@aotter/mantle 0.2.0-alpha.3 → 0.2.0-alpha.5

package/dist/core/observation.d.ts

@@ -0,0 +1,3 @@
+/** Best-effort metadata callbacks: delivery belongs to the host, never to the business response. */
+export declare function observe<T>(listener: ((event: T) => void | Promise<void>) | undefined, event: T): void;
+//# sourceMappingURL=observation.d.ts.map

package/dist/core/observation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"observation.d.ts","sourceRoot":"","sources":["../../src/core/observation.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,wBAAgB,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAGrG"}

package/dist/core/observation.js

@@ -0,0 +1,10 @@
+/** Best-effort metadata callbacks: delivery belongs to the host, never to the business response. */
+export function observe(listener, event) {
+    if (!listener)
+        return;
+    try {
+        void Promise.resolve(listener(event)).catch(() => { });
+    }
+    catch { /* The adopter owns delivery failure reporting. */ }
+}
+//# sourceMappingURL=observation.js.map

package/dist/core/observation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"observation.js","sourceRoot":"","sources":["../../src/core/observation.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,MAAM,UAAU,OAAO,CAAI,QAA0D,EAAE,KAAQ;IAC7F,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,IAAI,CAAC;QAAC,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;AAC7H,CAAC"}

package/dist/core/withCaller.d.ts

@@ -6,6 +6,14 @@ export interface WithCallerOptions {
      * `resource_metadata` parameter of the 401 challenge, so an MCP entry passes it and every challenge carries it.
      */
     readonly resourceMetadata?: string;
+    /** Metadata only; no request body or credential. A delivery promise is not awaited. */
+    readonly onRefusal?: (event: CallerRefusal) => void | Promise<void>;
+}
+/** A request refused before a surface runs, not an executed tool invocation. */
+export interface CallerRefusal {
+    readonly at: number;
+    readonly status: 401 | 403;
+    readonly reason: "origin" | "credential";
 }
 /**
  * The one authentication boundary of a service's entry (ADR-0032 decision 8): resolve the Caller once per request, then run the

package/dist/core/withCaller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"withCaller.d.ts","sourceRoot":"","sources":["../../src/core/withCaller.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAO5C,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,iBAAsB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAmB9I"}
+{"version":3,"file":"withCaller.d.ts","sourceRoot":"","sources":["../../src/core/withCaller.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAQ5C,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,uFAAuF;IACvF,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,YAAY,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,iBAAsB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAuB9I"}

package/dist/core/withCaller.js

@@ -1,4 +1,5 @@
 import { makeDiagnostic, redactForWire } from "../spec/kernel/index.js";
+import { observe } from "./observation.js";
 const SAFE = new Set(["GET", "HEAD", "OPTIONS"]);
 const refuse = (status, code, message, path, challenge) => Response.json({ error: redactForWire(makeDiagnostic({ code, phase: "runtime", severity: "error", path, message })) }, { status, headers: { "cache-control": "private, no-store", ...(challenge ? { "www-authenticate": challenge } : {}) } });
 /**
@@ -8,6 +9,11 @@ const refuse = (status, code, message, path, challenge) => Response.json({ error
  */
 export function withCaller(resolve, surface, options = {}) {
     return async (request) => {
+        const rejected = (reason, status, code, message, path, challenge) => {
+            if (options.onRefusal)
+                observe(options.onRefusal, { at: Date.now(), status, reason });
+            return refuse(status, code, message, path, challenge);
+        };
         const r = await resolve(request);
         if ("caller" in r) {
             if (r.caller.kind === "user" && r.caller.credential === "session" && !SAFE.has(request.method)) {
@@ -15,15 +21,15 @@ export function withCaller(resolve, surface, options = {}) {
                 const origin = request.headers.get("origin");
                 // neither header is what Better Auth refuses too: every browser sends one of them on a mutation
                 if ((!site && !origin) || (site && site !== "same-origin" && site !== "none") || (origin && origin !== new URL(request.url).origin))
-                    return refuse(403, "AUTH_DENIED", "Cross-origin session mutation rejected.", "request:origin");
+                    return rejected("origin", 403, "AUTH_DENIED", "Cross-origin session mutation rejected.", "request:origin");
             }
             return surface(request, r.caller);
         }
         const status = r.status ?? 401;
         const challenge = r.challenge && options.resourceMetadata ? `${r.challenge}, resource_metadata="${options.resourceMetadata}"` : r.challenge ?? (options.resourceMetadata ? `Bearer resource_metadata="${options.resourceMetadata}"` : undefined);
         return status === 401
-            ? refuse(401, "UNAUTHENTICATED", "The presented credential is missing, malformed, expired, revoked, or invalid.", "request:authorization", challenge)
-            : refuse(403, "AUTH_DENIED", "The verified credential lacks a required scope.", "request:authorization", challenge);
+            ? rejected("credential", 401, "UNAUTHENTICATED", "The presented credential is missing, malformed, expired, revoked, or invalid.", "request:authorization", challenge)
+            : rejected("credential", 403, "AUTH_DENIED", "The verified credential lacks a required scope.", "request:authorization", challenge);
     };
 }
 //# sourceMappingURL=withCaller.js.map

package/dist/core/withCaller.js.map

@@ -1 +1 @@
-{"version":3,"file":"withCaller.js","sourceRoot":"","sources":["../../src/core/withCaller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAuB,MAAM,yBAAyB,CAAC;AAI7F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEjD,MAAM,MAAM,GAAG,CAAC,MAAiB,EAAE,IAAoB,EAAE,OAAe,EAAE,IAAY,EAAE,SAAkB,EAAE,EAAE,CAC5G,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAUhP;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAuB,EAAE,OAAgB,EAAE,UAA6B,EAAE;IACnG,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/F,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACnD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC7C,gGAAgG;gBAChG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;oBACjI,OAAO,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,yCAAyC,EAAE,gBAAgB,CAAC,CAAC;YACnG,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;QAC/B,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,wBAAwB,OAAO,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,6BAA6B,OAAO,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACjP,OAAO,MAAM,KAAK,GAAG;YACnB,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,+EAA+E,EAAE,uBAAuB,EAAE,SAAS,CAAC;YACrJ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,iDAAiD,EAAE,uBAAuB,EAAE,SAAS,CAAC,CAAC;IACxH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"withCaller.js","sourceRoot":"","sources":["../../src/core/withCaller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAuB,MAAM,yBAAyB,CAAC;AAG7F,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEjD,MAAM,MAAM,GAAG,CAAC,MAAiB,EAAE,IAAoB,EAAE,OAAe,EAAE,IAAY,EAAE,SAAkB,EAAE,EAAE,CAC5G,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAmBhP;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAuB,EAAE,OAAgB,EAAE,UAA6B,EAAE;IACnG,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,CAAC,MAA+B,EAAE,MAAiB,EAAE,IAAoB,EAAE,OAAe,EAAE,IAAY,EAAE,SAAkB,EAAE,EAAE;YAC/I,IAAI,OAAO,CAAC,SAAS;gBAAE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACtF,OAAO,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACxD,CAAC,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/F,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACnD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC7C,gGAAgG;gBAChG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;oBACjI,OAAO,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE,yCAAyC,EAAE,gBAAgB,CAAC,CAAC;YAC/G,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;QAC/B,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,wBAAwB,OAAO,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,6BAA6B,OAAO,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACjP,OAAO,MAAM,KAAK,GAAG;YACnB,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE,iBAAiB,EAAE,+EAA+E,EAAE,uBAAuB,EAAE,SAAS,CAAC;YACrK,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE,aAAa,EAAE,iDAAiD,EAAE,uBAAuB,EAAE,SAAS,CAAC,CAAC;IACxI,CAAC,CAAC;AACJ,CAAC"}

