@nifrajs/mcp 5.0.0 → 5.2.0

package/CHANGELOG.md

@@ -0,0 +1,428 @@
+# @nifrajs/mcp
+
+## 5.2.0
+
+### Patch Changes
+
+- 9498cf8: The package ships its `CHANGELOG.md`, so the installed package has the notes for every version, as the GitHub release does. Before, the tarball held only the code, `README.md`, `LICENSE` and `package.json`.
+- Updated dependencies [9498cf8]
+  - @nifrajs/agent-protocol@5.2.0
+
+## 5.1.0
+
+### Patch Changes
+
+- abb4354: The package now ships the MIT `LICENSE` text, as every other @nifrajs package already did.
+- 2b8f235: The HTTP transport no longer opens its GET server-message stream for a caller it has not checked. With `authorizeMessage` set, a GET that asks for `text/event-stream` is now answered `405` (the Streamable HTTP answer for "no stream offered here"), since that stream carries no message the callback could authorize; before, any caller could open one and hold it with keep-alive comments. Without `authorizeMessage`, the stream now closes after five minutes, and a client that wants it again reconnects. Nothing is sent on this stream, so no message is lost; tool calls and their progress still travel on the POST stream.
+- Updated dependencies [abb4354]
+  - @nifrajs/agent-protocol@5.1.0
+
+## 5.0.0
+
+### Minor Changes
+
+- 1af7543: Event streams stay bounded for a client that stops reading. `mountAgent` takes `maxOutputBytes` (default 4 MiB): past it an SSE response ends with an `output_limit` error frame, and with an `evidenceLog` a `Last-Event-ID` reconnect reads on. `respondMcpHttp` and `createMcpServer` take `maxPendingBytes` (default 4 MiB): an SSE stream with more than that waiting for its client is dropped and its tool call cancelled. The coding agent's `turn.send` stream advances the backend only as the client reads, and a resumable follower that falls `replayBytes` behind is dropped and can attach again from its cursor.
+
+### Patch Changes
+
+- Updated dependencies [36bdc71]
+- Updated dependencies [2198640]
+- Updated dependencies [6b0db44]
+- Updated dependencies [a3b3c51]
+- Updated dependencies [6b96131]
+- Updated dependencies [d6a7fa0]
+- Updated dependencies [343bae0]
+- Updated dependencies [b435f13]
+- Updated dependencies [6340cd8]
+- Updated dependencies [34b3014]
+- Updated dependencies [848ce97]
+- Updated dependencies [a0a02f4]
+- Updated dependencies [0aed425]
+- Updated dependencies [eaf030b]
+- Updated dependencies [7de0397]
+- Updated dependencies [1af7543]
+- Updated dependencies [4199ff3]
+- Updated dependencies [90d9ee6]
+- Updated dependencies [364a234]
+- Updated dependencies [c06cba5]
+- Updated dependencies [f4d3852]
+- Updated dependencies [4a82ae0]
+- Updated dependencies [0ff867a]
+- Updated dependencies [e7391bf]
+- Updated dependencies [0b80a59]
+- Updated dependencies [c64db12]
+- Updated dependencies [3753104]
+- Updated dependencies [4b3b1fa]
+- Updated dependencies [3562557]
+- Updated dependencies [53087f3]
+- Updated dependencies [2def6c7]
+- Updated dependencies [b5b5bc3]
+- Updated dependencies [22e1777]
+- Updated dependencies [3a483cd]
+- Updated dependencies [35f52c7]
+- Updated dependencies [343cb81]
+- Updated dependencies [d91fd44]
+- Updated dependencies [b13e071]
+- Updated dependencies [077657f]
+- Updated dependencies [a5963cb]
+- Updated dependencies [05aac0e]
+- Updated dependencies [1a6616f]
+- Updated dependencies [7775c2b]
+- Updated dependencies [846e2f6]
+- Updated dependencies [aadd9fc]
+- Updated dependencies [ea16748]
+- Updated dependencies [fc0284a]
+- Updated dependencies [5b22f4d]
+- Updated dependencies [1b94593]
+- Updated dependencies [9f58295]
+- Updated dependencies [b9608ac]
+- Updated dependencies [7a165de]
+- Updated dependencies [4064f36]
+- Updated dependencies [48aad8c]
+- Updated dependencies [41050ed]
+- Updated dependencies [fc837cb]
+- Updated dependencies [b80ce77]
+- Updated dependencies [9b1acc9]
+- Updated dependencies [740109f]
+- Updated dependencies [e0a25fe]
+- Updated dependencies [3630b6e]
+- Updated dependencies [1290c6d]
+- Updated dependencies [d0a7d58]
+  - @nifrajs/agent-protocol@5.0.0
+  - @nifrajs/agent@5.0.0
+  - @nifrajs/core@5.0.0
+
+## 4.0.2
+
+### Patch Changes
+
+- @nifrajs/agent-protocol@4.0.2
+
+## 4.0.1
+
+### Patch Changes
+
+- @nifrajs/agent-protocol@4.0.1
+
+## 4.0.0
+
+### Minor Changes
+
+- d4d40a5: feat(mcp): `allowedHosts` DNS-rebinding guard
+
+  `createMcpServer()`, `respondMcpHttp()`, and `serveDatabaseAsMcp()` accept `allowedHosts`. A
+  request whose Host is not listed gets 403, with or without an Origin. Set it for servers on
+  localhost or a private network, where a DNS-rebound page presents a matching Origin. The check reads
+  the inbound `Host` header. Host names compare case-insensitively, an entry without a port matches any
+  port, and an entry with a port matches the effective port, so `localhost:80` admits
+  `http://localhost/`.
+
+  The same-origin default now accepts an `https:` Origin on an `http:` request URL (a TLS-terminating
+  proxy) and still rejects a downgrade.
+
+- 9ccf198: `handleRpc` takes `exposeToolErrors`, which answers a throwing tool with `Tool execution failed: <message>` instead of the bare text. It is off by default, so a remote caller still sees nothing from an error message. `nifra mcp` turns it on for its stdio server, so the local agent sees why a project tool failed, for example the error that stopped the backend from loading.
+
+### Patch Changes
+
+- Updated dependencies [6695a23]
+- Updated dependencies [7b2ff47]
+- Updated dependencies [422248c]
+- Updated dependencies [62115dd]
+- Updated dependencies [dbc91b6]
+- Updated dependencies [d2329f5]
+- Updated dependencies [1eb77df]
+- Updated dependencies [dde125b]
+- Updated dependencies [72b62fa]
+- Updated dependencies [aa44e93]
+- Updated dependencies [4a3ee60]
+- Updated dependencies [aad6297]
+- Updated dependencies [dad0d41]
+- Updated dependencies [538adc2]
+- Updated dependencies [f47edd1]
+- Updated dependencies [df9530a]
+- Updated dependencies [3e6973f]
+- Updated dependencies [25e8edf]
+- Updated dependencies [2b5e5fc]
+- Updated dependencies [3b090de]
+- Updated dependencies [da7d792]
+- Updated dependencies [612a296]
+- Updated dependencies [fb14dfa]
+- Updated dependencies [8ae97f6]
+- Updated dependencies [4af6f39]
+- Updated dependencies [ca8b50d]
+- Updated dependencies [b00a889]
+- Updated dependencies [b53d64f]
+- Updated dependencies [66fd712]
+- Updated dependencies [9c3d524]
+- Updated dependencies [738e7a1]
+- Updated dependencies [4801cac]
+- Updated dependencies [1b2d53a]
+- Updated dependencies [25fe13d]
+- Updated dependencies [0852290]
+- Updated dependencies [0589dbe]
+- Updated dependencies [2e2d8c0]
+- Updated dependencies [856f5ce]
+- Updated dependencies [18aa5aa]
+- Updated dependencies [cfd86b3]
+- Updated dependencies [8ff96c9]
+- Updated dependencies [4c46199]
+- Updated dependencies [eef4932]
+- Updated dependencies [6de8686]
+- Updated dependencies [d7892ea]
+- Updated dependencies [4936309]
+- Updated dependencies [ff5a779]
+- Updated dependencies [bbdc5a1]
+- Updated dependencies [10bc446]
+- Updated dependencies [e8270d9]
+- Updated dependencies [ff4a062]
+- Updated dependencies [43ba944]
+- Updated dependencies [46c741a]
+- Updated dependencies [7bfa25e]
+- Updated dependencies [4936309]
+- Updated dependencies [6e257a6]
+- Updated dependencies [4a03d30]
+- Updated dependencies [8e30090]
+- Updated dependencies [28f3aaf]
+- Updated dependencies [6d20355]
+- Updated dependencies [6907cbe]
+- Updated dependencies [b64c3ee]
+- Updated dependencies [bda9637]
+- Updated dependencies [81c720e]
+- Updated dependencies [ed60b23]
+- Updated dependencies [a158b74]
+- Updated dependencies [ff25d68]
+  - @nifrajs/agent@4.0.0
+  - @nifrajs/core@4.0.0
+  - @nifrajs/agent-protocol@4.0.0
+
+## 3.5.0
+
+### Patch Changes
+
+- @nifrajs/agent-protocol@3.5.0
+
+## 3.4.0
+
+### Minor Changes
+
+- Harden MCP error responses and browser-origin defaults, confine scaffold writes to `routes/`, and
+  make sanitized HTML require an explicit sanitizer function.
+
+### Patch Changes
+
+- 8d23613: Add the opt-in `@nifrajs/webmcp` package: typed WebMCP registration, core-backed receipts, deterministic predictive-UI reconciliation, and host-independent conformance checks. Also tighten agent execution cancellation cleanup so aborted local work cannot leak into later turns.
+- Updated dependencies [8d23613]
+  - @nifrajs/agent-protocol@3.4.0
+
+## 3.3.0
+
+## 3.2.0
+
+### Patch Changes
+
+- 1a041a9: Add provider-neutral gateway and deployment contracts with deterministic reference adapters and evidence-safe policy checks.
+- cefedc2: Stream progress notifications and final JSON-RPC responses over `text/event-stream`, and support
+  cancellable SSE GET connections for Streamable HTTP clients.
+
+## 3.1.0
+
+## 3.0.0
+
+### Patch Changes
+
+- Updated dependencies [f3d2a35]
+- Updated dependencies [6e43c15]
+- Updated dependencies [f0fd370]
+- Updated dependencies [86a555b]
+- Updated dependencies [8c5f4cf]
+- Updated dependencies [f0fd370]
+- Updated dependencies [381bbf3]
+- Updated dependencies [36801ae]
+- Updated dependencies [9acadba]
+- Updated dependencies [99fc683]
+- Updated dependencies [73d894d]
+  - @nifrajs/core@3.0.0
+
+## 2.14.1
+
+## 2.14.0
+
+## 2.13.0
+
+## 2.12.1
+
+## 2.12.0
+
+### Minor Changes
+
+- cb04de8: New `authorizeMessage` option on `createMcpServer` (and per request via
+  `mcp.fetch(request, { authorizeMessage })`): a hook run once per parsed message, before any tool runs,
+  that answers `403` with a JSON-RPC `unauthorized` error (`MCP_ERROR.UNAUTHORIZED`) when it returns
+  `false`. The HTTP layer above an MCP mount only ever sees one opaque POST, so a route guard cannot
+  express "this caller may list tools but may not call the write ones" - this is the seam that can. It
+  runs after the body has been read under `maxBodyBytes`, so it costs no second read of the stream.
+- e2d1939: Add typed tool contracts with shared fail-closed adapters, static verification work graphs, bounded provider-neutral agent turns, deterministic trajectory replay, and an explicit execution-policy seam with a non-isolating local process adapter.
+
+### Patch Changes
+
+- f3cc02e: `handleRpc` rejects a `tools/call` whose request id is already in flight, with
+  `-32600 duplicate request id is already in progress`, instead of starting a second call under the same
+  id. Registering the second call overwrote the first's `AbortController`, so `notifications/cancelled`
+  for that id then cancelled only the newer call and left the earlier one running with nothing able to
+  stop it. JSON-RPC requires an id to be unique among in-flight requests, so no conforming client is
+  affected.
+
+## 2.11.0
+
+## 2.10.0
+
+## 2.9.1
+
+## 2.9.0
+
