@agimon-ai/doompi-core 0.0.1-alpha.100

package/dist/src/server/sessionMcpHandler.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionMcpHandler.d.mts","names":[],"sources":["../../../src/server/sessionMcpHandler.ts"],"mappings":";;;;;iBAkDiB;WACN,gBAAgB;WAChB;IAAmB;IAAc;;;iBAmD3B;WACN;WACA;WACA,aAAa;;iBAGP;;WAEN;WACA,eAAe,KAAK;WACpB,cAAc,OAAO,iCAAiC;WACtD;;WAEA;WACA,YAAY,YAAY;;WAExB,aAAa;WACb,iBAAiB,sBAAsB,+BAA+B,QAAQ;WAC9E,uBACP,OAAO,uBACP,gBACA,kBACA,SAAS,gBACN,mBAAmB,QAAQ;;WAEvB,YAAY;;WAEZ,gBAAgB,YAAY;WAC5B;WACA;;YAGC,8BAA8B;EAEtC,YAAY;EAAiB;EAAe;;YAGpC,yBAAyB,SAAS,YAAY,QAAQ;;wBAkElD,4BAA4B,SAAS,+BAA+B"}

package/dist/src/server/sessionMcpHandler.mjs

@@ -0,0 +1,493 @@
+import { SessionMcpConversationError, sessionMcpConversationDigest } from "../services/sessionMcpConversations/index.mjs";
+import { randomUUID } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
+import { ProtocolError, ProtocolErrorCode, Server, createMcpHandler } from "@modelcontextprotocol/server";
+//#region src/server/sessionMcpHandler.ts
+/** Stable transport tools stay available when a conversation changes its MCP composition. */
+const SESSION_MCP_EXTRA_TOOLS = [
+	{
+		name: "load_extra_tools",
+		title: "Load extra tools",
+		description: "Discover tools and skills in this conversation that differ from the last parent catalog refresh.",
+		inputSchema: {
+			type: "object",
+			properties: {},
+			additionalProperties: false
+		},
+		annotations: { readOnlyHint: true },
+		_meta: { ui: { visibility: ["model"] } }
+	},
+	{
+		name: "use_extra_tools",
+		title: "Use extra tools",
+		description: "Invoke one currently available extra tool by exact name with its declared arguments.",
+		inputSchema: {
+			type: "object",
+			properties: {
+				name: { type: "string" },
+				arguments: { type: "object" }
+			},
+			required: ["name"],
+			additionalProperties: false
+		},
+		_meta: { ui: { visibility: ["model"] } }
+	},
+	{
+		name: "session_capabilities",
+		title: "Session capabilities",
+		description: "Inspect the tools and skills currently available in this conversation, independently of the parent catalog diff.",
+		inputSchema: {
+			type: "object",
+			properties: {},
+			additionalProperties: false
+		},
+		annotations: { readOnlyHint: true },
+		_meta: { ui: { visibility: ["model"] } }
+	}
+];
+function publicTool(tool) {
+	return {
+		name: tool.name,
+		title: tool.label,
+		description: tool.description,
+		inputSchema: tool.parameters,
+		...tool.annotations === void 0 ? {} : { annotations: tool.annotations },
+		...tool.outputSchema === void 0 ? {} : { outputSchema: tool.outputSchema },
+		_meta: {
+			...tool._meta,
+			ui: {
+				...tool._meta?.ui,
+				visibility: tool._meta?.ui?.visibility ?? ["model"]
+			}
+		}
+	};
+}
+function grantedExtraTools(grant) {
+	return grant.scope === "session" ? SESSION_MCP_EXTRA_TOOLS : SESSION_MCP_EXTRA_TOOLS.filter((tool) => grant.tools.includes(tool.name));
+}
+function extraTools(baseline, tools) {
+	return tools.map(publicTool).filter((tool) => !SESSION_MCP_EXTRA_TOOLS.some((wrapper) => wrapper.name === tool.name) && !isDeepStrictEqual(baseline.tools.find((original) => original.name === tool.name), tool));
+}
+function toolArguments(name, value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid arguments for '${name}'.`);
+	const args = value;
+	if (Object.keys(args).some((key) => key !== "name" && key !== "arguments") || (name === "load_extra_tools" || name === "session_capabilities") && Object.keys(args).length !== 0 || name === "use_extra_tools" && (typeof args.name !== "string" || args.name.trim() === "" || args.arguments !== void 0 && (typeof args.arguments !== "object" || args.arguments === null || Array.isArray(args.arguments)))) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid arguments for '${name}'.`);
+	return args;
+}
+function jsonError(status, message, authenticate = false, resourceMetadataUrl) {
+	return Response.json({
+		jsonrpc: "2.0",
+		error: {
+			code: -32e3,
+			message
+		},
+		id: null
+	}, {
+		status,
+		headers: {
+			"cache-control": "no-store",
+			...authenticate ? { "www-authenticate": resourceMetadataUrl === void 0 ? "Bearer" : `Bearer resource_metadata="${resourceMetadataUrl}"` } : {}
+		}
+	});
+}
+function bearerToken(request) {
+	const authorization = request.headers.get("authorization");
+	return (authorization === null ? void 0 : /^Bearer ([A-Za-z0-9_-]+)$/iu.exec(authorization))?.[1];
+}
+function currentUrl(request) {
+	try {
+		const url = new URL(request.url);
+		return url.search === "" && url.hash === "" ? url.href : void 0;
+	} catch {
+		return;
+	}
+}
+function grantedSurface(grant, surface) {
+	const snapshot = surface.readSurface();
+	if (snapshot.tools.some((tool) => SESSION_MCP_EXTRA_TOOLS.some((wrapper) => wrapper.name === tool.name))) throw new ProtocolError(ProtocolErrorCode.InvalidRequest, "A session tool conflicts with a reserved remote tool name.");
+	const toolNames = new Set(grant.tools);
+	const skillNames = new Set(grant.skills);
+	const tools = grant.scope === "session" ? snapshot.tools : snapshot.tools.filter((tool) => toolNames.has(tool.name));
+	const resourceUris = new Set(tools.map((tool) => tool._meta?.ui?.resourceUri));
+	return {
+		snapshot,
+		tools,
+		skills: grant.scope === "session" ? snapshot.skills : snapshot.skills.filter((skill) => skillNames.has(skill.name)),
+		uiResources: (snapshot.uiResources ?? []).filter((resource) => resourceUris.has(resource.uri))
+	};
+}
+/** Identity is supplied by the approved tool descriptor, never by upstream result metadata. */
+function widgetResult(tool, result) {
+	const widget = tool?._meta?.["doompi/widget"];
+	return typeof widget !== "string" ? result : {
+		...result,
+		_meta: {
+			...result._meta,
+			"doompi/widget": widget,
+			"doompi/toolName": tool.name
+		}
+	};
+}
+/** Creates a stateless Streamable HTTP MCP request handler for session capabilities. */
+function createSessionMcpHttpHandler(options) {
+	const audience = new URL(options.audience);
+	if (audience.protocol !== "https:" || audience.username !== "" || audience.password !== "" || audience.search !== "" || audience.hash !== "") throw new Error("Session MCP audience must be an absolute HTTPS URL without credentials, a query, or a fragment.");
+	const exactAudience = audience.href;
+	if (options.pathToken !== void 0 && !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u.test(options.pathToken)) throw new Error("Session MCP path token must be a compact JWT.");
+	const exactResource = options.pathToken === void 0 ? exactAudience : `${exactAudience}/${options.pathToken}`;
+	const authenticate = options.pathToken === void 0 ? options.authorization.authenticateAccessToken : options.authorization.authenticateUrlToken;
+	const operations = options.operations ?? /* @__PURE__ */ new Map();
+	const baselines = options.baselines ?? /* @__PURE__ */ new Map();
+	const operationOwner = (grant, requestId) => JSON.stringify([
+		grant.clientId,
+		grant.sessionId,
+		grant.sessionGeneration,
+		grant.id,
+		requestId
+	]);
+	return async (request) => {
+		if (currentUrl(request) !== exactResource) return jsonError(404, "MCP resource not found.");
+		const token = options.pathToken ?? bearerToken(request);
+		if (token === void 0) return jsonError(401, "A Bearer access token is required.", true, options.resourceMetadataUrl);
+		const grant = authenticate(token, exactAudience);
+		if (grant === void 0) return options.pathToken === void 0 ? jsonError(401, "The Bearer access token is invalid or expired.", true, options.resourceMetadataUrl) : jsonError(401, "The signed MCP URL is invalid or revoked.");
+		const authorizeOperation = async () => {
+			const activeGrant = authenticate(token, exactAudience);
+			if (activeGrant === void 0 || activeGrant.id !== grant.id) throw new ProtocolError(ProtocolErrorCode.InvalidRequest, "The session grant is no longer active.");
+			const target = await options.resolveSession(activeGrant.sessionId);
+			const recheckedGrant = authenticate(token, exactAudience);
+			if (recheckedGrant === void 0 || recheckedGrant.id !== activeGrant.id || target === void 0 || target.generation !== recheckedGrant.sessionGeneration) throw new ProtocolError(ProtocolErrorCode.InvalidRequest, "The session grant is no longer active.");
+			return {
+				grant: recheckedGrant,
+				target
+			};
+		};
+		try {
+			await authorizeOperation();
+		} catch {
+			return options.pathToken === void 0 ? jsonError(401, "The session grant is no longer active.", true, options.resourceMetadataUrl) : jsonError(401, "The signed MCP URL is invalid or revoked.");
+		}
+		const server = new Server({
+			name: options.serverName ?? "doompi-session",
+			version: options.serverVersion ?? "1.0.0"
+		}, {
+			capabilities: {
+				tools: {},
+				resources: {}
+			},
+			instructions: "Use only this bound DoomPi session. Call load_context before work and after selection changes. Call session_capabilities for the current inventory; load_extra_tools returns only conversation differences. Invoke extras with use_extra_tools and guidance with load_skill. Inspect before editing and follow repository checks. Do not assume UI, downloadable files, or background notifications. Read saved logs instead of relaunching work. Saving a plan does not authorize implementation."
