@adcp/sdk 12.0.0 → 12.0.1

package/dist/lib/server/serve.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/server/serve.ts"],"sourcesContent":["/**\n * One-liner HTTP server for AdCP MCP agents.\n *\n * Wraps the StreamableHTTPServerTransport + http.createServer boilerplate\n * so agent builders can focus on business logic.\n *\n * @example\n * ```typescript\n * import { createTaskCapableServer, serve } from '@adcp/sdk';\n *\n * function createAgent({ taskStore }) {\n *   const server = createTaskCapableServer('My Agent', '1.0.0', { taskStore });\n *   server.registerTool('get_signals', { description: 'Discover audiences.', inputSchema: schema }, handler);\n *   return server;\n * }\n *\n * serve(createAgent); // listening on http://localhost:3001/mcp\n * ```\n */\n\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\nimport { PARSE_ERROR, isJsonContentType } from '@modelcontextprotocol/server';\nimport { hostHeaderValidation, originValidation } from '@modelcontextprotocol/node';\nimport { createServer, type IncomingMessage, type Server as HttpServer } from 'http';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { TaskStore } from '@modelcontextprotocol/sdk/experimental/tasks/interfaces.js';\nimport { InMemoryTaskStore } from '@modelcontextprotocol/sdk/experimental/tasks/stores/in-memory.js';\nimport type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';\nimport type { AuthPrincipal, Authenticator, ServeRequestContext } from './auth';\nimport {\n  ADCP_SERVE_REQUEST_CONTEXT,\n  AuthError,\n  authenticatorNeedsRawBody,\n  respondUnauthorized,\n  signatureErrorCodeFromCause,\n} from './auth';\nimport { ADCP_PRE_TRANSPORT, ADCP_INSTRUCTIONS_FN, type AdcpPreTransport } from './create-adcp-server';\nimport { isAdcpServer, type AdcpServer } from './adcp-server';\nimport { createModernMcpServerAdapter } from './mcp-modern-server';\n\n/**\n * Context passed to the agent factory on each request.\n *\n * Contains shared resources that must survive across stateless HTTP requests,\n * such as the task store for MCP Tasks protocol support.\n *\n * For multi-tenant / multi-host deployments, provide a custom `TaskStore` via\n * `ServeOptions` that enforces tenant/session scoping, and branch on\n * {@link host} inside your factory to return host-specific handlers.\n */\nexport interface ServeContext {\n  /** Shared task store — use this when creating your McpServer so tasks persist across requests. */\n  taskStore: TaskStore;\n  /**\n   * Canonical host the request arrived on, lowercased with port preserved\n   * (e.g. `snap.example.com`, `localhost:3001`). Resolved from\n   * `X-Forwarded-Host` when `ServeOptions.trustForwardedHost` is true,\n   * otherwise from the `Host` header. Empty string when neither header\n   * is present (unusual — HTTP/1.1 requires `Host`).\n   *\n   * Use this in the factory to branch on hostname when a single process\n   * fronts multiple agents. The same string is passed to\n   * `publicUrl` / `protectedResource` resolver functions.\n   */\n  host: string;\n}\n\n/**\n * Thrown from an agent factory (or a `publicUrl` / `protectedResource`\n * resolver) when the incoming request's host isn't configured. `serve()`\n * catches it and responds 404 with a generic body — the adapter routing\n * table never crosses the wire. Any other thrown error still surfaces\n * as 500 so unrelated bugs stay loud.\n */\nexport class UnknownHostError extends Error {\n  constructor(message = 'Unknown host') {\n    super(message);\n    this.name = 'UnknownHostError';\n  }\n}\n\n/**\n * OAuth 2.0 Protected Resource Metadata (RFC 9728) advertised at\n * `/.well-known/oauth-protected-resource<mountPath>`.\n *\n * The `resource` URL itself is taken from `ServeOptions.publicUrl` — set\n * that to the canonical MCP endpoint (e.g. `https://my-agent.example.com/mcp`)\n * so clients request tokens bound to the right RFC 8707 audience.\n */\nexport interface ProtectedResourceMetadata {\n  /** URLs of authorization servers that issue tokens for this resource. */\n  authorization_servers: string[];\n  /** Scopes this resource accepts. Optional. */\n  scopes_supported?: string[];\n  /** Bearer token methods supported. Defaults to `['header']`. */\n  bearer_methods_supported?: Array<'header' | 'body' | 'query'>;\n  /** Human-readable resource docs URL. Optional. */\n  resource_documentation?: string;\n  /** Per-resource policy URL. Optional. */\n  resource_policy_uri?: string;\n  /** Per-resource ToS URL. Optional. */\n  resource_tos_uri?: string;\n}\n\nexport interface ServeOptions {\n  /** Port to listen on. Defaults to PORT env var or 3001. */\n  port?: number;\n  /** HTTP path to mount the MCP endpoint on. Defaults to '/mcp'. */\n  path?: string;\n  /**\n   * Hostnames allowed on framework-owned AdCP server requests, without ports.\n   * The guard runs before protocol-era classification, so it protects both\n   * legacy and MCP 2026-07-28 traffic. Defaults to the hostname from\n   * `publicUrl`, or localhost-only when no public URL is set. Public and\n   * reverse-proxied deployments must configure `publicUrl` or this allowlist;\n   * include the upstream Host too when a proxy rewrites it.\n   */\n  allowedHosts?: string[];\n  /**\n   * Origin hostnames allowed on browser-originated framework AdCP requests,\n   * across both protocol eras. Requests without Origin pass. Defaults to\n   * {@link allowedHosts}.\n   */\n  allowedOrigins?: string[];\n  /**\n   * Maximum buffered MCP request body size used for era classification.\n   * Defaults to 2 MiB. Set explicitly when an AdCP extension legitimately\n   * carries larger JSON payloads.\n   */\n  maxRequestBytes?: number;\n  /** Called when the server starts listening. */\n  onListening?: (url: string) => void;\n  /**\n   * Async check called before the server begins accepting connections.\n   * Throw to abort boot — `serve()` logs the error and calls `process.exit(1)`,\n   * so the server never enters listen mode and no traffic arrives during the\n   * check. Use to validate external dependencies (database pools, credential\n   * fetches) so a misconfigured deployment fails loudly at startup rather than\n   * silently on the first live request.\n   *\n   * @example\n   * ```ts\n   * serve(createAgent, {\n   *   readinessCheck: () => store.probe(),\n   * });\n   * ```\n   */\n  readinessCheck?: () => Promise<void>;\n  /**\n   * Custom task store. Defaults to a shared InMemoryTaskStore.\n   *\n   * The default InMemoryTaskStore only evicts tasks that have a TTL set.\n   * For long-running servers, always set `ttl` when creating tasks, or\n   * provide a store with automatic eviction to prevent unbounded memory growth.\n   */\n  taskStore?: TaskStore;\n\n  /**\n   * Canonical public URL of this MCP endpoint (e.g. `https://my-agent.example.com/mcp`).\n   * Required when `protectedResource` is configured — the RFC 9728 `resource`\n   * field, the RFC 6750 `resource_metadata` URL on 401 challenges, and the\n   * JWT audience your tokens must carry are all derived from it. Setting this\n   * defends against attacker-controlled `Host` header phishing: without it,\n   * the server would advertise whatever host a caller happened to send.\n   *\n   * Must be an absolute https:// URL whose path matches the mount path.\n   *\n   * **Multi-host.** Pass a function `(host) => string` when one process\n   * fronts multiple hostnames (white-label publishers, multi-brand\n   * adapters). The resolver runs per unique host — the returned URL is\n   * cached and used as the RFC 9728 `resource`, the 401-challenge\n   * `resource_metadata`, and the JWT audience for that host. Each\n   * resolved URL's path must match the mount path, same as the static\n   * form. Setting {@link trustForwardedHost} is recommended when\n   * behind a proxy.\n   */\n  publicUrl?: string | ((host: string) => string);\n\n  /**\n   * Authentication middleware applied to every request. When configured,\n   * missing or invalid credentials produce a 401 with a compliant\n   * `WWW-Authenticate` header — no request reaches the MCP transport\n   * without passing. Use helpers from `./auth`: `verifyApiKey`,\n   * `verifyBearer`, or `anyOf(verifyApiKey(...), verifyBearer(...))`.\n   */\n  authenticate?: Authenticator;\n\n  /**\n   * Advertise OAuth 2.0 protected-resource metadata at\n   * `/.well-known/oauth-protected-resource<mountPath>`. Requires {@link publicUrl}.\n   *\n   * Pass a function `(host) => ProtectedResourceMetadata` for multi-host\n   * deployments whose authorization servers or supported scopes vary per\n   * hostname (e.g., each white-label seller has its own AS). The resolver\n   * runs once per unique host and the result is cached. The static form\n   * still works when every host uses the same PRM body.\n   */\n  protectedResource?: ProtectedResourceMetadata | ((host: string) => ProtectedResourceMetadata);\n\n  /**\n   * Reuse the agent returned by the factory across requests instead of\n   * closing it after each. Default `false` (one fresh server per\n   * request — the pre-existing behavior).\n   *\n   * When `true`, `serve()` DOES NOT call `agentServer.close()` between\n   * requests. The factory is still called on every request; it's the\n   * caller's responsibility to cache `AdcpServer` instances (typically\n   * keyed on `ctx.host`) and return the cached instance when possible.\n   * Concurrent requests to the same cached server are serialized per\n   * instance — `McpServer.connect()` rejects when a transport is\n   * already attached, so the framework wraps the\n   * connect→handleRequest→release cycle in a per-instance async\n   * mutex. Requests for DIFFERENT cached servers still run in parallel.\n   *\n   * Use when `createAdcpServer(...)` setup cost (tool registration,\n   * handler wiring) is a measurable portion of request latency — common\n   * in multi-host deployments with many tools per host. Trade-off:\n   * throughput per unique host drops to 1 in flight at a time. For\n   * higher concurrency per host, cache a small pool of servers in the\n   * factory and round-robin.\n   *\n   * Cleanup is the caller's responsibility: listen for the process\n   * shutdown signal and call `close()` on every cached server to\n   * release MCP Tasks timers, HTTP keepalives, etc.\n   *\n   * **Incompatible with long-lived server→client streams.** MCP's\n   * `Protocol._onclose` aborts in-flight handlers and clears progress\n   * tokens when the transport closes. In stateless HTTP mode (the\n   * default this helper uses) each request is already single-response,\n   * so this is a no-op concern. Don't enable `reuseAgent` if you\n   * eventually wire a transport that keeps an SSE channel open across\n   * multiple logical requests.\n   */\n  reuseAgent?: boolean;\n\n  /**\n   * Trust `X-Forwarded-Host` and RFC 7239 `Forwarded: host=...` for\n   * host resolution and for reconstructing the public URL on 401\n   * challenges. Default `false` — an attacker-controlled header can't\n   * flip the advertised OAuth `resource` URL unless you opt in.\n   *\n   * **Your proxy must OVERWRITE the forwarded headers on ingress, not\n   * append.** The framework trusts the first (left-most) entry in a\n   * chain. With an overwriting proxy that's the sanitized value; with\n   * an appending proxy it's whatever the client sent — an attacker\n   * picks it. Common behavior:\n   *\n   * - Overwrite (safe to trust): Fly.io, Cloud Run, GCP HTTPS LB.\n   * - Append (NOT safe without extra config): AWS ALB default, nginx\n   *   default. These need `proxy_set_header X-Forwarded-Host $host;`\n   *   or equivalent before enabling this flag.\n   *\n   * Verify your proxy's behavior against a request that already has\n   * `X-Forwarded-Host: attacker.example` in it before turning this on.\n   */\n  trustForwardedHost?: boolean;\n\n  /**\n   * Pre-MCP middleware — runs after authentication but before MCP transport\n   * is connected. Intended for transport-layer concerns like RFC 9421\n   * request-signature verification: the agent's body is already buffered\n   * into `(req as any).rawBody` before the middleware fires so signature\n   * verifiers can hash it without racing the transport's own body read.\n   *\n   * Return `true` to signal the middleware handled the response (e.g. a\n   * 401 with `WWW-Authenticate`); the transport is skipped. Return `false`\n   * to continue into MCP dispatch.\n   *\n   * Throwing from the middleware produces a 500 with a generic body.\n   */\n  preTransport?: (\n    req: import('http').IncomingMessage & { rawBody?: string },\n    res: import('http').ServerResponse\n  ) => Promise<boolean>;\n}\n\n/**\n * Start an HTTP server that serves an AdCP MCP agent.\n *\n * Creates a new MCP server instance per request (stateless), wires up the\n * StreamableHTTPServerTransport, and returns the underlying http.Server\n * for lifecycle control.\n *\n * A shared task store is created once and passed to the factory on every\n * request via `ServeContext`. This ensures MCP Tasks (create → poll → result)\n * work correctly across stateless HTTP requests.\n *\n * **Multi-host.** Pass functions for `publicUrl` and `protectedResource` and\n * branch on `ctx.host` in the factory to front multiple hostnames from one\n * process. The framework resolves host from `X-Forwarded-Host` (when\n * `trustForwardedHost: true`) or `Host`, threads it through `ServeContext`,\n * and caches per-host `publicUrl`/PRM so each hostname advertises its own\n * audience-bound `resource`.\n *\n * @param createAgent - Factory function that returns a configured server —\n *   either an `AdcpServer` from `createAdcpServer()` or a raw SDK `McpServer`\n *   from `createTaskCapableServer()`. Called once per request so each gets a\n *   fresh instance (a server can only be connected once). Receives a\n *   `ServeContext` with a shared `taskStore` and the resolved `host` —\n *   branch on `host` to return host-specific handlers in multi-host mode.\n *   Framework `AdcpServer` instances serve both MCP 2026-07-28 and legacy\n *   clients. Raw v1 SDK `McpServer` instances remain legacy-only so resources,\n *   prompts, Tasks, and custom transport extras are never silently dropped.\n * @param options - Port, path, and callback configuration.\n * @returns The http.Server instance. Use the `onListening` callback or\n *   listen for the 'listening' event to know when it's ready.\n */\nexport function serve(createAgent: (ctx: ServeContext) => AdcpServer | McpServer, options?: ServeOptions): HttpServer {\n  const envPort = process.env.PORT ? parseInt(process.env.PORT, 10) : undefined;\n  if (envPort !== undefined && (Number.isNaN(envPort) || envPort < 0 || envPort > 65535)) {\n    throw new Error(`Invalid PORT environment variable: \"${process.env.PORT}\"`);\n  }\n  const port = options?.port ?? envPort ?? 3001;\n  const mountPath = options?.path ?? '/mcp';\n  const taskStore = options?.taskStore ?? new InMemoryTaskStore();\n  const trustForwardedHost = options?.trustForwardedHost === true;\n  const reuseAgent = options?.reuseAgent === true;\n  const maxRequestBytes = options?.maxRequestBytes ?? 2 * 1024 * 1024;\n  if (!Number.isSafeInteger(maxRequestBytes) || maxRequestBytes <= 0) {\n    throw new Error('serve(): `maxRequestBytes` must be a positive safe integer');\n  }\n\n  // Per-instance mutex chain for `reuseAgent: true`. The MCP SDK's\n  // `Protocol.connect()` hard-throws when a transport is already\n  // attached (node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js:215),\n  // so concurrent requests that land on the same cached server would\n  // race without this. WeakMap so agents GC normally when the caller\n  // drops references. Only used when `reuseAgent` is true — the\n  // default path still creates a fresh server per request and doesn't\n  // share any state across calls.\n  const reuseMutexes = new WeakMap<AdcpServer | McpServer, Promise<unknown>>();\n\n  if (options?.protectedResource && !options.publicUrl) {\n    throw new Error(\n      'serve(): `protectedResource` requires `publicUrl` (the canonical https:// URL clients use for this MCP endpoint). ' +\n        'Without it, the server would advertise an attacker-controlled Host header as the OAuth resource URL.'\n    );\n  }\n\n  const publicUrlOption = options?.publicUrl;\n  const protectedResourceOption = options?.protectedResource;\n  const publicUrlIsFn = typeof publicUrlOption === 'function';\n  const prmIsFn = typeof protectedResourceOption === 'function';\n\n  // Static publicUrl — validate once at construction. Function form validates\n  // lazily per host so a stale factory for one host can't prevent boot.\n  let staticPublicOrigin: string | undefined;\n  if (typeof publicUrlOption === 'string') {\n    staticPublicOrigin = validatePublicUrl(publicUrlOption, mountPath);\n  }\n\n  // Per-host caches. Function-form options are pure host → value lookups,\n  // so memoization is safe and avoids the per-request allocation of\n  // `new URL(...)` plus the caller's own host → config table work.\n  const publicUrlCache = new Map<string, string>();\n  const publicOriginCache = new Map<string, string>();\n  const prmCache = new Map<string, ProtectedResourceMetadata>();\n\n  const resolvePublicUrl = (host: string): string | undefined => {\n    if (typeof publicUrlOption === 'string') return publicUrlOption;\n    if (!publicUrlIsFn) return undefined;\n    let cached = publicUrlCache.get(host);\n    if (cached !== undefined) return cached;\n    cached = (publicUrlOption as (h: string) => string)(host);\n    const origin = validatePublicUrl(cached, mountPath);\n    publicUrlCache.set(host, cached);\n    publicOriginCache.set(host, origin);\n    return cached;\n  };\n\n  const resolvePublicOrigin = (host: string): string | undefined => {\n    if (typeof publicUrlOption === 'string') return staticPublicOrigin;\n    // Populate via resolvePublicUrl so both caches share a single validation pass.\n    if (resolvePublicUrl(host) == null) return undefined;\n    return publicOriginCache.get(host);\n  };\n\n  const resolveProtectedResource = (host: string): ProtectedResourceMetadata | undefined => {\n    if (!protectedResourceOption) return undefined;\n    if (!prmIsFn) return protectedResourceOption as ProtectedResourceMetadata;\n    let cached = prmCache.get(host);\n    if (cached !== undefined) return cached;\n    cached = (protectedResourceOption as (h: string) => ProtectedResourceMetadata)(host);\n    prmCache.set(host, cached);\n    return cached;\n  };\n\n  if (options?.authenticate == null && process.env.NODE_ENV === 'production') {\n    console.warn(\n      '[adcp/serve] No `authenticate` configured — this agent will accept unauthenticated requests. ' +\n        'AdCP security_baseline requires authentication in production.'\n    );\n  }\n\n  const explicitPreTransport = options?.preTransport as AdcpPreTransport | undefined;\n\n  const protectedResourcePath = `/.well-known/oauth-protected-resource${mountPath}`;\n\n  const httpServer = createServer(async (req, res) => {\n    const { pathname } = new URL(req.url || '', 'http://localhost');\n    const host = resolveHost(req, { trustForwardedHost });\n\n    // RFC 9728 protected-resource metadata — intentionally auth-free so\n    // clients can discover the authorization server before they have a token.