@miragon/pulse-widget-shell 0.24.2 → 0.25.0

package/dist/profile.d.ts

@@ -1,75 +0,0 @@
-import { z } from "zod";
-/**
- * The profile key of an EXPLICITLY declared local caller — a transport without
- * auth that serves exactly one user (stdio, tests), declared via
- * `runWithMcpRequestInfo({ anonymousCaller: true }, …)`. Never reached by an
- * HTTP request: a request without OAuth has no identity at all.
- */
-export declare const ANONYMOUS_PROFILE_KEY = "anonymous";
-/**
- * The minimal structural view of the profile store a module needs for its own
- * settings slice: read the record, and (when the host wired a writable store)
- * write back a `modules` patch. Deliberately narrower than camunda7's
- * `ProfileStore` — a module has no business with `delete` or with another
- * module's slice. `save` merges per module key on the store side,
- * one level deep and atomically per key: a `modules.<yours>` patch spreads
- * over your stored slice (`undefined` clears a field) and never touches a
- * foreign slice, which is what lets a save carry its patch alone
- * (`saveModuleSlice`).
- */
-export interface ProfileSource {
-    get(key: string): Promise<ProfileSlice | undefined>;
-    save?(key: string, input: {
-        modules: Record<string, unknown>;
-    }, opts?: {
-        userId?: string;
-    }): Promise<unknown>;
-}
-/** The slice of the shared profile record a foreign module may read. */
-export interface ProfileSlice {
-    /** UI + summary language, for localizing the module's own tool summaries. */
-    language?: string;
-    /** Per-module settings slices, keyed by module name. */
-    modules?: Record<string, unknown>;
-}
-/**
- * Resolves the key a user profile hangs on — the single place that decides
- * "whose profile is this", shared by every module. Fail-closed precedence:
- *
- *   1. the OAuth caller — resolved from the handler `ctx` through the
- *      toolkit's `resolveCaller` whenever a `ctx` is passed (registrar and
- *      widget-tool handlers all have one), else from the ambient request
- *      info the middleware derived the same way (ctx-less paths: pipeline
- *      steps). An authenticated `ctx` decides ALONE: a provider that maps no
- *      subject yields no key, never a fallback;
- *   2. {@link ANONYMOUS_PROFILE_KEY} for an explicitly declared local caller
- *      (`anonymousCaller` — stdio, tests; never set from a request);
- *   3. `undefined` otherwise — an HTTP request without OAuth, or no request
- *      context at all (a missing middleware install included). Reads fall back
- *      to defaults, saves refuse (`requireProfileKey`).
- *
- * Nothing a client chooses for itself (a session id, a header) is ever a key.
- * `ctx` is typed `unknown` so the mcp-use handler context (whose exact shape
- * isn't part of the stable surface) passes without a cast at the call site.
- */
-export declare function resolveProfileKey(ctx?: unknown): string | undefined;
-/**
- * Just the OAuth half of {@link resolveProfileKey}: the authenticated
- * caller's id (from `ctx`, else the ambient request info), never the declared
- * anonymous key. Save paths stamp it onto the record as its owner
- * (`opts.userId`), so a record says which signed-in user it belongs to.
- */
-export declare function resolveAuthUserId(ctx?: unknown): string | undefined;
-/**
- * Strip `.default()` wrappers from a schema shape, keeping each field's
- * description — the safe way to derive a settings SAVE input from the schema
- * that defines the settings themselves.
- *
- * Zod 4 re-applies defaults THROUGH `.partial()` on parse, so a defaulted
- * partial would materialize omitted fields at the tool boundary: a
- * "single-field" save would then silently reset every other defaulted
- * preference. Save inputs therefore must be default-free — build them as
- * `z.object(withoutDefaults(schema.shape)).partial()`.
- */
-export declare function withoutDefaults(shape: z.ZodRawShape): z.ZodRawShape;
-//# sourceMappingURL=profile.d.ts.map

package/dist/profile.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../src/profile.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,cAAc,CAAA;AAEhD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;IACnD,IAAI,CAAC,CACH,GAAG,EAAE,MAAM,EACX,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,EAC3C,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC,OAAO,CAAC,CAAA;CACpB;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAMnE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGnE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAQnE"}

