@happyvertical/smrt-app-mcp 0.51.37 → 0.51.39

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","names":[],"sources":["../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/buffer_utils.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/errors.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/base64url.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/validate.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key_descriptor.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_algorithms.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_verify.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jwt_claims_set.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwt/verify.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwks/local.js","../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwks/remote.js","../src/auth.ts"],"sourcesContent":["const encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder(\"utf-8\", { fatal: !0 }), MAX_INT32 = 2 ** 32;\nfunction concat(...buffers) {\n  const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);\n  let i = 0;\n  for (const buffer of buffers)\n    buf.set(buffer, i), i += buffer.length;\n  return buf;\n}\nfunction writeUInt32BE(buf, value, offset) {\n  if (value < 0 || value >= MAX_INT32)\n    throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);\n  buf.set([value >>> 24, value >>> 16, value >>> 8, value & 255], offset);\n}\nfunction uint64be(value) {\n  const high = Math.floor(value / MAX_INT32), low = value % MAX_INT32, buf = new Uint8Array(8);\n  return writeUInt32BE(buf, high, 0), writeUInt32BE(buf, low, 4), buf;\n}\nfunction uint32be(value) {\n  const buf = new Uint8Array(4);\n  return writeUInt32BE(buf, value), buf;\n}\nconst NON_ASCII = /[^\\x00-\\x7f]/;\nfunction encode(string) {\n  if (typeof string == \"string\" && string.length >= 128) {\n    if (NON_ASCII.test(string))\n      throw new TypeError(\"non-ASCII string encountered in encode()\");\n    return encoder.encode(string);\n  }\n  const bytes = new Uint8Array(string.length);\n  for (let i = 0; i < string.length; i++) {\n    const code = string.charCodeAt(i);\n    if (code > 127)\n      throw new TypeError(\"non-ASCII string encountered in encode()\");\n    bytes[i] = code;\n  }\n  return bytes;\n}\nfunction encodeBase64(input, url = !1) {\n  if (Uint8Array.prototype.toBase64)\n    return input.toBase64({ alphabet: url ? \"base64url\" : \"base64\", omitPadding: url });\n  const CHUNK_SIZE = 32768, arr = [];\n  for (let i = 0; i < input.length; i += CHUNK_SIZE)\n    arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n  const encoded = btoa(arr.join(\"\"));\n  return url ? encoded.replace(/=/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\") : encoded;\n}\nfunction decodeBase64(encoded, url = !1) {\n  if (Uint8Array.fromBase64)\n    return Uint8Array.fromBase64(encoded, { alphabet: url ? \"base64url\" : \"base64\" });\n  if (url) {\n    if (encoded.includes(\"+\") || encoded.includes(\"/\"))\n      throw new TypeError(\"Invalid base64url\");\n    encoded = encoded.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  }\n  const binary = atob(encoded), bytes = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i++)\n    bytes[i] = binary.charCodeAt(i);\n  return bytes;\n}\nasync function digest(algorithm, data) {\n  const subtleDigest = `SHA-${algorithm.slice(-3)}`;\n  return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));\n}\nexport {\n  concat,\n  decodeBase64,\n  decoder,\n  digest,\n  encode,\n  encodeBase64,\n  encoder,\n  strictDecoder,\n  uint32be,\n  uint64be\n};\n","class JOSEError extends Error {\n  static code = \"ERR_JOSE_GENERIC\";\n  code = \"ERR_JOSE_GENERIC\";\n  constructor(message, options) {\n    super(message, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);\n  }\n}\nclass JWTClaimValidationFailed extends JOSEError {\n  static code = \"ERR_JWT_CLAIM_VALIDATION_FAILED\";\n  code = \"ERR_JWT_CLAIM_VALIDATION_FAILED\";\n  claim;\n  reason;\n  payload;\n  constructor(message, payload, claim = \"unspecified\", reason = \"unspecified\") {\n    super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;\n  }\n}\nclass JWTExpired extends JOSEError {\n  static code = \"ERR_JWT_EXPIRED\";\n  code = \"ERR_JWT_EXPIRED\";\n  claim;\n  reason;\n  payload;\n  constructor(message, payload, claim = \"unspecified\", reason = \"unspecified\") {\n    super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;\n  }\n}\nclass JOSEAlgNotAllowed extends JOSEError {\n  static code = \"ERR_JOSE_ALG_NOT_ALLOWED\";\n  code = \"ERR_JOSE_ALG_NOT_ALLOWED\";\n}\nclass JOSENotSupported extends JOSEError {\n  static code = \"ERR_JOSE_NOT_SUPPORTED\";\n  code = \"ERR_JOSE_NOT_SUPPORTED\";\n}\nclass JWEDecryptionFailed extends JOSEError {\n  static code = \"ERR_JWE_DECRYPTION_FAILED\";\n  code = \"ERR_JWE_DECRYPTION_FAILED\";\n  constructor(message = \"decryption operation failed\", options) {\n    super(message, options);\n  }\n}\nclass JWEInvalid extends JOSEError {\n  static code = \"ERR_JWE_INVALID\";\n  code = \"ERR_JWE_INVALID\";\n}\nclass JWSInvalid extends JOSEError {\n  static code = \"ERR_JWS_INVALID\";\n  code = \"ERR_JWS_INVALID\";\n}\nclass JWTInvalid extends JOSEError {\n  static code = \"ERR_JWT_INVALID\";\n  code = \"ERR_JWT_INVALID\";\n}\nclass JWKInvalid extends JOSEError {\n  static code = \"ERR_JWK_INVALID\";\n  code = \"ERR_JWK_INVALID\";\n}\nclass JWKSInvalid extends JOSEError {\n  static code = \"ERR_JWKS_INVALID\";\n  code = \"ERR_JWKS_INVALID\";\n}\nclass JWKSNoMatchingKey extends JOSEError {\n  static code = \"ERR_JWKS_NO_MATCHING_KEY\";\n  code = \"ERR_JWKS_NO_MATCHING_KEY\";\n  constructor(message = \"no applicable key found in the JSON Web Key Set\", options) {\n    super(message, options);\n  }\n}\nclass JWKSMultipleMatchingKeys extends JOSEError {\n  [Symbol.asyncIterator] = async function* () {\n  };\n  static code = \"ERR_JWKS_MULTIPLE_MATCHING_KEYS\";\n  code = \"ERR_JWKS_MULTIPLE_MATCHING_KEYS\";\n  constructor(message = \"multiple matching keys found in the JSON Web Key Set\", options) {\n    super(message, options);\n  }\n}\nclass JWKSTimeout extends JOSEError {\n  static code = \"ERR_JWKS_TIMEOUT\";\n  code = \"ERR_JWKS_TIMEOUT\";\n  constructor(message = \"request timed out\", options) {\n    super(message, options);\n  }\n}\nclass JWSSignatureVerificationFailed extends JOSEError {\n  static code = \"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";\n  code = \"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";\n  constructor(message = \"signature verification failed\", options) {\n    super(message, options);\n  }\n}\nexport {\n  JOSEAlgNotAllowed,\n  JOSEError,\n  JOSENotSupported,\n  JWEDecryptionFailed,\n  JWEInvalid,\n  JWKInvalid,\n  JWKSInvalid,\n  JWKSMultipleMatchingKeys,\n  JWKSNoMatchingKey,\n  JWKSTimeout,\n  JWSInvalid,\n  JWSSignatureVerificationFailed,\n  JWTClaimValidationFailed,\n  JWTExpired,\n  JWTInvalid\n};\n","import { encoder, decoder, encodeBase64, decodeBase64 } from \"../lib/buffer_utils.js\";\nconst invalid = \"The input to be decoded is not correctly encoded.\";\nfunction decode(input) {\n  try {\n    return decodeBase64(typeof input == \"string\" ? input : decoder.decode(input), !0);\n  } catch (cause) {\n    throw new TypeError(invalid, { cause });\n  }\n}\nfunction encode(input) {\n  return encodeBase64(typeof input == \"string\" ? encoder.encode(input) : input, !0);\n}\nexport {\n  decode,\n  encode\n};\n","import { JOSENotSupported, JWSInvalid } from \"../util/errors.js\";\nimport { decode } from \"../util/base64url.js\";\nimport { encode, strictDecoder } from \"./buffer_utils.js\";\nfunction assertUint8Array(input, label) {\n  if (!(input instanceof Uint8Array))\n    throw new TypeError(`${label} must be an instance of Uint8Array`);\n}\nfunction isObject(input) {\n  if (typeof input != \"object\" || input === null || Object.prototype.toString.call(input) !== \"[object Object]\")\n    return !1;\n  const prototype = Object.getPrototypeOf(input);\n  return prototype === null || Object.getPrototypeOf(prototype) === null;\n}\nfunction isJwkSet(input) {\n  return isObject(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject);\n}\nfunction isDisjoint(...headers) {\n  const parameters = /* @__PURE__ */ new Set();\n  for (const header of headers)\n    if (header)\n      for (const parameter of Object.keys(header)) {\n        if (parameters.has(parameter))\n          return !1;\n        parameters.add(parameter);\n      }\n  return !0;\n}\nfunction assertNotSet(value, name) {\n  if (value !== void 0)\n    throw new TypeError(`${name} can only be called once`);\n}\nfunction decodeBase64url(value, label, ErrorClass) {\n  try {\n    return decode(value);\n  } catch {\n    throw new ErrorClass(`Failed to base64url decode the ${label}`);\n  }\n}\nfunction encodeBase64url(value, label, ErrorClass) {\n  try {\n    return encode(value);\n  } catch {\n    throw new ErrorClass(`The ${label} is not a valid base64url string`);\n  }\n}\nfunction parseJoseHeader(b64, ErrorClass, message) {\n  let parsed;\n  try {\n    parsed = JSON.parse(strictDecoder.decode(decode(b64)));\n  } catch {\n    throw new ErrorClass(message);\n  }\n  if (!isObject(parsed))\n    throw new ErrorClass(message);\n  return parsed;\n}\nconst JWS_RECOGNIZED = { __proto__: null, b64: !0 }, JWE_RECOGNIZED = { __proto__: null };\nfunction validateAlgorithms(option, algorithms) {\n  if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != \"string\")))\n    throw new TypeError(`\"${option}\" option must be an array of strings`);\n  return algorithms === void 0 ? void 0 : new Set(algorithms);\n}\nfunction validateCritDuplicates(Err, protectedHeader) {\n  const { crit } = protectedHeader ?? {};\n  if (Array.isArray(crit) && new Set(crit).size !== crit.length)\n    throw new Err('\"crit\" (Critical) Header Parameter MUST NOT contain duplicate values');\n}\nfunction validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {\n  if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0)\n    throw new Err('\"crit\" (Critical) Header Parameter MUST be integrity protected');\n  if (!protectedHeader || protectedHeader.crit === void 0)\n    return [];\n  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != \"string\" || input.length === 0))\n    throw new Err('\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present');\n  const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };\n  for (const parameter of protectedHeader.crit) {\n    if (!(parameter in recognized))\n      throw new JOSENotSupported(`Extension Header Parameter \"${parameter}\" is not recognized`);\n    if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0)\n      throw new Err(`Extension Header Parameter \"${parameter}\" is missing`);\n    if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0))\n      throw new Err(`Extension Header Parameter \"${parameter}\" MUST be integrity protected`);\n  }\n  return protectedHeader.crit;\n}\nfunction validateB64(protectedHeader, extensions) {\n  if (extensions.includes(\"b64\")) {\n    const b64 = protectedHeader.b64;\n    if (typeof b64 != \"boolean\")\n      throw new JWSInvalid('The \"b64\" (base64url-encode payload) Header Parameter must be a boolean');\n    return b64;\n  }\n  return !0;\n}\nfunction serializeJoseHeader(Err, header) {\n  let serialized, parsed;\n  try {\n    serialized = JSON.stringify(header), parsed = JSON.parse(serialized);\n  } catch (cause) {\n    throw new Err(\"JOSE Header is not valid JSON\", { cause });\n  }\n  if (!isObject(parsed))\n    throw new Err(\"JOSE Header is not a JSON object\");\n  return [parsed, serialized];\n}\nexport {\n  JWE_RECOGNIZED,\n  JWS_RECOGNIZED,\n  assertNotSet,\n  assertUint8Array,\n  decodeBase64url,\n  encodeBase64url,\n  isDisjoint,\n  isJwkSet,\n  isObject,\n  parseJoseHeader,\n  serializeJoseHeader,\n  validateAlgorithms,\n  validateB64,\n  validateCrit,\n  validateCritDuplicates\n};\n","import { isObject } from \"./validate.js\";\nimport { decode } from \"../util/base64url.js\";\nimport { JOSENotSupported } from \"../util/errors.js\";\nconst tag = (key) => key[Symbol.toStringTag], jwkMatchesOp = (entry, key, usage) => {\n  const { alg } = entry;\n  if (key.use !== void 0) {\n    const expected = usage === \"sign\" || usage === \"verify\" ? \"sig\" : \"enc\";\n    if (key.use !== expected)\n      throw new TypeError(`Invalid key for this operation, its \"use\" must be \"${expected}\" when present`);\n  }\n  if (key.alg !== void 0 && key.alg !== alg)\n    throw new TypeError(`Invalid key for this operation, its \"alg\" must be \"${alg}\" when present`);\n  if (Array.isArray(key.key_ops)) {\n    const expectedKeyOp = usage === \"encrypt\" || usage === \"decrypt\" ? entry.ops?.