@cyanheads/mcp-ts-core 0.13.9 → 0.13.11

package/changelog/0.13.x/0.13.10.md

@@ -0,0 +1,118 @@
+---
+summary: "A client can no longer pre-answer a consent gate with a response its declared capabilities do not cover, framework-built errors carry their request ID and fill a declared recovery hint, and multi-arch Docker builds stop running Bun under QEMU."
+breaking: false
+security: true
+agent-notes: |
+  Adoption steps for a consumer upgrading from 0.13.9.
+
+  1. Dockerfile — move every install into a `deps` stage. These steps
+     replace 0.13.8's agent-notes step 7. A production stage that copies
+     `bunfig.toml` (the 0.13.8 / 0.13.9 scaffold) fails `lint:packaging`
+     check 15 once `scripts/lint-packaging.ts` is resynced, and its
+     multi-arch build aborts on the non-native leg. `init` never overwrites
+     `Dockerfile`, so port by hand:
+     a. Resync the framework scripts (maintenance Phase C, or `init` in
+        place) so `scripts/install-otel.ts` exists. Commit it, and keep
+        `scripts/` out of `.dockerignore`: the image build copies it.
+     b. Copy the scaffold `Dockerfile`'s `deps` stage — its
+        `FROM --platform=$BUILDPLATFORM` on the build stage's `oven/bun` tag,
+        manifest copy, scanner seed, `TARGETARCH` → `.bun-cpu` mapping,
+        cross-install, `install-otel.ts` step, and scanner removal — in
+        between the build and production stages.
+     c. In the production stage, delete the `package.json`/`bun.lock`/
+        `bunfig.toml` copy, the scanner seed, the `bun install`,
+        `ARG OTEL_ENABLED`, and the OTel `RUN` (the `bun -e` range lookup
+        plus `bun add`, or an older plain `bun add` list). Before the `dist`
+        copy, add `COPY package.json ./` and
+        `COPY --from=deps /usr/src/app/node_modules ./node_modules`. Keep
+        everything else.
+     d. Move any other build-time `bun` / `bunx` call out of a stage not
+        pinned to `$BUILDPLATFORM`; check 15 names each line. Verify with
+        `bun run lint:packaging`.
+     A server still on the pre-0.13.8 production stage lints clean, but its
+     image installs skip the release-age gate and scanner; port it too.
+  2. Drop redundant recovery forwards. `ctx.fail('x', msg, ctx.recoveryFor('x'))`
+     becomes `ctx.fail('x', msg)`, and a service throw keeps only
+     `{ reason: 'x', … }` (a service that took `ctx` only for the spread can
+     drop it). Keep explicit `recovery: { hint }` overrides, deliberate
+     cross-reason forwards, and forwards a test asserts on a direct
+     `definition.handler(...)` throw — or move that assertion to
+     `runToolContract`, which applies the fill. The lint rule
+     `error-contract-recovery-unforwarded` is gone: swap its mentions in
+     `CLAUDE.md` / `AGENTS.md` for the template's Errors wording, and drop it
+     from any script that greps lint output.
+  3. Tests pinning exact error text or `data`: a tool error's `content[]`
+     now closes with `request <id>`, and tool, resource, and prompt error
+     `data` gain `requestId` (a classified plain `Error` returns
+     `data: { requestId }`). Assert with the envelope's own value or
+     `expect.any(String)`. `runToolContract` adds no request id but now
+     fills a declared hint, adding a `Recovery:` line. A server that put an
+     upstream id in `data.requestId` renames it (`upstreamRequestId`); one
+     that copied `ctx.requestId` there drops it.
+  4. Alerts: `invalid_arguments` and `client_capability_missing` records
+     now log at `notice`, tagged `mcp.error.severity: "notice"`. The
+     `Prompt generation failed.` record is gone — key prompt alerts on
+     `Error in prompt:<name>`.
+  5. Consent gates: a destructive handler that acts on `ctx.inputs` alone,
+     compares a target carried in `requestState`, or stores a record without
+     the operation and caller moves to the `api-context` § Consent gates
+     pattern: redeem a `ctx.state` record
+     `{ operation, clientId, subject, target, contentHash }` first and ask
+     again on any mismatch. Keep the record where every instance a retry
+     reaches can read it (`filesystem`, `supabase`, or `cloudflare-d1`,
+     never `cloudflare-kv`), and make an action that must not repeat
+     idempotent per record until an atomic `ctx.state.take` exists (#593).
+     Tests copy the round-one record into the round-two mock context
+     (`api-testing` § Mock inputs).
+  6. Set `MCP_REQUEST_STATE_KEY` (≥ 32 bytes, e.g. `openssl rand -base64 32`,
+     the same on every instance and Worker isolate) on any server whose
+     `requestState` drives a mutation or carries ids across rounds. A
+     startup `info` record naming the variable confirms it took. A client
+     or test that builds `requestState` by hand then gets `-32602`
+     `invalid_request_state`.
+  7. Replace a catch of `client_capability_missing` used to fall through to
+     another source with a `ctx.clientCapabilities` check before
+     `ctx.requestInput`, after reading `ctx.inputs`. Treat `undefined` as
+     cannot-ask, and never use it to skip a consent prompt.
+  8. `Context` gains a required `clientCapabilities` key, so a hand-built
+     `Context` literal (a custom mock typed `Context`) needs it.
+     `createMockContext` tests change only when they seed
+     `clientCapabilities`, which applies the production filter.
+---
+