package/dist/profile.js

@@ -1,85 +0,0 @@
-/**
- * The cross-module contract for user settings: WHOSE profile a request touches
- * and WHAT shape a module may read/write on it.
- *
- * Modules are peers and never import each other, but they all read and write
- * ONE shared profile record — so the key resolution and the fallback key are
- * not per-module opinions, they are a contract that must be byte-identical
- * everywhere. Two modules resolving different keys for the same caller would
- * silently split a user's settings across two records (language from one,
- * analytics defaults from another) without any error. This module is that
- * single source, imported by both the profile store's owner (camunda7) and
- * every module that keeps a `profile.modules.<module>` slice.
- *
- * Lives on the `/server` path only — the ambient request info pulls in
- * `node:async_hooks`, which must never reach the widget bundle.
- */
-import { resolveCaller } from "@miragon/mcp-toolkit-core";
-import { z } from "zod";
-import { getMcpRequestInfo } from "./request-context.js";
-/**
- * The profile key of an EXPLICITLY declared local caller — a transport without
- * auth that serves exactly one user (stdio, tests), declared via
- * `runWithMcpRequestInfo({ anonymousCaller: true }, …)`. Never reached by an
- * HTTP request: a request without OAuth has no identity at all.
- */
-export const ANONYMOUS_PROFILE_KEY = "anonymous";
-/**
- * Resolves the key a user profile hangs on — the single place that decides
- * "whose profile is this", shared by every module. Fail-closed precedence:
- *
- *   1. the OAuth caller — resolved from the handler `ctx` through the
- *      toolkit's `resolveCaller` whenever a `ctx` is passed (registrar and
- *      widget-tool handlers all have one), else from the ambient request
- *      info the middleware derived the same way (ctx-less paths: pipeline
- *      steps). An authenticated `ctx` decides ALONE: a provider that maps no
- *      subject yields no key, never a fallback;
- *   2. {@link ANONYMOUS_PROFILE_KEY} for an explicitly declared local caller
- *      (`anonymousCaller` — stdio, tests; never set from a request);
- *   3. `undefined` otherwise — an HTTP request without OAuth, or no request
- *      context at all (a missing middleware install included). Reads fall back
- *      to defaults, saves refuse (`requireProfileKey`).
- *
- * Nothing a client chooses for itself (a session id, a header) is ever a key.
- * `ctx` is typed `unknown` so the mcp-use handler context (whose exact shape
- * isn't part of the stable surface) passes without a cast at the call site.
- */
-export function resolveProfileKey(ctx) {
-    const caller = resolveCaller(ctx);
-    if (caller)
-        return caller.userId;
-    const info = getMcpRequestInfo();
-    if (info?.authUserId)
-        return info.authUserId;
-    return info?.anonymousCaller ? ANONYMOUS_PROFILE_KEY : undefined;
-}
-/**
- * Just the OAuth half of {@link resolveProfileKey}: the authenticated
- * caller's id (from `ctx`, else the ambient request info), never the declared
- * anonymous key. Save paths stamp it onto the record as its owner
- * (`opts.userId`), so a record says which signed-in user it belongs to.
- */
-export function resolveAuthUserId(ctx) {
-    const caller = resolveCaller(ctx);
-    return caller ? caller.userId : getMcpRequestInfo()?.authUserId;
-}
-/**
- * Strip `.default()` wrappers from a schema shape, keeping each field's
- * description — the safe way to derive a settings SAVE input from the schema
- * that defines the settings themselves.
- *
- * Zod 4 re-applies defaults THROUGH `.partial()` on parse, so a defaulted
- * partial would materialize omitted fields at the tool boundary: a
- * "single-field" save would then silently reset every other defaulted
- * preference. Save inputs therefore must be default-free — build them as
- * `z.object(withoutDefaults(schema.shape)).partial()`.
- */
-export function withoutDefaults(shape) {
-    return Object.fromEntries(Object.entries(shape).map(([key, schema]) => {
-        if (!(schema instanceof z.ZodDefault))
-            return [key, schema];
-        const inner = schema.unwrap();
-        return [key, schema.description ? inner.describe(schema.description) : inner];
-    }));
-}
-//# sourceMappingURL=profile.js.map

package/dist/profile.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"profile.js","sourceRoot":"","sources":["../src/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAA;AA8BhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAa;IAC7C,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,MAAM,CAAA;IAChC,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAA;IAChC,IAAI,IAAI,EAAE,UAAU;QAAE,OAAO,IAAI,CAAC,UAAU,CAAA;IAC5C,OAAO,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAA;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAa;IAC7C,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IACjC,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,EAAE,EAAE,UAAU,CAAA;AACjE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,KAAoB;IAClD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE;QAC1C,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,UAAU,CAAC;YAAE,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAe,CAAA;QAC1C,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAC/E,CAAC,CAAC,CACH,CAAA;AACH,CAAC"}