package/dist/mcp/createMcpSurface.d.ts

@@ -1,6 +1,28 @@
+import { type Diagnostic } from "../spec/kernel/index.js";
 import { type McpTool } from "../spec/domain/index.js";
-import { type MantleRuntime, type Surface } from "../core/index.js";
+import { type Caller, type MantleRuntime, type MediaStorage, type Surface } from "../core/index.js";
 import { type McpApps } from "./apps.js";
+import { type MediaMcpTool } from "./media.js";
+export type McpObservation = {
+    readonly kind: "request-refused";
+    readonly at: number;
+    readonly surface: "public" | "staff";
+    readonly status: 401 | 403;
+} | {
+    readonly kind: "invocation";
+    readonly at: number;
+    readonly surface: "public" | "staff";
+    readonly invocationId: string;
+    readonly tool: string;
+    readonly caller: Caller;
+} & ({
+    readonly phase: "attempt";
+} | {
+    readonly phase: "completion";
+    readonly outcome: "succeeded" | "failed" | "denied";
+    readonly durationMs: number;
+    readonly code?: Diagnostic["code"];
+});
 export interface McpSurfaceOptions {
     /** Where this surface answers, e.g. `/mcp` or `/mcp/staff`. */
     readonly basePath: string;
@@ -18,17 +40,21 @@ export interface McpSurfaceOptions {
     readonly maxRequestBodySize?: number;
     /** Language tried first when a description is localized. Defaults to `en`. */
     readonly locale?: string;
+    /** Optional staff media tools. Needs runtime.site and shares its library with Admin; never enabled on public MCP. */
+    readonly media?: MediaStorage;
     /**
      * The scope floor (ADR-0014): every presented credential but a cookie session must carry these before any tool is listed or called,
      * so a token minted for a narrow integration never reaches a tool. Defaults to the one compatibility scope, `["mcp"]`.
      */
     readonly requiredScopes?: readonly string[];
+    /** Native metadata only. Delivery promises are not awaited; synchronous listener work still runs inline. The host owns transport and request lifetime. */
+    readonly onObservation?: (event: McpObservation) => void | Promise<void>;
 }
 /** The result `_meta` key naming the tool, on results an App renders. */
 export declare const APP_TOOL_META_KEY = "net.aotter.mantle/tool";
 /** The surface and the tools it registers for a client without MCP Apps, in its locale. */
 export type McpSurface = Surface & {
-    readonly tools: readonly McpTool[];
+    readonly tools: readonly (McpTool | MediaMcpTool)[];
 };
 export declare function createMcpSurface(runtime: MantleRuntime, options: McpSurfaceOptions): McpSurface;
 //# sourceMappingURL=createMcpSurface.d.ts.map

package/dist/mcp/createMcpSurface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createMcpSurface.d.ts","sourceRoot":"","sources":["../../src/mcp/createMcpSurface.ts"],"names":[],"mappings":"AAQA,OAAO,EAAiF,KAAK,OAAO,EAAE,MAAM,yBAAyB,CAAC;AACtI,OAAO,EAAgC,KAAK,aAAa,EAAE,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAqE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAE5G,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uHAAuH;IACvH,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC;IACrC,uGAAuG;IACvG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpG,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,mDAAmD;IACnD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAmBD,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAE1D,2FAA2F;AAC3F,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,CAAC;AAE1E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,GAAG,UAAU,CAwG/F"}
+{"version":3,"file":"createMcpSurface.d.ts","sourceRoot":"","sources":["../../src/mcp/createMcpSurface.ts"],"names":[],"mappings":"AAOA,OAAO,EAAkD,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1G,OAAO,EAAiF,KAAK,OAAO,EAAE,MAAM,yBAAyB,CAAC;AACtI,OAAO,EAAmB,KAAK,MAAM,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACrH,OAAO,EAAqE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAC5G,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAG3D,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,GAC3H;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,CAC1K;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;CAAE,CACzJ,CAAC;AAEJ,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uHAAuH;IACvH,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC;IACrC,uGAAuG;IACvG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpG,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,mDAAmD;IACnD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,qHAAqH;IACrH,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,0JAA0J;IAC1J,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1E;AAmBD,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAE1D,2FAA2F;AAC3F,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,GAAG,YAAY,CAAC,EAAE,CAAA;CAAE,CAAC;AAE3F,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,GAAG,UAAU,CA+H/F"}

