@usestratus/mcp-aws 0.1.0

package/dist/disclosure/search.d.ts

@@ -0,0 +1,15 @@
+import type { ToolConfig } from "../types.js";
+export type SearchResult = {
+    name: string;
+    description: string;
+    score: number;
+    tags: string[];
+};
+export declare class SearchIndex {
+    private readonly entries;
+    private readonly docFrequencies;
+    private avgDocLength;
+    build(tools: ToolConfig[]): void;
+    search(query: string, maxResults?: number): SearchResult[];
+}
+//# sourceMappingURL=search.d.ts.map

package/dist/disclosure/search.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../src/disclosure/search.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CACf,CAAC;AAmBF,qBAAa,WAAW;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6B;IAC5D,OAAO,CAAC,YAAY,CAAK;IAEzB,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI;IAmChC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,SAAK,GAAG,YAAY,EAAE;CAsCtD"}

package/dist/disclosure/search.js

@@ -0,0 +1,73 @@
+function tokenize(text) {
+    return text
+        .toLowerCase()
+        .replace(/[^a-z0-9\s]/g, " ")
+        .split(/\s+/)
+        .filter((t) => t.length > 1);
+}
+export class SearchIndex {
+    entries = [];
+    docFrequencies = new Map();
+    avgDocLength = 0;
+    build(tools) {
+        this.entries.length = 0;
+        this.docFrequencies.clear();
+        for (const tool of tools) {
+            const parts = [tool.name, tool.description, ...(tool.tags ?? [])];
+            const terms = tokenize(parts.join(" "));
+            const tf = new Map();
+            for (const term of terms) {
+                tf.set(term, (tf.get(term) ?? 0) + 1);
+            }
+            this.entries.push({
+                name: tool.name,
+                description: tool.description,
+                tags: tool.tags ?? [],
+                terms,
+                termFrequencies: tf,
+                length: terms.length,
+            });
+            const seen = new Set();
+            for (const term of terms) {
+                if (!seen.has(term)) {
+                    seen.add(term);
+                    this.docFrequencies.set(term, (this.docFrequencies.get(term) ?? 0) + 1);
+                }
+            }
+        }
+        const total = this.entries.reduce((sum, e) => sum + e.length, 0);
+        this.avgDocLength = this.entries.length > 0 ? total / this.entries.length : 0;
+    }
+    search(query, maxResults = 10) {
+        const queryTerms = tokenize(query);
+        if (queryTerms.length === 0 || this.entries.length === 0)
+            return [];
+        const n = this.entries.length;
+        const k1 = 1.5;
+        const b = 0.75;
+        const scored = [];
+        for (const entry of this.entries) {
+            let score = 0;
+            for (const term of queryTerms) {
+                const tf = entry.termFrequencies.get(term) ?? 0;
+                if (tf === 0)
+                    continue;
+                const df = this.docFrequencies.get(term) ?? 0;
+                const idf = Math.log((n - df + 0.5) / (df + 0.5) + 1);
+                const tfNorm = (tf * (k1 + 1)) / (tf + k1 * (1 - b + (b * entry.length) / this.avgDocLength));
+                score += idf * tfNorm;
+            }
+            if (score > 0) {
+                scored.push({ entry, score });
+            }
+        }
+        scored.sort((a, b) => b.score - a.score);
+        return scored.slice(0, maxResults).map((s) => ({
+            name: s.entry.name,
+            description: s.entry.description,
+            score: s.score,
+            tags: s.entry.tags,
+        }));
+    }
+}
+//# sourceMappingURL=search.js.map

