@novorb/mcp-core 2.1.1 → 3.0.0

package/dist/tools.js

@@ -0,0 +1,370 @@
+/**
+ * @novorb/mcp-core - Tools
+ *
+ * Register a server's tool definitions on an SDK v2 `McpServer` through `McpServer.registerTool`, so
+ * the SDK keeps doing what it does (tools/list from the schemas, input validation, output validation
+ * with the era projection, unknown tool = ProtocolError -32602) and mcp-core adds only what it lacks:
+ *
+ * - one central wrapper per tool: `logToolCall` / `logToolResult` with the duration (shape only,
+ *   never values);
+ * - thrown errors become an `isError` result through `mapError` (default: a safe message, never a
+ *   stack trace, never a raw error object); a thrown schema error (zod / Standard Schema issues) names
+ *   the offending fields;
+ * - a returned legacy `{ success: false, error }` envelope becomes `isError: true`;
+ * - degraded mode: a tool whose `requires` env keys are not configured is still LISTED and answers one
+ *   uniform error, `<server> is not configured: set <KEYS>`;
+ * - `enabled` filters what is registered at all.
+ *
+ *   registerTools(server, [
+ *     {
+ *       name: 'lookup',
+ *       description: 'Look up a value',
+ *       inputSchema: z.object({ key: z.string() }),
+ *       annotations: TOOL_ANNOTATIONS.readOnly,
+ *       requires: ['API_TOKEN'],
+ *       handler: async ({ key }, ctx) => toolResult(await client.get(key, { signal: ctx.signal })),
+ *     },
+ *   ], { env, serverName: 'my-mcp' });
+ */
+import { CLIENT_CAPABILITIES_META_KEY, inputRequired, isInputRequiredResult, ProtocolError, ProtocolErrorCode, } from '@modelcontextprotocol/server';
+import { createClientInput, requestEra } from './client-input.js';
+import { attachCredentialMeta, attachCredentialReport, credentialReportBytes, withCredentialsField, } from './credential-report.js';
+import { CredentialScope, NoUsableCredentialError, processCredentials, runWithCredentialScope, } from './credentials.js';
+import { resolveLimits } from './limits.js';
+import { bindToSurface } from './notifications.js';
+import { InvalidCursorError, invalidCursorResult } from './pagination.js';
+import { runWithRequestContext } from './protocol-logging.js';
+import { RequestStateKeyError } from './request-state.js';
+import { declaresPageArgs, decodeToolCursor, enforceResultLimits, handlerArgs, } from './result-limits.js';
+import { requestStateCodecOf } from './server.js';
+import { InvalidPathSegmentError } from './url-path.js';
+import { getLogger, logToolCall, logToolResult, maskSecretValues } from './utils/logger.js';
+import { redactStringSecrets } from './utils/redact.js';
+/** Identity helper that types a definition's handler arguments from its own input schema. */
+export function defineTool(definition) {
+    return definition;
+}
+const LIMIT_KEYS = [
+    'MCP_LIST_PAGE_SIZE',
+    'MCP_MAX_RESULT_ITEMS',
+    'MCP_MAX_RESULT_BYTES',
+    'MCP_MAX_TOOL_INPUT_ELEMENTS',
+];
+/** The response-limit keys as read through the loaded env (env file and defaults included). */
+function limitsEnv(env) {
+    const out = {};
+    for (const key of LIMIT_KEYS)
+        out[key] = env.get(key);
+    return out;
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * A success result: the text block is `opts.text`, the string itself, or pretty JSON; a plain object
+ * is also sent as `structuredContent` (the spec requires an object there).
+ */
+export function toolResult(data, opts = {}) {
+    const text = opts.text ?? (typeof data === 'string' ? data : (JSON.stringify(data, null, 2) ?? String(data)));
+    const result = { content: [{ type: 'text', text }] };
+    if (isPlainObject(data))
+        result.structuredContent = data;
+    return result;
+}
+/**
+ * Text bound for a client in an error: secret query/userinfo/Basic parameters redacted and every
+ * registered secret value masked, exactly as the logger does for its lines.
+ */
+export function maskClientText(text) {
+    return maskSecretValues(redactStringSecrets(text));
+}
+/**
+ * An error result (`isError: true`): the message as text, optional details as a second JSON block.
+ * Both are passed through `maskClientText`.
