@adcp/sdk 12.0.0 → 12.0.2

package/dist/lib/server/responses.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/server/responses.ts"],"sourcesContent":["/**\n * Typed response builders for AdCP MCP servers.\n *\n * @deprecated For new code, use `createAdcpServerFromPlatform` from\n * `@adcp/sdk/server` instead — it constructs wire responses internally\n * from your typed `DecisioningPlatform` return values, so adopters don't\n * touch these builders. The functions below remain exported for v5\n * adopters wiring raw MCP tool handlers (mid-migration), and for adopters\n * shaping bespoke tools the platform interface doesn't yet model. For new\n * v6 adopters, ignore this whole module — the framework handles wire\n * shaping.\n *\n * Each function takes typed data (compile-time checked against AdCP schemas)\n * and returns an MCP-compatible tool response with `content` (text summary)\n * + `structuredContent` (typed payload).\n *\n * The input parameter enforces the AdCP schema shape at compile time.\n * The return type is compatible with MCP SDK's CallToolResult.\n *\n * @example\n * ```typescript\n * import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\n * import { capabilitiesResponse, productsResponse, adcpError } from '@adcp/sdk/server';\n * import { GetProductsRequestSchema } from '@adcp/sdk/schemas';\n *\n * const server = new McpServer({ name: 'My Agent', version: '1.0.0' });\n *\n * server.registerTool(\n *   'get_adcp_capabilities',\n *   { inputSchema: {} },\n *   async () => capabilitiesResponse({ supported_protocols: ['media_buy'] })\n * );\n *\n * server.registerTool(\n *   'get_products',\n *   { inputSchema: GetProductsRequestSchema.shape },\n *   async (params) => productsResponse({ products: myProducts, cache_scope: 'account' })\n * );\n * ```\n */\n\nimport type { GetAdCPCapabilitiesResponse } from '../types/tools.generated';\nimport type { GetProductsResponse } from '../types/core.generated';\nimport type { CreateMediaBuySuccess } from '../types/core.generated';\nimport type { GetMediaBuyDeliveryResponse } from '../types/tools.generated';\nimport type { RequireCacheScopeWhenProducts, ServerPayload } from '../types/server-payload';\nimport { validActionsForStatus } from './media-buy-helpers';\nimport type { CancelMediaBuyInput } from './media-buy-helpers';\nimport type {\n  ListCreativeFormatsResponse,\n  UpdateMediaBuySuccess,\n  GetMediaBuysResponse,\n  ProvidePerformanceFeedbackSuccess,\n  BuildCreativeSuccess,\n  BuildCreativeMultiSuccess,\n  PreviewCreativeSingleResponse,\n  PreviewCreativeBatchResponse,\n  PreviewCreativeVariantResponse,\n  GetCreativeDeliveryResponse,\n  ListCreativesResponse,\n  SyncCreativesError,\n  SyncCreativesSuccess,\n  GetSignalsResponse,\n  ActivateSignalSuccess,\n  ListAccountsResponse,\n  ListPropertyListsResponse,\n  ListCollectionListsResponse,\n  ListContentStandardsResponse,\n  GetPlanAuditLogsResponse,\n  ReportUsageRequest,\n  ReportUsageResponse,\n  SyncAccountsResponse,\n  SyncGovernanceResponse,\n} from '../types/tools.generated';\nimport type {\n  AcquireRightsResponse,\n  AcquireRightsAcquired,\n  AcquireRightsPendingApproval,\n  AcquireRightsRejected,\n  UpdateRightsResponse,\n  UpdateRightsSuccess,\n  CreativeApprovalResponse,\n  CreativeApproved,\n  CreativeRejected,\n  CreativePendingReview,\n  CreativeApprovalError,\n} from '../types/core.generated';\n\n/**\n * MCP-compatible tool response shape.\n *\n * `structuredContent` is optional because error responses legitimately carry\n * only `content` (the human-readable error text) — forcing every wrapper to\n * fabricate an empty structuredContent obscures the success/error split.\n * All success builders in this file still populate it.\n *\n * Uses Record<string, unknown> for structuredContent to satisfy\n * MCP SDK's CallToolResult index signature requirement.\n */\nexport interface McpToolResponse {\n  [key: string]: unknown;\n  content: Array<{ type: 'text'; text: string }>;\n  structuredContent?: Record<string, unknown>;\n}\n\n// MCP SDK requires structuredContent to have an index signature ({ [x: string]: unknown }).\n// Generated AdCP types are TypeScript interfaces without index signatures. At runtime,\n// JSON objects are always Records — this bridge is safe.\nexport function toStructuredContent(data: object): Record<string, unknown> {\n  return data as unknown as Record<string, unknown>;\n}\n\nconst MEDIA_BUY_STATUS_VALUES = new Set([\n  'pending_creatives',\n  'pending_start',\n  'active',\n  'paused',\n  'completed',\n  'rejected',\n  'canceled',\n]);\n\nfunction completedStructuredContent(data: object, opts?: { splitMediaBuyStatus?: boolean }): Record<string, unknown> {\n  const structured = { ...toStructuredContent(data) };\n  if (\n    opts?.splitMediaBuyStatus === true &&\n    typeof structured.status === 'string' &&\n    MEDIA_BUY_STATUS_VALUES.has(structured.status)\n  ) {\n    if (structured.media_buy_status === undefined) structured.media_buy_status = structured.status;\n    delete structured.status;\n  }\n  if (structured.status === undefined) structured.status = 'completed';\n  return structured;\n}\n\nfunction failedStructuredContent(data: object): Record<string, unknown> {\n  const structured = { ...toStructuredContent(data) };\n  if (structured.status === undefined) structured.status = 'failed';\n  return structured;\n}\n\nfunction stripNotificationConfigSecrets<T extends object>(row: T): T {\n  const notificationConfigs = (row as { notification_configs?: unknown }).notification_configs;\n  if (!Array.isArray(notificationConfigs)) return row;\n  return {\n    ...row,\n    notification_configs: notificationConfigs.map(config => {\n      if (config == null || typeof config !== 'object') return config;\n      const authentication = (config as { authentication?: unknown }).authentication;\n      if (authentication == null || typeof authentication !== 'object') return config;\n      const { credentials: _credentials, ...authenticationWithoutCredentials } = authentication as Record<\n        string,\n        unknown\n      >;\n      const stripped = { ...(config as Record<string, unknown>) };\n      if (Object.keys(authenticationWithoutCredentials).length > 0) {\n        stripped.authentication = authenticationWithoutCredentials;\n      } else {\n        delete stripped.authentication;\n      }\n      return stripped;\n    }),\n  };\n}\n\nfunction stripBusinessEntityBank<T extends object>(row: T, key: 'billing_entity' | 'invoice_recipient'): T {\n  const entity = (row as Record<string, unknown>)[key];\n  if (entity == null || typeof entity !== 'object') return row;\n  if (!('bank' in entity)) return row;\n  const { bank: _bank, ...entityWithoutBank } = entity as Record<string, unknown>;\n  const stripped = { ...row } as Record<string, unknown>;\n  if (Object.keys(entityWithoutBank).length > 0) {\n    stripped[key] = entityWithoutBank;\n  } else {\n    delete stripped[key];\n  }\n  return stripped as T;\n}\n\nfunction stripAccountWriteOnlyFields<T extends object>(account: T): T {\n  return stripBusinessEntityBank(stripNotificationConfigSecrets(account), 'billing_entity');\n}\n\nfunction stripAccountsWriteOnlyFields<T extends { accounts?: unknown }>(data: T): T {\n  if (!Array.isArray(data.accounts)) return data;\n  return {\n    ...data,\n    accounts: data.accounts.map(account =>\n      account != null && typeof account === 'object' ? stripAccountWriteOnlyFields(account) : account\n    ),\n  };\n}\n\nfunction stripMediaBuyWriteOnlyFields<T extends object>(buy: T): T {\n  let stripped = stripBusinessEntityBank(buy, 'invoice_recipient');\n  const account = (stripped as { account?: unknown }).account;\n  if (account == null || typeof account !== 'object') return stripped;\n  return {\n    ...stripped,\n    account: stripAccountWriteOnlyFields(account),\n  };\n}\n\nfunction stripMediaBuysWriteOnlyFields<T extends { media_buys?: unknown }>(data: T): T {\n  if (!Array.isArray(data.media_buys)) return data;\n  return {\n    ...data,\n    media_buys: data.media_buys.map(buy =>\n      buy != null && typeof buy === 'object' ? stripMediaBuyWriteOnlyFields(buy) : buy\n    ),\n  };\n}\n\n// `setup` is only ever nested inside an `Account` (the IO-signing / pending_approval\n// path). A top-level `setup` on a media buy response means the builder read the\n// storyboard's \"setup.url\" shorthand as a top-level field. The strict handler types\n// would catch this, but `DomainHandler` accepts `Record<string, unknown>` for DX,\n// so the error has to move to runtime.\nfunction assertNoTopLevelSetup(data: unknown, builder: string): void {\n  if (data != null && typeof data === 'object' && 'setup' in data) {\n    throw new Error(\n      `${builder}: \\`setup\\` is not a field on the media buy — it belongs inside \\`account.setup\\`. ` +\n        `Move \\`{ setup: { url, message } }\\` to \\`{ account: { ..., setup: { url, message } } }\\`. ` +\n        `The setup URL is a property of the Account (returned alongside \\`status: 'pending_approval'\\`), not the MediaBuy.`\n    );\n  }\n}\n\n/**\n * Build a get_adcp_capabilities response.\n *\n * `supported_protocols` lists AdCP domain protocols (media_buy, signals, governance, etc.),\n * NOT transport protocols (mcp, a2a).\n *\n * Stamps the v3 protocol envelope's required `status: \"completed\"` field at\n * the top level of `structuredContent`. Synchronous task responses MUST carry\n * `status` per `protocol-envelope.json` (AdCP #4876); without it the\n * `v3_envelope_integrity/no_legacy_status_fields` conformance step fails.\n * The status is injected here rather than added to `GetAdCPCapabilitiesResponse`\n * because it's an envelope concern, not a payload field — the wire shape and\n * the typed payload model live at different layers.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function capabilitiesResponse(\n  data: ServerPayload<GetAdCPCapabilitiesResponse>,\n  summary?: string\n): McpToolResponse {\n  return {\n    content: [{ type: 'text', text: summary ?? 'Agent capabilities retrieved' }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a get_products response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function productsResponse(\n  data: RequireCacheScopeWhenProducts<ServerPayload<GetProductsResponse>>,\n  summary?: string\n): McpToolResponse {\n  const structured = completedStructuredContent(data);\n  const defaultSummary =\n    data.unchanged === true ? 'Product feed unchanged' : `Found ${(data.products ?? []).length} products`;\n  return {\n    content: [{ type: 'text', text: summary ?? defaultSummary }],\n    structuredContent: structured,\n  };\n}\n\n/**\n * Build a successful create_media_buy response.\n *\n * Applies protocol defaults when not explicitly provided:\n * - `revision` defaults to `1` (initial revision for optimistic concurrency)\n * - `confirmed_at` defaults to the current ISO 8601 timestamp\n * - `valid_actions` populated from status via `validActionsForStatus()` when\n *   `status` is provided but `valid_actions` is not\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function mediaBuyResponse(data: ServerPayload<CreateMediaBuySuccess>, summary?: string): McpToolResponse {\n  assertNoTopLevelSetup(data, 'mediaBuyResponse');\n  const withDefaults = { ...stripMediaBuyWriteOnlyFields(data) };\n  if (withDefaults.revision === undefined) {\n    withDefaults.revision = 1;\n  }\n  if (withDefaults.confirmed_at === undefined) {\n    withDefaults.confirmed_at = new Date().toISOString();\n  }\n  if (withDefaults.valid_actions === undefined && withDefaults.status != null) {\n    withDefaults.valid_actions = validActionsForStatus(withDefaults.status);\n  }\n  return {\n    content: [{ type: 'text', text: summary ?? `Media buy ${withDefaults.media_buy_id} created` }],\n    structuredContent: completedStructuredContent(withDefaults, { splitMediaBuyStatus: true }),\n  };\n}\n\n/**\n * Build a get_media_buy_delivery response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function deliveryResponse(data: ServerPayload<GetMediaBuyDeliveryResponse>, summary?: string): McpToolResponse {\n  return {\n    content: [\n      {\n        type: 'text',\n        text:\n          summary ??\n          `Delivery data for ${data.media_buy_deliveries.length} media buy${data.media_buy_deliveries.length === 1 ? '' : 's'}`,\n      },\n    ],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a list_accounts response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function listAccountsResponse(data: ServerPayload<ListAccountsResponse>, summary?: string): McpToolResponse {\n  const stripped = stripAccountsWriteOnlyFields(data);\n  return {\n    content: [{ type: 'text', text: summary ?? `Found ${stripped.accounts.length} accounts` }],\n    structuredContent: completedStructuredContent(stripped),\n  };\n}\n\n/**\n * Build a list_creative_formats response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function listCreativeFormatsResponse(\n  data: ServerPayload<ListCreativeFormatsResponse>,\n  summary?: string\n): McpToolResponse {\n  return {\n    content: [{ type: 'text', text: summary ?? `Found ${data.formats.length} creative formats` }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a successful update_media_buy response.\n *\n * When `status` is provided but `valid_actions` is not, auto-populates\n * `valid_actions` from `validActionsForStatus()`.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function updateMediaBuyResponse(data: ServerPayload<UpdateMediaBuySuccess>, summary?: string): McpToolResponse {\n  assertNoTopLevelSetup(data, 'updateMediaBuyResponse');\n  const withDefaults = { ...stripBusinessEntityBank(data, 'invoice_recipient') };\n  if (withDefaults.valid_actions === undefined && withDefaults.status != null) {\n    withDefaults.valid_actions = validActionsForStatus(withDefaults.status);\n  }\n  return {\n    content: [{ type: 'text', text: summary ?? `Media buy ${withDefaults.media_buy_id} updated` }],\n    structuredContent: completedStructuredContent(withDefaults, { splitMediaBuyStatus: true }),\n  };\n}\n\n/**\n * Build a get_media_buys response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function getMediaBuysResponse(data: ServerPayload<GetMediaBuysResponse>, summary?: string): McpToolResponse {\n  if (Array.isArray(data.media_buys)) {\n    for (const buy of data.media_buys) {\n      assertNoTopLevelSetup(buy, 'getMediaBuysResponse');\n    }\n  }\n  const stripped = stripMediaBuysWriteOnlyFields(data);\n  return {\n    content: [\n      {\n        type: 'text',\n        text: summary ?? `Found ${stripped.media_buys.length} media buy${stripped.media_buys.length === 1 ? '' : 's'}`,\n      },\n    ],\n    structuredContent: completedStructuredContent(stripped),\n  };\n}\n\n/**\n * Build a successful provide_performance_feedback response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function performanceFeedbackResponse(\n  data: ServerPayload<ProvidePerformanceFeedbackSuccess>,\n  summary?: string\n): McpToolResponse {\n  return {\n    content: [{ type: 'text', text: summary ?? 'Performance feedback accepted' }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a successful build_creative response (single format).\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function buildCreativeResponse(data: ServerPayload<BuildCreativeSuccess>, summary?: string): McpToolResponse {\n  // Optional-chain the default summary — handler responses that drop\n  // `format_id` still reach the wire-level schema validator (which names\n  // the missing field), instead of crashing the dispatcher here with an\n  // opaque `Cannot read properties of undefined (reading 'id')`.\n  const formatId = data.creative_manifest?.format_id?.id;\n  return {\n    content: [{ type: 'text', text: summary ?? (formatId ? `Creative built: ${formatId}` : 'Creative built') }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a successful build_creative response (multi-format).\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function buildCreativeMultiResponse(\n  data: ServerPayload<BuildCreativeMultiSuccess>,\n  summary?: string\n): McpToolResponse {\n  const count = data.creative_manifests?.length ?? 0;\n  return {\n    content: [{ type: 'text', text: summary ?? `Built ${count} creative formats` }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a preview_creative response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function previewCreativeResponse(\n  data: PreviewCreativeSingleResponse | PreviewCreativeBatchResponse | PreviewCreativeVariantResponse,\n  summary?: string\n): McpToolResponse {\n  const defaultSummary =\n    data.response_type === 'single'\n      ? (() => {\n          const n = (data as PreviewCreativeSingleResponse).previews.length;\n          return `Preview generated: ${n} variant${n === 1 ? '' : 's'}`;\n        })()\n      : data.response_type === 'batch'\n        ? (() => {\n            const n = (data as PreviewCreativeBatchResponse).results.length;\n            return `Batch preview: ${n} result${n === 1 ? '' : 's'}`;\n          })()\n        : `Variant preview generated`;\n  return {\n    content: [{ type: 'text', text: summary ?? defaultSummary }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a get_creative_delivery response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function creativeDeliveryResponse(\n  data: ServerPayload<GetCreativeDeliveryResponse>,\n  summary?: string\n): McpToolResponse {\n  return {\n    content: [{ type: 'text', text: summary ?? `Creative delivery data for ${data.currency} report` }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a list_creatives response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function listCreativesResponse(data: ServerPayload<ListCreativesResponse>, summary?: string): McpToolResponse {\n  return {\n    content: [\n      {\n        type: 'text',\n        text:\n          summary ?? `Found ${data.query_summary.total_matching} creatives (${data.query_summary.returned} returned)`,\n      },\n    ],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a list_property_lists response. The governance property-list catalog\n * is returned under the required `lists` wrapper — use this helper so\n * handlers can't accidentally emit a bare array at the top level (which the\n * storyboard runner flags as shape drift).\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function listPropertyListsResponse(\n  data: ServerPayload<ListPropertyListsResponse>,\n  summary?: string\n): McpToolResponse {\n  return {\n    content: [\n      {\n        type: 'text',\n        text: summary ?? `Found ${data.lists.length} property list${data.lists.length === 1 ? '' : 's'}`,\n      },\n    ],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a list_collection_lists response. Companion to\n * `listPropertyListsResponse` — same `lists` wrapper shape; parallel\n * governance surface for program-level collections.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function listCollectionListsResponse(\n  data: ServerPayload<ListCollectionListsResponse>,\n  summary?: string\n): McpToolResponse {\n  return {\n    content: [\n      {\n        type: 'text',\n        text: summary ?? `Found ${data.lists.length} collection list${data.lists.length === 1 ? '' : 's'}`,\n      },\n    ],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a list_content_standards response. The response type is a union\n * (success branch with `standards` array, error branch with `errors`) —\n * the helper wraps either shape verbatim; schema-level invariants are\n * enforced at wire validation, not here.\n *\n * Discriminates on `'standards' in data` rather than `'errors' in data` so\n * a legitimate success response that happens to carry advisory `errors`\n * still gets a counted summary. The error-only text fires only when\n * `standards` is absent. Mirrors `acquireRightsResponse`'s success-first\n * discrimination pattern a few screens down.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function listContentStandardsResponse(\n  data: ServerPayload<ListContentStandardsResponse>,\n  summary?: string\n): McpToolResponse {\n  const defaultSummary =\n    'standards' in data\n      ? `Found ${data.standards.length} content standard${data.standards.length === 1 ? '' : 's'}`\n      : 'Content standards lookup error';\n  return {\n    content: [{ type: 'text', text: summary ?? defaultSummary }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a get_plan_audit_logs response. Wraps the audit data array under\n * the required `plans` key — handlers that return a bare array trip the\n * storyboard runner's shape-drift hint.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function getPlanAuditLogsResponse(\n  data: ServerPayload<GetPlanAuditLogsResponse>,\n  summary?: string\n): McpToolResponse {\n  return {\n    content: [\n      {\n        type: 'text',\n        text: summary ?? `Audit data for ${data.plans.length} plan${data.plans.length === 1 ? '' : 's'}`,\n      },\n    ],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\ntype SyncCreativesResponsePayload = ServerPayload<SyncCreativesSuccess> | ServerPayload<SyncCreativesError>;\n\nfunction isSyncCreativesErrorPayload(data: SyncCreativesResponsePayload): data is ServerPayload<SyncCreativesError> {\n  return (\n    Array.isArray((data as { errors?: unknown }).errors) && !Array.isArray((data as { creatives?: unknown }).creatives)\n  );\n}\n\n/**\n * Build a sync_creatives response. Accepts both row-level success payloads\n * and operation-level error payloads. If a payload includes `creatives`, the\n * builder treats it as success-shaped even when advisory row errors are also\n * present; operation-level errors are the errors-only arm.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function syncCreativesResponse(data: SyncCreativesResponsePayload, summary?: string): McpToolResponse {\n  if (isSyncCreativesErrorPayload(data)) {\n    const firstError = data.errors[0];\n    const defaultSummary = firstError ? `${firstError.code}: ${firstError.message}` : 'Sync creatives failed';\n    return {\n      content: [{ type: 'text', text: summary ?? defaultSummary }],\n      isError: true,\n      structuredContent: failedStructuredContent(data),\n    };\n  }\n\n  return {\n    content: [\n      {\n        type: 'text',\n        text: summary ?? `Synced ${data.creatives.length} creative${data.creatives.length === 1 ? '' : 's'}`,\n      },\n    ],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a get_signals response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function getSignalsResponse(data: ServerPayload<GetSignalsResponse>, summary?: string): McpToolResponse {\n  return {\n    content: [\n      {\n        type: 'text',\n        text: summary ?? `Found ${(data.signals ?? []).length} signal${(data.signals ?? []).length === 1 ? '' : 's'}`,\n      },\n    ],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a successful activate_signal response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function activateSignalResponse(data: ServerPayload<ActivateSignalSuccess>, summary?: string): McpToolResponse {\n  return {\n    content: [\n      {\n        type: 'text',\n        text:\n          summary ??\n          `Signal activated across ${data.deployments.length} deployment${data.deployments.length === 1 ? '' : 's'}`,\n      },\n    ],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a cancel response for update_media_buy with action: 'cancel'.\n *\n * Eliminates the cancellation metadata trap by requiring `canceled_by`\n * and auto-setting `canceled_at`, `status: 'canceled'`, and `valid_actions: []`.\n *\n * Note: `cancellation` is not yet on the `UpdateMediaBuySuccess` generated type\n * (it exists on the full `MediaBuy` entity). This builder constructs the response\n * as a plain object to include it. When the upstream schema adds `cancellation`\n * to the update response, this can be tightened.\n *\n * @example\n * ```typescript\n * server.registerTool(\n *   'update_media_buy',\n *   { inputSchema: UpdateMediaBuyRequestSchema.shape },\n *   async (params) => {\n *     if (params.action === 'cancel') {\n *       return cancelMediaBuyResponse({\n *         media_buy_id: params.media_buy_id,\n *         canceled_by: 'buyer',\n *         revision: currentRevision + 1,\n *       });\n *     }\n *     // ... handle other actions\n *   }\n * );\n * ```\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function cancelMediaBuyResponse(input: CancelMediaBuyInput, summary?: string): McpToolResponse {\n  const cancellation: Record<string, unknown> = {\n    canceled_at: input.canceled_at ?? new Date().toISOString(),\n    canceled_by: input.canceled_by,\n  };\n  if (input.reason !== undefined) {\n    cancellation.reason = input.reason;\n  }\n\n  const data: Record<string, unknown> = {\n    media_buy_id: input.media_buy_id,\n    status: 'canceled',\n    valid_actions: [],\n    revision: input.revision,\n    cancellation,\n  };\n  if (input.affected_packages !== undefined) {\n    data.affected_packages = input.affected_packages;\n  }\n  if (input.sandbox !== undefined) {\n    data.sandbox = input.sandbox;\n  }\n\n  return {\n    content: [{ type: 'text', text: summary ?? `Media buy ${input.media_buy_id} canceled` }],\n    structuredContent: completedStructuredContent(data, { splitMediaBuyStatus: true }),\n  };\n}\n\n/**\n * Build an `acquire_rights` response. Thin envelope wrapper — enforces the\n * discriminated union on `status` at the type level, wraps the domain object\n * in `content` + `structuredContent`, nothing else. Schema-level constraints\n * (credential length, schemes cardinality, required-field presence) belong\n * in wire-level Zod validation, not here.\n *\n * Enable dev-time enforcement via\n * `createAdcpServer({ validation: { responses: 'strict' } })` until it\n * becomes the default.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function acquireRightsResponse(data: ServerPayload<AcquireRightsResponse>, summary?: string): McpToolResponse {\n  const dataAsAny = data as AcquireRightsResponse & { rights_status?: string; rights_id?: string };\n  const defaultSummary =\n    'errors' in data\n      ? 