\n    if (protectedResourceOption && pathname === protectedResourcePath) {\n      let resource: string | undefined;\n      let prm: ProtectedResourceMetadata | undefined;\n      try {\n        resource = resolvePublicUrl(host);\n        prm = resolveProtectedResource(host);\n      } catch (err) {\n        if (err instanceof UnknownHostError) {\n          // Operator signalled \"this host isn't in my routing table.\" 404\n          // lets the OAuth grader probe fall through cleanly and doesn't\n          // leak the configured host set across the wire.\n          res.writeHead(404);\n          res.end('Not found');\n          return;\n        }\n        console.error('[adcp/serve] publicUrl/protectedResource resolver failed:', err);\n        res.writeHead(500, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'Protected-resource metadata unavailable for this host.' }));\n        return;\n      }\n      if (!resource || !prm) {\n        // Fail closed: advertising a garbage resource URL would mint\n        // audience-mismatched tokens across the fleet. 404 signals \"this\n        // host doesn't publish PRM\" — the operator sees it and either\n        // wires the host up or takes it out of DNS.\n        res.writeHead(404);\n        res.end('Not found');\n        return;\n      }\n      const body = {\n        resource,\n        ...prm,\n        bearer_methods_supported: prm.bearer_methods_supported ?? ['header'],\n      };\n      res.writeHead(200, { 'Content-Type': 'application/json' });\n      res.end(JSON.stringify(body));\n      return;\n    }\n\n    if (pathname === mountPath || pathname === `${mountPath}/`) {\n      // Resolve per-request `resource_metadata` URL for 401 challenges and\n      // the per-host `publicUrl` authenticators read via\n      // {@link getServeRequestContext}. Resolving both up front means\n      // the audience callback in `verifyBearer` can never diverge from\n      // what the framework advertises in `/.well-known/...`. For static\n      // PRM this is the same string every request (pre-multi-host\n      // behavior); for function-form PRM/URL it follows the host.\n      let resourceMetadataUrl: string | undefined;\n      let resolvedPublicUrl: string | undefined;\n      try {\n        resolvedPublicUrl = resolvePublicUrl(host);\n      } catch (err) {\n        if (err instanceof UnknownHostError) {\n          res.writeHead(404);\n          res.end('Not found');\n          return;\n        }\n        console.error('[adcp/serve] publicUrl resolver failed:', err);\n        res.writeHead(500, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'Protected-resource metadata unavailable for this host.' }));\n        return;\n      }\n      if (protectedResourceOption) {\n        const hostOrigin = resolvePublicOrigin(host);\n        if (hostOrigin) resourceMetadataUrl = `${hostOrigin}${protectedResourcePath}`;\n      }\n\n      // Stamp the serve-resolved context on the request so authenticator\n      // callbacks (e.g. `verifyBearer`'s audience resolver) inherit the\n      // framework's host resolution — they MUST NOT re-derive host from\n      // raw headers, since that would diverge from what PRM advertises\n      // and let a spoofed `X-Forwarded-Host` flip the JWT audience check\n      // when `trustForwardedHost` is false.\n      const serveRequestContext: ServeRequestContext = resolvedPublicUrl\n        ? { host, publicUrl: resolvedPublicUrl }\n        : { host };\n      (req as IncomingMessage & { [ADCP_SERVE_REQUEST_CONTEXT]?: ServeRequestContext })[ADCP_SERVE_REQUEST_CONTEXT] =\n        serveRequestContext;\n\n      // Body buffering happens at most once per request. An idempotent helper\n      // lets the auth path (for signature authenticators) and the preTransport\n      // path share the buffer without re-reading a drained stream.\n      let rawBody: string | undefined;\n      let parsedBody: unknown;\n      let bodyParseFailed = false;\n      const ensureRawBody = async (): Promise<void> => {\n        if (rawBody !== undefined) return;\n        rawBody = await bufferBody(req, maxRequestBytes);\n        (req as { rawBody?: string }).rawBody = rawBody;\n        if (rawBody.length > 0) {\n          try {\n            parsedBody = JSON.parse(rawBody);\n          } catch {\n            bodyParseFailed = true;\n          }\n        }\n      };\n\n      // RFC 9421 signature authenticators need `req.rawBody` for Content-Digest\n      // recompute, so buffer before authentication runs when the authenticator\n      // (or any branch of an anyOf composition) carries the needs-raw-body tag.\n      if (authenticatorNeedsRawBody(options?.authenticate)) {\n        try {\n          await ensureRawBody();\n        } catch (err) {\n          // `bufferBody` has already called `req.destroy()` on the\n          // oversize path; additional teardown here would race the\n          // response write. Write the status and return.\n          const errName = (err as Error).name || 'Error';\n          console.error(`[adcp/serve] request body read failed before auth: ${errName}`);\n          if (!res.headersSent) {\n            res.writeHead(400, { 'Content-Type': 'application/json' });\n            res.end(JSON.stringify({ error: 'Request body read failed.' }));\n          }\n          return;\n        }\n      }\n\n      // Enforce authentication before transport work.\n      if (options?.authenticate) {\n        let principal: AuthPrincipal | null;\n        try {\n          principal = await options.authenticate(req);\n        } catch (err) {\n          // Surface only sanitized messages to the client; log internal cause server-side.\n          const publicMessage = err instanceof AuthError ? err.publicMessage : 'Credentials rejected.';\n          console.error('[adcp/auth] rejected:', err);\n          // Switch challenge scheme to `Signature` when the rejection\n          // originates in the RFC 9421 verifier — the signed_requests\n          // negative-vector grader reads the error code from the\n          // `WWW-Authenticate` header, so collapsing it into the generic\n          // `Bearer error=\"invalid_token\"` challenge would surface the\n          // wrong code and fail every negative vector.\n          const signatureCode = signatureErrorCodeFromCause(err);\n          if (signatureCode) {\n            respondUnauthorized(req, res, {\n              signatureError: signatureCode,\n              errorDescription: publicMessage,\n              resourceMetadata: resourceMetadataUrl,\n            });\n            return;\n          }\n          respondUnauthorized(req, res, {\n            error: 'invalid_token',\n            errorDescription: publicMessage,\n            resourceMetadata: resourceMetadataUrl,\n          });\n          return;\n        }\n        if (!principal) {\n          respondUnauthorized(req, res, {\n            error: 'invalid_token',\n            errorDescription: 'Missing or unrecognized credentials.',\n            resourceMetadata: resourceMetadataUrl,\n          });\n          return;\n        }\n        // Propagate to MCP transport so tool handlers see `extra.authInfo`.\n        attachAuthInfo(req, principal);\n      }\n\n      // Create the agent first so we can inspect it for an auto-wired\n      // preTransport attached by `createAdcpServer({ signedRequests })`. An\n      // explicit `options.preTransport` wins — it lets callers override the\n      // default wiring (e.g., to add request logging or swap verifier\n      // implementations).\n      let agentServer: AdcpServer | McpServer;\n      try {\n        agentServer = createAgent({ taskStore, host });\n      } catch (err) {\n        if (err instanceof UnknownHostError) {\n          // Factory signalled \"this host isn't routable.\" 404 keeps the\n          // adapter table off the wire while giving ops a clean failure\n          // mode instead of the generic-500 confusion.\n          res.writeHead(404);\n          res.end('Not found');\n          return;\n        }\n        // Unexpected factory failure — surface as 500 to the client and\n        // log server-side. Rethrowing would bubble to the createServer\n        // handler as an unhandled rejection (async callback), which\n        // could crash a node process with `--unhandled-rejections=strict`.\n        console.error('[adcp/serve] factory threw:', err);\n        if (!res.headersSent) {\n          res.writeHead(500, { 'Content-Type': 'application/json' });\n          res.end(JSON.stringify({ error: 'Internal server error' }));\n        }\n        return;\n      }\n      // Refuse `reuseAgent: true` + function-form `instructions`. The function\n      // is captured at server construction and would not re-evaluate per\n      // session under server reuse — silently degrading to \"instructions are\n      // a constant after all\" is worse than failing loud at the first request.\n      // Adopters fix this by removing `reuseAgent: true` (default factory\n      // creates a fresh agent per request, which is what the function needs)\n      // OR by passing a static string for `instructions`.\n      //\n      // The check fires when `reuseAgent: true` was declared, regardless of\n      // whether the adopter's factory actually caches. The flag is the\n      // adopter's stated intent to reuse; we can't introspect cache behavior.\n      if (reuseAgent && (agentServer as unknown as Record<symbol, unknown>)[ADCP_INSTRUCTIONS_FN] === true) {\n        const hint =\n          'Drop `reuseAgent: true` (a fresh agent per request fires the function each session) OR pass a static string for `instructions`.';\n        console.error(\n          '[adcp/serve] refusing reuseAgent: true with function-form instructions. ' +\n            'The function fires once per agent instance lifetime (at MCP initialize) and would not re-evaluate on subsequent sessions under server reuse. ' +\n            hint\n        );\n        if (!res.headersSent) {\n          res.writeHead(500, { 'Content-Type': 'application/json' });\n          res.end(\n            JSON.stringify({\n              error: 'serve(): reuseAgent is incompatible with function-form instructions',\n              hint,\n            })\n          );\n        }\n        return;\n      }\n      const attached = (agentServer as unknown as Record<symbol, unknown>)[ADCP_PRE_TRANSPORT];\n      const autoWiredPreTransport = typeof attached === 'function' ? (attached as AdcpPreTransport) : undefined;\n      const activePreTransport = explicitPreTransport ?? autoWiredPreTransport;\n\n      if (activePreTransport) {\n        try {\n          await ensureRawBody();\n          const handled = await activePreTransport(req as import('http').IncomingMessage & { rawBody?: string }, res);\n          if (handled) {\n            // PreTransport already responded (401, etc.). Close the agent\n            // before returning so the McpServer doesn't leak.\n            await agentServer.close();\n            return;\n          }\n        } catch (err) {\n          // Narrow to name+code — transport errors can embed remote URLs.\n          const errName = (err as Error).name || 'Error';\n          const errCode = (err as { code?: string }).code ?? 'unknown';\n          console.error(`preTransport middleware error: ${errName} (${errCode})`);\n          if (!res.headersSent) {\n            res.writeHead(500, { 'Content-Type': 'application/json' });\n            res.end(JSON.stringify({ error: 'Internal server error' }));\n          }\n          await agentServer.close();\n          return;\n        }\n      }\n\n      // In reuseAgent mode, serialize connect→handle→close per server\n      // instance. `McpServer.connect()` rejects when a transport is\n      // already attached (protocol.js:215), so concurrent requests on a\n      // cached server would race without this chain. Requests on\n      // DIFFERENT servers (different WeakMap keys) proceed in parallel.\n      // Outside reuseAgent mode the factory returns a fresh server per\n      // request — no shared instance, no lock needed.\n      const runTransportCycle = async (): Promise<void> => {\n        let modernAdapter: ReturnType<typeof createModernMcpServerAdapter> | undefined;\n        try {\n          // The official v2 classifier and Node adapter both need the parsed\n          // body after auth/signing middleware may have drained the stream.\n          // Buffer once, then pass the same parsed value to whichever era owns\n          // the request. Malformed JSON and unsupported media types fail before\n          // either protocol era receives a drained request stream.\n          await ensureRawBody();\n\n          if (req.method?.toUpperCase() === 'POST' && !isJsonContentType(req.headers['content-type'])) {\n            res.writeHead(415, { 'Content-Type': 'application/json' });\n            res.end(\n              JSON.stringify({\n                jsonrpc: '2.0',\n                error: { code: -32000, message: 'Unsupported Media Type: Content-Type must be application/json' },\n                id: null,\n              })\n            );\n            return;\n          }\n\n          if (req.method?.toUpperCase() === 'POST' && (bodyParseFailed || rawBody?.length === 0)) {\n            res.writeHead(400, { 'Content-Type': 'application/json' });\n            res.end(\n              JSON.stringify({\n                jsonrpc: '2.0',\n                error: { code: PARSE_ERROR, message: 'Parse error: request body is not valid JSON' },\n                id: null,\n              })\n            );\n            return;\n          }\n\n          // Raw v1 SDK McpServer instances retain their complete legacy\n          // surface (resources, prompts, custom handlers, Tasks extras).\n          // Only the framework-owned AdcpServer can be mirrored losslessly\n          // onto the 2026-07-28 tool transport.\n          const frameworkAgent = isAdcpServer(agentServer) ? agentServer : undefined;\n          if (frameworkAgent) {\n            const defaultAllowedHosts = resolvedPublicUrl\n              ? [new URL(resolvedPublicUrl).hostname]\n              : ['localhost', '127.0.0.1', '[::1]'];\n            const allowedHosts = options?.allowedHosts ?? defaultAllowedHosts;\n            const allowedOrigins = options?.allowedOrigins ?? allowedHosts;\n            if (!hostHeaderValidation(allowedHosts)(req, res)) return;\n            if (!originValidation(allowedOrigins)(req, res)) return;\n          }\n\n          let legacyRequest = true;\n          if (frameworkAgent) {\n            modernAdapter = createModernMcpServerAdapter(frameworkAgent);\n            legacyRequest = await modernAdapter.isLegacyRequest(req, parsedBody);\n          }\n\n          if (legacyRequest) {\n            const transport = new StreamableHTTPServerTransport({\n              sessionIdGenerator: undefined,\n            });\n            await agentServer.connect(transport);\n            // The stream was consumed for era classification, so always pass\n            // the parsed body when one was available.\n            if (parsedBody !== undefined) {\n              await transport.handleRequest(req, res, parsedBody);\n            } else {\n              await transport.handleRequest(req, res);\n            }\n          } else {\n            await modernAdapter!.handle(req, res, parsedBody);\n          }\n        } catch (err) {\n          console.error('Server error:', err);\n          if (!res.headersSent) {\n            res.writeHead(500, { 'Content-Type': 'application/json' });\n            res.end(JSON.stringify({ error: 'Internal server error' }));\n          }\n        } finally {\n          await modernAdapter?.close();\n          // close() here releases the transport AND (in reuseAgent mode)\n          // resets `_transport = undefined` on the cached server so the\n          // next queued request can connect. The server's tools,\n          // handlers, and idempotency wiring survive — close() clears\n          // the transport, not the registration.\n          await agentServer.close();\n        }\n      };\n\n      if (reuseAgent) {\n        const prev = reuseMutexes.get(agentServer) ?? Promise.resolve();\n        // `.then(runTransportCycle, runTransportCycle)` runs the cycle on\n        // EITHER prior outcome — we only care about sequencing, not the\n        // prior request's result. A plain `.then(runTransportCycle)`\n        // would skip this request when the prior rejected, leaving it\n        // stuck behind a poison-pill promise forever.\n        const current = prev.then(runTransportCycle, runTransportCycle);\n        // Swallow errors on the copy stored for sequencing so one\n        // rejection doesn't poison every subsequent request for this\n        // server instance. `current` itself is still awaited below and\n        // surfaces errors to THIS request.\n        reuseMutexes.set(\n          agentServer,\n          current.catch(() => {})\n        );\n        await current;\n      } else {\n        await runTransportCycle();\n      }\n    } else {\n      res.writeHead(404);\n      res.end('Not found');\n    }\n  });\n\n  const doListen = () => {\n    httpServer.listen(port, () => {\n      const actualPort = (httpServer.address() as { port: number }).port;\n      const url = `http://localhost:${actualPort}${mountPath}`;\n      if (options?.onListening) {\n        options.onListening(url);\n      } else {\n        console.log(`AdCP agent running at ${url}`);\n        console.log(`\\nTest with:\\n  npx @adcp/sdk@latest ${url}`);\n      }\n    });\n  };\n\n  if (options?.readinessCheck) {\n    options\n      .readinessCheck()\n      .then(doListen)\n      .catch((err: unknown) => {\n        const message = err instanceof Error ? err.message : String(err);\n        console.error('[adcp/serve] readinessCheck failed — aborting boot:', message);\n        process.exit(1);\n      });\n  } else {\n    doListen();\n  }\n\n  return httpServer;\n}\n\nfunction trimTrailingSlashes(s: string): string {\n  let end = s.length;\n  while (end > 0 && s.charCodeAt(end - 1) === 47 /* '/' */) end--;\n  return s.slice(0, end);\n}\n\n/**\n * Parse and validate a `publicUrl`, returning its origin. Shared by the\n * static-string path (validated once at `serve()` construction) and the\n * function path (validated lazily per unique host). A bad value from the\n * function form throws on the first request for that host, after PRM\n * resolution has already decided to fetch; the error is caught at the\n * call site and surfaced as a 500 so the operator sees the misconfigured\n * host instead of a silent audience-mismatch on minted tokens.\n */\nfunction validatePublicUrl(publicUrl: string, mountPath: string): string {\n  let parsed: URL;\n  try {\n    parsed = new URL(publicUrl);\n  } catch {\n    throw new Error(`serve(): \\`publicUrl\\` is not a valid URL: ${publicUrl}`);\n  }\n  if (trimTrailingSlashes(parsed.pathname) !== trimTrailingSlashes(mountPath)) {\n    throw new Error(\n      `serve(): \\`publicUrl\\` path (${parsed.pathname}) must match mount path (${mountPath}). ` +\n        'The public URL is the full MCP endpoint URL, including the path.'\n    );\n  }\n  return parsed.origin;\n}\n\n/**\n * Strip the port from a `host` string (`\"snap.example.com:3001\"` →\n * `\"snap.example.com\"`). Use inside `publicUrl` / `protectedResource`\n * resolvers to build scheme://host URLs without carrying the test-time\n * port into production URLs. IPv6 brackets preserved.