@cyanheads/mcp-ts-core 0.12.5 → 0.12.6

package/AGENTS.md

@@ -1,7 +1,7 @@
 # Developer Protocol
 
 **Package:** `@cyanheads/mcp-ts-core`
-**Version:** 0.12.5
+**Version:** 0.12.6
 **Engines:** Bun ≥1.3.0, Node ≥24.0.0
 **MCP SDK:** `@modelcontextprotocol/server` ^2.0.0 (protocol revisions 2026-07-28 and 2025-*)
 **Zod:** ^4.5.4
@@ -59,7 +59,7 @@ Both paths share the same public API. Init copies starter `package.json`, config
 | `/utils` | formatting, encoding, network, pagination, overflow (`outlineOnOverflow`, `OUTLINE_VARIANT`, `selectSections`, `formatOutline`), logging, runtime, telemetry, token counting, parsers†, sanitization†, scheduling† | All utilities (†optional peer deps) |
 | `/services` | `OpenRouterProvider`, `SpeechService`, `createSpeechProvider`, `ElevenLabsProvider`, `WhisperProvider`, `GraphService`, provider interfaces and types | LLM, Speech (TTS/STT), Graph services |
 | `/linter` | `validateDefinitions`, `LintReport`, `LintDiagnostic`, `LintInput`, `LintSeverity` | Definition validation |
-| `/testing` | `createMockContext`, `createMockSession`, `createFetchMock`, `runToolContract`, `createMockLogger`, `getEnrichment`, `getContentBlocks`, `createInMemoryStorage` | Test kit for handlers and upstream HTTP boundaries |
+| `/testing` | `createMockContext`, `createMockSession`, `createFetchMock`, `runToolContract`, `createMockLogger`, `getEnrichment`, `getContentBlocks`, `createInMemoryStorage`, `expectInputRequired` | Test kit for handlers and upstream HTTP boundaries |
 | `/testing/fuzz` | `fuzzTool`, `fuzzResource`, `fuzzPrompt`, `zodToArbitrary`, `adversarialArbitrary`, `ADVERSARIAL_STRINGS` | Fuzz testing |
 | `/testing/vitest` | `mcpTest`, `toolContractSuite`, `McpTestFixtures` (+ re-exported `/testing` helpers) | Vitest fixtures and tool conformance suites (optional peer `vitest`) |
 
@@ -76,7 +76,7 @@ import { McpError, JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
 import { getMyService } from '@/services/my-domain/my-service.js';
 ```
 
-Build configs exported for consumer extension: `tsconfig.json` extends `@cyanheads/mcp-ts-core/tsconfig.base.json`, `biome.json` extends `@cyanheads/mcp-ts-core/biome`, `vitest.config.ts` spreads from `@cyanheads/mcp-ts-core/vitest.config`.
+Build configs exported for consumer extension: `tsconfig.json` extends `@cyanheads/mcp-ts-core/tsconfig.base.json`, `biome.json` extends `@cyanheads/mcp-ts-core/biome`, `vitest.config.ts` folds in `@cyanheads/mcp-ts-core/vitest.config` via `mergeConfig`.
 
 ---
 
@@ -115,7 +115,7 @@ await createApp({
 
 **Identity fields** — Optional `title`, `websiteUrl`, `description`, `icons` (SEP-973) pass through to the SDK's `initialize` serverInfo and to the server manifest, keeping the `/.well-known/mcp.json` server card and landing page consistent with what `initialize` reports. Explicit `description` wins over `MCP_SERVER_DESCRIPTION`/package.json.
 
-**Also available** — `landing` (`LandingConfig`, HTTP transport only: landing-page config, all fields optional), `context: { exposeStatelessSessionId }` (populate `ctx.sessionId` from the SDK's per-request token in stateless HTTP mode; default `false`), and `cacheHints` (2026-07-28 `ttlMs`/`cacheScope` per cacheable operation — see Adding a Resource for the per-resource override).
+**Also available** — `landing` (`LandingConfig`, HTTP transport only: landing-page config, all fields optional), `context: { exposeStatelessSessionId }` (populate `ctx.sessionId` from the SDK's per-request token in stateless HTTP mode; default `false`), `eventBus` (the `ServerEventBus` backing `subscriptions/listen`; defaults to an in-process bus — supply one for a multi-isolate or multi-process runtime, Workers most of all), and `cacheHints` (2026-07-28 `ttlMs`/`cacheScope` per cacheable operation — see Adding a Resource for the per-resource override).
 
 ### Cloudflare Workers — `createWorkerHandler(options)`
 
@@ -146,6 +146,7 @@ interface CoreServices {
   logger: Logger;
   storage: StorageService;
   rateLimiter: RateLimiter;
+  notify: ServerNotifier;       // out-of-request list-changed / resource-updated publishing
   canvas?: DataCanvas;          // present when CANVAS_PROVIDER_TYPE=duckdb; never on Workers
   llmProvider?: ILlmProvider;
   speechService?: SpeechService;
@@ -299,7 +300,7 @@ interface Context {
   readonly uri?: URL;                         // present for resource handlers
   readonly content: ContentCollect;           // media blocks → prepended to content[]; never in structuredContent
   readonly enrich: Enrich;                    // success-path agent context → structuredContent + content[]; typed on HandlerContext<R, E>
-  recoveryFor(reason: string): { recovery: { hint: string } } | {};  // opt-in contract resolver
+  recoveryFor(reason: string): { recovery: { hint: string } } | Record<string, never>; // opt-in contract resolver
 }
 ```
 
@@ -388,7 +389,7 @@ async handler(input, ctx) {
 
 **`ctx.recoveryFor(reason)`** returns `{}` when no contract exists (spread-safe). Typed against the declared reason union on `HandlerContext<R>`. Works in services: `throw validationError(msg, { reason: 'X', ...ctx.recoveryFor('X') })`. Opt-in — author spreads explicitly.
 
-**Contracts are inline, per-tool.** Don't extract shared `errors[]` constants — locality is the point, and dynamic `recovery` hints need tool-specific context. Declare domain-specific failures only; **baseline codes** (`InternalError`, `ServiceUnavailable`, `Timeout`, `ValidationError`, `SerializationError`) are auto-allowed by conformance lint. The lint scans handler source only — service-layer throws still reach clients via auto-classification.
+**Contracts are inline, per-tool.** Don't extract shared `errors[]` constants — locality is the point, and dynamic `recovery` hints need tool-specific context. Declare domain-specific failures only; **baseline codes** (`InternalError`, `ServiceUnavailable`, `Timeout`, `ValidationError`, `SerializationError`, `RequestCancelled`) are auto-allowed by conformance lint. The lint scans handler source only — service-layer throws still reach clients via auto-classification.
 
