRequestSchema;
+        mcpSdkLoaded = true;
+    }
+    // Create MCP server instance
+    function createMcpServer(tenant) {
+        const server = new Server({ name: 'tetra-mcp', version: '1.0.0' }, { capabilities: { tools: {} } });
+        server.setRequestHandler(ListToolsRequestSchema, async () => ({
+            tools,
+        }));
+        server.setRequestHandler(CallToolRequestSchema, async (request) => {
+            const { name, arguments: args = {} } = request.params;
+            const handler = handlers[name];
+            if (!handler) {
+                throw new Error(`Unknown tool: ${name}`);
+            }
+            logToolCall(tenant.tokenId, tenant.organizationId, name);
+            return handler(args);
+        });
+        return server;
+    }
+    // Main endpoint
+    router.all('/', async (req, res) => {
+        const tenant = await authenticateRequest(req, res);
+        if (!tenant)
+            return;
+        // Rate limit
+        const rateResult = checkRateLimit(tenant.tokenId, rateLimitMax, rateLimitWindowMs);
+        res.setHeader('X-RateLimit-Limit', rateLimitMax);
+        res.setHeader('X-RateLimit-Remaining', rateResult.remaining);
+        res.setHeader('X-RateLimit-Reset', Math.ceil(rateResult.resetAt / 1000));
+        if (!rateResult.allowed) {
+            res.status(429).json({
+                error: 'Rate limit exceeded',
+                retry_after: Math.ceil((rateResult.resetAt - Date.now()) / 1000),
+            });
+            return;
+        }
+        // Lazy-load MCP SDK
+        try {
+            await ensureMcpSdk();
+        }
+        catch (err) {
+            logger.error({ err }, 'Failed to load @modelcontextprotocol/sdk — is it installed?');
+            res.status(500).json({ error: 'MCP SDK not available' });
+            return;
+        }
+        const transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: undefined,
+        });
+        const server = createMcpServer(tenant);
+        try {
+            await server.connect(transport);
+            await runWithMcpTenant(tenant, async () => {
+                await transport.handleRequest(req, res, req.body);
+            });
+        }
+        catch (error) {
+            if (!res.headersSent) {
+                res.status(500).json({
+                    error: 'MCP request failed',
+                    details: error instanceof Error ? error.message : 'Unknown error',
+                });
+            }
+        }
+        finally {
+            await transport.close().catch(() => { });
+            await server.close().catch(() => { });
+        }
+    });
+}
+//# sourceMappingURL=mcp-routes.js.map

package/dist/shared/mcp/mcp-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-routes.js","sourceRoot":"","sources":["../../../src/shared/mcp/mcp-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG5E,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;AAS1C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAC;AAElD,uCAAuC;AACvC,WAAW,CAAC,GAAG,EAAE;IACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QACxC,IAAI,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;AACH,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AAE1B,SAAS,cAAc,CACrB,OAAe,EACf,GAAW,EACX,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEtC,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC;QAC/C,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAElD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,GAAG;QAC5B,SAAS;QACT,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,MAAuB;IAClE,MAAM,EACJ,KAAK,EACL,QAAQ,EACR,WAAW,EACX,YAAY,GAAG,GAAG,EAClB,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAClC,cAAc,GAAG,IAAI,GACtB,GAAG,MAAM,CAAC;IAEX,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEzD,kCAAkC;IAClC,SAAS,WAAW,CAAC,OAAe,EAAE,cAAsB,EAAE,QAAgB;QAC5E,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aACnF,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,cAAc;IACd,KAAK,UAAU,mBAAmB,CAChC,GAAY,EACZ,GAAa;QAEb,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;YACjF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,MAAW,CAAC;IAChB,IAAI,6BAAkC,CAAC;IACvC,IAAI,qBAA0B,CAAC;IAC/B,IAAI,sBAA2B,CAAC;IAEhC,KAAK,UAAU,YAAY;QACzB,IAAI,YAAY;YAAE,OAAO;QACzB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,2CAA2C,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,oDAAoD,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAC;QACpE,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAC1B,6BAA6B,GAAG,YAAY,CAAC,6BAA6B,CAAC;QAC3E,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC;QACvD,sBAAsB,GAAG,QAAQ,CAAC,sBAAsB,CAAC;QACzD,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,6BAA6B;IAC7B,SAAS,eAAe,CAAC,MAAqB;QAC5C,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EACvC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;QAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5D,KAAK;SACN,CAAC,CAAC,CAAC;QAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;YACrE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YACtD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;YAC3C,CAAC;YACD,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;YACzD,OAAO,OAAO,CAAC,IAA+B,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,gBAAgB;IAChB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACpD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,aAAa;QACb,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;QACnF,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;QACjD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QAC7D,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;QAEzE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,qBAAqB;gBAC5B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;aACjE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,oBAAoB;QACpB,IAAI,CAAC;YACH,MAAM,YAAY,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,6DAA6D,CAAC,CAAC;YACrF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;SAC9B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAEvC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,gBAAgB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;gBACxC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,oBAAoB;oBAC3B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;iBAClE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACxC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/shared/mcp/mcp-tokens-routes.d.ts