'Rights acquisition error'\n      : dataAsAny.rights_status === 'acquired'\n        ? `Rights ${dataAsAny.rights_id} acquired`\n        : dataAsAny.rights_status === 'rejected'\n          ? `Rights ${dataAsAny.rights_id} rejected`\n          : `Rights ${dataAsAny.rights_id} pending approval`;\n  return {\n    content: [{ type: 'text', text: summary ?? defaultSummary }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Per-variant constructor — builds an `AcquireRightsAcquired` success response\n * and wraps it. Cleaner autocomplete than `acquireRightsResponse({ rights_status: 'acquired', ... })`\n * because a coding agent typing `acquireRightsAcqu…` gets the required-fields\n * shape directly without reading a 4-variant union.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function acquireRightsAcquired(\n  data: Omit<AcquireRightsAcquired, 'rights_status'>,\n  summary?: string\n): McpToolResponse {\n  return acquireRightsResponse({ ...data, rights_status: 'acquired' } as unknown as AcquireRightsResponse, summary);\n}\n\n/** Per-variant constructor for the `pending_approval` branch. */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function acquireRightsPendingApproval(\n  data: Omit<AcquireRightsPendingApproval, 'rights_status'>,\n  summary?: string\n): McpToolResponse {\n  return acquireRightsResponse(\n    { ...data, rights_status: 'pending_approval' } as unknown as AcquireRightsResponse,\n    summary\n  );\n}\n\n/** Per-variant constructor for the `rejected` branch. */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function acquireRightsRejected(\n  data: Omit<AcquireRightsRejected, 'rights_status'>,\n  summary?: string\n): McpToolResponse {\n  return acquireRightsResponse({ ...data, rights_status: 'rejected' } as unknown as AcquireRightsResponse, summary);\n}\n\n/**\n * Build an `update_rights` response. Wraps a `UpdateRightsResponse` (success\n * or error arm — discriminated structurally on `errors` presence) in the\n * standard `content` + `structuredContent` envelope. The framework auto-\n * applies this wrapper for v6 typed-platform handlers; direct callers are\n * v5 raw-handler adopters only.\n *\n * Mirrors `acquireRightsResponse`'s shape conventions (success-first\n * default summary, error pass-through).\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function updateRightsResponse(data: ServerPayload<UpdateRightsResponse>, summary?: string): McpToolResponse {\n  const defaultSummary =\n    'errors' in data\n      ? 'Rights update error'\n      : data.implementation_date == null\n        ? `Rights ${data.rights_id} update pending approval`\n        : `Rights ${data.rights_id} updated`;\n  return {\n    content: [{ type: 'text', text: summary ?? defaultSummary }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Per-variant constructor for the success arm. The wire spec doesn't\n * carry a `status` discriminator on `update_rights` (unlike\n * `acquire_rights`); success is identified structurally by absence of\n * `errors`. The narrow constructor is still useful — it gives autocomplete\n * the success-shape fields (`terms`, `generation_credentials`,\n * `rights_constraint`) without crossing the union.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function updateRightsSuccess(data: ServerPayload<UpdateRightsSuccess>, summary?: string): McpToolResponse {\n  return updateRightsResponse(data as unknown as UpdateRightsResponse, summary);\n}\n\n/**\n * Build a `creative_approval` webhook response.\n *\n * Unlike the other builders in this module, `creative_approval` is NOT an\n * MCP/A2A tool — the spec models it as an HTTP webhook. The buyer POSTs\n * a `CreativeApprovalRequest` to the `approval_webhook` URL returned in\n * `acquire_rights`; the brand-rights agent reviews and returns one of four\n * arms (Approved / Rejected / PendingReview / Error). Adopters wire this\n * builder into their HTTP server's response path — see the\n * `BrandRightsPlatform.reviewCreativeApproval` Platform method and the\n * skill at `skills/build-brand-rights-agent/SKILL.md` for the receiver\n * pattern.\n *\n * Returns the raw JSON-serializable payload, NOT an `McpToolResponse` —\n * webhooks have no `content` envelope. Adopters serialize this to JSON and\n * write to the HTTP response body.\n */\nexport function creativeApprovalResponse(data: CreativeApprovalResponse): CreativeApprovalResponse {\n  return data;\n}\n\n/** Per-variant constructor for the `approved` branch — webhook payload. */\nexport function creativeApprovalApproved(data: Omit<CreativeApproved, 'status'>): CreativeApproved {\n  return { ...data, status: 'approved' } as CreativeApproved;\n}\n\n/** Per-variant constructor for the `rejected` branch — webhook payload. */\nexport function creativeApprovalRejected(data: Omit<CreativeRejected, 'status'>): CreativeRejected {\n  return { ...data, status: 'rejected' } as CreativeRejected;\n}\n\n/** Per-variant constructor for the `pending_review` branch — webhook payload. */\nexport function creativeApprovalPendingReview(data: Omit<CreativePendingReview, 'status'>): CreativePendingReview {\n  return { ...data, status: 'pending_review' } as CreativePendingReview;\n}\n\n/** Per-variant constructor for the multi-error arm — webhook payload. */\nexport function creativeApprovalError(data: CreativeApprovalError): CreativeApprovalError {\n  return data;\n}\n\n/**\n * Build a `sync_accounts` response. Thin envelope wrapper accepting the full\n * `SyncAccountsResponse` union; error payloads pass through.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function syncAccountsResponse(data: ServerPayload<SyncAccountsResponse>, summary?: string): McpToolResponse {\n  const stripped = 'accounts' in data ? stripAccountsWriteOnlyFields(data) : data;\n  const defaultSummary =\n    'errors' in stripped\n      ? 'Account sync error'\n      : `Synced ${stripped.accounts?.length ?? 0} account${stripped.accounts?.length === 1 ? '' : 's'}`;\n  return {\n    content: [{ type: 'text', text: summary ?? defaultSummary }],\n    structuredContent: completedStructuredContent(stripped),\n  };\n}\n\n/**\n * Build a sync_governance response. The spec permits two top-level shapes\n * (success / error); the type union enforces discrimination on `status`.\n *\n * Strips `governance_agents[i].authentication` from every row before emit:\n * the spec marks `authentication.credentials` write-only (the buyer sends\n * the bearer; the seller persists it for outbound `check_governance` calls\n * but MUST NOT echo it back). The natural `{ ...entry.governance_agents[i] }`\n * echo idiom would compile silently against the typed return shape and ship\n * credentials over the wire AND into the idempotency replay cache, arming\n * the buyer (and any subsequent caller hitting the same key) to impersonate\n * the seller against the governance agent. Strip is enforced at the wire-\n * emit boundary so both v5 (`opts.accounts.syncGovernance`) and v6\n * (`AccountStore.syncGovernance`) paths are protected.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function syncGovernanceResponse(data: ServerPayload<SyncGovernanceResponse>, summary?: string): McpToolResponse {\n  const stripped = stripGovernanceAgentSecrets(data);\n  return {\n    content: [{ type: 'text', text: summary ?? 'Governance registration synced' }],\n    structuredContent: completedStructuredContent(stripped),\n  };\n}\n\nfunction stripGovernanceAgentSecrets(\n  data: ServerPayload<SyncGovernanceResponse>\n): ServerPayload<SyncGovernanceResponse> {\n  if (!('accounts' in data) || !Array.isArray(data.accounts)) return data;\n  return {\n    ...data,\n    accounts: data.accounts.map(row => {\n      if (!row.governance_agents) return row;\n      return {\n        ...row,\n        // AdCP 3.1.0-beta.2 narrowed the wire shape to `{ url }` only;\n        // `categories` was removed (per-agent category signaling moved\n        // out of band) and `authentication` remains write-only. Project\n        // explicitly to defeat JS / `as any` smuggling of either field.\n        governance_agents: row.governance_agents.map(a => ({ url: a.url })),\n      };\n    }),\n  };\n}\n\n/**\n * Build a `report_usage` response. Thin envelope wrapper. Schema-level\n * `accepted` requiredness is enforced at the type level (via\n * `ReportUsageResponse.accepted: number`) and at wire-level validation;\n * this builder does not re-assert it.\n *\n * @example\n * ```typescript\n * // Explicit:\n * reportUsage: async (params) =>\n *   reportUsageResponse({ accepted: 8, errors: [{ usage_index: 2, message: 'invalid' }] })\n *\n * // Ack every usage[] row with optional errors (shortcut):\n * reportUsage: async (params) => reportUsageResponse.acceptAll(params)\n * ```\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function reportUsageResponse(data: ServerPayload<ReportUsageResponse>, summary?: string): McpToolResponse {\n  return {\n    content: [\n      { type: 'text', text: summary ?? `Accepted ${data.accepted} usage record${data.accepted === 1 ? '' : 's'}` },\n    ],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Shortcut for the common case: accept all rows in the request, optionally\n * minus any `errors[]` the caller computed. Sets\n * `accepted = (request.usage?.length ?? 0) - errors.length`.\n *\n * Use with honest errors — passing no `errors` when rows failed validation\n * is lying to buyers and the audit trail.\n */\nreportUsageResponse.acceptAll = function acceptAll(\n  request: ReportUsageRequest,\n  opts?: { errors?: ReportUsageResponse['errors']; summary?: string }\n): McpToolResponse {\n  const total = request.usage?.length ?? 0;\n  const errors = opts?.errors ?? [];\n  const accepted = Math.max(0, total - errors.length);\n  return reportUsageResponse(\n    {\n      status: errors.length > 0 ? 'failed' : 'completed',\n      accepted,\n      ...(errors.length > 0 ? { errors } : {}),\n    } as ReportUsageResponse,\n    opts?.summary\n  );\n};\n"],"mappings":";;;;;;AA8CA,SAAS,6BAA6B;AA8D/B,SAAS,oBAAoB,MAAuC;AACzE,SAAO;AACT;AAEA,MAAM,0BAA0B,oBAAI,IAAI;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,2BAA2B,MAAc,MAAmE;AACnH,QAAM,aAAa,EAAE,GAAG,oBAAoB,IAAI,EAAE;AAClD,MACE,MAAM,wBAAwB,QAC9B,OAAO,WAAW,WAAW,YAC7B,wBAAwB,IAAI,WAAW,MAAM,GAC7C;AACA,QAAI,WAAW,qBAAqB,OAAW,YAAW,mBAAmB,WAAW;AACxF,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,WAAW,WAAW,OAAW,YAAW,SAAS;AACzD,SAAO;AACT;AAEA,SAAS,wBAAwB,MAAuC;AACtE,QAAM,aAAa,EAAE,GAAG,oBAAoB,IAAI,EAAE;AAClD,MAAI,WAAW,WAAW,OAAW,YAAW,SAAS;AACzD,SAAO;AACT;AAEA,SAAS,+BAAiD,KAAW;AACnE,QAAM,sBAAuB,IAA2C;AACxE,MAAI,CAAC,MAAM,QAAQ,mBAAmB,EAAG,QAAO;AAChD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,sBAAsB,oBAAoB,IAAI,YAAU;AACtD,UAAI,UAAU,QAAQ,OAAO,WAAW,SAAU,QAAO;AACzD,YAAM,iBAAkB,OAAwC;AAChE,UAAI,kBAAkB,QAAQ,OAAO,mBAAmB,SAAU,QAAO;AACzE,YAAM,EAAE,aAAa,cAAc,GAAG,iCAAiC,IAAI;AAI3E,YAAM,WAAW,EAAE,GAAI,OAAmC;AAC1D,UAAI,OAAO,KAAK,gCAAgC,EAAE,SAAS,GAAG;AAC5D,iBAAS,iBAAiB;AAAA,MAC5B,OAAO;AACL,eAAO,SAAS;AAAA,MAClB;AACA,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,SAAS,wBAA0C,KAAQ,KAAgD;AACzG,QAAM,SAAU,IAAgC,GAAG;AACnD,MAAI,UAAU,QAAQ,OAAO,WAAW,SAAU,QAAO;AACzD,MAAI,EAAE,UAAU,QAAS,QAAO;AAChC,QAAM,EAAE,MAAM,OAAO,GAAG,kBAAkB,IAAI;AAC9C,QAAM,WAAW,EAAE,GAAG,IAAI;AAC1B,MAAI,OAAO,KAAK,iBAAiB,EAAE,SAAS,GAAG;AAC7C,aAAS,GAAG,IAAI;AAAA,EAClB,OAAO;AACL,WAAO,SAAS,GAAG;AAAA,EACrB;AACA,SAAO;AACT;AAEA,SAAS,4BAA8C,SAAe;AACpE,SAAO,wBAAwB,+BAA+B,OAAO,GAAG,gBAAgB;AAC1F;AAEA,SAAS,6BAA+D,MAAY;AAClF,MAAI,CAAC,MAAM,QAAQ,KAAK,QAAQ,EAAG,QAAO;AAC1C,SAAO;AAAA,IACL,GAAG;AAAA,IACH,UAAU,KAAK,SAAS;AAAA,MAAI,aAC1B,WAAW,QAAQ,OAAO,YAAY,WAAW,4BAA4B,OAAO,IAAI;AAAA,IAC1F;AAAA,EACF;AACF;AAEA,SAAS,6BAA+C,KAAW;AACjE,MAAI,WAAW,wBAAwB,KAAK,mBAAmB;AAC/D,QAAM,UAAW,SAAmC;AACpD,MAAI,WAAW,QAAQ,OAAO,YAAY,SAAU,QAAO;AAC3D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,4BAA4B,OAAO;AAAA,EAC9C;AACF;AAEA,SAAS,8BAAkE,MAAY;AACrF,MAAI,CAAC,MAAM,QAAQ,KAAK,UAAU,EAAG,QAAO;AAC5C,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,KAAK,WAAW;AAAA,MAAI,SAC9B,OAAO,QAAQ,OAAO,QAAQ,WAAW,6BAA6B,GAAG,IAAI;AAAA,IAC/E;AAAA,EACF;AACF;AAOA,SAAS,sBAAsB,MAAe,SAAuB;AACnE,MAAI,QAAQ,QAAQ,OAAO,SAAS,YAAY,WAAW,MAAM;AAC/D,UAAM,IAAI;AAAA,MACR,GAAG,OAAO;AAAA,IAGZ;AAAA,EACF;AACF;AAiBO,SAAS,qBACd,MACA,SACiB;AACjB,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,+BAA+B,CAAC;AAAA,IAC3E,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAMO,SAAS,iBACd,MACA,SACiB;AACjB,QAAM,aAAa,2BAA2B,IAAI;AAClD,QAAM,iBACJ,KAAK,cAAc,OAAO,2BAA2B,UAAU,KAAK,YAAY,CAAC,GAAG,MAAM;AAC5F,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,eAAe,CAAC;AAAA,IAC3D,mBAAmB;AAAA,EACrB;AACF;AAYO,SAAS,iBAAiB,MAA4C,SAAmC;AAC9G,wBAAsB,MAAM,kBAAkB;AAC9C,QAAM,eAAe,EAAE,GAAG,6BAA6B,IAAI,EAAE;AAC7D,MAAI,aAAa,aAAa,QAAW;AACvC,iBAAa,WAAW;AAAA,EAC1B;AACA,MAAI,aAAa,iBAAiB,QAAW;AAC3C,iBAAa,gBAAe,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrD;AACA,MAAI,aAAa,kBAAkB,UAAa,aAAa,UAAU,MAAM;AAC3E,iBAAa,gBAAgB,sBAAsB,aAAa,MAAM;AAAA,EACxE;AACA,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,aAAa,aAAa,YAAY,WAAW,CAAC;AAAA,IAC7F,mBAAmB,2BAA2B,cAAc,EAAE,qBAAqB,KAAK,CAAC;AAAA,EAC3F;AACF;AAMO,SAAS,iBAAiB,MAAkD,SAAmC;AACpH,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MACE,WACA,qBAAqB,KAAK,qBAAqB,MAAM,aAAa,KAAK,qBAAqB,WAAW,IAAI,KAAK,GAAG;AAAA,MACvH;AAAA,IACF;AAAA,IACA,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAMO,SAAS,qBAAqB,MAA2C,SAAmC;AACjH,QAAM,WAAW,6BAA6B,IAAI;AAClD,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,SAAS,SAAS,SAAS,MAAM,YAAY,CAAC;AAAA,IACzF,mBAAmB,2BAA2B,QAAQ;AAAA,EACxD;AACF;AAMO,SAAS,4BACd,MACA,SACiB;AACjB,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,SAAS,KAAK,QAAQ,MAAM,oBAAoB,CAAC;AAAA,IAC5F,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AASO,SAAS,uBAAuB,MAA4C,SAAmC;AACpH,wBAAsB,MAAM,wBAAwB;AACpD,QAAM,eAAe,EAAE,GAAG,wBAAwB,MAAM,mBAAmB,EAAE;AAC7E,MAAI,aAAa,kBAAkB,UAAa,aAAa,UAAU,MAAM;AAC3E,iBAAa,gBAAgB,sBAAsB,aAAa,MAAM;AAAA,EACxE;AACA,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,aAAa,aAAa,YAAY,WAAW,CAAC;AAAA,IAC7F,mBAAmB,2BAA2B,cAAc,EAAE,qBAAqB,KAAK,CAAC;AAAA,EAC3F;AACF;AAMO,SAAS,qBAAqB,MAA2C,SAAmC;AACjH,MAAI,MAAM,QAAQ,KAAK,UAAU,GAAG;AAClC,eAAW,OAAO,KAAK,YAAY;AACjC,4BAAsB,KAAK,sBAAsB;AAAA,IACnD;AAAA,EACF;AACA,QAAM,WAAW,8BAA8B,IAAI;AACnD,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MAAM,WAAW,SAAS,SAAS,WAAW,MAAM,aAAa,SAAS,WAAW,WAAW,IAAI,KAAK,GAAG;AAAA,MAC9G;AAAA,IACF;AAAA,IACA,mBAAmB,2BAA2B,QAAQ;AAAA,EACxD;AACF;AAMO,SAAS,4BACd,MACA,SACiB;AACjB,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,gCAAgC,CAAC;AAAA,IAC5E,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAMO,SAAS,sBAAsB,MAA2C,SAAmC;AAKlH,QAAM,WAAW,KAAK,mBAAmB,WAAW;AACpD,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,YAAY,WAAW,mBAAmB,QAAQ,KAAK,kBAAkB,CAAC;AAAA,IAC1G,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAMO,SAAS,2BACd,MACA,SACiB;AACjB,QAAM,QAAQ,KAAK,oBAAoB,UAAU;AACjD,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,SAAS,KAAK,oBAAoB,CAAC;AAAA,IAC9E,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAMO,SAAS,wBACd,MACA,SACiB;AACjB,QAAM,iBACJ,KAAK,kBAAkB,YAClB,MAAM;AACL,UAAM,IAAK,KAAuC,SAAS;AAC3D,WAAO,sBAAsB,CAAC,WAAW,MAAM,IAAI,KAAK,GAAG;AAAA,EAC7D,GAAG,IACH,KAAK,kBAAkB,WACpB,MAAM;AACL,UAAM,IAAK,KAAsC,QAAQ;AACzD,WAAO,kBAAkB,CAAC,UAAU,MAAM,IAAI,KAAK,GAAG;AAAA,EACxD,GAAG,IACH;AACR,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,eAAe,CAAC;AAAA,IAC3D,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAMO,SAAS,yBACd,MACA,SACiB;AACjB,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,8BAA8B,KAAK,QAAQ,UAAU,CAAC;AAAA,IACjG,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAMO,SAAS,sBAAsB,MAA4C,SAAmC;AACnH,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MACE,WAAW,SAAS,KAAK,cAAc,cAAc,eAAe,KAAK,cAAc,QAAQ;AAAA,MACnG;AAAA,IACF;AAAA,IACA,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AASO,SAAS,0BACd,MACA,SACiB;AACjB,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MAAM,WAAW,SAAS,KAAK,MAAM,MAAM,iBAAiB,KAAK,MAAM,WAAW,IAAI,KAAK,GAAG;AAAA,MAChG;AAAA,IACF;AAAA,IACA,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAQO,SAAS,4BACd,MACA,SACiB;AACjB,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MAAM,WAAW,SAAS,KAAK,MAAM,MAAM,mBAAmB,KAAK,MAAM,WAAW,IAAI,KAAK,GAAG;AAAA,MAClG;AAAA,IACF;AAAA,IACA,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAeO,SAAS,6BACd,MACA,SACiB;AACjB,QAAM,iBACJ,eAAe,OACX,SAAS,KAAK,UAAU,MAAM,oBAAoB,KAAK,UAAU,WAAW,IAAI,KAAK,GAAG,KACxF;AACN,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,eAAe,CAAC;AAAA,IAC3D,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAQO,SAAS,yBACd,MACA,SACiB;AACjB,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MAAM,WAAW,kBAAkB,KAAK,MAAM,MAAM,QAAQ,KAAK,MAAM,WAAW,IAAI,KAAK,GAAG;AAAA,MAChG;AAAA,IACF;AAAA,IACA,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAIA,SAAS,4BAA4B,MAA+E;AAClH,SACE,MAAM,QAAS,KAA8B,MAAM,KAAK,CAAC,MAAM,QAAS,KAAiC,SAAS;AAEtH;AASO,SAAS,sBAAsB,MAAoC,SAAmC;AAC3G,MAAI,4BAA4B,IAAI,GAAG;AACrC,UAAM,aAAa,KAAK,OAAO,CAAC;AAChC,UAAM,iBAAiB,aAAa,GAAG,WAAW,IAAI,KAAK,WAAW,OAAO,KAAK;AAClF,WAAO;AAAA,MACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,eAAe,CAAC;AAAA,MAC3D,SAAS;AAAA,MACT,mBAAmB,wBAAwB,IAAI;AAAA,IACjD;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MAAM,WAAW,UAAU,KAAK,UAAU,MAAM,YAAY,KAAK,UAAU,WAAW,IAAI,KAAK,GAAG;AAAA,MACpG;AAAA,IACF;AAAA,IACA,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAMO,SAAS,mBAAmB,MAAyC,SAAmC;AAC7G,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MAAM,WAAW,UAAU,KAAK,WAAW,CAAC,GAAG,MAAM,WAAW,KAAK,WAAW,CAAC,GAAG,WAAW,IAAI,KAAK,GAAG;AAAA,MAC7G;AAAA,IACF;AAAA,IACA,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAMO,SAAS,uBAAuB,MAA4C,SAAmC;AACpH,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MACE,WACA,2BAA2B,KAAK,YAAY,MAAM,cAAc,KAAK,YAAY,WAAW,IAAI,KAAK,GAAG;AAAA,MAC5G;AAAA,IACF;AAAA,IACA,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAgCO,SAAS,uBAAuB,OAA4B,SAAmC;AACpG,QAAM,eAAwC;AAAA,IAC5C,aAAa,MAAM,gBAAe,oBAAI,KAAK,GAAE,YAAY;AAAA,IACzD,aAAa,MAAM;AAAA,EACrB;AACA,MAAI,MAAM,WAAW,QAAW;AAC9B,iBAAa,SAAS,MAAM;AAAA,EAC9B;AAEA,QAAM,OAAgC;AAAA,IACpC,cAAc,MAAM;AAAA,IACpB,QAAQ;AAAA,IACR,eAAe,CAAC;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB;AAAA,EACF;AACA,MAAI,MAAM,sBAAsB,QAAW;AACzC,SAAK,oBAAoB,MAAM;AAAA,EACjC;AACA,MAAI,MAAM,YAAY,QAAW;AAC/B,SAAK,UAAU,MAAM;AAAA,EACvB;AAEA,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,aAAa,MAAM,YAAY,YAAY,CAAC;AAAA,IACvF,mBAAmB,2BAA2B,MAAM,EAAE,qBAAqB,KAAK,CAAC;AAAA,EACnF;AACF;AAcO,SAAS,sBAAsB,MAA4C,SAAmC;AACnH,QAAM,YAAY;AAClB,QAAM,iBACJ,YAAY,OACR,6BACA,UAAU,kBAAkB,aAC1B,UAAU,UAAU,SAAS,cAC7B,UAAU,kBAAkB,aAC1B,UAAU,UAAU,SAAS,cAC7B,UAAU,UAAU,SAAS;AACvC,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,eAAe,CAAC;AAAA,IAC3D,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AASO,SAAS,sBACd,MACA,SACiB;AACjB,SAAO,sBAAsB,EAAE,GAAG,MAAM,eAAe,WAAW,GAAuC,OAAO;AAClH;AAIO,SAAS,6BACd,MACA,SACiB;AACjB,SAAO;AAAA,IACL,EAAE,GAAG,MAAM,eAAe,mBAAmB;AAAA,IAC7C;AAAA,EACF;AACF;AAIO,SAAS,sBACd,MACA,SACiB;AACjB,SAAO,sBAAsB,EAAE,GAAG,MAAM,eAAe,WAAW,GAAuC,OAAO;AAClH;AAaO,SAAS,qBAAqB,MAA2C,SAAmC;AACjH,QAAM,iBACJ,YAAY,OACR,wBACA,KAAK,uBAAuB,OAC1B,UAAU,KAAK,SAAS,6BACxB,UAAU,KAAK,SAAS;AAChC,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,eAAe,CAAC;AAAA,IAC3D,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAWO,SAAS,oBAAoB,MAA0C,SAAmC;AAC/G,SAAO,qBAAqB,MAAyC,OAAO;AAC9E;AAmBO,SAAS,yBAAyB,MAA0D;AACjG,SAAO;AACT;AAGO,SAAS,yBAAyB,MAA0D;AACjG,SAAO,EAAE,GAAG,MAAM,QAAQ,WAAW;AACvC;AAGO,SAAS,yBAAyB,MAA0D;AACjG,SAAO,EAAE,GAAG,MAAM,QAAQ,WAAW;AACvC;AAGO,SAAS,8BAA8B,MAAoE;AAChH,SAAO,EAAE,GAAG,MAAM,QAAQ,iBAAiB;AAC7C;AAGO,SAAS,sBAAsB,MAAoD;AACxF,SAAO;AACT;AAOO,SAAS,qBAAqB,MAA2C,SAAmC;AACjH,QAAM,WAAW,cAAc,OAAO,6BAA6B,IAAI,IAAI;AAC3E,QAAM,iBACJ,YAAY,WACR,uBACA,UAAU,SAAS,UAAU,UAAU,CAAC,WAAW,SAAS,UAAU,WAAW,IAAI,KAAK,GAAG;AACnG,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,eAAe,CAAC;AAAA,IAC3D,mBAAmB,2BAA2B,QAAQ;AAAA,EACxD;AACF;AAkBO,SAAS,uBAAuB,MAA6C,SAAmC;AACrH,QAAM,WAAW,4BAA4B,IAAI;AACjD,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,iCAAiC,CAAC;AAAA,IAC7E,mBAAmB,2BAA2B,QAAQ;AAAA,EACxD;AACF;AAEA,SAAS,4BACP,MACuC;AACvC,MAAI,EAAE,cAAc,SAAS,CAAC,MAAM,QAAQ,KAAK,QAAQ,EAAG,QAAO;AACnE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,UAAU,KAAK,SAAS,IAAI,SAAO;AACjC,UAAI,CAAC,IAAI,kBAAmB,QAAO;AACnC,aAAO;AAAA,QACL,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA,QAKH,mBAAmB,IAAI,kBAAkB,IAAI,QAAM,EAAE,KAAK,EAAE,IAAI,EAAE;AAAA,MACpE;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAmBO,SAAS,oBAAoB,MAA0C,SAAmC;AAC/G,SAAO;AAAA,IACL,SAAS;AAAA,MACP,EAAE,MAAM,QAAQ,MAAM,WAAW,YAAY,KAAK,QAAQ,gBAAgB,KAAK,aAAa,IAAI,KAAK,GAAG,GAAG;AAAA,IAC7G;AAAA,IACA,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAUA,oBAAoB,YAAY,SAAS,UACvC,SACA,MACiB;AACjB,QAAM,QAAQ,QAAQ,OAAO,UAAU;AACvC,QAAM,SAAS,MAAM,UAAU,CAAC;AAChC,QAAM,WAAW,KAAK,IAAI,GAAG,QAAQ,OAAO,MAAM;AAClD,SAAO;AAAA,IACL;AAAA,MACE,QAAQ,OAAO,SAAS,IAAI,WAAW;AAAA,MACvC;AAAA,MACA,GAAI,OAAO,SAAS,IAAI,EAAE,OAAO,IAAI,CAAC;AAAA,IACxC;AAAA,IACA,MAAM;AAAA,EACR;AACF;","names":[]}
+{"version":3,"sources":["../../../src/lib/server/responses.ts"],"sourcesContent":["/**\n * Typed response builders for AdCP MCP servers.\n *\n * @deprecated For new code, use `createAdcpServerFromPlatform` from\n * `@adcp/sdk/server` instead — it constructs wire responses internally\n * from your typed `DecisioningPlatform` return values, so adopters don't\n * touch these builders. The functions below remain exported for v5\n * adopters wiring raw MCP tool handlers (mid-migration), and for adopters\n * shaping bespoke tools the platform interface doesn't yet model. For new\n * v6 adopters, ignore this whole module — the framework handles wire\n * shaping.\n *\n * Each function takes typed data (compile-time checked against AdCP schemas)\n * and returns an MCP-compatible tool response with `content` (text summary)\n * + `structuredContent` (typed payload).\n *\n * The input parameter enforces the AdCP schema shape at compile time.\n * The return type is compatible with MCP SDK's CallToolResult.\n *\n * @example\n * ```typescript\n * import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\n * import { capabilitiesResponse, productsResponse, adcpError } from '@adcp/sdk/server';\n * import { GetProductsRequestSchema } from '@adcp/sdk/schemas';\n *\n * const server = new McpServer({ name: 'My Agent', version: '1.0.0' });\n *\n * server.registerTool(\n *   'get_adcp_capabilities',\n *   { inputSchema: {} },\n *   async () => capabilitiesResponse({ supported_protocols: ['media_buy'] })\n * );\n *\n * server.registerTool(\n *   'get_products',\n *   { inputSchema: GetProductsRequestSchema.shape },\n *   async (params) => productsResponse({ products: myProducts, cache_scope: 'account' })\n * );\n * ```\n */\n\nimport type { GetAdCPCapabilitiesResponse } from '../types/tools.generated';\nimport type { GetProductsResponse } from '../types/core.generated';\nimport type { CreateMediaBuySuccess } from '../types/core.generated';\nimport type { GetMediaBuyDeliveryResponse } from '../types/tools.generated';\nimport type { RequireCacheScopeWhenProducts, ServerPayload } from '../types/server-payload';\nimport { validActionsForStatus } from './media-buy-helpers';\nimport type { CancelMediaBuyInput } from './media-buy-helpers';\nimport type {\n  ListCreativeFormatsResponse,\n  UpdateMediaBuySuccess,\n  GetMediaBuysResponse,\n  ProvidePerformanceFeedbackSuccess,\n  BuildCreativeSuccess,\n  BuildCreativeMultiSuccess,\n  PreviewCreativeSingleResponse,\n  PreviewCreativeBatchResponse,\n  PreviewCreativeVariantResponse,\n  GetCreativeDeliveryResponse,\n  ListCreativesResponse,\n  SyncCreativesError,\n  SyncCreativesSuccess,\n  GetSignalsResponse,\n  ActivateSignalSuccess,\n  ListAccountsResponse,\n  ListPropertyListsResponse,\n  ListCollectionListsResponse,\n  ListContentStandardsResponse,\n  GetPlanAuditLogsResponse,\n  ReportUsageRequest,\n  ReportUsageResponse,\n  SyncAccountsResponse,\n  SyncGovernanceResponse,\n} from '../types/tools.generated';\nimport type {\n  AcquireRightsResponse,\n  AcquireRightsAcquired,\n  AcquireRightsPendingApproval,\n  AcquireRightsRejected,\n  UpdateRightsResponse,\n  UpdateRightsSuccess,\n  CreativeApprovalResponse,\n  CreativeApproved,\n  CreativeRejected,\n  CreativePendingReview,\n  CreativeApprovalError,\n} from '../types/core.generated';\n\n/**\n * MCP-compatible tool response shape.\n *\n * `structuredContent` is optional because error responses legitimately carry\n * only `content` (the human-readable error text) — forcing every wrapper to\n * fabricate an empty structuredContent obscures the success/error split.\n * All success builders in this file still populate it.\n *\n * Uses Record<string, unknown> for structuredContent to satisfy\n * MCP SDK's CallToolResult index signature requirement.\n */\nexport interface McpToolResponse {\n  [key: string]: unknown;\n  content: Array<{ type: 'text'; text: string }>;\n  structuredContent?: Record<string, unknown>;\n}\n\n// MCP SDK requires structuredContent to have an index signature ({ [x: string]: unknown }).\n// Generated AdCP types are TypeScript interfaces without index signatures. At runtime,\n// JSON objects are always Records — this bridge is safe.\nexport function toStructuredContent(data: object): Record<string, unknown> {\n  return data as unknown as Record<string, unknown>;\n}\n\nconst MEDIA_BUY_STATUS_VALUES = new Set([\n  'pending_creatives',\n  'pending_start',\n  'active',\n  'paused',\n  'completed',\n  'rejected',\n  'canceled',\n]);\n\nfunction completedStructuredContent(data: object, opts?: { splitMediaBuyStatus?: boolean }): Record<string, unknown> {\n  const structured = { ...toStructuredContent(data) };\n  if (\n    opts?.splitMediaBuyStatus === true &&\n    typeof structured.status === 'string' &&\n    MEDIA_BUY_STATUS_VALUES.has(structured.status)\n  ) {\n    if (structured.media_buy_status === undefined) structured.media_buy_status = structured.status;\n    delete structured.status;\n  }\n  if (structured.status === undefined) structured.status = 'completed';\n  return structured;\n}\n\nfunction failedStructuredContent(data: object): Record<string, unknown> {\n  const structured = { ...toStructuredContent(data) };\n  if (structured.status === undefined) structured.status = 'failed';\n  return structured;\n}\n\nfunction stripNotificationConfigSecrets<T extends object>(row: T): T {\n  const notificationConfigs = (row as { notification_configs?: unknown }).notification_configs;\n  if (!Array.isArray(notificationConfigs)) return row;\n  return {\n    ...row,\n    notification_configs: notificationConfigs.map(config => {\n      if (config == null || typeof config !