 **Fallback for ad-hoc throws** (no contract entry fits, prototype tools, service-layer code): use error factories.
 
@@ -398,7 +399,7 @@ throw notFound('Item not found', { itemId: '123' });
 throw validationError('Missing required field: name', { field: 'name' });
 ```
 
-Available factories: `invalidParams`, `invalidRequest`, `notFound`, `forbidden`, `unauthorized`, `validationError`, `conflict`, `rateLimited`, `timeout`, `serviceUnavailable`, `configurationError`, `internalError`, `serializationError`, `databaseError`. All accept `(message, data?, options?)` where `options` is `{ cause?: unknown }`.
+Available factories: `invalidParams`, `invalidRequest`, `notFound`, `forbidden`, `unauthorized`, `validationError`, `conflict`, `rateLimited`, `timeout`, `serviceUnavailable`, `configurationError`, `internalError`, `serializationError`, `databaseError`, `requestCancelled`. All accept `(message, data?, options?)` where `options` is `{ cause?: unknown }`.
 
 For HTTP responses from upstream APIs, use `httpErrorFromResponse(response, { service, data })` from `/utils` — maps the full status table (401/403/408/422/429/5xx) and captures body + `Retry-After`.
 
@@ -467,7 +468,7 @@ describe('myTool', () => {
 });
 ```
 
-**`createMockContext` options:** `createMockContext()` (state included), `{ tenantId: 'test-tenant' }` (explicit tenant; defaults to `'default'`, as stdio resolves it), `{ errors: myTool.errors }` (typed `ctx.fail`), `{ elicit: vi.fn() }`, `{ progress: true }` (task progress).
+**`createMockContext` options:** `createMockContext()` (state included), `{ tenantId: 'test-tenant' }` (explicit tenant; defaults to `'default'`, as stdio resolves it), `{ errors: myTool.errors }` (typed `ctx.fail`), `{ inputResponses }` / `{ requestState }` (seed `ctx.inputs` to drive a multi-round-trip handler's second round directly), plus `auth`, `sessionId`, `signal`, `requestId`, `uri`, and the four `notify*` callbacks.
 
 **`ctx.state` in tests is the production path.** The mock backs it with a real `StorageService` over an `InMemoryProvider`, so key validation (`[a-zA-Z0-9_.\-/]+` — colons rejected) and TTL expiry behave exactly as they do in a deployment. Passing `errors` narrows the return type to `HandlerContext<ReasonOf<…>>`, which is what a definition declaring a contract types its handler's `ctx` as — so `definition.handler(input, ctx)` typechecks.
 
@@ -544,16 +545,26 @@ Skills live in `skills/<name>/SKILL.md`; the full list is discoverable via the a
 | `bun run lint:mcp` | Validate MCP definitions against spec |
 | `bun run format` | Auto-fix Biome lint/format issues (safe fixes only) |
 | `bun run format:unsafe` | Also apply Biome's unsafe autofixes — review the diff; they can change behavior, not just formatting |
-| `bun run test` | Unit/compliance/smoke/fuzz/typecheck suites (Bun runtime) |
-| `bun run test:all` | Release gate: `test:coverage` + `test:node` + `test:worker` + `test:integration` |
-| `bun run test:node` | Same suites + integration under real Node (bypasses the bun-node PATH shim) |
-| `bun run test:leaks` | Suites with Vitest async-leak detection (`--detect-async-leaks`) |
-| `bun run test:typecheck` | Typecheck project only — `.test-d.ts` contracts with `@ts-expect-error` negative cases |
+| `bun run tree` | Regenerate `docs/tree.md` after the directory structure changes |
+| `bun run test` | Every root project — unit, leak-gate, compliance, smoke, fuzz, typecheck (Bun runtime) |
+| `bun run test:unit` / `:smoke` / `:fuzz` / `:compliance` / `:typecheck` | One root project via `--project`. `test:typecheck` runs the `.test-d.ts` contracts, whose `@ts-expect-error` cases are the negative assertions |
+| `bun run test:leak-gate` | The retention gate's own sentinel suite. Each case spawns a full Vitest run, so it is excluded from the `unit` project |
+| `bun run test:coverage` | Root projects with coverage thresholds enforced |
+| `bun run test:integration` | Real server subprocesses over stdio and HTTP |
+| `bun run test:worker` | The framework under real `workerd`, then a standalone Worker bundle through the Wrangler toolchain — real Node on both legs |
+| `bun run test:package` | Rebuilds, packs the tarball, and consumes it as an external project would (exports, declarations, both runtimes) |
+| `bun run test:node` | Root projects + integration under real Node via `scripts/with-node.ts`, which bypasses Bun's `node` PATH shim |
+| `bun run test:order` | Root projects on real Node in shuffled file order under a pinned seed — catches inter-file state leakage |
+| `bun run test:leaks` | Real-Node root async-resource retention gate; [scope and evidence](tests/leaks/README.md) |
+| `bun run test:all` | Release gate: `rebuild` → `test:coverage` → `test:node` → `test:worker` → `test:integration`. `test:package` and `test:leaks` are separate lanes |
+| `bun run bench` / `bench:node` / `bench:io` / `bench:io:bun` | Microbenchmarks (`tests/benchmarks/micro`) and opt-in transport I/O measurements (`tests/benchmarks/io`) |
 | `bun run start:stdio` | Production mode (stdio, after build) |
 | `bun run start:http` | Production mode (HTTP, after build) |
 | `bun run changelog:build` | Regenerate `CHANGELOG.md` from `changelog/*.md` |
 | `bun run changelog:check` | Verify `CHANGELOG.md` is in sync with `changelog/` (used by devcheck) |
 
+Lane configs live in `tests/config/` (`vitest.integration.ts`, `vitest.worker.ts`, `vitest.worker-bundle.ts`, `vitest.package.ts`, `vitest.benchmark.ts`, `vitest.performance.ts`, `vitest.leaks.ts`, `vitest.leak-sentinels.ts`). Two configs stay at the repo root: `vitest.config.ts`, the root `projects` list a bare `vitest` invocation discovers, and `vitest.config.base.mjs`, the published `./vitest.config` export.
+
 After `bun update --latest`, run the `maintenance` skill to investigate changelogs, adopt upstream changes, and sync project skills.
 