package/dist/mcp/createMcpSurface.js

@@ -1,13 +1,16 @@
 /**
- * The MCP surface (ADR-0032 decision 9): a Fetch function over the runtime. Tools come only from Procedures (through an `mcp`
- * Trigger) and Views, never from a Schema. A Procedure's tool is `invokeProcedure`; a View's tool is `store.as(caller).view`, so both
+ * The MCP surface (ADR-0032 decision 9): a Fetch function over the runtime. Plan tools come from Procedures (through an `mcp`
+ * Trigger) and Views, never from a Schema; optional staff media tools use the existing site library. A Procedure's tool is `invokeProcedure`; a View's tool is `store.as(caller).view`, so both
  * run the same auth, guard and validation as every other source.
  */
 import { McpServer, createMcpHandler, fromJsonSchema, isJsonContentType, readRequestBody } from "@modelcontextprotocol/server";
 import { RESOURCE_MIME_TYPE, registerAppResource, registerAppTool } from "@modelcontextprotocol/ext-apps/server";
 import { DiagnosticError, makeDiagnostic, redactForWire } from "../spec/kernel/index.js";
 import { mcpTools } from "../spec/domain/index.js";
+import { evaluateAuthAll } from "../core/index.js";
 import { appHtml, appMeta, clientUiSupport, linkApps } from "./apps.js";
+import { mediaTools } from "./media.js";
+import { observe } from "../core/observation.js";
 const CONTEXT_KEY = "mantle.caller";
 const UI_KEY = "mantle.clientUi";
 const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
@@ -27,7 +30,10 @@ export function createMcpSurface(runtime, options) {
     const base = options.basePath.replace(/\/+$/, "") || "/";
     const maxBody = options.maxRequestBodySize ?? 1024 * 1024;
     const requiredScopes = options.requiredScopes ?? ["mcp"];
-    const tools = mcpTools(runtime.plan, options.surface, options.locale ?? "en");
+    const library = options.surface === "staff" && options.media && runtime.site?.media(options.media);
+    const tools = [...mcpTools(runtime.plan, options.surface, options.locale ?? "en"), ...(library ? mediaTools(library, runtime.site) : [])];
+    if (new Set(tools.map((t) => t.name)).size !== tools.length)
+        throw new TypeError("MCP media tool name collides with a declared Procedure or View.");
     const byName = new Map(tools.map((t) => [t.name, t]));
     // a surface whose every tool needs identity is closed to anonymous from `initialize` on, as the staff surface is: a client
     // decides whether to sign in when it connects, so a 401 that waits for the first tool call never shows it a sign-in. A
@@ -38,6 +44,8 @@ export function createMcpSurface(runtime, options) {
     const apps = linkApps(options.apps, new Set(tools.map((t) => t.name)), new Set(tools.filter((t) => t.kind === "view").map((t) => t.name)));
     const serverInfo = { name: "aotter.mantle", version: "0.2.0", ...options.serverInfo };
     const challenge = (status, error, bare = false) => {
+        if (options.onObservation)
+            observe(options.onObservation, { kind: "request-refused", at: Date.now(), surface: options.surface, status });
         const parts = [...(error?.code ? [`error="${error.code}"`] : []), ...(error?.scope ? [`scope="${error.scope}"`] : []), ...(options.resourceMetadata ? [`resource_metadata="${options.resourceMetadata}"`] : [])];
         const code = status === 401 ? "UNAUTHENTICATED" : "AUTH_DENIED";
         return Response.json({ error: redactForWire(makeDiagnostic({ code, phase: "runtime", severity: "error", path: "mcp", message: status === 401 ? "Authentication is required." : "The credential does not allow this." })) }, { status, headers: bare ? {} : { "www-authenticate": `Bearer${parts.length ? " " + parts.join(", ") : ""}` } });
@@ -60,18 +68,42 @@ export function createMcpSurface(runtime, options) {
             const execute = async (args) => {
                 const input = isRecord(args) ? args : {};
                 const cause = { kind: "mcp", id: crypto.randomUUID() };
+                // An observer cannot mutate the Caller used for execution, including its scopes array.
+                const observedCaller = options.onObservation ? Object.freeze(caller.kind === "user" ? {
+                    kind: "user", subject: caller.subject, ...(caller.issuer !== undefined ? { issuer: caller.issuer } : {}),
+                    role: caller.role, scopes: Object.freeze([...caller.scopes]), credential: caller.credential,
+                    credentialId: caller.credentialId, clientId: caller.clientId,
+                } : { kind: "anonymous" }) : caller;
+                const metadata = { kind: "invocation", surface: options.surface, invocationId: cause.id, tool: tool.name, caller: observedCaller };
+                if (options.onObservation)
+                    observe(options.onObservation, { ...metadata, phase: "attempt", at: Date.now() });
+                const started = options.onObservation ? performance.now() : 0;
+                let outcome = "succeeded";
+                let code;
                 try {
+                    if (tool.kind === "media") {
+                        const denied = evaluateAuthAll(tool.requires, caller, `MCP ${tool.name}`);
+                        if (denied)
+                            throw new DiagnosticError(denied);
+                        return result(await tool.run(input));
+                    }
                     if (tool.kind === "procedure")
                         return result(await runtime.invokeProcedure({ procedure: tool.source, input, caller, cause }));
                     const { limit, cursor, ...rest } = input;
                     return result(await runtime.store.as(caller, cause).view(tool.source, { input: rest, ...(limit !== undefined ? { limit: limit } : {}), ...(cursor !== undefined ? { cursor: cursor } : {}) }));
                 }
                 catch (e) {
+                    code = e instanceof DiagnosticError ? e.diagnostic.code : "INTERNAL_ERROR";
+                    outcome = code === "AUTH_DENIED" || code === "UNAUTHENTICATED" ? "denied" : "failed";
                     if (e instanceof DiagnosticError)
                         return failure(e.diagnostic, tool.outputSchema !== undefined);
                     console.error(`[mantle mcp ${tool.name}] unhandled failure`, e);
                     return failure(makeDiagnostic({ code: "INTERNAL_ERROR", phase: "runtime", severity: "error", path: `MCP ${tool.name}`, message: "Internal error." }), tool.outputSchema !== undefined);
                 }
+                finally {
+                    if (options.onObservation)
+                        observe(options.onObservation, { ...metadata, phase: "completion", at: Date.now(), outcome, durationMs: Math.max(0, performance.now() - started), ...(code ? { code } : {}) });
+                }
             };
             const config = { ...(tool.title ? { title: tool.title } : {}), description: tool.description, inputSchema: schemaOf(tool.inputSchema), ...(tool.outputSchema ? { outputSchema: schemaOf(tool.outputSchema) } : {}), ...(tool.annotations ? { annotations: tool.annotations } : {}) };
             const uri = withApps ? apps.appOnly.get(tool.name) ?? apps.rendersIn.get(tool.name) : undefined;