+## 2.8.2
+
+### Patch Changes
+
+- f7d68e8: Numeric limit options (body/payload byte caps, TTLs, cache sizes, concurrency, ISR revalidate windows) are now validated at construction and throw a `RangeError` on non-finite or out-of-range values instead of silently disabling the bound - a `NaN` cap previously made `size > max` comparisons fail open. JWT `requiredClaims` now checks own properties only, so inherited names like `toString` no longer satisfy a required claim. `@nifrajs/mcp-db` gates multi-statement input with a real tokenizer, bounds `run_query` materialization to `maxRows + 1` via a wrapping subquery, and skips SQLite planner pseudo-nodes when verifying the table allowlist. `nifra scaffold` refuses to write through symlinked route directories.
+
+## 2.8.1
+
+## 2.8.0
+
+## 2.7.1
+
+## 2.7.0
+
+## 2.6.1
+
+## 2.6.0
+
+### Minor Changes
+
+- 10fb70c: `defineMcpTool` accepts `annotations` (the MCP tool safety hints - `readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`, `title`), surfaced in `tools/list` and `tools/describe`. Hosts use these to pick confirmation UX, and connector directory reviews expect every tool to declare them. The hosted docs tools (`nifra_docs`, `nifra_example`, `nifra_types`, `nifra_learn`, `nifra_examples_app`) now all declare themselves read-only and closed-world.
+
+## 2.5.0
+
+### Minor Changes
+
+- 3731c69: Add the 2026-07-28 modern MCP transport alongside the handshake, so a server speaks both eras on one endpoint. It implements `server/discover` (advertising supported versions, capabilities, and identity), per-request protocol-version negotiation (an `UnsupportedProtocolVersionError` for a version the server does not speak), the `resultType` completion envelope with cache hints on list/read results, and - over HTTP - validation of the mirrored `Mcp-Method`/`Mcp-Name`/`MCP-Protocol-Version` headers against the request body (a `HeaderMismatch` answered with 400) plus the spec's status codes (404 for an unknown method). Clients that still use the `initialize` handshake are served exactly as before. `createMcpServer` and the HTTP handler gain an `instructions` field surfaced in discovery.
+- 0740f77: Harden the Streamable HTTP transport so a hosted MCP server loads cleanly as a remote connector. The CORS preflight now allows the request headers browser-based clients send (`MCP-Protocol-Version`, `Mcp-Method`, `Mcp-Name`, `Authorization`, `Accept`, `Last-Event-ID`) and exposes the protocol-version header. `initialize` negotiates the protocol version, echoing the client's requested revision when the server also speaks it. Notifications are acknowledged with `202 Accepted`; a `GET` that requests `text/event-stream` returns `405`; and `respondMcpHttp` gains an `allowedOrigins` option that rejects any other browser origin with `403` as a DNS-rebinding guard (omitted by default, so a public server stays open).
+
+## 2.4.0
+
+## 2.3.0
+
+## 2.2.0
+
+## 2.1.0
+
+## 2.0.0
+
+### Major Changes
+
+- d91a45b: Remove Nifra's remaining deprecated and compatibility-only public surfaces for the 2.0 cutover.
+
+  - `@nifrajs/core` and `nifra` now expose only the lean HTTP server API at their package roots. Import
+    optional systems from their documented subpaths. The deprecated invariant runner and the
+    `@nifrajs/budget` compatibility package are removed; use `@nifrajs/testing` and
+    `@nifrajs/core/budget` respectively.
+  - Web redirects accept only an options object as their second argument, the prerender enumeration
+    wrapper is removed in favor of `enumerateStaticRoutes()`, and fragment navigation resolves IDs only.
+  - MCP Apps metadata uses only `_meta.ui.resourceUri`; the deprecated flat `ui/resourceUri` key is gone.
+  - Telemetry uses `ObservationAdapter` directly; the `AgentSpan`, `AgentSpanExporter`, and `SpanExporter`
+    aliases are removed.
+  - Invalid HTTP method overrides always fail closed with 400; the legacy ignore mode is removed.
+  - `nifra build` always emits a complete target deploy directory and defaults to Bun. The old
+    client-only build branch is removed; `nifra start` runs the generated Bun `server.js`.
+
+### Minor Changes
+
+- 202e758: Schema-typed MCP tools, and the default template demonstrates the contract.
+
+  - `defineMcpTool` accepts `input`: a Standard Schema (nifra's `t`, zod, valibot, arktype, …) that
+    validates every call's arguments before the handler runs and types the handler's `args`. Invalid
+    arguments return an in-band `isError` result naming each issue, so a calling agent can correct
+    and retry. Schemas that carry a JSON Schema (nifra's `t` does) become the advertised
+    `inputSchema` automatically; an explicit `inputSchema` still overrides. The raw
+    `inputSchema`-only form keeps working unchanged.
+  - The `api` template's app now ships a `t`-validated route (body + response schemas) and its tests
+    drive the app through `testClient` - the contract-first pitch is visible in the first file a new
+    user opens, not just the docs.
+
+## 1.13.0
+
+## 1.12.0
+
+## 1.11.0
+
+## 1.10.0
+
+## 1.9.1
+
+### Patch Changes
+
+- 3eb27ae: Internal tidy - remove a dead local variable in the query engine and clean up example wording in doc comments. No API or behavior change.
+
+## 1.9.0
+
+## 1.8.0
+
+## 1.7.0
+
+## 1.6.0
+
+## 1.5.0
+
+## 1.4.0
+
+## 1.3.1
+
+## 1.3.0
+
+### Minor Changes
+
+- 4a4b1c4: feat: MCP tool annotations on `server().tool()`
+
+  `.tool()` config now accepts `annotations` - the MCP spec's per-tool safety hints (`title`, `readOnlyHint`,
+  `destructiveHint`, `idempotentHint`, `openWorldHint`) - surfaced in `tools/list` and `tools/describe`. An
+  agent can now tell a read-only tool from a destructive one and decide whether to auto-invoke or confirm
+  first, instead of treating every exposed tool as equally risky.
+
+## 1.2.2
+
+## 1.2.1
+
+## 1.2.0
+
+## 1.1.0
+
+## 1.0.0
+
+### Minor Changes
+
+- c099d5f: Add `@nifrajs/mcp` - build MCP servers, and **MCP Apps** (interactive `ui://` widgets, SEP-1865), for a nifra app.
+
+  MCP tools have only ever returned text. MCP Apps lets a tool return **interactive UI**: a tool links a `ui://` resource (MIME `text/html;profile=mcp-app`); the host renders it in a sandboxed iframe and bridges it to the server over MCP-JSON-RPC-on-`postMessage`. `@nifrajs/mcp` ships:
+
+  - The transport-agnostic JSON-RPC core (`handleRpc`, shared with `@nifrajs/cli`'s dev MCP) extended for MCP Apps - `structuredContent`, `_meta.ui.resourceUri`, and the `io.modelcontextprotocol/ui` capability.
+  - `respondMcpHttp` - a Web `fetch` handler you mount at `POST /mcp`. nifra route handlers can return a raw `Response`, so mounting is one line per verb.
+  - `defineMcpWidget` - author a `ui://` widget as one self-contained HTML doc with a tiny zero-dependency `postMessage` bridge inlined (`mcpApp.onData(render)` to render the host-pushed `structuredContent`; `mcpApp.callTool(...)` to re-invoke a tool through the host).
+  - `defineMcpTool` + `createMcpServer` - wire tools to widgets and get a mountable server. See `examples/mcp-app/`.
+  - `@nifrajs/mcp/react` - `reactWidget({ component })` authors a widget from a React component instead of an HTML string: the component is bundled for the browser (Bun.build) and re-renders on each `structuredContent` push over the bridge. `react`/`react-dom` resolve from the consumer; the core stays dependency-free.
+  - **Host theming + render intent** (see `THEMING.md`). `defineMcpTool({ intent })` adds `_meta.ui.intent` (`table`/`list`/`form`/…) so a generative host renders `structuredContent` with its own themed component. For iframe widgets, the bridge handles a `ui/notifications/theme` push and auto-applies the host's shadcn/Tailwind semantic tokens (`--primary`, `--card`, `--border`, `--radius`, …) to the widget root - so a widget that styles with `hsl(var(--primary))` matches the embedding app with zero extra code.
+
+  `@nifrajs/cli`'s MCP protocol core moved into `@nifrajs/mcp` (the CLI re-exports it); behavior is unchanged - a tool whose handler returns a plain `string` behaves exactly as before. nifra's own public docs MCP (nifra.dev `/mcp`) now also dogfoods this - `nifra_examples_app` renders the examples as an interactive widget.
+
+### Patch Changes
+
+- de9675b: Pre-1.0 security hardening pass. A framework-wide audit found no critical/high issues; these close the medium/low items it surfaced.
+
+  - **`cache()` - no cross-user leak by default.** A `200` to a request bearing `Authorization`/`Cookie` is no longer stored (and replayed to other users) unless the response is explicitly `Cache-Control: public`/`s-maxage` (RFC 9111 §3.5). Opt back in per cache with `cacheAuthenticated: true` for a route that's identical for every caller.
+  - **`idempotency()` - route-scoped keys + a `key` hook.** The default store key is now scoped by method+path, so the same `Idempotency-Key` on a different endpoint can't collide and replay another resource's response. Added a `key(req, header)` option to scope by principal (e.g. user id). Method matching normalized to upper-case.
+  - **`etag()` - a `304` no longer carries the `200`'s `Content-Length`/`Content-Type`.**
+  - **`@nifrajs/core` - inbound WebSocket frames are capped** when serving on Bun (`listen()`): frames over `wsMaxPayloadBytes` (default `maxBodyBytes`, 1 MB) are rejected by the runtime before reaching a handler, so a huge frame can't be buffered/parsed into memory. New `ServerOptions.wsMaxPayloadBytes`.
+  - **`@nifrajs/core` - WebSocket routes are same-origin by default (CSWSH).** A `ws()` route with no `allowedOrigins` now rejects a **cross-origin browser** handshake (an `Origin` whose host differs from the request's) with `403` - closing cross-site WebSocket hijacking, since browsers send cookies on WS handshakes and don't apply CORS. Non-browser clients (no `Origin`) and same-origin browsers are unaffected. **Breaking** for a route that served a cross-origin browser without declaring `allowedOrigins`: set `allowedOrigins` to the permitted origins (or `() => true` for a genuinely public socket).
+  - **`@nifrajs/node` - static file handler** now adds `X-Content-Type-Options: nosniff` and re-checks the real path (symlink containment) before streaming, matching the image server.
+  - **`@nifrajs/mcp` - widget bridge** now rejects `postMessage` events whose source isn't the parent window (including null-source synthetic events), closing a spoofing gap the previous guard left open.
+  - **`@nifrajs/cli` - the MCP `nifra_run`/`nifra_ws` `entry` arg** is kept inside the project root, so a crafted `entry` can't import/execute a module outside the project.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nifra Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/http.d.ts