 ---
@@ -591,7 +602,7 @@ security: false                                         # optional, default fals
 
 Badge order when both set: `· ⚠️ Breaking · 🛡️ Security`. Summary > 350 chars or malformed boolean fails `changelog:check`.
 
-**Section order** (Keep a Changelog): Added, Changed, Deprecated, Removed, Fixed, Security. Omit empty sections. Pre-release versions consolidate as sub-headers inside the final version's file — no separate files per pre-release.
+**Section order:** the Keep a Changelog sequence — Added, Changed, Deprecated, Removed, Fixed, Security — then `Dependencies` last. Omit empty sections. Pre-release versions consolidate as sub-headers inside the final version's file — no separate files per pre-release.
 
 ---
 

package/CLAUDE.md

@@ -1,7 +1,7 @@
 # Developer Protocol
 
 **Package:** `@cyanheads/mcp-ts-core`
-**Version:** 0.12.5
+**Version:** 0.12.6
 **Engines:** Bun ≥1.3.0, Node ≥24.0.0
 **MCP SDK:** `@modelcontextprotocol/server` ^2.0.0 (protocol revisions 2026-07-28 and 2025-*)
 **Zod:** ^4.5.4
@@ -59,7 +59,7 @@ Both paths share the same public API. Init copies starter `package.json`, config
 | `/utils` | formatting, encoding, network, pagination, overflow (`outlineOnOverflow`, `OUTLINE_VARIANT`, `selectSections`, `formatOutline`), logging, runtime, telemetry, token counting, parsers†, sanitization†, scheduling† | All utilities (†optional peer deps) |
 | `/services` | `OpenRouterProvider`, `SpeechService`, `createSpeechProvider`, `ElevenLabsProvider`, `WhisperProvider`, `GraphService`, provider interfaces and types | LLM, Speech (TTS/STT), Graph services |
 | `/linter` | `validateDefinitions`, `LintReport`, `LintDiagnostic`, `LintInput`, `LintSeverity` | Definition validation |
-| `/testing` | `createMockContext`, `createMockSession`, `createFetchMock`, `runToolContract`, `createMockLogger`, `getEnrichment`, `getContentBlocks`, `createInMemoryStorage` | Test kit for handlers and upstream HTTP boundaries |
+| `/testing` | `createMockContext`, `createMockSession`, `createFetchMock`, `runToolContract`, `createMockLogger`, `getEnrichment`, `getContentBlocks`, `createInMemoryStorage`, `expectInputRequired` | Test kit for handlers and upstream HTTP boundaries |
 | `/testing/fuzz` | `fuzzTool`, `fuzzResource`, `fuzzPrompt`, `zodToArbitrary`, `adversarialArbitrary`, `ADVERSARIAL_STRINGS` | Fuzz testing |
 | `/testing/vitest` | `mcpTest`, `toolContractSuite`, `McpTestFixtures` (+ re-exported `/testing` helpers) | Vitest fixtures and tool conformance suites (optional peer `vitest`) |
 
@@ -76,7 +76,7 @@ import { McpError, JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
 import { getMyService } from '@/services/my-domain/my-service.js';
 ```
 
-Build configs exported for consumer extension: `tsconfig.json` extends `@cyanheads/mcp-ts-core/tsconfig.base.json`, `biome.json` extends `@cyanheads/mcp-ts-core/biome`, `vitest.config.ts` spreads from `@cyanheads/mcp-ts-core/vitest.config`.
+Build configs exported for consumer extension: `tsconfig.json` extends `@cyanheads/mcp-ts-core/tsconfig.base.json`, `biome.json` extends `@cyanheads/mcp-ts-core/biome`, `vitest.config.ts` folds in `@cyanheads/mcp-ts-core/vitest.config` via `mergeConfig`.
 
 ---
 
@@ -115,7 +115,7 @@ await createApp({
 
 **Identity fields** — Optional `title`, `websiteUrl`, `description`, `icons` (SEP-973) pass through to the SDK's `initialize` serverInfo and to the server manifest, keeping the `/.well-known/mcp.json` server card and landing page consistent with what `initialize` reports. Explicit `description` wins over `MCP_SERVER_DESCRIPTION`/package.json.
 
-**Also available** — `landing` (`LandingConfig`, HTTP transport only: landing-page config, all fields optional), `context: { exposeStatelessSessionId }` (populate `ctx.sessionId` from the SDK's per-request token in stateless HTTP mode; default `false`), and `cacheHints` (2026-07-28 `ttlMs`/`cacheScope` per cacheable operation — see Adding a Resource for the per-resource override).
+**Also available** — `landing` (`LandingConfig`, HTTP transport only: landing-page config, all fields optional), `context: { exposeStatelessSessionId }` (populate `ctx.sessionId` from the SDK's per-request token in stateless HTTP mode; default `false`), `eventBus` (the `ServerEventBus` backing `subscriptions/listen`; defaults to an in-process bus — supply one for a multi-isolate or multi-process runtime, Workers most of all), and `cacheHints` (2026-07-28 `ttlMs`/`cacheScope` per cacheable operation — see Adding a Resource for the per-resource override).
 
 ### Cloudflare Workers — `createWorkerHandler(options)`
 
@@ -146,6 +146,7 @@ interface CoreServices {
   logger: Logger;
   storage: StorageService;
   rateLimiter: RateLimiter;
+  notify: ServerNotifier;       // out-of-request list-changed / resource-updated publishing
   canvas?: DataCanvas;          // present when CANVAS_PROVIDER_TYPE=duckdb; never on Workers
   llmProvider?: ILlmProvider;
   speechService?: SpeechService;
@@ -299,7 +300,7 @@ interface Context {
   readonly uri?: URL;                         // present for resource handlers
   readonly content: ContentCollect;           // media blocks → prepended to content[]; never in structuredContent
   readonly enrich: Enrich;                    // success-path agent context → structuredContent + content[]; typed on HandlerContext<R, E>
-  recoveryFor(reason: string): { recovery: { hint: string } } | {};  // opt-in contract resolver
+  recoveryFor(reason: string): { recovery: { hint: string } } | Record<string, never>; // opt-in contract resolver
 }
 ```
 
@@ -388,7 +389,7 @@ async handler(input, ctx) {
 
 **`ctx.recoveryFor(reason)`** returns `{}` when no contract exists (spread-safe). Typed against the declared reason union on `HandlerContext<R>`. Works in services: `throw validationError(msg, { reason: 'X', ...ctx.recoveryFor('X') })`. Opt-in — author spreads explicitly.
 