@@ -0,0 +1,21 @@
+/**
+ * MCP Token Management Routes — Factory
+ *
+ * CRUD for API tokens. All endpoints require authenticated user (Supabase JWT).
+ * Tokens are scoped to the user's active organization.
+ *
+ * Usage:
+ * ```typescript
+ * import { addMcpTokenRoutes } from '@soulbatical/tetra-core';
+ *
+ * const mcpTokensRouter = Router();
+ * addMcpTokenRoutes(mcpTokensRouter, { tokenPrefix: 'vincifox_' });
+ * app.use('/api/mcp-tokens', mcpTokensRouter);
+ * ```
+ */
+import type { Router } from 'express';
+export interface McpTokenRoutesConfig {
+    tokenPrefix: string;
+}
+export declare function addMcpTokenRoutes(router: Router, config: McpTokenRoutesConfig): void;
+//# sourceMappingURL=mcp-tokens-routes.d.ts.map

package/dist/shared/mcp/mcp-tokens-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-tokens-routes.d.ts","sourceRoot":"","sources":["../../../src/shared/mcp/mcp-tokens-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AAKzD,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;CACrB;AAOD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAqEpF"}

package/dist/shared/mcp/mcp-tokens-routes.js

@@ -0,0 +1,82 @@
+/**
+ * MCP Token Management Routes — Factory
+ *
+ * CRUD for API tokens. All endpoints require authenticated user (Supabase JWT).
+ * Tokens are scoped to the user's active organization.
+ *
+ * Usage:
+ * ```typescript
+ * import { addMcpTokenRoutes } from '@soulbatical/tetra-core';
+ *
+ * const mcpTokensRouter = Router();
+ * addMcpTokenRoutes(mcpTokensRouter, { tokenPrefix: 'vincifox_' });
+ * app.use('/api/mcp-tokens', mcpTokensRouter);
+ * ```
+ */
+import { authenticateToken } from '../../middleware/authMiddleware.js';
+import { systemDB } from '../../core/systemDb.js';
+import { generateMcpApiToken } from './tenant-context.js';
+function getOrgId(req) {
+    const user = req.user;
+    return user?.activeOrganizationId || user?.active_organization_id || user?.organizationId || null;
+}
+export function addMcpTokenRoutes(router, config) {
+    const { tokenPrefix } = config;
+    const db = systemDB('mcp-tokens');
+    // GET / — List all tokens for the active organization
+    router.get('/', authenticateToken, async (req, res) => {
+        const orgId = getOrgId(req);
+        if (!orgId) {
+            res.status(400).json({ error: 'No active organization' });
+            return;
+        }
+        const { data, error } = await db
+            .from('mcp_api_tokens')
+            .select('id, name, is_active, last_used_at, created_at, revoked_at, created_by')
+            .eq('organization_id', orgId)
+            .order('created_at', { ascending: false });
+        if (error) {
+            res.status(500).json({ error: 'Failed to list tokens' });
+            return;
+        }
+        res.json({ tokens: data || [] });
+    });
+    // POST / — Generate a new API token
+    router.post('/', authenticateToken, async (req, res) => {
+        const orgId = getOrgId(req);
+        const user = req.user;
+        if (!orgId) {
+            res.status(400).json({ error: 'No active organization' });
+            return;
+        }
+        const { name } = req.body || {};
+        const tokenName = name || `API Token (${new Date().toISOString().slice(0, 10)})`;
+        try {
+            const token = await generateMcpApiToken(orgId, tokenName, tokenPrefix, user.id);
+            res.json({ token, name: tokenName });
+        }
+        catch (err) {
+            res.status(500).json({ error: 'Failed to generate token' });
+        }
+    });
+    // DELETE /:tokenId — Revoke a token
+    router.delete('/:tokenId', authenticateToken, async (req, res) => {
+        const orgId = getOrgId(req);
+        if (!orgId) {
+            res.status(400).json({ error: 'No active organization' });
+            return;
+        }
+        const tokenId = Array.isArray(req.params.tokenId) ? req.params.tokenId[0] : req.params.tokenId;
+        const { error } = await db
+            .from('mcp_api_tokens')
+            .update({ is_active: false, revoked_at: new Date().toISOString() })
+            .eq('id', tokenId)
+            .eq('organization_id', orgId);
+        if (error) {
+            res.status(500).json({ error: 'Failed to revoke token' });
+            return;
+        }
+        res.json({ success: true });
+    });
+}
+//# sourceMappingURL=mcp-tokens-routes.js.map

