@roxyon/mcp 0.1.1 → 0.2.0

package/dist/chunk-BNTVFLMW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts","../src/prompts.ts","../src/resources.ts","../src/tools.ts","../src/context.ts","../src/session.ts","../src/result.ts"],"sourcesContent":["import { createRequire } from 'node:module';\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { registerPrompts } from './prompts.js';\nimport { registerResources } from './resources.js';\nimport { registerTools } from './tools.js';\n\nexport const SERVER_NAME = 'roxyon';\nexport const SERVER_VERSION: string = (\n  createRequire(import.meta.url)('../package.json') as { version: string }\n).version;\n\n/** Build the Roxyon MCP server with every tool, resource and prompt registered. */\nexport function createServer(): McpServer {\n  const server = new McpServer(\n    { name: SERVER_NAME, version: SERVER_VERSION },\n    {\n      instructions:\n        'Roxyon lets you build LumenJS SPAs, use the Roxyon BaaS, and deploy apps and web ' +\n        'projects to Roxyon infrastructure. Read the roxyon://docs/* resources before writing ' +\n        'LumenJS or calling the BaaS. To deploy: roxyon_init once per project, then roxyon_deploy ' +\n        '(dry run, then confirm:true). Side-effecting tools require confirm:true.',\n    },\n  );\n\n  registerResources(server);\n  registerPrompts(server);\n  registerTools(server);\n  return server;\n}\n","import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { z } from 'zod';\n\nexport function registerPrompts(server: McpServer): void {\n  server.registerPrompt(\n    'scaffold-lumen-app',\n    {\n      title: 'Scaffold a LumenJS + Roxyon app',\n      description:\n        'Guidance for creating a new LumenJS SPA wired to the Roxyon BaaS and ready to deploy.',\n      argsSchema: {\n        idea: z.string().describe('What the app should do.'),\n        dir: z.string().optional().describe('Where to create it.'),\n      },\n    },\n    ({ idea, dir }) => ({\n      messages: [\n        {\n          role: 'user',\n          content: {\n            type: 'text',\n            text: `Build a LumenJS single-page app: ${idea}\\n\\nSteps:\\n1. Read the \"roxyon://docs/lumenjs\" resource — follow V1 rules exactly (one bind per region, no nested bind, build option lists in JS not :for, check every BaaS write for an error field).\\n2. Read \"roxyon://docs/baas\" for the data/auth API.\\n3. Scaffold with the LumenJS CLI: \\`lm create <name>\\`${dir ? ` in ${dir}` : ''}. Put views under src/views/, wire the BaaS in src/index.js via config.json.\\n4. When it runs locally (\\`lm serve\\`), call roxyon_init then roxyon_deploy (dry run first, then confirm:true).`,\n          },\n        },\n      ],\n    }),\n  );\n\n  server.registerPrompt(\n    'deploy-to-roxyon',\n    {\n      title: 'Deploy this project to Roxyon',\n      description: 'Walk through deploying the current project to Roxyon infrastructure.',\n      argsSchema: { dir: z.string().describe('Absolute path to the project.') },\n    },\n    ({ dir }) => ({\n      messages: [\n        {\n          role: 'user',\n          content: {\n            type: 'text',\n            text: `Deploy the project at ${dir} to Roxyon.\\n\\n1. If there is no roxyon.json, call roxyon_init (it detects the runtime; ask me which host if there are several).\\n2. Call roxyon_deploy with just the dir first to see the plan.\\n3. If the plan looks right, call roxyon_deploy again with confirm:true.\\n4. For an app runtime, report the final status and, if it failed, the last error from roxyon_app_status.`,\n          },\n        },\n      ],\n    }),\n  );\n}\n","import { readFile } from 'node:fs/promises';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\n\nconst RESOURCE_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', 'resources');\n\ninterface Doc {\n  uri: string;\n  name: string;\n  file: string;\n  title: string;\n  description: string;\n}\n\nconst DOCS: Doc[] = [\n  {\n    uri: 'roxyon://docs/lumenjs',\n    name: 'lumenjs-reference',\n    file: 'lumenjs.md',\n    title: 'LumenJS — complete reference',\n    description:\n      'Full LumenJS V1 reference for building SPAs with vanilla JS/HTML/CSS (no build step), ' +\n      'contrasted with Vue/React. Read before writing .view files.',\n  },\n  {\n    uri: 'roxyon://docs/baas',\n    name: 'baas-reference',\n    file: 'baas.md',\n    title: 'Roxyon BaaS reference',\n    description:\n      'The Roxyon Backend-as-a-Service REST API: endpoints, auth flow, query rules, and the ' +\n      'resolve-on-failure write behaviour.',\n  },\n  {\n    uri: 'roxyon://docs/deploy',\n    name: 'deploy-reference',\n    file: 'deploy.md',\n    title: 'Deploying to Roxyon',\n    description:\n      'How roxyon_init / roxyon_deploy work, the roxyon.json schema, static vs app deploys, env ' +\n      'vars, and git push-to-deploy.',\n  },\n];\n\nexport function registerResources(server: McpServer): void {\n  for (const doc of DOCS) {\n    server.registerResource(\n      doc.name,\n      doc.uri,\n      { title: doc.title, description: doc.description, mimeType: 'text/markdown' },\n      async () => {\n        const body = await readFile(join(RESOURCE_DIR, doc.file), 'utf8');\n        return { contents: [{ uri: doc.uri, mimeType: 'text/markdown', text: body }] };\n      },\n    );\n  }\n}\n","import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { type Roxyon, envFromStored, formatEnv } from '@roxyon/api-client';\nimport {\n  buildIgnore,\n  buildProjectConfig,\n  deployProject,\n  detectRuntime,\n  listFiles,\n  loadProjectConfig,\n  saveProjectConfig,\n} from '@roxyon/deploy-core';\nimport { z } from 'zod';\nimport { currentContext } from './context.js';\nimport { type ToolResult, errorResult, guard, text } from './result.js';\nimport { type RoxyonSession, getSession } from './session.js';\n\n/**\n * `roxyon_init` / `roxyon_deploy` read and write the caller's local project\n * directory — impossible over the remote HTTP server. Returns an explanatory\n * result when running in that mode, `null` otherwise (proceed).\n */\nfunction remoteFilesystemBlock(tool: 'roxyon_init' | 'roxyon_deploy'): ToolResult | null {\n  if (!currentContext().remote) return null;\n  return errorResult(\n    [\n      `${tool} needs access to your local project files, which the hosted Roxyon MCP`,\n      'server does not have. Either:',\n      '  • run the `roxyon` CLI locally (`npm i -g @roxyon/cli`, then `roxyon deploy`), or',\n      '  • use `roxyon_link_github` to connect a git repo for push-to-deploy, then',\n      '    `roxyon_app_status` / `roxyon_logs` to watch it here.',\n    ].join('\\n'),\n  );\n}\n\n/** Resolve an application id from an explicit id or a project directory. */\nasync function resolveApp(args: { application?: string; dir?: string }): Promise<{\n  applicationId: string;\n  host?: string;\n}> {\n  if (args.application) return { applicationId: args.application };\n  if (args.dir) {\n    const cfg = await loadProjectConfig(args.dir);\n    if (cfg?.application) return { applicationId: cfg.application, host: cfg.host };\n    throw new Error(\n      `No application linked in ${args.dir}/roxyon.json. Deploy it once (roxyon_deploy) or pass \"application\".`,\n    );\n  }\n  throw new Error('Pass either \"application\" (an id) or \"dir\" (a project directory).');\n}\n\n/** The account context (user + subscriptions + domains) — one call, PAT-safe. */\nfunction accountContext(session: RoxyonSession) {\n  return session.roxyon.account.context();\n}\n\nexport function registerTools(server: McpServer): void {\n  // -----------------------------------------------------------------------\n  server.registerTool(\n    'roxyon_whoami',\n    {\n      title: 'Roxyon: who am I',\n      description: 'Show the signed-in Roxyon user and their subscriptions (which one is active).',\n      inputSchema: {},\n    },\n    () =>\n      guard(async () => {\n        const session = await getSession();\n        const ctx = await accountContext(session);\n        const lines = [\n          `User: ${ctx.user.email || ctx.user.id} (${ctx.user.id})`,\n          `Auth: ${session.source}${ctx.scopes.length ? ` (scopes: ${ctx.scopes.join(', ')})` : ''}`,\n          '',\n          'Subscriptions:',\n          ...ctx.subscriptions.map(\n            (s) =>\n              `  ${s.name || s.id} — ${s.status || '?'