@tangle-network/agent-app 0.44.60 → 0.45.2

package/dist/sandbox/index.js

@@ -13,10 +13,7 @@ import {
   assertEnvWithinLimits,
   assertProvisionPayloadWithinCap,
   attachReasoningEffort,
-  bearerSubprotocolToken,
-  bearerToken,
   buildAppToolMcpServers,
-  buildSandboxRuntimeProxyHeaders,
   buildSandboxToolFileMounts,
   buildSandboxToolPathSetupScript,
   classifySeveredStream,
@@ -24,26 +21,18 @@ import {
   createD1PrewarmClaimStore,
   createSandboxPrewarmer,
   createSandboxTerminalConnectionRoute,
-  createSandboxTerminalToken,
-  createWorkspaceSandboxConnectionHandler,
   createWorkspaceSandboxManager,
-  createWorkspaceSandboxRuntimeProxyHandler,
-  createWorkspaceSandboxTerminalUpgradeHandler,
   deferredCorpusHash,
   deleteSecret,
   detectInteractiveQuestion,
   driveSandboxTurn,
-  encodeSandboxRuntimePath,
   ensureWorkspaceSandbox,
   flattenHistory,
   getClient,
-  isSandboxTerminalWsUpgrade,
   isTerminalPromptEvent,
-  matchSandboxTerminalWsPath,
   mergeExtraMcp,
   mergeHistoryIntoParts,
   mintSandboxScopedToken,
-  mintTerminalProxyToken,
   peekWorkspaceSandbox,
   readSandboxBinaryBytes,
   readSecret,
@@ -54,12 +43,10 @@ import {
   resolveSandboxClientCredentials,
   runSandboxPrompt,
   runSandboxToolPathSetup,
-  sandboxSidecarProxyUrl,
   sandboxToolBinDir,
   sandboxToolPath,
   sandboxToolRootDir,
   secretStoreFromClient,
-  selectedBearerSubprotocol,
   shellQuote,
   splitDeferredProfileFiles,
   statSandboxFileSize,
@@ -68,16 +55,12 @@ import {
   syncSandboxMemberAdd,
   syncSandboxMemberRemove,
   syncSandboxMemberRole,
-  terminalTokenFromRequest,
-  terminalUpgradeSubprotocolEcho,
-  verifySandboxTerminalToken,
-  verifyTerminalProxyToken,
   writeProfileFilesToBox
-} from "../chunk-APFJITYT.js";
+} from "../chunk-AOQ4FCSH.js";
 import "../chunk-LWSJK546.js";
-import "../chunk-CQZSAR77.js";
-import "../chunk-ICOHEZK6.js";
-import "../chunk-3EJ6SFJI.js";
+import "../chunk-73F3CKVK.js";
+import "../chunk-ITCINLSU.js";
+import "../chunk-IVEKCOM7.js";
 import "../chunk-YEFFHORB.js";
 import "../chunk-S5SRJJQG.js";
 import "../chunk-JML7WKWU.js";
@@ -96,10 +79,7 @@ export {
   assertEnvWithinLimits,
   assertProvisionPayloadWithinCap,
   attachReasoningEffort,
-  bearerSubprotocolToken,
-  bearerToken,
   buildAppToolMcpServers,
-  buildSandboxRuntimeProxyHeaders,
   buildSandboxToolFileMounts,
   buildSandboxToolPathSetupScript,
   classifySeveredStream,
@@ -107,26 +87,18 @@ export {
   createD1PrewarmClaimStore,
   createSandboxPrewarmer,
   createSandboxTerminalConnectionRoute,
-  createSandboxTerminalToken,
-  createWorkspaceSandboxConnectionHandler,
   createWorkspaceSandboxManager,
-  createWorkspaceSandboxRuntimeProxyHandler,
-  createWorkspaceSandboxTerminalUpgradeHandler,
   deferredCorpusHash,
   deleteSecret,
   detectInteractiveQuestion,
   driveSandboxTurn,
-  encodeSandboxRuntimePath,
   ensureWorkspaceSandbox,
   flattenHistory,
   getClient,
-  isSandboxTerminalWsUpgrade,
   isTerminalPromptEvent,
-  matchSandboxTerminalWsPath,
   mergeExtraMcp,
   mergeHistoryIntoParts,
   mintSandboxScopedToken,
-  mintTerminalProxyToken,
   peekWorkspaceSandbox,
   readSandboxBinaryBytes,
   readSecret,
@@ -137,12 +109,10 @@ export {
   resolveSandboxClientCredentials,
   runSandboxPrompt,
   runSandboxToolPathSetup,
-  sandboxSidecarProxyUrl,
   sandboxToolBinDir,
   sandboxToolPath,
   sandboxToolRootDir,
   secretStoreFromClient,
-  selectedBearerSubprotocol,
   shellQuote,
   splitDeferredProfileFiles,
   statSandboxFileSize,
@@ -151,10 +121,6 @@ export {
   syncSandboxMemberAdd,
   syncSandboxMemberRemove,
   syncSandboxMemberRole,
-  terminalTokenFromRequest,
-  terminalUpgradeSubprotocolEcho,
-  verifySandboxTerminalToken,
-  verifyTerminalProxyToken,
   writeProfileFilesToBox
 };
 //# sourceMappingURL=index.js.map