package/dist/profile.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=profile.test.d.ts.map

package/dist/profile.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"profile.test.d.ts","sourceRoot":"","sources":["../src/profile.test.ts"],"names":[],"mappings":""}

package/dist/profile.test.js

@@ -1,71 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { z } from "zod";
-import { ANONYMOUS_PROFILE_KEY, resolveAuthUserId, resolveProfileKey, withoutDefaults, } from "./profile.js";
-import { runWithMcpRequestInfo } from "./request-context.js";
-/** A tool-handler `ctx` as mcp-use hands it to callbacks (flattened `auth.user`). */
-const authed = (user) => ({ auth: { user, payload: {} } });
-describe("resolveProfileKey", () => {
-    it("resolves the OAuth caller from the handler ctx (any provider spelling)", () => {
-        expect(resolveProfileKey(authed({ id: "user-1" }))).toBe("user-1");
-        expect(resolveProfileKey(authed({ userId: "user-2" }))).toBe("user-2");
-        expect(resolveProfileKey({ auth: { payload: { sub: "user-3" } } })).toBe("user-3");
-    });
-    it("lets an authenticated ctx decide alone — no subject is NO key, never a fallback", () => {
-        const anonymous = { anonymousCaller: true };
-        expect(runWithMcpRequestInfo(anonymous, () => resolveProfileKey(authed({ id: "" })))).toBe(undefined);
-        expect(runWithMcpRequestInfo({ authUserId: "user-9" }, () => resolveProfileKey(authed({ id: 42 })))).toBeUndefined();
-    });
-    it("falls back to the ambient OAuth caller for ctx-less paths (pipeline steps)", () => {
-        expect(runWithMcpRequestInfo({ authUserId: "user-7" }, () => resolveProfileKey())).toBe("user-7");
-        // A ctx WITHOUT auth (a signed-out call) does not shadow it.
-        expect(runWithMcpRequestInfo({ authUserId: "user-7" }, () => resolveProfileKey({}))).toBe("user-7");
-    });
-    it("resolves the anonymous key only for an EXPLICITLY declared local caller", () => {
-        expect(runWithMcpRequestInfo({ anonymousCaller: true }, () => resolveProfileKey())).toBe(ANONYMOUS_PROFILE_KEY);
-    });
-    it("fails closed: no request context (missing middleware install) is no identity", () => {
-        expect(resolveProfileKey()).toBeUndefined();
-        expect(resolveProfileKey({})).toBeUndefined();
-    });
-    it("fails closed: an HTTP request without OAuth is no identity", () => {
-        expect(runWithMcpRequestInfo({}, () => resolveProfileKey())).toBeUndefined();
-        expect(runWithMcpRequestInfo({ authorization: "Bearer x" }, () => resolveProfileKey())).toBeUndefined();
-    });
-});
-describe("resolveAuthUserId", () => {
-    it("returns only the OAuth caller, never the anonymous key", () => {
-        expect(resolveAuthUserId(authed({ id: "user-1" }))).toBe("user-1");
-        expect(runWithMcpRequestInfo({ authUserId: "user-7" }, () => resolveAuthUserId())).toBe("user-7");
-        expect(runWithMcpRequestInfo({ anonymousCaller: true }, () => resolveAuthUserId())).toBe(undefined);
-        expect(resolveAuthUserId()).toBeUndefined();
-        expect(resolveAuthUserId({ auth: {} })).toBeUndefined();
-    });
-});
-describe("withoutDefaults", () => {
-    const schema = z.object({
-        period: z.enum(["7d", "30d"]).default("7d").describe("Look-back window."),
-        limit: z.number().int().default(10),
-        optional: z.string().optional(),
-    });
-    it("keeps omitted fields ABSENT instead of materializing defaults (the zod-4 partial trap)", () => {
-        // The trap this guards: `schema.partial()` re-applies the defaults on parse.
-        expect(schema.partial().parse({})).toEqual({ period: "7d", limit: 10 });
-        const saveInput = z.object(withoutDefaults(schema.shape)).partial();
-        expect(saveInput.parse({})).toEqual({});
-        expect(saveInput.parse({ limit: 3 })).toEqual({ limit: 3 });
-    });
-    it("preserves each field's description (the model reads them at the tool boundary)", () => {
-        const stripped = withoutDefaults(schema.shape);
-        expect(stripped.period.description).toBe("Look-back window.");
-    });
-    it("still validates the stripped fields", () => {
-        const saveInput = z.object(withoutDefaults(schema.shape)).partial();
-        expect(saveInput.safeParse({ period: "nope" }).success).toBe(false);
-        expect(saveInput.safeParse({ period: "30d" }).success).toBe(true);
-    });
-    it("passes fields that carry no default through untouched", () => {
-        const stripped = withoutDefaults(schema.shape);
-        expect(stripped.optional).toBe(schema.shape.optional);
-    });
-});
-//# sourceMappingURL=profile.test.js.map