}${s.datacenter ? ` · ${s.datacenter}` : ''}`,\n          ),\n          '',\n          `Hosts: ${ctx.domains.map((d) => d.name).join(', ') || '(none)'}`,\n        ];\n        return text(lines.join('\\n'), {\n          user: ctx.user,\n          scopes: ctx.scopes,\n          subscriptions: ctx.subscriptions,\n          hosts: ctx.domains.map((d) => d.name),\n        });\n      }),\n  );\n\n  // -----------------------------------------------------------------------\n  server.registerTool(\n    'roxyon_list_domains',\n    {\n      title: 'Roxyon: list hosts',\n      description:\n        'List the domains (hosts) on the active subscription — the possible deploy targets.',\n      inputSchema: {},\n    },\n    () =>\n      guard(async () => {\n        const session = await getSession();\n        const { domains } = await accountContext(session);\n        return text(\n          domains.length\n            ? domains.map((d) => `- ${d.name}`).join('\\n')\n            : '(no hosts on this account)',\n          { hosts: domains.map((d) => d.name) },\n        );\n      }),\n  );\n\n  // -----------------------------------------------------------------------\n  server.registerTool(\n    'roxyon_list_apps',\n    {\n      title: 'Roxyon: list applications',\n      description:\n        'List the applications on the active subscription with their status and revision.',\n      inputSchema: {},\n    },\n    () =>\n      guard(async () => {\n        const session = await getSession();\n        const apps = await session.roxyon.account.apps();\n        const body = apps.length\n          ? apps\n              .map(\n                (a) =>\n                  `- ${a.name} [${a.id}] — ${a.status || '?'} ` +\n                  `(rev ${a.appliedRevision}/${a.configRevision})` +\n                  `${a.repo ? ` · git:${a.repo.branch}` : ''}`,\n              )\n              .join('\\n')\n          : '(no applications)';\n        return text(body, { applications: apps });\n      }),\n  );\n\n  // -----------------------------------------------------------------------\n  server.registerTool(\n    'roxyon_init',\n    {\n      title: 'Roxyon: initialise a project',\n      description:\n        \"Detect a project's type and write roxyon.json. Run this once per project before roxyon_deploy. \" +\n        'Does not create anything on the platform.',\n      inputSchema: {\n        dir: z.string().describe('Absolute path to the project directory.'),\n        runtime: z.enum(['lumen', 'node', 'python', 'php']).optional(),\n        host: z.string().optional().describe('Deploy host (a domain on the subscription).'),\n        folder: z.string().optional().describe('Sub-path under the host; \"\" = site root.'),\n        overwrite: z.boolean().optional().describe('Replace an existing roxyon.json.'),\n      },\n    },\n    (args) =>\n      guard(async () => {\n        const blocked = remoteFilesystemBlock('roxyon_init');\n        if (blocked) return blocked;\n        const session = await getSession();\n        const existing = await loadProjectConfig(args.dir);\n        if (existing && !args.overwrite) {\n          return errorResult(\n            `roxyon.json already exists in ${args.dir}. Pass overwrite:true to replace it.`,\n            { config: existing },\n          );\n        }\n        const { domains } = await accountContext(session);\n        if (domains.length === 0) {\n          return errorResult(\n            'This account has no hosts. Add a domain in the Roxyon console first.',\n          );\n        }\n        const detected = await detectRuntime(args.dir);\n        const runtime = args.runtime ?? detected.runtime;\n        const host = args.host ?? domains[0]!.name;\n        if (!domains.some((d) => d.name === host)) {\n          return errorResult(\n            `Host \"${host}\" is not on this account (have: ${domains.map((d) => d.name).join(', ')}).`,\n          );\n        }\n        const config = buildProjectConfig({\n          cwd: args.dir,\n          runtime,\n          host,\n          folder: args.folder,\n          start: detected.start,\n        });\n        const path = await saveProjectConfig(config, args.dir);\n        return text(\n          `Wrote ${path}\\nDetected: ${detected.runtime} (${detected.reason})\\n\\n${JSON.stringify(config, null, 2)}`,\n          { path, detected: detected.runtime, config },\n        );\n      }),\n  );\n\n  // -----------------------------------------------------------------------\n  server.registerTool(\n    'roxyon_deploy',\n    {\n      title: 'Roxyon: deploy a project',\n      description:\n        'Build (if configured) and deploy the project in \"dir\" to Roxyon. Without confirm:true this ' +\n        'returns a dry-run plan (what would build, where it would go, how many files). With confirm:true ' +\n        'it runs the build, uploads, and — for app runtimes — waits for it to go live. Requires roxyon.json ' +\n        '(run roxyon_init first).',\n      inputSchema: {\n        dir: z\n          .string()\n          .describe('Absolute path to the project directory (must contain roxyon.json).'),\n        confirm: z.boolean().optional().describe('Actually deploy. Omit for a dry-run plan.'),\n        build: z.boolean().optional().describe('Run the configured build command (default true).'),\n        follow: z\n          .boolean()\n          .optional()\n          .describe('For app runtimes, wait until running/failed (default true).'),\n      },\n    },\n    (args) =>\n      guard(async () => {\n        const blocked = remoteFilesystemBlock('roxyon_deploy');\n        if (blocked) return blocked;\n        const session = await getSession();\n        const config = await loadProjectConfig(args.dir);\n        if (!config) {\n          return errorResult(`No roxyon.json in ${args.dir}. Run roxyon_init first.`);\n        }\n\n        if (!args.confirm) {\n          const ig = await buildIgnore(args.dir);\n          const packRoot =\n            config.kind === 'static' && config.outDir ? `${args.dir}/${config.outDir}` : args.dir;\n          let files: string[] = [];\n          try {\n            files = await listFiles(packRoot, ig);\n          } catch {\n            /* outDir may not exist until the build runs */\n          }\n          const plan = [\n            'DRY RUN — pass confirm:true to deploy.',\n            '',\n            `Project:  ${config.name} (${config.runtime}, ${config.kind})`,\n            `Target:   ${config.host}${config.folder ? `/${config.folder}` : ''}`,\n            config.build ? `Build:    ${config.build}` : 'Build:    (none)',\n            config.kind === 'app'\n              ? `App:      ${config.application ?? '(created on first deploy)'}`\n              : 'Serve:    static files from the host document root',\n            files.length\n              ? `Would pack ${files.length} file(s) from ${config.kind === 'static' && config.outDir ? config.outDir : '.'}`\n              : `Would pack the build output (${config.outDir ?? 'dist'}) after building`,\n          ].join('\\n');\n          return text(plan, { dryRun: true, config });\n        }\n\n        const logLines: string[] = [];\n        const outcome = await deployProject({\n          cwd: args.dir,\n          roxyon: session.roxyon,\n          preferredSubscription: session.preferredSubscription,\n          build: args.build,\n          follow: args.follow ?? true,\n          timeoutMs: 5 * 60 * 1000,\n          reporter: {\n            step: (m) => logLines.push(`» ${m}`),\n            log: (l) => logLines.push(`  ${l}`),\n          },\n        });\n\n        const tail = logLines.slice(-60).join('\\n');\n        if (outcome.kind === 'static' && outcome.ok) {\n          return text(`${tail}\\n\\n✓ Live: ${outcome.url} (${outcome.files} files)`, {\n            ok: true,\n            kind: 'static',\n            url: outcome.url,\n          });\n        }\n        if (outcome.kind === 'app' && outcome.ok) {\n          return text(\n            `${tail}\\n\\n✓ ${outcome.status === 'running' ? `Live: ${outcome.url ?? outcome.application}` : `Build queued (revision ${outcome.revision})`}`,\n            {\n              ok: true,\n              kind: 'app',\n              application: outcome.application,\n              status: outcome.status,\n              url: outcome.url,\n            },\n          );\n        }\n        return errorResult(\n          `${tail}\\n\\n✗ Deploy failed: ${'error' in outcome ? outcome.error : 'unknown'}`,\n          { ok: false, application: 'application' in outcome ? outcome.application : undefined },\n        );\n      }),\n  );\n\n  // -----------------------------------------------------------------------\n  server.registerTool(\n    'roxyon_app_status',\n    {\n      title: 'Roxyon: application status',\n      description:\n        'Current status, revisions and last error for an application (by id or project dir).',\n      inputSchema: {\n        application: z.string().optional(),\n        dir: z\n          .string()\n          .optional()\n          .describe('A project directory whose roxyon.json links an application.'),\n      },\n    },\n    (args) =>\n      guard(async () => {\n        const session = await getSession();\n        const { applicationId } = await resolveApp(args);\n        const app = await session.roxyon.account.getApp(applicationId);\n        if (!app) return errorResult(`Application ${applicationId} not found.`);\n        const settled = app.configRevision <= app.appliedRevision;\n        const body = [\n          `${app.name} [${app.id}]`,\n          `Status:   ${app.status || '?'