@vectros-ai/mcp-server 0.5.0

package/CHANGELOG.md

@@ -0,0 +1,38 @@
+# Changelog
+
+All notable changes to `@vectros-ai/mcp-server` are documented here.
+This project adheres to [Semantic Versioning](https://semver.org).
+
+## 0.5.0 — 2026-06-20
+
+Initial public release of the Vectros MCP server.
+
+### Added
+
+- A [Model Context Protocol](https://modelcontextprotocol.io) server exposing the
+  Vectros data plane to MCP-aware agents (Claude Desktop, Cursor, Code, Cline,
+  Continue, VS Code, and hosted agent platforms) as **21 data-plane tools** — and
+  only data-plane tools (no web or external-search surface, by design).
+- Full data-plane coverage:
+  - **Hybrid search** with keyword-precision and relevance controls, ownership /
+    folder / type / metadata / date scoping.
+  - **Structured records** — create / read / update / delete / query, with field
+    lookups (equality, range, prefix; ascending or descending) and idempotent
+    create by `externalId`.
+  - **Documents** — idempotent, optionally-typed ingest (inline text or file
+    upload), retrieval (metadata, text, or a presigned download URL), update,
+    delete, and query / lookup.
+  - **Folders** — create / read / update / delete, with pagination.
+  - **In-perimeter inference** — retrieval-augmented generation (with retrieval
+    scoping and prompt steering) and single-document Q&A.
+  - **Discovery & history** — schema catalog, current-credential identity,
+    identity resolution (look up a user / org / client by your own id), and
+    record / document version history.
+- Optimistic concurrency (`expectedVersion`) on record / document / folder
+  updates; results are bounded with MCP-specific limits to protect the agent
+  context window.
+- One-command start: `npx -y @vectros-ai/mcp-server`.
+- Pairs with `@vectros-ai/cli bootstrap`, which mints a least-privilege scoped
+  key so the server never needs your root credential.
+- Fail-closed configuration: the server refuses to start on a missing or invalid
+  base URL, or on an insecure network bind.

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Vectros
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,298 @@
+# @vectros-ai/mcp-server
+
+A [Model Context Protocol](https://modelcontextprotocol.io) server
+that exposes Vectros — hybrid search, structured records, documents,
+and in-perimeter RAG / document Q&A — to MCP-aware agents (Claude
+Desktop, Cursor, Code, Cline, Continue, VS Code, hosted agent
+platforms).
+
+```
+npx -y @vectros-ai/mcp-server
+```
+
+Your agent can search your indexed corpus, query structured records,
+ingest documents, and ask questions grounded against documents — all
+without leaving the BAA boundary.
+
+## Quick start — one command
+
+The fastest way to set up is the [`@vectros-ai/cli`](https://www.npmjs.com/package/@vectros-ai/cli)
+`bootstrap` command. It mints a **least-privilege scoped key** (`ssk_*`)
+bound to a narrowed AccessProfile, optionally scaffolds a use-case data
+model, and safe-merges the `vectros` server into your MCP client config —
+no root key, and no hand-editing JSON:
+
+```bash
+npx -y @vectros-ai/cli bootstrap
+```
+
+You pick what to set up (a blank read-only credential, or a **blueprint**
+like task tracking) and sign in once with a token from the
+developer portal. The command then:
+
+- mints a scoped `ssk_*` for **this machine** (independently rotatable),
+- creates the matching AccessProfile — **data-plane only**; the command
+  refuses to provision control-plane scope (keys / profiles / billing / …),
+- backs up and merges the entry into `claude_desktop_config.json` (Claude
+  Desktop, Cursor, Cline). For **Claude Code**, add `--client code`: it merges
+  the project `.mcp.json` and prints the equivalent `claude mcp add` command.
+
+Restart your MCP client and you're done. It's idempotent (re-run any time);
+`--rotate` replaces this machine's key.
+
+For scripted / agent use, set the sign-in token in the environment and skip
+the prompts:
+
+```bash
+VECTROS_BOOTSTRAP_TOKEN=… npx -y @vectros-ai/cli bootstrap \
+  --blueprint task-management --yes
+```
+
+Prefer to wire it up by hand? See **Configure manually** below.