package/dist/shared/mcp/mcp-tokens-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-tokens-routes.js","sourceRoot":"","sources":["../../../src/shared/mcp/mcp-tokens-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAM1D,SAAS,QAAQ,CAAC,GAAY;IAC5B,MAAM,IAAI,GAAI,GAAW,CAAC,IAAI,CAAC;IAC/B,OAAO,IAAI,EAAE,oBAAoB,IAAI,IAAI,EAAE,sBAAsB,IAAI,IAAI,EAAE,cAAc,IAAI,IAAI,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAA4B;IAC5E,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IAElC,sDAAsD;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACvE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE;aAC7B,IAAI,CAAC,gBAAgB,CAAC;aACtB,MAAM,CAAC,uEAAuE,CAAC;aAC/E,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC;aAC5B,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAE7C,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,oCAAoC;IACpC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAI,GAAW,CAAC,IAAI,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,IAAI,cAAc,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;QAEjF,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAChF,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,oCAAoC;IACpC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAClF,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;QAE/F,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE;aACvB,IAAI,CAAC,gBAAgB,CAAC;aACtB,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;aAClE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC;aACjB,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAEhC,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/shared/mcp/mcp-usage-routes.d.ts

@@ -0,0 +1,17 @@
+/**
+ * MCP Usage Routes — Factory
+ *
+ * Returns audit log stats for the active organization.
+ *
+ * Usage:
+ * ```typescript
+ * import { addMcpUsageRoutes } from '@soulbatical/tetra-core';
+ *
+ * const mcpUsageRouter = Router();
+ * addMcpUsageRoutes(mcpUsageRouter);
+ * app.use('/api/mcp-usage', mcpUsageRouter);
+ * ```
+ */
+import type { Router } from 'express';
+export declare function addMcpUsageRoutes(router: Router): void;
+//# sourceMappingURL=mcp-usage-routes.d.ts.map

package/dist/shared/mcp/mcp-usage-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-usage-routes.d.ts","sourceRoot":"","sources":["../../../src/shared/mcp/mcp-usage-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AASzD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CA8DtD"}