package/dist/disclosure/search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.js","sourceRoot":"","sources":["../../src/disclosure/search.ts"],"names":[],"mappings":"AAkBA,SAAS,QAAQ,CAAC,IAAY;IAC7B,OAAO,IAAI;SACT,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,OAAO,WAAW;IACN,OAAO,GAAiB,EAAE,CAAC;IAC3B,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpD,YAAY,GAAG,CAAC,CAAC;IAEzB,KAAK,CAAC,KAAmB;QACxB,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAE5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAExC,MAAM,EAAE,GAAG,IAAI,GAAG,EAAkB,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1B,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACvC,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;gBACrB,KAAK;gBACL,eAAe,EAAE,EAAE;gBACnB,MAAM,EAAE,KAAK,CAAC,MAAM;aACpB,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACf,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzE,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,CAAC,KAAa,EAAE,UAAU,GAAG,EAAE;QACpC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEpE,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9B,MAAM,EAAE,GAAG,GAAG,CAAC;QACf,MAAM,CAAC,GAAG,IAAI,CAAC;QAEf,MAAM,MAAM,GAA2C,EAAE,CAAC;QAE1D,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;gBAC/B,MAAM,EAAE,GAAG,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChD,IAAI,EAAE,KAAK,CAAC;oBAAE,SAAS;gBAEvB,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;gBAEtD,MAAM,MAAM,GACX,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;gBAChF,KAAK,IAAI,GAAG,GAAG,MAAM,CAAC;YACvB,CAAC;YAED,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/B,CAAC;QACF,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAEzC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI;YAClB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW;YAChC,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI;SAClB,CAAC,CAAC,CAAC;IACL,CAAC;CACD"}

package/dist/disclosure/tier.d.ts

@@ -0,0 +1,16 @@
+import type { McpSession, ToolConfig } from "../types.js";
+/**
+ * Returns tools visible to this session based on tier and promotions.
+ */
+export declare function getVisibleTools(allTools: Map<string, ToolConfig>, session: McpSession): ToolConfig[];
+/**
+ * Promotes a tool to the session's visible set.
+ * Returns true if the tool was newly promoted.
+ */
+export declare function promoteToVisible(session: McpSession, toolName: string): boolean;
+/**
+ * Unlocks a gate and promotes hidden tools whose gate depends on it.
+ * Returns the names of newly promoted tools.
+ */
+export declare function handleGateUnlock(allTools: Map<string, ToolConfig>, session: McpSession, gateName: string): string[];
+//# sourceMappingURL=tier.d.ts.map

package/dist/disclosure/tier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tier.d.ts","sourceRoot":"","sources":["../../src/disclosure/tier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE1D;;GAEG;AACH,wBAAgB,eAAe,CAC9B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,OAAO,EAAE,UAAU,GACjB,UAAU,EAAE,CAQd;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI/E;AAmCD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC/B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,OAAO,EAAE,UAAU,EACnB,QAAQ,EAAE,MAAM,GACd,MAAM,EAAE,CAcV"}

