@nyuchi/mzizi-mcp 0.13.0 → 0.15.0

package/README.md

@@ -12,7 +12,7 @@ Owned and operated by **Mzizi**.
 ---
 
 **Live at** `https://mcp.mzizi.dev/mcp` (Cloudflare Worker `mzizi-mcp`, version
-0.13.0 — `MZIZI_MCP_VERSION` in `src/server.ts` is what `serverInfo.version`
+0.15.0 — `MZIZI_MCP_VERSION` in `src/server.ts` is what `serverInfo.version`
 reports, and it moves in lockstep with `package.json` and `server.json`).
 
 ## Free, with no gate except Fundi
@@ -66,7 +66,102 @@ Point any MCP client at the live HTTP endpoint:
 
 No sign-in is needed. To use the Fundi tools, use
 `"url": "https://mcp.mzizi.dev/mcp/signin"` instead; the client runs the WorkOS
-Connect OAuth (PKCE) flow on first connect.
+Connect OAuth (PKCE) flow on first connect. `/mcp` never answers `401`, so a client
+never starts that flow there. The authorization server supports dynamic client
+registration and does not publish a client ID metadata document.
+
+### Per client
+
+Each client writes the entry above in its own format. The full guide, with the vendor page
+each line was read from, is
+[docs.mzizi.dev/toolchain/connect](https://docs.mzizi.dev/toolchain/connect); the table in this
+repository's [README](../README.md#connect-a-client) has the config path and key for Claude
+Code, Claude.ai and Desktop, Codex, Cursor, VS Code, Antigravity, Gemini CLI, Devin Desktop
+(formerly Windsurf), Zed, Cline, OpenCode, Kiro and JetBrains. All of it is documented by the
+vendors, read on 2026-11-03, and not run in the tools. The short version:
+
+```bash
+# Claude Code: the server alone (skills over MCP) ...
+claude mcp add --transport http mzizi https://mcp.mzizi.dev/mcp
+# ... or the public plugin, which also installs the skills
+/plugin marketplace add mzizi-dev/mzizi-registry
+/plugin install mzizi@mzizi
+
+# Codex: the server (there is no Codex plugin until mzizi-registry#520 merges)
+codex mcp add mzizi --url https://mcp.mzizi.dev/mcp
+
+# Gemini CLI (enterprise; free and Pro/Ultra users moved to Antigravity CLI on 2026-06-18)
+gemini mcp add --transport http mzizi https://mcp.mzizi.dev/mcp
+
+# VS Code
+code --add-mcp '{"name":"mzizi","type":"http","url":"https://mcp.mzizi.dev/mcp"}'
+```
+
+- **Claude.ai, Claude Desktop:** a custom connector at `https://mcp.mzizi.dev/mcp`, with no
+  sign-in. For the Fundi tools, a second one at `/mcp/signin` with **Register automatically**.
+- **ChatGPT:** Plugins, **+**, **Add custom MCP server**, then **Create as a plugin**.
+- **Claude API:** the MCP connector,
+  `"mcp_servers": [{"type": "url", "url": "https://mcp.mzizi.dev/mcp", "name": "mzizi"}]`, with
+  `{"type": "mcp_toolset", "mcp_server_name": "mzizi"}` in `tools` and the
+  `mcp-client-2025-11-20` beta header.
+- **OpenAI Responses API and Agents SDK:** a tool
+  `{"type": "mcp", "server_label": "mzizi", "server_url": "https://mcp.mzizi.dev/mcp"}`
+  (`HostedMCPTool(tool_config=...)` in the SDK).
+- **The URL key differs by client:** `url` (Cursor, Zed, Kiro, JetBrains, Devin Desktop,
+  Cline, OpenCode), `serverUrl` (Antigravity), `httpUrl` (Gemini CLI `settings.json`). Cline
+  needs `"type": "streamableHttp"` set explicitly (without it, it falls back to SSE), and
+  Devin Desktop names the transport `transport`, not `type`.
+- **Needs a bridge or stdio:** a client that only speaks stdio (older MCP clients, and Junie,
+  whose current help page does not confirm streamable HTTP) runs `npx -y @nyuchi/mzizi-mcp`
+  (stdio, below). `mcp-remote` is a third-party bridge this project has not tested.
+
+**Skills over MCP.** A client that cannot install the npm package (Claude.ai, ChatGPT, the
+APIs) gets the skills from `mzizi_get_skills`: no arguments lists them with their category,
+`name` returns one in full, and `category` (`dev`, `design`, `language` or `build`) returns
+every skill in it. A skill's answer lists the files it ships beside its SKILL.md
+(`hygiene.sh`, `progress.sh`, `mzizi-design`'s token stylesheets); `name` plus `file` returns
+one file's content. The same skills are also **MCP resources** (`mzizi://skills/<name>` for the
+SKILL.md body, `mzizi://skills/<name>/<path>` for each file, listed by `resources/list`) and
+**MCP prompts** (`skill-<name>`, whose message is the whole skill), so a client that reads
+resources or offers prompts gets them without calling a tool. `catalogue.json` and
+`mzizi_mcp_describe` list every skill with its category and files. All of it is read from the
+skill files bundled at build time, and `test/skills-surfaces.test.ts` fails if any surface
+drifts from `mzizi-skills/`. Codex, Cursor, VS Code, Gemini CLI, Antigravity, Zed, OpenCode and
+Devin Desktop also read `.agents/skills/`, where `npx skills experimental_sync` links the npm
+bundle. For instruction formats that cannot hold a skill (Cursor rules, Antigravity and Devin
+rules, `AGENTS.md`), see [`mzizi-skills/adapters/`](../mzizi-skills/adapters/README.md).
+
+How a skills change reaches this server: the skills are read from `../mzizi-skills/` in this
+repository at build time, not from npm and not from the registry pin. A change to a SKILL.md
+merged to `main` redeploys `mcp.mzizi.dev` (Workers Builds), and that deploy serves it. The npm
+publish of `@nyuchi/mzizi-skills` and the registry's dependency bump feed the plugin and
+`api.mzizi.dev/v1/skills`, not this server.
+
+### Compatibility with the MCP spec
+
+Probed from outside with `curl` on 2026-11-03, with no `Origin` header and again with a CLI
+user agent (`codex_cli_rs/0.1`), against the Streamable HTTP page of the 2026-07-28 revision
+(<https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http>):
+
+| Probe                                                           | Result                                                                                                                                                                                                                |
+| --------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `initialize` with `2025-06-18`, `2025-11-25`                    | `200`, `application/json`, same version echoed, tools, resources and prompts with `listChanged`; no `Mcp-Session-Id` (stateless)                                                                                      |
+| `initialize` with `2026-07-28`                                  | `200`, answers `2025-11-25` (the legacy handshake is the highest it negotiates)                                                                                                                                       |
+| `server/discover` and `tools/list` with `_meta` and the headers | `200`; `supportedVersions: ["2026-07-28"]`, 14 tools                                                                                                                                                                  |
+| `tools/call` without `Mcp-Name`                                 | `400`, JSON-RPC `-32020` `HeaderMismatch`, as the spec requires                                                                                                                                                       |
+| `tools/list` with no `initialize` and no version header         | `200` (treated as the earliest header-less version, which the spec allows)                                                                                                                                            |
+| notification POST (`notifications/initialized`)                 | `202`, no body                                                                                                                                                                                                        |
+| `GET` on the endpoint                                           | `405` with `Allow: POST, OPTIONS` (the spec's answer for a server with no GET stream)                                                                                                                                 |
+| `Accept: application/json` alone                                | `406`; the client must list both `application/json` and `text/event-stream`                                                                                                                                           |
+| `MCP-Protocol-Version: 1999-01-01`                              | `400`, lists the supported versions (`2025-11-25` back to `2024-10-07`)                                                                                                                                               |
+| `Origin: http://evil.example`, `Origin: null`                   | `403`                                                                                                                                                                                                                 |
+| `Origin: https://evil.example`                                  | `200` on the deployed 0.14.0: any `https` origin is accepted. The spec says an invalid Origin MUST get `403`. The explicit allowlist merged to `staging` in #319 refuses it, and is live only after the next release. |
+| `/mcp/signin` without a token                                   | `401` with `WWW-Authenticate: Bearer ... resource_metadata=...`, the OAuth flow clients start from                                                                                                                    |
+
+Deviations to know about: a JSON-RPC batch array (removed from the spec in 2025-06-18) answers
+a single object, not an array, and `server/discover` lists only the modern version while the
+legacy handshake still negotiates the older ones. No client was run; these are the server's
+answers to a plain HTTP client.
 
