@opencx/mcp 1.11.88 → 1.12.1

package/dist/api-client.d.ts

@@ -19,7 +19,9 @@ export type OpenCXClient = Client<paths> & {
     readonly coworkerSessionId: string | undefined;
     postMultipart(path: string, formData: FormData): Promise<JsonValue>;
 };
-export declare function createOpenCXClient(apiKey: string, baseUrl: string): OpenCXClient;
+export declare function createOpenCXClient(apiKey: string, baseUrl: string, options?: {
+    coworkerSessionId?: string;
+}): OpenCXClient;
 /**
  * Wraps a value as an MCP text-content result. Handles `undefined` from 204
  * responses by falling back to `{}` so `JSON.stringify` always produces a string.

package/dist/api-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAqB,EAAE,KAAK,MAAM,EAAmB,MAAM,eAAe,CAAC;AAC3E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAElE,qBAAa,QAAS,SAAQ,KAAK;aAEf,MAAM,EAAE,MAAM;aACd,UAAU,EAAE,MAAM;aAClB,IAAI,EAAE,MAAM;gBAFZ,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM;CAK/B;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAchD;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG;IACzC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACrE,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CA4ChF;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,SAAS,GAAG;IAAE,OAAO,EAAE,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAEjG"}
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAqB,EAAE,KAAK,MAAM,EAAmB,MAAM,eAAe,CAAC;AAC3E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAElE,qBAAa,QAAS,SAAQ,KAAK;aAEf,MAAM,EAAE,MAAM;aACd,UAAU,EAAE,MAAM;aAClB,IAAI,EAAE,MAAM;gBAFZ,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM;CAK/B;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAchD;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG;IACzC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACrE,CAAC;AAEF,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3C,YAAY,CA4Cd;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,SAAS,GAAG;IAAE,OAAO,EAAE,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAEjG"}

package/dist/api-client.js

@@ -35,12 +35,12 @@ export function safePath(segment) {
     }
     return encodeURIComponent(decoded);
 }
-export function createOpenCXClient(apiKey, baseUrl) {
+export function createOpenCXClient(apiKey, baseUrl, options = {}) {
     const normalizedBase = baseUrl.replace(/\/$/, '');
     const headers = {
         Authorization: `Bearer ${apiKey}`,
     };
-    const coworkerSessionId = process.env.OPENCX_COWORKER_SESSION_ID;
+    const { coworkerSessionId } = options;
     if (coworkerSessionId) {
         headers['x-opencx-coworker-session-id'] = coworkerSessionId;
     }

package/dist/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,YAA8C,MAAM,eAAe,CAAC;AAE3E,OAAO,EAAE,eAAe,EAAkB,MAAM,iBAAiB,CAAC;AAElE,MAAM,OAAO,QAAS,SAAQ,KAAK;IAEf;IACA;IACA;IAHlB,YACkB,MAAc,EACd,UAAkB,EAClB,IAAY;QAE5B,KAAK,CAAC,oBAAoB,MAAM,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC,CAAC;QAJ3C,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAQ;QAClB,SAAI,GAAJ,IAAI,CAAQ;QAG5B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAOD,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,OAAe;IAChE,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,MAAM,EAAE;KAClC,CAAC;IAEF,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACjE,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,CAAC,8BAA8B,CAAC,GAAG,iBAAiB,CAAC;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAQ;QACjC,OAAO,EAAE,cAAc;QACvB,OAAO;KACR,CAAC,CAAC;IAEH,MAAM,eAAe,GAAe;QAClC,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE;YAC3B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnD,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAE5B,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,QAAkB;QAC3D,MAAM,GAAG,GAAG,GAAG,cAAc,GAAG,IAAI,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAI,IAAmB;IAChD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AACjD,CAAC"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,YAA8C,MAAM,eAAe,CAAC;AAE3E,OAAO,EAAE,eAAe,EAAkB,MAAM,iBAAiB,CAAC;AAElE,MAAM,OAAO,QAAS,SAAQ,KAAK;IAEf;IACA;IACA;IAHlB,YACkB,MAAc,EACd,UAAkB,EAClB,IAAY;QAE5B,KAAK,CAAC,oBAAoB,MAAM,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC,CAAC;QAJ3C,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAQ;QAClB,SAAI,GAAJ,IAAI,CAAQ;QAG5B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAOD,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,OAAe,EACf,UAA0C,EAAE;IAE5C,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,MAAM,EAAE;KAClC,CAAC;IAEF,MAAM,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC;IACtC,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,CAAC,8BAA8B,CAAC,GAAG,iBAAiB,CAAC;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAQ;QACjC,OAAO,EAAE,cAAc;QACvB,OAAO;KACR,CAAC,CAAC;IAEH,MAAM,eAAe,GAAe;QAClC,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE;YAC3B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnD,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAE5B,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,QAAkB;QAC3D,MAAM,GAAG,GAAG,GAAG,cAAc,GAAG,IAAI,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAI,IAAmB;IAChD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AACjD,CAAC"}

