@ggui-ai/mcp-server 0.19.0 → 0.21.0

package/dist/api-renders-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-renders-routes.d.ts","sourceRoot":"","sources":["../src/api-renders-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAQ9F,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACzD,sEAAsE;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,KAAK,MAAM,GAAG,SAAS,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,oEAAoE;IACpE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,MAAM,CAAC;IACzC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAgX9D"}
+{"version":3,"file":"api-renders-routes.d.ts","sourceRoot":"","sources":["../src/api-renders-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAQ9F,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACzD,sEAAsE;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,KAAK,MAAM,GAAG,SAAS,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,oEAAoE;IACpE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,MAAM,CAAC;IACzC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAoX9D"}

package/dist/api-renders-routes.js

@@ -46,6 +46,7 @@
 import { verifyToken } from "@ggui-ai/mcp-server-core";
 import { deriveContractBundle, derivePublicEnvProjection, deriveRenderMeta, spreadRenderMetaViewOntoSlice, } from "@ggui-ai/mcp-server-handlers/renders";
 import { composeSessionApiUrls, MCP_APP_AI_GGUI_RENDER_META_KEY, } from "@ggui-ai/protocol/integrations/mcp-apps";
+import { createPublicReadPreflight } from "./browser-cors.js";
 /**
  * Mount `GET /api/sessions/:sessionId/state` +
  * `GET /api/sessions/:sessionId/events` onto the express app.
@@ -57,6 +58,8 @@ export function mountApiRendersRoutes(opts) {
     // host if fronted separately, else the public origin); the request
     // host is the last resort for local/tunnel deployments.
     const staticBase = codeBaseUrl ?? publicBaseUrl;
+    // ggui#1231 — a public `*` read owns its preflight (null-origin frames).
+    app.options("/api/sessions/:sessionId/state", createPublicReadPreflight());
     app.get("/api/sessions/:sessionId/state", async (req, res) => {
         // CORS on EVERY response, gates included: cross-origin frames can
         // only read a status when the response carries ACAO. Without it a
@@ -285,6 +288,8 @@ export function mountApiRendersRoutes(opts) {
             [MCP_APP_AI_GGUI_RENDER_META_KEY]: renderMeta,
         });
     });
+    // ggui#1231 — a public `*` read owns its preflight (null-origin frames).
+    app.options("/api/sessions/:sessionId/events", createPublicReadPreflight());
     app.get("/api/sessions/:sessionId/events", async (req, res) => {
         // CORS pre-gates — same contract as /state: the 410/401 verdicts
         // are part of the polling rung's protocol and must be readable

package/dist/api-renders-stream-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-renders-stream-route.d.ts","sourceRoot":"","sources":["../src/api-renders-stream-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,KAAK,EAAc,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG7E,OAAO,KAAK,EAAE,OAAO,EAAY,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAE1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAS,CAAC;AA2DvC,MAAM,WAAW,iCAAiC;IAChD,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,2DAA2D;IAC3D,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,wBAAwB,GAAG,IAAI,CAAC;IAChE,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,yBAAyB;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,iCAAiC,GAAG,IAAI,CA0MxF"}
+{"version":3,"file":"api-renders-stream-route.d.ts","sourceRoot":"","sources":["../src/api-renders-stream-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,KAAK,EAAc,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG7E,OAAO,KAAK,EAAE,OAAO,EAAY,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAE1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAS,CAAC;AA2DvC,MAAM,WAAW,iCAAiC;IAChD,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,2DAA2D;IAC3D,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,wBAAwB,GAAG,IAAI,CAAC;IAChE,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,yBAAyB;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,iCAAiC,GAAG,IAAI,CA4MxF"}

package/dist/api-renders-stream-route.js

@@ -44,6 +44,7 @@
  * is the client ladder's SSE→polling demotion signal.
  */
 import { verifyToken } from "@ggui-ai/mcp-server-core";
+import { createPublicReadPreflight } from "./browser-cors.js";
 /**
  * Heartbeat cadence (25s). Under ALB's 60s idle default with 2x+
  * headroom; each tick also probes render expiry so an evicted /
@@ -110,6 +111,8 @@ function parseNonNegativeInt(raw) {
 export function mountApiRendersStreamRoute(opts) {
     const { app, renderStore, secret, channelProvider, logger } = opts;
     const heartbeatMs = opts.heartbeatMs ?? SSE_HEARTBEAT_MS;
+    // ggui#1231 — a public `*` read owns its preflight (null-origin frames).
+    app.options("/api/sessions/:sessionId/stream", createPublicReadPreflight());
     app.get("/api/sessions/:sessionId/stream", async (req, res) => {
         // ── Phase 1: plain-HTTP gates, BEFORE any event-stream byte ──
         // (EventSource fails permanently on non-200 — the demotion signal.)

package/dist/browser-cors.d.ts

@@ -9,11 +9,23 @@
  * where the browser itself holds the Streamable HTTP connection: guuey's
  * browser host layer, local dev SPAs, Electron renderers.
  *
- * POSTURE: an origin ALLOWLIST, never `*`. The three existing `*` routes
- * (runtime-bundle, code, api-renders) are credential-free or token-gated
- * public reads; `/mcp` is different — `cookieAuthMiddleware` promotes the
- * session cookie to a Bearer on it, so it belongs to the cookie-authed
- * class. `Access-Control-Allow-Credentials` is NEVER set.
+ * POSTURE: an origin ALLOWLIST, never `*`, for everything THIS layer
+ * answers. The public `*` read routes (runtime bundle + shims, code and
+ * contract modules, the session read endpoints) are credential-free or
+ * token-in-URL public reads that stamp `*` on their own responses — and
+ * since ggui#1231 they also OWN their preflight, via
+ * `createPublicReadPreflight()`. The reason is structural: a sandboxed
+ * `srcdoc` frame's origin is the literal `null`, a value no allowlist
+ * can name, and a preflight this layer ended with a bare 204 made every
+ * request the browser chose to preflight fail as an opaque CORS error
+ * while the plain GET kept working. So an OPTIONS from an origin this
+ * layer does not allow is PASSED THROUGH, not ended — a route-level
+ * `app.options(path, createPublicReadPreflight())` gets its turn, and
+ * `createPreflightFallback()`, mounted last, closes what nobody owns
+ * with the bare 204. `/mcp` is different — `cookieAuthMiddleware`
+ * promotes the session cookie to a Bearer on it, so it belongs to the
+ * cookie-authed class and never owns a `*` preflight.
+ * `Access-Control-Allow-Credentials` is NEVER set, by either handler.
  *
  * LAYER RELATIONSHIP: origin-validation runs first and decides WHETHER a
  * request executes at all (the spec-mandated 403); this layer decides HOW
@@ -26,4 +38,26 @@ import { type OriginHostPolicy } from "./origin-validation.js";
 export declare function createBrowserCorsMiddleware(opts: {
     readonly policy: OriginHostPolicy;
 }): RequestHandler;
+/**
+ * The preflight answer of a public `*` read route (ggui#1231). Register
+ * it as `app.options(<the same path>, createPublicReadPreflight())`
+ * beside the route's `app.get`, so the preflight says exactly what the
+ * GET already says: any origin — including the `null` of a sandboxed
+ * `srcdoc` frame, which no allowlist can name — may read it. Reflects
+ * the requested headers so a host-injected extra needs no code change
+ * here. Never sets `Access-Control-Allow-Credentials`.
+ *
+ * An origin the allowlist DOES name never reaches this handler: the
+ * allowlist layer answers its preflight first, with the specific origin.
+ */
+export declare function createPublicReadPreflight(): RequestHandler;
+/**
+ * The terminal answer for a preflight nobody owns: a bare 204 with no
+ * CORS header, so the browser fails the request. Mount it LAST — after
+ * every route — because `createBrowserCorsMiddleware` passes an
+ * unlisted-origin (or origin-less) OPTIONS through precisely so a
+ * route-level preflight can answer before this does. Non-OPTIONS
+ * requests are untouched.
+ */
+export declare function createPreflightFallback(): RequestHandler;
 //# sourceMappingURL=browser-cors.d.ts.map

package/dist/browser-cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-cors.d.ts","sourceRoot":"","sources":["../src/browser-cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AA8BnF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,GAAG,cAAc,CA+CjB"}
+{"version":3,"file":"browser-cors.d.ts","sourceRoot":"","sources":["../src/browser-cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AA8BnF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,GAAG,cAAc,CAiDjB;AAYD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,IAAI,cAAc,CAc1D;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,cAAc,CAQxD"}