package/dist/shared/mcp/mcp-usage-routes.js

@@ -0,0 +1,78 @@
+/**
+ * MCP Usage Routes — Factory
+ *
+ * Returns audit log stats for the active organization.
+ *
+ * Usage:
+ * ```typescript
+ * import { addMcpUsageRoutes } from '@soulbatical/tetra-core';
+ *
+ * const mcpUsageRouter = Router();
+ * addMcpUsageRoutes(mcpUsageRouter);
+ * app.use('/api/mcp-usage', mcpUsageRouter);
+ * ```
+ */
+import { authenticateToken } from '../../middleware/authMiddleware.js';
+import { systemDB } from '../../core/systemDb.js';
+function getOrgId(req) {
+    const user = req.user;
+    return user?.activeOrganizationId || user?.active_organization_id || user?.organizationId || null;
+}
+export function addMcpUsageRoutes(router) {
+    const db = systemDB('mcp-usage');
+    // GET / — Usage stats (total calls, by tool, daily trend)
+    // Query: ?period=7d|30d|90d
+    router.get('/', authenticateToken, async (req, res) => {
+        const orgId = getOrgId(req);
+        if (!orgId) {
+            res.status(400).json({ error: 'No active organization' });
+            return;
+        }
+        const period = req.query.period || '30d';
+        const days = period === '7d' ? 7 : period === '90d' ? 90 : 30;
+        const since = new Date();
+        since.setDate(since.getDate() - days);
+        try {
+            const { count: totalCalls } = await db
+                .from('mcp_audit_log')
+                .select('id', { count: 'exact', head: true })
+                .eq('organization_id', orgId)
+                .gte('created_at', since.toISOString());
+            const { data: logs } = await db
+                .from('mcp_audit_log')
+                .select('tool_name, created_at')
+                .eq('organization_id', orgId)
+                .gte('created_at', since.toISOString())
+                .order('created_at', { ascending: true });
+            // Aggregate
+            const byTool = {};
+            const byDay = {};
+            for (const log of logs || []) {
+                byTool[log.tool_name] = (byTool[log.tool_name] || 0) + 1;
+                const day = log.created_at.slice(0, 10);
+                byDay[day] = (byDay[day] || 0) + 1;
+            }
+            // Fill day gaps
+            const trend = [];
+            const current = new Date(since);
+            const now = new Date();
+            while (current <= now) {
+                const day = current.toISOString().slice(0, 10);
+                trend.push({ date: day, count: byDay[day] || 0 });
+                current.setDate(current.getDate() + 1);
+            }
+            res.json({
+                period,
+                total_calls: totalCalls || 0,
+                by_tool: Object.entries(byTool)
+                    .map(([tool, count]) => ({ tool, count }))
+                    .sort((a, b) => b.count - a.count),
+                trend,
+            });
+        }
+        catch (err) {
+            res.status(500).json({ error: 'Failed to load usage stats' });
+        }
+    });
+}
+//# sourceMappingURL=mcp-usage-routes.js.map

package/dist/shared/mcp/mcp-usage-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-usage-routes.js","sourceRoot":"","sources":["../../../src/shared/mcp/mcp-usage-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD,SAAS,QAAQ,CAAC,GAAY;IAC5B,MAAM,IAAI,GAAI,GAAW,CAAC,IAAI,CAAC;IAC/B,OAAO,IAAI,EAAE,oBAAoB,IAAI,IAAI,EAAE,sBAAsB,IAAI,IAAI,EAAE,cAAc,IAAI,IAAI,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEjC,0DAA0D;IAC1D,4BAA4B;IAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACvE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAI,GAAG,CAAC,KAAK,CAAC,MAAiB,IAAI,KAAK,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE;iBACnC,IAAI,CAAC,eAAe,CAAC;iBACrB,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;iBAC5C,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC;iBAC5B,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YAE1C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE;iBAC5B,IAAI,CAAC,eAAe,CAAC;iBACrB,MAAM,CAAC,uBAAuB,CAAC;iBAC/B,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC;iBAC5B,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;iBACtC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE5C,YAAY;YACZ,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,MAAM,KAAK,GAA2B,EAAE,CAAC;YACzC,KAAK,MAAM,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC7B,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBACzD,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YAED,gBAAgB;YAChB,MAAM,KAAK,GAAsC,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,OAAO,OAAO,IAAI,GAAG,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YACzC,CAAC;YAED,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM;gBACN,WAAW,EAAE,UAAU,IAAI,CAAC;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;qBAC5B,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;qBACzC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;gBACpC,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/shared/mcp/tenant-context.d.ts

@@ -0,0 +1,44 @@
+/**
+ * MCP Tenant Context
+ *
+ * Provides:
+ * - Token validation (Bearer token → organization_id)
+ * - Request-scoped tenant context via AsyncLocalStorage
+ * - Token generation for admin use
+ *
+ * Works with any project that has the mcp_api_tokens table.
+ */
+import type { TenantContext } from './types.js';
+/**
+ * Get the current tenant's organization_id.
+ * Returns undefined when running in local stdio mode (no tenant context).
+ */
+export declare function getMcpOrganizationId(): string | undefined;
+/**
+ * Get the full tenant context (org + token).
+ */
+export declare function getMcpTenantContext(): TenantContext | undefined;
+/**
+ * Run a function within a tenant context.
+ * The context is propagated through async calls via AsyncLocalStorage.
+ */
+export declare function runWithMcpTenant<T>(ctx: TenantContext, fn: () => T): T;
+/**
+ * Validate a Bearer token and return the tenant context.
+ * Throws if token is invalid, revoked, or inactive.
+ *
+ * @param token - The raw API token (e.g. "vincifox_abc123...")
+ * @param expectedPrefix - Expected token prefix (e.g. "vincifox_")
+ */
+export declare function validateMcpApiToken(token: string, expectedPrefix: string): Promise<TenantContext>;
+/**
+ * Generate a new API token for an organization.
+ * Returns the plaintext token (only shown once — stored as SHA-256 hash).
+ *
+ * @param organizationId - The organization UUID
+ * @param name - Human-readable token name
+ * @param prefix - Token prefix (e.g. "vincifox_")
+ * @param createdBy - Optional user UUID who created the token
+ */
+export declare function generateMcpApiToken(organizationId: string, name: string, prefix: string, createdBy?: string): Promise<string>;
+//# sourceMappingURL=tenant-context.d.ts.map

