npm - @nifrajs/mcp - Versions diffs - 3.3.0 → 3.5.0 - Mend

@nifrajs/mcp 3.3.0 → 3.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (26) hide show

package/dist/protocol.js CHANGED Viewed

@@ -36,6 +36,9 @@ export const MCP_ERROR = {
 };
 const META_PROTOCOL_VERSION = "io.modelcontextprotocol/protocolVersion";
 const META_SERVER_INFO = "io.modelcontextprotocol/serverInfo";
+const MAX_RPC_ID_LENGTH = 128;
+const MAX_RPC_METHOD_LENGTH = 128;
+const MAX_CANCEL_REASON_LENGTH = 512;
 /** The MIME type a UI resource MUST use so a host recognizes it as an MCP App widget (SEP-1865). */
 export const UI_MIME = "text/html;profile=mcp-app";
 /** The `capabilities.extensions` key advertising UI support in the `initialize` result (SEP-1865). */
@@ -56,7 +59,68 @@ export function createMcpProtocolState() {
 function requestKey(id) {
     if (typeof id === "string")
         return `s:${id}`;
-    return typeof id === "number" && Number.isFinite(id) ? `n:${id}` : undefined;
+    return typeof id === "number" && Number.isSafeInteger(id) ? `n:${id}` : undefined;
+}
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** Validate a JSON-RPC request/notification before any transport or method-specific access. */
+export function isJsonRpcRequest(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const record = value;
+    if (Object.hasOwn(record, "result") || Object.hasOwn(record, "error"))
+        return false;
+    if (Object.hasOwn(record, "jsonrpc") && record.jsonrpc !== "2.0")
+        return false;
+    if (typeof record.method !== "string" ||
+        record.method.length === 0 ||
+        record.method.length > MAX_RPC_METHOD_LENGTH)
+        return false;
+    if (Object.hasOwn(record, "id")) {
+        const id = record.id;
+        if (id !== null &&
+            typeof id !== "string" &&
+            !(typeof id === "number" && Number.isSafeInteger(id)))
+            return false;
+        if (typeof id === "string" && id.length > MAX_RPC_ID_LENGTH)
+            return false;
+    }
+    return (!Object.hasOwn(record, "params") ||
+        (record.params !== null && typeof record.params === "object" && !Array.isArray(record.params)));
+}
+/** Validate a JSON-RPC response received by a transport-side client hook. Responses are not accepted
+ * by {@link handleRpc}; this guard exists for the stdio roots/list answer, which is the one server-
+ * initiated request response the CLI consumes itself. */
+export function isJsonRpcResponse(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const record = value;
+    if (record.jsonrpc !== "2.0")
+        return false;
+    if (Object.hasOwn(record, "method") || Object.hasOwn(record, "params"))
+        return false;
+    if (record.id !== null &&
+        typeof record.id !== "string" &&
+        !(typeof record.id === "number" && Number.isSafeInteger(record.id)))
+        return false;
+    if (typeof record.id === "string" && record.id.length > MAX_RPC_ID_LENGTH)
+        return false;
+    const hasResult = Object.hasOwn(record, "result");
+    const hasError = Object.hasOwn(record, "error");
+    if (hasResult === hasError)
+        return false;
+    if (!hasError)
+        return true;
+    const error = record.error;
+    if (error === null || typeof error !== "object" || Array.isArray(error))
+        return false;
+    const errorRecord = error;
+    return (typeof errorRecord.code === "number" &&
+        Number.isSafeInteger(errorRecord.code) &&
+        typeof errorRecord.message === "string" &&
+        errorRecord.message.length > 0 &&
+        errorRecord.message.length <= MAX_RPC_METHOD_LENGTH);
 }
 function metaObject(params) {
     const meta = params?._meta;
@@ -78,7 +142,9 @@ function progressTokenOf(params) {
 }
 function cancellationReason(params) {
     const reason = params?.reason;
-    return typeof reason === "string" && reason.length > 0 ? reason : undefined;
+    return typeof reason === "string" && reason.length > 0
+        ? reason.slice(0, MAX_CANCEL_REASON_LENGTH)
+        : undefined;
 }
 function linkAbortSignal(parent, child) {
     if (parent === undefined)
@@ -144,6 +210,8 @@ function toolCallResult(result, tool) {
  * notification (no reply). Tool errors are reported in-band (`isError`) so the agent can react to them.
  */
 export async function handleRpc(message, tools, serverInfo, features = {}, options = {}) {
+    if (!isJsonRpcRequest(message))
+        return rpcError(null, -32600, "Invalid Request");
     const { id, method, params } = message;
     const isNotification = id === undefined;
     const rid = id ?? null;
@@ -255,7 +323,10 @@ export async function handleRpc(message, tools, serverInfo, features = {}, optio
             const tool = tools.find((t) => t.name === name);
             if (!tool)
                 return rpcError(rid, -32602, `unknown tool: ${String(name)}`);
-            const args = params?.arguments ?? {};
+            const suppliedArguments = params?.arguments;
+            if (suppliedArguments !== undefined && !record(suppliedArguments))
+                return rpcError(rid, -32602, "tool arguments must be an object");
+            const args = suppliedArguments ?? {};
             const controller = new AbortController();
             const key = requestKey(id);
             if (key !== undefined && state.activeRequests.has(key)) {
@@ -299,15 +370,19 @@ export async function handleRpc(message, tools, serverInfo, features = {}, optio
                 reportProgress(1, 1);
                 return reply(toolCallResult(result, tool));
             }
-            catch (err) {
+            catch {
                 if (controller.signal.aborted) {
                     return reply({
                         content: [{ type: "text", text: abortMessage(controller.signal) }],
                         isError: true,
                     });
                 }
-                const msg = err instanceof Error ? err.message : String(err);
-                return reply({ content: [{ type: "text", text: `Error: ${msg}` }], isError: true });
+                // Handler errors are application-internal data. Never reflect their messages to a remote
+                // MCP caller: paths, SQL diagnostics, provider responses, and secrets commonly end up there.
+                return reply({
+                    content: [{ type: "text", text: "Tool execution failed" }],
+                    isError: true,
+                });
             }
             finally {
                 cleanupAbort();
@@ -362,16 +437,19 @@ export async function handleRpc(message, tools, serverInfo, features = {}, optio
             const prompt = prompts.find((p) => p.name === name);
             if (!prompt)
                 return rpcError(rid, -32602, `unknown prompt: ${String(name)}`);
-            const args = params?.arguments ?? {};
+            const suppliedArguments = params?.arguments;
+            if (suppliedArguments !== undefined && !record(suppliedArguments))
+                return rpcError(rid, -32602, "prompt arguments must be an object");
+            const args = suppliedArguments ?? {};
             try {
                 return reply({
                     description: prompt.description,
                     messages: await prompt.handler(args),
                 });
             }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                return rpcError(rid, -32000, msg);
+            catch {
+                // Prompt handlers have the same trust boundary as tools; expose only a stable protocol error.
+                return rpcError(rid, -32000, "Prompt execution failed");
             }
         }
         default:

