libmodulor 0.29.0 → 0.31.0

package/dist/esm/target/lib/react/useAction.js

@@ -5,7 +5,6 @@ export function useAction({ action, autoExec = false, confirm, onError, onInit,
     const [errMsg, setErrMsg] = useState(null);
     const [execRes, setExecRes] = useState(null);
     const [execState, setExecState] = useState(onInit ? UCExecState.INITIALIZING : UCExecState.IDLE);
-    // biome-ignore lint/correctness/useExhaustiveDependencies : must run only once
     useEffect(() => {
         (async () => {
             if (execState === UCExecState.INITIALIZING) {

package/dist/esm/target/lib/react/useUC.js

@@ -21,9 +21,6 @@ export function useUC(appManifest, def, auth, opts) {
         }
         return v;
     });
-    // biome-ignore lint/correctness/useExhaustiveDependencies(appManifest): avoid infinite re-rendering
-    // biome-ignore lint/correctness/useExhaustiveDependencies(def): avoid infinite re-rendering
-    // biome-ignore lint/correctness/useExhaustiveDependencies(opts?.fillWith): avoid infinite re-rendering
     useEffect(() => {
         const v = new UC(appManifest, def, auth);
         if (opts?.fillWith) {

package/dist/esm/target/lib/server/AuthenticationChecker.js

@@ -30,19 +30,20 @@ let AuthenticationChecker = class AuthenticationChecker {
         this.ucPolicyFactory = ucPolicyFactory;
     }
     async exec({ authCookie, authorizationHeader, uc, }) {
+        const { lifecycle: { server }, sec, } = uc.def;
+        const authType = sec?.authType ?? DEFAULT_UC_SEC_AT;
         this.logger.trace('Checking auth', {
             authCookie,
             authorizationHeader,
+            authType,
         });
         const output = {
             allowed: false, // By default it's not allowed
             auth: null,
         };
-        const { lifecycle: { server }, sec, } = uc.def;
         if (typeof server !== 'object') {
             return output;
         }
-        const authType = sec?.authType ?? DEFAULT_UC_SEC_AT;
         const policy = (await this.ucPolicyFactory(server.policy));
         const canBeExecutedPreAuth = await policy.canBeExecutedPreAuth();
         if (canBeExecutedPreAuth) {
@@ -53,29 +54,33 @@ let AuthenticationChecker = class AuthenticationChecker {
         }
         else {
             // Follows the OpenAPI spec : https://swagger.io/docs/specification/authentication
+            const fromAuthHeader = authorizationHeader && !Array.isArray(authorizationHeader)
+                ? authorizationHeader
+                : undefined;
+            const fromCookie = authCookie && !Array.isArray(authCookie)
+                ? authCookie
+                : undefined;
             switch (authType) {
                 case 'apiKey':
-                    if (authorizationHeader &&
-                        !Array.isArray(authorizationHeader)) {
+                    if (fromAuthHeader) {
                         output.auth =
                             await this.privateApiKeyAuthenticationChecker.exec({
-                                rawValue: authorizationHeader,
+                                rawValue: fromAuthHeader,
                             });
                     }
                     break;
                 case 'basic':
-                    if (authorizationHeader &&
-                        !Array.isArray(authorizationHeader)) {
+                    if (fromAuthHeader) {
                         output.auth =
                             await this.basicAuthenticationChecker.exec({
-                                rawValue: authorizationHeader,
+                                rawValue: fromAuthHeader,
                             });
                     }
                     break;
                 case 'jwt':
-                    if (authCookie && !Array.isArray(authCookie)) {
+                    if (fromCookie || fromAuthHeader) {
                         output.auth = await this.jwtAuthenticationChecker.exec({
-                            rawValue: authCookie,
+                            rawValue: fromCookie ?? fromAuthHeader,
                         });
                     }
                     break;

package/dist/esm/target/lib/server/JWTAuthenticationChecker.d.ts

@@ -9,6 +9,7 @@ export declare class JWTAuthenticationChecker implements Configurable<S>, Worker
     private jwtManager;
     private logger;
     private settingsManager;
+    private static PREFIXES;
     constructor(jwtManager: JWTManager, logger: Logger, settingsManager: SettingsManager<S>);
     s(): S;
     exec({ rawValue }: Input): Promise<Output | null>;