}${settled ? '' : ' (applying)'}`,\n          `Revision: ${app.appliedRevision} / ${app.configRevision}`,\n          `Runtime:  ${app.runtime}`.trim(),\n          app.lastError ? `\\nLast error:\\n${app.lastError}` : '',\n        ]\n          .filter(Boolean)\n          .join('\\n');\n        return text(body, {\n          id: app.id,\n          status: app.status,\n          settled,\n          configRevision: app.configRevision,\n          appliedRevision: app.appliedRevision,\n          lastError: app.lastError || undefined,\n        });\n      }),\n  );\n\n  // -----------------------------------------------------------------------\n  server.registerTool(\n    'roxyon_logs',\n    {\n      title: 'Roxyon: application logs',\n      description: 'Recent journal lines for an application (by id or project dir).',\n      inputSchema: {\n        application: z.string().optional(),\n        dir: z.string().optional(),\n        lines: z\n          .number()\n          .int()\n          .min(1)\n          .max(1000)\n          .optional()\n          .describe('How many lines (default 100).'),\n      },\n    },\n    (args) =>\n      guard(async () => {\n        const session = await getSession();\n        const { applicationId } = await resolveApp(args);\n        const lines = await session.roxyon.applications.logs(applicationId, args.lines ?? 100);\n        return text(lines.join('\\n') || '(no log lines)', { lines });\n      }),\n  );\n\n  // -----------------------------------------------------------------------\n  server.registerTool(\n    'roxyon_restart',\n    {\n      title: 'Roxyon: restart an application',\n      description: 'Bounce the application process (no rebuild). Needs confirm:true.',\n      inputSchema: {\n        application: z.string().optional(),\n        dir: z.string().optional(),\n        confirm: z.boolean().optional(),\n      },\n    },\n    (args) =>\n      guard(async () => {\n        const session = await getSession();\n        const { applicationId } = await resolveApp(args);\n        if (!args.confirm)\n          return text(`Would restart ${applicationId}. Pass confirm:true.`, { dryRun: true });\n        await session.roxyon.applications.restart(applicationId);\n        return text(`Restart queued for ${applicationId}.`, { ok: true });\n      }),\n  );\n\n  // -----------------------------------------------------------------------\n  server.registerTool(\n    'roxyon_env_get',\n    {\n      title: 'Roxyon: read environment variables',\n      description: \"An application's environment variables as KEY=value lines.\",\n      inputSchema: { application: z.string().optional(), dir: z.string().optional() },\n    },\n    (args) =>\n      guard(async () => {\n        const session = await getSession();\n        const { applicationId } = await resolveApp(args);\n        const env = await session.roxyon.applications.getEnv(applicationId);\n        return text(formatEnv(env) || '(none set)', { env });\n      }),\n  );\n\n  // -----------------------------------------------------------------------\n  server.registerTool(\n    'roxyon_env_set',\n    {\n      title: 'Roxyon: set environment variables',\n      description:\n        \"Merge variables into an application's environment and bump its revision. Run roxyon_deploy \" +\n        'afterwards to apply. Needs confirm:true. PORT and HOST are platform-managed and ignored.',\n      inputSchema: {\n        application: z.string().optional(),\n        dir: z.string().optional(),\n        vars: z.record(z.string()).describe('{ KEY: \"value\", ... } to set.'),\n        remove: z.array(z.string()).optional().describe('Keys to delete.'),\n        confirm: z.boolean().optional(),\n      },\n    },\n    (args) =>\n      guard(async () => {\n        const session = await getSession();\n        const { applicationId } = await resolveApp(args);\n        const set: Record<string, string> = {};\n        for (const [k, v] of Object.entries(args.vars)) {\n          if (k === 'PORT' || k === 'HOST') continue;\n          if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(k)) return errorResult(`Invalid env key \"${k}\".`);\n          set[k] = v;\n        }\n        const planned = [...Object.keys(set), ...(args.remove ?? []).map((k) => `-${k}`)];\n        if (!args.confirm) {\n          return text(`Would update: ${planned.join(', ') || '(nothing)'}. Pass confirm:true.`, {\n            dryRun: true,\n            changed: planned,\n          });\n        }\n        const r = await session.roxyon.applications.setEnv(applicationId, {\n          set,\n          remove: args.remove ?? [],\n        });\n        return text(`Updated ${r.changed.join(', ') || '(nothing)'}. Run roxyon_deploy to apply.`, {\n          ok: true,\n          changed: r.changed,\n        });\n      }),\n  );\n\n  // -----------------------------------------------------------------------\n  server.registerTool(\n    'roxyon_link_github',\n    {\n      title: 'Roxyon: connect a git remote',\n      description:\n        'Connect a git repository to an application for push-to-deploy. Returns the deploy key and ' +\n        'webhook URL to add to the repo. Needs confirm:true.',\n      inputSchema: {\n        application: z.string().optional(),\n        dir: z.string().optional(),\n        repoUrl: z.string().describe('SSH git URL, e.g. git@github.com:you/app.git'),\n        branch: z.string().optional().describe('Branch to deploy (default main).'),\n        confirm: z.boolean().optional(),\n      },\n    },\n    (args) =>\n      guard(async () => {\n        const session = await getSession();\n        const { applicationId } = await resolveApp(args);\n        if (!args.confirm) {\n          return text(\n            `Would connect ${args.repoUrl} (${args.branch ?? 'main'}) to ${applicationId}. Pass confirm:true.`,\n            { dryRun: true },\n          );\n        }\n        const res = await session.roxyon.applications.repoConnect(\n          applicationId,\n          args.repoUrl,\n          args.branch ?? 'main',\n        );\n        const body = [\n          `Connected ${args.repoUrl} (${args.branch ?? 'main'}).`,\n          res.deployKey ? `\\nDeploy key (add to the repo, read-only):\\n${res.deployKey}` : '',\n          res.webhookUrl ? `\\nWebhook URL: ${res.webhookUrl}` : '',\n          res.secret ? `Webhook secret: ${res.secret}` : '',\n          res.hint ? `\\n${res.hint}` : '',\n        ]\n          .filter(Boolean)\n          .join('\\n');\n        return text(body, {\n          ok: true,\n          deployKey: res.deployKey,\n          webhookUrl: res.webhookUrl,\n          secret: res.secret,\n        });\n      }),\n  );\n}\n\n// Re-exported for tests.\nexport { resolveApp };\nexport type { Roxyon, ToolResult };\n","import { AsyncLocalStorage } from 'node:async_hooks';\n\n/**\n * Per-request state for the HTTP transport. The stdio entry never opens a\n * context, so {@link currentContext} returns `{}` there and everything falls\n * back to the env / stored-login behaviour.\n */\nexport interface RequestContext {\n  /** Bearer token presented on this HTTP request (from the OAuth layer). */\n  token?: string;\n  /**\n   * True when serving the remote HTTP server. Tools that need the caller's\n   * local filesystem (`roxyon_init`, `roxyon_deploy`) refuse in this mode.\n   */\n  remote?: boolean;\n}\n\nconst storage = new AsyncLocalStorage<RequestContext>();\n\n/** Run `fn` with `ctx` visible to {@link currentContext} for its whole async tree. */\nexport function runWithContext<T>(ctx: RequestContext, fn: () => T): T {\n  return storage.run(ctx, fn);\n}\n\n/** The context for the in-flight request, or `{}` on the stdio transport. */\nexport function currentContext(): RequestContext {\n  return storage.getStore() ?? {};\n}\n","import { Roxyon, isAuthError } from '@roxyon/api-client';\nimport { endpointsFromEnv, loadCredentials, tokenFromEnv } from '@roxyon/deploy-core';\nimport { currentContext } from './context.js';\n\nexport interface RoxyonSession {\n  roxyon: Roxyon;\n  preferredSubscription?: string;\n  /** how the session was authenticated, for diagnostics */\n  source: 'env-token' | 'stored-login' | 'oauth';\n}\n\nexport class NotAuthenticatedError extends Error {\n  constructor() {\n    super(\n      'Not signed in to Roxyon. Run `roxyon login` in a terminal, or set ROXYON_TOKEN ' +\n        \"in this MCP server's environment.\",\n    );\n    this.name = 'NotAuthenticatedError';\n  }\n}\n\n/**\n * Resolve a Roxyon client for a tool call. Order: `ROXYON_TOKEN` env var, then\n * the login stored by the CLI at `~/.roxyon/config.json`.\n */\nexport async function getSession(): Promise<RoxyonSession> {\n  const { apiUrl, consoleUrl } = endpointsFromEnv();\n\n  // HTTP transport: the bearer token from this request wins over any ambient\n  // env/stored credentials, and each request gets its own client.