+# 0.13.10 — 2026-09-26
+
+## Added
+
+- **`ctx.clientCapabilities`** ([#580](https://github.com/cyanheads/mcp-ts-core/issues/580)) — what the client declared for this request (`undefined` for a 2025-era request under stateless HTTP), for deciding whether to ask for optional context, never whether to skip a consent prompt. `ClientCapabilities` is exported from the main entry, and `createMockContext({ clientCapabilities })` seeds it.
+- **`MCP_REQUEST_STATE_KEY`** ([#496](https://github.com/cyanheads/mcp-ts-core/issues/496)) — opt-in key (≥ 32 bytes, the same on every instance) that seals the `requestState` a handler returns, bound to the caller for 900 s. Any other state is rejected as `-32602` `invalid_request_state` before the handler runs; also a Worker core binding.
+- **`scripts/install-otel.ts`** ([#578](https://github.com/cyanheads/mcp-ts-core/issues/578)) — ships in the package and the scaffold, installing every `@opentelemetry/*` peer plus `@hono/otel` at the framework's declared ranges and passing extra arguments (`--os`, `--cpu`) to its `bun install`. The Dockerfiles run it in place of a hand-kept list.
+
+## Changed
+
+- **A declared `recovery` reaches the wire without `ctx.recoveryFor`** ([#579](https://github.com/cyanheads/mcp-ts-core/issues/579)) — a tool or resource failure whose `data.reason` names an `errors[]` entry and carries no `data.recovery` gets that entry's hint, service throws included, and `runToolContract` does the same. A throw-site hint still wins.
+- **Error envelopes carry `data.requestId`** ([#576](https://github.com/cyanheads/mcp-ts-core/issues/576)) — tool, resource, prompt, and `httpErrorHandler` errors return the `requestId` their log records carry, and a tool's `content[]` closes with `request <id>`. A resource `-32602` whose `data` is exactly `{ uri }` and `runToolContract` results go without.
+- **Framework refusals log at `notice`** ([#567](https://github.com/cyanheads/mcp-ts-core/issues/567)) — `Error in tool:<name>` for `invalid_arguments` and `client_capability_missing` drops from `error` to `notice`, and `mcp.errors.classified` tags them `mcp.error.severity: "notice"`. A declared `severity` naming either reason still wins.
+- **`lint:packaging` check 15 flags JavaScript in any target-platform stage** ([#575](https://github.com/cyanheads/mcp-ts-core/issues/575)) — a Dockerfile stage not starting `FROM --platform=$BUILDPLATFORM` fails when a `RUN` invokes `bun` for anything but `install`/`add`, or installs once `bunfig.toml` is in the stage, naming each line.
+- **The release review pass may ship caller-handed work** — `release-pr-review` commits uncommitted work the caller explicitly hands over on top of the stack and adds it to the changelog entry; `release-and-publish` admits those commits above the release commit.
+- Skill versions: `add-service` 1.11 → 1.12, `add-test` 1.7 → 1.8, `add-tool` 2.31 → 2.32, `api-config` 1.22 → 1.23, `api-context` 2.8 → 2.9, `api-errors` 1.18 → 1.19, `api-linter` 1.20 → 1.21, `api-telemetry` 1.15 → 1.16, `api-testing` 1.12 → 1.13, `api-workers` 1.8 → 1.9, `design-mcp-server` 2.30 → 2.31, `field-test` 2.17 → 2.18, `polish-docs-meta` 2.20 → 2.21, `release-and-publish` 2.22 → 2.23, `release-pr-review` 1.6 → 1.7, `security-pass` 1.11 → 1.12.
+
+## Removed
+
+- **`error-contract-recovery-unforwarded`** ([#579](https://github.com/cyanheads/mcp-ts-core/issues/579)) — the lint rule is gone; with the recovery fill, a bare `ctx.fail('<reason>')` reaches the client with its hint.
+
+## Fixed
+
+- **Multi-arch Docker builds no longer run Bun under QEMU** ([#575](https://github.com/cyanheads/mcp-ts-core/issues/575)) — the framework and scaffold Dockerfiles install production dependencies in a `deps` stage on `$BUILDPLATFORM`, cross-installing with `--os`/`--cpu`, so the production stage's only Bun calls are `HEALTHCHECK` and `CMD`. Existing servers port by hand.
+- **An argless prompt's `generate` receives `{}`** ([#581](https://github.com/cyanheads/mcp-ts-core/issues/581)) — not the SDK's request context, and its input measures 0 bytes.
+- **A failed prompt writes one error record, under its own request id** ([#582](https://github.com/cyanheads/mcp-ts-core/issues/582)) — `Error in prompt:<name>` at `error`, and a completion record of `Prompt generation finished.` at `info` with `metrics.isSuccess: false` in place of `Prompt generation failed.` at `error`. Each `prompts/get` logs under its own `requestId`.
+
+## Security
+
+- **`ctx.inputs` keeps only responses the client declared** ([#496](https://github.com/cyanheads/mcp-ts-core/issues/496)) — a client that did not declare `elicitation`, or declared only its URL mode, could pre-answer a consent gate on its first call. A response now reaches `ctx.inputs` only when the client's declared capabilities and modes cover it, on both protocol eras.
+- **Consent gates redeem a server record** — a client that declared `elicitation` can still pre-answer, so `api-context` § *Consent gates* documents storing `{ operation, clientId, subject, target, contentHash }` in `ctx.state` under a random id and redeeming it before acting. That stops a sequential replay, not concurrent retries, until an atomic `ctx.state.take` exists ([#593](https://github.com/cyanheads/mcp-ts-core/issues/593)).
+
+## Dependencies
+
+- `hono` ^4.13.8 → ^4.13.9.
+- Dev: `@cloudflare/workers-types` 5.20260922.1 → 5.20260924.1.