== 'object') return config;\n      const authentication = (config as { authentication?: unknown }).authentication;\n      if (authentication == null || typeof authentication !== 'object') return config;\n      const { credentials: _credentials, ...authenticationWithoutCredentials } = authentication as Record<\n        string,\n        unknown\n      >;\n      const stripped = { ...(config as Record<string, unknown>) };\n      if (Object.keys(authenticationWithoutCredentials).length > 0) {\n        stripped.authentication = authenticationWithoutCredentials;\n      } else {\n        delete stripped.authentication;\n      }\n      return stripped;\n    }),\n  };\n}\n\nfunction stripBusinessEntityBank<T extends object>(row: T, key: 'billing_entity' | 'invoice_recipient'): T {\n  const entity = (row as Record<string, unknown>)[key];\n  if (entity == null || typeof entity !== 'object') return row;\n  if (!('bank' in entity)) return row;\n  const { bank: _bank, ...entityWithoutBank } = entity as Record<string, unknown>;\n  const stripped = { ...row } as Record<string, unknown>;\n  if (Object.keys(entityWithoutBank).length > 0) {\n    stripped[key] = entityWithoutBank;\n  } else {\n    delete stripped[key];\n  }\n  return stripped as T;\n}\n\nfunction stripAccountWriteOnlyFields<T extends object>(account: T): T {\n  return stripBusinessEntityBank(stripNotificationConfigSecrets(account), 'billing_entity');\n}\n\nfunction stripAccountsWriteOnlyFields<T extends { accounts?: unknown }>(data: T): T {\n  if (!Array.isArray(data.accounts)) return data;\n  return {\n    ...data,\n    accounts: data.accounts.map(account =>\n      account != null && typeof account === 'object' ? stripAccountWriteOnlyFields(account) : account\n    ),\n  };\n}\n\nfunction stripMediaBuyWriteOnlyFields<T extends object>(buy: T): T {\n  let stripped = stripBusinessEntityBank(buy, 'invoice_recipient');\n  const account = (stripped as { account?: unknown }).account;\n  if (account == null || typeof account !== 'object') return stripped;\n  return {\n    ...stripped,\n    account: stripAccountWriteOnlyFields(account),\n  };\n}\n\nfunction stripMediaBuysWriteOnlyFields<T extends { media_buys?: unknown }>(data: T): T {\n  if (!Array.isArray(data.media_buys)) return data;\n  return {\n    ...data,\n    media_buys: data.media_buys.map(buy =>\n      buy != null && typeof buy === 'object' ? stripMediaBuyWriteOnlyFields(buy) : buy\n    ),\n  };\n}\n\n// `setup` is only ever nested inside an `Account` (the IO-signing / pending_approval\n// path). A top-level `setup` on a media buy response means the builder read the\n// storyboard's \"setup.url\" shorthand as a top-level field. The strict handler types\n// would catch this, but `DomainHandler` accepts `Record<string, unknown>` for DX,\n// so the error has to move to runtime.\nfunction assertNoTopLevelSetup(data: unknown, builder: string): void {\n  if (data != null && typeof data === 'object' && 'setup' in data) {\n    throw new Error(\n      `${builder}: \\`setup\\` is not a field on the media buy — it belongs inside \\`account.setup\\`. ` +\n        `Move \\`{ setup: { url, message } }\\` to \\`{ account: { ..., setup: { url, message } } }\\`. ` +\n        `The setup URL is a property of the Account (returned alongside \\`status: 'pending_approval'\\`), not the MediaBuy.`\n    );\n  }\n}\n\n/**\n * Build a get_adcp_capabilities response.\n *\n * `supported_protocols` lists AdCP domain protocols (media_buy, signals, governance, etc.),\n * NOT transport protocols (mcp, a2a).\n *\n * Stamps the v3 protocol envelope's required `status: \"completed\"` field at\n * the top level of `structuredContent`. Synchronous task responses MUST carry\n * `status` per `protocol-envelope.json` (AdCP #4876); without it the\n * `v3_envelope_integrity/no_legacy_status_fields` conformance step fails.\n * The status is injected here rather than added to `GetAdCPCapabilitiesResponse`\n * because it's an envelope concern, not a payload field — the wire shape and\n * the typed payload model live at different layers.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function capabilitiesResponse(\n  data: ServerPayload<GetAdCPCapabilitiesResponse>,\n  summary?: string\n): McpToolResponse {\n  return {\n    content: [{ type: 'text', text: summary ?? 'Agent capabilities retrieved' }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a get_products response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function productsResponse(\n  data: RequireCacheScopeWhenProducts<ServerPayload<GetProductsResponse>>,\n  summary?: string\n): McpToolResponse {\n  const structured = completedStructuredContent(data);\n  const defaultSummary =\n    data.unchanged === true ? 'Product feed unchanged' : `Found ${(data.products ?? []).length} products`;\n  return {\n    content: [{ type: 'text', text: summary ?? defaultSummary }],\n    structuredContent: structured,\n  };\n}\n\n/**\n * Build a successful create_media_buy response.\n *\n * Applies protocol defaults when not explicitly provided:\n * - `revision` defaults to `1` (initial revision for optimistic concurrency)\n * - `confirmed_at` defaults to the current ISO 8601 timestamp\n * - `valid_actions` populated from status via `validActionsForStatus()` when\n *   `status` is provided but `valid_actions` is not\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function mediaBuyResponse(data: ServerPayload<CreateMediaBuySuccess>, summary?: string): McpToolResponse {\n  assertNoTopLevelSetup(data, 'mediaBuyResponse');\n  const withDefaults = { ...stripMediaBuyWriteOnlyFields(data) };\n  if (withDefaults.revision === undefined) {\n    withDefaults.revision = 1;\n  }\n  if (withDefaults.confirmed_at === undefined) {\n    withDefaults.confirmed_at = new Date().toISOString();\n  }\n  if (withDefaults.valid_actions === undefined && withDefaults.status != null) {\n    withDefaults.valid_actions = validActionsForStatus(withDefaults.status);\n  }\n  return {\n    content: [{ type: 'text', text: summary ?? `Media buy ${withDefaults.media_buy_id} created` }],\n    structuredContent: completedStructuredContent(withDefaults, { splitMediaBuyStatus: true }),\n  };\n}\n\n/**\n * Build a get_media_buy_delivery response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function deliveryResponse(data: ServerPayload<GetMediaBuyDeliveryResponse>, summary?: string): McpToolResponse {\n  return {\n    content: [\n      {\n        type: 'text',\n        text:\n          summary ??\n          `Delivery data for ${data.media_buy_deliveries.length} media buy${data.media_buy_deliveries.length === 1 ? '' : 's'}`,\n      },\n    ],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a list_accounts response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function listAccountsResponse(data: ServerPayload<ListAccountsResponse>, summary?: string): McpToolResponse {\n  const stripped = stripAccountsWriteOnlyFields(data);\n  return {\n    content: [{ type: 'text', text: summary ?? `Found ${stripped.accounts.length} accounts` }],\n    structuredContent: completedStructuredContent(stripped),\n  };\n}\n\n/**\n * Build a list_creative_formats response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function listCreativeFormatsResponse(\n  data: ServerPayload<ListCreativeFormatsResponse>,\n  summary?: string\n): McpToolResponse {\n  return {\n    content: [{ type: 'text', text: summary ?? `Found ${data.formats.length} creative formats` }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a successful update_media_buy response.\n *\n * When `status` is provided but `valid_actions` is not, auto-populates\n * `valid_actions` from `validActionsForStatus()`.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function updateMediaBuyResponse(data: ServerPayload<UpdateMediaBuySuccess>, summary?: string): McpToolResponse {\n  assertNoTopLevelSetup(data, 'updateMediaBuyResponse');\n  const withDefaults = { ...stripBusinessEntityBank(data, 'invoice_recipient') };\n  if (withDefaults.valid_actions === undefined && withDefaults.status != null) {\n    withDefaults.valid_actions = validActionsForStatus(withDefaults.status);\n  }\n  return {\n    content: [{ type: 'text', text: summary ?? `Media buy ${withDefaults.media_buy_id} updated` }],\n    structuredContent: completedStructuredContent(withDefaults, { splitMediaBuyStatus: true }),\n  };\n}\n\n/**\n * Build a get_media_buys response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function getMediaBuysResponse(data: ServerPayload<GetMediaBuysResponse>, summary?: string): McpToolResponse {\n  if (Array.isArray(data.media_buys)) {\n    for (const buy of data.media_buys) {\n      assertNoTopLevelSetup(buy, 'getMediaBuysResponse');\n    }\n  }\n  const stripped = stripMediaBuysWriteOnlyFields(data);\n  return {\n    content: [\n      {\n        type: 'text',\n        text: summary ?? `Found ${stripped.media_buys.length} media buy${stripped.media_buys.length === 1 ? '' : 's'}`,\n      },\n    ],\n    structuredContent: completedStructuredContent(stripped),\n  };\n}\n\n/**\n * Build a successful provide_performance_feedback response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function performanceFeedbackResponse(\n  data: ServerPayload<ProvidePerformanceFeedbackSuccess>,\n  summary?: string\n): McpToolResponse {\n  return {\n    content: [{ type: 'text', text: summary ?? 'Performance feedback accepted' }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a successful build_creative response (single format).\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function buildCreativeResponse(data: ServerPayload<BuildCreativeSuccess>, summary?: string): McpToolResponse {\n  // Optional-chain the default summary — handler responses that drop\n  // `format_id` still reach the wire-level schema validator (which names\n  // the missing field), instead of crashing the dispatcher here with an\n  // opaque `Cannot read properties of undefined (reading 'id')`.\n  const formatId = data.creative_manifest?.format_id?.id;\n  return {\n    content: [{ type: 'text', text: summary ?? (formatId ? `Creative built: ${formatId}` : 'Creative built') }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a successful build_creative response (multi-format).\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function buildCreativeMultiResponse(\n  data: ServerPayload<BuildCreativeMultiSuccess>,\n  summary?: string\n): McpToolResponse {\n  const count = data.creative_manifests?.length ?? 0;\n  return {\n    content: [{ type: 'text', text: summary ?? `Built ${count} creative formats` }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a preview_creative response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function previewCreativeResponse(\n  data: PreviewCreativeSingleResponse | PreviewCreativeBatchResponse | PreviewCreativeVariantResponse,\n  summary?: string\n): McpToolResponse {\n  const defaultSummary =\n    data.response_type === 'single'\n      ? (() => {\n          const n = (data as PreviewCreativeSingleResponse).previews.length;\n          return `Preview generated: ${n} variant${n === 1 ? '' : 's'}`;\n        })()\n      : data.response_type === 'batch'\n        ? (() => {\n            const n = (data as PreviewCreativeBatchResponse).results.length;\n            return `Batch preview: ${n} result${n === 1 ? '' : 's'}`;\n          })()\n        : `Variant preview generated`;\n  return {\n    content: [{ type: 'text', text: summary ?? defaultSummary }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a get_creative_delivery response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function creativeDeliveryResponse(\n  data: ServerPayload<GetCreativeDeliveryResponse>,\n  summary?: string\n): McpToolResponse {\n  return {\n    content: [{ type: 'text', text: summary ?? `Creative delivery data for ${data.currency} report` }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a list_creatives response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function listCreativesResponse(data: ServerPayload<ListCreativesResponse>, summary?: string): McpToolResponse {\n  return {\n    content: [\n      {\n        type: 'text',\n        text:\n          summary ?? `Found ${data.query_summary.total_matching} creatives (${data.query_summary.returned} returned)`,\n      },\n    ],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a list_property_lists response. The governance property-list catalog\n * is returned under the required `lists` wrapper — use this helper so\n * handlers can't accidentally emit a bare array at the top level (which the\n * storyboard runner flags as shape drift).\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function listPropertyListsResponse(\n  data: ServerPayload<ListPropertyListsResponse>,\n  summary?: string\n): McpToolResponse {\n  return {\n    content: [\n      {\n        type: 'text',\n        text: summary ?? `Found ${data.lists.length} property list${data.lists.length === 1 ? '' : 's'}`,\n      },\n    ],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a list_collection_lists response. Companion to\n * `listPropertyListsResponse` — same `lists` wrapper shape; parallel\n * governance surface for program-level collections.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function listCollectionListsResponse(\n  data: ServerPayload<ListCollectionListsResponse>,\n  summary?: string\n): McpToolResponse {\n  return {\n    content: [\n      {\n        type: 'text',\n        text: summary ?? `Found ${data.lists.length} collection list${data.lists.length === 1 ? '' : 's'}`,\n      },\n    ],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a list_content_standards response. The response type is a union\n * (success branch with `standards` array, error branch with `errors`) —\n * the helper wraps either shape verbatim; schema-level invariants are\n * enforced at wire validation, not here.\n *\n * Discriminates on `'standards' in data` rather than `'errors' in data` so\n * a legitimate success response that happens to carry advisory `errors`\n * still gets a counted summary. The error-only text fires only when\n * `standards` is absent. Mirrors `acquireRightsResponse`'s success-first\n * discrimination pattern a few screens down.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function listContentStandardsResponse(\n  data: ServerPayload<ListContentStandardsResponse>,\n  summary?: string\n): McpToolResponse {\n  const defaultSummary =\n    'standards' in data\n      ? `Found ${data.standards.length} content standard${data.standards.length === 1 ? '' : 's'}`\n      : 'Content standards lookup error';\n  return {\n    content: [{ type: 'text', text: summary ?? defaultSummary }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a get_plan_audit_logs response. Wraps the audit data array under\n * the required `plans` key — handlers that return a bare array trip the\n * storyboard runner's shape-drift hint.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function getPlanAuditLogsResponse(\n  data: ServerPayload<GetPlanAuditLogsResponse>,\n  summary?: string\n): McpToolResponse {\n  return {\n    content: [\n      {\n        type: 'text',\n        text: summary ?? `Audit data for ${data.plans.length} plan${data.plans.length === 1 ? '' : 's'}`,\n      },\n    ],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\ntype SyncCreativesResponsePayload = ServerPayload<SyncCreativesSuccess> | ServerPayload<SyncCreativesError>;\n\nfunction isSyncCreativesErrorPayload(data: SyncCreativesResponsePayload): data is ServerPayload<SyncCreativesError> {\n  return (\n    Array.isArray((data as { errors?: unknown }).errors) && !Array.isArray((data as { creatives?: unknown }).creatives)\n  );\n}\n\n/**\n * Build a sync_creatives response. Accepts both row-level success payloads\n * and operation-level error payloads. If a payload includes `creatives`, the\n * builder treats it as success-shaped even when advisory row errors are also\n * present; operation-level errors are the errors-only arm.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function syncCreativesResponse(data: SyncCreativesResponsePayload, summary?: string): McpToolResponse {\n  if (isSyncCreativesErrorPayload(data)) {\n    const firstError = data.errors[0];\n    const defaultSummary = firstError ? `${firstError.code}: ${firstError.message}` : 'Sync creatives failed';\n    return {\n      content: [{ type: 'text', text: summary ?? defaultSummary }],\n      isError: true,\n      structuredContent: failedStructuredContent(data),\n    };\n  }\n\n  return {\n    content: [\n      {\n        type: 'text',\n        text: summary ?? `Synced ${data.creatives.length} creative${data.creatives.length === 1 ? '' : 's'}`,\n      },\n    ],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a get_signals response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function getSignalsResponse(data: ServerPayload<GetSignalsResponse>, summary?: string): McpToolResponse {\n  return {\n    content: [\n      {\n        type: 'text',\n        text: summary ?? `Found ${(data.signals ?? []).length} signal${(data.signals ?? []).length === 1 ? '' : 's'}`,\n      },\n    ],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a successful activate_signal response.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function activateSignalResponse(data: ServerPayload<ActivateSignalSuccess>, summary?: string): McpToolResponse {\n  return {\n    content: [\n      {\n        type: 'text',\n        text:\n          summary ??\n          `Signal activated across ${data.deployments.length} deployment${data.deployments.length === 1 ? '' : 's'}`,\n      },\n    ],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Build a cancel response for update_media_buy with action: 'cancel'.\n *\n * Eliminates the cancellation metadata trap by requiring `canceled_by`\n * and auto-setting `canceled_at`, `status: 'canceled'`, and `valid_actions: []`.\n *\n * Note: `cancellation` is not yet on the `UpdateMediaBuySuccess` generated type\n * (it exists on the full `MediaBuy` entity). This builder constructs the response\n * as a plain object to include it. When the upstream schema adds `cancellation`\n * to the update response, this can be tightened.\n *\n * @example\n * ```typescript\n * server.registerTool(\n *   'update_media_buy',\n *   { inputSchema: UpdateMediaBuyRequestSchema.shape },\n *   async (params) => {\n *     if (params.action === 'cancel') {\n *       return cancelMediaBuyResponse({\n *         media_buy_id: params.media_buy_id,\n *         canceled_by: 'buyer',\n *         revision: currentRevision + 1,\n *       });\n *     }\n *     // ... handle other actions\n *   }\n * );\n * ```\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function cancelMediaBuyResponse(input: CancelMediaBuyInput, summary?: string): McpToolResponse {\n  const cancellation: Record<string, unknown> = {\n    canceled_at: input.canceled_at ?? new Date().toISOString(),\n    canceled_by: input.canceled_by,\n  };\n  if (input.reason !== undefined) {\n    cancellation.reason = input.reason;\n  }\n\n  const data: Record<string, unknown> = {\n    media_buy_id: input.media_buy_id,\n    status: 'canceled',\n    valid_actions: [],\n    revision: input.revision,\n    cancellation,\n  };\n  if (input.affected_packages !== undefined) {\n    data.affected_packages = input.affected_packages;\n  }\n  if (input.sandbox !== undefined) {\n    data.sandbox = input.sandbox;\n  }\n\n  return {\n    content: [{ type: 'text', text: summary ?? `Media buy ${input.media_buy_id} canceled` }],\n    structuredContent: completedStructuredContent(data, { splitMediaBuyStatus: true }),\n  };\n}\n\n/**\n * Build an `acquire_rights` response. Thin envelope wrapper — enforces the\n * discriminated union on `status` at the type level, wraps the domain object\n * in `content` + `structuredContent`, nothing else. Schema-level constraints\n * (credential length, schemes cardinality, required-field presence) belong\n * in wire-level Zod validation, not here.\n *\n * Enable dev-time enforcement via\n * `createAdcpServer({ validation: { responses: 'strict' } })` until it\n * becomes the default.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function acquireRightsResponse(data: ServerPayload<AcquireRightsResponse>, summary?: string): McpToolResponse {\n  const dataAsAny = data as AcquireRightsResponse & { rights_status?: string; rights_id?: string };\n  const defaultSummary =\n    'errors' in data\n      ? 'Rights acquisition error'\n      : dataAsAny.rights_status === 'acquired'\n        ? `Rights ${dataAsAny.rights_id} acquired`\n        : dataAsAny.rights_status === 'rejected'\n          ? `Rights ${dataAsAny.rights_id} rejected`\n          : `Rights ${dataAsAny.rights_id} pending approval`;\n  return {\n    content: [{ type: 'text', text: summary ?? defaultSummary }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Per-variant constructor — builds an `AcquireRightsAcquired` success response\n * and wraps it. Cleaner autocomplete than `acquireRightsResponse({ rights_status: 'acquired', ... })`\n * because a coding agent typing `acquireRightsAcqu…` gets the required-fields\n * shape directly without reading a 4-variant union.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function acquireRightsAcquired(\n  data: Omit<AcquireRightsAcquired, 'rights_status'>,\n  summary?: string\n): McpToolResponse {\n  return acquireRightsResponse({ ...data, rights_status: 'acquired' } as unknown as AcquireRightsResponse, summary);\n}\n\n/** Per-variant constructor for the `pending_approval` branch. */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function acquireRightsPendingApproval(\n  data: Omit<AcquireRightsPendingApproval, 'rights_status'>,\n  summary?: string\n): McpToolResponse {\n  return acquireRightsResponse(\n    { ...data, rights_status: 'pending_approval' } as unknown as AcquireRightsResponse,\n    summary\n  );\n}\n\n/** Per-variant constructor for the `rejected` branch. */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function acquireRightsRejected(\n  data: Omit<AcquireRightsRejected, 'rights_status'>,\n  summary?: string\n): McpToolResponse {\n  return acquireRightsResponse({ ...data, rights_status: 'rejected' } as unknown as AcquireRightsResponse, summary);\n}\n\n/**\n * Build an `update_rights` response. Wraps a `UpdateRightsResponse` (success\n * or error arm — discriminated structurally on `errors` presence) in the\n * standard `content` + `structuredContent` envelope. The framework auto-\n * applies this wrapper for v6 typed-platform handlers; direct callers are\n * v5 raw-handler adopters only.\n *\n * Mirrors `acquireRightsResponse`'s shape conventions (success-first\n * default summary, error pass-through).\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function updateRightsResponse(data: ServerPayload<UpdateRightsResponse>, summary?: string): McpToolResponse {\n  const defaultSummary =\n    'errors' in data\n      ? 'Rights update error'\n      : data.implementation_date == null\n        ? `Rights ${data.rights_id} update pending approval`\n        : `Rights ${data.rights_id} updated`;\n  return {\n    content: [{ type: 'text', text: summary ?? defaultSummary }],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Per-variant constructor for the success arm. The wire spec doesn't\n * carry a `status` discriminator on `update_rights` (unlike\n * `acquire_rights`); success is identified structurally by absence of\n * `errors`. The narrow constructor is still useful — it gives autocomplete\n * the success-shape fields (`terms`, `generation_credentials`,\n * `rights_constraint`) without crossing the union.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function updateRightsSuccess(data: ServerPayload<UpdateRightsSuccess>, summary?: string): McpToolResponse {\n  return updateRightsResponse(data as unknown as UpdateRightsResponse, summary);\n}\n\n/**\n * Build a `creative_approval` webhook response.\n *\n * Unlike the other builders in this module, `creative_approval` is NOT an\n * MCP/A2A tool — the spec models it as an HTTP webhook. The buyer POSTs\n * a `CreativeApprovalRequest` to the `approval_webhook` URL returned in\n * `acquire_rights`; the brand-rights agent reviews and returns one of four\n * arms (Approved / Rejected / PendingReview / Error). Adopters wire this\n * builder into their HTTP server's response path — see the\n * `BrandRightsPlatform.reviewCreativeApproval` Platform method and the\n * skill at `skills/build-brand-rights-agent/SKILL.md` for the receiver\n * pattern.\n *\n * Returns the raw JSON-serializable payload, NOT an `McpToolResponse` —\n * webhooks have no `content` envelope. Adopters serialize this to JSON and\n * write to the HTTP response body.\n */\nexport function creativeApprovalResponse(data: CreativeApprovalResponse): CreativeApprovalResponse {\n  return data;\n}\n\n/** Per-variant constructor for the `approved` branch — webhook payload. */\nexport function creativeApprovalApproved(data: Omit<CreativeApproved, 'status'>): CreativeApproved {\n  return { ...data, status: 'approved' } as CreativeApproved;\n}\n\n/** Per-variant constructor for the `rejected` branch — webhook payload. */\nexport function creativeApprovalRejected(data: Omit<CreativeRejected, 'status'>): CreativeRejected {\n  return { ...data, status: 'rejected' } as CreativeRejected;\n}\n\n/** Per-variant constructor for the `pending_review` branch — webhook payload. */\nexport function creativeApprovalPendingReview(data: Omit<CreativePendingReview, 'status'>): CreativePendingReview {\n  return { ...data, status: 'pending_review' } as CreativePendingReview;\n}\n\n/** Per-variant constructor for the multi-error arm — webhook payload. */\nexport function creativeApprovalError(data: CreativeApprovalError): CreativeApprovalError {\n  return data;\n}\n\n/**\n * Build a `sync_accounts` response. Thin envelope wrapper accepting the full\n * `SyncAccountsResponse` union; error payloads pass through.