@sonordev/site-kit 6.5.0 → 7.0.1

package/dist/mcp/client.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/mcp/WebMcpTools.tsx"],"names":["useDeferredActivation","useEffect"],"mappings":";;;;;;AAsDA,SAAS,eAAA,GAA2C;AAClD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,MAAM,GAAA,GAAM,QAAA;AACZ,EAAA,IAAI,GAAA,CAAI,YAAA,EAAc,OAAO,GAAA,CAAI,YAAA;AACjC,EAAA,MAAM,GAAA,GAAM,SAAA;AACZ,EAAA,OAAO,IAAI,YAAA,IAAgB,IAAA;AAC7B;AAGO,SAAS,iBAAA,GAA6B;AAC3C,EAAA,OAAO,iBAAgB,KAAM,IAAA;AAC/B;AAuEO,SAAS,WAAA,CAAY;AAAA,EAC1B,QAAQ,EAAC;AAAA,EACT,aAAa,EAAC;AAAA,EACd,QAAA,GAAW,UAAA;AAAA,EACX,KAAA,GAAQ,IAAA;AAAA,EACR,QAAA,GAAW;AACb,CAAA,EAAqB;AACnB,EAAA,MAAM,KAAA,GAAQA,uCAAsB,KAAK,CAAA;AAEzC,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,KAAA,EAAO;AAGZ,IAAA,MAAM,eAAe,eAAA,EAAgB;AACrC,IAAA,IAAI,CAAC,YAAA,EAAc;AAEnB,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AAEvC,IAAA,MAAM,UAAA,GAAa,OACjB,IAAA,EACA,IAAA,KAC2B;AAC3B,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,QAAA,EAAU;AAAA,UACrC,MAAA,EAAQ,MAAA;AAAA,UACR,OAAA,EAAS;AAAA,YACP,cAAA,EAAgB,kBAAA;AAAA,YAChB,MAAA,EAAQ,qCAAA;AAAA,YACR,YAAA,EAAc,YAAA;AAAA,YACd,UAAA,EAAY;AAAA,WACd;AAAA,UACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,YACnB,OAAA,EAAS,KAAA;AAAA,YACT,EAAA,EAAI,UAAU,IAAI,CAAA,CAAA;AAAA,YAClB,MAAA,EAAQ,YAAA;AAAA,YACR,MAAA,EAAQ,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA;AAAK,WACjC,CAAA;AAAA,UACD,QAAQ,UAAA,CAAW;AAAA,SACpB,CAAA;AACD,QAAA,MAAM,OAAA,GAAW,MAAM,QAAA,CAAS,IAAA,EAAK;AAIrC,QAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,UAAA,OAAO;AAAA,YACL,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,OAAA,CAAQ,KAAA,CAAM,OAAA,IAAW,mBAAA,EAAqB,CAAA;AAAA,YAC9E,OAAA,EAAS;AAAA,WACX;AAAA,QACF;AACA,QAAA,OAAO,OAAA,CAAQ,MAAA,IAAU,EAAE,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,aAAA,EAAe,CAAA,EAAE;AAAA,MAC9E,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,UAAA,CAAW,MAAA,CAAO,OAAA,EAAS,MAAM,KAAA;AACrC,QAAA,MAAM,SAAS,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACpE,QAAA,OAAO,EAAE,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA,kBAAA,EAAqB,MAAM,CAAA,CAAA,EAAI,CAAA,EAAG,SAAS,IAAA,EAAK;AAAA,MAC3F;AAAA,IACF,CAAA;AAEA,IAAA,MAAM,SAAA,GAAY,CAAC,KAAA,KAAkC;AACnD,MAAA,IAAI,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,MAAM,OAAA,CAAS,KAAA,CAAwB,OAAO,CAAA,EAAG;AACzF,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,OAAO;AAAA,QACL,OAAA,EAAS;AAAA,UACP,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,IAAA,CAAK,SAAA,CAAU,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA;AAAE,SAC3F;AAAA,QACA,iBAAA,EAAmB;AAAA,OACrB;AAAA,IACF,CAAA;AAEA,IAAA,MAAM,UAAU,CAAC,IAAA,KACf,IAAA,CAAK,GAAA,CAAI,CAAC,IAAA,MAAU;AAAA,MAClB,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,OAAA,EAAS,CAAC,IAAA,KAAkC,UAAA,CAAW,KAAK,IAAA,EAAM,IAAA,IAAQ,EAAE;AAAA,KAC9E,CAAE,CAAA;AAEJ,IAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,CAAC,IAAA,MAAU;AAAA,MACtC,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,OAAA,EAAS,OAAO,IAAA,KAAkC,SAAA,CAAU,MAAM,KAAK,OAAA,CAAQ,IAAA,IAAQ,EAAE,CAAC;AAAA,KAC5F,CAAE,CAAA;AAGF,IAAA,MAAM,kBAAkB,YAA6C;AACnE,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,QAAA,EAAU;AAAA,QACrC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,MAAA,EAAQ,qCAAA;AAAA,UACR,YAAA,EAAc;AAAA,SAChB;AAAA,QACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,OAAA,EAAS,OAAO,EAAA,EAAI,aAAA,EAAe,MAAA,EAAQ,YAAA,EAAc,CAAA;AAAA,QAChF,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AACD,MAAA,MAAM,OAAA,GAAW,MAAM,QAAA,CAAS,IAAA,EAAK;AAGrC,MAAA,OAAO,OAAA,CAAQ,MAAA,EAAQ,KAAA,IAAS,EAAC;AAAA,IACnC,CAAA;AAEA,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,KAAA,CAAM,YAAY;AAChB,MAAA,IAAI;AACF,QAAA,MAAM,aACJ,KAAA,CAAM,MAAA,KAAW,KAAK,QAAA,GAAW,MAAM,iBAAgB,GAAI,KAAA;AAC7D,QAAA,IAAI,SAAA,EAAW;AAEf,QAAA,MAAM,cAAc,CAAC,GAAG,QAAQ,UAAU,CAAA,EAAG,GAAG,KAAK,CAAA;AACrD,QAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAE9B,QAAA,IAAI,OAAO,YAAA,CAAa,YAAA,KAAiB,UAAA,EAAY;AACnD,UAAA,KAAA,MAAW,cAAc,WAAA,EAAa;AACpC,YAAA,IAAI,SAAA,EAAW;AACf,YAAA,MAAM,aAAa,YAAA,CAAa,UAAA,EAAY,EAAE,MAAA,EAAQ,UAAA,CAAW,QAAQ,CAAA;AAAA,UAC3E;AAAA,QACF,CAAA,MAAA,IAAW,OAAO,YAAA,CAAa,cAAA,KAAmB,UAAA,EAAY;AAC5D,UAAA,MAAM,YAAA,CAAa,cAAA,CAAe,EAAE,KAAA,EAAO,aAAa,CAAA;AAAA,QAC1D;AAAA,MACF,SAAS,KAAA,EAAO;AAId,QAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA,EAAc;AACzC,UAAA,OAAA,CAAQ,IAAA,CAAK,8CAA8C,KAAK,CAAA;AAAA,QAClE;AAAA,MACF;AAAA,IACF,CAAA,GAAG;AAEH,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AAGZ,MAAA,UAAA,CAAW,KAAA,EAAM;AAAA,IACnB,CAAA;AAAA,EACF,GAAG,CAAC,KAAA,EAAO,OAAO,UAAA,EAAY,QAAA,EAAU,QAAQ,CAAC,CAAA;AAEjD,EAAA,OAAO,IAAA;AACT","file":"client.js","sourcesContent":["'use client'\n\n/**\n * @sonordev/site-kit/mcp — WebMCP in-page tool registration\n *\n * The browser half of WebMCP (W3C Web Machine Learning CG). When an agent is\n * driving the page — a browser-integrated assistant, an extension, a\n * headless-Chrome operator — it does not fetch our `.well-known` card and open\n * a network connection. It looks for tools registered on the *document*.\n *\n * `document.modelContext.registerTool()` is the current shape in the explainer;\n * earlier drafts and some flagged builds put the same object on `navigator`,\n * and an even earlier one took a whole tool array via `provideContext()`. All\n * three are probed, because the spec is a live draft and a site that only\n * knows one shape silently exposes nothing in the others.\n *\n * ── Why the handlers are proxied ──────────────────────────────────────────\n * Tools are registered here as thin wrappers that POST `tools/call` to this\n * site's own MCP endpoint. That is deliberate:\n *\n *   - one implementation. The tool an agent calls in-page and the tool it\n *     calls over HTTP run the SAME server-side handler, so they cannot drift.\n *   - no secrets in the bundle. Handlers reach Sonor with `SONOR_API_KEY`.\n *     Registering real handlers client-side would drag that key into a\n *     `'use client'` graph, which is exactly how a raw `sonor_` key once ended\n *     up in a public chunk of an upforge build (see build-entries.ts).\n *\n * Tools that genuinely need live DOM state (reading what's on screen, filling\n * a form the user is looking at) are passed as `localTools` and run in-page.\n */\n\nimport { useEffect } from 'react'\nimport { useDeferredActivation } from '../shared/defer'\nimport type { JsonSchemaObject, McpToolResult } from './types'\n\n// ============================================\n// The WebMCP surface, as far as we rely on it\n// ============================================\n\ninterface WebMcpToolDefinition {\n  name: string\n  description: string\n  inputSchema: JsonSchemaObject\n  execute: (args: Record<string, unknown>) => Promise<McpToolResult>\n}\n\ninterface ModelContextLike {\n  registerTool?: (\n    tool: WebMcpToolDefinition,\n    options?: { signal?: AbortSignal },\n  ) => Promise<unknown> | unknown\n  provideContext?: (context: { tools: WebMcpToolDefinition[] }) => Promise<unknown> | unknown\n}\n\nfunction getModelContext(): ModelContextLike | null {\n  if (typeof window === 'undefined') return null\n  const doc = document as unknown as { modelContext?: ModelContextLike }\n  if (doc.modelContext) return doc.modelContext\n  const nav = navigator as unknown as { modelContext?: ModelContextLike }\n  return nav.modelContext ?? null\n}\n\n/** True when the visiting browser exposes WebMCP at all. */\nexport function isWebMcpAvailable(): boolean {\n  return getModelContext() !== null\n}\n\n// ============================================\n// Props\n// ============================================\n\n/** A tool as it crosses the server→client boundary: JSON, no functions. */\nexport interface WebMcpToolDescriptor {\n  name: string\n  title?: string\n  description: string\n  inputSchema: JsonSchemaObject\n}\n\nexport interface WebMcpLocalTool extends WebMcpToolDescriptor {\n  /** Runs in the browser. Use for DOM-aware tools only. */\n  execute: (args: Record<string, unknown>) => Promise<unknown> | unknown\n}\n\nexport interface WebMcpToolsProps {\n  /**\n   * Proxied tools — executed server-side via the MCP endpoint.\n   *\n   * Usually omit this. Passing descriptors from a server component sends the\n   * whole tool catalog through the RSC payload of EVERY page, costing every\n   * human visitor several KB for a capability only an agent uses. Leave it\n   * empty and the component fetches `tools/list` instead — but only after\n   * confirming the browser actually exposes WebMCP, so the fetch never\n   * happens for ordinary visitors. Pass descriptors only to pin a subset.\n   */\n  tools?: WebMcpToolDescriptor[]\n  /** Tools whose handler runs in the browser. */\n  localTools?: WebMcpLocalTool[]\n  /** MCP endpoint on this origin (default `/api/mcp`). */\n  endpoint?: string\n  /**\n   * Wait for the page to go quiet before registering (default true).\n   *\n   * Registration is not user-visible and must never compete with hydration.\n   * An agent arriving at the page polls or listens for `toolchange`, so a\n   * couple of hundred milliseconds costs nothing; a blocked LCP costs a lot.\n   */\n  defer?: boolean\n  /**\n   * Fetch the catalog from the endpoint's `tools/list` when no `tools` are\n   * passed (default true). The fetch is gated on WebMCP being present.\n   */\n  discover?: boolean\n}\n\n// ============================================\n// Component\n// ============================================\n\n/**\n * Register this site's MCP tools with the visiting browser's agent.\n *\n * Renders nothing. Mount it as a CHILDLESS sibling in the layout — never as a\n * wrapper around `{children}`, which would de-opt the whole route to client\n * rendering (the cardinal rule in the root CLAUDE.md).\n *\n * @example\n * ```tsx\n * // app/layout.tsx\n * <SiteKitLayout>{children}</SiteKitLayout>\n * <WebMcpTools endpoint=\"/api/mcp\" />\n * ```\n *\n * Prefer `endpoint` (discovery) over a `tools` list from a server component:\n * descriptors passed as props land in every page's RSC payload.\n */\nexport function WebMcpTools({\n  tools = [],\n  localTools = [],\n  endpoint = '/api/mcp',\n  defer = true,\n  discover = true,\n}: WebMcpToolsProps) {\n  const ready = useDeferredActivation(defer)\n\n  useEffect(() => {\n    if (!ready) return\n    // Gate EVERYTHING on WebMCP being present. A browser without it does no\n    // work and issues no request — which is every human visitor today.\n    const modelContext = getModelContext()\n    if (!modelContext) return\n\n    const controller = new AbortController()\n\n    const callRemote = async (\n      name: string,\n      args: Record<string, unknown>,\n    ): Promise<McpToolResult> => {\n      try {\n        const response = await fetch(endpoint, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n            Accept: 'application/json, text/event-stream',\n            'Mcp-Method': 'tools/call',\n            'Mcp-Name': name,\n          },\n          body: JSON.stringify({\n            jsonrpc: '2.0',\n            id: `webmcp-${name}`,\n            method: 'tools/call',\n            params: { name, arguments: args },\n          }),\n          signal: controller.signal,\n        })\n        const payload = (await response.json()) as {\n          result?: McpToolResult\n          error?: { message?: string }\n        }\n        if (payload.error) {\n          return {\n            content: [{ type: 'text', text: payload.error.message ?? 