package/changelog/0.13.x/0.13.11.md

@@ -0,0 +1,113 @@
+---
+summary: "A headless MCP Apps host renders app tool views in tests and from the CLI, ctx.log's mirror to the client honors MCP_LOG_LEVEL and masks sensitive fields, and devcheck's git scans and the scaffold server.json HTTP entry are fixed."
+breaking: false
+security: true
+agent-notes: |
+  Adoption steps for a consumer upgrading from 0.13.10.
+
+  1. Re-sync the framework scripts (maintenance Phase C). devcheck's
+     `TODOs/FIXMEs` step now matches: resolve each tracked uppercase `TODO` or
+     `FIXME` it reports. `Tracked Secrets` now also catches root-level files
+     (`.npmrc`, `credentials.json`, `*.pem`, `.env`, …): `git rm --cached`
+     each one and ignore it. A tracked `.github/secret_scanning.yml` now
+     passes. `lint-packaging` gains check 16 (step 2), and
+     `scripts/prune-musl-packages.ts` arrives (step 5).
+  2. Edit `server.json` — upgrading never rewrites it, and the re-synced
+     `lint:packaging` fails the old shape. Remove the `run` + `start:*`
+     `packageArguments` from each npm entry, set `"runtimeHint": "npx"` (not
+     lint-enforced), and add
+     `{ "name": "MCP_TRANSPORT_TYPE", "description": "Selects the HTTP transport.", "format": "string", "value": "http" }`
+     to the `streamable-http` entry's `environmentVariables` — `value`, not
+     `default`.
+  3. `.gitignore`: replace the `.env`, `.env.local`, and `.env.*.local` lines
+     with `.env*`, `!.env.example`, `!.env.template`, `!.env.sample`.
+     `.dockerignore`: replace the enumerated `.env` lines with `.env*`, and add
+     `.mcpregistry_github_token` and `.mcpregistry_registry_token`. Then run
+     `git ls-files '*.env*'` and `git rm --cached` anything but the three
+     templates.
+  4. Replace `.github/workflows/codeql.yml` with the scaffold copy. Once the
+     default branch has analyses under `/language:actions` and
+     `/language:javascript-typescript`, delete the
+     `.github/workflows/codeql.yml:analyze` analyses on `refs/heads/main`,
+     newest first (`DELETE .../code-scanning/analyses/<id>?confirm_delete=true`);
+     a repo that never ran the old workflow has none. A required status check
+     named `Analyze` becomes `Analyze (actions)` and
+     `Analyze (javascript-typescript)`.
+  5. `Dockerfile` `deps` stage: after the OTel step and before the scanner
+     `rm`, add `COPY scripts/prune-musl-packages.ts ./scripts/` and
+     `RUN bun scripts/prune-musl-packages.ts`. Skip both on a musl (Alpine)
+     runtime image.
+  6. Mirror servers: remove any `SQLITE_BUSY` retry wrapped around
+     `openSqliteHandle`. A failed open now rejects as `DatabaseError` with the
+     driver error on `cause` (`err.cause.code`); match on that, not on the raw
+     driver error.
+  7. Run the skill sync (maintenance Phase A) for the skills listed under
+     Changed.
+---
+
+# 0.13.11 — 2026-10-03
+
+## Added
+
+- **`@cyanheads/mcp-ts-core/testing/apps`** ([#623](https://github.com/cyanheads/mcp-ts-core/issues/623)) — `renderAppTool` calls an app tool as an MCP Apps client and renders its `ui://` view in headless `chrome-headless-shell` inside the spec's sandbox and CSP, reporting `initialized`, `errors`, `cspViolations`, `messages`, `text`, and `screenshots`. It throws only on setup failures and needs the optional peers `@modelcontextprotocol/client` and `@modelcontextprotocol/ext-apps`.
+- **`mcp-ts-core app-render`** — the same run from the CLI, writing `report.json` and screenshots under `--out`; it exits 1 only on bad arguments or a setup failure. The `field-test` skill renders every app tool with it (Step 6).
+- **`Logger.isLevelEnabled(level)`** — the level check every sink and the `ctx.log` mirror share, on the RFC 5424 order; `true` before `initialize()`.
+- **`ATTR_MCP_RESOURCE_URI_LENGTH`** — `mcp.resource.uri_length`, exported from `/utils`.
+- **`scripts/prune-musl-packages.ts`** — ships in the package and the scaffold, deleting every installed package whose own `libc` lists `musl` and not `glibc`.
+- **`lint:packaging` check 16** — fails a `server.json` npm entry carrying the `run` + `start:*` arguments, or a `streamable-http` npm entry whose `MCP_TRANSPORT_TYPE` is not `"value": "http"`. devcheck's Packaging step now runs on `server.json` alone.
+
+## Changed
+
+- **The log level filter compares RFC 5424 severity** — a `notice` floor now drops `info`, `crit` drops `error`, and `emerg` drops `alert` from every sink, where the pino-level comparison let them through.
+- **Skill guidance** — `api-config`: call `getServerConfig()` in `setup()` so a bad value fails startup; `api-mirror`: run a long scheduled sync in a child process; `api-testing`: assert a resource's declared hints through `createWorkerHandler`; `field-test`: start the server with `MCP_LOG_RATE_LIMIT_THRESHOLD=0` to count upstream requests from its log.
+- **Skill corrections** — `add-test`: a cancellation test asserts the work stopped; `add-tool`: keep a tolerated blank out of `.describe()`; `api-mirror`: the lifecycle scripts resolve `@/` only through a `tsconfig.json`, so an npm-installed server cannot run them; `code-simplifier`: `InvalidParams` covers schema rejections and upstream 400s; `git-wrapup`: the npm tarball carries `changelog/`, not the `CHANGELOG.md` rollup; `greenfield-build`: cancel the first private CodeQL run, never delete it.
+- **`release-pr-review` settles a stranded alert by category** — an alert that will not close after its fix is cleared by deleting the retired category's analyses on its ref.
+- Skill versions: `add-app-tool` 1.7 → 1.8, `add-test` 1.8 → 1.9, `add-tool` 2.32 → 2.33, `api-config` 1.23 → 1.24, `api-context` 2.9 → 2.10, `api-mirror` 1.3 → 1.4, `api-telemetry` 1.16 → 1.17, `api-testing` 1.13 → 1.14, `api-utils` 2.14 → 2.15, `code-simplifier` 1.6 → 1.7, `field-test` 2.18 → 2.19, `git-wrapup` 1.27 → 1.28, `orchestrations` 1.12 → 1.13 (workflow `greenfield-build` 1.3 → 1.4), `polish-docs-meta` 2.21 → 2.22, `release-and-publish` 2.23 → 2.24, `release-pr-review` 1.7 → 1.8, `setup` 1.11 → 1.12.
+
+## Fixed
+
+- **devcheck's `TODOs/FIXMEs` step matches** ([#588](https://github.com/cyanheads/mcp-ts-core/issues/588)) — `git grep -nwE '(TODO|FIXME)'` replaces a `\b` pattern macOS git read as a literal `b`. It is case-sensitive and skips `framework-skills/` and the `.claude`, `.agents`, `.codex`, `.cursor`, and `.windsurf` skill directories.
+- **`Tracked Secrets` catches root-level files** ([#629](https://github.com/cyanheads/mcp-ts-core/issues/629)) — every pattern carries `:(glob)`, so a root `.npmrc`, `credentials.json`, `*.pem`, or `.env` fails the step.
+- **`Tracked Secrets` passes `.github/secret_scanning.yml`** ([#594](https://github.com/cyanheads/mcp-ts-core/issues/594)) — at that exact path only.
+- **The scaffold `server.json` HTTP entry starts HTTP** ([#622](https://github.com/cyanheads/mcp-ts-core/issues/622)) — npm entries drop the `run start:*` arguments a registry client hands the bin, and set `"runtimeHint": "npx"`. The `streamable-http` entry also fixes `MCP_TRANSPORT_TYPE` as `"value": "http"`, and this repo's `server.json` matches.
+- **Scaffold ignore rules cover every env file** ([#589](https://github.com/cyanheads/mcp-ts-core/issues/589)) — `.gitignore` ignores `.env*` except `.env.example`, `.env.template`, and `.env.sample`; `.dockerignore` excludes `.env*` and the MCP registry token files. This repo's own files match.
+- **CodeQL alerts close once fixed** ([#470](https://github.com/cyanheads/mcp-ts-core/issues/470)) — the scaffold and repo workflows run one job per language, uploading under `/language:<language>`, default setup's category. A required `Analyze` check becomes `Analyze (actions)` and `Analyze (javascript-typescript)`.
+- **Docker images drop musl bindings** ([#608](https://github.com/cyanheads/mcp-ts-core/issues/608)) — both Dockerfiles' `deps` stage runs `scripts/prune-musl-packages.ts` after the OTel step, removing musl variants (DuckDB's ~70 MB binding among them) the glibc runtime never loads.
+- **`ctx.log` reaches the client only at or above `MCP_LOG_LEVEL`** ([#621](https://github.com/cyanheads/mcp-ts-core/issues/621)) — `notifications/message` honors the floor on every transport, `silent` included; a client's own level can only narrow it.
+- **`openSqliteHandle` waits out a lock and fails cleanly** ([#607](https://github.com/cyanheads/mcp-ts-core/issues/607)) — `busy_timeout` is set before the first read, and the switch to WAL retries a busy result until `busyTimeoutMs`. A failed open closes the connection and rejects as `DatabaseError`, driver error on `cause` (a missing `better-sqlite3` still throws `ConfigurationError`).
+- **`mcp-ts-core -h` exits 0** — as `--help` does, where it printed the usage and exited 1.
+
+## Security
+
+- **`ctx.log` masks sensitive fields on the wire** ([#630](https://github.com/cyanheads/mcp-ts-core/issues/630)) — the `notifications/message` payload carries `[REDACTED]` for every sensitive field at any depth, matched as `sanitizeForLogging` matches, fields added through `setSensitiveFields` included. The caller's object is not modified.
+- **A resource read's records and span cap the client's URI** ([#617](https://github.com/cyanheads/mcp-ts-core/issues/617)) — `resourceUri`, `metrics.uri`, and `mcp.resource.uri` carry at most the first 1,024 characters, with `resourceUriLength` / `mcp.resource.uri_length` holding the uncut length when cut. `ctx.uri` and the response keep the full URI.
+
+## Dependencies
+
+- `@modelcontextprotocol/server` ^2.1.0 → ^2.2.0 (`initialize` and the tool, resource, resource-template, and prompt lists are unchanged on the example server).
+- `@hono/node-server` ^2.1.1 → ^2.1.3.
+- `hono` ^4.13.9 → ^4.13.12.
+- Peer: `@duckdb/node-api` ^1.5.5-r.1 → ^1.5.5-r.1 || ^1.5.6-r.1.
+- Peer (new, optional): `@modelcontextprotocol/client` ^2.1.0, `@modelcontextprotocol/ext-apps` ^2.0.0.
+- Overrides: `brace-expansion` ^2.1.3 → ^2.1.7.
+- Overrides: `fast-uri` ^3.1.6 → ^3.1.8.
+- Overrides: `ip-address` ^10.3.1 → ^10.7.1.
+- Dev (new): `@modelcontextprotocol/ext-apps` ^2.0.3.
+- Dev: `@biomejs/biome` 2.5.14 → 2.5.15.
+- Dev: `@cloudflare/workers-types` 5.20260924.1 → 5.20260930.2.
+- Dev: `@duckdb/node-api` ^1.5.5-r.5 → ^1.5.6-r.1.
+- Dev: `@hono/otel` ^1.1.2 → ^1.2.0.
+- Dev: `@modelcontextprotocol/client` ^2.1.0 → ^2.2.0.
+- Dev: `@supabase/supabase-js` ^2.117.1 → ^2.117.2.
+- Dev: `@types/node` 26.6.2 → 26.6.3.
+- Dev: `@types/sanitize-html` ^2.16.1 → ^2.16.2.
+- Dev: `fast-xml-parser` ^5.11.1 → ^5.11.2.
+- Dev: `ignore` ^7.0.10 → ^7.0.11.
+- Dev: `openai` ^7.23.0 → ^7.25.0.
+- Dev: `sanitize-html` ^2.17.7 → ^2.18.0.
+- Dev: `tsc-alias` ^1.9.5 → ^1.9.7.
+- Dev: `vite` 8.3.0 → 8.3.1.
+- Scaffold dev: `@biomejs/biome` 2.5.14 → 2.5.15.
+- Scaffold dev: `@types/node` 26.6.2 → 26.6.3.
+- Scaffold dev: `ignore` ^7.0.9 → ^7.0.11.
+- Scaffold dev: `tsc-alias` ^1.9.5 → ^1.9.7.