\n */\nexport function hostname(host: string): string {\n  if (host.startsWith('[')) {\n    // IPv6 — preserve brackets, drop port after the closing bracket.\n    const end = host.indexOf(']');\n    if (end === -1) return host;\n    return host.slice(0, end + 1);\n  }\n  const colon = host.lastIndexOf(':');\n  return colon === -1 ? host : host.slice(0, colon);\n}\n\n/**\n * Resolve the canonical host the request arrived on for multi-host\n * routing and per-host PRM / audience advertisement. Same logic\n * `serve()` uses internally — exported so callers writing their own\n * host-dispatch middleware (e.g., behind `createExpressAdapter`) can\n * match `serve()`'s semantics exactly instead of re-implementing them.\n *\n * When `options.trustForwardedHost: true`, consults in order:\n *   1. `X-Forwarded-Host` (most common — Fly, Cloud Run, most ALBs).\n *   2. RFC 7239 `Forwarded: host=...` (spec-standard, less common).\n *   3. `Host`.\n *\n * When `trustForwardedHost: false` (default), only `Host` is read — an\n * attacker-controlled forwarded header can't flip the advertised OAuth\n * `resource` URL.\n *\n * **Proxy behavior matters when you opt in.** The helper trusts the\n * FIRST entry in a forwarded chain. That's safe when your proxy\n * OVERWRITES the header on ingress (rewriting the original value from\n * the client). It's UNSAFE when your proxy APPENDS — the attacker gets\n * to pick the first entry. Fly, Cloud Run, and GCP HTTPS LBs overwrite;\n * AWS ALB and nginx (by default) append. Verify your proxy's behavior\n * before enabling `trustForwardedHost`.\n *\n * Normalizes to lowercase and preserves port. Returns empty string when\n * no usable header is present (HTTP/1.1 requires `Host`, so this is\n * unusual — callers can branch on it to fail closed).\n *\n * @example\n * ```ts\n * import express from 'express';\n * import { resolveHost } from '@adcp/sdk/server';\n *\n * const routersByHost = new Map<string, express.Router>();\n *\n * function hostDispatch(req, res, next) {\n *   const host = resolveHost(req, { trustForwardedHost: true });\n *   const router = routersByHost.get(host);\n *   if (!router) return res.status(404).end();\n *   return router(req, res, next);\n * }\n * ```\n */\nexport function resolveHost(req: IncomingMessage, options?: { trustForwardedHost?: boolean }): string {\n  const trustForwardedHost = options?.trustForwardedHost === true;\n  if (trustForwardedHost) {\n    const xfh = firstHeaderValue(req.headers['x-forwarded-host']);\n    if (xfh) {\n      const first = xfh.split(',')[0]?.trim();\n      if (first) return first.toLowerCase();\n    }\n    const forwarded = firstHeaderValue(req.headers['forwarded']);\n    if (forwarded) {\n      const host = parseForwardedHost(forwarded);\n      if (host) return host.toLowerCase();\n    }\n  }\n  const host = firstHeaderValue(req.headers['host']);\n  return host ? host.toLowerCase() : '';\n}\n\n/**\n * Extract the `host=` parameter from an RFC 7239 `Forwarded:` header.\n * Takes the first (left-most) hop — same policy as the `X-Forwarded-Host`\n * chain rule above, and subject to the same \"your proxy must overwrite,\n * not append\" guarantee.\n *\n * Handles quoted-string values per RFC 7239 §4 (IPv6 literals and hosts\n * with ports must be quoted). Returns undefined when the header has no\n * `host` parameter, a malformed value, or a blank host.\n */\nfunction parseForwardedHost(header: string): string | undefined {\n  // Multi-hop: `Forwarded: for=1;host=a.example, for=2;host=b.example` —\n  // first hop is the client-facing proxy's view. Commas INSIDE quoted\n  // strings aren't separators, so a naive split would mis-parse IPv6.\n  // Scan manually, respecting quotes.\n  const firstHop = extractFirstForwardedHop(header);\n  if (!firstHop) return undefined;\n  for (const pair of firstHop.split(';')) {\n    const eq = pair.indexOf('=');\n    if (eq === -1) continue;\n    const key = pair.slice(0, eq).trim().toLowerCase();\n    if (key !== 'host') continue;\n    let value = pair.slice(eq + 1).trim();\n    if (value.startsWith('\"') && value.endsWith('\"') && value.length >= 2) {\n      value = value.slice(1, -1).replace(/\\\\(.)/g, '$1');\n    }\n    return value || undefined;\n  }\n  return undefined;\n}\n\nfunction extractFirstForwardedHop(header: string): string | undefined {\n  let depth = 0;\n  let start = 0;\n  for (let i = 0; i < header.length; i++) {\n    const ch = header[i];\n    if (ch === '\"') {\n      // Skip the quoted run, respecting backslash escapes.\n      i++;\n      while (i < header.length && header[i] !== '\"') {\n        if (header[i] === '\\\\') i++;\n        i++;\n      }\n      continue;\n    }\n    if (ch === ',' && depth === 0) {\n      return header.slice(start, i);\n    }\n  }\n  return header.slice(start).trim() || undefined;\n}\n\nfunction firstHeaderValue(value: string | string[] | undefined): string | undefined {\n  if (typeof value === 'string') return value;\n  if (Array.isArray(value) && value.length > 0) return value[0];\n  return undefined;\n}\n\nfunction attachAuthInfo(req: IncomingMessage, principal: AuthPrincipal): void {\n  // Propagate the kind-discriminated `credential` (Stage 3 of #1269) into\n  // `info.extra.credential` so the dispatcher can hoist it to top-level\n  // `ctx.authInfo.credential` and pass it to `BuyerAgentRegistry.resolve`.\n  // MCP's `extra` is `Record<string, unknown>`, so this round-trips\n  // without a wire-shape change. Adopters with custom authenticators that\n  // don't stamp `credential` see the registry resolve to `null` (no\n  // credential = no known agent), preserving Stage 2's strict opt-in.\n  //\n  // Also forward `principal.extra` — adopter-provided extension data stamped\n  // in the `verify` callback. This surfaces as `BuyerAgentResolveInput.extra`\n  // in `BuyerAgentRegistry.resolve` (see buyer-agent.ts). `credential` is\n  // always spread last so an adopter cannot overwrite the framework-stamped\n  // credential via their `extra` object.\n  const baseExtra = principal.claims !== undefined ? { ...principal.claims } : undefined;\n  const adopterExtra =\n    typeof principal.extra === 'object' && principal.extra !== null\n      ? (principal.extra as Record<string, unknown>)\n      : undefined;\n  const hasExtra = baseExtra !== undefined || adopterExtra !== undefined || principal.credential !== undefined;\n  const extra = hasExtra\n    ? {\n        ...(baseExtra ?? {}),\n        ...(adopterExtra ?? {}),\n        // credential last — prevents an adopter's `extra.credential` from\n        // overwriting the framework-enforced kind-discriminated credential.\n        ...(principal.credential !== undefined ? { credential: principal.credential } : {}),\n      }\n    : undefined;\n  const info: AuthInfo = {\n    token: principal.token ?? '',\n    clientId: principal.principal,\n    scopes: principal.scopes ?? [],\n    ...(principal.expiresAt !== undefined ? { expiresAt: principal.expiresAt } : {}),\n    ...(extra !== undefined ? { extra } : {}),\n  };\n  (req as IncomingMessage & { auth?: AuthInfo }).auth = info;\n}\n\nfunction bufferBody(req: import('http').IncomingMessage, maxBytes: number): Promise<string> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    req.on('data', chunk => {\n      size += chunk.length;\n      if (size > maxBytes) {\n        reject(new Error(`Request body exceeded ${maxBytes} bytes`));\n        req.destroy();\n        return;\n      }\n      chunks.push(chunk as Buffer);\n    });\n    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));\n    req.on('error', reject);\n  });\n}\n"],"mappings":";;;;;;AAoBA,SAAS,qCAAqC;AAC9C,SAAS,aAAa,yBAAyB;AAC/C,SAAS,sBAAsB,wBAAwB;AACvD,SAAS,oBAAqE;AAG9E,SAAS,yBAAyB;AAGlC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB,4BAAmD;AAChF,SAAS,oBAAqC;AAC9C,SAAS,oCAAoC;AAoCtC,MAAM,yBAAyB,MAAM;AAAA,EAC1C,YAAY,UAAU,gBAAgB;AACpC,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAoOO,SAAS,MAAM,aAA4D,SAAoC;AACpH,QAAM,UAAU,QAAQ,IAAI,OAAO,SAAS,QAAQ,IAAI,MAAM,EAAE,IAAI;AACpE,MAAI,YAAY,WAAc,OAAO,MAAM,OAAO,KAAK,UAAU,KAAK,UAAU,QAAQ;AACtF,UAAM,IAAI,MAAM,uCAAuC,QAAQ,IAAI,IAAI,GAAG;AAAA,EAC5E;AACA,QAAM,OAAO,SAAS,QAAQ,WAAW;AACzC,QAAM,YAAY,SAAS,QAAQ;AACnC,QAAM,YAAY,SAAS,aAAa,IAAI,kBAAkB;AAC9D,QAAM,qBAAqB,SAAS,uBAAuB;AAC3D,QAAM,aAAa,SAAS,eAAe;AAC3C,QAAM,kBAAkB,SAAS,mBAAmB,IAAI,OAAO;AAC/D,MAAI,CAAC,OAAO,cAAc,eAAe,KAAK,mBAAmB,GAAG;AAClE,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAUA,QAAM,eAAe,oBAAI,QAAkD;AAE3E,MAAI,SAAS,qBAAqB,CAAC,QAAQ,WAAW;AACpD,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,kBAAkB,SAAS;AACjC,QAAM,0BAA0B,SAAS;AACzC,QAAM,gBAAgB,OAAO,oBAAoB;AACjD,QAAM,UAAU,OAAO,4BAA4B;AAInD,MAAI;AACJ,MAAI,OAAO,oBAAoB,UAAU;AACvC,yBAAqB,kBAAkB,iBAAiB,SAAS;AAAA,EACnE;AAKA,QAAM,iBAAiB,oBAAI,IAAoB;AAC/C,QAAM,oBAAoB,oBAAI,IAAoB;AAClD,QAAM,WAAW,oBAAI,IAAuC;AAE5D,QAAM,mBAAmB,CAAC,SAAqC;AAC7D,QAAI,OAAO,oBAAoB,SAAU,QAAO;AAChD,QAAI,CAAC,cAAe,QAAO;AAC3B,QAAI,SAAS,eAAe,IAAI,IAAI;AACpC,QAAI,WAAW,OAAW,QAAO;AACjC,aAAU,gBAA0C,IAAI;AACxD,UAAM,SAAS,kBAAkB,QAAQ,SAAS;AAClD,mBAAe,IAAI,MAAM,MAAM;AAC/B,sBAAkB,IAAI,MAAM,MAAM;AAClC,WAAO;AAAA,EACT;AAEA,QAAM,sBAAsB,CAAC,SAAqC;AAChE,QAAI,OAAO,oBAAoB,SAAU,QAAO;AAEhD,QAAI,iBAAiB,IAAI,KAAK,KAAM,QAAO;AAC3C,WAAO,kBAAkB,IAAI,IAAI;AAAA,EACnC;AAEA,QAAM,2BAA2B,CAAC,SAAwD;AACxF,QAAI,CAAC,wBAAyB,QAAO;AACrC,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,SAAS,SAAS,IAAI,IAAI;AAC9B,QAAI,WAAW,OAAW,QAAO;AACjC,aAAU,wBAAqE,IAAI;AACnF,aAAS,IAAI,MAAM,MAAM;AACzB,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,gBAAgB,QAAQ,QAAQ,IAAI,aAAa,cAAc;AAC1E,YAAQ;AAAA,MACN;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,uBAAuB,SAAS;AAEtC,QAAM,wBAAwB,wCAAwC,SAAS;AAE/E,QAAM,aAAa,aAAa,OAAO,KAAK,QAAQ;AAClD,UAAM,EAAE,SAAS,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,kBAAkB;AAC9D,UAAM,OAAO,YAAY,KAAK,EAAE,mBAAmB,CAAC;AAIpD,QAAI,2BAA2B,aAAa,uBAAuB;AACjE,UAAI;AACJ,UAAI;AACJ,UAAI;AACF,mBAAW,iBAAiB,IAAI;AAChC,cAAM,yBAAyB,IAAI;AAAA,MACrC,SAAS,KAAK;AACZ,YAAI,eAAe,kBAAkB;AAInC,cAAI,UAAU,GAAG;AACjB,cAAI,IAAI,WAAW;AACnB;AAAA,QACF;AACA,gBAAQ,MAAM,6DAA6D,GAAG;AAC9E,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,yDAAyD,CAAC,CAAC;AAC3F;AAAA,MACF;AACA,UAAI,CAAC,YAAY,CAAC,KAAK;AAKrB,YAAI,UAAU,GAAG;AACjB,YAAI,IAAI,WAAW;AACnB;AAAA,MACF;AACA,YAAM,OAAO;AAAA,QACX;AAAA,QACA,GAAG;AAAA,QACH,0BAA0B,IAAI,4BAA4B,CAAC,QAAQ;AAAA,MACrE;AACA,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,IAAI,CAAC;AAC5B;AAAA,IACF;AAEA,QAAI,aAAa,aAAa,aAAa,GAAG,SAAS,KAAK;AAQ1D,UAAI;AACJ,UAAI;AACJ,UAAI;AACF,4BAAoB,iBAAiB,IAAI;AAAA,MAC3C,SAAS,KAAK;AACZ,YAAI,eAAe,kBAAkB;AACnC,cAAI,UAAU,GAAG;AACjB,cAAI,IAAI,WAAW;AACnB;AAAA,QACF;AACA,gBAAQ,MAAM,2CAA2C,GAAG;AAC5D,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,yDAAyD,CAAC,CAAC;AAC3F;AAAA,MACF;AACA,UAAI,yBAAyB;AAC3B,cAAM,aAAa,oBAAoB,IAAI;AAC3C,YAAI,WAAY,uBAAsB,GAAG,UAAU,GAAG,qBAAqB;AAAA,MAC7E;AAQA,YAAM,sBAA2C,oBAC7C,EAAE,MAAM,WAAW,kBAAkB,IACrC,EAAE,KAAK;AACX,MAAC,IAAiF,0BAA0B,IAC1G;AAKF,UAAI;AACJ,UAAI;AACJ,UAAI,kBAAkB;AACtB,YAAM,gBAAgB,YAA2B;AAC/C,YAAI,YAAY,OAAW;AAC3B,kBAAU,MAAM,WAAW,KAAK,eAAe;AAC/C,QAAC,IAA6B,UAAU;AACxC,YAAI,QAAQ,SAAS,GAAG;AACtB,cAAI;AACF,yBAAa,KAAK,MAAM,OAAO;AAAA,UACjC,QAAQ;AACN,8BAAkB;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AAKA,UAAI,0BAA0B,SAAS,YAAY,GAAG;AACpD,YAAI;AACF,gBAAM,cAAc;AAAA,QACtB,SAAS,KAAK;AAIZ,gBAAM,UAAW,IAAc,QAAQ;AACvC,kBAAQ,MAAM,sDAAsD,OAAO,EAAE;AAC7E,cAAI,CAAC,IAAI,aAAa;AACpB,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI,IAAI,KAAK,UAAU,EAAE,OAAO,4BAA4B,CAAC,CAAC;AAAA,UAChE;AACA;AAAA,QACF;AAAA,MACF;AAGA,UAAI,SAAS,cAAc;AACzB,YAAI;AACJ,YAAI;AACF,sBAAY,MAAM,QAAQ,aAAa,GAAG;AAAA,QAC5C,SAAS,KAAK;AAEZ,gBAAM,gBAAgB,eAAe,YAAY,IAAI,gBAAgB;AACrE,kBAAQ,MAAM,yBAAyB,GAAG;AAO1C,gBAAM,gBAAgB,4BAA4B,GAAG;AACrD,cAAI,eAAe;AACjB,gCAAoB,KAAK,KAAK;AAAA,cAC5B,gBAAgB;AAAA,cAChB,kBAAkB;AAAA,cAClB,kBAAkB;AAAA,YACpB,CAAC;AACD;AAAA,UACF;AACA,8BAAoB,KAAK,KAAK;AAAA,YAC5B,OAAO;AAAA,YACP,kBAAkB;AAAA,YAClB,kBAAkB;AAAA,UACpB,CAAC;AACD;AAAA,QACF;AACA,YAAI,CAAC,WAAW;AACd,8BAAoB,KAAK,KAAK;AAAA,YAC5B,OAAO;AAAA,YACP,kBAAkB;AAAA,YAClB,kBAAkB;AAAA,UACpB,CAAC;AACD;AAAA,QACF;AAEA,uBAAe,KAAK,SAAS;AAAA,MAC/B;AAOA,UAAI;AACJ,UAAI;AACF,sBAAc,YAAY,EAAE,WAAW,KAAK,CAAC;AAAA,MAC/C,SAAS,KAAK;AACZ,YAAI,eAAe,kBAAkB;AAInC,cAAI,UAAU,GAAG;AACjB,cAAI,IAAI,WAAW;AACnB;AAAA,QACF;AAKA,gBAAQ,MAAM,+BAA+B,GAAG;AAChD,YAAI,CAAC,IAAI,aAAa;AACpB,cAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,cAAI,IAAI,KAAK,UAAU,EAAE,OAAO,wBAAwB,CAAC,CAAC;AAAA,QAC5D;AACA;AAAA,MACF;AAYA,UAAI,cAAe,YAAmD,oBAAoB,MAAM,MAAM;AACpG,cAAM,OACJ;AACF,gBAAQ;AAAA,UACN,0NAEE;AAAA,QACJ;AACA,YAAI,CAAC,IAAI,aAAa;AACpB,cAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,cAAI;AAAA,YACF,KAAK,UAAU;AAAA,cACb,OAAO;AAAA,cACP;AAAA,YACF,CAAC;AAAA,UACH;AAAA,QACF;AACA;AAAA,MACF;AACA,YAAM,WAAY,YAAmD,kBAAkB;AACvF,YAAM,wBAAwB,OAAO,aAAa,aAAc,WAAgC;AAChG,YAAM,qBAAqB,wBAAwB;AAEnD,UAAI,oBAAoB;AACtB,YAAI;AACF,gBAAM,cAAc;AACpB,gBAAM,UAAU,MAAM,mBAAmB,KAA8D,GAAG;AAC1G,cAAI,SAAS;AAGX,kBAAM,YAAY,MAAM;AACxB;AAAA,UACF;AAAA,QACF,SAAS,KAAK;AAEZ,gBAAM,UAAW,IAAc,QAAQ;AACvC,gBAAM,UAAW,IAA0B,QAAQ;AACnD,kBAAQ,MAAM,kCAAkC,OAAO,KAAK,OAAO,GAAG;AACtE,cAAI,CAAC,IAAI,aAAa;AACpB,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI,IAAI,KAAK,UAAU,EAAE,OAAO,wBAAwB,CAAC,CAAC;AAAA,UAC5D;AACA,gBAAM,YAAY,MAAM;AACxB;AAAA,QACF;AAAA,MACF;AASA,YAAM,oBAAoB,YAA2B;AACnD,YAAI;AACJ,YAAI;AAMF,gBAAM,cAAc;AAEpB,cAAI,IAAI,QAAQ,YAAY,MAAM,UAAU,CAAC,kBAAkB,IAAI,QAAQ,cAAc,CAAC,GAAG;AAC3F,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI;AAAA,cACF,KAAK,UAAU;AAAA,gBACb,SAAS;AAAA,gBACT,OAAO,EAAE,MAAM,OAAQ,SAAS,gEAAgE;AAAA,gBAChG,IAAI;AAAA,cACN,CAAC;AAAA,YACH;AACA;AAAA,UACF;AAEA,cAAI,IAAI,QAAQ,YAAY,MAAM,WAAW,mBAAmB,SAAS,WAAW,IAAI;AACtF,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI;AAAA,cACF,KAAK,UAAU;AAAA,gBACb,SAAS;AAAA,gBACT,OAAO,EAAE,MAAM,aAAa,SAAS,8CAA8C;AAAA,gBACnF,IAAI;AAAA,cACN,CAAC;AAAA,YACH;AACA;AAAA,UACF;AAMA,gBAAM,iBAAiB,aAAa,WAAW,IAAI,cAAc;AACjE,cAAI,gBAAgB;AAClB,kBAAM,sBAAsB,oBACxB,CAAC,IAAI,IAAI,iBAAiB,EAAE,QAAQ,IACpC,CAAC,aAAa,aAAa,OAAO;AACtC,kBAAM,eAAe,SAAS,gBAAgB;AAC9C,kBAAM,iBAAiB,SAAS,kBAAkB;AAClD,gBAAI,CAAC,qBAAqB,YAAY,EAAE,KAAK,GAAG,EAAG;AACnD,gBAAI,CAAC,iBAAiB,cAAc,EAAE,KAAK,GAAG,EAAG;AAAA,UACnD;AAEA,cAAI,gBAAgB;AACpB,cAAI,gBAAgB;AAClB,4BAAgB,6BAA6B,cAAc;AAC3D,4BAAgB,MAAM,cAAc,gBAAgB,KAAK,UAAU;AAAA,UACrE;AAEA,cAAI,eAAe;AACjB,kBAAM,YAAY,IAAI,8BAA8B;AAAA,cAClD,oBAAoB;AAAA,YACtB,CAAC;AACD,kBAAM,YAAY,QAAQ,SAAS;AAGnC,gBAAI,eAAe,QAAW;AAC5B,oBAAM,UAAU,cAAc,KAAK,KAAK,UAAU;AAAA,YACpD,OAAO;AACL,oBAAM,UAAU,cAAc,KAAK,GAAG;AAAA,YACxC;AAAA,UACF,OAAO;AACL,kBAAM,cAAe,OAAO,KAAK,KAAK,UAAU;AAAA,UAClD;AAAA,QACF,SAAS,KAAK;AACZ,kBAAQ,MAAM,iBAAiB,GAAG;AAClC,cAAI,CAAC,IAAI,aAAa;AACpB,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI,IAAI,KAAK,UAAU,EAAE,OAAO,wBAAwB,CAAC,CAAC;AAAA,UAC5D;AAAA,QACF,UAAE;AACA,gBAAM,eAAe,MAAM;AAM3B,gBAAM,YAAY,MAAM;AAAA,QAC1B;AAAA,MACF;AAEA,UAAI,YAAY;AACd,cAAM,OAAO,aAAa,IAAI,WAAW,KAAK,QAAQ,QAAQ;AAM9D,cAAM,UAAU,KAAK,KAAK,mBAAmB,iBAAiB;AAK9D,qBAAa;AAAA,UACX;AAAA,UACA,QAAQ,MAAM,MAAM;AAAA,UAAC,CAAC;AAAA,QACxB;AACA,cAAM;AAAA,MACR,OAAO;AACL,cAAM,kBAAkB;AAAA,MAC1B;AAAA,IACF,OAAO;AACL,UAAI,UAAU,GAAG;AACjB,UAAI,IAAI,WAAW;AAAA,IACrB;AAAA,EACF,CAAC;AAED,QAAM,WAAW,MAAM;AACrB,eAAW,OAAO,MAAM,MAAM;AAC5B,YAAM,aAAc,WAAW,QAAQ,EAAuB;AAC9D,YAAM,MAAM,oBAAoB,UAAU,GAAG,SAAS;AACtD,UAAI,SAAS,aAAa;AACxB,gBAAQ,YAAY,GAAG;AAAA,MACzB,OAAO;AACL,gBAAQ,IAAI,yBAAyB,GAAG,EAAE;AAC1C,gBAAQ,IAAI;AAAA;AAAA,yBAAwC,GAAG,EAAE;AAAA,MAC3D;AAAA,IACF,CAAC;AAAA,EACH;AAEA,MAAI,SAAS,gBAAgB;AAC3B,YACG,eAAe,EACf,KAAK,QAAQ,EACb,MAAM,CAAC,QAAiB;AACvB,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,cAAQ,MAAM,4DAAuD,OAAO;AAC5E,cAAQ,KAAK,CAAC;AAAA,IAChB,CAAC;AAAA,EACL,OAAO;AACL,aAAS;AAAA,EACX;AAEA,SAAO;AACT;AAEA,SAAS,oBAAoB,GAAmB;AAC9C,MAAI,MAAM,EAAE;AACZ,SAAO,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC,MAAM,GAAc;AAC1D,SAAO,EAAE,MAAM,GAAG,GAAG;AACvB;AAWA,SAAS,kBAAkB,WAAmB,WAA2B;AACvE,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,SAAS;AAAA,EAC5B,QAAQ;AACN,UAAM,IAAI,MAAM,8CAA8C,SAAS,EAAE;AAAA,EAC3E;AACA,MAAI,oBAAoB,OAAO,QAAQ,MAAM,oBAAoB,SAAS,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR,gCAAgC,OAAO,QAAQ,4BAA4B,SAAS;AAAA,IAEtF;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAQO,SAAS,SAAS,MAAsB;AAC7C,MAAI,KAAK,WAAW,GAAG,GAAG;AAExB,UAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,QAAI,QAAQ,GAAI,QAAO;AACvB,WAAO,KAAK,MAAM,GAAG,MAAM,CAAC;AAAA,EAC9B;AACA,QAAM,QAAQ,KAAK,YAAY,GAAG;AAClC,SAAO,UAAU,KAAK,OAAO,KAAK,MAAM,GAAG,KAAK;AAClD;AA6CO,SAAS,YAAY,KAAsB,SAAoD;AACpG,QAAM,qBAAqB,SAAS,uBAAuB;AAC3D,MAAI,oBAAoB;AACtB,UAAM,MAAM,iBAAiB,IAAI,QAAQ,kBAAkB,CAAC;AAC5D,QAAI,KAAK;AACP,YAAM,QAAQ,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACtC,UAAI,MAAO,QAAO,MAAM,YAAY;AAAA,IACtC;AACA,UAAM,YAAY,iBAAiB,IAAI,QAAQ,WAAW,CAAC;AAC3D,QAAI,WAAW;AACb,YAAMA,QAAO,mBAAmB,SAAS;AACzC,UAAIA,MAAM,QAAOA,MAAK,YAAY;AAAA,IACpC;AAAA,EACF;AACA,QAAM,OAAO,iBAAiB,IAAI,QAAQ,MAAM,CAAC;AACjD,SAAO,OAAO,KAAK,YAAY,IAAI;AACrC;AAYA,SAAS,mBAAmB,QAAoC;AAK9D,QAAM,WAAW,yBAAyB,MAAM;AAChD,MAAI,CAAC,SAAU,QAAO;AACtB,aAAW,QAAQ,SAAS,MAAM,GAAG,GAAG;AACtC,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,OAAO,GAAI;AACf,UAAM,MAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY;AACjD,QAAI,QAAQ,OAAQ;AACpB,QAAI,QAAQ,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AACpC,QAAI,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,KAAK,MAAM,UAAU,GAAG;AACrE,cAAQ,MAAM,MAAM,GAAG,EAAE,EAAE,QAAQ,UAAU,IAAI;AAAA,IACnD;AACA,WAAO,SAAS;AAAA,EAClB;AACA,SAAO;AACT;AAEA,SAAS,yBAAyB,QAAoC;AACpE,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,KAAK,OAAO,CAAC;AACnB,QAAI,OAAO,KAAK;AAEd;AACA,aAAO,IAAI,OAAO,UAAU,OAAO,CAAC,MAAM,KAAK;AAC7C,YAAI,OAAO,CAAC,MAAM,KAAM;AACxB;AAAA,MACF;AACA;AAAA,IACF;AACA,QAAI,OAAO,OAAO,UAAU,GAAG;AAC7B,aAAO,OAAO,MAAM,OAAO,CAAC;AAAA,IAC9B;AAAA,EACF;AACA,SAAO,OAAO,MAAM,KAAK,EAAE,KAAK,KAAK;AACvC;AAEA,SAAS,iBAAiB,OAA0D;AAClF,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,QAAO,MAAM,CAAC;AAC5D,SAAO;AACT;AAEA,SAAS,eAAe,KAAsB,WAAgC;AAc5E,QAAM,YAAY,UAAU,WAAW,SAAY,EAAE,GAAG,UAAU,OAAO,IAAI;AAC7E,QAAM,eACJ,OAAO,UAAU,UAAU,YAAY,UAAU,UAAU,OACtD,UAAU,QACX;AACN,QAAM,WAAW,cAAc,UAAa,iBAAiB,UAAa,UAAU,eAAe;AACnG,QAAM,QAAQ,WACV;AAAA,IACE,GAAI,aAAa,CAAC;AAAA,IAClB,GAAI,gBAAgB,CAAC;AAAA;AAAA;AAAA,IAGrB,GAAI,UAAU,eAAe,SAAY,EAAE,YAAY,UAAU,WAAW,IAAI,CAAC;AAAA,EACnF,IACA;AACJ,QAAM,OAAiB;AAAA,IACrB,OAAO,UAAU,SAAS;AAAA,IAC1B,UAAU,UAAU;AAAA,IACpB,QAAQ,UAAU,UAAU,CAAC;AAAA,IAC7B,GAAI,UAAU,cAAc,SAAY,EAAE,WAAW,UAAU,UAAU,IAAI,CAAC;AAAA,IAC9E,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC;AAAA,EACzC;AACA,EAAC,IAA8C,OAAO;AACxD;AAEA,SAAS,WAAW,KAAqC,UAAmC;AAC1F,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAmB,CAAC;AAC1B,QAAI,OAAO;AACX,QAAI,GAAG,QAAQ,WAAS;AACtB,cAAQ,MAAM;AACd,UAAI,OAAO,UAAU;AACnB,eAAO,IAAI,MAAM,yBAAyB,QAAQ,QAAQ,CAAC;AAC3D,YAAI,QAAQ;AACZ;AAAA,MACF;AACA,aAAO,KAAK,KAAe;AAAA,IAC7B,CAAC;AACD,QAAI,GAAG,OAAO,MAAM,QAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC,CAAC;AACnE,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;","names":["host"]}
