fastr-mcp-suite 1.0.0 → 1.2.0

package/LICENSE.md

@@ -1,110 +1,26 @@
-# License — Fastr MCP Suite (server implementation)
+# MIT License
 
-The `server/` directory is licensed under the **Business Source License 1.1**
-on the terms below. The skill content under the repository's `skills/` directory
-is a separate work, licensed MIT, and is not part of the Licensed Work.
+Copyright (c) 2026 Atif Jubaer (Fastrsoft)
 
----
-
-Business Source License 1.1
-
-License text copyright (c) 2024 MariaDB plc, All Rights Reserved.
-"Business Source License" is a trademark of MariaDB plc.
-
-Parameters
-
-Licensor:             Atif Jubaer (Fastrsoft)
-Licensed Work:        The Fastr MCP Suite server implementation — the contents of
-                      the `server/` directory of this repository, including its
-                      source code, build scripts, configuration and any bundled
-                      copies of the skill documents. The Licensed Work is
-                      (c) 2026 Atif Jubaer (Fastrsoft).
-Additional Use Grant: You may make production use of the Licensed Work, provided
-                      Your use does not include offering the Licensed Work to third
-                      parties on a hosted or embedded basis in order to compete with
-                      the Licensor's paid version(s) of the Licensed Work, and does
-                      not include reselling, sublicensing or private-labelling the
-                      Licensed Work as a paid MCP server, paid distribution or
-                      commercial hosted service.
-Change Date:          Four years from the date each version of the Licensed Work is
-                      first publicly distributed.
-Change License:       MIT License
-
-Terms
-
-The Licensor hereby grants you the right to copy, modify, create derivative
-works, redistribute, and make non-production use of the Licensed Work. The
-Licensor may make an Additional Use Grant, above, permitting limited production use.
-
-Effective on the Change Date, or the fourth anniversary of the first publicly
-available distribution of a specific version of the Licensed Work under this
-License, whichever comes first, the Licensor hereby grants you rights under
-the terms of the Change License, and the rights granted in the paragraph
-above terminate.
-
-If your use of the Licensed Work does not comply with the requirements
-currently in effect as described in this License, you must purchase a
-commercial license from the Licensor, its affiliated entities, or authorized
-resellers, or you must refrain from using the Licensed Work.
-
-All copies of the original and modified Licensed Work, and derivative works
-of the Licensed Work, are subject to this License. This License applies
-separately for each version of the Licensed Work and the Change Date may vary
-for each version of the Licensed Work released by Licensor.
-
-You must conspicuously display this License on each original or modified copy
-of the Licensed Work. If you receive the Licensed Work in original or
-modified form from a third party, the terms and conditions set forth in this
-License apply to your use of that work.
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
 
-Any use of the Licensed Work in violation of this License will automatically
-terminate your rights under this License for the current and all other
-versions of the Licensed Work.
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
 
-This License does not grant you any right in any trademark or logo of
-Licensor or its affiliates (provided that you may use a trademark or logo of
-Licensor as expressly required by this License).
-
-TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
-AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
-EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
-TITLE.
-Covenants of Licensor
-
-In consideration of the right to use this License's text and the "Business Source
-License" name and trademark, Licensor covenants to MariaDB, and to all other
-recipients of the licensed work to be provided by Licensor:
-
-To specify as the Change License the GPL Version 2.0 or any later version, or a
-license that is compatible with GPL Version 2.0 or a later version, where
-"compatible" means that software provided under the Change License can be
-included in a program with software provided under GPL Version 2.0 or a later
-version. Licensor may specify additional Change Licenses without limitation.
-
-To either: (a) specify an additional grant of rights to use that does not impose
-any additional restriction on the right granted in this License, as the
-Additional Use Grant; or (b) insert the text "None".
-
-To specify a Change Date.
-
-Not to modify this License in any other way.
-
-Notice
-
-The Business Source License (this document, or the "License") is not an Open
-Source license. However, the Licensed Work will eventually be made available
-under an Open Source License, as stated in this License.
-
-For more information on the use of the Business Source License for MariaDB
-products, please visit the MariaDB Business Source License FAQ
-<https://mariadb.com/bsl-faq-mariadb/>. For more information on the use of the
-Business Source License generally, please visit the Adopting and Developing
-Business Source License FAQ <https://mariadb.com/bsl-faq-adopting/>.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
 