package/dist/disclosure/tier.js

@@ -0,0 +1,69 @@
+/**
+ * Returns tools visible to this session based on tier and promotions.
+ */
+export function getVisibleTools(allTools, session) {
+    const results = [];
+    for (const tool of allTools.values()) {
+        if (tool.tier === "always" || session.visibleTools.has(tool.name)) {
+            results.push(tool);
+        }
+    }
+    return results;
+}
+/**
+ * Promotes a tool to the session's visible set.
+ * Returns true if the tool was newly promoted.
+ */
+export function promoteToVisible(session, toolName) {
+    if (session.visibleTools.has(toolName))
+        return false;
+    session.visibleTools.add(toolName);
+    return true;
+}
+/**
+ * Check if a tool's gate is (or wraps) a `requires()` gate matching the given name.
+ * We detect this by calling the gate with the prerequisite in `unlockedGates` and without.
+ * If the gate passes with it and fails without it, the gate depends on this prerequisite.
+ */
+function gateMatchesPrerequisite(tool, gateName) {
+    if (!tool.gate)
+        return false;
+    // Synchronous heuristic: call the gate with and without the prerequisite.
+    // requires() gates are synchronous, so this works for the common case.
+    const baseCtx = {
+        auth: { authenticated: false, roles: [], claims: {} },
+        toolName: tool.name,
+        sessionId: "check",
+        metadata: { unlockedGates: new Set() },
+    };
+    const withCtx = {
+        ...baseCtx,
+        metadata: { unlockedGates: new Set([gateName]) },
+    };
+    const withoutResult = tool.gate(baseCtx);
+    const withResult = tool.gate(withCtx);
+    // Both should be synchronous GateResult for requires() gates
+    if (withoutResult instanceof Promise || withResult instanceof Promise) {
+        // Async gates can't be checked synchronously — default to deny (don't promote)
+        return false;
+    }
+    return !withoutResult.allowed && withResult.allowed;
+}
+/**
+ * Unlocks a gate and promotes hidden tools whose gate depends on it.
+ * Returns the names of newly promoted tools.
+ */
+export function handleGateUnlock(allTools, session, gateName) {
+    session.unlockedGates.add(gateName);
+    const promoted = [];
+    for (const tool of allTools.values()) {
+        if (tool.tier === "hidden" && !session.visibleTools.has(tool.name)) {
+            if (gateMatchesPrerequisite(tool, gateName)) {
+                session.visibleTools.add(tool.name);
+                promoted.push(tool.name);
+            }
+        }
+    }
+    return promoted;
+}
+//# sourceMappingURL=tier.js.map

package/dist/disclosure/tier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tier.js","sourceRoot":"","sources":["../../src/disclosure/tier.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,UAAU,eAAe,CAC9B,QAAiC,EACjC,OAAmB;IAEnB,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAmB,EAAE,QAAgB;IACrE,IAAI,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,IAAgB,EAAE,QAAgB;IAClE,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAE7B,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,OAAO,GAAG;QACf,IAAI,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,EAAc,EAAE,MAAM,EAAE,EAAE,EAAE;QACjE,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,GAAG,EAAU,EAAE;KAC9C,CAAC;IACF,MAAM,OAAO,GAAG;QACf,GAAG,OAAO;QACV,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE;KAChD,CAAC;IAEF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEtC,6DAA6D;IAC7D,IAAI,aAAa,YAAY,OAAO,IAAI,UAAU,YAAY,OAAO,EAAE,CAAC;QACvE,+EAA+E;QAC/E,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC/B,QAAiC,EACjC,OAAmB,EACnB,QAAgB;IAEhB,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpE,IAAI,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC7C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,34 @@
+import type { Gate } from "./types.js";
+export declare class McpAwsError extends Error {
+    constructor(message: string);
+}
+export declare class GateDeniedError extends McpAwsError {
+    readonly toolName: string;
+    readonly reason: string;
+    readonly hint?: string;
+    readonly gate?: Gate;
+    constructor(opts: {
+        toolName: string;
+        reason: string;
+        hint?: string;
+        gate?: Gate;
+    });
+}
+export declare class AuthenticationError extends McpAwsError {
+    constructor(message: string);
+}
+export declare class SessionNotFoundError extends McpAwsError {
+    readonly sessionId: string;
+    constructor(sessionId: string);
+}
+export declare class ToolExecutionError extends McpAwsError {
+    readonly toolName: string;
+    readonly cause: unknown;
+    constructor(toolName: string, cause: unknown);
+}
+export declare class ToolTimeoutError extends McpAwsError {
+    readonly toolName: string;
+    readonly timeoutMs: number;
+    constructor(toolName: string, timeoutMs: number);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,qBAAa,WAAY,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI3B;AAED,qBAAa,eAAgB,SAAQ,WAAW;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;gBAET,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,CAAA;KAAE;CAQlF;AAED,qBAAa,mBAAoB,SAAQ,WAAW;gBACvC,OAAO,EAAE,MAAM;CAI3B;AAED,qBAAa,oBAAqB,SAAQ,WAAW;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,SAAS,EAAE,MAAM;CAK7B;AAED,qBAAa,kBAAmB,SAAQ,WAAW;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,SAAkB,KAAK,EAAE,OAAO,CAAC;gBAErB,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAO5C;AAED,qBAAa,gBAAiB,SAAQ,WAAW;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAM/C"}