[usage === \"encrypt\" ? 0 : 1] : usage;\n    if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))\n      throw new TypeError(`Invalid key for this operation, its \"key_ops\" must include \"${expectedKeyOp}\" when present`);\n  }\n};\nasync function prepareKey(entry, key, usage) {\n  const { alg, secret } = entry, privateKey = usage === \"decrypt\" || usage === \"sign\";\n  if (secret && key instanceof Uint8Array)\n    return key;\n  let normalized, keyObject;\n  if (isObject(key)) {\n    if (normalized = normalizeJwk(key), typeof normalized.kty != \"string\")\n      throw invalidKeyType(alg, key, secret);\n    if (!(secret ? normalized.kty === \"oct\" && typeof normalized.k == \"string\" : normalized.kty !== \"oct\" && (privateKey ? normalized.kty === \"AKP\" && typeof normalized.priv == \"string\" || typeof normalized.d == \"string\" : normalized.d === void 0 && normalized.priv === void 0)))\n      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? \"private\" : \"public\"} JWK`);\n    if (jwkMatchesOp(entry, normalized, usage), normalized.kty === \"oct\")\n      return decode(normalized.k);\n    if (!Object.isFrozen(key)) {\n      const { key_ops } = key;\n      Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);\n    }\n  } else {\n    if (!isKeyLike(key))\n      throw invalidKeyType(alg, key, secret);\n    const expectedType = secret ? \"secret\" : privateKey ? \"private\" : \"public\";\n    if (key.type !== expectedType && (secret || [\"secret\", \"public\", \"private\"].includes(key.type)))\n      throw new TypeError(`${tag(key)} instances must be of type \"${expectedType}\" for the ${alg} algorithm`);\n    if (isCryptoKey(key))\n      return key;\n    if (keyObject = key, keyObject.type === \"secret\")\n      return keyObject.export();\n  }\n  cache ||= /* @__PURE__ */ new WeakMap();\n  const cacheKey = key;\n  let cached = cache.get(cacheKey);\n  if (cached?.[alg])\n    return cached[alg];\n  if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == \"function\") {\n    const isPublic = keyObject.type === \"public\", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;\n    return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);\n  }\n  return normalized ??= keyObject.export({ format: \"jwk\" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);\n}\nlet cache;\nconst nist = {\n  __proto__: null,\n  prime256v1: \"P-256\",\n  secp384r1: \"P-384\",\n  secp521r1: \"P-521\"\n};\nfunction assertCryptoKey(key) {\n  if (!isCryptoKey(key))\n    throw new Error(\"CryptoKey instance expected\");\n}\nconst isCryptoKey = (key) => {\n  if (key?.[Symbol.toStringTag] === \"CryptoKey\")\n    return !0;\n  try {\n    return key instanceof CryptoKey;\n  } catch {\n    return !1;\n  }\n}, isKeyObject = (key) => key?.[Symbol.toStringTag] === \"KeyObject\", isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);\nfunction message(msg, actual, ...types) {\n  if (types.length > 2) {\n    const last = types.pop();\n    msg += `one of type ${types.join(\", \")}, or ${last}.`;\n  } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;\n  return actual == null ? msg += ` Received ${actual}` : typeof actual == \"function\" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == \"object\" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;\n}\nconst invalidKeyInput = (actual, ...types) => message(\"Key must be \", actual, ...types);\nfunction invalidKeyType(alg, actual, secret) {\n  const types = [\"CryptoKey\", \"KeyObject\", \"JSON Web Key\"];\n  return secret && types.push(\"Uint8Array\"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));\n}\nconst unusable = (name, prop = \"algorithm.name\") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);\nfunction checkUsage(key, usage) {\n  if (usage && !key.usages.includes(usage))\n    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);\n}\nfunction checkModulusLength(alg, key) {\n  const { modulusLength } = key.algorithm;\n  if (typeof modulusLength != \"number\" || modulusLength < 2048)\n    throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);\n}\nfunction checkCryptoKey(key, expected, usage) {\n  const algorithm = key.algorithm;\n  if (algorithm.name !== expected.name)\n    throw unusable(expected.name);\n  if (expected.hash && algorithm.hash?.name !== expected.hash)\n    throw unusable(expected.hash, \"algorithm.hash\");\n  if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)\n    throw unusable(expected.namedCurve, \"algorithm.namedCurve\");\n  if (expected.length !== void 0 && algorithm.length !== expected.length)\n    throw unusable(expected.length, \"algorithm.length\");\n  checkUsage(key, usage);\n}\nfunction snapshotJwk(jwk) {\n  return { __proto__: null, ...jwk };\n}\nfunction normalizeJwk(jwk) {\n  const normalized = snapshotJwk(jwk);\n  if (normalized.ext !== void 0 && typeof normalized.ext != \"boolean\")\n    throw new TypeError('\"ext\" (Extractable) Parameter must be a boolean');\n  if (normalized.key_ops !== void 0) {\n    const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;\n    if (!keyOps || keyOps.some((operation) => typeof operation != \"string\") || new Set(keyOps).size !== keyOps.length)\n      throw new TypeError('\"key_ops\" (Key Operations) Parameter must be an array of unique strings');\n    normalized.key_ops = keyOps;\n  }\n  return normalized;\n}\nfunction validateExtractableOption(extractable) {\n  if (extractable !== void 0 && typeof extractable != \"boolean\")\n    throw new TypeError('\"extractable\" option must be a boolean');\n  return extractable;\n}\nasync function jwkToKey(entry, jwk, extractable) {\n  if (!entry.kty.includes(jwk.kty))\n    throw new JOSENotSupported('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');\n  const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };\n  return keyData.kty !== \"AKP\" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey(\"jwk\", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);\n}\nasync function rawKey(key, expected, usage, extractable = !1) {\n  return key instanceof Uint8Array && (key = await crypto.subtle.importKey(\"raw\", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;\n}\nexport {\n  assertCryptoKey,\n  checkCryptoKey,\n  checkModulusLength,\n  checkUsage,\n  invalidKeyInput,\n  isCryptoKey,\n  isKeyLike,\n  isKeyObject,\n  jwkToKey,\n  normalizeJwk,\n  prepareKey,\n  rawKey,\n  snapshotJwk,\n  validateExtractableOption\n};\n","function table(entries) {\n  const out = { __proto__: null };\n  for (const alg in entries)\n    out[alg] = { ...entries[alg], alg };\n  return out;\n}\nexport {\n  table\n};\n","import { JOSENotSupported } from \"../util/errors.js\";\nimport { table } from \"./key_descriptor.js\";\nconst sig = [[\"verify\"], [\"sign\"]];\nfunction hmac(bits) {\n  const subtle = { name: \"HMAC\", hash: `SHA-${bits}` };\n  return { kty: [\"oct\"], secret: !0, subtle, signing: subtle, usages: sig };\n}\nfunction rsa(bits, saltLength) {\n  const subtle = { name: saltLength ? \"RSA-PSS\" : \"RSASSA-PKCS1-v1_5\", hash: `SHA-${bits}` };\n  return {\n    kty: [\"RSA\"],\n    subtle,\n    signing: saltLength ? { ...subtle, saltLength } : subtle,\n    usages: sig,\n    minRsaBits: 2048\n  };\n}\nfunction ecdsa(crv, bits) {\n  return {\n    kty: [\"EC\"],\n    crv,\n    subtle: { name: \"ECDSA\", namedCurve: crv },\n    signing: { name: \"ECDSA\", hash: `SHA-${bits}` },\n    usages: sig\n  };\n}\nfunction eddsa() {\n  const subtle = { name: \"Ed25519\" };\n  return {\n    kty: [\"OKP\"],\n    crv: \"Ed25519\",\n    subtle,\n    signing: subtle,\n    usages: sig\n  };\n}\nfunction mldsa(bits) {\n  const subtle = { name: `ML-DSA-${bits}` };\n  return {\n    kty: [\"AKP\"],\n    subtle,\n    signing: subtle,\n    usages: sig\n  };\n}\nconst JWS = table({\n  HS256: hmac(256),\n  HS384: hmac(384),\n  HS512: hmac(512),\n  RS256: rsa(256),\n  RS384: rsa(384),\n  RS512: rsa(512),\n  PS256: rsa(256, 32),\n  PS384: rsa(384, 48),\n  PS512: rsa(512, 64),\n  ES256: ecdsa(\"P-256\", 256),\n  ES384: ecdsa(\"P-384\", 384),\n  ES512: ecdsa(\"P-521\", 512),\n  EdDSA: eddsa(),\n  Ed25519: eddsa(),\n  \"ML-DSA-44\": mldsa(44),\n  \"ML-DSA-65\": mldsa(65),\n  \"ML-DSA-87\": mldsa(87)\n});\nfunction jwsAlgorithm(alg) {\n  const entry = typeof alg == \"string\" ? JWS[alg] : void 0;\n  if (!entry)\n    throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);\n  return entry;\n}\nexport {\n  JWS,\n  jwsAlgorithm\n};\n","import { jwsAlgorithm } from \"./jws_algorithms.js\";\nimport { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from \"../util/errors.js\";\nimport { concat, decoder, encoder, encode } from \"./buffer_utils.js\";\nimport { decodeBase64url, encodeBase64url, parseJoseHeader, isDisjoint, isObject, validateB64, validateCrit, validateAlgorithms, JWS_RECOGNIZED } from \"./validate.js\";\nimport { prepareKey, rawKey, checkModulusLength } from \"./key.js\";\nfunction snapshotJws(jws, sharedPayload) {\n  const encodedProtected = jws.protected, inputHeader = jws.header, header = isObject(inputHeader) ? { ...inputHeader } : inputHeader;\n  let payload = sharedPayload ? sharedPayload[0] : jws.payload;\n  !sharedPayload && payload instanceof Uint8Array && (payload = new Uint8Array(payload));\n  const signature = jws.signature, snapshot = { payload, signature };\n  if (encodedProtected !== void 0 && (snapshot.protected = encodedProtected), inputHeader !== void 0 && (snapshot.header = header), encodedProtected === void 0 && header === void 0)\n    throw new JWSInvalid('Flattened JWS must have either of the \"protected\" or \"header\" members');\n  if (encodedProtected !== void 0 && typeof encodedProtected != \"string\")\n    throw new JWSInvalid(\"JWS Protected Header incorrect type\");\n  if (payload === void 0)\n    throw new JWSInvalid(\"JWS Payload missing\");\n  if (typeof signature != \"string\")\n    throw new JWSInvalid(\"JWS Signature missing or incorrect type\");\n  if (header !== void 0 && !isObject(header))\n    throw new JWSInvalid(\"JWS Unprotected Header incorrect type\");\n  return snapshot;\n}\nfunction prepareVerify(options) {\n  return [options && validateAlgorithms(\"algorithms\", options.algorithms), options?.crit];\n}\nfunction parseProtectedHeader(encodedProtected) {\n  return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, \"JWS Protected Header is invalid\");\n}\nfunction encodeJsonUnencodedPayload(payload) {\n  const invalid = /[\\p{Cs}\\p{Cn}]/u.exec(payload)?.[0];\n  if (invalid !== void 0)\n    throw new JWSInvalid(/\\p{Cs}/u.test(invalid) ? \"JWS Payload must be a well-formed Unicode string\" : \"JWS Payload must not contain unassigned Unicode code points\");\n  return encoder.encode(payload);\n}\nfunction encodeCompactUnencodedPayload(payload) {\n  try {\n    return encode(payload);\n  } catch {\n    throw new JWSInvalid(\"JWS Compact Serialization payload must use only ASCII characters\");\n  }\n}\nasync function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {\n  const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);\n  if (!isDisjoint(parsedProt, header))\n    throw new JWSInvalid(\"JWS Protected and JWS Unprotected Header Parameter names must be disjoint\");\n  const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;\n  if (typeof alg != \"string\" || !alg)\n    throw new JWSInvalid('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');\n  if (shared[0] && !shared[0].has(alg))\n    throw new JOSEAlgNotAllowed('\"alg\" (Algorithm) Header Parameter value not allowed');\n  if (b64) {\n    if (typeof inputPayload != \"string\")\n      throw new JWSInvalid(\"JWS Payload must be a string\");\n  } else if (typeof inputPayload != \"string\" && !(inputPayload instanceof Uint8Array))\n    throw new JWSInvalid(\"JWS Payload must be a string or an Uint8Array instance\");\n  const signingPayload = b64 || typeof inputPayload != \"string\" ? inputPayload : encodeUnencodedPayload(inputPayload);\n  let resolvedKey = !1;\n  typeof key == \"function\" && (key = await key(parsedProt, jws), resolvedKey = !0);\n  const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode(\".\"), typeof signingPayload == \"string\" ? shared[2] ??= encodeBase64url(signingPayload, \"payload\", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, \"signature\", JWSInvalid), k = await prepareKey(entry, key, \"verify\"), cryptoKey = await rawKey(k, entry.subtle, \"verify\");\n  entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);\n  let verified = !1;\n  try {\n    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);\n  } catch {\n  }\n  if (!verified)\n    throw new JWSSignatureVerificationFailed();\n  const result = { payload: typeof signingPayload == \"string\" ? decodeBase64url(signingPayload, \"payload\", JWSInvalid) : signingPayload };\n  return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];\n}\nasync function verifyCompact(jws, shared, key) {\n  if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != \"string\")\n    throw new JWSInvalid(\"Compact JWS must be a string or Uint8Array\");\n  const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(\".\");\n  if (length !== 3)\n    throw new JWSInvalid(\"Invalid Compact JWS\");\n  return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);\n}\nexport {\n  encodeJsonUnencodedPayload,\n  parseProtectedHeader,\n  prepareVerify,\n  snapshotJws,\n  verifyCompact,\n  verifySignature\n};\n","import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from \"../util/errors.js\";\nimport { encoder, strictDecoder } from \"./buffer_utils.js\";\nimport { isObject } from \"./validate.js\";\nconst epoch = (date) => Math.floor(date.getTime() / 1e3), multipliers = {\n  s: 1,\n  m: 60,\n  h: 3600,\n  d: 86400,\n  w: 604800,\n  y: 31557600\n}, REGEX = /^(\\+|\\-)? ?(\\d+|\\d+\\.\\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i, checkFailed = \"check_failed\";\nfunction invalidDuration() {\n  throw new TypeError(\"Invalid time period format\");\n}\nfunction secs(str) {\n  typeof str != \"string\" && invalidDuration();\n  const matched = REGEX.exec(str);\n  (!matched || matched[4] && matched[1]) && invalidDuration();\n  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);\n  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === \"-\" || matched[4] === \"ago\" ? -numericDate2 : numericDate2;\n}\nfunction validateInput(label, input) {\n  if (!Number.isFinite(input))\n    throw new TypeError(`Invalid ${label} input`);\n  return input;\n}\nfunction validateStringClaim(claim, value) {\n  if (typeof value != \"string\")\n    throw new TypeError(`\"${claim}\" claim must be a string`);\n}\nfunction validateAudienceClaim(value) {\n  if (typeof value != \"string\" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member != \"string\")))\n    throw new TypeError('\"aud\" claim must be a string or an array of strings');\n}\nfunction numericDate(value, label) {\n  return typeof value == \"number\" ? validateInput(label, value) : value instanceof Date ? validateInput(label, epoch(value)) : epoch(/* @__PURE__ */ new Date()) + secs(value);\n}\nconst normalizeTyp = (value) => {\n  const normalized = value.toLowerCase();\n  return value.includes(\"/\") ? normalized : `application/${normalized}`;\n}, checkAudiencePresence = (audPayload, audOption) => typeof audPayload == \"string\" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : !1;\nfunction validateNumericDate(payload, claim, required = !1) {\n  const value = payload[claim];\n  if (!(value === void 0 && !required)) {\n    if (typeof value != \"number\")\n      throw new JWTClaimValidationFailed(`\"${claim}\" claim must be a number`, payload, claim, \"invalid\");\n    return value;\n  }\n}\nfunction unexpectedClaim(payload, claim) {\n  throw new JWTClaimValidationFailed(`unexpected \"${claim}\" claim value`, payload, claim, checkFailed);\n}\nfunction validateClaimsSet(protectedHeader, encodedPayload, options = {}) {\n  let payload;\n  try {\n    payload = JSON.parse(strictDecoder.decode(encodedPayload));\n  } catch {\n  }\n  if (!isObject(payload))\n    throw new JWTInvalid(\"JWT Claims Set must be a top-level JSON object\");\n  const { typ } = options;\n  if (typ !== void 0 && (typeof protectedHeader.typ != \"string\" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))\n    throw new JWTClaimValidationFailed('unexpected \"typ\" JWT header value', payload, \"typ\", checkFailed);\n  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];\n  maxTokenAge !== void 0 && presenceCheck.push(\"iat\"), audience !== void 0 && presenceCheck.push(\"aud\"), subject !== void 0 && presenceCheck.push(\"sub\"), issuer !== void 0 && presenceCheck.push(\"iss\");\n  for (const claim of new Set(presenceCheck.reverse()))\n    if (!Object.hasOwn(payload, claim))\n      throw new JWTClaimValidationFailed(`missing required \"${claim}\" claim`, payload, claim, \"missing\");\n  issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, \"iss\"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, \"sub\"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == \"string\" ? [audience] : audience) && unexpectedClaim(payload, \"aud\");\n  const { clockTolerance } = options;\n  let tolerance = 0;\n  if (typeof clockTolerance == \"string\")\n    tolerance = secs(clockTolerance);\n  else if (clockTolerance !== void 0) {\n    if (typeof clockTolerance != \"number\")\n      throw new TypeError(\"Invalid clockTolerance option type\");\n    tolerance = clockTolerance;\n  }\n  validateInput(\"clockTolerance option\", tolerance);\n  const { currentDate } = options, now = validateInput(\"currentDate option\", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, \"iat\", maxTokenAge !== void 0), nbf = validateNumericDate(payload, \"nbf\");\n  if (nbf !== void 0 && nbf > now + tolerance)\n    throw new JWTClaimValidationFailed('\"nbf\" claim timestamp check failed', payload, \"nbf\", checkFailed);\n  const exp = validateNumericDate(payload, \"exp\");\n  if (exp !== void 0 && exp <= now - tolerance)\n    throw new JWTExpired('\"exp\" claim timestamp check failed', payload, \"exp\", checkFailed);\n  if (maxTokenAge !== void 0) {\n    const age = now - iat, max = validateInput(\"maxTokenAge option\", typeof maxTokenAge == \"number\" ? maxTokenAge : secs(maxTokenAge));\n    if (age - tolerance > max)\n      throw new JWTExpired('\"iat\" claim timestamp check failed (too far in the past)', payload, \"iat\", checkFailed);\n    if (age < -tolerance)\n      throw new JWTClaimValidationFailed('\"iat\" claim timestamp check failed (it should be in the past)', payload, \"iat\", checkFailed);\n  }\n  return payload;\n}\nlet producerPayloads;\nfunction producerPayload(producer) {\n  return producerPayloads.get(producer);\n}\nfunction jwtData(producer) {\n  const payload = producerPayload(producer);\n  for (const claim of [\"iat\", \"nbf\", \"exp\"]) {\n    const value = payload[claim];\n    if (typeof value == \"number\" && !Number.isFinite(value))\n      throw new TypeError(`\"${claim}\" claim must be a finite number`);\n  }\n  return encoder.encode(JSON.stringify(payload));\n}\nfunction jwtClaim(producer, claim) {\n  return producerPayload(producer)[claim];\n}\nclass JWTClaimsBuilder {\n  constructor(payload = {}) {\n    if (!isObject(payload))\n      throw new TypeError(\"JWT Claims Set MUST be an object\");\n    (producerPayloads ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(payload));\n  }\n  setIssuer(value) {\n    return validateStringClaim(\"iss\", value), producerPayload(this).iss = value, this;\n  }\n  setSubject(value) {\n    return validateStringClaim(\"sub\", value), producerPayload(this).sub = value, this;\n  }\n  setAudience(value) {\n    return validateAudienceClaim(value), producerPayload(this).aud = value, this;\n  }\n  setJti(value) {\n    return validateStringClaim(\"jti\", value), producerPayload(this).jti = value, this;\n  }\n  setNotBefore(value) {\n    return producerPayload(this).nbf = numericDate(value, \"setNotBefore\"), this;\n  }\n  setExpirationTime(value) {\n    return producerPayload(this).exp = numericDate(value, \"setExpirationTime\"), this;\n  }\n  setIssuedAt(value) {\n    const payload = producerPayload(this);\n    return value === void 0 ? payload.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == \"string\" ? payload.iat = validateInput(\"setIssuedAt\", epoch(/* @__PURE__ */ new Date()) + secs(value)) : payload.iat = numericDate(value, \"setIssuedAt\"), this;\n  }\n}\nexport {\n  JWTClaimsBuilder,\n  jwtClaim,\n  jwtData,\n  secs,\n  validateClaimsSet\n};\n","import { prepareVerify, verifyCompact } from \"../lib/jws_verify.js\";\nimport { validateClaimsSet } from \"../lib/jwt_claims_set.js\";\nimport { JWTInvalid } from \"../util/errors.js\";\nasync function jwtVerify(jwt, key, options) {\n  const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);\n  if (!b64)\n    throw new JWTInvalid(\"JWTs MUST NOT use unencoded payload\");\n  const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);\n  return { ...verified, payload };\n}\nexport {\n  jwtVerify\n};\n","import { jwkToKey, snapshotJwk } from \"../lib/key.js\";\nimport { JWS } from \"../lib/jws_algorithms.js\";\nimport { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys } from \"../util/errors.js\";\nimport { isJwkSet } from \"../lib/validate.js\";\nfunction isUsableJWK(jwk, entry, alg, kid) {\n  const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;\n  return (ext === void 0 || typeof ext == \"boolean\") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == \"string\" && keyOps.indexOf(operation) === index) && keyOps.includes(\"verify\")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == \"string\" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== \"AKP\" : alg === jwkAlg) && (use === void 0 || use === \"sig\") && (!entry.crv || crv === entry.crv);\n}\nasync function importWithAlgCache(cache, jwk, entry) {\n  const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk), { alg } = entry;\n  if (cached[alg] === void 0) {\n    const pending = jwkToKey(entry, jwk, !0).then((key) => {\n      if (key.type !== \"public\")\n        throw new JWKSInvalid(\"JSON Web Key Set members must be public keys\");\n      return cached[alg] = key, key;\n    }).catch((error) => {\n      throw cached[alg] === pending && delete cached[alg], error;\n    });\n    cached[alg] = pending;\n  }\n  return cached[alg];\n}\nfunction createLocalJWKSet(jwks) {\n  let snapshot;\n  try {\n    snapshot = structuredClone(jwks);\n  } catch {\n  }\n  if (!isJwkSet(snapshot))\n    throw new JWKSInvalid(\"JSON Web Key Set malformed\");\n  const metadata = snapshot.keys.map((jwk) => {\n    const normalized = snapshotJwk(jwk);\n    return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;\n  }), cached = /* @__PURE__ */ new WeakMap();\n  return Object.defineProperty(async (protectedHeader, token) => {\n    const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == \"string\" ? JWS[alg] : void 0;\n    if (!entry || entry.secret)\n      throw new JOSENotSupported('Unsupported \"alg\" value for a JSON Web Key Set');\n    const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;\n    if (!length)\n      throw new JWKSNoMatchingKey();\n    if (length !== 1) {\n      const error = new JWKSMultipleMatchingKeys();\n      throw error[Symbol.asyncIterator] = async function* () {\n        for (const jwk2 of candidates)\n          try {\n            yield await importWithAlgCache(cached, jwk2, entry);\n          } catch {\n          }\n      }, error;\n    }\n    return importWithAlgCache(cached, jwk, entry);\n  }, \"jwks\", {\n    value: () => structuredClone(snapshot)\n  });\n}\nexport {\n  createLocalJWKSet\n};\n","import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from \"../util/errors.js\";\nimport { createLocalJWKSet } from \"./local.js\";\nimport { isJwkSet } from \"../lib/validate.js\";\nfunction isCloudflareWorkers() {\n  return typeof WebSocketPair < \"u\" || typeof navigator < \"u\" && navigator.userAgent === \"Cloudflare-Workers\" || typeof EdgeRuntime < \"u\" && EdgeRuntime === \"vercel\";\n}\nlet USER_AGENT;\n(typeof navigator > \"u\" || !navigator.userAgent?.startsWith?.(\"Mozilla/5.0 \")) && (USER_AGENT = \"jose/v6.2.12\");\nconst customFetch = /* @__PURE__ */ Symbol();\nasync function fetchJwks(url, headers, signal, fetchImpl = fetch) {\n  const response = await fetchImpl(url, {\n    method: \"GET\",\n    signal,\n    redirect: \"manual\",\n    headers\n  }).catch((err) => {\n    throw err.name === \"TimeoutError\" ? new JWKSTimeout() : err;\n  });\n  if (response.status !== 200)\n    throw new JOSEError(\"Expected 200 OK from the JSON Web Key Set HTTP response\");\n  try {\n    return await response.json();\n  } catch {\n    throw new JOSEError(\"Failed to parse the JSON Web Key Set HTTP response as JSON\");\n  }\n}\nconst jwksCache = /* @__PURE__ */ Symbol();\nfunction isFreshFor(timestamp, duration) {\n  return Number.isFinite(timestamp) && Date.now() < timestamp + duration;\n}\nfunction validateDuration(value, fallback, option) {\n  if (Number.isNaN(value))\n    throw new TypeError(`\"${option}\" option must not be NaN`);\n  return typeof value == \"number\" ? value : fallback;\n}\nfunction createRemoteJWKSet(url, options) {\n  if (!