@toolgrain/mcp 0.0.0-stage → 0.1.0-rc.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Keshav Katwe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,87 @@
-# Temporary Holding Version
+# @toolgrain/mcp
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Define reusable, typed MCP tools and servers with Zod validation. Toolgrain
+implements MCP directly, independently of `@modelcontextprotocol/sdk`.
+
+## Installation
+
+Release candidate for Toolgrain `0.1.0`; use the explicit `next` tag.
+A stable Toolgrain release is not yet available.
+
+```sh
+npm install @toolgrain/mcp@next @toolgrain/node@next zod
+npm install --save-dev typescript @types/node
+```
+
+`@toolgrain/node` supplies the transport in this example. Zod is a required peer
+dependency; version 4 Classic and Mini schemas are supported.
+
+## A typed tool over stdio
+
+```ts
+import { createServer, tool } from "@toolgrain/mcp";
+import { stdio } from "@toolgrain/node";
+import { z } from "zod";
+
+const greet = tool({
+  title: "Greeting",
+  description: "Greet someone by name",
+  annotations: { readOnlyHint: true },
+  input: z.object({ name: z.string().min(1) }),
+  output: z.object({ message: z.string() }),
+  execute: ({ name }) => ({ message: `Hello, ${name}!` }),
+});
+
+const server = createServer({
+  name: "hello-server",
+  version: "1.0.0",
+  tools: { greet },
+});
+
+await server.listen(stdio());
+```
+
+Save the example as `server.mts`, compile it using TypeScript with
+`--strict --module NodeNext --target ES2022`, then run `node server.mjs`.
+Stdio uses stdin and stdout for MCP; write application logs to stderr. EOF
+closes the connection. An MCP client starts the program and sends requests.
+
+Registration keys define exposed tool names. Definitions created with `tool()`
+are frozen and reusable across servers. Input types are inferred, and input and
+declared output schemas are parsed asynchronously, including defaults and
+transforms. Ordinary strings and JSON become MCP results. Use `mcpResult()` for
+rich content, explicit public errors, and result metadata.
+
+Handlers can accept `execute(input, ctx)` to use request information and
+`ctx.signal` for cooperative cancellation. Use `toolContext()` for direct handler
+calls, which bypass server validation and result conversion. Unexpected server
+execution failures return generic errors and reach the optional `onError`
+callback. Request-cached dependencies use `createContext()` and inferred
+accessors; see the
+[context guide](https://github.com/keshavkatwe/toolgrain/blob/main/docs/context.md).
+
+## Transports and compatibility
+
+Use `stdio()` or `http()` from
+[@toolgrain/node](https://github.com/keshavkatwe/toolgrain/tree/main/packages/node#readme),
+or mount a Web handler from
+[@toolgrain/http](https://github.com/keshavkatwe/toolgrain/tree/main/packages/http#readme).
+Both MCP `2026-07-28` and initialization-based `2025-06-18` are supported through
+the same tool API. Current HTTP support uses independent POST requests and JSON
+responses. See the
+[client compatibility notes](https://github.com/keshavkatwe/toolgrain/blob/main/docs/compatibility.md)
+for tested clients and limitations.
+
+## Requirements
+
+ESM only. Node.js `^24.20.0` or Bun `>=1.4.4 <2`; Zod `^4.6.6`; TypeScript 5.5.4
+or later with `strict` enabled. Node stack traces can use the included source
+maps with `node --enable-source-maps server.mjs`. See the
+[support policy](https://github.com/keshavkatwe/toolgrain/blob/main/docs/support-policy.md)
+and [full API guide](https://github.com/keshavkatwe/toolgrain#readme).
+
+## License
+
+MIT License, copyright 2026 Keshav Katwe. See the
+[license text](https://github.com/keshavkatwe/toolgrain/blob/main/packages/mcp/LICENSE).
+Third-party dependencies retain their own licenses.