package/dist/errors.js

@@ -0,0 +1,56 @@
+export class McpAwsError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "McpAwsError";
+    }
+}
+export class GateDeniedError extends McpAwsError {
+    toolName;
+    reason;
+    hint;
+    gate;
+    constructor(opts) {
+        super(`Gate denied for tool "${opts.toolName}": ${opts.reason}`);
+        this.name = "GateDeniedError";
+        this.toolName = opts.toolName;
+        this.reason = opts.reason;
+        this.hint = opts.hint;
+        this.gate = opts.gate;
+    }
+}
+export class AuthenticationError extends McpAwsError {
+    constructor(message) {
+        super(message);
+        this.name = "AuthenticationError";
+    }
+}
+export class SessionNotFoundError extends McpAwsError {
+    sessionId;
+    constructor(sessionId) {
+        super(`Session not found: ${sessionId}`);
+        this.name = "SessionNotFoundError";
+        this.sessionId = sessionId;
+    }
+}
+export class ToolExecutionError extends McpAwsError {
+    toolName;
+    cause;
+    constructor(toolName, cause) {
+        const message = cause instanceof Error ? cause.message : String(cause);
+        super(`Tool "${toolName}" execution failed: ${message}`);
+        this.name = "ToolExecutionError";
+        this.toolName = toolName;
+        this.cause = cause;
+    }
+}
+export class ToolTimeoutError extends McpAwsError {
+    toolName;
+    timeoutMs;
+    constructor(toolName, timeoutMs) {
+        super(`Tool "${toolName}" timed out after ${timeoutMs}ms`);
+        this.name = "ToolTimeoutError";
+        this.toolName = toolName;
+        this.timeoutMs = timeoutMs;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,WAAY,SAAQ,KAAK;IACrC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC3B,CAAC;CACD;AAED,MAAM,OAAO,eAAgB,SAAQ,WAAW;IACtC,QAAQ,CAAS;IACjB,MAAM,CAAS;IACf,IAAI,CAAU;IACd,IAAI,CAAQ;IAErB,YAAY,IAAsE;QACjF,KAAK,CAAC,yBAAyB,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,CAAC;CACD;AAED,MAAM,OAAO,mBAAoB,SAAQ,WAAW;IACnD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;CACD;AAED,MAAM,OAAO,oBAAqB,SAAQ,WAAW;IAC3C,SAAS,CAAS;IAE3B,YAAY,SAAiB;QAC5B,KAAK,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC5B,CAAC;CACD;AAED,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACzC,QAAQ,CAAS;IACR,KAAK,CAAU;IAEjC,YAAY,QAAgB,EAAE,KAAc;QAC3C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,KAAK,CAAC,SAAS,QAAQ,uBAAuB,OAAO,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,CAAC;CACD;AAED,MAAM,OAAO,gBAAiB,SAAQ,WAAW;IACvC,QAAQ,CAAS;IACjB,SAAS,CAAS;IAE3B,YAAY,QAAgB,EAAE,SAAiB;QAC9C,KAAK,CAAC,SAAS,QAAQ,qBAAqB,SAAS,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC5B,CAAC;CACD"}