 ### stdio (local / offline)
 
@@ -163,22 +258,81 @@ call, passing the result through untouched:
 
 ## Tools
 
-| Tool                               | Returns                                                                        |
-| ---------------------------------- | ------------------------------------------------------------------------------ |
-| `mzizi_search`                     | Word search over components, conventions, AI instruction sets and releases     |
-| `mzizi_get_component`              | One component in full, **Rust first**; `include: ["docs", "versions"]`         |
-| `mzizi_list_components`            | The lean, paged index; filter by `node`, `owner`, `collection`, `type`, `rust` |
-| `mzizi_get_tokens`                 | Brand system; `family: "colors"` for all 21 colour families                    |
-| `mzizi_get_architecture`           | The DNA helix, or one node/rung with `node` (uncapped)                         |
-| `mzizi_get_doctrine`               | `ubuntu-pillars`, `ubuntu-principles`, `ai-instructions`, `conventions`        |
-| `mzizi_get_skills`                 | The agent skills: listed with their category, one by `name`, or a `category`   |
-| `mzizi_check_accessibility`        | Contrast ratio against the Mzizi AAA floor, computed locally                   |
-| `mzizi_report_issue`               | Your issue desk. **Sign-in**                                                   |
-| `mzizi_fundi`                      | Delegate to fundi (when the Worker can reach fundi). **Sign-in**               |
-| `mzizi_mcp_describe`               | This server's tools, their access, what each replaces, and data sources        |
-| `docs_search_mzizi`                | Search the documentation (forwarded)                                           |
-| `docs_query_docs_filesystem_mzizi` | Read-only `rg`/`cat`/`tree` over the doc pages (forwarded)                     |
-| `docs_submit_feedback`             | Report a documentation problem (forwarded)                                     |
+| Tool                               | Returns                                                                                                                  |
+| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
+| `mzizi_search`                     | Word search over components, conventions, AI instruction sets and releases                                               |
+| `mzizi_get_component`              | One component in full, **Rust first**; `include: ["docs", "versions"]`                                                   |
+| `mzizi_list_components`            | The lean, paged index; filter by `node`, `owner`, `collection`, `type`, `rust`                                           |
+| `mzizi_get_tokens`                 | Brand system; `family: "colors"` for all 21 colour families, `"floors"` for the Bundu floor                              |
+| `mzizi_get_architecture`           | The DNA helix, or one node/rung with `node` (uncapped)                                                                   |
+| `mzizi_get_doctrine`               | `ubuntu-pillars`, `ubuntu-principles`, `ai-instructions`, `conventions`, `bundu-floor`                                   |
+| `mzizi_get_skills`                 | The agent skills: listed, one by `name` (with `file`), or a `category`                                                   |
+| `mzizi_check_accessibility`        | WCAG 2 contrast ratio and the Mzizi 7:1 floor, and spacing values against the spacing floor, computed locally (not APCA) |
+| `mzizi_report_issue`               | Your issue desk. **Sign-in**                                                                                             |
+| `mzizi_fundi`                      | Delegate to fundi (when the Worker can reach fundi). **Sign-in**                                                         |
+| `mzizi_mcp_describe`               | This server's tools, their access, what each replaces, and data sources                                                  |
+| `docs_search_mzizi`                | Search the documentation (forwarded)                                                                                     |
+| `docs_query_docs_filesystem_mzizi` | Read-only `rg`/`cat`/`tree` over the doc pages (forwarded)                                                               |
+| `docs_submit_feedback`             | Report a documentation problem (forwarded)                                                                               |
+
+**How the tools behave (SDK v2, #295).**
+
+- Built on the official MCP TypeScript SDK v2 (`@modelcontextprotocol/server`). Over HTTP it
+  serves the **2026-07-28** revision (`server/discover`, per-request `_meta`, no sessions)
+  through the SDK's `createMcpHandler`, and 2025-era clients (`initialize`) through the SDK's
+  Streamable HTTP transport with JSON responses. Every request gets a fresh server; nothing is
+  shared between callers. `GET` and `DELETE` answer 405.
+- Every tool has a `title` and all four annotations (`readOnlyHint`, `destructiveHint`,
+  `idempotentHint`, `openWorldHint`). `mzizi_search`, `mzizi_list_components` and
+  `mzizi_check_accessibility` declare an `outputSchema` and return matching `structuredContent`.
+- **Size limit:** `mzizi_search` and `mzizi_list_components` stop a page at 25,000 characters
+  (`CHARACTER_LIMIT`, `src/limits.ts`) by returning fewer items. `has_more` and `next_offset`
+  (`meta.has_more` / `meta.next_offset` on search) say where the next page starts;
+  `mzizi_list_components` also keeps `hasMore` / `nextOffset` for older clients.
+- A domain failure (unknown component, bad colour, sign-in needed) is a tool result with
+  `isError: true` and text that says how to recover, never a protocol error.
+- **Browser origins (Streamable HTTP §Security):** a request with an `Origin` header whose host is
+  not on the list is refused with 403 before any server is built, on `/mcp`, `/mcp/signin` and
+  every other path starting with `/mcp`, with or without a token, and before the anonymous rate
+  limit is charged. The code refuses a present but empty `Origin` (only a missing header counts as
+  no `Origin`), though workerd appears to deliver an empty header as absent. The list is `mzizi.dev`, `www.mzizi.dev`, `docs.mzizi.dev`, `app.mzizi.dev` and
+  `mcp.mzizi.dev`, each over `https` on the default port only (no `http`, no `:8443`, no other
+  subdomain), plus localhost on any port. Add more with the `MZIZI_ALLOWED_ORIGINS` variable,
+  comma-separated `https://host` origins (case and a trailing slash are tolerated; anything else
+  that is not a plain `https` origin is dropped with a logged warning). Clients that send no
+  `Origin` (every non-browser client) are not affected. On `/mcp`, CORS echoes an allowed `Origin`
+  with `Vary: Origin` and never answers `Access-Control-Allow-Origin: *`. The OAuth provider's own
+  endpoints (`/token`, `/register`, `/.well-known/*`) keep the provider's CORS behaviour, which
+  echoes the caller's `Origin`, and `/catalogue.json` is `*` on purpose. Browser clients hosted on
+  other sites cannot call `/mcp` (`src/origin.ts` is the one list).
+- **PKCE and token audience:** the authorization-server metadata advertises `S256` only. Audience
+  binding applies only to clients that send a `resource` indicator (RFC 8707): such a token is
+  refused on a different server or path, but a token for `/mcp` is also accepted on
+  `/mcp/signin` (path-prefix matching, the same server). A token minted with no `resource` has no
+  audience and is served on `/mcp` and `/mcp/signin` (see the CHANGELOG, #295).
+- Calls to fundi and to the identity provider time out after 15 s.
+- `evals.xml` holds ten read-only questions with answers checked against production.
+
+**The Bundu floor, and the spacing floor in it.** The registry's minimums nothing can go under are
+served three ways, all read from the bundled registry's `/v1/brand` `accessibility` block at the
+pinned commit (`minTouchTarget`, `minInset`, `minControlGap`, `minLabelGap`, `minItemGap`,
+`minBodyLeading`), never typed in this repo (`src/floors.ts`): `mzizi_get_tokens family=floors` (also
+`family=accessibility`, and `family=spacing`, which returns `spacingFloor` beside the scale),
+`mzizi_get_doctrine topic=bundu-floor`, and the `floors` block of `mzizi_mcp_describe`, the
+`mzizi://tools` resource and `GET /catalogue.json`. The spacing floor (owner, 2026-11-04,
+mzizi-registry#617) is a 14px inset between text and its container edge (`--inset-floor`), 7px gaps between
+adjacent controls, between a label and its field and between sibling items (`--gap-floor`), and 1.5
+body leading (`--leading-floor`). `mzizi_check_accessibility` takes `insetPx`, `controlGapPx`,
+`labelGapPx`, `itemGapPx` and `leading` beside (or instead of) the two colours, compares each with that
+floor and returns `spacing: { floor, checks, meetsFloor }`. If the pinned registry commit predates the
+floor, `floors.spacing` is `null`, the tool descriptions name no number, and a spacing check is a tool
+error saying so (or, beside colours, a `spacingUnavailable` note); the tools never answer from a copy. To check a project's source rather than values, run `mzizi check` (`@nyuchi/mzizi-cli`).
+
+**Text colours from `mzizi_get_tokens`.** Every colour family carries `textLight` /
+`textDark`: use them for text in that colour on the base surface (they are
+`--color-<name>-text`). On a family's container, use `onContainerLight` /
+`onContainerDark`. Never use `hex`, `lightHex` or `darkHex` as a text colour: they
+are accents and fills.
 
