@softure-ai/mcp-access 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -4,6 +4,15 @@ Newest first. Each version lists what changed for an app that uses `@softure-ai/
 production, the version gets a line `verified in: <app>@<commit>` ([docs/05](../../docs/05-adoption-playbook.md),
 "Definition of done"). Versions before the first one below are described in their GitHub Releases (`mcp-access@x.y.z`).
 
+## 0.6.0
+
+- Request diagnostics (#1066): `createMcpEndpoint({ diagnostics })` (and so `createMcpRoute`), off by default. `true`
+  logs one `console.info` line per request, a function receives each `McpRequestDiagnostic` instead: the JSON-RPC
+  method, the tool name of a `tools/call`, the session state (`none`, `current`, `stale` with the version it carries,
+  `not_issued`, `unchecked`), the served tool list version, whether a session id was issued, the status, and on
+  `initialize` the client's `clientInfo` and protocol version. Never a token, body, argument value, session id or
+  user identity. The README says what hosted clients do with a changed tool list. Migrate: nothing.
+
 ## 0.5.0
 
 - Sessions that follow the tool list (#1055): `createMcpEndpoint` answers `initialize` with an `Mcp-Session-Id` that

package/README.md

@@ -210,6 +210,54 @@ the tool list (#1055):
   factory and throws unless a session opened under `before` is renewed for every access level whose list changed (and
   kept for the others).
 
+### Request diagnostics
+
+When a client shows a tool list that the server no longer serves, the question is what the client sends. Turn the
+diagnostics on for a test session, for example behind an env flag of the app:
+
+```ts
+// app/api/mcp/route.ts
+export const POST = createMcpRoute({ createServer, diagnostics: process.env.MCP_DIAGNOSTICS === "1" });
+```
+
+- `true` logs one `console.info` line per request, `@softure-ai/mcp-access: mcp request {...}`; a function
+  (`diagnostics: (entry) => ...`) receives each `McpRequestDiagnostic` instead, for the app's own logger.
+- An entry holds `httpMethod`, the JSON-RPC `method` (`"batch"` for an array), the `tool` of a `tools/call`,
+  `session` (`none`, `current`, `stale`, `not_issued` for an id the endpoint never issued, `unchecked` when it was not
+  checked), `sessionVersion` (the version a stale session carries), the served `toolListVersion`, `sessionIssued`,
+  the answer `status`, and on `initialize` the `client` (`clientInfo` name and version) and `protocolVersion`.
+- Never in an entry: the token, the body, argument values, the session id or the user's identity. Client text is
+  cut to 128 characters and stripped of control characters.
+
+Reading a test session: an `initialize` with `sessionIssued: true` followed by `tools/list` in `session: "current"`
+is a client that follows the version. A `stale` 404 followed by no `initialize` is a client that ignores session
+renewal. Only `tools/call` lines after a release, with `session: "none"` and no `tools/list`, is a client that serves the
+model its own cached list.
+
+### What hosted clients do with a changed tool list
+
+Public reports up to 2026-11 show that the Claude apps (claude.ai custom connectors, the desktop and mobile apps)
+keep a tool list cache on their side that nothing the server sends reliably refreshes: not a new server version
+(#877), not session renewal (#1055), not `notifications/tools/list_changed`
+([claude-ai-mcp#137](https://github.com/anthropics/claude-ai-mcp/issues/137),
+[claude-ai-mcp#1182](https://github.com/anthropics/claude-ai-mcp/issues/1182),
+[claude-code#38324](https://github.com/anthropics/claude-code/issues/38324),
+[claude-code#88172](https://github.com/anthropics/claude-code/issues/88172)). The server can re-initialize correctly
+while the model still sees the old schemas. What refreshed it differs by surface and over time:
+
+- claude.ai web: a new conversation; when that is not enough, removing the connector and adding it again.
+- Claude desktop and mobile apps: disconnect and reconnect in Settings → Connectors, otherwise remove and re-add the
+  connector; on the desktop app, quitting and relaunching the app.
+- Claude Code: the cache is keyed by the server name
+  ([claude-code#40025](https://github.com/anthropics/claude-code/issues/40025)); restart, or rename the server
+  entry.
+
+What the server can do: keep #877 and #1055 on (a client that follows the protocol re-initializes and re-lists after the
+404), and accept old input while clients catch up (a new field optional, a removed field
+still parsed) so a stale schema degrades instead of failing. Renaming the server or the connector forces a new cache
+entry, at the cost of every user reconnecting, so it is a last resort. Tell users after a release that changed a tool
+schema: start a new conversation, and if the old tools are still shown, remove and re-add the connector.
+
 ### Strict tool input
 
 zod objects strip unknown keys, so a call with a misspelt field (`notes` for `note`) or a field of a newer tool list
@@ -923,6 +971,8 @@ to `@softure-ai/privacy` (`privacy` flags on):
   app that wants `jwks_uri` adds it through `oauth.metadata` and serves the empty set itself).
 - Only `S256` PKCE and the `authorization_code` and `refresh_token` grants.
 - Write access is per token, not per tool; finer scopes would be a new option.
+- A hosted client's own tool list cache cannot be refreshed from the server (see "What hosted clients do with a
+  changed tool list"); the version and the session renewal help only clients that re-list.
 - The MCP endpoint's rate limit is per client address, not per token (API tokens are counted per token as well).
 - One API token kind per app (one prefix); the `kind` column takes more kinds without a migration of the rows.
 - `responseMode: "json"` drops mid-call notifications; a streaming tool would need a different mode. Long work is an

package/dist/index.js

@@ -45,7 +45,7 @@ export const API_TOKEN_RATE_LIMIT_BUCKETS = {
 export const mcpAccess = defineModule({
     manifest: {
         id: MODULE_ID,
-        version: "0.5.0",
+        version: "0.6.0",
         dependsOn: { security: "^0.2.0", auth: "^0.2.0", jobs: "^0.1.1?", ops: "^0.2.0?" },
         dbSchema: "mcp",
         tables: ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants", "oauth_registration_window", "used_confirmations", "operation_tasks"],