package/dist/esm/target/lib/server/JWTAuthenticationChecker.js

@@ -10,12 +10,18 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
+var JWTAuthenticationChecker_1;
 import { inject, injectable } from 'inversify';
 import { UnauthorizedError } from '../../../error/index.js';
 let JWTAuthenticationChecker = class JWTAuthenticationChecker {
+    static { JWTAuthenticationChecker_1 = this; }
     jwtManager;
     logger;
     settingsManager;
+    static PREFIXES = [
+        'Bearer',
+        'JWT',
+    ];
     constructor(jwtManager, logger, settingsManager) {
         this.jwtManager = jwtManager;
         this.logger = logger;
@@ -27,7 +33,10 @@ let JWTAuthenticationChecker = class JWTAuthenticationChecker {
         };
     }
     async exec({ rawValue }) {
-        const value = rawValue?.replace('JWT ', '');
+        let value = rawValue;
+        for (const p of JWTAuthenticationChecker_1.PREFIXES) {
+            value = value?.replaceAll(`${p} `, '');
+        }
         if (!value) {
             return null;
         }
@@ -68,7 +77,7 @@ let JWTAuthenticationChecker = class JWTAuthenticationChecker {
         return false;
     }
 };
-JWTAuthenticationChecker = __decorate([
+JWTAuthenticationChecker = JWTAuthenticationChecker_1 = __decorate([
     injectable(),
     __param(0, inject('JWTManager')),
     __param(1, inject('Logger')),

package/dist/esm/target/lib/server/ServerBooter.d.ts

@@ -5,7 +5,7 @@ import type { TargetEntrypointInput } from '../entrypoint.js';
 import { OpenAPISpecBuilder } from '../openapi/OpenAPISpecBuilder.js';
 import { ServerInstaller } from './ServerInstaller.js';
 import type { ServerManager, ServerManagerSettings } from './ServerManager.js';
-type S = Pick<ServerManagerSettings, 'server_expose_openapi_spec' | 'server_expose_openapi_spec_at' | 'server_static_dir_path' | 'server_tmp_path'>;
+type S = Pick<ServerManagerSettings, 'server_expose_mcp' | 'server_expose_mcp_at' | 'server_expose_openapi_spec' | 'server_expose_openapi_spec_at' | 'server_static_dir_path' | 'server_tmp_path'>;
 type Input = TargetEntrypointInput & {
     autoMountUCs?: boolean;
 };

package/dist/esm/target/lib/server/ServerBooter.js

@@ -43,6 +43,8 @@ let ServerBooter = class ServerBooter {
     }
     s() {
         return {
+            server_expose_mcp: this.settingsManager.get()('server_expose_mcp'),
+            server_expose_mcp_at: this.settingsManager.get()('server_expose_mcp_at'),
             server_expose_openapi_spec: this.settingsManager.get()('server_expose_openapi_spec'),
             server_expose_openapi_spec_at: this.settingsManager.get()('server_expose_openapi_spec_at'),
             server_static_dir_path: this.settingsManager.get()('server_static_dir_path'),
@@ -97,6 +99,14 @@ let ServerBooter = class ServerBooter {
             });
             await this.serverManager.mountOpenAPISpec(spec, at);
         }
+        if (this.s().server_expose_mcp) {
+            const at = this.s().server_expose_mcp_at;
+            this.logger.info('Mounting MCP', {
+                at,
+                mountedUCs: mountedUCs.length,
+            });
+            await this.serverManager.mountMCP(mountedUCs, at);
+        }
         await this.serverManager.warmUp();
         await this.serverManager.start();
     }

package/dist/esm/target/lib/server/ServerManager.d.ts

@@ -1,5 +1,6 @@
 import type { AppManifest } from '../../../app/index.js';
 import type { ApiKey, DirPath, FilePath, HostPort, HTTPMethod, Password, URL, URLPath, Username } from '../../../dt/index.js';
+import type { ProductUCsLoaderOutput } from '../../../product/index.js';
 import type { Settings } from '../../../std/index.js';
 import type { UCDef, UCHTTPContract, UCInput, UCManager, UCOPIBase } from '../../../uc/index.js';
 import type { HTTPCSPValue } from '../../../utils/http/types.js';
@@ -25,8 +26,12 @@ export interface ServerManagerSettings extends ServerManagerAuthSettings, Settin
     server_cors_headers: HTTPHeaderName[];
     server_cors_methods: HTTPMethod[];
     server_cors_origins: URL[];
+    server_expose_mcp: boolean;
+    server_expose_mcp_at: URLPath;
     server_expose_openapi_spec: boolean;
     server_expose_openapi_spec_at: URLPath;
+    server_mcp_dangerously_skip_pub_api_key_check: boolean;
+    server_mcp_dangerously_skip_auth_check: boolean;
     server_public_api_key_header_name: PublicApiKeyHeaderName;
     server_public_url: URL;
     server_ssl_fullchain_path: FilePath | null;
@@ -51,6 +56,11 @@ export interface ServerManager extends Initializable {
      * @param contract
      */
     mountSync<I extends UCInput | undefined = undefined, OPI0 extends UCOPIBase | undefined = undefined, OPI1 extends UCOPIBase | undefined = undefined>(appManifest: AppManifest, ucd: UCDef<I, OPI0, OPI1>, contract: UCHTTPContract): void;
+    /**
+     * Mount the MCP endpoint
+     * @param spec
+     */
+    mountMCP(ucs: ProductUCsLoaderOutput, at: URLPath): Promise<void>;
     /**
      * Mount the OpenAPI spec
      * @param spec