package/dist/create-server-options.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=create-server-options.spec.d.ts.map

package/dist/create-server-options.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-server-options.spec.d.ts","sourceRoot":"","sources":["../src/create-server-options.spec.ts"],"names":[],"mappings":""}

package/dist/create-server-options.spec.js

@@ -0,0 +1,67 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { connectInMemory, fetchCallHeaders, fetchCallUrl, toolTextResultSchema, } from './spec-helpers.js';
+function jsonResponse(body) {
+    return new Response(body, { status: 200, headers: { 'Content-Type': 'application/json' } });
+}
+function stubFetch(body = '{}') {
+    const fetchSpy = vi.fn().mockResolvedValue(jsonResponse(body));
+    vi.stubGlobal('fetch', fetchSpy);
+    return fetchSpy;
+}
+describe('createServer options', () => {
+    afterEach(() => {
+        vi.unstubAllEnvs();
+        vi.restoreAllMocks();
+    });
+    it('never reads FIRECRAWL_API_KEY from ambient process env (multi-tenant leak guard)', async () => {
+        vi.stubEnv('FIRECRAWL_API_KEY', 'ambient-env-key-must-not-leak');
+        const fetchSpy = stubFetch();
+        const { client, cleanup } = await connectInMemory();
+        const result = toolTextResultSchema.parse(await client.callTool({ name: 'web_search', arguments: { query: 'anything' } }));
+        expect(result.isError).toBe(true);
+        expect(result.content[0].text).toBe('FIRECRAWL_API_KEY not configured');
+        expect(fetchSpy).not.toHaveBeenCalled();
+        await cleanup();
+    });
+    it('uses an explicitly granted Firecrawl key', async () => {
+        const fetchSpy = stubFetch(JSON.stringify({ success: true, data: [] }));
+        const { client, cleanup } = await connectInMemory({ firecrawlApiKey: 'granted-key' });
+        const result = toolTextResultSchema.parse(await client.callTool({ name: 'web_search', arguments: { query: 'opencx' } }));
+        expect(result.isError).toBeFalsy();
+        expect(fetchSpy).toHaveBeenCalledTimes(1);
+        const call = fetchSpy.mock.calls[0];
+        expect(fetchCallUrl(call)).toContain('api.firecrawl.dev');
+        expect(fetchCallHeaders(call).get('authorization')).toBe('Bearer granted-key');
+        await cleanup();
+    });
+    it('returns an empty-result string when Firecrawl succeeds without a data field', async () => {
+        stubFetch(JSON.stringify({ success: true }));
+        const { client, cleanup } = await connectInMemory({ firecrawlApiKey: 'granted-key' });
+        const result = toolTextResultSchema.parse(await client.callTool({ name: 'web_search', arguments: { query: 'nothing' } }));
+        // `text` must stay a string — JSON.stringify(undefined) would produce a
+        // non-string value and fail MCP output validation at the protocol layer.
+        expect(result.isError).toBeFalsy();
+        expect(result.content[0].text).toBe('[]');
+        await cleanup();
+    });
+    it('sends the coworker session id header when explicitly provided', async () => {
+        const fetchSpy = stubFetch(JSON.stringify({ name: 'org', created_at: null, updated_at: null }));
+        const { client, cleanup } = await connectInMemory({ coworkerSessionId: 'session-42' });
+        await client.callTool({ name: 'get_organization', arguments: {} });
+        expect(fetchSpy).toHaveBeenCalledTimes(1);
+        const headers = fetchCallHeaders(fetchSpy.mock.calls[0]);
+        expect(headers.get('x-opencx-coworker-session-id')).toBe('session-42');
+        await cleanup();
+    });
+    it('never reads OPENCX_COWORKER_SESSION_ID from ambient process env', async () => {
+        vi.stubEnv('OPENCX_COWORKER_SESSION_ID', 'ambient-session-must-not-leak');
+        const fetchSpy = stubFetch(JSON.stringify({ name: 'org', created_at: null, updated_at: null }));
+        const { client, cleanup } = await connectInMemory();
+        await client.callTool({ name: 'get_organization', arguments: {} });
+        expect(fetchSpy).toHaveBeenCalledTimes(1);
+        const headers = fetchCallHeaders(fetchSpy.mock.calls[0]);
+        expect(headers.get('x-opencx-coworker-session-id')).toBeNull();
+        await cleanup();
+    });
+});
+//# sourceMappingURL=create-server-options.spec.js.map

