@sonordev/site-kit 4.2.3 → 4.3.0

package/dist/mcp/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/mcp/types.ts","../../src/mcp/protocol.ts","../../src/mcp/serverCard.ts","../../src/mcp/handlers.ts","../../src/mcp/declarative.ts"],"names":[],"mappings":";;;AAsKO,SAAS,cACd,IAAA,EACsB;AACtB,EAAA,OAAO,IAAA;AACT;;;ACtIO,IAAM,2BAAA,GAA8B;AAOpC,IAAM,4BAAA,GAA+B,CAAC,YAAA,EAAc,YAAA,EAAc,YAAY;AAG9E,IAAM,+BAAA,GAAkC;AAAA,EAC7C,2BAAA;AAAA,EACA,GAAG;AACL;AAGO,IAAM,qBAAA,GAAwB;AAC9B,IAAM,gBAAA,GAAmB;AACzB,IAAM,gBAAA,GAAmB;AAMzB,IAAM,mBAAA,GAAsB,MAAA;AAC5B,IAAM,uBAAA,GAA0B,MAAA;AAChC,IAAM,wBAAA,GAA2B;AACjC,IAAM,sBAAA,GAAyB,MAAA;AAG/B,IAAM,yBAAA,GAA4B;AAElC,IAAM,sCAAA,GAAyC;AA4CtD,IAAM,aAAA,GAAgB,GAAA;AAEtB,SAAS,aAAa,KAAA,EAAwC;AAC5D,EAAA,OACE,OAAO,UAAU,QAAA,IACjB,KAAA,KAAU,QACV,KAAA,CAAM,OAAA,CAAS,MAAwB,OAAO,CAAA;AAElD;AAUO,SAAS,aAAa,KAAA,EAA+B;AAC1D,EAAA,IAAI,YAAA,CAAa,KAAK,CAAA,EAAG,OAAO,KAAA;AAEhC,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,CAAA,EAAE;AAAA,EACpD;AAEA,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AACzC,IAAA,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,MAAA,EAAQ,IAAA,EAAM,aAAA,EAAe,CAAA,EAAE;AAAA,EAC5D;AAEA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACN,IAAA,IAAA,GAAO,OAAO,KAAK,CAAA;AAAA,EACrB;AACA,EAAA,IAAI,IAAA,CAAK,SAAS,aAAA,EAAe;AAC/B,IAAA,IAAA,GAAO,CAAA,EAAG,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,aAAa,CAAC;AAAA,kBAAA,CAAA;AAAA,EACxC;AAEA,EAAA,OAAO;AAAA,IACL,SAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,CAAA;AAAA,IAChC,iBAAA,EAAmB;AAAA,GACrB;AACF;AAEO,SAAS,gBAAgB,OAAA,EAAgC;AAC9D,EAAA,OAAO,EAAE,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,CAAA,EAAG,OAAA,EAAS,IAAA,EAAK;AACrE;AAgBO,SAAS,iBAAiB,IAAA,EAAgD;AAC/E,EAAA,MAAM,UAAA,GAAgC;AAAA,IACpC,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,aAAa,IAAA,CAAK,WAAA;AAAA,IAClB,aAAa,IAAA,CAAK;AAAA,GACpB;AACA,EAAA,IAAI,IAAA,CAAK,KAAA,EAAO,UAAA,CAAW,KAAA,GAAQ,IAAA,CAAK,KAAA;AACxC,EAAA,IAAI,IAAA,CAAK,YAAA,EAAc,UAAA,CAAW,YAAA,GAAe,IAAA,CAAK,YAAA;AACtD,EAAA,IAAI,IAAA,CAAK,WAAA,EAAa,UAAA,CAAW,WAAA,GAAc,IAAA,CAAK,WAAA;AACpD,EAAA,OAAO,UAAA;AACT;AAeO,SAAS,YAAA,CACd,MACA,IAAA,EACe;AACf,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,WAAA,CAAY,QAAA,IAAY,EAAC;AAC/C,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,MAAA,CAAO,CAAC,GAAA,KAAQ;AACvC,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAG,CAAA;AACtB,IAAA,OAAO,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,EAAA;AAAA,EAC5D,CAAC,CAAA;AACD,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,OAAO,CAAA,yBAAA,EAA4B,OAAA,CAAQ,MAAA,GAAS,CAAA,GAAI,GAAA,GAAM,EAAE,CAAA,EAAA,EAAK,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAA,EACzF;AAEA,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,MAAM,CAAA,IAAK,MAAA,CAAO,OAAA,CAAQ,IAAA,CAAK,WAAA,CAAY,UAAA,IAAc,EAAE,CAAA,EAAG;AAC7E,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAG,CAAA;AACtB,IAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AAC3C,IAAA,IAAI,OAAO,IAAA,IAAQ,CAAC,OAAO,IAAA,CAAK,QAAA,CAAS,KAAe,CAAA,EAAG;AACzD,MAAA,OAAO,CAAA,mBAAA,EAAsB,GAAG,CAAA,GAAA,EAAM,IAAA,CAAK,UAAU,KAAK,CAAC,sBAAsB,MAAA,CAAO,IAAA,CACrF,IAAI,CAAC,CAAA,KAAM,KAAK,SAAA,CAAU,CAAC,CAAC,CAAA,CAC5B,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAA,IACf;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAaA,SAAS,YAAA,GAAe;AAGtB,EAAA,OAAO,EAAE,KAAA,EAAO,EAAE,WAAA,EAAa,OAAM,EAAE;AACzC;AAEA,SAAS,gBAAgB,IAAA,EAAqB;AAC5C,EAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,OAAA,EAAS,KAAK,OAAA,EAAS,GAAI,IAAA,CAAK,KAAA,GAAQ,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA,EAAM,GAAI,EAAC,EAAG;AAChG;AAMO,SAAS,mBAAmB,OAAA,EAA0B;AAC3D,EAAA,OAAQ,+BAAA,CAAsD,SAAS,OAAO,CAAA;AAChF;AAEA,SAAS,uBAAA,CAAwB,IAAe,SAAA,EAAoC;AAClF,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,QAAA,EAAU;AAAA,MACR,OAAA,EAAS,KAAA;AAAA,MACT,EAAA;AAAA,MACA,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,sCAAA;AAAA,QACN,OAAA,EAAS,8BAAA;AAAA,QACT,MAAM,EAAE,SAAA,EAAW,CAAC,GAAG,+BAA+B,GAAG,SAAA;AAAU;AACrE;AACF,GACF;AACF;AAEO,SAAS,YAAA,CACd,EAAA,EACA,IAAA,EACA,OAAA,EACA,QACA,IAAA,EACiB;AACjB,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,UAAU,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,OAAO,EAAE,IAAA,EAAM,OAAA,EAAS,GAAI,OAAO,EAAE,IAAA,EAAK,GAAI,IAAI;AAAE,GACtF;AACF;AA+BA,eAAsB,QAAA,CACpB,SACA,OAAA,EAC0B;AAC1B,EAAA,MAAM,EAAE,QAAO,GAAI,OAAA;AACnB,EAAA,MAAM,EAAA,GAAK,QAAQ,EAAA,IAAM,IAAA;AACzB,EAAA,MAAM,cAAA,GAAiB,QAAQ,EAAA,KAAO,MAAA;AACtC,EAAA,MAAM,MAAA,GAAU,OAAA,CAAQ,MAAA,IAAU,EAAC;AACnC,EAAA,MAAM,IAAA,GAAQ,MAAA,CAAO,KAAA,IAAS,EAAC;AAI/B,EAAA,MAAM,WAAA,GACJ,OAAO,IAAA,CAAK,qBAAqB,MAAM,QAAA,GAClC,IAAA,CAAK,qBAAqB,CAAA,GAC3B,IAAA;AACN,EAAA,MAAM,aAAA,GAAgB,QAAQ,qBAAA,IAAyB,IAAA;AAEvD,EAAA,IAAI,WAAA,IAAe,aAAA,IAAiB,WAAA,KAAgB,aAAA,EAAe;AACjE,IAAA,OAAO,YAAA;AAAA,MACL,EAAA;AAAA,MACA,yBAAA;AAAA,MACA,CAAA,oDAAA,EAAuD,aAAa,CAAA,6BAAA,EAAgC,WAAW,CAAA,CAAA,CAAA;AAAA,MAC/G;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,mBAAmB,WAAA,IAAe,aAAA;AACxC,EAAA,IAAI,gBAAA,IAAoB,CAAC,kBAAA,CAAmB,gBAAgB,CAAA,EAAG;AAC7D,IAAA,OAAO,uBAAA,CAAwB,IAAI,gBAAgB,CAAA;AAAA,EACrD;AAIA,EAAA,IAAI,OAAA,CAAQ,YAAA,IAAgB,OAAA,CAAQ,YAAA,KAAiB,QAAQ,MAAA,EAAQ;AACnE,IAAA,OAAO,YAAA;AAAA,MACL,EAAA;AAAA,MACA,yBAAA;AAAA,MACA,CAAA,0CAAA,EAA6C,OAAA,CAAQ,YAAY,CAAA,6BAAA,EAAgC,QAAQ,MAAM,CAAA,CAAA,CAAA;AAAA,MAC/G;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,QAAQ,UAAA,EAAY;AACtB,IAAA,MAAM,QAAA,GACJ,OAAO,MAAA,CAAO,IAAA,KAAS,QAAA,GACnB,MAAA,CAAO,IAAA,GACP,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GACpB,MAAA,CAAO,GAAA,GACP,IAAA;AACR,IAAA,IAAI,QAAA,IAAY,OAAA,CAAQ,UAAA,KAAe,QAAA,EAAU;AAC/C,MAAA,OAAO,YAAA;AAAA,QACL,EAAA;AAAA,QACA,yBAAA;AAAA,QACA,CAAA,wCAAA,EAA2C,OAAA,CAAQ,UAAU,CAAA,6BAAA,EAAgC,QAAQ,CAAA,CAAA,CAAA;AAAA,QACrG;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,iBAAiB,WAAA,EAAa;AACxC,IAAA,IAAI,CAAC,aAAA,EAAe;AAClB,MAAA,OAAO,YAAA;AAAA,QACL,EAAA;AAAA,QACA,yBAAA;AAAA,QACA,kEAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,QAAQ,YAAA,EAAc;AACzB,MAAA,OAAO,YAAA;AAAA,QACL,EAAA;AAAA,QACA,yBAAA;AAAA,QACA,wDAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,aAAa,gBAAA,IAAoB,2BAAA;AAEvC,EAAA,QAAQ,QAAQ,MAAA;AAAQ;AAAA,IAEtB,KAAK,iBAAA,EAAmB;AACtB,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,GAAA;AAAA,QACR,QAAA,EAAU;AAAA,UACR,OAAA,EAAS,KAAA;AAAA,UACT,EAAA;AAAA,UACA,MAAA,EAAQ;AAAA,YACN,UAAA,EAAY,UAAA;AAAA,YACZ,iBAAA,EAAmB,CAAC,GAAG,+BAA+B,CAAA;AAAA,YACtD,cAAc,YAAA,EAAa;AAAA,YAC3B,GAAI,MAAA,CAAO,IAAA,CAAK,YAAA,GAAe,EAAE,cAAc,MAAA,CAAO,IAAA,CAAK,YAAA,EAAa,GAAI,EAAC;AAAA,YAC7E,KAAA,EAAO,OAAO,aAAA,IAAiB,IAAA;AAAA,YAC/B,UAAA,EAAY,QAAA;AAAA,YACZ,KAAA,EAAO,EAAE,CAAC,gBAAgB,GAAG,eAAA,CAAgB,MAAA,CAAO,IAAI,CAAA;AAAE;AAC5D;AACF,OACF;AAAA,IACF;AAAA;AAAA,IAGA,KAAK,YAAA,EAAc;AAKjB,MAAA,MAAM,QAAQ,OAAO,MAAA,CAAO,eAAA,KAAoB,QAAA,GAAW,OAAO,eAAA,GAAkB,EAAA;AACpF,MAAA,MAAM,SAAS,kBAAA,CAAmB,KAAK,CAAA,GAAI,KAAA,GAAQ,6BAA6B,CAAC,CAAA;AACjF,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,GAAA;AAAA,QACR,QAAA,EAAU;AAAA,UACR,OAAA,EAAS,KAAA;AAAA,UACT,EAAA;AAAA,UACA,MAAA,EAAQ;AAAA,YACN,eAAA,EAAiB,MAAA;AAAA,YACjB,cAAc,YAAA,EAAa;AAAA,YAC3B,UAAA,EAAY,eAAA,CAAgB,MAAA,CAAO,IAAI,CAAA;AAAA,YACvC,GAAI,MAAA,CAAO,IAAA,CAAK,YAAA,GAAe,EAAE,cAAc,MAAA,CAAO,IAAA,CAAK,YAAA,EAAa,GAAI;AAAC;AAC/E;AACF,OACF;AAAA,IACF;AAAA,IAEA,KAAK,2BAAA;AAAA,IACL,KAAK,aAAA;AACH,MAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,QAAA,EAAU,IAAA,EAAK;AAAA,IAEvC,KAAK,MAAA;AACH,MAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,QAAA,EAAU,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,MAAA,EAAQ,EAAC,EAAE,EAAE;AAAA;AAAA,IAGrE,KAAK,YAAA,EAAc;AACjB,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAClB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,YAAA,KAAiB,KAAK,EACtC,GAAA,CAAI,CAAC,CAAA,KAAM,gBAAA,CAAiB,CAAC,CAAC,CAAA;AACjC,MAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,QAAA,EAAU,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,MAAA,EAAQ,EAAE,KAAA,EAAM,EAAE,EAAE;AAAA,IAC5E;AAAA,IAEA,KAAK,YAAA,EAAc;AACjB,MAAA,MAAM,OAAO,OAAO,MAAA,CAAO,IAAA,KAAS,QAAA,GAAW,OAAO,IAAA,GAAO,EAAA;AAC7D,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,IAAA,IAAQ,CAAA,CAAE,YAAA,KAAiB,KAAK,CAAA;AAEjF,MAAA,IAAI,CAAC,IAAA,EAAM;AACT,QAAA,OAAO,YAAA;AAAA,UACL,EAAA;AAAA,UACA,sBAAA;AAAA,UACA,CAAA,cAAA,EAAiB,QAAQ,QAAQ,CAAA,CAAA;AAAA,UACjC,GAAA;AAAA,UACA;AAAA,YACE,SAAA,EAAW,MAAA,CAAO,KAAA,CACf,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,YAAA,KAAiB,KAAK,CAAA,CACtC,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAI;AAAA;AACtB,SACF;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAQ,MAAA,CAAO,SAAA,IAAa,EAAC;AACnC,MAAA,MAAM,OAAA,GAAU,YAAA,CAAa,IAAA,EAAM,IAAI,CAAA;AACvC,MAAA,IAAI,OAAA,EAAS;AAKX,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,GAAA;AAAA,UACR,QAAA,EAAU,EAAE,OAAA,EAAS,KAAA,EAAO,IAAI,MAAA,EAAQ,eAAA,CAAgB,OAAO,CAAA;AAAE,SACnE;AAAA,MACF;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,MAAO,IAAA,CAAK,OAAA,CAGV,IAAA,EAAM;AAAA,UAClB,GAAG,OAAA,CAAQ,OAAA;AAAA,UACX,OAAA,EAAS,MAAA;AAAA,UACT,eAAA,EAAiB;AAAA,SAClB,CAAA;AACD,QAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,QAAA,EAAU,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,MAAA,EAAQ,YAAA,CAAa,GAAG,CAAA,EAAE,EAAE;AAAA,MACpF,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,SAAS,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACpE,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,GAAA;AAAA,UACR,QAAA,EAAU;AAAA,YACR,OAAA,EAAS,KAAA;AAAA,YACT,EAAA;AAAA,YACA,QAAQ,eAAA,CAAgB,CAAA,MAAA,EAAS,KAAK,IAAI,CAAA,UAAA,EAAa,MAAM,CAAA,CAAE;AAAA;AACjE,SACF;AAAA,MACF;AAAA,IACF;AAAA;AAAA;AAAA,IAIA,KAAK,gBAAA;AACH,MAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,QAAA,EAAU,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,MAAA,EAAQ,EAAE,SAAA,EAAW,EAAC,IAAI,EAAE;AAAA,IACpF,KAAK,cAAA;AACH,MAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,QAAA,EAAU,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,MAAA,EAAQ,EAAE,OAAA,EAAS,EAAC,IAAI,EAAE;AAAA,IAElF,SAAS;AACP,MAAA,IAAI,gBAAgB,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,UAAU,IAAA,EAAK;AAGzD,MAAA,OAAO,aAAa,EAAA,EAAI,wBAAA,EAA0B,qBAAqB,OAAA,CAAQ,MAAM,IAAI,GAAG,CAAA;AAAA,IAC9F;AAAA;AAEJ;;;AC9eO,IAAM,sBAAA,GACX;AAGK,IAAM,oBAAA,GAAuB;AAE7B,IAAM,2BAAA,GAA8B;AAQpC,IAAM,sBAAA,GAAyB;AAyC/B,SAAS,mBAAmB,OAAA,EAAmD;AACpF,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC9C,EAAA,MAAM,IAAA,GAAO,QAAQ,OAAA,IAAW,UAAA;AAChC,EAAA,MAAM,MAAA,GAAS,CAAA,EAAG,IAAI,CAAA,EAAG,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,IAAA,GAAO,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA,CAAA;AAEjE,EAAA,MAAM,IAAA,GAAsB;AAAA,IAC1B,OAAA,EAAS,sBAAA;AAAA,IACT,IAAA,EAAM,QAAQ,IAAA,CAAK,IAAA;AAAA,IACnB,OAAA,EAAS,QAAQ,IAAA,CAAK,OAAA;AAAA,IACtB,WAAA,EAAa,QAAQ,IAAA,CAAK,WAAA;AAAA,IAC1B,OAAA,EAAS;AAAA,MACP;AAAA,QACE,IAAA,EAAM,iBAAA;AAAA,QACN,GAAA,EAAK,MAAA;AAAA,QACL,yBAAA,EAA2B,CAAC,GAAG,+BAA+B;AAAA,OAChE;AAAA,MACA,GAAI,OAAA,CAAQ,iBAAA,IAAqB;AAAC;AACpC,GACF;AAEA,EAAA,IAAI,QAAQ,IAAA,CAAK,KAAA,EAAO,IAAA,CAAK,KAAA,GAAQ,QAAQ,IAAA,CAAK,KAAA;AAClD,EAAA,IAAI,OAAA,CAAQ,KAAK,UAAA,IAAc,IAAA,OAAW,UAAA,GAAa,OAAA,CAAQ,KAAK,UAAA,IAAc,IAAA;AAClF,EAAA,IAAI,OAAA,CAAQ,KAAA,EAAO,MAAA,EAAQ,IAAA,CAAK,QAAQ,OAAA,CAAQ,KAAA;AAEhD,EAAA,MAAM,OAAgC,EAAC;AACvC,EAAA,IAAI,OAAA,CAAQ,KAAK,YAAA,EAAc;AAC7B,IAAA,IAAA,CAAK,gCAAgC,CAAA,GAAI,OAAA,CAAQ,IAAA,CAAK,YAAA;AAAA,EACxD;AACA,EAAA,IAAI,OAAA,CAAQ,OAAO,MAAA,EAAQ;AACzB,IAAA,IAAA,CAAK,sBAAsB,CAAA,GAAI,OAAA,CAAQ,KAAA,CACpC,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,YAAA,KAAiB,KAAK,CAAA,CACtC,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,MACX,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,GAAI,EAAE,KAAA,GAAQ,EAAE,OAAO,CAAA,CAAE,KAAA,KAAU,EAAC;AAAA,MACpC,aAAa,CAAA,CAAE,WAAA;AAAA,MACf,QAAA,EAAU,CAAA,CAAE,WAAA,EAAa,YAAA,IAAgB;AAAA,KAC3C,CAAE,CAAA;AAAA,EACN;AACA,EAAA,IAAI,OAAO,IAAA,CAAK,IAAI,EAAE,MAAA,GAAS,CAAA,OAAQ,KAAA,GAAQ,IAAA;AAE/C,EAAA,OAAO,IAAA;AACT;AAOO,SAAS,sBAAsB,IAAA,EAA+B;AACnE,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,IAAI,IAAA,CAAK,YAAY,sBAAA,EAAwB;AAC3C,IAAA,QAAA,CAAS,IAAA,CAAK,CAAA,mBAAA,EAAsB,sBAAsB,CAAA,CAAA,CAAG,CAAA;AAAA,EAC/D;AAGA,EAAA,IAAI,CAAC,oBAAA,CAAqB,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA,EAAG;AACzC,IAAA,QAAA,CAAS,IAAA;AAAA,MACP,CAAA,MAAA,EAAS,KAAK,IAAI,CAAA,8EAAA;AAAA,KACpB;AAAA,EACF;AACA,EAAA,IAAI,CAAC,4BAAA,CAA6B,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,EAAG;AACpD,IAAA,QAAA,CAAS,IAAA,CAAK,CAAA,SAAA,EAAY,IAAA,CAAK,OAAO,CAAA,yCAAA,CAA2C,CAAA;AAAA,EACnF;AACA,EAAA,IAAI,CAAC,IAAA,CAAK,WAAA,EAAa,MAAK,EAAG,QAAA,CAAS,KAAK,yBAAyB,CAAA;AAEtE,EAAA,KAAA,MAAW,MAAA,IAAU,IAAA,CAAK,OAAA,IAAW,EAAC,EAAG;AACvC,IAAA,IAAI,CAAC,aAAA,CAAc,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,IAAK,CAAC,qBAAA,CAAsB,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,EAAG;AAC9E,MAAA,QAAA,CAAS,IAAA,CAAK,CAAA,YAAA,EAAe,MAAA,CAAO,GAAG,CAAA,gDAAA,CAAkD,CAAA;AAAA,IAC3F;AAAA,EACF;AAEA,EAAA,OAAO,QAAA;AACT;;;AChHA,IAAM,mBAAA,GAAsB;AAAA,EAC1B,cAAA;AAAA,EACA,QAAA;AAAA,EACA,eAAA;AAAA,EACA,sBAAA;AAAA,EACA,YAAA;AAAA,EACA,UAAA;AAAA,EACA,gBAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,YAAY,MAAA,EAAwC;AAC3D,EAAA,OAAO;AAAA,IACL,6BAAA,EAA+B,MAAA;AAAA,IAC/B,8BAAA,EAAgC,eAAA;AAAA,IAChC,8BAAA,EAAgC,mBAAA,CAAoB,IAAA,CAAK,IAAI,CAAA;AAAA,IAC7D,+BAAA,EAAiC,sBAAA;AAAA,IACjC,wBAAA,EAA0B;AAAA,GAC5B;AACF;AAUO,SAAS,kBAAkB,KAAA,EAAqC;AACrE,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,EAAA,MAAM,KAAA,GAAQ,sBAAA,CAAuB,IAAA,CAAK,KAAK,CAAA;AAC/C,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,EAAA,IAAI;AACF,IAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAC9B,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,CAAC,CAAC,CAAA;AAC5B,MAAA,MAAM,KAAA,GAAQ,WAAW,IAAA,CAAK,MAAA,EAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAC,CAAA;AAC5D,MAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA;AAAA,IACvC;AACA,IAAA,OAAO,MAAA,CAAO,KAAK,KAAA,CAAM,CAAC,GAAG,QAAQ,CAAA,CAAE,SAAS,MAAM,CAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAgCA,SAAS,aAAA,CAAc,SAAkB,OAAA,EAAoD;AAC3F,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AAC3C,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,KAAY,GAAA,EAAK,OAAO,GAAA;AACxC,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,OAAA,CAAQ,CAAC,CAAA,IAAK,GAAA;AAClC,EAAA,OAAO,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,GAAI,MAAA,GAAS,IAAA;AAC7C;AAEA,SAAS,IAAA,CAAK,IAAA,EAAe,MAAA,EAAgB,OAAA,EAA2C;AACtF,EAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG;AAAA,IACxC,MAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACP,cAAA,EAAgB,kBAAA;AAAA,MAChB,eAAA,EAAiB,UAAA;AAAA,MACjB,GAAG;AAAA;AACL,GACD,CAAA;AACH;AAeO,SAAS,iBAAiB,OAAA,EAA8C;AAC7E,EAAA,MAAM,EAAE,QAAO,GAAI,OAAA;AAEnB,EAAA,eAAe,KAAK,OAAA,EAAqC;AACvD,IAAA,MAAM,MAAA,GAAS,aAAA,CAAc,OAAA,EAAS,OAAA,CAAQ,cAAc,CAAA;AAC5D,IAAA,IAAI,WAAW,IAAA,EAAM;AAGnB,MAAA,OAAO,IAAA;AAAA,QACL,EAAE,SAAS,KAAA,EAAO,KAAA,EAAO,EAAE,IAAA,EAAM,uBAAA,EAAyB,OAAA,EAAS,oBAAA,EAAqB,EAAE;AAAA,QAC1F,GAAA;AAAA,QACA;AAAC,OACH;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,YAAY,MAAM,CAAA;AAE/B,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,MAAM,QAAQ,IAAA,EAAK;AAAA,IAC/B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,QACL,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,IAAA,EAAM,KAAA,EAAO,EAAE,IAAA,EAAM,mBAAA,EAAqB,OAAA,EAAS,aAAA,EAAc,EAAE;AAAA,QACzF,GAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,qBAAA,GAAwB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,sBAAsB,CAAA;AACxE,IAAA,MAAM,eAAe,iBAAA,CAAkB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAC,CAAA;AACxE,IAAA,MAAM,aAAa,iBAAA,CAAkB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAC,CAAA;AAEpE,IAAA,MAAM,eAAA,GAAkB;AAAA,MACtB,MAAA;AAAA,MACA,OAAA,EAAS;AAAA,QACP,SAAS,OAAA,CAAQ,OAAA;AAAA,QACjB,OAAA;AAAA,QACA,QAAQ,OAAA,CAAQ;AAAA,OAClB;AAAA,MACA,qBAAA;AAAA,MACA,YAAA;AAAA,MACA,UAAA;AAAA,MACA,eAAe,OAAA,CAAQ;AAAA,KACzB;AAKA,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC1B,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA;AAAA,QAC7B,QAAQ,GAAA,CAAI,CAAC,MAAM,QAAA,CAAS,CAAA,EAAqB,eAAe,CAAC;AAAA,OACnE;AACA,MAAA,MAAM,SAAA,GAAY,SAAS,GAAA,CAAI,CAAC,MAAM,CAAA,CAAE,QAAQ,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA;AAChE,MAAA,IAAI,SAAA,CAAU,MAAA,KAAW,CAAA,EAAG,OAAO,IAAI,QAAA,CAAS,IAAA,EAAM,EAAE,MAAA,EAAQ,GAAA,EAAK,OAAA,EAAS,IAAA,EAAM,CAAA;AACpF,MAAA,OAAO,IAAA,CAAK,WAAW,GAAA,EAAK;AAAA,QAC1B,GAAG,IAAA;AAAA,QACH,wBAAwB,qBAAA,IAAyB;AAAA,OAClD,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,OAAA,GAAU,OAAA;AAChB,IAAA,IAAI,CAAC,WAAW,OAAO,OAAA,KAAY,YAAY,OAAO,OAAA,CAAQ,WAAW,QAAA,EAAU;AACjF,MAAA,MAAM,GAAA,GAAM,YAAA,CAAa,IAAA,EAAM,uBAAA,EAAyB,mBAAmB,GAAG,CAAA;AAC9E,MAAA,OAAO,IAAA,CAAK,GAAA,CAAI,QAAA,EAAU,GAAA,CAAI,QAAQ,IAAI,CAAA;AAAA,IAC5C;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,OAAA,EAAS,eAAe,CAAA;AAEvD,IAAA,IAAI,OAAA,CAAQ,aAAa,IAAA,EAAM;AAE7B,MAAA,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,GAAA,EAAK,OAAA,EAAS,MAAM,CAAA;AAAA,IAC1D;AAEA,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,QAAA,EAAU,OAAA,CAAQ,MAAA,EAAQ;AAAA,MAC5C,GAAG,IAAA;AAAA,MACH,wBAAwB,qBAAA,IAAyB;AAAA,KAClD,CAAA;AAAA,EACH;AAKA,EAAA,eAAe,iBAAiB,OAAA,EAAqC;AACnE,IAAA,MAAM,MAAA,GAAS,aAAA,CAAc,OAAA,EAAS,OAAA,CAAQ,cAAc,CAAA,IAAK,GAAA;AACjE,IAAA,OAAO,IAAI,QAAA;AAAA,MACT,KAAK,SAAA,CAAU;AAAA,QACb,OAAA,EAAS,KAAA;AAAA,QACT,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,uBAAA;AAAA,UACN,OAAA,EACE;AAAA;AACJ,OACD,CAAA;AAAA,MACD;AAAA,QACE,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,KAAA,EAAO,eAAA;AAAA,UACP,GAAG,YAAY,MAAM;AAAA;AACvB;AACF,KACF;AAAA,EACF;AAEA,EAAA,eAAe,QAAQ,OAAA,EAAqC;AAC1D,IAAA,MAAM,MAAA,GAAS,aAAA,CAAc,OAAA,EAAS,OAAA,CAAQ,cAAc,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,MAAM,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAC9D,IAAA,OAAO,IAAI,QAAA,CAAS,IAAA,EAAM,EAAE,MAAA,EAAQ,KAAK,OAAA,EAAS,WAAA,CAAY,MAAM,CAAA,EAAG,CAAA;AAAA,EACzE;AAEA,EAAA,OAAO,EAAE,IAAA,EAAM,GAAA,EAAK,gBAAA,EAAkB,MAAA,EAAQ,kBAAkB,OAAA,EAAQ;AAC1E;AAsCO,SAAS,2BACd,OAAA,EAC4B;AAC5B,EAAA,MAAM,IAAA,GAAsB,mBAAmB,OAAO,CAAA;AACtD,EAAA,MAAM,OAAO,CAAA,EAAG,IAAA,CAAK,UAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAC;AAAA,CAAA;AAC7C,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,IAAA;AAEjC,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,eAAA,EAAiB,mBAAmB,MAAM,CAAA,CAAA;AAAA;AAAA,IAE1C,6BAAA,EAA+B,GAAA;AAAA,IAC/B,8BAAA,EAAgC,cAAA;AAAA,IAChC,8BAAA,EAAgC;AAAA,GAClC;AAEA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,YAAY,IAAI,QAAA,CAAS,MAAM,EAAE,MAAA,EAAQ,GAAA,EAAK,OAAA,EAAS,CAAA;AAAA,IAC5D,OAAA,EAAS,YAAY,IAAI,QAAA,CAAS,MAAM,EAAE,MAAA,EAAQ,GAAA,EAAK,OAAA,EAAS;AAAA,GAClE;AACF;;;ACjQO,SAAS,oBACd,OAAA,EAC+B;AAC/B,EAAA,MAAM,UAAA,GAA4C;AAAA,IAChD,UAAU,OAAA,CAAQ,IAAA;AAAA,IAClB,iBAAiB,OAAA,CAAQ;AAAA,GAC3B;AAGA,EAAA,IAAI,OAAA,CAAQ,UAAA,EAAY,UAAA,CAAW,cAAA,GAAiB,EAAA;AACpD,EAAA,OAAO,UAAA;AACT;AAuBO,SAAS,qBAAqB,WAAA,EAAqD;AACxF,EAAA,OAAO,EAAE,sBAAsB,WAAA,EAAY;AAC7C","file":"index.mjs","sourcesContent":["/**\n * @sonordev/site-kit/mcp — shared types\n *\n * ONE tool definition, THREE surfaces. A `SiteKitMcpTool` is consumed by:\n *\n *   1. the remote MCP endpoint  (`createMcpHandler`)      — off-browser agents\n *   2. the in-page WebMCP API   (`<WebMcpTools>`)         — browser agents\n *   3. the MCP Server Card      (`buildMcpServerCard`)    — discovery only\n *\n * Keeping the definition in one shape is the whole point: the tool an agent\n * finds by crawling `/.well-known/mcp.json` and the tool it finds by driving a\n * browser to the page are the same tool, with the same schema and the same\n * handler. Two definitions would drift the way the two Square token refreshers\n * drifted (see the root CLAUDE.md \"Consolidate Duplicated Logic\" note).\n */\n\n// ============================================\n// JSON Schema (the subset MCP tool inputs use)\n// ============================================\n\n/** A JSON Schema node. Deliberately loose — MCP passes these through verbatim. */\nexport interface JsonSchemaNode {\n  type?: 'object' | 'array' | 'string' | 'number' | 'integer' | 'boolean' | 'null'\n  description?: string\n  enum?: readonly (string | number | boolean | null)[]\n  default?: unknown\n  items?: JsonSchemaNode\n  properties?: Record<string, JsonSchemaNode>\n  required?: readonly string[]\n  additionalProperties?: boolean | JsonSchemaNode\n  minimum?: number\n  maximum?: number\n  minLength?: number\n  maxLength?: number\n  pattern?: string\n  format?: string\n  /** MCP 2026-07-28: mirror this param into an `Mcp-Param-{name}` HTTP header. */\n  'x-mcp-header'?: string\n  [key: string]: unknown\n}\n\n/** Tool input schemas are always objects at the root, per the MCP spec. */\nexport interface JsonSchemaObject extends JsonSchemaNode {\n  type: 'object'\n  properties?: Record<string, JsonSchemaNode>\n  required?: readonly string[]\n}\n\n// ============================================\n// Tool results\n// ============================================\n\nexport interface McpTextContent {\n  type: 'text'\n  text: string\n}\n\nexport interface McpResourceLinkContent {\n  type: 'resource_link'\n  uri: string\n  name?: string\n  description?: string\n  mimeType?: string\n}\n\nexport type McpContent = McpTextContent | McpResourceLinkContent\n\nexport interface McpToolResult {\n  content: McpContent[]\n  /** Machine-readable payload. Agents prefer this over parsing `content`. */\n  structuredContent?: unknown\n  isError?: boolean\n}\n\n/**\n * What a handler may return. Anything that is not already an `McpToolResult`\n * is normalized by `toToolResult()`: objects become pretty JSON in a text block\n * AND are carried verbatim as `structuredContent`, so an agent can either read\n * the prose or consume the data.