@usegraft/mcp 0.1.1 → 1.0.0-beta.0

package/dist/index.js

@@ -2,98 +2,34 @@
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 // src/server.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync2, statSync as statSync2, unlinkSync } from "fs";
-import { existsSync as existsSync2 } from "fs";
-import { join as join2 } from "path";
+import { unlinkSync } from "fs";
+import { createStorage, storageConfigFromEnv } from "@usegraft/assets";
+import { compile, compileStatic, resolveContained as resolveContained4 } from "@usegraft/compiler";
+import { GraftError as GraftError10 } from "@usegraft/contracts";
 import {
-  contentTypeFor,
-  createStorage,
-  defaultKeyFor,
-  storageConfigFromEnv
-} from "@usegraft/assets";
-import {
-  compile,
-  compileStatic,
-  composeDocument,
-  parseDocument as parseDocument2,
-  writeDocumentFile
-} from "@usegraft/compiler";
-import {
-  GraftError as GraftError2
-} from "@usegraft/contracts";
-import {
-  APPROVAL_HEADER,
-  AssetRef,
   createFunctionsHandler,
   defineFunction,
   field
 } from "@usegraft/core";
-import {
-  assertSearchQuery,
-  decideApproval,
-  listBranches,
-  listCompilations,
-  listPendingApprovals,
-  openStaticIndex,
-  resolveBranchScope,
-  scopeChain,
-  searchContent
-} from "@usegraft/db";
-import { describeItem, listItems, loadItem } from "@usegraft/registry";
+import { openStaticIndex, resolveBranchScope, searchContent } from "@usegraft/db";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z } from "zod";
 
-// src/content-files.ts
-import { existsSync, readdirSync, readFileSync, statSync } from "fs";
-import { join, relative, sep } from "path";
-import { parseDocument } from "@usegraft/compiler";
+// src/content-hints.ts
+import { findDoc as findDocIn, requireCollection as requireCollectionIn } from "@usegraft/compiler";
+var MCP_HINTS = {
+  listCollections: "see list_collections",
+  authorDocument: "or author it with write_content."
+};
+var requireCollection = (collections, name) => requireCollectionIn(collections, name, MCP_HINTS);
+var findDoc = (contentDir, collectionName, collection, slug) => findDocIn(contentDir, collectionName, collection, slug, MCP_HINTS);
+
+// src/tools/approvals.ts
+import { GraftError as GraftError2 } from "@usegraft/contracts";
+import { decideApproval, listPendingApprovals } from "@usegraft/db";
+import { z as z2 } from "zod";
+
+// src/tool-result.ts
 import { GraftError } from "@usegraft/contracts";
-function requireCollection(collections, name) {
-  const collection = collections[name];
-  if (!collection) {
-    const known = Object.keys(collections).join(", ") || "(none registered)";
-    throw new GraftError({
-      code: "COLLECTION_NOT_FOUND",
-      message: `No collection named "${name}" is registered`,
-      fix: `Use one of the registered collections: ${known} (see list_collections), or add defineCollection({ name: "${name}", \u2026 }) to the schema.`,
-      details: { collection: name, registered: Object.keys(collections) }
-    });
-  }
-  return collection;
-}
-function readCollectionDocs(contentDir, collectionName, collection) {
-  const dir = join(contentDir, collectionName);
-  if (!existsSync(dir) || !statSync(dir).isDirectory()) return [];
-  const docs = [];
-  for (const file of walk(dir)) {
-    const sourcePath = relative(contentDir, file).split(sep).join("/");
-    docs.push(parseDocument(readFileSync(file, "utf8"), collection, sourcePath));
-  }
-  return docs.sort((a, b) => a.slug.localeCompare(b.slug));
-}
-function findDoc(contentDir, collectionName, collection, slug) {
-  const docs = readCollectionDocs(contentDir, collectionName, collection);
-  const doc = docs.find((candidate) => candidate.slug === slug);
-  if (!doc) {
-    const slugs = docs.map((candidate) => candidate.slug);
-    throw new GraftError({
-      code: "DOCUMENT_NOT_FOUND",
-      message: `No document with slug "${slug}" in collection "${collectionName}"`,
-      fix: slugs.length > 0 ? `Existing slugs: ${slugs.join(", ")}. Use one of those, or author the document with write_content.` : `Collection "${collectionName}" has no documents yet \u2014 author the first one with write_content.`,
-      details: { collection: collectionName, slug, existing: slugs }
-    });
-  }
-  return doc;
-}
-function walk(dir) {
-  const out = [];
-  for (const name of readdirSync(dir)) {
-    const full = join(dir, name);
-    if (statSync(full).isDirectory()) out.push(...walk(full));
-    else if (/\.mdx?$/.test(name)) out.push(full);
-  }
-  return out.sort();
-}
 
 // src/explain.ts
 import { ErrorCodes } from "@usegraft/contracts";
@@ -224,9 +160,9 @@ var ERROR_KNOWLEDGE = {
     meaning: "The Graft server (`graft serve`) has nothing mounted at the requested path \u2014 the request reached the right process but the wrong URL.",
     typicalCauses: [
       "A typo in the endpoint path (e.g. /api/fns instead of /api/fn/<name>)",
-      "Expecting the frontend app's routes on the headless runtime \u2014 graft serve hosts only the function, MCP, and health endpoints"
+      "Expecting the frontend app's routes on the headless runtime \u2014 graft serve hosts functions, MCP, authored-content reads, and health"
     ],
-    howToRecover: "Use POST /api/fn/<name> for typed functions, POST /api/mcp for the MCP Streamable HTTP surface, or GET /healthz for liveness. The error's details carry the path that missed."
+    howToRecover: "Use POST /api/fn/<name> for typed functions, POST /api/mcp for the MCP Streamable HTTP surface, GET /api/content/v1/documents or GET /api/content/v1/search for authored content, or GET /healthz for liveness. The error's details carry the path that missed."
   },
   AUTHORITY_MISMATCH: {
     code: "AUTHORITY_MISMATCH",
@@ -373,9 +309,10 @@ var ERROR_KNOWLEDGE = {
     meaning: "The operation is human-gated: a pending approval request was filed (details.approvalId) and the call will not run until a human approves it. Destructive functions are always gated; under the 'human' approval policy every mutation is.",
     typicalCauses: [
       "Calling a function marked `destructive: true` (deletes or irreversibly overwrites data)",
-      "Calling any mutation on a deployment whose approvalPolicy is 'human'"
+      "Calling any mutation on a deployment whose approvalPolicy is 'human'",
+      "Calling a destructive function over MCP at all \u2014 the 'unattended' policy that lifts this gate for a headless deployment is not part of the MCP surface, so there is no server setting that makes this tool call stop asking. That is deliberate, and not something to route around"
     ],
-    howToRecover: "Ask a human operator to run `graft approve <approvalId>` (they can also `graft deny` it). Once approved, retry the EXACT same call carrying the approval id \u2014 over MCP pass it as the `approval` tool argument; over raw HTTP send the `x-graft-approval: <approvalId>` header. Approvals are one-shot and bound to the exact input \u2014 never work around the gate."
+    howToRecover: "Ask a human operator to run `graft approve <approvalId>` (they can also `graft deny` it). Once approved, retry the EXACT same call carrying the approval id \u2014 over MCP pass it as the `approval` tool argument; over raw HTTP send the `x-graft-approval: <approvalId>` header. Approvals are one-shot and bound to the exact input \u2014 never work around the gate. If you are seeing this over MCP, the server did not ask your client directly: either the mount has not opted into elicited approvals (`approvalElicitation`, off by default and intended for a local server whose operator is present) or your client did not declare the elicitation capability. Both are ordinary \u2014 the gate is the same either way, only the way the human is reached differs."
   },
   APPROVAL_INVALID: {
     code: "APPROVAL_INVALID",
@@ -388,6 +325,16 @@ var ERROR_KNOWLEDGE = {
     ],
     howToRecover: "pending \u2192 wait for the human decision; denied \u2192 do not retry, ask the operator; already_consumed or not_found \u2192 call again without the approval id to file a fresh request; mismatch \u2192 retry with exactly the approved input."
   },
+  APPROVAL_UNATTRIBUTED: {
+    code: "APPROVAL_UNATTRIBUTED",
+    meaning: "The approval was filed by a caller with no stable identity, so there is nobody the request can be held to and no meaningful separation of duties to enforce. It cannot be decided by anyone.",
+    typicalCauses: [
+      "An unauthenticated caller reached a destructive function (an MCP mount or functions route serving anonymous actors)",
+      "A trusted issuer minted a token with no `sub` claim, so the actor authenticated but carried no id",
+      "A row left over from before approvals required an identified requester"
+    ],
+    howToRecover: "Fix the filing surface, not the row: require authentication where the approval was requested (an actor resolver, or a token that carries `sub`), then have the caller request the operation again so the approval records who wants it. A stale row can be resolved directly in the database."
+  },
   APPROVAL_SELF_DECISION: {
     code: "APPROVAL_SELF_DECISION",
     meaning: "The identity deciding an approval is the same identity that requested it. Separation of duties: a requester can never approve (or deny) their own destructive operation.",
@@ -486,9 +433,15 @@ function explainCode(code) {
   return code in ErrorCodes ? ERROR_KNOWLEDGE[code] : void 0;
 }
 
-// src/server.ts
-function ok(payload) {
-  return { content: [{ type: "text", text: JSON.stringify(payload, null, 2) }] };
+// src/tool-result.ts
+var isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function ok(payload, links = []) {
+  const result = {
+    // Text first: a client that ignores the rest still gets the whole answer.
+    content: [{ type: "text", text: JSON.stringify(payload, null, 2) }, ...links]
+  };
+  if (isPlainObject(payload)) result.structuredContent = payload;
+  return result;
 }
 function fail(error) {
   const explanation = ERROR_KNOWLEDGE[error.code];
@@ -506,465 +459,317 @@ function fail(error) {
     ]
   };
 }
-async function guarded(body) {
+async function guarded(body, linksFor) {
   try {
-    return ok(await body());
+    const payload = await body();
+    return ok(payload, linksFor?.(payload));
   } catch (error) {
-    if (error instanceof GraftError2) return fail(error);
+    if (error instanceof GraftError) return fail(error);
     throw error;
   }
 }
-function createGraftMcp(options) {
-  const { contentDir, collections } = options;
-  const branchId = options.branchId ?? "main";
-  const staticIndexPath = options.db === void 0 ? options.staticIndexPath : void 0;
-  const maybeDb = options.db;
-  if (maybeDb === void 0 && staticIndexPath === void 0) {
-    throw new GraftError2({
-      code: "CONFIG_INVALID",
-      message: "createGraftMcp needs an index: pass `db` (Postgres) or `staticIndexPath`.",
-      fix: "Pass `db` from createDb(DATABASE_URL), or `staticIndexPath` pointing at the compiled artifact (.graft/index.db) for a static project."
-    });
+async function guardedResource(body) {
+  try {
+    return await body();
+  } catch (error) {
+    if (!(error instanceof GraftError)) throw error;
+    const explanation = ERROR_KNOWLEDGE[error.code];
+    throw new Error(
+      [error.message, error.fix && `Fix: ${error.fix}`, explanation?.howToRecover].filter(Boolean).join(" "),
+      { cause: error }
+    );
   }
-  const requireDb = (feature, insteadDo) => {
-    if (maybeDb !== void 0) return maybeDb;
-    throw new GraftError2({
-      code: "NEEDS_DATABASE",
-      message: `${feature} needs the Postgres index; this project serves a static index (${staticIndexPath}).`,
-      fix: `${insteadDo} To move this project to the Postgres tier: set DATABASE_URL, change graft.config to \`export const index = "postgres"\`, run \`graft db migrate\`, then \`graft compile\`.`,
-      details: { feature, index: "static" }
-    });
-  };
-  const projectContent = async () => staticIndexPath === void 0 ? compile({ contentDir, collections, db: requireDb("compile", ""), branchId }) : compileStatic({ contentDir, collections, indexPath: staticIndexPath });
-  const searchIndex = async (query) => {
-    if (staticIndexPath === void 0) {
-      return searchContent(requireDb("search_content", ""), query);
-    }
-    const index = await openStaticIndex(staticIndexPath);
-    try {
-      return await index.searchContent({
-        query: query.query,
-        collections: query.collections,
-        limit: query.limit
-      });
-    } finally {
-      await index.close();
-    }
-  };
-  const functions = options.functions ?? {};
-  const functionsByName = /* @__PURE__ */ new Map();
-  for (const fn of Object.values(functions)) functionsByName.set(fn.name, fn);
-  let scopePromise;
-  const getScope = () => {
-    scopePromise ??= options.scope ? Promise.resolve(options.scope) : resolveBranchScope(requireDb("Branch scope resolution", ""), branchId);
-    return scopePromise;
-  };
-  let functionsHandler;
-  const getFunctionsHandler = () => {
-    functionsHandler ??= createFunctionsHandler({
-      functions,
-      db: requireDb(
-        "run_function",
-        "Typed functions read and write operational data in Postgres, so a static project has none."