package/dist/browser-cors.js

@@ -26,12 +26,9 @@ export function createBrowserCorsMiddleware(opts) {
     const { policy } = opts;
     return (req, res, next) => {
         const origin = typeof req.headers.origin === "string" ? req.headers.origin : undefined;
-        // No Origin — a non-browser client. Nothing to negotiate.
+        // No Origin — a non-browser client. Nothing to negotiate; an OPTIONS
+        // falls through to a route-owned preflight or the fallback's 204.
         if (origin === undefined || origin.length === 0) {
-            if (req.method === "OPTIONS") {
-                res.status(204).end();
-                return;
-            }
             next();
             return;
         }
@@ -53,9 +50,63 @@ export function createBrowserCorsMiddleware(opts) {
                 const requested = req.headers["access-control-request-headers"];
                 res.setHeader("Access-Control-Allow-Headers", typeof requested === "string" && requested.length > 0 ? requested : DEFAULT_ALLOW_HEADERS);
                 res.setHeader("Access-Control-Max-Age", MAX_AGE_SECONDS);
+                res.status(204).end();
+                return;
             }
-            // A disallowed preflight gets a bare 204 with no CORS headers —
-            // the browser fails the request, which is the intended outcome.
+            // A preflight from an origin this layer does not allow is NOT ended
+            // here (ggui#1231): the public `*` read routes own theirs — see
+            // `createPublicReadPreflight()` — and `createPreflightFallback()`
+            // answers everything nobody owns with a bare 204 and no CORS
+            // header, so the browser fails the request, the intended outcome.
+            next();
+            return;
+        }
+        next();
+    };
+}
+/** Methods a public read route serves; nothing side-effectful. */
+const PUBLIC_READ_ALLOW_METHODS = "GET, HEAD, OPTIONS";
+/**
+ * Fallback allow-headers for a public read preflight that names none.
+ * These routes take no `Authorization`: their gate, where they have one,
+ * is a token in the URL, which the preflight never carries.
+ */
+const PUBLIC_READ_DEFAULT_ALLOW_HEADERS = "Accept, Content-Type, Range";
+/**
+ * The preflight answer of a public `*` read route (ggui#1231). Register
+ * it as `app.options(<the same path>, createPublicReadPreflight())`
+ * beside the route's `app.get`, so the preflight says exactly what the
+ * GET already says: any origin — including the `null` of a sandboxed
+ * `srcdoc` frame, which no allowlist can name — may read it. Reflects
+ * the requested headers so a host-injected extra needs no code change
+ * here. Never sets `Access-Control-Allow-Credentials`.
+ *
+ * An origin the allowlist DOES name never reaches this handler: the
+ * allowlist layer answers its preflight first, with the specific origin.
+ */
+export function createPublicReadPreflight() {
+    return (req, res) => {
+        res.setHeader("Access-Control-Allow-Origin", "*");
+        res.setHeader("Access-Control-Allow-Methods", PUBLIC_READ_ALLOW_METHODS);
+        const requested = req.headers["access-control-request-headers"];
+        res.setHeader("Access-Control-Allow-Headers", typeof requested === "string" && requested.length > 0
+            ? requested
+            : PUBLIC_READ_DEFAULT_ALLOW_HEADERS);
+        res.setHeader("Access-Control-Max-Age", MAX_AGE_SECONDS);
+        res.status(204).end();
+    };
+}
+/**
+ * The terminal answer for a preflight nobody owns: a bare 204 with no
+ * CORS header, so the browser fails the request. Mount it LAST — after
+ * every route — because `createBrowserCorsMiddleware` passes an
+ * unlisted-origin (or origin-less) OPTIONS through precisely so a
+ * route-level preflight can answer before this does. Non-OPTIONS
+ * requests are untouched.
+ */
+export function createPreflightFallback() {
+    return (req, res, next) => {
+        if (req.method === "OPTIONS") {
             res.status(204).end();
             return;
         }

package/dist/code-module-variant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"code-module-variant.d.ts","sourceRoot":"","sources":["../src/code-module-variant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAU1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE;IACrC,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,KAAK,MAAM,GAAG,SAAS,CAAC;AAEzB,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,MAAM,CAET;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,iBAAiB,CASpB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAQ9G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GACf,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAkBzC;AAQD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C,GAAG,IAAI,CAyCP;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,QAAkD,CAAC;AAEzF;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,0BAA0B,EAAE,SAAS,CAAC;IACjE,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GAAG,IAAI,CA8DP"}
+{"version":3,"file":"code-module-variant.d.ts","sourceRoot":"","sources":["../src/code-module-variant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAU1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE;IACrC,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,KAAK,MAAM,GAAG,SAAS,CAAC;AAEzB,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,MAAM,CAET;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,iBAAiB,CASpB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAQ9G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GACf,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAkBzC;AAQD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C,GAAG,IAAI,CA2CP;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,QAAkD,CAAC;AAEzF;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,0BAA0B,EAAE,SAAS,CAAC;IACjE,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GAAG,IAAI,CAgEP"}

package/dist/code-module-variant.js

@@ -39,6 +39,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { rewriteImports, findBareImportSpecifiers, stripMarkers, ASSET_SHIM_FOR_SPECIFIER, } from "@ggui-ai/design/rendering";
 import { hoistImports } from "@ggui-ai/design/module-loader";
+import { createPublicReadPreflight } from "./browser-cors.js";
 /** The variant URL for (hash, rt) under `base` — ONE composition site. */
 export function composeCodeModuleUrl(args) {
     return `${args.base}/code/${args.hash}.m${args.runtimeHash}.js`;
@@ -122,6 +123,8 @@ const RUNTIME_HASH_REGEX = /^[a-f0-9]{12}$/;
  */
 export function mountShimRoutes(opts) {
     const { app, urlPrefix, runtimeHash, shims } = opts;
+    // ggui#1231 — a public `*` read owns its preflight (null-origin frames).
+    app.options(`${urlPrefix}/:rt/:file`, createPublicReadPreflight());
     app.get(`${urlPrefix}/:rt/:file`, (req, res) => {
         // Same CORS rationale as the runtime bundle: module fetches from a
         // sandboxed `srcdoc` iframe (`null` origin) always run CORS mode.
@@ -179,6 +182,8 @@ export const CODE_MODULE_VARIANT_ROUTE = /^\/code\/([a-f0-9]{64})\.m([a-f0-9]{12
  */
 export function mountCodeModuleVariantRoute(opts) {
     const { app, codeStore, variant, logger } = opts;
+    // ggui#1231 — a public `*` read owns its preflight (null-origin frames).
+    app.options(CODE_MODULE_VARIANT_ROUTE, createPublicReadPreflight());
     app.get(CODE_MODULE_VARIANT_ROUTE, async (req, res) => {
         res.setHeader("Access-Control-Allow-Origin", "*");
         // RegExp routes surface capture groups as positional params.

package/dist/code-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"code-routes.d.ts","sourceRoot":"","sources":["../src/code-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,0BAA0B,CAAC;AAElC,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,wBAAwB,CAAC;CACnD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAqDxD"}
+{"version":3,"file":"code-routes.d.ts","sourceRoot":"","sources":["../src/code-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,0BAA0B,CAAC;AAGlC,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,wBAAwB,CAAC;CACnD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAuDxD"}

package/dist/code-routes.js

@@ -29,6 +29,7 @@
  */
 import { CODE_HASH_REGEX } from "@ggui-ai/mcp-server-core";
 import { mountCodeModuleVariantRoute, } from "./code-module-variant.js";
+import { createPublicReadPreflight } from "./browser-cors.js";
 /**
  * Mount `GET /code/:hash.js` + `GET /contract/:hash.js` (+ the
  * module-variant route when configured) onto the express app. Returns
@@ -45,6 +46,8 @@ export function mountCodeRoutes(opts) {
         });
     }
     const mountContentAddressableRoute = (mountPath, label) => {
+        // ggui#1231 — a public `*` read owns its preflight (null-origin frames).
+        app.options(mountPath, createPublicReadPreflight());
         app.get(mountPath, async (req, res) => {
             res.setHeader("Access-Control-Allow-Origin", "*");
             const hash = req.params["hash"];

package/dist/instructions-presets.js

@@ -45,7 +45,7 @@
  * matter when an operator wants the LLM to also reason about how the
  * underlying tools/call envelopes flow.
  */
-const ACTION_ROUTING_PARAGRAPH = "Action routing: every actionSpec entry is a GESTURE — a discrete event the agent reacts to on its next turn. When the user interacts, the iframe relays the action through `ggui_runtime_submit_action` to the server, which appends the event onto a per-render pipe. Your `ggui_consume` long-poll unblocks mid-turn with the event payload plus a uiContext snapshot of every declared contextSpec slot. There is no synchronous server-side tool-fire — `actions drive turns` is a structural invariant (docs/principles/actions-vs-context.md): an action always waits for the agent. Cross-MCP `nextStep` hints work the same way: the agent reads the event's `actionData.nextStep`, decides whether to honor it, and calls the named tool on the next turn (the tool MAY live on a different MCP server — declare it in `agentCapabilities.tools` so the cross-ref invariant passes).";
+const ACTION_ROUTING_PARAGRAPH = "Action routing: every actionSpec entry is a GESTURE — a discrete event the agent reacts to on its next turn. When the user interacts, the iframe relays the action through `ggui_runtime_submit_action` to the server, which appends the event onto a per-render pipe. Your `ggui_consume` long-poll unblocks mid-turn with the event payload plus a uiContext snapshot of every declared contextSpec slot. There is no synchronous server-side tool-fire — `actions drive turns` is a structural invariant (https://docs.ggui.ai/concepts/sessions-and-the-event-model/): an action always waits for the agent. Cross-MCP `nextStep` hints work the same way: the agent reads the event's `actionData.nextStep`, decides whether to honor it, and calls the named tool on the next turn (the tool MAY live on a different MCP server — declare it in `agentCapabilities.tools` so the cross-ref invariant passes).";
 /**
  * Worked invocation example. Layered atop the `aggressive` content by
  * `always` only — shows the literal handshake → render pattern an
@@ -72,7 +72,7 @@ const DEFAULT_PRESET_BODY = [
     '',
     '  • streamSpec   — agent → client (live updates). Live outbound channels for streaming data to the UI mid-render — chat tokens, progress events, log lines, time-series data. Each entry has a `schema` for the frame shape; you push frames via ggui_emit. e.g. a chat surface has `assistantMessage` on streamSpec for token-by-token output.',
     '',
-    'PLACEMENT RULE for actionSpec vs contextSpec: "does this thing need the agent\'s next-turn reasoning?" Yes → actionSpec. No → contextSpec. There is no third category (full rule: docs/principles/actions-vs-context.md).',
+    'PLACEMENT RULE for actionSpec vs contextSpec: "does this thing need the agent\'s next-turn reasoning?" Yes → actionSpec. No → contextSpec. There is no third category (full rule: https://docs.ggui.ai/concepts/sessions-and-the-event-model/).',
     '',
     '═══ LIFECYCLE ═══',
     '',