 **The tool list is whatever `tools/list` returns.** The `docs_*` names mirror
 whatever docs.mzizi.dev lists; the three above are what it lists today (checked
@@ -212,8 +366,24 @@ tools present the Rust implementation first wherever one exists:
     `GET /v1/ui/{name}` body unchanged (shadcn-shaped, `files[]` inline). If the registry
     refuses the React build but Rust exists, `react` is `{build, error}` and the Rust
     still leads.
+  - `react.vendor` is what you need to vendor the React build without calling the API:
+    - `registry`: `{repository, ref}`, the registry commit this server's data comes from.
+    - `files[]`: `{path, target, url, sha256}`. `url` is
+      `https://raw.githubusercontent.com/mzizi-dev/mzizi-registry/<ref>/<path>`, pinned to
+      the same `ref` the `sha256` is taken at.
+    - `imports[]`: every `@/` specifier the files import, re-export or load with a dynamic
+      `import()` (comments are ignored), with `providedBy`, the declared registry
+      dependency that installs it, or `null`. `@/lib/utils` is provided by the registry's
+      `utils` item, or by shadcn init in a project that ran it.
+    - `live.url`: `https://api.mzizi.dev/v1/ui/<name>`, labelled live. It serves the
+      commit the API is deployed at, which can differ from `registry.ref`.
+    - **What `sha256` covers:** the registry source at `path`@`ref`, which is what
+      `files[].url` serves. A file written by `shadcn add` can differ: shadcn strips
+      `"use client"` when the project sets `rsc: false`, and rewrites `@/` aliases to the
+      project's own. Hash the registry source, not the installed file.
   - **Breaking for readers of 0.10.x:** the React body moved from `component` to
     `react`, and `renamedFrom` moved to the top level.
+
 - `mzizi_list_components` rows carry `rustCrate` when the component has Rust (absent
   otherwise), the response carries `withRust` (how many of `total` have Rust), and
   `rust: true` / `rust: false` filters on it.
@@ -228,8 +398,8 @@ tools present the Rust implementation first wherever one exists:
 **Shape notes (changed when the registry moved into the build).**
 
 - `mzizi_get_component` with `include: ["versions"]` is derived from the committed
-  changelog and rename map: rows are `{version, title, change, breaking,
-released_at}` with `meta.previousNames`. The database view it used to read is gone
+  changelog and rename map: rows are
+  `{version, title, change, breaking, released_at}` with `meta.previousNames`. The database view it used to read is gone
   from this path.
 - `mzizi_search` returns `{data: [{kind, name, title?, description?}], meta}`, with
   `kind` one of `component | convention | ai-instruction | release`. Documentation
@@ -265,11 +435,12 @@ at. See `AUTH.md`.
 
 Plain vars (`[vars]` in `wrangler.toml`, not secrets):
 
-| Var                    | Notes                                                         |
-| ---------------------- | ------------------------------------------------------------- |
-| `WORKOS_CLIENT_ID`     | Connect OAuth app client id (public client; PKCE)             |
-| `WORKOS_M2M_CLIENT_ID` | Fundi M2M app client id; used only on the HTTP + M2M fallback |
-| `FUNDI_URL`            | Base URL of the fundi worker, for the HTTP + M2M fallback     |
+| Var                     | Notes                                                                                                                                                                                          |
+| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `WORKOS_CLIENT_ID`      | Connect OAuth app client id (public client; PKCE)                                                                                                                                              |
+| `WORKOS_M2M_CLIENT_ID`  | Fundi M2M app client id; used only on the HTTP + M2M fallback                                                                                                                                  |
+| `FUNDI_URL`             | Base URL of the fundi worker, for the HTTP + M2M fallback                                                                                                                                      |
+| `MZIZI_ALLOWED_ORIGINS` | Optional, unset by default. Extra browser origins for `/mcp`, comma-separated `https://host` (e.g. `https://partner.example`); a public setting, so a var, not a secret. See "Browser origins" |
 
 Bindings (`wrangler.toml`): `FUNDI_SERVICE` (Service Binding to `mzizi-fundi`'s
 `FundiInternal` entrypoint; what makes fundi reachable in production),
@@ -346,7 +517,7 @@ fails the build, and a failed build deploys nothing — the running version stay
 
 **Rollback:** Cloudflare dashboard → Workers & Pages → `mzizi-mcp` → Deployments → pick
 the previous version → _Rollback_, or `wrangler rollback` from `mzizi-mcp/`. Reverting
-the commit on `main` (merges are rebase-only) redeploys the previous source through Workers
+the squash commit on `main` (merges are squash, through the merge queue) redeploys the previous source through Workers
 Builds.
 