+
+## Configure manually (Claude Desktop or any MCP client)
+
+```json
+{
+  "mcpServers": {
+    "vectros": {
+      "command": "npx",
+      "args": ["-y", "@vectros-ai/mcp-server"],
+      "env": {
+        "VECTROS_API_KEY": "ssk_live_..."
+      }
+    }
+  }
+}
+```
+
+Restart Claude Desktop. The agent now sees the Vectros tools and
+two resources as callable surfaces.
+
+## Configure manually (Claude Code)
+
+Claude Code reads a project-scoped `.mcp.json` with the same shape — drop this
+at your project root (commit it to share the server with the repo):
+
+```json
+{
+  "mcpServers": {
+    "vectros": {
+      "command": "npx",
+      "args": ["-y", "@vectros-ai/mcp-server"],
+      "env": {
+        "VECTROS_API_KEY": "ssk_live_..."
+      }
+    }
+  }
+}
+```
+
+Or let Claude Code's CLI write it for you:
+
+```bash
+claude mcp add vectros -e VECTROS_API_KEY=ssk_live_... -- npx -y @vectros-ai/mcp-server
+```
+
+Add `-e VECTROS_API_BASE_URL=https://api.staging.vectros.ai` for a non-production
+environment. Reopen the project in Claude Code and the Vectros tools are
+available.
+
+## Tools (21 tools)
+
+**Search & RAG**
+
+| Tool | What it does |
+|---|---|
+| `hybrid_search` | Hybrid BM25 + dense search across the tenant's indexed content (records + documents). Narrow by ownership, folder, type, metadata filters, a created date window, and keyword-precision (`textMode`) / relevance floors. Returns the indexed projection of each hit. |
+| `rag_ask` | Ask a question grounded against the indexed corpus. Scope retrieval (ownership / folder / type / metadata filters / date window) and steer generation (`instructions` / `temperature`). Streaming generation aggregated; progress notifications keep the call alive for the generation window. |
+| `document_ask` | Ask a question grounded against a single document. Same aggregation + progress-notification shape as `rag_ask`. |
+
+**Records** (structured, schema-validated data)
+
+| Tool | What it does |
+|---|---|
+| `list_schemas` | List the record-schema catalog the credential can see (filter by `surface` or resolve one by `recordType`). Makes `record_query` / `record_create` discoverable. |
+| `record_query` | Query records by lookup field (equality / range / prefix, with `asc`/`desc` ordering) or list mode (filter by ownership + type). |
+| `record_get` | Fetch one record by id, including its full payload (large payloads truncated to protect the agent context window). |
+| `record_create` | Create a record of a given type; idempotent by `externalId`; optional per-record `indexMode`. |
+| `record_update` | Patch a record's payload (deep-merged; `null` deletes a key); optimistic concurrency via `expectedVersion`. |
+| `record_delete` | Permanently delete a record by id (leaves a tombstone). |
+
+**Documents** (text/file content, indexed for search + Q&A)
+
+| Tool | What it does |
+|---|---|
+| `document_ingest` | Create a document — inline text body OR local file upload (file mode is stdio-transport only). Idempotent by `externalId`; optional `schemaId` + `payload` for a typed, lookup-queryable document. |
+| `document_query` | Query documents by lookup field (equality / range / prefix, with `asc`/`desc` ordering) or list mode (filter by ownership + type). |
+| `document_get` | Fetch a document by id (metadata; optional text truncated at ~8K tokens; optional presigned `downloadUrl` for file-backed documents). |
+| `document_update` | Patch a document's metadata / typed payload (deep-merged); optimistic concurrency via `expectedVersion`. |
+| `document_delete` | Permanently delete a document by id (removes it and its indexed content). |
+
+**Folders** (group records + documents)
+
+| Tool | What it does |
+|---|---|
+| `folder_query` | Get a folder by id, or list folders (a parent's children for tree navigation, or a flat tenant list; paginated via `nextCursor`). |
+| `folder_create` | Create a folder. |
+| `folder_update` | Update a folder's name / description / ownership (merge-patch; optimistic concurrency via `expectedVersion`; folders cannot be re-parented). |
+| `folder_delete` | Delete a folder. |
+
+**Identity & history**
+
+| Tool | What it does |
+|---|---|
+| `current_identity` | Describe the credential: tenantId, environment, principalType, and (where surfaced) allowedActions + dataScope. |
+| `lookup_principal` | Resolve a user / org / client by your own `externalId` (→ its Vectros UUID, for the ownership filters) or by a schema lookup field. Read-only. |
+| `version_history` | Read the audit/version trail (CREATE/UPDATE/DELETE, with actor + diff) for one record or document. Read-only. |
+
+All 21 tools wrap published Vectros HTTP API endpoints. JSON
+responses are what the agent sees as tool output. Per-call cost
+surfaces via the `usage` field on inference responses.