@@ -50,13 +50,16 @@ export interface McpHttpOptions {
      * Optional authorization, run once per request against the parsed message - after the body has been
      * read under the size cap, so it never costs a second read of the stream. Returning `false` answers
      * `403` with a JSON-RPC error (`MCP_ERROR.UNAUTHORIZED`) and the handler never sees the message.
+     * A GET for the server-message stream carries no message to authorize, so with this set it is
+     * answered `405` (no stream offered) instead.
      */
     readonly authorizeMessage?: (message: JsonRpcRequest, request: Request) => boolean | Promise<boolean>;
 }
 /**
  * Handle one MCP request over HTTP against the given `tools`/`features`. POST a JSON-RPC body → a JSON-RPC
  * response, or an SSE stream carrying progress notifications and the final response when the client
- * accepts `text/event-stream`; GET → a health page or a cancellable SSE stream; OPTIONS → CORS preflight.
+ * accepts `text/event-stream`; GET → a health page or a keep-alive SSE stream that closes after five minutes
+ * (`405` when `authorizeMessage` is set); OPTIONS → CORS preflight.
  * Never throws - a bad body becomes a JSON-RPC parse error. Dual-era: a modern (2026-07-28) POST that
  * mirrors its method/name/version into headers is validated against the body before dispatch and gets spec
  * HTTP statuses; legacy requests are served unchanged. The dispatch is the shared, transport-agnostic