-      ),
-      branch: branchId,
-      actor: options.actor,
-      approvalPolicy: options.approvalPolicy,
-      rateLimit: options.rateLimit,
-      gitSha: options.gitSha,
-      audit: options.audit,
-      approvals: options.approvals
-    });
-    return functionsHandler;
-  };
-  const deleteContentFn = defineFunction({
-    name: "delete_content",
-    kind: "mutation",
-    destructive: true,
-    public: true,
-    description: "Delete an authored MDX document and recompile (MCP delete_content tool).",
-    returns: "{ deleted, branch, gitSha, changes }",
-    input: {
-      collection: field.string({ description: "Collection name" }),
-      slug: field.string({ description: "Document slug to delete" })
-    },
-    handler: async ({ input }) => {
-      const collection = requireCollection(collections, input.collection);
-      const doc = findDoc(contentDir, input.collection, collection, input.slug);
-      unlinkSync(join2(contentDir, ...doc.sourcePath.split("/")));
-      const result = await projectContent();
-      return {
-        deleted: doc.sourcePath,
-        branch: branchId,
-        gitSha: result.gitSha,
-        changes: result.changes
-      };
-    }
-  });
-  let deleteHandler;
-  const getDeleteHandler = () => {
-    deleteHandler ??= createFunctionsHandler({
-      // The one-shot, input-bound human approval lives in Postgres. Rather than
-      // silently downgrading to an ungated delete, a static project is told to
-      // do it the way git already makes safe: delete the file and recompile.
-      db: requireDb(
-        "delete_content",
-        "Its human approval gate is a Postgres table, and dropping the gate would make the delete ungated. In a static project, delete the file and recompile \u2014 git is authoritative, so the file IS the document and git history is the undo."
-      ),
-      functions: { delete_content: deleteContentFn },
-      branch: branchId,
-      actor: options.actor,
-      rateLimit: options.rateLimit,
-      gitSha: options.gitSha,
-      audit: options.audit,
-      approvals: options.approvals
-    });
-    return deleteHandler;
-  };
-  let storagePromise;
-  const getStorage = () => {
-    storagePromise ??= (async () => {
-      if (options.storage) {
-        return typeof options.storage === "function" ? options.storage() : options.storage;
-      }
-      try {
-        return createStorage(storageConfigFromEnv());
-      } catch (error) {
-        throw new GraftError2({
-          code: "ENV_VAR_MISSING",
-          message: error instanceof Error ? error.message : String(error),
-          fix: "Set S3_ENDPOINT, S3_ACCESS_KEY, S3_SECRET_KEY, and S3_BUCKET in the MCP server's environment (.env), then retry.",
-          details: { variables: ["S3_ENDPOINT", "S3_ACCESS_KEY", "S3_SECRET_KEY", "S3_BUCKET"] }
-        });
-      }
-    })();
-    return storagePromise;
-  };
-  const server = new McpServer({
-    name: options.name ?? "graft",
-    version: options.version ?? "0.0.0"
-  });
+}
+
+// src/tools/annotations.ts
+var READS = {
+  readOnlyHint: true,
+  openWorldHint: false
+};
+var WRITES = {
+  readOnlyHint: false,
+  destructiveHint: false,
+  idempotentHint: false,
+  openWorldHint: false
+};
+var DESTROYS = {
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: false,
+  openWorldHint: false
+};
+
+// src/tools/outputs.ts
+import { FunctionDescriptor, RegistryItemDescriptor, SchemaDescription } from "@usegraft/contracts";
+import { z } from "zod";
+var DocumentData = z.record(z.string(), z.unknown());
+var ChangeSet = z.object({
+  added: z.array(z.string()),
+  changed: z.array(z.string()),
+  removed: z.array(z.string()),
+  unchanged: z.number()
+});
+var listCollectionsOutput = {
+  branch: z.string(),
+  collections: z.array(
+    z.object({
+      name: z.string(),
+      description: z.string().optional(),
+      authority: z.string(),
+      fields: z.number()
+    })
+  )
+};
+var describeSchemaOutput = SchemaDescription.shape;
+var listFunctionsOutput = {
+  branch: z.string(),
+  functions: z.array(
+    z.object({
+      name: z.string(),
+      kind: z.string(),
+      description: z.string().optional(),
+      public: z.boolean().optional(),
+      destructive: z.boolean().optional(),
+      args: z.number()
+    })
+  )
+};
+var describeFunctionOutput = FunctionDescriptor.shape;
+var listRegistryOutput = {
+  items: z.array(
+    z.object({
+      name: z.string(),
+      type: z.string(),
+      description: z.string(),
+      registryDependencies: z.array(z.string()).optional()
+    })
+  )
+};
+var describeItemOutput = RegistryItemDescriptor.shape;
+var listPackagesOutput = {
+  packages: z.array(
+    z.object({
+      name: z.string(),
+      role: z.string(),
+      when: z.string(),
+      tier: z.enum(["static", "postgres", "either"]),
+      framework: z.string().optional(),
+      direct: z.boolean()
+    })
+  )
+};
+var listContentOutput = {
+  collection: z.string(),
+  documents: z.array(
+    z.object({
+      slug: z.string(),
+      sourcePath: z.string(),
+      data: DocumentData
+    })
+  )
+};
+var getContentOutput = {
+  collection: z.string(),
+  slug: z.string(),
+  sourcePath: z.string(),
+  data: DocumentData,
+  body: z.string()
+};
+var searchContentOutput = {
+  branch: z.string(),
+  /** The resolved overlay chain, leaf-first — which branches were searched. */
+  chain: z.array(z.string()),
+  query: z.string(),
+  hits: z.array(
+    z.object({
+      collection: z.string(),
+      slug: z.string(),
+      sourcePath: z.string(),
+      rank: z.number(),
+      snippet: z.string(),
+      data: DocumentData
+    })
+  )
+};
+var writeContentOutput = {
+  written: z.string(),
+  branch: z.string(),
+  /** Null when the content tree is not in a git checkout. */
+  gitSha: z.string().nullable(),
+  changes: ChangeSet
+};
+var listBranchesOutput = {
+  branches: z.array(
+    z.object({
+      name: z.string(),
+      parent: z.string().nullable(),
+      backend: z.string(),
+      status: z.string(),
+      createdAt: z.string(),
+      endpointHost: z.string().nullable()
+    })
+  )
+};
+var listCompilationsOutput = {
+  compilations: z.array(
+    z.object({
+      id: z.string(),
+      branchId: z.string(),
+      gitSha: z.string().nullable(),
+      docCount: z.number(),
+      added: z.number(),
+      changed: z.number(),
+      removed: z.number(),
+      createdAt: z.string()
+    })
+  )
+};
+var listApprovalsOutput = {
+  approvals: z.array(
+    z.object({
+      id: z.string(),
+      branchId: z.string(),
+      functionName: z.string(),
+      /** The canonical input the approval is bound to; jsonb, so open. */
+      input: z.unknown(),
+      requestedByKind: z.string(),
+      requestedById: z.string().nullable(),
+      correlationId: z.string().nullable(),
+      createdAt: z.string()
+    })
+  )
+};
+var decideApprovalOutput = {
+  id: z.string(),
+  status: z.string(),
+  decidedBy: z.string().nullable(),
+  functionName: z.string()
+};
+var putAssetOutput = {
+  key: z.string(),
+  contentType: z.string(),
+  bytes: z.number(),
+  url: z.string(),
+  /** A ready-to-paste `field.asset` frontmatter snippet. */
+  frontmatter: z.string()
+};
+var explainErrorOutput = {
+  code: z.string().optional(),
+  known: z.boolean().optional(),
+  meaning: z.string().optional(),
+  typicalCauses: z.array(z.string()).optional(),
+  howToRecover: z.string().optional(),
+  /** The `fix` off the actual error, which beats the general advice. */
+  specificFix: z.string().optional(),
+  message: z.string().optional(),
+  knownCodes: z.array(z.string()).optional(),
+  hint: z.string().optional()
+};
+
+// src/tools/approvals.ts
+var registerApprovalTools = (server, deps) => {
+  const { branchId, requireDb, requireDecider, requireScope } = deps;
   server.registerTool(
-    "list_collections",
+    "list_approvals",
     {
-      title: "List collections",
-      description: "List every registered content collection (name, description, authority, field count). Start here to learn what kinds of content this project has.",
+      title: "List pending approvals",
+      outputSchema: listApprovalsOutput,
+      annotations: READS,
+      description: "Pending human-gated approvals. Decide with decide_approval, Studio Approve/Deny, or `graft approve` / `graft deny`. Same data as GET /api/studio/v1/approvals.",
       inputSchema: {}
     },
-    () => guarded(() => ({
-      branch: branchId,
-      collections: Object.values(collections).map((collection) => {
-        const descriptor = collection.describe();
-        return {
-          name: descriptor.name,
-          description: descriptor.description,
-          authority: descriptor.authority,
-          fields: descriptor.fields.length
-        };
-      })
+    () => guarded(async () => ({
+      approvals: (await listPendingApprovals(
+        requireDb(
+          "list_approvals",
+          "Approvals gate destructive operations on operational data, which a static project does not have."
+        )
+      )).map((row) => ({
+        id: row.id,
+        branchId: row.branchId,
+        functionName: row.functionName,
+        input: row.input,
+        requestedByKind: row.requestedByKind,
+        requestedById: row.requestedById,
+        correlationId: row.correlationId,
+        createdAt: row.createdAt.toISOString()
+      }))
     }))
   );
   server.registerTool(
-    "describe_schema",
+    "decide_approval",
     {
-      title: "Describe the content schema",
-      description: "Full schema introspection: every collection with its typed fields (name, type, optional, description), plus every registered function (kind, args, public/destructive). Documents also accept an optional kebab-case `slug` (defaults to the filename). Prefer list_functions / describe_function when you only need the function surface.",
-      inputSchema: {}
+      title: "Approve or deny a pending approval",
+      outputSchema: decideApprovalOutput,
+      annotations: DESTROYS,
+      description: "Record a decision on a pending approval (same as Studio Approve/Deny and `graft approve` / `graft deny`). The decision is attributed to the identity THIS connection authenticated as \u2014 there is no way to name a different decider \u2014 and a requester can never decide their own approval. Requires an authenticated caller and an owner DB role that can UPDATE approvals.",
+      inputSchema: {
+        id: z2.string().describe("Pending approval id from list_approvals"),
+        decision: z2.enum(["approved", "denied"]).describe("approved or denied")
+      }
     },
-    () => guarded(() => {
+    ({ id, decision }) => guarded(async () => {
+      requireScope("decide_approval", "approvals:decide");
+      const row = await decideApproval(
+        requireDb(
+          "decide_approval",
+          "Approvals gate destructive operations on operational data, which a static project does not have."
+        ),
+        id,
+        decision,
+        requireDecider()
+      );
+      if (!row) {
+        throw new GraftError2({
+          code: "APPROVAL_INVALID",
+          message: `No PENDING approval "${id}" exists \u2014 it may already be decided, consumed, or mistyped.`,
+          fix: "Call list_approvals and use a pending id.",
+          details: { id }
+        });
+      }
       return {
-        collections: Object.values(collections).map((collection) => {
-          const descriptor = collection.describe();
-          return { ...descriptor, fields: descriptor.fields.map(teachAssetFields) };
-        }),
-        functions: [...functionsByName.values()].map((fn) => fn.describe())
-      };
-    })
-  );
-  server.registerTool(
-    "list_functions",
-    {
-      title: "List functions",
-      description: "List every registered typed function (name, kind, public, destructive, short description). Use describe_function for the full input schema, then run_function to invoke. Mutations reject anonymous callers unless public: true; destructive functions always require human approval (graft approve).",
-      inputSchema: {}
-    },
-    () => guarded(() => ({
-      branch: branchId,
-      functions: [...functionsByName.values()].map((fn) => {
-        const d = fn.describe();
-        return {
-          name: d.name,
-          kind: d.kind,
-          description: d.description,
-          public: d.public,
-          destructive: d.destructive,
-          args: d.args.length
-        };
-      })
-    }))
-  );
-  server.registerTool(
-    "describe_function",
-    {
-      title: "Describe one function",
-      description: "Full introspection for one function: kind, args (name/type/optional/description), returns, public, destructive. Use this before run_function so the input object matches the schema.",
-      inputSchema: {
-        name: z.string().describe("Function name as returned by list_functions")
-      }
-    },
-    ({ name }) => guarded(() => {
-      const fn = functionsByName.get(name);
-      if (!fn) {
-        throw new GraftError2({
-          code: "FUNCTION_NOT_FOUND",
-          message: `No function named "${name}" is registered.`,
-          fix: `Call list_functions and use one of: ${[...functionsByName.keys()].join(", ") || "(none registered)"}.`,
-          details: { requested: name, available: [...functionsByName.keys()] }
-        });
-      }
-      return fn.describe();
-    })
-  );
-  server.registerTool(
-    "run_function",
-    {
-      title: "Run a typed function",
-      description: "Invoke a defineFunction by name with a JSON input object. Same pipeline as POST /api/fn/<name>: Zod validation, access rules, rate limits, audit log, and the human gate for destructive ops. The server may already act with a configured identity (graft mcp uses GRAFT_DEV_TOKEN; over HTTP your connection's bearer is forwarded) \u2014 only pass authorization to override it. Pass approval after a human runs `graft approve <id>` for gated calls. Success returns { data, correlationId }; failures are GraftError JSON with a fix.",
-      inputSchema: {
-        name: z.string().describe("Function name (defineFunction name, not the export key)"),
-        input: z.record(z.string(), z.unknown()).optional().describe("Input fields object; defaults to {}. See describe_function for the schema."),
-        authorization: z.string().optional().describe(
-          "Bearer token override (with or without the 'Bearer ' prefix). Usually unnecessary \u2014 the server's configured identity applies when omitted."
-        ),
-        approval: z.string().optional().describe(
-          "Approval id from a prior DESTRUCTIVE_OP_REQUIRES_APPROVAL response (after `graft approve <id>`)."