package/dist/esm/target/lib/server/ServerRequestHandler.d.ts

@@ -26,12 +26,15 @@ export interface ServerRequestHandlerRes {
     redirect: (location: URL | URLPath) => Promise<void>;
     setCookie: (info: AuthCookieCreatorOutput) => Promise<void>;
 }
-interface Input<I extends UCInput | undefined = undefined, OPI0 extends UCOPIBase | undefined = undefined, OPI1 extends UCOPIBase | undefined = undefined> {
+export interface ServerRequestHandlerInput<I extends UCInput | undefined = undefined, OPI0 extends UCOPIBase | undefined = undefined, OPI1 extends UCOPIBase | undefined = undefined> {
     appManifest: AppManifest;
+    dangerouslySkipAuthCheck?: boolean | undefined;
+    dangerouslySkipPubApiKeyCheck?: boolean | undefined;
     envelope: HTTPDataEnvelope;
     execOpts?: UCManagerExecServerOpts<OPI0, OPI1> | undefined;
     req: ServerRequestHandlerReq;
     res: ServerRequestHandlerRes;
+    skipSideEffects?: boolean | undefined;
     ucd: UCDef<I, OPI0, OPI1>;
     /**
      * It is not injected in the handler constructor because it must be the same as the one used in ServerManager.
@@ -41,15 +44,18 @@ interface Input<I extends UCInput | undefined = undefined, OPI0 extends UCOPIBas
     ucManager: UCManager;
 }
 type BodylessStatus = 204 | 302;
-type Output<OPI0 extends UCOPIBase | undefined = undefined, OPI1 extends UCOPIBase | undefined = undefined> = {
+type Output<OPI0 extends UCOPIBase | undefined = undefined, OPI1 extends UCOPIBase | undefined = undefined> = ({
     body: undefined;
     status: BodylessStatus;
 } | {
     body: UCOutput<OPI0, OPI1> | object;
+    rawErr?: Error;
     status: Exclude<HTTPStatusNumber, BodylessStatus>;
+}) & {
+    rawErr?: Error;
 };
 type S = Pick<ServerManagerSettings, 'server_cookies_name_auth' | 'server_public_api_key_header_name'>;
-export declare class ServerRequestHandler implements Worker<Input, Promise<Output>> {
+export declare class ServerRequestHandler implements Worker<ServerRequestHandlerInput, Promise<Output>> {
     private authCookieCreator;
     private authenticationChecker;
     private customerFacingErrorBuilder;
@@ -58,10 +64,9 @@ export declare class ServerRequestHandler implements Worker<Input, Promise<Outpu
     private requestLogger;
     private settingsManager;
     private ucBuilder;
-    private static X_FORWARDED_PROTO_HEADER_NAME;
     constructor(authCookieCreator: AuthCookieCreator, authenticationChecker: AuthenticationChecker, customerFacingErrorBuilder: CustomerFacingErrorBuilder, publicApiKeyChecker: PublicApiKeyChecker, requestChecker: RequestChecker, requestLogger: RequestLogger, settingsManager: SettingsManager<S>, ucBuilder: UCBuilder);
     s(): S;
-    exec<I extends UCInput | undefined = undefined, OPI0 extends UCOPIBase | undefined = undefined, OPI1 extends UCOPIBase | undefined = undefined>({ appManifest, envelope, execOpts, req, res, ucd, ucManager, }: Input<I, OPI0, OPI1>): Promise<Output<OPI0, OPI1>>;
+    exec<I extends UCInput | undefined = undefined, OPI0 extends UCOPIBase | undefined = undefined, OPI1 extends UCOPIBase | undefined = undefined>({ appManifest, dangerouslySkipAuthCheck, dangerouslySkipPubApiKeyCheck, envelope, execOpts, req, res, skipSideEffects, ucd, ucManager, }: ServerRequestHandlerInput<I, OPI0, OPI1>): Promise<Output<OPI0, OPI1>>;
     private fill;
     private applySideEffects;
     private applyClearAuthSideEffect;

