@vipcasso/mcp 0.0.0-stage → 0.0.1

package/LICENSE

@@ -0,0 +1,12 @@
+License — TBD at project kickoff.
+
+Choose one and replace the contents of this file. Common options:
+
+- **MIT** — permissive, broad reuse allowed. Most popular for open-source SaaS.
+- **Apache-2.0** — permissive + explicit patent grant + trademark restriction.
+- **BSL (Business Source License)** — source-available, time-limited commercial-use restriction. Common for commercial OSS-adjacent projects.
+- **Proprietary / All Rights Reserved** — closed source. State explicitly to avoid ambiguity.
+
+Reference: https://choosealicense.com/
+
+Once chosen, log the decision in docs/DECISIONS.md with rationale (commercial posture, contributor expectations, dependency-license compatibility).

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { loadOperations, operationsFromDocument, MCP_HIDDEN_OPERATIONS, type ApiOperation, type OpenApiDoc, type OperationOptions } from "./operations.js";
+export { createVipcassoMcpServer, multipartBody } from "./server.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC3J,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { loadOperations, operationsFromDocument, MCP_HIDDEN_OPERATIONS } from "./operations.js";
+export { createVipcassoMcpServer, multipartBody } from "./server.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,qBAAqB,EAA6D,MAAM,iBAAiB,CAAC;AAC3J,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/operations.d.ts

@@ -0,0 +1,61 @@
+/**
+ * MCP is a transport over the ONE router (blueprint §3.3): tools are derived
+ * from the live OpenAPI document, never hand-declared, so a new endpoint is a
+ * new tool (and a new CLI command) with no code here. Shared by the stdio
+ * server, the API's `POST /mcp` (W7) and the generated CLI.
+ */
+export interface ApiOperation {
+    toolName: string;
+    method: string;
+    path: string;
+    description: string;
+    pathParams: string[];
+    /** Declared query parameters (names), for a generated CLI's `--query k=v`. */
+    queryParams: string[];
+    /** The operation takes a request body. */
+    hasBody: boolean;
+    /** How the body travels: JSON, multipart (files), or none. */
+    bodyMediaType: "json" | "multipart" | null;
+    /** The JSON body's schema with `$ref`s inlined, so a tool list is self-contained (Codex on #418). */
+    bodySchema?: Record<string, unknown> | undefined;
+    /** The document says the body is required. */
+    bodyRequired: boolean;
+}
+interface OpenApiOperation {
+    operationId?: string;
+    summary?: string;
+    description?: string;
+    parameters?: {
+        name: string;
+        in: string;
+    }[];
+    requestBody?: {
+        required?: boolean;
+        content?: Record<string, {
+            schema?: unknown;
+        }>;
+    } | undefined;
+}
+export interface OpenApiDoc {
+    paths: Record<string, Record<string, OpenApiOperation>>;
+    components?: {
+        schemas?: Record<string, unknown>;
+    } | undefined;
+}
+/** Inline every `$ref` (against `components.schemas`) so a client needs nothing else; cycles become `{}`. */
+export declare function resolveRefs(schema: unknown, doc: OpenApiDoc, seen?: readonly string[]): unknown;
+/**
+ * Operations a MODEL must never call through MCP: their response is a secret
+ * that would land in the model's context, the transcript and client logs
+ * (Codex on #417). The CLI — a human at a keyboard — still has them.
+ */
+export declare const MCP_HIDDEN_OPERATIONS: ReadonlySet<string>;
+export interface OperationOptions {
+    /** Include the operations hidden from models (the CLI passes true). */
+    includeHidden?: boolean;
+}
+export declare function loadOperations(apiBaseUrl: string, fetchImpl?: typeof fetch, opts?: OperationOptions): Promise<ApiOperation[]>;
+/** The same derivation from an already-loaded document (the API's `POST /mcp` uses it in-process). */
+export declare function operationsFromDocument(doc: OpenApiDoc, opts?: OperationOptions): ApiOperation[];
+export {};
+//# sourceMappingURL=operations.d.ts.map