+{"version":3,"sources":["../../../src/lib/server/serve.ts"],"sourcesContent":["/**\n * One-liner HTTP server for AdCP MCP agents.\n *\n * Wraps the StreamableHTTPServerTransport + http.createServer boilerplate\n * so agent builders can focus on business logic.\n *\n * @example\n * ```typescript\n * import { createTaskCapableServer, serve } from '@adcp/sdk';\n *\n * function createAgent({ taskStore }) {\n *   const server = createTaskCapableServer('My Agent', '1.0.0', { taskStore });\n *   server.registerTool('get_signals', { description: 'Discover audiences.', inputSchema: schema }, handler);\n *   return server;\n * }\n *\n * serve(createAgent); // listening on http://localhost:3001/mcp\n * ```\n */\n\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\nimport { PARSE_ERROR, isJsonContentType } from '@modelcontextprotocol/server';\nimport { hostHeaderValidation, originValidation } from '@modelcontextprotocol/node';\nimport { createServer, type IncomingMessage, type Server as HttpServer } from 'http';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { TaskStore } from '@modelcontextprotocol/sdk/experimental/tasks/interfaces.js';\nimport { InMemoryTaskStore } from '@modelcontextprotocol/sdk/experimental/tasks/stores/in-memory.js';\nimport type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';\nimport type { AuthPrincipal, Authenticator, ServeRequestContext } from './auth';\nimport {\n  ADCP_SERVE_REQUEST_CONTEXT,\n  AuthError,\n  authenticatorNeedsRawBody,\n  respondUnauthorized,\n  signatureErrorCodeFromCause,\n} from './auth';\nimport { ADCP_PRE_TRANSPORT, ADCP_INSTRUCTIONS_FN, type AdcpPreTransport } from './create-adcp-server';\nimport { isAdcpServer, type AdcpServer } from './adcp-server';\nimport { createModernMcpServerAdapter } from './mcp-modern-server';\n\n/**\n * Context passed to the agent factory on each request.\n *\n * Contains shared resources that must survive across stateless HTTP requests,\n * such as the task store for MCP Tasks protocol support.\n *\n * For multi-tenant / multi-host deployments, provide a custom `TaskStore` via\n * `ServeOptions` that enforces tenant/session scoping, and branch on\n * {@link host} inside your factory to return host-specific handlers.\n */\nexport interface ServeContext {\n  /** Shared task store — use this when creating your McpServer so tasks persist across requests. */\n  taskStore: TaskStore;\n  /**\n   * Canonical host the request arrived on, lowercased with port preserved\n   * (e.g. `snap.example.com`, `localhost:3001`). Resolved from\n   * `X-Forwarded-Host` when `ServeOptions.trustForwardedHost` is true,\n   * otherwise from the `Host` header. Empty string when neither header\n   * is present (unusual — HTTP/1.1 requires `Host`).\n   *\n   * Use this in the factory to branch on hostname when a single process\n   * fronts multiple agents. The same string is passed to\n   * `publicUrl` / `protectedResource` resolver functions.\n   */\n  host: string;\n}\n\n/**\n * Thrown from an agent factory (or a `publicUrl` / `protectedResource`\n * resolver) when the incoming request's host isn't configured. `serve()`\n * catches it and responds 404 with a generic body — the adapter routing\n * table never crosses the wire. Any other thrown error still surfaces\n * as 500 so unrelated bugs stay loud.\n */\nexport class UnknownHostError extends Error {\n  constructor(message = 'Unknown host') {\n    super(message);\n    this.name = 'UnknownHostError';\n  }\n}\n\n/**\n * OAuth 2.0 Protected Resource Metadata (RFC 9728) advertised at\n * `/.well-known/oauth-protected-resource<mountPath>`.\n *\n * The `resource` URL itself is taken from `ServeOptions.publicUrl` — set\n * that to the canonical MCP endpoint (e.g. `https://my-agent.example.com/mcp`)\n * so clients request tokens bound to the right RFC 8707 audience.\n */\nexport interface ProtectedResourceMetadata {\n  /** URLs of authorization servers that issue tokens for this resource. */\n  authorization_servers: string[];\n  /** Scopes this resource accepts. Optional. */\n  scopes_supported?: string[];\n  /** Bearer token methods supported. Defaults to `['header']`. */\n  bearer_methods_supported?: Array<'header' | 'body' | 'query'>;\n  /** Human-readable resource docs URL. Optional. */\n  resource_documentation?: string;\n  /** Per-resource policy URL. Optional. */\n  resource_policy_uri?: string;\n  /** Per-resource ToS URL. Optional. */\n  resource_tos_uri?: string;\n}\n\nexport interface ServeOptions {\n  /** Port to listen on. Defaults to PORT env var or 3001. */\n  port?: number;\n  /** HTTP path to mount the MCP endpoint on. Defaults to '/mcp'. */\n  path?: string;\n  /**\n   * Hostnames allowed on framework-owned AdCP server requests, without ports.\n   * The guard runs before protocol-era classification, so it protects both\n   * legacy and MCP 2026-07-28 traffic. Defaults to the hostname from\n   * `publicUrl`, or localhost-only when no public URL is set. Public and\n   * reverse-proxied deployments must configure `publicUrl` or this allowlist;\n   * include the upstream Host too when a proxy rewrites it.\n   */\n  allowedHosts?: string[];\n  /**\n   * Origin hostnames allowed on browser-originated framework AdCP requests,\n   * across both protocol eras. Requests without Origin pass. Defaults to\n   * {@link allowedHosts}.\n   */\n  allowedOrigins?: string[];\n  /**\n   * Maximum buffered MCP request body size used for era classification.\n   * Defaults to 2 MiB. Set explicitly when an AdCP extension legitimately\n   * carries larger JSON payloads.\n   */\n  maxRequestBytes?: number;\n  /** Called when the server starts listening. */\n  onListening?: (url: string) => void;\n  /**\n   * Async check called before the server begins accepting connections.\n   * Throw to abort boot — `serve()` logs the error and calls `process.exit(1)`,\n   * so the server never enters listen mode and no traffic arrives during the\n   * check. Use to validate external dependencies (database pools, credential\n   * fetches) so a misconfigured deployment fails loudly at startup rather than\n   * silently on the first live request.\n   *\n   * @example\n   * ```ts\n   * serve(createAgent, {\n   *   readinessCheck: () => store.probe(),\n   * });\n   * ```\n   */\n  readinessCheck?: () => Promise<void>;\n  /**\n   * Custom task store. Defaults to a shared InMemoryTaskStore.\n   *\n   * The default InMemoryTaskStore only evicts tasks that have a TTL set.\n   * For long-running servers, always set `ttl` when creating tasks, or\n   * provide a store with automatic eviction to prevent unbounded memory growth.\n   */\n  taskStore?: TaskStore;\n\n  /**\n   * Canonical public URL of this MCP endpoint (e.g. `https://my-agent.example.com/mcp`).\n   * Required when `protectedResource` is configured — the RFC 9728 `resource`\n   * field, the RFC 6750 `resource_metadata` URL on 401 challenges, and the\n   * JWT audience your tokens must carry are all derived from it. Setting this\n   * defends against attacker-controlled `Host` header phishing: without it,\n   * the server would advertise whatever host a caller happened to send.\n   *\n   * Must be an absolute https:// URL whose path matches the mount path.\n   *\n   * **Multi-host.** Pass a function `(host) => string` when one process\n   * fronts multiple hostnames (white-label publishers, multi-brand\n   * adapters). The resolver runs per unique host — the returned URL is\n   * cached and used as the RFC 9728 `resource`, the 401-challenge\n   * `resource_metadata`, and the JWT audience for that host. Each\n   * resolved URL's path must match the mount path, same as the static\n   * form. Setting {@link trustForwardedHost} is recommended when\n   * behind a proxy.\n   */\n  publicUrl?: string | ((host: string) => string);\n\n  /**\n   * Authentication middleware applied to every request. When configured,\n   * missing or invalid credentials produce a 401 with a compliant\n   * `WWW-Authenticate` header — no request reaches the MCP transport\n   * without passing. Use helpers from `./auth`: `verifyApiKey`,\n   * `verifyBearer`, or `anyOf(verifyApiKey(...), verifyBearer(...))`.\n   */\n  authenticate?: Authenticator;\n\n  /**\n   * Advertise OAuth 2.0 protected-resource metadata at\n   * `/.well-known/oauth-protected-resource<mountPath>`. Requires {@link publicUrl}.\n   *\n   * Pass a function `(host) => ProtectedResourceMetadata` for multi-host\n   * deployments whose authorization servers or supported scopes vary per\n   * hostname (e.g., each white-label seller has its own AS). The resolver\n   * runs once per unique host and the result is cached. The static form\n   * still works when every host uses the same PRM body.\n   */\n  protectedResource?: ProtectedResourceMetadata | ((host: string) => ProtectedResourceMetadata);\n\n  /**\n   * Reuse the agent returned by the factory across requests instead of\n   * closing it after each. Default `false` (one fresh server per\n   * request — the pre-existing behavior).\n   *\n   * When `true`, `serve()` DOES NOT call `agentServer.close()` between\n   * requests. The factory is still called on every request; it's the\n   * caller's responsibility to cache `AdcpServer` instances (typically\n   * keyed on `ctx.host`) and return the cached instance when possible.\n   * Concurrent requests to the same cached server are serialized per\n   * instance — `McpServer.connect()` rejects when a transport is\n   * already attached, so the framework wraps the\n   * connect→handleRequest→release cycle in a per-instance async\n   * mutex. Requests for DIFFERENT cached servers still run in parallel.\n   *\n   * Use when `createAdcpServer(...)` setup cost (tool registration,\n   * handler wiring) is a measurable portion of request latency — common\n   * in multi-host deployments with many tools per host. Trade-off:\n   * throughput per unique host drops to 1 in flight at a time. For\n   * higher concurrency per host, cache a small pool of servers in the\n   * factory and round-robin.\n   *\n   * Cleanup is the caller's responsibility: listen for the process\n   * shutdown signal and call `close()` on every cached server to\n   * release MCP Tasks timers, HTTP keepalives, etc.\n   *\n   * **Incompatible with long-lived server→client streams.** MCP's\n   * `Protocol._onclose` aborts in-flight handlers and clears progress\n   * tokens when the transport closes. In stateless HTTP mode (the\n   * default this helper uses) each request is already single-response,\n   * so this is a no-op concern. Don't enable `reuseAgent` if you\n   * eventually wire a transport that keeps an SSE channel open across\n   * multiple logical requests.\n   */\n  reuseAgent?: boolean;\n\n  /**\n   * Trust `X-Forwarded-Host` and RFC 7239 `Forwarded: host=...` for\n   * host resolution and for reconstructing the public URL on 401\n   * challenges. Default `false` — an attacker-controlled header can't\n   * flip the advertised OAuth `resource` URL unless you opt in.\n   *\n   * **Your proxy must OVERWRITE the forwarded headers on ingress, not\n   * append.** The framework trusts the first (left-most) entry in a\n   * chain. With an overwriting proxy that's the sanitized value; with\n   * an appending proxy it's whatever the client sent — an attacker\n   * picks it. Common behavior:\n   *\n   * - Overwrite (safe to trust): Fly.io, Cloud Run, GCP HTTPS LB.\n   * - Append (NOT safe without extra config): AWS ALB default, nginx\n   *   default. These need `proxy_set_header X-Forwarded-Host $host;`\n   *   or equivalent before enabling this flag.\n   *\n   * Verify your proxy's behavior against a request that already has\n   * `X-Forwarded-Host: attacker.example` in it before turning this on.\n   */\n  trustForwardedHost?: boolean;\n\n  /**\n   * Pre-MCP middleware — runs after authentication but before MCP transport\n   * is connected. Intended for transport-layer concerns like RFC 9421\n   * request-signature verification: the agent's body is already buffered\n   * into `(req as any).rawBody` before the middleware fires so signature\n   * verifiers can hash it without racing the transport's own body read.\n   *\n   * Return `true` to signal the middleware handled the response (e.g. a\n   * 401 with `WWW-Authenticate`); the transport is skipped. Return `false`\n   * to continue into MCP dispatch.\n   *\n   * Throwing from the middleware produces a 500 with a generic body.\n   */\n  preTransport?: (\n    req: import('http').IncomingMessage & { rawBody?: string },\n    res: import('http').ServerResponse\n  ) => Promise<boolean>;\n}\n\n/**\n * Start an HTTP server that serves an AdCP MCP agent.\n *\n * Creates a new MCP server instance per request (stateless), wires up the\n * StreamableHTTPServerTransport, and returns the underlying http.Server\n * for lifecycle control.\n *\n * A shared task store is created once and passed to the factory on every\n * request via `ServeContext`. This ensures MCP Tasks (create → poll → result)\n * work correctly across stateless HTTP requests.\n *\n * **Multi-host.** Pass functions for `publicUrl` and `protectedResource` and\n * branch on `ctx.host` in the factory to front multiple hostnames from one\n * process. The framework resolves host from `X-Forwarded-Host` (when\n * `trustForwardedHost: true`) or `Host`, threads it through `ServeContext`,\n * and caches per-host `publicUrl`/PRM so each hostname advertises its own\n * audience-bound `resource`.\n *\n * @param createAgent - Factory function that returns a configured server —\n *   either an `AdcpServer` from `createAdcpServer()` or a raw SDK `McpServer`\n *   from `createTaskCapableServer()`. Called once per request so each gets a\n *   fresh instance (a server can only be connected once). Receives a\n *   `ServeContext` with a shared `taskStore` and the resolved `host` —\n *   branch on `host` to return host-specific handlers in multi-host mode.\n *   Framework `AdcpServer` instances serve both MCP 2026-07-28 and legacy\n *   clients. Raw v1 SDK `McpServer` instances remain legacy-only so resources,\n *   prompts, Tasks, and custom transport extras are never silently dropped.\n * @param options - Port, path, and callback configuration.\n * @returns The http.Server instance. Use the `onListening` callback or\n *   listen for the 'listening' event to know when it's ready.\n */\nexport function serve(createAgent: (ctx: ServeContext) => AdcpServer | McpServer, options?: ServeOptions): HttpServer {\n  const envPort = process.env.PORT ? parseInt(process.env.PORT, 10) : undefined;\n  if (envPort !== undefined && (Number.isNaN(envPort) || envPort < 0 || envPort > 65535)) {\n    throw new Error(`Invalid PORT environment variable: \"${process.env.PORT}\"`);\n  }\n  const port = options?.port ?? envPort ?? 3001;\n  const mountPath = options?.path ?? '/mcp';\n  const taskStore = options?.taskStore ?? new InMemoryTaskStore();\n  const trustForwardedHost = options?.trustForwardedHost === true;\n  const reuseAgent = options?.reuseAgent === true;\n  const maxRequestBytes = options?.maxRequestBytes ?? 2 * 1024 * 1024;\n  if (!Number.isSafeInteger(maxRequestBytes) || maxRequestBytes <= 0) {\n    throw new Error('serve(): `maxRequestBytes` must be a positive safe integer');\n  }\n\n  // Per-instance mutex chain for `reuseAgent: true`. The MCP SDK's\n  // `Protocol.connect()` hard-throws when a transport is already\n  // attached (node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js:215),\n  // so concurrent requests that land on the same cached server would\n  // race without this. WeakMap so agents GC normally when the caller\n  // drops references. Only used when `reuseAgent` is true — the\n  // default path still creates a fresh server per request and doesn't\n  // share any state across calls.\n  const reuseMutexes = new WeakMap<AdcpServer | McpServer, Promise<unknown>>();\n\n  if (options?.protectedResource && !options.publicUrl) {\n    throw new Error(\n      'serve(): `protectedResource` requires `publicUrl` (the canonical https:// URL clients use for this MCP endpoint). ' +\n        'Without it, the server would advertise an attacker-controlled Host header as the OAuth resource URL.'\n    );\n  }\n\n  const publicUrlOption = options?.publicUrl;\n  const protectedResourceOption = options?.protectedResource;\n  const publicUrlIsFn = typeof publicUrlOption === 'function';\n  const prmIsFn = typeof protectedResourceOption === 'function';\n\n  // Static publicUrl — validate once at construction. Function form validates\n  // lazily per host so a stale factory for one host can't prevent boot.\n  let staticPublicOrigin: string | undefined;\n  if (typeof publicUrlOption === 'string') {\n    staticPublicOrigin = validatePublicUrl(publicUrlOption, mountPath);\n  }\n\n  // Per-host caches. Function-form options are pure host → value lookups,\n  // so memoization is safe and avoids the per-request allocation of\n  // `new URL(...)` plus the caller's own host → config table work.\n  const publicUrlCache = new Map<string, string>();\n  const publicOriginCache = new Map<string, string>();\n  const prmCache = new Map<string, ProtectedResourceMetadata>();\n\n  const resolvePublicUrl = (host: string): string | undefined => {\n    if (typeof publicUrlOption === 'string') return publicUrlOption;\n    if (!publicUrlIsFn) return undefined;\n    let cached = publicUrlCache.get(host);\n    if (cached !== undefined) return cached;\n    cached = (publicUrlOption as (h: string) => string)(host);\n    const origin = validatePublicUrl(cached, mountPath);\n    publicUrlCache.set(host, cached);\n    publicOriginCache.set(host, origin);\n    return cached;\n  };\n\n  const resolvePublicOrigin = (host: string): string | undefined => {\n    if (typeof publicUrlOption === 'string') return staticPublicOrigin;\n    // Populate via resolvePublicUrl so both caches share a single validation pass.\n    if (resolvePublicUrl(host) == null) return undefined;\n    return publicOriginCache.get(host);\n  };\n\n  const resolveProtectedResource = (host: string): ProtectedResourceMetadata | undefined => {\n    if (!protectedResourceOption) return undefined;\n    if (!prmIsFn) return protectedResourceOption as ProtectedResourceMetadata;\n    let cached = prmCache.get(host);\n    if (cached !== undefined) return cached;\n    cached = (protectedResourceOption as (h: string) => ProtectedResourceMetadata)(host);\n    prmCache.set(host, cached);\n    return cached;\n  };\n\n  if (options?.authenticate == null && process.env.NODE_ENV === 'production') {\n    console.warn(\n      '[adcp/serve] No `authenticate` configured — this agent will accept unauthenticated requests. ' +\n        'AdCP security_baseline requires authentication in production.'\n    );\n  }\n\n  const explicitPreTransport = options?.preTransport as AdcpPreTransport | undefined;\n\n  const protectedResourcePath = `/.well-known/oauth-protected-resource${mountPath}`;\n\n  const httpServer = createServer(async (req, res) => {\n    const { pathname } = new URL(req.url || '', 'http://localhost');\n    const host = resolveHost(req, { trustForwardedHost });\n\n    // RFC 9728 protected-resource metadata — intentionally auth-free so\n    // clients can discover the authorization server before they have a token.\n    if (protectedResourceOption && pathname === protectedResourcePath) {\n      let resource: string | undefined;\n      let prm: ProtectedResourceMetadata | undefined;\n      try {\n        resource = resolvePublicUrl(host);\n        prm = resolveProtectedResource(host);\n      } catch (err) {\n        if (err instanceof UnknownHostError) {\n          // Operator signalled \"this host isn't in my routing table.\" 404\n          // lets the OAuth grader probe fall through cleanly and doesn't\n          // leak the configured host set across the wire.