package/dist/esm/target/lib/server/ServerRequestHandler.js

@@ -10,11 +10,10 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-var ServerRequestHandler_1;
 import { inject, injectable } from 'inversify';
-import { IllegalArgumentError, isEmptyJSON } from '../../../error/index.js';
+import { IllegalArgumentError, isEmptyJSON, logDevWarning, } from '../../../error/index.js';
 import { UCBuilder, UCOutputReader, UCOutputSideEffectType, } from '../../../uc/index.js';
-import { AUTHORIZATION_HEADER_NAME } from '../shared.js';
+import { AUTHORIZATION_HEADER_NAME, X_FORWARDED_PROTO_HEADER_NAME, } from '../shared.js';
 import { AuthCookieCreator, } from './AuthCookieCreator.js';
 import { AuthenticationChecker } from './AuthenticationChecker.js';
 import { CustomerFacingErrorBuilder } from './CustomerFacingErrorBuilder.js';
@@ -22,7 +21,6 @@ import { PublicApiKeyChecker } from './PublicApiKeyChecker.js';
 import { RequestChecker } from './RequestChecker.js';
 import { RequestLogger } from './RequestLogger.js';
 let ServerRequestHandler = class ServerRequestHandler {
-    static { ServerRequestHandler_1 = this; }
     authCookieCreator;
     authenticationChecker;
     customerFacingErrorBuilder;
@@ -31,7 +29,6 @@ let ServerRequestHandler = class ServerRequestHandler {
     requestLogger;
     settingsManager;
     ucBuilder;
-    static X_FORWARDED_PROTO_HEADER_NAME = 'X-Forwarded-Proto';
     constructor(authCookieCreator, authenticationChecker, customerFacingErrorBuilder, publicApiKeyChecker, requestChecker, requestLogger, settingsManager, ucBuilder) {
         this.authCookieCreator = authCookieCreator;
         this.authenticationChecker = authenticationChecker;
@@ -48,7 +45,7 @@ let ServerRequestHandler = class ServerRequestHandler {
             server_public_api_key_header_name: this.settingsManager.get()('server_public_api_key_header_name'),
         };
     }
-    async exec({ appManifest, envelope, execOpts, req, res, ucd, ucManager, }) {
+    async exec({ appManifest, dangerouslySkipAuthCheck = false, dangerouslySkipPubApiKeyCheck = false, envelope, execOpts, req, res, skipSideEffects = false, ucd, ucManager, }) {
         try {
             const { bodyRaw, cookie, header, method, secure, url } = req;
             this.requestLogger.exec({
@@ -59,34 +56,46 @@ let ServerRequestHandler = class ServerRequestHandler {
             this.requestChecker.exec({
                 secure,
                 url,
-                xForwardedProtoHeader: await header(ServerRequestHandler_1.X_FORWARDED_PROTO_HEADER_NAME),
+                xForwardedProtoHeader: await header(X_FORWARDED_PROTO_HEADER_NAME),
             });
             const { ext, sec } = ucd;
-            await this.publicApiKeyChecker.exec({
-                checkType: sec?.publicApiKeyCheckType,
-                value: await header(this.s().server_public_api_key_header_name),
-            });
+            if (dangerouslySkipPubApiKeyCheck) {
+                logDevWarning('Skipping pub api key check');
+            }
+            else {
+                await this.publicApiKeyChecker.exec({
+                    checkType: sec?.publicApiKeyCheckType,
+                    value: await header(this.s().server_public_api_key_header_name),
+                });
+            }
             const uc = this.ucBuilder.exec({
                 appManifest,
                 auth: null,
                 def: ucd,
             });
-            const { auth } = await this.authenticationChecker.exec({
-                authCookie: await cookie(this.s().server_cookies_name_auth),
-                authorizationHeader: await header(AUTHORIZATION_HEADER_NAME),
-                uc,
-            });
-            if (auth) {
-                uc.auth = auth;
+            if (dangerouslySkipAuthCheck) {
+                logDevWarning('Skipping auth check');
+            }
+            else {
+                const { auth } = await this.authenticationChecker.exec({
+                    authCookie: await cookie(this.s().server_cookies_name_auth),
+                    authorizationHeader: await header(AUTHORIZATION_HEADER_NAME),
+                    uc,
+                });
+                if (auth) {
+                    uc.auth = auth;
+                }
             }
             await this.fill(req, envelope, uc);
             const output = await ucManager.execServer(uc, execOpts);
-            const { status } = await this.applySideEffects(res, ucd, output);
-            if (status !== undefined) {
-                return {
-                    body: undefined,
-                    status,
-                };
+            if (!skipSideEffects) {
+                const { status } = await this.applySideEffects(res, ucd, output);
+                if (status !== undefined) {
+                    return {
+                        body: undefined,
+                        status,
+                    };
+                }
             }
             if (!output) {
                 return {
@@ -106,6 +115,7 @@ let ServerRequestHandler = class ServerRequestHandler {
             });
             return {
                 body: error.toObj(),
+                rawErr: err,
                 status: error.httpStatus,
             };
         }
@@ -186,7 +196,7 @@ let ServerRequestHandler = class ServerRequestHandler {
         res.setCookie(output);
     }
 };
-ServerRequestHandler = ServerRequestHandler_1 = __decorate([
+ServerRequestHandler = __decorate([
     injectable(),
     __param(0, inject(AuthCookieCreator)),
     __param(1, inject(AuthenticationChecker)),