-        )
-      }
-    },
-    ({ name, input, authorization, approval }) => guarded(async () => {
-      if (functionsByName.size === 0) {
-        throw new GraftError2({
-          code: "FUNCTION_NOT_FOUND",
-          message: "This MCP server has no functions registered.",
-          fix: "Export `functions` from graft.config.ts (defineFunction results, often via mergePrimitives) and restart the MCP server / pass them to createGraftMcp({ functions }).",
-          details: { requested: name, available: [] }
-        });
-      }
-      if (!functionsByName.has(name)) {
-        throw new GraftError2({
-          code: "FUNCTION_NOT_FOUND",
-          message: `No function named "${name}" is registered.`,
-          fix: `Call list_functions and use one of: ${[...functionsByName.keys()].join(", ")}.`,
-          details: { requested: name, available: [...functionsByName.keys()] }
-        });
-      }
-      return invokeFunction(getFunctionsHandler(), name, input ?? {}, {
-        credential: authorization ?? options.defaultAuthorization,
-        approval
-      });
-    })
-  );
-  server.registerTool(
-    "list_registry",
-    {
-      title: "List registry items",
-      description: "List every owned primitive available to `graft add` \u2014 shadcn-style copy-in blocks / fields / access rules / bundles (name, type, one-line description, and any registry items it pulls in). Use describe_item for the full details, then install with `graft add <name>` from the CLI. MCP browses what exists; the CLI installs it.",
-      inputSchema: {}
-    },
-    () => guarded(() => ({
-      items: listItems(options.registryRoot).map((item) => ({
-        name: item.name,
-        type: item.type,
-        description: item.description,
-        registryDependencies: item.registryDependencies
-      }))
-    }))
-  );
-  server.registerTool(
-    "describe_item",
-    {
-      title: "Describe a registry item",
-      description: "Full details for one owned primitive: type, description, the files it writes into the project, npm dependencies to install, the registry items it pulls in first, and whether it ships an llms.txt fragment. Use list_registry for names; install with `graft add <name>` (CLI). MCP does not install.",
-      inputSchema: {
-        name: z.string().describe("Item name as returned by list_registry")
-      }
-    },
-    ({ name }) => guarded(() => describeItem(loadItem(name, options.registryRoot)))
-  );
-  server.registerTool(
-    "list_content",
-    {
-      title: "List documents in a collection",
-      description: "List every document in a collection, read from the authored MDX files (git is the source of truth). Returns slug, sourcePath, and frontmatter data.",
-      inputSchema: {
-        collection: z.string().describe("Collection name, as returned by list_collections")
-      }
-    },
-    ({ collection: name }) => guarded(() => {
-      const collection = requireCollection(collections, name);
-      const docs = readCollectionDocs(contentDir, name, collection);
-      return {
-        collection: name,
-        documents: docs.map((doc) => ({
-          slug: doc.slug,
-          sourcePath: doc.sourcePath,
-          data: doc.data
-        }))
-      };
-    })
-  );
-  server.registerTool(
-    "get_content",
-    {
-      title: "Get one document",
-      description: "Read a single document by collection + slug from the authored MDX files: validated frontmatter data, MDX body, and the file path to edit.",
-      inputSchema: {
-        collection: z.string().describe("Collection name"),
-        slug: z.string().describe("Document slug (kebab-case)")
-      }
-    },
-    ({ collection: name, slug }) => guarded(() => {
-      const collection = requireCollection(collections, name);
-      const doc = findDoc(contentDir, name, collection, slug);
-      return {
-        collection: name,
-        slug: doc.slug,
-        sourcePath: doc.sourcePath,
-        data: doc.data,
-        body: doc.body
-      };
-    })
-  );
-  server.registerTool(
-    "search_content",
-    {
-      title: "Full-text search across content",
-      description: 'Search authored content by words, "quoted phrases", `or`, and -exclusions (websearch syntax). Searches the branch\'s effective content in the compiled Postgres index \u2014 on a preview branch that includes documents inherited from parent branches, with branch overrides winning \u2014 so results are as fresh as the last compile (write_content compiles automatically); every hit carries the sourcePath of the file to edit. Ranking weights slug matches over frontmatter over body.',
-      inputSchema: {
-        query: z.string().describe('What to find, e.g. pricing "free tier" -enterprise'),
-        collection: z.string().optional().describe("Restrict to one collection (default: all registered collections)"),
-        limit: z.number().optional().describe("Max hits, best-ranked first (default 20)")
-      }
-    },
-    ({ query, collection: name, limit }) => guarded(async () => {
-      if (name !== void 0) requireCollection(collections, name);
-      assertSearchQuery(query);
-      const collectionNames = name === void 0 ? Object.keys(collections) : [name];
-      const chain = staticIndexPath === void 0 ? scopeChain(await getScope()) : [branchId];
-      const hits = await searchIndex({ query, chain, collections: collectionNames, limit });
-      return {
-        branch: branchId,
-        chain,
-        query,
-        hits: hits.map(({ row, rank, snippet }) => ({
-          collection: row.collection,
-          slug: row.slug,
-          sourcePath: row.sourcePath,
-          rank,
-          snippet,
-          data: row.data
-        }))
-      };
-    })
-  );
-  server.registerTool(
-    "write_content",
-    {
-      title: "Write a document (create or update)",
-      description: "Author or update a document: validates the data against the collection schema, writes <contentDir>/<collection>/<slug>.mdx, and compiles the content tree into the database. Returns exactly what changed. Git is the version history: commit the file afterwards if you have the server's checkout; remote callers can't and needn't \u2014 the checkout's operator owns the commit.",
-      inputSchema: {
-        collection: z.string().describe("Collection name"),
-        slug: z.string().describe("Document slug \u2014 kebab-case; becomes the filename and the URL segment"),
-        data: z.record(z.string(), z.unknown()).describe("Frontmatter data; must satisfy the collection schema (see describe_schema)"),
-        body: z.string().optional().describe("MDX body (markdown). Defaults to empty.")
-      }
-    },
-    ({ collection: name, slug, data, body }) => guarded(async () => {
-      const collection = requireCollection(collections, name);
-      if (collection.authority === "db-authoritative") {
-        throw new GraftError2({
-          code: "AUTHORITY_MISMATCH",
-          message: `Collection "${name}" is db-authoritative \u2014 its records live in Postgres, not as MDX files.`,
-          fix: `Write this data through the collection's function endpoint (POST /api/fn/<name>, see llms.txt) instead of write_content. write_content is only for file-authoritative collections.`,
-          details: { collection: name, authority: collection.authority }
-        });
-      }
-      const frontmatterSlug = data.slug;
-      if (frontmatterSlug !== void 0 && frontmatterSlug !== slug) {
-        throw new GraftError2({
-          code: "INVALID_SLUG",
-          message: `data.slug ("${String(frontmatterSlug)}") conflicts with the slug argument ("${slug}")`,
-          fix: "Omit `slug` from data \u2014 the slug argument names the file and the document.",
-          details: { slug, frontmatterSlug }
-        });
-      }
-      const sourcePath = `${name}/${slug}.mdx`;
-      const fullPath = join2(contentDir, ...sourcePath.split("/"));
-      const existingRaw = existsSync2(fullPath) ? readFileSync2(fullPath, "utf8") : void 0;
-      const raw = composeDocument(existingRaw, data, body ?? "");
-      parseDocument2(raw, collection, sourcePath);
-      assertSlugFree(contentDir, name, collection, slug, sourcePath);
-      writeDocumentFile(fullPath, raw);
-      const result = await projectContent();
-      return {
-        written: sourcePath,
-        branch: branchId,
-        gitSha: result.gitSha,
-        changes: result.changes
+        id: row.id,
+        status: row.status,
+        decidedBy: row.decidedBy,
+        functionName: row.functionName
       };
     })
   );
-  server.registerTool(
-    "delete_content",
-    {
-      title: "Delete a document (human-gated)",
-      description: "Delete an authored document: removes <contentDir>/<collection>/<slug>.mdx and compiles, so the index soft-deletes it. DESTRUCTIVE and always human-gated \u2014 the first call files an approval and fails with its id; a human decides with `graft approve <id>` (or deny); then retry the SAME collection+slug with `approval: <id>` (the MCP form of the x-graft-approval header). Approvals are one-shot and bound to that exact input. Git is the version history: commit the deletion afterwards if you have the server's checkout; remote callers can't and needn't \u2014 the checkout's operator owns the commit.",
-      inputSchema: {
-        collection: z.string().describe("Collection name"),
-        slug: z.string().describe("Document slug to delete"),
-        approval: z.string().optional().describe(
-          "Approval id from a prior DESTRUCTIVE_OP_REQUIRES_APPROVAL response, after a human ran `graft approve <id>`."
-        )
-      }
-    },
-    ({ collection: name, slug, approval }) => guarded(async () => {
-      const collection = requireCollection(collections, name);
-      if (collection.authority === "db-authoritative") {
-        throw new GraftError2({
-          code: "AUTHORITY_MISMATCH",
-          message: `Collection "${name}" is db-authoritative \u2014 its records live in Postgres, not as MDX files.`,
-          fix: "Delete records through the collection's typed functions (a destructive defineFunction over deleteRecord \u2014 see list_functions), not delete_content. delete_content is only for file-authoritative collections.",
-          details: { collection: name, authority: collection.authority }
-        });
-      }
-      findDoc(contentDir, name, collection, slug);
-      const { data, correlationId } = await invokeFunction(
-        getDeleteHandler(),
-        "delete_content",
-        { collection: name, slug },
-        { credential: options.defaultAuthorization, approval }
-      );
-      return { ...data, correlationId };
-    })
-  );
+};
+
+// src/tools/assets.ts
+import { readFileSync } from "fs";
+import { contentTypeFor, defaultKeyFor } from "@usegraft/assets";
+import { AssetRef } from "@usegraft/core";
+import { resolveContained } from "@usegraft/compiler";
+import { GraftError as GraftError3 } from "@usegraft/contracts";
+import { z as z3 } from "zod";
+var registerAssetTools = (server, deps) => {
+  const { getStorage, options, requireScope } = deps;
+  const uploadRoot = options.localUploadRoot;
   server.registerTool(
     "put_asset",
     {
       title: "Upload an asset (image / binary)",
-      description: "Upload a binary to the asset store and get the frontmatter reference for an `asset` field. Pass `path` (a file on the machine running this MCP server \u2014 the stdio case) OR `base64` + `key` (remote agents send the bytes). Refuses to overwrite an existing key unless overwrite: true \u2014 the store keeps no version history. Then reference the returned key from an asset field via write_content.",
+      outputSchema: putAssetOutput,
+      annotations: DESTROYS,
+      description: (uploadRoot ? "Upload a binary to the asset store and get the frontmatter reference for an `asset` field. Pass `path` (a file inside this project) OR `base64` + `key`. " : "Upload a binary to the asset store and get the frontmatter reference for an `asset` field. Pass `base64` + `key` \u2014 this server reads no files from its own disk. ") + "Refuses to overwrite an existing key unless overwrite: true \u2014 the store keeps no version history. Then reference the returned key from an asset field via write_content.",
       inputSchema: {
-        key: z.string().optional().describe(
+        key: z3.string().optional().describe(
           'Asset key \u2014 a lowercase path like "pages/pricing/hero.png". Required with base64; defaults to assets/<filename> with path.'
         ),
-        path: z.string().optional().describe("Path to a file on the MCP server's machine (local/stdio agents)."),
-        base64: z.string().optional().describe("The file's bytes, base64-encoded (remote/HTTP agents)."),
-        contentType: z.string().optional().describe("MIME type. Defaults to an inference from the key/path extension."),
-        overwrite: z.boolean().optional().describe("Replace an existing binary at this key. Off by default.")
+        path: z3.string().optional().describe(
+          uploadRoot ? `Path to a file inside ${uploadRoot} (local/stdio agents).` : "Not available on this server \u2014 send the bytes as `base64` instead."
+        ),
+        base64: z3.string().optional().describe("The file's bytes, base64-encoded (remote/HTTP agents)."),
+        contentType: z3.string().optional().describe("MIME type. Defaults to an inference from the key/path extension."),
+        overwrite: z3.boolean().optional().describe("Replace an existing binary at this key. Off by default.")
       }
     },
     ({ key: keyArg, path, base64, contentType, overwrite }) => guarded(async () => {
+      requireScope("put_asset", "content:write");
       if (path === void 0 === (base64 === void 0)) {
-        throw new GraftError2({
+        throw new GraftError3({
           code: "INPUT_VALIDATION_FAILED",
           message: "Pass exactly one of `path` (a file on the MCP server's machine) or `base64` (the file's bytes).",
           fix: "Local/stdio agents: pass path. Remote/HTTP agents: read the file yourself and pass base64 + key."
@@ -972,10 +777,22 @@ function createGraftMcp(options) {
       }
       let bytes;
       if (path !== void 0) {
+        if (uploadRoot === void 0) {
+          throw new GraftError3({
+            code: "UNAUTHORIZED",
+            message: "This server does not read files from its own disk.",
+            fix: "Read the file yourself and send its bytes as `base64` with a `key`. Reading server-local paths is only available to a local stdio server, which grants it explicitly.",
+            details: { tool: "put_asset" }
+          });
+        }
+        const full = resolveContained(uploadRoot, path, {
+          label: "asset source",
+          allowAbsolute: true
+        });
         try {
-          bytes = readFileSync2(path);
+          bytes = readFileSync(full);
         } catch {
-          throw new GraftError2({
+          throw new GraftError3({
             code: "DOCUMENT_NOT_FOUND",
             message: `File not found: ${path}`,
             fix: "Pass a path to a file that exists on the machine running this MCP server, or send the bytes as base64 instead.",
@@ -984,7 +801,7 @@ function createGraftMcp(options) {
         }
       } else {
         if (!/^[A-Za-z0-9+/=\s]+$/.test(base64)) {
-          throw new GraftError2({
+          throw new GraftError3({
             code: "INPUT_VALIDATION_FAILED",
             message: "`base64` contains characters outside the base64 alphabet.",
             fix: "Encode the file's raw bytes as standard base64 (A-Z a-z 0-9 + / =). To upload a file by its location on the server's machine, use `path` instead."