+		});
+		server.setNotificationHandler("notifications/cancelled", async (notification) => {
+			const active = await authorizeOperation();
+			if (notification.params.requestId === void 0) return;
+			const owner = operationOwner(active.grant, notification.params.requestId);
+			const conversation = sessionMcpConversationDigest(notification.params._meta);
+			if (conversation === void 0) return;
+			const candidates = [...operations.values()].filter((operation) => operation.owner === owner && operation.conversation === conversation);
+			if (candidates.length === 1) candidates[0].controller.abort();
+		});
+		server.setRequestHandler("tools/list", async () => {
+			const active = await authorizeOperation();
+			await options.onVerified?.(active.grant);
+			const { tools, skills } = grantedSurface(active.grant, active.target.toolSurface);
+			const parentTools = tools.map(publicTool);
+			const wrappers = grantedExtraTools(active.grant);
+			const baseline = structuredClone({
+				tools: parentTools,
+				skills: skills.map(({ name, description }) => ({
+					name,
+					description
+				}))
+			});
+			await authorizeOperation();
+			baselines.set(active.grant.clientId, baseline);
+			return { tools: [...parentTools, ...wrappers] };
+		});
+		server.setRequestHandler("tools/call", async (message, ctx) => {
+			const conversation = sessionMcpConversationDigest(ctx.mcpReq._meta ?? message.params._meta);
+			const owner = operationOwner(grant, ctx.mcpReq.id);
+			const key = JSON.stringify([owner, conversation]);
+			if (operations.has(key)) throw new ProtocolError(ProtocolErrorCode.InvalidRequest, "A tool call with this request identity is already active.");
+			if (options.operations !== void 0 && operations.size >= 1024) throw new ProtocolError(ProtocolErrorCode.InvalidRequest, "Too many active MCP tool calls. Retry later.");
+			const controller = new AbortController();
+			operations.set(key, {
+				controller,
+				owner,
+				conversation
+			});
+			const signal = AbortSignal.any([
+				request.signal,
+				ctx.mcpReq.signal,
+				controller.signal
+			]);
+			const invocationId = randomUUID();
+			let skillAccessOpen = true;
+			let widgetTool;
+			let invocation;
+			const publishInvocation = () => {
+				if (invocation?.sessionId === void 0) return;
+				try {
+					options.onInvocation?.({ ...invocation });
+				} catch {
+					options.onNotice?.("session MCP call history could not be saved");
+				}
+			};
+			const completeInvocation = (result) => {
+				if (invocation !== void 0) {
+					invocation = {
+						...invocation,
+						status: signal.aborted ? "cancelled" : result.isError ? "failed" : "succeeded",
+						finishedAt: Date.now(),
+						output: result.structuredContent ?? result.content
+					};
+					publishInvocation();
+				}
+				return result;
+			};
+			try {
+				const parent = await authorizeOperation();
+				invocation = {
+					id: invocationId,
+					parentSessionId: parent.grant.sessionId,
+					clientId: parent.grant.clientId,
+					conversationDigest: conversation,
+					toolName: message.params.name,
+					startedAt: Date.now(),
+					status: "running",
+					input: message.params.arguments ?? {}
+				};
+				publishInvocation();
+				const wrapper = grantedExtraTools(parent.grant).some((tool) => tool.name === message.params.name);
+				const advertised = wrapper ? void 0 : grantedSurface(parent.grant, parent.target.toolSurface).tools.find((tool) => tool.name === message.params.name);
+				if (!wrapper && !advertised) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Tool '${message.params.name}' is not granted or active.`);
+				widgetTool = advertised;
+				const wrapperArgs = wrapper ? toolArguments(message.params.name, message.params.arguments ?? {}) : void 0;
+				await options.onVerified?.(parent.grant);
+				options.onNotice?.(`session MCP invocation id=${invocationId} lifecycle=started`);
+				const resolveTarget = async (reserve) => {
+					const active = await authorizeOperation();
+					if (!conversation) throw new SessionMcpConversationError("CONVERSATION_ID_REQUIRED", "This connection requires conversation metadata. Use a compatible ChatGPT conversation and retry.");
+					if (!options.resolveConversation) throw new SessionMcpConversationError("CONVERSATION_ROUTING_UNAVAILABLE", "Conversation routing is unavailable in this host.");
+					signal.throwIfAborted();
+					const target = await options.resolveConversation(active.grant, conversation, reserve, signal);
+					await authorizeOperation();
+					signal.throwIfAborted();
+					return {
+						grant: active.grant,
+						target
+					};
+				};
+				if (wrapper && !conversation) throw new SessionMcpConversationError("CONVERSATION_ID_REQUIRED", "This connection requires conversation metadata. Use a compatible ChatGPT conversation and retry.");
+				if ((message.params.name === "load_extra_tools" || message.params.name === "use_extra_tools") && !baselines.has(parent.grant.clientId)) throw new SessionMcpConversationError("SESSION_MCP_BASELINE_REQUIRED", "Refresh this MCP connection tool catalog before loading or using extra tools.");
+				const active = await resolveTarget(true);
+				invocation = {
+					...invocation,
+					sessionId: active.target.sessionId ?? parent.grant.sessionId
+				};
+				publishInvocation();
+				const { snapshot, tools, skills } = grantedSurface(active.grant, active.target.toolSurface);
+				const baseline = baselines.get(parent.grant.clientId);
+				const extras = wrapper && baseline ? extraTools(baseline, tools) : [];
+				if (message.params.name === "session_capabilities" && wrapper) {
+					const capabilities = {
+						sessionId: active.target.sessionId ?? parent.grant.sessionId,
+						generation: active.target.generation,
+						revision: snapshot.revision,
+						baseline: baseline === void 0 ? "missing" : "available",
+						inventory: "active_surface",
+						discovery: "unknown",
+						tools: [...tools.map(publicTool), ...grantedExtraTools(active.grant)],
+						skills: skills.map(({ name, description }) => ({
+							name,
+							description
+						}))
+					};
+					const current = await resolveTarget(false);
+					if (current.target.toolSurface !== active.target.toolSurface || current.target.generation !== active.target.generation || current.target.sessionId !== active.target.sessionId || current.target.toolSurface.readSurface().revision !== snapshot.revision) throw new ProtocolError(ProtocolErrorCode.InvalidRequest, "The session tool surface has changed.");
+					options.onNotice?.(`session MCP invocation id=${invocationId} lifecycle=succeeded`);
+					return completeInvocation({
+						content: [{
+							type: "text",
+							text: JSON.stringify(capabilities)
+						}],
+						structuredContent: capabilities,
+						isError: false
+					});
+				}
+				if (message.params.name === "load_extra_tools" && wrapper) {
+					const discovery = {
+						tools: extras,
+						skills: (tools.some((tool) => tool.name === "load_skill") ? skills : []).map(({ name, description }) => ({
+							name,
+							description
+						})).filter((skill) => !isDeepStrictEqual(baseline.skills.find((original) => original.name === skill.name), skill))
+					};
+					const current = await resolveTarget(false);
+					if (current.target.toolSurface !== active.target.toolSurface || current.target.generation !== active.target.generation || current.target.sessionId !== active.target.sessionId || current.target.toolSurface.readSurface().revision !== snapshot.revision) throw new ProtocolError(ProtocolErrorCode.InvalidRequest, "The session tool surface has changed.");
+					options.onNotice?.(`session MCP invocation id=${invocationId} lifecycle=succeeded`);
+					return completeInvocation({
+						content: [{
+							type: "text",
+							text: JSON.stringify(discovery)
+						}],
+						structuredContent: discovery,
+						isError: false
+					});
+				}
+				const name = wrapper ? wrapperArgs.name : message.params.name;
+				const selected = tools.find((tool) => tool.name === name);
+				if (wrapper && (!extras.some((tool) => tool.name === name) || !selected)) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Extra tool '${name}' is not granted or active.`);
+				if (!wrapper && (!selected || !isDeepStrictEqual(selected.parameters, advertised.parameters) || !isDeepStrictEqual(selected.outputSchema, advertised.outputSchema) || !isDeepStrictEqual(selected.annotations, advertised.annotations) || !isDeepStrictEqual(selected._meta, advertised._meta))) throw new SessionMcpConversationError("SESSION_TOOL_SURFACE_CHANGED", "The target session does not expose the approved tool contract. Refresh the connection or restore a compatible session selection.");
+				widgetTool = wrapper ? void 0 : selected;
+				const recheck = async () => {
+					const current = await resolveTarget(false);
+					if (current.target.toolSurface !== active.target.toolSurface || current.target.generation !== active.target.generation || current.target.sessionId !== active.target.sessionId) throw new ProtocolError(ProtocolErrorCode.InvalidRequest, "The session tool surface has changed.");
+					if (wrapper) {
+						if (!grantedExtraTools(current.grant).some((tool) => tool.name === message.params.name)) throw new ProtocolError(ProtocolErrorCode.InvalidRequest, "The connection tool surface has changed.");
+					} else {
+						const currentAdvertised = grantedSurface(current.grant, parent.target.toolSurface).tools.find((tool) => tool.name === message.params.name);
+						if (!currentAdvertised || !isDeepStrictEqual(currentAdvertised, advertised)) throw new ProtocolError(ProtocolErrorCode.InvalidRequest, "The connection tool surface has changed.");
+					}
+					return current;
+				};
+				const authorizedSkills = async () => {
+					if (!skillAccessOpen) throw new ProtocolError(ProtocolErrorCode.InvalidRequest, "Remote skill access is no longer active.");
+					signal.throwIfAborted();
+					const current = await recheck();
+					signal.throwIfAborted();
+					return grantedSurface(current.grant, current.target.toolSurface);
+				};
+				const mcpSkills = {
+					async list() {
+						const { skills } = await authorizedSkills();
+						return skills.map(({ name, description }) => ({
+							name,
+							description
+						}));
+					},
+					async read(name) {
+						const current = await authorizedSkills();
+						const skill = current.skills.find((candidate) => candidate.name === name);
+						if (!skill) throw new ProtocolError(ProtocolErrorCode.InvalidParams, "Skill is not granted or active.");
+						const text = await active.target.toolSurface.readSkill(current.snapshot.revision, skill.uri);
+						signal.throwIfAborted();
+						if ((await authorizedSkills()).snapshot.revision !== current.snapshot.revision) throw new ProtocolError(ProtocolErrorCode.InvalidRequest, "The session skill surface has changed.");
+						return text;
+					}
+				};
+				invocation = {
+					...invocation,
+					toolName: name,
+					input: wrapper ? wrapperArgs.arguments ?? {} : message.params.arguments ?? {}
+				};
+				publishInvocation();
+				const result = await active.target.toolSurface.invokeTool({
+					revision: snapshot.revision,
+					name,
+					arguments: wrapper ? wrapperArgs.arguments ?? {} : message.params.arguments ?? {},
+					signal,
+					mcpSkills,
+					authorize: async () => {
+						const current = await recheck();
+						if (wrapper) {
+							const currentTool = grantedSurface(current.grant, current.target.toolSurface).tools.find((tool) => tool.name === name);
+							if (!currentTool || !isDeepStrictEqual(currentTool, selected)) throw new ProtocolError(ProtocolErrorCode.InvalidRequest, "The extra tool surface has changed.");
+						}
+					}
+				});
+				await recheck();
+				options.onNotice?.(`session MCP invocation id=${invocationId} lifecycle=succeeded`);
+				return completeInvocation(widgetResult(wrapper ? void 0 : selected, {
+					content: result.content,
+					...result.structuredContent === void 0 ? {} : { structuredContent: result.structuredContent },
+					...result._meta === void 0 ? {} : { _meta: result._meta },
+					isError: result.isError ?? false
+				}));
+			} catch (error) {
+				const cause = error instanceof SessionMcpConversationError ? error.code : signal.aborted ? "aborted" : error instanceof ProtocolError ? `mcp_${String(error.code)}` : error instanceof Error ? error.name : "unknown";
+				options.onNotice?.(`session MCP invocation id=${invocationId} lifecycle=failed cause=${cause}`);
+				if (invocation !== void 0) {
+					invocation = {
+						...invocation,
+						status: signal.aborted ? "cancelled" : "failed",
+						finishedAt: Date.now(),
+						output: {
+							cause,
+							message: error instanceof Error ? error.message : "Tool call failed."