package/dist/mcp/createMcpSurface.js.map

@@ -1 +1 @@
-{"version":3,"file":"createMcpSurface.js","sourceRoot":"","sources":["../../src/mcp/createMcpSurface.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAA4I,MAAM,8BAA8B,CAAC;AACzQ,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACjH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAmB,MAAM,yBAAyB,CAAC;AAC1G,OAAO,EAAE,QAAQ,EAAqF,MAAM,yBAAyB,CAAC;AAEtI,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAsC,MAAM,WAAW,CAAC;AAsB5G,MAAM,WAAW,GAAG,eAAe,CAAC;AACpC,MAAM,MAAM,GAAG,iBAAiB,CAAC;AACjC,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAExH,8IAA8I;AAC9I,MAAM,YAAY,GAAwB,EAAE,YAAY,KAAgC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAU,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5K,MAAM,QAAQ,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,cAAc,CAAC,CAAmB,EAAE,YAAY,CAA2B,CAAC;AAEhH,MAAM,QAAQ,GAAG,CAAC,CAAwC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,gBAAgB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEjM,MAAM,MAAM,GAAG,CAAC,IAAa,EAAkB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACxK,yLAAyL;AACzL,MAAM,OAAO,GAAG,CAAC,CAAa,EAAE,eAAwB,EAAkB,EAAE;IAC1E,MAAM,OAAO,GAAG,EAAE,WAAW,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AACnJ,CAAC,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAK1D,MAAM,UAAU,gBAAgB,CAAC,OAAsB,EAAE,OAA0B;IACjF,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,kBAAkB,IAAI,IAAI,GAAG,IAAI,CAAC;IAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,2HAA2H;IAC3H,uHAAuH;IACvH,uHAAuH;IACvH,2HAA2H;IAC3H,8EAA8E;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChI,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3I,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAEtF,MAAM,SAAS,GAAG,CAAC,MAAiB,EAAE,KAAyC,EAAE,IAAI,GAAG,KAAK,EAAE,EAAE;QAC/F,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,sBAAsB,OAAO,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjN,MAAM,IAAI,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC;QAChE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,qCAAqC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9U,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAmB,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,aAAa,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;IAEhK,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,EAAmB,EAAE,EAAE;QACpD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,UAAU,EAAE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,EAAE,KAAK,aAAa,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;QACnE,IAAI,QAAQ;YAAE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBACxB,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAC/K,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1I,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBAAE,SAAS;YACxC,oFAAoF;YACpF,MAAM,UAAU,GAAG,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClH,MAAM,GAAG,GAAG,KAAK,EAAE,IAAa,EAA2B,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;YAC5G,MAAM,OAAO,GAAG,KAAK,EAAE,IAAa,EAA2B,EAAE;gBAC/D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,KAAc,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;gBAChE,IAAI,CAAC;oBACH,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;wBAAE,OAAO,MAAM,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;oBAC9H,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;oBACzC,OAAO,MAAM,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrN,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,YAAY,eAAe;wBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;oBAChG,OAAO,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,CAAC;oBAChE,OAAO,OAAO,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,EAAE,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;gBACzL,CAAC;YACH,CAAC,CAAC;YACF,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACrR,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACpE,4FAA4F;YAC5F,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAA2C,EAAE,GAAY,CAAC,CAAC;QACjN,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC5C,MAAM,CAAC,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,WAAW,CAAuB,CAAC;QAC/D,MAAM,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxG,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAEhJ,MAAM,OAAO,GAAY,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;QACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1J,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAClG,0HAA0H;QAC1H,6BAA6B;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACrH,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9H,yGAAyG;QACzG,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1I,wFAAwF;QACxF,gFAAgF;QAChF,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC1H,MAAM,QAAQ,GAAa,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;QACpM,IAAI,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChJ,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAC7D,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,4BAA4B,OAAO,cAAc,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5K,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAAC,CAAC;QACpD,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAAC,CAAC,CAAC,sCAAsC;QAC7H,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,QAAQ,CAAC,KAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAC7B,4FAA4F;QAC5F,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,YAAY,IAAI,IAAI,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnP,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAChM,oGAAoG;YACpG,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;gBAC5D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClF,IAAI,OAAO,CAAC,MAAM;oBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3I,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC;AAClG,CAAC"}
+{"version":3,"file":"createMcpSurface.js","sourceRoot":"","sources":["../../src/mcp/createMcpSurface.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAA4I,MAAM,8BAA8B,CAAC;AACzQ,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACjH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAmB,MAAM,yBAAyB,CAAC;AAC1G,OAAO,EAAE,QAAQ,EAAqF,MAAM,yBAAyB,CAAC;AACtI,OAAO,EAAE,eAAe,EAAoE,MAAM,kBAAkB,CAAC;AACrH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAsC,MAAM,WAAW,CAAC;AAC5G,OAAO,EAAE,UAAU,EAAqB,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAiCjD,MAAM,WAAW,GAAG,eAAe,CAAC;AACpC,MAAM,MAAM,GAAG,iBAAiB,CAAC;AACjC,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAExH,8IAA8I;AAC9I,MAAM,YAAY,GAAwB,EAAE,YAAY,KAAgC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAU,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5K,MAAM,QAAQ,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,cAAc,CAAC,CAAmB,EAAE,YAAY,CAA2B,CAAC;AAEhH,MAAM,QAAQ,GAAG,CAAC,CAAwC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,gBAAgB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEjM,MAAM,MAAM,GAAG,CAAC,IAAa,EAAkB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACxK,yLAAyL;AACzL,MAAM,OAAO,GAAG,CAAC,CAAa,EAAE,eAAwB,EAAkB,EAAE;IAC1E,MAAM,OAAO,GAAG,EAAE,WAAW,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AACnJ,CAAC,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAK1D,MAAM,UAAU,gBAAgB,CAAC,OAAsB,EAAE,OAA0B;IACjF,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,kBAAkB,IAAI,IAAI,GAAG,IAAI,CAAC;IAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnG,MAAM,KAAK,GAA+B,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,IAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvK,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;IACpJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,2HAA2H;IAC3H,uHAAuH;IACvH,uHAAuH;IACvH,2HAA2H;IAC3H,8EAA8E;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChI,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3I,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAEtF,MAAM,SAAS,GAAG,CAAC,MAAiB,EAAE,KAAyC,EAAE,IAAI,GAAG,KAAK,EAAE,EAAE;QAC/F,IAAI,OAAO,CAAC,aAAa;YAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACzI,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,sBAAsB,OAAO,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjN,MAAM,IAAI,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC;QAChE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,qCAAqC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9U,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAmB,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,aAAa,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;IAEhK,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,EAAmB,EAAE,EAAE;QACpD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,UAAU,EAAE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,EAAE,KAAK,aAAa,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;QACnE,IAAI,QAAQ;YAAE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBACxB,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAC/K,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1I,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBAAE,SAAS;YACxC,oFAAoF;YACpF,MAAM,UAAU,GAAG,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClH,MAAM,GAAG,GAAG,KAAK,EAAE,IAAa,EAA2B,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;YAC5G,MAAM,OAAO,GAAG,KAAK,EAAE,IAAa,EAA2B,EAAE;gBAC/D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,KAAc,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;gBAChE,uFAAuF;gBACvF,MAAM,cAAc,GAAW,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC;oBAC5F,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjH,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC3F,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC7D,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAoB,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC7C,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,YAAqB,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;gBAC5I,IAAI,OAAO,CAAC,aAAa;oBAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC7G,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9D,IAAI,OAAO,GAAsC,WAAW,CAAC;gBAC7D,IAAI,IAAoC,CAAC;gBACzC,IAAI,CAAC;oBACH,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;wBAC1B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;wBAC1E,IAAI,MAAM;4BAAE,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;wBAC9C,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;oBACvC,CAAC;oBACD,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;wBAAE,OAAO,MAAM,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;oBAC9H,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;oBACzC,OAAO,MAAM,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrN,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,GAAG,CAAC,YAAY,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;oBAC3E,OAAO,GAAG,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;oBACrF,IAAI,CAAC,YAAY,eAAe;wBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;oBAChG,OAAO,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,CAAC;oBAChE,OAAO,OAAO,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,EAAE,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;gBACzL,CAAC;wBAAS,CAAC;oBACT,IAAI,OAAO,CAAC,aAAa;wBAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC5M,CAAC;YACH,CAAC,CAAC;YACF,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACrR,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACpE,4FAA4F;YAC5F,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAA2C,EAAE,GAAY,CAAC,CAAC;QACjN,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC5C,MAAM,CAAC,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,WAAW,CAAuB,CAAC;QAC/D,MAAM,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxG,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAEhJ,MAAM,OAAO,GAAY,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;QACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1J,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAClG,0HAA0H;QAC1H,6BAA6B;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACrH,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9H,yGAAyG;QACzG,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1I,wFAAwF;QACxF,gFAAgF;QAChF,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC1H,MAAM,QAAQ,GAAa,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;QACpM,IAAI,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChJ,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAC7D,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,4BAA4B,OAAO,cAAc,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5K,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAAC,CAAC;QACpD,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAAC,CAAC,CAAC,sCAAsC;QAC7H,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,QAAQ,CAAC,KAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAC7B,4FAA4F;QAC5F,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,YAAY,IAAI,IAAI,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnP,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAChM,oGAAoG;YACpG,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;gBAC5D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClF,IAAI,OAAO,CAAC,MAAM;oBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3I,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC;AAClG,CAAC"}