package/dist/server/endpoint.d.ts

@@ -2,6 +2,7 @@ import { type McpServer, type Server } from "@modelcontextprotocol/server";
 import type { McpServerIdentity } from "../contract.js";
 import { MCP_READ_SCOPE, MCP_WRITE_SCOPE } from "./scopes.js";
 import { type McpAccessContext } from "./tokens.js";
+import { type McpRequestDiagnostics } from "./request-diagnostics.js";
 export { MCP_READ_SCOPE, MCP_WRITE_SCOPE };
 /** The security bucket the endpoint counts in; `MCP_RATE_LIMIT_BUCKETS` holds its default. */
 export declare const MCP_RATE_LIMIT_BUCKET = "mcp";
@@ -22,6 +23,12 @@ export interface McpEndpointOptions {
      * `toolListVersion` (`createMcpServerFactory`). Without either, the endpoint issues no session id.
      */
     readonly toolListVersion?: ToolListVersionReader;
+    /**
+     * Request diagnostics (#1066), off by default: `true` logs one `console.info` line per request, a function receives
+     * each entry. An entry holds the JSON-RPC method, the tool name, the session state, the served tool list version,
+     * the status and the client's `clientInfo` on `initialize`; never a token, body, argument value or identity.
+     */
+    readonly diagnostics?: McpRequestDiagnostics;
 }
 /** Serves one request to the MCP endpoint. */
 export type McpEndpoint = (ctx: McpAccessContext, request: Request) => Promise<Response>;
@@ -31,5 +38,5 @@ export type McpEndpoint = (ctx: McpAccessContext, request: Request) => Promise<R
  * (`responseMode: "json"`): a stream would add proxy buffering and timeouts for no tool that needs
  * it, and mid-call notifications are dropped.
  */
-export declare function createMcpEndpoint({ createServer, toolListVersion }: McpEndpointOptions): McpEndpoint;
+export declare function createMcpEndpoint({ createServer, toolListVersion, diagnostics }: McpEndpointOptions): McpEndpoint;
 //# sourceMappingURL=endpoint.d.ts.map

package/dist/server/endpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint.d.ts","sourceRoot":"","sources":["../../src/server/endpoint.ts"],"names":[],"mappings":"AAKA,OAAO,EAML,KAAK,SAAS,EACd,KAAK,MAAM,EACZ,MAAM,8BAA8B,CAAC;AAGtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGxD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAWvE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;AAE3C,8FAA8F;AAC9F,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C,6FAA6F;AAC7F,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAOjD,mGAAmG;AACnG,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,iBAAiB,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;AAEjH,iGAAiG;AACjG,MAAM,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,iBAAiB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAErF,qHAAqH;AACrH,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;IACjE,QAAQ,CAAC,eAAe,EAAE,qBAAqB,CAAC;CACjD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,GAAG,yBAAyB,CAAC;IACpE;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC;CAClD;AAED,8CAA8C;AAC9C,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEzF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,EAAE,kBAAkB,GAAG,WAAW,CA+DpG"}
+{"version":3,"file":"endpoint.d.ts","sourceRoot":"","sources":["../../src/server/endpoint.ts"],"names":[],"mappings":"AAKA,OAAO,EAML,KAAK,SAAS,EACd,KAAK,MAAM,EACZ,MAAM,8BAA8B,CAAC;AAGtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGxD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAWvE,OAAO,EAML,KAAK,qBAAqB,EAE3B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;AAE3C,8FAA8F;AAC9F,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C,6FAA6F;AAC7F,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAOjD,mGAAmG;AACnG,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,iBAAiB,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;AAEjH,iGAAiG;AACjG,MAAM,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,iBAAiB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAErF,qHAAqH;AACrH,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;IACjE,QAAQ,CAAC,eAAe,EAAE,qBAAqB,CAAC;CACjD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,GAAG,yBAAyB,CAAC;IACpE;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACjD;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;CAC9C;AAUD,8CAA8C;AAC9C,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEzF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,EAAE,kBAAkB,GAAG,WAAW,CAmFjH"}

package/dist/server/endpoint.js

@@ -10,8 +10,9 @@ import { getProtectedResourceMetadataUrl, isOAuthEnabled } from "./oauth-http.js
 import { resolveMcpOrigins } from "./origins.js";
 import { MCP_READ_SCOPE, MCP_WRITE_SCOPE } from "./scopes.js";
 import { verifyAccessToken } from "./tokens.js";
-import { createSessionRenewalResponse, createToolListSessionId, isInitializeRequest, isToolListSessionCurrent, MCP_SESSION_ID_HEADER, rewriteInitializeAnswer, } from "./tool-list-session.js";
+import { createSessionRenewalResponse, createToolListSessionId, isInitializeRequest, isToolListSessionCurrent, MCP_SESSION_ID_HEADER, readToolListSessionVersion, rewriteInitializeAnswer, } from "./tool-list-session.js";
 import { isWritingEnabled } from "./writes-switch.js";
+import { createDiagnosticsSink, readJsonRpcSummary, sanitizeDiagnosticText, } from "./request-diagnostics.js";
 export { MCP_READ_SCOPE, MCP_WRITE_SCOPE };
 /** The security bucket the endpoint counts in; `MCP_RATE_LIMIT_BUCKETS` holds its default. */
 export const MCP_RATE_LIMIT_BUCKET = "mcp";
@@ -27,14 +28,27 @@ const NO_STORE = { "cache-control": "no-store" };
  * (`responseMode: "json"`): a stream would add proxy buffering and timeouts for no tool that needs
  * it, and mid-call notifications are dropped.
  */
-export function createMcpEndpoint({ createServer, toolListVersion }) {
+export function createMcpEndpoint({ createServer, toolListVersion, diagnostics }) {
     const readToolListVersion = toolListVersion ?? getFactoryToolListVersion(createServer);
+    const report = createDiagnosticsSink(diagnostics);
     const handler = createMcpHandler((requestContext) => createServer(readIdentity(requestContext.authInfo)), {
         responseMode: "json",
         maxRequestBodySize: MAX_MCP_REQUEST_BYTES,
         onerror: (error) => console.error(`@softure-ai/mcp-access: the MCP handler reported: ${errorLogLabel(error)}`),
     });
     return async (ctx, request) => {
+        if (report === undefined)
+            return serve(ctx, request, null);
+        const trace = { session: "unchecked", sessionVersion: null, toolListVersion: null, sessionIssued: false };
+        // Read before serving: the SDK consumes the body. Only the method, tool name and clientInfo are kept.
+        const summary = await readJsonRpcSummary(request, MAX_MCP_REQUEST_BYTES);
+        const response = await serve(ctx, request, trace);
+        report(createDiagnostic(request, summary, trace, response.status));
+        return response;
+    };
+    async function serve(ctx, request, trace) {
+        if (trace !== null && !request.headers.has(MCP_SESSION_ID_HEADER))
+            trace.session = "none";
         assertRateLimitBucket(ctx);
         const client = identifyClient(ctx, request.headers);
         if (!client.ok)
@@ -55,14 +69,14 @@ export function createMcpEndpoint({ createServer, toolListVersion }) {
         const authInfo = await authenticate(ctx, request);
         if (authInfo instanceof Response)
             return authInfo;
-        return serveInSession(request, authInfo);
-    };
+        return serveInSession(request, authInfo, trace);
+    }
     /**
      * Sessions tied to the tool list version (#1055): a session from another version (a release changed a tool, or the
      * access level changed) answers 404, so the client initializes again and lists the tools again; `initialize` gets a
      * new session id. A request without a session id is served as it always was.
      */
-    async function serveInSession(request, authInfo) {
+    async function serveInSession(request, authInfo, trace) {
         const sessionId = request.headers.get(MCP_SESSION_ID_HEADER);
         const isInitialize = sessionId === null && (await isInitializeRequest(request, MAX_MCP_REQUEST_BYTES));
         if (readToolListVersion === undefined || (sessionId === null && !isInitialize)) {
@@ -79,12 +93,45 @@ export function createMcpEndpoint({ createServer, toolListVersion }) {
             const response = await handler.fetch(request, { authInfo });
             return isInitialize ? rewriteInitializeAnswer(response, null) : response;
         }
+        if (trace !== null)
+            trace.toolListVersion = version;
         if (sessionId !== null) {
-            return isToolListSessionCurrent(sessionId, version) ? handler.fetch(request, { authInfo }) : createSessionRenewalResponse();
+            if (isToolListSessionCurrent(sessionId, version)) {
+                if (trace !== null)
+                    trace.session = "current";
+                return handler.fetch(request, { authInfo });
+            }
+            if (trace !== null)
+                recordRenewedSession(trace, sessionId);
+            return createSessionRenewalResponse();
         }
-        return rewriteInitializeAnswer(await handler.fetch(request, { authInfo }), createToolListSessionId(version));
+        const response = await rewriteInitializeAnswer(await handler.fetch(request, { authInfo }), createToolListSessionId(version));
+        if (trace !== null)
+            trace.sessionIssued = response.headers.has(MCP_SESSION_ID_HEADER);
+        return response;
     }
 }
+/** A session answered 404: stale when the id carries a version, not issued by the endpoint otherwise. */
+function recordRenewedSession(trace, sessionId) {
+    const sessionVersion = readToolListSessionVersion(sessionId);
+    trace.session = sessionVersion === null ? "not_issued" : "stale";
+    trace.sessionVersion = sessionVersion === null ? null : sanitizeDiagnosticText(sessionVersion);
+}
+/** The diagnostics entry of one served request. */
+function createDiagnostic(request, summary, trace, status) {
+    return {
+        httpMethod: request.method,
+        method: summary.method,
+        tool: summary.tool,
+        session: trace.session,
+        sessionVersion: trace.sessionVersion,
+        toolListVersion: trace.toolListVersion,
+        sessionIssued: trace.sessionIssued,
+        status,
+        client: summary.client,
+        protocolVersion: summary.protocolVersion,
+    };
+}
 /** The factory's own version reader, when it has one (`createMcpServerFactory`). */
 function getFactoryToolListVersion(factory) {
     return "toolListVersion" in factory && typeof factory.toolListVersion === "function" ? factory.toolListVersion : undefined;