+						}
+					};
+					publishInvocation();
+				}
+				if (!(error instanceof SessionMcpConversationError)) throw error;
+				return widgetResult(widgetTool, {
+					content: [{
+						type: "text",
+						text: error.message
+					}],
+					isError: true,
+					structuredContent: {
+						code: error.code,
+						message: error.message,
+						...error.bindingId === void 0 ? {} : { bindingId: error.bindingId }
+					}
+				});
+			} finally {
+				skillAccessOpen = false;
+				operations.delete(key);
+			}
+		});
+		server.setRequestHandler("resources/list", async () => {
+			const active = await authorizeOperation();
+			const { uiResources } = grantedSurface(active.grant, active.target.toolSurface);
+			return { resources: [...uiResources] };
+		});
+		server.setRequestHandler("resources/read", async (message, ctx) => {
+			const conversation = sessionMcpConversationDigest(ctx.mcpReq._meta ?? message.params._meta);
+			const active = await authorizeOperation();
+			const { snapshot, skills, uiResources } = grantedSurface(active.grant, active.target.toolSurface);
+			const skill = skills.find((candidate) => candidate.uri === message.params.uri);
+			if (skill !== void 0) {
+				if (!conversation) throw new ProtocolError(ProtocolErrorCode.InvalidParams, "Use load_skill with conversation metadata to read target-session guidance.");
+				if (!options.resolveConversation) throw new ProtocolError(ProtocolErrorCode.InvalidRequest, "Conversation routing is unavailable in this host.");
+				const text = await (await options.resolveConversation(active.grant, conversation, false, request.signal)).toolSurface.readSkill(snapshot.revision, skill.uri);
+				await authorizeOperation();
+				return { contents: [{
+					uri: skill.uri,
+					mimeType: "text/markdown",
+					text
+				}] };
+			}
+			const resource = uiResources.find((candidate) => candidate.uri === message.params.uri);
+			if (resource !== void 0 && active.target.toolSurface.readUiResource !== void 0) {
+				request.signal.throwIfAborted();
+				const text = await active.target.toolSurface.readUiResource(snapshot.revision, resource.uri);
+				request.signal.throwIfAborted();
+				const current = await authorizeOperation();
+				const after = grantedSurface(current.grant, current.target.toolSurface);
+				if (current.target.toolSurface !== active.target.toolSurface || after.snapshot.revision !== snapshot.revision || !isDeepStrictEqual(after.uiResources.find((candidate) => candidate.uri === resource.uri), resource)) throw new ProtocolError(ProtocolErrorCode.InvalidRequest, "The session UI resource surface has changed.");
+				return { contents: [{
+					...resource,
+					text
+				}] };
+			}
+			if (message.params.uri.startsWith("ui:")) throw new ProtocolError(ProtocolErrorCode.InvalidParams, "UI resource is not granted or active.");
+			throw new ProtocolError(ProtocolErrorCode.InvalidParams, "Use load_skill with conversation metadata to read target-session guidance.");
+		});
+		const handler = createMcpHandler(() => server, { legacy: "reject" });
+		try {
+			return await handler.fetch(request, { authInfo: {
+				token,
+				clientId: grant.clientId,
+				scopes: grant.scope === "session" ? ["session"] : [...grant.tools.map((name) => `tool:${name}`), ...grant.skills.map((name) => `skill:${name}`)],
+				expiresAt: Math.floor(grant.expiresAt / 1e3),
+				resource: new URL(exactResource)
+			} });
+		} catch {
+			return jsonError(500, "Internal MCP server error.");
+		}
+	};
+}
+//#endregion
+export { SESSION_MCP_EXTRA_TOOLS, createSessionMcpHttpHandler };
+
+//# sourceMappingURL=sessionMcpHandler.mjs.map

package/dist/src/server/sessionMcpHandler.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionMcpHandler.mjs","names":[],"sources":["../../../src/server/sessionMcpHandler.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { isDeepStrictEqual } from 'node:util';\n\nimport {\n  createMcpHandler,\n  ProtocolError,\n  ProtocolErrorCode,\n  Server,\n  type CallToolResult,\n  type Tool,\n} from '@modelcontextprotocol/server';\n\nimport type { SessionMcpInvocation } from '../schemas/sessionMcpActivity';\nimport type { SessionMcpAccessGrant, SessionMcpAuthorizationService } from '../services/sessionMcpAuthorization';\nimport { sessionMcpConversationDigest, SessionMcpConversationError } from '../services/sessionMcpConversations';\nimport type { SessionToolDescriptor, SessionToolSurface } from '../types/server/sessionToolSurface';\n\n/** Stable transport tools stay available when a conversation changes its MCP composition. */\nexport const SESSION_MCP_EXTRA_TOOLS: readonly Tool[] = [\n  {\n    name: 'load_extra_tools',\n    title: 'Load extra tools',\n    description: 'Discover tools and skills in this conversation that differ from the last parent catalog refresh.',\n    inputSchema: { type: 'object', properties: {}, additionalProperties: false },\n    annotations: { readOnlyHint: true },\n    _meta: { ui: { visibility: ['model'] } },\n  },\n  {\n    name: 'use_extra_tools',\n    title: 'Use extra tools',\n    description: 'Invoke one currently available extra tool by exact name with its declared arguments.',\n    inputSchema: {\n      type: 'object',\n      properties: { name: { type: 'string' }, arguments: { type: 'object' } },\n      required: ['name'],\n      additionalProperties: false,\n    },\n    _meta: { ui: { visibility: ['model'] } },\n  },\n  {\n    name: 'session_capabilities',\n    title: 'Session capabilities',\n    description:\n      'Inspect the tools and skills currently available in this conversation, independently of the parent catalog diff.',\n    inputSchema: { type: 'object', properties: {}, additionalProperties: false },\n    annotations: { readOnlyHint: true },\n    _meta: { ui: { visibility: ['model'] } },\n  },\n];\n\nexport interface SessionMcpBaseline {\n  readonly tools: readonly Tool[];\n  readonly skills: readonly { name: string; description: string }[];\n}\n\nfunction publicTool(tool: SessionToolDescriptor): Tool {\n  return {\n    name: tool.name,\n    title: tool.label,\n    description: tool.description,\n    inputSchema: tool.parameters as Tool['inputSchema'],\n    ...(tool.annotations === undefined ? {} : { annotations: tool.annotations }),\n    ...(tool.outputSchema === undefined ? {} : { outputSchema: tool.outputSchema }),\n    _meta: {\n      ...tool._meta,\n      ui: { ...tool._meta?.ui, visibility: tool._meta?.ui?.visibility ?? ['model'] },\n    },\n  };\n}\n\nfunction grantedExtraTools(grant: SessionMcpAccessGrant): readonly Tool[] {\n  return grant.scope === 'session'\n    ? SESSION_MCP_EXTRA_TOOLS\n    : SESSION_MCP_EXTRA_TOOLS.filter((tool) => grant.tools.includes(tool.name));\n}\n\nfunction extraTools(baseline: SessionMcpBaseline, tools: readonly SessionToolDescriptor[]): Tool[] {\n  return tools.map(publicTool).filter(\n    (tool) =>\n      !SESSION_MCP_EXTRA_TOOLS.some((wrapper) => wrapper.name === tool.name) &&\n      !isDeepStrictEqual(\n        baseline.tools.find((original) => original.name === tool.name),\n        tool,\n      ),\n  );\n}\n\nfunction toolArguments(name: string, value: unknown): { name?: string; arguments?: Record<string, unknown> } {\n  if (typeof value !== 'object' || value === null || Array.isArray(value))\n    throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid arguments for '${name}'.`);\n  const args = value as Record<string, unknown>;\n  if (\n    Object.keys(args).some((key) => key !== 'name' && key !== 'arguments') ||\n    ((name === 'load_extra_tools' || name === 'session_capabilities') && Object.keys(args).length !== 0) ||\n    (name === 'use_extra_tools' &&\n      (typeof args.name !== 'string' ||\n        args.name.trim() === '' ||\n        (args.arguments !== undefined &&\n          (typeof args.arguments !== 'object' || args.arguments === null || Array.isArray(args.arguments)))))\n  )\n    throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid arguments for '${name}'.