package/dist/profile.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"profile.test.js","sourceRoot":"","sources":["../src/profile.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAE5D,qFAAqF;AACrF,MAAM,MAAM,GAAG,CAAC,IAA6B,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;AAEnF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAClE,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACtE,MAAM,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACpF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,MAAM,SAAS,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,CAAA;QAC3C,MAAM,CAAC,qBAAqB,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACxF,SAAS,CACV,CAAA;QACD,MAAM,CACJ,qBAAqB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAC7F,CAAC,aAAa,EAAE,CAAA;IACnB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,CAAC,qBAAqB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CACrF,QAAQ,CACT,CAAA;QACD,6DAA6D;QAC7D,MAAM,CAAC,qBAAqB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CACvF,QAAQ,CACT,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,CAAC,qBAAqB,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CACtF,qBAAqB,CACtB,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,aAAa,EAAE,CAAA;QAC3C,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,qBAAqB,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;QAC5E,MAAM,CACJ,qBAAqB,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAChF,CAAC,aAAa,EAAE,CAAA;IACnB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAClE,MAAM,CAAC,qBAAqB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CACrF,QAAQ,CACT,CAAA;QACD,MAAM,CAAC,qBAAqB,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CACtF,SAAS,CACV,CAAA;QACD,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,aAAa,EAAE,CAAA;QAC3C,MAAM,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IACzD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACzE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC,CAAA;IAEF,EAAE,CAAC,wFAAwF,EAAE,GAAG,EAAE;QAChG,6EAA6E;QAC7E,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;QAEvE,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;QACnE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACvC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC9C,MAAM,CAAE,QAAQ,CAAC,MAAoB,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;QACnE,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACnE,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC9C,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/request-context.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=request-context.test.d.ts.map

package/dist/request-context.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-context.test.d.ts","sourceRoot":"","sources":["../src/request-context.test.ts"],"names":[],"mappings":""}