\n  const requestToken = currentContext().token;\n  if (requestToken) {\n    return {\n      roxyon: new Roxyon({ sessionToken: requestToken, baseUrl: apiUrl, consoleUrl }),\n      source: 'oauth',\n    };\n  }\n\n  const envToken = tokenFromEnv();\n  if (envToken) {\n    return {\n      roxyon: new Roxyon({ sessionToken: envToken, baseUrl: apiUrl, consoleUrl }),\n      source: 'env-token',\n    };\n  }\n  const creds = await loadCredentials();\n  if (!creds?.sessionToken) throw new NotAuthenticatedError();\n  return {\n    roxyon: new Roxyon({ sessionToken: creds.sessionToken, baseUrl: apiUrl, consoleUrl }),\n    preferredSubscription: creds.subscription,\n    source: 'stored-login',\n  };\n}\n\nexport function isSessionGone(err: unknown): boolean {\n  return err instanceof NotAuthenticatedError || isAuthError(err);\n}\n","import { isSessionGone } from './session.js';\n\nexport interface ToolResult {\n  content: Array<{ type: 'text'; text: string }>;\n  structuredContent?: Record<string, unknown>;\n  isError?: boolean;\n  /** SDK's CallToolResult carries an open index signature. */\n  [k: string]: unknown;\n}\n\nexport function text(body: string, structured?: Record<string, unknown>): ToolResult {\n  return {\n    content: [{ type: 'text', text: body }],\n    ...(structured ? { structuredContent: structured } : {}),\n  };\n}\n\nexport function errorResult(message: string, structured?: Record<string, unknown>): ToolResult {\n  return {\n    content: [{ type: 'text', text: message }],\n    ...(structured ? { structuredContent: structured } : {}),\n    isError: true,\n  };\n}\n\n/** Wrap a tool body so thrown errors become clean `isError` results. */\nexport async function guard(fn: () => Promise<ToolResult>): Promise<ToolResult> {\n  try {\n    return await fn();\n  } catch (err) {\n    if (isSessionGone(err)) {\n      return errorResult(\n        (err as Error).message ||\n          'Roxyon session expired — run `roxyon login` again, or refresh ROXYON_TOKEN.',\n      );\n    }\n    return errorResult(err instanceof Error ? err.message : String(err));\n  }\n}\n"],"mappings":";;;AAAA,SAAS,qBAAqB;AAC9B,SAAS,iBAAiB;;;ACA1B,SAAS,SAAS;AAEX,SAAS,gBAAgB,QAAyB;AACvD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,aACE;AAAA,MACF,YAAY;AAAA,QACV,MAAM,EAAE,OAAO,EAAE,SAAS,yBAAyB;AAAA,QACnD,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,qBAAqB;AAAA,MAC3D;AAAA,IACF;AAAA,IACA,CAAC,EAAE,MAAM,IAAI,OAAO;AAAA,MAClB,UAAU;AAAA,QACR;AAAA,UACE,MAAM;AAAA,UACN,SAAS;AAAA,YACP,MAAM;AAAA,YACN,MAAM,oCAAoC,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,wDAAuT,MAAM,OAAO,GAAG,KAAK,EAAE;AAAA;AAAA,UAC9X;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,aAAa;AAAA,MACb,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,+BAA+B,EAAE;AAAA,IAC1E;AAAA,IACA,CAAC,EAAE,IAAI,OAAO;AAAA,MACZ,UAAU;AAAA,QACR;AAAA,UACE,MAAM;AAAA,UACN,SAAS;AAAA,YACP,MAAM;AAAA,YACN,MAAM,yBAAyB,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UACpC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;AC/CA,SAAS,gBAAgB;AACzB,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAG9B,IAAM,eAAe,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,MAAM,WAAW;AAUpF,IAAM,OAAc;AAAA,EAClB;AAAA,IACE,KAAK;AAAA,IACL,MAAM;AAAA,IACN,MAAM;AAAA,IACN,OAAO;AAAA,IACP,aACE;AAAA,EAEJ;AAAA,EACA;AAAA,IACE,KAAK;AAAA,IACL,MAAM;AAAA,IACN,MAAM;AAAA,IACN,OAAO;AAAA,IACP,aACE;AAAA,EAEJ;AAAA,EACA;AAAA,IACE,KAAK;AAAA,IACL,MAAM;AAAA,IACN,MAAM;AAAA,IACN,OAAO;AAAA,IACP,aACE;AAAA,EAEJ;AACF;AAEO,SAAS,kBAAkB,QAAyB;AACzD,aAAW,OAAO,MAAM;AACtB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,EAAE,OAAO,IAAI,OAAO,aAAa,IAAI,aAAa,UAAU,gBAAgB;AAAA,MAC5E,YAAY;AACV,cAAM,OAAO,MAAM,SAAS,KAAK,cAAc,IAAI,IAAI,GAAG,MAAM;AAChE,eAAO,EAAE,UAAU,CAAC,EAAE,KAAK,IAAI,KAAK,UAAU,iBAAiB,MAAM,KAAK,CAAC,EAAE;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;;;ACxDA,SAAqC,iBAAiB;AACtD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,KAAAA,UAAS;;;ACXlB,SAAS,yBAAyB;AAiBlC,IAAM,UAAU,IAAI,kBAAkC;AAG/C,SAAS,eAAkB,KAAqB,IAAgB;AACrE,SAAO,QAAQ,IAAI,KAAK,EAAE;AAC5B;AAGO,SAAS,iBAAiC;AAC/C,SAAO,QAAQ,SAAS,KAAK,CAAC;AAChC;;;AC3BA,SAAS,QAAQ,mBAAmB;AACpC,SAAS,kBAAkB,iBAAiB,oBAAoB;AAUzD,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAC/C,cAAc;AACZ;AAAA,MACE;AAAA,IAEF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAMA,eAAsB,aAAqC;AACzD,QAAM,EAAE,QAAQ,WAAW,IAAI,iBAAiB;AAIhD,QAAM,eAAe,eAAe,EAAE;AACtC,MAAI,cAAc;AAChB,WAAO;AAAA,MACL,QAAQ,IAAI,OAAO,EAAE,cAAc,cAAc,SAAS,QAAQ,WAAW,CAAC;AAAA,MAC9E,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,QAAM,WAAW,aAAa;AAC9B,MAAI,UAAU;AACZ,WAAO;AAAA,MACL,QAAQ,IAAI,OAAO,EAAE,cAAc,UAAU,SAAS,QAAQ,WAAW,CAAC;AAAA,MAC1E,QAAQ;AAAA,IACV;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,gBAAgB;AACpC,MAAI,CAAC,OAAO,aAAc,OAAM,IAAI,sBAAsB;AAC1D,SAAO;AAAA,IACL,QAAQ,IAAI,OAAO,EAAE,cAAc,MAAM,cAAc,SAAS,QAAQ,WAAW,CAAC;AAAA,IACpF,uBAAuB,MAAM;AAAA,IAC7B,QAAQ;AAAA,EACV;AACF;AAEO,SAAS,cAAc,KAAuB;AACnD,SAAO,eAAe,yBAAyB,YAAY,GAAG;AAChE;;;AC9CO,SAAS,KAAK,MAAc,YAAkD;AACnF,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,CAAC;AAAA,IACtC,GAAI,aAAa,EAAE,mBAAmB,WAAW,IAAI,CAAC;AAAA,EACxD;AACF;AAEO,SAAS,YAAY,SAAiB,YAAkD;AAC7F,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,QAAQ,CAAC;AAAA,IACzC,GAAI,aAAa,EAAE,mBAAmB,WAAW,IAAI,CAAC;AAAA,IACtD,SAAS;AAAA,EACX;AACF;AAGA,eAAsB,MAAM,IAAoD;AAC9E,MAAI;AACF,WAAO,MAAM,GAAG;AAAA,EAClB,SAAS,KAAK;AACZ,QAAI,cAAc,GAAG,GAAG;AACtB,aAAO;AAAA,QACJ,IAAc,WACb;AAAA,MACJ;AAAA,IACF;AACA,WAAO,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,EACrE;AACF;;;AHjBA,SAAS,sBAAsB,MAA0D;AACvF,MAAI,CAAC,eAAe,EAAE,OAAQ,QAAO;AACrC,SAAO;AAAA,IACL;AAAA,MACE,GAAG,IAAI;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AACF;AAGA,eAAe,WAAW,MAGvB;AACD,MAAI,KAAK,YAAa,QAAO,EAAE,eAAe,KAAK,YAAY;AAC/D,MAAI,KAAK,KAAK;AACZ,UAAM,MAAM,MAAM,kBAAkB,KAAK,GAAG;AAC5C,QAAI,KAAK,YAAa,QAAO,EAAE,eAAe,IAAI,aAAa,MAAM,IAAI,KAAK;AAC9E,UAAM,IAAI;AAAA,MACR,4BAA4B,KAAK,GAAG;AAAA,IACtC;AAAA,EACF;AACA,QAAM,IAAI,MAAM,mEAAmE;AACrF;AAGA,SAAS,eAAe,SAAwB;AAC9C,SAAO,QAAQ,OAAO,QAAQ,QAAQ;AACxC;AAEO,SAAS,cAAc,QAAyB;AAErD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,aAAa;AAAA,MACb,aAAa,CAAC;AAAA,IAChB;AAAA,IACA,MACE,MAAM,YAAY;AAChB,YAAM,UAAU,MAAM,WAAW;AACjC,YAAM,MAAM,MAAM,eAAe,OAAO;AACxC,YAAM,QAAQ;AAAA,QACZ,SAAS,IAAI,KAAK,SAAS,IAAI,KAAK,EAAE,KAAK,IAAI,KAAK,EAAE;AAAA,QACtD,SAAS,QAAQ,MAAM,GAAG,IAAI,OAAO,SAAS,aAAa,IAAI,OAAO,KAAK,IAAI,CAAC,MAAM,EAAE;AAAA,QACxF;AAAA,QACA;AAAA,QACA,GAAG,IAAI,cAAc;AAAA,UACnB,CAAC,MACC,KAAK,EAAE,QAAQ,EAAE,EAAE,WAAM,EAAE,UAAU,GAAG,GAAG,EAAE,aAAa,SAAM,EAAE,UAAU,KAAK,EAAE;AAAA,QACvF;AAAA,QACA;AAAA,QACA,UAAU,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK,QAAQ;AAAA,MACjE;AACA,aAAO,KAAK,MAAM,KAAK,IAAI,GAAG;AAAA,QAC5B,MAAM,IAAI;AAAA,QACV,QAAQ,IAAI;AAAA,QACZ,eAAe,IAAI;AAAA,QACnB,OAAO,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,MACtC,CAAC;AAAA,IACH,CAAC;AAAA,EACL;AAGA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,aACE;AAAA,MACF,aAAa,CAAC;AAAA,IAChB;AAAA,IACA,MACE,MAAM,YAAY;AAChB,YAAM,UAAU,MAAM,WAAW;AACjC,YAAM,EAAE,QAAQ,IAAI,MAAM,eAAe,OAAO;AAChD,aAAO;AAAA,QACL,QAAQ,SACJ,QAAQ,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,IAAI,IAC3C;AAAA,QACJ,EAAE,OAAO,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;AAAA,MACtC;AAAA,IACF,CAAC;AAAA,EACL;AAGA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,aACE;AAAA,MACF,aAAa,CAAC;AAAA,IAChB;AAAA,IACA,MACE,MAAM,YAAY;AAChB,YAAM,UAAU,MAAM,WAAW;AACjC,YAAM,OAAO,MAAM,QAAQ,OAAO,QAAQ,KAAK;AAC/C,YAAM,OAAO,KAAK,SACd,KACG;AAAA,QACC,CAAC,MACC,KAAK,EAAE,IAAI,KAAK,EAAE,EAAE,YAAO,EAAE,UAAU,GAAG,SAClC,EAAE,eAAe,IAAI,EAAE,cAAc,IAC1C,EAAE,OAAO,aAAU,EAAE,KAAK,MAAM,KAAK,EAAE;AAAA,MAC9C,EACC,KAAK,IAAI,IACZ;AACJ,aAAO,KAAK,MAAM,EAAE,cAAc,KAAK,CAAC;AAAA,IAC1C,CAAC;AAAA,EACL;AAGA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,aACE;AAAA,MAEF,aAAa;AAAA,QACX,KAAKC,GAAE,OAAO,EAAE,SAAS,yCAAyC;AAAA,QAClE,SAASA,GAAE,KAAK,CAAC,SAAS,QAAQ,UAAU,KAAK,CAAC,EAAE,SAAS;AAAA,QAC7D,MAAMA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS,6CAA6C;AAAA,QAClF,QAAQA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS,0CAA0C;AAAA,QACjF,WAAWA,GAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,kCAAkC;AAAA,MAC/E;AAAA,IACF;AAAA,IACA,CAAC,SACC,MAAM,YAAY;AAChB,YAAM,UAAU,sBAAsB,aAAa;AACnD,UAAI,QAAS,QAAO;AACpB,YAAM,UAAU,MAAM,WAAW;AACjC,YAAM,WAAW,MAAM,kBAAkB,KAAK,GAAG;AACjD,UAAI,YAAY,CAAC,KAAK,WAAW;AAC/B,eAAO;AAAA,UACL,iCAAiC,KAAK,GAAG;AAAA,UACzC,EAAE,QAAQ,SAAS;AAAA,QACrB;AAAA,MACF;AACA,YAAM,EAAE,QAAQ,IAAI,MAAM,eAAe,OAAO;AAChD,UAAI,QAAQ,WAAW,GAAG;AACxB,eAAO;AAAA,UACL;AAAA,QACF;AAAA,MACF;AACA,YAAM,WAAW,MAAM,cAAc,KAAK,GAAG;AAC7C,YAAM,UAAU,KAAK,WAAW,SAAS;AACzC,YAAM,OAAO,KAAK,QAAQ,QAAQ,CAAC,EAAG;AACtC,UAAI,CAAC,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,GAAG;AACzC,eAAO;AAAA,UACL,SAAS,IAAI,mCAAmC,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC;AAAA,QACvF;AAAA,MACF;AACA,YAAM,SAAS,mBAAmB;AAAA,QAChC,KAAK,KAAK;AAAA,QACV;AAAA,QACA;AAAA,QACA,QAAQ,KAAK;AAAA,QACb,OAAO,SAAS;AAAA,MAClB,CAAC;AACD,YAAM,OAAO,MAAM,kBAAkB,QAAQ,KAAK,GAAG;AACrD,aAAO;AAAA,QACL,SAAS,IAAI;AAAA,YAAe,SAAS,OAAO,KAAK,SAAS,MAAM;AAAA;AAAA,EAAQ,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,QACvG,EAAE,MAAM,UAAU,SAAS,SAAS,OAAO;AAAA,MAC7C;AAAA,IACF,CAAC;AAAA,EACL;AAGA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