package/dist/auth/abort.d.ts

@@ -0,0 +1,3 @@
+/** Stop waiting promptly even when an integration cannot cancel its underlying work. */
+export declare function abortable<T>(work: Promise<T>, signal: AbortSignal): Promise<T>;
+//# sourceMappingURL=abort.d.ts.map

package/dist/auth/abort.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"abort.d.ts","sourceRoot":"","sources":["../../src/auth/abort.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,wBAAgB,SAAS,CAAC,CAAC,EACzB,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAChB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,CAAC,CAAC,CASZ"}

package/dist/auth/abort.js

@@ -0,0 +1,14 @@
+/** Stop waiting promptly even when an integration cannot cancel its underlying work. */
+export function abortable(work, signal) {
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        if (signal.aborted)
+            abort();
+        else
+            signal.addEventListener("abort", abort, { once: true });
+        work
+            .then(resolve, reject)
+            .finally(() => signal.removeEventListener("abort", abort));
+    });
+}
+//# sourceMappingURL=abort.js.map

package/dist/auth/abort.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abort.js","sourceRoot":"","sources":["../../src/auth/abort.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,MAAM,UAAU,SAAS,CACvB,IAAgB,EAChB,MAAmB;IAEnB,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,OAAO;YAAE,KAAK,EAAE,CAAC;;YACvB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI;aACD,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;aACrB,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/audience.d.ts

@@ -0,0 +1,3 @@
+/** Validate the audience of an already verified token without disclosing its claims. */
+export declare function validateTokenAudience(audience: unknown, resource: string): void;
+//# sourceMappingURL=audience.d.ts.map

package/dist/auth/audience.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audience.d.ts","sourceRoot":"","sources":["../../src/auth/audience.ts"],"names":[],"mappings":"AAEA,wFAAwF;AACxF,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,MAAM,GACf,IAAI,CAeN"}

package/dist/auth/audience.js

@@ -0,0 +1,17 @@
+import { AuthError } from "./errors.js";
+/** Validate the audience of an already verified token without disclosing its claims. */
+export function validateTokenAudience(audience, resource) {
+    if (audience === undefined)
+        throw new AuthError("invalid_token", {
+            description: `Access token is missing the aud claim. Configure the authorization server to include an audience and request a new token with resource=${resource}.`,
+        });
+    const audiences = typeof audience === "string" ? [audience] : audience;
+    if (!Array.isArray(audiences) ||
+        audiences.some((value) => typeof value !== "string"))
+        throw new AuthError("invalid_token");
+    if (!audiences.includes(resource))
+        throw new AuthError("invalid_token", {
+            description: `Access token aud claim does not match the expected resource ${resource}. Request a new token with this resource.`,
+        });
+}
+//# sourceMappingURL=audience.js.map

package/dist/auth/audience.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audience.js","sourceRoot":"","sources":["../../src/auth/audience.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CACnC,QAAiB,EACjB,QAAgB;IAEhB,IAAI,QAAQ,KAAK,SAAS;QACxB,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE;YACnC,WAAW,EAAE,0IAA0I,QAAQ,GAAG;SACnK,CAAC,CAAC;IACL,MAAM,SAAS,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvE,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QACzB,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAEpD,MAAM,IAAI,SAAS,CAAC,eAAe,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/B,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE;YACnC,WAAW,EAAE,+DAA+D,QAAQ,2CAA2C;SAChI,CAAC,CAAC;AACP,CAAC"}

package/dist/auth/authorization.d.ts

@@ -0,0 +1,7 @@
+import type { AuthIdentity, AuthMetadata, AuthProvider, AuthScope } from "./types.js";
+export declare function createAuthorization(provider?: AuthProvider): {
+    metadata: () => AuthMetadata | undefined;
+    authorize(token: string, resource: string, signal: AbortSignal, finish: () => void): Promise<AuthScope>;
+    consume(scope?: AuthScope): AuthIdentity | undefined;
+};
+//# sourceMappingURL=authorization.d.ts.map

package/dist/auth/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../src/auth/authorization.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,SAAS,EACV,MAAM,YAAY,CAAC;AASpB,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,YAAY;IAsBvD,QAAQ;IACF,SAAS,QACN,MAAM,YACH,MAAM,UACR,WAAW,UACX,MAAM,IAAI,GACjB,OAAO,CAAC,SAAS,CAAC;IA0BrB,OAAO,SAAS,SAAS,GAAG,YAAY,GAAG,SAAS;EASvD"}