package/dist/sequences/index.d.ts

@@ -1,8 +1,9 @@
 import { j as SequenceMediaKind, f as SequenceTimeline, k as TimelineInterval, b as SequenceStore } from '../store-B7LLlk9p.js';
 export { M as MIN_SEQUENCE_CLIP_FRAMES, N as NewSequenceClip, l as NewSequenceDecision, m as NewSequenceTrack, g as SequenceClip, a as SequenceClipMedia, n as SequenceClipPatch, o as SequenceDecision, d as SequenceExportFormat, h as SequenceExportRecord, p as SequenceExportStatus, q as SequenceFrameSnapshot, i as SequenceMeta, r as SequenceStatus, S as SequenceStoreScope, e as SequenceTrack, c as SequenceTrackKind, T as TimelineClipBounds, s as assertClipFitsSequence, t as chooseCaptionPlacement, u as clampClipDuration, v as clampClipStart, w as formatSeconds, x as formatTimecode, y as framesToSeconds, z as secondsToFrames, A as snapshotFrame, B as trackIntervals } from '../store-B7LLlk9p.js';
 export { A as AddCaptionOperation, C as CaptionTargetResolution, a as CreateTrackOperation, D as DeleteClipOperation, E as ExtendSequenceOperation, M as MoveClipOperation, P as PlaceClipOperation, Q as QueueExportOperation, S as SEQUENCE_OPERATION_TYPES, b as SequenceApplyResult, c as SequenceOperation, d as SequenceOperationContext, e as SequenceOperationType, f as SequencePlan, g as SetClipDisabledOperation, h as SetClipTextOperation, i as SplitClipOperation, T as TrimClipOperation, j as applySequenceOperation, k as applySequenceOperations, l as assertSequenceMediaUrl, m as captionTrackNameForLanguage, n as lastClipEndFrame, p as parseSequenceOperations, r as resolveCaptionPlacement, o as resolveCaptionTarget, q as resolvePlaceClipTrack, v as validateAddCaption, s as validateCreateTrack, t as validateDeleteClip, u as validateExtendSequence, w as validateMoveClip, x as validatePlaceClip, y as validateQueueExport, z as validateSequenceOperation, B as validateSequenceOperations, F as validateSetClipDisabled, G as validateSetClipText, H as validateSplitClip, I as validateTrimClip } from '../apply-6wlMOLf8.js';
-import { S as ScopedMcpServerEntryOptions, A as AppToolMcpServer } from '../mcp-Dt4V4ZLT.js';
+import { S as ScopedMcpServerEntryOptions, A as AppToolMcpServer } from '../mcp-BOgNWSED.js';
 export { M as SEQUENCES_MCP_PROTOCOL_VERSIONS } from '../mcp-rpc-CzU5LWWT.js';
+import '@tangle-network/agent-interface';
 import '../types-DbU-oO5h.js';
 import '../auth-DJs6lfAs.js';
 

package/dist/sequences/index.js

@@ -18,7 +18,7 @@ import {
   MCP_PROTOCOL_VERSIONS,
   buildScopedMcpServerEntry,
   createMcpToolHandler
-} from "../chunk-3EJ6SFJI.js";
+} from "../chunk-IVEKCOM7.js";
 
 // src/sequences/operations.ts
 var SEQUENCE_OPERATION_TYPES = [

package/dist/skills-placement/index.js

@@ -4,7 +4,7 @@ import {
 } from "../chunk-M3UFMQ7D.js";
 import {
   KNOWN_HARNESSES
-} from "../chunk-CQZSAR77.js";
+} from "../chunk-73F3CKVK.js";
 
 // src/skills-placement/index.ts
 import { skillDirForHarness } from "@tangle-network/agent-profile-materialize";

package/dist/tools/index.d.ts

@@ -2,8 +2,9 @@ import { T as ToolHeaderNames } from '../auth-DJs6lfAs.js';
 export { A as AuthenticateOptions, D as DEFAULT_HEADER_NAMES, a as ToolAuthResult, b as authenticateToolRequest, r as readToolArgs } from '../auth-DJs6lfAs.js';
 import { e as AppToolTaxonomy, d as AppToolHandlers, b as AppToolDefinition, A as AppToolContext, c as AppToolProducedEvent, f as AppToolOutcome, a as AppToolName } from '../types-DbU-oO5h.js';
 export { g as APP_TOOL_NAMES, h as AddCitationArgs, i as AddCitationResult, B as BuildAppToolsOptions, O as OpenAIFunctionTool, R as RenderUiArgs, j as RenderUiResult, S as ScheduleFollowupArgs, k as ScheduleFollowupResult, l as SubmitProposalArgs, m as SubmitProposalResult, n as buildAppToolOpenAITools, o as customToolToOpenAI, p as defineAppTool, q as findCustomTool, r as isAppToolName } from '../types-DbU-oO5h.js';
-export { A as AppToolMcpServer, B as BuildHttpMcpServerOptions, a as BuildMcpServerOptions, D as DEFAULT_APP_TOOL_PATHS, S as ScopedMcpServerEntryOptions, b as buildAppToolMcpServer, c as buildHttpMcpServer, d as buildScopedMcpServerEntry } from '../mcp-Dt4V4ZLT.js';
+export { A as AppToolMcpServer, B as BuildHttpMcpServerOptions, a as BuildMcpServerOptions, D as DEFAULT_APP_TOOL_PATHS, S as ScopedMcpServerEntryOptions, b as buildAppToolMcpServer, c as buildHttpMcpServer, d as buildScopedMcpServerEntry, u as unresolvableSurfaceCredential } from '../mcp-BOgNWSED.js';
 export { C as CreateMcpToolHandlerOptions, M as MCP_PROTOCOL_VERSIONS, b as McpProtocolVersion, c as McpServerInfo, a as McpToolDefinition, d as createMcpToolHandler } from '../mcp-rpc-CzU5LWWT.js';
+import '@tangle-network/agent-interface';
 