package/dist/llm-backed-negotiator.d.ts

@@ -48,7 +48,9 @@ import type { Blueprint } from "@ggui-ai/protocol";
  *
  * `callStructured` is wired for Anthropic only. Anthropic's
  * `/v1/messages` natively supports forced tool use via `tools[] +
- * tool_choice: {type:'tool', name}`, so we hit the API directly here
+ * tool_choice: {type:'tool', name}` — on the models that accept it; the
+ * always-thinking models refuse a forced tool (see
+ * `anthropicCallStructured`) — so we hit the API directly here
  * instead of expanding the `ProviderAdapter` interface for one
  * provider. Other providers (OpenAI, Google, OpenRouter, Bedrock)
  * omit `callStructured`; consumers detect absence and fall back to
@@ -63,6 +65,42 @@ import type { Blueprint } from "@ggui-ai/protocol";
  *     synthesizer)
  */
 export declare function buildLlmCaller(selection: LlmSelection, providerKey: ProviderKeyRef): LLMCaller;
+/**
+ * Thinking budget added to the caller's ANSWER budget when the model
+ * refuses a forced tool. Those are the always-thinking models: their
+ * thinking counts against `max_tokens` and comes before the tool call,
+ * so a caller's small answer budget (the rerank judge asks for 512)
+ * would be spent before the `tool_use` block exists. `max_tokens` is a
+ * ceiling, not spend.
+ */
+export declare const ALWAYS_THINKING_HEADROOM_TOKENS = 16000;
+/** How a structured call ended without the tool input it asked for. */
+export type AnthropicStructuredCallFailureKind = 
+/** The budget ran out (`stop_reason: max_tokens`) before the tool call. */
+"max_tokens"
+/** The model finished without calling the tool (possible under `auto`). */
+ | "no_tool_call"
+/** The model declined (`stop_reason: refusal`). */
+ | "refusal"
+/** The API answered non-2xx. */
+ | "http"
+/** The body was not a Messages response. */
+ | "malformed";
+/**
+ * A structured call that returned no tool input, NAMED by why. The kind
+ * is in the message too (`[max_tokens]` …), so a consumer that only
+ * surfaces the message — the rerank judge's `reason` — still reports
+ * which failure it was instead of an anonymous null decision.
+ */
+export declare class AnthropicStructuredCallError extends Error {
+    readonly kind: AnthropicStructuredCallFailureKind;
+    readonly status: number | undefined;
+    readonly stopReason: string | undefined;
+    constructor(kind: AnthropicStructuredCallFailureKind, detail: string, extra?: {
+        readonly status?: number;
+        readonly stopReason?: string;
+    });
+}
 /**
  * Dependencies for `createLlmBackedHandshakeNegotiator`. Only
  * `resolveLlm` is required; the rest carry default fallbacks.

package/dist/llm-backed-negotiator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"llm-backed-negotiator.d.ts","sourceRoot":"","sources":["../src/llm-backed-negotiator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EAEjB,YAAY,EACZ,cAAc,EACd,uBAAuB,EACvB,wBAAwB,EACxB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAEL,KAAK,aAAa,EAElB,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAInD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,GAAG,SAAS,CAmD9F;AA6ED;;;GAGG;AACH,MAAM,WAAW,gCAAgC;IAC/C;;;;;;OAMG;IACH,UAAU,EAAE,CACV,GAAG,EAAE,cAAc,KAEjB;QAAE,SAAS,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,cAAc,CAAA;KAAE,GACxD,OAAO,CAAC;QAAE,SAAS,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,cAAc,CAAA;KAAE,GAAG,IAAI,CAAC,GACxE,IAAI,CAAC;IACT;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE;QACN,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;QACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;QAClC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;KAChC,CAAC;IACF;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,2BAA2B,CAAC;IAClD;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,wBAAwB,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CAC/C;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,IAAI,CAAC,gCAAgC,EAAE,OAAO,GAAG,qBAAqB,GAAG,WAAW,CAAC,GAC1F,aAAa,EAAE,CAQjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,gCAAgC,GACrC,mBAAmB,CA6DrB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,m3DAoBgN,CAAC;AAqC7P;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,SAAS,SAAS,EAAE,EAChC,OAAO,EAAE,uBAAuB,GAC/B,MAAM,CA2CR;AA8CD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,OAAO,GAAG,wBAAwB,CAyBpF"}
+{"version":3,"file":"llm-backed-negotiator.d.ts","sourceRoot":"","sources":["../src/llm-backed-negotiator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EAEjB,YAAY,EACZ,cAAc,EACd,uBAAuB,EACvB,wBAAwB,EACxB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAEL,KAAK,aAAa,EAElB,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAInD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,GAAG,SAAS,CAmD9F;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,QAAS,CAAC;AAEtD,uEAAuE;AACvE,MAAM,MAAM,kCAAkC;AAC5C,2EAA2E;AACzE,YAAY;AACd,2EAA2E;GACzE,cAAc;AAChB,mDAAmD;GACjD,SAAS;AACX,gCAAgC;GAC9B,MAAM;AACR,4CAA4C;GAC1C,WAAW,CAAC;AAEhB;;;;;GAKG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,IAAI,EAAE,kCAAkC,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;gBAEtC,IAAI,EAAE,kCAAkC,EACxC,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO;CAQzE;AA8GD;;;GAGG;AACH,MAAM,WAAW,gCAAgC;IAC/C;;;;;;OAMG;IACH,UAAU,EAAE,CACV,GAAG,EAAE,cAAc,KAEjB;QAAE,SAAS,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,cAAc,CAAA;KAAE,GACxD,OAAO,CAAC;QAAE,SAAS,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,cAAc,CAAA;KAAE,GAAG,IAAI,CAAC,GACxE,IAAI,CAAC;IACT;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE;QACN,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;QACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;QAClC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;KAChC,CAAC;IACF;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,2BAA2B,CAAC;IAClD;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,wBAAwB,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CAC/C;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,IAAI,CAAC,gCAAgC,EAAE,OAAO,GAAG,qBAAqB,GAAG,WAAW,CAAC,GAC1F,aAAa,EAAE,CAQjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,gCAAgC,GACrC,mBAAmB,CA6DrB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,m3DAoBgN,CAAC;AAqC7P;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,SAAS,SAAS,EAAE,EAChC,OAAO,EAAE,uBAAuB,GAC/B,MAAM,CA2CR;AA8CD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,OAAO,GAAG,wBAAwB,CAyBpF"}