package/dist/esm/target/lib/server/consts.js

@@ -17,8 +17,12 @@ export const TARGET_DEFAULT_SERVER_MANAGER_SETTINGS = {
     server_csp_default_src: [],
     server_csp_img_src: [],
     server_csp_script_src: [],
+    server_expose_mcp: false,
+    server_expose_mcp_at: '/mcp',
     server_expose_openapi_spec: false,
     server_expose_openapi_spec_at: '/api/openapi.json',
+    server_mcp_dangerously_skip_auth_check: false,
+    server_mcp_dangerously_skip_pub_api_key_check: false,
     server_private_api_key_entries: [],
     server_public_api_key_entries: [unsafeDefaultSetting()],
     server_public_api_key_header_name: 'X-API-Key',

package/dist/esm/target/lib/server-express/funcs.js

@@ -1,7 +1,7 @@
 import cookieParser from 'cookie-parser';
 import express, {} from 'express';
 import fileUpload from 'express-fileupload';
-import { fmtSingleDataMsg, fmtSSEError, isError, SSE_HEADERS, } from '../../../utils/index.js';
+import { defaultStreamOnClose, fmtSingleDataMsg, fmtSSEError, isError, SSE_HEADERS, } from '../../../utils/index.js';
 export function buildHandler(appManifest, ucd, contract, serverRequestHandler, ucManager) {
     const { envelope } = contract;
     const handler = async (req, res) => {
@@ -15,11 +15,7 @@ export function buildHandler(appManifest, ucd, contract, serverRequestHandler, u
                 let streamedOnce = false;
                 execOpts = {
                     stream: {
-                        onClose: async () => {
-                            if (streamedOnce) {
-                                throw new Error('execOpts.stream.onClose needs to be set in the UC ServerMain');
-                            }
-                        },
+                        onClose: defaultStreamOnClose(streamedOnce),
                         onData: async (output) => {
                             streamedOnce = true;
                             if (!output) {

package/dist/esm/target/lib/server-hono/funcs.js

@@ -3,7 +3,7 @@ import { deleteCookie, getCookie, setCookie } from 'hono/cookie';
 import { logger } from 'hono/logger';
 import { secureHeaders } from 'hono/secure-headers';
 import { NotFoundError } from '../../../error/index.js';
-import { fmtSingleDataMsg, fmtSSEError, fromFormData, isError, SSE_HEADERS, } from '../../../utils/index.js';
+import { defaultStreamOnClose, fmtSingleDataMsg, fmtSSEError, fromFormData, isError, SSE_HEADERS, } from '../../../utils/index.js';
 export function buildHandler(appManifest, ucd, contract, serverRequestHandler, ucManager, beforeExec) {
     const { envelope } = contract;
     const handler = async (c) => {
@@ -28,10 +28,12 @@ export function buildHandler(appManifest, ucd, contract, serverRequestHandler, u
                             ctrl.close();
                             closed = true;
                         };
+                        let streamedOnce = false;
                         execOpts = {
                             stream: {
-                                onClose: async () => { },
+                                onClose: defaultStreamOnClose(streamedOnce),
                                 onData: async (output) => {
+                                    streamedOnce = true;
                                     if (!output || closed) {
                                         return;
                                     }

