@haikit/mcp 0.0.0-stage → 0.33.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 hai contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,84 @@
-# Temporary Holding Version
+# @haikit/mcp
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Call an MCP server's tools from inside your own HaiKIT tools.
+
+The model never sees an MCP tool. You declare the server tools your app may
+call, typed by schemas you own, and call them from a tool's `run` or an action
+handler, as you would a database. Your tool decides what the model hears of
+the result and what the browser shows. Nothing a third-party server says
+reaches the model unless your code puts it there: not its tools' names or
+descriptions, not its instructions, and not its results.
+
+```ts
+import { mcpServer, http } from "@haikit/mcp";
+import { defineTool } from "@haikit/core";
+import { z } from "zod";
+
+const github = mcpServer({
+  name: "github",
+  transport: http("https://api.example.com/mcp", { headers: { Authorization: `Bearer ${token}` } }),
+});
+
+// each server tool the app may call, checked both ways by your schemas
+const searchIssues = github.tool("search_issues", {
+  args: z.object({ q: z.string(), per_page: z.number() }),
+  result: z.object({ items: z.array(Issue) }),
+});
+
+// what the model sees is yours: the name, the description, the schema
+export const findIssues = defineTool({
+  name: "find_issues",
+  description: "Search this project's issues.",
+  input: z.object({ query: z.string() }),
+  inputJsonSchema: { type: "object", properties: { query: { type: "string" } }, required: ["query"] },
+  async run({ query }, ctx) {
+    const { items } = await searchIssues.call({ q: `repo:acme/app ${query}`, per_page: 50 }, ctx);
+    return ctx.render(issueList, { issues: items }); // rows to the browser, the digest to the model
+  },
+});
+
+await github.connect(); // at startup: stops here if a declared tool isn't on the server
+```
+
+- `stdio({ command, args })` starts a local server as a child process instead.
+  The child gets only a short list of safe environment variables, not yours.
+- A call throws `McpToolError` when the tool reports an error, and `McpError`
+  when there's no result: bad args, a result your schema refuses, a timeout,
+  a lost connection, a refusal. The message names only the server and the
+  tool. What the server said is on `err.text`, so a tool that lets the error
+  through doesn't pass the server's words to the model.
+- Progress from the server reaches `ctx.progress`, and keeps a long call alive.
+  A call times out after 30 s without word from the server, and after 90 s in
+  all, connecting included, inside the 120 s turn lease.
+- `textOf(result)` turns a result into text, for a tool that decides to pass
+  some of it on. A cut is always marked in the text.
+
+A server can take each user's own credential instead of the app's. Then each
+call runs as the conversation's owner, over a connection of their own:
+
+```ts
+import { createMcpAuth } from "@haikit/mcp";
+
+const mcpAuth = createMcpAuth({ userOf: (id) => auth.ownerOf(id) }); // auth from @haikit/auth
+const tracker = mcpServer({
+  name: "tracker",
+  transport: http("https://mcp.tracker.example/mcp"),
+  auth: mcpAuth.bearer((userId) => keys.find(userId)), // their token, or null
+});
+```
+
+A call with no one to run as is refused with reason `user`, and one for a user
+with no token with reason `auth`, before anything is sent: it never falls
+back to the app's identity. `err.auth.kind` says what the user must do:
+`connect`, `reconnect`, or grant more `scope`. A job outside any conversation
+passes `{ userId }`.
+
+`McpTool` isn't a HaiKIT `Tool`, so it can't be passed to
+`createHai({ tools })`: `npm run typetest` checks that.
+
+Imports only `@haikit/core`, never `@haikit/server`. Built on
+[`@modelcontextprotocol/client`](https://www.npmjs.com/package/@modelcontextprotocol/client),
+the official TypeScript SDK's client.
+
+Everything it does, with every default and message:
+[the reference manual](https://github.com/wfoxd/haikit/blob/main/docs/reference/mcp.md).