package/dist/llm-backed-negotiator.js

@@ -36,7 +36,7 @@
  * `resolveLlm` is wired into `generation`.
  */
 import { decideHandshake, } from "@ggui-ai/mcp-server-handlers/renders";
-import { isRecord } from "@ggui-ai/protocol";
+import { anthropicRejectsForcedToolChoice, isRecord } from "@ggui-ai/protocol";
 import { selectAdapter } from "@ggui-ai/ui-gen/providers";
 /**
  * Wrap a resolved BYOK credential pair into an `LLMCaller` the
@@ -46,7 +46,9 @@ import { selectAdapter } from "@ggui-ai/ui-gen/providers";
  *
  * `callStructured` is wired for Anthropic only. Anthropic's
  * `/v1/messages` natively supports forced tool use via `tools[] +
- * tool_choice: {type:'tool', name}`, so we hit the API directly here
+ * tool_choice: {type:'tool', name}` — on the models that accept it; the
+ * always-thinking models refuse a forced tool (see
+ * `anthropicCallStructured`) — so we hit the API directly here
  * instead of expanding the `ProviderAdapter` interface for one
  * provider. Other providers (OpenAI, Google, OpenRouter, Bedrock)
  * omit `callStructured`; consumers detect absence and fall back to
@@ -105,25 +107,73 @@ export function buildLlmCaller(selection, providerKey) {
     }
     return caller;
 }
-/** Anthropic-direct tool-use call. Forces a single tool invocation
- *  and returns the tool's `input` JSON. Throws on non-2xx, network
- *  errors, or response-shape failures so the caller (rerank judge,
- *  synthesizer) can collapse to its null-decision fallback. */
+/**
+ * Thinking budget added to the caller's ANSWER budget when the model
+ * refuses a forced tool. Those are the always-thinking models: their
+ * thinking counts against `max_tokens` and comes before the tool call,
+ * so a caller's small answer budget (the rerank judge asks for 512)
+ * would be spent before the `tool_use` block exists. `max_tokens` is a
+ * ceiling, not spend.
+ */
+export const ALWAYS_THINKING_HEADROOM_TOKENS = 16_000;
+/**
+ * A structured call that returned no tool input, NAMED by why. The kind
+ * is in the message too (`[max_tokens]` …), so a consumer that only
+ * surfaces the message — the rerank judge's `reason` — still reports
+ * which failure it was instead of an anonymous null decision.
+ */
+export class AnthropicStructuredCallError extends Error {
+    kind;
+    status;
+    stopReason;
+    constructor(kind, detail, extra = {}) {
+        super(`anthropic structured call [${kind}]: ${detail}`);
+        this.name = "AnthropicStructuredCallError";
+        this.kind = kind;
+        this.status = extra.status;
+        this.stopReason = extra.stopReason;
+    }
+}
+/**
+ * Anthropic-direct tool-use call; returns the tool's `input` JSON.
+ *
+ * Two request shapes, chosen by the shared model-rule predicate
+ * (`anthropicRejectsForcedToolChoice`, the same list the harness router
+ * reads — one list, so a model the API starts refusing is added once):
+ *
+ *   - Models that accept a forced tool: `tool_choice: {type: 'tool'}`
+ *     and the caller's `max_tokens`, as before.
+ *   - Models that refuse it (the always-thinking family): a forced tool
+ *     is an HTTP 400 on every call, so they get `tool_choice: auto` with
+ *     at most one call, an instruction naming the tool appended to the
+ *     system prompt, and `ALWAYS_THINKING_HEADROOM_TOKENS` added to the
+ *     caller's budget. `strict: true` is deliberately NOT sent: the two
+ *     consumers' schemas carry keywords strict tool use rejects (the
+ *     rerank judge's `minimum`/`maximum`, the synthesizer's map-shaped
+ *     `additionalProperties`), so it would trade one 400 for another;
+ *     both consumers already validate the input they get back.
+ *
+ * Every way the turn ends without the tool input throws an
+ * `AnthropicStructuredCallError` whose kind says which — the caller
+ * (rerank judge, synthesizer) collapses it to its null-decision
+ * fallback, and the kind rides along in the reason.
+ */
 async function anthropicCallStructured(args) {
+    const answerBudget = args.maxTokens ?? 1024;
+    const refusesForcedTool = anthropicRejectsForcedToolChoice(args.model);
     const body = {
         model: args.model,
-        max_tokens: args.maxTokens ?? 1024,
+        max_tokens: refusesForcedTool ? answerBudget + ALWAYS_THINKING_HEADROOM_TOKENS : answerBudget,
         // `temperature` was pinned to 0 for deterministic structured
         // output, but Anthropic deprecated the parameter on newer
         // tool-use models (Haiku 4.5+ rejects it with HTTP 400). Dropped.
-        // `tool_choice: { type: 'tool', name }` below already binds the
-        // output shape to the declared input_schema — the model can't
-        // emit a free-form text response when forced-tool is set.
         // Residual stochasticity is in field VALUES (e.g. action names);
         // both consumers (synthesizer + rerank judge) MUST tolerate
         // paraphrase via canonical-key normalisation rather than relying
         // on temperature=0.
-        system: args.systemPrompt,
+        system: refusesForcedTool
+            ? `${args.systemPrompt}\n\nAnswer by calling the \`${args.tool.name}\` tool exactly once. Do not answer in text.`
+            : args.systemPrompt,
         messages: [{ role: "user", content: args.userMessage }],
         tools: [
             {
@@ -132,10 +182,12 @@ async function anthropicCallStructured(args) {
                 input_schema: args.tool.input_schema,
             },
         ],
-        // Forced tool use — model MUST emit exactly this tool. Without
-        // this the model can drift to a text reply and synth/rerank
-        // both lose their structured guarantee.
-        tool_choice: { type: "tool", name: args.tool.name },
+        // Forced tool use where the model allows it — the model MUST emit
+        // exactly this tool. Where it doesn't, `auto` + one call + the
+        // instruction above, and a missing call is a named failure below.
+        tool_choice: refusesForcedTool
+            ? { type: "auto", disable_parallel_tool_use: true }
+            : { type: "tool", name: args.tool.name },
     };
     const response = await fetch("https://api.anthropic.com/v1/messages", {
         method: "POST",
@@ -148,17 +200,25 @@ async function anthropicCallStructured(args) {
     });
     if (!response.ok) {
         const text = await response.text().catch(() => "");
-        throw new Error(`anthropic tool-use HTTP ${response.status}: ${text.slice(0, 500)}`);
+        throw new AnthropicStructuredCallError("http", `HTTP ${response.status}: ${text.slice(0, 500)}`, {
+            status: response.status,
+        });
+    }
+    const json = await response.json();
+    if (!isRecord(json) || !Array.isArray(json["content"])) {
+        throw new AnthropicStructuredCallError("malformed", "response body is not a Messages response");
+    }
+    const stopReason = typeof json["stop_reason"] === "string" ? json["stop_reason"] : undefined;
+    const toolUse = json["content"].find((block) => isRecord(block) && block["type"] === "tool_use" && block["name"] === args.tool.name);
+    if (toolUse !== undefined && toolUse["input"] !== undefined)
+        return toolUse["input"];
+    if (stopReason === "max_tokens") {
+        throw new AnthropicStructuredCallError("max_tokens", `stop_reason=max_tokens before the "${args.tool.name}" tool_use block (max_tokens=${body.max_tokens})`, { stopReason });
     }
-    const json = (await response.json());
-    // Find the tool_use block. With `tool_choice: {type:'tool'}` the
-    // model is forced to emit exactly one; defensively scan in case the
-    // shape ever shifts.
-    const toolUse = json.content?.find((block) => block.type === "tool_use" && block.name === args.tool.name);
-    if (!toolUse || toolUse.input === undefined) {
-        throw new Error(`anthropic tool-use response missing tool_use block for "${args.tool.name}"`);
+    if (stopReason === "refusal") {
+        throw new AnthropicStructuredCallError("refusal", `the model declined (stop_reason=refusal)`, { stopReason });
     }
-    return toolUse.input;
+    throw new AnthropicStructuredCallError("no_tool_call", `the turn ended (stop_reason=${stopReason ?? "absent"}) without a "${args.tool.name}" tool_use block`, stopReason !== undefined ? { stopReason } : {});
 }
 /**
  * Build the handshake pool list: the per-app pool (from `cache`) first —

package/dist/oauth.d.ts

@@ -282,13 +282,14 @@ export declare function handleProtectedResourceMetadata(req: Request, res: Respo
  * describing this auth server's capabilities + endpoints.
  */
 export declare function handleAuthorizationServerMetadata(req: Request, res: Response, config: OAuthConfig): void;
-/**
- * `POST /oauth/register` — RFC 7591 Dynamic Client Registration. Issues
- * a random `client_id`. No `client_secret` (PKCE-only). Accepts arbitrary
- * `redirect_uris` from the client without validation against an allowlist
- * — the trade-off matches the MCP spec's pragmatism: any client willing
- * to do PKCE + paste-key gets registered.
- */
+type RedirectUriVerdict = {
+    readonly ok: readonly string[];
+} | {
+    readonly error: 'invalid_redirect_uri' | 'invalid_client_metadata';
+    readonly description: string;
+};
+/** Every rule the door applies to `redirect_uris`; refuses the WHOLE list on the first bad entry. */
+export declare function validateRedirectUris(raw: unknown): RedirectUriVerdict;
 export declare function handleRegister(req: Request, res: Response, config: OAuthConfig, storage: OAuthStorage): Promise<void>;
 /**
  * `GET /oauth/authorize` — render the paste-key form. Query params
@@ -320,7 +321,8 @@ export declare function handleAuthorizeGet(req: Request, res: Response, config:
  *      `lookupUser` binding.
  *   3. On success: write {code, accessToken=key, codeChallenge,
  *      redirectUri, clientId} to storage. 5-minute TTL.
- *   4. Redirect to `redirect_uri?code=<code>&state=<state>`.
+ *   4. Redirect to `redirect_uri?code=<code>&state=<state>&iss=<issuer>`
+ *      (RFC 9207; `issuer` byte-identical to the metadata's, ggui#1270).
  *   5. On bad key: re-render the page with an error message (preserves
  *      OAuth params).
  */
@@ -345,4 +347,5 @@ export declare function handleAuthorizePost(req: Request, res: Response, config:
  * 400 status code.
  */
 export declare function handleToken(req: Request, res: Response, storage: OAuthStorage): Promise<void>;
+export {};
 //# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAO5E,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAEhC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3E;AAMD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0BAA0B;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,wDAAwD;IACxD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC1D;;;;;OAKG;IACH,WAAW,IAAI,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;IAChD;;;;;OAKG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAErD,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAYlD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAQ7D,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIzD,WAAW,IAAI,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC;IAU/C,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMpD;AAMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAK1E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,YAAY,GAAE,MAAW,GACxB,MAAM,CAWR;AAuCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,MAAe,GACvB,IAAI,CASN;AAED;;;GAGG;AACH,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,GAClB,IAAI,CAaN;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CAwCf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,WAAW,EACjB,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,GACrC,OAAO,CAAC,IAAI,CAAC,CAmHf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CAiFf"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAO5E,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAEhC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3E;AAMD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0BAA0B;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,wDAAwD;IACxD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC1D;;;;;OAKG;IACH,WAAW,IAAI,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;IAChD;;;;;OAKG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAErD,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAYlD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAQ7D,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIzD,WAAW,IAAI,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC;IAU/C,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMpD;AAMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAK1E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,YAAY,GAAE,MAAW,GACxB,MAAM,CAWR;AA6CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,MAAe,GACvB,IAAI,CASN;AAED;;;GAGG;AACH,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,GAClB,IAAI,CAoBN;AAkDD,KAAK,kBAAkB,GACnB;IAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,KAAK,EAAE,sBAAsB,GAAG,yBAAyB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAuBzG,qGAAqG;AACrG,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAsBrE;AACD,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CA8Cf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CAkCf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,WAAW,EACjB,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,GACrC,OAAO,CAAC,IAAI,CAAC,CAwHf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CAiFf"}