package/dist/create-server-options.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-server-options.spec.js","sourceRoot":"","sources":["../src/create-server-options.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAE3B,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,SAAS,CAAC,IAAI,GAAG,IAAI;IAC5B,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAgB,CAAC,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,+BAA+B,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;QAE7B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CACvC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAChF,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACxE,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAExC,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAExE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CACvC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAC9E,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC1D,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAE/E,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAE7C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CACvC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAC/E,CAAC;QAEF,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1C,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEhG,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC,CAAC;QACvF,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAEnE,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAEvE,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,EAAE,CAAC,OAAO,CAAC,4BAA4B,EAAE,+BAA+B,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEhG,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QACpD,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAEnE,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAE/D,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/http.d.ts

@@ -0,0 +1,40 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { JsonValue } from './utils/json.js';
+export declare const COWORKER_SESSION_HEADER = "x-opencx-coworker-session-id";
+/** Extract the token from an `Authorization: Bearer <token>` header value. */
+export declare function extractBearer(header: string | string[] | undefined): string | undefined;
+/**
+ * Handle a single stateless Streamable HTTP MCP request.
+ *
+ * Creates a fresh server + transport per request (no session state), so it can
+ * be mounted behind any Node HTTP server. Both the standalone CLI (`--http`)
+ * and the hosted backend endpoint (`api.open.cx/mcp`) route through here.
+ *
+ * The caller is responsible for authentication — extract and validate the
+ * bearer token before calling this, then pass it as `apiKey` so tools call the
+ * public API on the caller's behalf. Everything else that is per-request
+ * (coworker attribution header, error envelope, teardown) is owned here so
+ * hosts cannot drift.
+ */
+export declare function handleStreamableHttp(options: {
+    apiKey: string;
+    baseUrl: string;
+    req: IncomingMessage;
+    res: ServerResponse;
+    /**
+     * Body already parsed by the host framework (e.g. Fastify). Omit when the
+     * body is still unread on the request stream.
+     */
+    parsedBody?: JsonValue;
+    /**
+     * Fallback companion attribution when the request carries no
+     * `x-opencx-coworker-session-id` header. The header always wins.
+     */
+    coworkerSessionId?: string;
+    /**
+     * Enables the Firecrawl tools for this request. The host decides per caller
+     * — never resolved from ambient process env (multi-tenant leak).
+     */
+    firecrawlApiKey?: string;
+}): Promise<void>;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AAEtE,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIvF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,eAAe,CAAC;IACrB,GAAG,EAAE,cAAc,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDhB"}

package/dist/http.js

@@ -0,0 +1,70 @@
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { createServer } from './server.js';
+export const COWORKER_SESSION_HEADER = 'x-opencx-coworker-session-id';
+/** Extract the token from an `Authorization: Bearer <token>` header value. */
+export function extractBearer(header) {
+    if (typeof header !== 'string')
+        return undefined;
+    const match = header.match(/^Bearer\s+(.+)$/i);
+    return match?.[1];
+}
+/**
+ * Handle a single stateless Streamable HTTP MCP request.
+ *
+ * Creates a fresh server + transport per request (no session state), so it can
+ * be mounted behind any Node HTTP server. Both the standalone CLI (`--http`)
+ * and the hosted backend endpoint (`api.open.cx/mcp`) route through here.
+ *
+ * The caller is responsible for authentication — extract and validate the
+ * bearer token before calling this, then pass it as `apiKey` so tools call the
+ * public API on the caller's behalf. Everything else that is per-request
+ * (coworker attribution header, error envelope, teardown) is owned here so
+ * hosts cannot drift.
+ */
+export async function handleStreamableHttp(options) {
+    const { apiKey, baseUrl, req, res, parsedBody, firecrawlApiKey } = options;
+    // Stateless mode has no session to push server-initiated messages from, yet
+    // the SDK would answer GET with a 200 SSE stream that idles forever — each
+    // connected client would pin a full per-request server in memory. 405 is the
+    // spec-sanctioned "no SSE stream here"; SDK clients fall back to POST-only.
+    if (req.method === 'GET') {
+        res.writeHead(405, { Allow: 'POST, DELETE' });
+        res.end();
+        return;
+    }
+    const coworkerHeader = req.headers[COWORKER_SESSION_HEADER];
+    const coworkerSessionId = typeof coworkerHeader === 'string' && coworkerHeader !== ''
+        ? coworkerHeader
+        : options.coworkerSessionId;
+    try {
+        const server = createServer(apiKey, baseUrl, { coworkerSessionId, firecrawlApiKey });
+        const transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: undefined,
+        });
+        res.on('close', () => {
+            transport.close().catch((_e) => {
+                console.error('Failed to close MCP HTTP transport', { _e });
+            });
+            server.close().catch((_e) => {
+                console.error('Failed to close MCP server', { _e });
+            });
+        });
+        await server.connect(transport);
+        await transport.handleRequest(req, res, parsedBody);
+    }
+    catch (_e) {
+        console.error('MCP HTTP request failed', { _e });
+        if (!res.headersSent && !res.destroyed) {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                jsonrpc: '2.0',
+                error: { code: -32603, message: 'Internal server error' },
+                id: null,
+            }));
+        }
+        else if (!res.writableEnded) {
+            res.end();
+        }
+    }
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAEtE,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,MAAqC;IACjE,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC/C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAoB1C;IACC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IAE3E,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9C,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GACrB,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,EAAE;QACzD,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAEhC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;SAC9B,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAW,EAAE,EAAE;gBACtC,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAW,EAAE,EAAE;gBACnC,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,EAAW,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACvC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE;gBACzD,EAAE,EAAE,IAAI;aACT,CAAC,CACH,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/http.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=http.spec.d.ts.map