package/dist/auth.d.ts

@@ -0,0 +1,80 @@
+import type { AuthProvider } from "@modelcontextprotocol/client";
+export interface McpAuthOptions {
+    /**
+     * Who a conversation belongs to: the user a call made in it runs as. With
+     * @haikit/auth, `(id) => auth.ownerOf(id)`. `null` for no one.
+     */
+    userOf(conversationId: string): string | null | Promise<string | null>;
+}
+/** Makes the `auth` of servers whose calls are made as each user. */
+export interface McpAuth {
+    /**
+     * Each user's own token, which the app already has: `token(userId)` gives
+     * it, or `null` when the user has none. Sent as `Authorization: Bearer`.
+     */
+    bearer(token: (userId: string) => string | null | Promise<string | null>): McpServerAuth;
+}
+/** How a server's calls are made as each user: made by an `McpAuth`, and given to `mcpServer({ auth })`. */
+export interface McpServerAuth {
+    readonly kind: "bearer";
+}
+/** What an `McpServerAuth` stands for. */
+export interface AuthConfig {
+    readonly kind: "bearer";
+    userOf(conversationId: string): string | null | Promise<string | null>;
+    token(userId: string): string | null | Promise<string | null>;
+    /** Server names in use with this `McpAuth`: each is a key for its users' credentials. */
+    readonly names: Set<string>;
+}
+/** The config an `McpServerAuth` stands for, or undefined if `createMcpAuth` didn't make it. */
+export declare const configOf: (auth: unknown) => AuthConfig | undefined;
+/**
+ * For servers whose calls are made as each user, with that user's own
+ * credential: `mcpServer({ auth: mcpAuth.bearer(token) })`.
+ */
+export declare function createMcpAuth(options: McpAuthOptions): McpAuth;
+/**
+ * The user has no credential, or the server refused theirs: thrown inside a
+ * connection, where the transport passes it on unchanged, and made an
+ * `McpError` with reason `auth`.
+ */
+export declare class NeedsAuth extends Error {
+    readonly kind: "connect" | "reconnect";
+    readonly name = "NeedsAuth";
+    constructor(kind: "connect" | "reconnect");
+}
+/** The app's lookup of a credential failed: made an `McpError` with reason `connection`. */
+export declare class LookupFailed extends Error {
+    readonly name = "LookupFailed";
+    constructor(cause: unknown);
+}
+/** One user's credential for one server, and the `AuthProvider` that sends it. */
+export interface Credential {
+    /** Before a connection or call: finds the credential, or throws `NeedsAuth("connect")`, so nothing is sent without one. */
+    ensure(): Promise<void>;
+    /** For a connection being closed: stops a lookup on its way, and its timer. */
+    close(): void;
+    readonly provider: AuthProvider;
+}
+/** A token from `bearer`'s function, kept until a lookup on a 401 finds another, or none. */
+export declare class BearerCredential implements Credential {
+    private readonly read;
+    private readonly user;
+    /** How long `read` may take: a lookup that never answers would hold up every call after it. */
+    private readonly timeoutMs;
+    private token;
+    /** The lookup on its way, which every caller shares: only it sets `token`. */
+    private looking;
+    /** Stops the lookup on its way, for `close()`. */
+    private stop;
+    constructor(read: (userId: string) => string | null | Promise<string | null>, user: string, 
+    /** How long `read` may take: a lookup that never answers would hold up every call after it. */
+    timeoutMs: number);
+    ensure(): Promise<void>;
+    close(): void;
+    readonly provider: AuthProvider;
+    /** One lookup at a time, for first calls and 401s that come together, so none overwrites another's token. */
+    private look;
+    private lookup;
+}