 ---

package/dist/auth/front.d.ts

@@ -4,6 +4,14 @@
  * Its own module, not `worker.ts`: the Worker's entry module may export only
  * handlers and Durable Object classes, and this is tested directly.
  */
+/**
+ * True for the provider's API route as the PROVIDER matches it: any path that
+ * starts with `/mcp` (`/mcp`, `/mcp/signin`, `/mcpx`, `/mcp%2Fsignin`: the
+ * provider's `matchApiRoute` is a bare `startsWith`). The Origin gate in
+ * `worker.ts` uses this, so no path the provider treats as the API route
+ * escapes the gate.
+ */
+export declare function isProviderApiPath(pathname: string): boolean;
 /**
  * True for a request the free tier serves: the MCP path, no credential at all.
  *

package/dist/auth/front.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"front.d.ts","sourceRoot":"","sources":["../../src/auth/front.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAI/D"}
+{"version":3,"file":"front.d.ts","sourceRoot":"","sources":["../../src/auth/front.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAI/D"}

package/dist/auth/front.js

@@ -6,6 +6,16 @@
  */
 /** The paths served to a caller with no token. `/mcp/signin` is deliberately not one. */
 const ANONYMOUS_PATHS = new Set(["/mcp", "/mcp/"]);
+/**
+ * True for the provider's API route as the PROVIDER matches it: any path that
+ * starts with `/mcp` (`/mcp`, `/mcp/signin`, `/mcpx`, `/mcp%2Fsignin`: the
+ * provider's `matchApiRoute` is a bare `startsWith`). The Origin gate in
+ * `worker.ts` uses this, so no path the provider treats as the API route
+ * escapes the gate.
+ */
+export function isProviderApiPath(pathname) {
+    return pathname.startsWith("/mcp");
+}
 /**
  * True for a request the free tier serves: the MCP path, no credential at all.
  *

package/dist/auth/front.js.map

@@ -1 +1 @@
-{"version":3,"file":"front.js","sourceRoot":"","sources":["../../src/auth/front.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,yFAAyF;AACzF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnD;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"front.js","sourceRoot":"","sources":["../../src/auth/front.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,yFAAyF;AACzF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC5D,CAAC"}

package/dist/auth/mcp-api-handler.d.ts

@@ -24,7 +24,7 @@ type AuthedContext = ExecutionContext & {
  * Takes no `ctx` on purpose, so the anonymous front in `worker.ts` cannot pick
  * up a `ctx.props` the provider did not set.
  */
-export declare function serveAnonymous(request: Request, env: Env): Promise<Response>;
+export declare function serveAnonymous(request: Request, env: Env, hosts?: readonly string[]): Promise<Response>;
 export declare const mcpApiHandler: {
     fetch(request: Request, env: Env, ctx: AuthedContext): Promise<Response>;
 };

package/dist/auth/mcp-api-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-api-handler.d.ts","sourceRoot":"","sources":["../../src/auth/mcp-api-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAGvC,KAAK,aAAa,GAAG,gBAAgB,GAAG;IAAE,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,CAAA;AAEzD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAE5E;AAED,eAAO,MAAM,aAAa;mBACH,OAAO,OAAO,GAAG,OAAO,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;CA4B/E,CAAA"}
+{"version":3,"file":"mcp-api-handler.d.ts","sourceRoot":"","sources":["../../src/auth/mcp-api-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAIvC,KAAK,aAAa,GAAG,gBAAgB,GAAG;IAAE,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,CAAA;AAEzD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,GAAE,SAAS,MAAM,EAA6B,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEjI;AAED,eAAO,MAAM,aAAa;mBACH,OAAO,OAAO,GAAG,OAAO,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;CA4B/E,CAAA"}

package/dist/auth/mcp-api-handler.js

@@ -15,6 +15,7 @@
 import { createMziziHttpHandler } from "../http.js";
 import { createFundiCaller, createUserTokenResolver, fundiConfigured } from "../fundi-client.js";
 import { deskFor } from "../desk-context.js";
+import { allowedHostsFromEnv } from "../origin.js";
 /**
  * The free tier: no user. `fundi` says whether to LIST mzizi_fundi (so its
  * refusal can say how to sign in); it wires no caller and no desk.
@@ -22,8 +23,8 @@ import { deskFor } from "../desk-context.js";
  * Takes no `ctx` on purpose, so the anonymous front in `worker.ts` cannot pick
  * up a `ctx.props` the provider did not set.
  */
-export function serveAnonymous(request, env) {
-    return createMziziHttpHandler({ anonymous: { fundi: fundiConfigured(env) } })(request);
+export function serveAnonymous(request, env, hosts = allowedHostsFromEnv(env)) {
+    return createMziziHttpHandler({ anonymous: { fundi: fundiConfigured(env) }, allowedOrigins: hosts })(request);
 }
 export const mcpApiHandler = {
     async fetch(request, env, ctx) {
@@ -47,7 +48,7 @@ export const mcpApiHandler = {
         // `idFromName` is deterministic, so the same person reaches the same object
         // across sessions, devices and years; that is what makes the history real.
         const desk = deskFor(env.ISSUE_DESK.get(env.ISSUE_DESK.idFromName(props.userId)), props, fundi?.resolveUserToken);
-        return createMziziHttpHandler({ fundi, desk })(request);
+        return createMziziHttpHandler({ fundi, desk, allowedOrigins: allowedHostsFromEnv(env) })(request);
     },
 };
 //# sourceMappingURL=mcp-api-handler.js.map