'Tool call failed.' }],\n            isError: true,\n          }\n        }\n        return payload.result ?? { content: [{ type: 'text', text: '(no result)' }] }\n      } catch (error) {\n        if (controller.signal.aborted) throw error\n        const detail = error instanceof Error ? error.message : String(error)\n        return { content: [{ type: 'text', text: `Tool call failed: ${detail}` }], isError: true }\n      }\n    }\n\n    const normalize = (value: unknown): McpToolResult => {\n      if (value && typeof value === 'object' && Array.isArray((value as McpToolResult).content)) {\n        return value as McpToolResult\n      }\n      return {\n        content: [\n          { type: 'text', text: typeof value === 'string' ? value : JSON.stringify(value, null, 2) },\n        ],\n        structuredContent: value,\n      }\n    }\n\n    const proxied = (list: WebMcpToolDescriptor[]): WebMcpToolDefinition[] =>\n      list.map((tool) => ({\n        name: tool.name,\n        description: tool.description,\n        inputSchema: tool.inputSchema,\n        execute: (args: Record<string, unknown>) => callRemote(tool.name, args ?? {}),\n      }))\n\n    const local = localTools.map((tool) => ({\n      name: tool.name,\n      description: tool.description,\n      inputSchema: tool.inputSchema,\n      execute: async (args: Record<string, unknown>) => normalize(await tool.execute(args ?? {})),\n    }))\n\n    /** Ask our own endpoint what it serves, so the two can't disagree. */\n    const listRemoteTools = async (): Promise<WebMcpToolDescriptor[]> => {\n      const response = await fetch(endpoint, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          Accept: 'application/json, text/event-stream',\n          'Mcp-Method': 'tools/list',\n        },\n        body: JSON.stringify({ jsonrpc: '2.0', id: 'webmcp-list', method: 'tools/list' }),\n        signal: controller.signal,\n      })\n      const payload = (await response.json()) as {\n        result?: { tools?: WebMcpToolDescriptor[] }\n      }\n      return payload.result?.tools ?? []\n    }\n\n    let cancelled = false\n    void (async () => {\n      try {\n        const discovered =\n          tools.length === 0 && discover ? await listRemoteTools() : tools\n        if (cancelled) return\n\n        const definitions = [...proxied(discovered), ...local]\n        if (definitions.length === 0) return\n\n        if (typeof modelContext.registerTool === 'function') {\n          for (const definition of definitions) {\n            if (cancelled) return\n            await modelContext.registerTool(definition, { signal: controller.signal })\n          }\n        } else if (typeof modelContext.provideContext === 'function') {\n          await modelContext.provideContext({ tools: definitions })\n        }\n      } catch (error) {\n        // A draft API that rejects is not a site error. Stay silent in\n        // production so a spec change never shows up as console noise on a\n        // marketing page.\n        if (process.env.NODE_ENV !== 'production') {\n          console.warn('[site-kit/mcp] WebMCP registration failed:', error)\n        }\n      }\n    })()\n\n    return () => {\n      cancelled = true\n      // Aborting the signal is how WebMCP unregisters — important on client\n      // navigation, or the previous page's tools linger on the document.\n      controller.abort()\n    }\n  }, [ready, tools, localTools, endpoint, discover])\n\n  return null\n}\n"]}

package/dist/mcp/client.mjs

@@ -1,129 +0,0 @@
-'use client';
-import { useDeferredActivation } from '../chunk-ZVBLXXNJ.mjs';
-import '../chunk-BEXTDHO4.mjs';
-import { useEffect } from 'react';
-
-function getModelContext() {
-  if (typeof window === "undefined") return null;
-  const doc = document;
-  if (doc.modelContext) return doc.modelContext;
-  const nav = navigator;
-  return nav.modelContext ?? null;
-}
-function isWebMcpAvailable() {
-  return getModelContext() !== null;
-}
-function WebMcpTools({
-  tools = [],
-  localTools = [],
-  endpoint = "/api/mcp",
-  defer = true,
-  discover = true
-}) {
-  const ready = useDeferredActivation(defer);
-  useEffect(() => {
-    if (!ready) return;
-    const modelContext = getModelContext();
-    if (!modelContext) return;
-    const controller = new AbortController();
-    const callRemote = async (name, args) => {
-      try {
-        const response = await fetch(endpoint, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            Accept: "application/json, text/event-stream",
-            "Mcp-Method": "tools/call",
-            "Mcp-Name": name
-          },
-          body: JSON.stringify({
-            jsonrpc: "2.0",
-            id: `webmcp-${name}`,
-            method: "tools/call",
-            params: { name, arguments: args }
-          }),
-          signal: controller.signal
-        });
-        const payload = await response.json();
-        if (payload.error) {
-          return {
-            content: [{ type: "text", text: payload.error.message ?? "Tool call failed." }],
-            isError: true
-          };
-        }
-        return payload.result ?? { content: [{ type: "text", text: "(no result)" }] };
-      } catch (error) {
-        if (controller.signal.aborted) throw error;
-        const detail = error instanceof Error ? error.message : String(error);
-        return { content: [{ type: "text", text: `Tool call failed: ${detail}` }], isError: true };
-      }
-    };
-    const normalize = (value) => {
-      if (value && typeof value === "object" && Array.isArray(value.content)) {
-        return value;
-      }
-      return {
-        content: [
-          { type: "text", text: typeof value === "string" ? value : JSON.stringify(value, null, 2) }
-        ],
-        structuredContent: value
-      };
-    };
-    const proxied = (list) => list.map((tool) => ({
-      name: tool.name,
-      description: tool.description,
-      inputSchema: tool.inputSchema,
-      execute: (args) => callRemote(tool.name, args ?? {})
-    }));
-    const local = localTools.map((tool) => ({
-      name: tool.name,
-      description: tool.description,
-      inputSchema: tool.inputSchema,
-      execute: async (args) => normalize(await tool.execute(args ?? {}))
-    }));
-    const listRemoteTools = async () => {
-      const response = await fetch(endpoint, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          Accept: "application/json, text/event-stream",
-          "Mcp-Method": "tools/list"
-        },
-        body: JSON.stringify({ jsonrpc: "2.0", id: "webmcp-list", method: "tools/list" }),
-        signal: controller.signal
-      });
-      const payload = await response.json();
-      return payload.result?.tools ?? [];
-    };
-    let cancelled = false;
-    void (async () => {
-      try {
-        const discovered = tools.length === 0 && discover ? await listRemoteTools() : tools;
-        if (cancelled) return;
-        const definitions = [...proxied(discovered), ...local];
-        if (definitions.length === 0) return;
-        if (typeof modelContext.registerTool === "function") {
-          for (const definition of definitions) {
-            if (cancelled) return;
-            await modelContext.registerTool(definition, { signal: controller.signal });
-          }
-        } else if (typeof modelContext.provideContext === "function") {
-          await modelContext.provideContext({ tools: definitions });
-        }
-      } catch (error) {
-        if (process.env.NODE_ENV !== "production") {
-          console.warn("[site-kit/mcp] WebMCP registration failed:", error);
-        }
-      }
-    })();
-    return () => {
-      cancelled = true;
-      controller.abort();
-    };
-  }, [ready, tools, localTools, endpoint, discover]);
-  return null;
-}
-
-export { WebMcpTools, isWebMcpAvailable };
-//# sourceMappingURL=client.mjs.map
-//# sourceMappingURL=client.mjs.map

package/dist/mcp/client.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/mcp/WebMcpTools.tsx"],"names":[],"mappings":";;;;AAsDA,SAAS,eAAA,GAA2C;AAClD,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,IAAA;AAC1C,EAAA,MAAM,GAAA,GAAM,QAAA;AACZ,EAAA,IAAI,GAAA,CAAI,YAAA,EAAc,OAAO,GAAA,CAAI,YAAA;AACjC,EAAA,MAAM,GAAA,GAAM,SAAA;AACZ,EAAA,OAAO,IAAI,YAAA,IAAgB,IAAA;AAC7B;AAGO,SAAS,iBAAA,GAA6B;AAC3C,EAAA,OAAO,iBAAgB,KAAM,IAAA;AAC/B;AAuEO,SAAS,WAAA,CAAY;AAAA,EAC1B,QAAQ,EAAC;AAAA,EACT,aAAa,EAAC;AAAA,EACd,QAAA,GAAW,UAAA;AAAA,EACX,KAAA,GAAQ,IAAA;AAAA,EACR,QAAA,GAAW;AACb,CAAA,EAAqB;AACnB,EAAA,MAAM,KAAA,GAAQ,sBAAsB,KAAK,CAAA;AAEzC,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,CAAC,KAAA,EAAO;AAGZ,IAAA,MAAM,eAAe,eAAA,EAAgB;AACrC,IAAA,IAAI,CAAC,YAAA,EAAc;AAEnB,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AAEvC,IAAA,MAAM,UAAA,GAAa,OACjB,IAAA,EACA,IAAA,KAC2B;AAC3B,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,QAAA,EAAU;AAAA,UACrC,MAAA,EAAQ,MAAA;AAAA,UACR,OAAA,EAAS;AAAA,YACP,cAAA,EAAgB,kBAAA;AAAA,YAChB,MAAA,EAAQ,qCAAA;AAAA,YACR,YAAA,EAAc,YAAA;AAAA,YACd,UAAA,EAAY;AAAA,WACd;AAAA,UACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,YACnB,OAAA,EAAS,KAAA;AAAA,YACT,EAAA,EAAI,UAAU,IAAI,CAAA,CAAA;AAAA,YAClB,MAAA,EAAQ,YAAA;AAAA,YACR,MAAA,EAAQ,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA;AAAK,WACjC,CAAA;AAAA,UACD,QAAQ,UAAA,CAAW;AAAA,SACpB,CAAA;AACD,QAAA,MAAM,OAAA,GAAW,MAAM,QAAA,CAAS,IAAA,EAAK;AAIrC,QAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,UAAA,OAAO;AAAA,YACL,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,OAAA,CAAQ,KAAA,CAAM,OAAA,IAAW,mBAAA,EAAqB,CAAA;AAAA,YAC9E,OAAA,EAAS;AAAA,WACX;AAAA,QACF;AACA,QAAA,OAAO,OAAA,CAAQ,MAAA,IAAU,EAAE,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,aAAA,EAAe,CAAA,EAAE;AAAA,MAC9E,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,UAAA,CAAW,MAAA,CAAO,OAAA,EAAS,MAAM,KAAA;AACrC,QAAA,MAAM,SAAS,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACpE,QAAA,OAAO,EAAE,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA,kBAAA,EAAqB,MAAM,CAAA,CAAA,EAAI,CAAA,EAAG,SAAS,IAAA,EAAK;AAAA,MAC3F;AAAA,IACF,CAAA;AAEA,IAAA,MAAM,SAAA,GAAY,CAAC,KAAA,KAAkC;AACnD,MAAA,IAAI,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,MAAM,OAAA,CAAS,KAAA,CAAwB,OAAO,CAAA,EAAG;AACzF,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,OAAO;AAAA,QACL,OAAA,EAAS;AAAA,UACP,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,IAAA,CAAK,SAAA,CAAU,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA;AAAE,SAC3F;AAAA,QACA,iBAAA,EAAmB;AAAA,OACrB;AAAA,IACF,CAAA;AAEA,IAAA,MAAM,UAAU,CAAC,IAAA,KACf,IAAA,CAAK,GAAA,CAAI,CAAC,IAAA,MAAU;AAAA,MAClB,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,OAAA,EAAS,CAAC,IAAA,KAAkC,UAAA,CAAW,KAAK,IAAA,EAAM,IAAA,IAAQ,EAAE;AAAA,KAC9E,CAAE,CAAA;AAEJ,IAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,CAAC,IAAA,MAAU;AAAA,MACtC,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,OAAA,EAAS,OAAO,IAAA,KAAkC,SAAA,CAAU,MAAM,KAAK,OAAA,CAAQ,IAAA,IAAQ,EAAE,CAAC;AAAA,KAC5F,CAAE,CAAA;AAGF,IAAA,MAAM,kBAAkB,YAA6C;AACnE,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,QAAA,EAAU;AAAA,QACrC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,MAAA,EAAQ,qCAAA;AAAA,UACR,YAAA,EAAc;AAAA,SAChB;AAAA,QACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,OAAA,EAAS,OAAO,EAAA,EAAI,aAAA,EAAe,MAAA,EAAQ,YAAA,EAAc,CAAA;AAAA,QAChF,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AACD,MAAA,MAAM,OAAA,GAAW,MAAM,QAAA,CAAS,IAAA,EAAK;AAGrC,MAAA,OAAO,OAAA,CAAQ,MAAA,EAAQ,KAAA,IAAS,EAAC;AAAA,IACnC,CAAA;AAEA,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,KAAA,CAAM,YAAY;AAChB,MAAA,IAAI;AACF,QAAA,MAAM,aACJ,KAAA,CAAM,MAAA,KAAW,KAAK,QAAA,GAAW,MAAM,iBAAgB,GAAI,KAAA;AAC7D,QAAA,IAAI,SAAA,EAAW;AAEf,QAAA,MAAM,cAAc,CAAC,GAAG,QAAQ,UAAU,CAAA,EAAG,GAAG,KAAK,CAAA;AACrD,QAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAE9B,QAAA,IAAI,OAAO,YAAA,CAAa,YAAA,KAAiB,UAAA,EAAY;AACnD,UAAA,KAAA,MAAW,cAAc,WAAA,EAAa;AACpC,YAAA,IAAI,SAAA,EAAW;AACf,YAAA,MAAM,aAAa,YAAA,CAAa,UAAA,EAAY,EAAE,MAAA,EAAQ,UAAA,CAAW,QAAQ,CAAA;AAAA,UAC3E;AAAA,QACF,CAAA,MAAA,IAAW,OAAO,YAAA,CAAa,cAAA,KAAmB,UAAA,EAAY;AAC5D,UAAA,MAAM,YAAA,CAAa,cAAA,CAAe,EAAE,KAAA,EAAO,aAAa,CAAA;AAAA,QAC1D;AAAA,MACF,SAAS,KAAA,EAAO;AAId,QAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA,EAAc;AACzC,UAAA,OAAA,CAAQ,IAAA,CAAK,8CAA8C,KAAK,CAAA;AAAA,QAClE;AAAA,MACF;AAAA,IACF,CAAA,GAAG;AAEH,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AAGZ,MAAA,UAAA,CAAW,KAAA,EAAM;AAAA,IACnB,CAAA;AAAA,EACF,GAAG,CAAC,KAAA,EAAO,OAAO,UAAA,EAAY,QAAA,EAAU,QAAQ,CAAC,CAAA;AAEjD,EAAA,OAAO,IAAA;AACT","file":"client.mjs","sourcesContent":["'use client'\n\n/**\n * @sonordev/site-kit/mcp — WebMCP in-page tool registration\n *\n * The browser half of WebMCP (W3C Web Machine Learning CG). When an agent is\n * driving the page — a browser-integrated assistant, an extension, a\n * headless-Chrome operator — it does not fetch our `.well-known` card and open\n * a network connection. It looks for tools registered on the *document*.\n *\n * `document.modelContext.registerTool()` is the current shape in the explainer;\n * earlier drafts and some flagged builds put the same object on `navigator`,\n * and an even earlier one took a whole tool array via `provideContext()`. All\n * three are probed, because the spec is a live draft and a site that only\n * knows one shape silently exposes nothing in the others.\n *\n * ── Why the handlers are proxied ──────────────────────────────────────────\n * Tools are registered here as thin wrappers that POST `tools/call` to this\n * site's own MCP endpoint. That is deliberate:\n *\n *   - one implementation. The tool an agent calls in-page and the tool it\n *     calls over HTTP run the SAME server-side handler, so they cannot drift.