+ */
+export function toolError(message, details) {
+    const content = [{ type: 'text', text: maskClientText(message) }];
+    if (details !== undefined)
+        content.push({ type: 'text', text: maskClientText(JSON.stringify(details, null, 2)) });
+    return { content, isError: true };
+}
+/** Mask every text block of an error result (whatever produced it). */
+function maskErrorResult(result) {
+    if (result.isError !== true)
+        return result;
+    return {
+        ...result,
+        content: result.content.map((block) => block.type === 'text' ? { ...block, text: maskClientText(block.text) } : block),
+    };
+}
+function schemaIssues(err) {
+    if (!isPlainObject(err) && !(err instanceof Error))
+        return undefined;
+    const issues = err.issues;
+    if (!Array.isArray(issues) || issues.length === 0)
+        return undefined;
+    if (!issues.every((i) => isPlainObject(i) && typeof i.message === 'string'))
+        return undefined;
+    return issues;
+}
+function issuePath(issue) {
+    const parts = (issue.path ?? []).map((p) => String(typeof p === 'object' && p !== null ? p.key : p));
+    return parts.join('.');
+}
+/** "Invalid arguments: a.b: msg; c: msg" for a thrown zod / Standard Schema error. */
+function formatIssues(issues) {
+    return `Invalid arguments: ${issues
+        .map((i) => {
+        const p = issuePath(i);
+        return p ? `${p}: ${i.message}` : i.message;
+    })
+        .join('; ')}`;
+}
+const MAX_ERROR_MESSAGE = 2000;
+/** The default `mapError`: the error message only (secret parameters redacted, bounded), never a stack. */
+export function defaultMapError(err) {
+    let message;
+    if (err instanceof Error)
+        message = err.message || err.name;
+    else if (typeof err === 'string')
+        message = err;
+    else
+        message = 'Internal error';
+    message = maskClientText(message).replace(/[\r\n]+/g, ' ');
+    if (message.length > MAX_ERROR_MESSAGE)
+        message = `${message.slice(0, MAX_ERROR_MESSAGE)}...`;
+    return { message: message || 'Internal error' };
+}
+function isCallToolResult(value) {
+    return isPlainObject(value) && Array.isArray(value.content);
+}
+function isLegacyEnvelope(value) {
+    return isPlainObject(value) && typeof value.success === 'boolean';
+}
+/**
+ * Map a handler's return value onto a CallToolResult. An SDK input-required result
+ * (`resultType: 'input_required'`) is returned untouched: the SDK owns it (it skips output validation
+ * for it and drives the multi-round-trip flow, or the 2025 legacy shim).
+ */
+export function normalizeOutcome(outcome, hasOutputSchema = false) {
+    if (isInputRequiredResult(outcome))
+        return outcome;
+    if (isCallToolResult(outcome))
+        return outcome;
+    if (isLegacyEnvelope(outcome)) {
+        const text = JSON.stringify(outcome, null, 2);
+        if (!outcome.success)
+            return { content: [{ type: 'text', text }], isError: true };
+        const result = { content: [{ type: 'text', text }] };
+        if (hasOutputSchema && isPlainObject(outcome.data))
+            result.structuredContent = outcome.data;
+        return result;
+    }
+    return toolResult(outcome);
+}
+/** The uniform degraded-mode message. */
+export function notConfiguredMessage(serverName, missing) {
+    return `${serverName} is not configured: set ${missing.join(', ')}`;
+}
+/**
+ * The client's declared capabilities for this request, read the way the SDK's own input-required gate
+ * reads them: the request's `_meta` envelope on 2026-07-28 requests, the `initialize`-scoped value on a
+ * 2025-era connection (`getClientCapabilities()`, deprecated in favour of the envelope but functional).
+ */
+function clientCapabilitiesOf(server, sdk) {
+    if (!sdk)
+        return undefined;
+    const envelope = sdk.mcpReq.envelope;
+    const fromEnvelope = envelope?.[CLIENT_CAPABILITIES_META_KEY];
+    return fromEnvelope ?? server.server.getClientCapabilities();
+}
+function contextFor(server, tool, args, sdk, credentials) {
+    const cursor = isPlainObject(args) && typeof args.cursor === 'string' && args.cursor !== '' ? args.cursor : undefined;
+    const progressToken = sdk?.mcpReq._meta?.progressToken;
+    const clientCapabilities = clientCapabilitiesOf(server, sdk);
+    const signal = sdk?.mcpReq.signal ?? new AbortController().signal;
+    const codec = requestStateCodecOf(server);
+    return {
+        requestState: () => (codec && sdk ? sdk.mcpReq.requestState() : undefined),
+        continueWith: async (state, inputRequests) => {
+            if (!codec) {
+                throw new RequestStateKeyError('requestState is not configured on this server: set MCP_REQUEST_STATE_KEY and pass requestStateCodec to createMcpServer');
+            }
+            if (!sdk)
+                throw new Error('continueWith needs the SDK request context');
+            const requestState = await codec.mint(state, sdk);
+            return inputRequired({ ...(inputRequests !== undefined ? { inputRequests } : {}), requestState });
+        },
+        tool,
+        signal,
+        authInfo: sdk?.http?.authInfo,
+        cursor,
+        ...(sdk ? { era: requestEra(sdk) } : {}),
+        ...(clientCapabilities !== undefined ? { clientCapabilities } : {}),
+        logger: getLogger(),
+        credentials,
+        sdk,
+        ...createClientInput(sdk, clientCapabilities),
+        progress: async (progress, total, message) => {
+            if (!sdk || progressToken === undefined || signal.aborted)
+                return;
+            try {
+                await sdk.mcpReq.notify({
+                    method: 'notifications/progress',
+                    params: {
+                        progressToken,
+                        progress,
+                        ...(total !== undefined ? { total } : {}),
+                        ...(message !== undefined ? { message } : {}),
+                    },
+                });
+            }
+            catch {
+                // A lost progress notification never fails the tool.