package/dist/oauth.js

@@ -60,7 +60,7 @@
  * once per install + caches the `client_id`. A server restart drops all
  * registrations; clients re-register transparently on next failure.
  */
-import { createHash, randomBytes } from 'node:crypto';
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import { isRecord } from '@ggui-ai/protocol';
 import { resolveIdentityFromHeaders, UnauthenticatedError } from './auth.js';
 export class InMemoryOAuthStorage {
@@ -181,8 +181,15 @@ function sha256Base64Url(input) {
     return createHash('sha256').update(input).digest('base64url');
 }
 function verifyPkce(verifier, challenge) {
-    const computed = sha256Base64Url(verifier);
-    return computed === challenge;
+    // Constant-time compare (ggui#1174). Both sides are base64url SHA-256
+    // digests when honest (43 chars); a length mismatch is refused before
+    // the compare because `timingSafeEqual` throws on unequal lengths, and
+    // the length of a digest is public anyway.
+    const computed = Buffer.from(sha256Base64Url(verifier));
+    const presented = Buffer.from(challenge);
+    if (computed.length !== presented.length)
+        return false;
+    return timingSafeEqual(computed, presented);
 }
 // =============================================================================
 // Route handlers
@@ -226,35 +233,138 @@ export function handleAuthorizationServerMetadata(req, res, config) {
         code_challenge_methods_supported: ['S256'],
         token_endpoint_auth_methods_supported: ['none'], // PKCE-only, no client_secret
         scopes_supported: ['mcp'],
+        // RFC 9207 / ggui#1270: every authorization response this AS sends
+        // carries `iss`. Advertising it obliges EVERY path that redirects to a
+        // client's redirect_uri — including an operator's `consentUrl` page on
+        // its own error redirect — to carry `iss` too (the 302 hands that page
+        // the value as `mcp_origin`); a conforming client rejects a response
+        // without it once this is true.
+        authorization_response_iss_parameter_supported: true,
     });
 }
 /**
  * `POST /oauth/register` — RFC 7591 Dynamic Client Registration. Issues
- * a random `client_id`. No `client_secret` (PKCE-only). Accepts arbitrary
- * `redirect_uris` from the client without validation against an allowlist
- * — the trade-off matches the MCP spec's pragmatism: any client willing
- * to do PKCE + paste-key gets registered.
+ * a random `client_id`. No `client_secret` (PKCE-only). Registration is
+ * OPEN — there is no allowlist of redirect URIs. The MCP authorization
+ * spec's current revision (2026-07-28) permits DCR as a deprecated
+ * fallback ("MAY … retained for backwards compatibility") and recommends
+ * Client ID Metadata Documents (SHOULD), which this server does not
+ * support yet (ggui#1269); a client falls back to DCR when the metadata
+ * advertises no `client_id_metadata_document_supported`, so today every
+ * host registers here, before its user has ever seen this server. What
+ * keeps an open door
+ * from being an open redirect (ggui#1174) is not the door but the
+ * controls around it, each of them pinned in `oauth-dcr.test.ts`:
+ *
+ *   - `redirect_uris` are SHAPE-checked here ({@link validateRedirectUris}):
+ *     absolute; no fragment; `https`, or `http` on a loopback host
+ *     (RFC 8252 §7.3), or a private-use scheme (RFC 8252 §7.1 — the
+ *     shape desktop MCP hosts register) that a browser cannot execute;
+ *     no wildcard host; at most {@link MAX_REDIRECT_URIS}; one bad entry
+ *     refuses the whole registration (`invalid_redirect_uri`).
+ *   - `client_name` is bounded and printable (`invalid_client_metadata`)
+ *     because the consent page prints it.
+ *   - `/oauth/authorize` accepts only a redirect URI the client registered,
+ *     by exact string match, and only PKCE `S256`.
+ *   - `/oauth/token` binds the code to (client, redirect URI, challenge),
+ *     single-use, 5-minute TTL, constant-time verifier check.
+ *   - The consent page names the client and the redirect host BEFORE it
+ *     asks for a key, so the user is the last control and an informed one.
+ *   - The mount carries a per-IP limit (10 registrations / 10 min, ggui#1193;
+ *     `server.ts`, the `/pair` middleware with its own quota), pinned in
+ *     `oauth-register-rate-limit.test.ts` — an open door is bounded, not shut.
  */
+const MAX_REDIRECT_URIS = 10;
+const MAX_REDIRECT_URI_LENGTH = 2048;
+const MAX_CLIENT_NAME_LENGTH = 100;
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', '[::1]', 'localhost']);
+/** Schemes a browser will EXECUTE rather than navigate to — never a redirect target. */
+const EXECUTABLE_SCHEMES = new Set([
+    'javascript:',
+    'data:',
+    'blob:',
+    'file:',
+    'about:',
+    'vbscript:',
+]);
+// eslint-disable-next-line no-control-regex -- the point is to find control characters
+const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+/** The one reason a URI is refused, or `undefined` when it is a redirect target. */
+function redirectUriProblem(uri) {
+    if (uri.length > MAX_REDIRECT_URI_LENGTH)
+        return 'longer than 2048 characters';
+    if (uri.includes('#'))
+        return 'carries a fragment';
+    let url;
+    try {
+        url = new URL(uri);
+    }
+    catch {
+        return 'is not an absolute URL';
+    }
+    if (url.hostname.includes('*'))
+        return 'names a wildcard host';
+    if (url.protocol === 'https:')
+        return undefined;
+    if (url.protocol === 'http:') {
+        return LOOPBACK_HOSTS.has(url.hostname)
+            ? undefined
+            : 'uses `http` on a non-loopback host (only 127.0.0.1, [::1] and localhost may be plain http)';
+    }
+    if (EXECUTABLE_SCHEMES.has(url.protocol))
+        return `uses the \`${url.protocol}\` scheme`;
+    return undefined;
+}
+/** Every rule the door applies to `redirect_uris`; refuses the WHOLE list on the first bad entry. */
+export function validateRedirectUris(raw) {
+    if (!Array.isArray(raw) || raw.length === 0) {
+        return { error: 'invalid_redirect_uri', description: '`redirect_uris` array is required' };
+    }
+    if (raw.length > MAX_REDIRECT_URIS) {
+        return {
+            error: 'invalid_client_metadata',
+            description: `\`redirect_uris\` carries ${raw.length} entries; at most ${MAX_REDIRECT_URIS} are accepted`,
+        };
+    }
+    const out = [];
+    for (const entry of raw) {
+        if (typeof entry !== 'string' || entry.length === 0) {
+            return { error: 'invalid_redirect_uri', description: 'every `redirect_uris` entry must be a non-empty string' };
+        }
+        const problem = redirectUriProblem(entry);
+        if (problem !== undefined) {
+            return { error: 'invalid_redirect_uri', description: `redirect URI ${problem}: ${entry.slice(0, 200)}` };
+        }
+        out.push(entry);
+    }
+    return { ok: out };
+}
 export async function handleRegister(req, res, config, storage) {
     const body = isRecord(req.body) ? req.body : {};
-    const redirectUrisRaw = body['redirect_uris'];
-    if (!Array.isArray(redirectUrisRaw) || redirectUrisRaw.length === 0) {
+    const verdict = validateRedirectUris(body['redirect_uris']);
+    if ('error' in verdict) {
+        res.status(400).json({ error: verdict.error, error_description: verdict.description });
+        return;
+    }
+    const redirectUris = verdict.ok;
+    const clientNameRaw = body['client_name'];
+    if (clientNameRaw !== undefined && typeof clientNameRaw !== 'string') {
         res.status(400).json({
-            error: 'invalid_redirect_uri',
-            error_description: '`redirect_uris` array is required',
+            error: 'invalid_client_metadata',
+            error_description: '`client_name` must be a string when present',
         });
         return;
     }
-    const redirectUris = redirectUrisRaw.filter((u) => typeof u === 'string' && u.length > 0);
-    if (redirectUris.length === 0) {
+    if (typeof clientNameRaw === 'string' &&
+        (clientNameRaw.length > MAX_CLIENT_NAME_LENGTH || CONTROL_CHARS.test(clientNameRaw))) {
         res.status(400).json({
-            error: 'invalid_redirect_uri',
-            error_description: '`redirect_uris` must contain at least one non-empty string',
+            error: 'invalid_client_metadata',
+            error_description: `\`client_name\` must be at most ${MAX_CLIENT_NAME_LENGTH} printable characters`,
         });
         return;
     }
+    const clientName = clientNameRaw;
     const clientId = `mcp_client_${randomBytes(16).toString('base64url')}`;
-    const clientName = typeof body['client_name'] === 'string' ? body['client_name'] : undefined;
     await storage.putClient({
         clientId,
         redirectUris,
@@ -305,12 +415,19 @@ export async function handleAuthorizeGet(req, res, config, storage) {
                 target.searchParams.set(k, val);
         }
         target.searchParams.set('mcp_origin', resolveIssuerUrl(req, config.issuerUrl));
+        // ggui#1174 — the hosted consent page names the client too. `client_name`
+        // is DISPLAY-ONLY and self-asserted at DCR (a stranger chose it); the
+        // honest signal on any consent page is `redirect_uri`, which the server
+        // binds by exact match to what that client registered.
+        if (v.client.clientName !== undefined) {
+            target.searchParams.set('client_name', v.client.clientName);
+        }
         res.redirect(302, target.toString());
         return;
     }
     // Forward all params back to the form so POST handler has them.
     // Includes `code_challenge`, `state`, etc.
-    res.type('html').send(renderAuthorizePage(params));
+    res.type('html').send(renderAuthorizePage(params, v.client));
 }
 /**
  * `POST /oauth/authorize` — handle paste-key form submission. Validates
@@ -326,7 +443,8 @@ export async function handleAuthorizeGet(req, res, config, storage) {
  *      `lookupUser` binding.
  *   3. On success: write {code, accessToken=key, codeChallenge,
  *      redirectUri, clientId} to storage. 5-minute TTL.
- *   4. Redirect to `redirect_uri?code=<code>&state=<state>`.
+ *   4. Redirect to `redirect_uri?code=<code>&state=<state>&iss=<issuer>`
+ *      (RFC 9207; `issuer` byte-identical to the metadata's, ggui#1270).
  *   5. On bad key: re-render the page with an error message (preserves
  *      OAuth params).
  */
@@ -357,7 +475,7 @@ export async function handleAuthorizePost(req, res, config, storage, auth, pairi
             res
                 .status(401)
                 .type('html')
-                .send(renderAuthorizePage(params, 'Pair code expired or invalid — restart the server for a fresh code.'));
+                .send(renderAuthorizePage(params, validation.client, 'Pair code expired or invalid — restart the server for a fresh code.'));
             return;
         }
     }
@@ -365,7 +483,7 @@ export async function handleAuthorizePost(req, res, config, storage, auth, pairi
         apiKey = pastedKey;
     }
     else {
-        res.status(400).type('html').send(renderAuthorizePage(params, 'Pair code or API key required'));
+        res.status(400).type('html').send(renderAuthorizePage(params, validation.client, 'Pair code or API key required'));
         return;
     }
     // Validate the key by running the adapter's auth path. Using the
@@ -382,7 +500,7 @@ export async function handleAuthorizePost(req, res, config, storage, auth, pairi
             res
                 .status(401)
                 .type('html')
-                .send(renderAuthorizePage(params, 'Invalid API key — try again.'));
+                .send(renderAuthorizePage(params, validation.client, 'Invalid API key — try again.'));
             return;
         }
         throw err;
@@ -431,13 +549,18 @@ export async function handleAuthorizePost(req, res, config, storage, auth, pairi
         // snapshot fails. The user gets their token; UI display is the
         // only thing that lags.
     }
-    // Build redirect URL — preserve the client's `state`.
+    // Build redirect URL — preserve the client's `state`, and name the
+    // issuer (RFC 9207, ggui#1270): the SAME `resolveIssuerUrl` value the
+    // metadata publishes as `issuer`, because a client compares the two
+    // by simple string comparison with no normalization. The mix-up
+    // defence: a code only goes to the token endpoint of the AS whose
+    // metadata the client recorded.
     const redirectUrl = new URL(params['redirect_uri']);
     redirectUrl.searchParams.set('code', code);
     if (params['state'])
         redirectUrl.searchParams.set('state', params['state']);
+    redirectUrl.searchParams.set('iss', resolveIssuerUrl(req, config.issuerUrl));
     res.redirect(302, redirectUrl.toString());
-    void config; // Reserved for future per-issuer overrides.
 }
 /**
  * `POST /oauth/token` — exchange auth code for access token. RFC 6749
@@ -570,7 +693,7 @@ async function validateAuthorizeParams(params, storage, config, issuer) {
             }
         }
     }
-    return { valid: true };
+    return { valid: true, client };
 }
 // =============================================================================
 // HTML rendering
@@ -667,7 +790,35 @@ ${bodyHtml}
 </body>
 </html>`;
 }
-function renderAuthorizePage(params, errorMessage) {
+/**
+ * What the consent page prints as the redirect target: `scheme://host` when
+ * the URI has a host (`https://client.example`, `claudedesktop://callback` —
+ * the same form the hosted consent page prints, so both doors show the same
+ * two facts identically), else the bare scheme. Never the path or query: the
+ * host is the signal the server binds by exact match; the rest is the
+ * client's own text.
+ */
+function describeRedirectTarget(uri) {
+    if (!uri)
+        return 'an unknown destination';
+    try {
+        const url = new URL(uri);
+        return url.host.length > 0 ? `${url.protocol}//${url.host}` : `a \`${url.protocol}\` app`;
+    }
+    catch {
+        return 'an unknown destination';
+    }
+}
+function renderAuthorizePage(params, client, errorMessage) {
+    // ggui#1174 — the user is the last control on an OPEN registration
+    // door, so the page says WHO registered (the DCR client_name, which a
+    // stranger chose — escaped, never trusted) and WHERE the code will be
+    // sent, before it asks for a key.
+    const who = client.clientName
+        ? `<strong>${escapeHtml(client.clientName)}</strong> <span class="ggui-code">${escapeHtml(client.clientId)}</span>`
+        : `an unnamed client <span class="ggui-code">${escapeHtml(client.clientId)}</span>`;
+    const whereTo = escapeHtml(describeRedirectTarget(params['redirect_uri']));
+    const requester = `<p class="ggui-muted">${who} is asking to connect. If you authorize, a one-time code is sent to <strong>${whereTo}</strong>. If you do not recognise either, close this page.</p>`;
     // Forward every OAuth param as a hidden input so the POST handler
     // sees the same shape as /GET — no client-side state stash needed.
     const hiddenFields = [
@@ -691,6 +842,7 @@ function renderAuthorizePage(params, errorMessage) {
         : '';
     const body = `<div class="ggui-card"><form method="POST" action="/oauth/authorize" class="ggui-stack">
 ${errorCallout}
+${requester}
 <label for="pair_code" class="ggui-label">Pair code</label>
 <div class="ggui-field"><input type="text" id="pair_code" name="pair_code" placeholder="000000" inputmode="numeric" autocomplete="off" autofocus pattern="[0-9]{6}" maxlength="6"></div>
 <p class="ggui-muted">The 6-digit code printed on your terminal when you ran <span class="ggui-code">ggui serve</span>. One-shot — restart the server for a fresh code.</p>