package/dist/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAIL,KAAK,cAAc,EAGnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,OAAO,EAGb,MAAM,eAAe,CAAA;AA2JtB,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAA;IACrC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,kGAAkG;IAClG,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACjC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CACtB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,cAAc,KACpB,gBAAgB,GAAG,SAAS,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAA;IACzE;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAC1B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,OAAO,KACb,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChC;AAuPD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,OAAO,EAAE,EAChB,UAAU,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC7C,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAsHnB"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAIL,KAAK,cAAc,EAGnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,OAAO,EAGb,MAAM,eAAe,CAAA;AA4JtB,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAA;IACrC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,kGAAkG;IAClG,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACjC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CACtB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,cAAc,KACpB,gBAAgB,GAAG,SAAS,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAA;IACzE;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAC1B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,OAAO,KACb,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChC;AAuPD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,OAAO,EAAE,EAChB,UAAU,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC7C,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,QAAQ,CAAC,CA+HnB"}

package/dist/http.js

@@ -145,6 +145,7 @@ const TEXT_DECODER = new TextDecoder();
 const TEXT_ENCODER = new TextEncoder();
 const SSE_CONTENT_TYPE = "text/event-stream; charset=utf-8";
 const SSE_KEEP_ALIVE_MS = 15_000;
+const GET_STREAM_LIFETIME_MS = 5 * 60_000;
 /** Invalid byte caps make `total > maxBytes` fail open (especially for `NaN`). Reject configuration
  * before any request body is read so MCP cannot silently lose its memory bound. */
 function assertByteLimit(value) {
@@ -381,7 +382,8 @@ function modernErrorStatus(response) {
 /**
  * Handle one MCP request over HTTP against the given `tools`/`features`. POST a JSON-RPC body → a JSON-RPC
  * response, or an SSE stream carrying progress notifications and the final response when the client
- * accepts `text/event-stream`; GET → a health page or a cancellable SSE stream; OPTIONS → CORS preflight.
+ * accepts `text/event-stream`; GET → a health page or a keep-alive SSE stream that closes after five minutes
+ * (`405` when `authorizeMessage` is set); OPTIONS → CORS preflight.
  * Never throws - a bad body becomes a JSON-RPC parse error. Dual-era: a modern (2026-07-28) POST that
  * mirrors its method/name/version into headers is validated against the body before dispatch and gets spec
  * HTTP statuses; legacy requests are served unchanged. The dispatch is the shared, transport-agnostic
@@ -410,9 +412,18 @@ export async function respondMcpHttp(request, tools, serverInfo, options = {}) {
             // Keep the GET side of Streamable HTTP usable for clients that open a server-message channel. This
             // transport has no durable session store, so the public seam is a cancellable keep-alive stream;
             // request-scoped progress still travels on the POST stream below.
+            if (options.authorizeMessage !== undefined) {
+                return new Response("method not allowed", {
+                    status: 405,
+                    headers: { allow: "POST, GET", ...cors },
+                });
+            }
             return eventStreamResponse(request, { allow: "POST, GET", ...cors }, async (stream) => {
                 stream.comment("connected");
+                // Nothing is ever sent here, so a bounded lifetime costs a client only a reconnect.
+                const lifetime = setTimeout(() => stream.close(), GET_STREAM_LIFETIME_MS);
                 await stream.closed;
+                clearTimeout(lifetime);
             }, SSE_KEEP_ALIVE_MS, maxResponseBytes, maxPendingBytes);
         }
         return new Response(options.health ??