+            }
+        },
+    };
+}
+/** The SDK rethrows exactly this protocol error from its tools/call handler; so must the wrapper. */
+function isRethrownProtocolError(err) {
+    return ProtocolError.isInstance(err) && err.code === ProtocolErrorCode.UrlElicitationRequired;
+}
+/**
+ * Register `tools` on `server` with `McpServer.registerTool`. Returns the SDK handles by registered
+ * name (for `disable()` / `enable()` / `remove()`).
+ */
+export function registerTools(server, tools, opts = {}) {
+    const handles = new Map();
+    const enabled = opts.enabled ? new Set(opts.enabled) : undefined;
+    const mapError = opts.mapError ?? defaultMapError;
+    const serverName = opts.serverName ?? 'this server';
+    const prefix = opts.prefix ?? '';
+    const serverLimits = opts.limits ?? {};
+    const registry = opts.credentials ?? processCredentials();
+    const valueFor = (key) => opts.env?.get(key);
+    for (const tool of tools) {
+        if (enabled && !enabled.has(tool.name))
+            continue;
+        const name = `${prefix}${tool.name}`;
+        const requires = tool.requires ?? [];
+        if (requires.length > 0 && !opts.env) {
+            throw new Error(`registerTools: tool ${name} declares requires but no env was passed`);
+        }
+        const declared = new Set(opts.env?.schema.map((s) => s.key));
+        const undeclared = requires.filter((k) => !declared.has(k));
+        if (undeclared.length > 0) {
+            throw new Error(`registerTools: tool ${name} requires ${undeclared.join(', ')}, which the env schema does not declare`);
+        }
+        if (tool.paginated && !declaresPageArgs(tool.inputSchema)) {
+            throw new Error(`registerTools: paginated tool ${name} must declare cursor and limit in its input schema`);
+        }
+        const limits = resolveLimits({
+            ...(serverLimits.maxItems !== undefined ? { maxResultItems: serverLimits.maxItems } : {}),
+            ...(serverLimits.maxBytes !== undefined ? { maxResultBytes: serverLimits.maxBytes } : {}),
+            ...(tool.limits?.maxItems !== undefined ? { maxResultItems: tool.limits.maxItems } : {}),
+            ...(tool.limits?.maxBytes !== undefined ? { maxResultBytes: tool.limits.maxBytes } : {}),
+        }, opts.env ? limitsEnv(opts.env) : process.env);
+        const outputSchema = tool.outputSchema !== undefined ? withCredentialsField(tool.outputSchema) : undefined;
+        const reportStructured = outputSchema !== undefined && outputSchema !== tool.outputSchema;
+        const execute = async (args, sdk, credentials) => {
+            const started = Date.now();
+            logToolCall(name, args);
+            let result;
+            let decoded;
+            try {
+                const missing = requires.filter((k) => !opts.env?.has(k));
+                const cursor = isPlainObject(args) && typeof args.cursor === 'string' ? args.cursor : undefined;
+                if (cursor !== undefined)
+                    decoded = decodeToolCursor(name, args, cursor, tool.paginated === true);
+                if (missing.length > 0) {
+                    result = toolError(notConfiguredMessage(serverName, missing));
+                }
+                else {
+                    const callArgs = handlerArgs(args, decoded, limits.maxResultItems);
+                    const outcome = await tool.handler(callArgs, contextFor(server, name, callArgs, sdk, credentials));
+                    result = normalizeOutcome(outcome, tool.outputSchema !== undefined);
+                    if (!isInputRequiredResult(result))
+                        result = maskErrorResult(result);
+                }
+            }
+            catch (err) {
+                if (err instanceof InvalidCursorError) {
+                    result = invalidCursorResult(err);
+                    logToolResult(name, { isError: true, durationMs: Date.now() - started });
+                    return result;
+                }
+                if (isRethrownProtocolError(err)) {
+                    logToolResult(name, { isError: true, durationMs: Date.now() - started });
+                    throw err;
+                }
+                const issues = schemaIssues(err);
+                if (err instanceof NoUsableCredentialError) {
+                    result = toolError(`${serverName} cannot serve ${name}: ${err.message}. Replace or renew the key(s), or wait for a degraded one to recover.`);
+                }
+                else if (err instanceof InvalidPathSegmentError) {
+                    // Actionable whatever the server's mapError does; the message names the argument, never the value.
+                    result = toolError(err.message);
+                }
+                else if (issues) {
+                    result = toolError(formatIssues(issues));
+                }
+                else {
+                    let mapped;
+                    try {
+                        mapped = mapError(err);
+                    }
+                    catch {
+                        mapped = { message: 'Internal error' };
+                    }
+                    result = toolError(mapped.code ? `${mapped.code}: ${mapped.message}` : mapped.message);
+                }
+            }
+            // The report's own bytes count against the byte cap, so the final result stays under it.