\n *   - no secrets in the bundle. Handlers reach Sonor with `SONOR_API_KEY`.\n *     Registering real handlers client-side would drag that key into a\n *     `'use client'` graph, which is exactly how a raw `sonor_` key once ended\n *     up in a public chunk of an upforge build (see build-entries.ts).\n *\n * Tools that genuinely need live DOM state (reading what's on screen, filling\n * a form the user is looking at) are passed as `localTools` and run in-page.\n */\n\nimport { useEffect } from 'react'\nimport { useDeferredActivation } from '../shared/defer'\nimport type { JsonSchemaObject, McpToolResult } from './types'\n\n// ============================================\n// The WebMCP surface, as far as we rely on it\n// ============================================\n\ninterface WebMcpToolDefinition {\n  name: string\n  description: string\n  inputSchema: JsonSchemaObject\n  execute: (args: Record<string, unknown>) => Promise<McpToolResult>\n}\n\ninterface ModelContextLike {\n  registerTool?: (\n    tool: WebMcpToolDefinition,\n    options?: { signal?: AbortSignal },\n  ) => Promise<unknown> | unknown\n  provideContext?: (context: { tools: WebMcpToolDefinition[] }) => Promise<unknown> | unknown\n}\n\nfunction getModelContext(): ModelContextLike | null {\n  if (typeof window === 'undefined') return null\n  const doc = document as unknown as { modelContext?: ModelContextLike }\n  if (doc.modelContext) return doc.modelContext\n  const nav = navigator as unknown as { modelContext?: ModelContextLike }\n  return nav.modelContext ?? null\n}\n\n/** True when the visiting browser exposes WebMCP at all. */\nexport function isWebMcpAvailable(): boolean {\n  return getModelContext() !== null\n}\n\n// ============================================\n// Props\n// ============================================\n\n/** A tool as it crosses the server→client boundary: JSON, no functions. */\nexport interface WebMcpToolDescriptor {\n  name: string\n  title?: string\n  description: string\n  inputSchema: JsonSchemaObject\n}\n\nexport interface WebMcpLocalTool extends WebMcpToolDescriptor {\n  /** Runs in the browser. Use for DOM-aware tools only. */\n  execute: (args: Record<string, unknown>) => Promise<unknown> | unknown\n}\n\nexport interface WebMcpToolsProps {\n  /**\n   * Proxied tools — executed server-side via the MCP endpoint.\n   *\n   * Usually omit this. Passing descriptors from a server component sends the\n   * whole tool catalog through the RSC payload of EVERY page, costing every\n   * human visitor several KB for a capability only an agent uses. Leave it\n   * empty and the component fetches `tools/list` instead — but only after\n   * confirming the browser actually exposes WebMCP, so the fetch never\n   * happens for ordinary visitors. Pass descriptors only to pin a subset.\n   */\n  tools?: WebMcpToolDescriptor[]\n  /** Tools whose handler runs in the browser. */\n  localTools?: WebMcpLocalTool[]\n  /** MCP endpoint on this origin (default `/api/mcp`). */\n  endpoint?: string\n  /**\n   * Wait for the page to go quiet before registering (default true).\n   *\n   * Registration is not user-visible and must never compete with hydration.\n   * An agent arriving at the page polls or listens for `toolchange`, so a\n   * couple of hundred milliseconds costs nothing; a blocked LCP costs a lot.\n   */\n  defer?: boolean\n  /**\n   * Fetch the catalog from the endpoint's `tools/list` when no `tools` are\n   * passed (default true). The fetch is gated on WebMCP being present.\n   */\n  discover?: boolean\n}\n\n// ============================================\n// Component\n// ============================================\n\n/**\n * Register this site's MCP tools with the visiting browser's agent.\n *\n * Renders nothing. Mount it as a CHILDLESS sibling in the layout — never as a\n * wrapper around `{children}`, which would de-opt the whole route to client\n * rendering (the cardinal rule in the root CLAUDE.md).\n *\n * @example\n * ```tsx\n * // app/layout.tsx\n * <SiteKitLayout>{children}</SiteKitLayout>\n * <WebMcpTools endpoint=\"/api/mcp\" />\n * ```\n *\n * Prefer `endpoint` (discovery) over a `tools` list from a server component:\n * descriptors passed as props land in every page's RSC payload.\n */\nexport function WebMcpTools({\n  tools = [],\n  localTools = [],\n  endpoint = '/api/mcp',\n  defer = true,\n  discover = true,\n}: WebMcpToolsProps) {\n  const ready = useDeferredActivation(defer)\n\n  useEffect(() => {\n    if (!ready) return\n    // Gate EVERYTHING on WebMCP being present. A browser without it does no\n    // work and issues no request — which is every human visitor today.\n    const modelContext = getModelContext()\n    if (!modelContext) return\n\n    const controller = new AbortController()\n\n    const callRemote = async (\n      name: string,\n      args: Record<string, unknown>,\n    ): Promise<McpToolResult> => {\n      try {\n        const response = await fetch(endpoint, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n            Accept: 'application/json, text/event-stream',\n            'Mcp-Method': 'tools/call',\n            'Mcp-Name': name,\n          },\n          body: JSON.stringify({\n            jsonrpc: '2.0',\n            id: `webmcp-${name}`,\n            method: 'tools/call',\n            params: { name, arguments: args },\n          }),\n          signal: controller.signal,\n        })\n        const payload = (await response.json()) as {\n          result?: McpToolResult\n          error?: { message?: string }\n        }\n        if (payload.error) {\n          return {\n            content: [{ type: 'text', text: payload.error.message ?? 'Tool call failed.' }],\n            isError: true,\n          }\n        }\n        return payload.result ?? { content: [{ type: 'text', text: '(no result)' }] }\n      } catch (error) {\n        if (controller.signal.aborted) throw error\n        const detail = error instanceof Error ? error.message : String(error)\n        return { content: [{ type: 'text', text: `Tool call failed: ${detail}` }], isError: true }\n      }\n    }\n\n    const normalize = (value: unknown): McpToolResult => {\n      if (value && typeof value === 'object' && Array.isArray((value as McpToolResult).content)) {\n        return value as McpToolResult\n      }\n      return {\n        content: [\n          { type: 'text', text: typeof value === 'string' ? value : JSON.stringify(value, null, 2) },\n        ],\n        structuredContent: value,\n      }\n    }\n\n    const proxied = (list: WebMcpToolDescriptor[]): WebMcpToolDefinition[] =>\n      list.map((tool) => ({\n        name: tool.name,\n        description: tool.description,\n        inputSchema: tool.inputSchema,\n        execute: (args: Record<string, unknown>) => callRemote(tool.name, args ?? {}),\n      }))\n\n    const local = localTools.map((tool) => ({\n      name: tool.name,\n      description: tool.description,\n      inputSchema: tool.inputSchema,\n      execute: async (args: Record<string, unknown>) => normalize(await tool.execute(args ?? {})),\n    }))\n\n    /** Ask our own endpoint what it serves, so the two can't disagree. */\n    const listRemoteTools = async (): Promise<WebMcpToolDescriptor[]> => {\n      const response = await fetch(endpoint, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          Accept: 'application/json, text/event-stream',\n          'Mcp-Method': 'tools/list',\n        },\n        body: JSON.stringify({ jsonrpc: '2.0', id: 'webmcp-list', method: 'tools/list' }),\n        signal: controller.signal,\n      })\n      const payload = (await response.json()) as {\n        result?: { tools?: WebMcpToolDescriptor[] }\n      }\n      return payload.result?.tools ?? []\n    }\n\n    let cancelled = false\n    void (async () => {\n      try {\n        const discovered =\n          tools.length === 0 && discover ? await listRemoteTools() : tools\n        if (cancelled) return\n\n        const definitions = [...proxied(discovered), ...local]\n        if (definitions.length === 0) return\n\n        if (typeof modelContext.registerTool === 'function') {\n          for (const definition of definitions) {\n            if (cancelled) return\n            await modelContext.registerTool(definition, { signal: controller.signal })\n          }\n        } else if (typeof modelContext.provideContext === 'function') {\n          await modelContext.provideContext({ tools: definitions })\n        }\n      } catch (error) {\n        // A draft API that rejects is not a site error. Stay silent in\n        // production so a spec change never shows up as console noise on a\n        // marketing page.\n        if (process.env.NODE_ENV !== 'production') {\n          console.warn('[site-kit/mcp] WebMCP registration failed:', error)\n        }\n      }\n    })()\n\n    return () => {\n      cancelled = true\n      // Aborting the signal is how WebMCP unregisters — important on client\n      // navigation, or the previous page's tools linger on the document.\n      controller.abort()\n    }\n  }, [ready, tools, localTools, endpoint, discover])\n\n  return null\n}\n"]}

package/dist/mcp/declarative.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"declarative.d.ts","sourceRoot":"","sources":["../../src/mcp/declarative.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,WAAW,0BAA0B;IACzC,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,0BAA0B,GAClC,6BAA6B,CAS/B;AAED,MAAM,WAAW,8BAA8B;IAC7C,oBAAoB,EAAE,MAAM,CAAA;CAC7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,8BAA8B,CAExF"}

package/dist/mcp/handlers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/mcp/handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAKL,+BAA+B,EAG/B,KAAK,mBAAmB,EACzB,MAAM,YAAY,CAAA;AACnB,OAAO,EAEL,KAAK,yBAAyB,EAE/B,MAAM,cAAc,CAAA;AAoCrB;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAcrE;AAMD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,mBAAmB,CAAA;IAC3B,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;IAC/B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7C,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CACjD;AAoBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CA8G7E;AAMD,MAAM,WAAW,2BAA4B,SAAQ,yBAAyB;IAC5E,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC5B,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAA;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,2BAA2B,GACnC,0BAA0B,CAkB5B;AAED,OAAO,EAAE,+BAA+B,EAAE,CAAA"}

package/dist/mcp/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,sBAAsB,EACtB,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,cAAc,EACd,aAAa,EACb,aAAa,GACd,MAAM,SAAS,CAAA;AAEhB,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAKvC,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,+BAA+B,EAC/B,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,sCAAsC,EACtC,wBAAwB,EACxB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,cAAc,EACd,eAAe,EACf,YAAY,EACZ,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,YAAY,CAAA;AAKnB,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,aAAa,EACb,SAAS,EACT,yBAAyB,GAC1B,MAAM,cAAc,CAAA;AAKrB,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,YAAY,CAAA;AAKnB,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AACzE,YAAY,EACV,0BAA0B,EAC1B,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,eAAe,CAAA"}