package/dist/cli/app-render.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @fileoverview The `app-render` subcommand of the `mcp-ts-core` bin: renders an app
+ * tool's view in the headless MCP Apps host, writes `report.json` and screenshots under
+ * `--out`, and prints the report. Exits non-zero only on bad arguments or a setup failure
+ * (see `renderAppTool`). Loaded on demand from `src/cli/init.ts`.
+ * @module src/cli/app-render
+ */
+export declare const APP_RENDER_USAGE = "\n  Usage:\n    mcp-ts-core app-render --tool <name> [--args '<json>'] [--click <selector>]...\n                           [--out <dir>] [--browser <path>] [--theme light|dark]\n                           [--width <px>] [--height <px>] [--stream-input] [--timeout <ms>]\n                           (--url <url> | -- <command> [args...])\n\n    Renders the tool's ui:// view in headless chrome-headless-shell inside the MCP Apps\n    sandbox, clicks each --click selector in order (a screenshot after each), and prints\n    the report. With --out, writes report.json and the screenshots there.\n\n    Browser: --browser, else MCP_APPS_BROWSER_PATH, else the newest chrome-headless-shell\n    in Puppeteer's cache. To install one there:\n      npx @puppeteer/browsers install chrome-headless-shell@stable --path ~/.cache/puppeteer\n\n  Example:\n    mcp-ts-core app-render --tool my_app_tool --args '{\"query\":\"probe\"}' \\\n      --click '#action-btn' --out ./app-run -- bun run dist/index.js\n";
+/** Run the subcommand with the arguments after `app-render`. Returns the exit code. */
+export declare function appRender(argv: string[]): Promise<number>;
+//# sourceMappingURL=app-render.d.ts.map

package/dist/cli/app-render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-render.d.ts","sourceRoot":"","sources":["../../src/cli/app-render.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,eAAO,MAAM,gBAAgB,w+BAkB5B,CAAC;AAEF,uFAAuF;AACvF,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA4B/D"}

package/dist/cli/app-render.js

@@ -0,0 +1,150 @@
+/**
+ * @fileoverview The `app-render` subcommand of the `mcp-ts-core` bin: renders an app
+ * tool's view in the headless MCP Apps host, writes `report.json` and screenshots under
+ * `--out`, and prints the report. Exits non-zero only on bad arguments or a setup failure
+ * (see `renderAppTool`). Loaded on demand from `src/cli/init.ts`.
+ * @module src/cli/app-render
+ */
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { parseArgs } from 'node:util';
+export const APP_RENDER_USAGE = `
+  Usage:
+    mcp-ts-core app-render --tool <name> [--args '<json>'] [--click <selector>]...
+                           [--out <dir>] [--browser <path>] [--theme light|dark]
+                           [--width <px>] [--height <px>] [--stream-input] [--timeout <ms>]
+                           (--url <url> | -- <command> [args...])
+
+    Renders the tool's ui:// view in headless chrome-headless-shell inside the MCP Apps
+    sandbox, clicks each --click selector in order (a screenshot after each), and prints
+    the report. With --out, writes report.json and the screenshots there.
+
+    Browser: --browser, else MCP_APPS_BROWSER_PATH, else the newest chrome-headless-shell
+    in Puppeteer's cache. To install one there:
+      npx @puppeteer/browsers install chrome-headless-shell@stable --path ~/.cache/puppeteer
+
+  Example:
+    mcp-ts-core app-render --tool my_app_tool --args '{"query":"probe"}' \\
+      --click '#action-btn' --out ./app-run -- bun run dist/index.js
+`;
+/** Run the subcommand with the arguments after `app-render`. Returns the exit code. */
+export async function appRender(argv) {
+    let options;
+    try {
+        const parsed = parseCli(argv);
+        if (!parsed) {
+            console.log(APP_RENDER_USAGE);
+            return 0;
+        }
+        options = parsed;
+    }
+    catch (err) {
+        console.error(`app-render: ${errorMessage(err)}\n${APP_RENDER_USAGE}`);
+        return 1;
+    }
+    const { renderAppTool } = await import('../testing/apps/index.js');
+    try {
+        const report = await renderAppTool(options);
+        const json = JSON.stringify(report, null, 2);
+        if (options.outDir) {
+            await mkdir(options.outDir, { recursive: true });
+            await writeFile(path.join(options.outDir, 'report.json'), `${json}\n`);
+        }
+        console.log(json);
+        return 0;
+    }
+    catch (err) {
+        console.error(`app-render: ${errorMessage(err)}`);
+        return 1;
+    }
+}
+/** Options from the command line, or undefined for `--help`. */
+function parseCli(argv) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        allowPositionals: true,
+        options: {
+            tool: { type: 'string' },
+            args: { type: 'string' },
+            click: { type: 'string', multiple: true },
+            out: { type: 'string' },
+            browser: { type: 'string' },
+            url: { type: 'string' },
+            theme: { type: 'string' },
+            width: { type: 'string' },
+            height: { type: 'string' },
+            'stream-input': { type: 'boolean' },
+            timeout: { type: 'string' },
+            help: { type: 'boolean', short: 'h' },
+        },
+    });
+    if (values.help)
+        return;
+    if (!values.tool)
+        throw new Error('--tool is required.');
+    let server;
+    if (values.url) {
+        if (positionals.length > 0)
+            throw new Error('Pass either --url or a command after --, not both.');
+        server = { url: values.url };
+    }
+    else {
+        const [command, ...args] = positionals;
+        if (!command)
+            throw new Error('Pass the server as --url <url> or as a command after --.');
+        server = { command, args, env: inheritedEnv() };
+    }
+    let args = {};
+    if (values.args !== undefined) {
+        try {
+            args = JSON.parse(values.args);
+        }
+        catch (err) {
+            throw new Error(`--args is not valid JSON: ${errorMessage(err)}`);
+        }
+    }
+    if (args === null || typeof args !== 'object' || Array.isArray(args)) {
+        throw new Error('--args must be a JSON object.');
+    }
+    if (values.theme !== undefined && values.theme !== 'light' && values.theme !== 'dark') {
+        throw new Error('--theme must be light or dark.');
+    }
+    const steps = (values.click ?? []).flatMap((selector, i) => [
+        { click: selector },
+        { screenshot: `click-${i + 1}` },
+    ]);
+    const width = optionalNumber(values.width, '--width');
+    const height = optionalNumber(values.height, '--height');
+    const timeoutMs = optionalNumber(values.timeout, '--timeout');
+    return {
+        server,
+        tool: values.tool,
+        arguments: args,
+        steps,
+        host: {
+            ...(values.theme && { theme: values.theme }),
+            ...(width !== undefined && { width }),
+            ...(height !== undefined && { height }),
+            ...(values['stream-input'] && { streamInput: true }),
+        },
+        ...(values.out && { outDir: path.resolve(values.out) }),
+        ...(values.browser && { browserPath: values.browser }),
+        ...(timeoutMs !== undefined && { timeoutMs }),
+    };
+}
+function optionalNumber(value, flag) {
+    if (value === undefined)
+        return;
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        throw new Error(`${flag} must be a positive number.`);
+    return parsed;
+}
+/** This process's environment, passed to a stdio server so its configuration reaches it. */
+function inheritedEnv() {
+    return Object.fromEntries(Object.entries(process.env).filter((entry) => entry[1] !== undefined));
+}
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=app-render.js.map