package/dist/mcp/media.d.ts

@@ -0,0 +1,9 @@
+/** Optional staff product tools over the same library Admin uses; media bytes never enter MCP. */
+import type { MediaLibrary, MantleSite } from "../core/index.js";
+import { type McpTool } from "../spec/domain/index.js";
+export type MediaMcpTool = Omit<McpTool, "kind"> & {
+    readonly kind: "media";
+    readonly run: (input: Record<string, unknown>) => Promise<unknown>;
+};
+export declare function mediaTools(library: MediaLibrary, site: MantleSite): MediaMcpTool[];
+//# sourceMappingURL=media.d.ts.map

package/dist/mcp/media.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../../src/mcp/media.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAA+G,KAAK,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAGpK,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC;AAMlJ,wBAAgB,UAAU,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,GAAG,YAAY,EAAE,CAyBlF"}

package/dist/mcp/media.js

@@ -0,0 +1,33 @@
+import { jsonSchemaToZod, safeParseJson, firstZodIssueAsJsonPointer } from "../spec/domain/index.js";
+import { DiagnosticError, makeDiagnostic } from "../spec/kernel/index.js";
+const requires = { auth: { all: [{ "ctx.staff": ["owner", "editor"] }] } };
+const string = { type: "string" };
+const texts = { alt: { type: "string", maxLength: 1000 }, caption: { type: "string", maxLength: 1000 } };
+const input = (properties, required = []) => ({ type: "object", properties, required, additionalProperties: false });
+export function mediaTools(library, site) {
+    const tool = (name, description, inputSchema, invoke, readOnlyHint = false) => {
+        const schema = jsonSchemaToZod(inputSchema);
+        return {
+            name, source: name, kind: "media", requires, description, inputSchema,
+            run: async (args) => {
+                const parsed = safeParseJson(schema, args);
+                if (!parsed.success) {
+                    const { instancePath, message } = firstZodIssueAsJsonPointer(parsed.error);
+                    throw new DiagnosticError(makeDiagnostic({ code: "INPUT_VALIDATION_FAILED", phase: "runtime", severity: "error", path: `MCP ${name}#/input${instancePath}`, expected: message }));
+                }
+                return invoke(parsed.data);
+            },
+            annotations: { readOnlyHint, destructiveHint: name === "delete_media_asset", openWorldHint: true },
+        };
+    };
+    return [
+        tool("get_media_upload_policy", "Read declared image purpose MIME slots and byte caps before preparing variants or requesting an upload. Optimization runs locally, never in the host.", input({}), async () => ({ purposes: (await site.read()).media?.purposes ?? [] }), true),
+        tool("create_media_upload", "Create short-lived PUT capabilities for image variants. Read site media purpose policy first; optimize images locally. Obtain attachment bytes yourself, then PUT each variant with its requiredHeaders and call commit_media_upload. Never store upload URLs as published images or ask the user to run terminal commands.", input({ filename: { type: "string", maxLength: 255 }, purpose: string, variants: { type: "array", minItems: 1, items: input({ mimeType: string, byteSize: { type: "integer", minimum: 1 }, role: { type: "string", enum: ["primary", "alternate", "fallback"] } }, ["mimeType", "byteSize", "role"]) }, ...texts }, ["filename", "purpose", "variants"]), (args) => library.createUpload(args)),
+        tool("commit_media_upload", "Verify all uploaded variants and commit one permanent media asset. Store the returned asset id in fields referencing media_assets.id, never a temporary upload URL. Unknown or expired upload groups require a new create_media_upload.", input({ uploadGroupId: string, ...texts }, ["uploadGroupId"]), ({ uploadGroupId, ...patch }) => library.commitUpload(uploadGroupId, patch)),
+        tool("list_media_assets", "List committed image assets, newest first, with their permanent variants and alt/caption. Search matches id, alt or caption; reuse only a returned cursor.", input({ limit: { type: "integer", minimum: 1, maximum: 500 }, cursor: string, search: string }), (args) => library.list(args), true),
+        tool("get_media_asset", "Read one committed media asset and its permanent variant URLs.", input({ id: string }, ["id"]), ({ id }) => library.get(id), true),
+        tool("update_media_asset", "Update committed asset alt or caption; omitted fields remain unchanged and empty strings clear text.", input({ id: string, ...texts }, ["id"]), ({ id, ...patch }) => library.update(id, patch)),
+        tool("delete_media_asset", "Delete an asset's objects and library record. Check application references first. A partial failure can be retried using the same id.", input({ id: string }, ["id"]), ({ id }) => library.delete(id)),
+    ];
+}
+//# sourceMappingURL=media.js.map