 ---
 
-## Commercial licensing
-
-For paid distribution, resale, private-label or hosted use outside the Additional
-Use Grant, contact the Licensor for a commercial license.
+The server and the skill content under `skills/` are both MIT. There is no
+commercial tier, no licence key, and no restriction on hosting a modified copy.

package/README.md

@@ -1,11 +1,42 @@
 # Fastr MCP Suite
 
-One MCP server that ships the Playing Cards — **FluentCart Pro Agent** and **Lemon Squeezy Developer Agent** — as executable tools plus a skills catalog, so an agent pulls only the slice of documentation it needs instead of loading 239 KB of markdown into the context window.
+One MCP server that ships the Playing Cards — **FluentCart Developer Agent** and **Lemon Squeezy Developer Agent** — as executable tools plus a skills catalog, so an agent pulls only the slice of documentation it needs instead of loading 239 KB of markdown into the context window.
+
+**Free and MIT-licensed.** All ten tools are registered for every caller on every transport: no licence key, no account, no subscription, no request quota. Nothing in this server validates a purchase, because there is nothing to purchase.
 
 Protocol: MCP `2026-07-28` (stateless, per-request `_meta` envelope) with a `2025-11-25` legacy fallback. Transports: `stdio` for local clients, Streamable HTTP for marketplaces and hosted deploys.
 
 ## Run it
 
+### From npm
+
+Published as [`fastr-mcp-suite`](https://www.npmjs.com/package/fastr-mcp-suite) — Node 22+, no clone and no build:
+
+```bash
+npx -y fastr-mcp-suite
+```
+
+Client config (Claude Code / Cursor / Windsurf):
+
+```json
+{
+  "mcpServers": {
+    "fastr-suite": {
+      "command": "npx",
+      "args": ["-y", "fastr-mcp-suite"]
+    }
+  }
+}
+```
+
+```bash
+claude mcp add fastr-suite -- npx -y fastr-mcp-suite
+```
+
+The npm package ships the stdio entry point only. The Streamable HTTP transport needs the source tree or the Docker image.
+
+### From source
+
 ```bash
 npm install
 npm run build        # tsc + bundles both skill folders into dist/skills
@@ -14,76 +45,61 @@ node dist/index.js   # stdio
 node dist/http.js    # Streamable HTTP on :8080 (POST /mcp, GET /health)
 ```
 
-Claude Code / Cursor / Windsurf:
+Point a client at the built file:
 
 ```json
 {
   "mcpServers": {
     "fastr-suite": {
       "command": "node",
-      "args": ["/absolute/path/to/server/dist/index.js"],
-      "env": { "PRO_LICENSE_KEY": "optional-license-key" }
+      "args": ["/absolute/path/to/server/dist/index.js"]
     }
   }
 }
 ```
 
-## Tiers
-
-| Tier | What is registered |
-| --- | --- |
-| `core` (free) | `ls_search_docs`, `ls_get_schema`, `fc_search_hooks`, `fc_get_db_schema`, `suite_get_pro_info`, plus `skills/list` and `resources/read` for both skills |
-| `pro` (paid) | everything above **and** `ls_verify_webhook`, `ls_validate_license`, `fc_generate_payment_gateway_boilerplate` |
+## Tools
 
-Pro tools are **not registered** on a core session — the schema never reaches the client, so there is nothing to call. `suite_get_pro_info` is the upgrade surface: it always answers with the current tier and what Pro adds.
+Ten tools, all free. `suite_get_info` reports the same list at runtime, scoped by card.
 
-How a tier is decided:
+| Card | Tool | Answers |
+| --- | --- | --- |
+| FluentCart | `fc_search_hooks` | A hook name, when it fires, its arguments |
+| FluentCart | `fc_get_db_schema` | A `wp_fct_*` table, its columns, the Eloquent model |
+| FluentCart | `fc_get_reference` | Any of the 49 reference files, whole or by heading |
+| FluentCart | `fc_generate_payment_gateway_boilerplate` | A complete PHP gateway class, settings schema and webhook entry point |
+| Lemon Squeezy | `ls_search_docs` | Webhook signatures, checkout payloads, subscription states |
+| Lemon Squeezy | `ls_get_schema` | The exact JSON:API body for an endpoint |
+| Lemon Squeezy | `ls_get_reference` | Any of the 7 Lemon Squeezy reference files, whole or by heading |
+| Lemon Squeezy | `ls_verify_webhook` | Timing-safe HMAC-SHA256 check against a raw payload |
+| Lemon Squeezy | `ls_validate_license` | A live licence key, validated against Lemon Squeezy's API |
+| Suite | `suite_get_info` | What this server is, which tools serve which card, and its licence |
 