package/dist/http.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.spec.d.ts","sourceRoot":"","sources":["../src/http.spec.ts"],"names":[],"mappings":""}

package/dist/http.spec.js

@@ -0,0 +1,178 @@
+import { createServer as createHttpServer } from 'node:http';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { z } from 'zod';
+import { extractBearer, handleStreamableHttp } from './http.js';
+import { toolTextResultSchema } from './spec-helpers.js';
+import { jsonValueSchema } from './utils/json.js';
+const addressSchema = z.object({ port: z.number() });
+const ORG_BODY = { name: 'http-test-org', created_at: null, updated_at: null };
+function listenPort(server) {
+    return addressSchema.parse(server.address()).port;
+}
+async function connectClient(url, bearer, extraHeaders = {}) {
+    const client = new Client({ name: 'http-spec-client', version: '0.0.0' });
+    const transport = new StreamableHTTPClientTransport(new URL(url), {
+        requestInit: { headers: { Authorization: `Bearer ${bearer}`, ...extraHeaders } },
+    });
+    await client.connect(transport);
+    return client;
+}
+describe('handleStreamableHttp', () => {
+    /** Stub OpenCX public API — records auth + coworker headers of every call. */
+    let apiStub;
+    let apiBaseUrl;
+    const seenApiCalls = [];
+    const hosts = [];
+    /**
+     * Host wiring mirrors index.ts's `--http` mode. The one axis under test per
+     * host: whether the body is pre-parsed by the framework (Fastify path) or
+     * left on the stream (raw CLI path), plus an optional coworker fallback.
+     */
+    async function startHost(options) {
+        const host = createHttpServer(async (req, res) => {
+            const bearer = extractBearer(req.headers.authorization);
+            if (!bearer) {
+                res.writeHead(401);
+                res.end();
+                return;
+            }
+            let parsedBody;
+            if (options.parseBody) {
+                const chunks = [];
+                for await (const chunk of req) {
+                    chunks.push(Buffer.from(chunk));
+                }
+                const raw = Buffer.concat(chunks).toString('utf8');
+                parsedBody = raw ? jsonValueSchema.parse(JSON.parse(raw)) : undefined;
+            }
+            await handleStreamableHttp({
+                apiKey: bearer,
+                baseUrl: apiBaseUrl,
+                req,
+                res,
+                parsedBody,
+                coworkerSessionId: options.coworkerSessionId,
+            });
+        });
+        await new Promise((resolve) => host.listen(0, '127.0.0.1', resolve));
+        hosts.push(host);
+        return `http://127.0.0.1:${listenPort(host)}/`;
+    }
+    /** Raw request stream host (CLI `--http` path). */
+    let streamedUrl;
+    /** Framework-parsed body host (backend/Fastify path). */
+    let parsedUrl;
+    beforeAll(async () => {
+        apiStub = createHttpServer((req, res) => {
+            const coworkerHeader = req.headers['x-opencx-coworker-session-id'];
+            seenApiCalls.push({
+                auth: typeof req.headers.authorization === 'string' ? req.headers.authorization : undefined,
+                coworkerSessionId: typeof coworkerHeader === 'string' ? coworkerHeader : undefined,
+            });
+            if (req.method === 'GET' && req.url === '/org') {
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify(ORG_BODY));
+                return;
+            }
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'not found' }));
+        });
+        await new Promise((resolve) => apiStub.listen(0, '127.0.0.1', resolve));
+        apiBaseUrl = `http://127.0.0.1:${listenPort(apiStub)}`;
+        streamedUrl = await startHost({});
+        parsedUrl = await startHost({ parseBody: true });
+    });
+    afterAll(async () => {
+        for (const server of [...hosts, apiStub]) {
+            await new Promise((resolve, reject) => server.close((err) => (err ? reject(err) : resolve())));
+        }
+    });
+    function apiCallsFor(bearer) {
+        return seenApiCalls.filter((c) => c.auth === `Bearer ${bearer}`);
+    }
+    it('serves initialize + tools/list over a raw request stream', async () => {
+        const client = await connectClient(streamedUrl, 'stream-key');
+        const { tools } = await client.listTools();