-**Contracts are inline, per-tool.** Don't extract shared `errors[]` constants — locality is the point, and dynamic `recovery` hints need tool-specific context. Declare domain-specific failures only; **baseline codes** (`InternalError`, `ServiceUnavailable`, `Timeout`, `ValidationError`, `SerializationError`) are auto-allowed by conformance lint. The lint scans handler source only — service-layer throws still reach clients via auto-classification.
+**Contracts are inline, per-tool.** Don't extract shared `errors[]` constants — locality is the point, and dynamic `recovery` hints need tool-specific context. Declare domain-specific failures only; **baseline codes** (`InternalError`, `ServiceUnavailable`, `Timeout`, `ValidationError`, `SerializationError`, `RequestCancelled`) are auto-allowed by conformance lint. The lint scans handler source only — service-layer throws still reach clients via auto-classification.
 
 **Fallback for ad-hoc throws** (no contract entry fits, prototype tools, service-layer code): use error factories.
 
@@ -398,7 +399,7 @@ throw notFound('Item not found', { itemId: '123' });
 throw validationError('Missing required field: name', { field: 'name' });
 ```
 
-Available factories: `invalidParams`, `invalidRequest`, `notFound`, `forbidden`, `unauthorized`, `validationError`, `conflict`, `rateLimited`, `timeout`, `serviceUnavailable`, `configurationError`, `internalError`, `serializationError`, `databaseError`. All accept `(message, data?, options?)` where `options` is `{ cause?: unknown }`.
+Available factories: `invalidParams`, `invalidRequest`, `notFound`, `forbidden`, `unauthorized`, `validationError`, `conflict`, `rateLimited`, `timeout`, `serviceUnavailable`, `configurationError`, `internalError`, `serializationError`, `databaseError`, `requestCancelled`. All accept `(message, data?, options?)` where `options` is `{ cause?: unknown }`.
 
 For HTTP responses from upstream APIs, use `httpErrorFromResponse(response, { service, data })` from `/utils` — maps the full status table (401/403/408/422/429/5xx) and captures body + `Retry-After`.
 
@@ -467,7 +468,7 @@ describe('myTool', () => {
 });
 ```
 
-**`createMockContext` options:** `createMockContext()` (state included), `{ tenantId: 'test-tenant' }` (explicit tenant; defaults to `'default'`, as stdio resolves it), `{ errors: myTool.errors }` (typed `ctx.fail`), `{ elicit: vi.fn() }`, `{ progress: true }` (task progress).
+**`createMockContext` options:** `createMockContext()` (state included), `{ tenantId: 'test-tenant' }` (explicit tenant; defaults to `'default'`, as stdio resolves it), `{ errors: myTool.errors }` (typed `ctx.fail`), `{ inputResponses }` / `{ requestState }` (seed `ctx.inputs` to drive a multi-round-trip handler's second round directly), plus `auth`, `sessionId`, `signal`, `requestId`, `uri`, and the four `notify*` callbacks.
 
 **`ctx.state` in tests is the production path.** The mock backs it with a real `StorageService` over an `InMemoryProvider`, so key validation (`[a-zA-Z0-9_.\-/]+` — colons rejected) and TTL expiry behave exactly as they do in a deployment. Passing `errors` narrows the return type to `HandlerContext<ReasonOf<…>>`, which is what a definition declaring a contract types its handler's `ctx` as — so `definition.handler(input, ctx)` typechecks.
 
@@ -544,16 +545,26 @@ Skills live in `skills/<name>/SKILL.md`; the full list is discoverable via the a
 | `bun run lint:mcp` | Validate MCP definitions against spec |
 | `bun run format` | Auto-fix Biome lint/format issues (safe fixes only) |
 | `bun run format:unsafe` | Also apply Biome's unsafe autofixes — review the diff; they can change behavior, not just formatting |
-| `bun run test` | Unit/compliance/smoke/fuzz/typecheck suites (Bun runtime) |
-| `bun run test:all` | Release gate: `test:coverage` + `test:node` + `test:worker` + `test:integration` |
-| `bun run test:node` | Same suites + integration under real Node (bypasses the bun-node PATH shim) |
-| `bun run test:leaks` | Suites with Vitest async-leak detection (`--detect-async-leaks`) |
-| `bun run test:typecheck` | Typecheck project only — `.test-d.ts` contracts with `@ts-expect-error` negative cases |
+| `bun run tree` | Regenerate `docs/tree.md` after the directory structure changes |
+| `bun run test` | Every root project — unit, leak-gate, compliance, smoke, fuzz, typecheck (Bun runtime) |
+| `bun run test:unit` / `:smoke` / `:fuzz` / `:compliance` / `:typecheck` | One root project via `--project`. `test:typecheck` runs the `.test-d.ts` contracts, whose `@ts-expect-error` cases are the negative assertions |
+| `bun run test:leak-gate` | The retention gate's own sentinel suite. Each case spawns a full Vitest run, so it is excluded from the `unit` project |
+| `bun run test:coverage` | Root projects with coverage thresholds enforced |
+| `bun run test:integration` | Real server subprocesses over stdio and HTTP |
+| `bun run test:worker` | The framework under real `workerd`, then a standalone Worker bundle through the Wrangler toolchain — real Node on both legs |
+| `bun run test:package` | Rebuilds, packs the tarball, and consumes it as an external project would (exports, declarations, both runtimes) |
+| `bun run test:node` | Root projects + integration under real Node via `scripts/with-node.ts`, which bypasses Bun's `node` PATH shim |
+| `bun run test:order` | Root projects on real Node in shuffled file order under a pinned seed — catches inter-file state leakage |
+| `bun run test:leaks` | Real-Node root async-resource retention gate; [scope and evidence](tests/leaks/README.md) |
+| `bun run test:all` | Release gate: `rebuild` → `test:coverage` → `test:node` → `test:worker` → `test:integration`. `test:package` and `test:leaks` are separate lanes |
+| `bun run bench` / `bench:node` / `bench:io` / `bench:io:bun` | Microbenchmarks (`tests/benchmarks/micro`) and opt-in transport I/O measurements (`tests/benchmarks/io`) |
 | `bun run start:stdio` | Production mode (stdio, after build) |
 | `bun run start:http` | Production mode (HTTP, after build) |
 | `bun run changelog:build` | Regenerate `CHANGELOG.md` from `changelog/*.md` |
 | `bun run changelog:check` | Verify `CHANGELOG.md` is in sync with `changelog/` (used by devcheck) |
 