package/dist/rate-limit-middleware.d.ts

@@ -13,6 +13,13 @@
  *   - Per-IP source: `X-Forwarded-For` (first non-empty hop) when
  *     `trustProxy=true`, else `req.socket.remoteAddress`. Falls back to
  *     `'unknown'` and treats every unidentified peer as a single bucket.
+ *     THE OPERATOR'S OBLIGATION behind `trustProxy=true`: the proxy in
+ *     front MUST OVERWRITE `X-Forwarded-For` from the connection it
+ *     accepted (ingress-nginx: `use-forwarded-headers: "false"`), never
+ *     append to a header the client sent — with an appending proxy the
+ *     first hop is whatever the caller wrote, so the caller picks its own
+ *     bucket per request and the limit binds only the honest. A limiter
+ *     whose key the limited party controls is not a limiter (ggui#1193).
  *   - On denial: 429 + `Retry-After` (seconds, ceiling) + JSON
  *     `{error: {code: 'rate_limited', message, retryAfter}}`.
  *   - On limiter throw: log + `next()` (fail-open). A limiter outage MUST
@@ -27,7 +34,11 @@ export interface PairLoginRateLimitOptions {
     readonly logger: Logger;
     /** Tag prefix on the bucket key. */
     readonly quotaKey: string;
-    /** When true, prefer the first `X-Forwarded-For` hop. Default false. */
+    /**
+     * When true, prefer the first `X-Forwarded-For` hop. Default false. Set
+     * it ONLY behind a proxy that overwrites the header (see the module
+     * docblock): behind one that appends, the bucket key is caller-chosen.
+     */
     readonly trustProxy?: boolean;
 }
 /** Extracted so tests can target the IP-resolution path directly if needed. */

package/dist/rate-limit-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit-middleware.d.ts","sourceRoot":"","sources":["../src/rate-limit-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAC7B,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC,EACxC,UAAU,EAAE,OAAO,GAClB,MAAM,CAaR;AAED,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,yBAAyB,GAC9B,cAAc,CA2ChB"}
+{"version":3,"file":"rate-limit-middleware.d.ts","sourceRoot":"","sources":["../src/rate-limit-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAC7B,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC,EACxC,UAAU,EAAE,OAAO,GAClB,MAAM,CAaR;AAED,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,yBAAyB,GAC9B,cAAc,CA2ChB"}

package/dist/runtime-bundle-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-bundle-route.d.ts","sourceRoot":"","sources":["../src/runtime-bundle-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sDAAsD;IACtD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAiEhE"}
+{"version":3,"file":"runtime-bundle-route.d.ts","sourceRoot":"","sources":["../src/runtime-bundle-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sDAAsD;IACtD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAwEhE"}

package/dist/runtime-bundle-route.js

@@ -22,6 +22,7 @@
  * avoids.
  */
 import { existsSync } from "node:fs";
+import { createPublicReadPreflight } from "./browser-cors.js";
 /**
  * Mount `GET <runtimePath>` onto the express app. Returns nothing —
  * the route self-registers. When the bundle file is missing on disk
@@ -32,8 +33,15 @@ export function mountRuntimeBundleRoute(opts) {
     // Content-hashed long-cache route (#472) — registered ahead of the
     // plain path so the two never shadow each other regardless of how a
     // custom `runtimePath` glob might overlap.
+    // ggui#1231 — the bundle is a public `*` read; its PREFLIGHT must say
+    // so too, or a sandboxed (`null`-origin) frame that preflights the
+    // fetch fails while the plain GET works. Registered for every mount
+    // path, the 503 "not built" branch included.
+    const preflight = createPublicReadPreflight();
+    app.options(runtimePath, preflight);
     if (opts.hashed !== undefined) {
         const { path: hashedPath, source } = opts.hashed;
+        app.options(hashedPath, preflight);
         app.get(hashedPath, (_req, res) => {
             res.setHeader("Content-Type", "application/javascript; charset=utf-8");
             // Immutable: the path names these exact bytes (see MountOptions