package/dist/shared/mcp/tenant-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-context.d.ts","sourceRoot":"","sources":["../../../src/shared/mcp/tenant-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAMhD;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAEzD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,aAAa,GAAG,SAAS,CAE/D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAEtE;AA4BD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,aAAa,CAAC,CAiCxB;AAID;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAkBjB"}

package/dist/shared/mcp/tenant-context.js

@@ -0,0 +1,117 @@
+/**
+ * MCP Tenant Context
+ *
+ * Provides:
+ * - Token validation (Bearer token → organization_id)
+ * - Request-scoped tenant context via AsyncLocalStorage
+ * - Token generation for admin use
+ *
+ * Works with any project that has the mcp_api_tokens table.
+ */
+import { createHash, randomBytes } from 'node:crypto';
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { createClient } from '@supabase/supabase-js';
+// ── AsyncLocalStorage for request-scoped context ──
+const tenantStorage = new AsyncLocalStorage();
+/**
+ * Get the current tenant's organization_id.
+ * Returns undefined when running in local stdio mode (no tenant context).
+ */
+export function getMcpOrganizationId() {
+    return tenantStorage.getStore()?.organizationId;
+}
+/**
+ * Get the full tenant context (org + token).
+ */
+export function getMcpTenantContext() {
+    return tenantStorage.getStore();
+}
+/**
+ * Run a function within a tenant context.
+ * The context is propagated through async calls via AsyncLocalStorage.
+ */
+export function runWithMcpTenant(ctx, fn) {
+    return tenantStorage.run(ctx, fn);
+}
+// ── DB client ──
+let db = null;
+function getDb() {
+    if (!db) {
+        const url = process.env.SUPABASE_URL;
+        const key = process.env.SUPABASE_SERVICE_ROLE_KEY;
+        if (!url || !key) {
+            throw new Error('SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY required for MCP tenant auth');
+        }
+        db = createClient(url, key, {
+            auth: { autoRefreshToken: false, persistSession: false },
+        });
+    }
+    return db;
+}
+// ── Token hashing ──
+function hashToken(token) {
+    return createHash('sha256').update(token).digest('hex');
+}
+// ── Token validation ──
+/**
+ * Validate a Bearer token and return the tenant context.
+ * Throws if token is invalid, revoked, or inactive.
+ *
+ * @param token - The raw API token (e.g. "vincifox_abc123...")
+ * @param expectedPrefix - Expected token prefix (e.g. "vincifox_")
+ */
+export async function validateMcpApiToken(token, expectedPrefix) {
+    if (!token.startsWith(expectedPrefix)) {
+        throw new Error('Invalid token format');
+    }
+    const hash = hashToken(token);
+    const supabase = getDb();
+    const { data, error } = await supabase
+        .from('mcp_api_tokens')
+        .select('id, organization_id, is_active, revoked_at')
+        .eq('token_hash', hash)
+        .single();
+    if (error || !data) {
+        throw new Error('Invalid API token');
+    }
+    if (!data.is_active || data.revoked_at) {
+        throw new Error('Token has been revoked');
+    }
+    // Update last_used_at (fire and forget)
+    supabase
+        .from('mcp_api_tokens')
+        .update({ last_used_at: new Date().toISOString() })
+        .eq('id', data.id)
+        .then(() => { });
+    return {
+        organizationId: data.organization_id,
+        tokenId: data.id,
+    };
+}
+// ── Token generation ──
+/**
+ * Generate a new API token for an organization.
+ * Returns the plaintext token (only shown once — stored as SHA-256 hash).
+ *
+ * @param organizationId - The organization UUID
+ * @param name - Human-readable token name
+ * @param prefix - Token prefix (e.g. "vincifox_")
+ * @param createdBy - Optional user UUID who created the token
+ */
+export async function generateMcpApiToken(organizationId, name, prefix, createdBy) {
+    const hex = randomBytes(32).toString('hex');
+    const token = `${prefix}${hex}`;
+    const hash = hashToken(token);
+    const supabase = getDb();
+    const { error } = await supabase.from('mcp_api_tokens').insert({
+        organization_id: organizationId,
+        token_hash: hash,
+        name,
+        created_by: createdBy || null,
+    });
+    if (error) {
+        throw new Error(`Failed to create token: ${error.message}`);
+    }
+    return token;
+}
+//# sourceMappingURL=tenant-context.js.map