+Lane configs live in `tests/config/` (`vitest.integration.ts`, `vitest.worker.ts`, `vitest.worker-bundle.ts`, `vitest.package.ts`, `vitest.benchmark.ts`, `vitest.performance.ts`, `vitest.leaks.ts`, `vitest.leak-sentinels.ts`). Two configs stay at the repo root: `vitest.config.ts`, the root `projects` list a bare `vitest` invocation discovers, and `vitest.config.base.mjs`, the published `./vitest.config` export.
+
 After `bun update --latest`, run the `maintenance` skill to investigate changelogs, adopt upstream changes, and sync project skills.
 
 ---
@@ -591,7 +602,7 @@ security: false                                         # optional, default fals
 
 Badge order when both set: `· ⚠️ Breaking · 🛡️ Security`. Summary > 350 chars or malformed boolean fails `changelog:check`.
 
-**Section order** (Keep a Changelog): Added, Changed, Deprecated, Removed, Fixed, Security. Omit empty sections. Pre-release versions consolidate as sub-headers inside the final version's file — no separate files per pre-release.
+**Section order:** the Keep a Changelog sequence — Added, Changed, Deprecated, Removed, Fixed, Security — then `Dependencies` last. Omit empty sections. Pre-release versions consolidate as sub-headers inside the final version's file — no separate files per pre-release.
 
 ---
 

package/README.md

@@ -5,7 +5,7 @@
 
 <div align="center">
 
-[![Version](https://img.shields.io/badge/Version-0.12.5-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![MCP Spec](https://img.shields.io/badge/MCP%20Spec-2026--07--28-8A2BE2.svg?style=flat-square)](https://modelcontextprotocol.io/specification/2026-07-28)
+[![Version](https://img.shields.io/badge/Version-0.12.6-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![MCP Spec](https://img.shields.io/badge/MCP%20Spec-2026--07--28-8A2BE2.svg?style=flat-square)](https://modelcontextprotocol.io/specification/2026-07-28)
 
 [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^2.0.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![TypeScript](https://img.shields.io/badge/TypeScript-^7.0.2-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.3.0%2B-blueviolet.svg?style=flat-square)](https://bun.sh/)
 

package/changelog/0.12.x/0.12.6.md

@@ -0,0 +1,44 @@
+---
+summary: "Five source fixes: detached storage writes after a capacity sweep, an unevictable empty rate-limit key, a module-load cursor key that broke standalone Worker startup, fuzz that never reached pattern-validated handlers, and a leaked shutdown deadline. The test suite trades type-only assertions for behavior and gains three lanes."
+breaking: false
+security: true
+agent-notes: |
+  Scaffold sync only: re-sync a project copy of CLAUDE.md/AGENTS.md for the
+  Dependencies and RequestCancelled bullet under Changed. Nothing else to adopt.
+---
+
+# 0.12.6 — 2026-09-06
+
+## Added
+
+- **`bun run test:leaks` is an async-resource retention gate** ([#404](https://github.com/cyanheads/mcp-ts-core/issues/404)) — it runs the root runtime projects on real Node, observes every allocation from file collection through worker teardown, and exits nonzero on retained operations, missing evidence, or forced termination. Its sentinel suite runs separately as `bun run test:leak-gate`. Scope and evidence: [tests/leaks/README.md](tests/leaks/README.md).
+- **Benchmark lanes** — `bun run bench` / `bench:node` for micro workloads over the tool pipeline, storage, and rate limiter, and `bench:io` / `bench:io:bun` for opt-in HTTP, Workerd, and native I/O measurements. Reports carry runtime and machine provenance; no timing threshold enters `test:all`. See [tests/benchmarks/README.md](tests/benchmarks/README.md).
+- **`bun run test:worker` also boots the built bundle standalone** ([#406](https://github.com/cyanheads/mcp-ts-core/issues/406)) — a Wrangler-hosted lane outside the Workerd test pool's module loader, which is where a startup-time failure is observable at all.
+
+## Changed
+
+- **Lane configs live in `tests/config/`** — `vitest.integration.ts`, `vitest.worker.ts`, and `vitest.package.ts` moved there, joined by the new worker-bundle, benchmark, performance, and leak configs. `vitest.config.ts` and the published `vitest.config.base.mjs` stay at the repository root.
+- **`scripts/with-node.ts` selects the real Node binary** for `test:node`, `test:order`, `test:worker`, and `bench:node`, replacing the inline shell each script carried.
+- **Scaffolded `CLAUDE.md` / `AGENTS.md`** — the changelog section order ends with `Dependencies`, and `RequestCancelled` is listed among the baseline error codes a tool need not declare.
+- **Test assertions moved from type shapes to behavior** — ten type-only suites that imported no runtime value, plus a duplicate `Context` suite, are gone (~2,700 lines). The behavior they claimed to cover is now exercised directly: `Context` state bounds and cancellation between I/O steps, the multi-round-trip input helper, format parity across every enum member, and Worker lifecycle-failure, storage-failure, and wire-contract paths.
+- **Every suite passes in shuffled order** — session stores, mirror handles, sockets, and response bodies that outlived their cases are settled per test, and paired tests no longer depend on file order. The disabled OpenRouter provider suite is rewritten and running again.
+- **The skip-only telemetry suite is gone** ([#362](https://github.com/cyanheads/mcp-ts-core/issues/362)) — `instrumentation.test.ts` carried nine skips and a todo attributing them to Bun; `instrumentation.lifecycle.test.ts` now covers all of it, including the lightweight-mode and idempotency cases the skips masked.
+- Shipped skills: `api-workers` 1.8.
+
+## Fixed
+
+- **`InMemoryProvider` reattaches the tenant map after a capacity sweep** ([#403](https://github.com/cyanheads/mcp-ts-core/issues/403)) — a sweep that removed the target tenant left `set()` writing into a detached map, so the value was unreachable while `size` still counted it. `setMany()` now preflights against the snapshot it counted rather than a later one.
+- **The cursor HMAC key is generated on first use, not at module load** ([#406](https://github.com/cyanheads/mcp-ts-core/issues/406)) — Workerd forbids random generation during global evaluation, so a standalone bundle failed to start. Cursor encoding, truncation, and tenant/tamper rejection are unchanged.
+- **`fuzzTool` and `fuzzResource` reach pattern-validated handlers** ([#385](https://github.com/cyanheads/mcp-ts-core/issues/385), [#350](https://github.com/cyanheads/mcp-ts-core/issues/350)) — a `.regex()` field now drives generation instead of rejecting every sample at parse, resource runs receive the definition's `errors[]`, and tool, resource, and prompt results are validated after the call rather than assumed.
+- **`shutdownOpenTelemetry()` clears its timeout on every path** — a rejected shutdown left the deadline timer armed.
+- **The root `.mcpbignore` anchors its development-directory patterns** ([#343](https://github.com/cyanheads/mcp-ts-core/issues/343)) — `/.claude/`, `/.agents/`, and `/skills/` no longer strip matching paths under `node_modules`, and `devcheck` runs Packaging whenever `.mcpbignore` exists, not only alongside a manifest.
+
+## Security
+
+- **An empty rate-limit key is evicted like any other** ([#405](https://github.com/cyanheads/mcp-ts-core/issues/405)) — the eviction candidate was tested for truthiness, so `''` was selected and never deleted; a server whose `keyGenerator` can produce it grew the tracked map past `maxTrackedKeys` under distinct-key churn.
+
+## Dependencies
+
+- `@opentelemetry/resources`, `@opentelemetry/sdk-metrics`, `@opentelemetry/sdk-trace-node` 2.10.0 → 2.11.0
+- `@supabase/supabase-js` 2.112.4 → 2.114.0
+- `ignore` 7.0.7 → 7.0.8, `tsc-alias` 1.9.2 → 1.9.4 (lockfile only; the declared ranges are unchanged)