package/dist/auth/mcp-api-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-api-handler.js","sourceRoot":"","sources":["../../src/auth/mcp-api-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAGhG,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAI5C;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB,EAAE,GAAQ;IACvD,OAAO,sBAAsB,CAAC,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;AACxF,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAQ,EAAE,GAAkB;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAA;QACvB,kEAAkE;QAClE,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,OAAO,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAEvD,yEAAyE;QACzE,4EAA4E;QAC5E,sCAAsC;QACtC,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,gCAAgC;QAChC,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC;YAChC,CAAC,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE;YAC3F,CAAC,CAAC,SAAS,CAAA;QACb,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,MAAM,IAAI,GAAG,OAAO,CAClB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAC3D,KAAK,EACL,KAAK,EAAE,gBAAgB,CACxB,CAAA;QAED,OAAO,sBAAsB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;IACzD,CAAC;CACF,CAAA"}
+{"version":3,"file":"mcp-api-handler.js","sourceRoot":"","sources":["../../src/auth/mcp-api-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAGhG,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAIlD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB,EAAE,GAAQ,EAAE,QAA2B,mBAAmB,CAAC,GAAG,CAAC;IAC5G,OAAO,sBAAsB,CAAC,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;AAC/G,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAQ,EAAE,GAAkB;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAA;QACvB,kEAAkE;QAClE,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,OAAO,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAEvD,yEAAyE;QACzE,4EAA4E;QAC5E,sCAAsC;QACtC,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,gCAAgC;QAChC,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC;YAChC,CAAC,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE;YAC3F,CAAC,CAAC,SAAS,CAAA;QACb,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,MAAM,IAAI,GAAG,OAAO,CAClB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAC3D,KAAK,EACL,KAAK,EAAE,gBAAgB,CACxB,CAAA;QAED,OAAO,sBAAsB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;IACnG,CAAC;CACF,CAAA"}

package/dist/auth/provider-options.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The OAuth provider's static options, shared by `worker.ts` and the tests that
+ * drive the real provider (`test/oauth-provider.test.ts`), so a test cannot
+ * pass against a configuration the Worker does not run.
+ *
+ * Its own module, not `worker.ts`: the Worker's entry module may export only
+ * handlers and Durable Object classes.
+ */
+export declare const PROVIDER_OPTIONS: {
+    readonly apiRoute: "/mcp";
+    readonly authorizeEndpoint: "/authorize";
+    readonly tokenEndpoint: "/token";
+    readonly clientRegistrationEndpoint: "/register";
+    readonly allowPlainPKCE: false;
+};
+//# sourceMappingURL=provider-options.d.ts.map

package/dist/auth/provider-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-options.d.ts","sourceRoot":"","sources":["../../src/auth/provider-options.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,gBAAgB;;;;;;CAWnB,CAAA"}

package/dist/auth/provider-options.js

@@ -0,0 +1,21 @@
+/**
+ * The OAuth provider's static options, shared by `worker.ts` and the tests that
+ * drive the real provider (`test/oauth-provider.test.ts`), so a test cannot
+ * pass against a configuration the Worker does not run.
+ *
+ * Its own module, not `worker.ts`: the Worker's entry module may export only
+ * handlers and Durable Object classes.
+ */
+export const PROVIDER_OPTIONS = {
+    // A prefix: it covers `/mcp` and `/mcp/signin`.
+    apiRoute: "/mcp",
+    authorizeEndpoint: "/authorize",
+    tokenEndpoint: "/token",
+    clientRegistrationEndpoint: "/register",
+    // OAuth 2.1 and the MCP authorization spec require S256; `plain` offers no
+    // protection against an intercepted code (#295). With this `false` the
+    // authorization-server metadata advertises `["S256"]` and the token endpoint
+    // refuses a `plain` challenge.
+    allowPlainPKCE: false,
+};
+//# sourceMappingURL=provider-options.js.map

package/dist/auth/provider-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-options.js","sourceRoot":"","sources":["../../src/auth/provider-options.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,gDAAgD;IAChD,QAAQ,EAAE,MAAM;IAChB,iBAAiB,EAAE,YAAY;IAC/B,aAAa,EAAE,QAAQ;IACvB,0BAA0B,EAAE,WAAW;IACvC,2EAA2E;IAC3E,uEAAuE;IACvE,6EAA6E;IAC7E,+BAA+B;IAC/B,cAAc,EAAE,KAAK;CACb,CAAA"}

package/dist/docs-federation.d.ts

@@ -19,7 +19,7 @@
  *     so the tool surface does not change shape while docs are down. Calls then
  *     fail with the clear error above until the upstream is back.
  */
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { McpServer } from "@modelcontextprotocol/server";
 export declare const DOCS_MCP_URL = "https://docs.mzizi.dev/mcp";
 export declare const DOCS_TOOL_PREFIX = "docs_";
 /** How long a fetched tool list is reused before asking upstream again. */

package/dist/docs-federation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs-federation.d.ts","sourceRoot":"","sources":["../src/docs-federation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,eAAO,MAAM,YAAY,+BAA+B,CAAC;AACzD,eAAO,MAAM,gBAAgB,UAAU,CAAC;AACxC,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB,QAAa,CAAC;AAC5C;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAI9C,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAwEjD,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AA+EF,4DAA4D;AAC5D,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC;AAsBD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC;IACzE,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,aAAa,GAAG,UAAU,CAAC;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAkCD;AAcD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,MAAM,EAAE,CAAC,CA6CnB"}
+{"version":3,"file":"docs-federation.d.ts","sourceRoot":"","sources":["../src/docs-federation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAG9D,eAAO,MAAM,YAAY,+BAA+B,CAAC;AACzD,eAAO,MAAM,gBAAgB,UAAU,CAAC;AACxC,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB,QAAa,CAAC;AAC5C;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAI9C,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAwEjD,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AA+EF,4DAA4D;AAC5D,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC;AAsBD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC;IACzE,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,aAAa,GAAG,UAAU,CAAC;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAkCD;AAcD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,MAAM,EAAE,CAAC,CA8CnB"}