-- **stdio** — `PRO_LICENSE_KEY` in the environment unlocks Pro. Convenience switch, not a security boundary.
-- **HTTP** — every request carries `Authorization: Bearer <token>`:
-  1. token in `VALID_LICENSE_KEYS` → Pro (ops/CI seats)
-  2. equals `MCPIZE_GATEWAY_SECRET` → Pro (constant-time compare)
-  3. equals `AGENSI_GATEWAY_SECRET` → Pro (constant-time compare)
-  4. otherwise validated live against `https://api.lemonsqueezy.com/v1/licenses/validate`, cached 10 minutes, active status and store id checked. Any failure fails closed to core.
+The skills catalog is attached as an MCP extension, so clients that understand it also get `skills/list` and `resources/read` over the same 64 files.
 
-Copy [`.env.example`](./.env.example) to `.env` for the HTTP transport.
+`ls_validate_license` is the only tool that reaches the network. It is cached for 60 s, bounded to 32 concurrent calls and times out at 5 s, so a public deploy does not become an unbounded relay into Lemon Squeezy's API.
 
 ## Deploy
 
-Docker (build from the **repository root** so the skill folders are in context):
+### Docker
 
 ```bash
-docker build -f server/Dockerfile -t fastr-mcp-suite .
-docker run -p 8080:8080 --env-file server/.env fastr-mcp-suite
+docker build -t fastr-mcp-suite .
+docker run -p 8080:8080 -e ALLOWED_HOSTS=your-host.example fastr-mcp-suite
 ```
 
-Works as-is on Railway / Render / Fly.io / MCPize: the image serves `POST /mcp` and answers `GET /health` for the platform healthcheck.
+`ALLOWED_HOSTS` is the only environment variable worth setting: a comma-separated Host allowlist for DNS-rebinding protection. `PORT` overrides `8080`. Nothing else is read.
 
-### Smithery
+Any host that accepts a long-running HTTP process works — Railway, Render, Fly.io, a VPS. Mount `/health` as the liveness probe: it returns the protocol version, the card list and the licence.
 
-Smithery publishes a **URL**, not a repo manifest — the old `smithery.yaml`/`smithery.json` format is gone. Deploy the image, then register the endpoint:
+### MCPize
 
-```bash
-npx -y smithery mcp publish "https://<your-host>/mcp" -n <namespace>/fastr-mcp-suite \
-  --config-schema "$(cat server/smithery.config.json)"
-```
+[`mcpize.yaml`](../mcpize.yaml) at the repository root is the deployment manifest; `npx mcpize deploy` builds and publishes from there. MCPize authenticates callers at its own edge, but that credential no longer changes what the server registers — a caller with or without it sees the same ten tools.
 
-[`smithery.config.json`](./smithery.config.json) maps the user's licence key from the `ls-license-key` header onto upstream `Authorization`, which is exactly what the HTTP transport already reads. The field is optional, so a free user connects straight into the core tier.
+## Not affiliated
 
-## Layout
+This is an independent developer tool. It does not connect to a WordPress database, does not modify a FluentCart store, and is not published by either vendor. Documentation in `skills/` is compiled from their public references.
 
-```
-src/
-  auth.ts                     tier resolution (stdio env + HTTP license validation)
-  paths.ts                    skills folder resolution (bundled dist/skills → repo skills/)
-  server.ts                   server factory, catalog attach, Pro info tool
-  index.ts                    stdio entry
-  http.ts                     Streamable HTTP entry + /health
-  cards/lemonsqueezy/tools.ts Card 2 tools
-  cards/fluentcart/tools.ts   Card 1 tools
-scripts/
-  copy-skills.mjs             bundles skills/* into dist/skills for npm
-  verify-stdio.mjs            end-to-end protocol, tier-gating and era probe
-```
+## Licence
 
-Skill **content** is MIT and lives in the public repo under `skills/`. This server implementation is BSL-1.1 — see [LICENSE.md](./LICENSE.md).
+MIT — see [`LICENSE.md`](./LICENSE.md). Fork it, host it, adapt it.