package/dist/core/app.d.ts

@@ -7,7 +7,7 @@
  */
 import { type Implementation, type ServerEventBus, type ServerNotifier } from '@modelcontextprotocol/server';
 import { config } from '../config/index.js';
-import { type LandingConfig, type ServerManifest } from '../core/serverManifest.js';
+import { type LandingConfig, type ServerManifest } from './serverManifest.js';
 import { type CacheHints } from '../mcp-server/cacheHints.js';
 import type { AnyPromptDefinition } from '../mcp-server/prompts/utils/promptDefinition.js';
 import type { AnyResourceDefinition } from '../mcp-server/resources/utils/resourceDefinition.js';
@@ -237,7 +237,7 @@ export declare function composeServices<TSupabaseClient extends object = Supabas
  */
 export declare function createApp<TSupabaseClient extends object = SupabaseClientHandle>(options?: CreateAppOptions<TSupabaseClient>): Promise<ServerHandle<TSupabaseClient>>;
 export { z } from 'zod';
-export type { Context, ContextInputs, ContextLogger, ContextState } from '../core/context.js';
+export type { Context, ContextInputs, ContextLogger, ContextState } from './context.js';
 export type { PromptDefinition } from '../mcp-server/prompts/utils/promptDefinition.js';
 export { prompt } from '../mcp-server/prompts/utils/promptDefinition.js';
 export type { AnyResourceDefinition, ResourceDefinition, } from '../mcp-server/resources/utils/resourceDefinition.js';

package/dist/core/app.js

@@ -8,8 +8,8 @@
 import { InMemoryServerEventBus, } from '@modelcontextprotocol/server';
 import { z } from 'zod';
 import { config, resetConfig } from '../config/index.js';
-import { startGcPressureLoop } from '../core/gcPressure.js';
-import { buildServerManifest, } from '../core/serverManifest.js';
+import { startGcPressureLoop } from './gcPressure.js';
+import { buildServerManifest, } from './serverManifest.js';
 import { assertValidCacheHints } from '../mcp-server/cacheHints.js';
 import { notifierFor } from '../mcp-server/notifications.js';
 import { PromptRegistry } from '../mcp-server/prompts/prompt-registration.js';

package/dist/core/index.d.ts

@@ -5,13 +5,13 @@
  * `DefinitionCounts`, `Database`) out of the consumer-facing surface.
  * @module src/core/index
  */
-export type { ContextOptions, CoreServices, CreateAppOptions, ServerHandle, SupabaseClientHandle, } from '../core/app.js';
-export { createApp } from '../core/app.js';
-export type { LandingConfig, LandingLink } from '../core/serverManifest.js';
+export type { ContextOptions, CoreServices, CreateAppOptions, ServerHandle, SupabaseClientHandle, } from './app.js';
+export { createApp } from './app.js';
+export type { LandingConfig, LandingLink } from './serverManifest.js';
 export type { CacheableResultMethod, CacheHints } from '../mcp-server/cacheHints.js';
 export { z } from 'zod';
-export type { AuthContext, ContentCollect, Context, ContextInputs, ContextLogger, ContextState, Enrich, EnrichHelpers, HandlerContext, ReasonOf, TypedEnrich, TypedFail, TypedRecoveryFor, } from '../core/context.js';
-export { createFail, createRecoveryFor } from '../core/context.js';
+export type { AuthContext, ContentCollect, Context, ContextInputs, ContextLogger, ContextState, Enrich, EnrichHelpers, HandlerContext, ReasonOf, TypedEnrich, TypedFail, TypedRecoveryFor, } from './context.js';
+export { createFail, createRecoveryFor } from './context.js';
 export { APP_RESOURCE_MIME_TYPE, appResource, appTool } from '../mcp-server/apps/appBuilders.js';
 export type { AnyPromptDefinition, PromptDefinition, } from '../mcp-server/prompts/utils/promptDefinition.js';
 export { prompt } from '../mcp-server/prompts/utils/promptDefinition.js';

