@nexusm/mcp-server 0.1.0

package/dist/errors.js

@@ -0,0 +1,245 @@
+/**
+ * Error contract and HTTP→MCP mapping for the Nexusm MCP server.
+ *
+ * Wave 1 (TASK-007): declared the type surface — NexusError, McpErrorCode,
+ *   interface stubs for AuthError / NetworkError / CancelError.
+ * Wave 2B (TASK-013): implements the full HTTP-status → MCP-error-code
+ *   mapping (proposal §M-3) via `mapHttpStatusToMcpError` and
+ *   `isAxiosLikeError`.
+ *
+ * SECURITY (matches auth.ts discipline):
+ *   `toJSON()` deliberately omits `cause` and `stack`. An axios-style error
+ *   attached as `cause` typically carries the original request config
+ *   including the `Authorization: Bearer <token>` header. Leaking that via a
+ *   JSON.stringify of a NexusError would defeat the token-redaction guarantee
+ *   of auth.ts. If callers need to inspect the cause they must do so
+ *   explicitly, not via serialization.
+ */
+/**
+ * MCP / JSON-RPC error codes surfaced by this server.
+ *
+ * Values mirror `@modelcontextprotocol/sdk` `ErrorCode` enum
+ * (`dist/esm/types.d.ts`). We re-declare locally rather than re-export
+ * the SDK enum so that:
+ *   1. errors.ts has zero runtime import from the SDK (keeps the
+ *      contract layer independent of SDK version churn)
+ *   2. TASK-013's mapping logic and tests have a single source of truth
+ *      for which codes this server is allowed to emit
+ *
+ * Scope decision (resolved ambiguity from spec):
+ *   We enumerate the four JSON-RPC standard codes required by §M-3
+ *   (`InvalidRequest`, `MethodNotFound`, `InvalidParams`, `InternalError`),
+ *   plus `ParseError` (-32700) for completeness of the JSON-RPC base
+ *   set, plus `ConnectionClosed` (-32000) and `RequestTimeout` (-32001)
+ *   which the SDK defines and which `NetworkError` / `CancelError`
+ *   downstream mappings will need. UrlElicitationRequired (-32042) is
+ *   intentionally omitted — not in scope for Wave 1 / Wave 2.
+ */
+export var McpErrorCode;
+(function (McpErrorCode) {
+    // JSON-RPC standard (https://www.jsonrpc.org/specification#error_object)
+    McpErrorCode[McpErrorCode["ParseError"] = -32700] = "ParseError";
+    McpErrorCode[McpErrorCode["InvalidRequest"] = -32600] = "InvalidRequest";
+    McpErrorCode[McpErrorCode["MethodNotFound"] = -32601] = "MethodNotFound";
+    McpErrorCode[McpErrorCode["InvalidParams"] = -32602] = "InvalidParams";
+    McpErrorCode[McpErrorCode["InternalError"] = -32603] = "InternalError";
+    // MCP SDK extensions used by this server's error taxonomy
+    McpErrorCode[McpErrorCode["ConnectionClosed"] = -32000] = "ConnectionClosed";
+    McpErrorCode[McpErrorCode["RequestTimeout"] = -32001] = "RequestTimeout";
+    /**
+     * TASK-013 additions: custom codes in the application-defined range
+     * (-32099..-32000 is reserved for implementation; we use the next
+     * available slots above -32000 for semantic clarity).
+     *
+     * Unauthorized (-32011): 401 / 403 from Nexus REST — semantically distinct
+     *   from InvalidRequest (-32600) so clients can detect auth failures without
+     *   parsing the message string.
+     * RateLimited (-32012): 429 Retry-After. Clients should honor
+     *   `data.retry_after_seconds` before retrying.
+     */
+    McpErrorCode[McpErrorCode["Unauthorized"] = -32011] = "Unauthorized";
+    McpErrorCode[McpErrorCode["RateLimited"] = -32012] = "RateLimited";
+})(McpErrorCode || (McpErrorCode = {}));
+/**
+ * Base error for all errors this MCP server emits.