package/dist/shared/mcp/tenant-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-context.js","sourceRoot":"","sources":["../../../src/shared/mcp/tenant-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAuB,MAAM,uBAAuB,CAAC;AAG1E,qDAAqD;AAErD,MAAM,aAAa,GAAG,IAAI,iBAAiB,EAAiB,CAAC;AAE7D;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,aAAa,CAAC,QAAQ,EAAE,EAAE,cAAc,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,aAAa,CAAC,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAI,GAAkB,EAAE,EAAW;IACjE,OAAO,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,kBAAkB;AAElB,IAAI,EAAE,GAA0B,IAAI,CAAC;AAErC,SAAS,KAAK;IACZ,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QAClD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC7F,CAAC;QACD,EAAE,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;YAC1B,IAAI,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE;SACzD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,sBAAsB;AAEtB,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,yBAAyB;AAEzB;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAa,EACb,cAAsB;IAEtB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC;IAEzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ;SACnC,IAAI,CAAC,gBAAgB,CAAC;SACtB,MAAM,CAAC,4CAA4C,CAAC;SACpD,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC;SACtB,MAAM,EAAE,CAAC;IAEZ,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,wCAAwC;IACxC,QAAQ;SACL,IAAI,CAAC,gBAAgB,CAAC;SACtB,MAAM,CAAC,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;SAClD,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;SACjB,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAElB,OAAO;QACL,cAAc,EAAE,IAAI,CAAC,eAAe;QACpC,OAAO,EAAE,IAAI,CAAC,EAAE;KACjB,CAAC;AACJ,CAAC;AAED,yBAAyB;AAEzB;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,cAAsB,EACtB,IAAY,EACZ,MAAc,EACd,SAAkB;IAElB,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAE9B,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC;IACzB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC;QAC7D,eAAe,EAAE,cAAc;QAC/B,UAAU,EAAE,IAAI;QAChB,IAAI;QACJ,UAAU,EAAE,SAAS,IAAI,IAAI;KAC9B,CAAC,CAAC;IAEH,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/shared/mcp/types.d.ts

@@ -0,0 +1,58 @@
+/**
+ * MCP Online Module — Types
+ *
+ * Shared types for MCP StreamableHTTP endpoints.
+ */
+export interface McpToolDefinition {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: 'object';
+        properties?: Record<string, unknown>;
+        required?: string[];
+    };
+}
+export interface McpToolResult {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    isError?: boolean;
+    [key: string]: unknown;
+}
+export type McpToolHandler = (args: Record<string, unknown>) => Promise<McpToolResult>;
+export interface TenantContext {
+    organizationId: string;
+    tokenId: string;
+}
+export interface McpRoutesConfig {
+    /** Tool definitions to expose via the MCP endpoint */
+    tools: McpToolDefinition[];
+    /** Map of tool name → handler function */
+    handlers: Record<string, McpToolHandler>;
+    /** Token prefix for validation, e.g. "vincifox_" or "snelstart_" */
+    tokenPrefix: string;
+    /** Rate limit: max requests per window (default: 100) */
+    rateLimitMax?: number;
+    /** Rate limit: window in ms (default: 15 minutes) */
+    rateLimitWindowMs?: number;
+    /** Enable audit logging to mcp_audit_log table (default: true) */
+    enableAuditLog?: boolean;
+}
+export interface McpAuthRoutesConfig {
+    /** Token prefix for generated tokens, e.g. "vincifox_" */
+    tokenPrefix: string;
+    /** Frontend URL for login redirect (falls back to FRONTEND_URL env or localhost:3000) */
+    frontendUrl?: string;
+    /** Path on the frontend where the approval page lives (default: "/app/settings/api-tokens") */
+    frontendApprovalPath?: string;
+    /** Default device name when not provided (default: "Claude Code") */
+    defaultDeviceName?: string;
+    /** Request expiry in seconds (default: 300 = 5 minutes) */
+    expirySeconds?: number;
+}
+export interface McpTokenRoutesConfig {
+}
+export interface McpUsageRoutesConfig {
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/shared/mcp/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/shared/mcp/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAIvF,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,MAAM,WAAW,eAAe;IAC9B,sDAAsD;IACtD,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzC,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+FAA+F;IAC/F,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;CAEpC;AAED,MAAM,WAAW,oBAAoB;CAEpC"}