package/dist/core/index.js

@@ -5,12 +5,12 @@
  * `DefinitionCounts`, `Database`) out of the consumer-facing surface.
  * @module src/core/index
  */
-export { createApp } from '../core/app.js';
+export { createApp } from './app.js';
 // ---------------------------------------------------------------------------
 // Zod re-export (consumers use the framework's copy, no separate zod dep)
 // ---------------------------------------------------------------------------
 export { z } from 'zod';
-export { createFail, createRecoveryFor } from '../core/context.js';
+export { createFail, createRecoveryFor } from './context.js';
 // ---------------------------------------------------------------------------
 // Definition builders & types
 // ---------------------------------------------------------------------------

package/dist/core/worker.d.ts

@@ -10,7 +10,7 @@
  * @module src/core/worker
  */
 import type { Ai, D1Database, KVNamespace, R2Bucket, ScheduledController } from '@cloudflare/workers-types';
-import { type CreateAppOptions } from '../core/app.js';
+import { type CreateAppOptions } from './app.js';
 /**
  * Cloudflare Worker Bindings with proper type safety.
  * No index signature — servers extend via intersection types.

package/dist/core/worker.js

@@ -1,5 +1,5 @@
 import { normalizeLogLevelAlias } from '../config/logLevelAlias.js';
-import { composeServices } from '../core/app.js';
+import { composeServices } from './app.js';
 import { createHttpApp } from '../mcp-server/transports/http/httpTransport.js';
 import { logger } from '../utils/internal/logger.js';
 import { requestContextService, withExtra } from '../utils/internal/requestContext.js';

package/dist/mcp-server/apps/appBuilders.d.ts

@@ -7,8 +7,8 @@
  * @module src/mcp-server/apps/appBuilders
  */
 import type { ZodObject, ZodRawShape } from 'zod';
-import type { ResourceDefinition } from '../../mcp-server/resources/utils/resourceDefinition.js';
-import type { ToolDefinition } from '../../mcp-server/tools/utils/toolDefinition.js';
+import type { ResourceDefinition } from '../resources/utils/resourceDefinition.js';
+import type { ToolDefinition } from '../tools/utils/toolDefinition.js';
 import type { ErrorContract } from '../../types-global/errors.js';
 /**
  * MIME type for MCP Apps HTML resources.

package/dist/mcp-server/apps/appBuilders.js

@@ -6,8 +6,8 @@
  * app resource `_meta.ui` into `resources/read` content items.
  * @module src/mcp-server/apps/appBuilders
  */
-import { resource } from '../../mcp-server/resources/utils/resourceDefinition.js';
-import { tool } from '../../mcp-server/tools/utils/toolDefinition.js';
+import { resource } from '../resources/utils/resourceDefinition.js';
+import { tool } from '../tools/utils/toolDefinition.js';
 /**
  * MIME type for MCP Apps HTML resources.
  * Matches `RESOURCE_MIME_TYPE` from `@modelcontextprotocol/ext-apps/server`

package/dist/mcp-server/cacheHints.d.ts

@@ -10,7 +10,7 @@
  * @module src/mcp-server/cacheHints
  */
 import type { ServerOptions } from '@modelcontextprotocol/server';
-import type { AnyResourceDefinition } from '../mcp-server/resources/utils/resourceDefinition.js';
+import type { AnyResourceDefinition } from './resources/utils/resourceDefinition.js';
 /**
  * Cache hints keyed by operation, for the closed set of methods whose
  * 2026-07-28 results carry `ttlMs` / `cacheScope`: `tools/list`,

package/dist/mcp-server/prompts/prompt-registration.d.ts

@@ -6,7 +6,7 @@
  * @module src/mcp-server/prompts/prompt-registration
  */
 import type { McpServer } from '@modelcontextprotocol/server';
-import type { AnyPromptDefinition } from '../../mcp-server/prompts/utils/promptDefinition.js';
+import type { AnyPromptDefinition } from './utils/promptDefinition.js';
 import type { logger as defaultLogger } from '../../utils/internal/logger.js';
 export declare class PromptRegistry {
     private promptDefs;

package/dist/mcp-server/prompts/prompt-registration.js

@@ -1,4 +1,4 @@
-import { isInputRequiredSignal } from '../../mcp-server/inputRequired.js';
+import { isInputRequiredSignal } from '../inputRequired.js';
 import { JsonRpcErrorCode, McpError } from '../../types-global/errors.js';
 import { ErrorHandler } from '../../utils/internal/error-handler/errorHandler.js';
 import { measurePromptGeneration } from '../../utils/internal/performance.js';

package/dist/mcp-server/resources/resource-registration.d.ts

@@ -3,9 +3,9 @@
  * @module src/mcp-server/resources/resource-registration
  */
 import { type McpServer, type ServerNotifier } from '@modelcontextprotocol/server';
-import type { ResourceSubscriptions } from '../../mcp-server/notifications.js';
-import type { AnyResourceDefinition } from '../../mcp-server/resources/utils/resourceDefinition.js';
-import { type ResourceHandlerFactoryServices } from '../../mcp-server/resources/utils/resourceHandlerFactory.js';
+import type { ResourceSubscriptions } from '../notifications.js';
+import type { AnyResourceDefinition } from './utils/resourceDefinition.js';
+import { type ResourceHandlerFactoryServices } from './utils/resourceHandlerFactory.js';
 export declare class ResourceRegistry {
     private resourceDefs;
     private services;

package/dist/mcp-server/resources/resource-registration.js

@@ -3,7 +3,7 @@
  * @module src/mcp-server/resources/resource-registration
  */
 import { ResourceTemplate, } from '@modelcontextprotocol/server';
-import { createResourceHandler, } from '../../mcp-server/resources/utils/resourceHandlerFactory.js';
+import { createResourceHandler, } from './utils/resourceHandlerFactory.js';
 import { JsonRpcErrorCode } from '../../types-global/errors.js';
 import { ErrorHandler } from '../../utils/internal/error-handler/errorHandler.js';
 import { logger } from '../../utils/internal/logger.js';

package/dist/mcp-server/resources/resourceSubscriptions.d.ts

@@ -24,7 +24,7 @@
  * @module src/mcp-server/resources/resourceSubscriptions
  */
 import type { McpServer } from '@modelcontextprotocol/server';
-import type { ResourceSubscriptions } from '../../mcp-server/notifications.js';
+import type { ResourceSubscriptions } from '../notifications.js';
 /**
  * Read-only view of one connection's subscription set. The set is mutated only
  * by the `resources/subscribe` / `resources/unsubscribe` handlers installed