package/dist/server/endpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../../src/server/endpoint.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,oGAAoG;AACpG,gGAAgG;AAChG,kGAAkG;AAClG,4BAA4B;AAC5B,OAAO,EACL,2BAA2B,EAC3B,gBAAgB,EAChB,UAAU,EACV,cAAc,GAIf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,+BAA+B,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAyB,MAAM,aAAa,CAAC;AACvE,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;AAE3C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAE3C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,aAAa,GAAG,QAAQ,CAAC;AAC/B,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAyBjD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAE,YAAY,EAAE,eAAe,EAAsB;IACrF,MAAM,mBAAmB,GAAG,eAAe,IAAI,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,gBAAgB,CAC9B,CAAC,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EACvE;QACE,YAAY,EAAE,MAAM;QACpB,kBAAkB,EAAE,qBAAqB;QACzC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,qDAAqD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;KAC/G,CACF,CAAC;IAEF,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC5B,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE3G,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,mFAAmF;YACnF,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,OAAO,CAAC,KAAK,CAAC,sDAAsD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5F,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC9B,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,QAAQ,YAAY,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAClD,OAAO,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEF;;;;OAIG;IACH,KAAK,UAAU,cAAc,CAAC,OAAgB,EAAE,QAAkB;QAChE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,SAAS,KAAK,IAAI,IAAI,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACvG,IAAI,mBAAmB,KAAK,SAAS,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5D,OAAO,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3E,CAAC;QACD,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2GAA2G;YAC3G,OAAO,CAAC,KAAK,CAAC,iEAAiE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5D,OAAO,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3E,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,wBAAwB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,4BAA4B,EAAE,CAAC;QAC9H,CAAC;QACD,OAAO,uBAAuB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,yBAAyB,CAAC,OAAqD;IACtF,OAAO,iBAAiB,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7H,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CAAC,GAAqB,EAAE,OAAgB;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,gGAAgG;IAChG,sGAAsG;IACtG,iGAAiG;IACjG,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1C,CAAC,CAAC,EAAE,cAAc,EAAE,mBAAmB,EAAE,+BAA+B,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE;QAC9H,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;IACvB,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,qDAAqD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,OAAO;QACL,KAAK;QACL,8EAA8E;QAC9E,QAAQ,EAAE,QAAQ,CAAC,OAAO;QAC1B,MAAM,EAAE,QAAQ,CAAC,QAAQ,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QAClG,qDAAqD;QACrD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAC1D,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,QAA8B;IAClD,MAAM,MAAM,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1E,4FAA4F;QAC5F,gFAAgF;QAChF,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;AACrG,CAAC;AAED,qGAAqG;AACrG,SAAS,qBAAqB,CAAC,GAAqB;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAA4D,CAAC;IAChH,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC,qBAAqB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,uDAAuD,qBAAqB,oEAAoE,CACjJ,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../../src/server/endpoint.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,oGAAoG;AACpG,gGAAgG;AAChG,kGAAkG;AAClG,4BAA4B;AAC5B,OAAO,EACL,2BAA2B,EAC3B,gBAAgB,EAChB,UAAU,EACV,cAAc,GAIf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,+BAA+B,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAyB,MAAM,aAAa,CAAC;AACvE,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,GAKvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;AAE3C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAE3C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,aAAa,GAAG,QAAQ,CAAC;AAC/B,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAuCjD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAsB;IAClG,MAAM,mBAAmB,GAAG,eAAe,IAAI,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,gBAAgB,CAC9B,CAAC,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EACvE;QACE,YAAY,EAAE,MAAM;QACpB,kBAAkB,EAAE,qBAAqB;QACzC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,qDAAqD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;KAC/G,CACF,CAAC;IAEF,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC5B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACxH,sGAAsG;QACtG,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,KAAK,UAAU,KAAK,CAAC,GAAqB,EAAE,OAAgB,EAAE,KAA0B;QACtF,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YAAE,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;QAC1F,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE3G,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,mFAAmF;YACnF,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,OAAO,CAAC,KAAK,CAAC,sDAAsD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5F,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC9B,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,QAAQ,YAAY,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAClD,OAAO,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,cAAc,CAAC,OAAgB,EAAE,QAAkB,EAAE,KAA0B;QAC5F,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,SAAS,KAAK,IAAI,IAAI,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACvG,IAAI,mBAAmB,KAAK,SAAS,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5D,OAAO,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3E,CAAC;QACD,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2GAA2G;YAC3G,OAAO,CAAC,KAAK,CAAC,iEAAiE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5D,OAAO,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3E,CAAC;QACD,IAAI,KAAK,KAAK,IAAI;YAAE,KAAK,CAAC,eAAe,GAAG,OAAO,CAAC;QACpD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,IAAI,wBAAwB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;gBACjD,IAAI,KAAK,KAAK,IAAI;oBAAE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC;gBAC9C,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,KAAK,KAAK,IAAI;gBAAE,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC3D,OAAO,4BAA4B,EAAE,CAAC;QACxC,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7H,IAAI,KAAK,KAAK,IAAI;YAAE,KAAK,CAAC,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACtF,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,yGAAyG;AACzG,SAAS,oBAAoB,CAAC,KAAmB,EAAE,SAAiB;IAClE,MAAM,cAAc,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC7D,KAAK,CAAC,OAAO,GAAG,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;IACjE,KAAK,CAAC,cAAc,GAAG,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;AACjG,CAAC;AAED,mDAAmD;AACnD,SAAS,gBAAgB,CAAC,OAAgB,EAAE,OAAuB,EAAE,KAAmB,EAAE,MAAc;IACtG,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,MAAM;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,MAAM;QACN,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,yBAAyB,CAAC,OAAqD;IACtF,OAAO,iBAAiB,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7H,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CAAC,GAAqB,EAAE,OAAgB;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,gGAAgG;IAChG,sGAAsG;IACtG,iGAAiG;IACjG,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1C,CAAC,CAAC,EAAE,cAAc,EAAE,mBAAmB,EAAE,+BAA+B,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE;QAC9H,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;IACvB,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,qDAAqD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,OAAO;QACL,KAAK;QACL,8EAA8E;QAC9E,QAAQ,EAAE,QAAQ,CAAC,OAAO;QAC1B,MAAM,EAAE,QAAQ,CAAC,QAAQ,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QAClG,qDAAqD;QACrD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAC1D,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,QAA8B;IAClD,MAAM,MAAM,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1E,4FAA4F;QAC5F,gFAAgF;QAChF,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;AACrG,CAAC;AAED,qGAAqG;AACrG,SAAS,qBAAqB,CAAC,GAAqB;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAA4D,CAAC;IAChH,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC,qBAAqB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,uDAAuD,qBAAqB,oEAAoE,CACjJ,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/server/index.d.ts