package/dist/protocol.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;4CAG4C;AAC5C,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAA;AAC5C;iHACiH;AACjH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,YAAY;CACb,CAAC,CAAA;AAEF;;kGAEkG;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAA;AACnD,+GAA+G;AAC/G,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,eAAe,EAAE,CAAC,KAAK;IACvB,mBAAmB,EAAE,CAAC,KAAK;IAC3B;wGACoG;IACpG,YAAY,EAAE,CAAC,KAAK;CACZ,CAAA;AACV,MAAM,qBAAqB,GAAG,yCAAyC,CAAA;AACvE,MAAM,gBAAgB,GAAG,oCAAoC,CAAA;AAE7D,oGAAoG;AACpG,MAAM,CAAC,MAAM,OAAO,GAAG,2BAA2B,CAAA;AAClD,sGAAsG;AACtG,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAA;AA+G5D,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,EAAa,EAAE,KAAc,EAAmB,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,KAAK;IACd,EAAE;IACF,MAAM,EAAE,KAAK;CACd,CAAC,CAAA;AACF,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,EAAa,EACb,IAAY,EACZ,OAAe,EACf,IAAc,EACG,EAAE,CAAC,CAAC;IACrB,OAAO,EAAE,KAAK;IACd,EAAE;IACF,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;CACxE,CAAC,CAAA;AAYF,MAAM,UAAU,sBAAsB;IACpC,OAAO,EAAE,cAAc,EAAE,IAAI,GAAG,EAAE,EAAE,CAAA;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,EAAW;IAC7B,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,EAAE,EAAE,CAAA;IAC5C,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC9E,CAAC;AAED,SAAS,UAAU,CACjB,MAA2C;IAE3C,MAAM,IAAI,GAAG,MAAM,EAAE,KAAK,CAAA;IAC1B,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACtE,CAAC,CAAE,IAAgC;QACnC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;0FAC0F;AAC1F,MAAM,UAAU,eAAe,CAAC,MAA2C;IACzE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAA;IAC3D,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,MAA2C;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,aAAa,CAAA;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvF,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,MAA2C;IACrE,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAA;IAC7B,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7E,CAAC;AAED,SAAS,eAAe,CAAC,MAA+B,EAAE,KAAsB;IAC9E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAA;IACzC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC1B,OAAO,GAAG,EAAE,GAAE,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACpD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACvD,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,MAAmB;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,cAAc,MAAM,EAAE,CAAA;IAClF,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,WAAmB;IAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IACpD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,CAAC,CAAC,CAAA;IAC3E,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,QAAQ,CAAA;IAC3C,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,CAAA;AACjD,CAAC;AAED,yGAAyG;AACzG,MAAM,oBAAoB,GAAG,SAAS,CAAA;AAEtC;;8DAE8D;AAC9D,SAAS,YAAY,CACnB,KAA8B,EAC9B,UAA6C,EAC7C,SAAkB;IAElB,MAAM,YAAY,GAChB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QACpF,CAAC,CAAE,KAAK,CAAC,KAAiC;QAC1C,CAAC,CAAC,SAAS,CAAA;IACf,OAAO;QACL,GAAG,KAAK;QACR,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,UAAU,EAAE;QAClE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAA;AACH,CAAC;AAED;;wGAEwG;AACxG,SAAS,cAAc,CAAC,MAA8B,EAAE,IAAa;IACnE,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;IACpF,MAAM,IAAI,GACR,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QACpD,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE;QACpD,CAAC,CAAC,SAAS,CAAA;IACf,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;QAC7B,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAuB,EACvB,KAAyB,EACzB,UAA6C,EAC7C,WAA8B,EAAE,EAChC,UAA8B,EAAE;IAEhC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IACtC,MAAM,cAAc,GAAG,EAAE,KAAK,SAAS,CAAA;IACvC,MAAM,GAAG,GAAG,EAAE,IAAI,IAAI,CAAA;IACtB,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAA;IAC1C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,sBAAsB,EAAE,CAAA;IAEvD,yGAAyG;IACzG,wGAAwG;IACxG,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,gBAAgB,KAAK,SAAS,CAAA;IAC/C,IAAI,QAAQ,IAAI,gBAAgB,KAAK,uBAAuB,EAAE,CAAC;QAC7D,OAAO,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,mBAAmB,EAAE,8BAA8B,EAAE;YAClF,SAAS,EAAE,CAAC,uBAAuB,CAAC;YACpC,SAAS,EAAE,gBAAgB;SAC5B,CAAC,CAAA;IACJ,CAAC;IACD,wGAAwG;IACxG,+FAA+F;IAC/F,MAAM,KAAK,GAAG,CAAC,KAA8B,EAAE,SAAS,GAAG,KAAK,EAAmB,EAAE,CACnF,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAE/E,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,kGAAkG;YAClG,mFAAmF;YACnF,MAAM,SAAS,GAAG,MAAM,EAAE,eAAe,CAAA;YACzC,MAAM,eAAe,GACnB,OAAO,SAAS,KAAK,QAAQ,IAAI,2BAA2B,CAAC,GAAG,CAAC,SAAS,CAAC;gBACzE,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,gBAAgB,CAAA;YACtB,OAAO,SAAS,CAAC,GAAG,EAAE;gBACpB,eAAe;gBACf,YAAY,EAAE;oBACZ,KAAK,EAAE,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS;wBAC3B,CAAC,CAAC;4BACE,UAAU,EAAE;gCACV,CAAC,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,EAAE;6BACtE;yBACF;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,UAAU;gBACV,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxF,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,iBAAiB;YACpB,8FAA8F;YAC9F,qDAAqD;YACrD,OAAO,SAAS,CACd,GAAG,EACH,YAAY,CACV;gBACE,iBAAiB,EAAE,CAAC,uBAAuB,CAAC;gBAC5C,YAAY,EAAE;oBACZ,KAAK,EAAE,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS;wBAC3B,CAAC,CAAC;4BACE,UAAU,EAAE;gCACV,CAAC,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,EAAE;6BACtE;yBACF;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxF,EACD,UAAU,EACV,IAAI,CACL,CACF,CAAA;QACH,KAAK,2BAA2B;YAC9B,OAAO,IAAI,CAAA;QACb,KAAK,yBAAyB,CAAC,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;YACzC,IAAI,GAAG,KAAK,SAAS;gBAAE,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAA;YACvF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,KAAK,MAAM;YACT,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QAC3B,KAAK,YAAY;YACf,OAAO,KAAK,CACV,MAAM,EAAE,OAAO,KAAK,IAAI;gBACtB,CAAC,CAAC;oBACE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACvB,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC;qBAC/C,CAAC,CAAC;iBACJ;gBACH,CAAC,CAAC;oBACE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACvB,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACtE,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACrD,CAAC,CAAC;iBACJ,EACL,IAAI,CACL,CAAA;QACH,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAA;YACzB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;YAC/C,IAAI,CAAC,IAAI;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,iBAAiB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACxE,OAAO,KAAK,CAAC;gBACX,IAAI,EAAE;oBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D;aACF,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAA;YACzB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;YAC/C,IAAI,CAAC,IAAI;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,iBAAiB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACxE,MAAM,IAAI,GAAI,MAAM,EAAE,SAAqC,IAAI,EAAE,CAAA;YACjE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;YACxC,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;YAC1B,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,6CAA6C,CAAC,CAAA;YAC7E,CAAC;YACD,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;YAChE,IAAI,GAAG,KAAK,SAAS;gBAAE,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAChE,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;YAC7C,IAAI,YAAY,GAAG,MAAM,CAAC,iBAAiB,CAAA;YAC3C,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,KAAc,EAAQ,EAAE;gBAChE,IACE,aAAa,KAAK,SAAS;oBAC3B,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC1B,QAAQ,IAAI,YAAY;oBACxB,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAChD,CAAC;oBACD,OAAM;gBACR,CAAC;gBACD,YAAY,GAAG,QAAQ,CAAA;gBACvB,OAAO,CAAC,gBAAgB,EAAE,CAAC;oBACzB,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,wBAAwB;oBAChC,MAAM,EAAE;wBACN,aAAa;wBACb,QAAQ;wBACR,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC1C;iBACF,CAAC,CAAA;YACJ,CAAC,CAAA;YACD,IAAI,CAAC;gBACH,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;gBACpB,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;gBAChF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;oBACtC,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,SAAS,EAAE,GAAG;oBACd,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzD,cAAc;iBACf,CAAC,CAAA;gBACF,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;gBAChF,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;gBACpB,OAAO,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC9B,OAAO,KAAK,CAAC;wBACX,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;wBAClE,OAAO,EAAE,IAAI;qBACd,CAAC,CAAA;gBACJ,CAAC;gBACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5D,OAAO,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;YACrF,CAAC;oBAAS,CAAC;gBACT,YAAY,EAAE,CAAA;gBACd,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,UAAU,EAAE,CAAC;oBACtE,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,gBAAgB;YACnB,OAAO,KAAK,CACV;gBACE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC/B,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrD,CAAC,CAAC;aACJ,EACD,IAAI,CACL,CAAA;QACH,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,CAAA;YACvB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;YACrD,IAAI,CAAC,QAAQ;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,qBAAqB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC/E,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;gBACrC,OAAO,KAAK,CACV;oBACE,QAAQ,EAAE;wBACR;4BACE,GAAG,EAAE,QAAQ,CAAC,GAAG;4BACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,YAAY;4BAC/D,IAAI,EAAE,OAAO,CAAC,IAAI;4BAClB,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACnE;qBACF;iBACF,EACD,IAAI,CACL,CAAA;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,8FAA8F;gBAC9F,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,4BAA4B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;QACD,KAAK,cAAc;YACjB,OAAO,KAAK,CACV;gBACE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjE,CAAC,CAAC;aACJ,EACD,IAAI,CACL,CAAA;QACH,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAA;YACzB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;YACnD,IAAI,CAAC,MAAM;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,mBAAmB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC5E,MAAM,IAAI,GAAI,MAAM,EAAE,SAAqC,IAAI,EAAE,CAAA;YACjE,IAAI,CAAC;gBACH,OAAO,KAAK,CAAC;oBACX,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,QAAQ,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;iBACrC,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5D,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YACnC,CAAC;QACH,CAAC;QACD;YACE,IAAI,cAAc;gBAAE,OAAO,IAAI,CAAA;YAC/B,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,qBAAqB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACvE,CAAC;AACH,CAAC"}
1	+ {"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;4CAG4C;AAC5C,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAA;AAC5C;iHACiH;AACjH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,YAAY;CACb,CAAC,CAAA;AAEF;;kGAEkG;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAA;AACnD,+GAA+G;AAC/G,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,eAAe,EAAE,CAAC,KAAK;IACvB,mBAAmB,EAAE,CAAC,KAAK;IAC3B;wGACoG;IACpG,YAAY,EAAE,CAAC,KAAK;CACZ,CAAA;AACV,MAAM,qBAAqB,GAAG,yCAAyC,CAAA;AACvE,MAAM,gBAAgB,GAAG,oCAAoC,CAAA;AAC7D,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAC7B,MAAM,qBAAqB,GAAG,GAAG,CAAA;AACjC,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAEpC,oGAAoG;AACpG,MAAM,CAAC,MAAM,OAAO,GAAG,2BAA2B,CAAA;AAClD,sGAAsG;AACtG,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAA;AA+G5D,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,EAAa,EAAE,KAAc,EAAmB,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,KAAK;IACd,EAAE;IACF,MAAM,EAAE,KAAK;CACd,CAAC,CAAA;AACF,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,EAAa,EACb,IAAY,EACZ,OAAe,EACf,IAAc,EACG,EAAE,CAAC,CAAC;IACrB,OAAO,EAAE,KAAK;IACd,EAAE;IACF,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;CACxE,CAAC,CAAA;AAYF,MAAM,UAAU,sBAAsB;IACpC,OAAO,EAAE,cAAc,EAAE,IAAI,GAAG,EAAE,EAAE,CAAA;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,EAAW;IAC7B,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,EAAE,EAAE,CAAA;IAC5C,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AACnF,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrF,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IACnF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC9E,IACE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,qBAAqB;QAE5C,OAAO,KAAK,CAAA;IACd,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAA;QACpB,IACE,EAAE,KAAK,IAAI;YACX,OAAO,EAAE,KAAK,QAAQ;YACtB,CAAC,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAErD,OAAO,KAAK,CAAA;QACd,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,iBAAiB;YAAE,OAAO,KAAK,CAAA;IAC3E,CAAC;IACD,OAAO,CACL,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;QAChC,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAC/F,CAAA;AACH,CAAC;AAED;;yDAEyD;AACzD,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrF,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC1C,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IACpF,IACE,MAAM,CAAC,EAAE,KAAK,IAAI;QAClB,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;QAC7B,CAAC,CAAC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAEnE,OAAO,KAAK,CAAA;IACd,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,iBAAiB;QAAE,OAAO,KAAK,CAAA;IACvF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/C,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACxC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrF,MAAM,WAAW,GAAG,KAAgC,CAAA;IACpD,OAAO,CACL,OAAO,WAAW,CAAC,IAAI,KAAK,QAAQ;QACpC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC;QACtC,OAAO,WAAW,CAAC,OAAO,KAAK,QAAQ;QACvC,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAC9B,WAAW,CAAC,OAAO,CAAC,MAAM,IAAI,qBAAqB,CACpD,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CACjB,MAA2C;IAE3C,MAAM,IAAI,GAAG,MAAM,EAAE,KAAK,CAAA;IAC1B,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACtE,CAAC,CAAE,IAAgC;QACnC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;0FAC0F;AAC1F,MAAM,UAAU,eAAe,CAAC,MAA2C;IACzE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAA;IAC3D,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,MAA2C;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,aAAa,CAAA;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvF,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,MAA2C;IACrE,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAA;IAC7B,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QACpD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC;QAC3C,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,SAAS,eAAe,CAAC,MAA+B,EAAE,KAAsB;IAC9E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAA;IACzC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC1B,OAAO,GAAG,EAAE,GAAE,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACpD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACvD,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,MAAmB;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,cAAc,MAAM,EAAE,CAAA;IAClF,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,WAAmB;IAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IACpD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,CAAC,CAAC,CAAA;IAC3E,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,QAAQ,CAAA;IAC3C,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,CAAA;AACjD,CAAC;AAED,yGAAyG;AACzG,MAAM,oBAAoB,GAAG,SAAS,CAAA;AAEtC;;8DAE8D;AAC9D,SAAS,YAAY,CACnB,KAA8B,EAC9B,UAA6C,EAC7C,SAAkB;IAElB,MAAM,YAAY,GAChB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QACpF,CAAC,CAAE,KAAK,CAAC,KAAiC;QAC1C,CAAC,CAAC,SAAS,CAAA;IACf,OAAO;QACL,GAAG,KAAK;QACR,UAAU,EAAE,UAAU;QACtB,KAAK,EAAE,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,UAAU,EAAE;QAClE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAA;AACH,CAAC;AAED;;wGAEwG;AACxG,SAAS,cAAc,CAAC,MAA8B,EAAE,IAAa;IACnE,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;IACpF,MAAM,IAAI,GACR,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QACpD,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE;QACpD,CAAC,CAAC,SAAS,CAAA;IACf,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;QAC7B,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAuB,EACvB,KAAyB,EACzB,UAA6C,EAC7C,WAA8B,EAAE,EAChC,UAA8B,EAAE;IAEhC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAA;IAChF,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IACtC,MAAM,cAAc,GAAG,EAAE,KAAK,SAAS,CAAA;IACvC,MAAM,GAAG,GAAG,EAAE,IAAI,IAAI,CAAA;IACtB,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAA;IAC1C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,sBAAsB,EAAE,CAAA;IAEvD,yGAAyG;IACzG,wGAAwG;IACxG,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,gBAAgB,KAAK,SAAS,CAAA;IAC/C,IAAI,QAAQ,IAAI,gBAAgB,KAAK,uBAAuB,EAAE,CAAC;QAC7D,OAAO,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,mBAAmB,EAAE,8BAA8B,EAAE;YAClF,SAAS,EAAE,CAAC,uBAAuB,CAAC;YACpC,SAAS,EAAE,gBAAgB;SAC5B,CAAC,CAAA;IACJ,CAAC;IACD,wGAAwG;IACxG,+FAA+F;IAC/F,MAAM,KAAK,GAAG,CAAC,KAA8B,EAAE,SAAS,GAAG,KAAK,EAAmB,EAAE,CACnF,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAE/E,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,kGAAkG;YAClG,mFAAmF;YACnF,MAAM,SAAS,GAAG,MAAM,EAAE,eAAe,CAAA;YACzC,MAAM,eAAe,GACnB,OAAO,SAAS,KAAK,QAAQ,IAAI,2BAA2B,CAAC,GAAG,CAAC,SAAS,CAAC;gBACzE,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,gBAAgB,CAAA;YACtB,OAAO,SAAS,CAAC,GAAG,EAAE;gBACpB,eAAe;gBACf,YAAY,EAAE;oBACZ,KAAK,EAAE,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS;wBAC3B,CAAC,CAAC;4BACE,UAAU,EAAE;gCACV,CAAC,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,EAAE;6BACtE;yBACF;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,UAAU;gBACV,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxF,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,iBAAiB;YACpB,8FAA8F;YAC9F,qDAAqD;YACrD,OAAO,SAAS,CACd,GAAG,EACH,YAAY,CACV;gBACE,iBAAiB,EAAE,CAAC,uBAAuB,CAAC;gBAC5C,YAAY,EAAE;oBACZ,KAAK,EAAE,EAAE;oBACT,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS;wBAC3B,CAAC,CAAC;4BACE,UAAU,EAAE;gCACV,CAAC,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,EAAE;6BACtE;yBACF;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxF,EACD,UAAU,EACV,IAAI,CACL,CACF,CAAA;QACH,KAAK,2BAA2B;YAC9B,OAAO,IAAI,CAAA;QACb,KAAK,yBAAyB,CAAC,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;YACzC,IAAI,GAAG,KAAK,SAAS;gBAAE,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAA;YACvF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,KAAK,MAAM;YACT,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QAC3B,KAAK,YAAY;YACf,OAAO,KAAK,CACV,MAAM,EAAE,OAAO,KAAK,IAAI;gBACtB,CAAC,CAAC;oBACE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACvB,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC;qBAC/C,CAAC,CAAC;iBACJ;gBACH,CAAC,CAAC;oBACE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACvB,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACtE,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACrD,CAAC,CAAC;iBACJ,EACL,IAAI,CACL,CAAA;QACH,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAA;YACzB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;YAC/C,IAAI,CAAC,IAAI;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,iBAAiB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACxE,OAAO,KAAK,CAAC;gBACX,IAAI,EAAE;oBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D;aACF,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAA;YACzB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;YAC/C,IAAI,CAAC,IAAI;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,iBAAiB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACxE,MAAM,iBAAiB,GAAG,MAAM,EAAE,SAAS,CAAA;YAC3C,IAAI,iBAAiB,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBAC/D,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,kCAAkC,CAAC,CAAA;YAClE,MAAM,IAAI,GAAG,iBAAiB,IAAI,EAAE,CAAA;YACpC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;YACxC,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;YAC1B,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,6CAA6C,CAAC,CAAA;YAC7E,CAAC;YACD,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;YAChE,IAAI,GAAG,KAAK,SAAS;gBAAE,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAChE,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;YAC7C,IAAI,YAAY,GAAG,MAAM,CAAC,iBAAiB,CAAA;YAC3C,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,KAAc,EAAQ,EAAE;gBAChE,IACE,aAAa,KAAK,SAAS;oBAC3B,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC1B,QAAQ,IAAI,YAAY;oBACxB,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAChD,CAAC;oBACD,OAAM;gBACR,CAAC;gBACD,YAAY,GAAG,QAAQ,CAAA;gBACvB,OAAO,CAAC,gBAAgB,EAAE,CAAC;oBACzB,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,wBAAwB;oBAChC,MAAM,EAAE;wBACN,aAAa;wBACb,QAAQ;wBACR,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC1C;iBACF,CAAC,CAAA;YACJ,CAAC,CAAA;YACD,IAAI,CAAC;gBACH,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;gBACpB,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;gBAChF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;oBACtC,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,SAAS,EAAE,GAAG;oBACd,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzD,cAAc;iBACf,CAAC,CAAA;gBACF,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;gBAChF,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;gBACpB,OAAO,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC9B,OAAO,KAAK,CAAC;wBACX,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;wBAClE,OAAO,EAAE,IAAI;qBACd,CAAC,CAAA;gBACJ,CAAC;gBACD,yFAAyF;gBACzF,6FAA6F;gBAC7F,OAAO,KAAK,CAAC;oBACX,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;oBAC1D,OAAO,EAAE,IAAI;iBACd,CAAC,CAAA;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,EAAE,CAAA;gBACd,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,UAAU,EAAE,CAAC;oBACtE,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,gBAAgB;YACnB,OAAO,KAAK,CACV;gBACE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC/B,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrD,CAAC,CAAC;aACJ,EACD,IAAI,CACL,CAAA;QACH,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,CAAA;YACvB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;YACrD,IAAI,CAAC,QAAQ;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,qBAAqB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC/E,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;gBACrC,OAAO,KAAK,CACV;oBACE,QAAQ,EAAE;wBACR;4BACE,GAAG,EAAE,QAAQ,CAAC,GAAG;4BACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,YAAY;4BAC/D,IAAI,EAAE,OAAO,CAAC,IAAI;4BAClB,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACnE;qBACF;iBACF,EACD,IAAI,CACL,CAAA;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,8FAA8F;gBAC9F,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,4BAA4B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;QACD,KAAK,cAAc;YACjB,OAAO,KAAK,CACV;gBACE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjE,CAAC,CAAC;aACJ,EACD,IAAI,CACL,CAAA;QACH,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAA;YACzB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;YACnD,IAAI,CAAC,MAAM;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,mBAAmB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC5E,MAAM,iBAAiB,GAAG,MAAM,EAAE,SAAS,CAAA;YAC3C,IAAI,iBAAiB,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBAC/D,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAA;YACpE,MAAM,IAAI,GAAG,iBAAiB,IAAI,EAAE,CAAA;YACpC,IAAI,CAAC;gBACH,OAAO,KAAK,CAAC;oBACX,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,QAAQ,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;iBACrC,CAAC,CAAA;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,8FAA8F;gBAC9F,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAA;YACzD,CAAC;QACH,CAAC;QACD;YACE,IAAI,cAAc;gBAAE,OAAO,IAAI,CAAA;YAC/B,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,qBAAqB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACvE,CAAC;AACH,CAAC"}