(url instanceof URL))\n    throw new TypeError(\"url must be an instance of URL\");\n  const href = new URL(url.href).href, opts = options ?? {}, timeoutOption = opts.timeoutDuration;\n  if (typeof timeoutOption == \"number\" && (!Number.isInteger(timeoutOption) || timeoutOption < 0))\n    throw new TypeError('\"timeoutDuration\" option must be a non-negative integer');\n  const timeoutDuration = typeof timeoutOption == \"number\" ? timeoutOption : 5e3, cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, \"cooldownDuration\"), cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, \"cacheMaxAge\"), headers = new Headers(opts.headers);\n  USER_AGENT && !headers.has(\"User-Agent\") && headers.set(\"User-Agent\", USER_AGENT), headers.has(\"accept\") || headers.set(\"accept\", \"application/json, application/jwk-set+json\");\n  const fetchImpl = opts[customFetch], cache = opts[jwksCache];\n  let jwksTimestamp, pendingFetch, reloadSequence = 0, appliedSequence = 0, local;\n  if (cache && typeof cache == \"object\") {\n    const { uat, jwks } = cache;\n    isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks) && (jwksTimestamp = uat, local = createLocalJWKSet(jwks));\n  }\n  const reload = async () => {\n    if (pendingFetch && isCloudflareWorkers() && (pendingFetch = void 0), !pendingFetch) {\n      const sequence = ++reloadSequence, current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {\n        const next = createLocalJWKSet(json);\n        if (sequence <= appliedSequence)\n          return;\n        local = next;\n        const updatedAt = Date.now();\n        cache && (cache.uat = updatedAt, cache.jwks = json), jwksTimestamp = updatedAt, appliedSequence = sequence;\n      }).finally(() => {\n        pendingFetch === current && (pendingFetch = void 0);\n      });\n    }\n    await pendingFetch;\n  };\n  return Object.defineProperties(async (protectedHeader, token) => {\n    (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) && await reload();\n    try {\n      return await local(protectedHeader, token);\n    } catch (err) {\n      if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration))\n        return await reload(), local(protectedHeader, token);\n      throw err;\n    }\n  }, {\n    coolingDown: {\n      get: () => isFreshFor(jwksTimestamp, cooldownDuration),\n      enumerable: !0\n    },\n    fresh: {\n      get: () => isFreshFor(jwksTimestamp, cacheMaxAge),\n      enumerable: !0\n    },\n    reload: {\n      value: reload,\n      enumerable: !0\n    },\n    reloading: {\n      get: () => !!pendingFetch,\n      enumerable: !0\n    },\n    jwks: {\n      value: () => local?.jwks(),\n      enumerable: !0\n    }\n  });\n}\nexport {\n  createRemoteJWKSet,\n  customFetch,\n  jwksCache\n};\n","/** Server-only OAuth protected-resource boundary. This is not an issuer. */\nimport { createRemoteJWKSet, type JWTPayload, jwtVerify } from 'jose';\nimport type { McpAppPrincipal } from './server.js';\n\nexport type McpDeploymentProfile = 'local' | 'self-hosted' | 'cloud';\nexport interface McpVerifiedIdentity {\n  readonly issuer: string;\n  readonly subject: string;\n  readonly scopes: readonly string[];\n  readonly claims: Readonly<JWTPayload>;\n}\nexport interface McpPrincipalMapping {\n  id: string;\n  tenantId?: string;\n  kind?: string;\n  roles?: string[];\n}\nexport interface McpResourceAuthOptions {\n  profile: McpDeploymentProfile;\n  /** Exact public resource identifier; also the required token audience. */\n  resource: string;\n  /** Exact issuer identifier, including any trailing slash. */\n  issuer: string;\n  /** Operator-configured signing keys. Never derived from an untrusted token. */\n  jwksUri: string;\n  scopes: readonly string[];\n  algorithms: readonly ('RS256' | 'ES256')[];\n  /** Default at+jwt. Select JWT only for a provider that uses it for access tokens. */\n  tokenType?: 'at+jwt' | 'JWT';\n  /** Default true. Set false only for an explicitly single-tenant application. */\n  requireTenant?: boolean;\n  /** Re-run for every request; return null for revoked/disabled/unmapped users.\n   * Resolve active tenant/membership in trusted application state, never request\n   * arguments. Provider JWT revocation is NOT detected by offline validation.\n   */\n  resolvePrincipal(\n    identity: McpVerifiedIdentity,\n  ): Promise<McpPrincipalMapping | null>;\n}\n\nconst scopePattern = /^[\\x21\\x23-\\x5b\\x5d-\\x7e]+$/u;\nfunction validateUrl(value: string, profile: McpDeploymentProfile): URL {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error('Invalid MCP authorization URL.');\n  }\n  const loopback = ['127.0.0.1', '[::1]', 'localhost'].includes(url.hostname);\n  if (\n    url.username ||\n    url.password ||\n    url.search ||\n    url.hash ||\n    /[\\s\"\\\\]/u.test(value) ||\n    (profile === 'local'\n      ? !loopback || !['http:', 'https:'].includes(url.protocol)\n      : url.protocol !== 'https:')\n  )\n    throw new Error('Invalid MCP authorization URL for deployment profile.');\n  return url;\n}\nfunction validString(value: unknown): value is string {\n  return (\n    typeof value === 'string' &&\n    value.length > 0 &&\n    value.length <= 1024 &&\n    value.trim() === value &&\n    [...value].every(\n      (character) =>\n        character.charCodeAt(0) > 31 && character.charCodeAt(0) !== 127,\n    )\n  );\n}\n\nexport interface McpResourceAuth {\n  /** Mount GET at this URL. Paths use RFC 9728's well-known path insertion. */\n  readonly metadataUrl: string;\n  metadataResponse(): Response;\n  /** A failure response contains no token, claims or upstream error details. */\n  authenticate(\n    request: Request,\n  ): Promise<\n    | { ok: true; principal: McpAppPrincipal & { id: string } }\n    | { ok: false; response: Response }\n  >;\n}\n\nexport function createMcpResourceAuth(\n  options: McpResourceAuthOptions,\n): McpResourceAuth {\n  if (!['local', 'self-hosted', 'cloud'].includes(options.profile)) {\n    throw new Error('Unknown MCP deployment profile.');\n  }\n  const resourceUrl = validateUrl(options.resource, options.profile);\n  validateUrl(options.issuer, options.profile);\n  validateUrl(options.jwksUri, options.profile);\n  if (\n    !options.algorithms.length ||\n    options.algorithms.some((alg) => !['RS256', 'ES256'].includes(alg))\n  ) {\n    throw new Error('Explicit asymmetric MCP token algorithms are required.');\n  }\n  if (options.scopes.some((scope) => !scopePattern.test(scope))) {\n    throw new Error('Invalid MCP OAuth scope.');\n  }\n  if (\n    options.tokenType !== undefined &&\n    !['at+jwt', 'JWT'].includes(options.tokenType)\n  ) {\n    throw new Error('Unsupported MCP access-token type.');\n  }\n  // Snapshot configuration so later caller mutation cannot broaden authority.\n  const issuer = options.issuer;\n  const resource = options.resource;\n  const scopes = [...new Set(options.scopes)];\n  const algorithms = [...options.algorithms];\n  const tokenType = options.tokenType ?? 'at+jwt';\n  const requireTenant = options.requireTenant !== false;\n  const resolvePrincipal = options.resolvePrincipal;\n  const keys = createRemoteJWKSet(new URL(options.jwksUri), {\n    timeoutDuration: 5000,\n  });\n  const metadataUrl = `${resourceUrl.origin}/.well-known/oauth-protected-resource${resourceUrl.pathname === '/' ? '' : resourceUrl.pathname}`;\n  function deny(error?: 'invalid_token' | 'insufficient_scope'): {\n    ok: false;\n    response: Response;\n  } {\n    const challenge = [\n      `Bearer resource_metadata=\"${metadataUrl}\"`,\n      ...(scopes.length ? [`scope=\"${scopes.join(' ')}\"`] : []),\n      ...(error ? [`error=\"${error}\"`] : []),\n    ].join(', ');\n    return {\n      ok: false,\n      response: new Response(null, {\n        status: error === 'insufficient_scope' ? 403 : 401,\n        headers: { 'WWW-Authenticate': challenge, 'Cache-Control': 'no-store' },\n      }),\n    };\n  }\n  return {\n    metadataUrl,\n    metadataResponse: () =>\n      Response.json(\n        {\n          resource,\n          authorization_servers: [issuer],\n          scopes_supported: scopes,\n          bearer_methods_supported: ['header'],\n        },\n        { headers: { 'Cache-Control': 'no-store' } },\n      ),\n    async authenticate(request) {\n      const authorization = request.headers.get('authorization');\n      if (!authorization) return deny();\n      const match =\n        /^Bearer +([A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+)$/iu.exec(\n          authorization,\n        );\n      if (!match) return deny('invalid_token');\n      try {\n        const { payload } = await jwtVerify(match[1], keys, {\n          issuer,\n          audience: resource,\n          algorithms,\n          typ: tokenType,\n          requiredClaims: ['iss', 'aud', 'sub', 'exp'],\n          clockTolerance: 0,\n        });\n        if (!validString(payload.sub) || typeof payload.scope !== 'string')\n          return deny('invalid_token');\n        const granted = payload.scope === '' ? [] : payload.scope.split(' ');\n        if (granted.some((scope) => !scopePattern.test(scope)))\n          return deny('invalid_token');\n        if (scopes.some((scope) => !granted.includes(scope)))\n          return deny('insufficient_scope');\n        const mapping = await resolvePrincipal(\n          Object.freeze({\n            issuer,\n            subject: payload.sub,\n            scopes: Object.freeze([...granted]),\n            claims: Object.freeze(payload),\n          }),\n        );\n        if (\n          !mapping ||\n          !validString(mapping.id) ||\n          (requireTenant && !validString(mapping.tenantId)) ||\n          (mapping.tenantId !== undefined && !validString(mapping.tenantId)) ||\n          (mapping.kind !== undefined && !validString(mapping.kind)) ||\n          (mapping.roles !== undefined &&\n            (!Array.isArray(mapping.roles) ||\n              !mapping.roles.every(validString)))\n        ) {\n          return deny('invalid_token');\n        }\n        return {\n          ok: true,\n          principal: {\n            id: mapping.id,\n            tenantId: mapping.tenantId,\n            kind: mapping.kind,\n            roles: mapping.roles ? [...mapping.roles] : undefined,\n            scopes: [...granted],\n          },\n        };\n      } catch {\n        return deny('invalid_token');\n      }\n    },\n  };\n}\n"],"x_google_ignoreList":[0,1,2,3,4,5,6,7,8,9,10,11],"mappings":";AAAA,IAAM,UAAU,IAAI,YAAY,GAAG,UAAU,IAAI,YAAY,GAAG,gBAAgB,IAAI,YAAY,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;AACtH,SAAS,OAAO,GAAG,SAAS;CAC1B,MAAM,OAAO,QAAQ,QAAQ,KAAK,EAAE,aAAa,MAAM,QAAQ,CAAC,GAAG,MAAM,IAAI,WAAW,IAAI;CAC5F,IAAI,IAAI;CACR,KAAK,MAAM,UAAU,SACnB,IAAI,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO;CAClC,OAAO;AACT;AAcA,IAAM,YAAY;AAClB,SAAS,OAAO,QAAQ;CACtB,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK;EACrD,IAAI,UAAU,KAAK,MAAM,GACvB,MAAM,IAAI,UAAU,0CAA0C;EAChE,OAAO,QAAQ,OAAO,MAAM;CAC9B;CACA,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;CAC1C,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;EACtC,MAAM,OAAO,OAAO,WAAW,CAAC;EAChC,IAAI,OAAO,KACT,MAAM,IAAI,UAAU,0CAA0C;EAChE,MAAM,KAAK;CACb;CACA,OAAO;AACT;AAUA,SAAS,aAAa,SAAS,MAAM,CAAC,GAAG;CACvC,IAAI,WAAW,YACb,OAAO,WAAW,WAAW,SAAS,EAAE,UAAU,MAAM,cAAc,SAAS,CAAC;CAClF,IAAI,KAAK;EACP,IAAI,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,GAC/C,MAAM,IAAI,UAAU,mBAAmB;EACzC,UAAU,QAAQ,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;CACxD;CACA,MAAM,SAAS,KAAK,OAAO,GAAG,QAAQ,IAAI,WAAW,OAAO,MAAM;CAClE,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KACjC,MAAM,KAAK,OAAO,WAAW,CAAC;CAChC,OAAO;AACT;;;AC1DA,IAAM,YAAN,cAAwB,MAAM;CAC5B,OAAO,OAAO;CACd,OAAO;CACP,YAAY,SAAS,SAAS;EAC5B,MAAM,SAAS,OAAO,GAAG,KAAK,OAAO,KAAK,YAAY,MAAM,MAAM,oBAAoB,MAAM,KAAK,WAAW;CAC9G;AACF;AACA,IAAM,2BAAN,cAAuC,UAAU;CAC/C,OAAO,OAAO;CACd,OAAO;CACP;CACA;CACA;CACA,YAAY,SAAS,SAAS,QAAQ,eAAe,SAAS,eAAe;EAC3E,MAAM,SAAS,EAAE,OAAO;GAAE;GAAO;GAAQ;EAAQ,EAAE,CAAC,GAAG,KAAK,QAAQ,OAAO,KAAK,SAAS,QAAQ,KAAK,UAAU;CAClH;AACF;AACA,IAAM,aAAN,cAAyB,UAAU;CACjC,OAAO,OAAO;CACd,OAAO;CACP;CACA;CACA;CACA,YAAY,SAAS,SAAS,QAAQ,eAAe,SAAS,eAAe;EAC3E,MAAM,SAAS,EAAE,OAAO;GAAE;GAAO;GAAQ;EAAQ,EAAE,CAAC,GAAG,KAAK,QAAQ,OAAO,KAAK,SAAS,QAAQ,KAAK,UAAU;CAClH;AACF;AACA,IAAM,oBAAN,cAAgC,UAAU;CACxC,OAAO,OAAO;CACd,OAAO;AACT;AACA,IAAM,mBAAN,cAA+B,UAAU;CACvC,OAAO,OAAO;CACd,OAAO;AACT;AAYA,IAAM,aAAN,cAAyB,UAAU;CACjC,OAAO,OAAO;CACd,OAAO;AACT;AACA,IAAM,aAAN,cAAyB,UAAU;CACjC,OAAO,OAAO;CACd,OAAO;AACT;AAKA,IAAM,cAAN,cAA0B,UAAU;CAClC,OAAO,OAAO;CACd,OAAO;AACT;AACA,IAAM,oBAAN,cAAgC,UAAU;CACxC,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,mDAAmD,SAAS;EAChF,MAAM,SAAS,OAAO;CACxB;AACF;AACA,IAAM,2BAAN,cAAuC,UAAU;CAC/C,CAAC,OAAO,iBAAiB,mBAAmB,CAC5C;CACA,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,wDAAwD,SAAS;EACrF,MAAM,SAAS,OAAO;CACxB;AACF;AACA,IAAM,cAAN,cAA0B,UAAU;CAClC,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,qBAAqB,SAAS;EAClD,MAAM,SAAS,OAAO;CACxB;AACF;AACA,IAAM,iCAAN,cAA6C,UAAU;CACrD,OAAO,OAAO;CACd,OAAO;CACP,YAAY,UAAU,iCAAiC,SAAS;EAC9D,MAAM,SAAS,OAAO;CACxB;AACF;;;AC1FA,IAAM,UAAU;AAChB,SAAS,OAAO,OAAO;CACrB,IAAI;EACF,OAAO,aAAa,OAAO,SAAS,WAAW,QAAQ,QAAQ,OAAO,KAAK,GAAG,CAAC,CAAC;CAClF,SAAS,OAAO;EACd,MAAM,IAAI,UAAU,SAAS,EAAE,MAAM,CAAC;CACxC;AACF;;;ACDA,SAAS,SAAS,OAAO;CACvB,IAAI,OAAO,SAAS,YAAY,UAAU,QAAQ,OAAO,UAAU,SAAS,KAAK,KAAK,MAAM,mBAC1F,OAAO,CAAC;CACV,MAAM,YAAY,OAAO,eAAe,KAAK;CAC7C,OAAO,cAAc,QAAQ,OAAO,eAAe,SAAS,MAAM;AACpE;AACA,SAAS,SAAS,OAAO;CACvB,OAAO,SAAS,KAAK,KAAK,MAAM,QAAQ,MAAM,IAAI,KAAK,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,QAAQ;AAC9F;AACA,SAAS,WAAW,GAAG,SAAS;CAC9B,MAAM,6BAA6B,IAAI,IAAI;CAC3C,KAAK,MAAM,UAAU,SACnB,IAAI,QACF,KAAK,MAAM,aAAa,OAAO,KAAK,MAAM,GAAG;EAC3C,IAAI,WAAW,IAAI,SAAS,GAC1B,OAAO,CAAC;EACV,WAAW,IAAI,SAAS;CAC1B;CACJ,OAAO,CAAC;AACV;AAKA,SAAS,gBAAgB,OAAO,OAAO,YAAY;CACjD,IAAI;EACF,OAAO,OAAO,KAAK;CACrB,QAAQ;EACN,MAAM,IAAI,WAAW,kCAAkC,OAAO;CAChE;AACF;AACA,SAAS,gBAAgB,OAAO,OAAO,YAAY;CACjD,IAAI;EACF,OAAO,OAAO,KAAK;CACrB,QAAQ;EACN,MAAM,IAAI,WAAW,OAAO,MAAM,iCAAiC;CACrE;AACF;AACA,SAAS,gBAAgB,KAAK,YAAY,SAAS;CACjD,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,cAAc,OAAO,OAAO,GAAG,CAAC,CAAC;CACvD,QAAQ;EACN,MAAM,IAAI,WAAW,OAAO;CAC9B;CACA,IAAI,CAAC,SAAS,MAAM,GAClB,MAAM,IAAI,WAAW,OAAO;CAC9B,OAAO;AACT;AACA,IAAM,iBAAiB;CAAE,WAAW;CAAM,KAAK,CAAC;AAAE;AAClD,SAAS,mBAAmB,QAAQ,YAAY;CAC9C,IAAI,eAAe,KAAK,MAAM,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,MAAM,MAAM,OAAO,KAAK,QAAQ,IACrG,MAAM,IAAI,UAAU,IAAI,OAAO,qCAAqC;CACtE,OAAO,eAAe,KAAK,IAAI,KAAK,IAAI,IAAI,IAAI,UAAU;AAC5D;AAMA,SAAS,aAAa,KAAK,mBAAmB,kBAAkB,iBAAiB,YAAY;CAC3F,IAAI,WAAW,SAAS,KAAK,KAAK,iBAAiB,SAAS,KAAK,GAC/D,MAAM,IAAI,IAAI,kEAAgE;CAChF,IAAI,CAAC,mBAAmB,gBAAgB,SAAS,KAAK,GACpD,OAAO,CAAC;CACV,IAAI,CAAC,MAAM,QAAQ,gBAAgB,IAAI,KAAK,gBAAgB,KAAK,WAAW,KAAK,gBAAgB,KAAK,MAAM,UAAU,OAAO,SAAS,YAAY,MAAM,WAAW,CAAC,GAClK,MAAM,IAAI,IAAI,yFAAuF;CACvG,MAAM,aAAa,qBAAqB,KAAK,IAAI,oBAAoB;EAAE,WAAW;EAAM,GAAG;EAAkB,GAAG;CAAkB;CAClI,KAAK,MAAM,aAAa,gBAAgB,MAAM;EAC5C,IAAI,EAAE,aAAa,aACjB,MAAM,IAAI,iBAAiB,+BAA+B,UAAU,oBAAoB;EAC1F,IAAI,CAAC,OAAO,OAAO,YAAY,SAAS,KAAK,WAAW,eAAe,KAAK,GAC1E,MAAM,IAAI,IAAI,+BAA+B,UAAU,aAAa;EACtE,IAAI,WAAW,eAAe,CAAC,OAAO,OAAO,iBAAiB,SAAS,KAAK,gBAAgB,eAAe,KAAK,IAC9G,MAAM,IAAI,IAAI,+BAA+B,UAAU,8BAA8B;CACzF;CACA,OAAO,gBAAgB;AACzB;AACA,SAAS,YAAY,iBAAiB,YAAY;CAChD,IAAI,WAAW,SAAS,KAAK,GAAG;EAC9B,MAAM,MAAM,gBAAgB;EAC5B,IAAI,OAAO,OAAO,WAChB,MAAM,IAAI,WAAW,2EAAyE;EAChG,OAAO;CACT;CACA,OAAO,CAAC;AACV;;;AC1FA,IAAM,OAAO,QAAQ,IAAI,OAAO,cAAc,gBAAgB,OAAO,KAAK,UAAU;CAClF,MAAM,EAAE,QAAQ;CAChB,IAAI,IAAI,QAAQ,KAAK,GAAG;EACtB,MAAM,WAAW,UAAU,UAAU,UAAU,WAAW,QAAQ;EAClE,IAAI,IAAI,QAAQ,UACd,MAAM,IAAI,UAAU,sDAAsD,SAAS,eAAe;CACtG;CACA,IAAI,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KACpC,MAAM,IAAI,UAAU,sDAAsD,IAAI,eAAe;CAC/F,IAAI,MAAM,QAAQ,IAAI,OAAO,GAAG;EAC9B,MAAM,gBAAgB,UAAU,aAAa,UAAU,YAAY,MAAM,MAAM,UAAU,YAAY,IAAI,KAAK;EAC9G,IAAI,iBAAiB,CAAC,IAAI,QAAQ,SAAS,aAAa,GACtD,MAAM,IAAI,UAAU,+DAA+D,cAAc,eAAe;CACpH;AACF;AACA,eAAe,WAAW,OAAO,KAAK,OAAO;CAC3C,MAAM,EAAE,KAAK,WAAW,OAAO,aAAa,UAAU,aAAa,UAAU;CAC7E,IAAI,UAAU,eAAe,YAC3B,OAAO;CACT,IAAI,YAAY;CAChB,IAAI,SAAS,GAAG,GAAG;EACjB,IAAI,aAAa,aAAa,GAAG,GAAG,OAAO,WAAW,OAAO,UAC3D,MAAM,eAAe,KAAK,KAAK,MAAM;EACvC,IAAI,EAAE,SAAS,WAAW,QAAQ,SAAS,OAAO,WAAW,KAAK,WAAW,WAAW,QAAQ,UAAU,aAAa,WAAW,QAAQ,SAAS,OAAO,WAAW,QAAQ,YAAY,OAAO,WAAW,KAAK,WAAW,WAAW,MAAM,KAAK,KAAK,WAAW,SAAS,KAAK,KAC7Q,MAAM,IAAI,UAAU,SAAS,kIAA4H,6CAA6C,aAAa,YAAY,SAAS,KAAK;EAC/O,IAAI,aAAa,OAAO,YAAY,KAAK,GAAG,WAAW,QAAQ,OAC7D,OAAO,OAAO,WAAW,CAAC;EAC5B,IAAI,CAAC,OAAO,SAAS,GAAG,GAAG;GACzB,MAAM,EAAE,YAAY;GACpB,MAAM,QAAQ,OAAO,KAAK,OAAO,OAAO,OAAO,GAAG,OAAO,OAAO,GAAG;EACrE;CACF,OAAO;EACL,IAAI,CAAC,UAAU,GAAG,GAChB,MAAM,eAAe,KAAK,KAAK,MAAM;EACvC,MAAM,eAAe,SAAS,WAAW,aAAa,YAAY;EAClE,IAAI,IAAI,SAAS,iBAAiB,UAAU;GAAC;GAAU;GAAU;EAAS,CAAC,CAAC,SAAS,IAAI,IAAI,IAC3F,MAAM,IAAI,UAAU,GAAG,IAAI,GAAG,EAAE,8BAA8B,aAAa,YAAY,IAAI,WAAW;EACxG,IAAI,YAAY,GAAG,GACjB,OAAO;EACT,IAAI,YAAY,KAAK,UAAU,SAAS,UACtC,OAAO,UAAU,OAAO;CAC5B;CACA,0BAA0B,IAAI,QAAQ;CACtC,MAAM,WAAW;CACjB,IAAI,SAAS,MAAM,IAAI,QAAQ;CAC/B,IAAI,SAAS,MACX,OAAO,OAAO;CAChB,IAAI,UAAU,MAAM,IAAI,UAAU,SAAS,CAAC,CAAC,GAAG,aAAa,OAAO,UAAU,eAAe,YAAY;EACvG,MAAM,WAAW,UAAU,SAAS,UAAU,MAAM,KAAK,UAAU,sBAAsB,aAAa,SAAS,MAAM,UAAU;GAAE;GAAK,mBAAmB,UAAU;EAAkB,CAAC,KAAK,MAAM;EACjM,OAAO,OAAO,OAAO,UAAU,YAAY,QAAQ,UAAU,MAAM,OAAO,WAAW,IAAI,EAAE;CAC7F;CACA,OAAO,eAAe,UAAU,OAAO,EAAE,QAAQ,MAAM,CAAC,GAAG,WAAW,MAAM,KAAK,OAAO,OAAO,MAAM,SAAS,OAAO,UAAU;AACjI;AACA,IAAI;AACJ,IAAM,OAAO;CACX,WAAW;CACX,YAAY;CACZ,WAAW;CACX,WAAW;AACb;AAKA,IAAM,eAAe,QAAQ;CAC3B,IAAI,MAAM,OAAO,iBAAiB,aAChC,OAAO,CAAC;CACV,IAAI;EACF,OAAO,eAAe;CACxB,QAAQ;EACN,OAAO,CAAC;CACV;AACF,GAAG,eAAe,QAAQ,MAAM,OAAO,iBAAiB,aAAa,aAAa,QAAQ,YAAY,GAAG,KAAK,YAAY,GAAG;AAC7H,SAAS,QAAQ,KAAK,QAAQ,GAAG,OAAO;CACtC,IAAI,MAAM,SAAS,GAAG;EACpB,MAAM,OAAO,MAAM,IAAI;EACvB,OAAO,eAAe,MAAM,KAAK,IAAI,EAAE,OAAO,KAAK;CACrD,OAAO,MAAM,WAAW,IAAI,OAAO,eAAe,MAAM,GAAG,MAAM,MAAM,GAAG,KAAK,OAAO,WAAW,MAAM,GAAG;CAC1G,OAAO,UAAU,OAAO,OAAO,aAAa,WAAW,OAAO,UAAU,cAAc,OAAO,OAAO,OAAO,sBAAsB,OAAO,SAAS,OAAO,UAAU,YAAY,UAAU,QAAQ,OAAO,aAAa,SAAS,OAAO,4BAA4B,OAAO,YAAY,SAAS;AAC9R;AAEA,SAAS,eAAe,KAAK,QAAQ,QAAQ;CAC3C,MAAM,QAAQ;EAAC;EAAa;EAAa;CAAc;CACvD,OAAO,UAAU,MAAM,KAAK,YAAY,GAAG,IAAI,UAAU,QAAQ,eAAe,IAAI,sBAAsB,QAAQ,GAAG,KAAK,CAAC;AAC7H;AACA,IAAM,YAAY,MAAM,OAAO,qCAAqB,IAAI,UAAU,kDAAkD,KAAK,WAAW,MAAM;AAC1I,SAAS,WAAW,KAAK,OAAO;CAC9B,IAAI,SAAS,CAAC,IAAI,OAAO,SAAS,KAAK,GACrC,MAAM,IAAI,UAAU,sEAAsE,MAAM,EAAE;AACtG;AACA,SAAS,mBAAmB,KAAK,KAAK;CACpC,MAAM,EAAE,kBAAkB,IAAI;CAC9B,IAAI,OAAO,iBAAiB,YAAY,gBAAgB,MACtD,MAAM,IAAI,UAAU,GAAG,IAAI,sDAAsD;AACrF;AACA,SAAS,eAAe,KAAK,UAAU,OAAO;CAC5C,MAAM,YAAY,IAAI;CACtB,IAAI,UAAU,SAAS,SAAS,MAC9B,MAAM,SAAS,SAAS,IAAI;CAC9B,IAAI,SAAS,QAAQ,UAAU,MAAM,SAAS,SAAS,MACrD,MAAM,SAAS,SAAS,MAAM,gBAAgB;CAChD,IAAI,SAAS,cAAc,UAAU,eAAe,SAAS,YAC3D,MAAM,SAAS,SAAS,YAAY,sBAAsB;CAC5D,IAAI,SAAS,WAAW,KAAK,KAAK,UAAU,WAAW,SAAS,QAC9D,MAAM,SAAS,SAAS,QAAQ,kBAAkB;CACpD,WAAW,KAAK,KAAK;AACvB;AACA,SAAS,YAAY,KAAK;CACxB,OAAO;EAAE,WAAW;EAAM,GAAG;CAAI;AACnC;AACA,SAAS,aAAa,KAAK;CACzB,MAAM,aAAa,YAAY,GAAG;CAClC,IAAI,WAAW,QAAQ,KAAK,KAAK,OAAO,WAAW,OAAO,WACxD,MAAM,IAAI,UAAU,mDAAiD;CACvE,IAAI,WAAW,YAAY,KAAK,GAAG;EACjC,MAAM,QAAQ,WAAW,SAAS,SAAS,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK;EACpF,IAAI,CAAC,UAAU,OAAO,MAAM,cAAc,OAAO,aAAa,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,OAAO,QACzG,MAAM,IAAI,UAAU,2EAAyE;EAC/F,WAAW,UAAU;CACvB;CACA,OAAO;AACT;AAMA,eAAe,SAAS,OAAO,KAAK,aAAa;CAC/C,IAAI,CAAC,MAAM,IAAI,SAAS,IAAI,GAAG,GAC7B,MAAM,IAAI,iBAAiB,gEAA8D;CAC3F,MAAM,YAAY,MAAM,UAAU;EAAE,KAAK,IAAI;EAAK,KAAK,IAAI;CAAI,CAAC,KAAK,MAAM,QAAQ,YAAY,CAAC,EAAE,IAAI,KAAK,IAAI,OAAO,UAAU;EAAE,GAAG;EAAK,KAAK,eAAe,IAAI;CAAI;CACtK,OAAO,QAAQ,QAAQ,SAAS,OAAO,QAAQ,KAAK,OAAO,QAAQ,KAAK,OAAO,OAAO,UAAU,OAAO,SAAS,WAAW,QAAQ,OAAO,CAAC,WAAW,IAAI,WAAW,MAAM,OAAO,YAAY,IAAI,EAAE;AACtM;AACA,eAAe,OAAO,KAAK,UAAU,OAAO,cAAc,CAAC,GAAG;CAC5D,OAAO,eAAe,eAAe,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,KAAK,UAAU,aAAa,CAAC,KAAK,CAAC,IAAI,eAAe,KAAK,UAAU,KAAK,GAAG;AAC/J;;;AC1IA,SAAS,MAAM,SAAS;CACtB,MAAM,MAAM,EAAE,WAAW,KAAK;CAC9B,KAAK,MAAM,OAAO,SAChB,IAAI,OAAO;EAAE,GAAG,QAAQ;EAAM;CAAI;CACpC,OAAO;AACT;;;ACHA,IAAM,MAAM,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,CAAC;AACjC,SAAS,KAAK,MAAM;CAClB,MAAM,SAAS;EAAE,MAAM;EAAQ,MAAM,OAAO;CAAO;CACnD,OAAO;EAAE,KAAK,CAAC,KAAK;EAAG,QAAQ,CAAC;EAAG;EAAQ,SAAS;EAAQ,QAAQ;CAAI;AAC1E;AACA,SAAS,IAAI,MAAM,YAAY;CAC7B,MAAM,SAAS;EAAE,MAAM,aAAa,YAAY;EAAqB,MAAM,OAAO;CAAO;CACzF,OAAO;EACL,KAAK,CAAC,KAAK;EACX;EACA,SAAS,aAAa;GAAE,GAAG;GAAQ;EAAW,IAAI;EAClD,QAAQ;EACR,YAAY;CACd;AACF;AACA,SAAS,MAAM,KAAK,MAAM;CACxB,OAAO;EACL,KAAK,CAAC,IAAI;EACV;EACA,QAAQ;GAAE,MAAM;GAAS,YAAY;EAAI;EACzC,SAAS;GAAE,MAAM;GAAS,MAAM,OAAO;EAAO;EAC9C,QAAQ;CACV;AACF;AACA,SAAS,QAAQ;CACf,MAAM,SAAS,EAAE,MAAM,UAAU;CACjC,OAAO;EACL,KAAK,CAAC,KAAK;EACX,KAAK;EACL;EACA,SAAS;EACT,QAAQ;CACV;AACF;AACA,SAAS,MAAM,MAAM;CACnB,MAAM,SAAS,EAAE,MAAM,UAAU,OAAO;CACxC,OAAO;EACL,KAAK,CAAC,KAAK;EACX;EACA,SAAS;EACT,QAAQ;CACV;AACF;AACA,IAAM,MAAM,MAAM;CAChB,OAAO,KAAK,GAAG;CACf,OAAO,KAAK,GAAG;CACf,OAAO,KAAK,GAAG;CACf,OAAO,IAAI,GAAG;CACd,OAAO,IAAI,GAAG;CACd,OAAO,IAAI,GAAG;CACd,OAAO,IAAI,KAAK,EAAE;CAClB,OAAO,IAAI,KAAK,EAAE;CAClB,OAAO,IAAI,KAAK,EAAE;CAClB,OAAO,MAAM,SAAS,GAAG;CACzB,OAAO,MAAM,SAAS,GAAG;CACzB,OAAO,MAAM,SAAS,GAAG;CACzB,OAAO,MAAM;CACb,SAAS,MAAM;CACf,aAAa,MAAM,EAAE;CACrB,aAAa,MAAM,EAAE;CACrB,aAAa,MAAM,EAAE;AACvB,CAAC;AACD,SAAS,aAAa,KAAK;CACzB,MAAM,QAAQ,OAAO,OAAO,WAAW,IAAI,OAAO,KAAK;CACvD,IAAI,CAAC,OACH,MAAM,IAAI,iBAAiB,OAAO,IAAI,4DAA4D;CACpG,OAAO;AACT;;;AC/CA,SAAS,cAAc,SAAS;CAC9B,OAAO,CAAC,WAAW,mBAAmB,cAAc,QAAQ,UAAU,GAAG,SAAS,IAAI;AACxF;AACA,SAAS,qBAAqB,kBAAkB;CAC9C,OAAO,qBAAqB,KAAK,IAAI,CAAC,IAAI,gBAAgB,kBAAkB,YAAY,iCAAiC;AAC3H;AAOA,SAAS,8BAA8B,SAAS;CAC9C,IAAI;EACF,OAAO,OAAO,OAAO;CACvB,QAAQ;EACN,MAAM,IAAI,WAAW,kEAAkE;CACzF;AACF;AACA,eAAe,gBAAgB,KAAK,QAAQ,KAAK,wBAAwB,iBAAiB;CACxF,MAAM,EAAE,WAAW,kBAAkB,QAAQ,SAAS,iBAAiB,KAAK,aAAa,mBAAmB,qBAAqB,gBAAgB;CACjJ,IAAI,CAAC,WAAW,YAAY,MAAM,GAChC,MAAM,IAAI,WAAW,2EAA2E;CAClG,MAAM,aAAa;EAAE,GAAG;EAAY,GAAG;CAAO,GAAG,MAAM,YAAY,YAAY,aAAa,YAAY,gBAAgB,OAAO,IAAI,YAAY,UAAU,CAAC,GAAG,EAAE,QAAQ;CACvK,IAAI,OAAO,OAAO,YAAY,CAAC,KAC7B,MAAM,IAAI,WAAW,6DAA2D;CAClF,IAAI,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,GAAG,GACjC,MAAM,IAAI,kBAAkB,wDAAsD;CACpF,IAAI;MACE,OAAO,gBAAgB,UACzB,MAAM,IAAI,WAAW,8BAA8B;CAAA,OAChD,IAAI,OAAO,gBAAgB,YAAY,EAAE,wBAAwB,aACtE,MAAM,IAAI,WAAW,wDAAwD;CAC/E,MAAM,iBAAiB,OAAO,OAAO,gBAAgB,WAAW,eAAe,uBAAuB,YAAY;CAClH,IAAI,cAAc,CAAC;CACnB,OAAO,OAAO,eAAe,MAAM,MAAM,IAAI,YAAY,GAAG,GAAG,cAAc,CAAC;CAC9E,MAAM,QAAQ,aAAa,GAAG,GAAG,OAAO,OAAO,qBAAqB,KAAK,IAAI,OAAO,gBAAgB,oBAAI,IAAI,WAAW,GAAG,OAAO,GAAG,GAAG,OAAO,kBAAkB,WAAW,OAAO,OAAO,gBAAgB,gBAAgB,WAAW,UAAU,IAAI,cAAc,GAAG,YAAY,gBAAgB,IAAI,WAAW,aAAa,UAAU,GAAG,IAAI,MAAM,WAAW,OAAO,KAAK,QAAQ,GAAG,YAAY,MAAM,OAAO,GAAG,MAAM,QAAQ,QAAQ;CACta,MAAM,cAAc,mBAAmB,MAAM,KAAK,SAAS;CAC3D,IAAI,WAAW,CAAC;CAChB,IAAI;EACF,WAAW,MAAM,OAAO,OAAO,OAAO,MAAM,SAAS,WAAW,WAAW,IAAI;CACjF,QAAQ,CACR;CACA,IAAI,CAAC,UACH,MAAM,IAAI,+BAA+B;CAC3C,MAAM,SAAS,EAAE,SAAS,OAAO,kBAAkB,WAAW,gBAAgB,gBAAgB,WAAW,UAAU,IAAI,eAAe;CACtI,OAAO,qBAAqB,KAAK,MAAM,OAAO,kBAAkB,aAAa,WAAW,KAAK,MAAM,OAAO,oBAAoB,SAAS,cAAc,CAAC;EAAE,GAAG;EAAQ,KAAK;CAAE,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG;AAClM;AACA,eAAe,cAAc,KAAK,QAAQ,KAAK;CAC7C,IAAI,eAAe,eAAe,MAAM,QAAQ,OAAO,GAAG,IAAI,OAAO,OAAO,UAC1E,MAAM,IAAI,WAAW,4CAA4C;CACnE,MAAM,EAAE,GAAG,iBAAiB,GAAG,SAAS,GAAG,WAAW,WAAW,IAAI,MAAM,GAAG;CAC9E,IAAI,WAAW,GACb,MAAM,IAAI,WAAW,qBAAqB;CAC5C,OAAO,gBAAgB;EAAE;EAAS,WAAW;EAAiB;CAAU,GAAG,QAAQ,KAAK,6BAA6B;AACvH;;;AC1EA,IAAM,SAAS,SAAS,KAAK,MAAM,KAAK,QAAQ,IAAI,GAAG,GAAG,cAAc;CACtE,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;AACL,GAAG,QAAQ,qIAAqI,cAAc;AAC9J,SAAS,kBAAkB;CACzB,MAAM,IAAI,UAAU,4BAA4B;AAClD;AACA,SAAS,KAAK,KAAK;CACjB,OAAO,OAAO,YAAY,gBAAgB;CAC1C,MAAM,UAAU,MAAM,KAAK,GAAG;CAC9B,CAAC,CAAC,WAAW,QAAQ,MAAM,QAAQ,OAAO,gBAAgB;CAC1D,MAAM,QAAQ,WAAW,QAAQ,EAAE,GAAG,eAAe,KAAK,MAAM,QAAQ,YAAY,QAAQ,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE;CAChH,OAAO,OAAO,SAAS,YAAY,KAAK,gBAAgB,GAAG,QAAQ,OAAO,OAAO,QAAQ,OAAO,QAAQ,CAAC,eAAe;AAC1H;AACA,SAAS,cAAc,OAAO,OAAO;CACnC,IAAI,CAAC,OAAO,SAAS,KAAK,GACxB,MAAM,IAAI,UAAU,WAAW,MAAM,OAAO;CAC9C,OAAO;AACT;AAYA,IAAM,gBAAgB,UAAU;CAC9B,MAAM,aAAa,MAAM,YAAY;CACrC,OAAO,MAAM,SAAS,GAAG,IAAI,aAAa,eAAe;AAC3D,GAAG,yBAAyB,YAAY,cAAc,OAAO,cAAc,WAAW,UAAU,SAAS,UAAU,IAAI,MAAM,QAAQ,UAAU,IAAI,UAAU,MAAM,QAAQ,WAAW,SAAS,GAAG,CAAC,IAAI,CAAC;AACxM,SAAS,oBAAoB,SAAS,OAAO,WAAW,CAAC,GAAG;CAC1D,MAAM,QAAQ,QAAQ;CACtB,IAAI,EAAE,UAAU,KAAK,KAAK,CAAC,WAAW;EACpC,IAAI,OAAO,SAAS,UAClB,MAAM,IAAI,yBAAyB,IAAI,MAAM,2BAA2B,SAAS,OAAO,SAAS;EACnG,OAAO;CACT;AACF;AACA,SAAS,gBAAgB,SAAS,OAAO;CACvC,MAAM,IAAI,yBAAyB,eAAe,MAAM,gBAAgB,SAAS,OAAO,WAAW;AACrG;AACA,SAAS,kBAAkB,iBAAiB,gBAAgB,UAAU,CAAC,GAAG;CACxE,IAAI;CACJ,IAAI;EACF,UAAU,KAAK,MAAM,cAAc,OAAO,cAAc,CAAC;CAC3D,QAAQ,CACR;CACA,IAAI,CAAC,SAAS,OAAO,GACnB,MAAM,IAAI,WAAW,gDAAgD;CACvE,MAAM,EAAE,QAAQ;CAChB,IAAI,QAAQ,KAAK,MAAM,OAAO,gBAAgB,OAAO,YAAY,aAAa,gBAAgB,GAAG,MAAM,aAAa,GAAG,IACrH,MAAM,IAAI,yBAAyB,uCAAqC,SAAS,OAAO,WAAW;CACrG,MAAM,EAAE,iBAAiB,CAAC,GAAG,QAAQ,SAAS,UAAU,gBAAgB,SAAS,gBAAgB,CAAC,GAAG,cAAc;CACnH,gBAAgB,KAAK,KAAK,cAAc,KAAK,KAAK,GAAG,aAAa,KAAK,KAAK,cAAc,KAAK,KAAK,GAAG,YAAY,KAAK,KAAK,cAAc,KAAK,KAAK,GAAG,WAAW,KAAK,KAAK,cAAc,KAAK,KAAK;CACrM,KAAK,MAAM,SAAS,IAAI,IAAI,cAAc,QAAQ,CAAC,GACjD,IAAI,CAAC,OAAO,OAAO,SAAS,KAAK,GAC/B,MAAM,IAAI,yBAAyB,qBAAqB,MAAM,UAAU,SAAS,OAAO,SAAS;CACrG,WAAW,KAAK,KAAK,EAAE,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM,EAAA,CAAG,SAAS,QAAQ,GAAG,KAAK,gBAAgB,SAAS,KAAK,GAAG,YAAY,KAAK,KAAK,QAAQ,QAAQ,WAAW,gBAAgB,SAAS,KAAK,GAAG,aAAa,KAAK,KAAK,CAAC,sBAAsB,QAAQ,KAAK,OAAO,YAAY,WAAW,CAAC,QAAQ,IAAI,QAAQ,KAAK,gBAAgB,SAAS,KAAK;CAC/V,MAAM,EAAE,mBAAmB;CAC3B,IAAI,YAAY;CAChB,IAAI,OAAO,kBAAkB,UAC3B,YAAY,KAAK,cAAc;MAC5B,IAAI,mBAAmB,KAAK,GAAG;EAClC,IAAI,OAAO,kBAAkB,UAC3B,MAAM,IAAI,UAAU,oCAAoC;EAC1D,YAAY;CACd;CACA,cAAc,yBAAyB,SAAS;CAChD,MAAM,EAAE,gBAAgB,SAAS,MAAM,cAAc,sBAAsB,MAAM,gBAAgB,KAAK,oBAAoB,IAAI,KAAK,IAAI,WAAW,CAAC,GAAG,MAAM,oBAAoB,SAAS,OAAO,gBAAgB,KAAK,CAAC,GAAG,MAAM,oBAAoB,SAAS,KAAK;CACjQ,IAAI,QAAQ,KAAK,KAAK,MAAM,MAAM,WAChC,MAAM,IAAI,yBAAyB,wCAAsC,SAAS,OAAO,WAAW;CACtG,MAAM,MAAM,oBAAoB,SAAS,KAAK;CAC9C,IAAI,QAAQ,KAAK,KAAK,OAAO,MAAM,WACjC,MAAM,IAAI,WAAW,wCAAsC,SAAS,OAAO,WAAW;CACxF,IAAI,gBAAgB,KAAK,GAAG;EAC1B,MAAM,MAAM,MAAM,KAAK,MAAM,cAAc,sBAAsB,OAAO,eAAe,WAAW,cAAc,KAAK,WAAW,CAAC;EACjI,IAAI,MAAM,YAAY,KACpB,MAAM,IAAI,WAAW,8DAA4D,SAAS,OAAO,WAAW;EAC9G,IAAI,MAAM,CAAC,WACT,MAAM,IAAI,yBAAyB,mEAAiE,SAAS,OAAO,WAAW;CACnI;CACA,OAAO;AACT;;;AC1FA,eAAe,UAAU,KAAK,KAAK,SAAS;CAC1C,MAAM,CAAC,UAAU,OAAO,MAAM,cAAc,KAAK,cAAc,OAAO,GAAG,GAAG;CAC5E,IAAI,CAAC,KACH,MAAM,IAAI,WAAW,qCAAqC;CAC5D,MAAM,UAAU,kBAAkB,SAAS,iBAAiB,SAAS,SAAS,OAAO;CACrF,OAAO;EAAE,GAAG;EAAU;CAAQ;AAChC;;;ACLA,SAAS,YAAY,KAAK,OAAO,KAAK,KAAK;CACzC,MAAM,EAAE,KAAK,SAAS,QAAQ,KAAK,KAAK,QAAQ,KAAK,QAAQ,KAAK,QAAQ;CAC1E,QAAQ,QAAQ,KAAK,KAAK,OAAO,OAAO,eAAe,WAAW,KAAK,KAAK,MAAM,QAAQ,MAAM,KAAK,OAAO,OAAO,WAAW,UAAU,OAAO,aAAa,YAAY,OAAO,QAAQ,SAAS,MAAM,KAAK,KAAK,OAAO,SAAS,QAAQ,MAAM,MAAM,IAAI,SAAS,GAAG,MAAM,QAAQ,KAAK,KAAK,OAAO,OAAO,YAAY,QAAQ,YAAY,WAAW,KAAK,IAAI,QAAQ,QAAQ,QAAQ,YAAY,QAAQ,KAAK,KAAK,QAAQ,WAAW,CAAC,MAAM,OAAO,QAAQ,MAAM;AACrc;AACA,eAAe,mBAAmB,OAAO,KAAK,OAAO;CACnD,MAAM,SAAS,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,EAAE,QAAQ;CACxE,IAAI,OAAO,SAAS,KAAK,GAAG;EAC1B,MAAM,UAAU,SAAS,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ;GACrD,IAAI,IAAI,SAAS,UACf,MAAM,IAAI,YAAY,8CAA8C;GACtE,OAAO,OAAO,OAAO,KAAK;EAC5B,CAAC,CAAC,CAAC,OAAO,UAAU;GAClB,MAAM,OAAO,SAAS,WAAW,OAAO,OAAO,MAAM;EACvD,CAAC;EACD,OAAO,OAAO;CAChB;CACA,OAAO,OAAO;AAChB;AACA,SAAS,kBAAkB,MAAM;CAC/B,IAAI;CACJ,IAAI;EACF,WAAW,gBAAgB,IAAI;CACjC,QAAQ,CACR;CACA,IAAI,CAAC,SAAS,QAAQ,GACpB,MAAM,IAAI,YAAY,4BAA4B;CACpD,MAAM,WAAW,SAAS,KAAK,KAAK,QAAQ;EAC1C,MAAM,aAAa,YAAY,GAAG;EAClC,OAAO,MAAM,QAAQ,WAAW,OAAO,MAAM,WAAW,UAAU,CAAC,GAAG,WAAW,OAAO,IAAI;CAC9F,CAAC,GAAG,yBAAyB,IAAI,QAAQ;CACzC,OAAO,OAAO,eAAe,OAAO,iBAAiB,UAAU;EAC7D,MAAM,EAAE,KAAK,QAAQ;GAAE,GAAG;GAAiB,GAAG,OAAO;EAAO,GAAG,QAAQ,OAAO,OAAO,WAAW,IAAI,OAAO,KAAK;EAChH,IAAI,CAAC,SAAS,MAAM,QAClB,MAAM,IAAI,iBAAiB,kDAAgD;EAC7E,MAAM,aAAa,SAAS,KAAK,QAAQ,GAAG,UAAU,YAAY,SAAS,QAAQ,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,WAAW;EAC3H,IAAI,CAAC,QACH,MAAM,IAAI,kBAAkB;EAC9B,IAAI,WAAW,GAAG;GAChB,MAAM,QAAQ,IAAI,yBAAyB;GAC3C,MAAM,MAAM,OAAO,iBAAiB,mBAAmB;IACrD,KAAK,MAAM,QAAQ,YACjB,IAAI;KACF,MAAM,MAAM,mBAAmB,QAAQ,MAAM,KAAK;IACpD,QAAQ,CACR;GACJ,GAAG;EACL;EACA,OAAO,mBAAmB,QAAQ,KAAK,KAAK;CAC9C,GAAG,QAAQ,EACT,aAAa,gBAAgB,QAAQ,EACvC,CAAC;AACH;;;ACpDA,SAAS,sBAAsB;CAC7B,OAAO,OAAO,gBAAgB,OAAO,OAAO,YAAY,OAAO,UAAU,cAAc,wBAAwB,OAAO,cAAc,OAAO,gBAAgB;AAC7J;AACA,IAAI;CACH,OAAO,YAAY,OAAO,CAAC,UAAU,WAAW,aAAa,cAAc,OAAO,aAAa;AAChG,IAAM,cAA8B,uBAAO;AAC3C,eAAe,UAAU,KAAK,SAAS,QAAQ,YAAY,OAAO;CAChE,MAAM,WAAW,MAAM,UAAU,KAAK;EACpC,QAAQ;EACR;EACA,UAAU;EACV;CACF,CAAC,CAAC,CAAC,OAAO,QAAQ;EAChB,MAAM,IAAI,SAAS,iBAAiB,IAAI,YAAY,IAAI;CAC1D,CAAC;CACD,IAAI,SAAS,WAAW,KACtB,MAAM,IAAI,UAAU,yDAAyD;CAC/E,IAAI;EACF,OAAO,MAAM,SAAS,KAAK;CAC7B,QAAQ;EACN,MAAM,IAAI,UAAU,4DAA4D;CAClF;AACF;AACA,IAAM,YAA4B,uBAAO;AACzC,SAAS,WAAW,WAAW,UAAU;CACvC,OAAO,OAAO,SAAS,SAAS,KAAK,KAAK,IAAI,IAAI,YAAY;AAChE;AACA,SAAS,iBAAiB,OAAO,UAAU,QAAQ;CACjD,IAAI,OAAO,MAAM,KAAK,GACpB,MAAM,IAAI,UAAU,IAAI,OAAO,yBAAyB;CAC1D,OAAO,OAAO,SAAS,WAAW,QAAQ;AAC5C;AACA,SAAS,mBAAmB,KAAK,SAAS;CACxC,IAAI,EAAE,eAAe,MACnB,MAAM,IAAI,UAAU,gCAAgC;CACtD,MAAM,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,GAAG,gBAAgB,KAAK;CAChF,IAAI,OAAO,iBAAiB,aAAa,CAAC,OAAO,UAAU,aAAa,KAAK,gBAAgB,IAC3F,MAAM,IAAI,UAAU,2DAAyD;CAC/E,MAAM,kBAAkB,OAAO,iBAAiB,WAAW,gBAAgB,KAAK,mBAAmB,iBAAiB,KAAK,kBAAkB,KAAK,kBAAkB,GAAG,cAAc,iBAAiB,KAAK,aAAa,KAAK,aAAa,GAAG,UAAU,IAAI,QAAQ,KAAK,OAAO;CAC7Q,cAAc,CAAC,QAAQ,IAAI,YAAY,KAAK,QAAQ,IAAI,cAAc,UAAU,GAAG,QAAQ,IAAI,QAAQ,KAAK,QAAQ,IAAI,UAAU,4CAA4C;CAC9K,MAAM,YAAY,KAAK,cAAc,QAAQ,KAAK;CAClD,IAAI,eAAe,cAAc,iBAAiB,GAAG,kBAAkB,GAAG;CAC1E,IAAI,SAAS,OAAO,SAAS,UAAU;EACrC,MAAM,EAAE,KAAK,SAAS;EACtB,WAAW,KAAK,WAAW,KAAK,SAAS,IAAI,MAAM,gBAAgB,KAAK,QAAQ,kBAAkB,IAAI;CACxG;CACA,MAAM,SAAS,YAAY;EACzB,IAAI,gBAAgB,oBAAoB,MAAM,eAAe,KAAK,IAAI,CAAC,cAAc;GACnF,MAAM,WAAW,EAAE,gBAAgB,UAAU,eAAe,UAAU,MAAM,SAAS,YAAY,QAAQ,eAAe,GAAG,SAAS,CAAC,CAAC,MAAM,SAAS;IACnJ,MAAM,OAAO,kBAAkB,IAAI;IACnC,IAAI,YAAY,iBACd;IACF,QAAQ;IACR,MAAM,YAAY,KAAK,IAAI;IAC3B,UAAU,MAAM,MAAM,WAAW,MAAM,OAAO,OAAO,gBAAgB,WAAW,kBAAkB;GACpG,CAAC,CAAC,CAAC,cAAc;IACf,iBAAiB,YAAY,eAAe,KAAK;GACnD,CAAC;EACH;EACA,MAAM;CACR;CACA,OAAO,OAAO,iBAAiB,OAAO,iBAAiB,UAAU;EAC/D,CAAC,CAAC,SAAS,CAAC,WAAW,eAAe,WAAW,MAAM,MAAM,OAAO;EACpE,IAAI;GACF,OAAO,MAAM,MAAM,iBAAiB,KAAK;EAC3C,SAAS,KAAK;GACZ,IAAI,eAAe,qBAAqB,CAAC,WAAW,eAAe,gBAAgB,GACjF,OAAO,MAAM,OAAO,GAAG,MAAM,iBAAiB,KAAK;GACrD,MAAM;EACR;CACF,GAAG;EACD,aAAa;GACX,WAAW,WAAW,eAAe,gBAAgB;GACrD,YAAY,CAAC;EACf;EACA,OAAO;GACL,WAAW,WAAW,eAAe,WAAW;GAChD,YAAY,CAAC;EACf;EACA,QAAQ;GACN,OAAO;GACP,YAAY,CAAC;EACf;EACA,WAAW;GACT,WAAW,CAAC,CAAC;GACb,YAAY,CAAC;EACf;EACA,MAAM;GACJ,aAAa,OAAO,KAAK;GACzB,YAAY,CAAC;EACf;CACF,CAAC;AACH;;;ACvDA,IAAM,eAAe;AACrB,SAAS,YAAY,OAAe,SAAoC;CACtE,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,KAAK;CACrB,QAAQ;EACN,MAAM,IAAI,MAAM,gCAAgC;CAClD;CACA,MAAM,WAAW;EAAC;EAAa;EAAS;CAAW,CAAA,CAAE,SAAS,IAAI,QAAQ;CAC1E,IACE,IAAI,YACJ,IAAI,YACJ,IAAI,UACJ,IAAI,QACJ,WAAW,KAAK,KAAK,MACpB,YAAY,UACT,CAAC,YAAY,CAAC,CAAC,SAAS,QAAQ,CAAA,CAAE,SAAS,IAAI,QAAQ,IACvD,IAAI,aAAa,WAErB,MAAM,IAAI,MAAM,uDAAuD;CACzE,OAAO;AACT;AACA,SAAS,YAAY,OAAiC;CACpD,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,QAChB,MAAM,KAAK,MAAM,SACjB,CAAC,GAAG,KAAK,CAAA,CAAE,OACR,cACC,UAAU,WAAW,CAAC,IAAI,MAAM,UAAU,WAAW,CAAC,MAAM,GAChE;AAEJ;AAeO,SAAS,sBACd,SACiB;CACjB,IAAI,CAAC;EAAC;EAAS;EAAe;CAAO,CAAA,CAAE,SAAS,QAAQ,OAAO,GAC7D,MAAM,IAAI,MAAM,iCAAiC;CAEnD,MAAM,cAAc,YAAY,QAAQ,UAAU,QAAQ,OAAO;CACjE,YAAY,QAAQ,QAAQ,QAAQ,OAAO;CAC3C,YAAY,QAAQ,SAAS,QAAQ,OAAO;CAC5C,IACE,CAAC,QAAQ,WAAW,UACpB,QAAQ,WAAW,MAAM,QAAQ,CAAC,CAAC,SAAS,OAAO,CAAA,CAAE,SAAS,GAAG,CAAC,GAElE,MAAM,IAAI,MAAM,wDAAwD;CAE1E,IAAI,QAAQ,OAAO,MAAM,UAAU,CAAC,aAAa,KAAK,KAAK,CAAC,GAC1D,MAAM,IAAI,MAAM,0BAA0B;CAE5C,IACE,QAAQ,cAAc,KAAA,KACtB,CAAC,CAAC,UAAU,KAAK,CAAA,CAAE,SAAS,QAAQ,SAAS,GAE7C,MAAM,IAAI,MAAM,oCAAoC;CAGtD,MAAM,SAAS,QAAQ;CACvB,MAAM,WAAW,QAAQ;CACzB,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,QAAQ,MAAM,CAAC;CAC1C,MAAM,aAAa,CAAC,GAAG,QAAQ,UAAU;CACzC,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,gBAAgB,QAAQ,kBAAkB;CAChD,MAAM,mBAAmB,QAAQ;CACjC,MAAM,OAAO,mBAAmB,IAAI,IAAI,QAAQ,OAAO,GAAG,EACxD,iBAAiB,IACnB,CAAC;CACD,MAAM,cAAc,GAAG,YAAY,OAAM,uCAAwC,YAAY,aAAa,MAAM,KAAK,YAAY;CACjI,SAAS,KAAK,OAGZ;EACA,MAAM,YAAY;GAChB,6BAA6B,YAAW;GACxC,GAAI,OAAO,SAAS,CAAC,UAAU,OAAO,KAAK,GAAG,EAAC,EAAG,IAAI,CAAC;GACvD,GAAI,QAAQ,CAAC,UAAU,MAAK,EAAG,IAAI,CAAC;EACtC,CAAA,CAAE,KAAK,IAAI;EACX,OAAO;GACL,IAAI;GACJ,UAAU,IAAI,SAAS,MAAM;IAC3B,QAAQ,UAAU,uBAAuB,MAAM;IAC/C,SAAS;KAAE,oBAAoB;KAAW,iBAAiB;IAAW;GACxE,CAAC;EACH;CACF;CACA,OAAO;EACL;EACA,wBACE,SAAS,KACP;GACE;GACA,uBAAuB,CAAC,MAAM;GAC9B,kBAAkB;GAClB,0BAA0B,CAAC,QAAQ;EACrC,GACA,EAAE,SAAS,EAAE,iBAAiB,WAAW,EAAE,CAC7C;EACF,MAAM,aAAa,SAAS;GAC1B,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,eAAe;GACzD,IAAI,CAAC,eAAe,OAAO,KAAK;GAChC,MAAM,QACJ,+DAA+D,KAC7D,aACF;GACF,IAAI,CAAC,OAAO,OAAO,KAAK,eAAe;GACvC,IAAI;IACF,MAAM,EAAE,YAAY,MAAM,UAAU,MAAM,IAAI,MAAM;KAClD;KACA,UAAU;KACV;KACA,KAAK;KACL,gBAAgB;MAAC;MAAO;MAAO;MAAO;KAAK;KAC3C,gBAAgB;IAClB,CAAC;IACD,IAAI,CAAC,YAAY,QAAQ,GAAG,KAAK,OAAO,QAAQ,UAAU,UACxD,OAAO,KAAK,eAAe;IAC7B,MAAM,UAAU,QAAQ,UAAU,KAAK,CAAC,IAAI,QAAQ,MAAM,MAAM,GAAG;IACnE,IAAI,QAAQ,MAAM,UAAU,CAAC,aAAa,KAAK,KAAK,CAAC,GACnD,OAAO,KAAK,eAAe;IAC7B,IAAI,OAAO,MAAM,UAAU,CAAC,QAAQ,SAAS,KAAK,CAAC,GACjD,OAAO,KAAK,oBAAoB;IAClC,MAAM,UAAU,MAAM,iBACpB,OAAO,OAAO;KACZ;KACA,SAAS,QAAQ;KACjB,QAAQ,OAAO,OAAO,CAAC,GAAG,OAAO,CAAC;KAClC,QAAQ,OAAO,OAAO,OAAO;IAC/B,CAAC,CACH;IACA,IACE,CAAC,WACD,CAAC,YAAY,QAAQ,EAAE,KACtB,iBAAiB,CAAC,YAAY,QAAQ,QAAQ,KAC9C,QAAQ,aAAa,KAAA,KAAa,CAAC,YAAY,QAAQ,QAAQ,KAC/D,QAAQ,SAAS,KAAA,KAAa,CAAC,YAAY,QAAQ,IAAI,KACvD,QAAQ,UAAU,KAAA,MAChB,CAAC,MAAM,QAAQ,QAAQ,KAAK,KAC3B,CAAC,QAAQ,MAAM,MAAM,WAAW,IAEpC,OAAO,KAAK,eAAe;IAE7B,OAAO;KACL,IAAI;KACJ,WAAW;MACT,IAAI,QAAQ;MACZ,UAAU,QAAQ;MAClB,MAAM,QAAQ;MACd,OAAO,QAAQ,QAAQ,CAAC,GAAG,QAAQ,KAAK,IAAI,KAAA;MAC5C,QAAQ,CAAC,GAAG,OAAO;KACrB;IACF;GACF,QAAQ;IACN,OAAO,KAAK,eAAe;GAC7B;EACF;CACF;AACF"}

package/dist/chunks/protocol-Ce0U_XSp.js

@@ -0,0 +1,184 @@
+import { ProtocolError, ProtocolErrorCode, Server } from "@modelcontextprotocol/server";
+//#region src/errors.ts
+var MCP_TOOL_ACCESS_DENIED_CODE = "mcp_tool_access_denied";
+var McpAccessError = class extends Error {
+	constructor(status, message, metadata = {}) {
+		super(message);
+		this.status = status;
+		this.metadata = metadata;
+		this.name = "McpAccessError";
+	}
+	status;
+	metadata;
+};
+//#endregion
+//#region src/tools.ts
+function matchesToolPattern(toolName, pattern) {
+	if (!pattern) return false;
+	if (pattern === "*") return true;
+	const parts = pattern.split("*");
+	if (parts.length === 1) return toolName === pattern;
+	let cursor = 0;
+	if (parts[0] && !toolName.startsWith(parts[0])) return false;
+	for (const part of parts) {
+		if (!part) continue;
+		const index = toolName.indexOf(part, cursor);
+		if (index < 0) return false;
+		cursor = index + part.length;
+	}
+	const last = parts.at(-1);
+	return !last || toolName.endsWith(last);
+}
+function isReadOnlyToolName(toolName) {
+	return toolName.endsWith("_list") || toolName.endsWith("_get");
+}
+function isPublicToolName(toolName, patterns) {
+	return isReadOnlyToolName(toolName) && patterns.some((pattern) => matchesToolPattern(toolName, pattern));
+}
+function isPublicMcpTool(tool, patterns) {
+	return (tool.annotations?.readOnlyHint ?? isReadOnlyToolName(tool.name)) && patterns.some((pattern) => matchesToolPattern(tool.name, pattern));
+}
+function classNamePrefixes(classNames) {
+	return new Set(classNames.map((className) => `${className.toLowerCase()}_`));
+}
+function isAllowedCoreTool(toolName, prefixes) {
+	for (const prefix of prefixes) if (toolName.startsWith(prefix)) return true;
+	return false;
+}
+function compareMcpToolNames(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+//#endregion
+//#region src/protocol.ts
+var MCP_TASKS_EXTENSION = "io.modelcontextprotocol/tasks";
+var DEFAULT_TOOL_LIST_CACHE_HINT = {
+	ttlMs: 864e5,
+	cacheScope: "private"
+};
+async function createMcpProtocolServerForRequest(appServer, options = {}) {
+	const principal = options.principal ?? null;
+	let extensions = {};
+	if (options.extensions) try {
+		const tools = await appServer.listTools({ principal });
+		const projected = await options.extensions({
+			principal,
+			tools
+		});
+		assertExtensionMetadata(projected);
+		if (Object.hasOwn(projected, "io.modelcontextprotocol/tasks")) throw new TypeError("Reserved extension.");
+		extensions = structuredClone(projected);
+	} catch {
+		throw new ProtocolError(ProtocolErrorCode.InternalError, "Extension discovery unavailable.");
+	}
+	return protocolServer(appServer, { principal }, extensions);
+}
+async function resolvePrincipal(option, context) {
+	if (typeof option === "function") return await option(context) ?? null;
+	return option ?? null;
+}
+function createMcpProtocolServer(appServer, options = {}) {
+	if ("extensions" in options) throw new TypeError("Extension discovery requires createMcpProtocolServerForRequest.");
+	return protocolServer(appServer, options, {});
+}
+function protocolServer(appServer, options, extensions) {
+	const tasksEnabled = appServer.tasksEnabled && typeof options.principal !== "function" && Boolean(options.principal?.id);
+	const server = new Server(appServer.serverInfo, {
+		capabilities: {
+			tools: {},
+			...appServer.listResources && appServer.readResource ? { resources: {} } : {},
+			...tasksEnabled || Object.keys(extensions).length ? { extensions: {
+				...extensions,
+				...tasksEnabled ? { [MCP_TASKS_EXTENSION]: {} } : {}
+			} } : {}
+		},
+		cacheHints: { "tools/list": DEFAULT_TOOL_LIST_CACHE_HINT }
+	});
+	server.setRequestHandler("tools/list", async (_request, context) => {
+		const principal = await resolvePrincipal(options.principal, context);
+		const cacheHint = await appServer.getToolsListCacheHint?.() ?? DEFAULT_TOOL_LIST_CACHE_HINT;
+		return {
+			tools: [...await appServer.listTools({ principal })].sort((left, right) => compareMcpToolNames(left.name, right.name)),
+			...cacheHint
+		};
+	});
+	if (appServer.listResources && appServer.readResource) {
+		server.setRequestHandler("resources/list", async (_request, context) => ({
+			resources: await appServer.listResources({ principal: await resolvePrincipal(options.principal, context) }),
+			ttlMs: 0,
+			cacheScope: "private"
+		}));
+		server.setRequestHandler("resources/read", async (request, context) => {
+			try {
+				return {
+					contents: [await appServer.readResource({
+						uri: request.params.uri,
+						principal: await resolvePrincipal(options.principal, context)
+					})],
+					ttlMs: 0,
+					cacheScope: "private"