package/dist/mcp/media.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.js","sourceRoot":"","sources":["../../src/mcp/media.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,0BAA0B,EAAiE,MAAM,yBAAyB,CAAC;AACpK,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAG1E,MAAM,QAAQ,GAA8B,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;AACtG,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAW,CAAC;AAC3C,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;AACzG,MAAM,KAAK,GAAG,CAAC,UAAsC,EAAE,WAAqB,EAAE,EAAc,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,CAAC;AAEvK,MAAM,UAAU,UAAU,CAAC,OAAqB,EAAE,IAAgB;IAChE,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,WAAmB,EAAE,WAAuB,EAAE,MAA2B,EAAE,YAAY,GAAG,KAAK,EAAgB,EAAE;QAC3I,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAC5C,OAAO;YACL,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW;YACrE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,0BAA0B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBAC3E,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,UAAU,YAAY,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;gBACpL,CAAC;gBACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAA+B,CAAC,CAAC;YACxD,CAAC;YACD,WAAW,EAAE,EAAE,YAAY,EAAE,eAAe,EAAE,IAAI,KAAK,oBAAoB,EAAE,aAAa,EAAE,IAAI,EAAE;SACnG,CAAC;IACJ,CAAC,CAAC;IACF,OAAO;QACL,IAAI,CAAC,yBAAyB,EAAE,uJAAuJ,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC;QAChR,IAAI,CAAC,qBAAqB,EAAE,6TAA6T,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1tB,IAAI,CAAC,qBAAqB,EAAE,yOAAyO,EAAE,KAAK,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,aAAuB,EAAE,KAAK,CAAC,CAAC;QAC5Z,IAAI,CAAC,mBAAmB,EAAE,4JAA4J,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;QAC5T,IAAI,CAAC,iBAAiB,EAAE,gEAAgE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAY,CAAC,EAAE,IAAI,CAAC;QACrK,IAAI,CAAC,oBAAoB,EAAE,sGAAsG,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAY,EAAE,KAAK,CAAC,CAAC;QACtO,IAAI,CAAC,oBAAoB,EAAE,uIAAuI,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAY,CAAC,CAAC;KAC7O,CAAC;AACJ,CAAC"}

package/docs/adr/0031-host-cloud-core-contract.md

@@ -1,6 +1,6 @@
 # ADR 0031: Cloud supplies the host Core pin
 
-Status: Accepted for mantle-host protocols 2 and 4.
+Status: Accepted for mantle-host protocols 2, 4, 5 and 6.
 
 The backend artifact includes `sdkVersion` and `sdkRevision` in its hashed
 bytes. The old host bundled a fixed Core revision. Cloud can run the previous
@@ -39,3 +39,64 @@ cleanup and deployment policy belong to the Cloud service. Core vendors its exac
 helper artifact/checksum and documents the MCP workflow; it gains no provider
 adapter, SQL compiler, runtime wiring or new Manifest grammar. Client-built
 handlers/static files are not represented as server build attestation.
+
+## Agent orchestration and offline packing (#1368)
+
+Cloud MCP remains protocol 4 and owns lifecycle state and permissions. The plugin
+helper no longer mirrors candidate/deploy state or polls Cloud. Its public bundle
+contains safe Git source transport and offline backend/frontend/source packing.
+The agent discovers MCP schemas, records non-secret operation IDs for identical
+retries, and observes server state before publication. Packaging still uses the
+installed Core compiler; this is not a Core runtime/provider adapter change.
+
+`pack backend --contract -` validates the project and Cloud pin. `pack frontend`
+requires the backend commit and ready kit candidate, and emits immutable hashes.
+The agent checks these against reservations and uses native HTTP grant transport.
+Cloud admission and plan/archive verification remain unchanged; handler/static
+bundles remain client-built. The source transport also rejects secret-named files
+in reachable history, without claiming to scan source content for credentials.
+
+## Protocol 5: mandatory structural website acceptance
+
+A shared artifact validator runs in offline frontend packing and host admission,
+and the host repeats it before new publication. The uploader cannot disable it
+with an artifact flag or a self-reported checklist. A permanent canonical origin
+is bound to the immutable static upload receipt and checked against the selected
+site at reservation. Current rule/version and frontend hash bind the report;
+changing a candidate or bytes requires fresh evidence. Existing stored releases
+remain readable and rollback preserves their historical bytes.
+
+The plugin packer requires `--origin` and emits structured missing-check
+diagnostics. The upload MCP contract requires `canonicalOrigin`. This changes
+validation meaning and therefore increments the host protocol, not the Manifest
+grammar or Core runtime. The validator checks built HTML AST structure and
+metadata, deterministic sitemap/robots and SPA routing configuration without
+executing untrusted code or launching a browser. The host provides Admin, OTP
+and media wiring; artifact validation does not certify delivery, uploads,
+arbitrary authorization, visual behavior, content truth or dynamic HTML refresh.
+A REST-only host must report dynamic-content SEO unsupported.
+
+## Local preparation and additive continuation (#1381)
+
+The existing offline helper may run explicit application check/build argv arrays, pack a clean fixed commit and ordinarily push it in a single `prepare` entry. It returns source-admission arguments and deterministic artifact metadata; no Cloud lifecycle state, HTTP upload, polling or publication is added. Commands cannot silently commit source changes; dirty tracked output fails the existing clean-commit checks. Credentials stay in session memory/stdin. Native host responses may add continuation facts derived from their authoritative resource/lease rows; read-only backend status remains read-only. These additions do not change artifact bytes, admission rules or protocol 5 validation meaning.
+
+## Protocol 6: durable publication and read-only handoff (#1385)
+
+Publication changes the native MCP sequence: one accepted publication operation
+continues durably in Cloud, including recoverable provider waits, without an
+agent repeatedly advancing deployment steps. The agent observes authoritative
+deployment status until terminal; status reads never start or advance work.
+Interrupted acceptance is recovered through the same immutable operation and
+arguments, not a replacement candidate. Permission revocation and deterministic
+refusals remain terminal until their stated correction; background work does not
+retain a credential or turn a previous authorization into permanent authority.
+
+This sequence change requires protocol 6. A client must validate that contract
+before relying on autonomous publication; it cannot merely poll a protocol 5
+host and expect progression. Historical source/release artifacts keep their
+identity and rollback rules. The new sequence does not change Manifest grammar
+or claim server build attestation. Local preparation and builds stay in the
+agent environment; the helper gains no deployment scheduler or build container.
+An accepted operation, ready preview or expired preview is not evidence of a
+serving release or completed cleanup. Terminal state, access policy and literal
+publication URL come from Cloud's authoritative status.

package/docs/adr/0032-store-centric-core-and-service-contract.md

@@ -212,6 +212,12 @@ Every Mantle package versions and releases together, so splitting by area buys n
 
 > **Amendment (ADR-0034):** `/indexeddb` is removed, with no browser driver in 0.2.0. D1 test helpers live at `/cloudflare/testing`. The plugin's helper scripts compile with the project's installed `@aotter/mantle/spec` and bundle no parser.
 