+ *
+ * Carries enough structured context to translate a thrown `NexusError` into a
+ * JSON-RPC error response without re-inspecting the underlying axios / SDK
+ * error.
+ */
+export class NexusError extends Error {
+    /**
+     * Upstream HTTP status (Nexus REST), or `null` when the error did not
+     * originate from an HTTP response (e.g. DNS failure, abort, internal
+     * invariant violation).
+     */
+    httpStatus;
+    /** MCP/JSON-RPC error code that this error will surface as. */
+    mcpErrorCode;
+    /**
+     * Whether the MCP client may safely retry this request.
+     * Populated by `mapHttpStatusToMcpError` and the NLI/network helpers.
+     */
+    retryable;
+    /**
+     * Additional structured data surfaced in the JSON-RPC `error.data` field.
+     * Safe to serialize — must never contain auth tokens or raw SDK internals.
+     * Populated by the mapping layer (e.g. `retry_after_seconds`, `network`,
+     * `timeout`).
+     */
+    data;
+    /**
+     * Underlying cause. Per ES2022 `Error.cause`. **Not serialized** by
+     * `toJSON()` — see file header SECURITY note.
+     */
+    cause;
+    constructor(message, mcpErrorCode, httpStatus = null, cause, options) {
+        super(message);
+        this.name = 'NexusError';
+        this.mcpErrorCode = mcpErrorCode;
+        this.httpStatus = httpStatus;
+        this.retryable = options?.retryable ?? false;
+        if (options?.data !== undefined) {
+            this.data = options.data;
+        }
+        if (cause !== undefined) {
+            this.cause = cause;
+        }
+        // Restore prototype chain — required when extending Error under
+        // some TS target/module combinations (defensive; cheap).
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+    /**
+     * Safe serialization. Deliberately omits `cause` and `stack` to
+     * prevent accidental token leakage if a caller logs the JSON form.
+     *
+     * `data` IS included — it is caller-controlled structured metadata that
+     * must never contain raw SDK objects (that would be caught during review
+     * of `mapHttpStatusToMcpError` callers).
+     */
+    toJSON() {
+        const base = {
+            name: this.name,
+            message: this.message,
+            httpStatus: this.httpStatus,
+            mcpErrorCode: this.mcpErrorCode,
+        };
+        if (this.data !== undefined) {
+            base.data = this.data;
+        }
+        return base;
+    }
+}
+/**
+ * Type guard for axios-compatible errors thrown by `@nexusm/sdk`.
+ *
+ * Matches any object with `isAxiosError === true`, which is the canonical
+ * axios duck-type flag. This guard intentionally does NOT import axios — it
+ * keeps `errors.ts` free of SDK runtime dependencies.
+ */
+export function isAxiosLikeError(err) {
+    return (typeof err === 'object' &&
+        err !== null &&
+        err['isAxiosError'] === true);
+}
+/**
+ * Parse a Retry-After header value into seconds.
+ *
+ * Handles both integer-seconds form ("60") and HTTP-date form
+ * ("Wed, 21 Oct 2026 07:28:00 GMT"). Returns `undefined` if the header
+ * is absent or unparseable — callers should degrade gracefully.
+ */
+function parseRetryAfterSeconds(headers) {
+    if (headers === undefined)
+        return undefined;
+    const raw = headers['retry-after'] ?? headers['Retry-After'];
+    const value = Array.isArray(raw) ? raw[0] : raw;
+    if (value === undefined)
+        return undefined;
+    // Integer seconds
+    const asInt = parseInt(value, 10);
+    if (!Number.isNaN(asInt) && String(asInt) === value.trim()) {
+        return asInt;
+    }
+    // HTTP-date: compute delta from now
+    const ts = Date.parse(value);
+    if (!Number.isNaN(ts)) {
+        const delta = Math.ceil((ts - Date.now()) / 1000);
+        return delta > 0 ? delta : 0;
+    }
+    return undefined;
+}
+/**
+ * Canonical entrypoint for converting an upstream HTTP response (or SDK
+ * network/timeout error) into a typed `NexusError` with the correct
+ * `McpErrorCode`, `retryable` flag, and `data` extras.