@@ -22,5 +22,6 @@ export { registerServerInfoTool, SERVER_INFO_TOOL_NAME, type McpBuildInfo, type
 export { toStrictToolInput, withStrictToolInput, type RenamedFields, type StrictToolInputMessages, type StrictToolInputOptions } from "./strict-input.js";
 export { DEFAULT_TOOL_LIST_RELEASE, describeToolList, fingerprintToolList, listServedTools, measureToolList, type MeasureToolListOptions, type RegisterTools, type ServedTool, type ToolListMeasurement, } from "./tool-list.js";
 export { createToolListSessionId, isToolListSessionCurrent, MCP_SESSION_ID_HEADER, readToolListSessionVersion, } from "./tool-list-session.js";
+export { type McpRequestDiagnostic, type McpRequestDiagnostics, type McpSessionState } from "./request-diagnostics.js";
 export { toolError, toolResult, withToolErrors, type ToolCaller, type ToolCallHook, type ToolCallOutcome, type ToolCallRecord, type ToolErrorHints, type ToolErrorOptions, } from "./tools.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,GAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1G,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,+BAA+B,EAC/B,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,GACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,4BAA4B,EACjC,KAAK,8BAA8B,EACnC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kCAAkC,EAClC,mBAAmB,EACnB,8BAA8B,EAC9B,cAAc,EACd,cAAc,EACd,4BAA4B,EAC5B,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,2BAA2B,EAC3B,YAAY,EACZ,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1L,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACtI,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC9F,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,EACd,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,6BAA6B,EAClC,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,KAAK,uBAAuB,EAAE,KAAK,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC1J,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,SAAS,EACT,UAAU,EACV,cAAc,EACd,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACtB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,GAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1G,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,+BAA+B,EAC/B,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,GACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,4BAA4B,EACjC,KAAK,8BAA8B,EACnC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kCAAkC,EAClC,mBAAmB,EACnB,8BAA8B,EAC9B,cAAc,EACd,cAAc,EACd,4BAA4B,EAC5B,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,2BAA2B,EAC3B,YAAY,EACZ,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1L,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACtI,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC9F,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,EACd,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,6BAA6B,EAClC,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,KAAK,uBAAuB,EAAE,KAAK,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC1J,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,EAAE,KAAK,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACvH,OAAO,EACL,SAAS,EACT,UAAU,EACV,cAAc,EACd,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACtB,MAAM,YAAY,CAAC"}