package/dist/esm/target/lib/shared.d.ts

@@ -3,4 +3,5 @@ import type { HTTPHeaderName } from '../../utils/index.js';
 export type AuthCookieName = 'auth';
 export type PublicApiKeyHeaderName = 'X-API-Key' | (string & {});
 export declare const AUTHORIZATION_HEADER_NAME: HTTPHeaderName;
+export declare const X_FORWARDED_PROTO_HEADER_NAME: HTTPHeaderName;
 export declare const DEFAULT_VERSION: SemVerVersion;

package/dist/esm/target/lib/shared.js

@@ -1,2 +1,3 @@
 export const AUTHORIZATION_HEADER_NAME = 'Authorization';
+export const X_FORWARDED_PROTO_HEADER_NAME = 'X-Forwarded-Proto';
 export const DEFAULT_VERSION = '0.1.0';

package/dist/esm/target/nextjs-server/NextJSServerManager.d.ts

@@ -1,5 +1,6 @@
 import type { AppManifest } from '../../app/index.js';
 import type { DirPath, URLPath } from '../../dt/index.js';
+import type { ProductUCsLoaderOutput } from '../../product/index.js';
 import type { UCDef, UCHTTPContract, UCInput, UCManager, UCOPIBase } from '../../uc/index.js';
 import type { OpenAPISpec } from '../lib/openapi/types.js';
 import type { ServerManager } from '../lib/server/ServerManager.js';
@@ -9,6 +10,7 @@ export declare class NextJSServerManager implements ServerManager {
     initSync(): void;
     mount<I extends UCInput | undefined = undefined, OPI0 extends UCOPIBase | undefined = undefined, OPI1 extends UCOPIBase | undefined = undefined>(_appManifest: AppManifest, _ucd: UCDef<I, OPI0, OPI1>, _contract: UCHTTPContract): Promise<void>;
     mountSync<I extends UCInput | undefined = undefined, OPI0 extends UCOPIBase | undefined = undefined, OPI1 extends UCOPIBase | undefined = undefined>(_appManifest: AppManifest, _ucd: UCDef<I, OPI0, OPI1>, _contract: UCHTTPContract): void;
+    mountMCP(_ucs: ProductUCsLoaderOutput, _at: URLPath): Promise<void>;
     mountOpenAPISpec(_spec: OpenAPISpec, _at: URLPath): Promise<void>;
     mountStaticDir(_dirPath: DirPath): Promise<void>;
     start(): Promise<void>;

package/dist/esm/target/nextjs-server/NextJSServerManager.js

@@ -21,6 +21,9 @@ let NextJSServerManager = class NextJSServerManager {
     mountSync(_appManifest, _ucd, _contract) {
         // Nothing to do
     }
+    async mountMCP(_ucs, _at) {
+        // Nothing to do
+    }
     async mountOpenAPISpec(_spec, _at) {
         // Nothing to do
     }

package/dist/esm/target/node-express-server/NodeExpressServerManager.d.ts

@@ -1,8 +1,10 @@
-import { type Express } from 'express';
+import { type Express, type RequestHandler } from 'express';
 import type { AppManifest } from '../../app/index.js';
 import type { DirPath, URLPath } from '../../dt/index.js';
+import type { ProductUCsLoaderOutput } from '../../product/index.js';
 import type { Configurable, EnvironmentManager, Logger, LoggerSettings, SettingsManager } from '../../std/index.js';
 import type { UCDef, UCHTTPContract, UCInput, UCManager, UCOPIBase } from '../../uc/index.js';
+import type { MCPHTTPRequestHandlerBuilder } from '../lib/mcp-server/http/MCPHTTPRequestHandlerBuilder.js';
 import type { OpenAPISpec } from '../lib/openapi/types.js';
 import { CustomerFacingErrorBuilder } from '../lib/server/CustomerFacingErrorBuilder.js';
 import { EntrypointsBuilder } from '../lib/server/EntrypointsBuilder.js';
@@ -20,13 +22,14 @@ export declare class NodeExpressServerManager implements Configurable<S>, Server
     protected environmentManager: EnvironmentManager;
     private helmetMiddlewareBuilder;
     protected logger: Logger;
+    private mcpHTTPRequestHandlerBuilder;
     private serverRequestHandler;
     private serverSSLCertLoader;
     private settingsManager;
     private ucManager;
     protected runtime: Express;
     private server;
-    constructor(corsMiddlewareBuilder: CORSMiddlewareBuilder, customerFacingErrorBuilder: CustomerFacingErrorBuilder, entrypointsBuilder: EntrypointsBuilder, environmentManager: EnvironmentManager, helmetMiddlewareBuilder: HelmetMiddlewareBuilder, logger: Logger, serverRequestHandler: ServerRequestHandler, serverSSLCertLoader: ServerSSLCertLoader, settingsManager: SettingsManager<S>, ucManager: UCManager);
+    constructor(corsMiddlewareBuilder: CORSMiddlewareBuilder, customerFacingErrorBuilder: CustomerFacingErrorBuilder, entrypointsBuilder: EntrypointsBuilder, environmentManager: EnvironmentManager, helmetMiddlewareBuilder: HelmetMiddlewareBuilder, logger: Logger, mcpHTTPRequestHandlerBuilder: MCPHTTPRequestHandlerBuilder<RequestHandler>, serverRequestHandler: ServerRequestHandler, serverSSLCertLoader: ServerSSLCertLoader, settingsManager: SettingsManager<S>, ucManager: UCManager);
     s(): S;
     getRuntime(): Express;
     overrideUCManager(ucManager: UCManager): void;
@@ -34,6 +37,7 @@ export declare class NodeExpressServerManager implements Configurable<S>, Server
     initSync(): void;
     mount<I extends UCInput | undefined = undefined, OPI0 extends UCOPIBase | undefined = undefined, OPI1 extends UCOPIBase | undefined = undefined>(appManifest: AppManifest, ucd: UCDef<I, OPI0, OPI1>, contract: UCHTTPContract): Promise<void>;
     mountSync<I extends UCInput | undefined = undefined, OPI0 extends UCOPIBase | undefined = undefined, OPI1 extends UCOPIBase | undefined = undefined>(appManifest: AppManifest, ucd: UCDef<I, OPI0, OPI1>, contract: UCHTTPContract): void;
+    mountMCP(ucs: ProductUCsLoaderOutput, at: URLPath): Promise<void>;
     mountOpenAPISpec(spec: OpenAPISpec, at: URLPath): Promise<void>;
     mountStaticDir(dirPath: DirPath): Promise<void>;
     start(): Promise<void>;

package/dist/esm/target/node-express-server/NodeExpressServerManager.js

@@ -30,19 +30,21 @@ let NodeExpressServerManager = class NodeExpressServerManager {
     environmentManager;
     helmetMiddlewareBuilder;
     logger;
+    mcpHTTPRequestHandlerBuilder;
     serverRequestHandler;
     serverSSLCertLoader;
     settingsManager;
     ucManager;
     runtime;
     server;
-    constructor(corsMiddlewareBuilder, customerFacingErrorBuilder, entrypointsBuilder, environmentManager, helmetMiddlewareBuilder, logger, serverRequestHandler, serverSSLCertLoader, settingsManager, ucManager) {
+    constructor(corsMiddlewareBuilder, customerFacingErrorBuilder, entrypointsBuilder, environmentManager, helmetMiddlewareBuilder, logger, mcpHTTPRequestHandlerBuilder, serverRequestHandler, serverSSLCertLoader, settingsManager, ucManager) {
         this.corsMiddlewareBuilder = corsMiddlewareBuilder;
         this.customerFacingErrorBuilder = customerFacingErrorBuilder;
         this.entrypointsBuilder = entrypointsBuilder;
         this.environmentManager = environmentManager;
         this.helmetMiddlewareBuilder = helmetMiddlewareBuilder;
         this.logger = logger;
+        this.mcpHTTPRequestHandlerBuilder = mcpHTTPRequestHandlerBuilder;
         this.serverRequestHandler = serverRequestHandler;
         this.serverSSLCertLoader = serverSSLCertLoader;
         this.settingsManager = settingsManager;
@@ -79,6 +81,12 @@ let NodeExpressServerManager = class NodeExpressServerManager {
     mountSync(appManifest, ucd, contract) {
         this.mountCommon(appManifest, ucd, contract);
     }
+    async mountMCP(ucs, at) {
+        this.runtime.post(at, this.mcpHTTPRequestHandlerBuilder.exec({
+            ucManager: this.ucManager,
+            ucs,
+        }));
+    }
     async mountOpenAPISpec(spec, at) {
         this.runtime.get(at, (_req, res) => {
             res.send(spec);
@@ -119,13 +127,14 @@ NodeExpressServerManager = __decorate([
     __param(3, inject('EnvironmentManager')),
     __param(4, inject(HelmetMiddlewareBuilder)),
     __param(5, inject('Logger')),
-    __param(6, inject(ServerRequestHandler)),
-    __param(7, inject(ServerSSLCertLoader)),
-    __param(8, inject('SettingsManager')),
-    __param(9, inject('UCManager')),
+    __param(6, inject('MCPHTTPRequestHandlerBuilder')),
+    __param(7, inject(ServerRequestHandler)),
+    __param(8, inject(ServerSSLCertLoader)),
+    __param(9, inject('SettingsManager')),
+    __param(10, inject('UCManager')),
     __metadata("design:paramtypes", [CORSMiddlewareBuilder,
         CustomerFacingErrorBuilder,
-        EntrypointsBuilder, Object, HelmetMiddlewareBuilder, Object, ServerRequestHandler,
+        EntrypointsBuilder, Object, HelmetMiddlewareBuilder, Object, Object, ServerRequestHandler,
         ServerSSLCertLoader, Object, Object])
 ], NodeExpressServerManager);
 export { NodeExpressServerManager };