+				};
+			} catch (error) {
+				if (error instanceof McpAccessError) throw new ProtocolError(ProtocolErrorCode.InvalidParams, "MCP resource is not available.");
+				throw error;
+			}
+		});
+	}
+	server.setRequestHandler("tools/call", async (request, context) => {
+		try {
+			return await appServer.callTool({
+				name: request.params.name,
+				arguments: request.params.arguments,
+				principal: await resolvePrincipal(options.principal, context)
+			});
+		} catch (error) {
+			if (error instanceof McpAccessError) {
+				const { code, retryable } = error.metadata;
+				throw new ProtocolError(error.status === 404 ? ProtocolErrorCode.InvalidParams : ProtocolErrorCode.InvalidRequest, error.message, {
+					...typeof code === "string" ? { code } : {},
+					...typeof retryable === "boolean" ? { retryable } : {}
+				});
+			}
+			throw error;
+		}
+	});
+	return server;
+}
+function assertExtensionMetadata(value) {
+	let budget = 65536;
+	const visit = (v, depth) => {
+		if (--budget < 0 || depth > 16) throw new TypeError("Extension metadata exceeds limits.");
+		if (v === null || typeof v === "boolean") return;
+		if (typeof v === "number" && Number.isFinite(v)) return;
+		if (typeof v === "string") {
+			budget -= new TextEncoder().encode(v).length;
+			if (budget < 0) throw new TypeError("Extension metadata exceeds limits.");
+			return;
+		}
+		if (Array.isArray(v)) {
+			if (v.length > 1024) throw new TypeError("Extension array exceeds limits.");
+			for (const item of v) visit(item, depth + 1);
+			return;
+		}
+		if (!v || typeof v !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(v))) throw new TypeError("Expected plain extension object.");
+		const names = Object.keys(v);
+		if (names.length > 256) throw new TypeError("Extension object exceeds limits.");
+		for (const name of names) {
+			if ([
+				"__proto__",
+				"constructor",
+				"prototype"
+			].includes(name)) throw new TypeError("Unsafe extension key.");
+			const descriptor = Object.getOwnPropertyDescriptor(v, name);
+			if (!descriptor || !("value" in descriptor)) throw new TypeError("Expected inert extension metadata.");
+			visit(name, depth + 1);
+			visit(descriptor.value, depth + 1);
+		}
+	};
+	visit(value, 0);
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new TypeError("Expected extension map.");
+	for (const [name, entry] of Object.entries(value)) if (!name.trim() || !entry || typeof entry !== "object" || Array.isArray(entry)) throw new TypeError("Expected named extension object.");
+}
+//#endregion
+export { compareMcpToolNames as a, isPublicToolName as c, MCP_TOOL_ACCESS_DENIED_CODE as d, McpAccessError as f, classNamePrefixes as i, isReadOnlyToolName as l, createMcpProtocolServer as n, isAllowedCoreTool as o, createMcpProtocolServerForRequest as r, isPublicMcpTool as s, MCP_TASKS_EXTENSION as t, matchesToolPattern as u };
+
+//# sourceMappingURL=protocol-Ce0U_XSp.js.map

package/dist/chunks/protocol-Ce0U_XSp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-Ce0U_XSp.js","names":[],"sources":["../../src/errors.ts","../../src/tools.ts","../../src/protocol.ts"],"sourcesContent":["/** Machine-readable code for a principal policy denial. */\nexport const MCP_TOOL_ACCESS_DENIED_CODE = 'mcp_tool_access_denied';\n\n/**\n * Metadata that is safe to expose for an app-MCP access failure. Policy\n * implementations must not place principal, scope, tool, or internal-error\n * details here.\n */\nexport interface McpAccessErrorMetadata {\n  code?: string;\n  retryable?: boolean;\n}\n\n/**\n * Error returned by the MCP app server when a caller tries to use a tool\n * they are not allowed to access. The HTTP layer should map `status` onto\n * the response status code.\n */\nexport class McpAccessError extends Error {\n  constructor(\n    readonly status: number,\n    message: string,\n    readonly metadata: McpAccessErrorMetadata = {},\n  ) {\n    super(message);\n    this.name = 'McpAccessError';\n  }\n}\n","/**\n * Tool-name policy helpers — used by `McpAppServer` to filter the full set\n * of generated tools down to what the calling principal is allowed to see,\n * and to decide whether an unauthenticated tool call should be permitted.\n *\n * @packageDocumentation\n */\n\n/**\n * Match a tool name against a glob-ish pattern with `*` wildcards.\n *\n * - Empty pattern → never matches.\n * - `*` → matches everything.\n * - `prefix_*` → matches anything starting with `prefix_`.\n * - `*_suffix` → matches anything ending with `_suffix`.\n * - `a_*_b` → matches any name containing `a_`, then any text, then `_b`.\n *\n * No regex characters are special besides `*` — the input is treated as a\n * literal string with star wildcards.\n */\nexport function matchesToolPattern(toolName: string, pattern: string): boolean {\n  if (!pattern) return false;\n  if (pattern === '*') return true;\n\n  const parts = pattern.split('*');\n  if (parts.length === 1) return toolName === pattern;\n\n  let cursor = 0;\n  if (parts[0] && !toolName.startsWith(parts[0])) return false;\n  for (const part of parts) {\n    if (!part) continue;\n    const index = toolName.indexOf(part, cursor);\n    if (index < 0) return false;\n    cursor = index + part.length;\n  }\n\n  const last = parts.at(-1);\n  return !last || toolName.endsWith(last);\n}\n\n/**\n * Read-only tool detection. Generated SMRT MCP tools follow the naming\n * convention `<class>_<verb>`; we treat `_list` and `_get` as read-only.\n */\nexport function isReadOnlyToolName(toolName: string): boolean {\n  return toolName.endsWith('_list') || toolName.endsWith('_get');\n}\n\n/**\n * Check whether a tool name is currently allowed for unauthenticated callers\n * given the configured public-tool patterns. Only read-only tools may ever\n * be public, regardless of pattern.\n */\nexport function isPublicToolName(\n  toolName: string,\n  patterns: readonly string[],\n): boolean {\n  return (\n    isReadOnlyToolName(toolName) &&\n    patterns.some((pattern) => matchesToolPattern(toolName, pattern))\n  );\n}\n\n/**\n * Check public eligibility using a descriptor's canonical read annotation when\n * available. The legacy name rule remains for generated catalogs predating\n * canonical annotations.\n */\nexport function isPublicMcpTool(\n  tool: {\n    name: string;\n    annotations?: { readOnlyHint?: boolean };\n  },\n  patterns: readonly string[],\n): boolean {\n  const readOnly =\n    tool.annotations?.readOnlyHint ?? isReadOnlyToolName(tool.name);\n  return (\n    readOnly &&\n    patterns.some((pattern) => matchesToolPattern(tool.name, pattern))\n  );\n}\n\n/**\n * Lower-case `<class>_` prefixes the app considers \"allowed core tools\"\n * given a list of SMRT class names. Used to build the allow-list for\n * `McpAppServer.listTools`.\n */\nexport function classNamePrefixes(\n  classNames: readonly string[],\n): ReadonlySet<string> {\n  return new Set(classNames.map((className) => `${className.toLowerCase()}_`));\n}\n\n/**\n * Whether a given tool name starts with any of the configured class\n * prefixes.\n */\nexport function isAllowedCoreTool(\n  toolName: string,\n  prefixes: ReadonlySet<string>,\n): boolean {\n  for (const prefix of prefixes) {\n    if (toolName.startsWith(prefix)) return true;\n  }\n  return false;\n}\n\n/**\n * Compare tool names by Unicode code unit, rather than the host locale, so a\n * catalog has one byte-stable order across every runtime.\n */\nexport function compareMcpToolNames(left: string, right: string): number {\n  return left < right ? -1 : left > right ? 1 : 0;\n}\n","/** MCP SDK v2 protocol adapter for the framework-neutral app server core. */\n\nimport type { MCPTool } from '@happyvertical/smrt-core/generators/mcp';\nimport {\n  type CallToolResult,\n  type JSONObject,\n  ProtocolError,\n  ProtocolErrorCode,\n  Server,\n  type ServerContext,\n  type Tool,\n} from '@modelcontextprotocol/server';\nimport { McpAccessError } from './errors.js';\nimport type { McpAppPrincipal, McpAppServer } from './server.js';\nimport { compareMcpToolNames } from './tools.js';\n\nexport const MCP_TASKS_EXTENSION = 'io.modelcontextprotocol/tasks';\n\nconst DEFAULT_TOOL_LIST_CACHE_HINT = {\n  ttlMs: 86_400_000,\n  cacheScope: 'private' as const,\n};\n\nexport interface McpProtocolServerOptions {\n  /** Resolve the authenticated application principal for each MCP request. */\n  principal?:\n    | McpAppPrincipal\n    | null\n    | ((\n        context: ServerContext,\n      ) => McpAppPrincipal | null | Promise<McpAppPrincipal | null>);\n}\n\n/** Request-bound options for asynchronous catalog extension projection. */\nexport interface McpProtocolRequestOptions {\n  principal?: McpAppPrincipal | null;\n  /** Optional inert extension metadata, recomputed from this request's authorized catalog. */\n  extensions?: (context: {\n    principal: McpAppPrincipal | null;\n    tools: readonly MCPTool[];\n  }) =>\n    | Record<string, Record<string, unknown>>\n    | Promise<Record<string, Record<string, unknown>>>;\n}\n\n/** Prepare native capabilities before the SDK HTTP factory installs discovery handlers. */\nexport async function createMcpProtocolServerForRequest(\n  appServer: McpAppServer,\n  options: McpProtocolRequestOptions = {},\n): Promise<Server> {\n  const principal = options.principal ?? null;\n  let extensions: Record<string, JSONObject> = {};\n  if (options.extensions) {\n    try {\n      const tools = await appServer.listTools({ principal });\n      const projected = await options.extensions({ principal, tools });\n      assertExtensionMetadata(projected);\n      if (Object.hasOwn(projected, MCP_TASKS_EXTENSION))\n        throw new TypeError('Reserved extension.');\n      extensions = structuredClone(projected);\n    } catch {\n      throw new ProtocolError(\n        ProtocolErrorCode.InternalError,\n        'Extension discovery unavailable.',\n      );\n    }\n  }\n  return protocolServer(appServer, { principal }, extensions);\n}\n\nasync function resolvePrincipal(\n  option: McpProtocolServerOptions['principal'],\n  context: ServerContext,\n): Promise<McpAppPrincipal | null> {\n  if (typeof option === 'function') return (await option(context)) ?? null;\n  return option ?? null;\n}\n\n/**\n * Adapt an app MCP core to the SDK v2 low-level server protocol.\n *\n * Transport ownership remains with the caller. In particular, this does not\n * add a production HTTP endpoint; it is safe to compose with `serveStdio` or\n * `createMcpHandler` in a deployment that supplies its own authentication.\n */\nexport function createMcpProtocolServer(\n  appServer: McpAppServer,\n  options: McpProtocolServerOptions = {},\n): Server {\n  if ('extensions' in options) {\n    throw new TypeError(\n      'Extension discovery requires createMcpProtocolServerForRequest.',\n    );\n  }\n  return protocolServer(appServer, options, {});\n}\n\nfunction protocolServer(\n  appServer: McpAppServer,\n  options: McpProtocolServerOptions,\n  extensions: Record<string, JSONObject>,\n): Server {\n  // Task lifecycle records are owner-scoped. Unlike ordinary public read-only\n  // tools, they cannot be safely exposed without a stable principal id.\n  const tasksEnabled =\n    appServer.tasksEnabled &&\n    typeof options.principal !== 'function' &&\n    Boolean(options.principal?.id);\n  const server = new Server(appServer.serverInfo, {\n    capabilities: {\n      tools: {},\n      ...(appServer.listResources && appServer.readResource\n        ? { resources: {} }\n        : {}),\n      ...(tasksEnabled || Object.keys(extensions).length\n        ? {\n            extensions: {\n              ...extensions,\n              ...(tasksEnabled ? { [MCP_TASKS_EXTENSION]: {} } : {}),\n            },\n          }\n        : {}),\n    } as never,\n    cacheHints: { 'tools/list': DEFAULT_TOOL_LIST_CACHE_HINT },\n  });\n\n  server.setRequestHandler('tools/list', async (_request, context) => {\n    const principal = await resolvePrincipal(options.principal, context);\n    const cacheHint =\n      (await appServer.getToolsListCacheHint?.()) ??\n      DEFAULT_TOOL_LIST_CACHE_HINT;\n    return {\n      tools: [...(await appServer.listTools({ principal }))].sort(\n        (left, right) => compareMcpToolNames(left.name, right.name),\n      ) as Tool[],\n      ...cacheHint,\n    };\n  });\n\n  if (appServer.listResources && appServer.readResource) {\n    server.setRequestHandler('resources/list', async (_request, context) => ({\n      resources: await appServer.listResources!({\n        principal: await resolvePrincipal(options.principal, context),\n      }),\n      ttlMs: 0,\n      cacheScope: 'private',\n    }));\n    server.setRequestHandler('resources/read', async (request, context) => {\n      try {\n        return {\n          contents: [\n            await appServer.readResource!