+## 2026-10-07 amendment — metadata observation belongs to its native boundary (#1356)
+
+MCP offers optional `onObservation` at registered tool dispatch and its existing request-refusal gates. Attempt and completion share the runtime cause ID; output/input, requested unknown names, URLs and exception messages are never observation fields. Unknown and client-hidden tools are not registered invocations. An authentication-refused request or batch is a request refusal, not a set of executed tools. Invalid credentials and session-origin refusals remain owned by `withCaller`, which offers optional `onRefusal` without parsing the body or exposing credentials.
+
+Callbacks are best-effort and platform-independent. Their synchronous exceptions and rejected promises do not change the business result or authentication challenge; delivery promises are not awaited. A host owns request lifetime, transport, source enrichment, storage, query authorization and reporting delivery failure. A pending callback can outlive the available request lifetime or be lost. Neither callback promises exactly-once capture or transactional audit. Core adds no telemetry table, provider binding, queue or global I/O promise. The existing business Store audit contract is unchanged.
+
 ## Conformance cases
 
 The three contracts #1188 made ADR gates are accepted only with these cases, run against every `StoreExecutor` and the lifecycle layer:
@@ -359,3 +365,20 @@ The three contracts #1188 made ADR gates are accepted only with these cases, run
 ## Implementation status
 
 Proposed. Nothing in decisions 1–13 is implemented beyond the ADR-0030 slices already on `develop`.
+
+## 2026-10-08 amendment — optional staff media MCP
+
+Issue #1384 restores the pre-consolidation media lifecycle without adding
+Schema CRUD or a new Runtime path. `createMcpSurface` may receive `media:
+MediaStorage`; only a staff surface with `runtime.site` advertises the native
+media policy/create/commit/list/get/update/delete tools. They delegate to the
+same `runtime.site.media(media)` library as Admin and use its editor/owner
+permission, purpose/type/size validation, expiry and object verification.
+The surface retains its shared credential scope floor and invocation
+observations; a collision with a manifest Procedure/View fails at assembly.
+Media bytes remain direct PUT capabilities. The deliberately removed base64
+variant-upload tool is not restored. No grammar, portable Runtime execution,
+storage schema or provider ownership changes. Application-owned/generated
+service files pass their chosen adapter to both Admin and staff MCP; the
+preset cannot invent object-storage credentials. Admin WebMCP continues to
+list manifest tools; its native media operations remain REST-backed.

package/docs/examples/reference-service/package.json

@@ -8,8 +8,8 @@
     "check": "mantle generate && mantle generate --check && tsc --noEmit && node smoke.mjs"
   },
   "dependencies": {
-    "@aotter/mantle": "0.2.0-alpha.3",
-    "@aotter/mantle-ui": "0.2.0-alpha.3",
+    "@aotter/mantle": "0.2.0-alpha.5",
+    "@aotter/mantle-ui": "0.2.0-alpha.5",
     "@better-auth/cimd": "1.7.7",
     "@better-auth/mcp": "1.7.7",
     "@better-auth/oauth-provider": "1.7.7",

package/docs/handbook/cloudflare/media-r2.md

@@ -1,5 +1,5 @@
 ---
-description: Media uploads in Mantle 0.2.0 on Cloudflare R2 — site media purposes, r2MediaStorage, wiring Admin's media routes, the presigned upload flow, and what to store in a Schema.
+description: Media uploads in Mantle 0.2.0 on Cloudflare R2 — site media purposes, r2MediaStorage, wiring Admin and staff MCP media tools, the presigned upload flow, and what to store in a Schema.
 ---
 # Media uploads with R2
 
@@ -37,7 +37,7 @@ export const mantle = createMantle(service, {
   } }),
 });
 
-// in mount(): the media storage, handed to Admin
+// in mount(): one media storage, shared by Admin and staff MCP
 const media = r2MediaStorage({
   bucket: env.MEDIA,
   signer: new AwsClient({ accessKeyId: env.R2_ACCESS_KEY_ID, secretAccessKey: env.R2_SECRET_ACCESS_KEY, region: "auto", service: "s3" }),
@@ -45,11 +45,16 @@ const media = r2MediaStorage({
   publicBase: env.MEDIA_PUBLIC_BASE,
 });
 const admin = guard(createAdminSurface(runtime, { basePath: "/admin", media, /* …the generated options… */ }));
+const staffMcp = guard(createMcpSurface(runtime, {
+  basePath: "/mcp/staff", surface: "staff", media, resourceMetadata,
+}), { resourceMetadata });
 ```
 
 `aws4fetch` is the application's dependency; Mantle only calls its `sign`.
-Without both `media` and site defaults, every media route answers 501
-`MEDIA_NOT_CONFIGURED`.
+Without both `media` and site defaults, every Admin media route answers 501
+`MEDIA_NOT_CONFIGURED`, and MCP advertises no media tools. Public MCP never
+advertises media tools. The generated preset does not invent bucket credentials;
+add the same explicit adapter to its application-owned service composition.
 
 ## 3. The upload flow
 
@@ -75,16 +80,62 @@ retried.
 Optimize images where they are made (in the browser or the agent), and upload
 the variants; Mantle does not transform images.
 
+## Staff MCP upload flow
+
+Connect the tenant's `/mcp/staff` using its own identity, with the `mcp` scope
+and `editor` or `owner` role. Cloud project membership is not tenant staff.
+The verified role is checked again on every call, as in Admin.
+
+1. Call `get_media_upload_policy` to read the declared purpose MIME slots and
+   byte caps. Obtain the chat attachment bytes in the agent environment and
+   optimize/encode the required variants there; do not ask the user to run a
+   terminal command.
+2. Call `create_media_upload` with the same body as Admin's create endpoint.
+3. PUT every variant's actual bytes to its capability URL using all returned
+   `requiredHeaders`, before `expiresAt`. Bytes never travel as base64 MCP JSON.
+4. Call `commit_media_upload` with `{ uploadGroupId, alt?, caption? }`.
+   Verify success before using the returned permanent asset `id`.
+5. Pass that ID to the application's content Procedure. Images are content
+   operations, not a new Cloud source build or deploy.
+
+`list_media_assets`, `get_media_asset`, `update_media_asset` (`id`, `alt?`,
+`caption?`) and `delete_media_asset` (`id`) share the same library and editor
+permission as Admin. A create refusal publishes nothing. Expired groups need
+new capabilities; partial delete failures can retry the same ID. Keep upload
+capabilities out of logs and persisted content.
+
 ## Storing media in a Schema
 
-Store the asset's `publicUrl` (or its `id`) in a string field and mark it:
+Store the committed asset ID, not its temporary capability URL:
 