@@ -994,7 +811,7 @@ function createGraftMcp(options) {
       }
       const key = keyArg ?? (path !== void 0 ? defaultKeyFor(path) : void 0);
       if (key === void 0) {
-        throw new GraftError2({
+        throw new GraftError3({
           code: "INPUT_VALIDATION_FAILED",
           message: "`key` is required when uploading via base64.",
           fix: 'Pass a lowercase path key naming the asset, e.g. "pages/pricing/hero.png".'
@@ -1002,7 +819,7 @@ function createGraftMcp(options) {
       }
       const keyCheck = AssetRef.shape.key.safeParse(key);
       if (!keyCheck.success) {
-        throw new GraftError2({
+        throw new GraftError3({
           code: "INPUT_VALIDATION_FAILED",
           message: `"${key}" is not a valid asset key.`,
           fix: 'Use a lowercase path of letters, digits, ".", "_", "-" with "/" separators, each segment starting alphanumeric \u2014 e.g. "pages/pricing/hero.png".',
@@ -1011,7 +828,7 @@ function createGraftMcp(options) {
       }
       const storage = await getStorage();
       if (overwrite !== true && await storage.exists(key)) {
-        throw new GraftError2({
+        throw new GraftError3({
           code: "ASSET_EXISTS",
           message: `Asset key "${key}" already holds a binary.`,
           fix: "Pick a distinct key (the store keeps no version history), or pass overwrite: true if replacing the existing binary is the actual intent.",
@@ -1031,10 +848,19 @@ function createGraftMcp(options) {
       };
     })
   );
+};
+
+// src/tools/branches.ts
+import { listBranches, listCompilations } from "@usegraft/db";
+import { z as z4 } from "zod";
+var registerBranchTools = (server, deps) => {
+  const { branchId, requireDb } = deps;
   server.registerTool(
     "list_branches",
     {
       title: "List branches",
+      outputSchema: listBranchesOutput,
+      annotations: READS,
       description: "List registered content branches (name, parent, backend, status). Same data as GET /api/studio/v1/branches and `graft branch`.",
       inputSchema: {}
     },
@@ -1058,10 +884,12 @@ function createGraftMcp(options) {
     "list_compilations",
     {
       title: "List compilations",
+      outputSchema: listCompilationsOutput,
+      annotations: READS,
       description: "Recent content projection trail rows (git SHA, added/changed/removed counts), newest first. Same data as GET /api/studio/v1/compilations and `graft compilations`.",
       inputSchema: {
-        branch: z.string().optional().describe("Restrict to one branch id (default: all branches)"),
-        limit: z.number().optional().describe("Max rows, newest first (default 20, max 100)")
+        branch: z4.string().optional().describe("Restrict to one branch id (default: all branches)"),
+        limit: z4.number().optional().describe("Max rows, newest first (default 20, max 100)")
       }
     },
     ({ branch, limit }) => guarded(async () => ({
@@ -1086,112 +914,31 @@ function createGraftMcp(options) {
       }))
     }))
   );
-  server.registerTool(
-    "list_approvals",
-    {
-      title: "List pending approvals",
-      description: "Pending human-gated approvals. Decide with decide_approval, Studio Approve/Deny, or `graft approve` / `graft deny`. Same data as GET /api/studio/v1/approvals.",
-      inputSchema: {}
-    },
-    () => guarded(async () => ({
-      approvals: (await listPendingApprovals(
-        requireDb(
-          "list_approvals",
-          "Approvals gate destructive operations on operational data, which a static project does not have."
-        )
-      )).map((row) => ({
-        id: row.id,
-        branchId: row.branchId,
-        functionName: row.functionName,
-        input: row.input,
-        requestedByKind: row.requestedByKind,
-        requestedById: row.requestedById,
-        correlationId: row.correlationId,
-        createdAt: row.createdAt.toISOString()
-      }))
-    }))
-  );
-  server.registerTool(
-    "decide_approval",
-    {
-      title: "Approve or deny a pending approval",
-      description: "Record a human decision on a pending approval (same as Studio Approve/Deny and `graft approve` / `graft deny`). Requires an owner DB role that can UPDATE approvals. The requester cannot decide their own approval.",
-      inputSchema: {
-        id: z.string().describe("Pending approval id from list_approvals"),
-        decision: z.enum(["approved", "denied"]).describe("approved or denied"),
-        decidedBy: z.string().optional().describe("Operator identity stamp (defaults to mcp-operator)")
-      }
-    },
-    ({ id, decision, decidedBy }) => guarded(async () => {
-      const row = await decideApproval(
-        requireDb(
-          "decide_approval",
-          "Approvals gate destructive operations on operational data, which a static project does not have."
-        ),
-        id,
-        decision,
-        decidedBy?.trim() || "mcp-operator"
-      );
-      if (!row) {
-        throw new GraftError2({
-          code: "APPROVAL_INVALID",
-          message: `No PENDING approval "${id}" exists \u2014 it may already be decided, consumed, or mistyped.`,
-          fix: "Call list_approvals and use a pending id.",
-          details: { id }
-        });
-      }
-      return {
-        id: row.id,
-        status: row.status,
-        decidedBy: row.decidedBy,
-        functionName: row.functionName
-      };
-    })
-  );
-  server.registerTool(
-    "explain_error",
-    {
-      title: "Explain a Graft error",
-      description: "Given a GraftError code or its JSON, explain what it means, its typical causes, and how to recover. Use whenever a tool call or compile fails.",
-      inputSchema: {
-        code: z.string().optional().describe("An error code, e.g. SCHEMA_VALIDATION_FAILED"),
-        error: z.string().optional().describe("A full GraftError JSON string, if you have one")
-      }
-    },
-    ({ code, error }) => guarded(() => {
-      let parsed;
-      if (error) {
-        try {
-          parsed = JSON.parse(error);
-        } catch {
-        }
-      }
-      const effective = code ?? parsed?.error;
-      if (!effective) {
-        return {
-          knownCodes: Object.keys(ERROR_KNOWLEDGE),
-          hint: "Pass `code` or the GraftError JSON as `error`."
-        };
-      }
-      const explanation = explainCode(effective);
-      if (!explanation) {
-        return {
-          code: effective,
-          known: false,
-          knownCodes: Object.keys(ERROR_KNOWLEDGE),
-          hint: "Not a Graft error code. If this came from another system, resolve it there."
-        };
-      }
-      return {
-        ...explanation,
-        // The specific fix from the actual error beats the general recovery advice.
-        specificFix: parsed?.fix,
-        message: parsed?.message
-      };
-    })
-  );
-  return server;
-}
+};
+
+// src/tools/content.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import {
+  composeDocument,
+  parseDocument as parseDocument2,
+  readCollectionDocs,
+  resolveContained as resolveContained2,
+  SLUG_RE,
+  writeDocumentFile
+} from "@usegraft/compiler";
+import { GraftError as GraftError5 } from "@usegraft/contracts";
+import { assertSafeMdx } from "@usegraft/mdx-safety";
+import { assertSearchQuery, scopeChain } from "@usegraft/db";
+import { z as z5 } from "zod";
+
+// src/tool-helpers.ts
+import { existsSync, readdirSync, readFileSync as readFileSync2, statSync } from "fs";
+import { join } from "path";
+import { parseDocument } from "@usegraft/compiler";
+import {
+  GraftError as GraftError4
+} from "@usegraft/contracts";
+import { APPROVAL_HEADER } from "@usegraft/core";
 async function invokeFunction(handler, name, input, identity) {
   const headers = new Headers({ "content-type": "application/json" });
   if (identity.credential) {
@@ -1217,6 +964,26 @@ async function invokeFunction(handler, name, input, identity) {
   const data = body !== null && typeof body === "object" && "data" in body ? body.data : body;
   return { data, correlationId, status: response.status };
 }
+function filedApprovalId(error) {
+  if (!(error instanceof GraftError4) || error.code !== "DESTRUCTIVE_OP_REQUIRES_APPROVAL") {
+    return void 0;
+  }
+  const id = error.details?.approvalId;
+  return typeof id === "string" ? id : void 0;
+}
+async function invokeFunctionWithApproval(handler, name, input, identity, elicit) {
+  try {
+    return await invokeFunction(handler, name, input, identity);
+  } catch (error) {
+    const approvalId = filedApprovalId(error);
+    if (approvalId === void 0 || elicit === void 0 || identity.approval !== void 0) {
+      throw error;
+    }
+    const approved = await elicit({ approvalId, functionName: name, input });
+    if (approved === void 0) throw error;
+    return invokeFunction(handler, name, input, { ...identity, approval: approved });
+  }
+}
 var ASSET_FIELD_HINT = "Asset reference: the value is an object { key, alt? }. Upload the file with the put_asset tool first \u2014 its response includes the exact snippet to use here.";
 function teachAssetFields(fieldDescriptor) {
   const taught = {
@@ -1237,7 +1004,7 @@ function graftErrorFromBody(body, correlationId) {
   if (body !== null && typeof body === "object") {
     const json = body;
     if (typeof json.error === "string" && typeof json.message === "string") {
-      return new GraftError2({
+      return new GraftError4({
         code: json.error,
         message: json.message,
         fix: toMcpFix(json.fix),
@@ -1248,7 +1015,7 @@ function graftErrorFromBody(body, correlationId) {
       });
     }
   }
-  return new GraftError2({
+  return new GraftError4({
     code: "FUNCTION_EXECUTION_FAILED",
     message: "Function invocation failed with a non-GraftError response.",
     fix: "Inspect the server logs; retry with list_functions / describe_function to confirm the name and input shape.",
@@ -1256,23 +1023,23 @@ function graftErrorFromBody(body, correlationId) {
   });
 }
 function assertSlugFree(contentDir, collectionName, collection, slug, targetSourcePath) {
-  const dir = join2(contentDir, collectionName);
-  if (!existsSync2(dir) || !statSync2(dir).isDirectory()) return;
-  for (const name of readdirSync2(dir, { recursive: true, encoding: "utf8" })) {
+  const dir = join(contentDir, collectionName);
+  if (!existsSync(dir) || !statSync(dir).isDirectory()) return;
+  for (const name of readdirSync(dir, { recursive: true, encoding: "utf8" })) {
     const normalized = name.split("\\").join("/");
     const sourcePath = `${collectionName}/${normalized}`;
-    const full = join2(dir, name);
-    if (sourcePath === targetSourcePath || !/\.mdx?$/.test(name) || statSync2(full).isDirectory()) {
+    const full = join(dir, name);
+    if (sourcePath === targetSourcePath || !/\.mdx?$/.test(name) || statSync(full).isDirectory()) {
       continue;
     }
     let existingSlug;
     try {
-      existingSlug = parseDocument2(readFileSync2(full, "utf8"), collection, sourcePath).slug;
+      existingSlug = parseDocument(readFileSync2(full, "utf8"), collection, sourcePath).slug;
     } catch {
       continue;
     }
     if (existingSlug === slug) {
-      throw new GraftError2({
+      throw new GraftError4({
         code: "SLUG_NOT_UNIQUE",
         message: `Slug "${slug}" in collection "${collectionName}" is already used by ${sourcePath}`,
         fix: `Update that document instead (write_content with slug "${slug}" targets ${targetSourcePath}, but ${sourcePath} owns the slug via frontmatter), or pick a different slug.`,
@@ -1282,47 +1049,1337 @@ function assertSlugFree(contentDir, collectionName, collection, slug, targetSour
   }
 }
 
-// src/http.ts
-import { GraftError as GraftError3 } from "@usegraft/contracts";
-import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-function jsonRpcError(status, code, message, headers) {
-  return Response.json({ jsonrpc: "2.0", error: { code, message }, id: null }, { status, headers });
+// src/tools/resource-uri.ts
+var documentUri = (branchId, collection, slug) => `graft://${branchId}/${collection}/${slug}`;
+var schemaUri = (branchId) => `graft://${branchId}/schema`;
+var documentUriTemplate = (branchId) => `graft://${branchId}/{collection}/{slug}`;
+var documentLink = (branchId, collection, slug) => ({
+  type: "resource_link",
+  uri: documentUri(branchId, collection, slug),
+  name: `${collection}/${slug}`,
+  mimeType: "text/markdown"
+});
+
+// src/tools/content.ts
+function assertSlugShape(slug, collection) {
+  if (SLUG_RE.test(slug)) return;
+  throw new GraftError5({
+    code: "INVALID_SLUG",
+    message: `Slug "${slug}" is not URL-safe.`,
+    fix: 'Slugs must be kebab-case: lowercase letters, digits, and single hyphens (e.g. "getting-started"). A slug names a file inside the collection directory, so it cannot contain "/", ".." or a drive letter.',
+    details: { slug, collection, pattern: SLUG_RE.source }
+  });
 }
-function createGraftMcpHandler(options) {
-  const { actor: resolveActor, requireActor, ...serverOptions } = options;
-  return async (request) => {
-    if (request.method !== "POST") {
-      return jsonRpcError(405, -32e3, "Method not allowed: this server is stateless (POST only)", {
-        allow: "POST"
-      });
-    }
-    if (resolveActor) {
-      let actor;
-      try {
-        actor = await resolveActor(request);
-      } catch (err) {
-        const message = err instanceof GraftError3 ? `${err.message} ${err.fix ?? ""}`.trim() : "Unauthorized";
-        return jsonRpcError(401, -32001, message);
+var registerContentReadTools = (server, deps) => {
+  const { branchId, collections, contentDir, getScope, searchIndex, staticIndexPath } = deps;
+  server.registerTool(
+    "list_content",
+    {
+      title: "List documents in a collection",
+      outputSchema: listContentOutput,
+      annotations: READS,
+      description: "List every document in a collection, read from the authored MDX files (git is the source of truth). Returns slug, sourcePath, and frontmatter data.",
+      inputSchema: {
+        collection: z5.string().describe("Collection name, as returned by list_collections")
       }
-      if (requireActor && actor.kind === "anonymous") {
-        return jsonRpcError(
-          401,
-          -32001,
-          "Unauthorized: this MCP endpoint requires authentication. Send `Authorization: Bearer <token>` from a trusted issuer."