package/dist/docs-federation.js

@@ -255,6 +255,7 @@ export async function registerDocsTools(server, opts = {}) {
         // One malformed upstream definition must not take down the whole server:
         // skip it and keep the rest (and every mzizi_* tool).
         try {
+            // `inputShapeFor` always returns a Zod object schema (never a raw shape).
             server.registerTool(name, {
                 title: tool.title ? `Docs: ${tool.title}` : undefined,
                 description: `[docs.mzizi.dev] ${tool.description ?? ""}`.trim(),

package/dist/docs-federation.js.map

@@ -1 +1 @@
-{"version":3,"file":"docs-federation.js","sourceRoot":"","sources":["../src/docs-federation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,CAAC,MAAM,YAAY,GAAG,4BAA4B,CAAC;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACxC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,MAAM,CAAC;AAC5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAC9C,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,eAAe,GAAG,MAAM,CAAC;AAU/B;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAA4B;IACrD;QACE,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,uTAAuT;QACzT,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE;YACtE,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,oBAAoB,EAAE,KAAK;SAC5B;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,uPAAuP;QACzP,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,+FAA+F;iBAClG;aACF;YACD,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,oBAAoB,EAAE,KAAK;SAC5B;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,+BAA+B;QACtC,WAAW,EACT,2IAA2I;QAC7I,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,CAAC;oBACZ,WAAW,EACT,yDAAyD;iBAC5D;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,CAAC;oBACZ,WAAW,EAAE,qDAAqD;iBACnE;aACF;YACD,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;YAC9B,oBAAoB,EAAE,KAAK;SAC5B;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;KACF;CACF,CAAC;AAcF,MAAM,aAAc,SAAQ,KAAK;CAAG;AAEpC,+EAA+E;AAC/E,KAAK,UAAU,GAAG,CAChB,GAAW,EACX,SAAuB,EACvB,MAAc,EACd,MAA+B,EAC/B,SAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACzB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;aAC9C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,IAAI,aAAa,CACpB,GAAa,EAAE,IAAI,KAAK,YAAY;YACnC,CAAC,CAAC,0BAA0B,SAAS,IAAI;YACzC,CAAC,CAAC,yBAA0B,GAAa,EAAE,OAAO,IAAI,eAAe,GAAG,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,OAAoC,CAAC;QACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACvC,oEAAoE;YACpE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;oBAAE,SAAS;gBACxC,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAoB,CAAC;oBAC9D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC;wBAAE,OAAO,GAAG,CAAC,CAAC;gBAC9C,CAAC;gBAAC,MAAM,CAAC;oBACP,wDAAwD;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,aAAa,CAAC,6CAA6C,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,aAAa,CACrB,sBAAsB,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,iBAAiB,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAGD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;AAChD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAyC,CAAC;AAErE,4DAA4D;AAC5D,MAAM,UAAU,kBAAkB;IAChC,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,gEAAgE;AAChE,MAAM,SAAS,GAAG,yBAAyB,CAAC;AAC5C,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,GAAqB,EAAE,CAAC;QACtC,IACE,CAAC,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAC1B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAEhB,SAAS;QACX,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA8B,EAAE;IAK9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,iBAAiB;QACxD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAElD,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,EAAE,CACjC,MAAM;QACJ,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,aAAsB,EAAE,KAAK,EAAE;QAChE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,UAAmB,EAAE,KAAK,EAAE,CAAC;IAEzE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,GAAG,uBAAuB;QACzD,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAEjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,GAAG,EACH,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EACxC,YAAY,EACZ,EAAE,EACF,eAAe,CAChB,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,wBAAwB,CAAC,CAAC;QAC1E,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAChD,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAI,GAAa,CAAC,OAAO,CAAC;QACrC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,aAAa,CAAC,MAA2C;IAChE,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,cAAc,CAAC,MAAgD,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,8EAA8E;QAChF,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAiB,EACjB,OAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,GAAG,gBAAgB,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QACjE,yEAAyE;QACzE,sDAAsD;QACtD,IAAI,CAAC;YACH,MAAM,CAAC,YAAY,CACjB,IAAI,EACJ;gBACE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;gBACrD,WAAW,EAAE,oBAAoB,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;gBAChE,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC,WAAW,CAAU;gBACrD,WAAW;aACZ,EACD,CAAC,KAAK,EAAE,IAA6B,EAAE,EAAE;gBACvC,IAAI,CAAC;oBACH,uEAAuE;oBACvE,0CAA0C;oBAC1C,OAAO,CAAC,MAAM,GAAG,CACf,GAAG,EACH,SAAS,EACT,YAAY,EACZ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAC1C,eAAe,CAChB,CAAU,CAAC;gBACd,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,SAAS,CACd,GAAG,IAAI,mCAAmC,GAAG,KAAM,GAAa,CAAC,OAAO,IAAI;wBAC1E,uIAAuI,CAC1I,CAAC;gBACJ,CAAC;YACH,CAAC,CAAU,CACZ,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"docs-federation.js","sourceRoot":"","sources":["../src/docs-federation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,CAAC,MAAM,YAAY,GAAG,4BAA4B,CAAC;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACxC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,MAAM,CAAC;AAC5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAC9C,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,eAAe,GAAG,MAAM,CAAC;AAU/B;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAA4B;IACrD;QACE,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,uTAAuT;QACzT,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE;YACtE,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,oBAAoB,EAAE,KAAK;SAC5B;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,uPAAuP;QACzP,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,+FAA+F;iBAClG;aACF;YACD,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,oBAAoB,EAAE,KAAK;SAC5B;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,+BAA+B;QACtC,WAAW,EACT,2IAA2I;QAC7I,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,CAAC;oBACZ,WAAW,EACT,yDAAyD;iBAC5D;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,CAAC;oBACZ,WAAW,EAAE,qDAAqD;iBACnE;aACF;YACD,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;YAC9B,oBAAoB,EAAE,KAAK;SAC5B;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;KACF;CACF,CAAC;AAcF,MAAM,aAAc,SAAQ,KAAK;CAAG;AAEpC,+EAA+E;AAC/E,KAAK,UAAU,GAAG,CAChB,GAAW,EACX,SAAuB,EACvB,MAAc,EACd,MAA+B,EAC/B,SAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACzB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;aAC9C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,IAAI,aAAa,CACpB,GAAa,EAAE,IAAI,KAAK,YAAY;YACnC,CAAC,CAAC,0BAA0B,SAAS,IAAI;YACzC,CAAC,CAAC,yBAA0B,GAAa,EAAE,OAAO,IAAI,eAAe,GAAG,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,OAAoC,CAAC;QACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACvC,oEAAoE;YACpE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;oBAAE,SAAS;gBACxC,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAoB,CAAC;oBAC9D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC;wBAAE,OAAO,GAAG,CAAC,CAAC;gBAC9C,CAAC;gBAAC,MAAM,CAAC;oBACP,wDAAwD;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,aAAa,CAAC,6CAA6C,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,aAAa,CACrB,sBAAsB,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,iBAAiB,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAGD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;AAChD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAyC,CAAC;AAErE,4DAA4D;AAC5D,MAAM,UAAU,kBAAkB;IAChC,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,gEAAgE;AAChE,MAAM,SAAS,GAAG,yBAAyB,CAAC;AAC5C,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,GAAqB,EAAE,CAAC;QACtC,IACE,CAAC,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAC1B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAEhB,SAAS;QACX,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA8B,EAAE;IAK9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,iBAAiB;QACxD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAElD,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,EAAE,CACjC,MAAM;QACJ,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,aAAsB,EAAE,KAAK,EAAE;QAChE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,UAAmB,EAAE,KAAK,EAAE,CAAC;IAEzE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,GAAG,uBAAuB;QACzD,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAEjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,GAAG,EACH,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EACxC,YAAY,EACZ,EAAE,EACF,eAAe,CAChB,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,wBAAwB,CAAC,CAAC;QAC1E,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAChD,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAI,GAAa,CAAC,OAAO,CAAC;QACrC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,aAAa,CAAC,MAA2C;IAChE,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,cAAc,CAAC,MAAgD,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,8EAA8E;QAChF,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAiB,EACjB,OAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,GAAG,gBAAgB,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QACjE,yEAAyE;QACzE,sDAAsD;QACtD,IAAI,CAAC;YACH,0EAA0E;YAC1E,MAAM,CAAC,YAAY,CACjB,IAAI,EACJ;gBACE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;gBACrD,WAAW,EAAE,oBAAoB,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;gBAChE,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC,WAAW,CAAU;gBACrD,WAAW;aACZ,EACD,CAAC,KAAK,EAAE,IAA6B,EAAE,EAAE;gBACvC,IAAI,CAAC;oBACH,uEAAuE;oBACvE,0CAA0C;oBAC1C,OAAO,CAAC,MAAM,GAAG,CACf,GAAG,EACH,SAAS,EACT,YAAY,EACZ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAC1C,eAAe,CAChB,CAAU,CAAC;gBACd,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,SAAS,CACd,GAAG,IAAI,mCAAmC,GAAG,KAAM,GAAa,CAAC,OAAO,IAAI;wBAC1E,uIAAuI,CAC1I,CAAC;gBACJ,CAAC;YACH,CAAC,CAAU,CACZ,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/env.d.ts