package/dist/cli/app-render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-render.js","sourceRoot":"","sources":["../../src/cli/app-render.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAQtC,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;CAkB/B,CAAC;AAEF,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAc;IAC5C,IAAI,OAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC9B,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,eAAe,YAAY,CAAC,GAAG,CAAC,KAAK,gBAAgB,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,eAAe,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,SAAS,QAAQ,CAAC,IAAc;IAC9B,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI,EAAE,IAAI;QACV,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACzC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACvB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACvB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACnC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACtC;KACF,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI;QAAE,OAAO;IACxB,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAEzD,IAAI,MAAuB,CAAC;IAC5B,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,MAAM,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC1F,MAAM,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,IAAI,GAAY,EAAE,CAAC;IACvB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAoB,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3E,EAAE,KAAK,EAAE,QAAQ,EAAE;QACnB,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE;KACjC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC9D,OAAO;QACL,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,IAA+B;QAC1C,KAAK;QACL,IAAI,EAAE;YACJ,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAC5C,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;YACrC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;SACrD;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACtD,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB,EAAE,IAAY;IAC7D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4FAA4F;AAC5F,SAAS,YAAY;IACnB,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAChC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAC7D,CACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC"}

package/dist/cli/init.d.ts

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 /**
  * @fileoverview CLI entry point for `@cyanheads/mcp-ts-core`. Dispatches subcommands.
- * Currently supports `init` for scaffolding new consumer projects.
+ * Supports `init` for scaffolding new consumer projects and `app-render` (loaded on
+ * demand) for rendering an app tool's view in the headless MCP Apps host.
  * @module src/cli/init
  */
 export {};

package/dist/cli/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/cli/init.ts"],"names":[],"mappings":";AACA;;;;GAIG"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/cli/init.ts"],"names":[],"mappings":";AACA;;;;;GAKG"}

package/dist/cli/init.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 /**
  * @fileoverview CLI entry point for `@cyanheads/mcp-ts-core`. Dispatches subcommands.
- * Currently supports `init` for scaffolding new consumer projects.
+ * Supports `init` for scaffolding new consumer projects and `app-render` (loaded on
+ * demand) for rendering an app tool's view in the headless MCP Apps host.
  * @module src/cli/init
  */
 import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
@@ -37,9 +38,13 @@ const [subcommand] = process.argv.slice(2);
 if (subcommand === 'init') {
     init();
 }
+else if (subcommand === 'app-render') {
+    const { appRender } = await import('./app-render.js');
+    process.exitCode = await appRender(process.argv.slice(3));
+}
 else {
     printUsage();
-    process.exit(subcommand === undefined || subcommand === '--help' ? 0 : 1);
+    process.exit(subcommand === undefined || subcommand === '--help' || subcommand === '-h' ? 0 : 1);
 }
 function printUsage() {
     console.log(`
@@ -48,11 +53,14 @@ function printUsage() {
   Usage:
     mcp-ts-core init [name]    Scaffold a new MCP server project
                                Without [name], scaffolds in place (upgrade flow)
+    mcp-ts-core app-render ... Render an app tool's view in a headless MCP Apps host
+                               and print the report (app-render --help for options)
     mcp-ts-core --help, -h     Show this help message
     mcp-ts-core init --help    Show init help (same output)
 