\n */\nexport type McpToolHandlerResult =\n  | McpToolResult\n  // `object` rather than `Record<string, unknown>` on purpose: a plain\n  // `interface` has no index signature, so it does NOT satisfy Record and a\n  // handler returning a typed shape would fail to compile for no good reason.\n  | object\n  | string\n  | number\n  | boolean\n  | null\n\n/**\n * Behavioural hints. These are advisory — the spec is explicit that clients\n * must not make security decisions from them — but good agents use them to\n * decide what needs a human in the loop, so setting them honestly matters.\n */\nexport interface McpToolAnnotations {\n  title?: string\n  /** Tool does not modify anything. Every \"look something up\" tool is one. */\n  readOnlyHint?: boolean\n  /** Tool may perform irreversible updates. Anything creating a CRM record is. */\n  destructiveHint?: boolean\n  /** Calling twice with the same args changes nothing extra. */\n  idempotentHint?: boolean\n  /** Tool touches the open internet / third parties. */\n  openWorldHint?: boolean\n}\n\n/** Context handed to every tool handler. */\nexport interface McpToolContext {\n  /** Where the call came in from: the remote endpoint or the in-page API. */\n  surface: 'http' | 'webmcp'\n  /** Absolute site origin, e.g. `https://upforge.io`. */\n  baseUrl?: string\n  /** The originating Request, when the call arrived over HTTP. */\n  request?: Request\n  /** Negotiated protocol version, when known. */\n  protocolVersion?: string\n  /** Abort signal — WebMCP passes one; HTTP passes the request's. */\n  signal?: AbortSignal\n}\n\nexport type McpToolHandler<Args = Record<string, unknown>> = (\n  args: Args,\n  context: McpToolContext,\n) => Promise<McpToolHandlerResult> | McpToolHandlerResult\n\n// ============================================\n// The tool definition\n// ============================================\n\nexport interface SiteKitMcpTool<Args = Record<string, unknown>> {\n  /**\n   * Machine name. Keep it `snake_case` and verb-led (`get_services`,\n   * `request_site_audit`) — this is the string a model reasons about, and the\n   * spec only SHOULDs header-safe characters, so stick to `[a-z0-9_]`.\n   */\n  name: string\n  /** Human display name for tool pickers. */\n  title?: string\n  /**\n   * What the tool does, in the voice of someone explaining it to a colleague.\n   * This is the single highest-leverage field in the whole module: it is the\n   * only thing a model reads when deciding whether to call the tool.\n   */\n  description: string\n  inputSchema: JsonSchemaObject\n  /** Optional schema for `structuredContent`. */\n  outputSchema?: JsonSchemaObject\n  annotations?: McpToolAnnotations\n  handler: McpToolHandler<Args>\n  /**\n   * Set false to keep a tool off the in-page WebMCP surface while still\n   * serving it from the remote endpoint (default: true). Useful for tools\n   * whose handler needs server-only secrets.\n   */\n  exposeToWebMcp?: boolean\n  /**\n   * Set false to keep a tool off the remote HTTP endpoint while still\n   * registering it in-page (default: true). Useful for tools that only make\n   * sense against live DOM state.\n   */\n  exposeToHttp?: boolean\n}\n\n/** Identity-function helper: gives you inference + autocomplete on the schema. */\nexport function defineMcpTool<Args = Record<string, unknown>>(\n  tool: SiteKitMcpTool<Args>,\n): SiteKitMcpTool<Args> {\n  return tool\n}\n\n// ============================================\n// Server identity\n// ============================================\n\nexport interface McpServerInfo {\n  /**\n   * Reverse-DNS name with exactly one forward slash, per SEP-2127:\n   * `io.upforge/site`. The part before the slash is a namespace you control.\n   */\n  name: string\n  /** Semver. No ranges. */\n  version: string\n  /** Display name. */\n  title?: string\n  /** One or two sentences an agent reads before connecting. */\n  description: string\n  websiteUrl?: string\n  /** Natural-language guidance for models on how to use this server well. */\n  instructions?: string\n}\n\nexport interface McpServerIcon {\n  src: string\n  mimeType?: string\n  sizes?: string\n  theme?: 'light' | 'dark'\n}\n","/**\n * @sonordev/site-kit/mcp — MCP wire protocol (transport-agnostic)\n *\n * A dependency-free implementation of the server half of MCP, covering BOTH\n * protocol eras (the spec's own term — see /specification/2026-07-28/basic/versioning):\n *\n *   modern (2026-07-28)  stateless; every request carries its protocol version\n *                        in `_meta`, mirrored into the `MCP-Protocol-Version`\n *                        header. `server/discover` replaces the handshake.\n *                        No sessions, no GET stream.\n *\n *   legacy (<= 2025-11-25)  `initialize` handshake, then `tools/list`.\n *                        Still what most shipped clients and SDKs speak, so\n *                        dropping it would mean \"spec-compliant and unusable\".\n *\n * We deliberately do NOT depend on `@modelcontextprotocol/sdk`. The server\n * surface we need is a few hundred lines of JSON-RPC, and site-kit ships to\n * every marketing site in the fleet — an SDK in `dependencies` would land in\n * every one of those installs to save code we'd have to wrap anyway.\n *\n * This file is pure: it takes a parsed JSON-RPC message and returns a response\n * object. Anything HTTP-shaped lives in `handlers.ts`.\n */\n\nimport type {\n  McpServerInfo,\n  McpToolContext,\n  McpToolResult,\n  SiteKitMcpTool,\n} from './types'\n\n// ============================================\n// Protocol versions\n// ============================================\n\n/** Current revision: stateless, per-request `_meta`, `server/discover`. */\nexport const MCP_PROTOCOL_VERSION_MODERN = '2026-07-28'\n\n/**\n * Handshake-based revisions we still answer. Ordered newest-first — this is\n * also the preference order when a legacy client asks for something we don't\n * know, in which case the spec says to reply with our own best version.\n */\nexport const MCP_PROTOCOL_VERSIONS_LEGACY = ['2025-11-25', '2025-06-18', '2025-03-26'] as const\n\n/** Everything we accept, newest first. Advertised verbatim in errors. */\nexport const MCP_SUPPORTED_PROTOCOL_VERSIONS = [\n  MCP_PROTOCOL_VERSION_MODERN,\n  ...MCP_PROTOCOL_VERSIONS_LEGACY,\n] as const\n\n/** `_meta` keys defined by the modern revision. */\nexport const META_PROTOCOL_VERSION = 'io.modelcontextprotocol/protocolVersion'\nexport const META_CLIENT_INFO = 'io.modelcontextprotocol/clientInfo'\nexport const META_SERVER_INFO = 'io.modelcontextprotocol/serverInfo'\n\n// ============================================\n// JSON-RPC error codes\n// ============================================\n\nexport const JSONRPC_PARSE_ERROR = -32700\nexport const JSONRPC_INVALID_REQUEST = -32600\nexport const JSONRPC_METHOD_NOT_FOUND = -32601\nexport const JSONRPC_INVALID_PARAMS = -32602\nexport const JSONRPC_INTERNAL_ERROR = -32603\n/** MCP-defined: headers disagree with the body. */\nexport const MCP_ERROR_HEADER_MISMATCH = -32020\n/** MCP-defined: we don't speak the version the client asked for. */\nexport const MCP_ERROR_UNSUPPORTED_PROTOCOL_VERSION = -32022\n\n// ============================================\n// Message shapes\n// ============================================\n\nexport type JsonRpcId = string | number | null\n\nexport interface JsonRpcRequest {\n  jsonrpc: '2.0'\n  id?: JsonRpcId\n  method: string\n  params?: Record<string, unknown>\n}\n\nexport interface JsonRpcError {\n  code: number\n  message: string\n  data?: unknown\n}\n\nexport interface JsonRpcResponse {\n  jsonrpc: '2.0'\n  id: JsonRpcId\n  result?: unknown\n  error?: JsonRpcError\n}\n\n/**\n * A response plus the HTTP status the transport should use. The spec pins\n * specific statuses to specific errors (404 for unknown method, 400 for\n * version/header problems), so the status is part of the protocol, not a\n * transport detail the caller gets to invent.\n */\nexport interface DispatchOutcome {\n  /** null for an accepted notification — the transport answers 202. */\n  response: JsonRpcResponse | null\n  status: number\n}\n\n// ============================================\n// Result normalization\n// ============================================\n\nconst MAX_JSON_TEXT = 60_000\n\nfunction isToolResult(value: unknown): value is McpToolResult {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    Array.isArray((value as McpToolResult).content)\n  )\n}\n\n/**\n * Normalize whatever a handler returned into a spec-shaped tool result.\n *\n * Structured data is emitted BOTH ways on purpose: as `structuredContent` for\n * agents that parse, and as pretty JSON inside a text block for agents (still\n * the majority) that only read `content`. Returning one or the other is how\n * you end up invisible to half the ecosystem.\n */\nexport function toToolResult(value: unknown): McpToolResult {\n  if (isToolResult(value)) return value\n\n  if (typeof value === 'string') {\n    return { content: [{ type: 'text', text: value }] }\n  }\n\n  if (value === undefined || value === null) {\n    return { content: [{ type: 'text', text: '(no result)' }] }\n  }\n\n  let text: string\n  try {\n    text = JSON.stringify(value, null, 2)\n  } catch {\n    text = String(value)\n  }\n  if (text.length > MAX_JSON_TEXT) {\n    text = `${text.slice(0, MAX_JSON_TEXT)}\\n… (truncated)`\n  }\n\n  return {\n    content: [{ type: 'text', text }],\n    structuredContent: value,\n  }\n}\n\nexport function toolErrorResult(message: string): McpToolResult {\n  return { content: [{ type: 'text', text: message }], isError: true }\n}\n\n// ============================================\n// Tool descriptors\n// ============================================\n\nexport interface McpToolDescriptor {\n  name: string\n  title?: string\n  description: string\n  inputSchema: unknown\n  outputSchema?: unknown\n  annotations?: unknown\n}\n\n/** The public face of a tool — everything except the handler. */\nexport function toToolDescriptor(tool: SiteKitMcpTool<never>): McpToolDescriptor {\n  const descriptor: McpToolDescriptor = {\n    name: tool.name,\n    description: tool.description,\n    inputSchema: tool.inputSchema,\n  }\n  if (tool.title) descriptor.title = tool.title\n  if (tool.outputSchema) descriptor.outputSchema = tool.outputSchema\n  if (tool.annotations) descriptor.annotations = tool.annotations\n  return descriptor\n}\n\n// ============================================\n// Argument validation\n// ============================================\n\n/**\n * Minimal required-field + enum check.