\n          res.writeHead(404);\n          res.end('Not found');\n          return;\n        }\n        console.error('[adcp/serve] publicUrl/protectedResource resolver failed:', err);\n        res.writeHead(500, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'Protected-resource metadata unavailable for this host.' }));\n        return;\n      }\n      if (!resource || !prm) {\n        // Fail closed: advertising a garbage resource URL would mint\n        // audience-mismatched tokens across the fleet. 404 signals \"this\n        // host doesn't publish PRM\" — the operator sees it and either\n        // wires the host up or takes it out of DNS.\n        res.writeHead(404);\n        res.end('Not found');\n        return;\n      }\n      const body = {\n        resource,\n        ...prm,\n        bearer_methods_supported: prm.bearer_methods_supported ?? ['header'],\n      };\n      res.writeHead(200, { 'Content-Type': 'application/json' });\n      res.end(JSON.stringify(body));\n      return;\n    }\n\n    if (pathname === mountPath || pathname === `${mountPath}/`) {\n      // Resolve per-request `resource_metadata` URL for 401 challenges and\n      // the per-host `publicUrl` authenticators read via\n      // {@link getServeRequestContext}. Resolving both up front means\n      // the audience callback in `verifyBearer` can never diverge from\n      // what the framework advertises in `/.well-known/...`. For static\n      // PRM this is the same string every request (pre-multi-host\n      // behavior); for function-form PRM/URL it follows the host.\n      let resourceMetadataUrl: string | undefined;\n      let resolvedPublicUrl: string | undefined;\n      try {\n        resolvedPublicUrl = resolvePublicUrl(host);\n      } catch (err) {\n        if (err instanceof UnknownHostError) {\n          res.writeHead(404);\n          res.end('Not found');\n          return;\n        }\n        console.error('[adcp/serve] publicUrl resolver failed:', err);\n        res.writeHead(500, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'Protected-resource metadata unavailable for this host.' }));\n        return;\n      }\n      if (protectedResourceOption) {\n        const hostOrigin = resolvePublicOrigin(host);\n        if (hostOrigin) resourceMetadataUrl = `${hostOrigin}${protectedResourcePath}`;\n      }\n\n      // Stamp the serve-resolved context on the request so authenticator\n      // callbacks (e.g. `verifyBearer`'s audience resolver) inherit the\n      // framework's host resolution — they MUST NOT re-derive host from\n      // raw headers, since that would diverge from what PRM advertises\n      // and let a spoofed `X-Forwarded-Host` flip the JWT audience check\n      // when `trustForwardedHost` is false.\n      const serveRequestContext: ServeRequestContext = resolvedPublicUrl\n        ? { host, publicUrl: resolvedPublicUrl }\n        : { host };\n      (req as IncomingMessage & { [ADCP_SERVE_REQUEST_CONTEXT]?: ServeRequestContext })[ADCP_SERVE_REQUEST_CONTEXT] =\n        serveRequestContext;\n\n      // Body buffering happens at most once per request. An idempotent helper\n      // lets the auth path (for signature authenticators) and the preTransport\n      // path share the buffer without re-reading a drained stream.\n      let rawBody: string | undefined;\n      let parsedBody: unknown;\n      let bodyParseFailed = false;\n      const ensureRawBody = async (): Promise<void> => {\n        if (rawBody !== undefined) return;\n        rawBody = await bufferBody(req, maxRequestBytes);\n        (req as { rawBody?: string }).rawBody = rawBody;\n        if (rawBody.length > 0) {\n          try {\n            parsedBody = JSON.parse(rawBody);\n          } catch {\n            bodyParseFailed = true;\n          }\n        }\n      };\n\n      // RFC 9421 signature authenticators need `req.rawBody` for Content-Digest\n      // recompute, so buffer before authentication runs when the authenticator\n      // (or any branch of an anyOf composition) carries the needs-raw-body tag.\n      if (authenticatorNeedsRawBody(options?.authenticate)) {\n        try {\n          await ensureRawBody();\n        } catch (err) {\n          // `bufferBody` has already called `req.destroy()` on the\n          // oversize path; additional teardown here would race the\n          // response write. Write the status and return.\n          const errName = (err as Error).name || 'Error';\n          console.error(`[adcp/serve] request body read failed before auth: ${errName}`);\n          if (!res.headersSent) {\n            res.writeHead(400, { 'Content-Type': 'application/json' });\n            res.end(JSON.stringify({ error: 'Request body read failed.' }));\n          }\n          return;\n        }\n      }\n\n      // Enforce authentication before transport work.\n      if (options?.authenticate) {\n        let principal: AuthPrincipal | null;\n        try {\n          principal = await options.authenticate(req);\n        } catch (err) {\n          // Surface only sanitized messages to the client; log internal cause server-side.\n          const publicMessage = err instanceof AuthError ? err.publicMessage : 'Credentials rejected.';\n          console.error('[adcp/auth] rejected:', err);\n          // Switch challenge scheme to `Signature` when the rejection\n          // originates in the RFC 9421 verifier — the signed_requests\n          // negative-vector grader reads the error code from the\n          // `WWW-Authenticate` header, so collapsing it into the generic\n          // `Bearer error=\"invalid_token\"` challenge would surface the\n          // wrong code and fail every negative vector.\n          const signatureCode = signatureErrorCodeFromCause(err);\n          if (signatureCode) {\n            respondUnauthorized(req, res, {\n              signatureError: signatureCode,\n              errorDescription: publicMessage,\n              resourceMetadata: resourceMetadataUrl,\n            });\n            return;\n          }\n          respondUnauthorized(req, res, {\n            error: 'invalid_token',\n            errorDescription: publicMessage,\n            resourceMetadata: resourceMetadataUrl,\n          });\n          return;\n        }\n        if (!principal) {\n          respondUnauthorized(req, res, {\n            error: 'invalid_token',\n            errorDescription: 'Missing or unrecognized credentials.',\n            resourceMetadata: resourceMetadataUrl,\n          });\n          return;\n        }\n        // Propagate to MCP transport so tool handlers see `extra.authInfo`.\n        attachAuthInfo(req, principal);\n      }\n\n      // Create the agent first so we can inspect it for an auto-wired\n      // preTransport attached by `createAdcpServer({ signedRequests })`. An\n      // explicit `options.preTransport` wins — it lets callers override the\n      // default wiring (e.g., to add request logging or swap verifier\n      // implementations).\n      let agentServer: AdcpServer | McpServer;\n      try {\n        agentServer = createAgent({ taskStore, host });\n      } catch (err) {\n        if (err instanceof UnknownHostError) {\n          // Factory signalled \"this host isn't routable.\" 404 keeps the\n          // adapter table off the wire while giving ops a clean failure\n          // mode instead of the generic-500 confusion.\n          res.writeHead(404);\n          res.end('Not found');\n          return;\n        }\n        // Unexpected factory failure — surface as 500 to the client and\n        // log server-side. Rethrowing would bubble to the createServer\n        // handler as an unhandled rejection (async callback), which\n        // could crash a node process with `--unhandled-rejections=strict`.\n        console.error('[adcp/serve] factory threw:', err);\n        if (!res.headersSent) {\n          res.writeHead(500, { 'Content-Type': 'application/json' });\n          res.end(JSON.stringify({ error: 'Internal server error' }));\n        }\n        return;\n      }\n      // Refuse `reuseAgent: true` + function-form `instructions`. The function\n      // is captured at server construction and would not re-evaluate per\n      // session under server reuse — silently degrading to \"instructions are\n      // a constant after all\" is worse than failing loud at the first request.\n      // Adopters fix this by removing `reuseAgent: true` (default factory\n      // creates a fresh agent per request, which is what the function needs)\n      // OR by passing a static string for `instructions`.\n      //\n      // The check fires when `reuseAgent: true` was declared, regardless of\n      // whether the adopter's factory actually caches. The flag is the\n      // adopter's stated intent to reuse; we can't introspect cache behavior.\n      if (reuseAgent && (agentServer as unknown as Record<symbol, unknown>)[ADCP_INSTRUCTIONS_FN] === true) {\n        const hint =\n          'Drop `reuseAgent: true` (a fresh agent per request fires the function each session) OR pass a static string for `instructions`.';\n        console.error(\n          '[adcp/serve] refusing reuseAgent: true with function-form instructions. ' +\n            'The function fires once per agent instance lifetime (at MCP initialize) and would not re-evaluate on subsequent sessions under server reuse. ' +\n            hint\n        );\n        if (!res.headersSent) {\n          res.writeHead(500, { 'Content-Type': 'application/json' });\n          res.end(\n            JSON.stringify({\n              error: 'serve(): reuseAgent is incompatible with function-form instructions',\n              hint,\n            })\n          );\n        }\n        return;\n      }\n      const attached = (agentServer as unknown as Record<symbol, unknown>)[ADCP_PRE_TRANSPORT];\n      const autoWiredPreTransport = typeof attached === 'function' ? (attached as AdcpPreTransport) : undefined;\n      const activePreTransport = explicitPreTransport ?? autoWiredPreTransport;\n\n      if (activePreTransport) {\n        try {\n          await ensureRawBody();\n          const handled = await activePreTransport(req as import('http').IncomingMessage & { rawBody?: string }, res);\n          if (handled) {\n            // PreTransport already responded (401, etc.). Close the agent\n            // before returning so the McpServer doesn't leak.\n            await agentServer.close();\n            return;\n          }\n        } catch (err) {\n          // Narrow to name+code — transport errors can embed remote URLs.\n          const errName = (err as Error).name || 'Error';\n          const errCode = (err as { code?: string }).code ?? 'unknown';\n          console.error(`preTransport middleware error: ${errName} (${errCode})`);\n          if (!res.headersSent) {\n            res.writeHead(500, { 'Content-Type': 'application/json' });\n            res.end(JSON.stringify({ error: 'Internal server error' }));\n          }\n          await agentServer.close();\n          return;\n        }\n      }\n\n      // In reuseAgent mode, serialize connect→handle→close per server\n      // instance. `McpServer.connect()` rejects when a transport is\n      // already attached (protocol.js:215), so concurrent requests on a\n      // cached server would race without this chain. Requests on\n      // DIFFERENT servers (different WeakMap keys) proceed in parallel.\n      // Outside reuseAgent mode the factory returns a fresh server per\n      // request — no shared instance, no lock needed.\n      const runTransportCycle = async (): Promise<void> => {\n        let modernAdapter: ReturnType<typeof createModernMcpServerAdapter> | undefined;\n        try {\n          // The official v2 classifier and Node adapter both need the parsed\n          // body after auth/signing middleware may have drained the stream.\n          // Buffer once, then pass the same parsed value to whichever era owns\n          // the request. Malformed JSON and unsupported media types fail before\n          // either protocol era receives a drained request stream.\n          await ensureRawBody();\n\n          if (req.method?.toUpperCase() === 'POST' && !isJsonContentType(req.headers['content-type'])) {\n            res.writeHead(415, { 'Content-Type': 'application/json' });\n            res.end(\n              JSON.stringify({\n                jsonrpc: '2.0',\n                error: { code: -32000, message: 'Unsupported Media Type: Content-Type must be application/json' },\n                id: null,\n              })\n            );\n            return;\n          }\n\n          if (req.method?.toUpperCase() === 'POST' && (bodyParseFailed || rawBody?.length === 0)) {\n            res.writeHead(400, { 'Content-Type': 'application/json' });\n            res.end(\n              JSON.stringify({\n                jsonrpc: '2.0',\n                error: { code: PARSE_ERROR, message: 'Parse error: request body is not valid JSON' },\n                id: null,\n              })\n            );\n            return;\n          }\n\n          // Raw v1 SDK McpServer instances retain their complete legacy\n          // surface (resources, prompts, custom handlers, Tasks extras).\n          // Only the framework-owned AdcpServer can be mirrored losslessly\n          // onto the 2026-07-28 tool transport.\n          const frameworkAgent = isAdcpServer(agentServer) ? agentServer : undefined;\n          if (frameworkAgent) {\n            const defaultAllowedHosts = resolvedPublicUrl\n              ? [new URL(resolvedPublicUrl).hostname]\n              : ['localhost', '127.0.0.1', '[::1]'];\n            const allowedHosts = options?.allowedHosts ?? defaultAllowedHosts;\n            const allowedOrigins = options?.allowedOrigins ?? allowedHosts;\n            if (!hostHeaderValidation(allowedHosts)(req, res)) return;\n            if (!originValidation(allowedOrigins)(req, res)) return;\n          }\n\n          let legacyRequest = true;\n          if (frameworkAgent) {\n            modernAdapter = createModernMcpServerAdapter(frameworkAgent);\n            legacyRequest = await modernAdapter.isLegacyRequest(req, parsedBody);\n          }\n\n          if (legacyRequest) {\n            const transport = new StreamableHTTPServerTransport({\n              sessionIdGenerator: undefined,\n            });\n            await agentServer.connect(transport);\n            // The stream was consumed for era classification, so always pass\n            // the parsed body when one was available.\n            if (parsedBody !== undefined) {\n              await transport.handleRequest(req, res, parsedBody);\n            } else {\n              await transport.handleRequest(req, res);\n            }\n          } else {\n            await modernAdapter!.handle(req, res, parsedBody);\n          }\n        } catch (err) {\n          console.error('Server error:', err);\n          if (!res.headersSent) {\n            res.writeHead(500, { 'Content-Type': 'application/json' });\n            res.end(JSON.stringify({ error: 'Internal server error' }));\n          }\n        } finally {\n          await modernAdapter?.close();\n          // close() here releases the transport AND (in reuseAgent mode)\n          // resets `_transport = undefined` on the cached server so the\n          // next queued request can connect. The server's tools,\n          // handlers, and idempotency wiring survive — close() clears\n          // the transport, not the registration.\n          await agentServer.close();\n        }\n      };\n\n      if (reuseAgent) {\n        const prev = reuseMutexes.get(agentServer) ?? Promise.resolve();\n        // `.then(runTransportCycle, runTransportCycle)` runs the cycle on\n        // EITHER prior outcome — we only care about sequencing, not the\n        // prior request's result. A plain `.then(runTransportCycle)`\n        // would skip this request when the prior rejected, leaving it\n        // stuck behind a poison-pill promise forever.\n        const current = prev.then(runTransportCycle, runTransportCycle);\n        // Swallow errors on the copy stored for sequencing so one\n        // rejection doesn't poison every subsequent request for this\n        // server instance. `current` itself is still awaited below and\n        // surfaces errors to THIS request.\n        reuseMutexes.set(\n          agentServer,\n          current.catch(() => {})\n        );\n        await current;\n      } else {\n        await runTransportCycle();\n      }\n    } else {\n      res.writeHead(404);\n      res.end('Not found');\n    }\n  });\n\n  const doListen = () => {\n    httpServer.listen(port, () => {\n      const actualPort = (httpServer.address() as { port: number }).port;\n      const url = `http://localhost:${actualPort}${mountPath}`;\n      if (options?.onListening) {\n        options.onListening(url);\n      } else {\n        console.log(`AdCP agent running at ${url}`);\n        console.log(`\\nTest with:\\n  npx @adcp/sdk@latest ${url}`);\n      }\n    });\n  };\n\n  if (options?.readinessCheck) {\n    options\n      .readinessCheck()\n      .then(doListen)\n      .catch((err: unknown) => {\n        const message = err instanceof Error ? err.message : String(err);\n        console.error('[adcp/serve] readinessCheck failed — aborting boot:', message);\n        process.exit(1);\n      });\n  } else {\n    doListen();\n  }\n\n  return httpServer;\n}\n\nfunction trimTrailingSlashes(s: string): string {\n  let end = s.length;\n  while (end > 0 && s.charCodeAt(end - 1) === 47 /* '/' */) end--;\n  return s.slice(0, end);\n}\n\n/**\n * Parse and validate a `publicUrl`, returning its origin. Shared by the\n * static-string path (validated once at `serve()` construction) and the\n * function path (validated lazily per unique host). A bad value from the\n * function form throws on the first request for that host, after PRM\n * resolution has already decided to fetch; the error is caught at the\n * call site and surfaced as a 500 so the operator sees the misconfigured\n * host instead of a silent audience-mismatch on minted tokens.\n */\nfunction validatePublicUrl(publicUrl: string, mountPath: string): string {\n  let parsed: URL;\n  try {\n    parsed = new URL(publicUrl);\n  } catch {\n    throw new Error(`serve(): \\`publicUrl\\` is not a valid URL: ${publicUrl}`);\n  }\n  if (trimTrailingSlashes(parsed.pathname) !== trimTrailingSlashes(mountPath)) {\n    throw new Error(\n      `serve(): \\`publicUrl\\` path (${parsed.pathname}) must match mount path (${mountPath}). ` +\n        'The public URL is the full MCP endpoint URL, including the path.'\n    );\n  }\n  return parsed.origin;\n}\n\n/**\n * Strip the port from a `host` string (`\"snap.example.com:3001\"` →\n * `\"snap.example.com\"`). Use inside `publicUrl` / `protectedResource`\n * resolvers to build scheme://host URLs without carrying the test-time\n * port into production URLs. IPv6 brackets preserved.\n */\nexport function hostname(host: string): string {\n  if (host.startsWith('[')) {\n    // IPv6 — preserve brackets, drop port after the closing bracket.\n    const end = host.indexOf(']');\n    if (end === -1) return host;\n    return host.slice(0, end + 1);\n  }\n  const colon = host.lastIndexOf(':');\n  return colon === -1 ? host : host.slice(0, colon);\n}\n\n/**\n * Resolve the canonical host the request arrived on for multi-host\n * routing and per-host PRM / audience advertisement. Same logic\n * `serve()` uses internally — exported so callers writing their own\n * host-dispatch middleware (e.g., behind `createExpressAdapter`) can\n * match `serve()`'s semantics exactly instead of re-implementing them.