+
+### Opting into a subset
+
+Pass `VECTROS_MCP_TOOLS=hybrid_search,rag_ask` to register only those
+two — useful for giving an agent read-only search access without
+exposing ingestion or inference costs to the credential. Unknown tool
+names fail fast at startup.
+
+## Resources
+
+Two read-only resources for ambient context (no tool call required):
+
+| URI | What it returns |
+|---|---|
+| `vectros://schemas` | Same payload as `list_schemas`. Lets the agent preload schemas into context for ambient discovery. |
+| `vectros://identity` | Same payload as `current_identity`. Lets the agent self-describe without spending a tool call. |
+
+## Recommended credential
+
+Use a **scoped permanent API key** (`ssk_*`), not a root key (`sk_*`).
+
+A scoped key is bound to a narrowed `AccessProfile` — e.g. read-only
+across one `orgId`. If your MCP install is compromised, the blast
+radius is whatever the profile allows, not the whole tenant. The
+server emits a `warn` log line on startup when you pass a wildcard
+`sk_*` for exactly this reason.
+
+**The easiest way to get one is `npx -y @vectros-ai/cli bootstrap` (above)**
+— it mints a least-privilege `ssk_*` and an AccessProfile for you, no root
+key required. To do it by hand instead: mint a scoped key from the developer
+portal under **Keys → Create scoped key**, bind it to an AccessProfile
+titled `mcp-read-all` or `mcp-read-scoped`, and drop the resulting
+`ssk_live_...` into the config above.
+
+See the Vectros developer documentation on scoped tokens ("Recommended
+AccessProfile for MCP") for least-privilege credential setup — the
+`vectros bootstrap` flow provisions a scoped `ssk_*` key and its AccessProfile
+in one command.
+
+## Environment variables
+
+| Var | Required | Default | Purpose |
+|---|---|---|---|
+| `VECTROS_API_KEY` | **yes** | — | Vectros API key. Accepts `sk_*` / `ssk_*` / `st_*`; `ssk_*` recommended. |
+| `VECTROS_API_BASE_URL` | no | `https://api.vectros.ai` | Override for staging or other envs. Validated: must be `https://` (or `http://` to localhost) and an official `*.vectros.ai` host. |
+| `VECTROS_ALLOW_INSECURE_BASE_URL` | no | — | Set `1` to bypass the base-URL allow-list (e.g. a trusted local proxy). **Not recommended** — sends your key to an unvalidated host; logs a warning. |
+| `VECTROS_MCP_INGEST_ROOT` | no | process cwd | Directory `document_ingest`'s `filePath` mode is jailed to. Paths escaping it (traversal/absolute/symlink) or matching a sensitive pattern are rejected. |
+| `VECTROS_MCP_TOOLS` | no | (all tools) | Comma-separated tool names (e.g. `hybrid_search,rag_ask`). |
+| `VECTROS_MCP_DEBUG` | no | — | Set `1` for verbose stderr logs. |
+| `VECTROS_MCP_SKIP_PING_VALIDATION` | no | — | Set `1` to disable the startup `/v1/ping` check. |
+| `VECTROS_MCP_HTTP_PORT` | HTTP only | `8765` | Port for HTTP transport. |
+| `VECTROS_MCP_HTTP_HOST` | HTTP only | `127.0.0.1` | Bind address. Use `0.0.0.0` for all interfaces (then set a bearer token). |
+| `VECTROS_MCP_HTTP_BEARER_TOKEN` | HTTP only | — | Client→server bearer token. **Strongly recommended** beyond localhost; **required** for a non-loopback bind. |
+| `VECTROS_MCP_HTTP_ALLOWED_HOSTS` | HTTP only | — | Comma-separated extra `Host` values to allow (DNS-rebinding protection). Set to the public hostname(s) behind a reverse proxy. |
+| `VECTROS_MCP_HTTP_ALLOWED_ORIGINS` | HTTP only | — | Comma-separated extra `Origin` values to allow. |
+| `VECTROS_MCP_HTTP_ALLOW_INSECURE` | HTTP only | — | Set `1` to permit a non-loopback bind without a bearer token. **Not recommended.** |
+
+## Startup credential validation
+
+Before the first tool call, the server runs a `GET /v1/ping` check
+against your credential. Bad keys fail at startup with a clear
+error instead of opaquely 401'ing mid-conversation. Set
+`VECTROS_MCP_SKIP_PING_VALIDATION=1` to disable.