 /** A correctable bad-input error a tool handler throws; the HTTP layer maps it
  *  to a 4xx with the code, the runtime layer to a failed tool_result. So the

package/dist/tools/index.js

@@ -9,7 +9,7 @@ import {
   restrictTaxonomy,
   verifyCapabilityToken,
   verifyExpiringCapabilityToken
-} from "../chunk-ICOHEZK6.js";
+} from "../chunk-ITCINLSU.js";
 import {
   DEFAULT_APP_TOOL_PATHS,
   DEFAULT_HEADER_NAMES,
@@ -19,8 +19,9 @@ import {
   buildHttpMcpServer,
   buildScopedMcpServerEntry,
   createMcpToolHandler,
-  readToolArgs
-} from "../chunk-3EJ6SFJI.js";
+  readToolArgs,
+  unresolvableSurfaceCredential
+} from "../chunk-IVEKCOM7.js";
 import {
   APP_TOOL_NAMES,
   ToolInputError,
@@ -56,6 +57,7 @@ export {
   readToolArgs,
   resolveToolCapabilities,
   restrictTaxonomy,
+  unresolvableSurfaceCredential,
   verifyCapabilityToken,
   verifyExpiringCapabilityToken
 };

package/dist/web-react/index.js

@@ -78,7 +78,7 @@ import {
   useSmoothText,
   useThinkingSeconds,
   waterfallLayout
-} from "../chunk-WXWU2FEB.js";
+} from "../chunk-RDK3CN7Y.js";
 import "../chunk-FBVLEGEG.js";
 import "../chunk-GINKOZFD.js";
 import {
@@ -102,7 +102,7 @@ import {
 import {
   tabTerminalConnectionId,
   useSandboxTerminalConnection
-} from "../chunk-S4YW2Y52.js";
+} from "../chunk-BATKJP3P.js";
 import "../chunk-QY4BRKRJ.js";
 import {
   ATTACHMENT_ACCEPT
@@ -157,7 +157,7 @@ import {
   stampInteractionAnswers
 } from "../chunk-3ZK5IJSW.js";
 import "../chunk-YJMCRXQQ.js";
-import "../chunk-CQZSAR77.js";
+import "../chunk-73F3CKVK.js";
 export {
   ATTACHMENT_ACCEPT,
   AgentActivityPanel,

package/dist/web-react/terminal.d.ts

@@ -13,13 +13,10 @@ interface SandboxTerminalConnection {
 /**
  * Define the response structure for a sandbox terminal connection including URLs, token, status, and errors
  *
- * Transport-agnostic by construction (#341/#349): the browser-direct
- * scoped-token route (`createSandboxTerminalConnectionRoute`,
- * `src/sandbox/terminal-connection.ts`) returns `sidecarUrl` only — no
- * `runtimeUrl` — while the (now `@deprecated`) same-origin proxy route
- * returns both. `useSandboxTerminalConnection` below resolves
- * `runtimeUrl ?? sidecarUrl` so either shape lands on the same connection
- * state without a hook change.
+ * The browser-direct scoped-token route (`createSandboxTerminalConnectionRoute`,
+ * `src/sandbox/terminal-connection.ts`) returns `sidecarUrl`. The hook also
+ * exposes that URL through the historical `runtimeUrl` state field so existing
+ * terminal panels do not need transport-specific branching.
  *
  * `connectionId` is the id the route's minted token's `sid` is bound to
  * (echoed back from the `connectionId` the hook sent) — pass it straight
@@ -63,12 +60,11 @@ interface UseSandboxTerminalConnectionResult extends SandboxTerminalConnection {
 /**
  * Manage and maintain a sandbox terminal connection with automatic polling and token refresh handling
  *
- * Transport-agnostic (#341/#349): this hook does not care whether
- * `connectionUrl` is backed by the fleet-default browser-direct
- * scoped-token route (`createSandboxTerminalConnectionRoute`,
- * `src/sandbox/terminal-connection.ts`, `sidecarUrl` only) or the
- * `@deprecated` same-origin proxy route (`runtimeUrl` + `sidecarUrl`) — it
- * resolves `runtimeUrl ?? sidecarUrl` either way.
+ * `connectionUrl` is backed by the browser-direct scoped-token route
+ * (`createSandboxTerminalConnectionRoute`,
+ * `src/sandbox/terminal-connection.ts`). The route returns `sidecarUrl`; the
+ * hook normalizes it into both URL fields for compatibility with existing
+ * terminal panels.
  *
  * Pass `tabTerminalConnectionId()` as `opts.connectionId` — the hook forwards
  * it as the `connectionId` query parameter the browser-direct route requires

package/dist/web-react/terminal.js

@@ -1,7 +1,7 @@
 import {
   tabTerminalConnectionId,
   useSandboxTerminalConnection
-} from "../chunk-S4YW2Y52.js";
+} from "../chunk-BATKJP3P.js";
 export {
   tabTerminalConnectionId,
   useSandboxTerminalConnection

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-app",
-  "version": "0.44.60",
+  "version": "0.45.2",
   "packageManager": "pnpm@11.17.0",
   "description": "Build agent applications with typed chat, tools, sandboxes, integrations, billing, and evaluation.",
   "keywords": [
@@ -438,7 +438,7 @@
     "@tangle-network/agent-docs": "0.2.1",
     "@tangle-network/agent-eval": "0.135.2",
     "@tangle-network/agent-integrations": "^0.52.0",
-    "@tangle-network/agent-interface": "0.36.0",
+    "@tangle-network/agent-interface": "0.40.0",
     "@tangle-network/agent-knowledge": "6.1.11",
     "@tangle-network/agent-profile-materialize": "0.9.2",
     "@tangle-network/agent-runtime": "0.109.2",
@@ -483,7 +483,7 @@
     "@radix-ui/react-dialog": ">=1.1",
     "@tangle-network/agent-eval": ">=0.135.2",
     "@tangle-network/agent-integrations": ">=0.52.0",
-    "@tangle-network/agent-interface": ">=0.36.0",
+    "@tangle-network/agent-interface": ">=0.38.0 <0.41.0",
     "@tangle-network/agent-knowledge": ">=6.1.11",
     "@tangle-network/agent-profile-materialize": ">=0.9.2",
     "@tangle-network/agent-runtime": ">=0.109.2",