-        );
+    },
+    ({ collection: name }) => guarded(
+      () => {
+        const collection = requireCollection(collections, name);
+        const docs = readCollectionDocs(contentDir, name, collection);
+        return {
+          collection: name,
+          documents: docs.map((doc) => ({
+            slug: doc.slug,
+            sourcePath: doc.sourcePath,
+            data: doc.data
+          }))
+        };
+      },
+      (payload) => payload.documents.map((doc) => documentLink(branchId, name, doc.slug))
+    )
+  );
+  server.registerTool(
+    "get_content",
+    {
+      title: "Get one document",
+      outputSchema: getContentOutput,
+      annotations: READS,
+      description: "Read a single document by collection + slug from the authored MDX files: validated frontmatter data, MDX body, and the file path to edit.",
+      inputSchema: {
+        collection: z5.string().describe("Collection name"),
+        slug: z5.string().describe("Document slug (kebab-case)")
+      }
+    },
+    ({ collection: name, slug }) => guarded(
+      () => {
+        const collection = requireCollection(collections, name);
+        const doc = findDoc(contentDir, name, collection, slug);
+        return {
+          collection: name,
+          slug: doc.slug,
+          sourcePath: doc.sourcePath,
+          data: doc.data,
+          body: doc.body
+        };
+      },
+      // The document's own address, so a client that reached it by search or
+      // by guesswork can pin it as context without constructing the URI.
+      (payload) => [documentLink(branchId, name, payload.slug)]
+    )
+  );
+  server.registerTool(
+    "search_content",
+    {
+      title: "Full-text search across content",
+      outputSchema: searchContentOutput,
+      annotations: READS,
+      description: 'Search authored content by words, "quoted phrases", `or`, and -exclusions (websearch syntax). Searches the branch\'s effective content in the compiled Postgres index \u2014 on a preview branch that includes documents inherited from parent branches, with branch overrides winning \u2014 so results are as fresh as the last compile (write_content compiles automatically); every hit carries the sourcePath of the file to edit. Ranking weights slug matches over frontmatter over body.',
+      inputSchema: {
+        query: z5.string().describe('What to find, e.g. pricing "free tier" -enterprise'),
+        collection: z5.string().optional().describe("Restrict to one collection (default: all registered collections)"),
+        limit: z5.number().optional().describe("Max hits, best-ranked first (default 20)")
       }
-    } else if (requireActor) {
-      return jsonRpcError(
-        401,
-        -32001,
-        "Unauthorized: requireActor is set but no actor resolver is configured \u2014 the server cannot authenticate anyone."
+    },
+    ({ query, collection: name, limit }) => guarded(
+      async () => {
+        if (name !== void 0) requireCollection(collections, name);
+        assertSearchQuery(query);
+        const collectionNames = name === void 0 ? Object.keys(collections) : [name];
+        const chain = staticIndexPath === void 0 ? scopeChain(await getScope()) : [branchId];
+        const hits = await searchIndex({ query, chain, collections: collectionNames, limit });
+        return {
+          branch: branchId,
+          chain,
+          query,
+          hits: hits.map(({ row, rank, snippet }) => ({
+            collection: row.collection,
+            slug: row.slug,
+            sourcePath: row.sourcePath,
+            rank,
+            snippet,
+            data: row.data
+          }))
+        };
+      },
+      // A hit already knows its collection and slug; the link saves the
+      // client a get_content round trip to reach the document itself.
+      (payload) => payload.hits.map((hit) => documentLink(branchId, hit.collection, hit.slug))
+    )
+  );
+};
+var registerContentWriteTools = (server, deps) => {
+  const {
+    branchId,
+    collections,
+    contentDir,
+    elicitApproval,
+    functions,
+    getDeleteHandler,
+    options,
+    projectContent,
+    requireScope
+  } = deps;
+  server.registerTool(
+    "write_content",
+    {
+      title: "Write a document (create or update)",
+      outputSchema: writeContentOutput,
+      annotations: WRITES,
+      description: "Author or update a document: validates the data against the collection schema, writes <contentDir>/<collection>/<slug>.mdx, and compiles the content tree into the database. Returns exactly what changed. Git is the version history: commit the file afterwards if you have the server's checkout; remote callers can't and needn't \u2014 the checkout's operator owns the commit.",
+      inputSchema: {
+        collection: z5.string().describe("Collection name"),
+        slug: z5.string().describe("Document slug \u2014 kebab-case; becomes the filename and the URL segment"),
+        data: z5.record(z5.string(), z5.unknown()).describe("Frontmatter data; must satisfy the collection schema (see describe_schema)"),
+        body: z5.string().optional().describe("MDX body (markdown). Defaults to empty.")
+      }
+    },
+    ({ collection: name, slug, data, body }) => guarded(
+      async () => {
+        requireScope("write_content", "content:write");
+        const collection = requireCollection(collections, name);
+        if (collection.authority === "db-authoritative") {
+          throw new GraftError5({
+            code: "AUTHORITY_MISMATCH",
+            message: `Collection "${name}" is db-authoritative \u2014 its records live in Postgres, not as MDX files.`,
+            fix: `Write this data through the collection's function endpoint (POST /api/fn/<name>, see llms.txt) instead of write_content. write_content is only for file-authoritative collections.`,
+            details: { collection: name, authority: collection.authority }
+          });
+        }
+        const frontmatterSlug = data.slug;
+        if (frontmatterSlug !== void 0 && frontmatterSlug !== slug) {
+          throw new GraftError5({
+            code: "INVALID_SLUG",
+            message: `data.slug ("${String(frontmatterSlug)}") conflicts with the slug argument ("${slug}")`,
+            fix: "Omit `slug` from data \u2014 the slug argument names the file and the document.",
+            details: { slug, frontmatterSlug }
+          });
+        }
+        assertSlugShape(slug, name);
+        const sourcePath = `${name}/${slug}.mdx`;
+        const fullPath = resolveContained2(contentDir, sourcePath, {
+          label: "document path"
+        });
+        assertSafeMdx(body ?? "", { label: `${name}/${slug}` });
+        const existingRaw = existsSync2(fullPath) ? readFileSync3(fullPath, "utf8") : void 0;
+        const raw = composeDocument(existingRaw, data, body ?? "");
+        parseDocument2(raw, collection, sourcePath);
+        assertSlugFree(contentDir, name, collection, slug, sourcePath);
+        writeDocumentFile(contentDir, sourcePath, raw);
+        const result = await projectContent();
+        return {
+          written: sourcePath,
+          branch: branchId,
+          gitSha: result.gitSha,
+          changes: result.changes
+        };
+      },
+      // Where the thing it just wrote now lives.
+      () => [documentLink(branchId, name, slug)]
+    )
+  );
+  server.registerTool(
+    "delete_content",
+    {
+      title: "Delete a document (human-gated)",
+      annotations: DESTROYS,
+      description: "Delete an authored document: removes <contentDir>/<collection>/<slug>.mdx and compiles, so the index soft-deletes it. DESTRUCTIVE and always human-gated \u2014 the first call files an approval and fails with its id; a human decides with `graft approve <id>` (or deny); then retry the SAME collection+slug with `approval: <id>` (the MCP form of the x-graft-approval header). Approvals are one-shot and bound to that exact input. On a server that has opted into elicited approvals AND a client that supports elicitation, you may instead be asked to confirm in-band and the call completes in one step \u2014 the gate is identical, only the way the human is reached differs, so do not treat either outcome as unusual. Git is the version history: commit the deletion afterwards if you have the server's checkout; remote callers can't and needn't \u2014 the checkout's operator owns the commit.",
+      inputSchema: {
+        collection: z5.string().describe("Collection name"),
+        slug: z5.string().describe("Document slug to delete"),
+        approval: z5.string().optional().describe(
+          "Approval id from a prior DESTRUCTIVE_OP_REQUIRES_APPROVAL response, after a human ran `graft approve <id>`."
+        )
+      }
+    },
+    ({ collection: name, slug, approval }) => guarded(async () => {
+      requireScope("delete_content", "content:write");
+      const collection = requireCollection(collections, name);
+      if (collection.authority === "db-authoritative") {
+        throw new GraftError5({
+          code: "AUTHORITY_MISMATCH",
+          message: `Collection "${name}" is db-authoritative \u2014 its records live in Postgres, not as MDX files.`,
+          fix: "Delete records through the collection's typed functions (a destructive defineFunction over deleteRecord \u2014 see list_functions), not delete_content. delete_content is only for file-authoritative collections.",
+          details: { collection: name, authority: collection.authority }
+        });
+      }
+      assertSlugShape(slug, name);
+      findDoc(contentDir, name, collection, slug);
+      const { data, correlationId } = await invokeFunctionWithApproval(
+        getDeleteHandler(),
+        "delete_content",
+        { collection: name, slug },
+        { credential: options.defaultAuthorization, approval },
+        elicitApproval
       );
-    }
-    const server = createGraftMcp({
-      ...serverOptions,
-      actor: resolveActor,
-      defaultAuthorization: request.headers.get("authorization") ?? serverOptions.defaultAuthorization
-    });
+      return { ...data, correlationId };
+    })
+  );
+};
+
+// src/tools/errors.ts
+import { z as z6 } from "zod";
+var registerErrorTools = (server, deps) => {
+  void deps;
+  server.registerTool(
+    "explain_error",
+    {
+      title: "Explain a Graft error",
+      outputSchema: explainErrorOutput,
+      annotations: READS,
+      description: "Given a GraftError code or its JSON, explain what it means, its typical causes, and how to recover. Use whenever a tool call or compile fails.",
+      inputSchema: {
+        code: z6.string().optional().describe("An error code, e.g. SCHEMA_VALIDATION_FAILED"),
+        error: z6.string().optional().describe("A full GraftError JSON string, if you have one")
+      }
+    },
+    ({ code, error }) => guarded(() => {
+      let parsed;
+      if (error) {
+        try {
+          parsed = JSON.parse(error);
+        } catch {
+        }
+      }
+      const effective = code ?? parsed?.error;
+      if (!effective) {
+        return {
+          knownCodes: Object.keys(ERROR_KNOWLEDGE),
+          hint: "Pass `code` or the GraftError JSON as `error`."
+        };
+      }
+      const explanation = explainCode(effective);
+      if (!explanation) {
+        return {
+          code: effective,
+          known: false,
+          knownCodes: Object.keys(ERROR_KNOWLEDGE),
+          hint: "Not a Graft error code. If this came from another system, resolve it there."
+        };
+      }
+      return {
+        ...explanation,
+        // The specific fix from the actual error beats the general recovery advice.