+ *
+ * Proposal §M-3 mapping table:
+ *
+ * | httpStatus              | McpErrorCode      | retryable | data extras              |
+ * |-------------------------|-------------------|-----------|--------------------------|
+ * | 401, 403                | Unauthorized      | false     | —                        |
+ * | 404                     | MethodNotFound    | false     | —                        |
+ * | 422                     | InvalidParams     | false     | —                        |
+ * | 429                     | RateLimited       | true*     | retry_after_seconds?: n  |
+ * | 503                     | ConnectionClosed  | true      | —                        |
+ * | 5xx (else)              | InternalError     | true      | —                        |
+ * | null + network=true     | InternalError     | true      | network: true            |
+ * | null + timeout=true     | RequestTimeout    | true      | timeout: true            |
+ *
+ * *429: retryable "after Retry-After header elapses" — we set retryable=true
+ *  and populate `data.retry_after_seconds` so clients can honour the window.
+ *
+ * Note: HTTP 200 + body.errors != null is NOT an error; that is the
+ * partial-degradation path handled in tool handlers (see context.ts). This
+ * function is only invoked on non-2xx responses or SDK error throws.
+ *
+ * @param httpStatus  HTTP status code, or `null` for non-HTTP errors.
+ * @param body        Raw response body (typed `unknown`; we do not parse it).
+ * @param headers     Response headers, used only to extract Retry-After on 429.
+ */
+export function mapHttpStatusToMcpError(httpStatus, body, headers) {
+    // Non-HTTP origin: distinguish timeout from generic network failure by
+    // inspecting whether the caller passed { timeout: true } in body (we
+    // treat `body` as a hint bag for non-HTTP paths).
+    if (httpStatus === null) {
+        const hint = body;
+        if (hint?.['timeout'] === true) {
+            return new NexusError('Request timed out', McpErrorCode.RequestTimeout, null, undefined, {
+                retryable: true,
+                data: { timeout: true },
+            });
+        }
+        return new NexusError('Network error', McpErrorCode.InternalError, null, undefined, {
+            retryable: true,
+            data: { network: true },
+        });
+    }
+    switch (true) {
+        case httpStatus === 401 || httpStatus === 403:
+            return new NexusError(`Unauthorized (HTTP ${httpStatus})`, McpErrorCode.Unauthorized, httpStatus, undefined, { retryable: false });
+        case httpStatus === 404:
+            return new NexusError('Resource not found (HTTP 404)', McpErrorCode.MethodNotFound, 404, undefined, { retryable: false });
+        case httpStatus === 422:
+            return new NexusError('Invalid parameters (HTTP 422)', McpErrorCode.InvalidParams, 422, undefined, { retryable: false });
+        case httpStatus === 429: {
+            const retryAfterSeconds = parseRetryAfterSeconds(headers);
+            const data = {};
+            if (retryAfterSeconds !== undefined) {
+                data['retry_after_seconds'] = retryAfterSeconds;
+            }
+            return new NexusError('Rate limited (HTTP 429)', McpErrorCode.RateLimited, 429, undefined, {
+                retryable: true,
+                data: Object.keys(data).length > 0 ? data : undefined,
+            });
+        }
+        case httpStatus === 503:
+            return new NexusError('Service unavailable (HTTP 503)', McpErrorCode.ConnectionClosed, 503, undefined, { retryable: true });
+        case httpStatus >= 500:
+            return new NexusError(`Internal server error (HTTP ${httpStatus})`, McpErrorCode.InternalError, httpStatus, undefined, { retryable: true });
+        default:
+            // Catch-all for unexpected non-2xx codes not in the table.