package/dist/chunk-3EJ6SFJI.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/tools/auth.ts","../src/tools/mcp.ts","../src/tools/mcp-rpc.ts"],"sourcesContent":["import type { AppToolContext } from './types'\n\n/**\n * Header names carrying the server-set per-turn context + the capability token.\n * Defaults are product-neutral (`X-Agent-App-*`); a product that already ships\n * a header convention (e.g. `X-Acme-User-Id`) passes its own.\n */\nexport interface ToolHeaderNames {\n  userId: string\n  workspaceId: string\n  threadId: string\n}\n\n/** Provide default HTTP header names for user, workspace, and thread identification */\nexport const DEFAULT_HEADER_NAMES: ToolHeaderNames = {\n  userId: 'X-Agent-App-User-Id',\n  workspaceId: 'X-Agent-App-Workspace-Id',\n  threadId: 'X-Agent-App-Thread-Id',\n}\n\n/** Define options to verify bearer tokens and customize authentication header names */\nexport interface AuthenticateOptions {\n  /** Verify the bearer capability token belongs to `userId`. The product's\n   *  HMAC/JWT impl — the seam that keeps token crypto out of this package. */\n  verifyToken: (userId: string, bearer: string) => Promise<boolean>\n  headerNames?: ToolHeaderNames\n}\n\n/** Represent the result of tool authentication with success context or failure response */\nexport type ToolAuthResult =\n  | { ok: true; ctx: AppToolContext }\n  | { ok: false; response: Response }\n\n/**\n * Recover + verify the trusted context for a tool request. The user comes from\n * a server-set header and the bearer token MUST verify against THAT user; the\n * workspace comes from a header too — never from tool args — so the model can\n * neither forge identity nor target another workspace. Fail-closed: any missing\n * credential or a token minted for another user yields a 401/400 Response.\n */\nexport async function authenticateToolRequest(request: Request, opts: AuthenticateOptions): Promise<ToolAuthResult> {\n  const h = opts.headerNames ?? DEFAULT_HEADER_NAMES\n  const userId = request.headers.get(h.userId)?.trim()\n  const workspaceId = request.headers.get(h.workspaceId)?.trim()\n  const threadId = request.headers.get(h.threadId)?.trim() || null\n  const bearer = request.headers.get('authorization')?.match(/^Bearer\\s+(.+)$/i)?.[1]\n\n  if (!userId || !bearer) {\n    return { ok: false, response: Response.json({ error: 'Missing capability credentials' }, { status: 401 }) }\n  }\n  if (!(await opts.verifyToken(userId, bearer))) {\n    return { ok: false, response: Response.json({ error: 'Invalid capability token' }, { status: 401 }) }\n  }\n  if (!workspaceId) {\n    return { ok: false, response: Response.json({ error: 'Missing workspace context' }, { status: 400 }) }\n  }\n  return { ok: true, ctx: { userId, workspaceId, threadId } }\n}\n\n/** Read a tool's argument object from the request body, tolerant of MCP host\n *  aliases (`args` / `arguments`) or a bare body. Returns null on non-JSON. */\nexport async function readToolArgs<T>(request: Request): Promise<T | null> {\n  let body: { args?: T; arguments?: T }\n  try {\n    body = (await request.json()) as typeof body\n  } catch {\n    return null\n  }\n  return (body.args ?? body.arguments ?? (body as T)) as T\n}\n","import type { AppToolContext } from './types'\nimport type { AppToolName } from './openai'\nimport type { AppToolDefinition } from './registry'\nimport type { ToolHeaderNames } from './auth'\nimport { DEFAULT_HEADER_NAMES } from './auth'\n\n/** Default route path each app tool is served at. A product mounts its routes\n *  at these paths (or supplies its own via {@link BuildMcpServerOptions.paths}). */\nexport const DEFAULT_APP_TOOL_PATHS: Record<AppToolName, string> = {\n  submit_proposal: '/api/tools/propose',\n  schedule_followup: '/api/tools/followup',\n  render_ui: '/api/tools/render-ui',\n  add_citation: '/api/tools/citation',\n}\n\n/** The portable MCP server entry the sandbox SDK accepts (transport + url +\n *  headers). Matches `AgentProfileMcpServer` structurally without importing the\n *  sandbox SDK — products spread it into their profile's `mcp` map. */\nexport interface AppToolMcpServer {\n  transport: 'http'\n  url: string\n  headers: Record<string, string>\n  enabled: true\n  metadata: { description: string }\n}\n\n/** Define configuration options for building an HTTP MCP server including path, baseUrl, token, context, and description */\nexport interface BuildHttpMcpServerOptions {\n  /** Route path on the app the sandbox POSTs to (e.g. `/api/tools/propose`). */\n  path: string\n  /** App base URL the sandbox reaches back to (no trailing slash required). */\n  baseUrl: string\n  /** Per-user capability token, baked into the Authorization header. */\n  token: string\n  ctx: AppToolContext\n  /** Tool description the model sees. */\n  description: string\n  headerNames?: ToolHeaderNames\n}\n\n/**\n * Build ONE HTTP MCP server entry — the generic agent→app bridge. The\n * capability token + the user/workspace/thread ids ride in server-set headers\n * (never tool args), so the model can't forge identity or target another\n * workspace. Workspace/thread headers are omitted when their `ctx` value is\n * empty/null (e.g. an integration-invoke bridge that's user-scoped only). Used\n * directly for non-app-tool bridges (integration_invoke) and via\n * {@link buildAppToolMcpServer} for the four app tools.