+            const report = credentials.touchedAny ? credentials.report() : [];
+            if (isInputRequiredResult(result)) {
+                result = attachCredentialMeta(result, report, maskClientText);
+            }
+            else {
+                const reportBytes = credentialReportBytes(report, reportStructured);
+                result = enforceResultLimits({
+                    tool: name,
+                    args,
+                    decoded,
+                    maxItems: limits.maxResultItems,
+                    maxBytes: Math.max(1, limits.maxResultBytes - reportBytes),
+                    ...(opts.onOversize ? { onOversize: opts.onOversize } : {}),
+                    ...(sdk?.http?.authInfo ? { authInfo: sdk.http.authInfo } : {}),
+                    ...(tool.envelope ? { envelope: tool.envelope } : {}),
+                }, result);
+                result = attachCredentialReport(result, report, { structured: reportStructured, mask: maskClientText });
+            }
+            logToolResult(name, {
+                isError: !isInputRequiredResult(result) && result.isError === true,
+                durationMs: Date.now() - started,
+            });
+            return result;
+        };
+        // The request scope lets the protocol log forwarder find this request's SDK context.
+        const run = (args, sdk) => {
+            const credentials = new CredentialScope(registry, valueFor);
+            const call = () => runWithCredentialScope(credentials, () => execute(args, sdk, credentials));
+            return sdk ? runWithRequestContext(sdk, call) : call();
+        };
+        const config = {
+            ...(tool.title !== undefined ? { title: tool.title } : {}),
+            description: tool.description,
+            inputSchema: tool.inputSchema,
+            ...(outputSchema !== undefined ? { outputSchema } : {}),
+            annotations: tool.annotations,
+            ...(tool.icons !== undefined ? { icons: tool.icons } : {}),
+            ...(tool.scopeChallenge !== undefined ? { scopeChallenge: tool.scopeChallenge } : {}),
+            ...(tool._meta !== undefined ? { _meta: tool._meta } : {}),
+        };
+        const handle = server.registerTool(name, config, (args, ctx) => run(args, ctx));
+        if (opts.surface)
+            bindToSurface(server, opts.surface, 'tool', name, handle);
+        handles.set(name, handle);
+    }
+    return handles;
+}
+//# sourceMappingURL=tools.js.map

package/dist/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAGL,4BAA4B,EAK5B,aAAa,EACb,qBAAqB,EACrB,aAAa,EACb,iBAAiB,GAKlB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAoB,iBAAiB,EAAmB,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACrG,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAuB,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,GAKZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAA2C,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EAAE,SAAS,EAAe,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACzG,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAiHxD,6FAA6F;AAC7F,MAAM,UAAU,UAAU,CAAmC,UAA6B;IACxF,OAAO,UAA0C,CAAC;AACpD,CAAC;AAkCD,MAAM,UAAU,GAAG;IACjB,oBAAoB;IACpB,sBAAsB;IACtB,sBAAsB;IACtB,6BAA6B;CACrB,CAAC;AAEX,+FAA+F;AAC/F,SAAS,SAAS,CAAC,GAAc;IAC/B,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,UAAU;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAa,EAAE,OAA0B,EAAE;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9G,MAAM,MAAM,GAAmB,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACrE,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,gBAAgB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,OAAiC;IAC1E,MAAM,OAAO,GAA8B,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7F,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,uEAAuE;AACvE,SAAS,eAAe,CAAC,MAAsB;IAC7C,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAC3C,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACpC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAC/E;KACF,CAAC;AACJ,CAAC;AAOD,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9F,OAAO,MAAuB,CAAC;AACjC,CAAC;AAED,SAAS,SAAS,CAAC,KAAkB;IACnC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrG,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,sFAAsF;AACtF,SAAS,YAAY,CAAC,MAAqB;IACzC,OAAO,sBAAsB,MAAM;SAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9C,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,2GAA2G;AAC3G,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,IAAI,OAAe,CAAC;IACpB,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC;SACvD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,GAAG,CAAC;;QAC3C,OAAO,GAAG,gBAAgB,CAAC;IAChC,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,iBAAiB;QAAE,OAAO,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,KAAK,CAAC;IAC9F,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,eAAe,GAAG,KAAK;IACxE,IAAI,qBAAqB,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACnD,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9C,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAClF,MAAM,MAAM,GAAmB,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,IAAI,eAAe,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;QAC5F,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,OAA0B;IACjF,OAAO,GAAG,UAAU,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,MAAiB,EAAE,GAA8B;IAC7E,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,QAA+C,CAAC;IAC5E,MAAM,YAAY,GAAG,QAAQ,EAAE,CAAC,4BAA4B,CAAmC,CAAC;IAChG,OAAO,YAAY,IAAI,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,UAAU,CACjB,MAAiB,EACjB,IAAY,EACZ,IAAa,EACb,GAA8B,EAC9B,WAA4B;IAE5B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACtH,MAAM,aAAa,GAAG,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC;IACvD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;IAClE,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO;QACL,YAAY,EAAE,GAAM,EAAE,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;YAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,oBAAoB,CAC5B,wHAAwH,