package/dist/mcp-server/resources/utils/resourceHandlerFactory.d.ts

@@ -4,8 +4,8 @@
  * @module src/mcp-server/resources/utils/resourceHandlerFactory
  */
 import type { InputRequiredResult, ReadResourceResult, ServerContext, ServerNotifier, Variables } from '@modelcontextprotocol/server';
-import { type ResourceSubscriptions } from '../../../mcp-server/notifications.js';
-import type { AnyResourceDefinition } from '../../../mcp-server/resources/utils/resourceDefinition.js';
+import { type ResourceSubscriptions } from '../../notifications.js';
+import type { AnyResourceDefinition } from './resourceDefinition.js';
 import type { StorageService } from '../../../storage/core/StorageService.js';
 import type { Logger } from '../../../utils/internal/logger.js';
 /** Services required by the handler factory to construct Context. */

package/dist/mcp-server/resources/utils/resourceHandlerFactory.js

@@ -5,10 +5,10 @@
  */
 import { config } from '../../../config/index.js';
 import { attachTypedFail, createContext } from '../../../core/context.js';
-import { createContextInputs, createRequestInput, isInputRequiredSignal, } from '../../../mcp-server/inputRequired.js';
-import { selectNotifiers } from '../../../mcp-server/notifications.js';
-import { withRequiredScopes } from '../../../mcp-server/transports/auth/lib/authUtils.js';
-import { resolveSessionMode } from '../../../mcp-server/types.js';
+import { createContextInputs, createRequestInput, isInputRequiredSignal, } from '../../inputRequired.js';
+import { selectNotifiers } from '../../notifications.js';
+import { withRequiredScopes } from '../../transports/auth/lib/authUtils.js';
+import { resolveSessionMode } from '../../types.js';
 import { McpError } from '../../../types-global/errors.js';
 import { ErrorHandler } from '../../../utils/internal/error-handler/errorHandler.js';
 import { measureResourceExecution } from '../../../utils/internal/performance.js';

package/dist/mcp-server/server.d.ts

@@ -11,10 +11,10 @@
  */
 import { type Implementation, McpServer, type ServerNotifier } from '@modelcontextprotocol/server';
 import type { AppConfig } from '../config/index.js';
-import type { CacheHints } from '../mcp-server/cacheHints.js';
-import type { PromptRegistry } from '../mcp-server/prompts/prompt-registration.js';
-import type { ResourceRegistry } from '../mcp-server/resources/resource-registration.js';
-import type { ToolRegistry } from '../mcp-server/tools/tool-registration.js';
+import type { CacheHints } from './cacheHints.js';
+import type { PromptRegistry } from './prompts/prompt-registration.js';
+import type { ResourceRegistry } from './resources/resource-registration.js';
+import type { ToolRegistry } from './tools/tool-registration.js';
 /** Dependencies required to create an MCP server instance. */
 export interface McpServerDeps {
     /**

package/dist/mcp-server/server.js

@@ -10,7 +10,7 @@
  * @module src/mcp-server/server
  */
 import { McpServer, } from '@modelcontextprotocol/server';
-import { installResourceSubscriptions } from '../mcp-server/resources/resourceSubscriptions.js';
+import { installResourceSubscriptions } from './resources/resourceSubscriptions.js';
 import { logger } from '../utils/internal/logger.js';
 import { requestContextService } from '../utils/internal/requestContext.js';
 /**

package/dist/mcp-server/tools/tool-registration.d.ts

@@ -3,9 +3,9 @@
  * @module src/mcp-server/tools/tool-registration
  */
 import type { McpServer, ServerNotifier } from '@modelcontextprotocol/server';
-import type { ResourceSubscriptions } from '../../mcp-server/notifications.js';
-import type { AnyToolDefinition } from '../../mcp-server/tools/utils/toolDefinition.js';
-import { type HandlerFactoryServices } from '../../mcp-server/tools/utils/toolHandlerFactory.js';
+import type { ResourceSubscriptions } from '../notifications.js';
+import type { AnyToolDefinition } from './utils/toolDefinition.js';
+import { type HandlerFactoryServices } from './utils/toolHandlerFactory.js';
 /**
  * Union of all accepted tool definition shapes.
  *

package/dist/mcp-server/tools/tool-registration.js

@@ -1,5 +1,5 @@
-import { getDisabledMetadata } from '../../mcp-server/tools/utils/disabled-tool.js';
-import { advertisedOutputSchema, createToolHandler, } from '../../mcp-server/tools/utils/toolHandlerFactory.js';
+import { getDisabledMetadata } from './utils/disabled-tool.js';
+import { advertisedOutputSchema, createToolHandler, } from './utils/toolHandlerFactory.js';
 import { JsonRpcErrorCode } from '../../types-global/errors.js';
 import { ErrorHandler } from '../../utils/internal/error-handler/errorHandler.js';
 import { logger } from '../../utils/internal/logger.js';

package/dist/mcp-server/tools/utils/disabled-tool.d.ts

@@ -23,7 +23,7 @@
  *
  * @module src/mcp-server/tools/utils/disabled-tool
  */
-import type { AnyToolDef } from '../../../mcp-server/tools/tool-registration.js';
+import type { AnyToolDef } from '../tool-registration.js';
 /**
  * Operator-facing metadata describing why a tool is disabled in the current
  * deployment and (optionally) how to enable it.

package/dist/mcp-server/tools/utils/toolHandlerFactory.d.ts

@@ -6,7 +6,7 @@
 import type { CallToolResult, ContentBlock, InputRequiredResult, ServerContext, ServerNotifier } from '@modelcontextprotocol/server';
 import { type ZodObject, type ZodRawShape } from 'zod';
 import type { Context } from '../../../core/context.js';
-import { type ResourceSubscriptions } from '../../../mcp-server/notifications.js';
+import { type ResourceSubscriptions } from '../../notifications.js';
 import type { StorageService } from '../../../storage/core/StorageService.js';
 import { type JsonRpcErrorCode } from '../../../types-global/errors.js';
 import type { Logger } from '../../../utils/internal/logger.js';