package/dist/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,SAAS,EACT,gBAAgB,EAIhB,SAAS,EAIT,eAAe,EACf,QAAQ,GACT,MAAM,eAAe,CAAA;AAEtB,2GAA2G;AAC3G,oGAAoG;AACpG,6GAA6G;AAC7G,sGAAsG;AACtG,MAAM,SAAS,GAA2B;IACxC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAC5B,gHAAgH;IAClH,+BAA+B,EAAE,sCAAsC;IACvE,wBAAwB,EAAE,OAAO;CAClC,CAAA;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,MAAc,EAAE,OAAgB;IACpD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;YAAE,OAAO,KAAK,CAAA;QACxC,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAA;QAC5F,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAA;QAC9D,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAOD,wGAAwG;AACxG,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACtE,IAAI,QAAgB,CAAA;IACpB,IAAI,IAAwB,CAAA;IAC5B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAA;QAC9E,QAAQ,GAAG,IAAI,OAAO,CAAC,WAAW,EAAE,GAAG,CAAA;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACnC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAA;YAC3C,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QAChC,CAAC;aAAM,CAAC;YACN,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAA;YAC1D,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;YAC9C,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QAC/B,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAA;IAChF,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAA;QAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,MAAM;YAAE,OAAO,SAAS,CAAA;QACxE,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;AAC/D,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACvC,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,OAAgB,EAAE,YAA2C;IAChF,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAA;IAC1E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACtC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC3D,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAC3C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;YAAE,SAAQ;QAC/E,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,IAAI,CAAA;IAChF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,OAAO,CACd,OAAgB,EAChB,cAA6C,EAC7C,cAAuB;IAEvB,IAAI,cAAc;QAAE,OAAO,EAAE,GAAG,SAAS,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAA;IAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,uGAAuG;IACvG,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC5D,IAAI,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,GAAG,SAAS,EAAE,6BAA6B,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAChF,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,GAAG,SAAS,EAAE,6BAA6B,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAChF,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,sBAAsB,GAAG,SAAS,CAAA;AACxC,MAAM,cAAc,GAAG,mBAAmB,CAAA;AAC1C,MAAM,0BAA0B,GAAG,SAAS,CAAA;AAC5C,MAAM,kBAAkB,GAAG,mBAAmB,CAAA;AAC9C,MAAM,yBAAyB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AACjD,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAA;AACtC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAA;AACtC,MAAM,gBAAgB,GAAG,kCAAkC,CAAA;AAC3D,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAEhC;mFACmF;AACnF,SAAS,eAAe,CAAC,KAAa;IACpC,wBAAwB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;AACzF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,wBAAwB,CAAC,KAAK,EAAE;QAC9B,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,kBAAkB;QAC3B,KAAK,EAAE,sBAAsB;KAC9B,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,wBAAwB,CAAC,KAAK,EAAE;QAC9B,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,mBAAmB;QAC5B,KAAK,EAAE,qBAAqB;KAC7B,CAAC,CAAA;AACJ,CAAC;AA8DD,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAA;AAC1F,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAgB,EAChB,OAA+B,EAC/B,GAAyD,EACzD,WAAW,GAAG,CAAC,EACf,aAAa,GAAG,0BAA0B,EAC1C,eAAe,GAAG,yBAAyB;IAE3C,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAA;IAC7C,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,UAAmE,CAAA;IACvE,IAAI,aAAa,GAAe,GAAG,EAAE,GAAE,CAAC,CAAA;IACxC,MAAM,aAAa,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClD,aAAa,GAAG,OAAO,CAAA;IACzB,CAAC,CAAC,CAAA;IACF,IAAI,cAAwC,CAAA;IAC5C,IAAI,SAAqD,CAAA;IAEzD,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,IAAI,SAAS,KAAK,SAAS;YAAE,aAAa,CAAC,SAAS,CAAC,CAAA;QACrD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjE,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,CAAC,eAAwB,EAAQ,EAAE;QAChD,IAAI,MAAM;YAAE,OAAM;QAClB,MAAM,GAAG,IAAI,CAAA;QACb,QAAQ,EAAE,CAAA;QACV,eAAe,CAAC,KAAK,EAAE,CAAA;QACvB,aAAa,EAAE,CAAA;QACf,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,UAAU,EAAE,KAAK,EAAE,CAAA;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;YAC3E,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,CAAC,KAAa,EAAQ,EAAE;QACpC,IAAI,MAAM;YAAE,OAAM;QAClB,6FAA6F;QAC7F,iGAAiG;QACjG,IAAI,CAAC,UAAU,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAA;YACzD,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,KAAK,CAAC,CAAA;YACf,CAAC;YACD,OAAM;QACR,CAAC;QACD,IAAI,CAAC;YACH,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,KAAK,CAAC,CAAA;QACf,CAAC;IACH,CAAC,CAAA;IAED,MAAM,MAAM,GAAuB;QACjC,MAAM,EAAE,eAAe,CAAC,MAAM;QAC9B,MAAM,EAAE,aAAa;QACrB,IAAI,CAAC,OAAO;YACV,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;YAClD,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;YAC9C,MAAM,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAA;YAC7F,MAAM,KAAK,GAAG,SAAS,OAAO,MAAM,CAAA;YACpC,KAAK,CACH,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,IAAI,aAAa;gBACpD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC,MAAM,CACtF,CAAA;QACH,CAAC;QACD,OAAO,CAAC,KAAK,GAAG,EAAE;YAChB,KAAK,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;QAChD,CAAC;QACD,KAAK;YACH,MAAM,CAAC,IAAI,CAAC,CAAA;QACd,CAAC;KACF,CAAA;IAED,MAAM,IAAI,GAAG,IAAI,cAAc,CAC7B;QACE,KAAK,CAAC,cAAc;YAClB,UAAU,GAAG,cAAc,CAAA;YAC3B,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,CAAA;gBACZ,OAAM;YACR,CAAC;YACD,cAAc,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACnC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACxE,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACpB,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAC3D;gBAAC,SAAoC,CAAC,KAAK,EAAE,EAAE,CAAA;YAClD,CAAC;YACD,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,IAAI,CACnC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EACpB,CAAC,KAAc,EAAE,EAAE;gBACjB,IAAI,MAAM;oBAAE,OAAM;gBAClB,IAAI,CAAC;oBACH,UAAU,EAAE,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAA;gBACjF,CAAC;wBAAS,CAAC;oBACT,MAAM,CAAC,KAAK,CAAC,CAAA;gBACf,CAAC;YACH,CAAC,CACF,CAAA;QACH,CAAC;QACD,MAAM;YACJ,MAAM,CAAC,KAAK,CAAC,CAAA;QACf,CAAC;KACF,EACD,IAAI,yBAAyB,CAAC,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAClE,CAAA;IAED,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,GAAG,OAAO;YACV,cAAc,EAAE,gBAAgB;YAChC,eAAe,EAAE,wBAAwB;YACzC,mBAAmB,EAAE,IAAI;SAC1B;KACF,CAAC,CAAA;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACpD,CAAC;AAED,SAAS,oBAAoB,CAAC,EAAwB,EAAE,OAA+B;IACrF,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE;QACjF,MAAM,EAAE,GAAG;QACX,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACtD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAA;QACpD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;QAC3D,IAAI,MAAM,GAAG,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IAC1D,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IACzB,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IAEpD,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC5D,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;IACnF,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAY,EAAE,CAAA;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IACnC,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,QAAgB;IAClD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACrC,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QACjD,IAAI,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,GAAG,QAAQ;YAAE,OAAO,SAAS,CAAA;QACxE,OAAO,OAAO,CAAA;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAAyB,EAAE,QAAgB;IAClE,IAAI,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAA;IACjE,OAAO,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAA;AAC5D,CAAC;AAED,MAAM,eAAe,GAAG,WAAW,CAAA;AACnC,MAAM,eAAe,GAAG,IAAI,CAAA;AAE5B;4GAC4G;AAC5G,SAAS,cAAc,CAAC,KAAoB;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAA;IACxF,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC1F,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;+GAE+G;AAC/G,SAAS,oBAAoB,CAC3B,OAAgB,EAChB,OAAuB,EACvB,WAAmB;IAEnB,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,IAAI,IAAI,CAAA;IAC9B,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;IACjE,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;QAC5D,OAAO,QAAQ,CACb,GAAG