CACzH,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YACxE,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAClD,OAAO,aAAa,CAAC,EAAE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI;QACJ,MAAM;QACN,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ;QAC7B,MAAM;QACN,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,EAAE,SAAS,EAAE;QACnB,WAAW;QACX,GAAG;QACH,GAAG,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,CAAC;QAC7C,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC3C,IAAI,CAAC,GAAG,IAAI,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO;YAClE,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;oBACtB,MAAM,EAAE,wBAAwB;oBAChC,MAAM,EAAE;wBACN,aAAa;wBACb,QAAQ;wBACR,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACzC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC9C;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,qDAAqD;YACvD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,SAAS,uBAAuB,CAAC,GAAY;IAC3C,OAAO,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,CAAC,sBAAsB,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAiB,EACjB,KAAmC,EACnC,OAA6B,EAAE;IAE/B,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAsB,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAEzE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACjD,MAAM,IAAI,GAAG,GAAG,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACrC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,0CAA0C,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,uBAAuB,IAAI,aAAa,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yCAAyC,CACvG,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,oDAAoD,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAC1B;YACE,GAAG,CAAC,YAAY,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,GAAG,CAAC,YAAY,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,EACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAC7C,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3G,MAAM,gBAAgB,GAAG,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI,CAAC,YAAY,CAAC;QAC1F,MAAM,OAAO,GAAG,KAAK,EACnB,IAAa,EACb,GAA8B,EAC9B,WAA4B,EACmB,EAAE;YACjD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxB,IAAI,MAA4C,CAAC;YACjD,IAAI,OAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChG,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;gBAClG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACvB,MAAM,GAAG,SAAS,CAAC,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;gBAChE,CAAC;qBAAM,CAAC;oBACN,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;oBACnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAiB,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;oBAC5G,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;oBACpE,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;wBAAE,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;oBACtC,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;oBAClC,aAAa,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;oBACzE,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,IAAI,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjC,aAAa,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;oBACzE,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBACjC,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;oBAC3C,MAAM,GAAG,SAAS,CAChB,GAAG,UAAU,iBAAiB,IAAI,KAAK,GAAG,CAAC,OAAO,uEAAuE,CAC1H,CAAC;gBACJ,CAAC;qBAAM,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;oBAClD,mGAAmG;oBACnG,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAClC,CAAC;qBAAM,IAAI,MAAM,EAAE,CAAC;oBAClB,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC3C,CAAC;qBAAM,CAAC;oBACN,IAAI,MAAuB,CAAC;oBAC5B,IAAI,CAAC;wBACH,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;oBACzB,CAAC;oBAAC,MAAM,CAAC;wBACP,MAAM,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;oBACzC,CAAC;oBACD,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACzF,CAAC;YACH,CAAC;YACD,yFAAyF;YACzF,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClC,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,MAAM,WAAW,GAAG,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;gBACpE,MAAM,GAAG,mBAAmB,CAC1B;oBACE,IAAI,EAAE,IAAI;oBACV,IAAI;oBACJ,OAAO;oBACP,QAAQ,EAAE,MAAM,CAAC,cAAc;oBAC/B,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,cAAc,GAAG,WAAW,CAAC;oBAC1D,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/D,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtD,EACD,MAAM,CACP,CAAC;gBACF,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1G,CAAC;YACD,aAAa,CAAC,IAAI,EAAE;gBAClB,OAAO,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;gBAClE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;aACjC,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QACF,qFAAqF;QACrF,MAAM,GAAG,GAAG,CAAC,IAAa,EAAE,GAAmB,EAAiD,EAAE;YAChG,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,GAAkD,EAAE,CAC/D,sBAAsB,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;YAC7E,OAAO,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG;YACb,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,IAAa,EAAE,GAAkB,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACxG,IAAI,IAAI,CAAC,OAAO;YAAE,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/transport.d.ts

@@ -1,102 +1,193 @@
 /**
- * @novorb/mcp-core — Transport
+ * @novorb/mcp-core - Transport
  *
- * Unified transport for MCP servers. Selects between stdio and native Streamable HTTP
- * based on the MCP_TRANSPORT environment variable.
+ * Unified transport for MCP servers on SDK v2. Selects between stdio and Streamable HTTP from the
+ * MCP_TRANSPORT environment variable; both legs take the SAME server factory.
  *
- * HTTP mode is stateless (sessionIdGenerator: undefined) — compatible with MCPize Cloud Run,
- * Apify Standby, and any other scale-to-zero host. One transport instance is created per
- * request; the server instance is resolved once and reconnected per request (SDK 1.29+).
+ * - stdio: `serveStdio(factory)` from `@modelcontextprotocol/server/stdio` (one instance per
+ *   connection; the client's opening message picks the protocol era).