package/dist/shared/mcp/types.js

@@ -0,0 +1,7 @@
+/**
+ * MCP Online Module — Types
+ *
+ * Shared types for MCP StreamableHTTP endpoints.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/shared/mcp/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/shared/mcp/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soulbatical/tetra-core",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "publishConfig": {
     "access": "restricted"
   },
@@ -30,7 +30,8 @@
     "scripts",
     "src/shared/auth/migrations",
     "src/shared/affiliate/migrations",
-    "src/shared/email/migrations"
+    "src/shared/email/migrations",
+    "src/shared/mcp/migrations"
   ],
   "scripts": {
     "build": "tsc",
@@ -46,6 +47,7 @@
     "zod": "^3.22.4"
   },
   "peerDependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0",
     "@supabase/supabase-js": "2.93.3",
     "@tanstack/react-table": "^8.0.0",
     "express": "^5.0.0",
@@ -61,9 +63,13 @@
     },
     "@tanstack/react-table": {
       "optional": true
+    },
+    "@modelcontextprotocol/sdk": {
+      "optional": true
     }
   },
   "devDependencies": {
+    "@modelcontextprotocol/sdk": "^1.27.1",
     "@supabase/supabase-js": "2.93.3",
     "@tanstack/react-table": "^8.21.3",
     "@types/express": "^5.0.0",

package/src/shared/mcp/migrations/001_mcp_api_tokens.sql

@@ -0,0 +1,21 @@
+-- MCP API tokens for online MCP access
+-- Each token is linked to an organization for multi-tenant isolation
+-- Token is stored as SHA-256 hash, never plaintext
+
+CREATE TABLE IF NOT EXISTS public.mcp_api_tokens (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  organization_id UUID NOT NULL REFERENCES organizations(id),
+  token_hash TEXT NOT NULL UNIQUE,
+  name TEXT NOT NULL DEFAULT 'Default',
+  created_by UUID REFERENCES auth.users(id),
+  is_active BOOLEAN NOT NULL DEFAULT true,
+  last_used_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  revoked_at TIMESTAMPTZ
+);
+
+ALTER TABLE public.mcp_api_tokens ENABLE ROW LEVEL SECURITY;
+CREATE POLICY "Service role full access" ON public.mcp_api_tokens
+  FOR ALL TO service_role USING (true) WITH CHECK (true);
+CREATE INDEX IF NOT EXISTS idx_mcp_api_tokens_hash ON public.mcp_api_tokens(token_hash);
+CREATE INDEX IF NOT EXISTS idx_mcp_api_tokens_org ON public.mcp_api_tokens(organization_id);

package/src/shared/mcp/migrations/002_mcp_audit_log.sql

@@ -0,0 +1,16 @@
+-- MCP audit log for tracking tool usage per token/organization
+
+CREATE TABLE IF NOT EXISTS public.mcp_audit_log (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  token_id UUID REFERENCES mcp_api_tokens(id),
+  organization_id UUID NOT NULL REFERENCES organizations(id),
+  tool_name TEXT NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+ALTER TABLE public.mcp_audit_log ENABLE ROW LEVEL SECURITY;
+CREATE POLICY "Service role full access" ON public.mcp_audit_log
+  FOR ALL TO service_role USING (true) WITH CHECK (true);
+CREATE INDEX IF NOT EXISTS idx_mcp_audit_log_org ON public.mcp_audit_log(organization_id);
+CREATE INDEX IF NOT EXISTS idx_mcp_audit_log_token ON public.mcp_audit_log(token_id);
+CREATE INDEX IF NOT EXISTS idx_mcp_audit_log_created ON public.mcp_audit_log(created_at DESC);