package/dist/server/index.js

@@ -23,5 +23,6 @@ export { registerServerInfoTool, SERVER_INFO_TOOL_NAME, } from "./server-info.js
 export { toStrictToolInput, withStrictToolInput } from "./strict-input.js";
 export { DEFAULT_TOOL_LIST_RELEASE, describeToolList, fingerprintToolList, listServedTools, measureToolList, } from "./tool-list.js";
 export { createToolListSessionId, isToolListSessionCurrent, MCP_SESSION_ID_HEADER, readToolListSessionVersion, } from "./tool-list-session.js";
+export {} from "./request-diagnostics.js";
 export { toolError, toolResult, withToolErrors, } from "./tools.js";
 //# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,+FAA+F;AAC/F,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,GAMhB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAkD,MAAM,kBAAkB,CAAC;AAC1G,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,eAAe,EACf,gBAAgB,GAMjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,+BAA+B,EAC/B,sBAAsB,GAGvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GASjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kCAAkC,EAClC,mBAAmB,EACnB,8BAA8B,EAC9B,cAAc,EACd,cAAc,EACd,4BAA4B,EAC5B,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,2BAA2B,EAC3B,YAAY,EACZ,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,GAK7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,iBAAiB,EAA0C,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,uBAAuB,EAAyD,MAAM,uBAAuB,CAAC;AAC1L,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAwB,MAAM,cAAc,CAAC;AACtI,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAA+B,MAAM,YAAY,CAAC;AAC9F,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,GAE5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,GAOlB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GAMf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAgC,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GAMtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAiF,MAAM,mBAAmB,CAAC;AAC1J,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,eAAe,GAKhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,SAAS,EACT,UAAU,EACV,cAAc,GAOf,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,+FAA+F;AAC/F,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,GAMhB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAkD,MAAM,kBAAkB,CAAC;AAC1G,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,eAAe,EACf,gBAAgB,GAMjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,+BAA+B,EAC/B,sBAAsB,GAGvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GASjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kCAAkC,EAClC,mBAAmB,EACnB,8BAA8B,EAC9B,cAAc,EACd,cAAc,EACd,4BAA4B,EAC5B,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,2BAA2B,EAC3B,YAAY,EACZ,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,GAK7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,iBAAiB,EAA0C,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,uBAAuB,EAAyD,MAAM,uBAAuB,CAAC;AAC1L,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAwB,MAAM,cAAc,CAAC;AACtI,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAA+B,MAAM,YAAY,CAAC;AAC9F,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,GAE5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,GAOlB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GAMf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAgC,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GAMtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAiF,MAAM,mBAAmB,CAAC;AAC1J,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,eAAe,GAKhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAA+E,MAAM,0BAA0B,CAAC;AACvH,OAAO,EACL,SAAS,EACT,UAAU,EACV,cAAc,GAOf,MAAM,YAAY,CAAC"}

package/dist/server/request-diagnostics.d.ts

@@ -0,0 +1,59 @@
+/** How a request's `Mcp-Session-Id` relates to the tool list version (#1055). */
+export type McpSessionState = 
+/** No session id came with the request. */
+"none"
+/** The session carries the current version and was served. */
+ | "current"
+/** The session carries another version and was answered 404, so the client should initialize again. */
+ | "stale"
+/** The session id is not one the endpoint issues; answered 404 like a stale one. */
+ | "not_issued"
+/** A session id came, but it was not checked (refused before authentication, or no version to check against). */
+ | "unchecked";
+/** One request as the diagnostics see it. */
+export interface McpRequestDiagnostic {
+    /** The HTTP method. */
+    readonly httpMethod: string;
+    /** The JSON-RPC method, `"batch"` for an array, `null` when the body was not read or is not JSON-RPC. */
+    readonly method: string | null;
+    /** The tool name of a `tools/call`, otherwise `null`. */
+    readonly tool: string | null;
+    readonly session: McpSessionState;
+    /** The version a stale session carries, otherwise `null`. */
+    readonly sessionVersion: string | null;
+    /** The tool list version served to the identity, `null` when unknown (refused before authentication, no reader). */
+    readonly toolListVersion: string | null;
+    /** Whether the answer issued a new session id (a successful `initialize`). */
+    readonly sessionIssued: boolean;
+    /** The HTTP status of the answer. */
+    readonly status: number;
+    /** The client's `clientInfo` on `initialize`, otherwise `null`. */
+    readonly client: {
+        readonly name: string;
+        readonly version: string;
+    } | null;
+    /** The protocol version the client asked for on `initialize`, otherwise the `MCP-Protocol-Version` header, or `null`. */
+    readonly protocolVersion: string | null;
+}
+/** `true` logs one `console.info` line per request; a function receives each entry instead. */
+export type McpRequestDiagnostics = boolean | ((entry: McpRequestDiagnostic) => void);
+/** What the diagnostics read from a request body. */
+export interface JsonRpcSummary {
+    readonly method: string | null;
+    readonly tool: string | null;
+    readonly client: {
+        readonly name: string;
+        readonly version: string;
+    } | null;
+    readonly protocolVersion: string | null;
+}
+/** Client-supplied text as it may be logged: control characters replaced, at most 128 characters. */
+export declare function sanitizeDiagnosticText(value: string): string;
+/**
+ * The method, tool name, `clientInfo` and protocol version of a request, read from a clone of its body. A body over
+ * `maxBytes` or one that is not JSON gives no method (the SDK answers it itself). Nothing else of the body is kept.
+ */
+export declare function readJsonRpcSummary(request: Request, maxBytes: number): Promise<JsonRpcSummary>;
+/** The sink for the option, or `undefined` when diagnostics are off. A throwing sink is logged, never rethrown. */
+export declare function createDiagnosticsSink(diagnostics: McpRequestDiagnostics | undefined): ((entry: McpRequestDiagnostic) => void) | undefined;
+//# sourceMappingURL=request-diagnostics.d.ts.map

package/dist/server/request-diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-diagnostics.d.ts","sourceRoot":"","sources":["../../src/server/request-diagnostics.ts"],"names":[],"mappings":"AAMA,iFAAiF;AACjF,MAAM,MAAM,eAAe;AACzB,2CAA2C;AACzC,MAAM;AACR,8DAA8D;GAC5D,SAAS;AACX,uGAAuG;GACrG,OAAO;AACT,oFAAoF;GAClF,YAAY;AACd,iHAAiH;GAC/G,WAAW,CAAC;AAEhB,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACnC,uBAAuB;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yGAAyG;IACzG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,6DAA6D;IAC7D,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,oHAAoH;IACpH,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,qCAAqC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5E,yHAAyH;IACzH,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CACzC;AAED,+FAA+F;AAC/F,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,CAAC,CAAC;AAEtF,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5E,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CACzC;AAMD,qGAAqG;AACrG,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAmCpG;AAED,mHAAmH;AACnH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,qBAAqB,GAAG,SAAS,GAAG,CAAC,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,CAAC,GAAG,SAAS,CAUzI"}