\n */\nexport function buildHttpMcpServer(opts: BuildHttpMcpServerOptions): AppToolMcpServer {\n  const base = opts.baseUrl.replace(/\\/+$/, '')\n  const h = opts.headerNames ?? DEFAULT_HEADER_NAMES\n  return {\n    transport: 'http',\n    url: `${base}${opts.path}`,\n    headers: {\n      Authorization: `Bearer ${opts.token}`,\n      [h.userId]: opts.ctx.userId,\n      ...(opts.ctx.workspaceId ? { [h.workspaceId]: opts.ctx.workspaceId } : {}),\n      ...(opts.ctx.threadId ? { [h.threadId]: opts.ctx.threadId } : {}),\n      'Content-Type': 'application/json',\n    },\n    enabled: true,\n    metadata: { description: opts.description },\n  }\n}\n\n/** Options for a per-document/scoped MCP channel entry (design-canvas,\n *  sequences, …). The capability token + path scope ONE resource; the document\n *  id lives in the path, never a tool argument. */\nexport interface ScopedMcpServerEntryOptions {\n  /** App base URL the sandbox reaches back to (trailing slash tolerated). */\n  baseUrl: string\n  /** Product route serving the resource's MCP handler — id is part of the path. */\n  path: string\n  /** Capability token the product minted for this (user, resource) scope. With\n   *  no token there is no entry to build — omit the server instead. */\n  token: string\n  /** Override the channel's default tool-server description. */\n  description?: string\n  /** Identity headers for products whose route recovers the user via\n   *  `authenticateToolRequest`. Omit when the bearer token is self-contained. */\n  ctx?: AppToolContext\n  headerNames?: ToolHeaderNames\n}\n\n/**\n * Build the `AgentProfileMcpServer`-shaped entry for a scoped, per-resource MCP\n * channel. The shared mechanism behind the per-domain entry builders\n * (`buildDesignCanvasMcpServerEntry`, `buildSequencesMcpServerEntry`): same\n * token/path guards, same description default, same ctx-vs-self-contained-token\n * branching. The domain is two parameters — `label` (for guard messages) and\n * `defaultDescription` — never baked.\n *\n * The no-`ctx` branch is a GENUINE behavioral path, not a shortcut: it emits a\n * self-contained-token entry with ONLY `Authorization` + `Content-Type`.\n * Routing it through {@link buildHttpMcpServer} would unconditionally write a\n * `userId` identity header (here `undefined`), so it stays a distinct branch.\n */\nexport function buildScopedMcpServerEntry(\n  opts: ScopedMcpServerEntryOptions & { label: string; defaultDescription: string },\n): AppToolMcpServer {\n  if (opts.token.trim().length === 0) {\n    throw new Error(`${opts.label} requires a capability token — omit the MCP server when none is available`)\n  }\n  if (!opts.path.startsWith('/')) {\n    throw new Error(`${opts.label} path must start with \"/\" (got \"${opts.path}\")`)\n  }\n  const description = opts.description ?? opts.defaultDescription\n\n  if (opts.ctx) {\n    return buildHttpMcpServer({\n      path: opts.path,\n      baseUrl: opts.baseUrl,\n      token: opts.token,\n      ctx: opts.ctx,\n      description,\n      headerNames: opts.headerNames ?? DEFAULT_HEADER_NAMES,\n    })\n  }\n\n  return {\n    transport: 'http',\n    url: `${opts.baseUrl.replace(/\\/+$/, '')}${opts.path}`,\n    headers: {\n      Authorization: `Bearer ${opts.token}`,\n      'Content-Type': 'application/json',\n    },\n    enabled: true,\n    metadata: { description },\n  }\n}\n\n/** Define configuration options required to build an MCP server including tool, baseUrl, token, and context */\nexport interface BuildMcpServerOptions {\n  /** A built-in app tool name, or a product-registered {@link AppToolDefinition}.\n   *  A custom tool supplies its route via `AppToolDefinition.path` (or `paths`). */\n  tool: AppToolName | AppToolDefinition\n  baseUrl: string\n  token: string\n  ctx: AppToolContext\n  description: string\n  headerNames?: ToolHeaderNames\n  paths?: Partial<Record<string, string>>\n}\n\n/** Build one app-tool MCP server entry — a thin wrapper over\n *  {@link buildHttpMcpServer} that resolves the tool's route path. Built-ins map\n *  through {@link DEFAULT_APP_TOOL_PATHS}; a custom tool uses its own `path`\n *  (or a `paths` override). */\nexport function buildAppToolMcpServer(opts: BuildMcpServerOptions): AppToolMcpServer {\n  const path =\n    typeof opts.tool === 'string'\n      ? opts.paths?.