,aACE;AAAA,MAIF,aAAa;AAAA,QACX,KAAKA,GACF,OAAO,EACP,SAAS,oEAAoE;AAAA,QAChF,SAASA,GAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,2CAA2C;AAAA,QACpF,OAAOA,GAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,kDAAkD;AAAA,QACzF,QAAQA,GACL,QAAQ,EACR,SAAS,EACT,SAAS,6DAA6D;AAAA,MAC3E;AAAA,IACF;AAAA,IACA,CAAC,SACC,MAAM,YAAY;AAChB,YAAM,UAAU,sBAAsB,eAAe;AACrD,UAAI,QAAS,QAAO;AACpB,YAAM,UAAU,MAAM,WAAW;AACjC,YAAM,SAAS,MAAM,kBAAkB,KAAK,GAAG;AAC/C,UAAI,CAAC,QAAQ;AACX,eAAO,YAAY,qBAAqB,KAAK,GAAG,0BAA0B;AAAA,MAC5E;AAEA,UAAI,CAAC,KAAK,SAAS;AACjB,cAAM,KAAK,MAAM,YAAY,KAAK,GAAG;AACrC,cAAM,WACJ,OAAO,SAAS,YAAY,OAAO,SAAS,GAAG,KAAK,GAAG,IAAI,OAAO,MAAM,KAAK,KAAK;AACpF,YAAI,QAAkB,CAAC;AACvB,YAAI;AACF,kBAAQ,MAAM,UAAU,UAAU,EAAE;AAAA,QACtC,QAAQ;AAAA,QAER;AACA,cAAM,OAAO;AAAA,UACX;AAAA,UACA;AAAA,UACA,aAAa,OAAO,IAAI,KAAK,OAAO,OAAO,KAAK,OAAO,IAAI;AAAA,UAC3D,aAAa,OAAO,IAAI,GAAG,OAAO,SAAS,IAAI,OAAO,MAAM,KAAK,EAAE;AAAA,UACnE,OAAO,QAAQ,aAAa,OAAO,KAAK,KAAK;AAAA,UAC7C,OAAO,SAAS,QACZ,aAAa,OAAO,eAAe,2BAA2B,KAC9D;AAAA,UACJ,MAAM,SACF,cAAc,MAAM,MAAM,iBAAiB,OAAO,SAAS,YAAY,OAAO,SAAS,OAAO,SAAS,GAAG,KAC1G,gCAAgC,OAAO,UAAU,MAAM;AAAA,QAC7D,EAAE,KAAK,IAAI;AACX,eAAO,KAAK,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,MAC5C;AAEA,YAAM,WAAqB,CAAC;AAC5B,YAAM,UAAU,MAAM,cAAc;AAAA,QAClC,KAAK,KAAK;AAAA,QACV,QAAQ,QAAQ;AAAA,QAChB,uBAAuB,QAAQ;AAAA,QAC/B,OAAO,KAAK;AAAA,QACZ,QAAQ,KAAK,UAAU;AAAA,QACvB,WAAW,IAAI,KAAK;AAAA,QACpB,UAAU;AAAA,UACR,MAAM,CAAC,MAAM,SAAS,KAAK,QAAK,CAAC,EAAE;AAAA,UACnC,KAAK,CAAC,MAAM,SAAS,KAAK,KAAK,CAAC,EAAE;AAAA,QACpC;AAAA,MACF,CAAC;AAED,YAAM,OAAO,SAAS,MAAM,GAAG,EAAE,KAAK,IAAI;AAC1C,UAAI,QAAQ,SAAS,YAAY,QAAQ,IAAI;AAC3C,eAAO,KAAK,GAAG,IAAI;AAAA;AAAA,eAAe,QAAQ,GAAG,KAAK,QAAQ,KAAK,WAAW;AAAA,UACxE,IAAI;AAAA,UACJ,MAAM;AAAA,UACN,KAAK,QAAQ;AAAA,QACf,CAAC;AAAA,MACH;AACA,UAAI,QAAQ,SAAS,SAAS,QAAQ,IAAI;AACxC,eAAO;AAAA,UACL,GAAG,IAAI;AAAA;AAAA,SAAS,QAAQ,WAAW,YAAY,SAAS,QAAQ,OAAO,QAAQ,WAAW,KAAK,0BAA0B,QAAQ,QAAQ,GAAG;AAAA,UAC5I;AAAA,YACE,IAAI;AAAA,YACJ,MAAM;AAAA,YACN,aAAa,QAAQ;AAAA,YACrB,QAAQ,QAAQ;AAAA,YAChB,KAAK,QAAQ;AAAA,UACf;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,GAAG,IAAI;AAAA;AAAA,wBAAwB,WAAW,UAAU,QAAQ,QAAQ,SAAS;AAAA,QAC7E,EAAE,IAAI,OAAO,aAAa,iBAAiB,UAAU,QAAQ,cAAc,OAAU;AAAA,MACvF;AAAA,IACF,CAAC;AAAA,EACL;AAGA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,QACjC,KAAKA,GACF,OAAO,EACP,SAAS,EACT,SAAS,6DAA6D;AAAA,MAC3E;AAAA,IACF;AAAA,IACA,CAAC,SACC,MAAM,YAAY;AAChB,YAAM,UAAU,MAAM,WAAW;AACjC,YAAM,EAAE,cAAc,IAAI,MAAM,WAAW,IAAI;AAC/C,YAAM,MAAM,MAAM,QAAQ,OAAO,QAAQ,OAAO,aAAa;AAC7D,UAAI,CAAC,IAAK,QAAO,YAAY,eAAe,aAAa,aAAa;AACtE,YAAM,UAAU,IAAI,kBAAkB,IAAI;AAC1C,YAAM,OAAO;AAAA,QACX,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE;AAAA,QACtB,aAAa,IAAI,UAAU,GAAG,GAAG,UAAU,KAAK,aAAa;AAAA,QAC7D,aAAa,IAAI,eAAe,MAAM,IAAI,cAAc;AAAA,QACxD,aAAa,IAAI,OAAO,GAAG,KAAK;AAAA,QAChC,IAAI,YAAY;AAAA;AAAA,EAAkB,IAAI,SAAS,KAAK;AAAA,MACtD,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AACZ,aAAO,KAAK,MAAM;AAAA,QAChB,IAAI,IAAI;AAAA,QACR,QAAQ,IAAI;AAAA,QACZ;AAAA,QACA,gBAAgB,IAAI;AAAA,QACpB,iBAAiB,IAAI;AAAA,QACrB,WAAW,IAAI,aAAa;AAAA,MAC9B,CAAC;AAAA,IACH,CAAC;AAAA,EACL;AAGA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,QACjC,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,QACzB,OAAOA,GACJ,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,GAAI,EACR,SAAS,EACT,SAAS,+BAA+B;AAAA,MAC7C;AAAA,IACF;AAAA,IACA,CAAC,SACC,MAAM,YAAY;AAChB,YAAM,UAAU,MAAM,WAAW;AACjC,YAAM,EAAE,cAAc,IAAI,MAAM,WAAW,IAAI;AAC/C,YAAM,QAAQ,MAAM,QAAQ,OAAO,aAAa,KAAK,eAAe,KAAK,SAAS,GAAG;AACrF,aAAO,KAAK,MAAM,KAAK,IAAI,KAAK,kBAAkB,EAAE,MAAM,CAAC;AAAA,IAC7D,CAAC;AAAA,EACL;AAGA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,QACjC,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,QACzB,SAASA,GAAE,QAAQ,EAAE,SAAS;AAAA,MAChC;AAAA,IACF;AAAA,IACA,CAAC,SACC,MAAM,YAAY;AAChB,YAAM,UAAU,MAAM,WAAW;AACjC,YAAM,EAAE,cAAc,IAAI,MAAM,WAAW,IAAI;AAC/C,UAAI,CAAC,KAAK;AACR,eAAO,KAAK,iBAAiB,aAAa,wBAAwB,EAAE,QAAQ,KAAK,CAAC;AACpF,YAAM,QAAQ,OAAO,aAAa,QAAQ,aAAa;AACvD,aAAO,KAAK,sBAAsB,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IAClE,CAAC;AAAA,EACL;AAGA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,aAAa;AAAA,MACb,aAAa,EAAE,aAAaA,GAAE,OAAO,EAAE,SAAS,GAAG,KAAKA,GAAE,OAAO,EAAE,SAAS,EAAE;AAAA,IAChF;AAAA,IACA,CAAC,SACC,MAAM,YAAY;AAChB,YAAM,UAAU,MAAM,WAAW;AACjC,YAAM,EAAE,cAAc,IAAI,MAAM,WAAW,IAAI;AAC/C,YAAM,MAAM,MAAM,QAAQ,OAAO,aAAa,OAAO,aAAa;AAClE,aAAO,KAAK,UAAU,GAAG,KAAK,cAAc,EAAE,IAAI,CAAC;AAAA,IACrD,CAAC;AAAA,EACL;AAGA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,aACE;AAAA,MAEF,aAAa;AAAA,QACX,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,QACjC,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,QACzB,MAAMA,GAAE,OAAOA,GAAE,OAAO,CAAC,EAAE,SAAS,+BAA+B;AAAA,QACnE,QAAQA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,iBAAiB;AAAA,QACjE,SAASA,GAAE,QAAQ,EAAE,SAAS;AAAA,MAChC;AAAA,IACF;AAAA,IACA,CAAC,SACC,MAAM,YAAY;AAChB,YAAM,UAAU,MAAM,WAAW;AACjC,YAAM,EAAE,cAAc,IAAI,MAAM,WAAW,IAAI;AAC/C,YAAM,MAA8B,CAAC;AACrC,iBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,IAAI,GAAG;AAC9C,YAAI,MAAM,UAAU,MAAM,OAAQ;AAClC,YAAI,CAAC,2BAA2B,KAAK,CAAC,EAAG,QAAO,YAAY,oBAAoB,CAAC,IAAI;AACrF,YAAI,CAAC,IAAI;AAAA,MACX;AACA,YAAM,UAAU,CAAC,GAAG,OAAO,KAAK,GAAG,GAAG,IAAI,KAAK,UAAU,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;AAChF,UAAI,CAAC,KAAK,SAAS;AACjB,eAAO,KAAK,iBAAiB,QAAQ,KAAK,IAAI,KAAK,WAAW,wBAAwB;AAAA,UACpF,QAAQ;AAAA,UACR,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AACA,YAAM,IAAI,MAAM,QAAQ,OAAO,aAAa,OAAO,eAAe;AAAA,QAChE;AAAA,QACA,QAAQ,KAAK,UAAU,CAAC;AAAA,MAC1B,CAAC;AACD,aAAO,KAAK,WAAW,EAAE,QAAQ,KAAK,IAAI,KAAK,WAAW,iCAAiC;AAAA,QACzF,IAAI;AAAA,QACJ,SAAS,EAAE;AAAA,MACb,CAAC;AAAA,IACH,CAAC;AAAA,EACL;AAGA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,aACE;AAAA,MAEF,aAAa;AAAA,QACX,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,QACjC,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,QACzB,SAASA,GAAE,OAAO,EAAE,SAAS,8CAA8C;AAAA,QAC3E,QAAQA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS,kCAAkC;AAAA,QACzE,SAASA,GAAE,QAAQ,EAAE,SAAS;AAAA,MAChC;AAAA,IACF;AAAA,IACA,CAAC,SACC,MAAM,YAAY;AAChB,YAAM,UAAU,MAAM,WAAW;AACjC,YAAM,EAAE,cAAc,IAAI,MAAM,WAAW,IAAI;AAC/C,UAAI,CAAC,KAAK,SAAS;AACjB,eAAO;AAAA,UACL,iBAAiB,KAAK,OAAO,KAAK,KAAK,UAAU,MAAM,QAAQ,aAAa;AAAA,UAC5E,EAAE,QAAQ,KAAK;AAAA,QACjB;AAAA,MACF;AACA,YAAM,MAAM,MAAM,QAAQ,OAAO,aAAa;AAAA,QAC5C;AAAA,QACA,KAAK;AAAA,QACL,KAAK,UAAU;AAAA,MACjB;AACA,YAAM,OAAO;AAAA,QACX,aAAa,KAAK,OAAO,KAAK,KAAK,UAAU,MAAM;AAAA,QACnD,IAAI,YAAY;AAAA;AAAA,EAA+C,IAAI,SAAS,KAAK;AAAA,QACjF,IAAI,aAAa;AAAA,eAAkB,IAAI,UAAU,KAAK;AAAA,QACtD,IAAI,SAAS,mBAAmB,IAAI,MAAM,KAAK;AAAA,QAC/C,IAAI,OAAO;AAAA,EAAK,IAAI,IAAI,KAAK;AAAA,MAC/B,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AACZ,aAAO,KAAK,MAAM;AAAA,QAChB,IAAI;AAAA,QACJ,WAAW,IAAI;AAAA,QACf,YAAY,IAAI;AAAA,QAChB,QAAQ,IAAI;AAAA,MACd,CAAC;AAAA,IACH,CAAC;AAAA,EACL;AACF;;;AHzeO,IAAM,cAAc;AACpB,IAAM,iBACX,cAAc,YAAY,GAAG,EAAE,iBAAiB,EAChD;AAGK,SAAS,eAA0B;AACxC,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,MAAM,aAAa,SAAS,eAAe;AAAA,IAC7C;AAAA,MACE,cACE;AAAA,IAIJ;AAAA,EACF;AAEA,oBAAkB,MAAM;AACxB,kBAAgB,MAAM;AACtB,gBAAc,MAAM;AACpB,SAAO;AACT;","names":["z","z"]}

package/dist/http-entry.js

@@ -0,0 +1,261 @@
+#!/usr/bin/env node
+import {
+  SERVER_NAME,
+  SERVER_VERSION,
+  createServer,
+  runWithContext
+} from "./chunk-BNTVFLMW.js";
+
+// src/http.ts
+import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+import {
+  getOAuthProtectedResourceMetadataUrl,
+  mcpAuthMetadataRouter
+} from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { hostHeaderValidation } from "@modelcontextprotocol/sdk/server/middleware/hostHeaderValidation.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import express from "express";
+
+// src/http-auth.ts
+import { createHash } from "crypto";
+import { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+function staticAuthServerMetadata(issuer) {
+  const b = issuer.replace(/\/+$/, "");
+  return {
+    issuer: b,
+    authorization_endpoint: `${b}/oauth/authorize`,
+    token_endpoint: `${b}/oauth/token`,
+    registration_endpoint: `${b}/oauth/register`,
+    revocation_endpoint: `${b}/oauth/revoke`,
+    response_types_supported: ["code"],
+    grant_types_supported: ["authorization_code", "refresh_token"],
+    code_challenge_methods_supported: ["S256"],
+    token_endpoint_auth_methods_supported: ["none"],
+    scopes_supported: ["read", "deploy", "logs"]
+  };
+}
+async function fetchAuthServerMetadata(issuer, doFetch = fetch) {
+  const url = `${issuer.replace(/\/+$/, "")}/.well-known/oauth-authorization-server`;
+  try {
+    const res = await doFetch(url, { headers: { accept: "application/json" } });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    const body = await res.json();
+    if (!body.issuer || !body.authorization_endpoint || !body.token_endpoint) {
+      throw new Error("incomplete metadata");
+    }
+    return { ...staticAuthServerMetadata(issuer), ...body };
+  } catch {
+    return staticAuthServerMetadata(issuer);
+  }
+}
+function permissiveVerifier(resource) {