\n *\n * Intentionally shallow. A full JSON Schema validator is a dependency and a\n * maintenance surface, and the failure it would catch — a model inventing a\n * field — is better handled by the handler itself returning a helpful\n * `isError` result the model can read and retry against. What we DO enforce is\n * the part a model cannot recover from on its own: a missing required argument.\n */\nexport function validateArgs(\n  tool: SiteKitMcpTool<never>,\n  args: Record<string, unknown>,\n): string | null {\n  const required = tool.inputSchema.required ?? []\n  const missing = required.filter((key) => {\n    const value = args[key]\n    return value === undefined || value === null || value === ''\n  })\n  if (missing.length > 0) {\n    return `Missing required argument${missing.length > 1 ? 's' : ''}: ${missing.join(', ')}.`\n  }\n\n  for (const [key, schema] of Object.entries(tool.inputSchema.properties ?? {})) {\n    const value = args[key]\n    if (value === undefined || value === null) continue\n    if (schema.enum && !schema.enum.includes(value as string)) {\n      return `Invalid value for \"${key}\": ${JSON.stringify(value)}. Expected one of: ${schema.enum\n        .map((v) => JSON.stringify(v))\n        .join(', ')}.`\n    }\n  }\n\n  return null\n}\n\n// ============================================\n// Server definition\n// ============================================\n\nexport interface McpServerDefinition {\n  info: McpServerInfo\n  tools: SiteKitMcpTool<never>[]\n  /** How long clients may cache `server/discover`, in ms. */\n  discoverTtlMs?: number\n}\n\nfunction capabilities() {\n  // `listChanged: false` is the honest answer for a statically-defined tool\n  // set: there is no subscription stream to notify anyone on.\n  return { tools: { listChanged: false } }\n}\n\nfunction serverInfoBlock(info: McpServerInfo) {\n  return { name: info.name, version: info.version, ...(info.title ? { title: info.title } : {}) }\n}\n\n// ============================================\n// Version negotiation\n// ============================================\n\nexport function isSupportedVersion(version: string): boolean {\n  return (MCP_SUPPORTED_PROTOCOL_VERSIONS as readonly string[]).includes(version)\n}\n\nfunction unsupportedVersionError(id: JsonRpcId, requested: string): DispatchOutcome {\n  return {\n    status: 400,\n    response: {\n      jsonrpc: '2.0',\n      id,\n      error: {\n        code: MCP_ERROR_UNSUPPORTED_PROTOCOL_VERSION,\n        message: 'Unsupported protocol version',\n        data: { supported: [...MCP_SUPPORTED_PROTOCOL_VERSIONS], requested },\n      },\n    },\n  }\n}\n\nexport function errorOutcome(\n  id: JsonRpcId,\n  code: number,\n  message: string,\n  status: number,\n  data?: unknown,\n): DispatchOutcome {\n  return {\n    status,\n    response: { jsonrpc: '2.0', id, error: { code, message, ...(data ? { data } : {}) } },\n  }\n}\n\n// ============================================\n// Dispatch\n// ============================================\n\nexport interface DispatchOptions {\n  server: McpServerDefinition\n  context: Omit<McpToolContext, 'surface'>\n  /**\n   * Protocol version taken from the `MCP-Protocol-Version` header, if any.\n   * Compared against the body's `_meta` value; a disagreement is a -32020.\n   */\n  headerProtocolVersion?: string | null\n  /** `Mcp-Method` header, already base64-sentinel-decoded. */\n  headerMethod?: string | null\n  /** `Mcp-Name` header, already base64-sentinel-decoded. */\n  headerName?: string | null\n  /**\n   * Reject modern requests that omit the required mirror headers.\n   *\n   * Off by default, and that is a considered choice rather than laziness: a\n   * public marketing MCP server exists to be reachable, and today's shipped\n   * clients overwhelmingly speak a legacy revision or omit the mirrors. We\n   * always reject a header that *disagrees* with the body — that is the actual\n   * security property the mirrors exist for (an intermediary routing on the\n   * header while we execute the body). A merely absent header costs nothing.\n   */\n  strictHeaders?: boolean\n}\n\nexport async function dispatch(\n  message: JsonRpcRequest,\n  options: DispatchOptions,\n): Promise<DispatchOutcome> {\n  const { server } = options\n  const id = message.id ?? null\n  const isNotification = message.id === undefined\n  const params = (message.params ?? {}) as Record<string, unknown>\n  const meta = (params._meta ?? {}) as Record<string, unknown>\n\n  // ── Era detection ────────────────────────────────────────────────────────\n  // A request is \"modern\" if it carries the per-request protocol version.\n  const bodyVersion =\n    typeof meta[META_PROTOCOL_VERSION] === 'string'\n      ? (meta[META_PROTOCOL_VERSION] as string)\n      : null\n  const headerVersion = options.headerProtocolVersion || null\n\n  if (bodyVersion && headerVersion && bodyVersion !== headerVersion) {\n    return errorOutcome(\n      id,\n      MCP_ERROR_HEADER_MISMATCH,\n      `Header mismatch: MCP-Protocol-Version header value '${headerVersion}' does not match body value '${bodyVersion}'`,\n      400,\n    )\n  }\n\n  const requestedVersion = bodyVersion || headerVersion\n  if (requestedVersion && !isSupportedVersion(requestedVersion)) {\n    return unsupportedVersionError(id, requestedVersion)\n  }\n\n  // Mirror-header validation. A mismatch is always fatal; absence is fatal\n  // only in strict mode (see DispatchOptions.strictHeaders).\n  if (options.headerMethod && options.headerMethod !== message.method) {\n    return errorOutcome(\n      id,\n      MCP_ERROR_HEADER_MISMATCH,\n      `Header mismatch: Mcp-Method header value '${options.headerMethod}' does not match body value '${message.method}'`,\n      400,\n    )\n  }\n  if (options.headerName) {\n    const bodyName =\n      typeof params.name === 'string'\n        ? params.name\n        : typeof params.uri === 'string'\n          ? params.uri\n          : null\n    if (bodyName && options.headerName !== bodyName) {\n      return errorOutcome(\n        id,\n        MCP_ERROR_HEADER_MISMATCH,\n        `Header mismatch: Mcp-Name header value '${options.headerName}' does not match body value '${bodyName}'`,\n        400,\n      )\n    }\n  }\n  if (options.strictHeaders && bodyVersion) {\n    if (!headerVersion) {\n      return errorOutcome(\n        id,\n        MCP_ERROR_HEADER_MISMATCH,\n        'Header mismatch: required MCP-Protocol-Version header is missing',\n        400,\n      )\n    }\n    if (!options.headerMethod) {\n      return errorOutcome(\n        id,\n        MCP_ERROR_HEADER_MISMATCH,\n        'Header mismatch: required Mcp-Method header is missing',\n        400,\n      )\n    }\n  }\n\n  const negotiated = requestedVersion || MCP_PROTOCOL_VERSION_MODERN\n\n  switch (message.method) {\n    // ── Modern discovery (MUST implement) ──────────────────────────────────\n    case 'server/discover': {\n      return {\n        status: 200,\n        response: {\n          jsonrpc: '2.0',\n          id,\n          result: {\n            resultType: 'complete',\n            supportedVersions: [...MCP_SUPPORTED_PROTOCOL_VERSIONS],\n            capabilities: capabilities(),\n            ...(server.info.instructions ? { instructions: server.info.instructions } : {}),\n            ttlMs: server.discoverTtlMs ?? 3_600_000,\n            cacheScope: 'public',\n            _meta: { [META_SERVER_INFO]: serverInfoBlock(server.info) },\n          },\n        },\n      }\n    }\n\n    // ── Legacy handshake ───────────────────────────────────────────────────\n    case 'initialize': {\n      // Echo the client's version when we speak it; otherwise answer with our\n      // best legacy version. The spec asks modern-only servers to *name* their\n      // versions here because legacy clients have no fall-forward path — we\n      // support both eras, so we simply pick something mutually intelligible.\n      const asked = typeof params.protocolVersion === 'string' ? params.protocolVersion : ''\n      const agreed = isSupportedVersion(asked) ? asked : MCP_PROTOCOL_VERSIONS_LEGACY[0]\n      return {\n        status: 200,\n        response: {\n          jsonrpc: '2.0',\n          id,\n          result: {\n            protocolVersion: agreed,\n            capabilities: capabilities(),\n            serverInfo: serverInfoBlock(server.info),\n            ...(server.info.instructions ? { instructions: server.info.instructions } : {}),\n          },\n        },\n      }\n    }\n\n    case 'notifications/initialized':\n    case 'initialized':\n      return { status: 202, response: null }\n\n    case 'ping':\n      return { status: 200, response: { jsonrpc: '2.0', id, result: {} } }\n\n    // ── Tools ──────────────────────────────────────────────────────────────\n    case 'tools/list': {\n      const tools = server.tools\n        .filter((t) => t.exposeToHttp !== false)\n        .map((t) => toToolDescriptor(t))\n      return { status: 200, response: { jsonrpc: '2.0', id, result: { tools } } }\n    }\n\n    case 'tools/call': {\n      const name = typeof params.name === 'string' ? params.name : ''\n      const tool = server.tools.find((t) => t.name === name && t.exposeToHttp !== false)\n\n      if (!tool) {\n        return errorOutcome(\n          id,\n          JSONRPC_INVALID_PARAMS,\n          `Unknown tool: ${name || '(none)'}`,\n          400,\n          {\n            available: server.tools\n              .filter((t) => t.exposeToHttp !== false)\n              .map((t) => t.name),\n          },\n        )\n      }\n\n      const args = (params.arguments ?? {}) as Record<string, unknown>\n      const invalid = validateArgs(tool, args)\n      if (invalid) {\n        // Returned as a tool result rather than a JSON-RPC error, on purpose:\n        // an `isError` result goes back to the MODEL, which can read it and\n        // retry with the right arguments. A protocol error goes to the client\n        // harness and usually just surfaces as a failure.