+        expect(tools.length).toBeGreaterThan(100);
+        expect(tools.map((t) => t.name)).toContain('get_organization');
+        await client.close();
+    });
+    it('serves tool calls and forwards the caller bearer to the API', async () => {
+        const client = await connectClient(streamedUrl, 'stream-key');
+        const result = toolTextResultSchema.parse(await client.callTool({ name: 'get_organization', arguments: {} }));
+        expect(JSON.parse(result.content[0].text)).toEqual(ORG_BODY);
+        expect(apiCallsFor('stream-key').length).toBeGreaterThan(0);
+        await client.close();
+    });
+    it('serves the same protocol when the host framework pre-parses the body', async () => {
+        const client = await connectClient(parsedUrl, 'parsed-key');
+        const { tools } = await client.listTools();
+        expect(tools.length).toBeGreaterThan(100);
+        const result = toolTextResultSchema.parse(await client.callTool({ name: 'get_organization', arguments: {} }));
+        expect(JSON.parse(result.content[0].text)).toEqual(ORG_BODY);
+        expect(apiCallsFor('parsed-key').length).toBeGreaterThan(0);
+        await client.close();
+    });
+    it('isolates concurrent callers — each request uses its own bearer', async () => {
+        const [clientA, clientB] = await Promise.all([
+            connectClient(streamedUrl, 'key-a'),
+            connectClient(streamedUrl, 'key-b'),
+        ]);
+        const before = seenApiCalls.length;
+        await Promise.all([
+            clientA.callTool({ name: 'get_organization', arguments: {} }),
+            clientB.callTool({ name: 'get_organization', arguments: {} }),
+        ]);
+        const newAuths = seenApiCalls.slice(before).map((c) => c.auth);
+        expect(newAuths).toHaveLength(2);
+        expect(new Set(newAuths)).toEqual(new Set(['Bearer key-a', 'Bearer key-b']));
+        await Promise.all([clientA.close(), clientB.close()]);
+    });
+    it('forwards the coworker session id header to API calls', async () => {
+        const client = await connectClient(streamedUrl, 'coworker-key', {
+            'x-opencx-coworker-session-id': 'coworker-session-42',
+        });
+        await client.callTool({ name: 'get_organization', arguments: {} });
+        expect(apiCallsFor('coworker-key')[0]?.coworkerSessionId).toBe('coworker-session-42');
+        await client.close();
+    });
+    it('sends no coworker header when neither caller nor host provides one', async () => {
+        const client = await connectClient(streamedUrl, 'no-coworker-key');
+        await client.callTool({ name: 'get_organization', arguments: {} });
+        const calls = apiCallsFor('no-coworker-key');
+        expect(calls.length).toBeGreaterThan(0);
+        expect(calls[0]?.coworkerSessionId).toBeUndefined();
+        await client.close();
+    });
+    it('falls back to the host-provided coworker session id when the caller sends no header', async () => {
+        const fallbackUrl = await startHost({ coworkerSessionId: 'host-env-session' });
+        const client = await connectClient(fallbackUrl, 'fallback-key');
+        await client.callTool({ name: 'get_organization', arguments: {} });
+        expect(apiCallsFor('fallback-key')[0]?.coworkerSessionId).toBe('host-env-session');
+        await client.close();
+    });
+    it('lets a per-request coworker header win over the host fallback', async () => {
+        const fallbackUrl = await startHost({ coworkerSessionId: 'host-env-session' });
+        const client = await connectClient(fallbackUrl, 'override-key', {
+            'x-opencx-coworker-session-id': 'per-request-session',
+        });
+        await client.callTool({ name: 'get_organization', arguments: {} });
+        expect(apiCallsFor('override-key')[0]?.coworkerSessionId).toBe('per-request-session');
+        await client.close();
+    });
+    it('rejects GET with 405 — stateless mode offers no SSE stream to pin', async () => {
+        const response = await fetch(streamedUrl, {
+            method: 'GET',
+            headers: {
+                Authorization: 'Bearer stream-key',
+                Accept: 'text/event-stream',
+            },
+        });
+        expect(response.status).toBe(405);
+        expect(response.headers.get('allow')).toBe('POST, DELETE');
+        await response.body?.cancel();
+    });
+});
+//# sourceMappingURL=http.spec.js.map