+  return {
+    async verifyAccessToken(token) {
+      if (!token.startsWith("roxp_")) {
+        throw new InvalidTokenError("not a Roxyon access token");
+      }
+      return {
+        token,
+        clientId: "dev",
+        scopes: ["read", "deploy", "logs"],
+        expiresAt: Math.floor(Date.now() / 1e3) + 300,
+        resource: new URL(resource)
+      };
+    }
+  };
+}
+function introspectionVerifier(cfg) {
+  const doFetch = cfg.fetch ?? fetch;
+  const cacheMs = cfg.cacheMs ?? 6e4;
+  const cache = /* @__PURE__ */ new Map();
+  return {
+    async verifyAccessToken(token) {
+      const key = createHash("sha256").update(token).digest("hex");
+      const hit = cache.get(key);
+      if (hit && hit.until > Date.now()) return hit.info;
+      let res;
+      try {
+        res = await doFetch(`${cfg.consoleUrl.replace(/\/+$/, "")}/oauth/introspect`, {
+          method: "POST",
+          headers: {
+            "content-type": "application/x-www-form-urlencoded",
+            authorization: `Bearer ${cfg.secret}`
+          },
+          body: new URLSearchParams({ token }).toString()
+        });
+      } catch (cause) {
+        throw new InvalidTokenError(`introspection request failed: ${cause.message}`);
+      }
+      const j = await res.json().catch(() => ({}));
+      if (!res.ok || j.active !== true) throw new InvalidTokenError("token is not active");
+      if (j.kind !== "oauth") {
+        throw new InvalidTokenError("token was not issued for a connector");
+      }
+      const aud = typeof j.aud === "string" ? j.aud : "";
+      if (aud && aud !== cfg.resource) {
+        throw new InvalidTokenError("token audience does not match this server");
+      }
+      const now = Math.floor(Date.now() / 1e3);
+      const expiresAt = typeof j.exp === "number" ? j.exp : now + 60;
+      const info = {
+        token,
+        clientId: typeof j.client_id === "string" ? j.client_id : "unknown",
+        scopes: typeof j.scope === "string" ? j.scope.split(/\s+/).filter(Boolean) : [],
+        expiresAt,
+        resource: new URL(cfg.resource),
+        extra: { uid: typeof j.sub === "string" ? j.sub : void 0 }
+      };
+      const ttl = Math.min(cacheMs, Math.max(0, (expiresAt - now) * 1e3));
+      if (ttl > 0) cache.set(key, { info, until: Date.now() + ttl });
+      return info;
+    }
+  };
+}
+
+// src/http.ts
+var SCOPES = ["read", "deploy", "logs"];
+function configFromEnv(env = process.env) {
+  const port = Number(env.PORT ?? env.MCP_PORT ?? 3e3);
+  const publicUrl = (env.MCP_PUBLIC_URL ?? `http://localhost:${port}`).replace(/\/+$/, "");
+  const oauthIssuer = (env.MCP_OAUTH_ISSUER ?? "https://console.roxyon.com").replace(/\/+$/, "");
+  const consoleUrl = (env.ROXYON_CONSOLE_URL ?? "https://console.roxyon.com").replace(/\/+$/, "");
+  const authMode = env.MCP_AUTH === "introspect" ? "introspect" : "permissive";
+  const hosts = /* @__PURE__ */ new Set(["localhost", "127.0.0.1"]);
+  try {
+    hosts.add(new URL(publicUrl).hostname);
+  } catch {
+  }
+  for (const h of (env.MCP_ALLOWED_HOSTS ?? "").split(",")) {
+    if (h.trim()) hosts.add(h.trim());
+  }
+  return {
+    port,
+    host: env.HOST ?? env.MCP_HOST ?? "0.0.0.0",
+    publicUrl,
+    oauthIssuer,
+    consoleUrl,
+    authMode,
+    introspectSecret: env.MCP_INTROSPECT_SECRET,
+    allowedHosts: [...hosts]
+  };
+}
+function buildVerifier(cfg) {
+  const resource = `${cfg.publicUrl}/mcp`;
+  if (cfg.authMode === "introspect") {
+    if (!cfg.introspectSecret) {
+      throw new Error("MCP_AUTH=introspect requires MCP_INTROSPECT_SECRET");
+    }
+    return introspectionVerifier({
+      consoleUrl: cfg.consoleUrl,
+      secret: cfg.introspectSecret,
+      resource
+    });
+  }
+  return permissiveVerifier(resource);
+}
+function buildApp(cfg, oauthMetadata) {
+  const app = express();
+  app.disable("x-powered-by");
+  app.get("/health", (_req, res) => {
+    res.json({ ok: true, service: SERVER_NAME, version: SERVER_VERSION });
+  });
+  app.use(hostHeaderValidation(cfg.allowedHosts));
+  app.use(express.json({ limit: "4mb" }));
+  const resourceUrl = new URL(`${cfg.publicUrl}/mcp`);
+  app.use(
+    mcpAuthMetadataRouter({
+      oauthMetadata: oauthMetadata ?? staticAuthServerMetadata(cfg.oauthIssuer),
+      resourceServerUrl: resourceUrl,
+      scopesSupported: SCOPES,
+      resourceName: "Roxyon"
+    })
+  );
+  const bearer = requireBearerAuth({
+    verifier: buildVerifier(cfg),
+    resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(resourceUrl)
+  });
+  app.post("/mcp", bearer, async (req, res) => {
+    const token = req.auth?.token;
+    const server = createServer();
+    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
+    res.on("close", () => {
+      transport.close();
+      server.close();
+    });
+    try {
+      await server.connect(transport);
+      await runWithContext(
+        { token, remote: true },
+        () => transport.handleRequest(req, res, req.body)
+      );
+    } catch (err) {
+      if (!res.headersSent) {
+        res.status(500).json({
+          jsonrpc: "2.0",
+          error: { code: -32603, message: err.message || "internal error" },
+          id: null
+        });
+      }
+    }
+  });
+  const methodNotAllowed = (_req, res) => {
+    res.status(405).json({
+      jsonrpc: "2.0",
+      error: { code: -32e3, message: "Method not allowed. Use POST /mcp." },
+      id: null
+    });
+  };
+  app.get("/mcp", methodNotAllowed);
+  app.delete("/mcp", methodNotAllowed);
+  return app;
+}
+async function startHttpServer(cfg = configFromEnv()) {
+  const oauthMetadata = cfg.authMode === "introspect" ? await fetchAuthServerMetadata(cfg.oauthIssuer) : staticAuthServerMetadata(cfg.oauthIssuer);
+  const app = buildApp(cfg, oauthMetadata);
+  await new Promise((resolve, reject) => {
+    const srv = app.listen(cfg.port, cfg.host, () => resolve());
+    srv.on("error", reject);
+  });
+  process.stderr.write(
+    `roxyon-mcp: HTTP on ${cfg.host}:${cfg.port} \u2014 resource ${cfg.publicUrl}/mcp, auth=${cfg.authMode}, issuer=${cfg.oauthIssuer}
+`
+  );
+}
+
+// src/http-entry.ts
+async function main() {
+  const argv = process.argv.slice(2);
+  if (argv.includes("--version") || argv.includes("-v")) {
+    process.stdout.write(`${SERVER_VERSION}
+`);
+    return;
+  }
+  if (argv.includes("--help") || argv.includes("-h")) {
+    process.stdout.write(
+      `${[
+        "roxyon-mcp-http \u2014 remote (Streamable HTTP) Roxyon MCP server",
+        "",
+        "Env:",
+        "  PORT                 listen port (default 3000)",
+        "  HOST                 bind address (default 0.0.0.0)",
+        "  MCP_PUBLIC_URL       public origin, e.g. https://mcp.roxyon.com",
+        "  MCP_OAUTH_ISSUER     authorization server (default https://console.roxyon.com)",
+        "  ROXYON_CONSOLE_URL   console base for API + introspection calls",
+        "  MCP_AUTH             permissive (default) | introspect",
+        "  MCP_INTROSPECT_SECRET   shared secret for MCP_AUTH=introspect",
+        "  MCP_ALLOWED_HOSTS    extra comma-separated Host header allowlist"
+      ].join("\n")}
+`
+    );
+    return;
+  }
+  await startHttpServer();
+}
+main().catch((err) => {
+  process.stderr.write(
+    `roxyon-mcp-http: fatal: ${err instanceof Error ? err.stack : String(err)}
+`
+  );
+  process.exit(1);
+});
+//# sourceMappingURL=http-entry.js.map

package/dist/http-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/http.ts","../src/http-auth.ts","../src/http-entry.ts"],"sourcesContent":["import { requireBearerAuth } from '@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js';\nimport type { OAuthTokenVerifier } from '@modelcontextprotocol/sdk/server/auth/provider.js';\nimport {\n  getOAuthProtectedResourceMetadataUrl,\n  mcpAuthMetadataRouter,\n} from '@modelcontextprotocol/sdk/server/auth/router.js';\nimport { hostHeaderValidation } from '@modelcontextprotocol/sdk/server/middleware/hostHeaderValidation.js';\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\nimport express, { type Express } from 'express';\nimport { runWithContext } from './context.js';\nimport {\n  type AuthServerMetadata,\n  fetchAuthServerMetadata,\n  introspectionVerifier,\n  permissiveVerifier,\n  staticAuthServerMetadata,\n} from './http-auth.js';\nimport { SERVER_NAME, SERVER_VERSION, createServer } from './server.js';\n\nconst SCOPES = ['read', 'deploy', 'logs'];\n\nexport interface HttpConfig {\n  port: number;\n  host: string;\n  /** Public origin this server is reached at, e.g. `https://mcp.roxyon.com`. */\n  publicUrl: string;\n  /** OAuth authorization server (the public console origin). */\n  oauthIssuer: string;\n  /** Console base for API + introspection calls (on-box in prod). */\n  consoleUrl: string;\n  authMode: 'permissive' | 'introspect';\n  introspectSecret?: string;\n  allowedHosts: string[];\n}\n\nexport function configFromEnv(env: NodeJS.ProcessEnv = process.env): HttpConfig {\n  const port = Number(env.PORT ?? env.MCP_PORT ?? 