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAEjE,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACxE;AAED,qEAAqE;AACrE,MAAM,WAAW,OAAO;IACtB;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,aAAa,CAAC;CAC1F;AAED,4GAA4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,0CAA0C;AAC1C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvE,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9D,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC7B;AAID,gGAAgG;AAChG,eAAO,MAAM,QAAQ,GAAI,MAAM,OAAO,KAAG,UAAU,GAAG,SACqB,CAAC;AAE5E;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAgB9D;AAED;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAEtB,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,WAAW;IADlD,QAAQ,CAAC,IAAI,eAAe;gBACP,IAAI,EAAE,SAAS,GAAG,WAAW;CAGnD;AAED,4FAA4F;AAC5F,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,kBAAkB;gBACnB,KAAK,EAAE,OAAO;CAG3B;AAED,kFAAkF;AAClF,MAAM,WAAW,UAAU;IACzB,2HAA2H;IAC3H,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,+EAA+E;IAC/E,KAAK,IAAI,IAAI,CAAC;IACd,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;CACjC;AAED,6FAA6F;AAC7F,qBAAa,gBAAiB,YAAW,UAAU;IAQ/C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,SAAS;IAV5B,OAAO,CAAC,KAAK,CAAuB;IACpC,8EAA8E;IAC9E,OAAO,CAAC,OAAO,CAAuC;IACtD,kDAAkD;IAClD,OAAO,CAAC,IAAI,CAA6B;gBAGtB,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAChE,IAAI,EAAE,MAAM;IAC7B,+FAA+F;IAC9E,SAAS,EAAE,MAAM;IAG9B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAK7B,KAAK,IAAI,IAAI;IAMb,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAc7B;IAEF,6GAA6G;IAC7G,OAAO,CAAC,IAAI;YASE,MAAM;CAiBrB"}

package/dist/auth.js

@@ -0,0 +1,119 @@
+const configs = new WeakMap();
+/** The config an `McpServerAuth` stands for, or undefined if `createMcpAuth` didn't make it. */
+export const configOf = (auth) => typeof auth === "object" && auth !== null ? configs.get(auth) : undefined;
+/**
+ * For servers whose calls are made as each user, with that user's own
+ * credential: `mcpServer({ auth: mcpAuth.bearer(token) })`.
+ */
+export function createMcpAuth(options) {
+    if (typeof options?.userOf !== "function") {
+        throw new TypeError("createMcpAuth: userOf must be a function, such as (id) => auth.ownerOf(id)");
+    }
+    const names = new Set();
+    const userOf = (conversationId) => options.userOf(conversationId);
+    return Object.freeze({
+        bearer(token) {
+            if (typeof token !== "function") {
+                throw new TypeError("bearer: token must be a function that takes a user id and returns their token, or null");
+            }
+            const auth = Object.freeze({ kind: "bearer" });
+            configs.set(auth, { kind: "bearer", userOf, token, names });
+            return auth;
+        },
+    });
+}
+/**
+ * The user has no credential, or the server refused theirs: thrown inside a
+ * connection, where the transport passes it on unchanged, and made an
+ * `McpError` with reason `auth`.
+ */
+export class NeedsAuth extends Error {
+    kind;
+    name = "NeedsAuth";
+    constructor(kind) {
+        super(kind === "connect" ? "the user has no credential" : "the server refused the user's credential");
+        this.kind = kind;
+    }
+}
+/** The app's lookup of a credential failed: made an `McpError` with reason `connection`. */
+export class LookupFailed extends Error {
+    name = "LookupFailed";
+    constructor(cause) {
+        super("the user's credential could not be looked up", { cause });
+    }
+}
+/** A token from `bearer`'s function, kept until a lookup on a 401 finds another, or none. */
+export class BearerCredential {
+    read;
+    user;
+    timeoutMs;
+    token = null;
+    /** The lookup on its way, which every caller shares: only it sets `token`. */
+    looking = null;
+    /** Stops the lookup on its way, for `close()`. */
+    stop = null;
+    constructor(read, user, 
+    /** How long `read` may take: a lookup that never answers would hold up every call after it. */
+    timeoutMs) {
+        this.read = read;
+        this.user = user;
+        this.timeoutMs = timeoutMs;
+    }
+    async ensure() {
+        if (this.token === null)
+            await this.look();
+        if (this.token === null)
+            throw new NeedsAuth("connect");
+    }
+    close() {
+        this.stop?.();
+    }
+    // The transport asks for the token before every request, and on a 401
+    // calls onUnauthorized, then tries once more with what it finds.