+            return new NexusError(`Unexpected HTTP error (status=${httpStatus})`, McpErrorCode.InternalError, httpStatus, undefined, { retryable: false });
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAN,IAAY,YAuBX;AAvBD,WAAY,YAAY;IACtB,yEAAyE;IACzE,gEAAmB,CAAA;IACnB,wEAAuB,CAAA;IACvB,wEAAuB,CAAA;IACvB,sEAAsB,CAAA;IACtB,sEAAsB,CAAA;IACtB,0DAA0D;IAC1D,4EAAyB,CAAA;IACzB,wEAAuB,CAAA;IACvB;;;;;;;;;;OAUG;IACH,oEAAqB,CAAA;IACrB,kEAAoB,CAAA;AACtB,CAAC,EAvBW,YAAY,KAAZ,YAAY,QAuBvB;AAED;;;;;;GAMG;AACH,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC;;;;OAIG;IACa,UAAU,CAAgB;IAE1C,+DAA+D;IAC/C,YAAY,CAAe;IAE3C;;;OAGG;IACa,SAAS,CAAU;IAEnC;;;;;OAKG;IACa,IAAI,CAA2B;IAE/C;;;OAGG;IACsB,KAAK,CAAW;IAEzC,YACE,OAAe,EACf,YAA0B,EAC1B,aAA4B,IAAI,EAChC,KAAe,EACf,OAGC;QAED,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC;QAC7C,IAAI,OAAO,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC3B,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,CAAC;QACD,gEAAgE;QAChE,yDAAyD;QACzD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;OAOG;IACI,MAAM;QAOX,MAAM,IAAI,GAMN;YACF,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAkCD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACX,GAA+B,CAAC,cAAc,CAAC,KAAK,IAAI,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAC7B,OAAkE;IAElE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,kBAAkB;IAClB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,oCAAoC;IACpC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAClD,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAyB,EACzB,IAAa,EACb,OAAuD;IAEvD,uEAAuE;IACvE,qEAAqE;IACrE,kDAAkD;IAClD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAkD,CAAC;QAChE,IAAI,IAAI,EAAE,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,IAAI,UAAU,CAAC,mBAAmB,EAAE,YAAY,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE;gBACvF,SAAS,EAAE,IAAI;gBACf,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,YAAY,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE;YAClF,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,GAAG;YAC3C,OAAO,IAAI,UAAU,CACnB,sBAAsB,UAAU,GAAG,EACnC,YAAY,CAAC,YAAY,EACzB,UAAU,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;QAEJ,KAAK,UAAU,KAAK,GAAG;YACrB,OAAO,IAAI,UAAU,CACnB,+BAA+B,EAC/B,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;QAEJ,KAAK,UAAU,KAAK,GAAG;YACrB,OAAO,IAAI,UAAU,CACnB,+BAA+B,EAC/B,YAAY,CAAC,aAAa,EAC1B,GAAG,EACH,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;QAEJ,KAAK,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC;YACxB,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC1D,MAAM,IAAI,GAA4B,EAAE,CAAC;YACzC,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,IAAI,CAAC,qBAAqB,CAAC,GAAG,iBAAiB,CAAC;YAClD,CAAC;YACD,OAAO,IAAI,UAAU,CAAC,yBAAyB,EAAE,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE;gBACzF,SAAS,EAAE,IAAI;gBACf,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aACtD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,UAAU,KAAK,GAAG;YACrB,OAAO,IAAI,UAAU,CACnB,gCAAgC,EAChC,YAAY,CAAC,gBAAgB,EAC7B,GAAG,EACH,SAAS,EACT,EAAE,SAAS,EAAE,IAAI,EAAE,CACpB,CAAC;QAEJ,KAAK,UAAU,IAAI,GAAG;YACpB,OAAO,IAAI,UAAU,CACnB,+BAA+B,UAAU,GAAG,EAC5C,YAAY,CAAC,aAAa,EAC1B,UAAU,EACV,SAAS,EACT,EAAE,SAAS,EAAE,IAAI,EAAE,CACpB,CAAC;QAEJ;YACE,2DAA2D;YAC3D,OAAO,IAAI,UAAU,CACnB,iCAAiC,UAAU,GAAG,EAC9C,YAAY,CAAC,aAAa,EAC1B,UAAU,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+/**
+ * @nexusm/mcp-server — MCP server entry point.
+ *
+ * Exposes 4 MVP tools (nexus.context_retrieve, nexus.memory_search,
+ * nexus.memory_create, nexus.memory_feedback) over the Model Context
+ * Protocol. Schemas are locked in
+ * `openspec/changes/us-037-mcp-server-exposure/proposal.md` §"R2 工具 Schema 锁定".