package/dist/http.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.spec.js","sourceRoot":"","sources":["../src/http.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAe,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAErD,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAO/E,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,MAAc,EACd,eAAuC,EAAE;IAEzC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;QAChE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,GAAG,YAAY,EAAE,EAAE;KACjF,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,8EAA8E;IAC9E,IAAI,OAAe,CAAC;IACpB,IAAI,UAAkB,CAAC;IACvB,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B;;;;OAIG;IACH,KAAK,UAAU,SAAS,CAAC,OAGxB;QACC,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACxD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,IAAI,UAAU,CAAC;YACf,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;oBAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnD,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,CAAC;YACD,MAAM,oBAAoB,CAAC;gBACzB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,UAAU;gBACnB,GAAG;gBACH,GAAG;gBACH,UAAU;gBACV,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;aAC7C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3E,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,oBAAoB,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;IACjD,CAAC;IAED,mDAAmD;IACnD,IAAI,WAAmB,CAAC;IACxB,yDAAyD;IACzD,IAAI,SAAiB,CAAC;IAEtB,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,OAAO,GAAG,gBAAgB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACtC,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;YACnE,YAAY,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;gBAC3F,iBAAiB,EAAE,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;aACnF,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC/C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9E,UAAU,GAAG,oBAAoB,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAEvD,WAAW,GAAG,MAAM,SAAS,CAAC,EAAE,CAAC,CAAC;QAClC,SAAS,GAAG,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CACvD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,SAAS,WAAW,CAAC,MAAc;QACjC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC9D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC/D,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CACvC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CACnE,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC5D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CACvC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CACnE,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC3C,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC;YACnC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC;SACpC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;QACnC,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;YAC7D,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;SAC9D,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAE7E,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,cAAc,EAAE;YAC9D,8BAA8B,EAAE,qBAAqB;SACtD,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACtF,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACnE,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAChE,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnF,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,cAAc,EAAE;YAC9D,8BAA8B,EAAE,qBAAqB;SACtD,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACtF,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;YACxC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,mBAAmB;gBAClC,MAAM,EAAE,mBAAmB;aAC5B;SACF,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3D,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.js