package/dist/server/request-diagnostics.js

@@ -0,0 +1,84 @@
+// Opt-in request diagnostics for the MCP endpoint (#1066). A hosted client can keep a stale tool list although the
+// server serves the current one, and nothing showed what the client actually sends. One entry per request says which
+// JSON-RPC method came, in which session state, with which answer. No token, body, argument value, session id or
+// user identity is ever part of an entry; client-supplied strings are cut and stripped of control characters.
+import { errorLogLabel } from "@softure-ai/core";
+const MAX_TEXT_LENGTH = 128;
+const PROTOCOL_VERSION_HEADER = "mcp-protocol-version";
+const EMPTY_SUMMARY = { method: null, tool: null, client: null, protocolVersion: null };
+/** Client-supplied text as it may be logged: control characters replaced, at most 128 characters. */
+export function sanitizeDiagnosticText(value) {
+    const clean = Array.from(value, (character) => (isControlCharacter(character) ? "?" : character)).join("");
+    return clean.length > MAX_TEXT_LENGTH ? `${clean.slice(0, MAX_TEXT_LENGTH)}…` : clean;
+}
+/**
+ * The method, tool name, `clientInfo` and protocol version of a request, read from a clone of its body. A body over
+ * `maxBytes` or one that is not JSON gives no method (the SDK answers it itself). Nothing else of the body is kept.
+ */
+export async function readJsonRpcSummary(request, maxBytes) {
+    const header = request.headers.get(PROTOCOL_VERSION_HEADER);
+    const headerVersion = header === null ? null : sanitizeDiagnosticText(header);
+    const withHeader = { ...EMPTY_SUMMARY, protocolVersion: headerVersion };
+    if (request.method !== "POST")
+        return withHeader;
+    const length = Number(request.headers.get("content-length") ?? "0");
+    if (!Number.isFinite(length) || length > maxBytes)
+        return withHeader;
+    let body;
+    try {
+        const text = await request.clone().text();
+        if (text.length > maxBytes)
+            return withHeader;
+        body = JSON.parse(text);
+    }
+    catch {
+        // Not JSON or no readable body: the SDK answers that itself; the entry just has no method.
+        return withHeader;
+    }
+    if (Array.isArray(body))
+        return { ...withHeader, method: "batch" };
+    if (!isRecord(body) || typeof body.method !== "string")
+        return withHeader;
+    const method = sanitizeDiagnosticText(body.method);
+    const params = isRecord(body.params) ? body.params : {};
+    if (body.method === "tools/call") {
+        return { ...withHeader, method, tool: typeof params.name === "string" ? sanitizeDiagnosticText(params.name) : null };
+    }
+    if (body.method !== "initialize")
+        return { ...withHeader, method };
+    const clientInfo = isRecord(params.clientInfo) ? params.clientInfo : null;
+    const client = clientInfo === null
+        ? null
+        : {
+            name: typeof clientInfo.name === "string" ? sanitizeDiagnosticText(clientInfo.name) : "",
+            version: typeof clientInfo.version === "string" ? sanitizeDiagnosticText(clientInfo.version) : "",
+        };
+    const protocolVersion = typeof params.protocolVersion === "string" ? sanitizeDiagnosticText(params.protocolVersion) : headerVersion;
+    return { method, tool: null, client, protocolVersion };
+}
+/** The sink for the option, or `undefined` when diagnostics are off. A throwing sink is logged, never rethrown. */
+export function createDiagnosticsSink(diagnostics) {
+    if (diagnostics === undefined || diagnostics === false)
+        return undefined;
+    const write = diagnostics === true ? logDiagnostic : diagnostics;
+    return (entry) => {
+        try {
+            write(entry);
+        }
+        catch (error) {
+            console.error(`@softure-ai/mcp-access: the request diagnostics sink failed: ${errorLogLabel(error)}`);
+        }
+    };
+}
+function logDiagnostic(entry) {
+    console.info(`@softure-ai/mcp-access: mcp request ${JSON.stringify(entry)}`);
+}
+/** C0 controls, DEL and C1 controls: anything that could break or forge a log line. */
+function isControlCharacter(character) {
+    const code = character.codePointAt(0) ?? 0;
+    return code < 0x20 || (code >= 0x7f && code <= 0x9f);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=request-diagnostics.js.map

package/dist/server/request-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-diagnostics.js","sourceRoot":"","sources":["../../src/server/request-diagnostics.ts"],"names":[],"mappings":"AAAA,mHAAmH;AACnH,qHAAqH;AACrH,iHAAiH;AACjH,8GAA8G;AAC9G,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAiDjD,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,uBAAuB,GAAG,sBAAsB,CAAC;AACvD,MAAM,aAAa,GAAmB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;AAExG,qGAAqG;AACrG,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3G,OAAO,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAgB,EAAE,QAAgB;IACzE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,EAAE,GAAG,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,QAAQ;QAAE,OAAO,UAAU,CAAC;IACrE,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ;YAAE,OAAO,UAAU,CAAC;QAC9C,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;QAC3F,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC;IAE1E,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QACjC,OAAO,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvH,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY;QAAE,OAAO,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,CAAC;IACnE,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,MAAM,MAAM,GACV,UAAU,KAAK,IAAI;QACjB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC;YACE,IAAI,EAAE,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;YACxF,OAAO,EAAE,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;SAClG,CAAC;IACR,MAAM,eAAe,GAAG,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IACpI,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACzD,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,qBAAqB,CAAC,WAA8C;IAClF,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACzE,MAAM,KAAK,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;IACjE,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,CAAC,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gEAAgE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxG,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAA2B;IAChD,OAAO,CAAC,IAAI,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,uFAAuF;AACvF,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/module.json

@@ -1,6 +1,6 @@
 {
   "id": "mcp-access",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "dependsOn": { "security": "^0.2.0", "auth": "^0.2.0", "jobs": "^0.1.1?", "ops": "^0.2.0?" },
   "dbSchema": "mcp",
   "tables": ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants", "oauth_registration_window", "used_confirmations", "operation_tasks"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softure-ai/mcp-access",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "SOFTURE AI MCP access module: hashed, scoped, expiring access tokens, a rate-limited Bearer endpoint around the app's MCP server factory, and a token page with client setup instructions for Next.js; tool result helpers with a safe error boundary, a stdio entry, a catalog parity check and the softure-mcp prune command.",
   "license": "MIT",
   "type": "module",

package/src/index.ts

@@ -51,7 +51,7 @@ export const API_TOKEN_RATE_LIMIT_BUCKETS = {
 export const mcpAccess = defineModule({
   manifest: {
     id: MODULE_ID,
-    version: "0.5.0",
+    version: "0.6.0",
     dependsOn: { security: "^0.2.0", auth: "^0.2.0", jobs: "^0.1.1?", ops: "^0.2.0?" },
     dbSchema: "mcp",
     tables: ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants", "oauth_registration_window", "used_confirmations", "operation_tasks"],

package/src/server/endpoint.ts

@@ -25,9 +25,19 @@ import {
   isInitializeRequest,
   isToolListSessionCurrent,
   MCP_SESSION_ID_HEADER,
+  readToolListSessionVersion,
   rewriteInitializeAnswer,
 } from "./tool-list-session.js";
 import { isWritingEnabled } from "./writes-switch.js";
+import {
+  createDiagnosticsSink,
+  readJsonRpcSummary,
+  sanitizeDiagnosticText,
+  type JsonRpcSummary,
+  type McpRequestDiagnostic,
+  type McpRequestDiagnostics,
+  type McpSessionState,
+} from "./request-diagnostics.js";
 
 export { MCP_READ_SCOPE, MCP_WRITE_SCOPE };
 