3000);\n  const publicUrl = (env.MCP_PUBLIC_URL ?? `http://localhost:${port}`).replace(/\\/+$/, '');\n  const oauthIssuer = (env.MCP_OAUTH_ISSUER ?? 'https://console.roxyon.com').replace(/\\/+$/, '');\n  const consoleUrl = (env.ROXYON_CONSOLE_URL ?? 'https://console.roxyon.com').replace(/\\/+$/, '');\n  const authMode = env.MCP_AUTH === 'introspect' ? 'introspect' : 'permissive';\n  const hosts = new Set<string>(['localhost', '127.0.0.1']);\n  try {\n    hosts.add(new URL(publicUrl).hostname);\n  } catch {\n    /* keep the defaults */\n  }\n  for (const h of (env.MCP_ALLOWED_HOSTS ?? '').split(',')) {\n    if (h.trim()) hosts.add(h.trim());\n  }\n  return {\n    port,\n    host: env.HOST ?? env.MCP_HOST ?? '0.0.0.0',\n    publicUrl,\n    oauthIssuer,\n    consoleUrl,\n    authMode,\n    introspectSecret: env.MCP_INTROSPECT_SECRET,\n    allowedHosts: [...hosts],\n  };\n}\n\nfunction buildVerifier(cfg: HttpConfig): OAuthTokenVerifier {\n  const resource = `${cfg.publicUrl}/mcp`;\n  if (cfg.authMode === 'introspect') {\n    if (!cfg.introspectSecret) {\n      throw new Error('MCP_AUTH=introspect requires MCP_INTROSPECT_SECRET');\n    }\n    return introspectionVerifier({\n      consoleUrl: cfg.consoleUrl,\n      secret: cfg.introspectSecret,\n      resource,\n    });\n  }\n  return permissiveVerifier(resource);\n}\n\n/**\n * Build the Express app for the remote MCP server. `oauthMetadata` is the\n * authorization-server descriptor advertised to clients; pass one to avoid the\n * boot-time fetch (tests), otherwise {@link startHttpServer} fetches it.\n */\nexport function buildApp(cfg: HttpConfig, oauthMetadata?: AuthServerMetadata): Express {\n  const app = express();\n  app.disable('x-powered-by');\n\n  // Health check first — no Host-header / auth requirements (HAProxy httpchk).\n  app.get('/health', (_req, res) => {\n    res.json({ ok: true, service: SERVER_NAME, version: SERVER_VERSION });\n  });\n\n  app.use(hostHeaderValidation(cfg.allowedHosts));\n  app.use(express.json({ limit: '4mb' }));\n\n  // RFC 9728 protected-resource metadata + RFC 8414 AS metadata mirror.\n  const resourceUrl = new URL(`${cfg.publicUrl}/mcp`);\n  app.use(\n    mcpAuthMetadataRouter({\n      oauthMetadata: (oauthMetadata ?? staticAuthServerMetadata(cfg.oauthIssuer)) as never,\n      resourceServerUrl: resourceUrl,\n      scopesSupported: SCOPES,\n      resourceName: 'Roxyon',\n    }),\n  );\n\n  const bearer = requireBearerAuth({\n    verifier: buildVerifier(cfg),\n    resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(resourceUrl),\n  });\n\n  app.post('/mcp', bearer, async (req, res) => {\n    const token = req.auth?.token;\n    const server = createServer();\n    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });\n    res.on('close', () => {\n      transport.close();\n      server.close();\n    });\n    try {\n      await server.connect(transport);\n      await runWithContext({ token, remote: true }, () =>\n        transport.handleRequest(req, res, req.body),\n      );\n    } catch (err) {\n      if (!res.headersSent) {\n        res.status(500).json({\n          jsonrpc: '2.0',\n          error: { code: -32603, message: (err as Error).message || 'internal error' },\n          id: null,\n        });\n      }\n    }\n  });\n\n  // Stateless: no server->client stream, no session to delete.\n  const methodNotAllowed = (_req: express.Request, res: express.Response) => {\n    res.status(405).json({\n      jsonrpc: '2.0',\n      error: { code: -32000, message: 'Method not allowed. Use POST /mcp.' },\n      id: null,\n    });\n  };\n  app.get('/mcp', methodNotAllowed);\n  app.delete('/mcp', methodNotAllowed);\n\n  return app;\n}\n\nexport async function startHttpServer(cfg: HttpConfig = configFromEnv()): Promise<void> {\n  const oauthMetadata =\n    cfg.authMode === 'introspect'\n      ? await fetchAuthServerMetadata(cfg.oauthIssuer)\n      : staticAuthServerMetadata(cfg.oauthIssuer);\n\n  const app = buildApp(cfg, oauthMetadata);\n  await new Promise<void>((resolve, reject) => {\n    const srv = app.listen(cfg.port, cfg.host, () => resolve());\n    srv.on('error', reject);\n  });\n  process.stderr.write(\n    `roxyon-mcp: HTTP on ${cfg.host}:${cfg.port} — resource ${cfg.publicUrl}/mcp, ` +\n      `auth=${cfg.authMode}, issuer=${cfg.oauthIssuer}\\n`,\n  );\n}\n","import { createHash } from 'node:crypto';\nimport { InvalidTokenError } from '@modelcontextprotocol/sdk/server/auth/errors.js';\nimport type { OAuthTokenVerifier } from '@modelcontextprotocol/sdk/server/auth/provider.js';\nimport type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';\n\n/** OAuth 2.0 Authorization Server Metadata (the subset the clients read). */\nexport interface AuthServerMetadata {\n  issuer: string;\n  authorization_endpoint: string;\n  token_endpoint: string;\n  registration_endpoint?: string;\n  revocation_endpoint?: string;\n  response_types_supported: string[];\n  grant_types_supported: string[];\n  code_challenge_methods_supported: string[];\n  token_endpoint_auth_methods_supported: string[];\n  scopes_supported: string[];\n}\n\n/**\n * The AS metadata for the Roxyon console. In production this is confirmed by\n * fetching `${issuer}/.well-known/oauth-authorization-server` at boot\n * ({@link fetchAuthServerMetadata}); this is the fallback / offline shape.\n */\nexport function staticAuthServerMetadata(issuer: string): AuthServerMetadata {\n  const b = issuer.replace(/\\/+$/, '');\n  return {\n    issuer: b,\n    authorization_endpoint: `${b}/oauth/authorize`,\n    token_endpoint: `${b}/oauth/token`,\n    registration_endpoint: `${b}/oauth/register`,\n    revocation_endpoint: `${b}/oauth/revoke`,\n    response_types_supported: ['code'],\n    grant_types_supported: ['authorization_code', 'refresh_token'],\n    code_challenge_methods_supported: ['S256'],\n    token_endpoint_auth_methods_supported: ['none'],\n    scopes_supported: ['read', 'deploy', 'logs'],\n  };\n}\n\n/** GET the console's live AS metadata, falling back to {@link staticAuthServerMetadata}. */\nexport async function fetchAuthServerMetadata(\n  issuer: string,\n  doFetch: typeof fetch = fetch,\n): Promise<AuthServerMetadata> {\n  const url = `${issuer.replace(/\\/+$/, '')}/.well-known/oauth-authorization-server`;\n  try {\n    const res = await doFetch(url, { headers: { accept: 'application/json' } });\n    if (!res.ok) throw new Error(`HTTP ${res.status}`);\n    const body = (await res.json()) as Partial<AuthServerMetadata>;\n    if (!body.issuer || !body.authorization_endpoint || !body.token_endpoint) {\n      throw new Error('incomplete metadata');\n    }\n    return { ...staticAuthServerMetadata(issuer), ...body } as AuthServerMetadata;\n  } catch {\n    return staticAuthServerMetadata(issuer);\n  }\n}\n\n/**\n * Phase 1 / local-dev verifier: accepts any `roxp_…` bearer and trusts the\n * console to reject it downstream. No audience or expiry enforcement — never\n * enable this in production (`MCP_AUTH=introspect` selects the real one).\n */\nexport function permissiveVerifier(resource: string): OAuthTokenVerifier {\n  return {\n    async verifyAccessToken(token: string): Promise<AuthInfo> {\n      if (!token.startsWith('roxp_')) {\n        throw new InvalidTokenError('not a Roxyon access token');\n      }\n      return {\n        token,\n        clientId: 'dev',\n        scopes: ['read', 'deploy', 'logs'],\n        expiresAt: Math.floor(Date.now() / 1000) + 300,\n        resource: new URL(resource),\n      };\n    },\n  };\n}\n\nexport interface IntrospectionConfig {\n  /** Console base for the introspection call — on-box (`http://127.0.0.1:9001`) in prod. */\n  consoleUrl: string;\n  /** Shared secret presented as `Authorization: Bearer` to `/oauth/introspect`. */\n  secret: string;\n  /** Canonical resource identifier this server accepts tokens for. */\n  resource: string;\n  fetch?: typeof fetch;\n  /** Result cache TTL cap in ms (default 60_000). */\n  cacheMs?: number;\n}\n\n/**\n * Production verifier: RFC 7662 token introspection against the console. Enforces\n * `active`, `kind === \"oauth\"`, and RFC 8707 audience binding, and caches the\n * result briefly to avoid a console round-trip per tool call.\n */\nexport function introspectionVerifier(cfg: IntrospectionConfig): OAuthTokenVerifier {\n  const doFetch = cfg.fetch ?? fetch;\n  const cacheMs = cfg.cacheMs ?? 60_000;\n  const cache = new Map<string, { info: AuthInfo; until: number }>();\n\n  return {\n    async verifyAccessToken(token: string): Promise<AuthInfo> {\n      const key = createHash('sha256').update(token).digest('hex');\n      const hit = cache.get(key);\n      if (hit && hit.until > Date.now()) return hit.info;\n\n      let res: Response;\n      try {\n        res = await doFetch(`${cfg.consoleUrl.replace(/\\/+$/, '')}/oauth/introspect`, {\n          method: 'POST',\n          headers: {\n            'content-type': 'application/x-www-form-urlencoded',\n            authorization: `Bearer ${cfg.secret}`,\n          },\n          body: new URLSearchParams({ token }).toString(),\n        });\n      } catch (cause) {\n        throw new InvalidTokenError(`introspection request failed: ${(cause as Error).message}`);\n      }\n\n      const j = (await res.json().catch(() => ({}))) as Record<string, unknown>;\n      if (!res.ok || j.active !