+ *
+ * Transport selection (proposal §M-14 dual transport):
+ *   - Default: stdio (StdioServerTransport)
+ *   - Optional: Streamable HTTP via env var `NEXUS_MCP_TRANSPORT=http`
+ *
+ * SDK package note: package.json depends on `@modelcontextprotocol/sdk`
+ * ^1.29 (v1 single package). The proposal §52 mentions a future v2 split
+ * (`@modelcontextprotocol/server` + `@modelcontextprotocol/node`); when the
+ * SDK migrates, update the import subpaths below — schema definitions and
+ * handler shapes are insulated in `src/tools/`.
+ *
+ * Logging discipline: stdio transport multiplexes JSON-RPC over stdin/stdout,
+ * so ALL diagnostic output must go to stderr (`console.error`). Never write
+ * to stdout outside the transport.
+ *
+ * Wave 1 (TASK-003): tool handlers return NOT_IMPLEMENTED. Wave 1+ (TASK-007..010)
+ * wires each handler to nexus-sdk-js. Auth (TASK-004) lives in src/auth.ts.
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG"}

package/dist/index.js

@@ -0,0 +1,146 @@
+#!/usr/bin/env node
+/**
+ * @nexusm/mcp-server — MCP server entry point.
+ *
+ * Exposes 4 MVP tools (nexus.context_retrieve, nexus.memory_search,
+ * nexus.memory_create, nexus.memory_feedback) over the Model Context
+ * Protocol. Schemas are locked in
+ * `openspec/changes/us-037-mcp-server-exposure/proposal.md` §"R2 工具 Schema 锁定".
+ *
+ * Transport selection (proposal §M-14 dual transport):
+ *   - Default: stdio (StdioServerTransport)
+ *   - Optional: Streamable HTTP via env var `NEXUS_MCP_TRANSPORT=http`
+ *
+ * SDK package note: package.json depends on `@modelcontextprotocol/sdk`
+ * ^1.29 (v1 single package). The proposal §52 mentions a future v2 split
+ * (`@modelcontextprotocol/server` + `@modelcontextprotocol/node`); when the
+ * SDK migrates, update the import subpaths below — schema definitions and
+ * handler shapes are insulated in `src/tools/`.
+ *
+ * Logging discipline: stdio transport multiplexes JSON-RPC over stdin/stdout,
+ * so ALL diagnostic output must go to stderr (`console.error`). Never write
+ * to stdout outside the transport.
+ *
+ * Wave 1 (TASK-003): tool handlers return NOT_IMPLEMENTED. Wave 1+ (TASK-007..010)
+ * wires each handler to nexus-sdk-js. Auth (TASK-004) lives in src/auth.ts.
+ */
+import { createRequire } from 'node:module';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { tools, toolsByName } from './tools/index.js';
+import { startMetricsServer, emitToolCall, emitToolDuration, emitToolsList } from './metrics.js';
+/**
+ * Extract the calling MCP client identifier from a request, with fallback.
+ *
+ * MCP `request._meta.clientInfo.name` is the standard JSON-RPC carrier when
+ * the client cooperates (Claude Code, Cursor, mcp-cli all set it). When the
+ * field is missing, fall back to env var `NEXUS_MCP_CLIENT_NAME` (set by
+ * launchers that wrap nexusm-mcp-server) and finally `unknown`. Cardinality
+ * is guarded inside `metrics.ts` via a whitelist (R2 ai D-5).
+ */
+function extractClient(request) {
+    const fromMeta = request._meta?.clientInfo?.name;
+    if (typeof fromMeta === 'string' && fromMeta.length > 0) {
+        return fromMeta;
+    }
+    const fromEnv = process.env.NEXUS_MCP_CLIENT_NAME;
+    return fromEnv && fromEnv.length > 0 ? fromEnv : 'unknown';
+}
+// Read version from package.json without `import assert` (Node 18+ compat).
+const require = createRequire(import.meta.url);
+const pkg = require('../package.json');
+const SERVER_NAME = 'nexus';
+const SERVER_VERSION = pkg.version;
+function createServer() {
+    const server = new Server({ name: SERVER_NAME, version: SERVER_VERSION }, { capabilities: { tools: {} } });
+    // tools/list — return the locked input/output schemas verbatim.