@@ -19,6 +19,7 @@ export interface Env {
     FUNDI_SERVICE?: Fetcher;
     COOKIE_ENCRYPTION_KEY: string;
     ISSUE_DESK: DurableObjectNamespace<import("./issue-desk.js").IssueDesk>;
+    MZIZI_ALLOWED_ORIGINS?: string;
     ANON_RATE_LIMIT?: import("./rate-limit.js").RateLimiter;
     OAUTH_KV: KVNamespace;
     OAUTH_PROVIDER: OAuthHelpers;

package/dist/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAEtE,MAAM,WAAW,GAAG;IAiBlB,gBAAgB,EAAE,MAAM,CAAA;IAYxB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAO9B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAUlB,aAAa,CAAC,EAAE,OAAO,CAAA;IAGvB,qBAAqB,EAAE,MAAM,CAAA;IAM7B,UAAU,EAAE,sBAAsB,CAAC,OAAO,iBAAiB,EAAE,SAAS,CAAC,CAAA;IAMvE,eAAe,CAAC,EAAE,OAAO,iBAAiB,EAAE,WAAW,CAAA;IAGvD,QAAQ,EAAE,WAAW,CAAA;IACrB,cAAc,EAAE,YAAY,CAAA;CAC7B"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAEtE,MAAM,WAAW,GAAG;IAiBlB,gBAAgB,EAAE,MAAM,CAAA;IAYxB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAO9B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAUlB,aAAa,CAAC,EAAE,OAAO,CAAA;IAGvB,qBAAqB,EAAE,MAAM,CAAA;IAM7B,UAAU,EAAE,sBAAsB,CAAC,OAAO,iBAAiB,EAAE,SAAS,CAAC,CAAA;IAMvE,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAM9B,eAAe,CAAC,EAAE,OAAO,iBAAiB,EAAE,WAAW,CAAA;IAGvD,QAAQ,EAAE,WAAW,CAAA;IACrB,cAAc,EAAE,YAAY,CAAA;CAC7B"}