+    provider = {
+        // A request is never sent without the user's token: the transport would
+        // send it with no Authorization at all. Gone since its call began, as
+        // when another call's 401 found none, it stops the request here.
+        token: async () => {
+            if (this.token === null)
+                throw new NeedsAuth("reconnect");
+            return this.token;
+        },
+        onUnauthorized: async () => {
+            // A token the server still refuses gets its 401 on the retry, and is
+            // kept: the next 401 looks again. Forgetting it would throw away a
+            // newer one that another call's 401 found meanwhile.
+            if ((await this.look()) === null)
+                throw new NeedsAuth("reconnect");
+        },
+    };
+    /** One lookup at a time, for first calls and 401s that come together, so none overwrites another's token. */
+    look() {
+        this.looking ??= this.lookup()
+            .then((token) => (this.token = token))
+            .finally(() => {
+            this.looking = null;
+        });
+        return this.looking;
+    }
+    async lookup() {
+        let timer;
+        const cut = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error(`no token within ${this.timeoutMs} ms`)), this.timeoutMs);
+            this.stop = () => reject(new Error("closed while the token was being looked up"));
+        });
+        let token;
+        try {
+            token = await Promise.race([Promise.resolve().then(() => this.read(this.user)), cut]);
+        }
+        catch (err) {
+            throw new LookupFailed(err);
+        }
+        finally {
+            clearTimeout(timer);
+            this.stop = null;
+        }
+        return typeof token === "string" && token !== "" ? token : null;
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAiCA,MAAM,OAAO,GAAG,IAAI,OAAO,EAAsB,CAAC;AAElD,gGAAgG;AAChG,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAa,EAA0B,EAAE,CAChE,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE5E;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,IAAI,OAAO,OAAO,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CAAC,4EAA4E,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,MAAM,GAAG,CAAC,cAAsB,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,CAAC,KAAiE;YACtE,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;gBAChC,MAAM,IAAI,SAAS,CAAC,wFAAwF,CAAC,CAAC;YAChH,CAAC;YACD,MAAM,IAAI,GAAkB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IAEb;IADZ,IAAI,GAAG,WAAW,CAAC;IAC5B,YAAqB,IAA6B;QAChD,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC;QADnF,SAAI,GAAJ,IAAI,CAAyB;IAElD,CAAC;CACF;AAED,4FAA4F;AAC5F,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,GAAG,cAAc,CAAC;IAC/B,YAAY,KAAc;QACxB,KAAK,CAAC,8CAA8C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;CACF;AAWD,6FAA6F;AAC7F,MAAM,OAAO,gBAAgB;IAQR;IACA;IAEA;IAVX,KAAK,GAAkB,IAAI,CAAC;IACpC,8EAA8E;IACtE,OAAO,GAAkC,IAAI,CAAC;IACtD,kDAAkD;IAC1C,IAAI,GAAwB,IAAI,CAAC;IAEzC,YACmB,IAAgE,EAChE,IAAY;IAC7B,+FAA+F;IAC9E,SAAiB;QAHjB,SAAI,GAAJ,IAAI,CAA4D;QAChE,SAAI,GAAJ,IAAI,CAAQ;QAEZ,cAAS,GAAT,SAAS,CAAQ;IACjC,CAAC;IAEJ,KAAK,CAAC,MAAM;QACV,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;IAChB,CAAC;IAED,sEAAsE;IACtE,iEAAiE;IACxD,QAAQ,GAAiB;QAChC,wEAAwE;QACxE,sEAAsE;QACtE,iEAAiE;QACjE,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;gBAAE,MAAM,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,cAAc,EAAE,KAAK,IAAI,EAAE;YACzB,qEAAqE;YACrE,mEAAmE;YACnE,qDAAqD;YACrD,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI;gBAAE,MAAM,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;QACrE,CAAC;KACF,CAAC;IAEF,6GAA6G;IACrG,IAAI;QACV,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,EAAE;aAC3B,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;aACrC,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,IAAI,KAAgD,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC3C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACpG,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;QACH,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;CACF"}

package/dist/errors.d.ts

@@ -0,0 +1,76 @@
+import type { ContentBlock } from "@modelcontextprotocol/client";
+/**
+ * Why a call failed:
+ *
+ * - `args`: the args didn't match the tool's `args` schema, so nothing was sent.