\n *\n * When `options.trustForwardedHost: true`, consults in order:\n *   1. `X-Forwarded-Host` (most common — Fly, Cloud Run, most ALBs).\n *   2. RFC 7239 `Forwarded: host=...` (spec-standard, less common).\n *   3. `Host`.\n *\n * When `trustForwardedHost: false` (default), only `Host` is read — an\n * attacker-controlled forwarded header can't flip the advertised OAuth\n * `resource` URL.\n *\n * **Proxy behavior matters when you opt in.** The helper trusts the\n * FIRST entry in a forwarded chain. That's safe when your proxy\n * OVERWRITES the header on ingress (rewriting the original value from\n * the client). It's UNSAFE when your proxy APPENDS — the attacker gets\n * to pick the first entry. Fly, Cloud Run, and GCP HTTPS LBs overwrite;\n * AWS ALB and nginx (by default) append. Verify your proxy's behavior\n * before enabling `trustForwardedHost`.\n *\n * Normalizes to lowercase and preserves port. Returns empty string when\n * no usable header is present (HTTP/1.1 requires `Host`, so this is\n * unusual — callers can branch on it to fail closed).\n *\n * @example\n * ```ts\n * import express from 'express';\n * import { resolveHost } from '@adcp/sdk/server';\n *\n * const routersByHost = new Map<string, express.Router>();\n *\n * function hostDispatch(req, res, next) {\n *   const host = resolveHost(req, { trustForwardedHost: true });\n *   const router = routersByHost.get(host);\n *   if (!router) return res.status(404).end();\n *   return router(req, res, next);\n * }\n * ```\n */\nexport function resolveHost(req: IncomingMessage, options?: { trustForwardedHost?: boolean }): string {\n  const trustForwardedHost = options?.trustForwardedHost === true;\n  if (trustForwardedHost) {\n    const xfh = firstHeaderValue(req.headers['x-forwarded-host']);\n    if (xfh) {\n      const first = xfh.split(',')[0]?.trim();\n      if (first) return first.toLowerCase();\n    }\n    const forwarded = firstHeaderValue(req.headers['forwarded']);\n    if (forwarded) {\n      const host = parseForwardedHost(forwarded);\n      if (host) return host.toLowerCase();\n    }\n  }\n  const host = firstHeaderValue(req.headers['host']);\n  return host ? host.toLowerCase() : '';\n}\n\n/**\n * Extract the `host=` parameter from an RFC 7239 `Forwarded:` header.\n * Takes the first (left-most) hop — same policy as the `X-Forwarded-Host`\n * chain rule above, and subject to the same \"your proxy must overwrite,\n * not append\" guarantee.\n *\n * Handles quoted-string values per RFC 7239 §4 (IPv6 literals and hosts\n * with ports must be quoted). Returns undefined when the header has no\n * `host` parameter, a malformed value, or a blank host.\n */\nfunction parseForwardedHost(header: string): string | undefined {\n  // Multi-hop: `Forwarded: for=1;host=a.example, for=2;host=b.example` —\n  // first hop is the client-facing proxy's view. Commas INSIDE quoted\n  // strings aren't separators, so a naive split would mis-parse IPv6.\n  // Scan manually, respecting quotes.\n  const firstHop = extractFirstForwardedHop(header);\n  if (!firstHop) return undefined;\n  for (const pair of firstHop.split(';')) {\n    const eq = pair.indexOf('=');\n    if (eq === -1) continue;\n    const key = pair.slice(0, eq).trim().toLowerCase();\n    if (key !== 'host') continue;\n    let value = pair.slice(eq + 1).trim();\n    if (value.startsWith('\"') && value.endsWith('\"') && value.length >= 2) {\n      value = value.slice(1, -1).replace(/\\\\(.)/g, '$1');\n    }\n    return value || undefined;\n  }\n  return undefined;\n}\n\nfunction extractFirstForwardedHop(header: string): string | undefined {\n  let depth = 0;\n  let start = 0;\n  for (let i = 0; i < header.length; i++) {\n    const ch = header[i];\n    if (ch === '\"') {\n      // Skip the quoted run, respecting backslash escapes.\n      i++;\n      while (i < header.length && header[i] !== '\"') {\n        if (header[i] === '\\\\') i++;\n        i++;\n      }\n      continue;\n    }\n    if (ch === ',' && depth === 0) {\n      return header.slice(start, i);\n    }\n  }\n  return header.slice(start).trim() || undefined;\n}\n\nfunction firstHeaderValue(value: string | string[] | undefined): string | undefined {\n  if (typeof value === 'string') return value;\n  if (Array.isArray(value) && value.length > 0) return value[0];\n  return undefined;\n}\n\nfunction attachAuthInfo(req: IncomingMessage, principal: AuthPrincipal): void {\n  // Propagate the kind-discriminated `credential` (Stage 3 of #1269) into\n  // `info.extra.credential` so the dispatcher can hoist it to top-level\n  // `ctx.authInfo.credential` and pass it to `BuyerAgentRegistry.resolve`.\n  // MCP's `extra` is `Record<string, unknown>`, so this round-trips\n  // without a wire-shape change. Adopters with custom authenticators that\n  // don't stamp `credential` see the registry resolve to `null` (no\n  // credential = no known agent), preserving Stage 2's strict opt-in.\n  //\n  // Also forward `principal.extra` — adopter-provided extension data stamped\n  // in the `verify` callback. This surfaces as `BuyerAgentResolveInput.extra`\n  // in `BuyerAgentRegistry.resolve` (see buyer-agent.ts). `credential` is\n  // always spread last so an adopter cannot overwrite the framework-stamped\n  // credential via their `extra` object.\n  const baseExtra = principal.claims !== undefined ? { ...principal.claims } : undefined;\n  const adopterExtra =\n    typeof principal.extra === 'object' && principal.extra !== null\n      ? (principal.extra as Record<string, unknown>)\n      : undefined;\n  const hasExtra = baseExtra !== undefined || adopterExtra !== undefined || principal.credential !== undefined;\n  const extra = hasExtra\n    ? {\n        ...(baseExtra ?? {}),\n        ...(adopterExtra ?? {}),\n        // credential last — prevents an adopter's `extra.credential` from\n        // overwriting the framework-enforced kind-discriminated credential.\n        ...(principal.credential !== undefined ? { credential: principal.credential } : {}),\n      }\n    : undefined;\n  const info: AuthInfo = {\n    token: principal.token ?? '',\n    clientId: principal.principal,\n    scopes: principal.scopes ?? [],\n    ...(principal.expiresAt !== undefined ? { expiresAt: principal.expiresAt } : {}),\n    ...(extra !== undefined ? { extra } : {}),\n  };\n  (req as IncomingMessage & { auth?: AuthInfo }).auth = info;\n}\n\nfunction bufferBody(req: import('http').IncomingMessage, maxBytes: number): Promise<string> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    req.on('data', chunk => {\n      size += chunk.length;\n      if (size > maxBytes) {\n        reject(new Error(`Request body exceeded ${maxBytes} bytes`));\n        req.destroy();\n        return;\n      }\n      chunks.push(chunk as Buffer);\n    });\n    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));\n    req.on('error', reject);\n  });\n}\n"],"mappings":"AAoBA,SAAS,qCAAqC;AAC9C,SAAS,aAAa,yBAAyB;AAC/C,SAAS,sBAAsB,wBAAwB;AACvD,SAAS,oBAAqE;AAG9E,SAAS,yBAAyB;AAGlC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB,4BAAmD;AAChF,SAAS,oBAAqC;AAC9C,SAAS,oCAAoC;AAoCtC,MAAM,yBAAyB,MAAM;AAAA,EAC1C,YAAY,UAAU,gBAAgB;AACpC,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAoOO,SAAS,MAAM,aAA4D,SAAoC;AACpH,QAAM,UAAU,QAAQ,IAAI,OAAO,SAAS,QAAQ,IAAI,MAAM,EAAE,IAAI;AACpE,MAAI,YAAY,WAAc,OAAO,MAAM,OAAO,KAAK,UAAU,KAAK,UAAU,QAAQ;AACtF,UAAM,IAAI,MAAM,uCAAuC,QAAQ,IAAI,IAAI,GAAG;AAAA,EAC5E;AACA,QAAM,OAAO,SAAS,QAAQ,WAAW;AACzC,QAAM,YAAY,SAAS,QAAQ;AACnC,QAAM,YAAY,SAAS,aAAa,IAAI,kBAAkB;AAC9D,QAAM,qBAAqB,SAAS,uBAAuB;AAC3D,QAAM,aAAa,SAAS,eAAe;AAC3C,QAAM,kBAAkB,SAAS,mBAAmB,IAAI,OAAO;AAC/D,MAAI,CAAC,OAAO,cAAc,eAAe,KAAK,mBAAmB,GAAG;AAClE,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAUA,QAAM,eAAe,oBAAI,QAAkD;AAE3E,MAAI,SAAS,qBAAqB,CAAC,QAAQ,WAAW;AACpD,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,kBAAkB,SAAS;AACjC,QAAM,0BAA0B,SAAS;AACzC,QAAM,gBAAgB,OAAO,oBAAoB;AACjD,QAAM,UAAU,OAAO,4BAA4B;AAInD,MAAI;AACJ,MAAI,OAAO,oBAAoB,UAAU;AACvC,yBAAqB,kBAAkB,iBAAiB,SAAS;AAAA,EACnE;AAKA,QAAM,iBAAiB,oBAAI,IAAoB;AAC/C,QAAM,oBAAoB,oBAAI,IAAoB;AAClD,QAAM,WAAW,oBAAI,IAAuC;AAE5D,QAAM,mBAAmB,CAAC,SAAqC;AAC7D,QAAI,OAAO,oBAAoB,SAAU,QAAO;AAChD,QAAI,CAAC,cAAe,QAAO;AAC3B,QAAI,SAAS,eAAe,IAAI,IAAI;AACpC,QAAI,WAAW,OAAW,QAAO;AACjC,aAAU,gBAA0C,IAAI;AACxD,UAAM,SAAS,kBAAkB,QAAQ,SAAS;AAClD,mBAAe,IAAI,MAAM,MAAM;AAC/B,sBAAkB,IAAI,MAAM,MAAM;AAClC,WAAO;AAAA,EACT;AAEA,QAAM,sBAAsB,CAAC,SAAqC;AAChE,QAAI,OAAO,oBAAoB,SAAU,QAAO;AAEhD,QAAI,iBAAiB,IAAI,KAAK,KAAM,QAAO;AAC3C,WAAO,kBAAkB,IAAI,IAAI;AAAA,EACnC;AAEA,QAAM,2BAA2B,CAAC,SAAwD;AACxF,QAAI,CAAC,wBAAyB,QAAO;AACrC,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,SAAS,SAAS,IAAI,IAAI;AAC9B,QAAI,WAAW,OAAW,QAAO;AACjC,aAAU,wBAAqE,IAAI;AACnF,aAAS,IAAI,MAAM,MAAM;AACzB,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,gBAAgB,QAAQ,QAAQ,IAAI,aAAa,cAAc;AAC1E,YAAQ;AAAA,MACN;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,uBAAuB,SAAS;AAEtC,QAAM,wBAAwB,wCAAwC,SAAS;AAE/E,QAAM,aAAa,aAAa,OAAO,KAAK,QAAQ;AAClD,UAAM,EAAE,SAAS,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,kBAAkB;AAC9D,UAAM,OAAO,YAAY,KAAK,EAAE,mBAAmB,CAAC;AAIpD,QAAI,2BAA2B,aAAa,uBAAuB;AACjE,UAAI;AACJ,UAAI;AACJ,UAAI;AACF,mBAAW,iBAAiB,IAAI;AAChC,cAAM,yBAAyB,IAAI;AAAA,MACrC,SAAS,KAAK;AACZ,YAAI,eAAe,kBAAkB;AAInC,cAAI,UAAU,GAAG;AACjB,cAAI,IAAI,WAAW;AACnB;AAAA,QACF;AACA,gBAAQ,MAAM,6DAA6D,GAAG;AAC9E,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,yDAAyD,CAAC,CAAC;AAC3F;AAAA,MACF;AACA,UAAI,CAAC,YAAY,CAAC,KAAK;AAKrB,YAAI,UAAU,GAAG;AACjB,YAAI,IAAI,WAAW;AACnB;AAAA,MACF;AACA,YAAM,OAAO;AAAA,QACX;AAAA,QACA,GAAG;AAAA,QACH,0BAA0B,IAAI,4BAA4B,CAAC,QAAQ;AAAA,MACrE;AACA,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,IAAI,CAAC;AAC5B;AAAA,IACF;AAEA,QAAI,aAAa,aAAa,aAAa,GAAG,SAAS,KAAK;AAQ1D,UAAI;AACJ,UAAI;AACJ,UAAI;AACF,4BAAoB,iBAAiB,IAAI;AAAA,MAC3C,SAAS,KAAK;AACZ,YAAI,eAAe,kBAAkB;AACnC,cAAI,UAAU,GAAG;AACjB,cAAI,IAAI,WAAW;AACnB;AAAA,QACF;AACA,gBAAQ,MAAM,2CAA2C,GAAG;AAC5D,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,yDAAyD,CAAC,CAAC;AAC3F;AAAA,MACF;AACA,UAAI,yBAAyB;AAC3B,cAAM,aAAa,oBAAoB,IAAI;AAC3C,YAAI,WAAY,uBAAsB,GAAG,UAAU,GAAG,qBAAqB;AAAA,MAC7E;AAQA,YAAM,sBAA2C,oBAC7C,EAAE,MAAM,WAAW,kBAAkB,IACrC,EAAE,KAAK;AACX,MAAC,IAAiF,0BAA0B,IAC1G;AAKF,UAAI;AACJ,UAAI;AACJ,UAAI,kBAAkB;AACtB,YAAM,gBAAgB,YAA2B;AAC/C,YAAI,YAAY,OAAW;AAC3B,kBAAU,MAAM,WAAW,KAAK,eAAe;AAC/C,QAAC,IAA6B,UAAU;AACxC,YAAI,QAAQ,SAAS,GAAG;AACtB,cAAI;AACF,yBAAa,KAAK,MAAM,OAAO;AAAA,UACjC,QAAQ;AACN,8BAAkB;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AAKA,UAAI,0BAA0B,SAAS,YAAY,GAAG;AACpD,YAAI;AACF,gBAAM,cAAc;AAAA,QACtB,SAAS,KAAK;AAIZ,gBAAM,UAAW,IAAc,QAAQ;AACvC,kBAAQ,MAAM,sDAAsD,OAAO,EAAE;AAC7E,cAAI,CAAC,IAAI,aAAa;AACpB,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI,IAAI,KAAK,UAAU,EAAE,OAAO,4BAA4B,CAAC,CAAC;AAAA,UAChE;AACA;AAAA,QACF;AAAA,MACF;AAGA,UAAI,SAAS,cAAc;AACzB,YAAI;AACJ,YAAI;AACF,sBAAY,MAAM,QAAQ,aAAa,GAAG;AAAA,QAC5C,SAAS,KAAK;AAEZ,gBAAM,gBAAgB,eAAe,YAAY,IAAI,gBAAgB;AACrE,kBAAQ,MAAM,yBAAyB,GAAG;AAO1C,gBAAM,gBAAgB,4BAA4B,GAAG;AACrD,cAAI,eAAe;AACjB,gCAAoB,KAAK,KAAK;AAAA,cAC5B,gBAAgB;AAAA,cAChB,kBAAkB;AAAA,cAClB,kBAAkB;AAAA,YACpB,CAAC;AACD;AAAA,UACF;AACA,8BAAoB,KAAK,KAAK;AAAA,YAC5B,OAAO;AAAA,YACP,kBAAkB;AAAA,YAClB,kBAAkB;AAAA,UACpB,CAAC;AACD;AAAA,QACF;AACA,YAAI,CAAC,WAAW;AACd,8BAAoB,KAAK,KAAK;AAAA,YAC5B,OAAO;AAAA,YACP,kBAAkB;AAAA,YAClB,kBAAkB;AAAA,UACpB,CAAC;AACD;AAAA,QACF;AAEA,uBAAe,KAAK,SAAS;AAAA,MAC/B;AAOA,UAAI;AACJ,UAAI;AACF,sBAAc,YAAY,EAAE,WAAW,KAAK,CAAC;AAAA,MAC/C,SAAS,KAAK;AACZ,YAAI,eAAe,kBAAkB;AAInC,cAAI,UAAU,GAAG;AACjB,cAAI,IAAI,WAAW;AACnB;AAAA,QACF;AAKA,gBAAQ,MAAM,+BAA+B,GAAG;AAChD,YAAI,CAAC,IAAI,aAAa;AACpB,cAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,cAAI,IAAI,KAAK,UAAU,EAAE,OAAO,wBAAwB,CAAC,CAAC;AAAA,QAC5D;AACA;AAAA,MACF;AAYA,UAAI,cAAe,YAAmD,oBAAoB,MAAM,MAAM;AACpG,cAAM,OACJ;AACF,gBAAQ;AAAA,UACN,0NAEE;AAAA,QACJ;AACA,YAAI,CAAC,IAAI,aAAa;AACpB,cAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,cAAI;AAAA,YACF,KAAK,UAAU;AAAA,cACb,OAAO;AAAA,cACP;AAAA,YACF,CAAC;AAAA,UACH;AAAA,QACF;AACA;AAAA,MACF;AACA,YAAM,WAAY,YAAmD,kBAAkB;AACvF,YAAM,wBAAwB,OAAO,aAAa,aAAc,WAAgC;AAChG,YAAM,qBAAqB,wBAAwB;AAEnD,UAAI,oBAAoB;AACtB,YAAI;AACF,gBAAM,cAAc;AACpB,gBAAM,UAAU,MAAM,mBAAmB,KAA8D,GAAG;AAC1G,cAAI,SAAS;AAGX,kBAAM,YAAY,MAAM;AACxB;AAAA,UACF;AAAA,QACF,SAAS,KAAK;AAEZ,gBAAM,UAAW,IAAc,QAAQ;AACvC,gBAAM,UAAW,IAA0B,QAAQ;AACnD,kBAAQ,MAAM,kCAAkC,OAAO,KAAK,OAAO,GAAG;AACtE,cAAI,CAAC,IAAI,aAAa;AACpB,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI,IAAI,KAAK,UAAU,EAAE,OAAO,wBAAwB,CAAC,CAAC;AAAA,UAC5D;AACA,gBAAM,YAAY,MAAM;AACxB;AAAA,QACF;AAAA,MACF;AASA,YAAM,oBAAoB,YAA2B;AACnD,YAAI;AACJ,YAAI;AAMF,gBAAM,cAAc;AAEpB,cAAI,IAAI,QAAQ,YAAY,MAAM,UAAU,CAAC,kBAAkB,IAAI,QAAQ,cAAc,CAAC,GAAG;AAC3F,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI;AAAA,cACF,KAAK,UAAU;AAAA,gBACb,SAAS;AAAA,gBACT,OAAO,EAAE,MAAM,OAAQ,SAAS,gEAAgE;AAAA,gBAChG,IAAI;AAAA,cACN,CAAC;AAAA,YACH;AACA;AAAA,UACF;AAEA,cAAI,IAAI,QAAQ,YAAY,MAAM,WAAW,mBAAmB,SAAS,WAAW,IAAI;AACtF,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI;AAAA,cACF,KAAK,UAAU;AAAA,gBACb,SAAS;AAAA,gBACT,OAAO,EAAE,MAAM,aAAa,SAAS,8CAA8C;AAAA,gBACnF,IAAI;AAAA,cACN,CAAC;AAAA,YACH;AACA;AAAA,UACF;AAMA,gBAAM,iBAAiB,aAAa,WAAW,IAAI,cAAc;AACjE,cAAI,gBAAgB;AAClB,kBAAM,sBAAsB,oBACxB,CAAC,IAAI,IAAI,iBAAiB,EAAE,QAAQ,IACpC,CAAC,aAAa,aAAa,OAAO;AACtC,kBAAM,eAAe,SAAS,gBAAgB;AAC9C,kBAAM,iBAAiB,SAAS,kBAAkB;AAClD,gBAAI,CAAC,qBAAqB,YAAY,EAAE,KAAK,GAAG,EAAG;AACnD,gBAAI,CAAC,iBAAiB,cAAc,EAAE,KAAK,GAAG,EAAG;AAAA,UACnD;AAEA,cAAI,gBAAgB;AACpB,cAAI,gBAAgB;AAClB,4BAAgB,6BAA6B,cAAc;AAC3D,4BAAgB,MAAM,cAAc,gBAAgB,KAAK,UAAU;AAAA,UACrE;AAEA,cAAI,eAAe;AACjB,kBAAM,YAAY,IAAI,8BAA8B;AAAA,cAClD,oBAAoB;AAAA,YACtB,CAAC;AACD,kBAAM,YAAY,QAAQ,SAAS;AAGnC,gBAAI,eAAe,QAAW;AAC5B,oBAAM,UAAU,cAAc,KAAK,KAAK,UAAU;AAAA,YACpD,OAAO;AACL,oBAAM,UAAU,cAAc,KAAK,GAAG;AAAA,YACxC;AAAA,UACF,OAAO;AACL,kBAAM,cAAe,OAAO,KAAK,KAAK,UAAU;AAAA,UAClD;AAAA,QACF,SAAS,KAAK;AACZ,kBAAQ,MAAM,iBAAiB,GAAG;AAClC,cAAI,CAAC,IAAI,aAAa;AACpB,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI,IAAI,KAAK,UAAU,EAAE,OAAO,wBAAwB,CAAC,CAAC;AAAA,UAC5D;AAAA,QACF,UAAE;AACA,gBAAM,eAAe,MAAM;AAM3B,gBAAM,YAAY,MAAM;AAAA,QAC1B;AAAA,MACF;AAEA,UAAI,YAAY;AACd,cAAM,OAAO,aAAa,IAAI,WAAW,KAAK,QAAQ,QAAQ;AAM9D,cAAM,UAAU,KAAK,KAAK,mBAAmB,iBAAiB;AAK9D,qBAAa;AAAA,UACX;AAAA,UACA,QAAQ,MAAM,MAAM;AAAA,UAAC,CAAC;AAAA,QACxB;AACA,cAAM;AAAA,MACR,OAAO;AACL,cAAM,kBAAkB;AAAA,MAC1B;AAAA,IACF,OAAO;AACL,UAAI,UAAU,GAAG;AACjB,UAAI,IAAI,WAAW;AAAA,IACrB;AAAA,EACF,CAAC;AAED,QAAM,WAAW,MAAM;AACrB,eAAW,OAAO,MAAM,MAAM;AAC5B,YAAM,aAAc,WAAW,QAAQ,EAAuB;AAC9D,YAAM,MAAM,oBAAoB,UAAU,GAAG,SAAS;AACtD,UAAI,SAAS,aAAa;AACxB,gBAAQ,YAAY,GAAG;AAAA,MACzB,OAAO;AACL,gBAAQ,IAAI,yBAAyB,GAAG,EAAE;AAC1C,gBAAQ,IAAI;AAAA;AAAA,yBAAwC,GAAG,EAAE;AAAA,MAC3D;AAAA,IACF,CAAC;AAAA,EACH;AAEA,MAAI,SAAS,gBAAgB;AAC3B,YACG,eAAe,EACf,KAAK,QAAQ,EACb,MAAM,CAAC,QAAiB;AACvB,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,cAAQ,MAAM,4DAAuD,OAAO;AAC5E,cAAQ,KAAK,CAAC;AAAA,IAChB,CAAC;AAAA,EACL,OAAO;AACL,aAAS;AAAA,EACX;AAEA,SAAO;AACT;AAEA,SAAS,oBAAoB,GAAmB;AAC9C,MAAI,MAAM,EAAE;AACZ,SAAO,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC,MAAM,GAAc;AAC1D,SAAO,EAAE,MAAM,GAAG,GAAG;AACvB;AAWA,SAAS,kBAAkB,WAAmB,WAA2B;AACvE,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,SAAS;AAAA,EAC5B,QAAQ;AACN,UAAM,IAAI,MAAM,8CAA8C,SAAS,EAAE;AAAA,EAC3E;AACA,MAAI,oBAAoB,OAAO,QAAQ,MAAM,oBAAoB,SAAS,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR,gCAAgC,OAAO,QAAQ,4BAA4B,SAAS;AAAA,IAEtF;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAQO,SAAS,SAAS,MAAsB;AAC7C,MAAI,KAAK,WAAW,GAAG,GAAG;AAExB,UAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,QAAI,QAAQ,GAAI,QAAO;AACvB,WAAO,KAAK,MAAM,GAAG,MAAM,CAAC;AAAA,EAC9B;AACA,QAAM,QAAQ,KAAK,YAAY,GAAG;AAClC,SAAO,UAAU,KAAK,OAAO,KAAK,MAAM,GAAG,KAAK;AAClD;AA6CO,SAAS,YAAY,KAAsB,SAAoD;AACpG,QAAM,qBAAqB,SAAS,uBAAuB;AAC3D,MAAI,oBAAoB;AACtB,UAAM,MAAM,iBAAiB,IAAI,QAAQ,kBAAkB,CAAC;AAC5D,QAAI,KAAK;AACP,YAAM,QAAQ,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACtC,UAAI,MAAO,QAAO,MAAM,YAAY;AAAA,IACtC;AACA,UAAM,YAAY,iBAAiB,IAAI,QAAQ,WAAW,CAAC;AAC3D,QAAI,WAAW;AACb,YAAMA,QAAO,mBAAmB,SAAS;AACzC,UAAIA,MAAM,QAAOA,MAAK,YAAY;AAAA,IACpC;AAAA,EACF;AACA,QAAM,OAAO,iBAAiB,IAAI,QAAQ,MAAM,CAAC;AACjD,SAAO,OAAO,KAAK,YAAY,IAAI;AACrC;AAYA,SAAS,mBAAmB,QAAoC;AAK9D,QAAM,WAAW,yBAAyB,MAAM;AAChD,MAAI,CAAC,SAAU,QAAO;AACtB,aAAW,QAAQ,SAAS,MAAM,GAAG,GAAG;AACtC,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,OAAO,GAAI;AACf,UAAM,MAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY;AACjD,QAAI,QAAQ,OAAQ;AACpB,QAAI,QAAQ,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AACpC,QAAI,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,KAAK,MAAM,UAAU,GAAG;AACrE,cAAQ,MAAM,MAAM,GAAG,EAAE,EAAE,QAAQ,UAAU,IAAI;AAAA,IACnD;AACA,WAAO,SAAS;AAAA,EAClB;AACA,SAAO;AACT;AAEA,SAAS,yBAAyB,QAAoC;AACpE,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,KAAK,OAAO,CAAC;AACnB,QAAI,OAAO,KAAK;AAEd;AACA,aAAO,IAAI,OAAO,UAAU,OAAO,CAAC,MAAM,KAAK;AAC7C,YAAI,OAAO,CAAC,MAAM,KAAM;AACxB;AAAA,MACF;AACA;AAAA,IACF;AACA,QAAI,OAAO,OAAO,UAAU,GAAG;AAC7B,aAAO,OAAO,MAAM,OAAO,CAAC;AAAA,IAC9B;AAAA,EACF;AACA,SAAO,OAAO,MAAM,KAAK,EAAE,KAAK,KAAK;AACvC;AAEA,SAAS,iBAAiB,OAA0D;AAClF,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,QAAO,MAAM,CAAC;AAC5D,SAAO;AACT;AAEA,SAAS,eAAe,KAAsB,WAAgC;AAc5E,QAAM,YAAY,UAAU,WAAW,SAAY,EAAE,GAAG,UAAU,OAAO,IAAI;AAC7E,QAAM,eACJ,OAAO,UAAU,UAAU,YAAY,UAAU,UAAU,OACtD,UAAU,QACX;AACN,QAAM,WAAW,cAAc,UAAa,iBAAiB,UAAa,UAAU,eAAe;AACnG,QAAM,QAAQ,WACV;AAAA,IACE,GAAI,aAAa,CAAC;AAAA,IAClB,GAAI,gBAAgB,CAAC;AAAA;AAAA;AAAA,IAGrB,GAAI,UAAU,eAAe,SAAY,EAAE,YAAY,UAAU,WAAW,IAAI,CAAC;AAAA,EACnF,IACA;AACJ,QAAM,OAAiB;AAAA,IACrB,OAAO,UAAU,SAAS;AAAA,IAC1B,UAAU,UAAU;AAAA,IACpB,QAAQ,UAAU,UAAU,CAAC;AAAA,IAC7B,GAAI,UAAU,cAAc,SAAY,EAAE,WAAW,UAAU,UAAU,IAAI,CAAC;AAAA,IAC9E,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC;AAAA,EACzC;AACA,EAAC,IAA8C,OAAO;AACxD;AAEA,SAAS,WAAW,KAAqC,UAAmC;AAC1F,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAmB,CAAC;AAC1B,QAAI,OAAO;AACX,QAAI,GAAG,QAAQ,WAAS;AACtB,cAAQ,MAAM;AACd,UAAI,OAAO,UAAU;AACnB,eAAO,IAAI,MAAM,yBAAyB,QAAQ,QAAQ,CAAC;AAC3D,YAAI,QAAQ;AACZ;AAAA,MACF;AACA,aAAO,KAAK,KAAe;AAAA,IAC7B,CAAC;AACD,QAAI,GAAG,OAAO,MAAM,QAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC,CAAC;AACnE,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;","names":["host"]}

package/dist/lib/server/socket-mode/conformance-client.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import WebSocket from "ws";
 import { WebSocketTransport } from "./ws-transport.mjs";
 const RECONNECT_INITIAL_MS = 1e3;