package/dist/events.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Typed observability events for MCP server lifecycle.
+ *
+ * @example
+ * ```ts
+ * const server = new McpServer("my-server@1.0.0");
+ *
+ * server.on("tool:call", (e) => {
+ *   console.log(`Tool ${e.toolName} called by ${e.auth.subject}`);
+ * });
+ *
+ * server.on("tool:result", (e) => {
+ *   console.log(`Tool ${e.toolName} completed in ${e.durationMs}ms`);
+ * });
+ *
+ * server.on("auth:success", (e) => {
+ *   console.log(`User ${e.auth.subject} authenticated`);
+ * });
+ * ```
+ */
+import type { AuthContext } from "./types.js";
+export type McpEventMap = {
+    /** Emitted when a tool is called */
+    "tool:call": {
+        toolName: string;
+        params: unknown;
+        auth: AuthContext;
+        sessionId: string;
+        timestamp: number;
+    };
+    /** Emitted after a tool returns (success or error) */
+    "tool:result": {
+        toolName: string;
+        durationMs: number;
+        isError: boolean;
+        auth: AuthContext;
+        sessionId: string;
+        timestamp: number;
+    };
+    /** Emitted when a gate denies a tool call */
+    "gate:denied": {
+        toolName: string;
+        reason: string;
+        auth: AuthContext;
+        sessionId: string;
+        timestamp: number;
+    };
+    /** Emitted on successful authentication */
+    "auth:success": {
+        auth: AuthContext;
+        timestamp: number;
+    };
+    /** Emitted on authentication failure */
+    "auth:failure": {
+        timestamp: number;
+    };
+    /** Emitted when search_tools promotes tools */
+    "tools:promoted": {
+        toolNames: string[];
+        query: string;
+        sessionId: string;
+        timestamp: number;
+    };
+    /** Emitted when a gate unlock promotes hidden tools */
+    "tools:unlocked": {
+        toolNames: string[];
+        prerequisite: string;
+        sessionId: string;
+        timestamp: number;
+    };
+    /** Emitted when deploy() is called */
+    "deploy:start": {
+        functionName: string;
+        region: string;
+        timestamp: number;
+    };
+    /** Emitted after deploy() completes */
+    "deploy:complete": {
+        functionName: string;
+        url: string;
+        region: string;
+        durationMs: number;
+        timestamp: number;
+    };
+};
+export type McpEventName = keyof McpEventMap;
+export declare class McpEventEmitter {
+    #private;
+    on<K extends McpEventName>(event: K, listener: (data: McpEventMap[K]) => void): void;
+    off<K extends McpEventName>(event: K, listener: (data: McpEventMap[K]) => void): void;
+    emit<K extends McpEventName>(event: K, data: McpEventMap[K]): void;
+}
+//# sourceMappingURL=events.d.ts.map

package/dist/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,MAAM,WAAW,GAAG;IACzB,oCAAoC;IACpC,WAAW,EAAE;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,OAAO,CAAC;QAChB,IAAI,EAAE,WAAW,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,sDAAsD;IACtD,aAAa,EAAE;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,IAAI,EAAE,WAAW,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,6CAA6C;IAC7C,aAAa,EAAE;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,WAAW,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,2CAA2C;IAC3C,cAAc,EAAE;QACf,IAAI,EAAE,WAAW,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,wCAAwC;IACxC,cAAc,EAAE;QACf,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,+CAA+C;IAC/C,gBAAgB,EAAE;QACjB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,uDAAuD;IACvD,gBAAgB,EAAE;QACjB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,sCAAsC;IACtC,cAAc,EAAE;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,uCAAuC;IACvC,iBAAiB,EAAE;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;CACF,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC;AAE7C,qBAAa,eAAe;;IAG3B,EAAE,CAAC,CAAC,SAAS,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,IAAI;IASpF,GAAG,CAAC,CAAC,SAAS,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,IAAI;IAIrF,IAAI,CAAC,CAAC,SAAS,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI;CAWlE"}

package/dist/events.js

@@ -0,0 +1,28 @@
+export class McpEventEmitter {
+    #listeners = new Map();
+    on(event, listener) {
+        let set = this.#listeners.get(event);
+        if (!set) {
+            set = new Set();
+            this.#listeners.set(event, set);
+        }
+        set.add(listener);
+    }
+    off(event, listener) {
+        this.#listeners.get(event)?.delete(listener);
+    }
+    emit(event, data) {
+        const set = this.#listeners.get(event);
+        if (!set)
+            return;
+        for (const listener of set) {
+            try {
+                listener(data);
+            }
+            catch {
+                // Don't let listener errors break the server
+            }
+        }
+    }
+}
+//# sourceMappingURL=events.js.map