 ```yaml
-cover: { type: string, x-mcp-hint: media-image }
+coverAssetId:
+  type: string
+  x-mantle-ref: media_assets
+  x-mcp-hint: media-image
+```
+
+The string reference defaults to the native library's `id` and enables Admin's
+existing MediaPicker. The hint alone does not enable the picker. Do not author
+a replacement `media_assets` Schema: the site's library owns that table.
+
+An asset ID is not an image URL. Resolve it with the existing site library in
+an application-owned frontend handler, then use a variant's `publicUrl`:
+
+```ts
+// The same media adapter used by Admin and staff MCP.
+const asset = await runtime.site!.media(media).get(post.coverAssetId);
+const primary = asset.variants.find((variant) => variant.role === "primary")!;
+// Render primary.publicUrl as the image src; asset.alt as its alt text.
 ```
 
-The hint tells Admin and agents what the field holds. No MCP tool uploads
-media in 0.2.0; an agent uploads through Admin's API with a staff session.
+A public frontend route must enforce the content's publication and visibility
+before resolving its media. Return only public URLs/alt/variant metadata it
+needs; never expose upload capabilities or a staff MCP credential. Native site
+product tables are not manifest Store tables: do not query `media_assets` in
+View/Procedure SQL or widen the SQL grammar to resolve them. A custom handler
+can use the existing library capability while its content reads remain
+caller-scoped.
 
 ## Stale uploads
 

package/docs/handbook/concepts/mcp-and-agents.md

@@ -17,13 +17,19 @@ Both run behind `withCaller(resolver, …)`, so a tool sees the same
 
 ## Which tools
 
-A surface lists exactly:
+A surface lists these plan tools:
 
 - each Procedure bound by a Trigger `{ kind: mcp, surface: <this surface> }`,
   named after the Procedure in snake case (`place-order` is `place_order`);
 - each View whose `surface` is this one, as a read-only tool with the View's
   `input` plus `limit` and `cursor`.
 
+A configured staff surface also offers optional media product tools (see
+[media upload](../cloudflare/media-r2.md)); these delegate to the same site
+library as Admin. Without site defaults or media storage they are absent;
+public MCP never exposes them. A name collision with a plan tool fails at
+assembly rather than replacing either tool.
+
 A Schema is never a tool: there are no generated create, update or publish
 record tools. To let an agent change rows, declare a Procedure and an `mcp`
 Trigger for it.
@@ -74,13 +80,15 @@ const staffMcp = withCaller(resolver,
   { resourceMetadata });
 ```
 
-`resourceMetadata` is the `/mcp` metadata URL. The staff surface admits only
+`resourceMetadata` is the `/mcp` metadata URL. Pass the same `media` adapter as Admin to enable media tools. They require
+`editor` or `owner`; a contributor can discover them but cannot call them.
+The staff surface admits only
 callers with a staff role, and the role is read on every request.
 
 ## WebMCP in Admin
 
-`GET /admin/api/webmcp` returns `{ tools, routes }`: the staff tools (what
-`/mcp/staff` lists, in its default locale) and, for each tool, the Admin page
+`GET /admin/api/webmcp` returns `{ tools, routes }`: the manifest staff tools (in its default locale; optional native media tools
+use the existing Admin media REST routes) and, for each tool, the Admin page
 it belongs to (a Procedure with a `target` maps to its collection, a View to its
 report). A browser agent in the console registers these tools and calls one
 with `POST /admin/api/webmcp/<tool>` and the input as the JSON body. Admin runs
@@ -123,6 +131,18 @@ On the public surface, a member-facing App is the application's to build; the
 SDK attaches none. The `develop` skill's
 [MCP App recipe](../../skills/develop/mcp-app.md) lists the pieces.
 
+## Native metadata observations
+
+`createMcpSurface` optionally takes `onObservation(event)`. Registered tool dispatch emits `kind: "invocation"` with `phase: "attempt"` then `phase: "completion"`, sharing `invocationId` with the runtime's MCP cause. Metadata includes time, surface, MCP tool name and a frozen copy of the resolved Caller; completion adds monotonic `durationMs`, `outcome` (`succeeded`, `failed`, `denied`) and an optional diagnostic code. Runtime auth, guard or input-validation refusal is a dispatched invocation with a failed/denied completion; it does not assert that a business handler executed or committed. The Caller contract uses opaque subject/credential record IDs, never emails or raw tokens. Input, output and diagnostic messages are absent. A host must still allowlist what it exports.
+
+The surface's existing authorization gates emit `kind: "request-refused"` with time, surface and HTTP status. A refused batch emits one request refusal and no invocation observations. Unknown/client-hidden tools and protocol validation errors do not fabricate executed invocations. These are separate measurements: request rejections must not be added to executed-call totals.
+
+`withCaller` optionally takes `onRefusal(event)` for identity or session-origin rejection before a surface runs. It emits only time, status and `reason: "credential" | "origin"`; it cannot identify a tool in a body it has not parsed. A host registers both hooks to cover the two boundaries without resolving identity twice.
+
+Callbacks can return `void` or a delivery promise. Delivery promises are not awaited; throws/rejections are contained and never change a response. Synchronous listener work still runs inline: keep it short. The host owns request-scoped background scheduling, transport, failure reporting and retention. The simplest request binding is to construct `createMcpSurface` and `withCaller` inside the host's request handler, with callbacks closing over that request's background-task function; reuse the already-created runtime, not a new runtime/Auth. Surface construction traverses its plan's tool catalog. A host that reuses surfaces can instead use its existing request-local context facility, such as AsyncLocalStorage, to retrieve the current execution context. Never close over the first request's context or share its delivery promise with another request. With Streamable HTTP, tool execution and completion observations may happen after `fetch` returns its Response, while its body is consumed; keep the request-bound context available through that lifetime.
+
+Attempt/completion can arrive out of order, a completion may be absent, and capture is best-effort. `succeeded` describes native execution/serialization, not successful transport delivery afterward. `durationMs` uses the host's `performance.now()` clock; its precision and advancement depend on the host. This is observability, not a billing or transactional audit guarantee. Omitting both callbacks preserves current dispatch/auth behavior and adds no provider dependency or storage statement. These callbacks cover this native MCP surface, not Admin WebMCP or every runtime source. The two refusal hooks have different shapes because caller rejection occurs before a surface has identified a tool; the adopter may project them into its own request-rejection metadata.
+
 ## Further reading
 
 - [Reads: Views, REST and MCP](./views.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aotter/mantle",
-  "version": "0.2.0-alpha.3",
+  "version": "0.2.0-alpha.5",
   "description": "Mantle: a manifest-driven service core. Store authored as SQL, surfaces as Fetch functions, and the mantle CLI.",
   "license": "Apache-2.0",
   "homepage": "https://mantle.tools/",