package/dist/request-context.test.js

@@ -1,107 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { callerCacheKey, getMcpRequestInfo, installMcpRequestContext, runWithMcpRequestInfo, } from "./request-context.js";
-/** Minimal server double capturing what `installMcpRequestContext` registers. */
-function fakeServer() {
-    const middlewares = [];
-    const server = {
-        use: (_pattern, fn) => {
-            middlewares.push(fn);
-            return server;
-        },
-    };
-    return { server, middlewares };
-}
-/** What the installed middleware hands the handler for `ctx`. */
-async function seenFor(ctx) {
-    const { server, middlewares } = fakeServer();
-    installMcpRequestContext(server);
-    let seen = "sentinel";
-    await middlewares[0](ctx, async () => {
-        seen = getMcpRequestInfo();
-    });
-    return seen;
-}
-describe("runWithMcpRequestInfo / getMcpRequestInfo", () => {
-    it("is undefined outside a request", () => {
-        expect(getMcpRequestInfo()).toBeUndefined();
-    });
-    it("exposes the info inside the run scope only", () => {
-        const inside = runWithMcpRequestInfo({ anonymousCaller: true }, () => getMcpRequestInfo());
-        expect(inside).toEqual({ anonymousCaller: true });
-        expect(getMcpRequestInfo()).toBeUndefined();
-    });
-});
-/**
- * The key a per-caller cache partitions by (analytics' BPMN names under
- * passthrough auth): who calls AND with which credential, never the
- * credential itself.
- */
-describe("callerCacheKey", () => {
-    const ALICE = { authUserId: "alice", authorization: "Bearer token-alice" };
-    it("is empty outside a request and for a request without a caller or a credential", () => {
-        expect(callerCacheKey()).toBe("");
-        expect(runWithMcpRequestInfo({ anonymousCaller: true }, callerCacheKey)).toBe("");
-    });
-    it("is stable for one caller and credential, and keeps no credential", () => {
-        const key = runWithMcpRequestInfo(ALICE, callerCacheKey);
-        expect(key).toMatch(/^[\w-]{43}$/);
-        expect(key).not.toContain("token-alice");
-        expect(runWithMcpRequestInfo({ ...ALICE }, callerCacheKey)).toBe(key);
-    });
-    it("tells callers and credentials apart, each on its own", () => {
-        const keys = [
-            ALICE,
-            { ...ALICE, authorization: "Bearer token-alice-2" },
-            { ...ALICE, authUserId: "bob" },
-            { authUserId: "alice" },
-            { authorization: "Bearer token-alice" },
-            // The two parts never run into each other.
-            { authUserId: "alice\nBearer", authorization: "token-alice" },
-        ].map((info) => runWithMcpRequestInfo(info, callerCacheKey));
-        expect(new Set(keys).size).toBe(keys.length);
-        expect(keys).not.toContain("");
-    });
-});
-describe("installMcpRequestContext", () => {
-    it("registers exactly one middleware, even when installed twice", () => {
-        const { server, middlewares } = fakeServer();
-        installMcpRequestContext(server);
-        installMcpRequestContext(server);
-        expect(middlewares).toHaveLength(1);
-    });
-    it("derives the OAuth caller and the Authorization header for downstream handlers", async () => {
-        const headers = { Authorization: "Bearer tok-123" };
-        // The middleware auth shape: the SDK AuthInfo, provider user under `extra`.
-        const ctx = {
-            request: { header: (name) => headers[name] },
-            auth: { token: "tok-123", extra: { user: { id: "user-7" }, payload: { sub: "user-7" } } },
-        };
-        expect(await seenFor(ctx)).toEqual({ authUserId: "user-7", authorization: "Bearer tok-123" });
-    });
-    it("never turns a client-chosen Mcp-Session-Id into an identity", async () => {
-        const headers = {
-            "mcp-session-id": "victim",
-            "Mcp-Session-Id": "victim",
-        };
-        const ctx = {
-            request: { header: (name) => headers[name] },
-            session: { sessionId: "victim" },
-        };
-        expect(await seenFor(ctx)).toEqual({ authUserId: undefined, authorization: undefined });
-    });
-    it("never declares an anonymous caller — only runWithMcpRequestInfo can", async () => {
-        expect(await seenFor({})).toEqual({ authUserId: undefined, authorization: undefined });
-    });
-    it("ignores a non-string auth user id and a throwing header accessor", async () => {
-        const ctx = {
-            request: {
-                header: () => {
-                    throw new Error("no request");
-                },
-            },
-            auth: { extra: { user: { id: 42 } } },
-        };
-        expect(await seenFor(ctx)).toEqual({ authUserId: undefined, authorization: undefined });
-    });
-});
-//# sourceMappingURL=request-context.test.js.map

package/dist/request-context.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-context.test.js","sourceRoot":"","sources":["../src/request-context.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,wBAAwB,EACxB,qBAAqB,GAEtB,MAAM,sBAAsB,CAAA;AAI7B,iFAAiF;AACjF,SAAS,UAAU;IACjB,MAAM,WAAW,GAAiB,EAAE,CAAA;IACpC,MAAM,MAAM,GAAsB;QAChC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE;YACpB,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACpB,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAA;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;AAChC,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,OAAO,CAAC,GAAY;IACjC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,CAAA;IAC5C,wBAAwB,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,IAAI,GAAY,UAAU,CAAA;IAC9B,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;QACnC,IAAI,GAAG,iBAAiB,EAAE,CAAA;IAC5B,CAAC,CAAC,CAAA;IACF,OAAO,IAAI,CAAA;AACb,CAAC;AAED,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACzD,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,aAAa,EAAE,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAA;QAC1F,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAA;QACjD,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,aAAa,EAAE,CAAA;IAC7C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;;GAIG;AACH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,CAAA;IAE1E,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,CAAC,qBAAqB,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAA;QACxD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;QACxC,MAAM,CAAC,qBAAqB,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,IAAI,GAAG;YACX,KAAK;YACL,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,sBAAsB,EAAE;YACnD,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;YAC/B,EAAE,UAAU,EAAE,OAAO,EAAE;YACvB,EAAE,aAAa,EAAE,oBAAoB,EAAE;YACvC,2CAA2C;YAC3C,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE;SAC9D,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAA;QAC5D,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,CAAA;QAC5C,wBAAwB,CAAC,MAAM,CAAC,CAAA;QAChC,wBAAwB,CAAC,MAAM,CAAC,CAAA;QAChC,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAA;QAC3E,4EAA4E;QAC5E,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YACpD,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE;SAC1F,CAAA;QACD,MAAM,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAC/F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,OAAO,GAA2B;YACtC,gBAAgB,EAAE,QAAQ;YAC1B,gBAAgB,EAAE,QAAQ;SAC3B,CAAA;QACD,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YACpD,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;SACjC,CAAA;QACD,MAAM,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAA;IACzF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,CAAC,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAA;IACxF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,GAAG,GAAG;YACV,OAAO,EAAE;gBACP,MAAM,EAAE,GAAG,EAAE;oBACX,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAA;gBAC/B,CAAC;aACF;YACD,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;SACtC,CAAA;QACD,MAAM,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAA;IACzF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/served-fonts.d.ts