package/dist/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAyFA,MAAM,OAAO,eAAe;IAC3B,UAAU,GAAG,IAAI,GAAG,EAAyC,CAAC;IAE9D,EAAE,CAAyB,KAAQ,EAAE,QAAwC;QAC5E,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,QAAoC,CAAC,CAAC;IAC/C,CAAC;IAED,GAAG,CAAyB,KAAQ,EAAE,QAAwC;QAC7E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,QAAoC,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAyB,KAAQ,EAAE,IAAoB;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,KAAK,MAAM,QAAQ,IAAI,GAAG,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACJ,QAAQ,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACR,6CAA6C;YAC9C,CAAC;QACF,CAAC;IACF,CAAC;CACD"}

package/dist/gating/combinators.d.ts

@@ -0,0 +1,10 @@
+import type { Gate } from "../types.js";
+/**
+ * All gates must pass. Returns the first failure.
+ */
+export declare function all(...gates: Gate[]): Gate;
+/**
+ * At least one gate must pass. Returns all failure reasons if none pass.
+ */
+export declare function any(...gates: Gate[]): Gate;
+//# sourceMappingURL=combinators.d.ts.map

package/dist/gating/combinators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"combinators.d.ts","sourceRoot":"","sources":["../../src/gating/combinators.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAA2B,MAAM,aAAa,CAAC;AAEjE;;GAEG;AACH,wBAAgB,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAU1C;AAED;;GAEG;AACH,wBAAgB,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAe1C"}

package/dist/gating/combinators.js

@@ -0,0 +1,34 @@
+/**
+ * All gates must pass. Returns the first failure.
+ */
+export function all(...gates) {
+    return async (ctx) => {
+        for (const gate of gates) {
+            const result = await gate(ctx);
+            if (!result.allowed) {
+                return result;
+            }
+        }
+        return { allowed: true };
+    };
+}
+/**
+ * At least one gate must pass. Returns all failure reasons if none pass.
+ */
+export function any(...gates) {
+    return async (ctx) => {
+        const failures = [];
+        for (const gate of gates) {
+            const result = await gate(ctx);
+            if (result.allowed) {
+                return { allowed: true };
+            }
+            failures.push(result.reason);
+        }
+        return {
+            allowed: false,
+            reason: `None of the gates passed: ${failures.join("; ")}`,
+        };
+    };
+}
+//# sourceMappingURL=combinators.js.map

package/dist/gating/combinators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"combinators.js","sourceRoot":"","sources":["../../src/gating/combinators.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,UAAU,GAAG,CAAC,GAAG,KAAa;IACnC,OAAO,KAAK,EAAE,GAAgB,EAAuB,EAAE;QACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO,MAAM,CAAC;YACf,CAAC;QACF,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,GAAG,CAAC,GAAG,KAAa;IACnC,OAAO,KAAK,EAAE,GAAgB,EAAuB,EAAE;QACtD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC1B,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,6BAA6B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC1D,CAAC;IACH,CAAC,CAAC;AACH,CAAC"}

package/dist/gating/gates.d.ts

@@ -0,0 +1,21 @@
+import type { Gate, GateContext } from "../types.js";
+/**
+ * Requires at least one of the specified roles.
+ */
+export declare function role(...roles: string[]): Gate;
+/**
+ * Arbitrary async predicate gate.
+ */
+export declare function check(fn: (ctx: GateContext) => boolean | Promise<boolean>, reason?: string): Gate;
+/**
+ * Requires a prerequisite tool to have been called (unlocked in session).
+ */
+export declare function requires(prerequisiteToolName: string): Gate;
+/**
+ * In-memory rate limiter per tool. Resets on cold start.
+ */
+export declare function rateLimit(opts: {
+    max: number;
+    windowMs: number;
+}): Gate;
+//# sourceMappingURL=gates.d.ts.map