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function syncAccountsResponse(data: ServerPayload<SyncAccountsResponse>, summary?: string): McpToolResponse {\n  const stripped = 'accounts' in data ? stripAccountsWriteOnlyFields(data) : data;\n  const defaultSummary =\n    'errors' in stripped\n      ? 'Account sync error'\n      : `Synced ${stripped.accounts?.length ?? 0} account${stripped.accounts?.length === 1 ? '' : 's'}`;\n  return {\n    content: [{ type: 'text', text: summary ?? defaultSummary }],\n    structuredContent: completedStructuredContent(stripped),\n  };\n}\n\n/**\n * Build a sync_governance response. The spec permits two top-level shapes\n * (success / error); the type union enforces discrimination on `status`.\n *\n * Strips `governance_agents[i].authentication` from every row before emit:\n * the spec marks `authentication.credentials` write-only (the buyer sends\n * the bearer; the seller persists it for outbound `check_governance` calls\n * but MUST NOT echo it back). The natural `{ ...entry.governance_agents[i] }`\n * echo idiom would compile silently against the typed return shape and ship\n * credentials over the wire AND into the idempotency replay cache, arming\n * the buyer (and any subsequent caller hitting the same key) to impersonate\n * the seller against the governance agent. Strip is enforced at the wire-\n * emit boundary so both v5 (`opts.accounts.syncGovernance`) and v6\n * (`AccountStore.syncGovernance`) paths are protected.\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function syncGovernanceResponse(data: ServerPayload<SyncGovernanceResponse>, summary?: string): McpToolResponse {\n  const stripped = stripGovernanceAgentSecrets(data);\n  return {\n    content: [{ type: 'text', text: summary ?? 'Governance registration synced' }],\n    structuredContent: completedStructuredContent(stripped),\n  };\n}\n\nfunction stripGovernanceAgentSecrets(\n  data: ServerPayload<SyncGovernanceResponse>\n): ServerPayload<SyncGovernanceResponse> {\n  if (!('accounts' in data) || !Array.isArray(data.accounts)) return data;\n  return {\n    ...data,\n    accounts: data.accounts.map(row => {\n      if (!row.governance_agents) return row;\n      return {\n        ...row,\n        // AdCP 3.1.0-beta.2 narrowed the wire shape to `{ url }` only;\n        // `categories` was removed (per-agent category signaling moved\n        // out of band) and `authentication` remains write-only. Project\n        // explicitly to defeat JS / `as any` smuggling of either field.\n        governance_agents: row.governance_agents.map(a => ({ url: a.url })),\n      };\n    }),\n  };\n}\n\n/**\n * Build a `report_usage` response. Thin envelope wrapper. Schema-level\n * `accepted` requiredness is enforced at the type level (via\n * `ReportUsageResponse.accepted: number`) and at wire-level validation;\n * this builder does not re-assert it.\n *\n * @example\n * ```typescript\n * // Explicit:\n * reportUsage: async (params) =>\n *   reportUsageResponse({ accepted: 8, errors: [{ usage_index: 2, message: 'invalid' }] })\n *\n * // Ack every usage[] row with optional errors (shortcut):\n * reportUsage: async (params) => reportUsageResponse.acceptAll(params)\n * ```\n */\n/** @deprecated v6: `createAdcpServerFromPlatform` constructs wire responses from typed platform returns. Direct use is for v5 raw-handler adopters mid-migration only. */\nexport function reportUsageResponse(data: ServerPayload<ReportUsageResponse>, summary?: string): McpToolResponse {\n  return {\n    content: [\n      { type: 'text', text: summary ?? `Accepted ${data.accepted} usage record${data.accepted === 1 ? '' : 's'}` },\n    ],\n    structuredContent: completedStructuredContent(data),\n  };\n}\n\n/**\n * Shortcut for the common case: accept all rows in the request, optionally\n * minus any `errors[]` the caller computed. Sets\n * `accepted = (request.usage?.length ?? 0) - errors.length`.\n *\n * Use with honest errors — passing no `errors` when rows failed validation\n * is lying to buyers and the audit trail.\n */\nreportUsageResponse.acceptAll = function acceptAll(\n  request: ReportUsageRequest,\n  opts?: { errors?: ReportUsageResponse['errors']; summary?: string }\n): McpToolResponse {\n  const total = request.usage?.length ?? 0;\n  const errors = opts?.errors ?? [];\n  const accepted = Math.max(0, total - errors.length);\n  return reportUsageResponse(\n    {\n      status: errors.length > 0 ? 'failed' : 'completed',\n      accepted,\n      ...(errors.length > 0 ? { errors } : {}),\n    } as ReportUsageResponse,\n    opts?.summary\n  );\n};\n"],"mappings":"AA8CA,SAAS,6BAA6B;AA8D/B,SAAS,oBAAoB,MAAuC;AACzE,SAAO;AACT;AAEA,MAAM,0BAA0B,oBAAI,IAAI;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,2BAA2B,MAAc,MAAmE;AACnH,QAAM,aAAa,EAAE,GAAG,oBAAoB,IAAI,EAAE;AAClD,MACE,MAAM,wBAAwB,QAC9B,OAAO,WAAW,WAAW,YAC7B,wBAAwB,IAAI,WAAW,MAAM,GAC7C;AACA,QAAI,WAAW,qBAAqB,OAAW,YAAW,mBAAmB,WAAW;AACxF,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,WAAW,WAAW,OAAW,YAAW,SAAS;AACzD,SAAO;AACT;AAEA,SAAS,wBAAwB,MAAuC;AACtE,QAAM,aAAa,EAAE,GAAG,oBAAoB,IAAI,EAAE;AAClD,MAAI,WAAW,WAAW,OAAW,YAAW,SAAS;AACzD,SAAO;AACT;AAEA,SAAS,+BAAiD,KAAW;AACnE,QAAM,sBAAuB,IAA2C;AACxE,MAAI,CAAC,MAAM,QAAQ,mBAAmB,EAAG,QAAO;AAChD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,sBAAsB,oBAAoB,IAAI,YAAU;AACtD,UAAI,UAAU,QAAQ,OAAO,WAAW,SAAU,QAAO;AACzD,YAAM,iBAAkB,OAAwC;AAChE,UAAI,kBAAkB,QAAQ,OAAO,mBAAmB,SAAU,QAAO;AACzE,YAAM,EAAE,aAAa,cAAc,GAAG,iCAAiC,IAAI;AAI3E,YAAM,WAAW,EAAE,GAAI,OAAmC;AAC1D,UAAI,OAAO,KAAK,gCAAgC,EAAE,SAAS,GAAG;AAC5D,iBAAS,iBAAiB;AAAA,MAC5B,OAAO;AACL,eAAO,SAAS;AAAA,MAClB;AACA,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,SAAS,wBAA0C,KAAQ,KAAgD;AACzG,QAAM,SAAU,IAAgC,GAAG;AACnD,MAAI,UAAU,QAAQ,OAAO,WAAW,SAAU,QAAO;AACzD,MAAI,EAAE,UAAU,QAAS,QAAO;AAChC,QAAM,EAAE,MAAM,OAAO,GAAG,kBAAkB,IAAI;AAC9C,QAAM,WAAW,EAAE,GAAG,IAAI;AAC1B,MAAI,OAAO,KAAK,iBAAiB,EAAE,SAAS,GAAG;AAC7C,aAAS,GAAG,IAAI;AAAA,EAClB,OAAO;AACL,WAAO,SAAS,GAAG;AAAA,EACrB;AACA,SAAO;AACT;AAEA,SAAS,4BAA8C,SAAe;AACpE,SAAO,wBAAwB,+BAA+B,OAAO,GAAG,gBAAgB;AAC1F;AAEA,SAAS,6BAA+D,MAAY;AAClF,MAAI,CAAC,MAAM,QAAQ,KAAK,QAAQ,EAAG,QAAO;AAC1C,SAAO;AAAA,IACL,GAAG;AAAA,IACH,UAAU,KAAK,SAAS;AAAA,MAAI,aAC1B,WAAW,QAAQ,OAAO,YAAY,WAAW,4BAA4B,OAAO,IAAI;AAAA,IAC1F;AAAA,EACF;AACF;AAEA,SAAS,6BAA+C,KAAW;AACjE,MAAI,WAAW,wBAAwB,KAAK,mBAAmB;AAC/D,QAAM,UAAW,SAAmC;AACpD,MAAI,WAAW,QAAQ,OAAO,YAAY,SAAU,QAAO;AAC3D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,4BAA4B,OAAO;AAAA,EAC9C;AACF;AAEA,SAAS,8BAAkE,MAAY;AACrF,MAAI,CAAC,MAAM,QAAQ,KAAK,UAAU,EAAG,QAAO;AAC5C,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,KAAK,WAAW;AAAA,MAAI,SAC9B,OAAO,QAAQ,OAAO,QAAQ,WAAW,6BAA6B,GAAG,IAAI;AAAA,IAC/E;AAAA,EACF;AACF;AAOA,SAAS,sBAAsB,MAAe,SAAuB;AACnE,MAAI,QAAQ,QAAQ,OAAO,SAAS,YAAY,WAAW,MAAM;AAC/D,UAAM,IAAI;AAAA,MACR,GAAG,OAAO;AAAA,IAGZ;AAAA,EACF;AACF;AAiBO,SAAS,qBACd,MACA,SACiB;AACjB,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,+BAA+B,CAAC;AAAA,IAC3E,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAMO,SAAS,iBACd,MACA,SACiB;AACjB,QAAM,aAAa,2BAA2B,IAAI;AAClD,QAAM,iBACJ,KAAK,cAAc,OAAO,2BAA2B,UAAU,KAAK,YAAY,CAAC,GAAG,MAAM;AAC5F,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,eAAe,CAAC;AAAA,IAC3D,mBAAmB;AAAA,EACrB;AACF;AAYO,SAAS,iBAAiB,MAA4C,SAAmC;AAC9G,wBAAsB,MAAM,kBAAkB;AAC9C,QAAM,eAAe,EAAE,GAAG,6BAA6B,IAAI,EAAE;AAC7D,MAAI,aAAa,aAAa,QAAW;AACvC,iBAAa,WAAW;AAAA,EAC1B;AACA,MAAI,aAAa,iBAAiB,QAAW;AAC3C,iBAAa,gBAAe,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrD;AACA,MAAI,aAAa,kBAAkB,UAAa,aAAa,UAAU,MAAM;AAC3E,iBAAa,gBAAgB,sBAAsB,aAAa,MAAM;AAAA,EACxE;AACA,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,aAAa,aAAa,YAAY,WAAW,CAAC;AAAA,IAC7F,mBAAmB,2BAA2B,cAAc,EAAE,qBAAqB,KAAK,CAAC;AAAA,EAC3F;AACF;AAMO,SAAS,iBAAiB,MAAkD,SAAmC;AACpH,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MACE,WACA,qBAAqB,KAAK,qBAAqB,MAAM,aAAa,KAAK,qBAAqB,WAAW,IAAI,KAAK,GAAG;AAAA,MACvH;AAAA,IACF;AAAA,IACA,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAMO,SAAS,qBAAqB,MAA2C,SAAmC;AACjH,QAAM,WAAW,6BAA6B,IAAI;AAClD,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,SAAS,SAAS,SAAS,MAAM,YAAY,CAAC;AAAA,IACzF,mBAAmB,2BAA2B,QAAQ;AAAA,EACxD;AACF;AAMO,SAAS,4BACd,MACA,SACiB;AACjB,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,SAAS,KAAK,QAAQ,MAAM,oBAAoB,CAAC;AAAA,IAC5F,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AASO,SAAS,uBAAuB,MAA4C,SAAmC;AACpH,wBAAsB,MAAM,wBAAwB;AACpD,QAAM,eAAe,EAAE,GAAG,wBAAwB,MAAM,mBAAmB,EAAE;AAC7E,MAAI,aAAa,kBAAkB,UAAa,aAAa,UAAU,MAAM;AAC3E,iBAAa,gBAAgB,sBAAsB,aAAa,MAAM;AAAA,EACxE;AACA,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,aAAa,aAAa,YAAY,WAAW,CAAC;AAAA,IAC7F,mBAAmB,2BAA2B,cAAc,EAAE,qBAAqB,KAAK,CAAC;AAAA,EAC3F;AACF;AAMO,SAAS,qBAAqB,MAA2C,SAAmC;AACjH,MAAI,MAAM,QAAQ,KAAK,UAAU,GAAG;AAClC,eAAW,OAAO,KAAK,YAAY;AACjC,4BAAsB,KAAK,sBAAsB;AAAA,IACnD;AAAA,EACF;AACA,QAAM,WAAW,8BAA8B,IAAI;AACnD,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MAAM,WAAW,SAAS,SAAS,WAAW,MAAM,aAAa,SAAS,WAAW,WAAW,IAAI,KAAK,GAAG;AAAA,MAC9G;AAAA,IACF;AAAA,IACA,mBAAmB,2BAA2B,QAAQ;AAAA,EACxD;AACF;AAMO,SAAS,4BACd,MACA,SACiB;AACjB,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,gCAAgC,CAAC;AAAA,IAC5E,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAMO,SAAS,sBAAsB,MAA2C,SAAmC;AAKlH,QAAM,WAAW,KAAK,mBAAmB,WAAW;AACpD,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,YAAY,WAAW,mBAAmB,QAAQ,KAAK,kBAAkB,CAAC;AAAA,IAC1G,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAMO,SAAS,2BACd,MACA,SACiB;AACjB,QAAM,QAAQ,KAAK,oBAAoB,UAAU;AACjD,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,SAAS,KAAK,oBAAoB,CAAC;AAAA,IAC9E,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAMO,SAAS,wBACd,MACA,SACiB;AACjB,QAAM,iBACJ,KAAK,kBAAkB,YAClB,MAAM;AACL,UAAM,IAAK,KAAuC,SAAS;AAC3D,WAAO,sBAAsB,CAAC,WAAW,MAAM,IAAI,KAAK,GAAG;AAAA,EAC7D,GAAG,IACH,KAAK,kBAAkB,WACpB,MAAM;AACL,UAAM,IAAK,KAAsC,QAAQ;AACzD,WAAO,kBAAkB,CAAC,UAAU,MAAM,IAAI,KAAK,GAAG;AAAA,EACxD,GAAG,IACH;AACR,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,eAAe,CAAC;AAAA,IAC3D,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAMO,SAAS,yBACd,MACA,SACiB;AACjB,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,8BAA8B,KAAK,QAAQ,UAAU,CAAC;AAAA,IACjG,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAMO,SAAS,sBAAsB,MAA4C,SAAmC;AACnH,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MACE,WAAW,SAAS,KAAK,cAAc,cAAc,eAAe,KAAK,cAAc,QAAQ;AAAA,MACnG;AAAA,IACF;AAAA,IACA,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AASO,SAAS,0BACd,MACA,SACiB;AACjB,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MAAM,WAAW,SAAS,KAAK,MAAM,MAAM,iBAAiB,KAAK,MAAM,WAAW,IAAI,KAAK,GAAG;AAAA,MAChG;AAAA,IACF;AAAA,IACA,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAQO,SAAS,4BACd,MACA,SACiB;AACjB,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MAAM,WAAW,SAAS,KAAK,MAAM,MAAM,mBAAmB,KAAK,MAAM,WAAW,IAAI,KAAK,GAAG;AAAA,MAClG;AAAA,IACF;AAAA,IACA,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAeO,SAAS,6BACd,MACA,SACiB;AACjB,QAAM,iBACJ,eAAe,OACX,SAAS,KAAK,UAAU,MAAM,oBAAoB,KAAK,UAAU,WAAW,IAAI,KAAK,GAAG,KACxF;AACN,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,eAAe,CAAC;AAAA,IAC3D,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAQO,SAAS,yBACd,MACA,SACiB;AACjB,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MAAM,WAAW,kBAAkB,KAAK,MAAM,MAAM,QAAQ,KAAK,MAAM,WAAW,IAAI,KAAK,GAAG;AAAA,MAChG;AAAA,IACF;AAAA,IACA,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAIA,SAAS,4BAA4B,MAA+E;AAClH,SACE,MAAM,QAAS,KAA8B,MAAM,KAAK,CAAC,MAAM,QAAS,KAAiC,SAAS;AAEtH;AASO,SAAS,sBAAsB,MAAoC,SAAmC;AAC3G,MAAI,4BAA4B,IAAI,GAAG;AACrC,UAAM,aAAa,KAAK,OAAO,CAAC;AAChC,UAAM,iBAAiB,aAAa,GAAG,WAAW,IAAI,KAAK,WAAW,OAAO,KAAK;AAClF,WAAO;AAAA,MACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,eAAe,CAAC;AAAA,MAC3D,SAAS;AAAA,MACT,mBAAmB,wBAAwB,IAAI;AAAA,IACjD;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MAAM,WAAW,UAAU,KAAK,UAAU,MAAM,YAAY,KAAK,UAAU,WAAW,IAAI,KAAK,GAAG;AAAA,MACpG;AAAA,IACF;AAAA,IACA,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAMO,SAAS,mBAAmB,MAAyC,SAAmC;AAC7G,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MAAM,WAAW,UAAU,KAAK,WAAW,CAAC,GAAG,MAAM,WAAW,KAAK,WAAW,CAAC,GAAG,WAAW,IAAI,KAAK,GAAG;AAAA,MAC7G;AAAA,IACF;AAAA,IACA,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAMO,SAAS,uBAAuB,MAA4C,SAAmC;AACpH,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MACE,WACA,2BAA2B,KAAK,YAAY,MAAM,cAAc,KAAK,YAAY,WAAW,IAAI,KAAK,GAAG;AAAA,MAC5G;AAAA,IACF;AAAA,IACA,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAgCO,SAAS,uBAAuB,OAA4B,SAAmC;AACpG,QAAM,eAAwC;AAAA,IAC5C,aAAa,MAAM,gBAAe,oBAAI,KAAK,GAAE,YAAY;AAAA,IACzD,aAAa,MAAM;AAAA,EACrB;AACA,MAAI,MAAM,WAAW,QAAW;AAC9B,iBAAa,SAAS,MAAM;AAAA,EAC9B;AAEA,QAAM,OAAgC;AAAA,IACpC,cAAc,MAAM;AAAA,IACpB,QAAQ;AAAA,IACR,eAAe,CAAC;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB;AAAA,EACF;AACA,MAAI,MAAM,sBAAsB,QAAW;AACzC,SAAK,oBAAoB,MAAM;AAAA,EACjC;AACA,MAAI,MAAM,YAAY,QAAW;AAC/B,SAAK,UAAU,MAAM;AAAA,EACvB;AAEA,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,aAAa,MAAM,YAAY,YAAY,CAAC;AAAA,IACvF,mBAAmB,2BAA2B,MAAM,EAAE,qBAAqB,KAAK,CAAC;AAAA,EACnF;AACF;AAcO,SAAS,sBAAsB,MAA4C,SAAmC;AACnH,QAAM,YAAY;AAClB,QAAM,iBACJ,YAAY,OACR,6BACA,UAAU,kBAAkB,aAC1B,UAAU,UAAU,SAAS,cAC7B,UAAU,kBAAkB,aAC1B,UAAU,UAAU,SAAS,cAC7B,UAAU,UAAU,SAAS;AACvC,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,eAAe,CAAC;AAAA,IAC3D,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AASO,SAAS,sBACd,MACA,SACiB;AACjB,SAAO,sBAAsB,EAAE,GAAG,MAAM,eAAe,WAAW,GAAuC,OAAO;AAClH;AAIO,SAAS,6BACd,MACA,SACiB;AACjB,SAAO;AAAA,IACL,EAAE,GAAG,MAAM,eAAe,mBAAmB;AAAA,IAC7C;AAAA,EACF;AACF;AAIO,SAAS,sBACd,MACA,SACiB;AACjB,SAAO,sBAAsB,EAAE,GAAG,MAAM,eAAe,WAAW,GAAuC,OAAO;AAClH;AAaO,SAAS,qBAAqB,MAA2C,SAAmC;AACjH,QAAM,iBACJ,YAAY,OACR,wBACA,KAAK,uBAAuB,OAC1B,UAAU,KAAK,SAAS,6BACxB,UAAU,KAAK,SAAS;AAChC,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,eAAe,CAAC;AAAA,IAC3D,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAWO,SAAS,oBAAoB,MAA0C,SAAmC;AAC/G,SAAO,qBAAqB,MAAyC,OAAO;AAC9E;AAmBO,SAAS,yBAAyB,MAA0D;AACjG,SAAO;AACT;AAGO,SAAS,yBAAyB,MAA0D;AACjG,SAAO,EAAE,GAAG,MAAM,QAAQ,WAAW;AACvC;AAGO,SAAS,yBAAyB,MAA0D;AACjG,SAAO,EAAE,GAAG,MAAM,QAAQ,WAAW;AACvC;AAGO,SAAS,8BAA8B,MAAoE;AAChH,SAAO,EAAE,GAAG,MAAM,QAAQ,iBAAiB;AAC7C;AAGO,SAAS,sBAAsB,MAAoD;AACxF,SAAO;AACT;AAOO,SAAS,qBAAqB,MAA2C,SAAmC;AACjH,QAAM,WAAW,cAAc,OAAO,6BAA6B,IAAI,IAAI;AAC3E,QAAM,iBACJ,YAAY,WACR,uBACA,UAAU,SAAS,UAAU,UAAU,CAAC,WAAW,SAAS,UAAU,WAAW,IAAI,KAAK,GAAG;AACnG,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,eAAe,CAAC;AAAA,IAC3D,mBAAmB,2BAA2B,QAAQ;AAAA,EACxD;AACF;AAkBO,SAAS,uBAAuB,MAA6C,SAAmC;AACrH,QAAM,WAAW,4BAA4B,IAAI;AACjD,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,WAAW,iCAAiC,CAAC;AAAA,IAC7E,mBAAmB,2BAA2B,QAAQ;AAAA,EACxD;AACF;AAEA,SAAS,4BACP,MACuC;AACvC,MAAI,EAAE,cAAc,SAAS,CAAC,MAAM,QAAQ,KAAK,QAAQ,EAAG,QAAO;AACnE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,UAAU,KAAK,SAAS,IAAI,SAAO;AACjC,UAAI,CAAC,IAAI,kBAAmB,QAAO;AACnC,aAAO;AAAA,QACL,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA,QAKH,mBAAmB,IAAI,kBAAkB,IAAI,QAAM,EAAE,KAAK,EAAE,IAAI,EAAE;AAAA,MACpE;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAmBO,SAAS,oBAAoB,MAA0C,SAAmC;AAC/G,SAAO;AAAA,IACL,SAAS;AAAA,MACP,EAAE,MAAM,QAAQ,MAAM,WAAW,YAAY,KAAK,QAAQ,gBAAgB,KAAK,aAAa,IAAI,KAAK,GAAG,GAAG;AAAA,IAC7G;AAAA,IACA,mBAAmB,2BAA2B,IAAI;AAAA,EACpD;AACF;AAUA,oBAAoB,YAAY,SAAS,UACvC,SACA,MACiB;AACjB,QAAM,QAAQ,QAAQ,OAAO,UAAU;AACvC,QAAM,SAAS,MAAM,UAAU,CAAC;AAChC,QAAM,WAAW,KAAK,IAAI,GAAG,QAAQ,OAAO,MAAM;AAClD,SAAO;AAAA,IACL;AAAA,MACE,QAAQ,OAAO,SAAS,IAAI,WAAW;AAAA,MACvC;AAAA,MACA,GAAI,OAAO,SAAS,IAAI,EAAE,OAAO,IAAI,CAAC;AAAA,IACxC;AAAA,IACA,MAAM;AAAA,EACR;AACF;","names":[]}

package/dist/lib/server/serve.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { PARSE_ERROR, isJsonContentType } from "@modelcontextprotocol/server";
 import { hostHeaderValidation, originValidation } from "@modelcontextprotocol/node";

package/dist/lib/server/serve.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/server/serve.ts"],"sourcesContent":["/**\n * One-liner HTTP server for AdCP MCP agents.\n *\n * Wraps the StreamableHTTPServerTransport + http.createServer boilerplate\n * so agent builders can focus on business logic.\n *\n * @example\n * ```typescript\n * import { createTaskCapableServer, serve } from '@adcp/sdk';\n *\n * function createAgent({ taskStore }) {\n *   const server = createTaskCapableServer('My Agent', '1.0.0', { taskStore });\n *   server.registerTool('get_signals', { description: 'Discover audiences.', inputSchema: schema }, handler);\n *   return server;\n * }\n *\n * serve(createAgent); // listening on http://localhost:3001/mcp\n * ```\n */\n\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\nimport { PARSE_ERROR, isJsonContentType } from '@modelcontextprotocol/server';\nimport { hostHeaderValidation, originValidation } from '@modelcontextprotocol/node';\nimport { createServer, type IncomingMessage, type Server as HttpServer } from 'http';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { TaskStore } from '@modelcontextprotocol/sdk/experimental/tasks/interfaces.js';\nimport { InMemoryTaskStore } from '@modelcontextprotocol/sdk/experimental/tasks/stores/in-memory.js';\nimport type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';\nimport type { AuthPrincipal, Authenticator, ServeRequestContext } from './auth';\nimport {\n  ADCP_SERVE_REQUEST_CONTEXT,\n  AuthError,\n  authenticatorNeedsRawBody,\n  respondUnauthorized,\n  signatureErrorCodeFromCause,\n} from './auth';\nimport { ADCP_PRE_TRANSPORT, ADCP_INSTRUCTIONS_FN, type AdcpPreTransport } from './create-adcp-server';\nimport { isAdcpServer, type AdcpServer } from './adcp-server';\nimport { createModernMcpServerAdapter } from './mcp-modern-server';\n\n/**\n * Context passed to the agent factory on each request.\n *\n * Contains shared resources that must survive across stateless HTTP requests,\n * such as the task store for MCP Tasks protocol support.\n *\n * For multi-tenant / multi-host deployments, provide a custom `TaskStore` via\n * `ServeOptions` that enforces tenant/session scoping, and branch on\n * {@link host} inside your factory to return host-specific handlers.\n */\nexport interface ServeContext {\n  /** Shared task store — use this when creating your McpServer so tasks persist across requests. */\n  taskStore: TaskStore;\n  /**\n   * Canonical host the request arrived on, lowercased with port preserved\n   * (e.g. `snap.example.com`, `localhost:3001`). Resolved from\n   * `X-Forwarded-Host` when `ServeOptions.trustForwardedHost` is true,\n   * otherwise from the `Host` header. Empty string when neither header\n   * is present (unusual — HTTP/1.1 requires `Host`).\n   *\n   * Use this in the factory to branch on hostname when a single process\n   * fronts multiple agents. The same string is passed to\n   * `publicUrl` / `protectedResource` resolver functions.\n   */\n  host: string;\n}\n\n/**\n * Thrown from an agent factory (or a `publicUrl` / `protectedResource`\n * resolver) when the incoming request's host isn't configured. `serve()`\n * catches it and responds 404 with a generic body — the adapter routing\n * table never crosses the wire. Any other thrown error still surfaces\n * as 500 so unrelated bugs stay loud.\n */\nexport class UnknownHostError extends Error {\n  constructor(message = 'Unknown host') {\n    super(message);\n    this.name = 'UnknownHostError';\n  }\n}\n\n/**\n * OAuth 2.0 Protected Resource Metadata (RFC 9728) advertised at\n * `/.well-known/oauth-protected-resource<mountPath>`.\n *\n * The `resource` URL itself is taken from `ServeOptions.publicUrl` — set\n * that to the canonical MCP endpoint (e.g. `https://my-agent.example.com/mcp`)\n * so clients request tokens bound to the right RFC 8707 audience.\n */\nexport interface ProtectedResourceMetadata {\n  /** URLs of authorization servers that issue tokens for this resource. */\n  authorization_servers: string[];\n  /** Scopes this resource accepts. Optional. */\n  scopes_supported?: string[];\n  /** Bearer token methods supported. Defaults to `['header']`. */\n  bearer_methods_supported?: Array<'header' | 'body' | 'query'>;\n  /** Human-readable resource docs URL. Optional. */\n  resource_documentation?: string;\n  /** Per-resource policy URL. Optional. */\n  resource_policy_uri?: string;\n  /** Per-resource ToS URL. Optional. */\n  resource_tos_uri?: string;\n}\n\nexport interface ServeOptions {\n  /** Port to listen on. Defaults to PORT env var or 3001. */\n  port?: number;\n  /** HTTP path to mount the MCP endpoint on. Defaults to '/mcp'. */\n  path?: string;\n  /**\n   * Hostnames allowed on framework-owned AdCP server requests, without ports.\n   * The guard runs before protocol-era classification, so it protects both\n   * legacy and MCP 2026-07-28 traffic. Defaults to the hostname from\n   * `publicUrl`, or localhost-only when no public URL is set. Public and\n   * reverse-proxied deployments must configure `publicUrl` or this allowlist;\n   * include the upstream Host too when a proxy rewrites it.\n   */\n  allowedHosts?: string[];\n  /**\n   * Origin hostnames allowed on browser-originated framework AdCP requests,\n   * across both protocol eras. Requests without Origin pass. Defaults to\n   * {@link allowedHosts}.\n   */\n  allowedOrigins?: string[];\n  /**\n   * Maximum buffered MCP request body size used for era classification.\n   * Defaults to 2 MiB. Set explicitly when an AdCP extension legitimately\n   * carries larger JSON payloads.\n   */\n  maxRequestBytes?: number;\n  /** Called when the server starts listening. */\n  onListening?: (url: string) => void;\n  /**\n   * Async check called before the server begins accepting connections.\n   * Throw to abort boot — `serve()` logs the error and calls `process.exit(1)`,\n   * so the server never enters listen mode and no traffic arrives during the\n   * check. Use to validate external dependencies (database pools, credential\n   * fetches) so a misconfigured deployment fails loudly at startup rather than\n   * silently on the first live request.\n   *\n   * @example\n   * ```ts\n   * serve(createAgent, {\n   *   readinessCheck: () => store.probe(),\n   * });\n   * ```\n   */\n  readinessCheck?: () => Promise<void>;\n  /**\n   * Custom task store. Defaults to a shared InMemoryTaskStore.\n   *\n   * The default InMemoryTaskStore only evicts tasks that have a TTL set.\n   * For long-running servers, always set `ttl` when creating tasks, or\n   * provide a store with automatic eviction to prevent unbounded memory growth.\n   */\n  taskStore?: TaskStore;\n\n  /**\n   * Canonical public URL of this MCP endpoint (e.g. `https://my-agent.example.com/mcp`).\n   * Required when `protectedResource` is configured — the RFC 9728 `resource`\n   * field, the RFC 6750 `resource_metadata` URL on 401 challenges, and the\n   * JWT audience your tokens must carry are all derived from it. Setting this\n   * defends against attacker-controlled `Host` header phishing: without it,\n   * the server would advertise whatever host a caller happened to send.\n   *\n   * Must be an absolute https:// URL whose path matches the mount path.\n   *\n   * **Multi-host.** Pass a function `(host) => string` when one process\n   * fronts multiple hostnames (white-label publishers, multi-brand\n   * adapters). The resolver runs per unique host — the returned URL is\n   * cached and used as the RFC 9728 `resource`, the 401-challenge\n   * `resource_metadata`, and the JWT audience for that host. Each\n   * resolved URL's path must match the mount path, same as the static\n   * form. Setting {@link trustForwardedHost} is recommended when\n   * behind a proxy.\n   */\n  publicUrl?: string | ((host: string) => string);\n\n  /**\n   * Authentication middleware applied to every request. When configured,\n   * missing or invalid credentials produce a 401 with a compliant\n   * `WWW-Authenticate` header — no request reaches the MCP transport\n   * without passing. Use helpers from `./auth`: `verifyApiKey`,\n   * `verifyBearer`, or `anyOf(verifyApiKey(...), verifyBearer(...))`.\n   */\n  authenticate?: Authenticator;\n\n  /**\n   * Advertise OAuth 2.0 protected-resource metadata at\n   * `/.well-known/oauth-protected-resource<mountPath>`. Requires {@link publicUrl}.\n   *\n   * Pass a function `(host) => ProtectedResourceMetadata` for multi-host\n   * deployments whose authorization servers or supported scopes vary per\n   * hostname (e.g., each white-label seller has its own AS). The resolver\n   * runs once per unique host and the result is cached. The static form\n   * still works when every host uses the same PRM body.\n   */\n  protectedResource?: ProtectedResourceMetadata | ((host: string) => ProtectedResourceMetadata);\n\n  /**\n   * Reuse the agent returned by the factory across requests instead of\n   * closing it after each. Default `false` (one fresh server per\n   * request — the pre-existing behavior).\n   *\n   * When `true`, `serve()` DOES NOT call `agentServer.close()` between\n   * requests. The factory is still called on every request; it's the\n   * caller's responsibility to cache `AdcpServer` instances (typically\n   * keyed on `ctx.host`) and return the cached instance when possible.\n   * Concurrent requests to the same cached server are serialized per\n   * instance — `McpServer.connect()` rejects when a transport is\n   * already attached, so the framework wraps the\n   * connect→handleRequest→release cycle in a per-instance async\n   * mutex. Requests for DIFFERENT cached servers still run in parallel.\n   *\n   * Use when `createAdcpServer(...)` setup cost (tool registration,\n   * handler wiring) is a measurable portion of request latency — common\n   * in multi-host deployments with many tools per host. Trade-off:\n   * throughput per unique host drops to 1 in flight at a time. For\n   * higher concurrency per host, cache a small pool of servers in the\n   * factory and round-robin.\n   *\n   * Cleanup is the caller's responsibility: listen for the process\n   * shutdown signal and call `close()` on every cached server to\n   * release MCP Tasks timers, HTTP keepalives, etc.\n   *\n   * **Incompatible with long-lived server→client streams.