@@ -1,19 +1,12 @@
 #!/usr/bin/env node
 import { createServer as createHttpServer } from 'node:http';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { extractBearer, handleStreamableHttp } from './http.js';
 import { createServer } from './server.js';
 const DEFAULT_BASE_URL = 'https://api.open.cx';
 function isHttpMode() {
     return process.argv.includes('--http') || process.env.MCP_TRANSPORT === 'http';
 }
-function extractBearer(req) {
-    const auth = req.headers['authorization'];
-    if (typeof auth !== 'string')
-        return undefined;
-    const match = auth.match(/^Bearer\s+(.+)$/i);
-    return match?.[1];
-}
 function startHttpMode() {
     const baseUrl = resolveBaseUrl();
     const port = Number(process.env.MCP_HTTP_PORT) || 3100;
@@ -30,18 +23,25 @@ function startHttpMode() {
             res.end('Not found');
             return;
         }
-        const bearer = extractBearer(req);
+        const bearer = extractBearer(req.headers.authorization);
         if (!bearer) {
             res.writeHead(401, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Missing Authorization: Bearer <token>' }));
             return;
         }
-        const mcpServer = createServer(bearer, baseUrl);
-        const transport = new StreamableHTTPServerTransport({
-            sessionIdGenerator: undefined,
+        // Standalone server = single-tenant: the operator's own env applies to
+        // every caller. Do NOT expose this server to untrusted bearer tokens with
+        // FIRECRAWL_API_KEY set — all callers would share (and bill) that key.
+        // The env coworker session id is a fallback; a per-request
+        // x-opencx-coworker-session-id header always wins (handled in http.ts).
+        await handleStreamableHttp({
+            apiKey: bearer,
+            baseUrl,
+            req,
+            res,
+            coworkerSessionId: process.env.OPENCX_COWORKER_SESSION_ID,
+            firecrawlApiKey: process.env.FIRECRAWL_API_KEY,
         });
-        await mcpServer.connect(transport);
-        await transport.handleRequest(req, res);
     });
     httpServer.listen(port, '0.0.0.0', () => {
         console.log(`OpenCX MCP HTTP server listening on http://0.0.0.0:${port}/mcp`);
@@ -66,7 +66,10 @@ function startStdioMode() {
         process.exit(1);
     }
     const baseUrl = resolveBaseUrl();
-    const server = createServer(apiKey, baseUrl);
+    const server = createServer(apiKey, baseUrl, {
+        coworkerSessionId: process.env.OPENCX_COWORKER_SESSION_ID,
+        firecrawlApiKey: process.env.FIRECRAWL_API_KEY,
+    });
     const transport = new StdioServerTransport();
     server.connect(transport).catch((err) => {
         console.error('Failed to start OpenCX MCP server:', err);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAE/C,SAAS,UAAU;IACjB,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,CAAC;AACjF,CAAC;AAED,SAAS,aAAa,CAAC,GAEtB;IACC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC7C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;IAEvD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrD,eAAe;QACf,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,mBAAmB;QACnB,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;YACvB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;SAC9B,CAAC,CAAC;QAEH,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;QACtC,OAAO,CAAC,GAAG,CAAC,sDAAsD,IAAI,MAAM,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CACX,6DAA6D;YAC3D,+CAA+C;YAC/C,4CAA4C;YAC5C,iDAAiD;YACjD,OAAO;YACP,uBAAuB;YACvB,qBAAqB;YACrB,6BAA6B;YAC7B,0CAA0C;YAC1C,wDAAwD;YACxD,WAAW;YACX,SAAS;YACT,KAAK,CACR,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC/C,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,gBAAgB,CAAC;IAEhE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;QACtF,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YAChD,OAAO,CAAC,KAAK,CACX,qFAAqF,CACtF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,+CAA+C,OAAO,GAAG,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,IAAI,UAAU,EAAE,EAAE,CAAC;IACjB,aAAa,EAAE,CAAC;AAClB,CAAC;KAAM,CAAC;IACN,cAAc,EAAE,CAAC;AACnB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAE/C,SAAS,UAAU;IACjB,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,CAAC;AACjF,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;IAEvD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrD,eAAe;QACf,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,mBAAmB;QACnB,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;YACvB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,uEAAuE;QACvE,0EAA0E;QAC1E,uEAAuE;QACvE,2DAA2D;QAC3D,wEAAwE;QACxE,MAAM,oBAAoB,CAAC;YACzB,MAAM,EAAE,MAAM;YACd,OAAO;YACP,GAAG;YACH,GAAG;YACH,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;YACzD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;SAC/C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;QACtC,OAAO,CAAC,GAAG,CAAC,sDAAsD,IAAI,MAAM,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CACX,6DAA6D;YAC3D,+CAA+C;YAC/C,4CAA4C;YAC5C,iDAAiD;YACjD,OAAO;YACP,uBAAuB;YACvB,qBAAqB;YACrB,6BAA6B;YAC7B,0CAA0C;YAC1C,wDAAwD;YACxD,WAAW;YACX,SAAS;YACT,KAAK,CACR,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE;QAC3C,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;QACzD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;KAC/C,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC/C,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,gBAAgB,CAAC;IAEhE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;QACtF,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YAChD,OAAO,CAAC,KAAK,CACX,qFAAqF,CACtF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,+CAA+C,OAAO,GAAG,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,IAAI,UAAU,EAAE,EAAE,CAAC;IACjB,aAAa,EAAE,CAAC;AAClB,CAAC;KAAM,CAAC;IACN,cAAc,EAAE,CAAC;AACnB,CAAC"}