`);\n  return args as { name?: string; arguments?: Record<string, unknown> };\n}\nexport interface SessionMcpTarget {\n  readonly generation: number;\n  readonly sessionId?: string;\n  readonly toolSurface: SessionToolSurface;\n}\n\nexport interface SessionMcpHttpHandlerOptions {\n  /** Exact HTTPS resource indicator minted into access grants. */\n  readonly audience: string;\n  readonly authorization: Pick<SessionMcpAuthorizationService, 'authenticateAccessToken' | 'authenticateUrlToken'>;\n  readonly onVerified?: (grant: SessionMcpAccessGrant) => void | Promise<void>;\n  readonly resourceMetadataUrl?: string;\n  /** Signed JWT carried as the final URL path segment instead of an Authorization header. */\n  readonly pathToken?: string;\n  readonly baselines?: Map<string, SessionMcpBaseline>;\n  /** Shared only by signed-URL requests in one live session incarnation. */\n  readonly operations?: SessionMcpOperationRegistry;\n  readonly resolveSession: (sessionId: string) => SessionMcpTarget | undefined | Promise<SessionMcpTarget | undefined>;\n  readonly resolveConversation?: (\n    grant: SessionMcpAccessGrant,\n    digest: string,\n    reserve: boolean,\n    signal?: AbortSignal,\n  ) => SessionMcpTarget | Promise<SessionMcpTarget>;\n  /** Only bounded, non-reversible correlation values are reported here. */\n  readonly onNotice?: (message: string) => void;\n  /** Host-only call history, separate from MCP notices and the agent transcript. */\n  readonly onInvocation?: (invocation: SessionMcpInvocation) => void;\n  readonly serverName?: string;\n  readonly serverVersion?: string;\n}\n\nexport type SessionMcpOperationRegistry = Map<\n  string,\n  { controller: AbortController; owner: string; conversation?: string }\n>;\n\nexport type SessionMcpHttpHandler = (request: Request) => Promise<Response>;\n\nfunction jsonError(status: number, message: string, authenticate = false, resourceMetadataUrl?: string): Response {\n  return Response.json(\n    { jsonrpc: '2.0', error: { code: -32_000, message }, id: null },\n    {\n      status,\n      headers: {\n        'cache-control': 'no-store',\n        ...(authenticate\n          ? {\n              'www-authenticate':\n                resourceMetadataUrl === undefined ? 'Bearer' : `Bearer resource_metadata=\"${resourceMetadataUrl}\"`,\n            }\n          : {}),\n      },\n    },\n  );\n}\n\nfunction bearerToken(request: Request): string | undefined {\n  const authorization = request.headers.get('authorization');\n  const match = authorization === null ? undefined : /^Bearer ([A-Za-z0-9_-]+)$/iu.exec(authorization);\n  return match?.[1];\n}\n\nfunction currentUrl(request: Request): string | undefined {\n  try {\n    const url = new URL(request.url);\n    return url.search === '' && url.hash === '' ? url.href : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction grantedSurface(grant: SessionMcpAccessGrant, surface: SessionToolSurface) {\n  const snapshot = surface.readSurface();\n  if (snapshot.tools.some((tool) => SESSION_MCP_EXTRA_TOOLS.some((wrapper) => wrapper.name === tool.name)))\n    throw new ProtocolError(\n      ProtocolErrorCode.InvalidRequest,\n      'A session tool conflicts with a reserved remote tool name.',\n    );\n  const toolNames = new Set(grant.tools);\n  const skillNames = new Set(grant.skills);\n  const tools = grant.scope === 'session' ? snapshot.tools : snapshot.tools.filter((tool) => toolNames.has(tool.name));\n  const resourceUris = new Set(tools.map((tool) => tool._meta?.ui?.resourceUri));\n  return {\n    snapshot,\n    tools,\n    skills: grant.scope === 'session' ? snapshot.skills : snapshot.skills.filter((skill) => skillNames.has(skill.name)),\n    uiResources: (snapshot.uiResources ?? []).filter((resource) => resourceUris.has(resource.uri)),\n  };\n}\n\n/** Identity is supplied by the approved tool descriptor, never by upstream result metadata. */\nfunction widgetResult(tool: SessionToolDescriptor | undefined, result: CallToolResult): CallToolResult {\n  const widget = tool?._meta?.['doompi/widget'];\n  return typeof widget !== 'string'\n    ? result\n    : {\n        ...result,\n        _meta: { ...result._meta, 'doompi/widget': widget, 'doompi/toolName': tool!.name },\n      };\n}\n\n/** Creates a stateless Streamable HTTP MCP request handler for session capabilities. */\nexport function createSessionMcpHttpHandler(options: SessionMcpHttpHandlerOptions): SessionMcpHttpHandler {\n  const audience = new URL(options.audience);\n  if (\n    audience.protocol !== 'https:' ||\n    audience.username !== '' ||\n    audience.password !== '' ||\n    audience.search !== '' ||\n    audience.hash !== ''\n  ) {\n    throw new Error('Session MCP audience must be an absolute HTTPS URL without credentials, a query, or a fragment.');\n  }\n  const exactAudience = audience.href;\n  if (options.pathToken !== undefined && !/^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/u.test(options.pathToken)) {\n    throw new Error('Session MCP path token must be a compact JWT.');\n  }\n  const exactResource = options.pathToken === undefined ? exactAudience : `${exactAudience}/${options.pathToken}`;\n  const authenticate =\n    options.pathToken === undefined\n      ? options.authorization.authenticateAccessToken\n      : options.authorization.authenticateUrlToken;\n  const operations: SessionMcpOperationRegistry = options.operations ?? new Map();\n  const baselines = options.baselines ?? new Map<string, SessionMcpBaseline>();\n  const operationOwner = (grant: SessionMcpAccessGrant, requestId: string | number): string =>\n    JSON.stringify([grant.clientId, grant.sessionId, grant.sessionGeneration, grant.id, requestId]);\n\n  return async (request) => {\n    if (currentUrl(request) !== exactResource) return jsonError(404, 'MCP resource not found.');\n    const token = options.pathToken ?? bearerToken(request);\n    if (token === undefined)\n      return jsonError(401, 'A Bearer access token is required.', true, options.resourceMetadataUrl);\n    const grant = authenticate(token, exactAudience);\n    if (grant === undefined)\n      return options.pathToken === undefined\n        ? jsonError(401, 'The Bearer access token is invalid or expired.', true, options.resourceMetadataUrl)\n        : jsonError(401, 'The signed MCP URL is invalid or revoked.');\n    const authorizeOperation = async (): Promise<{\n      grant: SessionMcpAccessGrant;\n      target: SessionMcpTarget;\n    }> => {\n      const activeGrant = authenticate(token, exactAudience);\n      if (activeGrant === undefined || activeGrant.id !== grant.id) {\n        throw new ProtocolError(ProtocolErrorCode.InvalidRequest, 'The session grant is no longer active.');\n      }\n      const target = await options.resolveSession(activeGrant.sessionId);\n      const recheckedGrant = authenticate(token, exactAudience);\n      if (\n        recheckedGrant === undefined ||\n        recheckedGrant.id !== activeGrant.id ||\n        target === undefined ||\n        target.generation !== recheckedGrant.sessionGeneration\n      ) {\n        throw new ProtocolError(ProtocolErrorCode.InvalidRequest, 'The session grant is no longer active.');\n      }\n      return { grant: recheckedGrant, target };\n    };\n    try {\n      await authorizeOperation();\n    } catch {\n      return options.pathToken === undefined\n        ? jsonError(401, 'The session grant is no longer active.', true, options.resourceMetadataUrl)\n        : jsonError(401, 'The signed MCP URL is invalid or revoked.');\n    }\n\n    const server = new Server(\n      { name: options.serverName ?? 'doompi-session', version: options.serverVersion ?? '1.0.0' },\n      {\n        capabilities: { tools: {}, resources: {} },\n        instructions:\n          'Use only this bound DoomPi session. Call load_context before work and after selection changes. ' +\n          'Call session_capabilities for the current inventory; load_extra_tools returns only conversation differences. ' +\n          'Invoke extras with use_extra_tools and guidance with load_skill. Inspect before editing and follow repository checks. ' +\n          'Do not assume UI, downloadable files, or background notifications. Read saved logs instead of relaunching work. ' +\n          'Saving a plan does not authorize implementation.',\n      },\n    );\n    server.setNotificationHandler('notifications/cancelled', async (notification) => {\n      const active = await authorizeOperation();\n      if (notification.params.requestId === undefined) return;\n      const owner = operationOwner(active.grant, notification.params.requestId);\n      const conversation = sessionMcpConversationDigest(notification.params._meta);\n      // A notification without a conversation identity cannot safely cancel one\n      // of several child runtimes that may reuse its request ID.