package/dist/esm/target/node-hono-server/NodeHonoServerManager.d.ts

@@ -1,8 +1,10 @@
-import type { Hono } from 'hono';
+import type { Hono, MiddlewareHandler } from 'hono';
 import type { AppManifest } from '../../app/index.js';
 import type { DirPath, URLPath } from '../../dt/index.js';
+import type { ProductUCsLoaderOutput } from '../../product/index.js';
 import type { Configurable, EnvironmentManager, Logger, SettingsManager } from '../../std/index.js';
 import type { UCDef, UCHTTPContract, UCInput, UCManager, UCOPIBase } from '../../uc/index.js';
+import type { MCPHTTPRequestHandlerBuilder } from '../lib/mcp-server/http/MCPHTTPRequestHandlerBuilder.js';
 import type { OpenAPISpec } from '../lib/openapi/types.js';
 import { CustomerFacingErrorBuilder } from '../lib/server/CustomerFacingErrorBuilder.js';
 import { EntrypointsBuilder } from '../lib/server/EntrypointsBuilder.js';
@@ -18,13 +20,14 @@ export declare class NodeHonoServerManager implements Configurable<S>, ServerMan
     private entrypointsBuilder;
     protected environmentManager: EnvironmentManager;
     private logger;
+    private mcpHTTPRequestHandlerBuilder;
     private serverRequestHandler;
     private serverSSLCertLoader;
     private settingsManager;
     private ucManager;
     protected runtime: Hono;
     private server;
-    constructor(corsMiddlewareBuilder: CORSMiddlewareBuilder, customerFacingErrorBuilder: CustomerFacingErrorBuilder, entrypointsBuilder: EntrypointsBuilder, environmentManager: EnvironmentManager, logger: Logger, serverRequestHandler: ServerRequestHandler, serverSSLCertLoader: ServerSSLCertLoader, settingsManager: SettingsManager<S>, ucManager: UCManager);
+    constructor(corsMiddlewareBuilder: CORSMiddlewareBuilder, customerFacingErrorBuilder: CustomerFacingErrorBuilder, entrypointsBuilder: EntrypointsBuilder, environmentManager: EnvironmentManager, logger: Logger, mcpHTTPRequestHandlerBuilder: MCPHTTPRequestHandlerBuilder<MiddlewareHandler>, serverRequestHandler: ServerRequestHandler, serverSSLCertLoader: ServerSSLCertLoader, settingsManager: SettingsManager<S>, ucManager: UCManager);
     s(): S;
     getRuntime(): Hono;
     overrideUCManager(ucManager: UCManager): void;
@@ -32,6 +35,7 @@ export declare class NodeHonoServerManager implements Configurable<S>, ServerMan
     initSync(): void;
     mount<I extends UCInput | undefined = undefined, OPI0 extends UCOPIBase | undefined = undefined, OPI1 extends UCOPIBase | undefined = undefined>(appManifest: AppManifest, ucd: UCDef<I, OPI0, OPI1>, contract: UCHTTPContract): Promise<void>;
     mountSync<I extends UCInput | undefined = undefined, OPI0 extends UCOPIBase | undefined = undefined, OPI1 extends UCOPIBase | undefined = undefined>(appManifest: AppManifest, ucd: UCDef<I, OPI0, OPI1>, contract: UCHTTPContract): void;
+    mountMCP(ucs: ProductUCsLoaderOutput, at: URLPath): Promise<void>;
     mountOpenAPISpec(spec: OpenAPISpec, at: URLPath): Promise<void>;
     mountStaticDir(dirPath: DirPath): Promise<void>;
     start(): Promise<void>;