+ * - `result`: the result didn't match its `result` schema.
+ * - `timeout`: the server didn't answer within `timeoutMs` or `maxTotalMs`.
+ * - `connection`: the server couldn't be reached, or the connection dropped.
+ * - `protocol`: the server refused the call, such as for a tool it doesn't
+ *   have, or asked for something this client doesn't do.
+ * - `closed`: `close()` was called.
+ * - `user`: a server with `auth` had no user to call as, so nothing was sent.
+ * - `auth`: the user's credential for the server is missing, was refused, or
+ *   needs more access. `auth` on the error says which.
+ */
+export type McpErrorReason = "args" | "result" | "timeout" | "connection" | "protocol" | "closed" | "user" | "auth";
+/** What a call with reason `auth` needs from the user. */
+export interface McpAuthNeed {
+    /**
+     * `connect`: the user has no credential for the server, so nothing was sent.
+     * `reconnect`: the server refused theirs. `scope`: theirs needs more access.
+     */
+    readonly kind: "connect" | "reconnect" | "scope";
+    /** On `scope`: the scope the server asked for, as its challenge put it. */
+    readonly scope?: string;
+}
+/**
+ * A call that didn't get a result. The message names only the server and the
+ * tool, never what the server said: a HaiKIT tool that lets this go reaches the
+ * model as `<name> failed: <message>`, and the server's words aren't the app's
+ * to pass on unread. Its words are on `text`, for logs and for code that
+ * decides.
+ *
+ * Detected by `name` rather than `instanceof`, as in @haikit/core: a duplicated
+ * install would give two distinct classes.
+ */
+export declare class McpError extends Error {
+    readonly name = "McpError";
+    /** The server's `name`. */
+    readonly server: string;
+    /** The tool called. Absent when `connect()` failed. */
+    readonly tool: string | undefined;
+    readonly reason: McpErrorReason;
+    /** What the server said about it, when it said anything: a JSON-RPC error's message. */
+    readonly text: string | undefined;
+    /** A JSON-RPC error's code. */
+    readonly code: number | undefined;
+    /** With reason `auth`: what the user's credential needs. */
+    readonly auth: McpAuthNeed | undefined;
+    constructor(reason: McpErrorReason, message: string, detail: {
+        server: string;
+        tool?: string;
+        text?: string;
+        code?: number;
+        cause?: unknown;
+        auth?: McpAuthNeed;
+    });
+}
+/**
+ * The tool ran and reported an error (`isError` in its result). Its message
+ * says only that, for the reason `McpError`'s does; what the server said is on
+ * `text` and `content`.