@@ -1,38 +0,0 @@
-/**
- * Geist and Geist Mono as a composed server serves them — the one contract
- * between the font route (`installFontAssets`, server path) and the views
- * that load the faces (`HostDocument`, UI path). Dependency-free, so it is
- * exported from both `/server` and `/widgets` without pulling node or React
- * code into the other side.
- *
- * Self-hosted on purpose (Miragon design system §4: no CDN, offline-capable,
- * GDPR-safe): the files come from the `@fontsource-variable/geist(-mono)`
- * packages, latin subset, variable weight 100–900.
- */
-/**
- * Where the server serves the files. The path names the fontsource release
- * the files come from, so a font update changes every URL and the route can
- * be cached `immutable`; `served-fonts.test.ts` holds it equal to the
- * installed packages.
- */
-export declare const SERVED_FONT_PATH = "/fonts/geist-5.3.0";
-/** The latin variable woff2 files under {@link SERVED_FONT_PATH} (the toolkit's `GEIST_FONT_FILES`). */
-export declare const SERVED_FONT_FILES: {
-    readonly sans: "geist-latin-wght-normal.woff2";
-    readonly mono: "geist-mono-latin-wght-normal.woff2";
-};
-/**
- * The base URL a view loads the faces from: {@link SERVED_FONT_PATH} on the
- * origin of the view's public base (mcp-use's `getPublicBaseUrl()`, resolved
- * per `resources/read`: `MCP_URL`'s origin, else the origin the host read the
- * view from). The same origin is the one the view's CSP admits in
- * `resourceDomains`. `undefined` outside a served view document (no base) or
- * for a base that is no http(s) URL — the view then declares no face and the
- * host's font renders.
- *
- * @example
- * servedFontBaseUrl("https://mcp.example.com/mcp/_mcp-use/public/")
- * // "https://mcp.example.com/fonts/geist-5.3.0"
- */
-export declare function servedFontBaseUrl(publicBase: string | undefined): string | undefined;
-//# sourceMappingURL=served-fonts.d.ts.map

package/dist/served-fonts.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"served-fonts.d.ts","sourceRoot":"","sources":["../src/served-fonts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,uBAAuB,CAAA;AAEpD,wGAAwG;AACxG,eAAO,MAAM,iBAAiB;;;CAGpB,CAAA;AAEV;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAUpF"}