+        specificFix: parsed?.fix,
+        message: parsed?.message
+      };
+    })
+  );
+};
+
+// src/tools/packages.ts
+import { z as z7 } from "zod";
+
+// src/packages.ts
+var PACKAGE_KNOWLEDGE = {
+  "@usegraft/cli": {
+    name: "@usegraft/cli",
+    role: "The `graft` command: init, compile, dev, serve, migrate, merge, add.",
+    when: "Always. It scaffolds the project and compiles content into the index.",
+    tier: "either",
+    direct: true
+  },
+  "@usegraft/sdk-next": {
+    name: "@usegraft/sdk-next",
+    role: "Next.js adapter: typed reads in Server Components, plus route handlers.",
+    when: "You are on Next.js (App Router).",
+    tier: "either",
+    framework: "next",
+    direct: true
+  },
+  "@usegraft/sdk-astro": {
+    name: "@usegraft/sdk-astro",
+    role: "Astro adapter: typed reads in components, plus `graftRoute`.",
+    when: "You are on Astro.",
+    tier: "either",
+    framework: "astro",
+    direct: true
+  },
+  "@usegraft/sdk-sveltekit": {
+    name: "@usegraft/sdk-sveltekit",
+    role: "SvelteKit adapter: typed reads in load functions, plus route handlers.",
+    when: "You are on SvelteKit.",
+    tier: "either",
+    framework: "sveltekit",
+    direct: true
+  },
+  "@usegraft/sdk-react-router": {
+    name: "@usegraft/sdk-react-router",
+    role: "React Router adapter: typed reads in loaders and actions.",
+    when: "You are on React Router in framework mode, which runs a server.",
+    tier: "either",
+    framework: "react-router",
+    direct: true
+  },
+  "@usegraft/sdk-tanstack-start": {
+    name: "@usegraft/sdk-tanstack-start",
+    role: "TanStack Start adapter: typed reads in server functions and loaders.",
+    when: "You are on TanStack Start.",
+    tier: "either",
+    framework: "tanstack-start",
+    direct: true
+  },
+  "@usegraft/sdk-react": {
+    name: "@usegraft/sdk-react",
+    role: "Browser client: typed reads over the content API, with a provider and hooks.",
+    when: "You need reads in the browser \u2014 a search box, an editor preview, a widget on an already-rendered page. No database reaches this package.",
+    tier: "postgres",
+    framework: "react",
+    direct: true
+  },
+  "@usegraft/sdk-core": {
+    name: "@usegraft/sdk-core",
+    role: "The framework-agnostic read client the adapters are built on.",
+    when: "You are on a framework with no adapter, or you want the client directly.",
+    tier: "either",
+    direct: true
+  },
+  "@usegraft/content-api": {
+    name: "@usegraft/content-api",
+    role: "The HTTP content API: a handler to mount, and a reader to consume it.",
+    when: "Something reads content over HTTP rather than in-process \u2014 the browser client, or another service.",
+    tier: "either",
+    direct: true
+  },
+  "@usegraft/mcp": {
+    name: "@usegraft/mcp",
+    role: "The MCP server: authoring, schema introspection, functions and approvals as tools.",
+    when: "You want an agent to read and write content. `graft mcp` and `graft serve` both mount it.",
+    tier: "either",
+    direct: true
+  },
+  "@usegraft/studio": {
+    name: "@usegraft/studio",
+    role: "The editing UI: documents, compiles, commits, branches and approvals.",
+    when: "A human needs to edit without touching the repository.",
+    tier: "postgres",
+    direct: true
+  },
+  "@usegraft/core": {
+    name: "@usegraft/core",
+    role: "defineCollection, defineFunction, the functions handler, and the field primitives.",
+    when: "Always \u2014 it is what graft.config.ts imports to declare a schema.",
+    tier: "either",
+    direct: true
+  },
+  "@usegraft/db": {
+    name: "@usegraft/db",
+    role: "The Postgres schema and Drizzle handle for operational data.",
+    when: "You are on the Postgres tier. Never reaches a browser.",
+    tier: "postgres",
+    direct: true
+  },
+  "@usegraft/auth": {
+    name: "@usegraft/auth",
+    role: "Actor resolution: bearer tokens, OIDC issuers and scopes.",
+    when: "You are authenticating callers to functions, MCP or Studio.",
+    tier: "postgres",
+    direct: true
+  },
+  "@usegraft/assets": {
+    name: "@usegraft/assets",
+    role: "The S3-compatible asset store behind `graft asset put` and `put_asset`.",
+    when: "Documents reference images or files.",
+    tier: "either",
+    direct: true
+  },
+  "@usegraft/compiler": {
+    name: "@usegraft/compiler",
+    role: "Reads authored MDX and projects it into the content index.",
+    when: "Pulled in by the CLI. Install directly only to compile from your own code.",
+    tier: "either",
+    direct: false
+  },
+  "@usegraft/contracts": {
+    name: "@usegraft/contracts",
+    role: "Shared types, error codes and the content-index interface.",
+    when: "A dependency of everything. Install directly only to implement your own index reader.",
+    tier: "either",
+    direct: false
+  },
+  "@usegraft/mdx-safety": {
+    name: "@usegraft/mdx-safety",
+    role: "Refuses executable MDX in authored bodies, per the project's mdxTrust.",
+    when: "Pulled in by the compiler and MCP. Install directly only to check MDX yourself.",
+    tier: "either",
+    direct: false
+  },
+  "@usegraft/content-migrations": {
+    name: "@usegraft/content-migrations",
+    role: "Migrations for authored documents, as opposed to database rows.",
+    when: "A schema change needs existing MDX rewritten.",
+    tier: "either",
+    direct: true
+  },
+  "@usegraft/tokens": {
+    name: "@usegraft/tokens",
+    role: "Graft's design tokens as plain CSS custom properties.",
+    when: "You are restyling Studio, or want a UI that matches it. One CSS import, no JavaScript.",
+    tier: "either",
+    direct: true
+  },
+  "@usegraft/registry": {
+    name: "@usegraft/registry",
+    role: "The owned primitives `graft add` copies into a project.",
+    when: "Pulled in by the CLI. Browse the items with list_registry.",
+    tier: "either",
+    direct: false
+  }
+};
+function allPackages() {
+  return Object.values(PACKAGE_KNOWLEDGE);
+}
+
+// src/tools/packages.ts
+var registerPackageTools = (server, deps) => {
+  void deps;
+  server.registerTool(
+    "list_packages",
+    {
+      title: "List Graft packages",
+      outputSchema: listPackagesOutput,
+      annotations: READS,
+      description: "Which @usegraft/* package to install for a given framework or job: what each one is, when you need it, and which tier it requires. Filter by `framework` when the user is on a known one, or by `tier`. Use this before suggesting an install; use list_registry for copy-in primitives instead.",
+      inputSchema: {
+        framework: z7.enum(["next", "astro", "sveltekit", "react-router", "tanstack-start", "react"]).optional().describe("Only the adapter for this framework, plus the packages every project needs"),
+        tier: z7.enum(["static", "postgres"]).optional().describe("Only packages usable on this tier"),
+        includeIndirect: z7.boolean().optional().describe("Include packages pulled in as dependencies rather than installed directly")
+      }
+    },
+    ({ framework, tier, includeIndirect }) => guarded(() => {
+      let packages = allPackages();
+      if (!includeIndirect) packages = packages.filter((p) => p.direct);
+      if (framework) {
+        packages = packages.filter((p) => p.framework === void 0 || p.framework === framework);
+      }
+      if (tier) packages = packages.filter((p) => p.tier === "either" || p.tier === tier);
+      return { packages: packages.sort((a, b) => a.name.localeCompare(b.name)) };
+    })
+  );
+};
+
+// src/tools/functions.ts
+import { GraftError as GraftError6 } from "@usegraft/contracts";
+import { z as z8 } from "zod";
+var registerFunctionTools = (server, deps) => {
+  const { elicitApproval, functions, functionsByName, getFunctionsHandler, options } = deps;
+  server.registerTool(
+    "run_function",
+    {
+      title: "Run a typed function",
+      annotations: DESTROYS,
+      description: "Invoke a defineFunction by name with a JSON input object. Same pipeline as POST /api/fn/<name>: Zod validation, access rules, rate limits, audit log, and the human gate for destructive ops. The server may already act with a configured identity (graft mcp uses GRAFT_DEV_TOKEN; over HTTP your connection's bearer is forwarded) \u2014 only pass authorization to override it. Pass approval after a human runs `graft approve <id>` for gated calls \u2014 or, where the server has opted into elicited approvals and your client supports elicitation, expect to be asked to confirm in-band and the call completes in one step. The gate is the same either way. Success returns { data, correlationId }; failures are GraftError JSON with a fix.",
+      inputSchema: {
+        name: z8.string().describe("Function name (defineFunction name, not the export key)"),
+        input: z8.record(z8.string(), z8.unknown()).optional().describe("Input fields object; defaults to {}. See describe_function for the schema."),
+        authorization: z8.string().optional().describe(
+          "Bearer token override (with or without the 'Bearer ' prefix). Usually unnecessary \u2014 the server's configured identity applies when omitted."
+        ),
+        approval: z8.string().optional().describe(
+          "Approval id from a prior DESTRUCTIVE_OP_REQUIRES_APPROVAL response (after `graft approve <id>`)."
+        )
+      }
+    },
+    ({ name, input, authorization, approval }) => guarded(async () => {
+      if (functionsByName.size === 0) {
+        throw new GraftError6({
+          code: "FUNCTION_NOT_FOUND",
+          message: "This MCP server has no functions registered.",
+          fix: "Export `functions` from graft.config.ts (defineFunction results, often via mergePrimitives) and restart the MCP server / pass them to createGraftMcp({ functions }).",
+          details: { requested: name, available: [] }
+        });
+      }
+      if (!functionsByName.has(name)) {
+        throw new GraftError6({
+          code: "FUNCTION_NOT_FOUND",
+          message: `No function named "${name}" is registered.`,
+          fix: `Call list_functions and use one of: ${[...functionsByName.keys()].join(", ")}.`,
+          details: { requested: name, available: [...functionsByName.keys()] }
+        });
+      }
+      return invokeFunctionWithApproval(
+        getFunctionsHandler(),
+        name,
+        input ?? {},
+        { credential: authorization ?? options.defaultAuthorization, approval },
+        elicitApproval
+      );
+    })
+  );
+};
+
+// src/tools/introspection.ts
+import { GraftError as GraftError7 } from "@usegraft/contracts";
+import { z as z9 } from "zod";
+var registerCollectionIntrospection = (server, deps) => {
+  const { branchId, collections } = deps;
+  server.registerTool(
+    "list_collections",
+    {
+      title: "List collections",
+      outputSchema: listCollectionsOutput,
+      annotations: READS,
+      description: "List every registered content collection (name, description, authority, field count). Start here to learn what kinds of content this project has.",
+      inputSchema: {}
+    },
+    () => guarded(() => ({
+      branch: branchId,
+      collections: Object.values(collections).map((collection) => {
+        const descriptor = collection.describe();
+        return {
+          name: descriptor.name,
+          description: descriptor.description,
+          authority: descriptor.authority,
+          fields: descriptor.fields.length
+        };
+      })
+    }))
+  );
+};
+var registerFunctionIntrospection = (server, deps) => {
+  const { branchId, collections, functions, functionsByName } = deps;
+  server.registerTool(
+    "describe_schema",
+    {
+      title: "Describe the content schema",
+      outputSchema: describeSchemaOutput,
+      annotations: READS,
+      description: "Full schema introspection: every collection with its typed fields (name, type, optional, description), plus every registered function (kind, args, public/destructive). Documents also accept an optional kebab-case `slug` (defaults to the filename). Prefer list_functions / describe_function when you only need the function surface.",
+      inputSchema: {}
+    },
+    () => guarded(() => {
+      return {
+        collections: Object.values(collections).map((collection) => {
+          const descriptor = collection.describe();
+          return { ...descriptor, fields: descriptor.fields.map(teachAssetFields) };
+        }),
+        functions: [...functionsByName.values()].map((fn) => fn.describe())
+      };
+    })
+  );
+  server.registerTool(
+    "list_functions",
+    {
+      title: "List functions",
+      outputSchema: listFunctionsOutput,
+      annotations: READS,
+      description: "List every registered typed function (name, kind, public, destructive, short description). Use describe_function for the full input schema, then run_function to invoke. Mutations reject anonymous callers unless public: true; destructive functions always require human approval (graft approve).",
+      inputSchema: {}
+    },
+    () => guarded(() => ({
+      branch: branchId,
+      functions: [...functionsByName.values()].map((fn) => {
+        const d = fn.describe();
+        return {
+          name: d.name,
+          kind: d.kind,
+          description: d.description,
+          public: d.public,
+          destructive: d.destructive,
+          args: d.args.length
+        };
+      })
+    }))
+  );
+  server.registerTool(
+    "describe_function",
+    {
+      title: "Describe one function",
+      outputSchema: describeFunctionOutput,
+      annotations: READS,
+      description: "Full introspection for one function: kind, args (name/type/optional/description), returns, public, destructive. Use this before run_function so the input object matches the schema.",
+      inputSchema: {
+        name: z9.string().describe("Function name as returned by list_functions")
+      }
+    },
+    ({ name }) => guarded(() => {
+      const fn = functionsByName.get(name);
+      if (!fn) {
+        throw new GraftError7({
+          code: "FUNCTION_NOT_FOUND",
+          message: `No function named "${name}" is registered.`,
+          fix: `Call list_functions and use one of: ${[...functionsByName.keys()].join(", ") || "(none registered)"}.`,
+          details: { requested: name, available: [...functionsByName.keys()] }
+        });
+      }
+      return fn.describe();
+    })
+  );
+};
+
+// src/approval-elicitation.ts
+import { GraftError as GraftError8 } from "@usegraft/contracts";
+import { decideApproval as decideApproval2 } from "@usegraft/db";
+var INPUT_PREVIEW_LIMIT = 1e3;
+function describeCall(functionName, input) {
+  const rendered = JSON.stringify(input);
+  if (rendered === void 0) return functionName;
+  if (rendered.length <= INPUT_PREVIEW_LIMIT) return `${functionName} ${rendered}`;
+  return [
+    `${functionName} ${rendered.slice(0, INPUT_PREVIEW_LIMIT)}\u2026`,
+    "",
+    `\u26A0\uFE0F Input truncated (${rendered.length} characters). Run \`graft approvals\` to read it in full before deciding \u2014 the approval binds to the whole input, not the part shown here.`
+  ].join("\n");
+}
+function createApprovalElicitor(options) {
+  return async ({ approvalId, functionName, input }) => {
+    if (options.server.server.getClientCapabilities()?.elicitation === void 0) {
+      return void 0;
+    }
+    let result;
+    try {
+      result = await options.server.server.elicitInput({
+        message: [
+          `Approve this destructive call?`,
+          "",
+          describeCall(functionName, input),
+          "",
+          `It will be recorded as decided by ${options.decider.kind}:${options.decider.id}.`,
+          "The approval is one-shot and bound to exactly this input."