\n      if (conversation === undefined) return;\n      const candidates = [...operations.values()].filter(\n        (operation) => operation.owner === owner && operation.conversation === conversation,\n      );\n      if (candidates.length === 1) candidates[0]!.controller.abort();\n    });\n    server.setRequestHandler('tools/list', async () => {\n      const active = await authorizeOperation();\n      await options.onVerified?.(active.grant);\n      const { tools, skills } = grantedSurface(active.grant, active.target.toolSurface);\n      const parentTools = tools.map(publicTool);\n      const wrappers = grantedExtraTools(active.grant);\n      const baseline = structuredClone({\n        tools: parentTools,\n        skills: skills.map(({ name, description }) => ({ name, description })),\n      });\n      await authorizeOperation();\n      baselines.set(active.grant.clientId, baseline);\n      return { tools: [...parentTools, ...wrappers] };\n    });\n    server.setRequestHandler('tools/call', async (message, ctx): Promise<CallToolResult> => {\n      const conversation = sessionMcpConversationDigest(\n        ctx.mcpReq._meta ?? (message.params as { _meta?: unknown })._meta,\n      );\n      const owner = operationOwner(grant, ctx.mcpReq.id);\n      const key = JSON.stringify([owner, conversation]);\n      if (operations.has(key))\n        throw new ProtocolError(\n          ProtocolErrorCode.InvalidRequest,\n          'A tool call with this request identity is already active.',\n        );\n      if (options.operations !== undefined && operations.size >= 1024)\n        throw new ProtocolError(ProtocolErrorCode.InvalidRequest, 'Too many active MCP tool calls. Retry later.');\n      const controller = new AbortController();\n      operations.set(key, { controller, owner, conversation });\n      const signal = AbortSignal.any([request.signal, ctx.mcpReq.signal, controller.signal]);\n      const invocationId = randomUUID();\n      let skillAccessOpen = true;\n      let widgetTool: SessionToolDescriptor | undefined;\n      let invocation: SessionMcpInvocation | undefined;\n      const publishInvocation = (): void => {\n        if (invocation?.sessionId === undefined) return;\n        try {\n          options.onInvocation?.({ ...invocation });\n        } catch {\n          // Observability failures must not turn an already executed tool into a retryable failure.\n          options.onNotice?.('session MCP call history could not be saved');\n        }\n      };\n      const completeInvocation = (result: CallToolResult): CallToolResult => {\n        if (invocation !== undefined) {\n          invocation = {\n            ...invocation,\n            status: signal.aborted ? 'cancelled' : result.isError ? 'failed' : 'succeeded',\n            finishedAt: Date.now(),\n            output: result.structuredContent ?? result.content,\n          };\n          publishInvocation();\n        }\n        return result;\n      };\n      try {\n        const parent = await authorizeOperation();\n        invocation = {\n          id: invocationId,\n          parentSessionId: parent.grant.sessionId,\n          clientId: parent.grant.clientId,\n          conversationDigest: conversation,\n          toolName: message.params.name,\n          startedAt: Date.now(),\n          status: 'running',\n          input: message.params.arguments ?? {},\n        };\n        publishInvocation();\n        const wrapper = grantedExtraTools(parent.grant).some((tool) => tool.name === message.params.name);\n        const advertised = wrapper\n          ? undefined\n          : grantedSurface(parent.grant, parent.target.toolSurface).tools.find(\n              (tool) => tool.name === message.params.name,\n            );\n        if (!wrapper && !advertised)\n          throw new ProtocolError(\n            ProtocolErrorCode.InvalidParams,\n            `Tool '${message.params.name}' is not granted or active.`,\n          );\n        widgetTool = advertised;\n        const wrapperArgs = wrapper ? toolArguments(message.params.name, message.params.arguments ?? {}) : undefined;\n        // A binding must not outlive an unpersisted registration when tools/call precedes tools/list.\n        await options.onVerified?.(parent.grant);\n        options.onNotice?.(`session MCP invocation id=${invocationId} lifecycle=started`);\n        const resolveTarget = async (reserve: boolean) => {\n          const active = await authorizeOperation();\n          if (!conversation)\n            throw new SessionMcpConversationError(\n              'CONVERSATION_ID_REQUIRED',\n              'This connection requires conversation metadata. Use a compatible ChatGPT conversation and retry.',\n            );\n          if (!options.resolveConversation)\n            throw new SessionMcpConversationError(\n              'CONVERSATION_ROUTING_UNAVAILABLE',\n              'Conversation routing is unavailable in this host.',\n            );\n          signal.throwIfAborted();\n          const target = await options.resolveConversation(active.grant, conversation, reserve, signal);\n          await authorizeOperation();\n          signal.throwIfAborted();\n          return { grant: active.grant, target };\n        };\n        if (wrapper && !conversation)\n          throw new SessionMcpConversationError(\n            'CONVERSATION_ID_REQUIRED',\n            'This connection requires conversation metadata. Use a compatible ChatGPT conversation and retry.',\n          );\n        if (\n          (message.params.name === 'load_extra_tools' || message.params.name === 'use_extra_tools') &&\n          !baselines.has(parent.grant.clientId)\n        )\n          throw new SessionMcpConversationError(\n            'SESSION_MCP_BASELINE_REQUIRED',\n            'Refresh this MCP connection tool catalog before loading or using extra tools.',\n          );\n        const active = await resolveTarget(true);\n        invocation = { ...invocation, sessionId: active.target.sessionId ?? parent.grant.sessionId };\n        publishInvocation();\n        const { snapshot, tools, skills } = grantedSurface(active.grant, active.target.toolSurface);\n        const baseline = baselines.get(parent.grant.clientId);\n        const extras = wrapper && baseline ? extraTools(baseline, tools) : [];\n        if (message.params.name === 'session_capabilities' && wrapper) {\n          const capabilities = {\n            sessionId: active.target.sessionId ?? parent.grant.sessionId,\n            generation: active.target.generation,\n            revision: snapshot.revision,\n            baseline: baseline === undefined ? 'missing' : 'available',\n            inventory: 'active_surface',\n            discovery: 'unknown',\n            tools: [...tools.map(publicTool), ...grantedExtraTools(active.grant)],\n            skills: skills.map(({ name, description }) => ({ name, description })),\n          };\n          const current = await resolveTarget(false);\n          if (\n            current.target.toolSurface !== active.target.toolSurface ||\n            current.target.generation !== active.target.generation ||\n            current.target.sessionId !== active.target.sessionId ||\n            current.target.toolSurface.readSurface().revision !== snapshot.revision\n          )\n            throw new ProtocolError(ProtocolErrorCode.InvalidRequest, 'The session tool surface has changed.');\n          options.onNotice?.(`session MCP invocation id=${invocationId} lifecycle=succeeded`);\n          return completeInvocation({\n            content: [{ type: 'text', text: JSON.stringify(capabilities) }],\n            structuredContent: capabilities,\n            isError: false,\n          });\n        }\n        if (message.params.name === 'load_extra_tools' && wrapper) {\n          const discovery = {\n            tools: extras,\n            skills: (tools.some((tool) => tool.name === 'load_skill') ? skills : [])\n              .map(({ name, description }) => ({ name, description }))\n              .filter(\n                (skill) =>\n                  !isDeepStrictEqual(\n                    baseline!.skills.find((original) => original.name === skill.name),\n                    skill,\n                  ),\n              ),\n          };\n          const current = await resolveTarget(false);\n          if (\n            current.target.toolSurface !