\n        return {\n          status: 200,\n          response: { jsonrpc: '2.0', id, result: toolErrorResult(invalid) },\n        }\n      }\n\n      try {\n        const raw = await (tool.handler as (\n          a: Record<string, unknown>,\n          c: McpToolContext,\n        ) => unknown)(args, {\n          ...options.context,\n          surface: 'http',\n          protocolVersion: negotiated,\n        })\n        return { status: 200, response: { jsonrpc: '2.0', id, result: toToolResult(raw) } }\n      } catch (error) {\n        const detail = error instanceof Error ? error.message : String(error)\n        return {\n          status: 200,\n          response: {\n            jsonrpc: '2.0',\n            id,\n            result: toolErrorResult(`Tool \"${tool.name}\" failed: ${detail}`),\n          },\n        }\n      }\n    }\n\n    // Declared unsupported rather than left to fall through, so the error names\n    // the reason instead of looking like a typo'd method.\n    case 'resources/list':\n      return { status: 200, response: { jsonrpc: '2.0', id, result: { resources: [] } } }\n    case 'prompts/list':\n      return { status: 200, response: { jsonrpc: '2.0', id, result: { prompts: [] } } }\n\n    default: {\n      if (isNotification) return { status: 202, response: null }\n      // 404 — the spec uses the status to distinguish an unknown METHOD on a\n      // real MCP endpoint from a 404 for an endpoint that isn't there at all.\n      return errorOutcome(id, JSONRPC_METHOD_NOT_FOUND, `Method not found: ${message.method}`, 404)\n    }\n  }\n}\n","/**\n * @sonordev/site-kit/mcp — MCP Server Card (SEP-2127)\n *\n * The card is a DISCOVERY document, not a capability manifest. SEP-2127 is\n * explicit that primitives (tools/resources/prompts) are omitted on purpose,\n * because what a server exposes can vary with auth state and feature flags —\n * the authoritative list is whatever `tools/list` returns at call time.\n *\n * So the card's job is small and specific: tell an agent that an MCP endpoint\n * exists here, what transport it speaks, and which protocol versions it knows,\n * with enough identity attached that a human reviewing the connection knows\n * what they're approving.\n *\n * ── The two paths ─────────────────────────────────────────────────────────\n * SEP-1649 originally proposed `/.well-known/mcp.json`. The ratified SEP-2127\n * moved to `/.well-known/mcp-server-card`. Plenty of deployed crawlers and\n * validators still probe the old path, and serving one JSON document from two\n * URLs costs nothing, so `createMcpServerCardHandler` is mounted at both.\n * `mcp-server-card` is the canonical one; `mcp.json` is compatibility.\n */\n\nimport type { McpServerIcon, McpServerInfo, SiteKitMcpTool } from './types'\nimport { MCP_SUPPORTED_PROTOCOL_VERSIONS } from './protocol'\n\nexport const MCP_SERVER_CARD_SCHEMA =\n  'https://static.modelcontextprotocol.io/schemas/v1/server-card.schema.json'\n\n/** Canonical well-known path (SEP-2127). */\nexport const MCP_SERVER_CARD_PATH = '/.well-known/mcp-server-card'\n/** Superseded SEP-1649 path, still widely probed. */\nexport const MCP_SERVER_CARD_LEGACY_PATH = '/.well-known/mcp.json'\n\n/**\n * Our own `_meta` namespace. `_meta` is the spec-sanctioned extension point,\n * and a reverse-DNS prefix is mandatory there, so a tool *summary* can ride\n * along without pretending to be a standard field. Agents that want the real\n * list still call `tools/list`; this is a hint for crawlers that never connect.\n */\nexport const SITE_KIT_CARD_META_KEY = 'io.sonor.site-kit/tools'\n\nexport interface McpRemote {\n  type: 'streamable-http' | 'sse'\n  url: string\n  supportedProtocolVersions?: string[]\n  headers?: {\n    name: string\n    description?: string\n    isRequired?: boolean\n    isSecret?: boolean\n    default?: string\n    choices?: string[]\n  }[]\n}\n\nexport interface McpServerCard {\n  $schema: string\n  name: string\n  version: string\n  description: string\n  title?: string\n  websiteUrl?: string\n  icons?: McpServerIcon[]\n  remotes?: McpRemote[]\n  _meta?: Record<string, unknown>\n}\n\nexport interface BuildMcpServerCardOptions {\n  info: McpServerInfo\n  /** Absolute site origin, e.g. `https://upforge.io` (no trailing slash). */\n  baseUrl: string\n  /** Path of the MCP endpoint on this origin (default `/api/mcp`). */\n  mcpPath?: string\n  icons?: McpServerIcon[]\n  /** Supply the tool set to publish a name/description summary under `_meta`. */\n  tools?: SiteKitMcpTool<never>[]\n  /** Extra remotes (e.g. a second endpoint on another host). */\n  additionalRemotes?: McpRemote[]\n}\n\nexport function buildMcpServerCard(options: BuildMcpServerCardOptions): McpServerCard {\n  const base = options.baseUrl.replace(/\\/$/, '')\n  const path = options.mcpPath ?? '/api/mcp'\n  const mcpUrl = `${base}${path.startsWith('/') ? path : `/${path}`}`\n\n  const card: McpServerCard = {\n    $schema: MCP_SERVER_CARD_SCHEMA,\n    name: options.info.name,\n    version: options.info.version,\n    description: options.info.description,\n    remotes: [\n      {\n        type: 'streamable-http',\n        url: mcpUrl,\n        supportedProtocolVersions: [...MCP_SUPPORTED_PROTOCOL_VERSIONS],\n      },\n      ...(options.additionalRemotes ?? []),\n    ],\n  }\n\n  if (options.info.title) card.title = options.info.title\n  if (options.info.websiteUrl || base) card.websiteUrl = options.info.websiteUrl || base\n  if (options.icons?.length) card.icons = options.icons\n\n  const meta: Record<string, unknown> = {}\n  if (options.info.instructions) {\n    meta['io.sonor.site-kit/instructions'] = options.info.instructions\n  }\n  if (options.tools?.length) {\n    meta[SITE_KIT_CARD_META_KEY] = options.tools\n      .filter((t) => t.exposeToHttp !== false)\n      .map((t) => ({\n        name: t.name,\n        ...(t.title ? { title: t.title } : {}),\n        description: t.description,\n        readOnly: t.annotations?.readOnlyHint ?? false,\n      }))\n  }\n  if (Object.keys(meta).length > 0) card._meta = meta\n\n  return card\n}\n\n/**\n * Validate a card against the parts of SEP-2127 that are actually checkable.\n * Returns human-readable problems; empty array means it looks conformant.\n * Used by the module's tests and worth calling in a site's own build check.\n */\nexport function validateMcpServerCard(card: McpServerCard): string[] {\n  const problems: string[] = []\n\n  if (card.$schema !== MCP_SERVER_CARD_SCHEMA) {\n    problems.push(`$schema should be \"${MCP_SERVER_CARD_SCHEMA}\"`)\n  }\n  // Reverse-DNS with EXACTLY one slash. `io.upforge/site` is valid;\n  // `upforge` and `io.upforge/site/mcp` are not.\n  if (!/^[^/\\s]+\\/[^/\\s]+$/.test(card.name)) {\n    problems.push(\n      `name \"${card.name}\" must be reverse-DNS with exactly one forward slash, e.g. \"io.example/server\"`,\n    )\n  }\n  if (!/^\\d+\\.\\d+\\.\\d+(?:[-+].+)?$/.test(card.version)) {\n    problems.push(`version \"${card.version}\" should be a concrete semver (no ranges)`)\n  }\n  if (!card.description?.trim()) problems.push('description is required')\n\n  for (const remote of card.remotes ?? []) {\n    if (!/^https:\\/\\//.test(remote.url) && !/^http:\\/\\/localhost/.test(remote.url)) {\n      problems.push(`remote url \"${remote.url}\" must be https (http allowed only on localhost)`)\n    }\n  }\n\n  return problems\n}\n","/**\n * @sonordev/site-kit/mcp — Next.js route handlers (Streamable HTTP + card)\n *\n * Two things get mounted on a site:\n *\n *   app/api/mcp/route.ts                  → createMcpHandler({ server })\n *   app/.well-known/mcp-server-card/...   → createMcpServerCardHandler({ ... })\n *   app/.well-known/mcp.json/route.ts     → the same handler (legacy path)\n *\n * The endpoint is stateless. Every request is self-describing, nothing is\n * cached between calls, and no session is minted — which is exactly what the\n * 2026-07-28 revision asks for and also the only thing that works on a\n * serverless host where consecutive requests hit different instances.\n */\n\nimport {\n  dispatch,\n  errorOutcome,\n  JSONRPC_INVALID_REQUEST,\n  JSONRPC_PARSE_ERROR,\n  MCP_SUPPORTED_PROTOCOL_VERSIONS,\n  MCP_PROTOCOL_VERSION_MODERN,\n  type JsonRpcRequest,\n  type McpServerDefinition,\n} from './protocol'\nimport {\n  buildMcpServerCard,\n  type BuildMcpServerCardOptions,\n  type McpServerCard,\n} from './serverCard'\n\n// ============================================\n// CORS\n// ============================================\n\n/**\n * Headers the MCP wire uses. `Mcp-Session-Id` and `Last-Event-ID` are legacy\n * (dropped in 2026-07-28) but listed so an older client's preflight passes\n * rather than failing opaquely in the browser.\n */\nconst MCP_REQUEST_HEADERS = [\n  'Content-Type',\n  'Accept',\n  'Authorization',\n  'MCP-Protocol-Version',\n  'Mcp-Method',\n  'Mcp-Name',\n  'Mcp-Session-Id',\n  'Last-Event-ID',\n]\n\nfunction corsHeaders(origin: string): Record<string, string> {\n  return {\n    'Access-Control-Allow-Origin': origin,\n    'Access-Control-Allow-Methods': 'POST, OPTIONS',\n    'Access-Control-Allow-Headers': MCP_REQUEST_HEADERS.join(', '),\n    'Access-Control-Expose-Headers': 'MCP-Protocol-Version',\n    'Access-Control-Max-Age': '86400',\n  }\n}\n\n// ============================================\n// Header decoding\n// ============================================\n\n/**\n * Undo the spec's Base64 sentinel wrapper: `=?base64?{b64}?=`.\n * Values that aren't wrapped come back untouched.\n */\nexport function decodeHeaderValue(value: string | null): string | null {\n  if (!value) return value\n  const match = /^=\\?base64\\?(.*)\\?=$/.exec(value)\n  if (!match) return value\n  try {\n    if (typeof atob === 'function') {\n      const binary = atob(match[1])\n      const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0))\n      return new TextDecoder().decode(bytes)\n    }\n    return Buffer.from(match[1], 'base64').toString('utf8')\n  } catch {\n    return value\n  }\n}\n\n// ============================================\n// MCP endpoint\n// ============================================\n\nexport interface McpHandlerOptions {\n  server: McpServerDefinition\n  /** Absolute site origin, passed to every tool handler as context. */\n  baseUrl?: string\n  /**\n   * Origins allowed to call the endpoint from a browser. Defaults to `*`.\n   *\n   * A public marketing MCP server is meant to be called by anyone's agent and\n   * serves only data that is already on the public site, so the wildcard is\n   * the correct setting, not a lapse. The DNS-rebinding attack the spec's\n   * Origin rule defends against is about *localhost* servers, where the\n   * browser can reach a private origin the attacker otherwise couldn't.\n   * Set this explicitly for any endpoint that gains auth or writes.