+        ].join("\n"),
+        requestedSchema: {
+          type: "object",
+          properties: {
+            approve: {
+              type: "boolean",
+              title: "Approve",
+              description: `Allow ${functionName} to run once, with exactly this input.`
+            }
+          },
+          required: ["approve"]
+        }
+      });
+    } catch {
+      return void 0;
+    }
+    if (result.action === "cancel") return void 0;
+    const approved = result.action === "accept" && result.content?.approve === true;
+    const row = await decideApproval2(
+      options.db(),
+      approvalId,
+      approved ? "approved" : "denied",
+      options.decider
+    );
+    if (!row) {
+      throw new GraftError8({
+        code: "APPROVAL_INVALID",
+        message: `Approval "${approvalId}" was no longer pending when the decision arrived.`,
+        fix: "Someone or something decided it while the prompt was open. Call the tool again to file a fresh approval.",
+        details: { id: approvalId, function: functionName }
+      });
+    }
+    return approved ? approvalId : void 0;
+  };
+}
+
+// src/tools/prompts.ts
+import { z as z10 } from "zod";
+import { completable } from "@modelcontextprotocol/sdk/server/completable.js";
+import { readCollectionDocs as readCollectionDocs2 } from "@usegraft/compiler";
+var say = (text) => ({
+  messages: [{ role: "user", content: { type: "text", text } }]
+});
+var registerContentPrompts = (server, deps) => {
+  const { branchId, collections, contentDir } = deps;
+  const fileCollections = () => Object.values(collections).filter((collection) => collection.describe().authority !== "db-authoritative").map((collection) => collection.describe().name);
+  const migrationSteps = (name) => {
+    if (collections[name]?.describe().authority === "db-authoritative") {
+      return [
+        "This collection is db-authoritative: its records live in Postgres, not as MDX files. `graft compile` has nothing to say about them, and no file will fail to name the work.",
+        "1. Edit the collection in graft.config.ts (or under graft/) to the new shape.",
+        "2. Write `migrations/<seq>-<name>.ts` default-exporting defineDataMigration. It backfills data_records and writes its ledger row in ONE transaction, so a half-applied migration is not a state this can reach.",
+        "3. `graft migrate` is a dry run. `graft migrate --apply` is the operator's consent, and is theirs to give \u2014 propose the command, do not assume it.",
+        "4. Commit. The migration is a reviewable commit, which is the whole reason it is a file rather than a live edit."
+      ];
+    }
+    return [
+      "How migrations work here \u2014 they are code, not a console action:",
+      "1. Edit the collection in graft.config.ts (or under graft/) to the new shape.",
+      "2. `graft compile` now fails, once per document that no longer satisfies the schema. That is the point: the failure names every file to fix.",
+      "3. Write `migrations/<seq>-<name>.ts` default-exporting defineContentMigration. It transforms old-shape frontmatter, validates every output against the NEW schema, and rewrites the files all-or-nothing.",
+      "4. `graft migrate` is a dry run. `graft migrate --apply` is the operator's consent, and is theirs to give \u2014 propose the command, do not assume it.",
+      "5. Compile again, then commit. The migration is a reviewable commit, which is the whole reason it is a file rather than a live edit."
+    ];
+  };
+  const slugsIn = (name) => {
+    const collection = collections[name];
+    if (!collection) return [];
+    try {
+      return readCollectionDocs2(contentDir, name, collection).map((doc) => doc.slug);
+    } catch {
+      return [];
+    }
+  };
+  const fieldLines = (name) => {
+    const collection = collections[name];
+    if (!collection) return "(unknown collection)";
+    return collection.describe().fields.map((field2) => {
+      const optional = field2.optional ? " (optional)" : " (required)";
+      const description = field2.description ? ` \u2014 ${field2.description}` : "";
+      return `- ${field2.name}: ${field2.type}${optional}${description}`;
+    }).join("\n");
+  };
+  const collectionArg = completable(
+    z10.string().describe("Collection name"),
+    (value) => fileCollections().filter((name) => name.startsWith(value))
+  );
+  server.registerPrompt(
+    "author-document",
+    {
+      title: "Author a document",
+      description: "Write a new document into a collection, with that collection's actual field list already filled in.",
+      argsSchema: {
+        collection: collectionArg,
+        topic: z10.string().describe("What the document should be about")
+      }
+    },
+    ({ collection, topic }) => say(
+      [
+        `Author a new document in the "${collection}" collection of this Graft project. Topic: ${topic}`,
+        "",
+        "Frontmatter must satisfy these fields exactly:",
+        fieldLines(collection),
+        "",
+        "How to do it:",
+        "1. Choose a kebab-case slug. It becomes the filename and the URL segment.",
+        "2. Call write_content with the collection, the slug, the frontmatter as `data`, and the MDX body.",
+        "3. write_content validates against the schema and compiles in one step \u2014 a schema failure comes back with a fix, so read it and correct the data rather than retrying unchanged.",
+        "",
+        "Body rules: prose and Markdown. Components are allowed only with literal attributes \u2014 the MDX safety gate refuses `{expressions}` and `import`, because rendering evaluates them as JavaScript on the server.",
+        "",
+        "Git owns the version history. If you are working in the server's checkout, commit the file afterwards; if you are remote, the checkout's operator owns the commit and you do not need to."
+      ].join("\n")
+    )
+  );
+  server.registerPrompt(
+    "revise-document",
+    {
+      title: "Revise a document",
+      description: "Edit an existing document, with its current content and its address already attached.",
+      argsSchema: {
+        collection: collectionArg,
+        slug: completable(z10.string().describe("Document slug"), (value, context) => {
+          const chosen = context?.arguments?.collection;
+          const candidates = chosen ? slugsIn(chosen) : fileCollections().flatMap(slugsIn);
+          return candidates.filter((slug) => slug.startsWith(value));
+        }),
+        goal: z10.string().describe("What should change")
+      }
+    },
+    ({ collection, slug, goal }) => say(
+      [
+        `Revise "${collection}/${slug}" in this Graft project. Goal: ${goal}`,
+        "",
+        `Read it first: ${documentUri(branchId, collection, slug)} (or get_content).`,
+        "",
+        "Frontmatter fields for this collection:",
+        fieldLines(collection),
+        "",
+        "Then call write_content with the same collection and slug. Send the full frontmatter and body, not a patch \u2014 write_content replaces the document.",
+        "",
+        "Change only what the goal asks for. Frontmatter keys you are not changing must come back byte-identical: the writer preserves untouched lines, and a reformatted file is a diff the author has to review for nothing.",
+        "",
+        "If that write comes back SLUG_NOT_UNIQUE, the document is not where write_content would put it \u2014 it is a .md file, or it lives under a different filename and claims this slug in its frontmatter. write_content always targets <collection>/<slug>.mdx, so it cannot edit that file in place. The error names the path that owns the slug; report it rather than writing a second document with the same slug."
+      ].join("\n")
+    )
+  );
+  server.registerPrompt(
+    "fix-error",
+    {
+      title: "Recover from a Graft error",
+      description: "Turn a GraftError into the next action, with this build's recovery text already resolved.",
+      argsSchema: {
+        code: completable(
+          z10.string().describe("The error code, e.g. SCHEMA_VALIDATION_FAILED"),
+          (value) => Object.keys(ERROR_KNOWLEDGE).filter((code) => code.startsWith(value.toUpperCase()))
+        )
+      }
+    },
+    ({ code }) => {
+      const explanation = explainCode(code);
+      if (!explanation) {
+        return say(
+          [
+            `"${code}" is not a Graft error code.`,
+            "",
+            `Call explain_error with no arguments to list the ${Object.keys(ERROR_KNOWLEDGE).length} codes this build knows, or pass the full GraftError JSON as \`error\`.`,
+            "If it came from another system, resolve it there \u2014 Graft has nothing to say about it."
+          ].join("\n")
+        );
+      }
+      return say(
+        [
+          `Recover from ${code} in this Graft project.`,
+          "",
+          `What it means: ${explanation.meaning}`,
+          "",
+          "Usually because:",
+          ...explanation.typicalCauses.map((cause) => `- ${cause}`),
+          "",
+          `How to recover: ${explanation.howToRecover}`,
+          "",
+          "The failing call's own `fix` is more specific than this page and beats it wherever the two differ \u2014 this is the general lesson behind the code, that was the advice for the one failure."
+        ].join("\n")
+      );
+    }
+  );
+  server.registerPrompt(
+    "plan-migration",
+    {
+      title: "Plan a schema migration",
+      description: "Change a collection's shape without breaking the documents already written against it.",
+      argsSchema: {
+        collection: collectionArg,
+        change: z10.string().describe("The schema change, e.g. add a required `description`")
+      }
+    },
+    ({ collection, change }) => say(
+      [
+        `Plan a migration for the "${collection}" collection of this Graft project. Change: ${change}`,
+        "",
+        "Current fields:",
+        fieldLines(collection),
+        "",
+        ...migrationSteps(collection)
+      ].join("\n")
+    )
+  );
+};
+
+// src/tools/registry.ts
+import { describeItem, listItems, loadItem } from "@usegraft/registry";
+import { z as z11 } from "zod";
+var registerRegistryTools = (server, deps) => {
+  const { options } = deps;
+  server.registerTool(
+    "list_registry",
+    {
+      title: "List registry items",
+      outputSchema: listRegistryOutput,
+      annotations: READS,
+      description: "List every owned primitive available to `graft add` \u2014 shadcn-style copy-in blocks / fields / access rules / bundles (name, type, one-line description, and any registry items it pulls in). Use describe_item for the full details, then install with `graft add <name>` from the CLI. MCP browses what exists; the CLI installs it.",
+      inputSchema: {}
+    },
+    () => guarded(() => ({
+      items: listItems(options.registryRoot).map((item) => ({
+        name: item.name,
+        type: item.type,
+        description: item.description,
+        registryDependencies: item.registryDependencies
+      }))
+    }))
+  );
+  server.registerTool(
+    "describe_item",
+    {
+      title: "Describe a registry item",
+      outputSchema: describeItemOutput,
+      annotations: READS,
+      description: "Full details for one owned primitive: type, description, the files it writes into the project, npm dependencies to install, the registry items it pulls in first, and whether it ships an llms.txt fragment. Use list_registry for names; install with `graft add <name>` (CLI). MCP does not install.",
+      inputSchema: {
+        name: z11.string().describe("Item name as returned by list_registry")
+      }
+    },
+    ({ name }) => guarded(() => describeItem(loadItem(name, options.registryRoot)))
+  );
+};
+
+// src/tools/resources.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { GraftError as GraftError9 } from "@usegraft/contracts";
+import { readCollectionDocs as readCollectionDocs3, resolveContained as resolveContained3 } from "@usegraft/compiler";
+import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
+var isFileAuthoritative = (authority) => authority !== "db-authoritative";
+var asString = (value) => typeof value === "string" && value !== "" ? value : void 0;
+var registerDocumentResources = (server, deps) => {
+  const { branchId, collections, contentDir } = deps;
+  const fileCollections = () => Object.values(collections).filter((collection) => isFileAuthoritative(collection.describe().authority)).map((collection) => collection.describe().name);
+  const allDocuments = () => {
+    const out = [];
+    for (const name of fileCollections()) {
+      try {
+        for (const doc of readCollectionDocs3(contentDir, name, collections[name])) {
+          out.push({
+            collection: name,
+            slug: doc.slug,
+            sourcePath: doc.sourcePath,
+            title: asString(doc.data.title),
+            description: asString(doc.data.description)
+          });
+        }
+      } catch {
+      }
+    }
+    return out;
+  };
+  server.registerResource(
+    "document",
+    new ResourceTemplate(documentUriTemplate(branchId), {
+      list: () => ({
+        resources: allDocuments().map((doc) => ({
+          uri: documentUri(branchId, doc.collection, doc.slug),
+          name: `${doc.collection}/${doc.slug}`,
+          title: doc.title ?? doc.slug,
+          description: doc.description ?? `Authored MDX at ${doc.sourcePath}`,
+          mimeType: "text/markdown"
+        }))
+      }),
+      // The URI variables autocomplete from what actually exists, and the slug
+      // list narrows to the collection already chosen — the context carries the
+      // variables filled in so far.
+      complete: {
+        collection: (value) => fileCollections().filter((name) => name.startsWith(value)),
+        slug: (value, context) => {
+          const chosen = context?.arguments?.collection;
+          return allDocuments().filter((doc) => chosen === void 0 || doc.collection === chosen).map((doc) => doc.slug).filter((slug) => slug.startsWith(value));
+        }
+      }
+    }),
+    {
+      title: "Authored document",
+      description: "One MDX document as authored, frontmatter and body, read from the content directory rather than the index \u2014 so it reflects the working tree, not the last compile. Attach it as context; edit it with write_content.",
+      mimeType: "text/markdown"
+    },
+    (uri, variables) => guardedResource(() => {
+      const collectionName = String(variables.collection);
+      const slug = String(variables.slug);
+      const collection = requireCollection(collections, collectionName);
+      if (!isFileAuthoritative(collection.describe().authority)) {
+        throw new GraftError9({
+          code: "AUTHORITY_MISMATCH",
+          message: `Collection "${collectionName}" is db-authoritative \u2014 its records live in Postgres, not as MDX files, so they have no document resource.`,
+          fix: "Read these through the collection's typed functions (see list_functions), not as a resource.",
+          details: { collection: collectionName, authority: collection.describe().authority }
+        });
+      }
+      const docs = readCollectionDocs3(contentDir, collectionName, collection);
+      const doc = docs.find((candidate) => candidate.slug === slug);
+      if (!doc) {
+        throw new GraftError9({
+          code: "DOCUMENT_NOT_FOUND",
+          message: `No document "${slug}" in collection "${collectionName}".`,
+          fix: `Known slugs: ${docs.map((d) => d.slug).join(", ") || "(none)"}. List the document resources, or author it with write_content.`,
+          details: { collection: collectionName, slug }
+        });
+      }
+      return {
+        contents: [
+          {
+            uri: uri.href,
+            mimeType: "text/markdown",
+            // Contained rather than joined: the scan that produced
+            // sourcePath happily lists a symlink, and this mount can be the
+            // unauthenticated docs server, where following one would serve
+            // bytes from outside the content tree to anybody who asks.