package/dist/operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../src/operations.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,8DAA8D;IAC9D,aAAa,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;IAC3C,qGAAqG;IACrG,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IACjD,8CAA8C;IAC9C,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,UAAU,gBAAgB;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5C,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,MAAM,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC;CAClG;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACxD,UAAU,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC;CAChE;AASD,6GAA6G;AAC7G,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,GAAE,SAAS,MAAM,EAAO,GAAG,OAAO,CAcnG;AAID;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAAgD,CAAC;AAEvG,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,OAAO,KAAa,EAC/B,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,YAAY,EAAE,CAAC,CAIzB;AAED,sGAAsG;AACtG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,GAAE,gBAAqB,GAAG,YAAY,EAAE,CAiCnG"}

package/dist/operations.js

@@ -0,0 +1,82 @@
+/**
+ * MCP is a transport over the ONE router (blueprint §3.3): tools are derived
+ * from the live OpenAPI document, never hand-declared, so a new endpoint is a
+ * new tool (and a new CLI command) with no code here. Shared by the stdio
+ * server, the API's `POST /mcp` (W7) and the generated CLI.
+ */
+/**
+ * Paths that are not for an API key: public visitor routes (session-token or
+ * unauthenticated), internal edge fallbacks, and the login flow. A model with a
+ * key could open a concierge session it can never continue (Codex on #418).
+ */
+const NOT_FOR_KEYS = /^\/(public|internal)\/|^\/v1\/auth\//;
+/** Inline every `$ref` (against `components.schemas`) so a client needs nothing else; cycles become `{}`. */
+export function resolveRefs(schema, doc, seen = []) {
+    if (Array.isArray(schema))
+        return schema.map((x) => resolveRefs(x, doc, seen));
+    if (!schema || typeof schema !== "object")
+        return schema;
+    const obj = schema;
+    const ref = obj["$ref"];
+    if (typeof ref === "string") {
+        const name = ref.replace(/^#\/components\/schemas\//, "");
+        if (seen.includes(name))
+            return {};
+        const target = doc.components?.schemas?.[name];
+        return target === undefined ? {} : resolveRefs(target, doc, [...seen, name]);
+    }
+    const out = {};
+    for (const [k, v] of Object.entries(obj))
+        out[k] = resolveRefs(v, doc, seen);
+    return out;
+}
+const METHODS = ["get", "post", "put", "patch", "delete"];
+/**
+ * Operations a MODEL must never call through MCP: their response is a secret
+ * that would land in the model's context, the transcript and client logs
+ * (Codex on #417). The CLI — a human at a keyboard — still has them.
+ */
+export const MCP_HIDDEN_OPERATIONS = new Set(["createApiKey", "createConnector"]);
+export async function loadOperations(apiBaseUrl, fetchImpl = fetch, opts = {}) {
+    const res = await fetchImpl(`${apiBaseUrl}/v1/openapi.json`);
+    if (!res.ok)
+        throw new Error(`failed to load OpenAPI document: ${res.status}`);
+    return operationsFromDocument((await res.json()), opts);
+}
+/** The same derivation from an already-loaded document (the API's `POST /mcp` uses it in-process). */
+export function operationsFromDocument(doc, opts = {}) {
+    const ops = [];
+    for (const [path, item] of Object.entries(doc.paths ?? {})) {
+        for (const method of METHODS) {
+            const op = item[method];
+            if (!op)
+                continue;
+            const toolName = op.operationId ??
+                `${method}_${path.replaceAll(/[{}]/g, "")}`
+                    .replaceAll(/[^a-zA-Z0-9]+/g, "_")
+                    .replaceAll(/_+/g, "_")
+                    .replace(/^_+|_+$/g, "");
+            if (!opts.includeHidden && (MCP_HIDDEN_OPERATIONS.has(toolName) || NOT_FOR_KEYS.test(path)))
+                continue;
+            const content = op.requestBody?.content ?? {};
+            const contentTypes = Object.keys(content);
+            const bodyMediaType = contentTypes.some((t) => t.startsWith("multipart/")) ? "multipart" : contentTypes.length > 0 || op.requestBody !== undefined ? "json" : null;
+            const jsonSchema = bodyMediaType === "json" ? (content["application/json"]?.schema ?? Object.values(content)[0]?.schema) : undefined;
+            const bodySchema = jsonSchema !== undefined ? resolveRefs(jsonSchema, doc) : undefined;
+            ops.push({
+                toolName,
+                method: method.toUpperCase(),
+                path,
+                description: op.description ?? op.summary ?? `${method.toUpperCase()} ${path}`,
+                pathParams: [...path.matchAll(/\{([^}]+)\}/g)].map((m) => m[1]),
+                queryParams: (op.parameters ?? []).filter((p) => p.in === "query").map((p) => p.name),
+                hasBody: bodyMediaType !== null,
+                bodyMediaType,
+                ...(bodySchema !== undefined ? { bodySchema } : {}),
+                bodyRequired: op.requestBody?.required === true,
+            });
+        }
+    }
+    return ops;
+}
+//# sourceMappingURL=operations.js.map