== true) throw new InvalidTokenError('token is not active');\n      if (j.kind !== 'oauth') {\n        throw new InvalidTokenError('token was not issued for a connector');\n      }\n      const aud = typeof j.aud === 'string' ? j.aud : '';\n      if (aud && aud !== cfg.resource) {\n        throw new InvalidTokenError('token audience does not match this server');\n      }\n\n      const now = Math.floor(Date.now() / 1000);\n      const expiresAt = typeof j.exp === 'number' ? j.exp : now + 60;\n      const info: AuthInfo = {\n        token,\n        clientId: typeof j.client_id === 'string' ? j.client_id : 'unknown',\n        scopes: typeof j.scope === 'string' ? j.scope.split(/\\s+/).filter(Boolean) : [],\n        expiresAt,\n        resource: new URL(cfg.resource),\n        extra: { uid: typeof j.sub === 'string' ? j.sub : undefined },\n      };\n\n      const ttl = Math.min(cacheMs, Math.max(0, (expiresAt - now) * 1000));\n      if (ttl > 0) cache.set(key, { info, until: Date.now() + ttl });\n      return info;\n    },\n  };\n}\n","import { startHttpServer } from './http.js';\nimport { SERVER_VERSION } from './server.js';\n\nasync function main(): Promise<void> {\n  const argv = process.argv.slice(2);\n  if (argv.includes('--version') || argv.includes('-v')) {\n    process.stdout.write(`${SERVER_VERSION}\\n`);\n    return;\n  }\n  if (argv.includes('--help') || argv.includes('-h')) {\n    process.stdout.write(\n      `${[\n        'roxyon-mcp-http — remote (Streamable HTTP) Roxyon MCP server',\n        '',\n        'Env:',\n        '  PORT                 listen port (default 3000)',\n        '  HOST                 bind address (default 0.0.0.0)',\n        '  MCP_PUBLIC_URL       public origin, e.g. https://mcp.roxyon.com',\n        '  MCP_OAUTH_ISSUER     authorization server (default https://console.roxyon.com)',\n        '  ROXYON_CONSOLE_URL   console base for API + introspection calls',\n        '  MCP_AUTH             permissive (default) | introspect',\n        '  MCP_INTROSPECT_SECRET   shared secret for MCP_AUTH=introspect',\n        '  MCP_ALLOWED_HOSTS    extra comma-separated Host header allowlist',\n      ].join('\\n')}\\n`,\n    );\n    return;\n  }\n  await startHttpServer();\n}\n\nmain().catch((err) => {\n  process.stderr.write(\n    `roxyon-mcp-http: fatal: ${err instanceof Error ? err.stack : String(err)}\\n`,\n  );\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;AAAA,SAAS,yBAAyB;AAElC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAC9C,OAAO,aAA+B;;;ACRtC,SAAS,kBAAkB;AAC3B,SAAS,yBAAyB;AAuB3B,SAAS,yBAAyB,QAAoC;AAC3E,QAAM,IAAI,OAAO,QAAQ,QAAQ,EAAE;AACnC,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,wBAAwB,GAAG,CAAC;AAAA,IAC5B,gBAAgB,GAAG,CAAC;AAAA,IACpB,uBAAuB,GAAG,CAAC;AAAA,IAC3B,qBAAqB,GAAG,CAAC;AAAA,IACzB,0BAA0B,CAAC,MAAM;AAAA,IACjC,uBAAuB,CAAC,sBAAsB,eAAe;AAAA,IAC7D,kCAAkC,CAAC,MAAM;AAAA,IACzC,uCAAuC,CAAC,MAAM;AAAA,IAC9C,kBAAkB,CAAC,QAAQ,UAAU,MAAM;AAAA,EAC7C;AACF;AAGA,eAAsB,wBACpB,QACA,UAAwB,OACK;AAC7B,QAAM,MAAM,GAAG,OAAO,QAAQ,QAAQ,EAAE,CAAC;AACzC,MAAI;AACF,UAAM,MAAM,MAAM,QAAQ,KAAK,EAAE,SAAS,EAAE,QAAQ,mBAAmB,EAAE,CAAC;AAC1E,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACjD,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAI,CAAC,KAAK,UAAU,CAAC,KAAK,0BAA0B,CAAC,KAAK,gBAAgB;AACxE,YAAM,IAAI,MAAM,qBAAqB;AAAA,IACvC;AACA,WAAO,EAAE,GAAG,yBAAyB,MAAM,GAAG,GAAG,KAAK;AAAA,EACxD,QAAQ;AACN,WAAO,yBAAyB,MAAM;AAAA,EACxC;AACF;AAOO,SAAS,mBAAmB,UAAsC;AACvE,SAAO;AAAA,IACL,MAAM,kBAAkB,OAAkC;AACxD,UAAI,CAAC,MAAM,WAAW,OAAO,GAAG;AAC9B,cAAM,IAAI,kBAAkB,2BAA2B;AAAA,MACzD;AACA,aAAO;AAAA,QACL;AAAA,QACA,UAAU;AAAA,QACV,QAAQ,CAAC,QAAQ,UAAU,MAAM;AAAA,QACjC,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,QAC3C,UAAU,IAAI,IAAI,QAAQ;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AACF;AAmBO,SAAS,sBAAsB,KAA8C;AAClF,QAAM,UAAU,IAAI,SAAS;AAC7B,QAAM,UAAU,IAAI,WAAW;AAC/B,QAAM,QAAQ,oBAAI,IAA+C;AAEjE,SAAO;AAAA,IACL,MAAM,kBAAkB,OAAkC;AACxD,YAAM,MAAM,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAC3D,YAAM,MAAM,MAAM,IAAI,GAAG;AACzB,UAAI,OAAO,IAAI,QAAQ,KAAK,IAAI,EAAG,QAAO,IAAI;AAE9C,UAAI;AACJ,UAAI;AACF,cAAM,MAAM,QAAQ,GAAG,IAAI,WAAW,QAAQ,QAAQ,EAAE,CAAC,qBAAqB;AAAA,UAC5E,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,eAAe,UAAU,IAAI,MAAM;AAAA,UACrC;AAAA,UACA,MAAM,IAAI,gBAAgB,EAAE,MAAM,CAAC,EAAE,SAAS;AAAA,QAChD,CAAC;AAAA,MACH,SAAS,OAAO;AACd,cAAM,IAAI,kBAAkB,iCAAkC,MAAgB,OAAO,EAAE;AAAA,MACzF;AAEA,YAAM,IAAK,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC5C,UAAI,CAAC,IAAI,MAAM,EAAE,WAAW,KAAM,OAAM,IAAI,kBAAkB,qBAAqB;AACnF,UAAI,EAAE,SAAS,SAAS;AACtB,cAAM,IAAI,kBAAkB,sCAAsC;AAAA,MACpE;AACA,YAAM,MAAM,OAAO,EAAE,QAAQ,WAAW,EAAE,MAAM;AAChD,UAAI,OAAO,QAAQ,IAAI,UAAU;AAC/B,cAAM,IAAI,kBAAkB,2CAA2C;AAAA,MACzE;AAEA,YAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,YAAM,YAAY,OAAO,EAAE,QAAQ,WAAW,EAAE,MAAM,MAAM;AAC5D,YAAM,OAAiB;AAAA,QACrB;AAAA,QACA,UAAU,OAAO,EAAE,cAAc,WAAW,EAAE,YAAY;AAAA,QAC1D,QAAQ,OAAO,EAAE,UAAU,WAAW,EAAE,MAAM,MAAM,KAAK,EAAE,OAAO,OAAO,IAAI,CAAC;AAAA,QAC9E;AAAA,QACA,UAAU,IAAI,IAAI,IAAI,QAAQ;AAAA,QAC9B,OAAO,EAAE,KAAK,OAAO,EAAE,QAAQ,WAAW,EAAE,MAAM,OAAU;AAAA,MAC9D;AAEA,YAAM,MAAM,KAAK,IAAI,SAAS,KAAK,IAAI,IAAI,YAAY,OAAO,GAAI,CAAC;AACnE,UAAI,MAAM,EAAG,OAAM,IAAI,KAAK,EAAE,MAAM,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC;AAC7D,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ADlIA,IAAM,SAAS,CAAC,QAAQ,UAAU,MAAM;AAgBjC,SAAS,cAAc,MAAyB,QAAQ,KAAiB;AAC9E,QAAM,OAAO,OAAO,IAAI,QAAQ,IAAI,YAAY,GAAI;AACpD,QAAM,aAAa,IAAI,kBAAkB,oBAAoB,IAAI,IAAI,QAAQ,QAAQ,EAAE;AACvF,QAAM,eAAe,IAAI,oBAAoB,8BAA8B,QAAQ,QAAQ,EAAE;AAC7F,QAAM,cAAc,IAAI,sBAAsB,8BAA8B,QAAQ,QAAQ,EAAE;AAC9F,QAAM,WAAW,IAAI,aAAa,eAAe,eAAe;AAChE,QAAM,QAAQ,oBAAI,IAAY,CAAC,aAAa,WAAW,CAAC;AACxD,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,SAAS,EAAE,QAAQ;AAAA,EACvC,QAAQ;AAAA,EAER;AACA,aAAW,MAAM,IAAI,qBAAqB,IAAI,MAAM,GAAG,GAAG;AACxD,QAAI,EAAE,KAAK,EAAG,OAAM,IAAI,EAAE,KAAK,CAAC;AAAA,EAClC;AACA,SAAO;AAAA,IACL;AAAA,IACA,MAAM,IAAI,QAAQ,IAAI,YAAY;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,IAAI;AAAA,IACtB,cAAc,CAAC,GAAG,KAAK;AAAA,EACzB;AACF;AAEA,SAAS,cAAc,KAAqC;AAC1D,QAAM,WAAW,GAAG,IAAI,SAAS;AACjC,MAAI,IAAI,aAAa,cAAc;AACjC,QAAI,CAAC,IAAI,kBAAkB;AACzB,YAAM,IAAI,MAAM,oDAAoD;AAAA,IACtE;AACA,WAAO,sBAAsB;AAAA,MAC3B,YAAY,IAAI;AAAA,MAChB,QAAQ,IAAI;AAAA,MACZ;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,mBAAmB,QAAQ;AACpC;AAOO,SAAS,SAAS,KAAiB,eAA6C;AACrF,QAAM,MAAM,QAAQ;AACpB,MAAI,QAAQ,cAAc;AAG1B,MAAI,IAAI,WAAW,CAAC,MAAM,QAAQ;AAChC,QAAI,KAAK,EAAE,IAAI,MAAM,SAAS,aAAa,SAAS,eAAe,CAAC;AAAA,EACtE,CAAC;AAED,MAAI,IAAI,qBAAqB,IAAI,YAAY,CAAC;AAC9C,MAAI,IAAI,QAAQ,KAAK,EAAE,OAAO,MAAM,CAAC,CAAC;AAGtC,QAAM,cAAc,IAAI,IAAI,GAAG,IAAI,SAAS,MAAM;AAClD,MAAI;AAAA,IACF,sBAAsB;AAAA,MACpB,eAAgB,iBAAiB,yBAAyB,IAAI,WAAW;AAAA,MACzE,mBAAmB;AAAA,MACnB,iBAAiB;AAAA,MACjB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,kBAAkB;AAAA,IAC/B,UAAU,cAAc,GAAG;AAAA,IAC3B,qBAAqB,qCAAqC,WAAW;AAAA,EACvE,CAAC;AAED,MAAI,KAAK,QAAQ,QAAQ,OAAO,KAAK,QAAQ;AAC3C,UAAM,QAAQ,IAAI,MAAM;AACxB,UAAM,SAAS,aAAa;AAC5B,UAAM,YAAY,IAAI,8BAA8B,EAAE,oBAAoB,OAAU,CAAC;AACrF,QAAI,GAAG,SAAS,MAAM;AACpB,gBAAU,MAAM;AAChB,aAAO,MAAM;AAAA,IACf,CAAC;AACD,QAAI;AACF,YAAM,OAAO,QAAQ,SAAS;AAC9B,YAAM;AAAA,QAAe,EAAE,OAAO,QAAQ,KAAK;AAAA,QAAG,MAC5C,UAAU,cAAc,KAAK,KAAK,IAAI,IAAI;AAAA,MAC5C;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,CAAC,IAAI,aAAa;AACpB,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,SAAS;AAAA,UACT,OAAO,EAAE,MAAM,QAAQ,SAAU,IAAc,WAAW,iBAAiB;AAAA,UAC3E,IAAI;AAAA,QACN,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF,CAAC;AAGD,QAAM,mBAAmB,CAAC,MAAuB,QAA0B;AACzE,QAAI,OAAO,GAAG,EAAE,KAAK;AAAA,MACnB,SAAS;AAAA,MACT,OAAO,EAAE,MAAM,OAAQ,SAAS,qCAAqC;AAAA,MACrE,IAAI;AAAA,IACN,CAAC;AAAA,EACH;AACA,MAAI,IAAI,QAAQ,gBAAgB;AAChC,MAAI,OAAO,QAAQ,gBAAgB;AAEnC,SAAO;AACT;AAEA,eAAsB,gBAAgB,MAAkB,cAAc,GAAkB;AACtF,QAAM,gBACJ,IAAI,aAAa,eACb,MAAM,wBAAwB,IAAI,WAAW,IAC7C,yBAAyB,IAAI,WAAW;AAE9C,QAAM,MAAM,SAAS,KAAK,aAAa;AACvC,QAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,UAAM,MAAM,IAAI,OAAO,IAAI,MAAM,IAAI,MAAM,MAAM,QAAQ,CAAC;AAC1D,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACD,UAAQ,OAAO;AAAA,IACb,uBAAuB,IAAI,IAAI,IAAI,IAAI,IAAI,oBAAe,IAAI,SAAS,cAC7D,IAAI,QAAQ,YAAY,IAAI,WAAW;AAAA;AAAA,EACnD;AACF;;;AEhKA,eAAe,OAAsB;AACnC,QAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AACjC,MAAI,KAAK,SAAS,WAAW,KAAK,KAAK,SAAS,IAAI,GAAG;AACrD,YAAQ,OAAO,MAAM,GAAG,cAAc;AAAA,CAAI;AAC1C;AAAA,EACF;AACA,MAAI,KAAK,SAAS,QAAQ,KAAK,KAAK,SAAS,IAAI,GAAG;AAClD,YAAQ,OAAO;AAAA,MACb,GAAG;AAAA,QACD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA,IACd;AACA;AAAA,EACF;AACA,QAAM,gBAAgB;AACxB;AAEA,KAAK,EAAE,MAAM,CAAC,QAAQ;AACpB,UAAQ,OAAO;AAAA,IACb,2BAA2B,eAAe,QAAQ,IAAI,QAAQ,OAAO,GAAG,CAAC;AAAA;AAAA,EAC3E;AACA,UAAQ,KAAK,CAAC;AAChB,CAAC;","names":[]}