== active.target.toolSurface ||\n            current.target.generation !== active.target.generation ||\n            current.target.sessionId !== active.target.sessionId ||\n            current.target.toolSurface.readSurface().revision !== snapshot.revision\n          )\n            throw new ProtocolError(ProtocolErrorCode.InvalidRequest, 'The session tool surface has changed.');\n          options.onNotice?.(`session MCP invocation id=${invocationId} lifecycle=succeeded`);\n          return completeInvocation({\n            content: [{ type: 'text', text: JSON.stringify(discovery) }],\n            structuredContent: discovery,\n            isError: false,\n          });\n        }\n        const name = wrapper ? wrapperArgs!.name! : message.params.name;\n        const selected = tools.find((tool) => tool.name === name);\n        if (wrapper && (!extras.some((tool) => tool.name === name) || !selected))\n          throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Extra tool '${name}' is not granted or active.`);\n        if (\n          !wrapper &&\n          (!selected ||\n            !isDeepStrictEqual(selected.parameters, advertised!.parameters) ||\n            !isDeepStrictEqual(selected.outputSchema, advertised!.outputSchema) ||\n            !isDeepStrictEqual(selected.annotations, advertised!.annotations) ||\n            !isDeepStrictEqual(selected._meta, advertised!._meta))\n        )\n          throw new SessionMcpConversationError(\n            'SESSION_TOOL_SURFACE_CHANGED',\n            'The target session does not expose the approved tool contract. Refresh the connection or restore a compatible session selection.',\n          );\n        widgetTool = wrapper ? undefined : selected;\n        const recheck = async () => {\n          const current = await resolveTarget(false);\n          if (\n            current.target.toolSurface !== active.target.toolSurface ||\n            current.target.generation !== active.target.generation ||\n            current.target.sessionId !== active.target.sessionId\n          )\n            throw new ProtocolError(ProtocolErrorCode.InvalidRequest, 'The session tool surface has changed.');\n          if (wrapper) {\n            if (!grantedExtraTools(current.grant).some((tool) => tool.name === message.params.name))\n              throw new ProtocolError(ProtocolErrorCode.InvalidRequest, 'The connection tool surface has changed.');\n          } else {\n            const currentAdvertised = grantedSurface(current.grant, parent.target.toolSurface).tools.find(\n              (tool) => tool.name === message.params.name,\n            );\n            if (!currentAdvertised || !isDeepStrictEqual(currentAdvertised, advertised))\n              throw new ProtocolError(ProtocolErrorCode.InvalidRequest, 'The connection tool surface has changed.');\n          }\n          return current;\n        };\n        const authorizedSkills = async () => {\n          if (!skillAccessOpen)\n            throw new ProtocolError(ProtocolErrorCode.InvalidRequest, 'Remote skill access is no longer active.');\n          signal.throwIfAborted();\n          const current = await recheck();\n          signal.throwIfAborted();\n          return grantedSurface(current.grant, current.target.toolSurface);\n        };\n        const mcpSkills = {\n          async list() {\n            const { skills } = await authorizedSkills();\n            return skills.map(({ name, description }) => ({ name, description }));\n          },\n          async read(name: string) {\n            const current = await authorizedSkills();\n            const skill = current.skills.find((candidate) => candidate.name === name);\n            if (!skill) throw new ProtocolError(ProtocolErrorCode.InvalidParams, 'Skill is not granted or active.');\n            const text = await active.target.toolSurface.readSkill(current.snapshot.revision, skill.uri);\n            signal.throwIfAborted();\n            const after = await authorizedSkills();\n            if (after.snapshot.revision !== current.snapshot.revision)\n              throw new ProtocolError(ProtocolErrorCode.InvalidRequest, 'The session skill surface has changed.');\n            return text;\n          },\n        };\n        invocation = {\n          ...invocation,\n          toolName: name,\n          input: wrapper ? (wrapperArgs!.arguments ?? {}) : (message.params.arguments ?? {}),\n        };\n        publishInvocation();\n        const result = await active.target.toolSurface.invokeTool({\n          revision: snapshot.revision,\n          name,\n          arguments: wrapper ? (wrapperArgs!.arguments ?? {}) : (message.params.arguments ?? {}),\n          signal,\n          mcpSkills,\n          authorize: async () => {\n            const current = await recheck();\n            if (wrapper) {\n              const currentTool = grantedSurface(current.grant, current.target.toolSurface).tools.find(\n                (tool) => tool.name === name,\n              );\n              if (!currentTool || !isDeepStrictEqual(currentTool, selected))\n                throw new ProtocolError(ProtocolErrorCode.InvalidRequest, 'The extra tool surface has changed.');\n            }\n          },\n        });\n        await recheck();\n        options.onNotice?.(`session MCP invocation id=${invocationId} lifecycle=succeeded`);\n        return completeInvocation(\n          widgetResult(wrapper ? undefined : selected, {\n            content: result.content,\n            ...(result.structuredContent === undefined ? {} : { structuredContent: result.structuredContent }),\n            ...(result._meta === undefined ? {} : { _meta: result._meta }),\n            isError: result.isError ?? false,\n          }),\n        );\n      } catch (error) {\n        // The cause is logged because the client may drop the answer, for example on a timeout\n        // during a first call that provisions a worktree, and then nothing else records why. Only a\n        // class or code: a message can carry tool arguments, which notices never do.\n        const cause =\n          error instanceof SessionMcpConversationError\n            ? error.code\n            : signal.aborted\n              ? 'aborted'\n              : error instanceof ProtocolError\n                ? `mcp_${String(error.code)}`\n                : error instanceof Error\n                  ? error.name\n                  : 'unknown';\n        options.onNotice?.(`session MCP invocation id=${invocationId} lifecycle=failed cause=${cause}`);\n        if (invocation !== undefined) {\n          invocation = {\n            ...invocation,\n            status: signal.aborted ? 'cancelled' : 'failed',\n            finishedAt: Date.now(),\n            output: { cause, message: error instanceof Error ? error.message : 'Tool call failed.' },\n          };\n          publishInvocation();\n        }\n        if (!(error instanceof SessionMcpConversationError)) throw error;\n        return widgetResult(widgetTool, {\n          content: [{ type: 'text', text: error.message }],\n          isError: true,\n          structuredContent: {\n            code: error.code,\n            message: error.message,\n            ...(error.bindingId === undefined ? {} : { bindingId: error.bindingId }),\n          },\n        });\n      } finally {\n        skillAccessOpen = false;\n        operations.delete(key);\n      }\n    });\n    server.setRequestHandler('resources/list', async () => {\n      const active = await authorizeOperation();\n      const { uiResources } = grantedSurface(active.grant, active.target.toolSurface);\n      return {\n        resources: [...uiResources],\n      };\n    });\n    server.setRequestHandler('resources/read', async (message, ctx) => {\n      const conversation = sessionMcpConversationDigest(\n        ctx.mcpReq._meta ?? (message.params as { _meta?: unknown })._meta,\n      );\n      const active = await authorizeOperation();\n      const { snapshot, skills, uiResources } = grantedSurface(active.grant, active.target.toolSurface);\n      const skill = skills.find((candidate) => candidate.uri === message.params.uri);\n      if (skill !