** MCP's\n   * `Protocol._onclose` aborts in-flight handlers and clears progress\n   * tokens when the transport closes. In stateless HTTP mode (the\n   * default this helper uses) each request is already single-response,\n   * so this is a no-op concern. Don't enable `reuseAgent` if you\n   * eventually wire a transport that keeps an SSE channel open across\n   * multiple logical requests.\n   */\n  reuseAgent?: boolean;\n\n  /**\n   * Trust `X-Forwarded-Host` and RFC 7239 `Forwarded: host=...` for\n   * host resolution and for reconstructing the public URL on 401\n   * challenges. Default `false` — an attacker-controlled header can't\n   * flip the advertised OAuth `resource` URL unless you opt in.\n   *\n   * **Your proxy must OVERWRITE the forwarded headers on ingress, not\n   * append.** The framework trusts the first (left-most) entry in a\n   * chain. With an overwriting proxy that's the sanitized value; with\n   * an appending proxy it's whatever the client sent — an attacker\n   * picks it. Common behavior:\n   *\n   * - Overwrite (safe to trust): Fly.io, Cloud Run, GCP HTTPS LB.\n   * - Append (NOT safe without extra config): AWS ALB default, nginx\n   *   default. These need `proxy_set_header X-Forwarded-Host $host;`\n   *   or equivalent before enabling this flag.\n   *\n   * Verify your proxy's behavior against a request that already has\n   * `X-Forwarded-Host: attacker.example` in it before turning this on.\n   */\n  trustForwardedHost?: boolean;\n\n  /**\n   * Pre-MCP middleware — runs after authentication but before MCP transport\n   * is connected. Intended for transport-layer concerns like RFC 9421\n   * request-signature verification: the agent's body is already buffered\n   * into `(req as any).rawBody` before the middleware fires so signature\n   * verifiers can hash it without racing the transport's own body read.\n   *\n   * Return `true` to signal the middleware handled the response (e.g. a\n   * 401 with `WWW-Authenticate`); the transport is skipped. Return `false`\n   * to continue into MCP dispatch.\n   *\n   * Throwing from the middleware produces a 500 with a generic body.\n   */\n  preTransport?: (\n    req: import('http').IncomingMessage & { rawBody?: string },\n    res: import('http').ServerResponse\n  ) => Promise<boolean>;\n}\n\n/**\n * Start an HTTP server that serves an AdCP MCP agent.\n *\n * Creates a new MCP server instance per request (stateless), wires up the\n * StreamableHTTPServerTransport, and returns the underlying http.Server\n * for lifecycle control.\n *\n * A shared task store is created once and passed to the factory on every\n * request via `ServeContext`. This ensures MCP Tasks (create → poll → result)\n * work correctly across stateless HTTP requests.\n *\n * **Multi-host.** Pass functions for `publicUrl` and `protectedResource` and\n * branch on `ctx.host` in the factory to front multiple hostnames from one\n * process. The framework resolves host from `X-Forwarded-Host` (when\n * `trustForwardedHost: true`) or `Host`, threads it through `ServeContext`,\n * and caches per-host `publicUrl`/PRM so each hostname advertises its own\n * audience-bound `resource`.\n *\n * @param createAgent - Factory function that returns a configured server —\n *   either an `AdcpServer` from `createAdcpServer()` or a raw SDK `McpServer`\n *   from `createTaskCapableServer()`. Called once per request so each gets a\n *   fresh instance (a server can only be connected once). Receives a\n *   `ServeContext` with a shared `taskStore` and the resolved `host` —\n *   branch on `host` to return host-specific handlers in multi-host mode.\n *   Framework `AdcpServer` instances serve both MCP 2026-07-28 and legacy\n *   clients. Raw v1 SDK `McpServer` instances remain legacy-only so resources,\n *   prompts, Tasks, and custom transport extras are never silently dropped.\n * @param options - Port, path, and callback configuration.\n * @returns The http.Server instance. Use the `onListening` callback or\n *   listen for the 'listening' event to know when it's ready.\n */\nexport function serve(createAgent: (ctx: ServeContext) => AdcpServer | McpServer, options?: ServeOptions): HttpServer {\n  const envPort = process.env.PORT ? parseInt(process.env.PORT, 10) : undefined;\n  if (envPort !== undefined && (Number.isNaN(envPort) || envPort < 0 || envPort > 65535)) {\n    throw new Error(`Invalid PORT environment variable: \"${process.env.PORT}\"`);\n  }\n  const port = options?.port ?? envPort ?? 3001;\n  const mountPath = options?.path ?? '/mcp';\n  const taskStore = options?.taskStore ?? new InMemoryTaskStore();\n  const trustForwardedHost = options?.trustForwardedHost === true;\n  const reuseAgent = options?.reuseAgent === true;\n  const maxRequestBytes = options?.maxRequestBytes ?? 2 * 1024 * 1024;\n  if (!Number.isSafeInteger(maxRequestBytes) || maxRequestBytes <= 0) {\n    throw new Error('serve(): `maxRequestBytes` must be a positive safe integer');\n  }\n\n  // Per-instance mutex chain for `reuseAgent: true`. The MCP SDK's\n  // `Protocol.connect()` hard-throws when a transport is already\n  // attached (node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js:215),\n  // so concurrent requests that land on the same cached server would\n  // race without this. WeakMap so agents GC normally when the caller\n  // drops references. Only used when `reuseAgent` is true — the\n  // default path still creates a fresh server per request and doesn't\n  // share any state across calls.\n  const reuseMutexes = new WeakMap<AdcpServer | McpServer, Promise<unknown>>();\n\n  if (options?.protectedResource && !options.publicUrl) {\n    throw new Error(\n      'serve(): `protectedResource` requires `publicUrl` (the canonical https:// URL clients use for this MCP endpoint). ' +\n        'Without it, the server would advertise an attacker-controlled Host header as the OAuth resource URL.'\n    );\n  }\n\n  const publicUrlOption = options?.publicUrl;\n  const protectedResourceOption = options?.protectedResource;\n  const publicUrlIsFn = typeof publicUrlOption === 'function';\n  const prmIsFn = typeof protectedResourceOption === 'function';\n\n  // Static publicUrl — validate once at construction. Function form validates\n  // lazily per host so a stale factory for one host can't prevent boot.\n  let staticPublicOrigin: string | undefined;\n  if (typeof publicUrlOption === 'string') {\n    staticPublicOrigin = validatePublicUrl(publicUrlOption, mountPath);\n  }\n\n  // Per-host caches. Function-form options are pure host → value lookups,\n  // so memoization is safe and avoids the per-request allocation of\n  // `new URL(...)` plus the caller's own host → config table work.\n  const publicUrlCache = new Map<string, string>();\n  const publicOriginCache = new Map<string, string>();\n  const prmCache = new Map<string, ProtectedResourceMetadata>();\n\n  const resolvePublicUrl = (host: string): string | undefined => {\n    if (typeof publicUrlOption === 'string') return publicUrlOption;\n    if (!publicUrlIsFn) return undefined;\n    let cached = publicUrlCache.get(host);\n    if (cached !== undefined) return cached;\n    cached = (publicUrlOption as (h: string) => string)(host);\n    const origin = validatePublicUrl(cached, mountPath);\n    publicUrlCache.set(host, cached);\n    publicOriginCache.set(host, origin);\n    return cached;\n  };\n\n  const resolvePublicOrigin = (host: string): string | undefined => {\n    if (typeof publicUrlOption === 'string') return staticPublicOrigin;\n    // Populate via resolvePublicUrl so both caches share a single validation pass.\n    if (resolvePublicUrl(host) == null) return undefined;\n    return publicOriginCache.get(host);\n  };\n\n  const resolveProtectedResource = (host: string): ProtectedResourceMetadata | undefined => {\n    if (!protectedResourceOption) return undefined;\n    if (!prmIsFn) return protectedResourceOption as ProtectedResourceMetadata;\n    let cached = prmCache.get(host);\n    if (cached !== undefined) return cached;\n    cached = (protectedResourceOption as (h: string) => ProtectedResourceMetadata)(host);\n    prmCache.set(host, cached);\n    return cached;\n  };\n\n  if (options?.authenticate == null && process.env.NODE_ENV === 'production') {\n    console.warn(\n      '[adcp/serve] No `authenticate` configured — this agent will accept unauthenticated requests. ' +\n        'AdCP security_baseline requires authentication in production.'\n    );\n  }\n\n  const explicitPreTransport = options?.preTransport as AdcpPreTransport | undefined;\n\n  const protectedResourcePath = `/.well-known/oauth-protected-resource${mountPath}`;\n\n  const httpServer = createServer(async (req, res) => {\n    const { pathname } = new URL(req.url || '', 'http://localhost');\n    const host = resolveHost(req, { trustForwardedHost });\n\n    // RFC 9728 protected-resource metadata — intentionally auth-free so\n    // clients can discover the authorization server before they have a token.\n    if (protectedResourceOption && pathname === protectedResourcePath) {\n      let resource: string | undefined;\n      let prm: ProtectedResourceMetadata | undefined;\n      try {\n        resource = resolvePublicUrl(host);\n        prm = resolveProtectedResource(host);\n      } catch (err) {\n        if (err instanceof UnknownHostError) {\n          // Operator signalled \"this host isn't in my routing table.\" 404\n          // lets the OAuth grader probe fall through cleanly and doesn't\n          // leak the configured host set across the wire.\n          res.writeHead(404);\n          res.end('Not found');\n          return;\n        }\n        console.error('[adcp/serve] publicUrl/protectedResource resolver failed:', err);\n        res.writeHead(500, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'Protected-resource metadata unavailable for this host.' }));\n        return;\n      }\n      if (!resource || !prm) {\n        // Fail closed: advertising a garbage resource URL would mint\n        // audience-mismatched tokens across the fleet. 404 signals \"this\n        // host doesn't publish PRM\" — the operator sees it and either\n        // wires the host up or takes it out of DNS.\n        res.writeHead(404);\n        res.end('Not found');\n        return;\n      }\n      const body = {\n        resource,\n        ...prm,\n        bearer_methods_supported: prm.bearer_methods_supported ?? ['header'],\n      };\n      res.writeHead(200, { 'Content-Type': 'application/json' });\n      res.end(JSON.stringify(body));\n      return;\n    }\n\n    if (pathname === mountPath || pathname === `${mountPath}/`) {\n      // Resolve per-request `resource_metadata` URL for 401 challenges and\n      // the per-host `publicUrl` authenticators read via\n      // {@link getServeRequestContext}. Resolving both up front means\n      // the audience callback in `verifyBearer` can never diverge from\n      // what the framework advertises in `/.well-known/...`. For static\n      // PRM this is the same string every request (pre-multi-host\n      // behavior); for function-form PRM/URL it follows the host.\n      let resourceMetadataUrl: string | undefined;\n      let resolvedPublicUrl: string | undefined;\n      try {\n        resolvedPublicUrl = resolvePublicUrl(host);\n      } catch (err) {\n        if (err instanceof UnknownHostError) {\n          res.writeHead(404);\n          res.end('Not found');\n          return;\n        }\n        console.error('[adcp/serve] publicUrl resolver failed:', err);\n        res.writeHead(500, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'Protected-resource metadata unavailable for this host.' }));\n        return;\n      }\n      if (protectedResourceOption) {\n        const hostOrigin = resolvePublicOrigin(host);\n        if (hostOrigin) resourceMetadataUrl = `${hostOrigin}${protectedResourcePath}`;\n      }\n\n      // Stamp the serve-resolved context on the request so authenticator\n      // callbacks (e.g. `verifyBearer`'s audience resolver) inherit the\n      // framework's host resolution — they MUST NOT re-derive host from\n      // raw headers, since that would diverge from what PRM advertises\n      // and let a spoofed `X-Forwarded-Host` flip the JWT audience check\n      // when `trustForwardedHost` is false.\n      const serveRequestContext: ServeRequestContext = resolvedPublicUrl\n        ? { host, publicUrl: resolvedPublicUrl }\n        : { host };\n      (req as IncomingMessage & { [ADCP_SERVE_REQUEST_CONTEXT]?: ServeRequestContext })[ADCP_SERVE_REQUEST_CONTEXT] =\n        serveRequestContext;\n\n      // Body buffering happens at most once per request. An idempotent helper\n      // lets the auth path (for signature authenticators) and the preTransport\n      // path share the buffer without re-reading a drained stream.\n      let rawBody: string | undefined;\n      let parsedBody: unknown;\n      let bodyParseFailed = false;\n      const ensureRawBody = async (): Promise<void> => {\n        if (rawBody !== undefined) return;\n        rawBody = await bufferBody(req, maxRequestBytes);\n        (req as { rawBody?: string }).rawBody = rawBody;\n        if (rawBody.length > 0) {\n          try {\n            parsedBody = JSON.parse(rawBody);\n          } catch {\n            bodyParseFailed = true;\n          }\n        }\n      };\n\n      // RFC 9421 signature authenticators need `req.rawBody` for Content-Digest\n      // recompute, so buffer before authentication runs when the authenticator\n      // (or any branch of an anyOf composition) carries the needs-raw-body tag.\n      if (authenticatorNeedsRawBody(options?.authenticate)) {\n        try {\n          await ensureRawBody();\n        } catch (err) {\n          // `bufferBody` has already called `req.destroy()` on the\n          // oversize path; additional teardown here would race the\n          // response write. Write the status and return.\n          const errName = (err as Error).name || 'Error';\n          console.error(`[adcp/serve] request body read failed before auth: ${errName}`);\n          if (!res.headersSent) {\n            res.writeHead(400, { 'Content-Type': 'application/json' });\n            res.end(JSON.stringify({ error: 'Request body read failed.' }));\n          }\n          return;\n        }\n      }\n\n      // Enforce authentication before transport work.\n      if (options?.authenticate) {\n        let principal: AuthPrincipal | null;\n        try {\n          principal = await options.authenticate(req);\n        } catch (err) {\n          // Surface only sanitized messages to the client; log internal cause server-side.\n          const publicMessage = err instanceof AuthError ? err.publicMessage : 'Credentials rejected.';\n          console.error('[adcp/auth] rejected:', err);\n          // Switch challenge scheme to `Signature` when the rejection\n          // originates in the RFC 9421 verifier — the signed_requests\n          // negative-vector grader reads the error code from the\n          // `WWW-Authenticate` header, so collapsing it into the generic\n          // `Bearer error=\"invalid_token\"` challenge would surface the\n          // wrong code and fail every negative vector.\n          const signatureCode = signatureErrorCodeFromCause(err);\n          if (signatureCode) {\n            respondUnauthorized(req, res, {\n              signatureError: signatureCode,\n              errorDescription: publicMessage,\n              resourceMetadata: resourceMetadataUrl,\n            });\n            return;\n          }\n          respondUnauthorized(req, res, {\n            error: 'invalid_token',\n            errorDescription: publicMessage,\n            resourceMetadata: resourceMetadataUrl,\n          });\n          return;\n        }\n        if (!principal) {\n          respondUnauthorized(req, res, {\n            error: 'invalid_token',\n            errorDescription: 'Missing or unrecognized credentials.',\n            resourceMetadata: resourceMetadataUrl,\n          });\n          return;\n        }\n        // Propagate to MCP transport so tool handlers see `extra.authInfo`.\n        attachAuthInfo(req, principal);\n      }\n\n      // Create the agent first so we can inspect it for an auto-wired\n      // preTransport attached by `createAdcpServer({ signedRequests })`. An\n      // explicit `options.preTransport` wins — it lets callers override the\n      // default wiring (e.g., to add request logging or swap verifier\n      // implementations).\n      let agentServer: AdcpServer | McpServer;\n      try {\n        agentServer = createAgent({ taskStore, host });\n      } catch (err) {\n        if (err instanceof UnknownHostError) {\n          // Factory signalled \"this host isn't routable.\" 404 keeps the\n          // adapter table off the wire while giving ops a clean failure\n          // mode instead of the generic-500 confusion.\n          res.writeHead(404);\n          res.end('Not found');\n          return;\n        }\n        // Unexpected factory failure — surface as 500 to the client and\n        // log server-side. Rethrowing would bubble to the createServer\n        // handler as an unhandled rejection (async callback), which\n        // could crash a node process with `--unhandled-rejections=strict`.\n        console.error('[adcp/serve] factory threw:', err);\n        if (!res.headersSent) {\n          res.writeHead(500, { 'Content-Type': 'application/json' });\n          res.end(JSON.stringify({ error: 'Internal server error' }));\n        }\n        return;\n      }\n      // Refuse `reuseAgent: true` + function-form `instructions`. The function\n      // is captured at server construction and would not re-evaluate per\n      // session under server reuse — silently degrading to \"instructions are\n      // a constant after all\" is worse than failing loud at the first request.\n      // Adopters fix this by removing `reuseAgent: true` (default factory\n      // creates a fresh agent per request, which is what the function needs)\n      // OR by passing a static string for `instructions`.\n      //\n      // The check fires when `reuseAgent: true` was declared, regardless of\n      // whether the adopter's factory actually caches. The flag is the\n      // adopter's stated intent to reuse; we can't introspect cache behavior.\n      if (reuseAgent && (agentServer as unknown as Record<symbol, unknown>)[ADCP_INSTRUCTIONS_FN] === true) {\n        const hint =\n          'Drop `reuseAgent: true` (a fresh agent per request fires the function each session) OR pass a static string for `instructions`.';\n        console.error(\n          '[adcp/serve] refusing reuseAgent: true with function-form instructions. ' +\n            'The function fires once per agent instance lifetime (at MCP initialize) and would not re-evaluate on subsequent sessions under server reuse. ' +\n            hint\n        );\n        if (!res.headersSent) {\n          res.writeHead(500, { 'Content-Type': 'application/json' });\n          res.end(\n            JSON.stringify({\n              error: 'serve(): reuseAgent is incompatible with function-form instructions',\n              hint,\n            })\n          );\n        }\n        return;\n      }\n      const attached = (agentServer as unknown as Record<symbol, unknown>)[ADCP_PRE_TRANSPORT];\n      const autoWiredPreTransport = typeof attached === 'function' ? (attached as AdcpPreTransport) : undefined;\n      const activePreTransport = explicitPreTransport ?? autoWiredPreTransport;\n\n      if (activePreTransport) {\n        try {\n          await ensureRawBody();\n          const handled = await activePreTransport(req as import('http').IncomingMessage & { rawBody?: string }, res);\n          if (handled) {\n            // PreTransport already responded (401, etc.). Close the agent\n            // before returning so the McpServer doesn't leak.\n            await agentServer.close();\n            return;\n          }\n        } catch (err) {\n          // Narrow to name+code — transport errors can embed remote URLs.\n          const errName = (err as Error).name || 'Error';\n          const errCode = (err as { code?: string }).code ?? 'unknown';\n          console.error(`preTransport middleware error: ${errName} (${errCode})`);\n          if (!res.headersSent) {\n            res.writeHead(500, { 'Content-Type': 'application/json' });\n            res.end(JSON.stringify({ error: 'Internal server error' }));\n          }\n          await agentServer.close();\n          return;\n        }\n      }\n\n      // In reuseAgent mode, serialize connect→handle→close per server\n      // instance. `McpServer.connect()` rejects when a transport is\n      // already attached (protocol.js:215), so concurrent requests on a\n      // cached server would race without this chain. Requests on\n      // DIFFERENT servers (different WeakMap keys) proceed in parallel.\n      // Outside reuseAgent mode the factory returns a fresh server per\n      // request — no shared instance, no lock needed.\n      const runTransportCycle = async (): Promise<void> => {\n        let modernAdapter: ReturnType<typeof createModernMcpServerAdapter> | undefined;\n        try {\n          // The official v2 classifier and Node adapter both need the parsed\n          // body after auth/signing middleware may have drained the stream.\n          // Buffer once, then pass the same parsed value to whichever era owns\n          // the request. Malformed JSON and unsupported media types fail before\n          // either protocol era receives a drained request stream.\n          await ensureRawBody();\n\n          if (req.method?.toUpperCase() === 'POST' && !isJsonContentType(req.headers['content-type'])) {\n            res.writeHead(415, { 'Content-Type': 'application/json' });\n            res.end(\n              JSON.stringify({\n                jsonrpc: '2.0',\n                error: { code: -32000, message: 'Unsupported Media Type: Content-Type must be application/json' },\n                id: null,\n              })\n            );\n            return;\n          }\n\n          if (req.method?.toUpperCase() === 'POST' && (bodyParseFailed || rawBody?.length === 0)) {\n            res.writeHead(400, { 'Content-Type': 'application/json' });\n            res.end(\n              JSON.stringify({\n                jsonrpc: '2.0',\n                error: { code: PARSE_ERROR, message: 'Parse error: request body is not valid JSON' },\n                id: null,\n              })\n            );\n            return;\n          }\n\n          // Raw v1 SDK McpServer instances retain their complete legacy\n          // surface (resources, prompts, custom handlers, Tasks extras).\n          // Only the framework-owned AdcpServer can be mirrored losslessly\n          // onto the 2026-07-28 tool transport.\n          const frameworkAgent = isAdcpServer(agentServer) ? agentServer : undefined;\n          if (frameworkAgent) {\n            const defaultAllowedHosts = resolvedPublicUrl\n              ? [new URL(resolvedPublicUrl).hostname]\n              : ['localhost', '127.0.0.1', '[::1]'];\n            const allowedHosts = options?.allowedHosts ?? defaultAllowedHosts;\n            const allowedOrigins = options?.allowedOrigins ?? allowedHosts;\n            if (!hostHeaderValidation(allowedHosts)(req, res)) return;\n            if (!originValidation(allowedOrigins)(req, res)) return;\n          }\n\n          let legacyRequest = true;\n          if (frameworkAgent) {\n            modernAdapter = createModernMcpServerAdapter(frameworkAgent);\n            legacyRequest = await modernAdapter.isLegacyRequest(req, parsedBody);\n          }\n\n          if (legacyRequest) {\n            const transport = new StreamableHTTPServerTransport({\n              sessionIdGenerator: undefined,\n            });\n            await agentServer.connect(transport);\n            // The stream was consumed for era classification, so always pass\n            // the parsed body when one was available.\n            if (parsedBody !== undefined) {\n              await transport.handleRequest(req, res, parsedBody);\n            } else {\n              await transport.handleRequest(req, res);\n            }\n          } else {\n            await modernAdapter!.handle(req, res, parsedBody);\n          }\n        } catch (err) {\n          console.error('Server error:', err);\n          if (!res.headersSent) {\n            res.writeHead(500, { 'Content-Type': 'application/json' });\n            res.end(JSON.stringify({ error: 'Internal server error' }));\n          }\n        } finally {\n          await modernAdapter?.close();\n          // close() here releases the transport AND (in reuseAgent mode)\n          // resets `_transport = undefined` on the cached server so the\n          // next queued request can connect. The server's tools,\n          // handlers, and idempotency wiring survive — close() clears\n          // the transport, not the registration.\n          await agentServer.close();\n        }\n      };\n\n      if (reuseAgent) {\n        const prev = reuseMutexes.get(agentServer) ?? Promise.resolve();\n        // `.then(runTransportCycle, runTransportCycle)` runs the cycle on\n        // EITHER prior outcome — we only care about sequencing, not the\n        // prior request's result. A plain `.then(runTransportCycle)`\n        // would skip this request when the prior rejected, leaving it\n        // stuck behind a poison-pill promise forever.\n        const current = prev.then(runTransportCycle, runTransportCycle);\n        // Swallow errors on the copy stored for sequencing so one\n        // rejection doesn't poison every subsequent request for this\n        // server instance. `current` itself is still awaited below and\n        // surfaces errors to THIS request.