+ * - http: `createMcpHandler(factory, { legacy: 'stateless' })` (the SDK default `responseMode: 'auto'`:
+ *   one JSON body unless the handler emits progress or log notifications first, then SSE) adapted with
+ *   `toNodeHandler` from `@modelcontextprotocol/node`, behind mcp-core's own `node:http` server that
+ *   adds `/health`, the fail-closed Bearer gate (the SDK's `verifyBearerToken` over the static key or a
+ *   pluggable verifier, `req.auth` set for the SDK), Host/Origin allow-lists and the 415/413 guards.
+ *   Stateless: a fresh instance per request, 2025-era clients served by the SDK's stateless fallback.
  *
  * Usage:
  *   import { startMcpServer } from '@novorb/mcp-core/transport';
+ *   await startMcpServer(() => buildServer());
  *
- *   // Factory (recommended for HTTP — ensures clean state per request):
- *   await startMcpServer(() => createServer(services));
- *
- *   // Server instance (fine for stdio; also works for HTTP in SDK 1.29+):
- *   await startMcpServer(server);
- *
- * Environment variables:
- *   MCP_TRANSPORT        — 'stdio' (default) | 'http'
- *   PORT                 — listen port for HTTP transport (default: 8080)
- *   MCP_HTTP_HOST        — bind address for HTTP (default: '0.0.0.0' for container hosts; set
- *                          '127.0.0.1' for local-only)
- *   MCP_API_KEY          — Bearer token for HTTP auth. REQUIRED in HTTP mode unless MCP_AUTH_DISABLED.
- *   MCP_AUTH_DISABLED    — set 'true' to run HTTP WITHOUT auth (only when a gateway/platform fronts it)
- *   MCP_MAX_BODY_BYTES   — max accepted POST body size (default: 4 MiB)
- *   MCP_ALLOWED_HOSTS    — comma-separated Host allowlist; setting it enables DNS-rebinding protection
- *   MCP_ALLOWED_ORIGINS  — comma-separated Origin allowlist (also enables DNS-rebinding protection)
+ * Environment variables (an explicit option wins):
+ *   MCP_TRANSPORT        - 'stdio' (default) | 'http'; any other value throws
+ *   PORT                 - listen port for HTTP transport (default: 8080)
+ *   MCP_HTTP_HOST        - bind address for HTTP (default: '0.0.0.0'; set '127.0.0.1' for local-only)
+ *   MCP_API_KEY          - Bearer token for HTTP auth. REQUIRED in HTTP mode unless MCP_AUTH_DISABLED or
+ *                          a `verifier` is passed.
+ *   MCP_AUTH_DISABLED    - set 'true' to run HTTP WITHOUT auth (only when a gateway/platform fronts it)
+ *   MCP_MAX_BODY_BYTES   - max accepted POST body size (default: 4 MiB)
+ *   MCP_ALLOWED_HOSTS    - comma-separated Host allowlist; setting it enables DNS-rebinding protection
+ *   MCP_ALLOWED_ORIGINS  - comma-separated Origin allowlist (also enables DNS-rebinding protection)
  */
-import { IncomingMessage, ServerResponse } from 'node:http';
-/** Accepts both the high-level McpServer and the low-level Server */
-type AnyMcpServer = {
-    connect(transport: unknown): Promise<void>;
-    close?(): Promise<void>;
-};
-/** A server instance or a factory that creates one per request */
-type ServerOrFactory = AnyMcpServer | (() => AnyMcpServer);
+import { type IncomingMessage, type ServerResponse } from 'node:http';
+import { type AuthInfo, type McpRequestContext, type McpServer, type Server, type ServerEventBus, type ServerNotifier, type VerifyBearerTokenOptions } from '@modelcontextprotocol/server';
+import { type HttpAuthOptions } from './auth.js';
+/**
+ * What the SDK hands a factory per serving unit: the protocol `era` ('modern' | 'legacy'), and on HTTP
+ * the verified `authInfo` (set by the Bearer gate) and the original `requestInfo`.
+ */
+export type RequestContext = McpRequestContext;
+/**
+ * Builds a fresh server instance: once per connection on stdio, once per request on HTTP. Receives the
+ * SDK's per-request context; zero-argument factories remain valid.
+ */
+export type ServerFactory = (ctx: RequestContext) => McpServer | Server;
+/** A started transport: resolved once stdio is serving or the HTTP listener is bound. */
+export interface TransportHandle {
+    mode: TransportMode;
+    /** http only: the bound host. */
+    host?: string;
+    /** http only: the bound port (the real one when 0 was requested). */
+    port?: number;
+    /** http only: the `/mcp` endpoint URL. */
+    url?: string;
+    /**
+     * Resolves once the transport has ended for any reason: `close()`, or (stdio) the client closing its
+     * end of the pipe (stdin end / close). `runMcpServer` uses it to dispose and exit on a stdio EOF.