package/dist/served-fonts.js

@@ -1,51 +0,0 @@
-/**
- * Geist and Geist Mono as a composed server serves them — the one contract
- * between the font route (`installFontAssets`, server path) and the views
- * that load the faces (`HostDocument`, UI path). Dependency-free, so it is
- * exported from both `/server` and `/widgets` without pulling node or React
- * code into the other side.
- *
- * Self-hosted on purpose (Miragon design system §4: no CDN, offline-capable,
- * GDPR-safe): the files come from the `@fontsource-variable/geist(-mono)`
- * packages, latin subset, variable weight 100–900.
- */
-/**
- * Where the server serves the files. The path names the fontsource release
- * the files come from, so a font update changes every URL and the route can
- * be cached `immutable`; `served-fonts.test.ts` holds it equal to the
- * installed packages.
- */
-export const SERVED_FONT_PATH = "/fonts/geist-5.3.0";
-/** The latin variable woff2 files under {@link SERVED_FONT_PATH} (the toolkit's `GEIST_FONT_FILES`). */
-export const SERVED_FONT_FILES = {
-    sans: "geist-latin-wght-normal.woff2",
-    mono: "geist-mono-latin-wght-normal.woff2",
-};
-/**
- * The base URL a view loads the faces from: {@link SERVED_FONT_PATH} on the
- * origin of the view's public base (mcp-use's `getPublicBaseUrl()`, resolved
- * per `resources/read`: `MCP_URL`'s origin, else the origin the host read the
- * view from). The same origin is the one the view's CSP admits in
- * `resourceDomains`. `undefined` outside a served view document (no base) or
- * for a base that is no http(s) URL — the view then declares no face and the
- * host's font renders.
- *
- * @example
- * servedFontBaseUrl("https://mcp.example.com/mcp/_mcp-use/public/")
- * // "https://mcp.example.com/fonts/geist-5.3.0"
- */
-export function servedFontBaseUrl(publicBase) {
-    if (!publicBase)
-        return undefined;
-    let base;
-    try {
-        base = new URL(publicBase);
-    }
-    catch {
-        return undefined;
-    }
-    if (base.protocol !== "http:" && base.protocol !== "https:")
-        return undefined;
-    return `${base.origin}${SERVED_FONT_PATH}`;
-}
-//# sourceMappingURL=served-fonts.js.map

package/dist/served-fonts.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"served-fonts.js","sourceRoot":"","sources":["../src/served-fonts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAA;AAEpD,wGAAwG;AACxG,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,IAAI,EAAE,+BAA+B;IACrC,IAAI,EAAE,oCAAoC;CAClC,CAAA;AAEV;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA8B;IAC9D,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAA;IACjC,IAAI,IAAS,CAAA;IACb,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC7E,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAA;AAC5C,CAAC"}

package/dist/served-fonts.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=served-fonts.test.d.ts.map

package/dist/served-fonts.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"served-fonts.test.d.ts","sourceRoot":"","sources":["../src/served-fonts.test.ts"],"names":[],"mappings":""}

package/dist/served-fonts.test.js

@@ -1,30 +0,0 @@
-import { createRequire } from "node:module";
-import { describe, expect, it } from "vitest";
-import { GEIST_FONT_FILES } from "@miragon/mcp-toolkit-ui";
-import { SERVED_FONT_FILES, SERVED_FONT_PATH, servedFontBaseUrl } from "./served-fonts.js";
-const require = createRequire(import.meta.url);
-const versionOf = (name) => require(`${name}/package.json`).version;
-describe("the served-font contract", () => {
-    it("names the installed fontsource release in the path, so a font update is a new URL", () => {
-        // The route is cached `immutable`: bumping the font packages without
-        // moving the path would keep every browser on the old files for a year.
-        for (const name of ["@fontsource-variable/geist", "@fontsource-variable/geist-mono"]) {
-            expect(SERVED_FONT_PATH, name).toBe(`/fonts/geist-${versionOf(name)}`);
-        }
-    });
-    it("serves the files the toolkit's fontFaces() names", () => {
-        expect(SERVED_FONT_FILES).toEqual(GEIST_FONT_FILES);
-    });
-});
-describe("servedFontBaseUrl", () => {
-    it("puts the font path on the origin of the view's public base", () => {
-        expect(servedFontBaseUrl("https://mcp.example.com/mcp/_mcp-use/public/")).toBe("https://mcp.example.com/fonts/geist-5.3.0");
-        expect(servedFontBaseUrl("http://127.0.0.1:8400/mcp/_mcp-use/public/")).toBe("http://127.0.0.1:8400/fonts/geist-5.3.0");
-    });
-    it("declares nothing outside a served view document or for a base that is no http(s) URL", () => {
-        for (const base of [undefined, "", "not a url", "data:text/plain,x", "ftp://files.example/"]) {
-            expect(servedFontBaseUrl(base), String(base)).toBeUndefined();
-        }
-    });
-});
-//# sourceMappingURL=served-fonts.test.js.map

package/dist/served-fonts.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"served-fonts.test.js","sourceRoot":"","sources":["../src/served-fonts.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE1F,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC9C,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAE,OAAO,CAAC,GAAG,IAAI,eAAe,CAAyB,CAAC,OAAO,CAAA;AAEpG,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,qEAAqE;QACrE,wEAAwE;QACxE,KAAK,MAAM,IAAI,IAAI,CAAC,4BAA4B,EAAE,iCAAiC,CAAC,EAAE,CAAC;YACrF,MAAM,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACxE,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,iBAAiB,CAAC,8CAA8C,CAAC,CAAC,CAAC,IAAI,CAC5E,2CAA2C,CAC5C,CAAA;QACD,MAAM,CAAC,iBAAiB,CAAC,4CAA4C,CAAC,CAAC,CAAC,IAAI,CAC1E,yCAAyC,CAC1C,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sFAAsF,EAAE,GAAG,EAAE;QAC9F,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,sBAAsB,CAAC,EAAE,CAAC;YAC7F,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;QAC/D,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/server-locale.d.ts