package/dist/auth/authorization.js

@@ -0,0 +1,58 @@
+import { abortable } from "./abort.js";
+import { identitySnapshot } from "./context.js";
+import { AuthError } from "./errors.js";
+import { authUrl } from "./url.js";
+export function createAuthorization(provider) {
+    const scopes = new WeakMap();
+    const metadata = provider && {
+        ...(provider.resource === undefined
+            ? {}
+            : { resource: authUrl(provider.resource) }),
+        authorizationServers: provider.authorizationServers.map((issuer) => {
+            authUrl(issuer);
+            return issuer;
+        }),
+    };
+    if (provider &&
+        (typeof provider.type !== "symbol" ||
+            !metadata?.authorizationServers.length))
+        throw new TypeError("Auth providers require a type symbol and at least one authorization server");
+    const verify = provider?.verify.bind(provider);
+    const type = provider?.type;
+    return {
+        metadata: () => metadata && structuredClone(metadata),
+        async authorize(token, resource, signal, finish) {
+            if (!verify || !type)
+                throw new Error("Server has no auth provider");
+            signal.throwIfAborted();
+            const resolved = metadata?.resource ?? authUrl(resource);
+            const identity = {
+                type,
+                value: identitySnapshot(await abortable(verify(token, { resource: resolved, signal }), signal)),
+            };
+            signal.throwIfAborted();
+            const entry = { identity, consumed: false, disposed: false };
+            const scope = Object.freeze({
+                signal,
+                dispose() {
+                    if (entry.disposed)
+                        return;
+                    entry.disposed = true;
+                    finish();
+                },
+            });
+            scopes.set(scope, entry);
+            return scope;
+        },
+        consume(scope) {
+            if (!metadata && !scope)
+                return;
+            const entry = scope && scopes.get(scope);
+            if (!entry || entry.consumed || entry.disposed)
+                throw new AuthError("invalid_token");
+            entry.consumed = true;
+            return entry.identity;
+        },
+    };
+}
+//# sourceMappingURL=authorization.js.map

package/dist/auth/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../src/auth/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAOxC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAQnC,MAAM,UAAU,mBAAmB,CAAC,QAAuB;IACzD,MAAM,MAAM,GAAG,IAAI,OAAO,EAAoB,CAAC;IAC/C,MAAM,QAAQ,GAA6B,QAAQ,IAAI;QACrD,GAAG,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YACjE,OAAO,CAAC,MAAM,CAAC,CAAC;YAChB,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;KACH,CAAC;IACF,IACE,QAAQ;QACR,CAAC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;YAChC,CAAC,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC;QAEzC,MAAM,IAAI,SAAS,CACjB,4EAA4E,CAC7E,CAAC;IACJ,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,CAAC;IAC5B,OAAO;QACL,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC;QACrD,KAAK,CAAC,SAAS,CACb,KAAa,EACb,QAAgB,EAChB,MAAmB,EACnB,MAAkB;YAElB,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACrE,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG;gBACf,IAAI;gBACJ,KAAK,EAAE,gBAAgB,CACrB,MAAM,SAAS,CACb,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAC7C,MAAM,CACP,CACF;aACF,CAAC;YACF,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,KAAK,GAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACpE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC1B,MAAM;gBACN,OAAO;oBACL,IAAI,KAAK,CAAC,QAAQ;wBAAE,OAAO;oBAC3B,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;oBACtB,MAAM,EAAE,CAAC;gBACX,CAAC;aACF,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,KAAiB;YACvB,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK;gBAAE,OAAO;YAChC,MAAM,KAAK,GAAG,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ;gBAC5C,MAAM,IAAI,SAAS,CAAC,eAAe,CAAC,CAAC;YACvC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;YACtB,OAAO,KAAK,CAAC,QAAQ,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/context.d.ts

@@ -0,0 +1,8 @@
+import type { ToolContext } from "../tools/context.js";
+import type { AuthIdentity, AuthReadonly } from "./types.js";
+/** Typed integrations bind their accessor to a stable, registered provider symbol. */
+export declare function createAuthAccessor<Identity extends object>(type: symbol): (ctx: ToolContext) => AuthReadonly<Identity>;
+export declare function attachAuth(ctx: ToolContext, auth?: AuthIdentity): ToolContext;
+/** Auth identities are plain data: copy them before exposing them to handlers. */
+export declare function identitySnapshot(value: object): object;
+//# sourceMappingURL=context.d.ts.map

package/dist/auth/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/auth/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI7D,sFAAsF;AACtF,wBAAgB,kBAAkB,CAAC,QAAQ,SAAS,MAAM,EAAE,IAAI,EAAE,MAAM,SACzD,WAAW,KAAG,YAAY,CAAC,QAAQ,CAAC,CAQlD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,WAAW,CAG7E;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAmBtD"}