\n        reuseMutexes.set(\n          agentServer,\n          current.catch(() => {})\n        );\n        await current;\n      } else {\n        await runTransportCycle();\n      }\n    } else {\n      res.writeHead(404);\n      res.end('Not found');\n    }\n  });\n\n  const doListen = () => {\n    httpServer.listen(port, () => {\n      const actualPort = (httpServer.address() as { port: number }).port;\n      const url = `http://localhost:${actualPort}${mountPath}`;\n      if (options?.onListening) {\n        options.onListening(url);\n      } else {\n        console.log(`AdCP agent running at ${url}`);\n        console.log(`\\nTest with:\\n  npx @adcp/sdk@latest ${url}`);\n      }\n    });\n  };\n\n  if (options?.readinessCheck) {\n    options\n      .readinessCheck()\n      .then(doListen)\n      .catch((err: unknown) => {\n        const message = err instanceof Error ? err.message : String(err);\n        console.error('[adcp/serve] readinessCheck failed — aborting boot:', message);\n        process.exit(1);\n      });\n  } else {\n    doListen();\n  }\n\n  return httpServer;\n}\n\nfunction trimTrailingSlashes(s: string): string {\n  let end = s.length;\n  while (end > 0 && s.charCodeAt(end - 1) === 47 /* '/' */) end--;\n  return s.slice(0, end);\n}\n\n/**\n * Parse and validate a `publicUrl`, returning its origin. Shared by the\n * static-string path (validated once at `serve()` construction) and the\n * function path (validated lazily per unique host). A bad value from the\n * function form throws on the first request for that host, after PRM\n * resolution has already decided to fetch; the error is caught at the\n * call site and surfaced as a 500 so the operator sees the misconfigured\n * host instead of a silent audience-mismatch on minted tokens.\n */\nfunction validatePublicUrl(publicUrl: string, mountPath: string): string {\n  let parsed: URL;\n  try {\n    parsed = new URL(publicUrl);\n  } catch {\n    throw new Error(`serve(): \\`publicUrl\\` is not a valid URL: ${publicUrl}`);\n  }\n  if (trimTrailingSlashes(parsed.pathname) !== trimTrailingSlashes(mountPath)) {\n    throw new Error(\n      `serve(): \\`publicUrl\\` path (${parsed.pathname}) must match mount path (${mountPath}). ` +\n        'The public URL is the full MCP endpoint URL, including the path.'\n    );\n  }\n  return parsed.origin;\n}\n\n/**\n * Strip the port from a `host` string (`\"snap.example.com:3001\"` →\n * `\"snap.example.com\"`). Use inside `publicUrl` / `protectedResource`\n * resolvers to build scheme://host URLs without carrying the test-time\n * port into production URLs. IPv6 brackets preserved.\n */\nexport function hostname(host: string): string {\n  if (host.startsWith('[')) {\n    // IPv6 — preserve brackets, drop port after the closing bracket.\n    const end = host.indexOf(']');\n    if (end === -1) return host;\n    return host.slice(0, end + 1);\n  }\n  const colon = host.lastIndexOf(':');\n  return colon === -1 ? host : host.slice(0, colon);\n}\n\n/**\n * Resolve the canonical host the request arrived on for multi-host\n * routing and per-host PRM / audience advertisement. Same logic\n * `serve()` uses internally — exported so callers writing their own\n * host-dispatch middleware (e.g., behind `createExpressAdapter`) can\n * match `serve()`'s semantics exactly instead of re-implementing them.\n *\n * When `options.trustForwardedHost: true`, consults in order:\n *   1. `X-Forwarded-Host` (most common — Fly, Cloud Run, most ALBs).\n *   2. RFC 7239 `Forwarded: host=...` (spec-standard, less common).\n *   3. `Host`.\n *\n * When `trustForwardedHost: false` (default), only `Host` is read — an\n * attacker-controlled forwarded header can't flip the advertised OAuth\n * `resource` URL.\n *\n * **Proxy behavior matters when you opt in.** The helper trusts the\n * FIRST entry in a forwarded chain. That's safe when your proxy\n * OVERWRITES the header on ingress (rewriting the original value from\n * the client). It's UNSAFE when your proxy APPENDS — the attacker gets\n * to pick the first entry. Fly, Cloud Run, and GCP HTTPS LBs overwrite;\n * AWS ALB and nginx (by default) append. Verify your proxy's behavior\n * before enabling `trustForwardedHost`.\n *\n * Normalizes to lowercase and preserves port. Returns empty string when\n * no usable header is present (HTTP/1.1 requires `Host`, so this is\n * unusual — callers can branch on it to fail closed).\n *\n * @example\n * ```ts\n * import express from 'express';\n * import { resolveHost } from '@adcp/sdk/server';\n *\n * const routersByHost = new Map<string, express.Router>();\n *\n * function hostDispatch(req, res, next) {\n *   const host = resolveHost(req, { trustForwardedHost: true });\n *   const router = routersByHost.get(host);\n *   if (!router) return res.status(404).end();\n *   return router(req, res, next);\n * }\n * ```\n */\nexport function resolveHost(req: IncomingMessage, options?: { trustForwardedHost?: boolean }): string {\n  const trustForwardedHost = options?.trustForwardedHost === true;\n  if (trustForwardedHost) {\n    const xfh = firstHeaderValue(req.headers['x-forwarded-host']);\n    if (xfh) {\n      const first = xfh.split(',')[0]?.trim();\n      if (first) return first.toLowerCase();\n    }\n    const forwarded = firstHeaderValue(req.headers['forwarded']);\n    if (forwarded) {\n      const host = parseForwardedHost(forwarded);\n      if (host) return host.toLowerCase();\n    }\n  }\n  const host = firstHeaderValue(req.headers['host']);\n  return host ? host.toLowerCase() : '';\n}\n\n/**\n * Extract the `host=` parameter from an RFC 7239 `Forwarded:` header.\n * Takes the first (left-most) hop — same policy as the `X-Forwarded-Host`\n * chain rule above, and subject to the same \"your proxy must overwrite,\n * not append\" guarantee.\n *\n * Handles quoted-string values per RFC 7239 §4 (IPv6 literals and hosts\n * with ports must be quoted). Returns undefined when the header has no\n * `host` parameter, a malformed value, or a blank host.\n */\nfunction parseForwardedHost(header: string): string | undefined {\n  // Multi-hop: `Forwarded: for=1;host=a.example, for=2;host=b.example` —\n  // first hop is the client-facing proxy's view. Commas INSIDE quoted\n  // strings aren't separators, so a naive split would mis-parse IPv6.\n  // Scan manually, respecting quotes.\n  const firstHop = extractFirstForwardedHop(header);\n  if (!firstHop) return undefined;\n  for (const pair of firstHop.split(';')) {\n    const eq = pair.indexOf('=');\n    if (eq === -1) continue;\n    const key = pair.slice(0, eq).trim().toLowerCase();\n    if (key !== 'host') continue;\n    let value = pair.slice(eq + 1).trim();\n    if (value.startsWith('\"') && value.endsWith('\"') && value.length >= 2) {\n      value = value.slice(1, -1).replace(/\\\\(.)/g, '$1');\n    }\n    return value || undefined;\n  }\n  return undefined;\n}\n\nfunction extractFirstForwardedHop(header: string): string | undefined {\n  let depth = 0;\n  let start = 0;\n  for (let i = 0; i < header.length; i++) {\n    const ch = header[i];\n    if (ch === '\"') {\n      // Skip the quoted run, respecting backslash escapes.\n      i++;\n      while (i < header.length && header[i] !== '\"') {\n        if (header[i] === '\\\\') i++;\n        i++;\n      }\n      continue;\n    }\n    if (ch === ',' && depth === 0) {\n      return header.slice(start, i);\n    }\n  }\n  return header.slice(start).trim() || undefined;\n}\n\nfunction firstHeaderValue(value: string | string[] | undefined): string | undefined {\n  if (typeof value === 'string') return value;\n  if (Array.isArray(value) && value.length > 0) return value[0];\n  return undefined;\n}\n\nfunction attachAuthInfo(req: IncomingMessage, principal: AuthPrincipal): void {\n  // Propagate the kind-discriminated `credential` (Stage 3 of #1269) into\n  // `info.extra.credential` so the dispatcher can hoist it to top-level\n  // `ctx.authInfo.credential` and pass it to `BuyerAgentRegistry.resolve`.\n  // MCP's `extra` is `Record<string, unknown>`, so this round-trips\n  // without a wire-shape change. Adopters with custom authenticators that\n  // don't stamp `credential` see the registry resolve to `null` (no\n  // credential = no known agent), preserving Stage 2's strict opt-in.\n  //\n  // Also forward `principal.extra` — adopter-provided extension data stamped\n  // in the `verify` callback. This surfaces as `BuyerAgentResolveInput.extra`\n  // in `BuyerAgentRegistry.resolve` (see buyer-agent.ts). `credential` is\n  // always spread last so an adopter cannot overwrite the framework-stamped\n  // credential via their `extra` object.\n  const baseExtra = principal.claims !== undefined ? { ...principal.claims } : undefined;\n  const adopterExtra =\n    typeof principal.extra === 'object' && principal.extra !== null\n      ? (principal.extra as Record<string, unknown>)\n      : undefined;\n  const hasExtra = baseExtra !== undefined || adopterExtra !== undefined || principal.credential !== undefined;\n  const extra = hasExtra\n    ? {\n        ...(baseExtra ?? {}),\n        ...(adopterExtra ?? {}),\n        // credential last — prevents an adopter's `extra.credential` from\n        // overwriting the framework-enforced kind-discriminated credential.\n        ...(principal.credential !== undefined ? { credential: principal.credential } : {}),\n      }\n    : undefined;\n  const info: AuthInfo = {\n    token: principal.token ?? '',\n    clientId: principal.principal,\n    scopes: principal.scopes ?? [],\n    ...(principal.expiresAt !== undefined ? { expiresAt: principal.expiresAt } : {}),\n    ...(extra !== undefined ? { extra } : {}),\n  };\n  (req as IncomingMessage & { auth?: AuthInfo }).auth = info;\n}\n\nfunction bufferBody(req: import('http').IncomingMessage, maxBytes: number): Promise<string> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    req.on('data', chunk => {\n      size += chunk.length;\n      if (size > maxBytes) {\n        reject(new Error(`Request body exceeded ${maxBytes} bytes`));\n        req.destroy();\n        return;\n      }\n      chunks.push(chunk as Buffer);\n    });\n    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));\n    req.on('error', reject);\n  });\n}\n"],"mappings":";;;;;;AAoBA,SAAS,qCAAqC;AAC9C,SAAS,aAAa,yBAAyB;AAC/C,SAAS,sBAAsB,wBAAwB;AACvD,SAAS,oBAAqE;AAG9E,SAAS,yBAAyB;AAGlC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB,4BAAmD;AAChF,SAAS,oBAAqC;AAC9C,SAAS,oCAAoC;AAoCtC,MAAM,yBAAyB,MAAM;AAAA,EAC1C,YAAY,UAAU,gBAAgB;AACpC,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAoOO,SAAS,MAAM,aAA4D,SAAoC;AACpH,QAAM,UAAU,QAAQ,IAAI,OAAO,SAAS,QAAQ,IAAI,MAAM,EAAE,IAAI;AACpE,MAAI,YAAY,WAAc,OAAO,MAAM,OAAO,KAAK,UAAU,KAAK,UAAU,QAAQ;AACtF,UAAM,IAAI,MAAM,uCAAuC,QAAQ,IAAI,IAAI,GAAG;AAAA,EAC5E;AACA,QAAM,OAAO,SAAS,QAAQ,WAAW;AACzC,QAAM,YAAY,SAAS,QAAQ;AACnC,QAAM,YAAY,SAAS,aAAa,IAAI,kBAAkB;AAC9D,QAAM,qBAAqB,SAAS,uBAAuB;AAC3D,QAAM,aAAa,SAAS,eAAe;AAC3C,QAAM,kBAAkB,SAAS,mBAAmB,IAAI,OAAO;AAC/D,MAAI,CAAC,OAAO,cAAc,eAAe,KAAK,mBAAmB,GAAG;AAClE,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAUA,QAAM,eAAe,oBAAI,QAAkD;AAE3E,MAAI,SAAS,qBAAqB,CAAC,QAAQ,WAAW;AACpD,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,kBAAkB,SAAS;AACjC,QAAM,0BAA0B,SAAS;AACzC,QAAM,gBAAgB,OAAO,oBAAoB;AACjD,QAAM,UAAU,OAAO,4BAA4B;AAInD,MAAI;AACJ,MAAI,OAAO,oBAAoB,UAAU;AACvC,yBAAqB,kBAAkB,iBAAiB,SAAS;AAAA,EACnE;AAKA,QAAM,iBAAiB,oBAAI,IAAoB;AAC/C,QAAM,oBAAoB,oBAAI,IAAoB;AAClD,QAAM,WAAW,oBAAI,IAAuC;AAE5D,QAAM,mBAAmB,CAAC,SAAqC;AAC7D,QAAI,OAAO,oBAAoB,SAAU,QAAO;AAChD,QAAI,CAAC,cAAe,QAAO;AAC3B,QAAI,SAAS,eAAe,IAAI,IAAI;AACpC,QAAI,WAAW,OAAW,QAAO;AACjC,aAAU,gBAA0C,IAAI;AACxD,UAAM,SAAS,kBAAkB,QAAQ,SAAS;AAClD,mBAAe,IAAI,MAAM,MAAM;AAC/B,sBAAkB,IAAI,MAAM,MAAM;AAClC,WAAO;AAAA,EACT;AAEA,QAAM,sBAAsB,CAAC,SAAqC;AAChE,QAAI,OAAO,oBAAoB,SAAU,QAAO;AAEhD,QAAI,iBAAiB,IAAI,KAAK,KAAM,QAAO;AAC3C,WAAO,kBAAkB,IAAI,IAAI;AAAA,EACnC;AAEA,QAAM,2BAA2B,CAAC,SAAwD;AACxF,QAAI,CAAC,wBAAyB,QAAO;AACrC,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,SAAS,SAAS,IAAI,IAAI;AAC9B,QAAI,WAAW,OAAW,QAAO;AACjC,aAAU,wBAAqE,IAAI;AACnF,aAAS,IAAI,MAAM,MAAM;AACzB,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,gBAAgB,QAAQ,QAAQ,IAAI,aAAa,cAAc;AAC1E,YAAQ;AAAA,MACN;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,uBAAuB,SAAS;AAEtC,QAAM,wBAAwB,wCAAwC,SAAS;AAE/E,QAAM,aAAa,aAAa,OAAO,KAAK,QAAQ;AAClD,UAAM,EAAE,SAAS,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,kBAAkB;AAC9D,UAAM,OAAO,YAAY,KAAK,EAAE,mBAAmB,CAAC;AAIpD,QAAI,2BAA2B,aAAa,uBAAuB;AACjE,UAAI;AACJ,UAAI;AACJ,UAAI;AACF,mBAAW,iBAAiB,IAAI;AAChC,cAAM,yBAAyB,IAAI;AAAA,MACrC,SAAS,KAAK;AACZ,YAAI,eAAe,kBAAkB;AAInC,cAAI,UAAU,GAAG;AACjB,cAAI,IAAI,WAAW;AACnB;AAAA,QACF;AACA,gBAAQ,MAAM,6DAA6D,GAAG;AAC9E,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,yDAAyD,CAAC,CAAC;AAC3F;AAAA,MACF;AACA,UAAI,CAAC,YAAY,CAAC,KAAK;AAKrB,YAAI,UAAU,GAAG;AACjB,YAAI,IAAI,WAAW;AACnB;AAAA,MACF;AACA,YAAM,OAAO;AAAA,QACX;AAAA,QACA,GAAG;AAAA,QACH,0BAA0B,IAAI,4BAA4B,CAAC,QAAQ;AAAA,MACrE;AACA,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,IAAI,CAAC;AAC5B;AAAA,IACF;AAEA,QAAI,aAAa,aAAa,aAAa,GAAG,SAAS,KAAK;AAQ1D,UAAI;AACJ,UAAI;AACJ,UAAI;AACF,4BAAoB,iBAAiB,IAAI;AAAA,MAC3C,SAAS,KAAK;AACZ,YAAI,eAAe,kBAAkB;AACnC,cAAI,UAAU,GAAG;AACjB,cAAI,IAAI,WAAW;AACnB;AAAA,QACF;AACA,gBAAQ,MAAM,2CAA2C,GAAG;AAC5D,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,yDAAyD,CAAC,CAAC;AAC3F;AAAA,MACF;AACA,UAAI,yBAAyB;AAC3B,cAAM,aAAa,oBAAoB,IAAI;AAC3C,YAAI,WAAY,uBAAsB,GAAG,UAAU,GAAG,qBAAqB;AAAA,MAC7E;AAQA,YAAM,sBAA2C,oBAC7C,EAAE,MAAM,WAAW,kBAAkB,IACrC,EAAE,KAAK;AACX,MAAC,IAAiF,0BAA0B,IAC1G;AAKF,UAAI;AACJ,UAAI;AACJ,UAAI,kBAAkB;AACtB,YAAM,gBAAgB,YAA2B;AAC/C,YAAI,YAAY,OAAW;AAC3B,kBAAU,MAAM,WAAW,KAAK,eAAe;AAC/C,QAAC,IAA6B,UAAU;AACxC,YAAI,QAAQ,SAAS,GAAG;AACtB,cAAI;AACF,yBAAa,KAAK,MAAM,OAAO;AAAA,UACjC,QAAQ;AACN,8BAAkB;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AAKA,UAAI,0BAA0B,SAAS,YAAY,GAAG;AACpD,YAAI;AACF,gBAAM,cAAc;AAAA,QACtB,SAAS,KAAK;AAIZ,gBAAM,UAAW,IAAc,QAAQ;AACvC,kBAAQ,MAAM,sDAAsD,OAAO,EAAE;AAC7E,cAAI,CAAC,IAAI,aAAa;AACpB,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI,IAAI,KAAK,UAAU,EAAE,OAAO,4BAA4B,CAAC,CAAC;AAAA,UAChE;AACA;AAAA,QACF;AAAA,MACF;AAGA,UAAI,SAAS,cAAc;AACzB,YAAI;AACJ,YAAI;AACF,sBAAY,MAAM,QAAQ,aAAa,GAAG;AAAA,QAC5C,SAAS,KAAK;AAEZ,gBAAM,gBAAgB,eAAe,YAAY,IAAI,gBAAgB;AACrE,kBAAQ,MAAM,yBAAyB,GAAG;AAO1C,gBAAM,gBAAgB,4BAA4B,GAAG;AACrD,cAAI,eAAe;AACjB,gCAAoB,KAAK,KAAK;AAAA,cAC5B,gBAAgB;AAAA,cAChB,kBAAkB;AAAA,cAClB,kBAAkB;AAAA,YACpB,CAAC;AACD;AAAA,UACF;AACA,8BAAoB,KAAK,KAAK;AAAA,YAC5B,OAAO;AAAA,YACP,kBAAkB;AAAA,YAClB,kBAAkB;AAAA,UACpB,CAAC;AACD;AAAA,QACF;AACA,YAAI,CAAC,WAAW;AACd,8BAAoB,KAAK,KAAK;AAAA,YAC5B,OAAO;AAAA,YACP,kBAAkB;AAAA,YAClB,kBAAkB;AAAA,UACpB,CAAC;AACD;AAAA,QACF;AAEA,uBAAe,KAAK,SAAS;AAAA,MAC/B;AAOA,UAAI;AACJ,UAAI;AACF,sBAAc,YAAY,EAAE,WAAW,KAAK,CAAC;AAAA,MAC/C,SAAS,KAAK;AACZ,YAAI,eAAe,kBAAkB;AAInC,cAAI,UAAU,GAAG;AACjB,cAAI,IAAI,WAAW;AACnB;AAAA,QACF;AAKA,gBAAQ,MAAM,+BAA+B,GAAG;AAChD,YAAI,CAAC,IAAI,aAAa;AACpB,cAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,cAAI,IAAI,KAAK,UAAU,EAAE,OAAO,wBAAwB,CAAC,CAAC;AAAA,QAC5D;AACA;AAAA,MACF;AAYA,UAAI,cAAe,YAAmD,oBAAoB,MAAM,MAAM;AACpG,cAAM,OACJ;AACF,gBAAQ;AAAA,UACN,0NAEE;AAAA,QACJ;AACA,YAAI,CAAC,IAAI,aAAa;AACpB,cAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,cAAI;AAAA,YACF,KAAK,UAAU;AAAA,cACb,OAAO;AAAA,cACP;AAAA,YACF,CAAC;AAAA,UACH;AAAA,QACF;AACA;AAAA,MACF;AACA,YAAM,WAAY,YAAmD,kBAAkB;AACvF,YAAM,wBAAwB,OAAO,aAAa,aAAc,WAAgC;AAChG,YAAM,qBAAqB,wBAAwB;AAEnD,UAAI,oBAAoB;AACtB,YAAI;AACF,gBAAM,cAAc;AACpB,gBAAM,UAAU,MAAM,mBAAmB,KAA8D,GAAG;AAC1G,cAAI,SAAS;AAGX,kBAAM,YAAY,MAAM;AACxB;AAAA,UACF;AAAA,QACF,SAAS,KAAK;AAEZ,gBAAM,UAAW,IAAc,QAAQ;AACvC,gBAAM,UAAW,IAA0B,QAAQ;AACnD,kBAAQ,MAAM,kCAAkC,OAAO,KAAK,OAAO,GAAG;AACtE,cAAI,CAAC,IAAI,aAAa;AACpB,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI,IAAI,KAAK,UAAU,EAAE,OAAO,wBAAwB,CAAC,CAAC;AAAA,UAC5D;AACA,gBAAM,YAAY,MAAM;AACxB;AAAA,QACF;AAAA,MACF;AASA,YAAM,oBAAoB,YAA2B;AACnD,YAAI;AACJ,YAAI;AAMF,gBAAM,cAAc;AAEpB,cAAI,IAAI,QAAQ,YAAY,MAAM,UAAU,CAAC,kBAAkB,IAAI,QAAQ,cAAc,CAAC,GAAG;AAC3F,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI;AAAA,cACF,KAAK,UAAU;AAAA,gBACb,SAAS;AAAA,gBACT,OAAO,EAAE,MAAM,OAAQ,SAAS,gEAAgE;AAAA,gBAChG,IAAI;AAAA,cACN,CAAC;AAAA,YACH;AACA;AAAA,UACF;AAEA,cAAI,IAAI,QAAQ,YAAY,MAAM,WAAW,mBAAmB,SAAS,WAAW,IAAI;AACtF,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI;AAAA,cACF,KAAK,UAAU;AAAA,gBACb,SAAS;AAAA,gBACT,OAAO,EAAE,MAAM,aAAa,SAAS,8CAA8C;AAAA,gBACnF,IAAI;AAAA,cACN,CAAC;AAAA,YACH;AACA;AAAA,UACF;AAMA,gBAAM,iBAAiB,aAAa,WAAW,IAAI,cAAc;AACjE,cAAI,gBAAgB;AAClB,kBAAM,sBAAsB,oBACxB,CAAC,IAAI,IAAI,iBAAiB,EAAE,QAAQ,IACpC,CAAC,aAAa,aAAa,OAAO;AACtC,kBAAM,eAAe,SAAS,gBAAgB;AAC9C,kBAAM,iBAAiB,SAAS,kBAAkB;AAClD,gBAAI,CAAC,qBAAqB,YAAY,EAAE,KAAK,GAAG,EAAG;AACnD,gBAAI,CAAC,iBAAiB,cAAc,EAAE,KAAK,GAAG,EAAG;AAAA,UACnD;AAEA,cAAI,gBAAgB;AACpB,cAAI,gBAAgB;AAClB,4BAAgB,6BAA6B,cAAc;AAC3D,4BAAgB,MAAM,cAAc,gBAAgB,KAAK,UAAU;AAAA,UACrE;AAEA,cAAI,eAAe;AACjB,kBAAM,YAAY,IAAI,8BAA8B;AAAA,cAClD,oBAAoB;AAAA,YACtB,CAAC;AACD,kBAAM,YAAY,QAAQ,SAAS;AAGnC,gBAAI,eAAe,QAAW;AAC5B,oBAAM,UAAU,cAAc,KAAK,KAAK,UAAU;AAAA,YACpD,OAAO;AACL,oBAAM,UAAU,cAAc,KAAK,GAAG;AAAA,YACxC;AAAA,UACF,OAAO;AACL,kBAAM,cAAe,OAAO,KAAK,KAAK,UAAU;AAAA,UAClD;AAAA,QACF,SAAS,KAAK;AACZ,kBAAQ,MAAM,iBAAiB,GAAG;AAClC,cAAI,CAAC,IAAI,aAAa;AACpB,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI,IAAI,KAAK,UAAU,EAAE,OAAO,wBAAwB,CAAC,CAAC;AAAA,UAC5D;AAAA,QACF,UAAE;AACA,gBAAM,eAAe,MAAM;AAM3B,gBAAM,YAAY,MAAM;AAAA,QAC1B;AAAA,MACF;AAEA,UAAI,YAAY;AACd,cAAM,OAAO,aAAa,IAAI,WAAW,KAAK,QAAQ,QAAQ;AAM9D,cAAM,UAAU,KAAK,KAAK,mBAAmB,iBAAiB;AAK9D,qBAAa;AAAA,UACX;AAAA,UACA,QAAQ,MAAM,MAAM;AAAA,UAAC,CAAC;AAAA,QACxB;AACA,cAAM;AAAA,MACR,OAAO;AACL,cAAM,kBAAkB;AAAA,MAC1B;AAAA,IACF,OAAO;AACL,UAAI,UAAU,GAAG;AACjB,UAAI,IAAI,WAAW;AAAA,IACrB;AAAA,EACF,CAAC;AAED,QAAM,WAAW,MAAM;AACrB,eAAW,OAAO,MAAM,MAAM;AAC5B,YAAM,aAAc,WAAW,QAAQ,EAAuB;AAC9D,YAAM,MAAM,oBAAoB,UAAU,GAAG,SAAS;AACtD,UAAI,SAAS,aAAa;AACxB,gBAAQ,YAAY,GAAG;AAAA,MACzB,OAAO;AACL,gBAAQ,IAAI,yBAAyB,GAAG,EAAE;AAC1C,gBAAQ,IAAI;AAAA;AAAA,yBAAwC,GAAG,EAAE;AAAA,MAC3D;AAAA,IACF,CAAC;AAAA,EACH;AAEA,MAAI,SAAS,gBAAgB;AAC3B,YACG,eAAe,EACf,KAAK,QAAQ,EACb,MAAM,CAAC,QAAiB;AACvB,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,cAAQ,MAAM,4DAAuD,OAAO;AAC5E,cAAQ,KAAK,CAAC;AAAA,IAChB,CAAC;AAAA,EACL,OAAO;AACL,aAAS;AAAA,EACX;AAEA,SAAO;AACT;AAEA,SAAS,oBAAoB,GAAmB;AAC9C,MAAI,MAAM,EAAE;AACZ,SAAO,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC,MAAM,GAAc;AAC1D,SAAO,EAAE,MAAM,GAAG,GAAG;AACvB;AAWA,SAAS,kBAAkB,WAAmB,WAA2B;AACvE,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,SAAS;AAAA,EAC5B,QAAQ;AACN,UAAM,IAAI,MAAM,8CAA8C,SAAS,EAAE;AAAA,EAC3E;AACA,MAAI,oBAAoB,OAAO,QAAQ,MAAM,oBAAoB,SAAS,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR,gCAAgC,OAAO,QAAQ,4BAA4B,SAAS;AAAA,IAEtF;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAQO,SAAS,SAAS,MAAsB;AAC7C,MAAI,KAAK,WAAW,GAAG,GAAG;AAExB,UAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,QAAI,QAAQ,GAAI,QAAO;AACvB,WAAO,KAAK,MAAM,GAAG,MAAM,CAAC;AAAA,EAC9B;AACA,QAAM,QAAQ,KAAK,YAAY,GAAG;AAClC,SAAO,UAAU,KAAK,OAAO,KAAK,MAAM,GAAG,KAAK;AAClD;AA6CO,SAAS,YAAY,KAAsB,SAAoD;AACpG,QAAM,qBAAqB,SAAS,uBAAuB;AAC3D,MAAI,oBAAoB;AACtB,UAAM,MAAM,iBAAiB,IAAI,QAAQ,kBAAkB,CAAC;AAC5D,QAAI,KAAK;AACP,YAAM,QAAQ,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACtC,UAAI,MAAO,QAAO,MAAM,YAAY;AAAA,IACtC;AACA,UAAM,YAAY,iBAAiB,IAAI,QAAQ,WAAW,CAAC;AAC3D,QAAI,WAAW;AACb,YAAMA,QAAO,mBAAmB,SAAS;AACzC,UAAIA,MAAM,QAAOA,MAAK,YAAY;AAAA,IACpC;AAAA,EACF;AACA,QAAM,OAAO,iBAAiB,IAAI,QAAQ,MAAM,CAAC;AACjD,SAAO,OAAO,KAAK,YAAY,IAAI;AACrC;AAYA,SAAS,mBAAmB,QAAoC;AAK9D,QAAM,WAAW,yBAAyB,MAAM;AAChD,MAAI,CAAC,SAAU,QAAO;AACtB,aAAW,QAAQ,SAAS,MAAM,GAAG,GAAG;AACtC,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,OAAO,GAAI;AACf,UAAM,MAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY;AACjD,QAAI,QAAQ,OAAQ;AACpB,QAAI,QAAQ,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AACpC,QAAI,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,KAAK,MAAM,UAAU,GAAG;AACrE,cAAQ,MAAM,MAAM,GAAG,EAAE,EAAE,QAAQ,UAAU,IAAI;AAAA,IACnD;AACA,WAAO,SAAS;AAAA,EAClB;AACA,SAAO;AACT;AAEA,SAAS,yBAAyB,QAAoC;AACpE,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,KAAK,OAAO,CAAC;AACnB,QAAI,OAAO,KAAK;AAEd;AACA,aAAO,IAAI,OAAO,UAAU,OAAO,CAAC,MAAM,KAAK;AAC7C,YAAI,OAAO,CAAC,MAAM,KAAM;AACxB;AAAA,MACF;AACA;AAAA,IACF;AACA,QAAI,OAAO,OAAO,UAAU,GAAG;AAC7B,aAAO,OAAO,MAAM,OAAO,CAAC;AAAA,IAC9B;AAAA,EACF;AACA,SAAO,OAAO,MAAM,KAAK,EAAE,KAAK,KAAK;AACvC;AAEA,SAAS,iBAAiB,OAA0D;AAClF,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,QAAO,MAAM,CAAC;AAC5D,SAAO;AACT;AAEA,SAAS,eAAe,KAAsB,WAAgC;AAc5E,QAAM,YAAY,UAAU,WAAW,SAAY,EAAE,GAAG,UAAU,OAAO,IAAI;AAC7E,QAAM,eACJ,OAAO,UAAU,UAAU,YAAY,UAAU,UAAU,OACtD,UAAU,QACX;AACN,QAAM,WAAW,cAAc,UAAa,iBAAiB,UAAa,UAAU,eAAe;AACnG,QAAM,QAAQ,WACV;AAAA,IACE,GAAI,aAAa,CAAC;AAAA,IAClB,GAAI,gBAAgB,CAAC;AAAA;AAAA;AAAA,IAGrB,GAAI,UAAU,eAAe,SAAY,EAAE,YAAY,UAAU,WAAW,IAAI,CAAC;AAAA,EACnF,IACA;AACJ,QAAM,OAAiB;AAAA,IACrB,OAAO,UAAU,SAAS;AAAA,IAC1B,UAAU,UAAU;AAAA,IACpB,QAAQ,UAAU,UAAU,CAAC;AAAA,IAC7B,GAAI,UAAU,cAAc,SAAY,EAAE,WAAW,UAAU,UAAU,IAAI,CAAC;AAAA,IAC9E,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC;AAAA,EACzC;AACA,EAAC,IAA8C,OAAO;AACxD;AAEA,SAAS,WAAW,KAAqC,UAAmC;AAC1F,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAmB,CAAC;AAC1B,QAAI,OAAO;AACX,QAAI,GAAG,QAAQ,WAAS;AACtB,cAAQ,MAAM;AACd,UAAI,OAAO,UAAU;AACnB,eAAO,IAAI,MAAM,yBAAyB,QAAQ,QAAQ,CAAC;AAC3D,YAAI,QAAQ;AACZ;AAAA,MACF;AACA,aAAO,KAAK,KAAe;AAAA,IAC7B,CAAC;AACD,QAAI,GAAG,OAAO,MAAM,QAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC,CAAC;AACnE,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;","names":["host"]}
+{"version":3,"sources":["../../../src/lib/server/serve.ts"],"sourcesContent":["/**\n * One-liner HTTP server for AdCP MCP agents.\n *\n * Wraps the StreamableHTTPServerTransport + http.createServer boilerplate\n * so agent builders can focus on business logic.\n *\n * @example\n * ```typescript\n * import { createTaskCapableServer, serve } from '@adcp/sdk';\n *\n * function createAgent({ taskStore }) {\n *   const server = createTaskCapableServer('My Agent', '1.0.0', { taskStore });\n *   server.registerTool('get_signals', { description: 'Discover audiences.', inputSchema: schema }, handler);\n *   return server;\n * }\n *\n * serve(createAgent); // listening on http://localhost:3001/mcp\n * ```\n */\n\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\nimport { PARSE_ERROR, isJsonContentType } from '@modelcontextprotocol/server';\nimport { hostHeaderValidation, originValidation } from '@modelcontextprotocol/node';\nimport { createServer, type IncomingMessage, type Server as HttpServer } from 'http';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { TaskStore } from '@modelcontextprotocol/sdk/experimental/tasks/interfaces.js';\nimport { InMemoryTaskStore } from '@modelcontextprotocol/sdk/experimental/tasks/stores/in-memory.js';\nimport type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';\nimport type { AuthPrincipal, Authenticator, ServeRequestContext } from './auth';\nimport {\n  ADCP_SERVE_REQUEST_CONTEXT,\n  AuthError,\n  authenticatorNeedsRawBody,\n  respondUnauthorized,\n  signatureErrorCodeFromCause,\n} from './auth';\nimport { ADCP_PRE_TRANSPORT, ADCP_INSTRUCTIONS_FN, type AdcpPreTransport } from './create-adcp-server';\nimport { isAdcpServer, type AdcpServer } from './adcp-server';\nimport { createModernMcpServerAdapter } from './mcp-modern-server';\n\n/**\n * Context passed to the agent factory on each request.\n *\n * Contains shared resources that must survive across stateless HTTP requests,\n * such as the task store for MCP Tasks protocol support.\n *\n * For multi-tenant / multi-host deployments, provide a custom `TaskStore` via\n * `ServeOptions` that enforces tenant/session scoping, and branch on\n * {@link host} inside your factory to return host-specific handlers.\n */\nexport interface ServeContext {\n  /** Shared task store — use this when creating your McpServer so tasks persist across requests. */\n  taskStore: TaskStore;\n  /**\n   * Canonical host the request arrived on, lowercased with port preserved\n   * (e.g. `snap.example.com`, `localhost:3001`). Resolved from\n   * `X-Forwarded-Host` when `ServeOptions.trustForwardedHost` is true,\n   * otherwise from the `Host` header. Empty string when neither header\n   * is present (unusual — HTTP/1.1 requires `Host`).\n   *\n   * Use this in the factory to branch on hostname when a single process\n   * fronts multiple agents. The same string is passed to\n   * `publicUrl` / `protectedResource` resolver functions.\n   */\n  host: string;\n}\n\n/**\n * Thrown from an agent factory (or a `publicUrl` / `protectedResource`\n * resolver) when the incoming request's host isn't configured. `serve()`\n * catches it and responds 404 with a generic body — the adapter routing\n * table never crosses the wire. Any other thrown error still surfaces\n * as 500 so unrelated bugs stay loud.\n */\nexport class UnknownHostError extends Error {\n  constructor(message = 'Unknown host') {\n    super(message);\n    this.name = 'UnknownHostError';\n  }\n}\n\n/**\n * OAuth 2.0 Protected Resource Metadata (RFC 9728) advertised at\n * `/.well-known/oauth-protected-resource<mountPath>`.\n *\n * The `resource` URL itself is taken from `ServeOptions.publicUrl` — set\n * that to the canonical MCP endpoint (e.g. `https://my-agent.example.com/mcp`)\n * so clients request tokens bound to the right RFC 8707 audience.\n */\nexport interface ProtectedResourceMetadata {\n  /** URLs of authorization servers that issue tokens for this resource. */\n  authorization_servers: string[];\n  /** Scopes this resource accepts. Optional. */\n  scopes_supported?: string[];\n  /** Bearer token methods supported. Defaults to `['header']`. */\n  bearer_methods_supported?: Array<'header' | 'body' | 'query'>;\n  /** Human-readable resource docs URL. Optional. */\n  resource_documentation?: string;\n  /** Per-resource policy URL. Optional. */\n  resource_policy_uri?: string;\n  /** Per-resource ToS URL. Optional. */\n  resource_tos_uri?: string;\n}\n\nexport interface ServeOptions {\n  /** Port to listen on. Defaults to PORT env var or 3001. */\n  port?: number;\n  /** HTTP path to mount the MCP endpoint on. Defaults to '/mcp'. */\n  path?: string;\n  /**\n   * Hostnames allowed on framework-owned AdCP server requests, without ports.\n   * The guard runs before protocol-era classification, so it protects both\n   * legacy and MCP 2026-07-28 traffic. Defaults to the hostname from\n   * `publicUrl`, or localhost-only when no public URL is set. Public and\n   * reverse-proxied deployments must configure `publicUrl` or this allowlist;\n   * include the upstream Host too when a proxy rewrites it.\n   */\n  allowedHosts?: string[];\n  /**\n   * Origin hostnames allowed on browser-originated framework AdCP requests,\n   * across both protocol eras. Requests without Origin pass. Defaults to\n   * {@link allowedHosts}.