\n   */\n  allowedOrigins?: string[] | '*'\n  /** Reject modern requests missing the mirror headers. See DispatchOptions. */\n  strictHeaders?: boolean\n}\n\nexport interface McpRouteHandlers {\n  POST: (request: Request) => Promise<Response>\n  GET: (request: Request) => Promise<Response>\n  DELETE: (request: Request) => Promise<Response>\n  OPTIONS: (request: Request) => Promise<Response>\n}\n\nfunction resolveOrigin(request: Request, allowed: string[] | '*' | undefined): string | null {\n  const origin = request.headers.get('origin')\n  if (!allowed || allowed === '*') return '*'\n  if (!origin) return allowed[0] ?? '*'\n  return allowed.includes(origin) ? origin : null\n}\n\nfunction json(body: unknown, status: number, headers: Record<string, string>): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: {\n      'Content-Type': 'application/json',\n      'Cache-Control': 'no-store',\n      ...headers,\n    },\n  })\n}\n\n/**\n * Create the Streamable HTTP MCP endpoint.\n *\n * @example\n * ```ts\n * // app/api/mcp/route.ts\n * import { createMcpHandler } from '@sonordev/site-kit/mcp'\n * import { mcpServer } from '@/lib/mcp/server'\n *\n * export const { POST, GET, DELETE, OPTIONS } = createMcpHandler({ server: mcpServer })\n * export const dynamic = 'force-dynamic'\n * ```\n */\nexport function createMcpHandler(options: McpHandlerOptions): McpRouteHandlers {\n  const { server } = options\n\n  async function POST(request: Request): Promise<Response> {\n    const origin = resolveOrigin(request, options.allowedOrigins)\n    if (origin === null) {\n      // Spec: invalid Origin MUST be 403; the body MAY be a JSON-RPC error\n      // with no id.\n      return json(\n        { jsonrpc: '2.0', error: { code: JSONRPC_INVALID_REQUEST, message: 'Origin not allowed' } },\n        403,\n        {},\n      )\n    }\n    const cors = corsHeaders(origin)\n\n    let payload: unknown\n    try {\n      payload = await request.json()\n    } catch {\n      return json(\n        { jsonrpc: '2.0', id: null, error: { code: JSONRPC_PARSE_ERROR, message: 'Parse error' } },\n        400,\n        cors,\n      )\n    }\n\n    const headerProtocolVersion = request.headers.get('mcp-protocol-version')\n    const headerMethod = decodeHeaderValue(request.headers.get('mcp-method'))\n    const headerName = decodeHeaderValue(request.headers.get('mcp-name'))\n\n    const dispatchOptions = {\n      server,\n      context: {\n        baseUrl: options.baseUrl,\n        request,\n        signal: request.signal,\n      },\n      headerProtocolVersion,\n      headerMethod,\n      headerName,\n      strictHeaders: options.strictHeaders,\n    }\n\n    // The current revision says the body is a single message. Batching was\n    // removed in 2025-06-18, but older clients still send arrays and answering\n    // them is a few lines, so we do.\n    if (Array.isArray(payload)) {\n      const outcomes = await Promise.all(\n        payload.map((m) => dispatch(m as JsonRpcRequest, dispatchOptions)),\n      )\n      const responses = outcomes.map((o) => o.response).filter(Boolean)\n      if (responses.length === 0) return new Response(null, { status: 202, headers: cors })\n      return json(responses, 200, {\n        ...cors,\n        'MCP-Protocol-Version': headerProtocolVersion || MCP_PROTOCOL_VERSION_MODERN,\n      })\n    }\n\n    const message = payload as JsonRpcRequest\n    if (!message || typeof message !== 'object' || typeof message.method !== 'string') {\n      const bad = errorOutcome(null, JSONRPC_INVALID_REQUEST, 'Invalid Request', 400)\n      return json(bad.response, bad.status, cors)\n    }\n\n    const outcome = await dispatch(message, dispatchOptions)\n\n    if (outcome.response === null) {\n      // Accepted notification — 202 with no body, per the transport spec.\n      return new Response(null, { status: 202, headers: cors })\n    }\n\n    return json(outcome.response, outcome.status, {\n      ...cors,\n      'MCP-Protocol-Version': headerProtocolVersion || MCP_PROTOCOL_VERSION_MODERN,\n    })\n  }\n\n  // 2026-07-28 removed the GET stream and DELETE session teardown. The spec\n  // names 405 as the response a modern-only server gives older clients that\n  // still try them.\n  async function methodNotAllowed(request: Request): Promise<Response> {\n    const origin = resolveOrigin(request, options.allowedOrigins) ?? '*'\n    return new Response(\n      JSON.stringify({\n        jsonrpc: '2.0',\n        error: {\n          code: JSONRPC_INVALID_REQUEST,\n          message:\n            'This MCP endpoint is stateless and accepts POST only. The GET stream and session teardown were removed in protocol revision 2026-07-28.',\n        },\n      }),\n      {\n        status: 405,\n        headers: {\n          'Content-Type': 'application/json',\n          Allow: 'POST, OPTIONS',\n          ...corsHeaders(origin),\n        },\n      },\n    )\n  }\n\n  async function OPTIONS(request: Request): Promise<Response> {\n    const origin = resolveOrigin(request, options.allowedOrigins)\n    if (origin === null) return new Response(null, { status: 403 })\n    return new Response(null, { status: 204, headers: corsHeaders(origin) })\n  }\n\n  return { POST, GET: methodNotAllowed, DELETE: methodNotAllowed, OPTIONS }\n}\n\n// ============================================\n// Server card endpoint\n// ============================================\n\nexport interface McpServerCardHandlerOptions extends BuildMcpServerCardOptions {\n  /** Seconds for `Cache-Control: public, max-age=…` (default 3600). */\n  maxAge?: number\n}\n\nexport interface McpServerCardRouteHandlers {\n  GET: () => Promise<Response>\n  OPTIONS: () => Promise<Response>\n}\n\n/**\n * Serve the SEP-2127 server card. Mount at BOTH well-known paths.\n *\n * The handler never reads the incoming Request, so the route stays statically\n * prerenderable — the same constraint the llms.txt handlers document, and for\n * the same reason: touching `request.headers` opts the route into dynamic\n * rendering and it stops being served from the CDN.\n *\n * @example\n * ```ts\n * // app/.well-known/mcp-server-card/route.ts\n * import { createMcpServerCardHandler } from '@sonordev/site-kit/mcp'\n * import { mcpServer, SITE_URL } from '@/lib/mcp/server'\n *\n * export const { GET, OPTIONS } = createMcpServerCardHandler({\n *   info: mcpServer.info,\n *   tools: mcpServer.tools,\n *   baseUrl: SITE_URL,\n * })\n * export const revalidate = 3600\n * ```\n */\nexport function createMcpServerCardHandler(\n  options: McpServerCardHandlerOptions,\n): McpServerCardRouteHandlers {\n  const card: McpServerCard = buildMcpServerCard(options)\n  const body = `${JSON.stringify(card, null, 2)}\\n`\n  const maxAge = options.maxAge ?? 3600\n\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/json',\n    'Cache-Control': `public, max-age=${maxAge}`,\n    // The card is a discovery document — it is meant to be fetched by anyone.\n    'Access-Control-Allow-Origin': '*',\n    'Access-Control-Allow-Methods': 'GET, OPTIONS',\n    'Access-Control-Allow-Headers': 'Content-Type',\n  }\n\n  return {\n    GET: async () => new Response(body, { status: 200, headers }),\n    OPTIONS: async () => new Response(null, { status: 204, headers }),\n  }\n}\n\nexport { MCP_SUPPORTED_PROTOCOL_VERSIONS }\n","/**\n * @sonordev/site-kit/mcp — declarative WebMCP (forms as tools)\n *\n * The half of WebMCP that needs no JavaScript. A `<form>` carrying `toolname`\n * and `tooldescription` IS an agent tool: the browser synthesizes the input\n * schema from the form controls, and the agent fills and submits the real\n * form the human would have used.\n *\n * This matters more than the imperative API for one reason — there is exactly\n * one code path. The agent submits the same form, hits the same validation,\n * files the same CRM record. Nothing can drift, because there is nothing to\n * drift from.\n *\n * Attributes (per the W3C declarative-api explainer):\n *   toolname               on <form>     — the tool's machine name\n *   tooldescription        on <form>     — what it does\n *   toolautosubmit         on <form>     — submit without waiting for the human\n *   toolparamdescription   on a control  — describes that field in the schema\n *\n * These are plain HTML attributes; React 19 passes unknown lowercase\n * attributes straight through to the DOM, so the returned objects spread\n * directly onto JSX.\n */\n\nexport interface DeclarativeToolFormOptions {\n  /** Machine name, `snake_case`. Match the remote tool it mirrors. */\n  name: string\n  /** What submitting this form accomplishes, in one sentence. */\n  description: string\n  /**\n   * Let an agent submit without a human confirming.\n   *\n   * Default false, and leave it false for anything that creates a record,\n   * sends a message, or spends money. A booking request or an audit request\n   * should be something the person watching agrees to — `toolautosubmit` on a\n   * lead form is how an agent files fifty of them by accident.\n   */\n  autoSubmit?: boolean\n}\n\nexport interface DeclarativeToolFormAttributes {\n  toolname: string\n  tooldescription: string\n  toolautosubmit?: string\n}\n\n/**\n * Attributes that turn a `<form>` into an agent-callable tool.\n *\n * @example\n * ```tsx\n * <form {...declarativeToolForm({\n *   name: 'request_site_audit',\n *   description: 'Request a free technical SEO and performance audit of a website.',\n * })} action=\"/api/audit\" method=\"post\">\n * ```\n */\nexport function declarativeToolForm(\n  options: DeclarativeToolFormOptions,\n): DeclarativeToolFormAttributes {\n  const attributes: DeclarativeToolFormAttributes = {\n    toolname: options.name,\n    tooldescription: options.description,\n  }\n  // Boolean attribute: present means true. Omit it entirely for false —\n  // `toolautosubmit=\"false\"` is still *present*, and so still true.\n  if (options.autoSubmit) attributes.toolautosubmit = ''\n  return attributes\n}\n\nexport interface DeclarativeToolFieldAttributes {\n  toolparamdescription: string\n}\n\n/**\n * Describe one form control for the synthesized input schema.\n *\n * The control's `name` becomes the schema property and `required` marks it\n * required, so this only supplies the prose — but the prose is what the model\n * reads to decide what to put in the field.\n *\n * @example\n * ```tsx\n * <input\n *   type=\"url\"\n *   name=\"url\"\n *   required\n *   {...declarativeToolField('The full URL of the website to audit, including https://')}\n * />\n * ```\n */\nexport function declarativeToolField(description: string): DeclarativeToolFieldAttributes {\n  return { toolparamdescription: description }\n}\n"]}