@@ -60,6 +70,20 @@ export interface McpEndpointOptions {
    * `toolListVersion` (`createMcpServerFactory`). Without either, the endpoint issues no session id.
    */
   readonly toolListVersion?: ToolListVersionReader;
+  /**
+   * Request diagnostics (#1066), off by default: `true` logs one `console.info` line per request, a function receives
+   * each entry. An entry holds the JSON-RPC method, the tool name, the session state, the served tool list version,
+   * the status and the client's `clientInfo` on `initialize`; never a token, body, argument value or identity.
+   */
+  readonly diagnostics?: McpRequestDiagnostics;
+}
+
+/** What serving a request found out, for the diagnostics. */
+interface SessionTrace {
+  session: McpSessionState;
+  sessionVersion: string | null;
+  toolListVersion: string | null;
+  sessionIssued: boolean;
 }
 
 /** Serves one request to the MCP endpoint. */
@@ -71,8 +95,9 @@ export type McpEndpoint = (ctx: McpAccessContext, request: Request) => Promise<R
  * (`responseMode: "json"`): a stream would add proxy buffering and timeouts for no tool that needs
  * it, and mid-call notifications are dropped.
  */
-export function createMcpEndpoint({ createServer, toolListVersion }: McpEndpointOptions): McpEndpoint {
+export function createMcpEndpoint({ createServer, toolListVersion, diagnostics }: McpEndpointOptions): McpEndpoint {
   const readToolListVersion = toolListVersion ?? getFactoryToolListVersion(createServer);
+  const report = createDiagnosticsSink(diagnostics);
   const handler = createMcpHandler(
     (requestContext) => createServer(readIdentity(requestContext.authInfo)),
     {
@@ -83,6 +108,17 @@ export function createMcpEndpoint({ createServer, toolListVersion }: McpEndpoint
   );
 
   return async (ctx, request) => {
+    if (report === undefined) return serve(ctx, request, null);
+    const trace: SessionTrace = { session: "unchecked", sessionVersion: null, toolListVersion: null, sessionIssued: false };
+    // Read before serving: the SDK consumes the body. Only the method, tool name and clientInfo are kept.
+    const summary = await readJsonRpcSummary(request, MAX_MCP_REQUEST_BYTES);
+    const response = await serve(ctx, request, trace);
+    report(createDiagnostic(request, summary, trace, response.status));
+    return response;
+  };
+
+  async function serve(ctx: McpAccessContext, request: Request, trace: SessionTrace | null): Promise<Response> {
+    if (trace !== null && !request.headers.has(MCP_SESSION_ID_HEADER)) trace.session = "none";
     assertRateLimitBucket(ctx);
     const client = identifyClient(ctx, request.headers);
     if (!client.ok) return Response.json({ error: "client_unidentified" }, { status: 400, headers: NO_STORE });
@@ -105,15 +141,15 @@ export function createMcpEndpoint({ createServer, toolListVersion }: McpEndpoint
 
     const authInfo = await authenticate(ctx, request);
     if (authInfo instanceof Response) return authInfo;
-    return serveInSession(request, authInfo);
-  };
+    return serveInSession(request, authInfo, trace);
+  }
 
   /**
    * Sessions tied to the tool list version (#1055): a session from another version (a release changed a tool, or the
    * access level changed) answers 404, so the client initializes again and lists the tools again; `initialize` gets a
    * new session id. A request without a session id is served as it always was.
    */
-  async function serveInSession(request: Request, authInfo: AuthInfo): Promise<Response> {
+  async function serveInSession(request: Request, authInfo: AuthInfo, trace: SessionTrace | null): Promise<Response> {
     const sessionId = request.headers.get(MCP_SESSION_ID_HEADER);
     const isInitialize = sessionId === null && (await isInitializeRequest(request, MAX_MCP_REQUEST_BYTES));
     if (readToolListVersion === undefined || (sessionId === null && !isInitialize)) {
@@ -129,13 +165,44 @@ export function createMcpEndpoint({ createServer, toolListVersion }: McpEndpoint
       const response = await handler.fetch(request, { authInfo });
       return isInitialize ? rewriteInitializeAnswer(response, null) : response;
     }
+    if (trace !== null) trace.toolListVersion = version;
     if (sessionId !== null) {
-      return isToolListSessionCurrent(sessionId, version) ? handler.fetch(request, { authInfo }) : createSessionRenewalResponse();
+      if (isToolListSessionCurrent(sessionId, version)) {
+        if (trace !== null) trace.session = "current";
+        return handler.fetch(request, { authInfo });
+      }
+      if (trace !== null) recordRenewedSession(trace, sessionId);
+      return createSessionRenewalResponse();
     }
-    return rewriteInitializeAnswer(await handler.fetch(request, { authInfo }), createToolListSessionId(version));
+    const response = await rewriteInitializeAnswer(await handler.fetch(request, { authInfo }), createToolListSessionId(version));
+    if (trace !== null) trace.sessionIssued = response.headers.has(MCP_SESSION_ID_HEADER);
+    return response;
   }
 }
 
+/** A session answered 404: stale when the id carries a version, not issued by the endpoint otherwise. */
+function recordRenewedSession(trace: SessionTrace, sessionId: string): void {
+  const sessionVersion = readToolListSessionVersion(sessionId);
+  trace.session = sessionVersion === null ? "not_issued" : "stale";
+  trace.sessionVersion = sessionVersion === null ? null : sanitizeDiagnosticText(sessionVersion);
+}
+
+/** The diagnostics entry of one served request. */
+function createDiagnostic(request: Request, summary: JsonRpcSummary, trace: SessionTrace, status: number): McpRequestDiagnostic {
+  return {
+    httpMethod: request.method,
+    method: summary.method,
+    tool: summary.tool,
+    session: trace.session,
+    sessionVersion: trace.sessionVersion,
+    toolListVersion: trace.toolListVersion,
+    sessionIssued: trace.sessionIssued,
+    status,
+    client: summary.client,
+    protocolVersion: summary.protocolVersion,
+  };
+}
+
 /** The factory's own version reader, when it has one (`createMcpServerFactory`). */
 function getFactoryToolListVersion(factory: McpServerFactory | VersionedMcpServerFactory): ToolListVersionReader | undefined {
   return "toolListVersion" in factory && typeof factory.toolListVersion === "function" ? factory.toolListVersion : undefined;

package/src/server/index.ts

@@ -163,6 +163,7 @@ export {
   MCP_SESSION_ID_HEADER,
   readToolListSessionVersion,
 } from "./tool-list-session.js";
+export { type McpRequestDiagnostic, type McpRequestDiagnostics, type McpSessionState } from "./request-diagnostics.js";
 export {
   toolError,
   toolResult,