+    server.setRequestHandler(ListToolsRequestSchema, async (request) => {
+        emitToolsList(extractClient(request));
+        return {
+            tools: tools.map((t) => ({
+                name: t.name,
+                description: t.description,
+                inputSchema: t.inputSchema,
+                outputSchema: t.outputSchema,
+            })),
+        };
+    });
+    // tools/call — dispatch to handler by tool name. Unknown tool names surface
+    // as protocol-level errors (per CallToolResult spec: "errors in _finding_
+    // the tool ... should be reported as an MCP error response").
+    // Wraps emitToolCall + emitToolDuration around the handler so metrics fire
+    // on both success + failure (R1 mid_audit C-2 + tech-lead Important #1).
+    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+        const name = request.params.name;
+        const client = extractClient(request);
+        const tool = toolsByName.get(name);
+        if (!tool) {
+            emitToolCall(name, 'unknown_tool', client);
+            throw new Error(`Unknown tool: ${name}`);
+        }
+        const args = (request.params.arguments ?? {});
+        const startNs = process.hrtime.bigint();
+        try {
+            const result = await tool.handler(args);
+            emitToolCall(name, 'success', client);
+            return result;
+        }
+        catch (err) {
+            emitToolCall(name, 'error', client);
+            throw err;
+        }
+        finally {
+            const durNs = process.hrtime.bigint() - startNs;
+            emitToolDuration(name, Number(durNs) / 1e9);
+        }
+    });
+    return server;
+}
+async function startStdio(server) {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error(`nexusm-mcp-server ${SERVER_VERSION} listening on stdio`);
+}
+async function startHttp(server) {
+    // Lazy import so stdio installs aren't forced to bundle the HTTP transport.
+    const { StreamableHTTPServerTransport } = await import('@modelcontextprotocol/sdk/server/streamableHttp.js');
+    const { createServer: createHttpServer } = await import('node:http');
+    const port = Number.parseInt(process.env.NEXUS_MCP_HTTP_PORT ?? '3000', 10);
+    // TODO(wave-2): per-request `server.connect()` + per-request transport
+    // is scaffold-only. Production HTTP transport needs session-keyed Server
+    // lifecycle per MCP spec (see TASK-014 integration tests + TASK-018
+    // middleware in detailed-tasks.yaml).
+    const httpServer = createHttpServer(async (req, res) => {
+        const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+        await server.connect(transport);
+        await transport.handleRequest(req, res);
+    });
+    httpServer.listen(port, () => {
+        console.error(`nexusm-mcp-server ${SERVER_VERSION} listening on http://0.0.0.0:${port}/`);
+    });
+}
+async function main() {
+    const server = createServer();
+    const transportMode = (process.env.NEXUS_MCP_TRANSPORT ?? 'stdio').toLowerCase();
+    // Start Prometheus metrics server on separate port (TASK-014, R2 m-6).
+    // Coexists with stdio transport — different fd / no stdin/stdout contention.
+    await startMetricsServer();
+    if (transportMode === 'http') {
+        await startHttp(server);
+    }
+    else if (transportMode === 'stdio') {
+        await startStdio(server);
+    }
+    else {
+        console.error(`Unknown NEXUS_MCP_TRANSPORT="${transportMode}" (expected "stdio" or "http")`);
+        process.exit(1);
+    }
+}
+main().catch((err) => {
+    // Never let an unhandled error leak credentials. stderr only.