package/dist/react.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,aAAa,CAAA;AAE7D,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB;8CAC0C;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,kGAAkG;IAClG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAC1B;AAwCD;+GAC+G;AAC/G,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,~~CAa9E~~"}
1	+ {"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,aAAa,CAAA;AAE7D,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB;8CAC0C;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,kGAAkG;IAClG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAC1B;AAwCD;+GAC+G;AAC/G,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,CAe9E"}

package/dist/react.js CHANGED Viewed

@@ -65,7 +65,9 @@ export async function reactWidget(opts) {
         ...(opts.description !== undefined ? { description: opts.description } : {}),
         ...(opts.title !== undefined ? { title: opts.title } : {}),
         ...(opts.head !== undefined ? { head: opts.head } : {}),
-        html: `<div id="root"></div>\n<script>${safe}</script>`,
+        // `safe` is a Bun-generated JavaScript bundle with every HTML script end-tag escaped before it is
+        // placed in this inline script. The widget test asserts the generated document remains intact.
+        html: `<div id="root"></div>\n<script>${safe}</script>`, // nosemgrep: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag
     });
 }
 //# sourceMappingURL=react.js.map

package/dist/react.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"react.js","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAA;AAiB7D,uGAAuG;AACvG,KAAK,UAAU,eAAe,CAAC,aAAqB,EAAE,MAAe;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IAClC,gGAAgG;IAChG,wGAAwG;IACxG,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,qBAAqB,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACrF,MAAM,IAAI,GAAG;;wBAES,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;;;;;;;EAOpE,CAAA;IACA,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC/B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC;YAC1B,WAAW,EAAE,CAAC,QAAQ,CAAC;YACvB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,MAAM;YACd,MAAM;YACN,MAAM,EAAE,EAAE,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE;SACjE,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,iCAAiC,aAAa,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChG,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,aAAa,EAAE,CAAC,CAAA;QAC3F,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;IAC5B,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACrC,CAAC;AACH,CAAC;AAED;+GAC+G;AAC/G,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAA;IACzE,oGAAoG;IACpG,8FAA8F;IAC9F,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAA;IACtD,OAAO,eAAe,CAAC;QACrB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,EAAE,kCAAkC,IAAI,WAAW;~~KACxD~~,CAAC,CAAA;AACJ,CAAC"}
1	+ {"version":3,"file":"react.js","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAA;AAiB7D,uGAAuG;AACvG,KAAK,UAAU,eAAe,CAAC,aAAqB,EAAE,MAAe;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IAClC,gGAAgG;IAChG,wGAAwG;IACxG,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,qBAAqB,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACrF,MAAM,IAAI,GAAG;;wBAES,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;;;;;;;EAOpE,CAAA;IACA,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC/B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC;YAC1B,WAAW,EAAE,CAAC,QAAQ,CAAC;YACvB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,MAAM;YACd,MAAM;YACN,MAAM,EAAE,EAAE,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE;SACjE,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,iCAAiC,aAAa,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChG,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,aAAa,EAAE,CAAC,CAAA;QAC3F,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;IAC5B,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACrC,CAAC;AACH,CAAC;AAED;+GAC+G;AAC/G,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAA;IACzE,oGAAoG;IACpG,8FAA8F;IAC9F,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAA;IACtD,OAAO,eAAe,CAAC;QACrB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,kGAAkG;QAClG,+FAA+F;QAC/F,IAAI,EAAE,kCAAkC,IAAI,WAAW,EAAE,wGAAwG;KAClK,CAAC,CAAA;AACJ,CAAC"}

package/dist/server.d.ts CHANGED Viewed

@@ -15,12 +15,12 @@
  * {@link McpServer.handle} dispatches a single JSON-RPC message directly (for headless verification / tests).
  *
  * SECURITY: this has NO built-in authentication - once mounted, every tool is callable by anyone who can
- * reach the route (the CORS header is `*` and no credentials are used, so it is effectively public). That
- * is fine for read-only/public tools; if any tool mutates state or returns private data, gate the route
- * yourself (check an `Authorization` header / session in the nifra handler before calling `mcp.fetch`).
+ * reach the route. Browser access is same-origin by default; set `allowAnyOrigin: true` only for a
+ * secret-free public server. If any tool mutates state or returns private data, gate the route yourself
+ * (check an `Authorization` header / session in the nifra handler before calling `mcp.fetch`).
  */
 import { type McpHttpOptions } from "./http.js";
-import { type JsonRpcRequest, type JsonRpcResponse, type McpPrompt, type McpResource, type McpServerFeatures, type McpTool } from "./protocol.js";
+import { type JsonRpcRequest, type JsonRpcResponse, type McpPrompt, type McpProtocolState, type McpResource, type McpServerFeatures, type McpTool } from "./protocol.js";
 import type { McpWidget } from "./widget.js";
 export interface CreateMcpServerOptions {
     readonly name: string;
@@ -35,11 +35,18 @@ export interface CreateMcpServerOptions {
     readonly health?: string;
     /** Max JSON-RPC body size in bytes (default 1 MB). */
     readonly maxBodyBytes?: number;
+    /** Max serialized JSON-RPC response or SSE frame size (default 1 MB). */
+    readonly maxResponseBytes?: number;
     /** Natural-language guidance for LLMs, surfaced in the modern `server/discover` result (2026-07-28). */
     readonly instructions?: string;
-    /** Origin allowlist for the DNS-rebinding guard. Omit to allow any origin; set it to reject other
-     * browser origins with 403 (e.g. a hardened, non-public mount). */
+    /** Explicitly allow browser clients from any origin. Omit for the secure same-origin default. */
+    readonly allowAnyOrigin?: boolean;
+    /** Origin allowlist for the DNS-rebinding guard. Set it to permit exact cross-origin clients. */
     readonly allowedOrigins?: readonly string[];
+    /** Shared state for one authenticated MCP session; prefer `resolveState` for multi-session hosts. */
+    readonly state?: McpProtocolState;
+    /** Resolve a session-scoped request registry after per-message authorization. */
+    readonly resolveState?: McpHttpOptions["resolveState"];
     /**
      * Per-message authorization, applied after the message parses and before any tool runs. Return
      * `false` to answer 403 with a JSON-RPC `unauthorized` error (`MCP_ERROR.UNAUTHORIZED`) and no result.
@@ -59,7 +66,7 @@ export interface McpServer {
         version: string;
     };
     /** Web `fetch` handler - mount at `POST /mcp` (GET is a health page, OPTIONS the CORS preflight). */
-    fetch(request: Request, overrides?: Pick<McpHttpOptions, "authorizeMessage">): Promise<Response>;
+    fetch(request: Request, overrides?: Pick<McpHttpOptions, "authorizeMessage" | "state" | "resolveState">): Promise<Response>;
     /** Dispatch one JSON-RPC message directly (no HTTP) - for headless verification and unit tests. */
     handle(message: JsonRpcRequest): Promise<JsonRpcResponse | null>;
     /**