package/src/server/request-diagnostics.ts

@@ -0,0 +1,130 @@
+// Opt-in request diagnostics for the MCP endpoint (#1066). A hosted client can keep a stale tool list although the
+// server serves the current one, and nothing showed what the client actually sends. One entry per request says which
+// JSON-RPC method came, in which session state, with which answer. No token, body, argument value, session id or
+// user identity is ever part of an entry; client-supplied strings are cut and stripped of control characters.
+import { errorLogLabel } from "@softure-ai/core";
+
+/** How a request's `Mcp-Session-Id` relates to the tool list version (#1055). */
+export type McpSessionState =
+  /** No session id came with the request. */
+  | "none"
+  /** The session carries the current version and was served. */
+  | "current"
+  /** The session carries another version and was answered 404, so the client should initialize again. */
+  | "stale"
+  /** The session id is not one the endpoint issues; answered 404 like a stale one. */
+  | "not_issued"
+  /** A session id came, but it was not checked (refused before authentication, or no version to check against). */
+  | "unchecked";
+
+/** One request as the diagnostics see it. */
+export interface McpRequestDiagnostic {
+  /** The HTTP method. */
+  readonly httpMethod: string;
+  /** The JSON-RPC method, `"batch"` for an array, `null` when the body was not read or is not JSON-RPC. */
+  readonly method: string | null;
+  /** The tool name of a `tools/call`, otherwise `null`. */
+  readonly tool: string | null;
+  readonly session: McpSessionState;
+  /** The version a stale session carries, otherwise `null`. */
+  readonly sessionVersion: string | null;
+  /** The tool list version served to the identity, `null` when unknown (refused before authentication, no reader). */
+  readonly toolListVersion: string | null;
+  /** Whether the answer issued a new session id (a successful `initialize`). */
+  readonly sessionIssued: boolean;
+  /** The HTTP status of the answer. */
+  readonly status: number;
+  /** The client's `clientInfo` on `initialize`, otherwise `null`. */
+  readonly client: { readonly name: string; readonly version: string } | null;
+  /** The protocol version the client asked for on `initialize`, otherwise the `MCP-Protocol-Version` header, or `null`. */
+  readonly protocolVersion: string | null;
+}
+
+/** `true` logs one `console.info` line per request; a function receives each entry instead. */
+export type McpRequestDiagnostics = boolean | ((entry: McpRequestDiagnostic) => void);
+
+/** What the diagnostics read from a request body. */
+export interface JsonRpcSummary {
+  readonly method: string | null;
+  readonly tool: string | null;
+  readonly client: { readonly name: string; readonly version: string } | null;
+  readonly protocolVersion: string | null;
+}
+
+const MAX_TEXT_LENGTH = 128;
+const PROTOCOL_VERSION_HEADER = "mcp-protocol-version";
+const EMPTY_SUMMARY: JsonRpcSummary = { method: null, tool: null, client: null, protocolVersion: null };
+
+/** Client-supplied text as it may be logged: control characters replaced, at most 128 characters. */
+export function sanitizeDiagnosticText(value: string): string {
+  const clean = Array.from(value, (character) => (isControlCharacter(character) ? "?" : character)).join("");
+  return clean.length > MAX_TEXT_LENGTH ? `${clean.slice(0, MAX_TEXT_LENGTH)}…` : clean;
+}
+
+/**
+ * The method, tool name, `clientInfo` and protocol version of a request, read from a clone of its body. A body over
+ * `maxBytes` or one that is not JSON gives no method (the SDK answers it itself). Nothing else of the body is kept.
+ */
+export async function readJsonRpcSummary(request: Request, maxBytes: number): Promise<JsonRpcSummary> {
+  const header = request.headers.get(PROTOCOL_VERSION_HEADER);
+  const headerVersion = header === null ? null : sanitizeDiagnosticText(header);
+  const withHeader = { ...EMPTY_SUMMARY, protocolVersion: headerVersion };
+  if (request.method !== "POST") return withHeader;
+  const length = Number(request.headers.get("content-length") ?? "0");
+  if (!Number.isFinite(length) || length > maxBytes) return withHeader;
+  let body: unknown;
+  try {
+    const text = await request.clone().text();
+    if (text.length > maxBytes) return withHeader;
+    body = JSON.parse(text);
+  } catch {
+    // Not JSON or no readable body: the SDK answers that itself; the entry just has no method.
+    return withHeader;
+  }
+  if (Array.isArray(body)) return { ...withHeader, method: "batch" };
+  if (!isRecord(body) || typeof body.method !== "string") return withHeader;
+
+  const method = sanitizeDiagnosticText(body.method);
+  const params = isRecord(body.params) ? body.params : {};
+  if (body.method === "tools/call") {
+    return { ...withHeader, method, tool: typeof params.name === "string" ? sanitizeDiagnosticText(params.name) : null };
+  }
+  if (body.method !== "initialize") return { ...withHeader, method };
+  const clientInfo = isRecord(params.clientInfo) ? params.clientInfo : null;
+  const client =
+    clientInfo === null
+      ? null
+      : {
+          name: typeof clientInfo.name === "string" ? sanitizeDiagnosticText(clientInfo.name) : "",
+          version: typeof clientInfo.version === "string" ? sanitizeDiagnosticText(clientInfo.version) : "",
+        };
+  const protocolVersion = typeof params.protocolVersion === "string" ? sanitizeDiagnosticText(params.protocolVersion) : headerVersion;
+  return { method, tool: null, client, protocolVersion };
+}
+
+/** The sink for the option, or `undefined` when diagnostics are off. A throwing sink is logged, never rethrown. */
+export function createDiagnosticsSink(diagnostics: McpRequestDiagnostics | undefined): ((entry: McpRequestDiagnostic) => void) | undefined {
+  if (diagnostics === undefined || diagnostics === false) return undefined;
+  const write = diagnostics === true ? logDiagnostic : diagnostics;
+  return (entry) => {
+    try {
+      write(entry);
+    } catch (error) {
+      console.error(`@softure-ai/mcp-access: the request diagnostics sink failed: ${errorLogLabel(error)}`);
+    }
+  };
+}
+
+function logDiagnostic(entry: McpRequestDiagnostic): void {
+  console.info(`@softure-ai/mcp-access: mcp request ${JSON.stringify(entry)}`);
+}
+
+/** C0 controls, DEL and C1 controls: anything that could break or forge a log line. */
+function isControlCharacter(character: string): boolean {
+  const code = character.codePointAt(0) ?? 0;
+  return code < 0x20 || (code >= 0x7f && code <= 0x9f);
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}