+ */
+export declare class McpToolError extends Error {
+    readonly name = "McpToolError";
+    readonly server: string;
+    readonly tool: string;
+    /** The result's text blocks, joined by newlines. */
+    readonly text: string;
+    /** The result's content blocks, as the server sent them. */
+    readonly content: ContentBlock[];
+    constructor(server: string, tool: string, content: ContentBlock[]);
+}
+export declare const isMcpError: (err: unknown) => err is McpError;
+export declare const isMcpToolError: (err: unknown) => err is McpToolError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;AAEpH,0DAA0D;AAC1D,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;IACjD,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,cAAc;IAC3B,2BAA2B;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,SAAS,CAAC;gBAGrC,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,WAAW,CAAA;KAAE;CAU/G;AAED;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;gBAErB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE;CAOlE;AAED,eAAO,MAAM,UAAU,GAAI,KAAK,OAAO,KAAG,GAAG,IAAI,QAA2D,CAAC;AAE7G,eAAO,MAAM,cAAc,GAAI,KAAK,OAAO,KAAG,GAAG,IAAI,YACA,CAAC"}

package/dist/errors.js

@@ -0,0 +1,57 @@
+/**
+ * A call that didn't get a result. The message names only the server and the
+ * tool, never what the server said: a HaiKIT tool that lets this go reaches the
+ * model as `<name> failed: <message>`, and the server's words aren't the app's
+ * to pass on unread. Its words are on `text`, for logs and for code that
+ * decides.
+ *
+ * Detected by `name` rather than `instanceof`, as in @haikit/core: a duplicated
+ * install would give two distinct classes.
+ */
+export class McpError extends Error {
+    name = "McpError";
+    /** The server's `name`. */
+    server;
+    /** The tool called. Absent when `connect()` failed. */
+    tool;
+    reason;
+    /** What the server said about it, when it said anything: a JSON-RPC error's message. */
+    text;
+    /** A JSON-RPC error's code. */
+    code;
+    /** With reason `auth`: what the user's credential needs. */
+    auth;
+    constructor(reason, message, detail) {
+        super(message, detail.cause === undefined ? undefined : { cause: detail.cause });
+        this.reason = reason;
+        this.server = detail.server;
+        this.tool = detail.tool;
+        this.text = detail.text;
+        this.code = detail.code;
+        this.auth = detail.auth === undefined ? undefined : Object.freeze({ ...detail.auth });
+    }
+}
+/**
+ * The tool ran and reported an error (`isError` in its result). Its message
+ * says only that, for the reason `McpError`'s does; what the server said is on
+ * `text` and `content`.
+ */
+export class McpToolError extends Error {
+    name = "McpToolError";
+    server;
+    tool;
+    /** The result's text blocks, joined by newlines. */
+    text;
+    /** The result's content blocks, as the server sent them. */
+    content;
+    constructor(server, tool, content) {
+        super(`${server}/${tool} reported an error`);
+        this.server = server;
+        this.tool = tool;
+        this.content = content;
+        this.text = content.flatMap((b) => (b.type === "text" ? [b.text] : [])).join("\n");
+    }
+}
+export const isMcpError = (err) => err instanceof Error && err.name === "McpError";
+export const isMcpToolError = (err) => err instanceof Error && err.name === "McpToolError";
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AA6BA;;;;;;;;;GASG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,GAAG,UAAU,CAAC;IAC3B,2BAA2B;IAClB,MAAM,CAAS;IACxB,uDAAuD;IAC9C,IAAI,CAAqB;IACzB,MAAM,CAAiB;IAChC,wFAAwF;IAC/E,IAAI,CAAqB;IAClC,+BAA+B;IACtB,IAAI,CAAqB;IAClC,4DAA4D;IACnD,IAAI,CAA0B;IAEvC,YACE,MAAsB,EACtB,OAAe,EACf,MAA4G;QAE5G,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,GAAG,cAAc,CAAC;IACtB,MAAM,CAAS;IACf,IAAI,CAAS;IACtB,oDAAoD;IAC3C,IAAI,CAAS;IACtB,4DAA4D;IACnD,OAAO,CAAiB;IAEjC,YAAY,MAAc,EAAE,IAAY,EAAE,OAAuB;QAC/D,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,oBAAoB,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,CAAC;CACF;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAY,EAAmB,EAAE,CAAC,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC;AAE7G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAY,EAAuB,EAAE,CAClE,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,158 @@
+/**
+ * @haikit/mcp — call MCP servers' tools from inside your own tools.