package/dist/gating/gates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gates.d.ts","sourceRoot":"","sources":["../../src/gating/gates.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,WAAW,EAAc,MAAM,aAAa,CAAC;AAEjE;;GAEG;AACH,wBAAgB,IAAI,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAY7C;AAED;;GAEG;AACH,wBAAgB,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAWjG;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAc3D;AAOD;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAwBvE"}

package/dist/gating/gates.js

@@ -0,0 +1,74 @@
+/**
+ * Requires at least one of the specified roles.
+ */
+export function role(...roles) {
+    return (ctx) => {
+        const hasRole = roles.some((r) => ctx.auth.roles.includes(r));
+        if (hasRole) {
+            return { allowed: true };
+        }
+        return {
+            allowed: false,
+            reason: `Requires one of roles: ${roles.join(", ")}`,
+            hint: "Ensure the user has the appropriate role assigned.",
+        };
+    };
+}
+/**
+ * Arbitrary async predicate gate.
+ */
+export function check(fn, reason) {
+    return async (ctx) => {
+        const passed = await fn(ctx);
+        if (passed) {
+            return { allowed: true };
+        }
+        return {
+            allowed: false,
+            reason: reason ?? "Check failed",
+        };
+    };
+}
+/**
+ * Requires a prerequisite tool to have been called (unlocked in session).
+ */
+export function requires(prerequisiteToolName) {
+    return (ctx) => {
+        if (ctx.metadata.unlockedGates instanceof Set) {
+            const gates = ctx.metadata.unlockedGates;
+            if (gates.has(prerequisiteToolName)) {
+                return { allowed: true };
+            }
+        }
+        return {
+            allowed: false,
+            reason: `Requires "${prerequisiteToolName}" to be called first`,
+            hint: `Call the "${prerequisiteToolName}" tool before using "${ctx.toolName}".`,
+        };
+    };
+}
+/**
+ * In-memory rate limiter per tool. Resets on cold start.
+ */
+export function rateLimit(opts) {
+    const counters = new Map();
+    return (ctx) => {
+        const key = `${ctx.sessionId}:${ctx.toolName}`;
+        const now = Date.now();
+        let state = counters.get(key);
+        if (!state || now - state.windowStart >= opts.windowMs) {
+            state = { count: 0, windowStart: now };
+            counters.set(key, state);
+        }
+        if (state.count >= opts.max) {
+            return {
+                allowed: false,
+                reason: `Rate limit exceeded: max ${opts.max} calls per ${opts.windowMs}ms`,
+                hint: "Wait before retrying this tool.",
+            };
+        }
+        state.count++;
+        return { allowed: true };
+    };
+}
+//# sourceMappingURL=gates.js.map

package/dist/gating/gates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gates.js","sourceRoot":"","sources":["../../src/gating/gates.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,UAAU,IAAI,CAAC,GAAG,KAAe;IACtC,OAAO,CAAC,GAAgB,EAAc,EAAE;QACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,0BAA0B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACpD,IAAI,EAAE,oDAAoD;SAC1D,CAAC;IACH,CAAC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,KAAK,CAAC,EAAoD,EAAE,MAAe;IAC1F,OAAO,KAAK,EAAE,GAAgB,EAAuB,EAAE;QACtD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,MAAM,IAAI,cAAc;SAChC,CAAC;IACH,CAAC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,oBAA4B;IACpD,OAAO,CAAC,GAAgB,EAAc,EAAE;QACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,YAAY,GAAG,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,aAA4B,CAAC;YACxD,IAAI,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC1B,CAAC;QACF,CAAC;QACD,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,aAAa,oBAAoB,sBAAsB;YAC/D,IAAI,EAAE,aAAa,oBAAoB,wBAAwB,GAAG,CAAC,QAAQ,IAAI;SAC/E,CAAC;IACH,CAAC,CAAC;AACH,CAAC;AAOD;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,IAAuC;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEnD,OAAO,CAAC,GAAgB,EAAc,EAAE;QACvC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxD,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;YACvC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1B,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,4BAA4B,IAAI,CAAC,GAAG,cAAc,IAAI,CAAC,QAAQ,IAAI;gBAC3E,IAAI,EAAE,iCAAiC;aACvC,CAAC;QACH,CAAC;QAED,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC,CAAC;AACH,CAAC"}