+     */
+    closed: Promise<void>;
+    /** The change-event bus this transport delivers from (`TransportOptions.bus`, else the process bus). */
+    bus: ServerEventBus;
+    /** Publish list-changed / resource-updated events to every connection of this transport. */
+    notify: ServerNotifier;
+    /** Close the transport (SDK handler, then the listener / stdio connection). Idempotent. */
+    close(): Promise<void>;
+}
+/** A server instance (stdio only) or a factory (stdio and HTTP). */
+export type ServerOrFactory = McpServer | Server | ServerFactory;
 export type TransportMode = 'stdio' | 'http';
 export interface TransportOptions {
     /** Transport mode. Defaults to MCP_TRANSPORT env var, falling back to 'stdio'. */
     mode?: TransportMode;
     /** HTTP listen port. Defaults to PORT env var, falling back to 8080. */
     port?: number;
+    /** HTTP bind address. Defaults to MCP_HTTP_HOST, falling back to 0.0.0.0. */
+    host?: string;
     /**
      * Optional Bearer token for HTTP auth. When set, all /mcp requests must include
      * `Authorization: Bearer <apiKey>`. Defaults to MCP_API_KEY env var.
      * Set to null to EXPLICITLY disable auth (equivalent to MCP_AUTH_DISABLED=true).
      */
     apiKey?: string | null;
+    /**
+     * Bearer gate options: a pluggable `verifier` (replaces the static key, for example a JWT verifier),
+     * `requiredScopes`, `resourceMetadataUrl`, `expectedResource`, and the API key's `AuthInfo` fields.
+     */
+    auth?: HttpAuthOptions;
+    /** POST body cap in bytes. Defaults to MCP_MAX_BODY_BYTES, falling back to 4 MiB. */
+    maxBodyBytes?: number;
+    /** Host allow-list. Defaults to MCP_ALLOWED_HOSTS. */
+    allowedHosts?: string[];
+    /** Origin allow-list. Defaults to MCP_ALLOWED_ORIGINS. */
+    allowedOrigins?: string[];
+    /**
+     * Install SIGINT/SIGTERM handlers that close the transport (default true). `runMcpServer` passes
+     * false and owns the signals itself (close transport, dispose, exit).
+     */
+    handleSignals?: boolean;
+    /**
+     * The change-event bus (default: the process bus, `processBus()`). HTTP: the SDK serves
+     * `subscriptions/listen` streams from it; stdio: every connection's instance forwards its events.
+     */
+    bus?: ServerEventBus;
 }
+/** Default POST body cap (the SDK's own default too). */
+export declare const DEFAULT_MAX_BODY_BYTES: number;
 /**
  * Constant-time comparison of the Authorization header against `Bearer <apiKey>`.
  * Both sides are SHA-256-hashed first so `timingSafeEqual` never throws on a length mismatch and the
- * token length is not itself a timing oracle.
+ * token length is not itself a timing oracle. (The transport itself now verifies through the SDK's
+ * `verifyBearerToken` with `apiKeyVerifier`, which compares the same way.)
  */
 export declare function bearerMatches(authHeader: string, apiKey: string): boolean;
 export interface HttpAuthResolution {
     /** Whether the Bearer check is enforced on /mcp requests. */
     authEnabled: boolean;
-    /** The resolved key ('' when auth is explicitly disabled). */
+    /** The resolved key ('' when auth is explicitly disabled or a verifier replaces it). */
     apiKey: string;
 }
 /**
- * Resolve HTTP auth — FAIL CLOSED. `apiKey: null` (programmatic) or MCP_AUTH_DISABLED=true are the
+ * Resolve HTTP auth - FAIL CLOSED. `apiKey: null` (programmatic) or MCP_AUTH_DISABLED=true are the
  * only ways to run open; a missing/empty MCP_API_KEY is treated as "not configured" (not a valid
- * empty key) and THROWS, so a config typo can't silently downgrade the endpoint to no-auth.
+ * empty key) and THROWS, so a config typo can't silently downgrade the endpoint to no-auth. A passed
+ * `auth.verifier` always enforces auth (it wins over every "disabled" switch).