package/dist/mcp/index.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/mcp/types.ts","../../src/mcp/protocol.ts","../../src/mcp/serverCard.ts","../../src/mcp/handlers.ts","../../src/mcp/declarative.ts"],"names":[],"mappings":";;;;;AAsKO,SAAS,cACd,IAAA,EACsB;AACtB,EAAA,OAAO,IAAA;AACT;;;ACtIO,IAAM,2BAAA,GAA8B;AAOpC,IAAM,4BAAA,GAA+B,CAAC,YAAA,EAAc,YAAA,EAAc,YAAY;AAG9E,IAAM,+BAAA,GAAkC;AAAA,EAC7C,2BAAA;AAAA,EACA,GAAG;AACL;AAGO,IAAM,qBAAA,GAAwB;AAC9B,IAAM,gBAAA,GAAmB;AACzB,IAAM,gBAAA,GAAmB;AAMzB,IAAM,mBAAA,GAAsB,MAAA;AAC5B,IAAM,uBAAA,GAA0B,MAAA;AAChC,IAAM,wBAAA,GAA2B;AACjC,IAAM,sBAAA,GAAyB,MAAA;AAG/B,IAAM,yBAAA,GAA4B;AAElC,IAAM,sCAAA,GAAyC;AA4CtD,IAAM,aAAA,GAAgB,GAAA;AAEtB,SAAS,aAAa,KAAA,EAAwC;AAC5D,EAAA,OACE,OAAO,UAAU,QAAA,IACjB,KAAA,KAAU,QACV,KAAA,CAAM,OAAA,CAAS,MAAwB,OAAO,CAAA;AAElD;AAUO,SAAS,aAAa,KAAA,EAA+B;AAC1D,EAAA,IAAI,YAAA,CAAa,KAAK,CAAA,EAAG,OAAO,KAAA;AAEhC,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,CAAA,EAAE;AAAA,EACpD;AAEA,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AACzC,IAAA,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,MAAA,EAAQ,IAAA,EAAM,aAAA,EAAe,CAAA,EAAE;AAAA,EAC5D;AAEA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACN,IAAA,IAAA,GAAO,OAAO,KAAK,CAAA;AAAA,EACrB;AACA,EAAA,IAAI,IAAA,CAAK,SAAS,aAAA,EAAe;AAC/B,IAAA,IAAA,GAAO,CAAA,EAAG,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,aAAa,CAAC;AAAA,kBAAA,CAAA;AAAA,EACxC;AAEA,EAAA,OAAO;AAAA,IACL,SAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,CAAA;AAAA,IAChC,iBAAA,EAAmB;AAAA,GACrB;AACF;AAEO,SAAS,gBAAgB,OAAA,EAAgC;AAC9D,EAAA,OAAO,EAAE,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,CAAA,EAAG,OAAA,EAAS,IAAA,EAAK;AACrE;AAgBO,SAAS,iBAAiB,IAAA,EAAgD;AAC/E,EAAA,MAAM,UAAA,GAAgC;AAAA,IACpC,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,aAAa,IAAA,CAAK,WAAA;AAAA,IAClB,aAAa,IAAA,CAAK;AAAA,GACpB;AACA,EAAA,IAAI,IAAA,CAAK,KAAA,EAAO,UAAA,CAAW,KAAA,GAAQ,IAAA,CAAK,KAAA;AACxC,EAAA,IAAI,IAAA,CAAK,YAAA,EAAc,UAAA,CAAW,YAAA,GAAe,IAAA,CAAK,YAAA;AACtD,EAAA,IAAI,IAAA,CAAK,WAAA,EAAa,UAAA,CAAW,WAAA,GAAc,IAAA,CAAK,WAAA;AACpD,EAAA,OAAO,UAAA;AACT;AAeO,SAAS,YAAA,CACd,MACA,IAAA,EACe;AACf,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,WAAA,CAAY,QAAA,IAAY,EAAC;AAC/C,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,MAAA,CAAO,CAAC,GAAA,KAAQ;AACvC,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAG,CAAA;AACtB,IAAA,OAAO,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,EAAA;AAAA,EAC5D,CAAC,CAAA;AACD,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,OAAO,CAAA,yBAAA,EAA4B,OAAA,CAAQ,MAAA,GAAS,CAAA,GAAI,GAAA,GAAM,EAAE,CAAA,EAAA,EAAK,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAA,EACzF;AAEA,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,MAAM,CAAA,IAAK,MAAA,CAAO,OAAA,CAAQ,IAAA,CAAK,WAAA,CAAY,UAAA,IAAc,EAAE,CAAA,EAAG;AAC7E,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAG,CAAA;AACtB,IAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AAC3C,IAAA,IAAI,OAAO,IAAA,IAAQ,CAAC,OAAO,IAAA,CAAK,QAAA,CAAS,KAAe,CAAA,EAAG;AACzD,MAAA,OAAO,CAAA,mBAAA,EAAsB,GAAG,CAAA,GAAA,EAAM,IAAA,CAAK,UAAU,KAAK,CAAC,sBAAsB,MAAA,CAAO,IAAA,CACrF,IAAI,CAAC,CAAA,KAAM,KAAK,SAAA,CAAU,CAAC,CAAC,CAAA,CAC5B,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAA,IACf;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAaA,SAAS,YAAA,GAAe;AAGtB,EAAA,OAAO,EAAE,KAAA,EAAO,EAAE,WAAA,EAAa,OAAM,EAAE;AACzC;AAEA,SAAS,gBAAgB,IAAA,EAAqB;AAC5C,EAAA,OAAO,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,OAAA,EAAS,KAAK,OAAA,EAAS,GAAI,IAAA,CAAK,KAAA,GAAQ,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA,EAAM,GAAI,EAAC,EAAG;AAChG;AAMO,SAAS,mBAAmB,OAAA,EAA0B;AAC3D,EAAA,OAAQ,+BAAA,CAAsD,SAAS,OAAO,CAAA;AAChF;AAEA,SAAS,uBAAA,CAAwB,IAAe,SAAA,EAAoC;AAClF,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,QAAA,EAAU;AAAA,MACR,OAAA,EAAS,KAAA;AAAA,MACT,EAAA;AAAA,MACA,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,sCAAA;AAAA,QACN,OAAA,EAAS,8BAAA;AAAA,QACT,MAAM,EAAE,SAAA,EAAW,CAAC,GAAG,+BAA+B,GAAG,SAAA;AAAU;AACrE;AACF,GACF;AACF;AAEO,SAAS,YAAA,CACd,EAAA,EACA,IAAA,EACA,OAAA,EACA,QACA,IAAA,EACiB;AACjB,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,UAAU,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,OAAO,EAAE,IAAA,EAAM,OAAA,EAAS,GAAI,OAAO,EAAE,IAAA,EAAK,GAAI,IAAI;AAAE,GACtF;AACF;AA+BA,eAAsB,QAAA,CACpB,SACA,OAAA,EAC0B;AAC1B,EAAA,MAAM,EAAE,QAAO,GAAI,OAAA;AACnB,EAAA,MAAM,EAAA,GAAK,QAAQ,EAAA,IAAM,IAAA;AACzB,EAAA,MAAM,cAAA,GAAiB,QAAQ,EAAA,KAAO,MAAA;AACtC,EAAA,MAAM,MAAA,GAAU,OAAA,CAAQ,MAAA,IAAU,EAAC;AACnC,EAAA,MAAM,IAAA,GAAQ,MAAA,CAAO,KAAA,IAAS,EAAC;AAI/B,EAAA,MAAM,WAAA,GACJ,OAAO,IAAA,CAAK,qBAAqB,MAAM,QAAA,GAClC,IAAA,CAAK,qBAAqB,CAAA,GAC3B,IAAA;AACN,EAAA,MAAM,aAAA,GAAgB,QAAQ,qBAAA,IAAyB,IAAA;AAEvD,EAAA,IAAI,WAAA,IAAe,aAAA,IAAiB,WAAA,KAAgB,aAAA,EAAe;AACjE,IAAA,OAAO,YAAA;AAAA,MACL,EAAA;AAAA,MACA,yBAAA;AAAA,MACA,CAAA,oDAAA,EAAuD,aAAa,CAAA,6BAAA,EAAgC,WAAW,CAAA,CAAA,CAAA;AAAA,MAC/G;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,mBAAmB,WAAA,IAAe,aAAA;AACxC,EAAA,IAAI,gBAAA,IAAoB,CAAC,kBAAA,CAAmB,gBAAgB,CAAA,EAAG;AAC7D,IAAA,OAAO,uBAAA,CAAwB,IAAI,gBAAgB,CAAA;AAAA,EACrD;AAIA,EAAA,IAAI,OAAA,CAAQ,YAAA,IAAgB,OAAA,CAAQ,YAAA,KAAiB,QAAQ,MAAA,EAAQ;AACnE,IAAA,OAAO,YAAA;AAAA,MACL,EAAA;AAAA,MACA,yBAAA;AAAA,MACA,CAAA,0CAAA,EAA6C,OAAA,CAAQ,YAAY,CAAA,6BAAA,EAAgC,QAAQ,MAAM,CAAA,CAAA,CAAA;AAAA,MAC/G;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,QAAQ,UAAA,EAAY;AACtB,IAAA,MAAM,QAAA,GACJ,OAAO,MAAA,CAAO,IAAA,KAAS,QAAA,GACnB,MAAA,CAAO,IAAA,GACP,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GACpB,MAAA,CAAO,GAAA,GACP,IAAA;AACR,IAAA,IAAI,QAAA,IAAY,OAAA,CAAQ,UAAA,KAAe,QAAA,EAAU;AAC/C,MAAA,OAAO,YAAA;AAAA,QACL,EAAA;AAAA,QACA,yBAAA;AAAA,QACA,CAAA,wCAAA,EAA2C,OAAA,CAAQ,UAAU,CAAA,6BAAA,EAAgC,QAAQ,CAAA,CAAA,CAAA;AAAA,QACrG;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,iBAAiB,WAAA,EAAa;AACxC,IAAA,IAAI,CAAC,aAAA,EAAe;AAClB,MAAA,OAAO,YAAA;AAAA,QACL,EAAA;AAAA,QACA,yBAAA;AAAA,QACA,kEAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,QAAQ,YAAA,EAAc;AACzB,MAAA,OAAO,YAAA;AAAA,QACL,EAAA;AAAA,QACA,yBAAA;AAAA,QACA,wDAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,aAAa,gBAAA,IAAoB,2BAAA;AAEvC,EAAA,QAAQ,QAAQ,MAAA;AAAQ;AAAA,IAEtB,KAAK,iBAAA,EAAmB;AACtB,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,GAAA;AAAA,QACR,QAAA,EAAU;AAAA,UACR,OAAA,EAAS,KAAA;AAAA,UACT,EAAA;AAAA,UACA,MAAA,EAAQ;AAAA,YACN,UAAA,EAAY,UAAA;AAAA,YACZ,iBAAA,EAAmB,CAAC,GAAG,+BAA+B,CAAA;AAAA,YACtD,cAAc,YAAA,EAAa;AAAA,YAC3B,GAAI,MAAA,CAAO,IAAA,CAAK,YAAA,GAAe,EAAE,cAAc,MAAA,CAAO,IAAA,CAAK,YAAA,EAAa,GAAI,EAAC;AAAA,YAC7E,KAAA,EAAO,OAAO,aAAA,IAAiB,IAAA;AAAA,YAC/B,UAAA,EAAY,QAAA;AAAA,YACZ,KAAA,EAAO,EAAE,CAAC,gBAAgB,GAAG,eAAA,CAAgB,MAAA,CAAO,IAAI,CAAA;AAAE;AAC5D;AACF,OACF;AAAA,IACF;AAAA;AAAA,IAGA,KAAK,YAAA,EAAc;AAKjB,MAAA,MAAM,QAAQ,OAAO,MAAA,CAAO,eAAA,KAAoB,QAAA,GAAW,OAAO,eAAA,GAAkB,EAAA;AACpF,MAAA,MAAM,SAAS,kBAAA,CAAmB,KAAK,CAAA,GAAI,KAAA,GAAQ,6BAA6B,CAAC,CAAA;AACjF,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,GAAA;AAAA,QACR,QAAA,EAAU;AAAA,UACR,OAAA,EAAS,KAAA;AAAA,UACT,EAAA;AAAA,UACA,MAAA,EAAQ;AAAA,YACN,eAAA,EAAiB,MAAA;AAAA,YACjB,cAAc,YAAA,EAAa;AAAA,YAC3B,UAAA,EAAY,eAAA,CAAgB,MAAA,CAAO,IAAI,CAAA;AAAA,YACvC,GAAI,MAAA,CAAO,IAAA,CAAK,YAAA,GAAe,EAAE,cAAc,MAAA,CAAO,IAAA,CAAK,YAAA,EAAa,GAAI;AAAC;AAC/E;AACF,OACF;AAAA,IACF;AAAA,IAEA,KAAK,2BAAA;AAAA,IACL,KAAK,aAAA;AACH,MAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,QAAA,EAAU,IAAA,EAAK;AAAA,IAEvC,KAAK,MAAA;AACH,MAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,QAAA,EAAU,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,MAAA,EAAQ,EAAC,EAAE,EAAE;AAAA;AAAA,IAGrE,KAAK,YAAA,EAAc;AACjB,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAClB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,YAAA,KAAiB,KAAK,EACtC,GAAA,CAAI,CAAC,CAAA,KAAM,gBAAA,CAAiB,CAAC,CAAC,CAAA;AACjC,MAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,QAAA,EAAU,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,MAAA,EAAQ,EAAE,KAAA,EAAM,EAAE,EAAE;AAAA,IAC5E;AAAA,IAEA,KAAK,YAAA,EAAc;AACjB,MAAA,MAAM,OAAO,OAAO,MAAA,CAAO,IAAA,KAAS,QAAA,GAAW,OAAO,IAAA,GAAO,EAAA;AAC7D,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,IAAA,IAAQ,CAAA,CAAE,YAAA,KAAiB,KAAK,CAAA;AAEjF,MAAA,IAAI,CAAC,IAAA,EAAM;AACT,QAAA,OAAO,YAAA;AAAA,UACL,EAAA;AAAA,UACA,sBAAA;AAAA,UACA,CAAA,cAAA,EAAiB,QAAQ,QAAQ,CAAA,CAAA;AAAA,UACjC,GAAA;AAAA,UACA;AAAA,YACE,SAAA,EAAW,MAAA,CAAO,KAAA,CACf,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,YAAA,KAAiB,KAAK,CAAA,CACtC,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAI;AAAA;AACtB,SACF;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAQ,MAAA,CAAO,SAAA,IAAa,EAAC;AACnC,MAAA,MAAM,OAAA,GAAU,YAAA,CAAa,IAAA,EAAM,IAAI,CAAA;AACvC,MAAA,IAAI,OAAA,EAAS;AAKX,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,GAAA;AAAA,UACR,QAAA,EAAU,EAAE,OAAA,EAAS,KAAA,EAAO,IAAI,MAAA,EAAQ,eAAA,CAAgB,OAAO,CAAA;AAAE,SACnE;AAAA,MACF;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,MAAO,IAAA,CAAK,OAAA,CAGV,IAAA,EAAM;AAAA,UAClB,GAAG,OAAA,CAAQ,OAAA;AAAA,UACX,OAAA,EAAS,MAAA;AAAA,UACT,eAAA,EAAiB;AAAA,SAClB,CAAA;AACD,QAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,QAAA,EAAU,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,MAAA,EAAQ,YAAA,CAAa,GAAG,CAAA,EAAE,EAAE;AAAA,MACpF,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,SAAS,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACpE,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,GAAA;AAAA,UACR,QAAA,EAAU;AAAA,YACR,OAAA,EAAS,KAAA;AAAA,YACT,EAAA;AAAA,YACA,QAAQ,eAAA,CAAgB,CAAA,MAAA,EAAS,KAAK,IAAI,CAAA,UAAA,EAAa,MAAM,CAAA,CAAE;AAAA;AACjE,SACF;AAAA,MACF;AAAA,IACF;AAAA;AAAA;AAAA,IAIA,KAAK,gBAAA;AACH,MAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,QAAA,EAAU,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,MAAA,EAAQ,EAAE,SAAA,EAAW,EAAC,IAAI,EAAE;AAAA,IACpF,KAAK,cAAA;AACH,MAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,QAAA,EAAU,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,MAAA,EAAQ,EAAE,OAAA,EAAS,EAAC,IAAI,EAAE;AAAA,IAElF,SAAS;AACP,MAAA,IAAI,gBAAgB,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,UAAU,IAAA,EAAK;AAGzD,MAAA,OAAO,aAAa,EAAA,EAAI,wBAAA,EAA0B,qBAAqB,OAAA,CAAQ,MAAM,IAAI,GAAG,CAAA;AAAA,IAC9F;AAAA;AAEJ;;;AC9eO,IAAM,sBAAA,GACX;AAGK,IAAM,oBAAA,GAAuB;AAE7B,IAAM,2BAAA,GAA8B;AAQpC,IAAM,sBAAA,GAAyB;AAyC/B,SAAS,mBAAmB,OAAA,EAAmD;AACpF,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC9C,EAAA,MAAM,IAAA,GAAO,QAAQ,OAAA,IAAW,UAAA;AAChC,EAAA,MAAM,MAAA,GAAS,CAAA,EAAG,IAAI,CAAA,EAAG,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,IAAA,GAAO,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA,CAAA;AAEjE,EAAA,MAAM,IAAA,GAAsB;AAAA,IAC1B,OAAA,EAAS,sBAAA;AAAA,IACT,IAAA,EAAM,QAAQ,IAAA,CAAK,IAAA;AAAA,IACnB,OAAA,EAAS,QAAQ,IAAA,CAAK,OAAA;AAAA,IACtB,WAAA,EAAa,QAAQ,IAAA,CAAK,WAAA;AAAA,IAC1B,OAAA,EAAS;AAAA,MACP;AAAA,QACE,IAAA,EAAM,iBAAA;AAAA,QACN,GAAA,EAAK,MAAA;AAAA,QACL,yBAAA,EAA2B,CAAC,GAAG,+BAA+B;AAAA,OAChE;AAAA,MACA,GAAI,OAAA,CAAQ,iBAAA,IAAqB;AAAC;AACpC,GACF;AAEA,EAAA,IAAI,QAAQ,IAAA,CAAK,KAAA,EAAO,IAAA,CAAK,KAAA,GAAQ,QAAQ,IAAA,CAAK,KAAA;AAClD,EAAA,IAAI,OAAA,CAAQ,KAAK,UAAA,IAAc,IAAA,OAAW,UAAA,GAAa,OAAA,CAAQ,KAAK,UAAA,IAAc,IAAA;AAClF,EAAA,IAAI,OAAA,CAAQ,KAAA,EAAO,MAAA,EAAQ,IAAA,CAAK,QAAQ,OAAA,CAAQ,KAAA;AAEhD,EAAA,MAAM,OAAgC,EAAC;AACvC,EAAA,IAAI,OAAA,CAAQ,KAAK,YAAA,EAAc;AAC7B,IAAA,IAAA,CAAK,gCAAgC,CAAA,GAAI,OAAA,CAAQ,IAAA,CAAK,YAAA;AAAA,EACxD;AACA,EAAA,IAAI,OAAA,CAAQ,OAAO,MAAA,EAAQ;AACzB,IAAA,IAAA,CAAK,sBAAsB,CAAA,GAAI,OAAA,CAAQ,KAAA,CACpC,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,YAAA,KAAiB,KAAK,CAAA,CACtC,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,MACX,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,GAAI,EAAE,KAAA,GAAQ,EAAE,OAAO,CAAA,CAAE,KAAA,KAAU,EAAC;AAAA,MACpC,aAAa,CAAA,CAAE,WAAA;AAAA,MACf,QAAA,EAAU,CAAA,CAAE,WAAA,EAAa,YAAA,IAAgB;AAAA,KAC3C,CAAE,CAAA;AAAA,EACN;AACA,EAAA,IAAI,OAAO,IAAA,CAAK,IAAI,EAAE,MAAA,GAAS,CAAA,OAAQ,KAAA,GAAQ,IAAA;AAE/C,EAAA,OAAO,IAAA;AACT;AAOO,SAAS,sBAAsB,IAAA,EAA+B;AACnE,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,IAAI,IAAA,CAAK,YAAY,sBAAA,EAAwB;AAC3C,IAAA,QAAA,CAAS,IAAA,CAAK,CAAA,mBAAA,EAAsB,sBAAsB,CAAA,CAAA,CAAG,CAAA;AAAA,EAC/D;AAGA,EAAA,IAAI,CAAC,oBAAA,CAAqB,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA,EAAG;AACzC,IAAA,QAAA,CAAS,IAAA;AAAA,MACP,CAAA,MAAA,EAAS,KAAK,IAAI,CAAA,8EAAA;AAAA,KACpB;AAAA,EACF;AACA,EAAA,IAAI,CAAC,4BAAA,CAA6B,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,EAAG;AACpD,IAAA,QAAA,CAAS,IAAA,CAAK,CAAA,SAAA,EAAY,IAAA,CAAK,OAAO,CAAA,yCAAA,CAA2C,CAAA;AAAA,EACnF;AACA,EAAA,IAAI,CAAC,IAAA,CAAK,WAAA,EAAa,MAAK,EAAG,QAAA,CAAS,KAAK,yBAAyB,CAAA;AAEtE,EAAA,KAAA,MAAW,MAAA,IAAU,IAAA,CAAK,OAAA,IAAW,EAAC,EAAG;AACvC,IAAA,IAAI,CAAC,aAAA,CAAc,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,IAAK,CAAC,qBAAA,CAAsB,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,EAAG;AAC9E,MAAA,QAAA,CAAS,IAAA,CAAK,CAAA,YAAA,EAAe,MAAA,CAAO,GAAG,CAAA,gDAAA,CAAkD,CAAA;AAAA,IAC3F;AAAA,EACF;AAEA,EAAA,OAAO,QAAA;AACT;;;AChHA,IAAM,mBAAA,GAAsB;AAAA,EAC1B,cAAA;AAAA,EACA,QAAA;AAAA,EACA,eAAA;AAAA,EACA,sBAAA;AAAA,EACA,YAAA;AAAA,EACA,UAAA;AAAA,EACA,gBAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,YAAY,MAAA,EAAwC;AAC3D,EAAA,OAAO;AAAA,IACL,6BAAA,EAA+B,MAAA;AAAA,IAC/B,8BAAA,EAAgC,eAAA;AAAA,IAChC,8BAAA,EAAgC,mBAAA,CAAoB,IAAA,CAAK,IAAI,CAAA;AAAA,IAC7D,+BAAA,EAAiC,sBAAA;AAAA,IACjC,wBAAA,EAA0B;AAAA,GAC5B;AACF;AAUO,SAAS,kBAAkB,KAAA,EAAqC;AACrE,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,EAAA,MAAM,KAAA,GAAQ,sBAAA,CAAuB,IAAA,CAAK,KAAK,CAAA;AAC/C,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,EAAA,IAAI;AACF,IAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAC9B,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,CAAC,CAAC,CAAA;AAC5B,MAAA,MAAM,KAAA,GAAQ,WAAW,IAAA,CAAK,MAAA,EAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAC,CAAA;AAC5D,MAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA;AAAA,IACvC;AACA,IAAA,OAAO,MAAA,CAAO,KAAK,KAAA,CAAM,CAAC,GAAG,QAAQ,CAAA,CAAE,SAAS,MAAM,CAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAgCA,SAAS,aAAA,CAAc,SAAkB,OAAA,EAAoD;AAC3F,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AAC3C,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,KAAY,GAAA,EAAK,OAAO,GAAA;AACxC,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,OAAA,CAAQ,CAAC,CAAA,IAAK,GAAA;AAClC,EAAA,OAAO,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,GAAI,MAAA,GAAS,IAAA;AAC7C;AAEA,SAAS,IAAA,CAAK,IAAA,EAAe,MAAA,EAAgB,OAAA,EAA2C;AACtF,EAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG;AAAA,IACxC,MAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACP,cAAA,EAAgB,kBAAA;AAAA,MAChB,eAAA,EAAiB,UAAA;AAAA,MACjB,GAAG;AAAA;AACL,GACD,CAAA;AACH;AAeO,SAAS,iBAAiB,OAAA,EAA8C;AAC7E,EAAA,MAAM,EAAE,QAAO,GAAI,OAAA;AAEnB,EAAA,eAAe,KAAK,OAAA,EAAqC;AACvD,IAAA,MAAM,MAAA,GAAS,aAAA,CAAc,OAAA,EAAS,OAAA,CAAQ,cAAc,CAAA;AAC5D,IAAA,IAAI,WAAW,IAAA,EAAM;AAGnB,MAAA,OAAO,IAAA;AAAA,QACL,EAAE,SAAS,KAAA,EAAO,KAAA,EAAO,EAAE,IAAA,EAAM,uBAAA,EAAyB,OAAA,EAAS,oBAAA,EAAqB,EAAE;AAAA,QAC1F,GAAA;AAAA,QACA;AAAC,OACH;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,YAAY,MAAM,CAAA;AAE/B,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,MAAM,QAAQ,IAAA,EAAK;AAAA,IAC/B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,QACL,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,IAAA,EAAM,KAAA,EAAO,EAAE,IAAA,EAAM,mBAAA,EAAqB,OAAA,EAAS,aAAA,EAAc,EAAE;AAAA,QACzF,GAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,qBAAA,GAAwB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,sBAAsB,CAAA;AACxE,IAAA,MAAM,eAAe,iBAAA,CAAkB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAC,CAAA;AACxE,IAAA,MAAM,aAAa,iBAAA,CAAkB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAC,CAAA;AAEpE,IAAA,MAAM,eAAA,GAAkB;AAAA,MACtB,MAAA;AAAA,MACA,OAAA,EAAS;AAAA,QACP,SAAS,OAAA,CAAQ,OAAA;AAAA,QACjB,OAAA;AAAA,QACA,QAAQ,OAAA,CAAQ;AAAA,OAClB;AAAA,MACA,qBAAA;AAAA,MACA,YAAA;AAAA,MACA,UAAA;AAAA,MACA,eAAe,OAAA,CAAQ;AAAA,KACzB;AAKA,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC1B,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA;AAAA,QAC7B,QAAQ,GAAA,CAAI,CAAC,MAAM,QAAA,CAAS,CAAA,EAAqB,eAAe,CAAC;AAAA,OACnE;AACA,MAAA,MAAM,SAAA,GAAY,SAAS,GAAA,CAAI,CAAC,MAAM,CAAA,CAAE,QAAQ,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA;AAChE,MAAA,IAAI,SAAA,CAAU,MAAA,KAAW,CAAA,EAAG,OAAO,IAAI,QAAA,CAAS,IAAA,EAAM,EAAE,MAAA,EAAQ,GAAA,EAAK,OAAA,EAAS,IAAA,EAAM,CAAA;AACpF,MAAA,OAAO,IAAA,CAAK,WAAW,GAAA,EAAK;AAAA,QAC1B,GAAG,IAAA;AAAA,QACH,wBAAwB,qBAAA,IAAyB;AAAA,OAClD,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,OAAA,GAAU,OAAA;AAChB,IAAA,IAAI,CAAC,WAAW,OAAO,OAAA,KAAY,YAAY,OAAO,OAAA,CAAQ,WAAW,QAAA,EAAU;AACjF,MAAA,MAAM,GAAA,GAAM,YAAA,CAAa,IAAA,EAAM,uBAAA,EAAyB,mBAAmB,GAAG,CAAA;AAC9E,MAAA,OAAO,IAAA,CAAK,GAAA,CAAI,QAAA,EAAU,GAAA,CAAI,QAAQ,IAAI,CAAA;AAAA,IAC5C;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,OAAA,EAAS,eAAe,CAAA;AAEvD,IAAA,IAAI,OAAA,CAAQ,aAAa,IAAA,EAAM;AAE7B,MAAA,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,GAAA,EAAK,OAAA,EAAS,MAAM,CAAA;AAAA,IAC1D;AAEA,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,QAAA,EAAU,OAAA,CAAQ,MAAA,EAAQ;AAAA,MAC5C,GAAG,IAAA;AAAA,MACH,wBAAwB,qBAAA,IAAyB;AAAA,KAClD,CAAA;AAAA,EACH;AAKA,EAAA,eAAe,iBAAiB,OAAA,EAAqC;AACnE,IAAA,MAAM,MAAA,GAAS,aAAA,CAAc,OAAA,EAAS,OAAA,CAAQ,cAAc,CAAA,IAAK,GAAA;AACjE,IAAA,OAAO,IAAI,QAAA;AAAA,MACT,KAAK,SAAA,CAAU;AAAA,QACb,OAAA,EAAS,KAAA;AAAA,QACT,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,uBAAA;AAAA,UACN,OAAA,EACE;AAAA;AACJ,OACD,CAAA;AAAA,MACD;AAAA,QACE,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,KAAA,EAAO,eAAA;AAAA,UACP,GAAG,YAAY,MAAM;AAAA;AACvB;AACF,KACF;AAAA,EACF;AAEA,EAAA,eAAe,QAAQ,OAAA,EAAqC;AAC1D,IAAA,MAAM,MAAA,GAAS,aAAA,CAAc,OAAA,EAAS,OAAA,CAAQ,cAAc,CAAA;AAC5D,IAAA,IAAI,MAAA,KAAW,MAAM,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAC9D,IAAA,OAAO,IAAI,QAAA,CAAS,IAAA,EAAM,EAAE,MAAA,EAAQ,KAAK,OAAA,EAAS,WAAA,CAAY,MAAM,CAAA,EAAG,CAAA;AAAA,EACzE;AAEA,EAAA,OAAO,EAAE,IAAA,EAAM,GAAA,EAAK,gBAAA,EAAkB,MAAA,EAAQ,kBAAkB,OAAA,EAAQ;AAC1E;AAsCO,SAAS,2BACd,OAAA,EAC4B;AAC5B,EAAA,MAAM,IAAA,GAAsB,mBAAmB,OAAO,CAAA;AACtD,EAAA,MAAM,OAAO,CAAA,EAAG,IAAA,CAAK,UAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAC;AAAA,CAAA;AAC7C,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,IAAA;AAEjC,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,eAAA,EAAiB,mBAAmB,MAAM,CAAA,CAAA;AAAA;AAAA,IAE1C,6BAAA,EAA+B,GAAA;AAAA,IAC/B,8BAAA,EAAgC,cAAA;AAAA,IAChC,8BAAA,EAAgC;AAAA,GAClC;AAEA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,YAAY,IAAI,QAAA,CAAS,MAAM,EAAE,MAAA,EAAQ,GAAA,EAAK,OAAA,EAAS,CAAA;AAAA,IAC5D,OAAA,EAAS,YAAY,IAAI,QAAA,CAAS,MAAM,EAAE,MAAA,EAAQ,GAAA,EAAK,OAAA,EAAS;AAAA,GAClE;AACF;;;ACjQO,SAAS,oBACd,OAAA,EAC+B;AAC/B,EAAA,MAAM,UAAA,GAA4C;AAAA,IAChD,UAAU,OAAA,CAAQ,IAAA;AAAA,IAClB,iBAAiB,OAAA,CAAQ;AAAA,GAC3B;AAGA,EAAA,IAAI,OAAA,CAAQ,UAAA,EAAY,UAAA,CAAW,cAAA,GAAiB,EAAA;AACpD,EAAA,OAAO,UAAA;AACT;AAuBO,SAAS,qBAAqB,WAAA,EAAqD;AACxF,EAAA,OAAO,EAAE,sBAAsB,WAAA,EAAY;AAC7C","file":"index.js","sourcesContent":["/**\n * @sonordev/site-kit/mcp — shared types\n *\n * ONE tool definition, THREE surfaces. A `SiteKitMcpTool` is consumed by:\n *\n *   1. the remote MCP endpoint  (`createMcpHandler`)      — off-browser agents\n *   2. the in-page WebMCP API   (`<WebMcpTools>`)         — browser agents\n *   3. the MCP Server Card      (`buildMcpServerCard`)    — discovery only\n *\n * Keeping the definition in one shape is the whole point: the tool an agent\n * finds by crawling `/.well-known/mcp.json` and the tool it finds by driving a\n * browser to the page are the same tool, with the same schema and the same\n * handler. Two definitions would drift the way the two Square token refreshers\n * drifted (see the root CLAUDE.md \"Consolidate Duplicated Logic\" note).\n */\n\n// ============================================\n// JSON Schema (the subset MCP tool inputs use)\n// ============================================\n\n/** A JSON Schema node. Deliberately loose — MCP passes these through verbatim. */\nexport interface JsonSchemaNode {\n  type?: 'object' | 'array' | 'string' | 'number' | 'integer' | 'boolean' | 'null'\n  description?: string\n  enum?: readonly (string | number | boolean | null)[]\n  default?: unknown\n  items?: JsonSchemaNode\n  properties?: Record<string, JsonSchemaNode>\n  required?: readonly string[]\n  additionalProperties?: boolean | JsonSchemaNode\n  minimum?: number\n  maximum?: number\n  minLength?: number\n  maxLength?: number\n  pattern?: string\n  format?: string\n  /** MCP 2026-07-28: mirror this param into an `Mcp-Param-{name}` HTTP header. */\n  'x-mcp-header'?: string\n  [key: string]: unknown\n}\n\n/** Tool input schemas are always objects at the root, per the MCP spec. */\nexport interface JsonSchemaObject extends JsonSchemaNode {\n  type: 'object'\n  properties?: Record<string, JsonSchemaNode>\n  required?: readonly string[]\n}\n\n// ============================================\n// Tool results\n// ============================================\n\nexport interface McpTextContent {\n  type: 'text'\n  text: string\n}\n\nexport interface McpResourceLinkContent {\n  type: 'resource_link'\n  uri: string\n  name?: string\n  description?: string\n  mimeType?: string\n}\n\nexport type McpContent = McpTextContent | McpResourceLinkContent\n\nexport interface McpToolResult {\n  content: McpContent[]\n  /** Machine-readable payload. Agents prefer this over parsing `content`. */\n  structuredContent?: unknown\n  isError?: boolean\n}\n\n/**\n * What a handler may return. Anything that is not already an `McpToolResult`\n * is normalized by `toToolResult()`: objects become pretty JSON in a text block\n * AND are carried verbatim as `structuredContent`, so an agent can either read\n * the prose or consume the data.\n */\nexport type McpToolHandlerResult =\n  | McpToolResult\n  // `object` rather than `Record<string, unknown>` on purpose: a plain\n  // `interface` has no index signature, so it does NOT satisfy Record and a\n  // handler returning a typed shape would fail to compile for no good reason.\n  | object\n  | string\n  | number\n  | boolean\n  | null\n\n/**\n * Behavioural hints. These are advisory — the spec is explicit that clients\n * must not make security decisions from them — but good agents use them to\n * decide what needs a human in the loop, so setting them honestly matters.\n */\nexport interface McpToolAnnotations {\n  title?: string\n  /** Tool does not modify anything. Every \"look something up\" tool is one. */\n  readOnlyHint?: boolean\n  /** Tool may perform irreversible updates. Anything creating a CRM record is. */\n  destructiveHint?: boolean\n  /** Calling twice with the same args changes nothing extra. */\n  idempotentHint?: boolean\n  /** Tool touches the open internet / third parties. */\n  openWorldHint?: boolean\n}\n\n/** Context handed to every tool handler. */\nexport interface McpToolContext {\n  /** Where the call came in from: the remote endpoint or the in-page API. */\n  surface: 'http' | 'webmcp'\n  /** Absolute site origin, e.g. `https://upforge.io`. */\n  baseUrl?: string\n  /** The originating Request, when the call arrived over HTTP. */\n  request?: Request\n  /** Negotiated protocol version, when known. */\n  protocolVersion?: string\n  /** Abort signal — WebMCP passes one; HTTP passes the request's. */\n  signal?: AbortSignal\n}\n\nexport type McpToolHandler<Args = Record<string, unknown>> = (\n  args: Args,\n  context: McpToolContext,\n) => Promise<McpToolHandlerResult> | McpToolHandlerResult\n\n// ============================================\n// The tool definition\n// ============================================\n\nexport interface SiteKitMcpTool<Args = Record<string, unknown>> {\n  /**\n   * Machine name. Keep it `snake_case` and verb-led (`get_services`,\n   * `request_site_audit`) — this is the string a model reasons about, and the\n   * spec only SHOULDs header-safe characters, so stick to `[a-z0-9_]`.\n   */\n  name: string\n  /** Human display name for tool pickers. */\n  title?: string\n  /**\n   * What the tool does, in the voice of someone explaining it to a colleague.\n   * This is the single highest-leverage field in the whole module: it is the\n   * only thing a model reads when deciding whether to call the tool.\n   */\n  description: string\n  inputSchema: JsonSchemaObject\n  /** Optional schema for `structuredContent`. */\n  outputSchema?: JsonSchemaObject\n  annotations?: McpToolAnnotations\n  handler: McpToolHandler<Args>\n  /**\n   * Set false to keep a tool off the in-page WebMCP surface while still\n   * serving it from the remote endpoint (default: true). Useful for tools\n   * whose handler needs server-only secrets.\n   */\n  exposeToWebMcp?: boolean\n  /**\n   * Set false to keep a tool off the remote HTTP endpoint while still\n   * registering it in-page (default: true). Useful for tools that only make\n   * sense against live DOM state.\n   */\n  exposeToHttp?: boolean\n}\n\n/** Identity-function helper: gives you inference + autocomplete on the schema. */\nexport function defineMcpTool<Args = Record<string, unknown>>(\n  tool: SiteKitMcpTool<Args>,\n): SiteKitMcpTool<Args> {\n  return tool\n}\n\n// ============================================\n// Server identity\n// ============================================\n\nexport interface McpServerInfo {\n  /**\n   * Reverse-DNS name with exactly one forward slash, per SEP-2127:\n   * `io.upforge/site`. The part before the slash is a namespace you control.\n   */\n  name: string\n  /** Semver. No ranges. */\n  version: string\n  /** Display name. */\n  title?: string\n  /** One or two sentences an agent reads before connecting. */\n  description: string\n  websiteUrl?: string\n  /** Natural-language guidance for models on how to use this server well. */\n  instructions?: string\n}\n\nexport interface McpServerIcon {\n  src: string\n  mimeType?: string\n  sizes?: string\n  theme?: 'light' | 'dark'\n}\n","/**\n * @sonordev/site-kit/mcp — MCP wire protocol (transport-agnostic)\n *\n * A dependency-free implementation of the server half of MCP, covering BOTH\n * protocol eras (the spec's own term — see /specification/2026-07-28/basic/versioning):\n *\n *   modern (2026-07-28)  stateless; every request carries its protocol version\n *                        in `_meta`, mirrored into the `MCP-Protocol-Version`\n *                        header. `server/discover` replaces the handshake.