,EACH,SAAS,CAAC,eAAe,EACzB,mDAAmD,CACpD,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACtD,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QACrD,OAAO,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,eAAe,EAAE,yCAAyC,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,gBAAgB,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAG,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAA;QACzF,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;QAClE,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnF,OAAO,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAA;QAC1F,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;6FAC6F;AAC7F,SAAS,iBAAiB,CAAC,QAAyB;IAClD,IAAI,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAA;IACtC,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAA;IAC/B,IAAI,IAAI,KAAK,SAAS,CAAC,mBAAmB,IAAI,IAAI,KAAK,SAAS,CAAC,eAAe;QAAE,OAAO,GAAG,CAAA;IAC5F,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,KAAgB,EAChB,UAA6C,EAC7C,UAA0B,EAAE;IAE5B,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAA;IACnE,eAAe,CAAC,YAAY,CAAC,CAAA;IAC7B,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAA;IAC/E,mBAAmB,CAAC,gBAAgB,CAAC,CAAA;IACrC,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAA;IAC5E,kBAAkB,CAAC,eAAe,CAAC,CAAA;IACnC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC,CAAA;IACtF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,oGAAoG;QACpG,gGAAgG;QAChG,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3F,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,mGAAmG;YACnG,iGAAiG;YACjG,kEAAkE;YAClE,OAAO,mBAAmB,CACxB,OAAO,EACP,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,EAC/B,KAAK,EAAE,MAAM,EAAE,EAAE;gBACf,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;gBAC3B,MAAM,MAAM,CAAC,MAAM,CAAA;YACrB,CAAC,EACD,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,CAChB,CAAA;QACH,CAAC;QACD,OAAO,IAAI,QAAQ,CACjB,OAAO,CAAC,MAAM;YACZ,oFAAoF,EACtF,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,GAAG,IAAI,EAAE,EAAE,CACtE,CAAA;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACxC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE;SACzC,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE;gBAChE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,IAAI;aACd,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7F,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9C,IAAI,OAAO,KAAK,SAAS;QACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,EAAE;YAC9D,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,IAAI;SACd,CAAC,CAAA;IACJ,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,uFAAuF;YACvF,6DAA6D;YAC7D,OAAO,oBAAoB,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,oBAAoB,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;IACD,IAAI,KAAK,GAAiC,OAAO,CAAC,KAAK,CAAA;IACvD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,oBAAoB,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACnD,6FAA6F;IAC7F,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;IAC/D,MAAM,OAAO,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,sBAAsB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9F,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,6FAA6F;QAC7F,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;QACvE,IAAI,WAAW,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IACvF,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,MAA2B,EAAmC,EAAE,CAChF,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE;QAC5D,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM;QACxC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC,CAAA;IACJ,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,mBAAmB,CACxB,OAAO,EACP,OAAO,EACP,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAA;YACvC,IAAI,QAAQ,KAAK,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5C,MAAM,CAAC,KAAK,EAAE,CAAA;QAChB,CAAC,EACD,CAAC,EACD,gBAAgB,EAChB,eAAe,CAChB,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAA;IACjC,oGAAoG;IACpG,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IAC1E,uGAAuG;IACvG,MAAM,MAAM,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAC5E,OAAO,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;AACxF,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,SAAS,EACT,gBAAgB,EAIhB,SAAS,EAIT,eAAe,EACf,QAAQ,GACT,MAAM,eAAe,CAAA;AAEtB,2GAA2G;AAC3G,oGAAoG;AACpG,6GAA6G;AAC7G,sGAAsG;AACtG,MAAM,SAAS,GAA2B;IACxC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAC5B,gHAAgH;IAClH,+BAA+B,EAAE,sCAAsC;IACvE,wBAAwB,EAAE,OAAO;CAClC,CAAA;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,MAAc,EAAE,OAAgB;IACpD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;YAAE,OAAO,KAAK,CAAA;QACxC,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAA;QAC5F,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAA;QAC9D,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAOD,wGAAwG;AACxG,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACtE,IAAI,QAAgB,CAAA;IACpB,IAAI,IAAwB,CAAA;IAC5B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAA;QAC9E,QAAQ,GAAG,IAAI,OAAO,CAAC,WAAW,EAAE,GAAG,CAAA;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACnC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAA;YAC3C,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QAChC,CAAC;aAAM,CAAC;YACN,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAA;YAC1D,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;YAC9C,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QAC/B,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAA;IAChF,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAA;QAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,MAAM;YAAE,OAAO,SAAS,CAAA;QACxE,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;AAC/D,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACvC,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,OAAgB,EAAE,YAA2C;IAChF,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAA;IAC1E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACtC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC3D,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAC3C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;YAAE,SAAQ;QAC/E,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,IAAI,CAAA;IAChF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,OAAO,CACd,OAAgB,EAChB,cAA6C,EAC7C,cAAuB;IAEvB,IAAI,cAAc;QAAE,OAAO,EAAE,GAAG,SAAS,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAA;IAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,uGAAuG;IACvG,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC5D,IAAI,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,GAAG,SAAS,EAAE,6BAA6B,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAChF,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,GAAG,SAAS,EAAE,6BAA6B,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAChF,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,sBAAsB,GAAG,SAAS,CAAA;AACxC,MAAM,cAAc,GAAG,mBAAmB,CAAA;AAC1C,MAAM,0BAA0B,GAAG,SAAS,CAAA;AAC5C,MAAM,kBAAkB,GAAG,mBAAmB,CAAA;AAC9C,MAAM,yBAAyB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AACjD,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAA;AACtC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAA;AACtC,MAAM,gBAAgB,GAAG,kCAAkC,CAAA;AAC3D,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAChC,MAAM,sBAAsB,GAAG,CAAC,GAAG,MAAM,CAAA;AAEzC;mFACmF;AACnF,SAAS,eAAe,CAAC,KAAa;IACpC,wBAAwB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;AACzF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,wBAAwB,CAAC,KAAK,EAAE;QAC9B,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,kBAAkB;QAC3B,KAAK,EAAE,sBAAsB;KAC9B,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,wBAAwB,CAAC,KAAK,EAAE;QAC9B,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,mBAAmB;QAC5B,KAAK,EAAE,qBAAqB;KAC7B,CAAC,CAAA;AACJ,CAAC;AAgED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAA;AAC1F,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAgB,EAChB,OAA+B,EAC/B,GAAyD,EACzD,WAAW,GAAG,CAAC,EACf,aAAa,GAAG,0BAA0B,EAC1C,eAAe,GAAG,yBAAyB;IAE3C,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAA;IAC7C,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,UAAmE,CAAA;IACvE,IAAI,aAAa,GAAe,GAAG,EAAE,GAAE,CAAC,CAAA;IACxC,MAAM,aAAa,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClD,aAAa,GAAG,OAAO,CAAA;IACzB,CAAC,CAAC,CAAA;IACF,IAAI,cAAwC,CAAA;IAC5C,IAAI,SAAqD,CAAA;IAEzD,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,IAAI,SAAS,KAAK,SAAS;YAAE,aAAa,CAAC,SAAS,CAAC,CAAA;QACrD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjE,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,CAAC,eAAwB,EAAQ,EAAE;QAChD,IAAI,MAAM;YAAE,OAAM;QAClB,MAAM,GAAG,IAAI,CAAA;QACb,QAAQ,EAAE,CAAA;QACV,eAAe,CAAC,KAAK,EAAE,CAAA;QACvB,aAAa,EAAE,CAAA;QACf,