package/dist/mcp/protocol.d.ts

@@ -0,0 +1,140 @@
+/**
+ * @sonordev/site-kit/mcp — MCP wire protocol (transport-agnostic)
+ *
+ * A dependency-free implementation of the server half of MCP, covering BOTH
+ * protocol eras (the spec's own term — see /specification/2026-07-28/basic/versioning):
+ *
+ *   modern (2026-07-28)  stateless; every request carries its protocol version
+ *                        in `_meta`, mirrored into the `MCP-Protocol-Version`
+ *                        header. `server/discover` replaces the handshake.
+ *                        No sessions, no GET stream.
+ *
+ *   legacy (<= 2025-11-25)  `initialize` handshake, then `tools/list`.
+ *                        Still what most shipped clients and SDKs speak, so
+ *                        dropping it would mean "spec-compliant and unusable".
+ *
+ * We deliberately do NOT depend on `@modelcontextprotocol/sdk`. The server
+ * surface we need is a few hundred lines of JSON-RPC, and site-kit ships to
+ * every marketing site in the fleet — an SDK in `dependencies` would land in
+ * every one of those installs to save code we'd have to wrap anyway.
+ *
+ * This file is pure: it takes a parsed JSON-RPC message and returns a response
+ * object. Anything HTTP-shaped lives in `handlers.ts`.
+ */
+import type { McpServerInfo, McpToolContext, McpToolResult, SiteKitMcpTool } from './types';
+/** Current revision: stateless, per-request `_meta`, `server/discover`. */
+export declare const MCP_PROTOCOL_VERSION_MODERN = "2026-07-28";
+/**
+ * Handshake-based revisions we still answer. Ordered newest-first — this is
+ * also the preference order when a legacy client asks for something we don't
+ * know, in which case the spec says to reply with our own best version.
+ */
+export declare const MCP_PROTOCOL_VERSIONS_LEGACY: readonly ['2025-11-25', '2025-06-18', '2025-03-26'];
+/** Everything we accept, newest first. Advertised verbatim in errors. */
+export declare const MCP_SUPPORTED_PROTOCOL_VERSIONS: readonly ["2026-07-28", "2025-11-25", "2025-06-18", "2025-03-26"];
+/** `_meta` keys defined by the modern revision. */
+export declare const META_PROTOCOL_VERSION = "io.modelcontextprotocol/protocolVersion";
+export declare const META_CLIENT_INFO = "io.modelcontextprotocol/clientInfo";
+export declare const META_SERVER_INFO = "io.modelcontextprotocol/serverInfo";
+export declare const JSONRPC_PARSE_ERROR = -32700;
+export declare const JSONRPC_INVALID_REQUEST = -32600;
+export declare const JSONRPC_METHOD_NOT_FOUND = -32601;
+export declare const JSONRPC_INVALID_PARAMS = -32602;
+export declare const JSONRPC_INTERNAL_ERROR = -32603;
+/** MCP-defined: headers disagree with the body. */
+export declare const MCP_ERROR_HEADER_MISMATCH = -32020;
+/** MCP-defined: we don't speak the version the client asked for. */
+export declare const MCP_ERROR_UNSUPPORTED_PROTOCOL_VERSION = -32022;
+export type JsonRpcId = string | number | null;
+export interface JsonRpcRequest {
+    jsonrpc: '2.0';
+    id?: JsonRpcId;
+    method: string;
+    params?: Record<string, unknown>;
+}
+export interface JsonRpcError {
+    code: number;
+    message: string;
+    data?: unknown;
+}
+export interface JsonRpcResponse {
+    jsonrpc: '2.0';
+    id: JsonRpcId;
+    result?: unknown;
+    error?: JsonRpcError;
+}
+/**
+ * A response plus the HTTP status the transport should use. The spec pins
+ * specific statuses to specific errors (404 for unknown method, 400 for
+ * version/header problems), so the status is part of the protocol, not a
+ * transport detail the caller gets to invent.
+ */
+export interface DispatchOutcome {
+    /** null for an accepted notification — the transport answers 202. */
+    response: JsonRpcResponse | null;
+    status: number;
+}
+/**
+ * Normalize whatever a handler returned into a spec-shaped tool result.
+ *
+ * Structured data is emitted BOTH ways on purpose: as `structuredContent` for
+ * agents that parse, and as pretty JSON inside a text block for agents (still
+ * the majority) that only read `content`. Returning one or the other is how
+ * you end up invisible to half the ecosystem.
+ */
+export declare function toToolResult(value: unknown): McpToolResult;
+export declare function toolErrorResult(message: string): McpToolResult;
+export interface McpToolDescriptor {
+    name: string;
+    title?: string;
+    description: string;
+    inputSchema: unknown;
+    outputSchema?: unknown;
+    annotations?: unknown;
+}
+/** The public face of a tool — everything except the handler. */
+export declare function toToolDescriptor(tool: SiteKitMcpTool<never>): McpToolDescriptor;
+/**
+ * Minimal required-field + enum check.
+ *
+ * Intentionally shallow. A full JSON Schema validator is a dependency and a
+ * maintenance surface, and the failure it would catch — a model inventing a
+ * field — is better handled by the handler itself returning a helpful
+ * `isError` result the model can read and retry against. What we DO enforce is
+ * the part a model cannot recover from on its own: a missing required argument.
+ */
+export declare function validateArgs(tool: SiteKitMcpTool<never>, args: Record<string, unknown>): string | null;
+export interface McpServerDefinition {
+    info: McpServerInfo;
+    tools: SiteKitMcpTool<never>[];
+    /** How long clients may cache `server/discover`, in ms. */
+    discoverTtlMs?: number;
+}
+export declare function isSupportedVersion(version: string): boolean;
+export declare function errorOutcome(id: JsonRpcId, code: number, message: string, status: number, data?: unknown): DispatchOutcome;
+export interface DispatchOptions {
+    server: McpServerDefinition;
+    context: Omit<McpToolContext, 'surface'>;
+    /**
+     * Protocol version taken from the `MCP-Protocol-Version` header, if any.
+     * Compared against the body's `_meta` value; a disagreement is a -32020.
+     */
+    headerProtocolVersion?: string | null;
+    /** `Mcp-Method` header, already base64-sentinel-decoded. */
+    headerMethod?: string | null;
+    /** `Mcp-Name` header, already base64-sentinel-decoded. */
+    headerName?: string | null;
+    /**
+     * Reject modern requests that omit the required mirror headers.
+     *
+     * Off by default, and that is a considered choice rather than laziness: a
+     * public marketing MCP server exists to be reachable, and today's shipped
+     * clients overwhelmingly speak a legacy revision or omit the mirrors. We
+     * always reject a header that *disagrees* with the body — that is the actual
+     * security property the mirrors exist for (an intermediary routing on the
+     * header while we execute the body). A merely absent header costs nothing.
+     */
+    strictHeaders?: boolean;
+}
+export declare function dispatch(message: JsonRpcRequest, options: DispatchOptions): Promise<DispatchOutcome>;
+//# sourceMappingURL=protocol.d.ts.map

package/dist/mcp/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/mcp/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,aAAa,EACb,cAAc,EACf,MAAM,SAAS,CAAA;AAMhB,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B,eAAe,CAAA;AAEvD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,YAAI,YAAY,EAAE,YAAY,EAAE,YAAY,CAAU,CAAA;AAE/F,yEAAyE;AACzE,eAAO,MAAM,+BAA+B,mEAGlC,CAAA;AAEV,mDAAmD;AACnD,eAAO,MAAM,qBAAqB,4CAA4C,CAAA;AAC9E,eAAO,MAAM,gBAAgB,uCAAuC,CAAA;AACpE,eAAO,MAAM,gBAAgB,uCAAuC,CAAA;AAMpE,eAAO,MAAM,mBAAmB,SAAS,CAAA;AACzC,eAAO,MAAM,uBAAuB,SAAS,CAAA;AAC7C,eAAO,MAAM,wBAAwB,SAAS,CAAA;AAC9C,eAAO,MAAM,sBAAsB,SAAS,CAAA;AAC5C,eAAO,MAAM,sBAAsB,SAAS,CAAA;AAC5C,mDAAmD;AACnD,eAAO,MAAM,yBAAyB,SAAS,CAAA;AAC/C,oEAAoE;AACpE,eAAO,MAAM,sCAAsC,SAAS,CAAA;AAM5D,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;AAE9C,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,KAAK,CAAA;IACd,EAAE,CAAC,EAAE,SAAS,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,KAAK,CAAA;IACd,EAAE,EAAE,SAAS,CAAA;IACb,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,YAAY,CAAA;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAA;IAChC,MAAM,EAAE,MAAM,CAAA;CACf;AAgBD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAyB1D;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAE9D;AAMD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,OAAO,CAAA;IACpB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,GAAG,iBAAiB,CAU/E;AAMD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,EAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,GAAG,IAAI,CAqBf;AAMD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,aAAa,CAAA;IACnB,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAA;IAC9B,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAgBD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE3D;AAiBD,wBAAgB,YAAY,CAC1B,EAAE,EAAE,SAAS,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,OAAO,GACb,eAAe,CAKjB;AAMD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,mBAAmB,CAAA;IAC3B,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;IACxC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,eAAe,CAAC,CA2M1B"}

package/dist/mcp/protocol.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=protocol.test.d.ts.map

package/dist/mcp/protocol.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.test.d.ts","sourceRoot":"","sources":["../../src/mcp/protocol.test.ts"],"names":[],"mappings":""}

package/dist/mcp/serverCard.d.ts

@@ -0,0 +1,77 @@
+/**
+ * @sonordev/site-kit/mcp — MCP Server Card (SEP-2127)
+ *
+ * The card is a DISCOVERY document, not a capability manifest. SEP-2127 is
+ * explicit that primitives (tools/resources/prompts) are omitted on purpose,
+ * because what a server exposes can vary with auth state and feature flags —
+ * the authoritative list is whatever `tools/list` returns at call time.
+ *
+ * So the card's job is small and specific: tell an agent that an MCP endpoint
+ * exists here, what transport it speaks, and which protocol versions it knows,
+ * with enough identity attached that a human reviewing the connection knows
+ * what they're approving.
+ *
+ * ── The two paths ─────────────────────────────────────────────────────────
+ * SEP-1649 originally proposed `/.well-known/mcp.json`. The ratified SEP-2127
+ * moved to `/.well-known/mcp-server-card`. Plenty of deployed crawlers and
+ * validators still probe the old path, and serving one JSON document from two
+ * URLs costs nothing, so `createMcpServerCardHandler` is mounted at both.
+ * `mcp-server-card` is the canonical one; `mcp.json` is compatibility.
+ */
+import type { McpServerIcon, McpServerInfo, SiteKitMcpTool } from './types';
+export declare const MCP_SERVER_CARD_SCHEMA = "https://static.modelcontextprotocol.io/schemas/v1/server-card.schema.json";
+/** Canonical well-known path (SEP-2127). */
+export declare const MCP_SERVER_CARD_PATH = "/.well-known/mcp-server-card";
+/** Superseded SEP-1649 path, still widely probed. */
+export declare const MCP_SERVER_CARD_LEGACY_PATH = "/.well-known/mcp.json";
+/**
+ * Our own `_meta` namespace. `_meta` is the spec-sanctioned extension point,
+ * and a reverse-DNS prefix is mandatory there, so a tool *summary* can ride
+ * along without pretending to be a standard field. Agents that want the real
+ * list still call `tools/list`; this is a hint for crawlers that never connect.
+ */
+export declare const SITE_KIT_CARD_META_KEY = "io.sonor.site-kit/tools";
+export interface McpRemote {
+    type: 'streamable-http' | 'sse';
+    url: string;
+    supportedProtocolVersions?: string[];
+    headers?: {
+        name: string;
+        description?: string;
+        isRequired?: boolean;
+        isSecret?: boolean;
+        default?: string;
+        choices?: string[];
+    }[];
+}
+export interface McpServerCard {
+    $schema: string;
+    name: string;
+    version: string;
+    description: string;
+    title?: string;
+    websiteUrl?: string;
+    icons?: McpServerIcon[];
+    remotes?: McpRemote[];
+    _meta?: Record<string, unknown>;
+}
+export interface BuildMcpServerCardOptions {
+    info: McpServerInfo;
+    /** Absolute site origin, e.g. `https://upforge.io` (no trailing slash). */
+    baseUrl: string;
+    /** Path of the MCP endpoint on this origin (default `/api/mcp`). */
+    mcpPath?: string;
+    icons?: McpServerIcon[];
+    /** Supply the tool set to publish a name/description summary under `_meta`. */
+    tools?: SiteKitMcpTool<never>[];
+    /** Extra remotes (e.g. a second endpoint on another host). */
+    additionalRemotes?: McpRemote[];
+}
+export declare function buildMcpServerCard(options: BuildMcpServerCardOptions): McpServerCard;
+/**
+ * Validate a card against the parts of SEP-2127 that are actually checkable.
+ * Returns human-readable problems; empty array means it looks conformant.
+ * Used by the module's tests and worth calling in a site's own build check.
+ */
+export declare function validateMcpServerCard(card: McpServerCard): string[];
+//# sourceMappingURL=serverCard.d.ts.map

package/dist/mcp/serverCard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverCard.d.ts","sourceRoot":"","sources":["../../src/mcp/serverCard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAG3E,eAAO,MAAM,sBAAsB,8EAC0C,CAAA;AAE7E,4CAA4C;AAC5C,eAAO,MAAM,oBAAoB,iCAAiC,CAAA;AAClE,qDAAqD;AACrD,eAAO,MAAM,2BAA2B,0BAA0B,CAAA;AAElE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,4BAA4B,CAAA;AAE/D,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,iBAAiB,GAAG,KAAK,CAAA;IAC/B,GAAG,EAAE,MAAM,CAAA;IACX,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,MAAM,CAAA;QACZ,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,UAAU,CAAC,EAAE,OAAO,CAAA;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KACnB,EAAE,CAAA;CACJ;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,aAAa,EAAE,CAAA;IACvB,OAAO,CAAC,EAAE,SAAS,EAAE,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,aAAa,CAAA;IACnB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAA;IACf,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,aAAa,EAAE,CAAA;IACvB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAA;IAC/B,8DAA8D;IAC9D,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAA;CAChC;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,aAAa,CAyCpF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,EAAE,CAyBnE"}