package/dist/gating/index.d.ts

@@ -0,0 +1,3 @@
+export { role, check, requires, rateLimit } from "./gates.js";
+export { all, any } from "./combinators.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/gating/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/gating/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/gating/index.js

@@ -0,0 +1,3 @@
+export { role, check, requires, rateLimit } from "./gates.js";
+export { all, any } from "./combinators.js";
+//# sourceMappingURL=index.js.map

package/dist/gating/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/gating/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+export { McpServer, type LambdaTransportConfig, type ExpressTransportConfig } from "./server.js";
+export type { ToolTier, ToolConfig, ToolHandler, ToolHandlerReturn, ToolContext, ToolResult, ToolOptions, ContentPart, TextContent, ImageContent, AuthContext, Gate, GateContext, GateResult, McpSession, SessionStore, ToolCallRecord, McpServerConfig, DisclosureMode, DisclosureConfig, CodeModeConfig, } from "./types.js";
+export { McpAwsError, GateDeniedError, AuthenticationError, SessionNotFoundError, ToolExecutionError, ToolTimeoutError, } from "./errors.js";
+export { apiKey, ApiKeyAuth, type ApiKeyAuthConfig, type ApiKeyEntry } from "./auth/api-key.js";
+export { cognito, CognitoAuth, type CognitoAuthConfig } from "./auth/cognito.js";
+export { chainAuth, type AuthProvider, type AuthRequest } from "./auth/index.js";
+export { buildResourceMetadata, buildWwwAuthenticateHeader, type ProtectedResourceMetadata, type ResourceMetadataConfig, } from "./auth/metadata.js";
+export { role, check, requires, rateLimit } from "./gating/gates.js";
+export { all, any } from "./gating/combinators.js";
+export { MemorySessionStore, type MemorySessionStoreConfig } from "./session/memory.js";
+export { DynamoSessionStore, type DynamoSessionStoreConfig } from "./session/dynamo.js";
+export type { SqliteSessionStoreConfig } from "./session/sqlite.js";
+export { SearchIndex, type SearchResult } from "./disclosure/search.js";
+export { FunctionExecutor, WorkerExecutor } from "./codemode/executor.js";
+export type { Executor, ExecuteResult } from "./codemode/executor.js";
+export { getAuthContext, getSession } from "./context.js";
+export { isBlockedUrl, assertSafeUrl } from "./ssrf.js";
+export type { McpEventMap, McpEventName } from "./events.js";
+export { codeMcpServer, createMcpHandler, type CodeMcpServerOptions, type CreateMcpHandlerOptions } from "./compose.js";
+export { deploy, destroy, type DeployConfig, type DeployResult, type DestroyResult, type VpcConfig, } from "./deploy.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,KAAK,qBAAqB,EAAE,KAAK,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAGjG,YAAY,EACX,QAAQ,EACR,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,UAAU,EACV,WAAW,EACX,WAAW,EACX,WAAW,EACX,YAAY,EACZ,WAAW,EACX,IAAI,EACJ,WAAW,EACX,UAAU,EACV,UAAU,EACV,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,cAAc,GACd,MAAM,YAAY,CAAC;AAGpB,OAAO,EACN,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,GAChB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACjF,OAAO,EACN,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,GAC3B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAGnD,OAAO,EAAE,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAGxF,YAAY,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGxE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC1E,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAGtE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGxD,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG7D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,KAAK,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAGxH,OAAO,EACN,MAAM,EACN,OAAO,EACP,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,SAAS,GACd,MAAM,aAAa,CAAC"}