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,UAAU,EAAE,KAAK,EAAE,CAAA;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;YAC3E,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,CAAC,KAAa,EAAQ,EAAE;QACpC,IAAI,MAAM;YAAE,OAAM;QAClB,6FAA6F;QAC7F,iGAAiG;QACjG,IAAI,CAAC,UAAU,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAA;YACzD,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,KAAK,CAAC,CAAA;YACf,CAAC;YACD,OAAM;QACR,CAAC;QACD,IAAI,CAAC;YACH,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,KAAK,CAAC,CAAA;QACf,CAAC;IACH,CAAC,CAAA;IAED,MAAM,MAAM,GAAuB;QACjC,MAAM,EAAE,eAAe,CAAC,MAAM;QAC9B,MAAM,EAAE,aAAa;QACrB,IAAI,CAAC,OAAO;YACV,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;YAClD,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;YAC9C,MAAM,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAA;YAC7F,MAAM,KAAK,GAAG,SAAS,OAAO,MAAM,CAAA;YACpC,KAAK,CACH,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,IAAI,aAAa;gBACpD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC,MAAM,CACtF,CAAA;QACH,CAAC;QACD,OAAO,CAAC,KAAK,GAAG,EAAE;YAChB,KAAK,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;QAChD,CAAC;QACD,KAAK;YACH,MAAM,CAAC,IAAI,CAAC,CAAA;QACd,CAAC;KACF,CAAA;IAED,MAAM,IAAI,GAAG,IAAI,cAAc,CAC7B;QACE,KAAK,CAAC,cAAc;YAClB,UAAU,GAAG,cAAc,CAAA;YAC3B,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,CAAA;gBACZ,OAAM;YACR,CAAC;YACD,cAAc,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACnC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACxE,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACpB,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAC3D;gBAAC,SAAoC,CAAC,KAAK,EAAE,EAAE,CAAA;YAClD,CAAC;YACD,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,IAAI,CACnC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EACpB,CAAC,KAAc,EAAE,EAAE;gBACjB,IAAI,MAAM;oBAAE,OAAM;gBAClB,IAAI,CAAC;oBACH,UAAU,EAAE,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAA;gBACjF,CAAC;wBAAS,CAAC;oBACT,MAAM,CAAC,KAAK,CAAC,CAAA;gBACf,CAAC;YACH,CAAC,CACF,CAAA;QACH,CAAC;QACD,MAAM;YACJ,MAAM,CAAC,KAAK,CAAC,CAAA;QACf,CAAC;KACF,EACD,IAAI,yBAAyB,CAAC,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAClE,CAAA;IAED,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,GAAG,OAAO;YACV,cAAc,EAAE,gBAAgB;YAChC,eAAe,EAAE,wBAAwB;YACzC,mBAAmB,EAAE,IAAI;SAC1B;KACF,CAAC,CAAA;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACpD,CAAC;AAED,SAAS,oBAAoB,CAAC,EAAwB,EAAE,OAA+B;IACrF,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE;QACjF,MAAM,EAAE,GAAG;QACX,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACtD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAA;QACpD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;QAC3D,IAAI,MAAM,GAAG,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IAC1D,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IACzB,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IAEpD,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC5D,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;IACnF,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAY,EAAE,CAAA;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IACnC,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,QAAgB;IAClD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACrC,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QACjD,IAAI,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,GAAG,QAAQ;YAAE,OAAO,SAAS,CAAA;QACxE,OAAO,OAAO,CAAA;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAAyB,EAAE,QAAgB;IAClE,IAAI,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAA;IACjE,OAAO,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAA;AAC5D,CAAC;AAED,MAAM,eAAe,GAAG,WAAW,CAAA;AACnC,MAAM,eAAe,GAAG,IAAI,CAAA;AAE5B;4GAC4G;AAC5G,SAAS,cAAc,CAAC,KAAoB;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAA;IACxF,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC1F,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;+GAE+G;AAC/G,SAAS,oBAAoB,CAC3B,OAAgB,EAChB,OAAuB,EACvB,WAAmB;IAEnB,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,IAAI,IAAI,CAAA;IAC9B,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;IACjE,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;QAC5D,OAAO,QAAQ,CACb,GAAG,EACH,SAAS,CAAC,eAAe,EACzB,mDAAmD,CACpD,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACtD,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QACrD,OAAO,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,eAAe,EAAE,yCAAyC,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,gBAAgB,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAG,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAA;QACzF,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;QAClE,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnF,OAAO,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAA;QAC1F,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;6FAC6F;AAC7F,SAAS,iBAAiB,CAAC,QAAyB;IAClD,IAAI,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAA;IACtC,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAA;IAC/B,IAAI,IAAI,KAAK,SAAS,CAAC,mBAAmB,IAAI,IAAI,KAAK,SAAS,CAAC,eAAe;QAAE,OAAO,GAAG,CAAA;IAC5F,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,KAAgB,EAChB,UAA6C,EAC7C,UAA0B,EAAE;IAE5B,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAA;IACnE,eAAe,CAAC,YAAY,CAAC,CAAA;IAC7B,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAA;IAC/E,mBAAmB,CAAC,gBAAgB,CAAC,CAAA;IACrC,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAA;IAC5E,kBAAkB,CAAC,eAAe,CAAC,CAAA;IACnC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC,CAAA;IACtF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,oGAAoG;QACpG,gGAAgG;QAChG,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3F,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,mGAAmG;YACnG,iGAAiG;YACjG,kEAAkE;YAClE,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBAC3C,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE;oBACxC,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE;iBACzC,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,mBAAmB,CACxB,OAAO,EACP,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,EAC/B,KAAK,EAAE,MAAM,EAAE,EAAE;gBACf,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;gBAC3B,oFAAoF;gBACpF,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,sBAAsB,CAAC,CAAA;gBACzE,MAAM,MAAM,CAAC,MAAM,CAAA;gBACnB,YAAY,CAAC,QAAQ,CAAC,CAAA;YACxB,CAAC,EACD,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,CAChB,CAAA;QACH,CAAC;QACD,OAAO,IAAI,QAAQ,CACjB,OAAO,CAAC,MAAM;YACZ,oFAAoF,EACtF,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,GAAG,IAAI,EAAE,EAAE,CACtE,CAAA;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACxC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE;SACzC,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE;gBAChE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,IAAI;aACd,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7F,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9C,IAAI,OAAO,KAAK,SAAS;QACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,EAAE;YAC9D,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,IAAI;SACd,CAAC,CAAA;IACJ,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,uFAAuF;YACvF,6DAA6D;YAC7D,OAAO,oBAAoB,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,oBAAoB,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;IACD,IAAI,KAAK,GAAiC,OAAO,CAAC,KAAK,CAAA;IACvD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,oBAAoB,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACnD,6FAA6F;IAC7F,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;IAC/D,MAAM,OAAO,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,sBAAsB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9F,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,6FAA6F;QAC7F,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;QACvE,IAAI,WAAW,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IACvF,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,MAA2B,EAAmC,EAAE,CAChF,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE;QAC5D,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM;QACxC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC,CAAA;IACJ,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,mBAAmB,CACxB,OAAO,EACP,OAAO,EACP,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAA;YACvC,IAAI,QAAQ,KAAK,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5C,MAAM,CAAC,KAAK,EAAE,CAAA;QAChB,CAAC,EACD,CAAC,EACD,gBAAgB,EAChB,eAAe,CAChB,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAA;IACjC,oGAAoG;IACpG,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IAC1E,uGAAuG;IACvG,MAAM,MAAM,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAC5E,OAAO,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;AACxF,CAAC"}