package/dist/operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.js","sourceRoot":"","sources":["../src/operations.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAiCH;;;;GAIG;AACH,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAE5D,6GAA6G;AAC7G,MAAM,UAAU,WAAW,CAAC,MAAe,EAAE,GAAe,EAAE,OAA0B,EAAE;IACxF,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/E,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IACzD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AAEnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAOvG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAkB,EAClB,YAA0B,KAAK,EAC/B,OAAyB,EAAE;IAE3B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,UAAU,kBAAkB,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,OAAO,sBAAsB,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAe,EAAE,IAAI,CAAC,CAAC;AACxE,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,sBAAsB,CAAC,GAAe,EAAE,OAAyB,EAAE;IACjF,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,IAAI,CAAC,EAAE;gBAAE,SAAS;YAClB,MAAM,QAAQ,GACZ,EAAE,CAAC,WAAW;gBACd,GAAG,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE;qBACxC,UAAU,CAAC,gBAAgB,EAAE,GAAG,CAAC;qBACjC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC;qBACtB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAE,SAAS;YACtG,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,EAAE,OAAO,IAAI,EAAE,CAAC;YAC9C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YACnK,MAAM,UAAU,GAAG,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrI,MAAM,UAAU,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAE,WAAW,CAAC,UAAU,EAAE,GAAG,CAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;YACpH,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ;gBACR,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;gBAC5B,IAAI;gBACJ,WAAW,EAAE,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,OAAO,IAAI,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE;gBAC9E,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC;gBACzE,WAAW,EAAE,CAAC,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrF,OAAO,EAAE,aAAa,KAAK,IAAI;gBAC/B,aAAa;gBACb,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,YAAY,EAAE,EAAE,CAAC,WAAW,EAAE,QAAQ,KAAK,IAAI;aAChD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,18 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/**
+ * Vipcasso MCP server — one tool per API operation, executed as plain HTTP
+ * calls against the API. No business logic lives here (transport only).
+ */
+export declare function createVipcassoMcpServer(opts: {
+    apiBaseUrl: string;
+    apiKey?: string | undefined;
+    fetchImpl?: typeof fetch;
+}): Promise<McpServer>;
+/** `fields` + base64 `files` → the multipart body an upload route expects. */
+export declare function multipartBody(fields: Record<string, string> | undefined, files: {
+    field: string;
+    filename: string;
+    content_base64: string;
+    content_type?: string | undefined;
+}[] | undefined): FormData;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIpE;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,SAAS,CAAC,CAgDrB;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAAE,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EAAE,GAAG,SAAS,GAAG,QAAQ,CAUvM"}