package/dist/auth.d.ts

@@ -1,31 +1,20 @@
-export type Tier = 'core' | 'pro';
-export interface AuthContext {
-    tier: Tier;
-    userId?: string;
-    source: 'stdio' | 'lemonsqueezy' | 'mcpize' | 'agensi' | 'none';
-    /** Human-readable explanation, surfaced by `suite_get_pro_info` and logs. */
-    reason: string;
-}
-/**
- * Local (stdio) tier resolution.
- *
- * Setting `PRO_LICENSE_KEY` in the environment unlocks Pro. This is a local
- * trust boundary, not a security boundary: anyone who controls the machine can
- * set the variable. The paid gate that matters is the HTTP transport, where
- * every request is validated server-side. Commercial terms are enforced by the
- * BSL-1.1 licence in `server/LICENSE`.
- */
-export declare function resolveLocalAuth(): AuthContext;
 /**
- * Resolve the tier for one HTTP request.
- *
- * 1. `VALID_LICENSE_KEYS` allowlist (ops escape hatch, e.g. internal seats).
- * 2. MCPize gateway token, checked against `MCPIZE_GATEWAY_SECRET`.
- * 3. Agensi gateway token, checked against `AGENSI_GATEWAY_SECRET`.
- * 4. Everything else is treated as a Lemon Squeezy licence key and validated live.
+ * The suite is free and MIT-licensed: every tool is registered for every caller
+ * on every transport. There is no tier to resolve, no licence key to validate,
+ * and no outbound call to make before a session can work — so this module no
+ * longer authenticates anything.
  *
- * There is deliberately no prefix-based trust: a client cannot mint itself Pro
- * by sending a string that starts with `ls_live_`.
+ * `AuthContext` survives as a small descriptor of the session. It is what
+ * `createServerInstance` receives and what `suite_get_info` reports, which is
+ * still useful when diagnosing which transport a client actually reached.
  */
-export declare function authenticateRequest(request?: Request): Promise<AuthContext>;
+export type CardId = 'fluentcart' | 'lemonsqueezy';
+export interface AuthContext {
+    /** Always `free`. Kept as a literal so a future gate has one obvious seam. */
+    tier: 'free';
+    cards: CardId[];
+    source: 'stdio' | 'http';
+    reason: string;
+}
+export declare function fullAccess(source: 'stdio' | 'http'): AuthContext;
 //# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,IAAI,GAAG,MAAM,GAAG,KAAK,CAAC;AAElC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,GAAG,cAAc,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IAChE,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;CAChB;AAqCD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAM9C;AAiED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAgCjF"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,MAAM,GAAG,YAAY,GAAG,cAAc,CAAC;AAInD,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,WAAW,CAOhE"}