\n *                        No sessions, no GET stream.\n *\n *   legacy (<= 2025-11-25)  `initialize` handshake, then `tools/list`.\n *                        Still what most shipped clients and SDKs speak, so\n *                        dropping it would mean \"spec-compliant and unusable\".\n *\n * We deliberately do NOT depend on `@modelcontextprotocol/sdk`. The server\n * surface we need is a few hundred lines of JSON-RPC, and site-kit ships to\n * every marketing site in the fleet — an SDK in `dependencies` would land in\n * every one of those installs to save code we'd have to wrap anyway.\n *\n * This file is pure: it takes a parsed JSON-RPC message and returns a response\n * object. Anything HTTP-shaped lives in `handlers.ts`.\n */\n\nimport type {\n  McpServerInfo,\n  McpToolContext,\n  McpToolResult,\n  SiteKitMcpTool,\n} from './types'\n\n// ============================================\n// Protocol versions\n// ============================================\n\n/** Current revision: stateless, per-request `_meta`, `server/discover`. */\nexport const MCP_PROTOCOL_VERSION_MODERN = '2026-07-28'\n\n/**\n * Handshake-based revisions we still answer. Ordered newest-first — this is\n * also the preference order when a legacy client asks for something we don't\n * know, in which case the spec says to reply with our own best version.\n */\nexport const MCP_PROTOCOL_VERSIONS_LEGACY = ['2025-11-25', '2025-06-18', '2025-03-26'] as const\n\n/** Everything we accept, newest first. Advertised verbatim in errors. */\nexport const MCP_SUPPORTED_PROTOCOL_VERSIONS = [\n  MCP_PROTOCOL_VERSION_MODERN,\n  ...MCP_PROTOCOL_VERSIONS_LEGACY,\n] as const\n\n/** `_meta` keys defined by the modern revision. */\nexport const META_PROTOCOL_VERSION = 'io.modelcontextprotocol/protocolVersion'\nexport const META_CLIENT_INFO = 'io.modelcontextprotocol/clientInfo'\nexport const META_SERVER_INFO = 'io.modelcontextprotocol/serverInfo'\n\n// ============================================\n// JSON-RPC error codes\n// ============================================\n\nexport const JSONRPC_PARSE_ERROR = -32700\nexport const JSONRPC_INVALID_REQUEST = -32600\nexport const JSONRPC_METHOD_NOT_FOUND = -32601\nexport const JSONRPC_INVALID_PARAMS = -32602\nexport const JSONRPC_INTERNAL_ERROR = -32603\n/** MCP-defined: headers disagree with the body. */\nexport const MCP_ERROR_HEADER_MISMATCH = -32020\n/** MCP-defined: we don't speak the version the client asked for. */\nexport const MCP_ERROR_UNSUPPORTED_PROTOCOL_VERSION = -32022\n\n// ============================================\n// Message shapes\n// ============================================\n\nexport type JsonRpcId = string | number | null\n\nexport interface JsonRpcRequest {\n  jsonrpc: '2.0'\n  id?: JsonRpcId\n  method: string\n  params?: Record<string, unknown>\n}\n\nexport interface JsonRpcError {\n  code: number\n  message: string\n  data?: unknown\n}\n\nexport interface JsonRpcResponse {\n  jsonrpc: '2.0'\n  id: JsonRpcId\n  result?: unknown\n  error?: JsonRpcError\n}\n\n/**\n * A response plus the HTTP status the transport should use. The spec pins\n * specific statuses to specific errors (404 for unknown method, 400 for\n * version/header problems), so the status is part of the protocol, not a\n * transport detail the caller gets to invent.\n */\nexport interface DispatchOutcome {\n  /** null for an accepted notification — the transport answers 202. */\n  response: JsonRpcResponse | null\n  status: number\n}\n\n// ============================================\n// Result normalization\n// ============================================\n\nconst MAX_JSON_TEXT = 60_000\n\nfunction isToolResult(value: unknown): value is McpToolResult {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    Array.isArray((value as McpToolResult).content)\n  )\n}\n\n/**\n * Normalize whatever a handler returned into a spec-shaped tool result.\n *\n * Structured data is emitted BOTH ways on purpose: as `structuredContent` for\n * agents that parse, and as pretty JSON inside a text block for agents (still\n * the majority) that only read `content`. Returning one or the other is how\n * you end up invisible to half the ecosystem.\n */\nexport function toToolResult(value: unknown): McpToolResult {\n  if (isToolResult(value)) return value\n\n  if (typeof value === 'string') {\n    return { content: [{ type: 'text', text: value }] }\n  }\n\n  if (value === undefined || value === null) {\n    return { content: [{ type: 'text', text: '(no result)' }] }\n  }\n\n  let text: string\n  try {\n    text = JSON.stringify(value, null, 2)\n  } catch {\n    text = String(value)\n  }\n  if (text.length > MAX_JSON_TEXT) {\n    text = `${text.slice(0, MAX_JSON_TEXT)}\\n… (truncated)`\n  }\n\n  return {\n    content: [{ type: 'text', text }],\n    structuredContent: value,\n  }\n}\n\nexport function toolErrorResult(message: string): McpToolResult {\n  return { content: [{ type: 'text', text: message }], isError: true }\n}\n\n// ============================================\n// Tool descriptors\n// ============================================\n\nexport interface McpToolDescriptor {\n  name: string\n  title?: string\n  description: string\n  inputSchema: unknown\n  outputSchema?: unknown\n  annotations?: unknown\n}\n\n/** The public face of a tool — everything except the handler. */\nexport function toToolDescriptor(tool: SiteKitMcpTool<never>): McpToolDescriptor {\n  const descriptor: McpToolDescriptor = {\n    name: tool.name,\n    description: tool.description,\n    inputSchema: tool.inputSchema,\n  }\n  if (tool.title) descriptor.title = tool.title\n  if (tool.outputSchema) descriptor.outputSchema = tool.outputSchema\n  if (tool.annotations) descriptor.annotations = tool.annotations\n  return descriptor\n}\n\n// ============================================\n// Argument validation\n// ============================================\n\n/**\n * Minimal required-field + enum check.\n *\n * Intentionally shallow. A full JSON Schema validator is a dependency and a\n * maintenance surface, and the failure it would catch — a model inventing a\n * field — is better handled by the handler itself returning a helpful\n * `isError` result the model can read and retry against. What we DO enforce is\n * the part a model cannot recover from on its own: a missing required argument.\n */\nexport function validateArgs(\n  tool: SiteKitMcpTool<never>,\n  args: Record<string, unknown>,\n): string | null {\n  const required = tool.inputSchema.required ?? []\n  const missing = required.filter((key) => {\n    const value = args[key]\n    return value === undefined || value === null || value === ''\n  })\n  if (missing.length > 0) {\n    return `Missing required argument${missing.length > 1 ? 's' : ''}: ${missing.join(', ')}.`\n  }\n\n  for (const [key, schema] of Object.entries(tool.inputSchema.properties ?? {})) {\n    const value = args[key]\n    if (value === undefined || value === null) continue\n    if (schema.enum && !schema.enum.includes(value as string)) {\n      return `Invalid value for \"${key}\": ${JSON.stringify(value)}. Expected one of: ${schema.enum\n        .map((v) => JSON.stringify(v))\n        .join(', ')}.`\n    }\n  }\n\n  return null\n}\n\n// ============================================\n// Server definition\n// ============================================\n\nexport interface McpServerDefinition {\n  info: McpServerInfo\n  tools: SiteKitMcpTool<never>[]\n  /** How long clients may cache `server/discover`, in ms. */\n  discoverTtlMs?: number\n}\n\nfunction capabilities() {\n  // `listChanged: false` is the honest answer for a statically-defined tool\n  // set: there is no subscription stream to notify anyone on.\n  return { tools: { listChanged: false } }\n}\n\nfunction serverInfoBlock(info: McpServerInfo) {\n  return { name: info.name, version: info.version, ...(info.title ? { title: info.title } : {}) }\n}\n\n// ============================================\n// Version negotiation\n// ============================================\n\nexport function isSupportedVersion(version: string): boolean {\n  return (MCP_SUPPORTED_PROTOCOL_VERSIONS as readonly string[]).includes(version)\n}\n\nfunction unsupportedVersionError(id: JsonRpcId, requested: string): DispatchOutcome {\n  return {\n    status: 400,\n    response: {\n      jsonrpc: '2.0',\n      id,\n      error: {\n        code: MCP_ERROR_UNSUPPORTED_PROTOCOL_VERSION,\n        message: 'Unsupported protocol version',\n        data: { supported: [...MCP_SUPPORTED_PROTOCOL_VERSIONS], requested },\n      },\n    },\n  }\n}\n\nexport function errorOutcome(\n  id: JsonRpcId,\n  code: number,\n  message: string,\n  status: number,\n  data?: unknown,\n): DispatchOutcome {\n  return {\n    status,\n    response: { jsonrpc: '2.0', id, error: { code, message, ...(data ? { data } : {}) } },\n  }\n}\n\n// ============================================\n// Dispatch\n// ============================================\n\nexport interface DispatchOptions {\n  server: McpServerDefinition\n  context: Omit<McpToolContext, 'surface'>\n  /**\n   * Protocol version taken from the `MCP-Protocol-Version` header, if any.\n   * Compared against the body's `_meta` value; a disagreement is a -32020.\n   */\n  headerProtocolVersion?: string | null\n  /** `Mcp-Method` header, already base64-sentinel-decoded. */\n  headerMethod?: string | null\n  /** `Mcp-Name` header, already base64-sentinel-decoded. */\n  headerName?: string | null\n  /**\n   * Reject modern requests that omit the required mirror headers.\n   *\n   * Off by default, and that is a considered choice rather than laziness: a\n   * public marketing MCP server exists to be reachable, and today's shipped\n   * clients overwhelmingly speak a legacy revision or omit the mirrors. We\n   * always reject a header that *disagrees* with the body — that is the actual\n   * security property the mirrors exist for (an intermediary routing on the\n   * header while we execute the body). A merely absent header costs nothing.\n   */\n  strictHeaders?: boolean\n}\n\nexport async function dispatch(\n  message: JsonRpcRequest,\n  options: DispatchOptions,\n): Promise<DispatchOutcome> {\n  const { server } = options\n  const id = message.id ?? null\n  const isNotification = message.id === undefined\n  const params = (message.params ?? {}) as Record<string, unknown>\n  const meta = (params._meta ?? {}) as Record<string, unknown>\n\n  // ── Era detection ────────────────────────────────────────────────────────\n  // A request is \"modern\" if it carries the per-request protocol version.\n  const bodyVersion =\n    typeof meta[META_PROTOCOL_VERSION] === 'string'\n      ? (meta[META_PROTOCOL_VERSION] as string)\n      : null\n  const headerVersion = options.headerProtocolVersion || null\n\n  if (bodyVersion && headerVersion && bodyVersion !== headerVersion) {\n    return errorOutcome(\n      id,\n      MCP_ERROR_HEADER_MISMATCH,\n      `Header mismatch: MCP-Protocol-Version header value '${headerVersion}' does not match body value '${bodyVersion}'`,\n      400,\n    )\n  }\n\n  const requestedVersion = bodyVersion || headerVersion\n  if (requestedVersion && !isSupportedVersion(requestedVersion)) {\n    return unsupportedVersionError(id, requestedVersion)\n  }\n\n  // Mirror-header validation. A mismatch is always fatal; absence is fatal\n  // only in strict mode (see DispatchOptions.strictHeaders).\n  if (options.headerMethod && options.headerMethod !== message.method) {\n    return errorOutcome(\n      id,\n      MCP_ERROR_HEADER_MISMATCH,\n      `Header mismatch: Mcp-Method header value '${options.headerMethod}' does not match body value '${message.method}'`,\n      400,\n    )\n  }\n  if (options.headerName) {\n    const bodyName =\n      typeof params.name === 'string'\n        ? params.name\n        : typeof params.uri === 'string'\n          ? params.uri\n          : null\n    if (bodyName && options.headerName !