@@ -1,58 +0,0 @@
-import type { ProfileSource } from "./profile.js";
-/** A locale-bound translate for server summaries: `t(key, params?) => string`. */
-export type ServerT = (key: string, params?: Record<string, unknown>) => string;
-/** The shape of the toolkit's `createTranslator(catalogs)` result. */
-export type Translator = (locale: string, key: string, params?: Record<string, unknown>) => string;
-/**
- * Resolve the active locale for the in-flight request from the user profile
- * (`resolveProfileKey` → `language`), falling back to English — also for the
- * `system` preference: the host locale it follows is a widget-side signal
- * (`hostContext.locale`) the server never sees. Pass the
- * tool-handler `ctx` so the lookup resolves the caller exactly like the save
- * path (`resolveProfileKey`: the OAuth caller from `ctx`) — without it, only
- * the ambient request info can name the caller.
- *
- * Fail-soft on every axis — no store, no key, or a store OUTAGE: with
- * `DATABASE_URL` the store is a network call, and this runs as the first
- * `await` of many widget tools — a Postgres hiccup must degrade the summary to
- * English, never fail a tool whose data comes from the engine/Prometheus.
- */
-export declare function resolveProfileLocale(store: ProfileSource | undefined, ctx?: unknown): Promise<string>;
-/**
- * Bind a module's translator to the per-request locale resolution: the module
- * creates its `localizeFor` once —
- * `export const localizeFor = createLocalizeFor(translator)` — and tool
- * handlers localize their model-facing summaries with
- * `const t = await localizeFor(store, ctx); … summary: t("key", { … })`.
- */
-export declare function createLocalizeFor(translator: Translator): (store?: ProfileSource, ctx?: unknown) => Promise<ServerT>;
-/** What a show tool needs to word its result: the model summary and the view title. */
-export interface ViewLocale {
-    /** Model summaries: the profile language, English for "system" ({@link createLocalizeFor}). */
-    t: ServerT;
-    /**
-     * The view's title (the host toolbar) in the profile language, or
-     * undefined when the profile says "system": the server never sees the
-     * host's locale, so it sets no title rather than an English one over a
-     * German view, and the widget's own heading names the view in the host's
-     * language (#322 U3).
-     */
-    title: (key: string, params?: Record<string, unknown>) => string | undefined;
-}
-/**
- * Bind a module's translator to the ONE view-title rule every show tool of
- * every module follows: `export const viewLocaleOf = createViewLocaleOf(translator)`,
- * for a handler that already holds the caller's profile language (a settings
- * view reads the whole record anyway).
- */
-export declare function createViewLocaleOf(translator: Translator): (language: string | undefined) => ViewLocale;
-/**
- * `createLocalizeFor` plus the view title, from ONE profile read: a show tool
- * words its result with
- * `const { t, title } = await localizeViewFor(store, ctx)`, then
- * `title: title("key"), summary: t("key", { … })`.
- * Fail-soft like it: no store, no caller or a store outage reads as "system"
- * (no title, an English summary).
- */
-export declare function createLocalizeViewFor(translator: Translator): (store?: ProfileSource, ctx?: unknown) => Promise<ViewLocale>;
-//# sourceMappingURL=server-locale.d.ts.map

package/dist/server-locale.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"server-locale.d.ts","sourceRoot":"","sources":["../src/server-locale.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAIjD,kFAAkF;AAClF,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAA;AAE/E,sEAAsE;AACtE,MAAM,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAA;AAElG;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,aAAa,GAAG,SAAS,EAChC,GAAG,CAAC,EAAE,OAAO,GACZ,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,UAAU,GACrB,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAK5D;AAED,uFAAuF;AACvF,MAAM,WAAW,UAAU;IACzB,+FAA+F;IAC/F,CAAC,EAAE,OAAO,CAAA;IACV;;;;;;OAMG;IACH,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,GAAG,SAAS,CAAA;CAC7E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,UAAU,GACrB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAM9C;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,UAAU,GACrB,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,UAAU,CAAC,CAM/D"}