({\n              uri: request.params.uri,\n              principal: await resolvePrincipal(options.principal, context),\n            }),\n          ],\n          ttlMs: 0,\n          cacheScope: 'private',\n        };\n      } catch (error) {\n        if (error instanceof McpAccessError)\n          throw new ProtocolError(\n            ProtocolErrorCode.InvalidParams,\n            'MCP resource is not available.',\n          );\n        throw error;\n      }\n    });\n  }\n\n  server.setRequestHandler('tools/call', async (request, context) => {\n    try {\n      return (await appServer.callTool({\n        name: request.params.name,\n        arguments: request.params.arguments,\n        principal: await resolvePrincipal(options.principal, context),\n      })) as CallToolResult;\n    } catch (error) {\n      if (error instanceof McpAccessError) {\n        const { code, retryable } = error.metadata;\n        throw new ProtocolError(\n          error.status === 404\n            ? ProtocolErrorCode.InvalidParams\n            : ProtocolErrorCode.InvalidRequest,\n          error.message,\n          {\n            ...(typeof code === 'string' ? { code } : {}),\n            ...(typeof retryable === 'boolean' ? { retryable } : {}),\n          },\n        );\n      }\n      throw error;\n    }\n  });\n\n  return server;\n}\n\n/** Bound plugin discovery metadata without allowing executable values or provider-specific types. */\nfunction assertExtensionMetadata(\n  value: unknown,\n): asserts value is Record<string, JSONObject> {\n  let budget = 65536;\n  const visit = (v: unknown, depth: number): void => {\n    if (--budget < 0 || depth > 16)\n      throw new TypeError('Extension metadata exceeds limits.');\n    if (v === null || typeof v === 'boolean') return;\n    if (typeof v === 'number' && Number.isFinite(v)) return;\n    if (typeof v === 'string') {\n      budget -= new TextEncoder().encode(v).length;\n      if (budget < 0) throw new TypeError('Extension metadata exceeds limits.');\n      return;\n    }\n    if (Array.isArray(v)) {\n      if (v.length > 1024)\n        throw new TypeError('Extension array exceeds limits.');\n      for (const item of v) visit(item, depth + 1);\n      return;\n    }\n    if (\n      !v ||\n      typeof v !== 'object' ||\n      ![Object.prototype, null].includes(Object.getPrototypeOf(v))\n    )\n      throw new TypeError('Expected plain extension object.');\n    const names = Object.keys(v);\n    if (names.length > 256)\n      throw new TypeError('Extension object exceeds limits.');\n    for (const name of names) {\n      if (['__proto__', 'constructor', 'prototype'].includes(name))\n        throw new TypeError('Unsafe extension key.');\n      const descriptor = Object.getOwnPropertyDescriptor(v, name);\n      if (!descriptor || !('value' in descriptor))\n        throw new TypeError('Expected inert extension metadata.');\n      visit(name, depth + 1);\n      visit(descriptor.value, depth + 1);\n    }\n  };\n  visit(value, 0);\n  if (!value || typeof value !== 'object' || Array.isArray(value))\n    throw new TypeError('Expected extension map.');\n  for (const [name, entry] of Object.entries(value)) {\n    if (\n      !name.trim() ||\n      !entry ||\n      typeof entry !== 'object' ||\n      Array.isArray(entry)\n    )\n      throw new TypeError('Expected named extension object.');\n  }\n}\n"],"mappings":";;AACO,IAAM,8BAA8B;AAiBpC,IAAM,iBAAN,cAA6B,MAAM;CACxC,YACW,QACT,SACS,WAAmC,CAAC,GAC7C;EACA,MAAM,OAAO;EAJJ,KAAA,SAAA;EAEA,KAAA,WAAA;EAGT,KAAK,OAAO;CACd;CANW;CAEA;AAKb;;;ACPO,SAAS,mBAAmB,UAAkB,SAA0B;CAC7E,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI,YAAY,KAAK,OAAO;CAE5B,MAAM,QAAQ,QAAQ,MAAM,GAAG;CAC/B,IAAI,MAAM,WAAW,GAAG,OAAO,aAAa;CAE5C,IAAI,SAAS;CACb,IAAI,MAAM,MAAM,CAAC,SAAS,WAAW,MAAM,EAAE,GAAG,OAAO;CACvD,KAAA,MAAW,QAAQ,OAAO;EACxB,IAAI,CAAC,MAAM;EACX,MAAM,QAAQ,SAAS,QAAQ,MAAM,MAAM;EAC3C,IAAI,QAAQ,GAAG,OAAO;EACtB,SAAS,QAAQ,KAAK;CACxB;CAEA,MAAM,OAAO,MAAM,GAAG,EAAE;CACxB,OAAO,CAAC,QAAQ,SAAS,SAAS,IAAI;AACxC;AAMO,SAAS,mBAAmB,UAA2B;CAC5D,OAAO,SAAS,SAAS,OAAO,KAAK,SAAS,SAAS,MAAM;AAC/D;AAOO,SAAS,iBACd,UACA,UACS;CACT,OACE,mBAAmB,QAAQ,KAC3B,SAAS,MAAM,YAAY,mBAAmB,UAAU,OAAO,CAAC;AAEpE;AAOO,SAAS,gBACd,MAIA,UACS;CAGT,QADE,KAAK,aAAa,gBAAgB,mBAAmB,KAAK,IAAI,MAG9D,SAAS,MAAM,YAAY,mBAAmB,KAAK,MAAM,OAAO,CAAC;AAErE;AAOO,SAAS,kBACd,YACqB;CACrB,OAAO,IAAI,IAAI,WAAW,KAAK,cAAc,GAAG,UAAU,YAAY,EAAC,EAAG,CAAC;AAC7E;AAMO,SAAS,kBACd,UACA,UACS;CACT,KAAA,MAAW,UAAU,UACnB,IAAI,SAAS,WAAW,MAAM,GAAG,OAAO;CAE1C,OAAO;AACT;AAMO,SAAS,oBAAoB,MAAc,OAAuB;CACvE,OAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAChD;;;AClGO,IAAM,sBAAsB;AAEnC,IAAM,+BAA+B;CACnC,OAAO;CACP,YAAY;AACd;AAyBA,eAAsB,kCACpB,WACA,UAAqC,CAAC,GACrB;CACjB,MAAM,YAAY,QAAQ,aAAa;CACvC,IAAI,aAAyC,CAAC;CAC9C,IAAI,QAAQ,YACV,IAAI;EACF,MAAM,QAAQ,MAAM,UAAU,UAAU,EAAE,UAAU,CAAC;EACrD,MAAM,YAAY,MAAM,QAAQ,WAAW;GAAE;GAAW;EAAM,CAAC;EAC/D,wBAAwB,SAAS;EACjC,IAAI,OAAO,OAAO,WAAA,+BAA8B,GAC9C,MAAM,IAAI,UAAU,qBAAqB;EAC3C,aAAa,gBAAgB,SAAS;CACxC,QAAQ;EACN,MAAM,IAAI,cACR,kBAAkB,eAClB,kCACF;CACF;CAEF,OAAO,eAAe,WAAW,EAAE,UAAU,GAAG,UAAU;AAC5D;AAEA,eAAe,iBACb,QACA,SACiC;CACjC,IAAI,OAAO,WAAW,YAAY,OAAQ,MAAM,OAAO,OAAO,KAAM;CACpE,OAAO,UAAU;AACnB;AASO,SAAS,wBACd,WACA,UAAoC,CAAC,GAC7B;CACR,IAAI,gBAAgB,SAClB,MAAM,IAAI,UACR,iEACF;CAEF,OAAO,eAAe,WAAW,SAAS,CAAC,CAAC;AAC9C;AAEA,SAAS,eACP,WACA,SACA,YACQ;CAGR,MAAM,eACJ,UAAU,gBACV,OAAO,QAAQ,cAAc,cAC7B,QAAQ,QAAQ,WAAW,EAAE;CAC/B,MAAM,SAAS,IAAI,OAAO,UAAU,YAAY;EAC9C,cAAc;GACZ,OAAO,CAAC;GACR,GAAI,UAAU,iBAAiB,UAAU,eACrC,EAAE,WAAW,CAAC,EAAE,IAChB,CAAC;GACL,GAAI,gBAAgB,OAAO,KAAK,UAAU,CAAA,CAAE,SACxC,EACE,YAAY;IACV,GAAG;IACH,GAAI,eAAe,GAAG,sBAAsB,CAAC,EAAE,IAAI,CAAC;GACtD,EACF,IACA,CAAC;EACP;EACA,YAAY,EAAE,cAAc,6BAA6B;CAC3D,CAAC;CAED,OAAO,kBAAkB,cAAc,OAAO,UAAU,YAAY;EAClE,MAAM,YAAY,MAAM,iBAAiB,QAAQ,WAAW,OAAO;EACnE,MAAM,YACH,MAAM,UAAU,wBAAwB,KACzC;EACF,OAAO;GACL,OAAO,CAAC,GAAI,MAAM,UAAU,UAAU,EAAE,UAAU,CAAC,CAAE,CAAA,CAAE,MACpD,MAAM,UAAU,oBAAoB,KAAK,MAAM,MAAM,IAAI,CAC5D;GACA,GAAG;EACL;CACF,CAAC;CAED,IAAI,UAAU,iBAAiB,UAAU,cAAc;EACrD,OAAO,kBAAkB,kBAAkB,OAAO,UAAU,aAAa;GACvE,WAAW,MAAM,UAAU,cAAe,EACxC,WAAW,MAAM,iBAAiB,QAAQ,WAAW,OAAO,EAC9D,CAAC;GACD,OAAO;GACP,YAAY;EACd,EAAE;EACF,OAAO,kBAAkB,kBAAkB,OAAO,SAAS,YAAY;GACrE,IAAI;IACF,OAAO;KACL,UAAU,CACR,MAAM,UAAU,aAAc;MAC5B,KAAK,QAAQ,OAAO;MACpB,WAAW,MAAM,iBAAiB,QAAQ,WAAW,OAAO;KAC9D,CAAC,CACH;KACA,OAAO;KACP,YAAY;IACd;GACF,SAAS,OAAO;IACd,IAAI,iBAAiB,gBACnB,MAAM,IAAI,cACR,kBAAkB,eAClB,gCACF;IACF,MAAM;GACR;EACF,CAAC;CACH;CAEA,OAAO,kBAAkB,cAAc,OAAO,SAAS,YAAY;EACjE,IAAI;GACF,OAAQ,MAAM,UAAU,SAAS;IAC/B,MAAM,QAAQ,OAAO;IACrB,WAAW,QAAQ,OAAO;IAC1B,WAAW,MAAM,iBAAiB,QAAQ,WAAW,OAAO;GAC9D,CAAC;EACH,SAAS,OAAO;GACd,IAAI,iBAAiB,gBAAgB;IACnC,MAAM,EAAE,MAAM,cAAc,MAAM;IAClC,MAAM,IAAI,cACR,MAAM,WAAW,MACb,kBAAkB,gBAClB,kBAAkB,gBACtB,MAAM,SACN;KACE,GAAI,OAAO,SAAS,WAAW,EAAE,KAAK,IAAI,CAAC;KAC3C,GAAI,OAAO,cAAc,YAAY,EAAE,UAAU,IAAI,CAAC;IACxD,CACF;GACF;GACA,MAAM;EACR;CACF,CAAC;CAED,OAAO;AACT;AAGA,SAAS,wBACP,OAC6C;CAC7C,IAAI,SAAS;CACb,MAAM,SAAS,GAAY,UAAwB;EACjD,IAAI,EAAE,SAAS,KAAK,QAAQ,IAC1B,MAAM,IAAI,UAAU,oCAAoC;EAC1D,IAAI,MAAM,QAAQ,OAAO,MAAM,WAAW;EAC1C,IAAI,OAAO,MAAM,YAAY,OAAO,SAAS,CAAC,GAAG;EACjD,IAAI,OAAO,MAAM,UAAU;GACzB,UAAU,IAAI,YAAY,CAAA,CAAE,OAAO,CAAC,CAAA,CAAE;GACtC,IAAI,SAAS,GAAG,MAAM,IAAI,UAAU,oCAAoC;GACxE;EACF;EACA,IAAI,MAAM,QAAQ,CAAC,GAAG;GACpB,IAAI,EAAE,SAAS,MACb,MAAM,IAAI,UAAU,iCAAiC;GACvD,KAAA,MAAW,QAAQ,GAAG,MAAM,MAAM,QAAQ,CAAC;GAC3C;EACF;EACA,IACE,CAAC,KACD,OAAO,MAAM,YACb,CAAC,CAAC,OAAO,WAAW,IAAI,CAAA,CAAE,SAAS,OAAO,eAAe,CAAC,CAAC,GAE3D,MAAM,IAAI,UAAU,kCAAkC;EACxD,MAAM,QAAQ,OAAO,KAAK,CAAC;EAC3B,IAAI,MAAM,SAAS,KACjB,MAAM,IAAI,UAAU,kCAAkC;EACxD,KAAA,MAAW,QAAQ,OAAO;GACxB,IAAI;IAAC;IAAa;IAAe;GAAW,CAAA,CAAE,SAAS,IAAI,GACzD,MAAM,IAAI,UAAU,uBAAuB;GAC7C,MAAM,aAAa,OAAO,yBAAyB,GAAG,IAAI;GAC1D,IAAI,CAAC,cAAc,EAAE,WAAW,aAC9B,MAAM,IAAI,UAAU,oCAAoC;GAC1D,MAAM,MAAM,QAAQ,CAAC;GACrB,MAAM,WAAW,OAAO,QAAQ,CAAC;EACnC;CACF;CACA,MAAM,OAAO,CAAC;CACd,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAC5D,MAAM,IAAI,UAAU,yBAAyB;CAC/C,KAAA,MAAW,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,GAC9C,IACE,CAAC,KAAK,KAAK,KACX,CAAC,SACD,OAAO,UAAU,YACjB,MAAM,QAAQ,KAAK,GAEnB,MAAM,IAAI,UAAU,kCAAkC;AAE5D"}

package/dist/continuation.d.ts

@@ -0,0 +1,30 @@
+import { type McpTaskContinuation, type McpTaskStore } from '@happyvertical/smrt-jobs';
+import type { McpAppPrincipal } from './server.js';
+import { type McpWorkflowToolDefinition } from './workflow-tools.js';
+/** Server-owned immutable review reference; contains no permission snapshot. */
+export interface McpWorkflowContinuation extends McpTaskContinuation {
+    /** Application review page, including the application's own authentication. */
+    reviewUrl: string;
+}
+/**
+ * Compose a durable job with its owning workflow. The host answer is only an
+ * input hint. `applyReviewed` must call the owning immutable review/revision and
+ * idempotency API, rechecking domain approval inside that transaction.
+ * No host callback or server session survives suspension.
+ */
+export declare function continueMcpWorkflow<T>(options: {
+    binding: McpWorkflowContinuation;
+    inputSchema: Record<string, unknown>;
+    applyReviewed: (input: unknown, binding: Readonly<McpTaskContinuation>) => Promise<T>;
+}): Promise<T>;
+/**
+ * Declare the ordinary tool fallback for hosts without elicitation. `storeFor`
+ * must return a store bound to the supplied verified actor and active tenant;
+ * the application policy callback resolves current read authority.
+ */
+export declare function createMcpContinuationTool(options: {
+    name: string;
+    storeFor: (principal: McpAppPrincipal) => Promise<Pick<McpTaskStore, 'getContinuation'>>;
+    authorize: (principal: McpAppPrincipal, taskId: string) => Promise<boolean>;
+}): McpWorkflowToolDefinition;
+//# sourceMappingURL=continuation.d.ts.map

package/dist/continuation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"continuation.d.ts","sourceRoot":"","sources":["../src/continuation.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,YAAY,EAClB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,qBAAqB,CAAC;AAE7B,gFAAgF;AAChF,MAAM,WAAW,uBAAwB,SAAQ,mBAAmB;IAClE,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE;IACpD,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,aAAa,EAAE,CACb,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,KACnC,OAAO,CAAC,CAAC,CAAC,CAAC;CACjB,GAAG,OAAO,CAAC,CAAC,CAAC,CA4Bb;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,CACR,SAAS,EAAE,eAAe,KACvB,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACpD,SAAS,EAAE,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7E,GAAG,yBAAyB,CA+C5B"}

package/dist/index.d.ts

@@ -21,8 +21,11 @@
  *
  * @packageDocumentation
  */
+export { continueMcpWorkflow, createMcpContinuationTool, type McpWorkflowContinuation, } from './continuation.js';
 export { MCP_TOOL_ACCESS_DENIED_CODE, McpAccessError, type McpAccessErrorMetadata, } from './errors.js';
-export { createMcpProtocolServer, type McpProtocolServerOptions, } from './protocol.js';
+export { createMcpProtocolServer, createMcpProtocolServerForRequest, type McpProtocolRequestOptions, type McpProtocolServerOptions, } from './protocol.js';
+export { MCP_APP_RESOURCE_MAX_BYTES, MCP_APP_RESOURCE_MIME, type McpAppResource, type McpAppResourceContent, type McpAppResourceCsp, type McpAppResourceDefinition, type McpResourcePolicy, prepareMcpAppResource, } from './resources.js';
 export { type CallToolInput, type CreateMcpAppServerOptions, createMcpAppServer, type ListToolsInput, type McpAppPrincipal, type McpAppServer, type McpAppUser, type McpPublicToolPatternsThunk, type McpSmrtOptionsThunk, type McpToolListCacheHint, type McpToolListCacheOptions, type McpToolPolicy, type McpToolPolicyContext, type McpWorkflowAssertion, } from './server.js';
-export { classNamePrefixes, isAllowedCoreTool, isPublicToolName, isReadOnlyToolName, matchesToolPattern, } from './tools.js';
+export { classNamePrefixes, isAllowedCoreTool, isPublicMcpTool, isPublicToolName, isReadOnlyToolName, matchesToolPattern, } from './tools.js';
+export { createMcpWorkflowTool, type McpWorkflowTool, type McpWorkflowToolContext, type McpWorkflowToolDefinition, type McpWorkflowToolVisibility, } from './workflow-tools.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,2BAA2B,EAC3B,cAAc,EACd,KAAK,sBAAsB,GAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uBAAuB,EACvB,KAAK,wBAAwB,GAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,yBAAyB,EAC9B,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,KAAK,uBAAuB,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,2BAA2B,EAC3B,cAAc,EACd,KAAK,sBAAsB,GAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,GAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,yBAAyB,EAC9B,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,GAC/B,MAAM,qBAAqB,CAAC"}