  */
-export declare function resolveHttpAuth(options: Pick<TransportOptions, 'apiKey'>, env?: NodeJS.ProcessEnv): HttpAuthResolution;
-/** Resolved configuration for the HTTP request handler — everything `startHttp` derives once at boot. */
+export declare function resolveHttpAuth(options: Pick<TransportOptions, 'apiKey' | 'auth'>, env?: NodeJS.ProcessEnv): HttpAuthResolution;
+/** Resolved configuration for the HTTP request handler: everything `startHttp` derives once at boot. */
 export interface RequestHandlerConfig {
-    /** Returns a server instance to connect for a request (fresh per request in the stateless model). */
-    getServer: () => AnyMcpServer;
-    /** Whether the Bearer check is enforced on /mcp requests. */
+    /** Builds a fresh server instance for each request (one instance serves one connection in SDK v2). */
+    getServer: ServerFactory;
+    /** Whether the Bearer check is enforced on /mcp requests (with the API key, or `auth.verifier`). */
     authEnabled: boolean;
-    /** The resolved Bearer key ('' when auth is disabled). */
+    /** The resolved Bearer key ('' when auth is disabled or a verifier replaces it). */
     apiKey: string;
-    /** Max accepted POST body size in bytes (→ 413 when exceeded). */
+    /** Bearer gate options (verifier, scopes, resource metadata, the API key's AuthInfo fields). */
+    auth?: HttpAuthOptions;
+    /** Max accepted POST body size in bytes (413 when exceeded). */
     maxBodyBytes: number;
-    /** Whether to enable the SDK's DNS-rebinding (Host/Origin) protection. */
+    /** Whether to enforce the Host/Origin allow-lists (DNS-rebinding protection). */
     enableDnsRebindingProtection: boolean;
-    /** Host allowlist (only consulted when DNS-rebinding protection is enabled). */
+    /** Host allowlist; `host` or `host:port` entries, matched port-agnostically by hostname. */
     allowedHosts: string[];
-    /** Origin allowlist (only consulted when DNS-rebinding protection is enabled). */
+    /** Origin allowlist; full origins or bare hostnames (matched by hostname), or `<scheme>://*`. */
     allowedOrigins: string[];
+    /** The change-event bus `subscriptions/listen` streams subscribe to (default the process bus). */
+    bus?: ServerEventBus;
 }
+/** The `(req, res)` listener for `node:http`, plus `close()` to tear down the SDK handler. */
+export type McpRequestHandler = ((req: IncomingMessage, res: ServerResponse) => Promise<void>) & {
+    close(): Promise<void>;
+};
+/** `host` or `host:port` -> the bare hostname the SDK's port-agnostic Host validation compares. */
+export declare function toHostname(entry: string): string;
+/**
+ * A full origin (`https://app.example.com:443`) -> its hostname; bare hostnames and `<scheme>://*`
+ * entries pass unchanged. The SDK honours a lowercase `<scheme>://*` entry (for example
+ * `chrome-extension://*`) as "every origin of that scheme", but never `http://*` or `https://*`.
+ */
+export declare function toOriginHostname(entry: string): string;
+/** Split a comma-separated allow-list env value. */
+export declare function parseList(value: string | undefined): string[];
+/** `IncomingMessage` with the `auth` the SDK node adapter forwards as `authInfo`. */
+export type AuthenticatedRequest = IncomingMessage & {
+    auth?: AuthInfo;
+};
+/**
+ * Run the Bearer gate: answers the SDK challenge (401/403 with `WWW-Authenticate`) and returns false,
+ * or sets `req.auth` and returns true. With no gate configured it lets the request through.
+ */
+export declare function runBearerGate(req: AuthenticatedRequest, res: ServerResponse, gate: VerifyBearerTokenOptions | undefined): Promise<boolean>;
+/** The content-type check: the SDK's media-type essence comparison (`application/json`, params allowed). */
+export declare function isJsonRequest(req: IncomingMessage): boolean;
 /**
  * Build the `(req, res)` handler for the HTTP transport. Extracted from `startHttp` so the routing,
- * auth, content-type/size guards, and error handling are unit-testable with mock req/res — no socket
- * binding required.
+ * auth, content-type/size guards, and error handling are unit-testable with mock req/res, no socket
+ * binding required. Order: `/health`, Bearer check, path check, Host/Origin allow-lists, 415, 413,
+ * then the SDK handler.
  */
-export declare function createRequestHandler(cfg: RequestHandlerConfig): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+export declare function createRequestHandler(cfg: RequestHandlerConfig): McpRequestHandler;
+/** The transport mode from the option, else MCP_TRANSPORT, else stdio; anything else throws. */
+export declare function resolveTransportMode(option: TransportMode | undefined, env?: NodeJS.ProcessEnv): "stdio" | "http";
 /**
- * Start an MCP server with the configured transport.
+ * Start an MCP server with the configured transport. Resolves with a `TransportHandle` once serving:
  *
- * For stdio: connects once and keeps the process alive.
- * For http: starts a stateless HTTP server. GET /health is always available.
- *           Pass a factory function to get a fresh server instance per request.
+ * For stdio: serves the process' stdin/stdout. An instance is accepted and wrapped as `() => instance`.
+ *            With `handleSignals` (default) SIGINT/SIGTERM close the connection and re-raise the signal
+ *            when no other listener remains. `closed` resolves when the client closes stdin.
+ * For http:  starts a stateless HTTP server and resolves once the listener is bound (the process stays
+ *            alive on the listener). With `handleSignals` (default) SIGINT/SIGTERM close it. Requires a
+ *            factory (a fresh instance per request).
  */
-export declare function startMcpServer(serverOrFactory: ServerOrFactory, options?: TransportOptions): Promise<void>;
-export {};
+export declare function startMcpServer(serverOrFactory: ServerOrFactory, options?: TransportOptions): Promise<TransportHandle>;
+/** A factory whose instances forward the bus's change events (a stdio connection is long-lived). */
+export declare function notifyingFactory(factory: ServerFactory, bus: ServerEventBus): ServerFactory;
 //# sourceMappingURL=transport.d.ts.map