+            text: readFileSync4(
+              resolveContained3(contentDir, doc.sourcePath, { label: "document source" }),
+              "utf8"
+            )
+          }
+        ]
+      };
+    })
+  );
+};
+var registerSchemaResource = (server, deps) => {
+  const { branchId, collections, functionsByName } = deps;
+  server.registerResource(
+    "schema",
+    schemaUri(branchId),
+    {
+      title: "Project schema",
+      description: "Every collection with its typed fields, and every registered function \u2014 the same payload as describe_schema. Attach it once instead of calling the tool each time.",
+      mimeType: "application/json"
+    },
+    (uri) => {
+      const description = {
+        collections: Object.values(collections).map((collection) => {
+          const descriptor = collection.describe();
+          return { ...descriptor, fields: descriptor.fields.map(teachAssetFields) };
+        }),
+        functions: [...functionsByName.values()].map((fn) => fn.describe())
+      };
+      return {
+        contents: [
+          {
+            uri: uri.href,
+            mimeType: "application/json",
+            text: JSON.stringify(description, null, 2)
+          }
+        ]
+      };
+    }
+  );
+};
+
+// src/server.ts
+function buildServer(options, register) {
+  const { contentDir, collections } = options;
+  const branchId = options.branchId ?? "main";
+  const staticIndexPath = options.db === void 0 ? options.staticIndexPath : void 0;
+  const maybeDb = options.db;
+  if (maybeDb === void 0 && staticIndexPath === void 0) {
+    throw new GraftError10({
+      code: "CONFIG_INVALID",
+      message: "createGraftMcp needs an index: pass `db` (Postgres) or `staticIndexPath`.",
+      fix: "Pass `db` from createDb(DATABASE_URL), or `staticIndexPath` pointing at the compiled artifact (.graft/index.db) for a static project."
+    });
+  }
+  const requireDb = (feature, insteadDo) => {
+    if (maybeDb !== void 0) return maybeDb;
+    throw new GraftError10({
+      code: "NEEDS_DATABASE",
+      message: `${feature} needs the Postgres index; this project serves a static index (${staticIndexPath}).`,
+      fix: `${insteadDo} To move this project to the Postgres tier: set DATABASE_URL, change graft.config to \`export const index = "postgres"\`, run \`graft db migrate\`, then \`graft compile\`.`,
+      details: { feature, index: "static" }
+    });
+  };
+  const requireScope = (tool, scope) => {
+    const actor = options.connectionActor;
+    if (actor === void 0) {
+      if (options.actor === void 0) return;
+      throw new GraftError10({
+        code: "CONFIG_INVALID",
+        message: `${tool} cannot be authorized: this server has an actor resolver but was given no connectionActor.`,
+        fix: "Pass `connectionActor` alongside `actor` when building the server \u2014 createGraftMcpHandler does this for you from the bearer it verified. Without it every scope check passes and write tools are ungated.",
+        details: { tool, required: scope }
+      });
+    }
+    if (actor.kind === "anonymous") return;
+    if ((actor.scopes ?? []).includes(scope)) return;
+    throw new GraftError10({
+      code: "UNAUTHORIZED",
+      message: `${tool} requires the "${scope}" scope, and this credential does not carry it.`,
+      fix: `Mint a token whose scope claim includes "${scope}" (for \`graft serve\`, add it to GRAFT_DEV_SCOPES). Content authoring, asset upload and approval decisions are deliberately separate from ordinary read scopes.`,
+      details: { tool, required: scope, held: actor.scopes ?? [] }
+    });
+  };
+  const requireDecider = () => {
+    const actor = options.connectionActor;
+    if (actor === void 0 || actor.kind === "anonymous" || !actor.id) {
+      throw new GraftError10({
+        code: "UNAUTHORIZED",
+        message: "decide_approval needs to know who is deciding, and this connection is not authenticated as anyone.",
+        fix: "Connect with `Authorization: Bearer <token>` from a trusted issuer (or set GRAFT_DEV_TOKEN for `graft mcp`). Deciding anonymously would make the requester-cannot-decide check meaningless, so it is refused rather than attributed to a placeholder.",
+        details: { tool: "decide_approval", actor: actor?.kind ?? "anonymous" }
+      });
+    }
+    return { kind: actor.kind, id: actor.id };
+  };
+  const projectContent = async () => staticIndexPath === void 0 ? compile({
+    contentDir,
+    collections,
+    db: requireDb("compile", ""),
+    branchId,
+    mdxTrust: options.mdxTrust
+  }) : compileStatic({
+    contentDir,
+    collections,
+    indexPath: staticIndexPath,
+    mdxTrust: options.mdxTrust
+  });
+  const searchIndex = async (query) => {
+    if (staticIndexPath === void 0) {
+      return searchContent(requireDb("search_content", ""), query);
+    }
+    const index = await openStaticIndex(staticIndexPath);
+    try {
+      return await index.searchContent({
+        query: query.query,
+        collections: query.collections,
+        limit: query.limit
+      });
+    } finally {
+      await index.close();
+    }
+  };
+  const functions = options.functions ?? {};
+  const functionsByName = /* @__PURE__ */ new Map();
+  for (const fn of Object.values(functions)) functionsByName.set(fn.name, fn);
+  let scopePromise;
+  const getScope = () => {
+    scopePromise ??= options.scope ? Promise.resolve(options.scope) : resolveBranchScope(requireDb("Branch scope resolution", ""), branchId);
+    return scopePromise;
+  };
+  let functionsHandler;
+  const getFunctionsHandler = () => {
+    functionsHandler ??= createFunctionsHandler({
+      functions,
+      db: requireDb(
+        "run_function",
+        "Typed functions read and write operational data in Postgres, so a static project has none."
+      ),
+      branch: branchId,
+      actor: options.actor,
+      approvalPolicy: options.approvalPolicy,
+      rateLimit: options.rateLimit,
+      gitSha: options.gitSha,
+      audit: options.audit,
+      approvals: options.approvals
+    });
+    return functionsHandler;
+  };
+  const deleteContentFn = defineFunction({
+    name: "delete_content",
+    kind: "mutation",
+    destructive: true,
+    public: true,
+    description: "Delete an authored MDX document and recompile (MCP delete_content tool).",
+    returns: "{ deleted, branch, gitSha, changes }",
+    input: {
+      collection: field.string({ description: "Collection name" }),
+      slug: field.string({ description: "Document slug to delete" })
+    },
+    handler: async ({ input }) => {
+      const collection = requireCollection(collections, input.collection);
+      const doc = findDoc(contentDir, input.collection, collection, input.slug);
+      unlinkSync(resolveContained4(contentDir, doc.sourcePath, { label: "document path" }));
+      const result = await projectContent();
+      return {
+        deleted: doc.sourcePath,
+        branch: branchId,
+        gitSha: result.gitSha,
+        changes: result.changes
+      };
+    }
+  });
+  let deleteHandler;
+  const getDeleteHandler = () => {
+    deleteHandler ??= createFunctionsHandler({
+      // The one-shot, input-bound human approval lives in Postgres. Rather than
+      // silently downgrading to an ungated delete, a static project is told to
+      // do it the way git already makes safe: delete the file and recompile.
+      db: requireDb(
+        "delete_content",
+        "Its human approval gate is a Postgres table, and dropping the gate would make the delete ungated. In a static project, delete the file and recompile \u2014 git is authoritative, so the file IS the document and git history is the undo."
+      ),
+      functions: { delete_content: deleteContentFn },
+      branch: branchId,
+      actor: options.actor,
+      rateLimit: options.rateLimit,
+      gitSha: options.gitSha,
+      audit: options.audit,
+      approvals: options.approvals
+    });
+    return deleteHandler;
+  };
+  let storagePromise;
+  const getStorage = () => {
+    storagePromise ??= (async () => {
+      if (options.storage) {
+        return typeof options.storage === "function" ? options.storage() : options.storage;
+      }
+      try {
+        return createStorage(storageConfigFromEnv());
+      } catch (error) {
+        throw new GraftError10({
+          code: "ENV_VAR_MISSING",
+          message: error instanceof Error ? error.message : String(error),
+          fix: "Set S3_ENDPOINT, S3_ACCESS_KEY, S3_SECRET_KEY, and S3_BUCKET in the MCP server's environment (.env), then retry.",
+          details: { variables: ["S3_ENDPOINT", "S3_ACCESS_KEY", "S3_SECRET_KEY", "S3_BUCKET"] }
+        });
+      }
+    })();
+    return storagePromise;
+  };
+  const server = new McpServer({
+    name: options.name ?? "graft",
+    version: options.version ?? "0.0.0"
+  });
+  const deps = {
+    options,
+    contentDir,
+    collections,
+    branchId,
+    staticIndexPath,
+    requireDb,
+    requireScope,
+    requireDecider,
+    projectContent,
+    searchIndex,
+    getScope,
+    functions,
+    functionsByName,
+    getFunctionsHandler,
+    getDeleteHandler,
+    getStorage,
+    // Absent unless the mount opted in. The default stays the out-of-band
+    // flow, which is the one a remote agent with no human attached must get.
+    elicitApproval: options.approvalElicitation ? createApprovalElicitor({
+      server,
+      db: () => requireDb(
+        "approval elicitation",
+        "Approvals gate destructive operations on operational data, which a static project does not have."
+      ),
+      decider: options.approvalElicitation.decider
+    }) : void 0
+  };
+  register(server, deps);
+  return server;
+}
+var FULL_SURFACE = (server, deps) => {
+  registerCollectionIntrospection(server, deps);
+  registerFunctionIntrospection(server, deps);
+  registerFunctionTools(server, deps);
+  registerRegistryTools(server, deps);
+  registerContentReadTools(server, deps);
+  registerContentWriteTools(server, deps);
+  registerAssetTools(server, deps);
+  registerBranchTools(server, deps);
+  registerApprovalTools(server, deps);
+  registerErrorTools(server, deps);
+  registerPackageTools(server, deps);
+  registerDocumentResources(server, deps);
+  registerSchemaResource(server, deps);
+  registerContentPrompts(server, deps);
+};
+var DOCS_SURFACE = (server, deps) => {
+  registerCollectionIntrospection(server, deps);
+  registerContentReadTools(server, deps);
+  registerErrorTools(server, deps);
+  registerPackageTools(server, deps);
+  registerDocumentResources(server, deps);
+};
+function createGraftMcp(options) {
+  return buildServer(options, FULL_SURFACE);
+}
+function createDocsMcp(options) {
+  return buildServer({ ...options, functions: void 0 }, DOCS_SURFACE);
+}
+
+// src/http.ts
+import { GraftError as GraftError11 } from "@usegraft/contracts";
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+function jsonRpcError(status, code, message, headers) {
+  return Response.json({ jsonrpc: "2.0", error: { code, message }, id: null }, { status, headers });
+}
+function createGraftMcpHandler(options) {
+  const { actor: resolveActor, allowAnonymous, ...serverOptions } = options;
+  if (resolveActor === void 0 && allowAnonymous !== true) {
+    throw new GraftError11({
+      code: "CONFIG_INVALID",
+      message: "createGraftMcpHandler was given no way to authenticate callers, and this endpoint serves content writes, asset uploads and approval decisions.",
+      fix: "Pass `actor` \u2014 the @usegraft/auth `createActorResolver` seam, the same one the functions route uses. For a local dev server with no auth at all, pass `allowAnonymous: true` explicitly; never do that on anything reachable from a network."
+    });
+  }
+  if (serverOptions.approvalElicitation !== void 0) {
+    throw new GraftError11({
+      code: "CONFIG_INVALID",
+      message: "createGraftMcpHandler cannot use `approvalElicitation`: over HTTP the client being asked to approve is the agent that made the call.",
+      fix: "Drop `approvalElicitation` from this handler. Approvals over HTTP go through the out-of-band path \u2014 the call returns DESTRUCTIVE_OP_REQUIRES_APPROVAL with an id, a human runs `graft approve <id>`, and the caller retries with it. Elicitation is for a stdio server (`createGraftMcp` / `graft mcp --elicit-approvals`) whose operator is at the machine."
+    });
+  }
+  return async (request) => {
+    if (request.method !== "POST") {
+      return jsonRpcError(405, -32e3, "Method not allowed: this server is stateless (POST only)", {
+        allow: "POST"
+      });
+    }
+    let actor;
+    if (resolveActor) {
+      try {
+        actor = await resolveActor(request);
+      } catch (err) {
+        const message = err instanceof GraftError11 ? `${err.message} ${err.fix ?? ""}`.trim() : "Unauthorized";
+        return jsonRpcError(401, -32001, message);
+      }
+      if (allowAnonymous !== true && actor.kind === "anonymous") {
+        return jsonRpcError(
+          401,
+          -32001,
+          "Unauthorized: this MCP endpoint requires authentication. Send `Authorization: Bearer <token>` from a trusted issuer."
+        );
+      }
+    }
+    const server = createGraftMcp({
+      ...serverOptions,
+      actor: resolveActor,
+      // Tools that need to know WHO is calling (rather than forward a
+      // credential) read this. It is the same identity the check above just
+      // verified, so a tool can never be told a different one.
+      ...actor === void 0 ? {} : { connectionActor: actor },
+      defaultAuthorization: request.headers.get("authorization") ?? serverOptions.defaultAuthorization
+    });
+    const transport = new WebStandardStreamableHTTPServerTransport({
+      sessionIdGenerator: void 0,
+      enableJsonResponse: true
+    });
+    try {
+      await server.connect(transport);
+      return await transport.handleRequest(request);
+    } finally {
+      void server.close().catch(() => void 0);
+    }
+  };
+}
+function createDocsMcpHandler(options) {
+  return async (request) => {
+    if (request.method !== "POST") {
+      return jsonRpcError(405, -32e3, "Method not allowed: this server is stateless (POST only)", {
+        allow: "POST"
+      });
+    }
+    const server = createDocsMcp(options);
     const transport = new WebStandardStreamableHTTPServerTransport({
       sessionIdGenerator: void 0,
       enableJsonResponse: true
@@ -1350,6 +2407,8 @@ async function serveStdio(server) {
 }
 export {
   ERROR_KNOWLEDGE,
+  createDocsMcp,
+  createDocsMcpHandler,
   createGraftMcp,
   createGraftMcpHandler,
   explainCode,