+ *
+ * The model never sees an MCP tool. An app declares the server tools it calls,
+ * typed by schemas it owns, and calls them from a HaiKIT tool's `run` or an
+ * action handler, the way it would call a database: that code decides what the
+ * model hears of a result and what the browser shows. So nothing a third-party
+ * server says — its tools' names and descriptions, its instructions, its
+ * results — reaches the model unless app code puts it there.
+ *
+ * There is no way to make a HaiKIT `Tool` from an MCP tool here, on purpose:
+ * an `McpTool` has no `run`, so `createHai({ tools })` won't take one.
+ *
+ * Imports only @haikit/core, like the model adapters.
+ */
+import type { Progress, Schema } from "@haikit/core";
+import { type AuthProvider, type ContentBlock, type Transport, type VersionNegotiationMode } from "@modelcontextprotocol/client";
+import { type McpServerAuth } from "./auth.js";
+export { createMcpAuth, type McpAuth, type McpAuthOptions, type McpServerAuth } from "./auth.js";
+export { McpError, McpToolError, isMcpError, isMcpToolError, type McpAuthNeed, type McpErrorReason } from "./errors.js";
+export { textOf, type TextOptions } from "./text.js";
+export { http, stdio, type HttpOptions } from "./transports.js";
+export type { AuthProvider, ContentBlock, Transport } from "@modelcontextprotocol/client";
+export interface McpServerOptions {
+    /** Names the server in errors and warnings, as in `github/search_issues`. */
+    name: string;
+    /**
+     * Makes a connection: called by the first `connect()` or call, and again
+     * for each reconnect. `http(url)` and `stdio({ command })` make one. For a
+     * server with `auth`, it's given the user's `AuthProvider`, and must be
+     * `http()`'s.
+     */
+    transport: (authProvider?: AuthProvider) => Transport | Promise<Transport>;
+    /**
+     * Makes each call as the user it runs for, with their own credential, over
+     * a connection of their own: `createMcpAuth({ userOf }).bearer(token)`.
+     * Without it, every call shares one connection and one identity.
+     */
+    auth?: McpServerAuth;
+    /**
+     * With `auth`: the most users connected at once. Past it, the least recently
+     * used connection with no call in flight is closed. Default 100.
+     */
+    maxConnections?: number;
+    /** With `auth`: a user's connection is closed after this long with no call, in milliseconds. Default 300,000. */
+    idleMs?: number;
+    /**
+     * How long the server may go without answering a call or reporting progress
+     * on it, in milliseconds. Also bounds making the transport, connecting,
+     * listing tools and, with `auth`, looking up a user's token. Default 30,000.
+     */
+    timeoutMs?: number;
+    /**
+     * The longest a call may take, progress or not, connecting included, in
+     * milliseconds. Default 90,000.
+     */
+    maxTotalMs?: number;
+    /**
+     * A declared tool was removed from the server, or its schema changed: seen
+     * when the server says its tools changed, and on a reconnect. Calls go on
+     * as before; one to a removed tool fails. Default: a `console.warn`. If it
+     * throws, the error is logged with `console.error`.
+     */
+    onChange?: (change: McpToolChange) => void;
+    /** The SDK's protocol version negotiation. Default `"legacy"`, the SDK's own: the 2025 handshake. */
+    versionNegotiation?: VersionNegotiationMode;
+}
+export interface McpToolChange {
+    server: string;
+    /** With `auth`: the user whose connection saw the change. Each user's tools are compared apart. */
+    user?: string;
+    /** Declared tools the server no longer has. */
+    removed: string[];
+    /** Declared tools whose input or output schema, or task support, changed. */
+    changed: string[];
+}
+export interface McpToolDef<A, R> {
+    /** Checks the args before anything is sent. They must come out an object. */
+    args: Schema<A>;
+    /**
+     * Checks the result, which `call` then resolves to: the server's structured
+     * result, or, without one, the JSON in its one text block. Without this,
+     * `call` resolves to the result's content as the server sent it.