== bodyName) {\n      return errorOutcome(\n        id,\n        MCP_ERROR_HEADER_MISMATCH,\n        `Header mismatch: Mcp-Name header value '${options.headerName}' does not match body value '${bodyName}'`,\n        400,\n      )\n    }\n  }\n  if (options.strictHeaders && bodyVersion) {\n    if (!headerVersion) {\n      return errorOutcome(\n        id,\n        MCP_ERROR_HEADER_MISMATCH,\n        'Header mismatch: required MCP-Protocol-Version header is missing',\n        400,\n      )\n    }\n    if (!options.headerMethod) {\n      return errorOutcome(\n        id,\n        MCP_ERROR_HEADER_MISMATCH,\n        'Header mismatch: required Mcp-Method header is missing',\n        400,\n      )\n    }\n  }\n\n  const negotiated = requestedVersion || MCP_PROTOCOL_VERSION_MODERN\n\n  switch (message.method) {\n    // ── Modern discovery (MUST implement) ──────────────────────────────────\n    case 'server/discover': {\n      return {\n        status: 200,\n        response: {\n          jsonrpc: '2.0',\n          id,\n          result: {\n            resultType: 'complete',\n            supportedVersions: [...MCP_SUPPORTED_PROTOCOL_VERSIONS],\n            capabilities: capabilities(),\n            ...(server.info.instructions ? { instructions: server.info.instructions } : {}),\n            ttlMs: server.discoverTtlMs ?? 3_600_000,\n            cacheScope: 'public',\n            _meta: { [META_SERVER_INFO]: serverInfoBlock(server.info) },\n          },\n        },\n      }\n    }\n\n    // ── Legacy handshake ───────────────────────────────────────────────────\n    case 'initialize': {\n      // Echo the client's version when we speak it; otherwise answer with our\n      // best legacy version. The spec asks modern-only servers to *name* their\n      // versions here because legacy clients have no fall-forward path — we\n      // support both eras, so we simply pick something mutually intelligible.\n      const asked = typeof params.protocolVersion === 'string' ? params.protocolVersion : ''\n      const agreed = isSupportedVersion(asked) ? asked : MCP_PROTOCOL_VERSIONS_LEGACY[0]\n      return {\n        status: 200,\n        response: {\n          jsonrpc: '2.0',\n          id,\n          result: {\n            protocolVersion: agreed,\n            capabilities: capabilities(),\n            serverInfo: serverInfoBlock(server.info),\n            ...(server.info.instructions ? { instructions: server.info.instructions } : {}),\n          },\n        },\n      }\n    }\n\n    case 'notifications/initialized':\n    case 'initialized':\n      return { status: 202, response: null }\n\n    case 'ping':\n      return { status: 200, response: { jsonrpc: '2.0', id, result: {} } }\n\n    // ── Tools ──────────────────────────────────────────────────────────────\n    case 'tools/list': {\n      const tools = server.tools\n        .filter((t) => t.exposeToHttp !== false)\n        .map((t) => toToolDescriptor(t))\n      return { status: 200, response: { jsonrpc: '2.0', id, result: { tools } } }\n    }\n\n    case 'tools/call': {\n      const name = typeof params.name === 'string' ? params.name : ''\n      const tool = server.tools.find((t) => t.name === name && t.exposeToHttp !== false)\n\n      if (!tool) {\n        return errorOutcome(\n          id,\n          JSONRPC_INVALID_PARAMS,\n          `Unknown tool: ${name || '(none)'}`,\n          400,\n          {\n            available: server.tools\n              .filter((t) => t.exposeToHttp !== false)\n              .map((t) => t.name),\n          },\n        )\n      }\n\n      const args = (params.arguments ?? {}) as Record<string, unknown>\n      const invalid = validateArgs(tool, args)\n      if (invalid) {\n        // Returned as a tool result rather than a JSON-RPC error, on purpose:\n        // an `isError` result goes back to the MODEL, which can read it and\n        // retry with the right arguments. A protocol error goes to the client\n        // harness and usually just surfaces as a failure.\n        return {\n          status: 200,\n          response: { jsonrpc: '2.0', id, result: toolErrorResult(invalid) },\n        }\n      }\n\n      try {\n        const raw = await (tool.handler as (\n          a: Record<string, unknown>,\n          c: McpToolContext,\n        ) => unknown)(args, {\n          ...options.context,\n          surface: 'http',\n          protocolVersion: negotiated,\n        })\n        return { status: 200, response: { jsonrpc: '2.0', id, result: toToolResult(raw) } }\n      } catch (error) {\n        const detail = error instanceof Error ? error.message : String(error)\n        return {\n          status: 200,\n          response: {\n            jsonrpc: '2.0',\n            id,\n            result: toolErrorResult(`Tool \"${tool.name}\" failed: ${detail}`),\n          },\n        }\n      }\n    }\n\n    // Declared unsupported rather than left to fall through, so the error names\n    // the reason instead of looking like a typo'd method.\n    case 'resources/list':\n      return { status: 200, response: { jsonrpc: '2.0', id, result: { resources: [] } } }\n    case 'prompts/list':\n      return { status: 200, response: { jsonrpc: '2.0', id, result: { prompts: [] } } }\n\n    default: {\n      if (isNotification) return { status: 202, response: null }\n      // 404 — the spec uses the status to distinguish an unknown METHOD on a\n      // real MCP endpoint from a 404 for an endpoint that isn't there at all.\n      return errorOutcome(id, JSONRPC_METHOD_NOT_FOUND, `Method not found: ${message.method}`, 404)\n    }\n  }\n}\n","/**\n * @sonordev/site-kit/mcp — MCP Server Card (SEP-2127)\n *\n * The card is a DISCOVERY document, not a capability manifest. SEP-2127 is\n * explicit that primitives (tools/resources/prompts) are omitted on purpose,\n * because what a server exposes can vary with auth state and feature flags —\n * the authoritative list is whatever `tools/list` returns at call time.\n *\n * So the card's job is small and specific: tell an agent that an MCP endpoint\n * exists here, what transport it speaks, and which protocol versions it knows,\n * with enough identity attached that a human reviewing the connection knows\n * what they're approving.\n *\n * ── The two paths ─────────────────────────────────────────────────────────\n * SEP-1649 originally proposed `/.well-known/mcp.json`. The ratified SEP-2127\n * moved to `/.well-known/mcp-server-card`. Plenty of deployed crawlers and\n * validators still probe the old path, and serving one JSON document from two\n * URLs costs nothing, so `createMcpServerCardHandler` is mounted at both.\n * `mcp-server-card` is the canonical one; `mcp.json` is compatibility.\n */\n\nimport type { McpServerIcon, McpServerInfo, SiteKitMcpTool } from './types'\nimport { MCP_SUPPORTED_PROTOCOL_VERSIONS } from './protocol'\n\nexport const MCP_SERVER_CARD_SCHEMA =\n  'https://static.modelcontextprotocol.io/schemas/v1/server-card.schema.json'\n\n/** Canonical well-known path (SEP-2127). */\nexport const MCP_SERVER_CARD_PATH = '/.well-known/mcp-server-card'\n/** Superseded SEP-1649 path, still widely probed. */\nexport const MCP_SERVER_CARD_LEGACY_PATH = '/.well-known/mcp.json'\n\n/**\n * Our own `_meta` namespace. `_meta` is the spec-sanctioned extension point,\n * and a reverse-DNS prefix is mandatory there, so a tool *summary* can ride\n * along without pretending to be a standard field. Agents that want the real\n * list still call `tools/list`; this is a hint for crawlers that never connect.\n */\nexport const SITE_KIT_CARD_META_KEY = 'io.sonor.site-kit/tools'\n\nexport interface McpRemote {\n  type: 'streamable-http' | 'sse'\n  url: string\n  supportedProtocolVersions?: string[]\n  headers?: {\n    name: string\n    description?: string\n    isRequired?: boolean\n    isSecret?: boolean\n    default?: string\n    choices?: string[]\n  }[]\n}\n\nexport interface McpServerCard {\n  $schema: string\n  name: string\n  version: string\n  description: string\n  title?: string\n  websiteUrl?: string\n  icons?: McpServerIcon[]\n  remotes?: McpRemote[]\n  _meta?: Record<string, unknown>\n}\n\nexport interface BuildMcpServerCardOptions {\n  info: McpServerInfo\n  /** Absolute site origin, e.g. `https://upforge.io` (no trailing slash). */\n  baseUrl: string\n  /** Path of the MCP endpoint on this origin (default `/api/mcp`). */\n  mcpPath?: string\n  icons?: McpServerIcon[]\n  /** Supply the tool set to publish a name/description summary under `_meta`. */\n  tools?: SiteKitMcpTool<never>[]\n  /** Extra remotes (e.g. a second endpoint on another host). */\n  additionalRemotes?: McpRemote[]\n}\n\nexport function buildMcpServerCard(options: BuildMcpServerCardOptions): McpServerCard {\n  const base = options.baseUrl.replace(/\\/$/, '')\n  const path = options.mcpPath ?? '/api/mcp'\n  const mcpUrl = `${base}${path.startsWith('/') ? path : `/${path}`}`\n\n  const card: McpServerCard = {\n    $schema: MCP_SERVER_CARD_SCHEMA,\n    name: options.info.name,\n    version: options.info.version,\n    description: options.info.description,\n    remotes: [\n      {\n        type: 'streamable-http',\n        url: mcpUrl,\n        supportedProtocolVersions: [...MCP_SUPPORTED_PROTOCOL_VERSIONS],\n      },\n      ...(options.additionalRemotes ?? []),\n    ],\n  }\n\n  if (options.info.title) card.title = options.info.title\n  if (options.info.websiteUrl || base) card.websiteUrl = options.info.websiteUrl || base\n  if (options.icons?.length) card.icons = options.icons\n\n  const meta: Record<string, unknown> = {}\n  if (options.info.instructions) {\n    meta['io.sonor.site-kit/instructions'] = options.info.instructions\n  }\n  if (options.tools?.length) {\n    meta[SITE_KIT_CARD_META_KEY] = options.tools\n      .filter((t) => t.exposeToHttp !== false)\n      .map((t) => ({\n        name: t.name,\n        ...(t.title ? { title: t.title } : {}),\n        description: t.description,\n        readOnly: t.annotations?.readOnlyHint ?? false,\n      }))\n  }\n  if (Object.keys(meta).length > 0) card._meta = meta\n\n  return card\n}\n\n/**\n * Validate a card against the parts of SEP-2127 that are actually checkable.\n * Returns human-readable problems; empty array means it looks conformant.\n * Used by the module's tests and worth calling in a site's own build check.\n */\nexport function validateMcpServerCard(card: McpServerCard): string[] {\n  const problems: string[] = []\n\n  if (card.$schema !== MCP_SERVER_CARD_SCHEMA) {\n    problems.push(`$schema should be \"${MCP_SERVER_CARD_SCHEMA}\"`)\n  }\n  // Reverse-DNS with EXACTLY one slash. `io.upforge/site` is valid;\n  // `upforge` and `io.upforge/site/mcp` are not.\n  if (!/^[^/\\s]+\\/[^/\\s]+$/.test(card.name)) {\n    problems.push(\n      `name \"${card.name}\" must be reverse-DNS with exactly one forward slash, e.g. \"io.example/server\"`,\n    )\n  }\n  if (!/^\\d+\\.\\d+\\.\\d+(?:[-+].+)?$/.test(card.version)) {\n    problems.push(`version \"${card.version}\" should be a concrete semver (no ranges)`)\n  }\n  if (!card.description?.trim()) problems.push('description is required')\n\n  for (const remote of card.remotes ?? []) {\n    if (!/^https:\\/\\//.test(remote.url) && !/^http:\\/\\/localhost/.test(remote.url)) {\n      problems.push(`remote url \"${remote.url}\" must be https (http allowed only on localhost)`)\n    }\n  }\n\n  return problems\n}\n","/**\n * @sonordev/site-kit/mcp — Next.js route handlers (Streamable HTTP + card)\n *\n * Two things get mounted on a site:\n *\n *   app/api/mcp/route.ts                  → createMcpHandler({ server })\n *   app/.well-known/mcp-server-card/...   → createMcpServerCardHandler({ ... })\n *   app/.well-known/mcp.json/route.ts     → the same handler (legacy path)\n *\n * The endpoint is stateless. Every request is self-describing, nothing is\n * cached between calls, and no session is minted — which is exactly what the\n * 2026-07-28 revision asks for and also the only thing that works on a\n * serverless host where consecutive requests hit different instances.\n */\n\nimport {\n  dispatch,\n  errorOutcome,\n  JSONRPC_INVALID_REQUEST,\n  JSONRPC_PARSE_ERROR,\n  MCP_SUPPORTED_PROTOCOL_VERSIONS,\n  MCP_PROTOCOL_VERSION_MODERN,\n  type JsonRpcRequest,\n  type McpServerDefinition,\n} from './protocol'\nimport {\n  buildMcpServerCard,\n  type BuildMcpServerCardOptions,\n  type McpServerCard,\n} from './serverCard'\n\n// ============================================\n// CORS\n// ============================================\n\n/**\n * Headers the MCP wire uses. `Mcp-Session-Id` and `Last-Event-ID` are legacy\n * (dropped in 2026-07-28) but listed so an older client's preflight passes\n * rather than failing opaquely in the browser.