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AASH,OAAO,KAAK,EACV,gBAAgB,EAChB,SAAS,EACT,WAAW,EACX,UAAU,EACV,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,aAAa,EACb,WAAW,EACX,WAAW,EACZ,MAAM,0BAA0B,CAAC;AA8BlC,OAAO,KAAK,EACV,qBAAqB,EACrB,cAAc,EACd,aAAa,EACd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAUL,KAAK,8BAA8B,EACpC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAML,KAAK,yBAAyB,EAC/B,MAAM,4CAA4C,CAAC;AAKpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,KAAK,EAAE,0BAA0B,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE5F,OAAO,KAAK,EAAE,SAAS,EAAwB,MAAM,mBAAmB,CAAC;AAIzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAgB,EAAE,KAAK,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAI9D,OAAO,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,KAAK,CAAC;AAKvC,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,WAAW,EACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,KAAK,sBAAsB,EAC5B,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EAOL,KAAK,UAAU,EACf,KAAK,oBAAoB,EAC1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAA0C,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1G,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAQL,KAAK,gBAAgB,EACrB,KAAK,UAAU,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAkBL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAOvD,OAAO,KAAK,EAAyB,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AA6BlE,OAAO,EAAyB,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAChG,OAAO,EAA0B,KAAK,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAE9F,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AAQ/D,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,UAAU,EAChB,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EAAwB,KAAK,WAAW,EAAqB,MAAM,YAAY,CAAC;AAOvF,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,2BAA2B,CAAC;AAOnC,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAC;AAG/B;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,EAAE,UAK1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CACpB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC1E;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;QACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;QAClC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;KAChC,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CACzD,CAAC;AA2FF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;CACpC,GAAG,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CA+DzD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B;;;;;;;;;OASG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC;IACzD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE;QACnB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAChC;;;;;;;WAOG;QACH,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;QACxC;;;;;WAKG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;QAC1C;;;;;;WAMG;QACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;QAC7C;;;;;;WAMG;QACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,OAAO,mBAAmB,EAAE,kBAAkB,GAAG,SAAS,CAAC;KAChG,CAAC;IACF,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACvC;;;;WAIG;QACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B;;;;;;;;WAQG;QACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QACxE;;;;;WAKG;QACH,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;QACpE;;;;;;WAMG;QACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QACzD;;;;;;;;;;;;;;WAcG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;QAC1D;;;;;;;;WAQG;QACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;QACjE;;;;;WAKG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,6DAA6D;QAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;QACtC;;;;;;;;WAQG;QACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;YACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;SAClC,GACD,SAAS,CAAC;QACd,mEAAmE;QACnE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5C;;;;;;;WAOG;QACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;QACnC;;;;;;;WAOG;QACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;QACzC;;;;;;;WAOG;QACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;QACnD;;;;;;;;;;WAUG;QACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;QAErD;;;;;;;;;;;WAWG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;QAErC;;;;;;;;;;;WAWG;QACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;QAE3C;;;;;;;;;;;;;WAaG;QACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE;YACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,mBAAmB,EAAE,UAAU,CAAC;YAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,mBAAmB,EAAE,UAAU,CAAC;SAC9D,KAAK,IAAI,CAAC;QAEX;;;;;;;;;;;;;;;;;WAiBG;QACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;QAE/B;;;;;WAKG;QACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B;;;;;;;WAOG;QACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;YAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;SACvB,KAAK,MAAM,GAAG,SAAS,CAAC;QACzB;;;;;;;;;;;;;WAaG;QACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;QACzE;;;;;;;;;;;;;;;;;;WAkBG;QACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,sCAAsC,EAAE,kBAAkB,CAAC;KAC/F,CAAC;IACF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACvC;;;;WAIG;QACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;QACnD;;;;;;WAMG;QACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;QACnD;;;;;;;;WAQG;QACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QACzD;;qEAE6D;QAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;QAC1D;8DACsD;QACtD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;QACjE,+EAA+E;QAC/E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,kFAAkF;QAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;QACtC,yEAAyE;QACzE,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;YACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;SAClC,GACD,SAAS,CAAC;QACd,mEAAmE;QACnE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC7C,CAAC;IACF;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;QACrD,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAC3C,CAAC;IACF;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,wBAAwB,GAAG,IAAI,CAAC;KAClE,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,SAAS,iBAAiB,EAAE,CAAC;IACrD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;CAC5C,GAAG,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAygBzD;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QAC1B,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;KAC/C,CAAC;IACF,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;KACpC,CAAC;IACF,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC1B,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;KAC7C,CAAC;IACF,QAAQ,CAAC,SAAS,CAAC,EAAE;QACnB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;KACtC,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;CACpC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa,GAClB,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAuDxD;AAED,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAEpC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAE/B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAE3E;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IAElE;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAE/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAEhC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAEvC;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC;IAEzD;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAE7C;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAE7D;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,SAAS,iBAAiB,EAAE,CAAC;IAErD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAE/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,GAAG;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAErE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IAEjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAEnE;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAE7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IAEnC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAE/C;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;QACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GACD,SAAS,CAAC;IAEd;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE3C;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAEpD;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,KAAK,IAAI,CAAC;IAElE;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC;IAE5D;;;;;;;;;OASG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B;;;;;;;WAOG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAChF,CAAC;IAEF,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,iBAAiB,GAAG,SAAS,CAAC;IAEvE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,GAAG,IAAI,KAAK,MAAM,CAAC;IAElF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,aAAa,GAAG,cAAc,CAAC;IAE3D,oDAAoD;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAExC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;IAC9E;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;IAE1E;;;;;;;OAOG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAEtC;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IAEhD;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAE9D;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,2BAA2B,EAAE,mCAAmC,CAAC;IAC7G;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,WAAW,CAC5C,MAAM,EACN,OAAO,mBAAmB,EAAE,wBAAwB,CACrD,CAAC;IAEF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAC;IAChD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,gBAAgB,CAAC;IAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;IAEvC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,OAAO,CAAC,EACb,OAAO,GACP;QACE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B;;;;;;;;;;;;WAYG;QACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;QACnD;;;;;WAKG;QACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB;;;;;;;;;;;;;;;;;WAiBG;QACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;KACvC,CAAC;IAEN;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,QAAQ,CAAC,OAAO,CAAC,EACb,OAAO,GACP;QACE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QACtB;;;;;;;;;;;;;;WAcG;QACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;KAC9B,CAAC;IAEN;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAEhD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;QAC5B;;;WAGG;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB;;;;;;WAMG;QACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;QACjD;;;;;;;;;;;;;;;;;;;;;;WAsBG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,WAAW,CAAC;KAC/C,CAAC;IAEF,QAAQ,CAAC,OAAO,CAAC,EACb,OAAO,GACP;QACE;;;;;;WAMG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;QAClC;;;;;WAKG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B;;;;;;;;;WASG;QACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAClC;;;WAGG;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB;;;;;;WAMG;QACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvC;;;;;;WAMG;QACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1C,CAAC;IAEN;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IAEnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAE3B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IAEnC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAErC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC;IAEhD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;QAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,QAAQ,CAAC,OAAO,CAAC,EACb,OAAO,GACP;QACE,6CAA6C;QAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB;;;;WAIG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH,QAAQ,CAAC,aAAa,CAAC,EACnB,OAAO,GACP;YACE;;;eAGG;YACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YACzB;;;;;eAKG;YACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;SAC3B,CAAC;QACN;;;;;;;;;;;;;;;WAeG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B;;;;;;;;;;;;;;;WAeG;QACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;KAChD,CAAC;IAEN;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,gEAAgE;QAChE,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;QACnC;;;WAGG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEzC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAEnD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAE/B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;IAErD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE;QAC5B,gEAAgE;QAChE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B;;;;WAIG;QACH,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;QAC5C,kEAAkE;QAClE,QAAQ,CAAC,YAAY,CAAC,EAAE,wBAAwB,CAAC,cAAc,CAAC,CAAC;QACjE,uDAAuD;QACvD,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,yBAAyB,KAAK,IAAI,CAAC;QAClE,wDAAwD;QACxD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;KAC7B,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,QAAQ,CAAC,SAAS,CAAC,EACf,KAAK,GACL;QACE;;;WAGG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;QACjC;;;WAGG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;KAC3C,CAAC;IAEN;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAE9C;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAExC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEzC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAE/C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAE3C;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAEnD;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAEjD;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC;IAErE;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAEtC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAEhD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAE3C;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB;;;;;;;;;;;WAWG;QACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;KAChD,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,aAAa,CAAC;QACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAClD,CAAC,CAAC;IACH;;;;;;;;;OASG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;QACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAClD,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9D,2DAA2D;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,wBAAwB,GAAG,IAAI,CAAC;IACxD;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,iBAAiB,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAClE;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;CAC3C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,uBAA4B,GAAG,UAAU,CA8iF/E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AASH,OAAO,KAAK,EACV,gBAAgB,EAChB,SAAS,EACT,WAAW,EACX,UAAU,EACV,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,aAAa,EACb,WAAW,EACX,WAAW,EACZ,MAAM,0BAA0B,CAAC;AA8BlC,OAAO,KAAK,EACV,qBAAqB,EACrB,cAAc,EACd,aAAa,EACd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAUL,KAAK,8BAA8B,EACpC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAML,KAAK,yBAAyB,EAC/B,MAAM,4CAA4C,CAAC;AAKpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,KAAK,EAAE,0BAA0B,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE5F,OAAO,KAAK,EAAE,SAAS,EAAwB,MAAM,mBAAmB,CAAC;AAIzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAgB,EAAE,KAAK,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAI9D,OAAO,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,KAAK,CAAC;AAKvC,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,WAAW,EACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,KAAK,sBAAsB,EAC5B,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EAOL,KAAK,UAAU,EACf,KAAK,oBAAoB,EAC1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAA0C,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1G,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAQL,KAAK,gBAAgB,EACrB,KAAK,UAAU,EAChB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAkBL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAOvD,OAAO,KAAK,EAAyB,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AA6BlE,OAAO,EAAyB,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAChG,OAAO,EAA0B,KAAK,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAE9F,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AAQ/D,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,UAAU,EAChB,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EAAwB,KAAK,WAAW,EAAqB,MAAM,YAAY,CAAC;AAOvF,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,2BAA2B,CAAC;AAOnC,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAC;AAG/B;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,EAAE,UAK1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CACpB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC1E;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;QACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;QAClC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;KAChC,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CACzD,CAAC;AA2FF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;CACpC,GAAG,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CA+DzD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B;;;;;;;;;OASG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC;IACzD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE;QACnB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAChC;;;;;;;WAOG;QACH,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;QACxC;;;;;WAKG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;QAC1C;;;;;;WAMG;QACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;QAC7C;;;;;;WAMG;QACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,OAAO,mBAAmB,EAAE,kBAAkB,GAAG,SAAS,CAAC;KAChG,CAAC;IACF,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACvC;;;;WAIG;QACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B;;;;;;;;WAQG;QACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QACxE;;;;;WAKG;QACH,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;QACpE;;;;;;WAMG;QACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QACzD;;;;;;;;;;;;;;WAcG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;QAC1D;;;;;;;;WAQG;QACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;QACjE;;;;;WAKG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,6DAA6D;QAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;QACtC;;;;;;;;WAQG;QACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;YACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;SAClC,GACD,SAAS,CAAC;QACd,mEAAmE;QACnE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5C;;;;;;;WAOG;QACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;QACnC;;;;;;;WAOG;QACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;QACzC;;;;;;;WAOG;QACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;QACnD;;;;;;;;;;WAUG;QACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;QAErD;;;;;;;;;;;WAWG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;QAErC;;;;;;;;;;;WAWG;QACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;QAE3C;;;;;;;;;;;;;WAaG;QACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE;YACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,mBAAmB,EAAE,UAAU,CAAC;YAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,mBAAmB,EAAE,UAAU,CAAC;SAC9D,KAAK,IAAI,CAAC;QAEX;;;;;;;;;;;;;;;;;WAiBG;QACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;QAE/B;;;;;WAKG;QACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B;;;;;;;WAOG;QACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;YAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;SACvB,KAAK,MAAM,GAAG,SAAS,CAAC;QACzB;;;;;;;;;;;;;WAaG;QACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;QACzE;;;;;;;;;;;;;;;;;;WAkBG;QACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,sCAAsC,EAAE,kBAAkB,CAAC;KAC/F,CAAC;IACF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACvC;;;;WAIG;QACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;QACnD;;;;;;WAMG;QACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;QACnD;;;;;;;;WAQG;QACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QACzD;;qEAE6D;QAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;QAC1D;8DACsD;QACtD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;QACjE,+EAA+E;QAC/E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,kFAAkF;QAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;QACtC,yEAAyE;QACzE,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;YACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;SAClC,GACD,SAAS,CAAC;QACd,mEAAmE;QACnE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC7C,CAAC;IACF;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;QACrD,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAC3C,CAAC;IACF;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,wBAAwB,GAAG,IAAI,CAAC;KAClE,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,SAAS,iBAAiB,EAAE,CAAC;IACrD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;CAC5C,GAAG,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAygBzD;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QAC1B,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;KAC/C,CAAC;IACF,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;KACpC,CAAC;IACF,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC1B,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;KAC7C,CAAC;IACF,QAAQ,CAAC,SAAS,CAAC,EAAE;QACnB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;KACtC,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;CACpC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa,GAClB,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAuDxD;AAED,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAEpC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAE/B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAE3E;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IAElE;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAE/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAEhC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAEvC;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC;IAEzD;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAE7C;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAE7D;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,SAAS,iBAAiB,EAAE,CAAC;IAErD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAE/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,GAAG;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAErE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IAEjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAEnE;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAE7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IAEnC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAE/C;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;QACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GACD,SAAS,CAAC;IAEd;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE3C;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAEpD;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,KAAK,IAAI,CAAC;IAElE;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC;IAE5D;;;;;;;;;OASG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B;;;;;;;WAOG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAChF,CAAC;IAEF,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,iBAAiB,GAAG,SAAS,CAAC;IAEvE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,GAAG,IAAI,KAAK,MAAM,CAAC;IAElF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,aAAa,GAAG,cAAc,CAAC;IAE3D,oDAAoD;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAExC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;IAC9E;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;IAE1E;;;;;;;OAOG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAEtC;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IAEhD;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAE9D;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,2BAA2B,EAAE,mCAAmC,CAAC;IAC7G;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,WAAW,CAC5C,MAAM,EACN,OAAO,mBAAmB,EAAE,wBAAwB,CACrD,CAAC;IAEF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAC;IAChD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,gBAAgB,CAAC;IAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;IAEvC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,OAAO,CAAC,EACb,OAAO,GACP;QACE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B;;;;;;;;;;;;WAYG;QACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;QACnD;;;;;WAKG;QACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB;;;;;;;;;;;;;;;;;WAiBG;QACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;KACvC,CAAC;IAEN;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,QAAQ,CAAC,OAAO,CAAC,EACb,OAAO,GACP;QACE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QACtB;;;;;;;;;;;;;;WAcG;QACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;KAC9B,CAAC;IAEN;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAEhD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;QAC5B;;;WAGG;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB;;;;;;WAMG;QACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;QACjD;;;;;;;;;;;;;;;;;;;;;;WAsBG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,WAAW,CAAC;KAC/C,CAAC;IAEF,QAAQ,CAAC,OAAO,CAAC,EACb,OAAO,GACP;QACE;;;;;;WAMG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;QAClC;;;;;WAKG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B;;;;;;;;;WASG;QACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAClC;;;WAGG;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB;;;;;;WAMG;QACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvC;;;;;;WAMG;QACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1C,CAAC;IAEN;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IAEnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAE3B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IAEnC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAErC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC;IAEhD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;QAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,QAAQ,CAAC,OAAO,CAAC,EACb,OAAO,GACP;QACE,6CAA6C;QAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB;;;;WAIG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH,QAAQ,CAAC,aAAa,CAAC,EACnB,OAAO,GACP;YACE;;;eAGG;YACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YACzB;;;;;eAKG;YACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;SAC3B,CAAC;QACN;;;;;;;;;;;;;;;WAeG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B;;;;;;;;;;;;;;;WAeG;QACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;KAChD,CAAC;IAEN;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,gEAAgE;QAChE,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;QACnC;;;WAGG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEzC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAEnD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAE/B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;IAErD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE;QAC5B,gEAAgE;QAChE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B;;;;WAIG;QACH,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;QAC5C,kEAAkE;QAClE,QAAQ,CAAC,YAAY,CAAC,EAAE,wBAAwB,CAAC,cAAc,CAAC,CAAC;QACjE,uDAAuD;QACvD,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,yBAAyB,KAAK,IAAI,CAAC;QAClE,wDAAwD;QACxD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;KAC7B,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,QAAQ,CAAC,SAAS,CAAC,EACf,KAAK,GACL;QACE;;;WAGG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;QACjC;;;WAGG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;KAC3C,CAAC;IAEN;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAE9C;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAExC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEzC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAE/C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAE3C;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAEnD;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAEjD;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC;IAErE;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAEtC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAEhD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAE3C;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB;;;;;;;;;;;WAWG;QACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;KAChD,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,aAAa,CAAC;QACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAClD,CAAC,CAAC;IACH;;;;;;;;;OASG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;QACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAClD,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9D,2DAA2D;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,wBAAwB,GAAG,IAAI,CAAC;IACxD;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,iBAAiB,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAClE;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;CAC3C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,uBAA4B,GAAG,UAAU,CA0kF/E"}