+     */
+    result?: Schema<R>;
+    /** Overrides the server's `timeoutMs` for this tool. */
+    timeoutMs?: number;
+    /** Overrides the server's `maxTotalMs` for this tool. */
+    maxTotalMs?: number;
+}
+/** A result with no `result` schema: what the server sent, unchecked. */
+export interface McpResult {
+    /** The content blocks, as the server sent them. */
+    content: ContentBlock[];
+    /** The server's structured result, when it sent one. */
+    structuredContent?: unknown;
+}
+/**
+ * What a call is made for. A HaiKIT tool's `ctx` or an action handler's can
+ * be passed as it is.
+ */
+export interface McpCallCtx {
+    /**
+     * The conversation the call is for. A server with `auth` calls as its
+     * owner, from `userOf`.
+     */
+    readonly conversationId?: string;
+    /**
+     * For a server with `auth`: the user to call as, for a call made outside any
+     * conversation, such as a job. With a `conversationId` too, it must be the
+     * conversation's owner.
+     */
+    readonly userId?: string;
+    /** Hears the server's progress notifications, as `ToolCtx.progress` does. */
+    progress?(progress: Progress): void;
+}
+/** One of the server's tools, as the app declared it. Not a HaiKIT `Tool`: the model never sees it. */
+export interface McpTool<A, R> {
+    readonly server: string;
+    readonly name: string;
+    /**
+     * Calls the tool. Throws `McpToolError` when the tool reports an error, and
+     * `McpError` when the call gets no result, or one its schema refuses.
+     */
+    call(args: A, ctx?: McpCallCtx): Promise<R>;
+}
+/** The connection to one MCP server, and the tools the app may call on it. */
+export interface McpConnection {
+    readonly name: string;
+    /**
+     * Declares one of the server's tools: the only way to call it. Declared
+     * after `connect()`, it is checked against the server's tools at once.
+     */
+    tool<A, R>(name: string, def: McpToolDef<A, R> & {
+        result: Schema<R>;
+    }): McpTool<A, R>;
+    tool<A>(name: string, def: McpToolDef<A, unknown> & {
+        result?: undefined;
+    }): McpTool<A, McpResult>;
+    /**
+     * Connects, and checks every declared tool: it throws if the server has no
+     * tool of that name, or one that can only run as an MCP task. Call it at
+     * startup, so a mistake stops the app there; the first call connects
+     * otherwise, and fails with the same error. A server with `auth` needs
+     * the user to connect as, and checks the tools that user sees.
+     */
+    connect(userId?: string): Promise<void>;
+    /**
+     * For a server with `auth`: closes the user's connection, if they have
+     * one. Their next call makes a new one, and looks up their credential again.
+     */
+    forget(userId: string): Promise<void>;
+    /** Closes the connection, and stops a `stdio` server. Final: a later call fails with reason `closed`. */
+    close(): Promise<void>;
+}
+/** The connection to an MCP server. Nothing connects until `connect()` or the first call. */
+export declare function mcpServer(options: McpServerOptions): McpConnection;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EASL,KAAK,YAAY,EAEjB,KAAK,YAAY,EAEjB,KAAK,SAAS,EACd,KAAK,sBAAsB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAyF,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAItI,OAAO,EAAE,aAAa,EAAE,KAAK,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AACxH,OAAO,EAAE,MAAM,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAChE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAuB1F,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,YAAY,KAAK,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3E;;;;OAIG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iHAAiH;IACjH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IAC3C,qGAAqG;IACrG,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;CAC7C;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,EAAE,CAAC;IAC9B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yEAAyE;AACzE,MAAM,WAAW,SAAS;IACxB,mDAAmD;IACnD,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,wDAAwD;IACxD,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;CACrC;AAED,uGAAuG;AACvG,MAAM,WAAW,OAAO,CAAC,CAAC,EAAE,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7C;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG;QAAE,MAAM,CAAC,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACnG;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,yGAAyG;IACzG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,6FAA6F;AAC7F,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAElE"}