package/dist/auth.js

@@ -1,143 +1,20 @@
-import crypto from 'node:crypto';
-const LS_VALIDATE_URL = 'https://api.lemonsqueezy.com/v1/licenses/validate';
-const LICENSE_CACHE_TTL_MS = 10 * 60 * 1000;
-/** token -> resolution, so a busy client does not hit Lemon Squeezy on every request. */
-const licenseCache = new Map();
-/** Unauthenticated callers can send arbitrary tokens, so the cache is bounded. */
-const LICENSE_CACHE_MAX = 5000;
-/** A failed validation is cached briefly: it bounds upstream load during an outage. */
-const NEGATIVE_CACHE_TTL_MS = 30 * 1000;
-/** Beyond this many concurrent validations the answer is "core" without calling out. */
-const MAX_INFLIGHT_VALIDATIONS = 64;
-let inFlightValidations = 0;
-function cacheResolution(token, tier, ttlMs) {
-    if (licenseCache.size >= LICENSE_CACHE_MAX) {
-        // Map iteration is insertion-ordered, so the first key is the oldest entry.
-        const oldest = licenseCache.keys().next().value;
-        if (oldest !== undefined)
-            licenseCache.delete(oldest);
-    }
-    licenseCache.set(token, { tier, expiresAt: Date.now() + ttlMs });
-}
-function timingSafeEqualStrings(a, b) {
-    const left = Buffer.from(a, 'utf8');
-    const right = Buffer.from(b, 'utf8');
-    return left.length === right.length && crypto.timingSafeEqual(left, right);
-}
-function bearerToken(authorization) {
-    if (!authorization)
-        return '';
-    return authorization.replace(/^Bearer\s+/i, '').trim();
-}
 /**
- * Local (stdio) tier resolution.
- *
- * Setting `PRO_LICENSE_KEY` in the environment unlocks Pro. This is a local
- * trust boundary, not a security boundary: anyone who controls the machine can
- * set the variable. The paid gate that matters is the HTTP transport, where
- * every request is validated server-side. Commercial terms are enforced by the
- * BSL-1.1 licence in `server/LICENSE`.
- */
-export function resolveLocalAuth() {
-    const key = process.env.PRO_LICENSE_KEY?.trim();
-    if (key && key.length >= 16) {
-        return { tier: 'pro', source: 'stdio', reason: 'PRO_LICENSE_KEY present in environment' };
-    }
-    return { tier: 'core', source: 'stdio', reason: 'stdio session without PRO_LICENSE_KEY' };
-}
-/**
- * Validate a licence key against Lemon Squeezy. Results are cached for 10
- * minutes. Any network or parsing failure fails closed (core tier).
- */
-async function validateLicenseKey(licenseKey) {
-    const cached = licenseCache.get(licenseKey);
-    if (cached && cached.expiresAt > Date.now()) {
-        return {
-            tier: cached.tier,
-            source: 'lemonsqueezy',
-            reason: cached.tier === 'pro' ? 'license key valid (cached)' : 'license key invalid (cached)'
-        };
-    }
-    // Any caller can present an unknown token. Without this cap, a burst of junk
-    // tokens becomes a burst of 5-second outbound requests.
-    if (inFlightValidations >= MAX_INFLIGHT_VALIDATIONS) {
-        return {
-            tier: 'core',
-            source: 'lemonsqueezy',
-            reason: 'license validation concurrency limit reached'
-        };
-    }
-    inFlightValidations += 1;
-    try {
-        const res = await fetch(LS_VALIDATE_URL, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
-            body: new URLSearchParams({ license_key: licenseKey }),
-            signal: AbortSignal.timeout(5000)
-        });
-        const data = (await res.json());
-        const expectedStore = process.env.LS_STORE_ID;
-        const storeMatches = !expectedStore || String(data.license_key?.store_id ?? '') === String(expectedStore);
-        const active = data.valid === true && data.license_key?.status === 'active' && storeMatches;
-        const tier = active ? 'pro' : 'core';
-        cacheResolution(licenseKey, tier, LICENSE_CACHE_TTL_MS);
-        return {
-            tier,
-            source: 'lemonsqueezy',
-            reason: active ? 'active Lemon Squeezy license' : 'license inactive, unknown, or wrong store'
-        };
-    }
-    catch (err) {
-        // Fail closed, but remember the failure for a moment: an outage must not
-        // turn every request from every client into another outbound attempt.
-        cacheResolution(licenseKey, 'core', NEGATIVE_CACHE_TTL_MS);
-        return {
-            tier: 'core',
-            source: 'lemonsqueezy',
-            reason: `license validation unavailable: ${err.message}`
-        };
-    }
-    finally {
-        inFlightValidations -= 1;
-    }
-}
-/**
- * Resolve the tier for one HTTP request.
- *
- * 1. `VALID_LICENSE_KEYS` allowlist (ops escape hatch, e.g. internal seats).
- * 2. MCPize gateway token, checked against `MCPIZE_GATEWAY_SECRET`.
- * 3. Agensi gateway token, checked against `AGENSI_GATEWAY_SECRET`.
- * 4. Everything else is treated as a Lemon Squeezy licence key and validated live.
+ * The suite is free and MIT-licensed: every tool is registered for every caller
+ * on every transport. There is no tier to resolve, no licence key to validate,
+ * and no outbound call to make before a session can work — so this module no
+ * longer authenticates anything.
  *
- * There is deliberately no prefix-based trust: a client cannot mint itself Pro
- * by sending a string that starts with `ls_live_`.
+ * `AuthContext` survives as a small descriptor of the session. It is what
+ * `createServerInstance` receives and what `suite_get_info` reports, which is