\n   */\n  allowedOrigins?: string[];\n  /**\n   * Maximum buffered MCP request body size used for era classification.\n   * Defaults to 2 MiB. Set explicitly when an AdCP extension legitimately\n   * carries larger JSON payloads.\n   */\n  maxRequestBytes?: number;\n  /** Called when the server starts listening. */\n  onListening?: (url: string) => void;\n  /**\n   * Async check called before the server begins accepting connections.\n   * Throw to abort boot — `serve()` logs the error and calls `process.exit(1)`,\n   * so the server never enters listen mode and no traffic arrives during the\n   * check. Use to validate external dependencies (database pools, credential\n   * fetches) so a misconfigured deployment fails loudly at startup rather than\n   * silently on the first live request.\n   *\n   * @example\n   * ```ts\n   * serve(createAgent, {\n   *   readinessCheck: () => store.probe(),\n   * });\n   * ```\n   */\n  readinessCheck?: () => Promise<void>;\n  /**\n   * Custom task store. Defaults to a shared InMemoryTaskStore.\n   *\n   * The default InMemoryTaskStore only evicts tasks that have a TTL set.\n   * For long-running servers, always set `ttl` when creating tasks, or\n   * provide a store with automatic eviction to prevent unbounded memory growth.\n   */\n  taskStore?: TaskStore;\n\n  /**\n   * Canonical public URL of this MCP endpoint (e.g. `https://my-agent.example.com/mcp`).\n   * Required when `protectedResource` is configured — the RFC 9728 `resource`\n   * field, the RFC 6750 `resource_metadata` URL on 401 challenges, and the\n   * JWT audience your tokens must carry are all derived from it. Setting this\n   * defends against attacker-controlled `Host` header phishing: without it,\n   * the server would advertise whatever host a caller happened to send.\n   *\n   * Must be an absolute https:// URL whose path matches the mount path.\n   *\n   * **Multi-host.** Pass a function `(host) => string` when one process\n   * fronts multiple hostnames (white-label publishers, multi-brand\n   * adapters). The resolver runs per unique host — the returned URL is\n   * cached and used as the RFC 9728 `resource`, the 401-challenge\n   * `resource_metadata`, and the JWT audience for that host. Each\n   * resolved URL's path must match the mount path, same as the static\n   * form. Setting {@link trustForwardedHost} is recommended when\n   * behind a proxy.\n   */\n  publicUrl?: string | ((host: string) => string);\n\n  /**\n   * Authentication middleware applied to every request. When configured,\n   * missing or invalid credentials produce a 401 with a compliant\n   * `WWW-Authenticate` header — no request reaches the MCP transport\n   * without passing. Use helpers from `./auth`: `verifyApiKey`,\n   * `verifyBearer`, or `anyOf(verifyApiKey(...), verifyBearer(...))`.\n   */\n  authenticate?: Authenticator;\n\n  /**\n   * Advertise OAuth 2.0 protected-resource metadata at\n   * `/.well-known/oauth-protected-resource<mountPath>`. Requires {@link publicUrl}.\n   *\n   * Pass a function `(host) => ProtectedResourceMetadata` for multi-host\n   * deployments whose authorization servers or supported scopes vary per\n   * hostname (e.g., each white-label seller has its own AS). The resolver\n   * runs once per unique host and the result is cached. The static form\n   * still works when every host uses the same PRM body.\n   */\n  protectedResource?: ProtectedResourceMetadata | ((host: string) => ProtectedResourceMetadata);\n\n  /**\n   * Reuse the agent returned by the factory across requests instead of\n   * closing it after each. Default `false` (one fresh server per\n   * request — the pre-existing behavior).\n   *\n   * When `true`, `serve()` DOES NOT call `agentServer.close()` between\n   * requests. The factory is still called on every request; it's the\n   * caller's responsibility to cache `AdcpServer` instances (typically\n   * keyed on `ctx.host`) and return the cached instance when possible.\n   * Concurrent requests to the same cached server are serialized per\n   * instance — `McpServer.connect()` rejects when a transport is\n   * already attached, so the framework wraps the\n   * connect→handleRequest→release cycle in a per-instance async\n   * mutex. Requests for DIFFERENT cached servers still run in parallel.\n   *\n   * Use when `createAdcpServer(...)` setup cost (tool registration,\n   * handler wiring) is a measurable portion of request latency — common\n   * in multi-host deployments with many tools per host. Trade-off:\n   * throughput per unique host drops to 1 in flight at a time. For\n   * higher concurrency per host, cache a small pool of servers in the\n   * factory and round-robin.\n   *\n   * Cleanup is the caller's responsibility: listen for the process\n   * shutdown signal and call `close()` on every cached server to\n   * release MCP Tasks timers, HTTP keepalives, etc.\n   *\n   * **Incompatible with long-lived server→client streams.** MCP's\n   * `Protocol._onclose` aborts in-flight handlers and clears progress\n   * tokens when the transport closes. In stateless HTTP mode (the\n   * default this helper uses) each request is already single-response,\n   * so this is a no-op concern. Don't enable `reuseAgent` if you\n   * eventually wire a transport that keeps an SSE channel open across\n   * multiple logical requests.\n   */\n  reuseAgent?: boolean;\n\n  /**\n   * Trust `X-Forwarded-Host` and RFC 7239 `Forwarded: host=...` for\n   * host resolution and for reconstructing the public URL on 401\n   * challenges. Default `false` — an attacker-controlled header can't\n   * flip the advertised OAuth `resource` URL unless you opt in.\n   *\n   * **Your proxy must OVERWRITE the forwarded headers on ingress, not\n   * append.** The framework trusts the first (left-most) entry in a\n   * chain. With an overwriting proxy that's the sanitized value; with\n   * an appending proxy it's whatever the client sent — an attacker\n   * picks it. Common behavior:\n   *\n   * - Overwrite (safe to trust): Fly.io, Cloud Run, GCP HTTPS LB.\n   * - Append (NOT safe without extra config): AWS ALB default, nginx\n   *   default. These need `proxy_set_header X-Forwarded-Host $host;`\n   *   or equivalent before enabling this flag.\n   *\n   * Verify your proxy's behavior against a request that already has\n   * `X-Forwarded-Host: attacker.example` in it before turning this on.\n   */\n  trustForwardedHost?: boolean;\n\n  /**\n   * Pre-MCP middleware — runs after authentication but before MCP transport\n   * is connected. Intended for transport-layer concerns like RFC 9421\n   * request-signature verification: the agent's body is already buffered\n   * into `(req as any).rawBody` before the middleware fires so signature\n   * verifiers can hash it without racing the transport's own body read.\n   *\n   * Return `true` to signal the middleware handled the response (e.g. a\n   * 401 with `WWW-Authenticate`); the transport is skipped. Return `false`\n   * to continue into MCP dispatch.\n   *\n   * Throwing from the middleware produces a 500 with a generic body.\n   */\n  preTransport?: (\n    req: import('http').IncomingMessage & { rawBody?: string },\n    res: import('http').ServerResponse\n  ) => Promise<boolean>;\n}\n\n/**\n * Start an HTTP server that serves an AdCP MCP agent.\n *\n * Creates a new MCP server instance per request (stateless), wires up the\n * StreamableHTTPServerTransport, and returns the underlying http.Server\n * for lifecycle control.\n *\n * A shared task store is created once and passed to the factory on every\n * request via `ServeContext`. This ensures MCP Tasks (create → poll → result)\n * work correctly across stateless HTTP requests.\n *\n * **Multi-host.** Pass functions for `publicUrl` and `protectedResource` and\n * branch on `ctx.host` in the factory to front multiple hostnames from one\n * process. The framework resolves host from `X-Forwarded-Host` (when\n * `trustForwardedHost: true`) or `Host`, threads it through `ServeContext`,\n * and caches per-host `publicUrl`/PRM so each hostname advertises its own\n * audience-bound `resource`.\n *\n * @param createAgent - Factory function that returns a configured server —\n *   either an `AdcpServer` from `createAdcpServer()` or a raw SDK `McpServer`\n *   from `createTaskCapableServer()`. Called once per request so each gets a\n *   fresh instance (a server can only be connected once). Receives a\n *   `ServeContext` with a shared `taskStore` and the resolved `host` —\n *   branch on `host` to return host-specific handlers in multi-host mode.\n *   Framework `AdcpServer` instances serve both MCP 2026-07-28 and legacy\n *   clients. Raw v1 SDK `McpServer` instances remain legacy-only so resources,\n *   prompts, Tasks, and custom transport extras are never silently dropped.\n * @param options - Port, path, and callback configuration.\n * @returns The http.Server instance. Use the `onListening` callback or\n *   listen for the 'listening' event to know when it's ready.\n */\nexport function serve(createAgent: (ctx: ServeContext) => AdcpServer | McpServer, options?: ServeOptions): HttpServer {\n  const envPort = process.env.PORT ? parseInt(process.env.PORT, 10) : undefined;\n  if (envPort !== undefined && (Number.isNaN(envPort) || envPort < 0 || envPort > 65535)) {\n    throw new Error(`Invalid PORT environment variable: \"${process.env.PORT}\"`);\n  }\n  const port = options?.port ?? envPort ?? 3001;\n  const mountPath = options?.path ?? '/mcp';\n  const taskStore = options?.taskStore ?? new InMemoryTaskStore();\n  const trustForwardedHost = options?.trustForwardedHost === true;\n  const reuseAgent = options?.reuseAgent === true;\n  const maxRequestBytes = options?.maxRequestBytes ?? 2 * 1024 * 1024;\n  if (!Number.isSafeInteger(maxRequestBytes) || maxRequestBytes <= 0) {\n    throw new Error('serve(): `maxRequestBytes` must be a positive safe integer');\n  }\n\n  // Per-instance mutex chain for `reuseAgent: true`. The MCP SDK's\n  // `Protocol.connect()` hard-throws when a transport is already\n  // attached (node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js:215),\n  // so concurrent requests that land on the same cached server would\n  // race without this. WeakMap so agents GC normally when the caller\n  // drops references. Only used when `reuseAgent` is true — the\n  // default path still creates a fresh server per request and doesn't\n  // share any state across calls.\n  const reuseMutexes = new WeakMap<AdcpServer | McpServer, Promise<unknown>>();\n\n  if (options?.protectedResource && !options.publicUrl) {\n    throw new Error(\n      'serve(): `protectedResource` requires `publicUrl` (the canonical https:// URL clients use for this MCP endpoint). ' +\n        'Without it, the server would advertise an attacker-controlled Host header as the OAuth resource URL.'\n    );\n  }\n\n  const publicUrlOption = options?.publicUrl;\n  const protectedResourceOption = options?.protectedResource;\n  const publicUrlIsFn = typeof publicUrlOption === 'function';\n  const prmIsFn = typeof protectedResourceOption === 'function';\n\n  // Static publicUrl — validate once at construction. Function form validates\n  // lazily per host so a stale factory for one host can't prevent boot.\n  let staticPublicOrigin: string | undefined;\n  if (typeof publicUrlOption === 'string') {\n    staticPublicOrigin = validatePublicUrl(publicUrlOption, mountPath);\n  }\n\n  // Per-host caches. Function-form options are pure host → value lookups,\n  // so memoization is safe and avoids the per-request allocation of\n  // `new URL(...)` plus the caller's own host → config table work.\n  const publicUrlCache = new Map<string, string>();\n  const publicOriginCache = new Map<string, string>();\n  const prmCache = new Map<string, ProtectedResourceMetadata>();\n\n  const resolvePublicUrl = (host: string): string | undefined => {\n    if (typeof publicUrlOption === 'string') return publicUrlOption;\n    if (!publicUrlIsFn) return undefined;\n    let cached = publicUrlCache.get(host);\n    if (cached !== undefined) return cached;\n    cached = (publicUrlOption as (h: string) => string)(host);\n    const origin = validatePublicUrl(cached, mountPath);\n    publicUrlCache.set(host, cached);\n    publicOriginCache.set(host, origin);\n    return cached;\n  };\n\n  const resolvePublicOrigin = (host: string): string | undefined => {\n    if (typeof publicUrlOption === 'string') return staticPublicOrigin;\n    // Populate via resolvePublicUrl so both caches share a single validation pass.\n    if (resolvePublicUrl(host) == null) return undefined;\n    return publicOriginCache.get(host);\n  };\n\n  const resolveProtectedResource = (host: string): ProtectedResourceMetadata | undefined => {\n    if (!protectedResourceOption) return undefined;\n    if (!prmIsFn) return protectedResourceOption as ProtectedResourceMetadata;\n    let cached = prmCache.get(host);\n    if (cached !== undefined) return cached;\n    cached = (protectedResourceOption as (h: string) => ProtectedResourceMetadata)(host);\n    prmCache.set(host, cached);\n    return cached;\n  };\n\n  if (options?.authenticate == null && process.env.NODE_ENV === 'production') {\n    console.warn(\n      '[adcp/serve] No `authenticate` configured — this agent will accept unauthenticated requests. ' +\n        'AdCP security_baseline requires authentication in production.'\n    );\n  }\n\n  const explicitPreTransport = options?.preTransport as AdcpPreTransport | undefined;\n\n  const protectedResourcePath = `/.well-known/oauth-protected-resource${mountPath}`;\n\n  const httpServer = createServer(async (req, res) => {\n    const { pathname } = new URL(req.url || '', 'http://localhost');\n    const host = resolveHost(req, { trustForwardedHost });\n\n    // RFC 9728 protected-resource metadata — intentionally auth-free so\n    // clients can discover the authorization server before they have a token.\n    if (protectedResourceOption && pathname === protectedResourcePath) {\n      let resource: string | undefined;\n      let prm: ProtectedResourceMetadata | undefined;\n      try {\n        resource = resolvePublicUrl(host);\n        prm = resolveProtectedResource(host);\n      } catch (err) {\n        if (err instanceof UnknownHostError) {\n          // Operator signalled \"this host isn't in my routing table.\" 404\n          // lets the OAuth grader probe fall through cleanly and doesn't\n          // leak the configured host set across the wire.\n          res.writeHead(404);\n          res.end('Not found');\n          return;\n        }\n        console.error('[adcp/serve] publicUrl/protectedResource resolver failed:', err);\n        res.writeHead(500, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'Protected-resource metadata unavailable for this host.' }));\n        return;\n      }\n      if (!resource || !prm) {\n        // Fail closed: advertising a garbage resource URL would mint\n        // audience-mismatched tokens across the fleet. 404 signals \"this\n        // host doesn't publish PRM\" — the operator sees it and either\n        // wires the host up or takes it out of DNS.\n        res.writeHead(404);\n        res.end('Not found');\n        return;\n      }\n      const body = {\n        resource,\n        ...prm,\n        bearer_methods_supported: prm.bearer_methods_supported ?? ['header'],\n      };\n      res.writeHead(200, { 'Content-Type': 'application/json' });\n      res.end(JSON.stringify(body));\n      return;\n    }\n\n    if (pathname === mountPath || pathname === `${mountPath}/`) {\n      // Resolve per-request `resource_metadata` URL for 401 challenges and\n      // the per-host `publicUrl` authenticators read via\n      // {@link getServeRequestContext}. Resolving both up front means\n      // the audience callback in `verifyBearer` can never diverge from\n      // what the framework advertises in `/.well-known/...`. For static\n      // PRM this is the same string every request (pre-multi-host\n      // behavior); for function-form PRM/URL it follows the host.\n      let resourceMetadataUrl: string | undefined;\n      let resolvedPublicUrl: string | undefined;\n      try {\n        resolvedPublicUrl = resolvePublicUrl(host);\n      } catch (err) {\n        if (err instanceof UnknownHostError) {\n          res.writeHead(404);\n          res.end('Not found');\n          return;\n        }\n        console.error('[adcp/serve] publicUrl resolver failed:', err);\n        res.writeHead(500, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'Protected-resource metadata unavailable for this host.' }));\n        return;\n      }\n      if (protectedResourceOption) {\n        const hostOrigin = resolvePublicOrigin(host);\n        if (hostOrigin) resourceMetadataUrl = `${hostOrigin}${protectedResourcePath}`;\n      }\n\n      // Stamp the serve-resolved context on the request so authenticator\n      // callbacks (e.g. `verifyBearer`'s audience resolver) inherit the\n      // framework's host resolution — they MUST NOT re-derive host from\n      // raw headers, since that would diverge from what PRM advertises\n      // and let a spoofed `X-Forwarded-Host` flip the JWT audience check\n      // when `trustForwardedHost` is false.\n      const serveRequestContext: ServeRequestContext = resolvedPublicUrl\n        ? { host, publicUrl: resolvedPublicUrl }\n        : { host };\n      (req as IncomingMessage & { [ADCP_SERVE_REQUEST_CONTEXT]?: ServeRequestContext })[ADCP_SERVE_REQUEST_CONTEXT] =\n        serveRequestContext;\n\n      // Body buffering happens at most once per request. An idempotent helper\n      // lets the auth path (for signature authenticators) and the preTransport\n      // path share the buffer without re-reading a drained stream.\n      let rawBody: string | undefined;\n      let parsedBody: unknown;\n      let bodyParseFailed = false;\n      const ensureRawBody = async (): Promise<void> => {\n        if (rawBody !== undefined) return;\n        rawBody = await bufferBody(req, maxRequestBytes);\n        (req as { rawBody?: string }).rawBody = rawBody;\n        if (rawBody.length > 0) {\n          try {\n            parsedBody = JSON.parse(rawBody);\n          } catch {\n            bodyParseFailed = true;\n          }\n        }\n      };\n\n      // RFC 9421 signature authenticators need `req.rawBody` for Content-Digest\n      // recompute, so buffer before authentication runs when the authenticator\n      // (or any branch of an anyOf composition) carries the needs-raw-body tag.\n      if (authenticatorNeedsRawBody(options?.authenticate)) {\n        try {\n          await ensureRawBody();\n        } catch (err) {\n          // `bufferBody` has already called `req.destroy()` on the\n          // oversize path; additional teardown here would race the\n          // response write. Write the status and return.\n          const errName = (err as Error).name || 'Error';\n          console.error(`[adcp/serve] request body read failed before auth: ${errName}`);\n          if (!res.headersSent) {\n            res.writeHead(400, { 'Content-Type': 'application/json' });\n            res.end(JSON.stringify({ error: 'Request body read failed.' }));\n          }\n          return;\n        }\n      }\n\n      // Enforce authentication before transport work.\n      if (options?.authenticate) {\n        let principal: AuthPrincipal | null;\n        try {\n          principal = await options.authenticate(req);\n        } catch (err) {\n          // Surface only sanitized messages to the client; log internal cause server-side.\n          const publicMessage = err instanceof AuthError ? err.publicMessage : 'Credentials rejected.';\n          console.error('[adcp/auth] rejected:', err);\n          // Switch challenge scheme to `Signature` when the rejection\n          // originates in the RFC 9421 verifier — the signed_requests\n          // negative-vector grader reads the error code from the\n          // `WWW-Authenticate` header, so collapsing it into the generic\n          // `Bearer error=\"invalid_token\"` challenge would surface the\n          // wrong code and fail every negative vector.\n          const signatureCode = signatureErrorCodeFromCause(err);\n          if (signatureCode) {\n            respondUnauthorized(req, res, {\n              signatureError: signatureCode,\n              errorDescription: publicMessage,\n              resourceMetadata: resourceMetadataUrl,\n            });\n            return;\n          }\n          respondUnauthorized(req, res, {\n            error: 'invalid_token',\n            errorDescription: publicMessage,\n            resourceMetadata: resourceMetadataUrl,\n          });\n          return;\n        }\n        if (!principal) {\n          respondUnauthorized(req, res, {\n            error: 'invalid_token',\n            errorDescription: 'Missing or unrecognized credentials.',\n            resourceMetadata: resourceMetadataUrl,\n          });\n          return;\n        }\n        // Propagate to MCP transport so tool handlers see `extra.authInfo`.\n        attachAuthInfo(req, principal);\n      }\n\n      // Create the agent first so we can inspect it for an auto-wired\n      // preTransport attached by `createAdcpServer({ signedRequests })`. An\n      // explicit `options.preTransport` wins — it lets callers override the\n      // default wiring (e.g., to add request logging or swap verifier\n      // implementations).\n      let agentServer: AdcpServer | McpServer;\n      try {\n        agentServer = createAgent({ taskStore, host });\n      } catch (err) {\n        if (err instanceof UnknownHostError) {\n          // Factory signalled \"this host isn't routable.\" 404 keeps the\n          // adapter table off the wire while giving ops a clean failure\n          // mode instead of the generic-500 confusion.\n          res.writeHead(404);\n          res.end('Not found');\n          return;\n        }\n        // Unexpected factory failure — surface as 500 to the client and\n        // log server-side. Rethrowing would bubble to the createServer\n        // handler as an unhandled rejection (async callback), which\n        // could crash a node process with `--unhandled-rejections=strict`.\n        console.error('[adcp/serve] factory threw:', err);\n        if (!res.headersSent) {\n          res.writeHead(500, { 'Content-Type': 'application/json' });\n          res.end(JSON.stringify({ error: 'Internal server error' }));\n        }\n        return;\n      }\n      // Refuse `reuseAgent: true` + function-form `instructions`. The function\n      // is captured at server construction and would not re-evaluate per\n      // session under server reuse — silently degrading to \"instructions are\n      // a constant after all\" is worse than failing loud at the first request.\n      // Adopters fix this by removing `reuseAgent: true` (default factory\n      // creates a fresh agent per request, which is what the function needs)\n      // OR by passing a static string for `instructions`.\n      //\n      // The check fires when `reuseAgent: true` was declared, regardless of\n      // whether the adopter's factory actually caches. The flag is the\n      // adopter's stated intent to reuse; we can't introspect cache behavior.\n      if (reuseAgent && (agentServer as unknown as Record<symbol, unknown>)[ADCP_INSTRUCTIONS_FN] === true) {\n        const hint =\n          'Drop `reuseAgent: true` (a fresh agent per request fires the function each session) OR pass a static string for `instructions`.';\n        console.error(\n          '[adcp/serve] refusing reuseAgent: true with function-form instructions. ' +\n            'The function fires once per agent instance lifetime (at MCP initialize) and would not re-evaluate on subsequent sessions under server reuse. ' +\n            hint\n        );\n        if (!res.headersSent) {\n          res.writeHead(500, { 'Content-Type': 'application/json' });\n          res.end(\n            JSON.stringify({\n              error: 'serve(): reuseAgent is incompatible with function-form instructions',\n              hint,\n            })\n          );\n        }\n        return;\n      }\n      const attached = (agentServer as unknown as Record<symbol, unknown>)[ADCP_PRE_TRANSPORT];\n      const autoWiredPreTransport = typeof attached === 'function' ? (attached as AdcpPreTransport) : undefined;\n      const activePreTransport = explicitPreTransport ?? autoWiredPreTransport;\n\n      if (activePreTransport) {\n        try {\n          await ensureRawBody();\n          const handled = await activePreTransport(req as import('http').IncomingMessage & { rawBody?: string }, res);\n          if (handled) {\n            // PreTransport already responded (401, etc.). Close the agent\n            // before returning so the McpServer doesn't leak.\n            await agentServer.close();\n            return;\n          }\n        } catch (err) {\n          // Narrow to name+code — transport errors can embed remote URLs.\n          const errName = (err as Error).name || 'Error';\n          const errCode = (err as { code?: string }).code ?? 'unknown';\n          console.error(`preTransport middleware error: ${errName} (${errCode})`);\n          if (!res.headersSent) {\n            res.writeHead(500, { 'Content-Type': 'application/json' });\n            res.end(JSON.stringify({ error: 'Internal server error' }));\n          }\n          await agentServer.close();\n          return;\n        }\n      }\n\n      // In reuseAgent mode, serialize connect→handle→close per server\n      // instance. `McpServer.connect()` rejects when a transport is\n      // already attached (protocol.js:215), so concurrent requests on a\n      // cached server would race without this chain. Requests on\n      // DIFFERENT servers (different WeakMap keys) proceed in parallel.\n      // Outside reuseAgent mode the factory returns a fresh server per\n      // request — no shared instance, no lock needed.\n      const runTransportCycle = async (): Promise<void> => {\n        let modernAdapter: ReturnType<typeof createModernMcpServerAdapter> | undefined;\n        try {\n          // The official v2 classifier and Node adapter both need the parsed\n          // body after auth/signing middleware may have drained the stream.