== undefined) {\n        if (!conversation)\n          throw new ProtocolError(\n            ProtocolErrorCode.InvalidParams,\n            'Use load_skill with conversation metadata to read target-session guidance.',\n          );\n        if (!options.resolveConversation)\n          throw new ProtocolError(\n            ProtocolErrorCode.InvalidRequest,\n            'Conversation routing is unavailable in this host.',\n          );\n        const target = await options.resolveConversation(active.grant, conversation, false, request.signal);\n        const text = await target.toolSurface.readSkill(snapshot.revision, skill.uri);\n        await authorizeOperation();\n        return { contents: [{ uri: skill.uri, mimeType: 'text/markdown', text }] };\n      }\n      const resource = uiResources.find((candidate) => candidate.uri === message.params.uri);\n      if (resource !== undefined && active.target.toolSurface.readUiResource !== undefined) {\n        // Templates are immutable and session-independent, so hosts may prefetch them without a conversation ID.\n        request.signal.throwIfAborted();\n        const text = await active.target.toolSurface.readUiResource(snapshot.revision, resource.uri);\n        request.signal.throwIfAborted();\n        const current = await authorizeOperation();\n        const after = grantedSurface(current.grant, current.target.toolSurface);\n        if (\n          current.target.toolSurface !== active.target.toolSurface ||\n          after.snapshot.revision !== snapshot.revision ||\n          !isDeepStrictEqual(\n            after.uiResources.find((candidate) => candidate.uri === resource.uri),\n            resource,\n          )\n        )\n          throw new ProtocolError(ProtocolErrorCode.InvalidRequest, 'The session UI resource surface has changed.');\n        return { contents: [{ ...resource, text }] };\n      }\n      if (message.params.uri.startsWith('ui:'))\n        throw new ProtocolError(ProtocolErrorCode.InvalidParams, 'UI resource is not granted or active.');\n      throw new ProtocolError(\n        ProtocolErrorCode.InvalidParams,\n        'Use load_skill with conversation metadata to read target-session guidance.',\n      );\n    });\n\n    // One server per request, as before. Only the 2026-07-28 revision is served; a 2025-era request\n    // is refused with the versions this endpoint supports.\n    const handler = createMcpHandler(() => server, { legacy: 'reject' });\n    try {\n      return await handler.fetch(request, {\n        authInfo: {\n          token,\n          clientId: grant.clientId,\n          scopes:\n            grant.scope === 'session'\n              ? ['session']\n              : [...grant.tools.map((name) => `tool:${name}`), ...grant.skills.map((name) => `skill:${name}`)],\n          expiresAt: Math.floor(grant.expiresAt / 1000),\n          resource: new URL(exactResource),\n        },\n      });\n    } catch {\n      return jsonError(500, 'Internal MCP server error.');\n    }\n  };\n}\n"],"mappings":";;;;;;AAkBA,MAAa,0BAA2C;CACtD;EACE,MAAM;EACN,OAAO;EACP,aAAa;EACb,aAAa;GAAE,MAAM;GAAU,YAAY,CAAC;GAAG,sBAAsB;EAAM;EAC3E,aAAa,EAAE,cAAc,KAAK;EAClC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,EAAE;CACzC;CACA;EACE,MAAM;EACN,OAAO;EACP,aAAa;EACb,aAAa;GACX,MAAM;GACN,YAAY;IAAE,MAAM,EAAE,MAAM,SAAS;IAAG,WAAW,EAAE,MAAM,SAAS;GAAE;GACtE,UAAU,CAAC,MAAM;GACjB,sBAAsB;EACxB;EACA,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,EAAE;CACzC;CACA;EACE,MAAM;EACN,OAAO;EACP,aACE;EACF,aAAa;GAAE,MAAM;GAAU,YAAY,CAAC;GAAG,sBAAsB;EAAM;EAC3E,aAAa,EAAE,cAAc,KAAK;EAClC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,EAAE;CACzC;AACF;AAOA,SAAS,WAAW,MAAmC;CACrD,OAAO;EACL,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,aAAa,KAAK;EAClB,aAAa,KAAK;EAClB,GAAI,KAAK,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY;EAC1E,GAAI,KAAK,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,KAAK,aAAa;EAC7E,OAAO;GACL,GAAG,KAAK;GACR,IAAI;IAAE,GAAG,KAAK,OAAO;IAAI,YAAY,KAAK,OAAO,IAAI,cAAc,CAAC,OAAO;GAAE;EAC/E;CACF;AACF;AAEA,SAAS,kBAAkB,OAA+C;CACxE,OAAO,MAAM,UAAU,YACnB,0BACA,wBAAwB,QAAQ,SAAS,MAAM,MAAM,SAAS,KAAK,IAAI,CAAC;AAC9E;AAEA,SAAS,WAAW,UAA8B,OAAiD;CACjG,OAAO,MAAM,IAAI,UAAU,CAAC,CAAC,QAC1B,SACC,CAAC,wBAAwB,MAAM,YAAY,QAAQ,SAAS,KAAK,IAAI,KACrE,CAAC,kBACC,SAAS,MAAM,MAAM,aAAa,SAAS,SAAS,KAAK,IAAI,GAC7D,IACF,CACJ;AACF;AAEA,SAAS,cAAc,MAAc,OAAwE;CAC3G,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,cAAc,kBAAkB,eAAe,0BAA0B,KAAK,GAAG;CAC7F,MAAM,OAAO;CACb,IACE,OAAO,KAAK,IAAI,CAAC,CAAC,MAAM,QAAQ,QAAQ,UAAU,QAAQ,WAAW,MACnE,SAAS,sBAAsB,SAAS,2BAA2B,OAAO,KAAK,IAAI,CAAC,CAAC,WAAW,KACjG,SAAS,sBACP,OAAO,KAAK,SAAS,YACpB,KAAK,KAAK,KAAK,MAAM,MACpB,KAAK,cAAc,KAAA,MACjB,OAAO,KAAK,cAAc,YAAY,KAAK,cAAc,QAAQ,MAAM,QAAQ,KAAK,SAAS,KAEpG,MAAM,IAAI,cAAc,kBAAkB,eAAe,0BAA0B,KAAK,GAAG;CAC7F,OAAO;AACT;AAwCA,SAAS,UAAU,QAAgB,SAAiB,eAAe,OAAO,qBAAwC;CAChH,OAAO,SAAS,KACd;EAAE,SAAS;EAAO,OAAO;GAAE,MAAM;GAAS;EAAQ;EAAG,IAAI;CAAK,GAC9D;EACE;EACA,SAAS;GACP,iBAAiB;GACjB,GAAI,eACA,EACE,oBACE,wBAAwB,KAAA,IAAY,WAAW,6BAA6B,oBAAoB,GACpG,IACA,CAAC;EACP;CACF,CACF;AACF;AAEA,SAAS,YAAY,SAAsC;CACzD,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,eAAe;CAEzD,QADc,kBAAkB,OAAO,KAAA,IAAY,8BAA8B,KAAK,aAAa,EAAA,GACpF;AACjB;AAEA,SAAS,WAAW,SAAsC;CACxD,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;EAC/B,OAAO,IAAI,WAAW,MAAM,IAAI,SAAS,KAAK,IAAI,OAAO,KAAA;CAC3D,QAAQ;EACN;CACF;AACF;AAEA,SAAS,eAAe,OAA8B,SAA6B;CACjF,MAAM,WAAW,QAAQ,YAAY;CACrC,IAAI,SAAS,MAAM,MAAM,SAAS,wBAAwB,MAAM,YAAY,QAAQ,SAAS,KAAK,IAAI,CAAC,GACrG,MAAM,IAAI,cACR,kBAAkB,gBAClB,4DACF;CACF,MAAM,YAAY,IAAI,IAAI,MAAM,KAAK;CACrC,MAAM,aAAa,IAAI,IAAI,MAAM,MAAM;CACvC,MAAM,QAAQ,MAAM,UAAU,YAAY,SAAS,QAAQ,SAAS,MAAM,QAAQ,SAAS,UAAU,IAAI,KAAK,IAAI,CAAC;CACnH,MAAM,eAAe,IAAI,IAAI,MAAM,KAAK,SAAS,KAAK,OAAO,IAAI,WAAW,CAAC;CAC7E,OAAO;EACL;EACA;EACA,QAAQ,MAAM,UAAU,YAAY,SAAS,SAAS,SAAS,OAAO,QAAQ,UAAU,WAAW,IAAI,MAAM,IAAI,CAAC;EAClH,cAAc,SAAS,eAAe,CAAC,EAAA,CAAG,QAAQ,aAAa,aAAa,IAAI,SAAS,GAAG,CAAC;CAC/F;AACF;;AAGA,SAAS,aAAa,MAAyC,QAAwC;CACrG,MAAM,SAAS,MAAM,QAAQ;CAC7B,OAAO,OAAO,WAAW,WACrB,SACA;EACE,GAAG;EACH,OAAO;GAAE,GAAG,OAAO;GAAO,iBAAiB;GAAQ,mBAAmB,KAAM;EAAK;CACnF;AACN;;AAGA,SAAgB,4BAA4B,SAA8D;CACxG,MAAM,WAAW,IAAI,IAAI,QAAQ,QAAQ;CACzC,IACE,SAAS,aAAa,YACtB,SAAS,aAAa,MACtB,SAAS,aAAa,MACtB,SAAS,WAAW,MACpB,SAAS,SAAS,IAElB,MAAM,IAAI,MAAM,iGAAiG;CAEnH,MAAM,gBAAgB,SAAS;CAC/B,IAAI,QAAQ,cAAc,KAAA,KAAa,CAAC,oDAAoD,KAAK,QAAQ,SAAS,GAChH,MAAM,IAAI,MAAM,+CAA+C;CAEjE,MAAM,gBAAgB,QAAQ,cAAc,KAAA,IAAY,gBAAgB,GAAG,cAAc,GAAG,QAAQ;CACpG,MAAM,eACJ,QAAQ,cAAc,KAAA,IAClB,QAAQ,cAAc,0BACtB,QAAQ,cAAc;CAC5B,MAAM,aAA0C,QAAQ,8BAAc,IAAI,IAAI;CAC9E,MAAM,YAAY,QAAQ,6BAAa,IAAI,IAAgC;CAC3E,MAAM,kBAAkB,OAA8B,cACpD,KAAK,UAAU;EAAC,MAAM;EAAU,MAAM;EAAW,MAAM;EAAmB,MAAM;EAAI;CAAS,CAAC;CAEhG,OAAO,OAAO,YAAY;EACxB,IAAI,WAAW,OAAO,MAAM,eAAe,OAAO,UAAU,KAAK,yBAAyB;EAC1F,MAAM,QAAQ,QAAQ,aAAa,YAAY,OAAO;EACtD,IAAI,UAAU,KAAA,GACZ,OAAO,UAAU,KAAK,sCAAsC,MAAM,QAAQ,mBAAmB;EAC/F,MAAM,QAAQ,aAAa,OAAO,aAAa;EAC/C,IAAI,UAAU,KAAA,GACZ,OAAO,QAAQ,cAAc,KAAA,IACzB,UAAU,KAAK,kDAAkD,MAAM,QAAQ,mBAAmB,IAClG,UAAU,KAAK,2CAA2C;EAChE,MAAM,qBAAqB,YAGrB;GACJ,MAAM,cAAc,aAAa,OAAO,aAAa;GACrD,IAAI,gBAAgB,KAAA,KAAa,YAAY,OAAO,MAAM,IACxD,MAAM,IAAI,cAAc,kBAAkB,gBAAgB,wCAAwC;GAEpG,MAAM,SAAS,MAAM,QAAQ,eAAe,YAAY,SAAS;GACjE,MAAM,iBAAiB,aAAa,OAAO,aAAa;GACxD,IACE,mBAAmB,KAAA,KACnB,eAAe,OAAO,YAAY,MAClC,WAAW,KAAA,KACX,OAAO,eAAe,eAAe,mBAErC,MAAM,IAAI,cAAc,kBAAkB,gBAAgB,wCAAwC;GAEpG,OAAO;IAAE,OAAO;IAAgB;GAAO;EACzC;EACA,IAAI;GACF,MAAM,mBAAmB;EAC3B,QAAQ;GACN,OAAO,QAAQ,cAAc,KAAA,IACzB,UAAU,KAAK,0CAA0C,MAAM,QAAQ,mBAAmB,IAC1F,UAAU,KAAK,2CAA2C;EAChE;EAEA,MAAM,SAAS,IAAI,OACjB;GAAE,MAAM,QAAQ,cAAc;GAAkB,SAAS,QAAQ,iBAAiB;EAAQ,GAC1F;GACE,cAAc;IAAE,OAAO,CAAC;IAAG,WAAW,CAAC;GAAE;GACzC,cACE;EAKJ,CACF;EACA,OAAO,uBAAuB,2BAA2B,OAAO,iBAAiB;GAC/E,MAAM,SAAS,MAAM,mBAAmB;GACxC,IAAI,aAAa,OAAO,cAAc,KAAA,GAAW;GACjD,MAAM,QAAQ,eAAe,OAAO,OAAO,aAAa,OAAO,SAAS;GACxE,MAAM,eAAe,6BAA6B,aAAa,OAAO,KAAK;GAG3E,IAAI,iBAAiB,KAAA,GAAW;GAChC,MAAM,aAAa,CAAC,GAAG,WAAW,OAAO,CAAC,CAAC,CAAC,QACzC,cAAc,UAAU,UAAU,SAAS,UAAU,iBAAiB,YACzE;GACA,IAAI,WAAW,WAAW,GAAG,WAAW,EAAE,CAAE,WAAW,MAAM;EAC/D,CAAC;EACD,OAAO,kBAAkB,cAAc,YAAY;GACjD,MAAM,SAAS,MAAM,mBAAmB;GACxC,MAAM,QAAQ,aAAa,OAAO,KAAK;GACvC,MAAM,EAAE,OAAO,WAAW,eAAe,OAAO,OAAO,OAAO,OAAO,WAAW;GAChF,MAAM,cAAc,MAAM,IAAI,UAAU;GACxC,MAAM,WAAW,kBAAkB,OAAO,KAAK;GAC/C,MAAM,WAAW,gBAAgB;IAC/B,OAAO;IACP,QAAQ,OAAO,KAAK,EAAE,MAAM,mBAAmB;KAAE;KAAM;IAAY,EAAE;GACvE,CAAC;GACD,MAAM,mBAAmB;GACzB,UAAU,IAAI,OAAO,MAAM,UAAU,QAAQ;GAC7C,OAAO,EAAE,OAAO,CAAC,GAAG,aAAa,GAAG,QAAQ,EAAE;EAChD,CAAC;EACD,OAAO,kBAAkB,cAAc,OAAO,SAAS,QAAiC;GACtF,MAAM,eAAe,6BACnB,IAAI,OAAO,SAAU,QAAQ,OAA+B,KAC9D;GACA,MAAM,QAAQ,eAAe,OAAO,IAAI,OAAO,EAAE;GACjD,MAAM,MAAM,KAAK,UAAU,CAAC,OAAO,YAAY,CAAC;GAChD,IAAI,WAAW,IAAI,GAAG,GACpB,MAAM,IAAI,cACR,kBAAkB,gBAClB,2DACF;GACF,IAAI,QAAQ,eAAe,KAAA,KAAa,WAAW,QAAQ,MACzD,MAAM,IAAI,cAAc,kBAAkB,gBAAgB,8CAA8C;GAC1G,MAAM,aAAa,IAAI,gBAAgB;GACvC,WAAW,IAAI,KAAK;IAAE;IAAY;IAAO;GAAa,CAAC;GACvD,MAAM,SAAS,YAAY,IAAI;IAAC,QAAQ;IAAQ,IAAI,OAAO;IAAQ,WAAW;GAAM,CAAC;GACrF,MAAM,eAAe,WAAW;GAChC,IAAI,kBAAkB;GACtB,IAAI;GACJ,IAAI;GACJ,MAAM,0BAAgC;IACpC,IAAI,YAAY,cAAc,KAAA,GAAW;IACzC,IAAI;KACF,QAAQ,eAAe,EAAE,GAAG,WAAW,CAAC;IAC1C,QAAQ;KAEN,QAAQ,WAAW,6CAA6C;IAClE;GACF;GACA,MAAM,sBAAsB,WAA2C;IACrE,IAAI,eAAe,KAAA,GAAW;KAC5B,aAAa;MACX,GAAG;MACH,QAAQ,OAAO,UAAU,cAAc,OAAO,UAAU,WAAW;MACnE,YAAY,KAAK,IAAI;MACrB,QAAQ,OAAO,qBAAqB,OAAO;KAC7C;KACA,kBAAkB;IACpB;IACA,OAAO;GACT;GACA,IAAI;IACF,MAAM,SAAS,MAAM,mBAAmB;IACxC,aAAa;KACX,IAAI;KACJ,iBAAiB,OAAO,MAAM;KAC9B,UAAU,OAAO,MAAM;KACvB,oBAAoB;KACpB,UAAU,QAAQ,OAAO;KACzB,WAAW,KAAK,IAAI;KACpB,QAAQ;KACR,OAAO,QAAQ,OAAO,aAAa,CAAC;IACtC;IACA,kBAAkB;IAClB,MAAM,UAAU,kBAAkB,OAAO,KAAK,CAAC,CAAC,MAAM,SAAS,KAAK,SAAS,QAAQ,OAAO,IAAI;IAChG,MAAM,aAAa,UACf,KAAA,IACA,eAAe,OAAO,OAAO,OAAO,OAAO,WAAW,CAAC,CAAC,MAAM,MAC3D,SAAS,KAAK,SAAS,QAAQ,OAAO,IACzC;IACJ,IAAI,CAAC,WAAW,CAAC,YACf,MAAM,IAAI,cACR,kBAAkB,eAClB,SAAS,QAAQ,OAAO,KAAK,4BAC/B;IACF,aAAa;IACb,MAAM,cAAc,UAAU,cAAc,QAAQ,OAAO,MAAM,QAAQ,OAAO,aAAa,CAAC,CAAC,IAAI,KAAA;IAEnG,MAAM,QAAQ,aAAa,OAAO,KAAK;IACvC,QAAQ,WAAW,6BAA6B,aAAa,mBAAmB;IAChF,MAAM,gBAAgB,OAAO,YAAqB;KAChD,MAAM,SAAS,MAAM,mBAAmB;KACxC,IAAI,CAAC,cACH,MAAM,IAAI,4BACR,4BACA,kGACF;KACF,IAAI,CAAC,QAAQ,qBACX,MAAM,IAAI,4BACR,oCACA,mDACF;KACF,OAAO,eAAe;KACtB,MAAM,SAAS,MAAM,QAAQ,oBAAoB,OAAO,OAAO,cAAc,SAAS,MAAM;KAC5F,MAAM,mBAAmB;KACzB,OAAO,eAAe;KACtB,OAAO;MAAE,OAAO,OAAO;MAAO;KAAO;IACvC;IACA,IAAI,WAAW,CAAC,cACd,MAAM,IAAI,4BACR,4BACA,kGACF;IACF,KACG,QAAQ,OAAO,SAAS,sBAAsB,QAAQ,OAAO,SAAS,sBACvE,CAAC,UAAU,IAAI,OAAO,MAAM,QAAQ,GAEpC,MAAM,IAAI,4BACR,iCACA,+EACF;IACF,MAAM,SAAS,MAAM,cAAc,IAAI;IACvC,aAAa;KAAE,GAAG;KAAY,WAAW,OAAO,OAAO,aAAa,OAAO,MAAM;IAAU;IAC3F,kBAAkB;IAClB,MAAM,EAAE,UAAU,OAAO,WAAW,eAAe,OAAO,OAAO,OAAO,OAAO,WAAW;IAC1F,MAAM,WAAW,UAAU,IAAI,OAAO,MAAM,QAAQ;IACpD,MAAM,SAAS,WAAW,WAAW,WAAW,UAAU,KAAK,IAAI,CAAC;IACpE,IAAI,QAAQ,OAAO,SAAS,0BAA0B,SAAS;KAC7D,MAAM,eAAe;MACnB,WAAW,OAAO,OAAO,aAAa,OAAO,MAAM;MACnD,YAAY,OAAO,OAAO;MAC1B,UAAU,SAAS;MACnB,UAAU,aAAa,KAAA,IAAY,YAAY;MAC/C,WAAW;MACX,WAAW;MACX,OAAO,CAAC,GAAG,MAAM,IAAI,UAAU,GAAG,GAAG,kBAAkB,OAAO,KAAK,CAAC;MACpE,QAAQ,OAAO,KAAK,EAAE,MAAM,mBAAmB;OAAE;OAAM;MAAY,EAAE;KACvE;KACA,MAAM,UAAU,MAAM,cAAc,KAAK;KACzC,IACE,QAAQ,OAAO,gBAAgB,OAAO,OAAO,eAC7C,QAAQ,OAAO,eAAe,OAAO,OAAO,cAC5C,QAAQ,OAAO,cAAc,OAAO,OAAO,aAC3C,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,aAAa,SAAS,UAE/D,MAAM,IAAI,cAAc,kBAAkB,gBAAgB,uCAAuC;KACnG,QAAQ,WAAW,6BAA6B,aAAa,qBAAqB;KAClF,OAAO,mBAAmB;MACxB,SAAS,CAAC;OAAE,MAAM;OAAQ,MAAM,KAAK,UAAU,YAAY;MAAE,CAAC;MAC9D,mBAAmB;MACnB,SAAS;KACX,CAAC;IACH;IACA,IAAI,QAAQ,OAAO,SAAS,sBAAsB,SAAS;KACzD,MAAM,YAAY;MAChB,OAAO;MACP,SAAS,MAAM,MAAM,SAAS,KAAK,SAAS,YAAY,IAAI,SAAS,CAAC,EAAA,CACnE,KAAK,EAAE,MAAM,mBAAmB;OAAE;OAAM;MAAY,EAAE,CAAC,CACvD,QACE,UACC,CAAC,kBACC,SAAU,OAAO,MAAM,aAAa,SAAS,SAAS,MAAM,IAAI,GAChE,KACF,CACJ;KACJ;KACA,MAAM,UAAU,MAAM,cAAc,KAAK;KACzC,IACE,QAAQ,OAAO,gBAAgB,OAAO,OAAO,eAC7C,QAAQ,OAAO,eAAe,OAAO,OAAO,cAC5C,QAAQ,OAAO,cAAc,OAAO,OAAO,aAC3C,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,aAAa,SAAS,UAE/D,MAAM,IAAI,cAAc,kBAAkB,gBAAgB,uCAAuC;KACnG,QAAQ,WAAW,6BAA6B,aAAa,qBAAqB;KAClF,OAAO,mBAAmB;MACxB,SAAS,CAAC;OAAE,MAAM;OAAQ,MAAM,KAAK,UAAU,SAAS;MAAE,CAAC;MAC3D,mBAAmB;MACnB,SAAS;KACX,CAAC;IACH;IACA,MAAM,OAAO,UAAU,YAAa,OAAQ,QAAQ,OAAO;IAC3D,MAAM,WAAW,MAAM,MAAM,SAAS,KAAK,SAAS,IAAI;IACxD,IAAI,YAAY,CAAC,OAAO,MAAM,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,WAC7D,MAAM,IAAI,cAAc,kBAAkB,eAAe,eAAe,KAAK,4BAA4B;IAC3G,IACE,CAAC,YACA,CAAC,YACA,CAAC,kBAAkB,SAAS,YAAY,WAAY,UAAU,KAC9D,CAAC,kBAAkB,SAAS,cAAc,WAAY,YAAY,KAClE,CAAC,kBAAkB,SAAS,aAAa,WAAY,WAAW,KAChE,CAAC,kBAAkB,SAAS,OAAO,WAAY,KAAK,IAEtD,MAAM,IAAI,4BACR,gCACA,kIACF;IACF,aAAa,UAAU,KAAA,IAAY;IACnC,MAAM,UAAU,YAAY;KAC1B,MAAM,UAAU,MAAM,cAAc,KAAK;KACzC,IACE,QAAQ,OAAO,gBAAgB,OAAO,OAAO,eAC7C,QAAQ,OAAO,eAAe,OAAO,OAAO,cAC5C,QAAQ,OAAO,cAAc,OAAO,OAAO,WAE3C,MAAM,IAAI,cAAc,kBAAkB,gBAAgB,uCAAuC;KACnG,IAAI,SACE;UAAA,CAAC,kBAAkB,QAAQ,KAAK,CAAC,CAAC,MAAM,SAAS,KAAK,SAAS,QAAQ,OAAO,IAAI,GACpF,MAAM,IAAI,cAAc,kBAAkB,gBAAgB,0CAA0C;KAAA,OACjG;MACL,MAAM,oBAAoB,eAAe,QAAQ,OAAO,OAAO,OAAO,WAAW,CAAC,CAAC,MAAM,MACtF,SAAS,KAAK,SAAS,QAAQ,OAAO,IACzC;MACA,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,mBAAmB,UAAU,GACxE,MAAM,IAAI,cAAc,kBAAkB,gBAAgB,0CAA0C;KACxG;KACA,OAAO;IACT;IACA,MAAM,mBAAmB,YAAY;KACnC,IAAI,CAAC,iBACH,MAAM,IAAI,cAAc,kBAAkB,gBAAgB,0CAA0C;KACtG,OAAO,eAAe;KACtB,MAAM,UAAU,MAAM,QAAQ;KAC9B,OAAO,eAAe;KACtB,OAAO,eAAe,QAAQ,OAAO,QAAQ,OAAO,WAAW;IACjE;IACA,MAAM,YAAY;KAChB,MAAM,OAAO;MACX,MAAM,EAAE,WAAW,MAAM,iBAAiB;MAC1C,OAAO,OAAO,KAAK,EAAE,MAAM,mBAAmB;OAAE;OAAM;MAAY,EAAE;KACtE;KACA,MAAM,KAAK,MAAc;MACvB,MAAM,UAAU,MAAM,iBAAiB;MACvC,MAAM,QAAQ,QAAQ,OAAO,MAAM,cAAc,UAAU,SAAS,IAAI;MACxE,IAAI,CAAC,OAAO,MAAM,IAAI,cAAc,kBAAkB,eAAe,iCAAiC;MACtG,MAAM,OAAO,MAAM,OAAO,OAAO,YAAY,UAAU,QAAQ,SAAS,UAAU,MAAM,GAAG;MAC3F,OAAO,eAAe;MAEtB,KAAI,MADgB,iBAAiB,EAAA,CAC3B,SAAS,aAAa,QAAQ,SAAS,UAC/C,MAAM,IAAI,cAAc,kBAAkB,gBAAgB,wCAAwC;MACpG,OAAO;KACT;IACF;IACA,aAAa;KACX,GAAG;KACH,UAAU;KACV,OAAO,UAAW,YAAa,aAAa,CAAC,IAAM,QAAQ,OAAO,aAAa,CAAC;IAClF;IACA,kBAAkB;IAClB,MAAM,SAAS,MAAM,OAAO,OAAO,YAAY,WAAW;KACxD,UAAU,SAAS;KACnB;KACA,WAAW,UAAW,YAAa,aAAa,CAAC,IAAM,QAAQ,OAAO,aAAa,CAAC;KACpF;KACA;KACA,WAAW,YAAY;MACrB,MAAM,UAAU,MAAM,QAAQ;MAC9B,IAAI,SAAS;OACX,MAAM,cAAc,eAAe,QAAQ,OAAO,QAAQ,OAAO,WAAW,CAAC,CAAC,MAAM,MACjF,SAAS,KAAK,SAAS,IAC1B;OACA,IAAI,CAAC,eAAe,CAAC,kBAAkB,aAAa,QAAQ,GAC1D,MAAM,IAAI,cAAc,kBAAkB,gBAAgB,qCAAqC;MACnG;KACF;IACF,CAAC;IACD,MAAM,QAAQ;IACd,QAAQ,WAAW,6BAA6B,aAAa,qBAAqB;IAClF,OAAO,mBACL,aAAa,UAAU,KAAA,IAAY,UAAU;KAC3C,SAAS,OAAO;KAChB,GAAI,OAAO,sBAAsB,KAAA,IAAY,CAAC,IAAI,EAAE,mBAAmB,OAAO,kBAAkB;KAChG,GAAI,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;KAC5D,SAAS,OAAO,WAAW;IAC7B,CAAC,CACH;GACF,SAAS,OAAO;IAId,MAAM,QACJ,iBAAiB,8BACb,MAAM,OACN,OAAO,UACL,YACA,iBAAiB,gBACf,OAAO,OAAO,MAAM,IAAI,MACxB,iBAAiB,QACf,MAAM,OACN;IACZ,QAAQ,WAAW,6BAA6B,aAAa,0BAA0B,OAAO;IAC9F,IAAI,eAAe,KAAA,GAAW;KAC5B,aAAa;MACX,GAAG;MACH,QAAQ,OAAO,UAAU,cAAc;MACvC,YAAY,KAAK,IAAI;MACrB,QAAQ;OAAE;OAAO,SAAS,iBAAiB,QAAQ,MAAM,UAAU;MAAoB;KACzF;KACA,kBAAkB;IACpB;IACA,IAAI,EAAE,iBAAiB,8BAA8B,MAAM;IAC3D,OAAO,aAAa,YAAY;KAC9B,SAAS,CAAC;MAAE,MAAM;MAAQ,MAAM,MAAM;KAAQ,CAAC;KAC/C,SAAS;KACT,mBAAmB;MACjB,MAAM,MAAM;MACZ,SAAS,MAAM;MACf,GAAI,MAAM,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAU;KACxE;IACF,CAAC;GACH,UAAU;IACR,kBAAkB;IAClB,WAAW,OAAO,GAAG;GACvB;EACF,CAAC;EACD,OAAO,kBAAkB,kBAAkB,YAAY;GACrD,MAAM,SAAS,MAAM,mBAAmB;GACxC,MAAM,EAAE,gBAAgB,eAAe,OAAO,OAAO,OAAO,OAAO,WAAW;GAC9E,OAAO,EACL,WAAW,CAAC,GAAG,WAAW,EAC5B;EACF,CAAC;EACD,OAAO,kBAAkB,kBAAkB,OAAO,SAAS,QAAQ;GACjE,MAAM,eAAe,6BACnB,IAAI,OAAO,SAAU,QAAQ,OAA+B,KAC9D;GACA,MAAM,SAAS,MAAM,mBAAmB;GACxC,MAAM,EAAE,UAAU,QAAQ,gBAAgB,eAAe,OAAO,OAAO,OAAO,OAAO,WAAW;GAChG,MAAM,QAAQ,OAAO,MAAM,cAAc,UAAU,QAAQ,QAAQ,OAAO,GAAG;GAC7E,IAAI,UAAU,KAAA,GAAW;IACvB,IAAI,CAAC,cACH,MAAM,IAAI,cACR,kBAAkB,eAClB,4EACF;IACF,IAAI,CAAC,QAAQ,qBACX,MAAM,IAAI,cACR,kBAAkB,gBAClB,mDACF;IAEF,MAAM,OAAO,OAAM,MADE,QAAQ,oBAAoB,OAAO,OAAO,cAAc,OAAO,QAAQ,MAAM,EAAA,CACxE,YAAY,UAAU,SAAS,UAAU,MAAM,GAAG;IAC5E,MAAM,mBAAmB;IACzB,OAAO,EAAE,UAAU,CAAC;KAAE,KAAK,MAAM;KAAK,UAAU;KAAiB;IAAK,CAAC,EAAE;GAC3E;GACA,MAAM,WAAW,YAAY,MAAM,cAAc,UAAU,QAAQ,QAAQ,OAAO,GAAG;GACrF,IAAI,aAAa,KAAA,KAAa,OAAO,OAAO,YAAY,mBAAmB,KAAA,GAAW;IAEpF,QAAQ,OAAO,eAAe;IAC9B,MAAM,OAAO,MAAM,OAAO,OAAO,YAAY,eAAe,SAAS,UAAU,SAAS,GAAG;IAC3F,QAAQ,OAAO,eAAe;IAC9B,MAAM,UAAU,MAAM,mBAAmB;IACzC,MAAM,QAAQ,eAAe,QAAQ,OAAO,QAAQ,OAAO,WAAW;IACtE,IACE,QAAQ,OAAO,gBAAgB,OAAO,OAAO,eAC7C,MAAM,SAAS,aAAa,SAAS,YACrC,CAAC,kBACC,MAAM,YAAY,MAAM,cAAc,UAAU,QAAQ,SAAS,GAAG,GACpE,QACF,GAEA,MAAM,IAAI,cAAc,kBAAkB,gBAAgB,8CAA8C;IAC1G,OAAO,EAAE,UAAU,CAAC;KAAE,GAAG;KAAU;IAAK,CAAC,EAAE;GAC7C;GACA,IAAI,QAAQ,OAAO,IAAI,WAAW,KAAK,GACrC,MAAM,IAAI,cAAc,kBAAkB,eAAe,uCAAuC;GAClG,MAAM,IAAI,cACR,kBAAkB,eAClB,4EACF;EACF,CAAC;EAID,MAAM,UAAU,uBAAuB,QAAQ,EAAE,QAAQ,SAAS,CAAC;EACnE,IAAI;GACF,OAAO,MAAM,QAAQ,MAAM,SAAS,EAClC,UAAU;IACR;IACA,UAAU,MAAM;IAChB,QACE,MAAM,UAAU,YACZ,CAAC,SAAS,IACV,CAAC,GAAG,MAAM,MAAM,KAAK,SAAS,QAAQ,MAAM,GAAG,GAAG,MAAM,OAAO,KAAK,SAAS,SAAS,MAAM,CAAC;IACnG,WAAW,KAAK,MAAM,MAAM,YAAY,GAAI;IAC5C,UAAU,IAAI,IAAI,aAAa;GACjC,EACF,CAAC;EACH,QAAQ;GACN,OAAO,UAAU,KAAK,4BAA4B;EACpD;CACF;AACF"}