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`nexusm-mcp-server fatal: ${msg}`);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAEnG,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEjG;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,OAAwD;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC;IACjD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAClD,OAAO,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,4EAA4E;AAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAE9D,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC;AAEnC,SAAS,YAAY;IACnB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,gEAAgE;IAChE,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACjE,aAAa,CAAC,aAAa,CAAC,OAA0D,CAAC,CAAC,CAAC;QACzF,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;aAC7B,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,0EAA0E;IAC1E,8DAA8D;IAC9D,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QACjC,MAAM,MAAM,GAAG,aAAa,CAAC,OAA0D,CAAC,CAAC;QACzF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC;QACzE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YACtC,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACpC,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC;YAChD,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,MAAc;IACtC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,qBAAqB,cAAc,qBAAqB,CAAC,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAc;IACrC,4EAA4E;IAC5E,MAAM,EAAE,6BAA6B,EAAE,GACrC,MAAM,MAAM,CAAC,oDAAoD,CAAC,CAAC;IACrE,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5E,uEAAuE;IACvE,yEAAyE;IACzE,oEAAoE;IACpE,sCAAsC;IACtC,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;QACvF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QAC3B,OAAO,CAAC,KAAK,CAAC,qBAAqB,cAAc,gCAAgC,IAAI,GAAG,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAEjF,uEAAuE;IACvE,6EAA6E;IAC7E,MAAM,kBAAkB,EAAE,CAAC;IAE3B,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;QAC7B,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;SAAM,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;QACrC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,gCAAgC,aAAa,gCAAgC,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,8DAA8D;IAC9D,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,KAAK,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/metrics.d.ts

@@ -0,0 +1,146 @@
+/**
+ * Prometheus metrics for the Nexus MCP server (US-037 Wave 2 TASK-014).
+ *
+ * Layer
+ * =====
+ * This file measures the **MCP protocol dispatch layer** — every `tools/call`
+ * and `tools/list` JSON-RPC request the MCP server handles. It is NOT the
+ * same as the Python-side `src/nexus/observability/metrics/mcp.py` which
+ * measures the **backend REST attribution layer** (post-MCP-dispatch).
+ *
+ * Both metric families share the `nexus_mcp_*` prefix but observe different
+ * events at different layers, so:
+ *   - TS metric names use `nexus_mcp_tool_*` (this file)
+ *   - Python metric names use `nexus_mcp_backend_*` (the backend mirror)
+ *   - Alert rules and Grafana panels must NOT sum across both — they would
+ *     double-count a single user action
+ *   - See ADR-001 + Wave 2 mid_audit tech-lead Important #2 (2026-05-22)
+ *
+ * Design notes
+ * ============
+ * - Spins up an **independent** HTTP listener on `NEXUS_METRICS_PORT` (default
+ *   9090) so the Prometheus scrape endpoint never touches stdin/stdout — the
+ *   stdio MCP transport monopolises those streams.
+ * - Uses `prom-client` for registry management; all metric instances are
+ *   module-level singletons (CollectorRegistry deduplication).
+ * - Cardinality guard (R2 ai D-5): the `client` label is limited to a fixed
+ *   allowlist; anything outside the list is coerced to `'unknown'` and a
+ *   separate debug counter tracks the raw string so operators can promote a
+ *   client to the allowlist without restarting the server.
+ *
+ * Startup integration
+ * ===================
+ * Call `startMetricsServer()` once from `src/index.ts` main() — it is a
+ * fire-and-forget async function that opens the HTTP port and logs to stderr.
+ * (Parent session must wire this call; see TASK-014 note.)
+ *
+ * prom-client npm dep note
+ * ========================
+ * Add `"prom-client": "^15.1.0"` to `dependencies` in `package.json`.
+ * This subagent does not modify package.json per task constraints.
+ */
+import { Registry, Counter, Histogram, Gauge } from 'prom-client';
+export declare const registry: Registry<"text/plain; version=0.0.4; charset=utf-8">;
+/**
+ * nexus_mcp_tool_calls_total — counts every tools/call dispatch.
+ *
+ * Labels:
+ *   tool   — MCP tool name (e.g. `nexus.memory_search`)
+ *   status — `'success'` | `'error'` | `'not_implemented'`
+ *   client — normalised client name from KNOWN_CLIENTS (or `'unknown'`)
+ */
+export declare const MCP_TOOL_CALLS_TOTAL: Counter<"status" | "tool" | "client">;
+/**
+ * nexus_mcp_tool_duration_seconds — latency histogram per tool.
+ *
+ * Buckets cover sub-millisecond to 10 s to capture both local (fast) and
+ * remote Nexus API (network-bound) call distributions.