   Examples:
     bunx @cyanheads/mcp-ts-core init my-mcp-server
+    bunx @cyanheads/mcp-ts-core app-render --tool my_app_tool -- bun run dist/index.js
 `);
 }
 // ── Init command ──────────────────────────────────────────────────────

package/dist/cli/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/cli/init.ts"],"names":[],"mappings":";AACA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC/E,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;AACtD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;AAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAClD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAKxF,CAAC;AACF;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC;KAChD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;KACxE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;KAC9C,IAAI,EAAE,CAAC;AACV,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,KAAK;IACL,KAAK;IACL,KAAK;IACL,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,EAAE;CACH,CAAC,CAAC;AAEH,yEAAyE;AAEzE,MAAM,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAE3C,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;IAC1B,IAAI,EAAE,CAAC;AACT,CAAC;KAAM,CAAC;IACN,UAAU,EAAE,CAAC;IACb,OAAO,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CAAC,GAAG,CAAC;4BACc,YAAY,CAAC,OAAO;;;;;;;;;;CAU/C,CAAC,CAAC;AACH,CAAC;AAED,yEAAyE;AAEzE,SAAS,IAAI;IACX,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IACzE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,6BAA6B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9D,MAAM,WAAW,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE3C,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,OAAO,CAAC,KAAK,CACX,kCAAkC,IAAI,kDAAkD,CACzF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IAErE,MAAM,aAAa,GAA2B;QAC5C,YAAY,EAAE,WAAW;QACzB,iBAAiB,EAAE,YAAY,CAAC,OAAO;QACvC,eAAe,EAAE,YAAY,CAAC,YAAY,EAAE,CAAC,8BAA8B,CAAC,IAAI,EAAE;QAClF,WAAW,EAAE,YAAY,CAAC,gBAAgB,EAAE,GAAG,IAAI,EAAE;KACtD,CAAC;IAEF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,yBAAyB;IACzB,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAErD,uBAAuB;IACvB,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAEpC,+BAA+B;IAC/B,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAE3C,gBAAgB;IAChB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,yEAAyE;AAEzE,SAAS,aAAa,CACpB,IAAY,EACZ,aAAqC,EACrC,OAAiB,EACjB,OAAiB;IAEjB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAEvC,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,OAAO,GAAG,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAE/C,qEAAqE;QACrE,qCAAqC;QACrC,wCAAwC;QACxC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACxD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAErD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAErC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,IAAI,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;gBACzD,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;YACD,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;AACH,CAAC;AAED,yEAAyE;AAEzE,SAAS,WAAW,CAAC,IAAY,EAAE,OAAiB,EAAE,OAAiB;IACrE,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO;IAErC,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAErC,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,yEAAyE;AAEzE,SAAS,kBAAkB,CAAC,IAAY,EAAE,OAAiB,EAAE,OAAiB;IAC5E,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO;IAEpC,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAElG,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QAEvC,MAAM,QAAQ,GAAG,eAAe,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QACrE,IAAI,QAAQ,KAAK,UAAU;YAAE,SAAS;QAEtC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAEvD,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,CAClB,kBAAkB,EAClB,GAAG,CAAC,IAAI,EACR,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAC9C,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAErC,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3D,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO;IAC9B,iFAAiF;IACjF,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACjG,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,wFAAwF;AACxF,SAAS,YAAY,CACnB,OAAe,EACf,QAAgB,EAChB,OAAe,EACf,OAAiB,EACjB,OAAiB;IAEjB,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AAEzE,+EAA+E;AAC/E,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAErC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,YAAY,CAAC,OAAiB,EAAE,OAAiB,EAAE,IAAwB;IAClF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;IAExE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,eAAe,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,sDAAsD,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;AACH,CAAC"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/cli/init.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC/E,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;AACtD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;AAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAClD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAKxF,CAAC;AACF;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC;KAChD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;KACxE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;KAC9C,IAAI,EAAE,CAAC;AACV,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,KAAK;IACL,KAAK;IACL,KAAK;IACL,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,EAAE;CACH,CAAC,CAAC;AAEH,yEAAyE;AAEzE,MAAM,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAE3C,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;IAC1B,IAAI,EAAE,CAAC;AACT,CAAC;KAAM,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;IACvC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtD,OAAO,CAAC,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;KAAM,CAAC;IACN,UAAU,EAAE,CAAC;IACb,OAAO,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CAAC,GAAG,CAAC;4BACc,YAAY,CAAC,OAAO;;;;;;;;;;;;;CAa/C,CAAC,CAAC;AACH,CAAC;AAED,yEAAyE;AAEzE,SAAS,IAAI;IACX,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IACzE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,6BAA6B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9D,MAAM,WAAW,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE3C,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,OAAO,CAAC,KAAK,CACX,kCAAkC,IAAI,kDAAkD,CACzF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IAErE,MAAM,aAAa,GAA2B;QAC5C,YAAY,EAAE,WAAW;QACzB,iBAAiB,EAAE,YAAY,CAAC,OAAO;QACvC,eAAe,EAAE,YAAY,CAAC,YAAY,EAAE,CAAC,8BAA8B,CAAC,IAAI,EAAE;QAClF,WAAW,EAAE,YAAY,CAAC,gBAAgB,EAAE,GAAG,IAAI,EAAE;KACtD,CAAC;IAEF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,yBAAyB;IACzB,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAErD,uBAAuB;IACvB,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAEpC,+BAA+B;IAC/B,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAE3C,gBAAgB;IAChB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,yEAAyE;AAEzE,SAAS,aAAa,CACpB,IAAY,EACZ,aAAqC,EACrC,OAAiB,EACjB,OAAiB;IAEjB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAEvC,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,OAAO,GAAG,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAE/C,qEAAqE;QACrE,qCAAqC;QACrC,wCAAwC;QACxC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACxD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAErD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAErC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,IAAI,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;gBACzD,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;YACD,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;AACH,CAAC;AAED,yEAAyE;AAEzE,SAAS,WAAW,CAAC,IAAY,EAAE,OAAiB,EAAE,OAAiB;IACrE,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO;IAErC,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAErC,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,yEAAyE;AAEzE,SAAS,kBAAkB,CAAC,IAAY,EAAE,OAAiB,EAAE,OAAiB;IAC5E,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO;IAEpC,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAElG,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QAEvC,MAAM,QAAQ,GAAG,eAAe,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QACrE,IAAI,QAAQ,KAAK,UAAU;YAAE,SAAS;QAEtC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAEvD,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,CAClB,kBAAkB,EAClB,GAAG,CAAC,IAAI,EACR,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAC9C,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAErC,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3D,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO;IAC9B,iFAAiF;IACjF,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACjG,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,wFAAwF;AACxF,SAAS,YAAY,CACnB,OAAe,EACf,QAAgB,EAChB,OAAe,EACf,OAAiB,EACjB,OAAiB;IAEjB,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AAEzE,+EAA+E;AAC/E,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAErC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,YAAY,CAAC,OAAiB,EAAE,OAAiB,EAAE,IAAwB;IAClF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;IAExE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,eAAe,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,sDAAsD,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/config/index.d.ts