package/dist/server.d.ts

@@ -59,7 +59,8 @@ export interface CreateMcpServerOptions {
      * This is the seam for "this caller may list tools but may not call the write ones" - the HTTP
      * layer above only sees one opaque POST, so a route guard cannot make that distinction.
      * `fetch(request, { authorizeMessage })` overrides it per request when the decision depends on
-     * something the surrounding handler resolved (a session, a tenant).
+     * something the surrounding handler resolved (a session, a tenant). With it set, a GET for the
+     * server-message stream is answered `405`, since that stream has no message to authorize.
      */
     readonly authorizeMessage?: (message: JsonRpcRequest, request: Request) => boolean | Promise<boolean>;
 }

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,WAAW,CAAA;AAC/D,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,OAAO,EAEb,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAE5C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;IACnC,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,WAAW,EAAE,CAAA;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACvC,4BAA4B;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,uFAAuF;IACvF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,wGAAwG;IACxG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,iGAAiG;IACjG,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,iGAAiG;IACjG,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,yGAAyG;IACzG,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,qGAAqG;IACrG,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACjC,iFAAiF;IACjF,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC,cAAc,CAAC,CAAA;IACtD;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAC1B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,OAAO,KACb,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;IACpC,QAAQ,CAAC,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACtD,qGAAqG;IACrG,KAAK,CACH,OAAO,EAAE,OAAO,EAChB,SAAS,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,kBAAkB,GAAG,OAAO,GAAG,cAAc,CAAC,GAC9E,OAAO,CAAC,QAAQ,CAAC,CAAA;IACpB,mGAAmG;IACnG,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;IAChE;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACrC;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,SAAS,CAyCvE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,WAAW,CAAA;AAC/D,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,OAAO,EAEb,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAE5C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;IACnC,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,WAAW,EAAE,CAAA;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACvC,4BAA4B;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,uFAAuF;IACvF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,wGAAwG;IACxG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,iGAAiG;IACjG,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,iGAAiG;IACjG,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,yGAAyG;IACzG,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,qGAAqG;IACrG,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACjC,iFAAiF;IACjF,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC,cAAc,CAAC,CAAA;IACtD;;;;;;;;;OASG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAC1B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,OAAO,KACb,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;IACpC,QAAQ,CAAC,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACtD,qGAAqG;IACrG,KAAK,CACH,OAAO,EAAE,OAAO,EAChB,SAAS,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,kBAAkB,GAAG,OAAO,GAAG,cAAc,CAAC,GAC9E,OAAO,CAAC,QAAQ,CAAC,CAAA;IACpB,mGAAmG;IACnG,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;IAChE;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACrC;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,SAAS,CAyCvE"}

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAuB,cAAc,EAAE,MAAM,WAAW,CAAA;AAC/D,OAAO,EACL,SAAS,EAQT,OAAO,GACR,MAAM,eAAe,CAAA;AAiEtB,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAA;IAClC,sGAAsG;IACtG,gDAAgD;IAChD,MAAM,SAAS,GAAkB,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAA;IAC/F,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IAC7D,MAAM,QAAQ,GAAsB;QAClC,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAA;IACD,OAAO;QACL,KAAK;QACL,QAAQ;QACR,UAAU;QACV,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAC5B,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE;YACzC,QAAQ;YACR,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/E,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,SAAS,EAAE,gBAAgB,KAAK,SAAS;gBAC3C,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;YACrE,GAAG,CAAC,SAAS,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC;SAC3F,CAAC;QACJ,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAClB,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE;YAC9C,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;SAC3D,CAAC;KACL,CAAA;AACH,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAuB,cAAc,EAAE,MAAM,WAAW,CAAA;AAC/D,OAAO,EACL,SAAS,EAQT,OAAO,GACR,MAAM,eAAe,CAAA;AAkEtB,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAA;IAClC,sGAAsG;IACtG,gDAAgD;IAChD,MAAM,SAAS,GAAkB,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAA;IAC/F,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IAC7D,MAAM,QAAQ,GAAsB;QAClC,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAA;IACD,OAAO;QACL,KAAK;QACL,QAAQ;QACR,UAAU;QACV,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAC5B,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE;YACzC,QAAQ;YACR,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/E,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,SAAS,EAAE,gBAAgB,KAAK,SAAS;gBAC3C,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;YACrE,GAAG,CAAC,SAAS,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC;SAC3F,CAAC;QACJ,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAClB,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE;YAC9C,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;SAC3D,CAAC;KACL,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/mcp",
-  "version": "5.0.0",
+  "version": "5.2.0",
   "description": "Build MCP servers - and MCP Apps (interactive `ui://` widgets, SEP-1865) - for a nifra app. The transport-agnostic JSON-RPC core (also used by `@nifrajs/cli`'s dev MCP), a Streamable-HTTP handler you mount at `POST /mcp`, and `defineMcpWidget`/`defineMcpTool` for tool results that render real UI in MCP hosts.",
   "keywords": [
     "bun",
@@ -56,7 +56,8 @@
   },
   "files": [
     "dist",
-    "src"
+    "src",
+    "CHANGELOG.md"
   ],
   "sideEffects": false,
   "scripts": {
@@ -67,11 +68,11 @@
     "access": "public"
   },
   "dependencies": {
-    "@nifrajs/agent-protocol": "5.0.0"
+    "@nifrajs/agent-protocol": "5.2.0"
   },
   "peerDependencies": {
-    "@nifrajs/agent": "^5.0.0",
-    "@nifrajs/core": "^5.0.0"
+    "@nifrajs/agent": "^5.2.0",
+    "@nifrajs/core": "^5.2.0"
   },
   "peerDependenciesMeta": {
     "@nifrajs/agent": {

package/src/http.ts

@@ -158,6 +158,7 @@ const TEXT_DECODER = new TextDecoder()
 const TEXT_ENCODER = new TextEncoder()
 const SSE_CONTENT_TYPE = "text/event-stream; charset=utf-8"
 const SSE_KEEP_ALIVE_MS = 15_000
+const GET_STREAM_LIFETIME_MS = 5 * 60_000
 
 /** Invalid byte caps make `total > maxBytes` fail open (especially for `NaN`). Reject configuration
  * before any request body is read so MCP cannot silently lose its memory bound. */
@@ -226,6 +227,8 @@ export interface McpHttpOptions {
    * Optional authorization, run once per request against the parsed message - after the body has been
    * read under the size cap, so it never costs a second read of the stream. Returning `false` answers
    * `403` with a JSON-RPC error (`MCP_ERROR.UNAUTHORIZED`) and the handler never sees the message.
+   * A GET for the server-message stream carries no message to authorize, so with this set it is
+   * answered `405` (no stream offered) instead.
    */
   readonly authorizeMessage?: (
     message: JsonRpcRequest,
@@ -481,7 +484,8 @@ function modernErrorStatus(response: JsonRpcResponse): number {
 /**
  * Handle one MCP request over HTTP against the given `tools`/`features`. POST a JSON-RPC body → a JSON-RPC
  * response, or an SSE stream carrying progress notifications and the final response when the client
- * accepts `text/event-stream`; GET → a health page or a cancellable SSE stream; OPTIONS → CORS preflight.
+ * accepts `text/event-stream`; GET → a health page or a keep-alive SSE stream that closes after five minutes
+ * (`405` when `authorizeMessage` is set); OPTIONS → CORS preflight.
  * Never throws - a bad body becomes a JSON-RPC parse error. Dual-era: a modern (2026-07-28) POST that
  * mirrors its method/name/version into headers is validated against the body before dispatch and gets spec
  * HTTP statuses; legacy requests are served unchanged. The dispatch is the shared, transport-agnostic
@@ -514,12 +518,21 @@ export async function respondMcpHttp(
       // Keep the GET side of Streamable HTTP usable for clients that open a server-message channel. This
       // transport has no durable session store, so the public seam is a cancellable keep-alive stream;
       // request-scoped progress still travels on the POST stream below.
+      if (options.authorizeMessage !== undefined) {
+        return new Response("method not allowed", {
+          status: 405,
+          headers: { allow: "POST, GET", ...cors },
+        })
+      }
       return eventStreamResponse(
         request,
         { allow: "POST, GET", ...cors },
         async (stream) => {
           stream.comment("connected")
+          // Nothing is ever sent here, so a bounded lifetime costs a client only a reconnect.
+          const lifetime = setTimeout(() => stream.close(), GET_STREAM_LIFETIME_MS)
           await stream.closed
+          clearTimeout(lifetime)
         },
         SSE_KEEP_ALIVE_MS,
         maxResponseBytes,

package/src/server.ts

@@ -71,7 +71,8 @@ export interface CreateMcpServerOptions {
    * This is the seam for "this caller may list tools but may not call the write ones" - the HTTP
    * layer above only sees one opaque POST, so a route guard cannot make that distinction.
    * `fetch(request, { authorizeMessage })` overrides it per request when the decision depends on
-   * something the surrounding handler resolved (a session, a tenant).
+   * something the surrounding handler resolved (a session, a tenant). With it set, a GET for the
+   * server-message stream is answered `405`, since that stream has no message to authorize.
    */
   readonly authorizeMessage?: (
     message: JsonRpcRequest,