package/dist/server.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,WAAW,CAAA;AAC/D,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,OAAO,EAEb,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAE5C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;IACnC,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,WAAW,EAAE,CAAA;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACvC,4BAA4B;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,wGAAwG;IACxG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;~~uEACmE~~;~~IACnE~~,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAC1B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,OAAO,KACb,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;IACpC,QAAQ,CAAC,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACtD,qGAAqG;IACrG,KAAK,~~CAAC~~,OAAO,EAAE,OAAO,~~EAAE~~,SAAS,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,kBAAkB,~~CAAC~~,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;~~IAChG~~,mGAAmG;IACnG,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;IAChE;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACrC;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,SAAS,~~CA8BvE~~"}
1	+ {"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,WAAW,CAAA;AAC/D,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,OAAO,EAEb,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAE5C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;IACnC,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,WAAW,EAAE,CAAA;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACvC,4BAA4B;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,wGAAwG;IACxG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,iGAAiG;IACjG,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,iGAAiG;IACjG,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,qGAAqG;IACrG,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACjC,iFAAiF;IACjF,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC,cAAc,CAAC,CAAA;IACtD;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAC1B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,OAAO,KACb,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;IACpC,QAAQ,CAAC,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACtD,qGAAqG;IACrG,KAAK,CACH,OAAO,EAAE,OAAO,EAChB,SAAS,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,kBAAkB,GAAG,OAAO,GAAG,cAAc,CAAC,GAC9E,OAAO,CAAC,QAAQ,CAAC,CAAA;IACpB,mGAAmG;IACnG,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;IAChE;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACrC;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,SAAS,CAuCvE"}

package/dist/server.js CHANGED Viewed

@@ -15,9 +15,9 @@
  * {@link McpServer.handle} dispatches a single JSON-RPC message directly (for headless verification / tests).
  *
  * SECURITY: this has NO built-in authentication - once mounted, every tool is callable by anyone who can
- * reach the route (the CORS header is `*` and no credentials are used, so it is effectively public). That
- * is fine for read-only/public tools; if any tool mutates state or returns private data, gate the route
- * yourself (check an `Authorization` header / session in the nifra handler before calling `mcp.fetch`).
+ * reach the route. Browser access is same-origin by default; set `allowAnyOrigin: true` only for a
+ * secret-free public server. If any tool mutates state or returns private data, gate the route yourself
+ * (check an `Authorization` header / session in the nifra handler before calling `mcp.fetch`).
  */
 import { respondMcpHttp } from "./http.js";
 import { handleRpc, UI_MIME, } from "./protocol.js";
@@ -42,13 +42,21 @@ export function createMcpServer(opts) {
             features,
             ...(opts.health !== undefined ? { health: opts.health } : {}),
             ...(opts.maxBodyBytes !== undefined ? { maxBodyBytes: opts.maxBodyBytes } : {}),
+            ...(opts.maxResponseBytes !== undefined ? { maxResponseBytes: opts.maxResponseBytes } : {}),
+            ...(opts.allowAnyOrigin === true ? { allowAnyOrigin: true } : {}),
             ...(opts.allowedOrigins !== undefined ? { allowedOrigins: opts.allowedOrigins } : {}),
+            ...(opts.state === undefined ? {} : { state: opts.state }),
+            ...(opts.resolveState === undefined ? {} : { resolveState: opts.resolveState }),
             ...(opts.authorizeMessage !== undefined ? { authorizeMessage: opts.authorizeMessage } : {}),
             ...(overrides?.authorizeMessage !== undefined
                 ? { authorizeMessage: overrides.authorizeMessage }
                 : {}),
+            ...(overrides?.state === undefined ? {} : { state: overrides.state }),
+            ...(overrides?.resolveState === undefined ? {} : { resolveState: overrides.resolveState }),
+        }),
+        handle: (message) => handleRpc(message, tools, serverInfo, features, {
+            ...(opts.state === undefined ? {} : { state: opts.state }),
         }),
-        handle: (message) => handleRpc(message, tools, serverInfo, features),
     };
 }
 //# sourceMappingURL=server.js.map

package/dist/server.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAuB,cAAc,EAAE,MAAM,WAAW,CAAA;AAC/D,OAAO,EACL,SAAS,~~EAOT~~,OAAO,GACR,MAAM,eAAe,CAAA;~~AAmDtB~~,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAA;IAClC,sGAAsG;IACtG,gDAAgD;IAChD,MAAM,SAAS,GAAkB,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAA;IAC/F,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IAC7D,MAAM,QAAQ,GAAsB;QAClC,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAA;IACD,OAAO;QACL,KAAK;QACL,QAAQ;QACR,UAAU;QACV,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAC5B,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE;YACzC,QAAQ;YACR,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,SAAS,EAAE,gBAAgB,KAAK,SAAS;gBAC3C,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;~~SACR~~,CAAC;QACJ,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,~~CAAC~~,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC;~~KACrE~~,CAAA;AACH,CAAC"}
1	+ {"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAuB,cAAc,EAAE,MAAM,WAAW,CAAA;AAC/D,OAAO,EACL,SAAS,EAQT,OAAO,GACR,MAAM,eAAe,CAAA;AA6DtB,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAA;IAClC,sGAAsG;IACtG,gDAAgD;IAChD,MAAM,SAAS,GAAkB,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAA;IAC/F,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IAC7D,MAAM,QAAQ,GAAsB;QAClC,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAA;IACD,OAAO;QACL,KAAK;QACL,QAAQ;QACR,UAAU;QACV,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAC5B,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE;YACzC,QAAQ;YACR,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/E,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,SAAS,EAAE,gBAAgB,KAAK,SAAS;gBAC3C,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;YACrE,GAAG,CAAC,SAAS,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC;SAC3F,CAAC;QACJ,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAClB,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE;YAC9C,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;SAC3D,CAAC;KACL,CAAA;AACH,CAAC"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/mcp",
-  "version": "3.3.0",
+  "version": "3.5.0",
   "description": "Build MCP servers - and MCP Apps (interactive `ui://` widgets, SEP-1865) - for a nifra app. The transport-agnostic JSON-RPC core (also used by `@nifrajs/cli`'s dev MCP), a Streamable-HTTP handler you mount at `POST /mcp`, and `defineMcpWidget`/`defineMcpTool` for tool results that render real UI in MCP hosts.",
   "keywords": [
     "bun",
@@ -63,9 +63,12 @@
   "publishConfig": {
     "access": "public"
   },
+  "dependencies": {
+    "@nifrajs/agent-protocol": "3.5.0"
+  },
   "peerDependencies": {
-    "@nifrajs/agent": "^3.3.0",
-    "@nifrajs/core": "^3.3.0"
+    "@nifrajs/agent": "^3.5.0",
+    "@nifrajs/core": "^3.5.0"
   },
   "peerDependenciesMeta": {
     "@nifrajs/agent": {