package/dist/server.js

@@ -103,7 +103,7 @@ import { resolveMcpInstructions } from "./instructions-presets.js";
 import { buildLlmCaller, createLlmBackedHandshakeNegotiator } from "./llm-backed-negotiator.js";
 import { createConsoleLogger } from "./logger.js";
 import { buildControlService, CONTROL_PATH } from "./control-service.js";
-import { createBrowserCorsMiddleware } from "./browser-cors.js";
+import { createBrowserCorsMiddleware, createPreflightFallback } from "./browser-cors.js";
 import { buildOriginHostPolicy, createOriginHostValidationMiddleware, validateOriginHost, } from "./origin-validation.js";
 import { composeHandlersWithMounts, validateMcpServices, validateServiceHandlers, } from "./mcp-mounts.js";
 import { mountOAuthLoginRoutes } from "./oauth-login.js";
@@ -1940,6 +1940,24 @@ export function createGguiServer(opts = {}) {
     };
     const oauthStorage = oauthConfig.storage ?? new InMemoryOAuthStorage();
     if (oauthEnabled) {
+        // ggui#1193 — per-IP limit on DCR (10 registrations / 10 min). The door is
+        // OPEN by design (#1174's ruling: MCP hosts register themselves), and an
+        // open door with no limiter is an unbounded anonymous write into this
+        // replica's memory. Same middleware as `/pair`, its own quota; mounted
+        // BEFORE the route so `next()` reaches the handler only when allowed. A
+        // denial names itself on both surfaces: 429 + `Retry-After` + `rate_limited`
+        // to the caller, `rate_limit_hit { quotaKey: 'oauth-register' }` to the operator.
+        const registerRateLimiter = new FixedWindowRateLimiter({
+            store: new InMemoryQuotaStore(),
+            limit: 10,
+            windowMs: 10 * 60 * 1000,
+        });
+        app.use("/oauth/register", createPairLoginRateLimitMiddleware({
+            limiter: registerRateLimiter,
+            logger: logger.child({ middleware: "rate-limit", route: "oauth-register" }),
+            quotaKey: "oauth-register",
+            ...(opts.trustProxy !== undefined ? { trustProxy: opts.trustProxy } : {}),
+        }));
         // Discovery + auth + token endpoints — see `./oauth-as-routes.ts`.
         // `getPairingService` late-binds: the pairing service is
         // constructed below this mount, and the consent-submit handler
@@ -3111,6 +3129,12 @@ export function createGguiServer(opts = {}) {
             }
             return result.theme;
         })();
+    // ggui#1231 — the LAST handler: a preflight no route owns ends here as a
+    // bare 204 with no CORS header. `createBrowserCorsMiddleware` passes an
+    // unlisted-origin OPTIONS through so the public `*` read routes' own
+    // `app.options(...)` (runtime bundle + shims, code/contract modules,
+    // session reads) can answer first; everything else falls to this.
+    app.use(createPreflightFallback());
     let httpServer = null;
     return {
         app,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/mcp-server",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "Self-hosted MCP server for the ggui protocol. An HTTP/MCP binding layer over @ggui-ai/mcp-server-handlers and the reference adapters from @ggui-ai/mcp-server-core — run it via `ggui serve`.",
   "keywords": [
     "ggui",
@@ -32,17 +32,17 @@
     "resend": "^6.12.2",
     "ws": "^8.20.1",
     "zod": "^4.3.6",
-    "@ggui-ai/console": "0.19.0",
-    "@ggui-ai/design": "0.19.0",
-    "@ggui-ai/iframe-runtime": "0.19.0",
-    "@ggui-ai/mcp-server-core": "0.19.0",
-    "@ggui-ai/mcp-server-handlers": "0.19.0",
-    "@ggui-ai/negotiator": "0.19.0",
-    "@ggui-ai/preview-a2ui": "0.19.0",
-    "@ggui-ai/project-config": "0.19.0",
-    "@ggui-ai/ui-gen": "0.19.0",
-    "@ggui-ai/ui-registry": "0.19.0",
-    "@ggui-ai/protocol": "0.19.0"
+    "@ggui-ai/console": "0.21.0",
+    "@ggui-ai/design": "0.21.0",
+    "@ggui-ai/mcp-server-core": "0.21.0",
+    "@ggui-ai/mcp-server-handlers": "0.21.0",
+    "@ggui-ai/iframe-runtime": "0.21.0",
+    "@ggui-ai/negotiator": "0.21.0",
+    "@ggui-ai/preview-a2ui": "0.21.0",
+    "@ggui-ai/project-config": "0.21.0",
+    "@ggui-ai/protocol": "0.21.0",
+    "@ggui-ai/ui-gen": "0.21.0",
+    "@ggui-ai/ui-registry": "0.21.0"
   },
   "devDependencies": {
     "@types/express": "^5.0.0",
@@ -51,7 +51,7 @@
     "@types/ws": "^8.5.10",
     "typescript": "^5.0.0",
     "vitest": "^3.2.6",
-    "@ggui-ai/protocol-conformance": "0.19.0"
+    "@ggui-ai/protocol-conformance": "0.21.0"
   },
   "repository": {
     "type": "git",