[opts.tool] ?? DEFAULT_APP_TOOL_PATHS[opts.tool]\n      : opts.paths?.[opts.tool.name] ?? opts.tool.path\n  if (!path) {\n    const name = typeof opts.tool === 'string' ? opts.tool : opts.tool.name\n    throw new Error(`buildAppToolMcpServer: tool \"${name}\" has no route path — set AppToolDefinition.path or pass it via opts.paths`)\n  }\n  return buildHttpMcpServer({\n    path,\n    baseUrl: opts.baseUrl,\n    token: opts.token,\n    ctx: opts.ctx,\n    description: opts.description,\n    headerNames: opts.headerNames,\n  })\n}\n","/**\n * Generic streamable-HTTP JSON-RPC 2.0 envelope for a tools-only MCP server.\n * Stateless, Workers-compatible: no session table, no SSE — every request gets\n * a single `application/json` response, which the streamable-HTTP transport\n * explicitly permits for tools-only servers.\n *\n * Protocol surface:\n *   initialize   → echo client's protocolVersion if supported, else latest\n *   ping         → empty result {}\n *   notifications/* (no `id`)  → 202 with no body\n *   tools/list   → tool manifest\n *   tools/call   → run + surface execution failures as isError text results\n *   anything else → -32601\n *\n * Execution failures (argument shape, validation, store throws) become `isError`\n * tool results carrying the thrown message verbatim — the model reads WHY and\n * retries. Protocol misuse becomes a JSON-RPC error object.\n */\n\nexport const MCP_PROTOCOL_VERSIONS = ['2025-06-18', '2025-03-26', '2024-11-05'] as const\n/** Resolve a valid protocol version from the predefined MCP_PROTOCOL_VERSIONS array */\nexport type McpProtocolVersion = (typeof MCP_PROTOCOL_VERSIONS)[number]\n\nconst LATEST_PROTOCOL_VERSION: McpProtocolVersion = MCP_PROTOCOL_VERSIONS[0]\n\n/** Describe the structure of server information including name and version */\nexport interface McpServerInfo {\n  name: string\n  version: string\n}\n\n/** One tool entry in the registry the handler owns. */\nexport interface McpToolDefinition<TEnv = Record<string, never>> {\n  name: string\n  description: string\n  /** JSON Schema for the `params.arguments` object. */\n  inputSchema: Record<string, unknown>\n  /** Receive validated (Record) args + the env the handler threaded; throw to\n   *  surface an isError result — never throw for protocol/framing issues. */\n  run(args: Record<string, unknown>, env: TEnv): Promise<unknown>\n}\n\n/** Define options for creating a handler that manages MCP tools with environment support */\nexport interface CreateMcpToolHandlerOptions<TEnv = Record<string, never>> {\n  serverInfo: McpServerInfo\n  /** Full tool list; order IS the tools/list order. */\n  tools: McpToolDefinition<TEnv>[]\n  /** Per-request environment threaded into every `run` call. If your tools are\n   *  stateless (or carry state through closure) pass an empty builder:\n   *  `() => ({} as TEnv)`. */\n  buildEnv(request: Request): TEnv | Promise<TEnv>\n}\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\ntype JsonRpcId = string | number | null\n\ninterface ToolCallContent {\n  content: Array<{ type: 'text'; text: string }>\n  isError?: true\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\nfunction rpcResult(id: JsonRpcId, result: unknown): Response {\n  return Response.json({ jsonrpc: '2.0', id, result })\n}\n\nfunction rpcError(id: JsonRpcId, code: number, message: string, status = 200): Response {\n  return Response.json({ jsonrpc: '2.0', id, error: { code, message } }, { status })\n}\n\n// ---------------------------------------------------------------------------\n// Factory\n// ---------------------------------------------------------------------------\n\n/**\n * Build a request handler for a tools-only MCP server. The returned function\n * accepts a standard `Request` and resolves to a `Response` — mount it on any\n * Cloudflare Worker route or Remix `loader`.\n *\n * The handler calls `buildEnv` exactly ONCE per `tools/call` request (after\n * the tool is found, before `run`) — non-`tools/call` paths skip it entirely\n * so metadata requests do not pay env-build cost.\n */\nexport function createMcpToolHandler<TEnv = Record<string, never>>(\n  opts: CreateMcpToolHandlerOptions<TEnv>,\n): (request: Request) => Promise<Response> {\n  const toolMap = new Map<string, McpToolDefinition<TEnv>>()\n  for (const tool of opts.tools) {\n    if (toolMap.has(tool.name)) throw new Error(`duplicate MCP tool name: ${tool.name}`)\n    toolMap.set(tool.name, tool)\n  }\n\n  return async (request: Request): Promise<Response> => {\n    if (request.method !