\n          // Buffer once, then pass the same parsed value to whichever era owns\n          // the request. Malformed JSON and unsupported media types fail before\n          // either protocol era receives a drained request stream.\n          await ensureRawBody();\n\n          if (req.method?.toUpperCase() === 'POST' && !isJsonContentType(req.headers['content-type'])) {\n            res.writeHead(415, { 'Content-Type': 'application/json' });\n            res.end(\n              JSON.stringify({\n                jsonrpc: '2.0',\n                error: { code: -32000, message: 'Unsupported Media Type: Content-Type must be application/json' },\n                id: null,\n              })\n            );\n            return;\n          }\n\n          if (req.method?.toUpperCase() === 'POST' && (bodyParseFailed || rawBody?.length === 0)) {\n            res.writeHead(400, { 'Content-Type': 'application/json' });\n            res.end(\n              JSON.stringify({\n                jsonrpc: '2.0',\n                error: { code: PARSE_ERROR, message: 'Parse error: request body is not valid JSON' },\n                id: null,\n              })\n            );\n            return;\n          }\n\n          // Raw v1 SDK McpServer instances retain their complete legacy\n          // surface (resources, prompts, custom handlers, Tasks extras).\n          // Only the framework-owned AdcpServer can be mirrored losslessly\n          // onto the 2026-07-28 tool transport.\n          const frameworkAgent = isAdcpServer(agentServer) ? agentServer : undefined;\n          if (frameworkAgent) {\n            const defaultAllowedHosts = resolvedPublicUrl\n              ? [new URL(resolvedPublicUrl).hostname]\n              : ['localhost', '127.0.0.1', '[::1]'];\n            const allowedHosts = options?.allowedHosts ?? defaultAllowedHosts;\n            const allowedOrigins = options?.allowedOrigins ?? allowedHosts;\n            if (!hostHeaderValidation(allowedHosts)(req, res)) return;\n            if (!originValidation(allowedOrigins)(req, res)) return;\n          }\n\n          let legacyRequest = true;\n          if (frameworkAgent) {\n            modernAdapter = createModernMcpServerAdapter(frameworkAgent);\n            legacyRequest = await modernAdapter.isLegacyRequest(req, parsedBody);\n          }\n\n          if (legacyRequest) {\n            const transport = new StreamableHTTPServerTransport({\n              sessionIdGenerator: undefined,\n            });\n            await agentServer.connect(transport);\n            // The stream was consumed for era classification, so always pass\n            // the parsed body when one was available.\n            if (parsedBody !== undefined) {\n              await transport.handleRequest(req, res, parsedBody);\n            } else {\n              await transport.handleRequest(req, res);\n            }\n          } else {\n            await modernAdapter!.handle(req, res, parsedBody);\n          }\n        } catch (err) {\n          console.error('Server error:', err);\n          if (!res.headersSent) {\n            res.writeHead(500, { 'Content-Type': 'application/json' });\n            res.end(JSON.stringify({ error: 'Internal server error' }));\n          }\n        } finally {\n          await modernAdapter?.close();\n          // close() here releases the transport AND (in reuseAgent mode)\n          // resets `_transport = undefined` on the cached server so the\n          // next queued request can connect. The server's tools,\n          // handlers, and idempotency wiring survive — close() clears\n          // the transport, not the registration.\n          await agentServer.close();\n        }\n      };\n\n      if (reuseAgent) {\n        const prev = reuseMutexes.get(agentServer) ?? Promise.resolve();\n        // `.then(runTransportCycle, runTransportCycle)` runs the cycle on\n        // EITHER prior outcome — we only care about sequencing, not the\n        // prior request's result. A plain `.then(runTransportCycle)`\n        // would skip this request when the prior rejected, leaving it\n        // stuck behind a poison-pill promise forever.\n        const current = prev.then(runTransportCycle, runTransportCycle);\n        // Swallow errors on the copy stored for sequencing so one\n        // rejection doesn't poison every subsequent request for this\n        // server instance. `current` itself is still awaited below and\n        // surfaces errors to THIS request.\n        reuseMutexes.set(\n          agentServer,\n          current.catch(() => {})\n        );\n        await current;\n      } else {\n        await runTransportCycle();\n      }\n    } else {\n      res.writeHead(404);\n      res.end('Not found');\n    }\n  });\n\n  const doListen = () => {\n    httpServer.listen(port, () => {\n      const actualPort = (httpServer.address() as { port: number }).port;\n      const url = `http://localhost:${actualPort}${mountPath}`;\n      if (options?.onListening) {\n        options.onListening(url);\n      } else {\n        console.log(`AdCP agent running at ${url}`);\n        console.log(`\\nTest with:\\n  npx @adcp/sdk@latest ${url}`);\n      }\n    });\n  };\n\n  if (options?.readinessCheck) {\n    options\n      .readinessCheck()\n      .then(doListen)\n      .catch((err: unknown) => {\n        const message = err instanceof Error ? err.message : String(err);\n        console.error('[adcp/serve] readinessCheck failed — aborting boot:', message);\n        process.exit(1);\n      });\n  } else {\n    doListen();\n  }\n\n  return httpServer;\n}\n\nfunction trimTrailingSlashes(s: string): string {\n  let end = s.length;\n  while (end > 0 && s.charCodeAt(end - 1) === 47 /* '/' */) end--;\n  return s.slice(0, end);\n}\n\n/**\n * Parse and validate a `publicUrl`, returning its origin. Shared by the\n * static-string path (validated once at `serve()` construction) and the\n * function path (validated lazily per unique host). A bad value from the\n * function form throws on the first request for that host, after PRM\n * resolution has already decided to fetch; the error is caught at the\n * call site and surfaced as a 500 so the operator sees the misconfigured\n * host instead of a silent audience-mismatch on minted tokens.\n */\nfunction validatePublicUrl(publicUrl: string, mountPath: string): string {\n  let parsed: URL;\n  try {\n    parsed = new URL(publicUrl);\n  } catch {\n    throw new Error(`serve(): \\`publicUrl\\` is not a valid URL: ${publicUrl}`);\n  }\n  if (trimTrailingSlashes(parsed.pathname) !== trimTrailingSlashes(mountPath)) {\n    throw new Error(\n      `serve(): \\`publicUrl\\` path (${parsed.pathname}) must match mount path (${mountPath}). ` +\n        'The public URL is the full MCP endpoint URL, including the path.'\n    );\n  }\n  return parsed.origin;\n}\n\n/**\n * Strip the port from a `host` string (`\"snap.example.com:3001\"` →\n * `\"snap.example.com\"`). Use inside `publicUrl` / `protectedResource`\n * resolvers to build scheme://host URLs without carrying the test-time\n * port into production URLs. IPv6 brackets preserved.\n */\nexport function hostname(host: string): string {\n  if (host.startsWith('[')) {\n    // IPv6 — preserve brackets, drop port after the closing bracket.\n    const end = host.indexOf(']');\n    if (end === -1) return host;\n    return host.slice(0, end + 1);\n  }\n  const colon = host.lastIndexOf(':');\n  return colon === -1 ? host : host.slice(0, colon);\n}\n\n/**\n * Resolve the canonical host the request arrived on for multi-host\n * routing and per-host PRM / audience advertisement. Same logic\n * `serve()` uses internally — exported so callers writing their own\n * host-dispatch middleware (e.g., behind `createExpressAdapter`) can\n * match `serve()`'s semantics exactly instead of re-implementing them.\n *\n * When `options.trustForwardedHost: true`, consults in order:\n *   1. `X-Forwarded-Host` (most common — Fly, Cloud Run, most ALBs).\n *   2. RFC 7239 `Forwarded: host=...` (spec-standard, less common).\n *   3. `Host`.\n *\n * When `trustForwardedHost: false` (default), only `Host` is read — an\n * attacker-controlled forwarded header can't flip the advertised OAuth\n * `resource` URL.\n *\n * **Proxy behavior matters when you opt in.** The helper trusts the\n * FIRST entry in a forwarded chain. That's safe when your proxy\n * OVERWRITES the header on ingress (rewriting the original value from\n * the client). It's UNSAFE when your proxy APPENDS — the attacker gets\n * to pick the first entry. Fly, Cloud Run, and GCP HTTPS LBs overwrite;\n * AWS ALB and nginx (by default) append. Verify your proxy's behavior\n * before enabling `trustForwardedHost`.\n *\n * Normalizes to lowercase and preserves port. Returns empty string when\n * no usable header is present (HTTP/1.1 requires `Host`, so this is\n * unusual — callers can branch on it to fail closed).\n *\n * @example\n * ```ts\n * import express from 'express';\n * import { resolveHost } from '@adcp/sdk/server';\n *\n * const routersByHost = new Map<string, express.Router>();\n *\n * function hostDispatch(req, res, next) {\n *   const host = resolveHost(req, { trustForwardedHost: true });\n *   const router = routersByHost.get(host);\n *   if (!router) return res.status(404).end();\n *   return router(req, res, next);\n * }\n * ```\n */\nexport function resolveHost(req: IncomingMessage, options?: { trustForwardedHost?: boolean }): string {\n  const trustForwardedHost = options?.trustForwardedHost === true;\n  if (trustForwardedHost) {\n    const xfh = firstHeaderValue(req.headers['x-forwarded-host']);\n    if (xfh) {\n      const first = xfh.split(',')[0]?.trim();\n      if (first) return first.toLowerCase();\n    }\n    const forwarded = firstHeaderValue(req.headers['forwarded']);\n    if (forwarded) {\n      const host = parseForwardedHost(forwarded);\n      if (host) return host.toLowerCase();\n    }\n  }\n  const host = firstHeaderValue(req.headers['host']);\n  return host ? host.toLowerCase() : '';\n}\n\n/**\n * Extract the `host=` parameter from an RFC 7239 `Forwarded:` header.\n * Takes the first (left-most) hop — same policy as the `X-Forwarded-Host`\n * chain rule above, and subject to the same \"your proxy must overwrite,\n * not append\" guarantee.\n *\n * Handles quoted-string values per RFC 7239 §4 (IPv6 literals and hosts\n * with ports must be quoted). Returns undefined when the header has no\n * `host` parameter, a malformed value, or a blank host.\n */\nfunction parseForwardedHost(header: string): string | undefined {\n  // Multi-hop: `Forwarded: for=1;host=a.example, for=2;host=b.example` —\n  // first hop is the client-facing proxy's view. Commas INSIDE quoted\n  // strings aren't separators, so a naive split would mis-parse IPv6.\n  // Scan manually, respecting quotes.\n  const firstHop = extractFirstForwardedHop(header);\n  if (!firstHop) return undefined;\n  for (const pair of firstHop.split(';')) {\n    const eq = pair.indexOf('=');\n    if (eq === -1) continue;\n    const key = pair.slice(0, eq).trim().toLowerCase();\n    if (key !== 'host') continue;\n    let value = pair.slice(eq + 1).trim();\n    if (value.startsWith('\"') && value.endsWith('\"') && value.length >= 2) {\n      value = value.slice(1, -1).replace(/\\\\(.)/g, '$1');\n    }\n    return value || undefined;\n  }\n  return undefined;\n}\n\nfunction extractFirstForwardedHop(header: string): string | undefined {\n  let depth = 0;\n  let start = 0;\n  for (let i = 0; i < header.length; i++) {\n    const ch = header[i];\n    if (ch === '\"') {\n      // Skip the quoted run, respecting backslash escapes.\n      i++;\n      while (i < header.length && header[i] !== '\"') {\n        if (header[i] === '\\\\') i++;\n        i++;\n      }\n      continue;\n    }\n    if (ch === ',' && depth === 0) {\n      return header.slice(start, i);\n    }\n  }\n  return header.slice(start).trim() || undefined;\n}\n\nfunction firstHeaderValue(value: string | string[] | undefined): string | undefined {\n  if (typeof value === 'string') return value;\n  if (Array.isArray(value) && value.length > 0) return value[0];\n  return undefined;\n}\n\nfunction attachAuthInfo(req: IncomingMessage, principal: AuthPrincipal): void {\n  // Propagate the kind-discriminated `credential` (Stage 3 of #1269) into\n  // `info.extra.credential` so the dispatcher can hoist it to top-level\n  // `ctx.authInfo.credential` and pass it to `BuyerAgentRegistry.resolve`.\n  // MCP's `extra` is `Record<string, unknown>`, so this round-trips\n  // without a wire-shape change. Adopters with custom authenticators that\n  // don't stamp `credential` see the registry resolve to `null` (no\n  // credential = no known agent), preserving Stage 2's strict opt-in.\n  //\n  // Also forward `principal.extra` — adopter-provided extension data stamped\n  // in the `verify` callback. This surfaces as `BuyerAgentResolveInput.extra`\n  // in `BuyerAgentRegistry.resolve` (see buyer-agent.ts). `credential` is\n  // always spread last so an adopter cannot overwrite the framework-stamped\n  // credential via their `extra` object.\n  const baseExtra = principal.claims !== undefined ? { ...principal.claims } : undefined;\n  const adopterExtra =\n    typeof principal.extra === 'object' && principal.extra !== null\n      ? (principal.extra as Record<string, unknown>)\n      : undefined;\n  const hasExtra = baseExtra !== undefined || adopterExtra !== undefined || principal.credential !== undefined;\n  const extra = hasExtra\n    ? {\n        ...(baseExtra ?? {}),\n        ...(adopterExtra ?? {}),\n        // credential last — prevents an adopter's `extra.credential` from\n        // overwriting the framework-enforced kind-discriminated credential.\n        ...(principal.credential !== undefined ? { credential: principal.credential } : {}),\n      }\n    : undefined;\n  const info: AuthInfo = {\n    token: principal.token ?? '',\n    clientId: principal.principal,\n    scopes: principal.scopes ?? [],\n    ...(principal.expiresAt !== undefined ? { expiresAt: principal.expiresAt } : {}),\n    ...(extra !== undefined ? { extra } : {}),\n  };\n  (req as IncomingMessage & { auth?: AuthInfo }).auth = info;\n}\n\nfunction bufferBody(req: import('http').IncomingMessage, maxBytes: number): Promise<string> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    req.on('data', chunk => {\n      size += chunk.length;\n      if (size > maxBytes) {\n        reject(new Error(`Request body exceeded ${maxBytes} bytes`));\n        req.destroy();\n        return;\n      }\n      chunks.push(chunk as Buffer);\n    });\n    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));\n    req.on('error', reject);\n  });\n}\n"],"mappings":"AAoBA,SAAS,qCAAqC;AAC9C,SAAS,aAAa,yBAAyB;AAC/C,SAAS,sBAAsB,wBAAwB;AACvD,SAAS,oBAAqE;AAG9E,SAAS,yBAAyB;AAGlC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB,4BAAmD;AAChF,SAAS,oBAAqC;AAC9C,SAAS,oCAAoC;AAoCtC,MAAM,yBAAyB,MAAM;AAAA,EAC1C,YAAY,UAAU,gBAAgB;AACpC,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAoOO,SAAS,MAAM,aAA4D,SAAoC;AACpH,QAAM,UAAU,QAAQ,IAAI,OAAO,SAAS,QAAQ,IAAI,MAAM,EAAE,IAAI;AACpE,MAAI,YAAY,WAAc,OAAO,MAAM,OAAO,KAAK,UAAU,KAAK,UAAU,QAAQ;AACtF,UAAM,IAAI,MAAM,uCAAuC,QAAQ,IAAI,IAAI,GAAG;AAAA,EAC5E;AACA,QAAM,OAAO,SAAS,QAAQ,WAAW;AACzC,QAAM,YAAY,SAAS,QAAQ;AACnC,QAAM,YAAY,SAAS,aAAa,IAAI,kBAAkB;AAC9D,QAAM,qBAAqB,SAAS,uBAAuB;AAC3D,QAAM,aAAa,SAAS,eAAe;AAC3C,QAAM,kBAAkB,SAAS,mBAAmB,IAAI,OAAO;AAC/D,MAAI,CAAC,OAAO,cAAc,eAAe,KAAK,mBAAmB,GAAG;AAClE,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAUA,QAAM,eAAe,oBAAI,QAAkD;AAE3E,MAAI,SAAS,qBAAqB,CAAC,QAAQ,WAAW;AACpD,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,kBAAkB,SAAS;AACjC,QAAM,0BAA0B,SAAS;AACzC,QAAM,gBAAgB,OAAO,oBAAoB;AACjD,QAAM,UAAU,OAAO,4BAA4B;AAInD,MAAI;AACJ,MAAI,OAAO,oBAAoB,UAAU;AACvC,yBAAqB,kBAAkB,iBAAiB,SAAS;AAAA,EACnE;AAKA,QAAM,iBAAiB,oBAAI,IAAoB;AAC/C,QAAM,oBAAoB,oBAAI,IAAoB;AAClD,QAAM,WAAW,oBAAI,IAAuC;AAE5D,QAAM,mBAAmB,CAAC,SAAqC;AAC7D,QAAI,OAAO,oBAAoB,SAAU,QAAO;AAChD,QAAI,CAAC,cAAe,QAAO;AAC3B,QAAI,SAAS,eAAe,IAAI,IAAI;AACpC,QAAI,WAAW,OAAW,QAAO;AACjC,aAAU,gBAA0C,IAAI;AACxD,UAAM,SAAS,kBAAkB,QAAQ,SAAS;AAClD,mBAAe,IAAI,MAAM,MAAM;AAC/B,sBAAkB,IAAI,MAAM,MAAM;AAClC,WAAO;AAAA,EACT;AAEA,QAAM,sBAAsB,CAAC,SAAqC;AAChE,QAAI,OAAO,oBAAoB,SAAU,QAAO;AAEhD,QAAI,iBAAiB,IAAI,KAAK,KAAM,QAAO;AAC3C,WAAO,kBAAkB,IAAI,IAAI;AAAA,EACnC;AAEA,QAAM,2BAA2B,CAAC,SAAwD;AACxF,QAAI,CAAC,wBAAyB,QAAO;AACrC,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,SAAS,SAAS,IAAI,IAAI;AAC9B,QAAI,WAAW,OAAW,QAAO;AACjC,aAAU,wBAAqE,IAAI;AACnF,aAAS,IAAI,MAAM,MAAM;AACzB,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,gBAAgB,QAAQ,QAAQ,IAAI,aAAa,cAAc;AAC1E,YAAQ;AAAA,MACN;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,uBAAuB,SAAS;AAEtC,QAAM,wBAAwB,wCAAwC,SAAS;AAE/E,QAAM,aAAa,aAAa,OAAO,KAAK,QAAQ;AAClD,UAAM,EAAE,SAAS,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,kBAAkB;AAC9D,UAAM,OAAO,YAAY,KAAK,EAAE,mBAAmB,CAAC;AAIpD,QAAI,2BAA2B,aAAa,uBAAuB;AACjE,UAAI;AACJ,UAAI;AACJ,UAAI;AACF,mBAAW,iBAAiB,IAAI;AAChC,cAAM,yBAAyB,IAAI;AAAA,MACrC,SAAS,KAAK;AACZ,YAAI,eAAe,kBAAkB;AAInC,cAAI,UAAU,GAAG;AACjB,cAAI,IAAI,WAAW;AACnB;AAAA,QACF;AACA,gBAAQ,MAAM,6DAA6D,GAAG;AAC9E,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,yDAAyD,CAAC,CAAC;AAC3F;AAAA,MACF;AACA,UAAI,CAAC,YAAY,CAAC,KAAK;AAKrB,YAAI,UAAU,GAAG;AACjB,YAAI,IAAI,WAAW;AACnB;AAAA,MACF;AACA,YAAM,OAAO;AAAA,QACX;AAAA,QACA,GAAG;AAAA,QACH,0BAA0B,IAAI,4BAA4B,CAAC,QAAQ;AAAA,MACrE;AACA,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,IAAI,CAAC;AAC5B;AAAA,IACF;AAEA,QAAI,aAAa,aAAa,aAAa,GAAG,SAAS,KAAK;AAQ1D,UAAI;AACJ,UAAI;AACJ,UAAI;AACF,4BAAoB,iBAAiB,IAAI;AAAA,MAC3C,SAAS,KAAK;AACZ,YAAI,eAAe,kBAAkB;AACnC,cAAI,UAAU,GAAG;AACjB,cAAI,IAAI,WAAW;AACnB;AAAA,QACF;AACA,gBAAQ,MAAM,2CAA2C,GAAG;AAC5D,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,yDAAyD,CAAC,CAAC;AAC3F;AAAA,MACF;AACA,UAAI,yBAAyB;AAC3B,cAAM,aAAa,oBAAoB,IAAI;AAC3C,YAAI,WAAY,uBAAsB,GAAG,UAAU,GAAG,qBAAqB;AAAA,MAC7E;AAQA,YAAM,sBAA2C,oBAC7C,EAAE,MAAM,WAAW,kBAAkB,IACrC,EAAE,KAAK;AACX,MAAC,IAAiF,0BAA0B,IAC1G;AAKF,UAAI;AACJ,UAAI;AACJ,UAAI,kBAAkB;AACtB,YAAM,gBAAgB,YAA2B;AAC/C,YAAI,YAAY,OAAW;AAC3B,kBAAU,MAAM,WAAW,KAAK,eAAe;AAC/C,QAAC,IAA6B,UAAU;AACxC,YAAI,QAAQ,SAAS,GAAG;AACtB,cAAI;AACF,yBAAa,KAAK,MAAM,OAAO;AAAA,UACjC,QAAQ;AACN,8BAAkB;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AAKA,UAAI,0BAA0B,SAAS,YAAY,GAAG;AACpD,YAAI;AACF,gBAAM,cAAc;AAAA,QACtB,SAAS,KAAK;AAIZ,gBAAM,UAAW,IAAc,QAAQ;AACvC,kBAAQ,MAAM,sDAAsD,OAAO,EAAE;AAC7E,cAAI,CAAC,IAAI,aAAa;AACpB,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI,IAAI,KAAK,UAAU,EAAE,OAAO,4BAA4B,CAAC,CAAC;AAAA,UAChE;AACA;AAAA,QACF;AAAA,MACF;AAGA,UAAI,SAAS,cAAc;AACzB,YAAI;AACJ,YAAI;AACF,sBAAY,MAAM,QAAQ,aAAa,GAAG;AAAA,QAC5C,SAAS,KAAK;AAEZ,gBAAM,gBAAgB,eAAe,YAAY,IAAI,gBAAgB;AACrE,kBAAQ,MAAM,yBAAyB,GAAG;AAO1C,gBAAM,gBAAgB,4BAA4B,GAAG;AACrD,cAAI,eAAe;AACjB,gCAAoB,KAAK,KAAK;AAAA,cAC5B,gBAAgB;AAAA,cAChB,kBAAkB;AAAA,cAClB,kBAAkB;AAAA,YACpB,CAAC;AACD;AAAA,UACF;AACA,8BAAoB,KAAK,KAAK;AAAA,YAC5B,OAAO;AAAA,YACP,kBAAkB;AAAA,YAClB,kBAAkB;AAAA,UACpB,CAAC;AACD;AAAA,QACF;AACA,YAAI,CAAC,WAAW;AACd,8BAAoB,KAAK,KAAK;AAAA,YAC5B,OAAO;AAAA,YACP,kBAAkB;AAAA,YAClB,kBAAkB;AAAA,UACpB,CAAC;AACD;AAAA,QACF;AAEA,uBAAe,KAAK,SAAS;AAAA,MAC/B;AAOA,UAAI;AACJ,UAAI;AACF,sBAAc,YAAY,EAAE,WAAW,KAAK,CAAC;AAAA,MAC/C,SAAS,KAAK;AACZ,YAAI,eAAe,kBAAkB;AAInC,cAAI,UAAU,GAAG;AACjB,cAAI,IAAI,WAAW;AACnB;AAAA,QACF;AAKA,gBAAQ,MAAM,+BAA+B,GAAG;AAChD,YAAI,CAAC,IAAI,aAAa;AACpB,cAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,cAAI,IAAI,KAAK,UAAU,EAAE,OAAO,wBAAwB,CAAC,CAAC;AAAA,QAC5D;AACA;AAAA,MACF;AAYA,UAAI,cAAe,YAAmD,oBAAoB,MAAM,MAAM;AACpG,cAAM,OACJ;AACF,gBAAQ;AAAA,UACN,0NAEE;AAAA,QACJ;AACA,YAAI,CAAC,IAAI,aAAa;AACpB,cAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,cAAI;AAAA,YACF,KAAK,UAAU;AAAA,cACb,OAAO;AAAA,cACP;AAAA,YACF,CAAC;AAAA,UACH;AAAA,QACF;AACA;AAAA,MACF;AACA,YAAM,WAAY,YAAmD,kBAAkB;AACvF,YAAM,wBAAwB,OAAO,aAAa,aAAc,WAAgC;AAChG,YAAM,qBAAqB,wBAAwB;AAEnD,UAAI,oBAAoB;AACtB,YAAI;AACF,gBAAM,cAAc;AACpB,gBAAM,UAAU,MAAM,mBAAmB,KAA8D,GAAG;AAC1G,cAAI,SAAS;AAGX,kBAAM,YAAY,MAAM;AACxB;AAAA,UACF;AAAA,QACF,SAAS,KAAK;AAEZ,gBAAM,UAAW,IAAc,QAAQ;AACvC,gBAAM,UAAW,IAA0B,QAAQ;AACnD,kBAAQ,MAAM,kCAAkC,OAAO,KAAK,OAAO,GAAG;AACtE,cAAI,CAAC,IAAI,aAAa;AACpB,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI,IAAI,KAAK,UAAU,EAAE,OAAO,wBAAwB,CAAC,CAAC;AAAA,UAC5D;AACA,gBAAM,YAAY,MAAM;AACxB;AAAA,QACF;AAAA,MACF;AASA,YAAM,oBAAoB,YAA2B;AACnD,YAAI;AACJ,YAAI;AAMF,gBAAM,cAAc;AAEpB,cAAI,IAAI,QAAQ,YAAY,MAAM,UAAU,CAAC,kBAAkB,IAAI,QAAQ,cAAc,CAAC,GAAG;AAC3F,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI;AAAA,cACF,KAAK,UAAU;AAAA,gBACb,SAAS;AAAA,gBACT,OAAO,EAAE,MAAM,OAAQ,SAAS,gEAAgE;AAAA,gBAChG,IAAI;AAAA,cACN,CAAC;AAAA,YACH;AACA;AAAA,UACF;AAEA,cAAI,IAAI,QAAQ,YAAY,MAAM,WAAW,mBAAmB,SAAS,WAAW,IAAI;AACtF,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI;AAAA,cACF,KAAK,UAAU;AAAA,gBACb,SAAS;AAAA,gBACT,OAAO,EAAE,MAAM,aAAa,SAAS,8CAA8C;AAAA,gBACnF,IAAI;AAAA,cACN,CAAC;AAAA,YACH;AACA;AAAA,UACF;AAMA,gBAAM,iBAAiB,aAAa,WAAW,IAAI,cAAc;AACjE,cAAI,gBAAgB;AAClB,kBAAM,sBAAsB,oBACxB,CAAC,IAAI,IAAI,iBAAiB,EAAE,QAAQ,IACpC,CAAC,aAAa,aAAa,OAAO;AACtC,kBAAM,eAAe,SAAS,gBAAgB;AAC9C,kBAAM,iBAAiB,SAAS,kBAAkB;AAClD,gBAAI,CAAC,qBAAqB,YAAY,EAAE,KAAK,GAAG,EAAG;AACnD,gBAAI,CAAC,iBAAiB,cAAc,EAAE,KAAK,GAAG,EAAG;AAAA,UACnD;AAEA,cAAI,gBAAgB;AACpB,cAAI,gBAAgB;AAClB,4BAAgB,6BAA6B,cAAc;AAC3D,4BAAgB,MAAM,cAAc,gBAAgB,KAAK,UAAU;AAAA,UACrE;AAEA,cAAI,eAAe;AACjB,kBAAM,YAAY,IAAI,8BAA8B;AAAA,cAClD,oBAAoB;AAAA,YACtB,CAAC;AACD,kBAAM,YAAY,QAAQ,SAAS;AAGnC,gBAAI,eAAe,QAAW;AAC5B,oBAAM,UAAU,cAAc,KAAK,KAAK,UAAU;AAAA,YACpD,OAAO;AACL,oBAAM,UAAU,cAAc,KAAK,GAAG;AAAA,YACxC;AAAA,UACF,OAAO;AACL,kBAAM,cAAe,OAAO,KAAK,KAAK,UAAU;AAAA,UAClD;AAAA,QACF,SAAS,KAAK;AACZ,kBAAQ,MAAM,iBAAiB,GAAG;AAClC,cAAI,CAAC,IAAI,aAAa;AACpB,gBAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,gBAAI,IAAI,KAAK,UAAU,EAAE,OAAO,wBAAwB,CAAC,CAAC;AAAA,UAC5D;AAAA,QACF,UAAE;AACA,gBAAM,eAAe,MAAM;AAM3B,gBAAM,YAAY,MAAM;AAAA,QAC1B;AAAA,MACF;AAEA,UAAI,YAAY;AACd,cAAM,OAAO,aAAa,IAAI,WAAW,KAAK,QAAQ,QAAQ;AAM9D,cAAM,UAAU,KAAK,KAAK,mBAAmB,iBAAiB;AAK9D,qBAAa;AAAA,UACX;AAAA,UACA,QAAQ,MAAM,MAAM;AAAA,UAAC,CAAC;AAAA,QACxB;AACA,cAAM;AAAA,MACR,OAAO;AACL,cAAM,kBAAkB;AAAA,MAC1B;AAAA,IACF,OAAO;AACL,UAAI,UAAU,GAAG;AACjB,UAAI,IAAI,WAAW;AAAA,IACrB;AAAA,EACF,CAAC;AAED,QAAM,WAAW,MAAM;AACrB,eAAW,OAAO,MAAM,MAAM;AAC5B,YAAM,aAAc,WAAW,QAAQ,EAAuB;AAC9D,YAAM,MAAM,oBAAoB,UAAU,GAAG,SAAS;AACtD,UAAI,SAAS,aAAa;AACxB,gBAAQ,YAAY,GAAG;AAAA,MACzB,OAAO;AACL,gBAAQ,IAAI,yBAAyB,GAAG,EAAE;AAC1C,gBAAQ,IAAI;AAAA;AAAA,yBAAwC,GAAG,EAAE;AAAA,MAC3D;AAAA,IACF,CAAC;AAAA,EACH;AAEA,MAAI,SAAS,gBAAgB;AAC3B,YACG,eAAe,EACf,KAAK,QAAQ,EACb,MAAM,CAAC,QAAiB;AACvB,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,cAAQ,MAAM,4DAAuD,OAAO;AAC5E,cAAQ,KAAK,CAAC;AAAA,IAChB,CAAC;AAAA,EACL,OAAO;AACL,aAAS;AAAA,EACX;AAEA,SAAO;AACT;AAEA,SAAS,oBAAoB,GAAmB;AAC9C,MAAI,MAAM,EAAE;AACZ,SAAO,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC,MAAM,GAAc;AAC1D,SAAO,EAAE,MAAM,GAAG,GAAG;AACvB;AAWA,SAAS,kBAAkB,WAAmB,WAA2B;AACvE,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,SAAS;AAAA,EAC5B,QAAQ;AACN,UAAM,IAAI,MAAM,8CAA8C,SAAS,EAAE;AAAA,EAC3E;AACA,MAAI,oBAAoB,OAAO,QAAQ,MAAM,oBAAoB,SAAS,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR,gCAAgC,OAAO,QAAQ,4BAA4B,SAAS;AAAA,IAEtF;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAQO,SAAS,SAAS,MAAsB;AAC7C,MAAI,KAAK,WAAW,GAAG,GAAG;AAExB,UAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,QAAI,QAAQ,GAAI,QAAO;AACvB,WAAO,KAAK,MAAM,GAAG,MAAM,CAAC;AAAA,EAC9B;AACA,QAAM,QAAQ,KAAK,YAAY,GAAG;AAClC,SAAO,UAAU,KAAK,OAAO,KAAK,MAAM,GAAG,KAAK;AAClD;AA6CO,SAAS,YAAY,KAAsB,SAAoD;AACpG,QAAM,qBAAqB,SAAS,uBAAuB;AAC3D,MAAI,oBAAoB;AACtB,UAAM,MAAM,iBAAiB,IAAI,QAAQ,kBAAkB,CAAC;AAC5D,QAAI,KAAK;AACP,YAAM,QAAQ,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACtC,UAAI,MAAO,QAAO,MAAM,YAAY;AAAA,IACtC;AACA,UAAM,YAAY,iBAAiB,IAAI,QAAQ,WAAW,CAAC;AAC3D,QAAI,WAAW;AACb,YAAMA,QAAO,mBAAmB,SAAS;AACzC,UAAIA,MAAM,QAAOA,MAAK,YAAY;AAAA,IACpC;AAAA,EACF;AACA,QAAM,OAAO,iBAAiB,IAAI,QAAQ,MAAM,CAAC;AACjD,SAAO,OAAO,KAAK,YAAY,IAAI;AACrC;AAYA,SAAS,mBAAmB,QAAoC;AAK9D,QAAM,WAAW,yBAAyB,MAAM;AAChD,MAAI,CAAC,SAAU,QAAO;AACtB,aAAW,QAAQ,SAAS,MAAM,GAAG,GAAG;AACtC,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,OAAO,GAAI;AACf,UAAM,MAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY;AACjD,QAAI,QAAQ,OAAQ;AACpB,QAAI,QAAQ,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AACpC,QAAI,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,KAAK,MAAM,UAAU,GAAG;AACrE,cAAQ,MAAM,MAAM,GAAG,EAAE,EAAE,QAAQ,UAAU,IAAI;AAAA,IACnD;AACA,WAAO,SAAS;AAAA,EAClB;AACA,SAAO;AACT;AAEA,SAAS,yBAAyB,QAAoC;AACpE,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,KAAK,OAAO,CAAC;AACnB,QAAI,OAAO,KAAK;AAEd;AACA,aAAO,IAAI,OAAO,UAAU,OAAO,CAAC,MAAM,KAAK;AAC7C,YAAI,OAAO,CAAC,MAAM,KAAM;AACxB;AAAA,MACF;AACA;AAAA,IACF;AACA,QAAI,OAAO,OAAO,UAAU,GAAG;AAC7B,aAAO,OAAO,MAAM,OAAO,CAAC;AAAA,IAC9B;AAAA,EACF;AACA,SAAO,OAAO,MAAM,KAAK,EAAE,KAAK,KAAK;AACvC;AAEA,SAAS,iBAAiB,OAA0D;AAClF,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,QAAO,MAAM,CAAC;AAC5D,SAAO;AACT;AAEA,SAAS,eAAe,KAAsB,WAAgC;AAc5E,QAAM,YAAY,UAAU,WAAW,SAAY,EAAE,GAAG,UAAU,OAAO,IAAI;AAC7E,QAAM,eACJ,OAAO,UAAU,UAAU,YAAY,UAAU,UAAU,OACtD,UAAU,QACX;AACN,QAAM,WAAW,cAAc,UAAa,iBAAiB,UAAa,UAAU,eAAe;AACnG,QAAM,QAAQ,WACV;AAAA,IACE,GAAI,aAAa,CAAC;AAAA,IAClB,GAAI,gBAAgB,CAAC;AAAA;AAAA;AAAA,IAGrB,GAAI,UAAU,eAAe,SAAY,EAAE,YAAY,UAAU,WAAW,IAAI,CAAC;AAAA,EACnF,IACA;AACJ,QAAM,OAAiB;AAAA,IACrB,OAAO,UAAU,SAAS;AAAA,IAC1B,UAAU,UAAU;AAAA,IACpB,QAAQ,UAAU,UAAU,CAAC;AAAA,IAC7B,GAAI,UAAU,cAAc,SAAY,EAAE,WAAW,UAAU,UAAU,IAAI,CAAC;AAAA,IAC9E,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC;AAAA,EACzC;AACA,EAAC,IAA8C,OAAO;AACxD;AAEA,SAAS,WAAW,KAAqC,UAAmC;AAC1F,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAmB,CAAC;AAC1B,QAAI,OAAO;AACX,QAAI,GAAG,QAAQ,WAAS;AACtB,cAAQ,MAAM;AACd,UAAI,OAAO,UAAU;AACnB,eAAO,IAAI,MAAM,yBAAyB,QAAQ,QAAQ,CAAC;AAC3D,YAAI,QAAQ;AACZ;AAAA,MACF;AACA,aAAO,KAAK,KAAe;AAAA,IAC7B,CAAC;AACD,QAAI,GAAG,OAAO,MAAM,QAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC,CAAC;AACnE,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;","names":["host"]}

package/dist/lib/server/socket-mode/conformance-client.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import WebSocket from "ws";
 import { WebSocketTransport } from "./ws-transport.mjs";
 const RECONNECT_INITIAL_MS = 1e3;