+ * still useful when diagnosing which transport a client actually reached.
  */
-export async function authenticateRequest(request) {
-    const token = bearerToken(request?.headers.get('authorization'));
-    if (!token) {
-        return { tier: 'core', source: 'none', reason: 'no Authorization header' };
-    }
-    const allowlist = (process.env.VALID_LICENSE_KEYS || '')
-        .split(',')
-        .map(k => k.trim())
-        .filter(Boolean);
-    // Compared in constant time like the gateway secrets, and without stopping at
-    // the first match so the loop's duration does not reveal an entry's position.
-    let allowlisted = false;
-    for (const candidate of allowlist) {
-        allowlisted = timingSafeEqualStrings(token, candidate) || allowlisted;
-    }
-    if (allowlisted) {
-        return { tier: 'pro', source: 'lemonsqueezy', reason: 'token in VALID_LICENSE_KEYS allowlist' };
-    }
-    const mcpizeSecret = process.env.MCPIZE_GATEWAY_SECRET?.trim();
-    if (mcpizeSecret && timingSafeEqualStrings(token, mcpizeSecret)) {
-        return { tier: 'pro', source: 'mcpize', reason: 'MCPize gateway secret matched' };
-    }
-    const agensiSecret = process.env.AGENSI_GATEWAY_SECRET?.trim();
-    if (agensiSecret && timingSafeEqualStrings(token, agensiSecret)) {
-        return { tier: 'pro', source: 'agensi', reason: 'Agensi gateway secret matched' };
-    }
-    return validateLicenseKey(token);
+const ALL_CARDS = ['fluentcart', 'lemonsqueezy'];
+export function fullAccess(source) {
+    return {
+        tier: 'free',
+        cards: [...ALL_CARDS],
+        source,
+        reason: 'the whole suite is free — no licence key, account, or purchase required'
+    };
 }
 //# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAYjC,MAAM,eAAe,GAAG,mDAAmD,CAAC;AAC5E,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5C,yFAAyF;AACzF,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6C,CAAC;AAE1E,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,uFAAuF;AACvF,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,wFAAwF;AACxF,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAEpC,IAAI,mBAAmB,GAAG,CAAC,CAAC;AAE5B,SAAS,eAAe,CAAC,KAAa,EAAE,IAAU,EAAE,KAAa;IAC/D,IAAI,YAAY,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;QAC3C,4EAA4E;QAC5E,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAChD,IAAI,MAAM,KAAK,SAAS;YAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IACD,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,aAA6B;IAChD,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;AAC5F,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5C,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,8BAA8B;SAC9F,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,wDAAwD;IACxD,IAAI,mBAAmB,IAAI,wBAAwB,EAAE,CAAC;QACpD,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,8CAA8C;SACvD,CAAC;IACJ,CAAC;IAED,mBAAmB,IAAI,CAAC,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YACtD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;QAEF,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAC9C,MAAM,YAAY,GAAG,CAAC,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC,aAAa,CAAC,CAAC;QAC1G,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,KAAK,QAAQ,IAAI,YAAY,CAAC;QAC5F,MAAM,IAAI,GAAS,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAE3C,eAAe,CAAC,UAAU,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;QACxD,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,2CAA2C;SAC9F,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,yEAAyE;QACzE,sEAAsE;QACtE,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC;QAC3D,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,mCAAmC,GAAG,CAAC,OAAO,EAAE;SACzD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,mBAAmB,IAAI,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAiB;IACzD,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IAEjE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;SACrD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SAClB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,8EAA8E;IAC9E,8EAA8E;IAC9E,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;QAClC,WAAW,GAAG,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,WAAW,CAAC;IACxE,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAClG,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,YAAY,IAAI,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,YAAY,IAAI,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACpF,CAAC;IAED,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,SAAS,GAAsB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AAUpE,MAAM,UAAU,UAAU,CAAC,MAAwB;IACjD,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC;QACrB,MAAM;QACN,MAAM,EAAE,yEAAyE;KAClF,CAAC;AACJ,CAAC"}

package/dist/cards/fluentcart/tools.d.ts

@@ -1,4 +1,3 @@
 import type { McpServer } from '@modelcontextprotocol/server';
-import type { AuthContext } from '../../auth.js';
-export declare function registerFluentCartTools(server: McpServer, auth: AuthContext): void;
+export declare function registerFluentCartTools(server: McpServer): void;
 //# sourceMappingURL=tools.d.ts.map

package/dist/cards/fluentcart/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/cards/fluentcart/tools.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAoKlF"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/cards/fluentcart/tools.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAK9D,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAuO/D"}