== 'POST') {\n      return new Response('MCP server accepts JSON-RPC 2.0 over POST only', {\n        status: 405,\n        headers: { Allow: 'POST' },\n      })\n    }\n\n    let body: unknown\n    try {\n      body = await request.json()\n    } catch {\n      return rpcError(null, -32700, 'Parse error: request body is not valid JSON', 400)\n    }\n\n    if (Array.isArray(body)) {\n      return rpcError(null, -32600, 'Invalid request: JSON-RPC batching is not supported', 400)\n    }\n    if (!isRecord(body) || body.jsonrpc !== '2.0' || typeof body.method !== 'string') {\n      return rpcError(\n        null,\n        -32600,\n        'Invalid request: expected a JSON-RPC 2.0 object with jsonrpc \"2.0\" and a string method',\n        400,\n      )\n    }\n\n    const method = body.method\n    const params = isRecord(body.params) ? body.params : {}\n\n    // Notifications have no `id` — acknowledge without a JSON-RPC body.\n    if (!('id' in body) || body.id === undefined) {\n      return new Response(null, { status: 202 })\n    }\n    const id = body.id as JsonRpcId\n\n    switch (method) {\n      case 'initialize': {\n        const requested = typeof params.protocolVersion === 'string' ? params.protocolVersion : undefined\n        const protocolVersion =\n          requested !== undefined && (MCP_PROTOCOL_VERSIONS as readonly string[]).includes(requested)\n            ? requested\n            : LATEST_PROTOCOL_VERSION\n        return rpcResult(id, {\n          protocolVersion,\n          capabilities: { tools: { listChanged: false } },\n          serverInfo: opts.serverInfo,\n        })\n      }\n\n      case 'ping':\n        return rpcResult(id, {})\n\n      case 'tools/list':\n        return rpcResult(id, {\n          tools: opts.tools.map((tool) => ({\n            name: tool.name,\n            description: tool.description,\n            inputSchema: tool.inputSchema,\n          })),\n        })\n\n      case 'tools/call': {\n        const name = params.name\n        if (typeof name !== 'string' || name.length === 0) {\n          return rpcError(id, -32602, 'tools/call requires params.name (string)')\n        }\n        const tool = toolMap.get(name)\n        if (!tool) {\n          return rpcError(\n            id,\n            -32602,\n            `Unknown tool: ${name}. Available tools: ${opts.tools.map((t) => t.name).join(', ')}`,\n          )\n        }\n        if (params.arguments !== undefined && !isRecord(params.arguments)) {\n          return rpcError(id, -32602, 'tools/call params.arguments must be an object when provided')\n        }\n        const args = isRecord(params.arguments) ? params.arguments : {}\n        let env: TEnv\n        try {\n          env = await opts.buildEnv(request)\n        } catch (err) {\n          const message = err instanceof Error ? err.message : String(err)\n          const payload: ToolCallContent = {\n            content: [{ type: 'text', text: `${name} failed to build env: ${message}` }],\n            isError: true,\n          }\n          return rpcResult(id, payload)\n        }\n        try {\n          const result = await tool.run(args, env)\n          const payload: ToolCallContent = { content: [{ type: 'text', text: JSON.stringify(result) }] }\n          return rpcResult(id, payload)\n        } catch (err) {\n          const message = err instanceof Error ? err.message : String(err)\n          const payload: ToolCallContent = {\n            content: [{ type: 'text', text: `${name} failed: ${message}` }],\n            isError: true,\n          }\n          return rpcResult(id, payload)\n        }\n      }\n\n      default:\n        return rpcError(id, -32601, `Method not found: ${method}`)\n    }\n  }\n}\n"],"mappings":";AAcO,IAAM,uBAAwC;AAAA,EACnD,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,UAAU;AACZ;AAsBA,eAAsB,wBAAwB,SAAkB,MAAoD;AAClH,QAAM,IAAI,KAAK,eAAe;AAC9B,QAAM,SAAS,QAAQ,QAAQ,IAAI,EAAE,MAAM,GAAG,KAAK;AACnD,QAAM,cAAc,QAAQ,QAAQ,IAAI,EAAE,WAAW,GAAG,KAAK;AAC7D,QAAM,WAAW,QAAQ,QAAQ,IAAI,EAAE,QAAQ,GAAG,KAAK,KAAK;AAC5D,QAAM,SAAS,QAAQ,QAAQ,IAAI,eAAe,GAAG,MAAM,kBAAkB,IAAI,CAAC;AAElF,MAAI,CAAC,UAAU,CAAC,QAAQ;AACtB,WAAO,EAAE,IAAI,OAAO,UAAU,SAAS,KAAK,EAAE,OAAO,iCAAiC,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAC5G;AACA,MAAI,CAAE,MAAM,KAAK,YAAY,QAAQ,MAAM,GAAI;AAC7C,WAAO,EAAE,IAAI,OAAO,UAAU,SAAS,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EACtG;AACA,MAAI,CAAC,aAAa;AAChB,WAAO,EAAE,IAAI,OAAO,UAAU,SAAS,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EACvG;AACA,SAAO,EAAE,IAAI,MAAM,KAAK,EAAE,QAAQ,aAAa,SAAS,EAAE;AAC5D;AAIA,eAAsB,aAAgB,SAAqC;AACzE,MAAI;AACJ,MAAI;AACF,WAAQ,MAAM,QAAQ,KAAK;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAQ,KAAK,QAAQ,KAAK,aAAc;AAC1C;;;AC7DO,IAAM,yBAAsD;AAAA,EACjE,iBAAiB;AAAA,EACjB,mBAAmB;AAAA,EACnB,