package/dist/server.js

@@ -0,0 +1,65 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+import { loadOperations } from "./operations.js";
+/**
+ * Vipcasso MCP server — one tool per API operation, executed as plain HTTP
+ * calls against the API. No business logic lives here (transport only).
+ */
+export async function createVipcassoMcpServer(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const server = new McpServer({ name: "vipcasso", version: "0.0.1" });
+    const operations = await loadOperations(opts.apiBaseUrl, fetchImpl);
+    for (const op of operations) {
+        server.tool(op.toolName, op.description, {
+            path_params: z.record(z.string(), z.string()).optional(),
+            query: z.record(z.string(), z.string()).optional(),
+            body: z.unknown().optional(),
+            /** Multipart operations (file uploads): text fields… */
+            fields: z.record(z.string(), z.string()).optional(),
+            /** …and files, base64-encoded (the API declares these as multipart/form-data). */
+            files: z.array(z.object({ field: z.string(), filename: z.string(), content_base64: z.string(), content_type: z.string().optional() })).optional(),
+        }, async (args) => {
+            let path = op.path;
+            for (const p of op.pathParams) {
+                const v = args.path_params?.[p];
+                if (v === undefined)
+                    throw new Error(`missing path param: ${p}`);
+                path = path.replace(`{${p}}`, encodeURIComponent(v));
+            }
+            const url = new URL(`${opts.apiBaseUrl}${path}`);
+            for (const [k, v] of Object.entries(args.query ?? {}))
+                url.searchParams.set(k, v);
+            // A multipart operation travels as FormData (the boundary comes from fetch);
+            // everything else as JSON.
+            const body = op.bodyMediaType === "multipart" ? multipartBody(args.fields, args.files) : args.body !== undefined ? JSON.stringify(args.body) : undefined;
+            const res = await fetchImpl(url.toString(), {
+                method: op.method,
+                headers: {
+                    ...(opts.apiKey ? { authorization: `Bearer ${opts.apiKey}` } : {}),
+                    ...(typeof body === "string" ? { "content-type": "application/json" } : {}),
+                },
+                ...(body !== undefined ? { body } : {}),
+            });
+            const text = await res.text();
+            return {
+                content: [{ type: "text", text }],
+                isError: !res.ok,
+            };
+        });
+    }
+    return server;
+}
+/** `fields` + base64 `files` → the multipart body an upload route expects. */
+export function multipartBody(fields, files) {
+    const fd = new FormData();
+    for (const [k, v] of Object.entries(fields ?? {}))
+        fd.set(k, v);
+    for (const f of files ?? []) {
+        const bytes = Uint8Array.from(atob(f.content_base64), (ch) => ch.charCodeAt(0));
+        const buf = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+        // append, not set: several files may share a field (`files`), and the API reads getAll (Codex #417).
+        fd.append(f.field, new Blob([buf], f.content_type ? { type: f.content_type } : undefined), f.filename);
+    }
+    return fd;
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAI7C;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAEpE,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CACT,EAAE,CAAC,QAAQ,EACX,EAAE,CAAC,WAAW,EACd;YACE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACxD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YAClD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAC5B,wDAAwD;YACxD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACnD,kFAAkF;YAClF,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;SAClJ,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,IAAI,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChC,IAAI,CAAC,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;gBACjE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC;YACjD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAElF,6EAA6E;YAC7E,2BAA2B;YAC3B,MAAM,IAAI,GAAG,EAAE,CAAC,aAAa,KAAK,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzJ,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAC1C,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,OAAO,EAAE;oBACP,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClE,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5E;gBACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC;gBAC1C,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE;aACjB,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,MAA0C,EAAE,KAAmH;IAC3L,MAAM,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CAAC;QACrG,qGAAqG;QACrG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/stdio.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=stdio.d.ts.map

package/dist/stdio.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":""}

package/dist/stdio.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { createVipcassoMcpServer } from "./server.js";
+const apiBaseUrl = process.env["VIPCASSO_API_URL"] ?? "https://api.vipcasso.com";
+const apiKey = process.env["VIPCASSO_API_KEY"];
+const server = await createVipcassoMcpServer({ apiBaseUrl, apiKey });
+await server.connect(new StdioServerTransport());
+//# sourceMappingURL=stdio.js.map

package/dist/stdio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,0BAA0B,CAAC;AACjF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAE/C,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;AACrE,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,47 @@
 {
   "name": "@vipcasso/mcp",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.0.1",
+  "private": false,
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./operations": {
+      "types": "./dist/operations.d.ts",
+      "default": "./dist/operations.js"
+    }
+  },
+  "bin": {
+    "vipcasso-mcp": "./dist/stdio.js"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "1.29.0",
+    "zod": "4.4.3"
+  },
+  "devDependencies": {
+    "@types/node": "26.1.1",
+    "typescript": "6.0.3",
+    "vitest": "4.1.11",
+    "@vitest/coverage-v8": "4.1.11"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist"
+  ],
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/AspynAI/vipcasso.git",
+    "directory": "packages/mcp"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit false --emitDeclarationOnly",
+    "lint": "eslint src",
+    "test": "vitest run"
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.