package/src/bridge.ts CHANGED Viewed

@@ -35,6 +35,8 @@ export interface McpAppBridge {
   onTheme(cb: (theme: unknown) => void): void
   /** Invoke a tool back through the host; resolves with the tools/call result. */
   callTool(name: string, args?: Record<string, unknown>): Promise<unknown>
+  /** Reject pending calls when the embedding host tears down the widget. */
+  disconnect(reason?: string): void
 }
 /** The bridge source, as a string for inlining in a `<script>`. Self-contained, no imports. */
@@ -46,11 +48,44 @@ export function bridgeScript(): string {
 // global or strip it, and so it has zero dependency on this module's runtime. Intentionally ES5-ish for
 // maximal host/iframe compatibility.
 const BRIDGE_SOURCE = `(function () {
-  var pending = {};
+  var pending = Object.create(null);
   var nextId = 1;
+  var maxPending = 64;
+  var maxCallbacks = 128;
+  var maxNameLength = 128;
+  var maxArgsChars = 65536;
+  var maxReasonLength = 512;
+  var callTimeoutMs = 30000;
+  var disconnected = false;
   var dataCbs = [];
   var inputCbs = [];
   var themeCbs = [];
+  function boundedReason(reason) {
+    return typeof reason === "string" && reason.length > 0
+      ? reason.slice(0, maxReasonLength)
+      : "mcp host disconnected";
+  }
+  function boundedArgs(args) {
+    if (args == null) return {};
+    if (typeof args !== "object" || Array.isArray(args)) return null;
+    try {
+      var encoded = JSON.stringify(args);
+      if (typeof encoded !== "string" || encoded.length > maxArgsChars) return null;
+      return JSON.parse(encoded);
+    } catch (e) {
+      return null;
+    }
+  }
+  function disconnect(reason) {
+    disconnected = true;
+    var message = boundedReason(reason);
+    for (var id in pending) {
+      if (!Object.prototype.hasOwnProperty.call(pending, id)) continue;
+      var item = pending[id]; delete pending[id];
+      if (item.timer) clearTimeout(item.timer);
+      try { item.reject(new Error(message)); } catch (e) {}
+    }
+  }
   function applyTheme(theme) {
     if (!theme || typeof theme !== "object") return;
     var root = document.documentElement;
@@ -72,22 +107,42 @@ const BRIDGE_SOURCE = `(function () {
     theme: null,
     onData: function (cb) {
       if (typeof cb !== "function") return;
+      if (dataCbs.length >= maxCallbacks) return;
       dataCbs.push(cb);
       if (api.data !== null) { try { cb(api.data); } catch (e) {} }
     },
-    onInput: function (cb) { if (typeof cb === "function") inputCbs.push(cb); },
+    onInput: function (cb) {
+      if (typeof cb !== "function" || inputCbs.length >= maxCallbacks) return;
+      inputCbs.push(cb);
+    },
     onTheme: function (cb) {
       if (typeof cb !== "function") return;
+      if (themeCbs.length >= maxCallbacks) return;
       themeCbs.push(cb);
       if (api.theme !== null) { try { cb(api.theme); } catch (e) {} }
     },
     callTool: function (name, args) {
+      if (disconnected) return Promise.reject(new Error("mcp host disconnected"));
+      if (typeof name !== "string" || name.length === 0 || name.length > maxNameLength)
+        return Promise.reject(new Error("mcp host tool name is invalid"));
+      var safeArgs = boundedArgs(args);
+      if (safeArgs === null) return Promise.reject(new Error("mcp host tool arguments are invalid"));
+      var count = 0;
+      for (var key in pending) if (Object.prototype.hasOwnProperty.call(pending, key)) count++;
+      if (count >= maxPending) return Promise.reject(new Error("mcp host call limit reached"));
       var id = "w" + nextId++;
       return new Promise(function (resolve, reject) {
-        pending[id] = { resolve: resolve, reject: reject };
-        post({ jsonrpc: "2.0", id: id, method: "tools/call", params: { name: name, arguments: args || {} } });
+        var timer = setTimeout(function () {
+          var item = pending[id];
+          if (!item) return;
+          delete pending[id];
+          try { item.reject(new Error("mcp host call timed out")); } catch (e) {}
+        }, callTimeoutMs);
+        pending[id] = { resolve: resolve, reject: reject, timer: timer };
+        post({ jsonrpc: "2.0", id: id, method: "tools/call", params: { name: name, arguments: safeArgs } });
       });
-    }
+    },
+    disconnect: function (reason) { disconnect(reason); }
   };
   function post(msg) { try { (window.parent || window).postMessage(msg, "*"); } catch (e) {} }
   function emit(list, value) { for (var i = 0; i < list.length; i++) { try { list[i](value); } catch (e) {} } }
@@ -102,6 +157,7 @@ const BRIDGE_SOURCE = `(function () {
     // A response to one of our tools/call requests (id-matched).
     if (msg.id != null && pending[msg.id]) {
       var p = pending[msg.id]; delete pending[msg.id];
+      if (p.timer) clearTimeout(p.timer);
       if (msg.error) p.reject(msg.error); else p.resolve(msg.result);
       return;
     }
@@ -118,6 +174,8 @@ const BRIDGE_SOURCE = `(function () {
       api.theme = theme;
       applyTheme(theme);
       emit(themeCbs, theme);
+    } else if (msg.method === "ui/notifications/disconnected") {
+      disconnect((msg.params || {}).reason);
     }
   });
   window.mcpApp = api;