package/dist/restrictions.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"restrictions.spec.js","sourceRoot":"","sources":["../src/restrictions.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,UAAU,GAAG,IAAI;IAClE,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACtE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CAAC,IAAe;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,GAAG,YAAY,OAAO;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAe;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,GAAG,YAAY,OAAO;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAgB,CAAC;IACpC,OAAO,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAe;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,GAAG,YAAY,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAgB,CAAC;IACpC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,IAAI,MAAc,CAAC;IACnB,IAAI,OAA4B,CAAC;IACjC,IAAI,QAAkC,CAAC;IAEvC,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACnB,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEjC,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;QACpE,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QAChF,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACtC,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEtC,OAAO,GAAG,KAAK,IAAI,EAAE;YACnB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,OAAO,EAAE,CAAC;QAChB,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,QAAQ,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAE9F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACnC,IAAI,EAAE,mBAAmB;YACzB,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;SACpE,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAc,CAAC;QACjD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACpE,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,sBAAsB,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACzF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACnC,IAAI,EAAE,mBAAmB;YACzB,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,eAAe,CAAC,EAAE;SACrE,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,QAAQ,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAE5E,MAAM,MAAM,CAAC,QAAQ,CAAC;YACpB,IAAI,EAAE,0BAA0B;YAChC,SAAS,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE;SACtE,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAc,CAAC;QACjD,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;QAClE,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,QAAQ,CAAC,qBAAqB,CAC5B,YAAY,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAChE,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACnC,IAAI,EAAE,2BAA2B;YACjC,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,OAAO,CAAC,EAAE;SAC7D,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAc,CAAC;QACjD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAClF,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,sBAAsB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,QAAQ,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAE7D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACnC,IAAI,EAAE,2BAA2B;YACjC,SAAS,EAAE;gBACT,EAAE,EAAE,MAAM;gBACV,sBAAsB,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;gBAC3C,UAAU,EAAE,0BAA0B;gBACtC,QAAQ,EAAE,IAAI;aACf;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAc,CAAC;QACjD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAClF,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YACzC,sBAAsB,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;YAC3C,UAAU,EAAE,0BAA0B;YACtC,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACnC,IAAI,EAAE,2BAA2B;YACjC,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,MAAM,CAAC,EAAE;SAC5D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,QAAQ,CAAC,qBAAqB,CAC5B,YAAY,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,OAAO,CAAC,EAAE,sBAAsB,EAAE,EAAE,EAAE,CAAC,CAC3F,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACnC,IAAI,EAAE,8BAA8B;YACpC,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,OAAO,CAAC,EAAE;SAC5D,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAc,CAAC;QACjD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QACnF,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,sBAAsB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"restrictions.spec.js","sourceRoot":"","sources":["../src/restrictions.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,UAAU,GAAG,IAAI;IAClE,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACtE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CAAC,IAAe;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,GAAG,YAAY,OAAO;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAe;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,GAAG,YAAY,OAAO;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAgB,CAAC;IACpC,OAAO,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAe;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,GAAG,YAAY,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAgB,CAAC;IACpC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,IAAI,MAAc,CAAC;IACnB,IAAI,OAA4B,CAAC;IACjC,IAAI,QAAkC,CAAC;IAEvC,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACnB,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEjC,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;QACpE,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QAChF,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACtC,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEtC,OAAO,GAAG,KAAK,IAAI,EAAE;YACnB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,OAAO,EAAE,CAAC;QAChB,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,QAAQ,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAE9F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACnC,IAAI,EAAE,mBAAmB;YACzB,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;SACpE,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAc,CAAC;QACjD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACpE,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,sBAAsB,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACzF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACnC,IAAI,EAAE,mBAAmB;YACzB,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,eAAe,CAAC,EAAE;SACrE,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,QAAQ,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAE5E,MAAM,MAAM,CAAC,QAAQ,CAAC;YACpB,IAAI,EAAE,0BAA0B;YAChC,SAAS,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE;SACtE,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAc,CAAC;QACjD,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;QAClE,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,QAAQ,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAEhG,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACnC,IAAI,EAAE,2BAA2B;YACjC,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,OAAO,CAAC,EAAE;SAC7D,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAc,CAAC;QACjD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAClF,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,sBAAsB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,QAAQ,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAE7D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACnC,IAAI,EAAE,2BAA2B;YACjC,SAAS,EAAE;gBACT,EAAE,EAAE,MAAM;gBACV,sBAAsB,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;gBAC3C,UAAU,EAAE,0BAA0B;gBACtC,QAAQ,EAAE,IAAI;aACf;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAc,CAAC;QACjD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAClF,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YACzC,sBAAsB,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;YAC3C,UAAU,EAAE,0BAA0B;YACtC,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACnC,IAAI,EAAE,2BAA2B;YACjC,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,MAAM,CAAC,EAAE;SAC5D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,QAAQ,CAAC,qBAAqB,CAC5B,YAAY,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,OAAO,CAAC,EAAE,sBAAsB,EAAE,EAAE,EAAE,CAAC,CAC3F,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACnC,IAAI,EAAE,8BAA8B;YACpC,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,OAAO,CAAC,EAAE;SAC5D,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAc,CAAC;QACjD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QACnF,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,sBAAsB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server.d.ts

@@ -1,3 +1,13 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function createServer(apiKey: string, baseUrl: string): McpServer;
+export interface CreateServerOptions {
+    /** Forwarded as `x-opencx-coworker-session-id` on every API call (companion attribution). */
+    coworkerSessionId?: string;
+    /**
+     * Enables the Firecrawl web_search/web_scrape tools. Threaded explicitly —
+     * never resolved from ambient process env, so a multi-tenant host can grant
+     * it per caller (see registerFirecrawlTools).
+     */
+    firecrawlApiKey?: string;
+}
+export declare function createServer(apiKey: string, baseUrl: string, options?: CreateServerOptions): McpServer;
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA0CpE,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,CAiDvE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA0CpE,MAAM,WAAW,mBAAmB;IAClC,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,mBAAwB,GAChC,SAAS,CAmDX"}