@@ -60,6 +60,7 @@ declare const ConfigSchema: z.ZodObject<{
     mcpGcPressureIntervalMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     mcpAllowedOrigins: z.ZodOptional<z.ZodArray<z.ZodString>>;
     mcpAuthSecretKey: z.ZodOptional<z.ZodString>;
+    mcpRequestStateKey: z.ZodOptional<z.ZodString>;
     mcpJwtExpectedIssuer: z.ZodOptional<z.ZodString>;
     mcpJwtExpectedAudience: z.ZodOptional<z.ZodString>;
     mcpAuthMode: z.ZodPreprocess<z.ZodDefault<z.ZodEnum<{
@@ -197,6 +198,7 @@ declare const parseConfig: (envOverrides?: Record<string, string | undefined>) =
     mcpGcPressureIntervalMs: number;
     mcpAllowedOrigins?: string[] | undefined;
     mcpAuthSecretKey?: string | undefined;
+    mcpRequestStateKey?: string | undefined;
     mcpJwtExpectedIssuer?: string | undefined;
     mcpJwtExpectedAudience?: string | undefined;
     mcpAuthMode: "jwt" | "none" | "oauth";
@@ -325,6 +327,7 @@ declare const config: {
     mcpGcPressureIntervalMs: number;
     mcpAllowedOrigins?: string[] | undefined;
     mcpAuthSecretKey?: string | undefined;
+    mcpRequestStateKey?: string | undefined;
     mcpJwtExpectedIssuer?: string | undefined;
     mcpJwtExpectedAudience?: string | undefined;
     mcpAuthMode: "jwt" | "none" | "oauth";

package/dist/config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,wEAAwE;AACxE,eAAO,MAAM,cAAc,2BAA2B,CAAC;AACvD,eAAO,MAAM,iBAAiB,QAAkC,CAAC;AA6DjE,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiYd,CAAC;AAGL,QAAA,MAAM,WAAW,kBAAmB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8MrE,CAAC;AAIF;;;;;;;;GAQG;AACH,QAAA,MAAM,WAAW,kBAAmB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KAAG,IAExE,CAAC;AAEF;;;;;;GAMG;AACH,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuBV,CAAC;AAEH;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAErD;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,wEAAwE;AACxE,eAAO,MAAM,cAAc,2BAA2B,CAAC;AACvD,eAAO,MAAM,iBAAiB,QAAkC,CAAC;AA6DjE,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2Yd,CAAC;AAGL,QAAA,MAAM,WAAW,kBAAmB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+MrE,CAAC;AAIF;;;;;;;;GAQG;AACH,QAAA,MAAM,WAAW,kBAAmB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KAAG,IAExE,CAAC;AAEF;;;;;;GAMG;AACH,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuBV,CAAC;AAEH;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAErD;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC"}

package/dist/config/index.js

@@ -204,6 +204,16 @@ const ConfigSchema = z
     mcpGcPressureIntervalMs: z.coerce.number().min(0).default(0),
     mcpAllowedOrigins: z.array(z.string()).optional(),
     mcpAuthSecretKey: z.string().optional(),
+    /**
+     * Opt-in HMAC key for multi-round-trip `requestState`. When set, the
+     * framework seals the state a handler returns with `ctx.requestInput` and
+     * the SDK verifies every echoed state before the handler runs, so a retry
+     * can only carry state this server minted, for the same principal, within
+     * 900 s. Every instance a retry can reach needs the same key. Unset, state
+     * round-trips raw. At least 32 bytes; the length is checked where the
+     * codec is built, so the startup error names this variable.
+     */
+    mcpRequestStateKey: z.string().optional(),
     mcpJwtExpectedIssuer: z.string().optional(),
     mcpJwtExpectedAudience: z.string().optional(),
     mcpAuthMode: z.preprocess(emptyStringAsUndefined, z.enum(['jwt', 'oauth', 'none']).default('none')),
@@ -481,6 +491,7 @@ const parseConfig = (envOverrides) => {
             .map((o) => o.trim())
             .filter(Boolean),
         mcpAuthSecretKey: env.MCP_AUTH_SECRET_KEY,
+        mcpRequestStateKey: env.MCP_REQUEST_STATE_KEY,
         mcpJwtExpectedIssuer: env.MCP_JWT_EXPECTED_ISSUER,
         mcpJwtExpectedAudience: env.MCP_JWT_EXPECTED_AUDIENCE,
         mcpAuthMode: env.MCP_AUTH_MODE,