+
+## HTTP transport
+
+For hosted-MCP scenarios — running the server behind a network
+boundary, sharing it across multiple agent instances, deploying as
+a sidecar — the package also ships an HTTP binary:
+
+```bash
+VECTROS_API_KEY=ssk_live_... \
+VECTROS_MCP_HTTP_PORT=8765 \
+VECTROS_MCP_HTTP_BEARER_TOKEN=$(openssl rand -hex 32) \
+  npx -y @vectros-ai/mcp-server vectros-mcp-server-http
+```
+
+The server listens on `http://127.0.0.1:8765/mcp` by default. The
+bearer token is optional but **strongly recommended for any
+deployment beyond localhost** — without it, anyone who can reach the
+port can call Vectros with your credentials.
+
+Health probe lives at `GET /healthz` (always unauthenticated, k8s
+readiness-friendly).
+
+Current limitation: the server uses one upstream credential per process
+(the env `VECTROS_API_KEY`). Per-request credential override via the
+incoming Authorization header is a planned enhancement. For now, deploy one
+server per credential boundary you want.
+
+## Programmatic use (advanced)
+
+Most consumers use the CLI shape above. If you need to embed the
+server in your own Node process:
+
+```ts
+import { VectrosMCPServer, createStdioTransport } from '@vectros-ai/mcp-server';
+
+const server = new VectrosMCPServer({
+  apiKey: process.env.VECTROS_API_KEY!,
+  tools: ['hybrid_search', 'rag_ask'],
+  resources: ['schemas'],     // opt-in resource filter; default = all
+  validateOnStart: true,      // default — set false to skip startup ping
+});
+await server.connect(createStdioTransport());
+```
+
+## What this server doesn't do (yet)
+
+- **No prompts capability** — `/rag` and `/ingest_pdf` slash-command
+  templates land in a future release. (Provisioning — the `bootstrap` command — lives
+  in the separate [`@vectros-ai/cli`](https://www.npmjs.com/package/@vectros-ai/cli)
+  package, above.)
+- **HTTP transport is single-tenant per process** — per-request
+  credential override via incoming Authorization header is a v1.0+
+  enhancement.
+- **No Python implementation** — TS only. Python users can `npx`
+  this server from any project.
+- **`rag_ask` and `document_ask` are not natively streaming** —
+  full answer aggregated before the tool returns. Progress
+  notifications cover the latency. Native MCP-spec streaming lands
+  when the spec stabilizes.
+
+The server is on a pre-1.0 track toward a stable 1.0 release.
+
+## Building from source
+
+```sh
+git clone https://github.com/vectros-ai/mcp-server
+cd mcp-server
+npm install
+npm run build
+npm test
+```
+
+`npm install` pulls `@vectros-ai/sdk` from the configured npm
+registry.
+
+`npm run build` runs `tsup` to produce the dual ESM/CJS output in
+`dist/`. The SDK is bundled into the build (see
+[`tsup.config.ts`](./tsup.config.ts)) — the published npm package is
+self-contained and works without `.npmrc` config on the consumer's
+machine.
+
+## License
+
+Apache-2.0. See the LICENSE file.

package/dist/cli-http.d.mts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/cli-http.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node