package/dist/lib/server/socket-mode/conformance-client.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/server/socket-mode/conformance-client.ts"],"sourcesContent":["/**\n * Adopter-facing Socket Mode client.\n *\n * Opens an outbound WebSocket from your dev/staging environment to a\n * remote AdCP runner (typically Addie at agenticadvertising.org) and\n * exposes your existing MCP `Server` over it. The remote runner can\n * then drive `tools/list`, `tools/call`, etc. against your server\n * exactly as if it had reached you over HTTP — no public DNS, no\n * inbound exposure.\n *\n * Three-line integration:\n *\n * ```ts\n * import { ConformanceClient } from '@adcp/sdk/server';\n * import { mcpServer } from './my-mcp-server';\n *\n * const client = new ConformanceClient({\n *   url: 'wss://addie.agenticadvertising.org/conformance/connect',\n *   token: process.env.ADCP_CONFORMANCE_TOKEN!,\n *   server: mcpServer,\n * });\n * await client.start();\n * ```\n *\n * Reconnect: exponential backoff capped at 30s. Stop via `close()` to\n * opt out of further reconnect attempts.\n *\n * Dev/staging only by design — production deployments must not expose\n * `comply_test_controller` on any surface, including this channel.\n * See [adcontextprotocol/adcp#3986](https://github.com/adcontextprotocol/adcp/issues/3986).\n */\n\nimport WebSocket from 'ws';\nimport type { Server as MCPServer } from '@modelcontextprotocol/sdk/server/index.js';\nimport { WebSocketTransport } from './ws-transport';\n\nexport type ConformanceStatus = 'idle' | 'connecting' | 'connected' | 'disconnected' | 'error';\n\nexport interface ConformanceClientOptions {\n  /**\n   * The remote runner's WebSocket URL. For Addie this is\n   * `wss://addie.agenticadvertising.org/conformance/connect` in\n   * production, `ws://localhost:3000/conformance/connect` in dev.\n   */\n  url: string;\n\n  /**\n   * Adopter-account-bound token issued by the runner. For Addie, ask in\n   * chat (\"give me a fresh conformance token\") or POST /api/conformance/token.\n   * Tokens are short-lived (typically 1h); on expiry, re-request and\n   * pass the new token via a fresh `ConformanceClient`.\n   */\n  token: string;\n\n  /**\n   * Your existing MCP server. The same instance you'd connect to\n   * `StreamableHTTPServerTransport` for normal traffic — this client\n   * exposes it bidirectionally over the outbound WebSocket.\n   */\n  server: MCPServer;\n\n  /**\n   * If true (default), reconnect on disconnect with exponential backoff\n   * up to 30s. Set false for one-shot connections.\n   */\n  reconnect?: boolean;\n\n  /**\n   * Status callback. Fires on every state transition. Useful for\n   * surfacing connection state in dev tooling or CI logs.\n   */\n  onStatus?: (status: ConformanceStatus, detail?: { error?: Error; attempt?: number }) => void;\n}\n\nconst RECONNECT_INITIAL_MS = 1000;\nconst RECONNECT_MAX_MS = 30_000;\n\nexport class ConformanceClient {\n  private status: ConformanceStatus = 'idle';\n  private socket?: WebSocket;\n  private transport?: WebSocketTransport;\n  private stopped = false;\n  private reconnectAttempt = 0;\n  private readonly opts: Required<Pick<ConformanceClientOptions, 'reconnect'>> & ConformanceClientOptions;\n\n  constructor(opts: ConformanceClientOptions) {\n    this.opts = { reconnect: true, ...opts };\n  }\n\n  async start(): Promise<void> {\n    this.stopped = false;\n    await this.connect();\n  }\n\n  async close(): Promise<void> {\n    this.stopped = true;\n    if (this.transport) {\n      await this.transport.close();\n    } else if (this.socket) {\n      this.socket.close(1000, 'adopter close');\n    }\n    this.setStatus('idle');\n  }\n\n  getStatus(): ConformanceStatus {\n    return this.status;\n  }\n\n  private async connect(): Promise<void> {\n    this.setStatus('connecting');\n    const url = new URL(this.opts.url);\n    url.searchParams.set('token', this.opts.token);\n    const socket = new WebSocket(url.toString());\n    this.socket = socket;\n    const transport = new WebSocketTransport(socket);\n    this.transport = transport;\n\n    socket.once('close', () => {\n      this.setStatus('disconnected');\n      if (!this.stopped && this.opts.reconnect) {\n        void this.scheduleReconnect();\n      }\n    });\n\n    try {\n      await this.opts.server.connect(transport);\n      this.reconnectAttempt = 0;\n      this.setStatus('connected');\n    } catch (err) {\n      this.setStatus('error', { error: err as Error });\n      socket.close(1011, 'connect failed');\n      if (!this.stopped && this.opts.reconnect) {\n        void this.scheduleReconnect();\n      }\n      throw err;\n    }\n  }\n\n  private async scheduleReconnect(): Promise<void> {\n    this.reconnectAttempt += 1;\n    const delay = Math.min(RECONNECT_INITIAL_MS * 2 ** (this.reconnectAttempt - 1), RECONNECT_MAX_MS);\n    this.setStatus('connecting', { attempt: this.reconnectAttempt });\n    await new Promise(r => setTimeout(r, delay));\n    if (this.stopped) return;\n    try {\n      await this.connect();\n    } catch {\n      // setStatus already invoked; loop continues via the close handler\n    }\n  }\n\n  private setStatus(status: ConformanceStatus, detail?: { error?: Error; attempt?: number }): void {\n    this.status = status;\n    this.opts.onStatus?.(status, detail);\n  }\n}\n"],"mappings":";;;;;;AAgCA,OAAO,eAAe;AAEtB,SAAS,0BAA0B;AAwCnC,MAAM,uBAAuB;AAC7B,MAAM,mBAAmB;AAElB,MAAM,kBAAkB;AAAA,EACrB,SAA4B;AAAA,EAC5B;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,mBAAmB;AAAA,EACV;AAAA,EAEjB,YAAY,MAAgC;AAC1C,SAAK,OAAO,EAAE,WAAW,MAAM,GAAG,KAAK;AAAA,EACzC;AAAA,EAEA,MAAM,QAAuB;AAC3B,SAAK,UAAU;AACf,UAAM,KAAK,QAAQ;AAAA,EACrB;AAAA,EAEA,MAAM,QAAuB;AAC3B,SAAK,UAAU;AACf,QAAI,KAAK,WAAW;AAClB,YAAM,KAAK,UAAU,MAAM;AAAA,IAC7B,WAAW,KAAK,QAAQ;AACtB,WAAK,OAAO,MAAM,KAAM,eAAe;AAAA,IACzC;AACA,SAAK,UAAU,MAAM;AAAA,EACvB;AAAA,EAEA,YAA+B;AAC7B,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,UAAyB;AACrC,SAAK,UAAU,YAAY;AAC3B,UAAM,MAAM,IAAI,IAAI,KAAK,KAAK,GAAG;AACjC,QAAI,aAAa,IAAI,SAAS,KAAK,KAAK,KAAK;AAC7C,UAAM,SAAS,IAAI,UAAU,IAAI,SAAS,CAAC;AAC3C,SAAK,SAAS;AACd,UAAM,YAAY,IAAI,mBAAmB,MAAM;AAC/C,SAAK,YAAY;AAEjB,WAAO,KAAK,SAAS,MAAM;AACzB,WAAK,UAAU,cAAc;AAC7B,UAAI,CAAC,KAAK,WAAW,KAAK,KAAK,WAAW;AACxC,aAAK,KAAK,kBAAkB;AAAA,MAC9B;AAAA,IACF,CAAC;AAED,QAAI;AACF,YAAM,KAAK,KAAK,OAAO,QAAQ,SAAS;AACxC,WAAK,mBAAmB;AACxB,WAAK,UAAU,WAAW;AAAA,IAC5B,SAAS,KAAK;AACZ,WAAK,UAAU,SAAS,EAAE,OAAO,IAAa,CAAC;AAC/C,aAAO,MAAM,MAAM,gBAAgB;AACnC,UAAI,CAAC,KAAK,WAAW,KAAK,KAAK,WAAW;AACxC,aAAK,KAAK,kBAAkB;AAAA,MAC9B;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAc,oBAAmC;AAC/C,SAAK,oBAAoB;AACzB,UAAM,QAAQ,KAAK,IAAI,uBAAuB,MAAM,KAAK,mBAAmB,IAAI,gBAAgB;AAChG,SAAK,UAAU,cAAc,EAAE,SAAS,KAAK,iBAAiB,CAAC;AAC/D,UAAM,IAAI,QAAQ,OAAK,WAAW,GAAG,KAAK,CAAC;AAC3C,QAAI,KAAK,QAAS;AAClB,QAAI;AACF,YAAM,KAAK,QAAQ;AAAA,IACrB,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEQ,UAAU,QAA2B,QAAoD;AAC/F,SAAK,SAAS;AACd,SAAK,KAAK,WAAW,QAAQ,MAAM;AAAA,EACrC;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/lib/server/socket-mode/conformance-client.ts"],"sourcesContent":["/**\n * Adopter-facing Socket Mode client.\n *\n * Opens an outbound WebSocket from your dev/staging environment to a\n * remote AdCP runner (typically Addie at agenticadvertising.org) and\n * exposes your existing MCP `Server` over it. The remote runner can\n * then drive `tools/list`, `tools/call`, etc. against your server\n * exactly as if it had reached you over HTTP — no public DNS, no\n * inbound exposure.\n *\n * Three-line integration:\n *\n * ```ts\n * import { ConformanceClient } from '@adcp/sdk/server';\n * import { mcpServer } from './my-mcp-server';\n *\n * const client = new ConformanceClient({\n *   url: 'wss://addie.agenticadvertising.org/conformance/connect',\n *   token: process.env.ADCP_CONFORMANCE_TOKEN!,\n *   server: mcpServer,\n * });\n * await client.start();\n * ```\n *\n * Reconnect: exponential backoff capped at 30s. Stop via `close()` to\n * opt out of further reconnect attempts.\n *\n * Dev/staging only by design — production deployments must not expose\n * `comply_test_controller` on any surface, including this channel.\n * See [adcontextprotocol/adcp#3986](https://github.com/adcontextprotocol/adcp/issues/3986).\n */\n\nimport WebSocket from 'ws';\nimport type { Server as MCPServer } from '@modelcontextprotocol/sdk/server/index.js';\nimport { WebSocketTransport } from './ws-transport';\n\nexport type ConformanceStatus = 'idle' | 'connecting' | 'connected' | 'disconnected' | 'error';\n\nexport interface ConformanceClientOptions {\n  /**\n   * The remote runner's WebSocket URL. For Addie this is\n   * `wss://addie.agenticadvertising.org/conformance/connect` in\n   * production, `ws://localhost:3000/conformance/connect` in dev.\n   */\n  url: string;\n\n  /**\n   * Adopter-account-bound token issued by the runner. For Addie, ask in\n   * chat (\"give me a fresh conformance token\") or POST /api/conformance/token.\n   * Tokens are short-lived (typically 1h); on expiry, re-request and\n   * pass the new token via a fresh `ConformanceClient`.\n   */\n  token: string;\n\n  /**\n   * Your existing MCP server. The same instance you'd connect to\n   * `StreamableHTTPServerTransport` for normal traffic — this client\n   * exposes it bidirectionally over the outbound WebSocket.\n   */\n  server: MCPServer;\n\n  /**\n   * If true (default), reconnect on disconnect with exponential backoff\n   * up to 30s. Set false for one-shot connections.\n   */\n  reconnect?: boolean;\n\n  /**\n   * Status callback. Fires on every state transition. Useful for\n   * surfacing connection state in dev tooling or CI logs.\n   */\n  onStatus?: (status: ConformanceStatus, detail?: { error?: Error; attempt?: number }) => void;\n}\n\nconst RECONNECT_INITIAL_MS = 1000;\nconst RECONNECT_MAX_MS = 30_000;\n\nexport class ConformanceClient {\n  private status: ConformanceStatus = 'idle';\n  private socket?: WebSocket;\n  private transport?: WebSocketTransport;\n  private stopped = false;\n  private reconnectAttempt = 0;\n  private readonly opts: Required<Pick<ConformanceClientOptions, 'reconnect'>> & ConformanceClientOptions;\n\n  constructor(opts: ConformanceClientOptions) {\n    this.opts = { reconnect: true, ...opts };\n  }\n\n  async start(): Promise<void> {\n    this.stopped = false;\n    await this.connect();\n  }\n\n  async close(): Promise<void> {\n    this.stopped = true;\n    if (this.transport) {\n      await this.transport.close();\n    } else if (this.socket) {\n      this.socket.close(1000, 'adopter close');\n    }\n    this.setStatus('idle');\n  }\n\n  getStatus(): ConformanceStatus {\n    return this.status;\n  }\n\n  private async connect(): Promise<void> {\n    this.setStatus('connecting');\n    const url = new URL(this.opts.url);\n    url.searchParams.set('token', this.opts.token);\n    const socket = new WebSocket(url.toString());\n    this.socket = socket;\n    const transport = new WebSocketTransport(socket);\n    this.transport = transport;\n\n    socket.once('close', () => {\n      this.setStatus('disconnected');\n      if (!this.stopped && this.opts.reconnect) {\n        void this.scheduleReconnect();\n      }\n    });\n\n    try {\n      await this.opts.server.connect(transport);\n      this.reconnectAttempt = 0;\n      this.setStatus('connected');\n    } catch (err) {\n      this.setStatus('error', { error: err as Error });\n      socket.close(1011, 'connect failed');\n      if (!this.stopped && this.opts.reconnect) {\n        void this.scheduleReconnect();\n      }\n      throw err;\n    }\n  }\n\n  private async scheduleReconnect(): Promise<void> {\n    this.reconnectAttempt += 1;\n    const delay = Math.min(RECONNECT_INITIAL_MS * 2 ** (this.reconnectAttempt - 1), RECONNECT_MAX_MS);\n    this.setStatus('connecting', { attempt: this.reconnectAttempt });\n    await new Promise(r => setTimeout(r, delay));\n    if (this.stopped) return;\n    try {\n      await this.connect();\n    } catch {\n      // setStatus already invoked; loop continues via the close handler\n    }\n  }\n\n  private setStatus(status: ConformanceStatus, detail?: { error?: Error; attempt?: number }): void {\n    this.status = status;\n    this.opts.onStatus?.(status, detail);\n  }\n}\n"],"mappings":"AAgCA,OAAO,eAAe;AAEtB,SAAS,0BAA0B;AAwCnC,MAAM,uBAAuB;AAC7B,MAAM,mBAAmB;AAElB,MAAM,kBAAkB;AAAA,EACrB,SAA4B;AAAA,EAC5B;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,mBAAmB;AAAA,EACV;AAAA,EAEjB,YAAY,MAAgC;AAC1C,SAAK,OAAO,EAAE,WAAW,MAAM,GAAG,KAAK;AAAA,EACzC;AAAA,EAEA,MAAM,QAAuB;AAC3B,SAAK,UAAU;AACf,UAAM,KAAK,QAAQ;AAAA,EACrB;AAAA,EAEA,MAAM,QAAuB;AAC3B,SAAK,UAAU;AACf,QAAI,KAAK,WAAW;AAClB,YAAM,KAAK,UAAU,MAAM;AAAA,IAC7B,WAAW,KAAK,QAAQ;AACtB,WAAK,OAAO,MAAM,KAAM,eAAe;AAAA,IACzC;AACA,SAAK,UAAU,MAAM;AAAA,EACvB;AAAA,EAEA,YAA+B;AAC7B,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,UAAyB;AACrC,SAAK,UAAU,YAAY;AAC3B,UAAM,MAAM,IAAI,IAAI,KAAK,KAAK,GAAG;AACjC,QAAI,aAAa,IAAI,SAAS,KAAK,KAAK,KAAK;AAC7C,UAAM,SAAS,IAAI,UAAU,IAAI,SAAS,CAAC;AAC3C,SAAK,SAAS;AACd,UAAM,YAAY,IAAI,mBAAmB,MAAM;AAC/C,SAAK,YAAY;AAEjB,WAAO,KAAK,SAAS,MAAM;AACzB,WAAK,UAAU,cAAc;AAC7B,UAAI,CAAC,KAAK,WAAW,KAAK,KAAK,WAAW;AACxC,aAAK,KAAK,kBAAkB;AAAA,MAC9B;AAAA,IACF,CAAC;AAED,QAAI;AACF,YAAM,KAAK,KAAK,OAAO,QAAQ,SAAS;AACxC,WAAK,mBAAmB;AACxB,WAAK,UAAU,WAAW;AAAA,IAC5B,SAAS,KAAK;AACZ,WAAK,UAAU,SAAS,EAAE,OAAO,IAAa,CAAC;AAC/C,aAAO,MAAM,MAAM,gBAAgB;AACnC,UAAI,CAAC,KAAK,WAAW,KAAK,KAAK,WAAW;AACxC,aAAK,KAAK,kBAAkB;AAAA,MAC9B;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAc,oBAAmC;AAC/C,SAAK,oBAAoB;AACzB,UAAM,QAAQ,KAAK,IAAI,uBAAuB,MAAM,KAAK,mBAAmB,IAAI,gBAAgB;AAChG,SAAK,UAAU,cAAc,EAAE,SAAS,KAAK,iBAAiB,CAAC;AAC/D,UAAM,IAAI,QAAQ,OAAK,WAAW,GAAG,KAAK,CAAC;AAC3C,QAAI,KAAK,QAAS;AAClB,QAAI;AACF,YAAM,KAAK,QAAQ;AAAA,IACrB,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEQ,UAAU,QAA2B,QAAoD;AAC/F,SAAK,SAAS;AACd,SAAK,KAAK,WAAW,QAAQ,MAAM;AAAA,EACrC;AACF;","names":[]}

package/dist/lib/server/socket-mode/index.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { ConformanceClient } from "./conformance-client.mjs";
 import { WebSocketTransport } from "./ws-transport.mjs";
 export {

package/dist/lib/server/socket-mode/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/server/socket-mode/index.ts"],"sourcesContent":["/**\n * Socket Mode — outbound-WebSocket bridge so an adopter's MCP server\n * can be reached by a remote runner without a public DNS / firewall\n * hole. Slack Socket Mode pattern.\n *\n * Today the canonical consumer is Addie at agenticadvertising.org for\n * conformance assistance during agent development. The transport is\n * neutral — any third-party orchestrator that speaks the same handshake\n * could terminate the other end.\n *\n * Dev/staging only — see `ConformanceClient` JSDoc for the policy.\n */\n\nexport { ConformanceClient, type ConformanceClientOptions, type ConformanceStatus } from './conformance-client';\nexport { WebSocketTransport } from './ws-transport';\n"],"mappings":";;;;;;AAaA,SAAS,yBAAgF;AACzF,SAAS,0BAA0B;","names":[]}
+{"version":3,"sources":["../../../../src/lib/server/socket-mode/index.ts"],"sourcesContent":["/**\n * Socket Mode — outbound-WebSocket bridge so an adopter's MCP server\n * can be reached by a remote runner without a public DNS / firewall\n * hole. Slack Socket Mode pattern.\n *\n * Today the canonical consumer is Addie at agenticadvertising.org for\n * conformance assistance during agent development. The transport is\n * neutral — any third-party orchestrator that speaks the same handshake\n * could terminate the other end.\n *\n * Dev/staging only — see `ConformanceClient` JSDoc for the policy.\n */\n\nexport { ConformanceClient, type ConformanceClientOptions, type ConformanceStatus } from './conformance-client';\nexport { WebSocketTransport } from './ws-transport';\n"],"mappings":"AAaA,SAAS,yBAAgF;AACzF,SAAS,0BAA0B;","names":[]}

package/dist/lib/server/socket-mode/ws-transport.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import WebSocket from "ws";
 import { JSONRPCMessageSchema } from "@modelcontextprotocol/sdk/types.js";
 class WebSocketTransport {

package/dist/lib/server/socket-mode/ws-transport.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/server/socket-mode/ws-transport.ts"],"sourcesContent":["/**\n * Adopter-side MCP `Transport` over an outbound WebSocket.\n *\n * Wraps a `ws` Node WebSocket as the MCP SDK's `Transport` interface\n * so an existing `Server` instance can be exposed bidirectionally over\n * a single outbound connection.\n *\n * This is the building block for \"Socket Mode\" — see `ConformanceClient`\n * for the high-level adopter-facing class.\n */\n\nimport WebSocket from 'ws';\nimport type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';\nimport { JSONRPCMessageSchema, type JSONRPCMessage } from '@modelcontextprotocol/sdk/types.js';\n\nexport class WebSocketTransport implements Transport {\n  onclose?: () => void;\n  onerror?: (error: Error) => void;\n  onmessage?: (message: JSONRPCMessage) => void;\n  sessionId?: string;\n\n  private closed = false;\n\n  constructor(private readonly socket: WebSocket) {}\n\n  async start(): Promise<void> {\n    this.socket.on('message', (data, isBinary) => {\n      if (isBinary) {\n        this.onerror?.(new Error('binary frames are not supported'));\n        return;\n      }\n      const text = data.toString('utf-8');\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(text);\n      } catch (err) {\n        this.onerror?.(new Error(`malformed JSON frame: ${(err as Error).message}`));\n        return;\n      }\n      const result = JSONRPCMessageSchema.safeParse(parsed);\n      if (!result.success) {\n        this.onerror?.(new Error(`malformed JSON-RPC message: ${result.error.message}`));\n        return;\n      }\n      this.onmessage?.(result.data);\n    });\n\n    this.socket.on('close', () => {\n      if (this.closed) return;\n      this.closed = true;\n      this.onclose?.();\n    });\n\n    this.socket.on('error', err => {\n      this.onerror?.(err);\n    });\n\n    if (this.socket.readyState === WebSocket.CONNECTING) {\n      await new Promise<void>((resolve, reject) => {\n        this.socket.once('open', () => resolve());\n        this.socket.once('error', reject);\n      });\n    }\n  }\n\n  async send(message: JSONRPCMessage): Promise<void> {\n    if (this.closed) throw new Error('transport closed');\n    return new Promise((resolve, reject) => {\n      this.socket.send(JSON.stringify(message), err => {\n        if (err) reject(err);\n        else resolve();\n      });\n    });\n  }\n\n  async close(): Promise<void> {\n    if (this.closed) return;\n    this.closed = true;\n    try {\n      this.socket.close(1000, 'transport closed');\n    } catch {\n      // ignore\n    }\n    this.onclose?.();\n  }\n}\n"],"mappings":";;;;;;AAWA,OAAO,eAAe;AAEtB,SAAS,4BAAiD;AAEnD,MAAM,mBAAwC;AAAA,EAQnD,YAA6B,QAAmB;AAAnB;AAAA,EAAoB;AAAA,EAApB;AAAA,EAP7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEQ,SAAS;AAAA,EAIjB,MAAM,QAAuB;AAC3B,SAAK,OAAO,GAAG,WAAW,CAAC,MAAM,aAAa;AAC5C,UAAI,UAAU;AACZ,aAAK,UAAU,IAAI,MAAM,iCAAiC,CAAC;AAC3D;AAAA,MACF;AACA,YAAM,OAAO,KAAK,SAAS,OAAO;AAClC,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,IAAI;AAAA,MAC1B,SAAS,KAAK;AACZ,aAAK,UAAU,IAAI,MAAM,yBAA0B,IAAc,OAAO,EAAE,CAAC;AAC3E;AAAA,MACF;AACA,YAAM,SAAS,qBAAqB,UAAU,MAAM;AACpD,UAAI,CAAC,OAAO,SAAS;AACnB,aAAK,UAAU,IAAI,MAAM,+BAA+B,OAAO,MAAM,OAAO,EAAE,CAAC;AAC/E;AAAA,MACF;AACA,WAAK,YAAY,OAAO,IAAI;AAAA,IAC9B,CAAC;AAED,SAAK,OAAO,GAAG,SAAS,MAAM;AAC5B,UAAI,KAAK,OAAQ;AACjB,WAAK,SAAS;AACd,WAAK,UAAU;AAAA,IACjB,CAAC;AAED,SAAK,OAAO,GAAG,SAAS,SAAO;AAC7B,WAAK,UAAU,GAAG;AAAA,IACpB,CAAC;AAED,QAAI,KAAK,OAAO,eAAe,UAAU,YAAY;AACnD,YAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,aAAK,OAAO,KAAK,QAAQ,MAAM,QAAQ,CAAC;AACxC,aAAK,OAAO,KAAK,SAAS,MAAM;AAAA,MAClC,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,SAAwC;AACjD,QAAI,KAAK,OAAQ,OAAM,IAAI,MAAM,kBAAkB;AACnD,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,WAAK,OAAO,KAAK,KAAK,UAAU,OAAO,GAAG,SAAO;AAC/C,YAAI,IAAK,QAAO,GAAG;AAAA,YACd,SAAQ;AAAA,MACf,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,QAAuB;AAC3B,QAAI,KAAK,OAAQ;AACjB,SAAK,SAAS;AACd,QAAI;AACF,WAAK,OAAO,MAAM,KAAM,kBAAkB;AAAA,IAC5C,QAAQ;AAAA,IAER;AACA,SAAK,UAAU;AAAA,EACjB;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/lib/server/socket-mode/ws-transport.ts"],"sourcesContent":["/**\n * Adopter-side MCP `Transport` over an outbound WebSocket.