package/dist/mcp/types.d.ts

@@ -0,0 +1,154 @@
+/**
+ * @sonordev/site-kit/mcp — shared types
+ *
+ * ONE tool definition, THREE surfaces. A `SiteKitMcpTool` is consumed by:
+ *
+ *   1. the remote MCP endpoint  (`createMcpHandler`)      — off-browser agents
+ *   2. the in-page WebMCP API   (`<WebMcpTools>`)         — browser agents
+ *   3. the MCP Server Card      (`buildMcpServerCard`)    — discovery only
+ *
+ * Keeping the definition in one shape is the whole point: the tool an agent
+ * finds by crawling `/.well-known/mcp.json` and the tool it finds by driving a
+ * browser to the page are the same tool, with the same schema and the same
+ * handler. Two definitions would drift the way the two Square token refreshers
+ * drifted (see the root CLAUDE.md "Consolidate Duplicated Logic" note).
+ */
+/** A JSON Schema node. Deliberately loose — MCP passes these through verbatim. */
+export interface JsonSchemaNode {
+    type?: 'object' | 'array' | 'string' | 'number' | 'integer' | 'boolean' | 'null';
+    description?: string;
+    enum?: readonly (string | number | boolean | null)[];
+    default?: unknown;
+    items?: JsonSchemaNode;
+    properties?: Record<string, JsonSchemaNode>;
+    required?: readonly string[];
+    additionalProperties?: boolean | JsonSchemaNode;
+    minimum?: number;
+    maximum?: number;
+    minLength?: number;
+    maxLength?: number;
+    pattern?: string;
+    format?: string;
+    /** MCP 2026-07-28: mirror this param into an `Mcp-Param-{name}` HTTP header. */
+    'x-mcp-header'?: string;
+    [key: string]: unknown;
+}
+/** Tool input schemas are always objects at the root, per the MCP spec. */
+export interface JsonSchemaObject extends JsonSchemaNode {
+    type: 'object';
+    properties?: Record<string, JsonSchemaNode>;
+    required?: readonly string[];
+}
+export interface McpTextContent {
+    type: 'text';
+    text: string;
+}
+export interface McpResourceLinkContent {
+    type: 'resource_link';
+    uri: string;
+    name?: string;
+    description?: string;
+    mimeType?: string;
+}
+export type McpContent = McpTextContent | McpResourceLinkContent;
+export interface McpToolResult {
+    content: McpContent[];
+    /** Machine-readable payload. Agents prefer this over parsing `content`. */
+    structuredContent?: unknown;
+    isError?: boolean;
+}
+/**
+ * What a handler may return. Anything that is not already an `McpToolResult`
+ * is normalized by `toToolResult()`: objects become pretty JSON in a text block
+ * AND are carried verbatim as `structuredContent`, so an agent can either read
+ * the prose or consume the data.
+ */
+export type McpToolHandlerResult = McpToolResult | object | string | number | boolean | null;
+/**
+ * Behavioural hints. These are advisory — the spec is explicit that clients
+ * must not make security decisions from them — but good agents use them to
+ * decide what needs a human in the loop, so setting them honestly matters.
+ */
+export interface McpToolAnnotations {
+    title?: string;
+    /** Tool does not modify anything. Every "look something up" tool is one. */
+    readOnlyHint?: boolean;
+    /** Tool may perform irreversible updates. Anything creating a CRM record is. */
+    destructiveHint?: boolean;
+    /** Calling twice with the same args changes nothing extra. */
+    idempotentHint?: boolean;
+    /** Tool touches the open internet / third parties. */
+    openWorldHint?: boolean;
+}
+/** Context handed to every tool handler. */
+export interface McpToolContext {
+    /** Where the call came in from: the remote endpoint or the in-page API. */
+    surface: 'http' | 'webmcp';
+    /** Absolute site origin, e.g. `https://upforge.io`. */
+    baseUrl?: string;
+    /** The originating Request, when the call arrived over HTTP. */
+    request?: Request;
+    /** Negotiated protocol version, when known. */
+    protocolVersion?: string;
+    /** Abort signal — WebMCP passes one; HTTP passes the request's. */
+    signal?: AbortSignal;
+}
+export type McpToolHandler<Args = Record<string, unknown>> = (args: Args, context: McpToolContext) => Promise<McpToolHandlerResult> | McpToolHandlerResult;
+export interface SiteKitMcpTool<Args = Record<string, unknown>> {
+    /**
+     * Machine name. Keep it `snake_case` and verb-led (`get_services`,
+     * `request_site_audit`) — this is the string a model reasons about, and the
+     * spec only SHOULDs header-safe characters, so stick to `[a-z0-9_]`.
+     */
+    name: string;
+    /** Human display name for tool pickers. */
+    title?: string;
+    /**
+     * What the tool does, in the voice of someone explaining it to a colleague.
+     * This is the single highest-leverage field in the whole module: it is the
+     * only thing a model reads when deciding whether to call the tool.
+     */
+    description: string;
+    inputSchema: JsonSchemaObject;
+    /** Optional schema for `structuredContent`. */
+    outputSchema?: JsonSchemaObject;
+    annotations?: McpToolAnnotations;
+    handler: McpToolHandler<Args>;
+    /**
+     * Set false to keep a tool off the in-page WebMCP surface while still
+     * serving it from the remote endpoint (default: true). Useful for tools
+     * whose handler needs server-only secrets.
+     */
+    exposeToWebMcp?: boolean;
+    /**
+     * Set false to keep a tool off the remote HTTP endpoint while still
+     * registering it in-page (default: true). Useful for tools that only make
+     * sense against live DOM state.
+     */
+    exposeToHttp?: boolean;
+}
+/** Identity-function helper: gives you inference + autocomplete on the schema. */
+export declare function defineMcpTool<Args = Record<string, unknown>>(tool: SiteKitMcpTool<Args>): SiteKitMcpTool<Args>;
+export interface McpServerInfo {
+    /**
+     * Reverse-DNS name with exactly one forward slash, per SEP-2127:
+     * `io.upforge/site`. The part before the slash is a namespace you control.
+     */
+    name: string;
+    /** Semver. No ranges. */
+    version: string;
+    /** Display name. */
+    title?: string;
+    /** One or two sentences an agent reads before connecting. */
+    description: string;
+    websiteUrl?: string;
+    /** Natural-language guidance for models on how to use this server well. */
+    instructions?: string;
+}
+export interface McpServerIcon {
+    src: string;
+    mimeType?: string;
+    sizes?: string;
+    theme?: 'light' | 'dark';
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/mcp/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/mcp/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAA;IAChF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,EAAE,CAAA;IACpD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,KAAK,CAAC,EAAE,cAAc,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IAC3C,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,oBAAoB,CAAC,EAAE,OAAO,GAAG,cAAc,CAAA;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,IAAI,EAAE,QAAQ,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IAC3C,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC7B;AAMD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,eAAe,CAAA;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,sBAAsB,CAAA;AAEhE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,UAAU,EAAE,CAAA;IACrB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAC5B,aAAa,GAIb,MAAM,GACN,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,CAAA;AAER;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,4EAA4E;IAC5E,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,gFAAgF;IAChF,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,8DAA8D;IAC9D,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,sDAAsD;IACtD,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,4CAA4C;AAC5C,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,OAAO,EAAE,MAAM,GAAG,QAAQ,CAAA;IAC1B,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gEAAgE;IAChE,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,mEAAmE;IACnE,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAED,MAAM,MAAM,cAAc,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAC3D,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,cAAc,KACpB,OAAO,CAAC,oBAAoB,CAAC,GAAG,oBAAoB,CAAA;AAMzD,MAAM,WAAW,cAAc,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC5D;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,gBAAgB,CAAA;IAC7B,+CAA+C;IAC/C,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAC/B,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,CAAA;IAC7B;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1D,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,GACzB,cAAc,CAAC,IAAI,CAAC,CAEtB;AAMD,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,oBAAoB;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;CACzB"}

package/dist/og/config.d.ts

@@ -58,6 +58,16 @@ export interface OgContent {
     /** Bottom bar segments, e.g. ['Give an hour', 'ludlowpto.org']. */
     bar?: string[];
 }
+/**
+ * A per-route entry in `cards`. Layered over the derived card, so it only
+ * states what differs — including inside `content`: a route can override just
+ * the subtitle and keep the title Sonor derived. The runtime always merged
+ * field by field; this type used to demand a full OgContent, which forced
+ * casts in every site that used the documented pattern.
+ */
+export type OgCardOverride = Partial<Omit<OgCardConfig, 'cards' | 'content'>> & {
+    content?: Partial<OgContent>;
+};
 export interface OgCardConfig {
     theme: OgTheme;
     /** First font = display face, second (optional) = hand/accent face. */
@@ -85,7 +95,7 @@ export interface OgCardConfig {
      * Each entry is layered over the site card, so it only states what differs.
      * Build-time only: never rendered as part of a card.
      */
-    cards?: Record<string, Partial<Omit<OgCardConfig, 'cards'>>>;
+    cards?: Record<string, OgCardOverride>;
     /**
      * MIDDLE escape hatch: keep the loader/renderer/verifier pipeline but
      * produce your own document. Receives the config and the same helpers the

package/dist/og/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/og/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,OAAO;IACtB,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAA;IACV,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAA;IACf,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,MAAM;IACrB,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAA;IACb,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,OAAO;IACtB,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAA;IACX,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAA;IACb,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAA;IACd,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,YAAY,CAAA;IACzB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA;IACvD,0GAA0G;IAC1G,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IAC5D;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,iBAAiB,KAAK,MAAM,CAAA;IACvE,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,6BAA6B;IAC7B,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAA;IAC1B,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAE/D;AAED,eAAO,MAAM,QAAQ,OAAO,CAAA;AAC5B,eAAO,MAAM,SAAS,MAAM,CAAA;AAE5B;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,MAAM,CAAA;AAC/B,eAAO,MAAM,YAAY,KAAK,CAAA;AAE9B;;;;GAIG;AACH,eAAO,MAAM,cAAc,mBAAmB,CAAA;AAE9C,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,IAAI,EAAE,OAAO,CAAA;IACb,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/og/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,OAAO;IACtB,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAA;IACV,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAA;IACf,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,MAAM;IACrB,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAA;IACb,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,OAAO;IACtB,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAA;IACX,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAA;IACb,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;CACf;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC,CAAC,GAAG;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;CAC7B,CAAA;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAA;IACd,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,YAAY,CAAA;IACzB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA;IACvD,0GAA0G;IAC1G,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,iBAAiB,KAAK,MAAM,CAAA;IACvE,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,6BAA6B;IAC7B,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAA;IAC1B,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAE/D;AAED,eAAO,MAAM,QAAQ,OAAO,CAAA;AAC5B,eAAO,MAAM,SAAS,MAAM,CAAA;AAE5B;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,MAAM,CAAA;AAC/B,eAAO,MAAM,YAAY,KAAK,CAAA;AAE9B;;;;GAIG;AACH,eAAO,MAAM,cAAc,mBAAmB,CAAA;AAE9C,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,IAAI,EAAE,OAAO,CAAA;IACb,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB"}

package/dist/og/index.js

@@ -1,25 +1,25 @@
 'use strict';
 
-var chunkZAVNGZJZ_js = require('../chunk-ZAVNGZJZ.js');
+var chunkSACGTFCK_js = require('../chunk-SACGTFCK.js');
 require('../chunk-SNAQBZPT.js');
 
 
 
 Object.defineProperty(exports, "OG_HEIGHT", {
   enumerable: true,
-  get: function () { return chunkZAVNGZJZ_js.OG_HEIGHT; }
+  get: function () { return chunkSACGTFCK_js.OG_HEIGHT; }
 });
 Object.defineProperty(exports, "OG_WIDTH", {
   enumerable: true,
-  get: function () { return chunkZAVNGZJZ_js.OG_WIDTH; }
+  get: function () { return chunkSACGTFCK_js.OG_WIDTH; }
 });
 Object.defineProperty(exports, "buildOgHtml", {
   enumerable: true,
-  get: function () { return chunkZAVNGZJZ_js.buildOgHtml; }
+  get: function () { return chunkSACGTFCK_js.buildOgHtml; }
 });
 Object.defineProperty(exports, "defineOgCard", {
   enumerable: true,
-  get: function () { return chunkZAVNGZJZ_js.defineOgCard; }
+  get: function () { return chunkSACGTFCK_js.defineOgCard; }
 });
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/og/index.mjs

@@ -1,4 +1,4 @@
-export { OG_HEIGHT, OG_WIDTH, buildOgHtml, defineOgCard } from '../chunk-HTLWSCUQ.mjs';
+export { OG_HEIGHT, OG_WIDTH, buildOgHtml, defineOgCard } from '../chunk-SRJSR6YP.mjs';
 import '../chunk-BEXTDHO4.mjs';
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map