+ *
+ * Labels:
+ *   tool — MCP tool name
+ */
+export declare const MCP_TOOL_DURATION_SECONDS: Histogram<"tool">;
+/**
+ * nexus_mcp_tools_list_calls_total — counts every tools/list request.
+ *
+ * Labels:
+ *   client — normalised client name
+ */
+export declare const MCP_TOOLS_LIST_CALLS_TOTAL: Counter<"client">;
+/**
+ * nexus_mcp_tool_description_version — Info-style gauge exposing the schema hash.
+ *
+ * Set to 1.0 with a `hash` label containing the first 8 characters of the
+ * SHA-256 of the concatenated tool description strings.  Alerts fire when
+ * the hash drifts between replicas or between server restarts.
+ *
+ * Labels:
+ *   hash — 8-char hex prefix of SHA-256(all tool descriptions)
+ */
+export declare const MCP_TOOL_DESCRIPTION_VERSION: Gauge<"hash">;
+/**
+ * nexus_mcp_unknown_client_total — debug counter for cardinality guard.
+ *
+ * Incremented when a raw client name is not in KNOWN_CLIENTS.  The `raw`
+ * label carries the original string so operators can identify clients to
+ * add to the allowlist.
+ *
+ * Labels:
+ *   raw — the raw client identifier as received (verbatim)
+ */
+export declare const MCP_UNKNOWN_CLIENT_TOTAL: Counter<"raw">;
+/**
+ * Record a tool/call dispatch.
+ *
+ * @param tool   - MCP tool name (e.g. `'nexus.memory_search'`)
+ * @param status - outcome string (`'success'`, `'error'`, `'not_implemented'`)
+ * @param client - raw client identifier; normalised internally against the allowlist
+ */
+export declare function emitToolCall(tool: string, status: string, client: string): void;
+/**
+ * Record a tools/list request.
+ *
+ * @param client - raw client identifier; normalised internally against the allowlist
+ */
+export declare function emitToolsList(client: string): void;
+/**
+ * Record an observation in the tool duration histogram.
+ *
+ * Call this with `tool` and the elapsed time in seconds.  Designed so callers
+ * wrap their handler with `Date.now()` before/after and pass
+ * `(end - start) / 1000`.
+ *
+ * @param tool        - MCP tool name
+ * @param durationSec - elapsed time in seconds
+ */
+export declare function emitToolDuration(tool: string, durationSec: number): void;
+/**
+ * Increment the debug counter for an unknown client.
+ *
+ * Called internally by `emitToolCall` and `emitToolsList`; exposed so callers
+ * can also emit directly if they detect the anomaly before dispatching.
+ *
+ * @param rawName - raw client string that was not in the allowlist
+ */
+export declare function emitUnknownClient(rawName: string): void;
+/**
+ * Register the tool-description schema hash in the Info gauge.
+ *
+ * Set this once during startup after the tool registry is built.  Pass the
+ * first 8 hex characters of SHA-256(concatenated tool descriptions) as `hash`.
+ *
+ * @param hash - 8-char hex prefix of the schema hash
+ */
+export declare function setDescriptionHash(hash: string): void;
+/**
+ * Start the Prometheus metrics scrape endpoint.
+ *
+ * Opens an HTTP server on `process.env.NEXUS_METRICS_PORT ?? 9090`.  The
+ * server only handles `GET /metrics`; all other paths return 404.
+ *
+ * This function must be called from `src/index.ts` main() (parent session
+ * wires the call).  It is intentionally fire-and-forget — it does not compete
+ * with the MCP transport for stdin/stdout.
+ */
+export declare function startMetricsServer(): Promise<void>;
+//# sourceMappingURL=metrics.d.ts.map

package/dist/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../src/metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAyB,MAAM,aAAa,CAAC;AAQzF,eAAO,MAAM,QAAQ,sDAAiB,CAAC;AAuBvC;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,uCAK/B,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,mBAMpC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,mBAKrC,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,eAKvC,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,gBAKnC,CAAC;AAMH;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAM/E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAMlD;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAExE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAErD;AAMD;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CA2BxD"}