\n *\n * Wraps a `ws` Node WebSocket as the MCP SDK's `Transport` interface\n * so an existing `Server` instance can be exposed bidirectionally over\n * a single outbound connection.\n *\n * This is the building block for \"Socket Mode\" — see `ConformanceClient`\n * for the high-level adopter-facing class.\n */\n\nimport WebSocket from 'ws';\nimport type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';\nimport { JSONRPCMessageSchema, type JSONRPCMessage } from '@modelcontextprotocol/sdk/types.js';\n\nexport class WebSocketTransport implements Transport {\n  onclose?: () => void;\n  onerror?: (error: Error) => void;\n  onmessage?: (message: JSONRPCMessage) => void;\n  sessionId?: string;\n\n  private closed = false;\n\n  constructor(private readonly socket: WebSocket) {}\n\n  async start(): Promise<void> {\n    this.socket.on('message', (data, isBinary) => {\n      if (isBinary) {\n        this.onerror?.(new Error('binary frames are not supported'));\n        return;\n      }\n      const text = data.toString('utf-8');\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(text);\n      } catch (err) {\n        this.onerror?.(new Error(`malformed JSON frame: ${(err as Error).message}`));\n        return;\n      }\n      const result = JSONRPCMessageSchema.safeParse(parsed);\n      if (!result.success) {\n        this.onerror?.(new Error(`malformed JSON-RPC message: ${result.error.message}`));\n        return;\n      }\n      this.onmessage?.(result.data);\n    });\n\n    this.socket.on('close', () => {\n      if (this.closed) return;\n      this.closed = true;\n      this.onclose?.();\n    });\n\n    this.socket.on('error', err => {\n      this.onerror?.(err);\n    });\n\n    if (this.socket.readyState === WebSocket.CONNECTING) {\n      await new Promise<void>((resolve, reject) => {\n        this.socket.once('open', () => resolve());\n        this.socket.once('error', reject);\n      });\n    }\n  }\n\n  async send(message: JSONRPCMessage): Promise<void> {\n    if (this.closed) throw new Error('transport closed');\n    return new Promise((resolve, reject) => {\n      this.socket.send(JSON.stringify(message), err => {\n        if (err) reject(err);\n        else resolve();\n      });\n    });\n  }\n\n  async close(): Promise<void> {\n    if (this.closed) return;\n    this.closed = true;\n    try {\n      this.socket.close(1000, 'transport closed');\n    } catch {\n      // ignore\n    }\n    this.onclose?.();\n  }\n}\n"],"mappings":"AAWA,OAAO,eAAe;AAEtB,SAAS,4BAAiD;AAEnD,MAAM,mBAAwC;AAAA,EAQnD,YAA6B,QAAmB;AAAnB;AAAA,EAAoB;AAAA,EAApB;AAAA,EAP7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEQ,SAAS;AAAA,EAIjB,MAAM,QAAuB;AAC3B,SAAK,OAAO,GAAG,WAAW,CAAC,MAAM,aAAa;AAC5C,UAAI,UAAU;AACZ,aAAK,UAAU,IAAI,MAAM,iCAAiC,CAAC;AAC3D;AAAA,MACF;AACA,YAAM,OAAO,KAAK,SAAS,OAAO;AAClC,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,IAAI;AAAA,MAC1B,SAAS,KAAK;AACZ,aAAK,UAAU,IAAI,MAAM,yBAA0B,IAAc,OAAO,EAAE,CAAC;AAC3E;AAAA,MACF;AACA,YAAM,SAAS,qBAAqB,UAAU,MAAM;AACpD,UAAI,CAAC,OAAO,SAAS;AACnB,aAAK,UAAU,IAAI,MAAM,+BAA+B,OAAO,MAAM,OAAO,EAAE,CAAC;AAC/E;AAAA,MACF;AACA,WAAK,YAAY,OAAO,IAAI;AAAA,IAC9B,CAAC;AAED,SAAK,OAAO,GAAG,SAAS,MAAM;AAC5B,UAAI,KAAK,OAAQ;AACjB,WAAK,SAAS;AACd,WAAK,UAAU;AAAA,IACjB,CAAC;AAED,SAAK,OAAO,GAAG,SAAS,SAAO;AAC7B,WAAK,UAAU,GAAG;AAAA,IACpB,CAAC;AAED,QAAI,KAAK,OAAO,eAAe,UAAU,YAAY;AACnD,YAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,aAAK,OAAO,KAAK,QAAQ,MAAM,QAAQ,CAAC;AACxC,aAAK,OAAO,KAAK,SAAS,MAAM;AAAA,MAClC,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,SAAwC;AACjD,QAAI,KAAK,OAAQ,OAAM,IAAI,MAAM,kBAAkB;AACnD,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,WAAK,OAAO,KAAK,KAAK,UAAU,OAAO,GAAG,SAAO;AAC/C,YAAI,IAAK,QAAO,GAAG;AAAA,YACd,SAAQ;AAAA,MACf,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,QAAuB;AAC3B,QAAI,KAAK,OAAQ;AACjB,SAAK,SAAS;AACd,QAAI;AACF,WAAK,OAAO,MAAM,KAAM,kBAAkB;AAAA,IAC5C,QAAQ;AAAA,IAER;AACA,SAAK,UAAU;AAAA,EACjB;AACF;","names":[]}

package/dist/lib/server/state-machine.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { AdcpError } from "./decisioning/async-outcome.mjs";
 const MEDIA_BUY_TRANSITIONS = /* @__PURE__ */ new Map([
   ["pending_creatives", /* @__PURE__ */ new Set(["pending_start", "active", "paused", "canceled", "rejected"])],

package/dist/lib/server/state-machine.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/server/state-machine.ts"],"sourcesContent":["/**\n * Canonical lifecycle graphs for resources whose status enums the spec\n * publishes. Single source of truth — the storyboard runner's\n * `status.monotonic` invariant in `testing/storyboard/default-invariants.ts`\n * imports the same maps, so a seller that enforces transitions with these\n * helpers cannot drift from the conformance-runner enforcement.\n *\n * Edges mirror the prose in `static/schemas/source/enums/<resource>-status.json`.\n * `active ↔ paused` (media buy), `approved ↔ archived` (creative), and the\n * `rejected → processing | pending_review` re-sync path are all explicit per\n * the spec; everything else is derived from the published lifecycle.\n *\n * Two surfaces per resource:\n *   - `isLegalXTransition(from, to)` — boolean predicate. Use when you\n *     want to wrap the failure in your own error type (test-controller\n *     code, custom audit shapes).\n *   - `assertXTransition(from, to)` — throws an `AdcpError` with the\n *     spec-correct `code`. For media buys this is `NOT_CANCELLABLE` on\n *     the re-cancel idempotency path and `INVALID_STATE` everywhere else.\n *     Production seller code that handles the wire protocol directly\n *     should use this — the framework projects `AdcpError` onto the\n *     wire `adcp_error` envelope automatically.\n *\n * @public\n */\n\nimport type { CreativeStatus, MediaBuyStatus } from '../types/core.generated';\nimport { AdcpError } from './decisioning/async-outcome';\n\n/**\n * Legal `MediaBuyStatus` transitions per `media-buy-status.json`.\n *\n * `active ↔ paused` is reversible (buyer pauses, seller resumes).\n * `completed | rejected | canceled` are terminal — no outbound edges.\n *\n * `pending_start → rejected` is supported because the schema's prose\n * (`\"declined by the seller after creation\"`) does not exclude post-start\n * rejection. Storyboards do not exercise that edge today; sellers MAY\n * narrow it in their own enforcement if their upstream forbids it.\n */\nexport const MEDIA_BUY_TRANSITIONS: ReadonlyMap<MediaBuyStatus, ReadonlySet<MediaBuyStatus>> = new Map<\n  MediaBuyStatus,\n  ReadonlySet<MediaBuyStatus>\n>([\n  ['pending_creatives', new Set(['pending_start', 'active', 'paused', 'canceled', 'rejected'])],\n  ['pending_start', new Set(['active', 'paused', 'canceled', 'rejected'])],\n  ['active', new Set(['paused', 'completed', 'canceled'])],\n  ['paused', new Set(['active', 'completed', 'canceled'])],\n  ['completed', new Set()],\n  ['rejected', new Set()],\n  ['canceled', new Set()],\n]);\n\n/**\n * Legal `CreativeStatus` transitions per `creative-status.json`.\n *\n * `processing → approved` is NOT a direct edge — the spec defines\n * `processing → pending_review | rejected`, and review is what produces\n * the `approved` state. `rejected → processing | pending_review` covers\n * the buyer's re-sync path (re-submit via `sync_creatives`). No states\n * are terminal — every state can recover via re-sync.\n */\nexport const CREATIVE_ASSET_TRANSITIONS: ReadonlyMap<CreativeStatus, ReadonlySet<CreativeStatus>> = new Map<\n  CreativeStatus,\n  ReadonlySet<CreativeStatus>\n>([\n  ['processing', new Set(['pending_review', 'rejected'])],\n  ['pending_review', new Set(['approved', 'rejected'])],\n  ['approved', new Set(['archived', 'rejected'])],\n  ['archived', new Set(['approved'])],\n  ['rejected', new Set(['processing', 'pending_review'])],\n]);\n\n/** Boolean predicate for `MediaBuyStatus` transitions. Self-edges are illegal. */\nexport function isLegalMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus): boolean {\n  return MEDIA_BUY_TRANSITIONS.get(from)?.has(to) ?? false;\n}\n\n/** Boolean predicate for `CreativeStatus` transitions. Self-edges are illegal. */\nexport function isLegalCreativeTransition(from: CreativeStatus, to: CreativeStatus): boolean {\n  return CREATIVE_ASSET_TRANSITIONS.get(from)?.has(to) ?? false;\n}\n\n/**\n * Throws an `AdcpError` with the spec-correct error code for an illegal\n * `MediaBuyStatus` transition.\n *\n * Code selection per `compliance/cache/<version>/protocols/media-buy/state-machine.yaml`:\n * _\"The cancellation-specific code takes precedence over the generic\n * INVALID_STATE when the attempted action is cancel; non-cancel actions\n * targeting or out of terminal states still return INVALID_STATE.\"_\n *\n *   - Any illegal transition where `to === 'canceled'` (i.e. the buyer was\n *     attempting a cancel that the current state forbids — `completed →\n *     canceled`, `rejected → canceled`, the double-cancel idempotency\n *     `canceled → canceled`): `NOT_CANCELLABLE`.\n *   - Any other illegal edge (terminal-state escapes like `canceled →\n *     paused`, `completed → active`, lifecycle skips): `INVALID_STATE`.\n *\n * Both codes carry `recovery: 'correctable'` per the manifest in\n * `STANDARD_ERROR_CODES` — the buyer can adjust their request (re-fetch\n * current state, choose a different action) rather than escalating.\n */\nexport function assertMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus): void {\n  if (isLegalMediaBuyTransition(from, to)) return;\n  if (to === 'canceled') {\n    throw new AdcpError('NOT_CANCELLABLE', {\n      message: `Media buy in ${from} state cannot be canceled.`,\n      field: 'status',\n    });\n  }\n  throw new AdcpError('INVALID_STATE', {\n    message: `Illegal MediaBuy transition: ${from} → ${to}.`,\n    field: 'status',\n  });\n}\n\n/**\n * Throws an `AdcpError('INVALID_STATE')` for an illegal `CreativeStatus`\n * transition. Creatives have no terminals — every state can recover via\n * re-sync — so there is no creative analogue to `NOT_CANCELLABLE`.\n */\nexport function assertCreativeTransition(from: CreativeStatus, to: CreativeStatus): void {\n  if (isLegalCreativeTransition(from, to)) return;\n  throw new AdcpError('INVALID_STATE', {\n    message: `Illegal Creative transition: ${from} → ${to}.`,\n    field: 'status',\n  });\n}\n"],"mappings":";;;;;;AA2BA,SAAS,iBAAiB;AAanB,MAAM,wBAAkF,oBAAI,IAGjG;AAAA,EACA,CAAC,qBAAqB,oBAAI,IAAI,CAAC,iBAAiB,UAAU,UAAU,YAAY,UAAU,CAAC,CAAC;AAAA,EAC5F,CAAC,iBAAiB,oBAAI,IAAI,CAAC,UAAU,UAAU,YAAY,UAAU,CAAC,CAAC;AAAA,EACvE,CAAC,UAAU,oBAAI,IAAI,CAAC,UAAU,aAAa,UAAU,CAAC,CAAC;AAAA,EACvD,CAAC,UAAU,oBAAI,IAAI,CAAC,UAAU,aAAa,UAAU,CAAC,CAAC;AAAA,EACvD,CAAC,aAAa,oBAAI,IAAI,CAAC;AAAA,EACvB,CAAC,YAAY,oBAAI,IAAI,CAAC;AAAA,EACtB,CAAC,YAAY,oBAAI,IAAI,CAAC;AACxB,CAAC;AAWM,MAAM,6BAAuF,oBAAI,IAGtG;AAAA,EACA,CAAC,cAAc,oBAAI,IAAI,CAAC,kBAAkB,UAAU,CAAC,CAAC;AAAA,EACtD,CAAC,kBAAkB,oBAAI,IAAI,CAAC,YAAY,UAAU,CAAC,CAAC;AAAA,EACpD,CAAC,YAAY,oBAAI,IAAI,CAAC,YAAY,UAAU,CAAC,CAAC;AAAA,EAC9C,CAAC,YAAY,oBAAI,IAAI,CAAC,UAAU,CAAC,CAAC;AAAA,EAClC,CAAC,YAAY,oBAAI,IAAI,CAAC,cAAc,gBAAgB,CAAC,CAAC;AACxD,CAAC;AAGM,SAAS,0BAA0B,MAAsB,IAA6B;AAC3F,SAAO,sBAAsB,IAAI,IAAI,GAAG,IAAI,EAAE,KAAK;AACrD;AAGO,SAAS,0BAA0B,MAAsB,IAA6B;AAC3F,SAAO,2BAA2B,IAAI,IAAI,GAAG,IAAI,EAAE,KAAK;AAC1D;AAsBO,SAAS,yBAAyB,MAAsB,IAA0B;AACvF,MAAI,0BAA0B,MAAM,EAAE,EAAG;AACzC,MAAI,OAAO,YAAY;AACrB,UAAM,IAAI,UAAU,mBAAmB;AAAA,MACrC,SAAS,gBAAgB,IAAI;AAAA,MAC7B,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,QAAM,IAAI,UAAU,iBAAiB;AAAA,IACnC,SAAS,gCAAgC,IAAI,WAAM,EAAE;AAAA,IACrD,OAAO;AAAA,EACT,CAAC;AACH;AAOO,SAAS,yBAAyB,MAAsB,IAA0B;AACvF,MAAI,0BAA0B,MAAM,EAAE,EAAG;AACzC,QAAM,IAAI,UAAU,iBAAiB;AAAA,IACnC,SAAS,gCAAgC,IAAI,WAAM,EAAE;AAAA,IACrD,OAAO;AAAA,EACT,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../../../src/lib/server/state-machine.ts"],"sourcesContent":["/**\n * Canonical lifecycle graphs for resources whose status enums the spec\n * publishes. Single source of truth — the storyboard runner's\n * `status.monotonic` invariant in `testing/storyboard/default-invariants.ts`\n * imports the same maps, so a seller that enforces transitions with these\n * helpers cannot drift from the conformance-runner enforcement.\n *\n * Edges mirror the prose in `static/schemas/source/enums/<resource>-status.json`.\n * `active ↔ paused` (media buy), `approved ↔ archived` (creative), and the\n * `rejected → processing | pending_review` re-sync path are all explicit per\n * the spec; everything else is derived from the published lifecycle.\n *\n * Two surfaces per resource:\n *   - `isLegalXTransition(from, to)` — boolean predicate. Use when you\n *     want to wrap the failure in your own error type (test-controller\n *     code, custom audit shapes).\n *   - `assertXTransition(from, to)` — throws an `AdcpError` with the\n *     spec-correct `code`. For media buys this is `NOT_CANCELLABLE` on\n *     the re-cancel idempotency path and `INVALID_STATE` everywhere else.\n *     Production seller code that handles the wire protocol directly\n *     should use this — the framework projects `AdcpError` onto the\n *     wire `adcp_error` envelope automatically.\n *\n * @public\n */\n\nimport type { CreativeStatus, MediaBuyStatus } from '../types/core.generated';\nimport { AdcpError } from './decisioning/async-outcome';\n\n/**\n * Legal `MediaBuyStatus` transitions per `media-buy-status.json`.\n *\n * `active ↔ paused` is reversible (buyer pauses, seller resumes).\n * `completed | rejected | canceled` are terminal — no outbound edges.\n *\n * `pending_start → rejected` is supported because the schema's prose\n * (`\"declined by the seller after creation\"`) does not exclude post-start\n * rejection. Storyboards do not exercise that edge today; sellers MAY\n * narrow it in their own enforcement if their upstream forbids it.\n */\nexport const MEDIA_BUY_TRANSITIONS: ReadonlyMap<MediaBuyStatus, ReadonlySet<MediaBuyStatus>> = new Map<\n  MediaBuyStatus,\n  ReadonlySet<MediaBuyStatus>\n>([\n  ['pending_creatives', new Set(['pending_start', 'active', 'paused', 'canceled', 'rejected'])],\n  ['pending_start', new Set(['active', 'paused', 'canceled', 'rejected'])],\n  ['active', new Set(['paused', 'completed', 'canceled'])],\n  ['paused', new Set(['active', 'completed', 'canceled'])],\n  ['completed', new Set()],\n  ['rejected', new Set()],\n  ['canceled', new Set()],\n]);\n\n/**\n * Legal `CreativeStatus` transitions per `creative-status.json`.\n *\n * `processing → approved` is NOT a direct edge — the spec defines\n * `processing → pending_review | rejected`, and review is what produces\n * the `approved` state. `rejected → processing | pending_review` covers\n * the buyer's re-sync path (re-submit via `sync_creatives`). No states\n * are terminal — every state can recover via re-sync.\n */\nexport const CREATIVE_ASSET_TRANSITIONS: ReadonlyMap<CreativeStatus, ReadonlySet<CreativeStatus>> = new Map<\n  CreativeStatus,\n  ReadonlySet<CreativeStatus>\n>([\n  ['processing', new Set(['pending_review', 'rejected'])],\n  ['pending_review', new Set(['approved', 'rejected'])],\n  ['approved', new Set(['archived', 'rejected'])],\n  ['archived', new Set(['approved'])],\n  ['rejected', new Set(['processing', 'pending_review'])],\n]);\n\n/** Boolean predicate for `MediaBuyStatus` transitions. Self-edges are illegal. */\nexport function isLegalMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus): boolean {\n  return MEDIA_BUY_TRANSITIONS.get(from)?.has(to) ?? false;\n}\n\n/** Boolean predicate for `CreativeStatus` transitions. Self-edges are illegal. */\nexport function isLegalCreativeTransition(from: CreativeStatus, to: CreativeStatus): boolean {\n  return CREATIVE_ASSET_TRANSITIONS.get(from)?.has(to) ?? false;\n}\n\n/**\n * Throws an `AdcpError` with the spec-correct error code for an illegal\n * `MediaBuyStatus` transition.\n *\n * Code selection per `compliance/cache/<version>/protocols/media-buy/state-machine.yaml`:\n * _\"The cancellation-specific code takes precedence over the generic\n * INVALID_STATE when the attempted action is cancel; non-cancel actions\n * targeting or out of terminal states still return INVALID_STATE.\"_\n *\n *   - Any illegal transition where `to === 'canceled'` (i.e. the buyer was\n *     attempting a cancel that the current state forbids — `completed →\n *     canceled`, `rejected → canceled`, the double-cancel idempotency\n *     `canceled → canceled`): `NOT_CANCELLABLE`.\n *   - Any other illegal edge (terminal-state escapes like `canceled →\n *     paused`, `completed → active`, lifecycle skips): `INVALID_STATE`.\n *\n * Both codes carry `recovery: 'correctable'` per the manifest in\n * `STANDARD_ERROR_CODES` — the buyer can adjust their request (re-fetch\n * current state, choose a different action) rather than escalating.\n */\nexport function assertMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus): void {\n  if (isLegalMediaBuyTransition(from, to)) return;\n  if (to === 'canceled') {\n    throw new AdcpError('NOT_CANCELLABLE', {\n      message: `Media buy in ${from} state cannot be canceled.`,\n      field: 'status',\n    });\n  }\n  throw new AdcpError('INVALID_STATE', {\n    message: `Illegal MediaBuy transition: ${from} → ${to}.`,\n    field: 'status',\n  });\n}\n\n/**\n * Throws an `AdcpError('INVALID_STATE')` for an illegal `CreativeStatus`\n * transition. Creatives have no terminals — every state can recover via\n * re-sync — so there is no creative analogue to `NOT_CANCELLABLE`.\n */\nexport function assertCreativeTransition(from: CreativeStatus, to: CreativeStatus): void {\n  if (isLegalCreativeTransition(from, to)) return;\n  throw new AdcpError('INVALID_STATE', {\n    message: `Illegal Creative transition: ${from} → ${to}.`,\n    field: 'status',\n  });\n}\n"],"mappings":"AA2BA,SAAS,iBAAiB;AAanB,MAAM,wBAAkF,oBAAI,IAGjG;AAAA,EACA,CAAC,qBAAqB,oBAAI,IAAI,CAAC,iBAAiB,UAAU,UAAU,YAAY,UAAU,CAAC,CAAC;AAAA,EAC5F,CAAC,iBAAiB,oBAAI,IAAI,CAAC,UAAU,UAAU,YAAY,UAAU,CAAC,CAAC;AAAA,EACvE,CAAC,UAAU,oBAAI,IAAI,CAAC,UAAU,aAAa,UAAU,CAAC,CAAC;AAAA,EACvD,CAAC,UAAU,oBAAI,IAAI,CAAC,UAAU,aAAa,UAAU,CAAC,CAAC;AAAA,EACvD,CAAC,aAAa,oBAAI,IAAI,CAAC;AAAA,EACvB,CAAC,YAAY,oBAAI,IAAI,CAAC;AAAA,EACtB,CAAC,YAAY,oBAAI,IAAI,CAAC;AACxB,CAAC;AAWM,MAAM,6BAAuF,oBAAI,IAGtG;AAAA,EACA,CAAC,cAAc,oBAAI,IAAI,CAAC,kBAAkB,UAAU,CAAC,CAAC;AAAA,EACtD,CAAC,kBAAkB,oBAAI,IAAI,CAAC,YAAY,UAAU,CAAC,CAAC;AAAA,EACpD,CAAC,YAAY,oBAAI,IAAI,CAAC,YAAY,UAAU,CAAC,CAAC;AAAA,EAC9C,CAAC,YAAY,oBAAI,IAAI,CAAC,UAAU,CAAC,CAAC;AAAA,EAClC,CAAC,YAAY,oBAAI,IAAI,CAAC,cAAc,gBAAgB,CAAC,CAAC;AACxD,CAAC;AAGM,SAAS,0BAA0B,MAAsB,IAA6B;AAC3F,SAAO,sBAAsB,IAAI,IAAI,GAAG,IAAI,EAAE,KAAK;AACrD;AAGO,SAAS,0BAA0B,MAAsB,IAA6B;AAC3F,SAAO,2BAA2B,IAAI,IAAI,GAAG,IAAI,EAAE,KAAK;AAC1D;AAsBO,SAAS,yBAAyB,MAAsB,IAA0B;AACvF,MAAI,0BAA0B,MAAM,EAAE,EAAG;AACzC,MAAI,OAAO,YAAY;AACrB,UAAM,IAAI,UAAU,mBAAmB;AAAA,MACrC,SAAS,gBAAgB,IAAI;AAAA,MAC7B,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,QAAM,IAAI,UAAU,iBAAiB;AAAA,IACnC,SAAS,gCAAgC,IAAI,WAAM,EAAE;AAAA,IACrD,OAAO;AAAA,EACT,CAAC;AACH;AAOO,SAAS,yBAAyB,MAAsB,IAA0B;AACvF,MAAI,0BAA0B,MAAM,EAAE,EAAG;AACzC,QAAM,IAAI,UAAU,iBAAiB;AAAA,IACnC,SAAS,gCAAgC,IAAI,WAAM,EAAE;AAAA,IACrD,OAAO;AAAA,EACT,CAAC;AACH;","names":[]}

package/dist/lib/server/state-store.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { ADCPError } from "../errors/index.mjs";
 class StateError extends ADCPError {
   code;