WAAW;AAAA,EACX,cAAc;AAChB;AAoCO,SAAS,mBAAmB,MAAmD;AACpF,QAAM,OAAO,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC5C,QAAM,IAAI,KAAK,eAAe;AAC9B,SAAO;AAAA,IACL,WAAW;AAAA,IACX,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI;AAAA,IACxB,SAAS;AAAA,MACP,eAAe,UAAU,KAAK,KAAK;AAAA,MACnC,CAAC,EAAE,MAAM,GAAG,KAAK,IAAI;AAAA,MACrB,GAAI,KAAK,IAAI,cAAc,EAAE,CAAC,EAAE,WAAW,GAAG,KAAK,IAAI,YAAY,IAAI,CAAC;AAAA,MACxE,GAAI,KAAK,IAAI,WAAW,EAAE,CAAC,EAAE,QAAQ,GAAG,KAAK,IAAI,SAAS,IAAI,CAAC;AAAA,MAC/D,gBAAgB;AAAA,IAClB;AAAA,IACA,SAAS;AAAA,IACT,UAAU,EAAE,aAAa,KAAK,YAAY;AAAA,EAC5C;AACF;AAkCO,SAAS,0BACd,MACkB;AAClB,MAAI,KAAK,MAAM,KAAK,EAAE,WAAW,GAAG;AAClC,UAAM,IAAI,MAAM,GAAG,KAAK,KAAK,gFAA2E;AAAA,EAC1G;AACA,MAAI,CAAC,KAAK,KAAK,WAAW,GAAG,GAAG;AAC9B,UAAM,IAAI,MAAM,GAAG,KAAK,KAAK,mCAAmC,KAAK,IAAI,IAAI;AAAA,EAC/E;AACA,QAAM,cAAc,KAAK,eAAe,KAAK;AAE7C,MAAI,KAAK,KAAK;AACZ,WAAO,mBAAmB;AAAA,MACxB,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,OAAO,KAAK;AAAA,MACZ,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,KAAK,eAAe;AAAA,IACnC,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,KAAK,GAAG,KAAK,QAAQ,QAAQ,QAAQ,EAAE,CAAC,GAAG,KAAK,IAAI;AAAA,IACpD,SAAS;AAAA,MACP,eAAe,UAAU,KAAK,KAAK;AAAA,MACnC,gBAAgB;AAAA,IAClB;AAAA,IACA,SAAS;AAAA,IACT,UAAU,EAAE,YAAY;AAAA,EAC1B;AACF;AAmBO,SAAS,sBAAsB,MAA+C;AACnF,QAAM,OACJ,OAAO,KAAK,SAAS,WACjB,KAAK,QAAQ,KAAK,IAAI,KAAK,uBAAuB,KAAK,IAAI,IAC3D,KAAK,QAAQ,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK;AAChD,MAAI,CAAC,MAAM;AACT,UAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO,KAAK,KAAK;AACnE,UAAM,IAAI,MAAM,gCAAgC,IAAI,iFAA4E;AAAA,EAClI;AACA,SAAO,mBAAmB;AAAA,IACxB;AAAA,IACA,SAAS,KAAK;AAAA,IACd,OAAO,KAAK;AAAA,IACZ,KAAK,KAAK;AAAA,IACV,aAAa,KAAK;AAAA,IAClB,aAAa,KAAK;AAAA,EACpB,CAAC;AACH;;;ACpJO,IAAM,wBAAwB,CAAC,cAAc,cAAc,YAAY;AAI9E,IAAM,0BAA8C,sBAAsB,CAAC;AAyC3E,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,UAAU,IAAe,QAA2B;AAC3D,SAAO,SAAS,KAAK,EAAE,SAAS,OAAO,IAAI,OAAO,CAAC;AACrD;AAEA,SAAS,SAAS,IAAe,MAAc,SAAiB,SAAS,KAAe;AACtF,SAAO,SAAS,KAAK,EAAE,SAAS,OAAO,IAAI,OAAO,EAAE,MAAM,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC;AACnF;AAeO,SAAS,qBACd,MACyC;AACzC,QAAM,UAAU,oBAAI,IAAqC;AACzD,aAAW,QAAQ,KAAK,OAAO;AAC7B,QAAI,QAAQ,IAAI,KAAK,IAAI,EAAG,OAAM,IAAI,MAAM,4BAA4B,KAAK,IAAI,EAAE;AACnF,YAAQ,IAAI,KAAK,MAAM,IAAI;AAAA,EAC7B;AAEA,SAAO,OAAO,YAAwC;AACpD,QAAI,QAAQ,WAAW,QAAQ;AAC7B,aAAO,IAAI,SAAS,kDAAkD;AAAA,QACpE,QAAQ;AAAA,QACR,SAAS,EAAE,OAAO,OAAO;AAAA,MAC3B,CAAC;AAAA,IACH;AAEA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,QAAQ,KAAK;AAAA,IAC5B,QAAQ;AACN,aAAO,SAAS,MAAM,QAAQ,+CAA+C,GAAG;AAAA,IAClF;AAEA,QAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,aAAO,SAAS,MAAM,QAAQ,uDAAuD,GAAG;AAAA,IAC1F;AACA,QAAI,CAAC,SAAS,IAAI,KAAK,KAAK,YAAY,SAAS,OAAO,KAAK,WAAW,UAAU;AAChF,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,KAAK;AACpB,UAAM,SAAS,SAAS,KAAK,MAAM,IAAI,KAAK,SAAS,CAAC;AAGtD,QAAI,EAAE,QAAQ,SAAS,KAAK,OAAO,QAAW;AAC5C,aAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3C;AACA,UAAM,KAAK,KAAK;AAEhB,YAAQ,QAAQ;AAAA,MACd,KAAK,cAAc;AACjB,cAAM,YAAY,OAAO,OAAO,oBAAoB,WAAW,OAAO,kBAAkB;AACxF,cAAM,kBACJ,cAAc,UAAc,sBAA4C,SAAS,SAAS,IACtF,YACA;AACN,eAAO,UAAU,IAAI;AAAA,UACnB;AAAA,UACA,cAAc,EAAE,OAAO,EAAE,aAAa,MAAM,EAAE;AAAA,UAC9C,YAAY,KAAK;AAAA,QACnB,CAAC;AAAA,MACH;AAAA,MAEA,KAAK;AACH,eAAO,UAAU,IAAI,CAAC,CAAC;AAAA,MAEzB,KAAK;AACH,eAAO,UAAU,IAAI;AAAA,UACnB,OAAO,KAAK,MAAM,IAAI,CAAC,UAAU;AAAA,YAC/B,MAAM,KAAK;AAAA,YACX,aAAa,KAAK;AAAA,YAClB,aAAa,KAAK;AAAA,UACpB,EAAE;AAAA,QACJ,CAAC;AAAA,MAEH,KAAK,cAAc;AACjB,cAAM,OAAO,OAAO;AACpB,YAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,iBAAO,SAAS,IAAI,QAAQ,0CAA0C;AAAA,QACxE;AACA,cAAM,OAAO,QAAQ,IAAI,IAAI;AAC7B,YAAI,CAAC,MAAM;AACT,iBAAO;AAAA,YACL;AAAA,YACA;AAAA,YACA,iBAAiB,IAAI,sBAAsB,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC;AAAA,UACrF;AAAA,QACF;AACA,YAAI,OAAO,cAAc,UAAa,CAAC,SAAS,OAAO,SAAS,GAAG;AACjE,iBAAO,SAAS,IAAI,QAAQ,6DAA6D;AAAA,QAC3F;AACA,cAAM,OAAO,SAAS,OAAO,SAAS,IAAI,OAAO,YAAY,CAAC;AAC9D,YAAI;AACJ,YAAI;AACF,gBAAM,MAAM,KAAK,SAAS,OAAO;AAAA,QACnC,SAAS,KAAK;AACZ,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,gBAAM,UAA2B;AAAA,YAC/B,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,GAAG,IAAI,yBAAyB,OAAO,GAAG,CAAC;AAAA,YAC3E,SAAS;AAAA,UACX;AACA,iBAAO,UAAU,IAAI,OAAO;AAAA,QAC9B;AACA,YAAI;AACF,gBAAM,SAAS,MAAM,KAAK,IAAI,MAAM,GAAG;AACvC,gBAAM,UAA2B,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,MAAM,EAAE,CAAC,EAAE;AAC7F,iBAAO,UAAU,IAAI,OAAO;AAAA,QAC9B,SAAS,KAAK;AACZ,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,gBAAM,UAA2B;AAAA,YAC/B,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,GAAG,IAAI,YAAY,OAAO,GAAG,CAAC;AAAA,YAC9D,SAAS;AAAA,UACX;AACA,iBAAO,UAAU,IAAI,OAAO;AAAA,QAC9B;AAAA,MACF;AAAA,MAEA;AACE,eAAO,SAAS,IAAI,QAAQ,qBAAqB,MAAM,EAAE;AAAA,IAC7D;AAAA,EACF;AACF;","names":[]}