\n */\nconst MCP_REQUEST_HEADERS = [\n  'Content-Type',\n  'Accept',\n  'Authorization',\n  'MCP-Protocol-Version',\n  'Mcp-Method',\n  'Mcp-Name',\n  'Mcp-Session-Id',\n  'Last-Event-ID',\n]\n\nfunction corsHeaders(origin: string): Record<string, string> {\n  return {\n    'Access-Control-Allow-Origin': origin,\n    'Access-Control-Allow-Methods': 'POST, OPTIONS',\n    'Access-Control-Allow-Headers': MCP_REQUEST_HEADERS.join(', '),\n    'Access-Control-Expose-Headers': 'MCP-Protocol-Version',\n    'Access-Control-Max-Age': '86400',\n  }\n}\n\n// ============================================\n// Header decoding\n// ============================================\n\n/**\n * Undo the spec's Base64 sentinel wrapper: `=?base64?{b64}?=`.\n * Values that aren't wrapped come back untouched.\n */\nexport function decodeHeaderValue(value: string | null): string | null {\n  if (!value) return value\n  const match = /^=\\?base64\\?(.*)\\?=$/.exec(value)\n  if (!match) return value\n  try {\n    if (typeof atob === 'function') {\n      const binary = atob(match[1])\n      const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0))\n      return new TextDecoder().decode(bytes)\n    }\n    return Buffer.from(match[1], 'base64').toString('utf8')\n  } catch {\n    return value\n  }\n}\n\n// ============================================\n// MCP endpoint\n// ============================================\n\nexport interface McpHandlerOptions {\n  server: McpServerDefinition\n  /** Absolute site origin, passed to every tool handler as context. */\n  baseUrl?: string\n  /**\n   * Origins allowed to call the endpoint from a browser. Defaults to `*`.\n   *\n   * A public marketing MCP server is meant to be called by anyone's agent and\n   * serves only data that is already on the public site, so the wildcard is\n   * the correct setting, not a lapse. The DNS-rebinding attack the spec's\n   * Origin rule defends against is about *localhost* servers, where the\n   * browser can reach a private origin the attacker otherwise couldn't.\n   * Set this explicitly for any endpoint that gains auth or writes.\n   */\n  allowedOrigins?: string[] | '*'\n  /** Reject modern requests missing the mirror headers. See DispatchOptions. */\n  strictHeaders?: boolean\n}\n\nexport interface McpRouteHandlers {\n  POST: (request: Request) => Promise<Response>\n  GET: (request: Request) => Promise<Response>\n  DELETE: (request: Request) => Promise<Response>\n  OPTIONS: (request: Request) => Promise<Response>\n}\n\nfunction resolveOrigin(request: Request, allowed: string[] | '*' | undefined): string | null {\n  const origin = request.headers.get('origin')\n  if (!allowed || allowed === '*') return '*'\n  if (!origin) return allowed[0] ?? '*'\n  return allowed.includes(origin) ? origin : null\n}\n\nfunction json(body: unknown, status: number, headers: Record<string, string>): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: {\n      'Content-Type': 'application/json',\n      'Cache-Control': 'no-store',\n      ...headers,\n    },\n  })\n}\n\n/**\n * Create the Streamable HTTP MCP endpoint.\n *\n * @example\n * ```ts\n * // app/api/mcp/route.ts\n * import { createMcpHandler } from '@sonordev/site-kit/mcp'\n * import { mcpServer } from '@/lib/mcp/server'\n *\n * export const { POST, GET, DELETE, OPTIONS } = createMcpHandler({ server: mcpServer })\n * export const dynamic = 'force-dynamic'\n * ```\n */\nexport function createMcpHandler(options: McpHandlerOptions): McpRouteHandlers {\n  const { server } = options\n\n  async function POST(request: Request): Promise<Response> {\n    const origin = resolveOrigin(request, options.allowedOrigins)\n    if (origin === null) {\n      // Spec: invalid Origin MUST be 403; the body MAY be a JSON-RPC error\n      // with no id.\n      return json(\n        { jsonrpc: '2.0', error: { code: JSONRPC_INVALID_REQUEST, message: 'Origin not allowed' } },\n        403,\n        {},\n      )\n    }\n    const cors = corsHeaders(origin)\n\n    let payload: unknown\n    try {\n      payload = await request.json()\n    } catch {\n      return json(\n        { jsonrpc: '2.0', id: null, error: { code: JSONRPC_PARSE_ERROR, message: 'Parse error' } },\n        400,\n        cors,\n      )\n    }\n\n    const headerProtocolVersion = request.headers.get('mcp-protocol-version')\n    const headerMethod = decodeHeaderValue(request.headers.get('mcp-method'))\n    const headerName = decodeHeaderValue(request.headers.get('mcp-name'))\n\n    const dispatchOptions = {\n      server,\n      context: {\n        baseUrl: options.baseUrl,\n        request,\n        signal: request.signal,\n      },\n      headerProtocolVersion,\n      headerMethod,\n      headerName,\n      strictHeaders: options.strictHeaders,\n    }\n\n    // The current revision says the body is a single message. Batching was\n    // removed in 2025-06-18, but older clients still send arrays and answering\n    // them is a few lines, so we do.\n    if (Array.isArray(payload)) {\n      const outcomes = await Promise.all(\n        payload.map((m) => dispatch(m as JsonRpcRequest, dispatchOptions)),\n      )\n      const responses = outcomes.map((o) => o.response).filter(Boolean)\n      if (responses.length === 0) return new Response(null, { status: 202, headers: cors })\n      return json(responses, 200, {\n        ...cors,\n        'MCP-Protocol-Version': headerProtocolVersion || MCP_PROTOCOL_VERSION_MODERN,\n      })\n    }\n\n    const message = payload as JsonRpcRequest\n    if (!message || typeof message !== 'object' || typeof message.method !== 'string') {\n      const bad = errorOutcome(null, JSONRPC_INVALID_REQUEST, 'Invalid Request', 400)\n      return json(bad.response, bad.status, cors)\n    }\n\n    const outcome = await dispatch(message, dispatchOptions)\n\n    if (outcome.response === null) {\n      // Accepted notification — 202 with no body, per the transport spec.\n      return new Response(null, { status: 202, headers: cors })\n    }\n\n    return json(outcome.response, outcome.status, {\n      ...cors,\n      'MCP-Protocol-Version': headerProtocolVersion || MCP_PROTOCOL_VERSION_MODERN,\n    })\n  }\n\n  // 2026-07-28 removed the GET stream and DELETE session teardown. The spec\n  // names 405 as the response a modern-only server gives older clients that\n  // still try them.\n  async function methodNotAllowed(request: Request): Promise<Response> {\n    const origin = resolveOrigin(request, options.allowedOrigins) ?? '*'\n    return new Response(\n      JSON.stringify({\n        jsonrpc: '2.0',\n        error: {\n          code: JSONRPC_INVALID_REQUEST,\n          message:\n            'This MCP endpoint is stateless and accepts POST only. The GET stream and session teardown were removed in protocol revision 2026-07-28.',\n        },\n      }),\n      {\n        status: 405,\n        headers: {\n          'Content-Type': 'application/json',\n          Allow: 'POST, OPTIONS',\n          ...corsHeaders(origin),\n        },\n      },\n    )\n  }\n\n  async function OPTIONS(request: Request): Promise<Response> {\n    const origin = resolveOrigin(request, options.allowedOrigins)\n    if (origin === null) return new Response(null, { status: 403 })\n    return new Response(null, { status: 204, headers: corsHeaders(origin) })\n  }\n\n  return { POST, GET: methodNotAllowed, DELETE: methodNotAllowed, OPTIONS }\n}\n\n// ============================================\n// Server card endpoint\n// ============================================\n\nexport interface McpServerCardHandlerOptions extends BuildMcpServerCardOptions {\n  /** Seconds for `Cache-Control: public, max-age=…` (default 3600). */\n  maxAge?: number\n}\n\nexport interface McpServerCardRouteHandlers {\n  GET: () => Promise<Response>\n  OPTIONS: () => Promise<Response>\n}\n\n/**\n * Serve the SEP-2127 server card. Mount at BOTH well-known paths.\n *\n * The handler never reads the incoming Request, so the route stays statically\n * prerenderable — the same constraint the llms.txt handlers document, and for\n * the same reason: touching `request.headers` opts the route into dynamic\n * rendering and it stops being served from the CDN.\n *\n * @example\n * ```ts\n * // app/.well-known/mcp-server-card/route.ts\n * import { createMcpServerCardHandler } from '@sonordev/site-kit/mcp'\n * import { mcpServer, SITE_URL } from '@/lib/mcp/server'\n *\n * export const { GET, OPTIONS } = createMcpServerCardHandler({\n *   info: mcpServer.info,\n *   tools: mcpServer.tools,\n *   baseUrl: SITE_URL,\n * })\n * export const revalidate = 3600\n * ```\n */\nexport function createMcpServerCardHandler(\n  options: McpServerCardHandlerOptions,\n): McpServerCardRouteHandlers {\n  const card: McpServerCard = buildMcpServerCard(options)\n  const body = `${JSON.stringify(card, null, 2)}\\n`\n  const maxAge = options.maxAge ?? 3600\n\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/json',\n    'Cache-Control': `public, max-age=${maxAge}`,\n    // The card is a discovery document — it is meant to be fetched by anyone.\n    'Access-Control-Allow-Origin': '*',\n    'Access-Control-Allow-Methods': 'GET, OPTIONS',\n    'Access-Control-Allow-Headers': 'Content-Type',\n  }\n\n  return {\n    GET: async () => new Response(body, { status: 200, headers }),\n    OPTIONS: async () => new Response(null, { status: 204, headers }),\n  }\n}\n\nexport { MCP_SUPPORTED_PROTOCOL_VERSIONS }\n","/**\n * @sonordev/site-kit/mcp — declarative WebMCP (forms as tools)\n *\n * The half of WebMCP that needs no JavaScript. A `<form>` carrying `toolname`\n * and `tooldescription` IS an agent tool: the browser synthesizes the input\n * schema from the form controls, and the agent fills and submits the real\n * form the human would have used.\n *\n * This matters more than the imperative API for one reason — there is exactly\n * one code path. The agent submits the same form, hits the same validation,\n * files the same CRM record. Nothing can drift, because there is nothing to\n * drift from.\n *\n * Attributes (per the W3C declarative-api explainer):\n *   toolname               on <form>     — the tool's machine name\n *   tooldescription        on <form>     — what it does\n *   toolautosubmit         on <form>     — submit without waiting for the human\n *   toolparamdescription   on a control  — describes that field in the schema\n *\n * These are plain HTML attributes; React 19 passes unknown lowercase\n * attributes straight through to the DOM, so the returned objects spread\n * directly onto JSX.\n */\n\nexport interface DeclarativeToolFormOptions {\n  /** Machine name, `snake_case`. Match the remote tool it mirrors. */\n  name: string\n  /** What submitting this form accomplishes, in one sentence. */\n  description: string\n  /**\n   * Let an agent submit without a human confirming.\n   *\n   * Default false, and leave it false for anything that creates a record,\n   * sends a message, or spends money. A booking request or an audit request\n   * should be something the person watching agrees to — `toolautosubmit` on a\n   * lead form is how an agent files fifty of them by accident.\n   */\n  autoSubmit?: boolean\n}\n\nexport interface DeclarativeToolFormAttributes {\n  toolname: string\n  tooldescription: string\n  toolautosubmit?: string\n}\n\n/**\n * Attributes that turn a `<form>` into an agent-callable tool.\n *\n * @example\n * ```tsx\n * <form {...declarativeToolForm({\n *   name: 'request_site_audit',\n *   description: 'Request a free technical SEO and performance audit of a website.',\n * })} action=\"/api/audit\" method=\"post\">\n * ```\n */\nexport function declarativeToolForm(\n  options: DeclarativeToolFormOptions,\n): DeclarativeToolFormAttributes {\n  const attributes: DeclarativeToolFormAttributes = {\n    toolname: options.name,\n    tooldescription: options.description,\n  }\n  // Boolean attribute: present means true. Omit it entirely for false —\n  // `toolautosubmit=\"false\"` is still *present*, and so still true.\n  if (options.autoSubmit) attributes.toolautosubmit = ''\n  return attributes\n}\n\nexport interface DeclarativeToolFieldAttributes {\n  toolparamdescription: string\n}\n\n/**\n * Describe one form control for the synthesized input schema.\n *\n * The control's `name` becomes the schema property and `required` marks it\n * required, so this only supplies the prose — but the prose is what the model\n * reads to decide what to put in the field.\n *\n * @example\n * ```tsx\n * <input\n *   type=\"url\"\n *   name=\"url\"\n *   required\n *   {...declarativeToolField('The full URL of the website to audit, including https://')}\n * />\n * ```\n */\nexport function declarativeToolField(description: string): DeclarativeToolFieldAttributes {\n  return { toolparamdescription: description }\n}\n"]}