package/dist/auth/context.js

@@ -0,0 +1,37 @@
+const key = Symbol.for("@toolgrain/mcp/auth-context/v1");
+/** Typed integrations bind their accessor to a stable, registered provider symbol. */
+export function createAuthAccessor(type) {
+    return (ctx) => {
+        const auth = Object.getOwnPropertyDescriptor(ctx, key)?.value;
+        if (!auth || auth.type !== type)
+            throw new Error("The context has no identity for this auth provider");
+        return auth.value;
+    };
+}
+export function attachAuth(ctx, auth) {
+    if (auth)
+        Object.defineProperty(ctx, key, { value: auth });
+    return Object.freeze(ctx);
+}
+/** Auth identities are plain data: copy them before exposing them to handlers. */
+export function identitySnapshot(value) {
+    if (value === null || typeof value !== "object")
+        throw new TypeError("Auth identities must be objects");
+    const copy = structuredClone(value);
+    const freeze = (item, visited) => {
+        if (typeof item !== "object" || item === null || visited.has(item))
+            return;
+        const prototype = Object.getPrototypeOf(item);
+        if (prototype !== Object.prototype &&
+            prototype !== Array.prototype &&
+            prototype !== null)
+            throw new TypeError("Auth identities must contain plain data");
+        visited.add(item);
+        for (const child of Object.values(item))
+            freeze(child, visited);
+        Object.freeze(item);
+    };
+    freeze(copy, new Set());
+    return copy;
+}
+//# sourceMappingURL=context.js.map

package/dist/auth/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/auth/context.ts"],"names":[],"mappings":"AAGA,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;AAEzD,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAA0B,IAAY;IACtE,OAAO,CAAC,GAAgB,EAA0B,EAAE;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,KAE3C,CAAC;QACd,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAC7B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,KAA+B,CAAC;IAC9C,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,IAAmB;IAC9D,IAAI,IAAI;QAAE,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAC7C,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,IAAa,EAAE,OAAoB,EAAE,EAAE;QACrD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC3E,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9C,IACE,SAAS,KAAK,MAAM,CAAC,SAAS;YAC9B,SAAS,KAAK,KAAK,CAAC,SAAS;YAC7B,SAAS,KAAK,IAAI;YAElB,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC;IACF,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/errors.d.ts

@@ -0,0 +1,14 @@
+export type AuthErrorCode = "invalid_request" | "invalid_token" | "access_denied" | "temporarily_unavailable";
+declare const brand: unique symbol;
+/** Only an explicitly public description is exposed; provider causes stay private. */
+export declare class AuthError extends Error {
+    readonly code: AuthErrorCode;
+    readonly [brand] = true;
+    readonly description?: string | undefined;
+    constructor(code: AuthErrorCode, options?: ErrorOptions & {
+        description?: string;
+    });
+}
+export declare function isAuthError(value: unknown): value is AuthError;
+export {};
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GACrB,iBAAiB,GACjB,eAAe,GACf,eAAe,GACf,yBAAyB,CAAC;AAE9B,QAAA,MAAM,KAAK,eAA4C,CAAC;AAExD,sFAAsF;AACtF,qBAAa,SAAU,SAAQ,KAAK;IAKhC,QAAQ,CAAC,IAAI,EAAE,aAAa;IAJ9B,QAAQ,CAAC,CAAC,KAAK,CAAC,QAAQ;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1C,YACW,IAAI,EAAE,aAAa,EAC5B,OAAO,CAAC,EAAE,YAAY,GAAG;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAclD;CACF;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAE9D"}

package/dist/auth/errors.js

@@ -0,0 +1,23 @@
+const brand = Symbol.for("@toolgrain/mcp/AuthError/v1");
+/** Only an explicitly public description is exposed; provider causes stay private. */
+export class AuthError extends Error {
+    code;
+    [brand] = true;
+    description;
+    constructor(code, options) {
+        super(options?.description ??
+            {
+                invalid_request: "Invalid authorization request",
+                invalid_token: "Invalid access token",
+                access_denied: "Access denied",
+                temporarily_unavailable: "Authorization service unavailable",
+            }[code], options);
+        this.code = code;
+        this.name = "AuthError";
+        this.description = options?.description;
+    }
+}
+export function isAuthError(value) {
+    return value instanceof Error && Reflect.get(value, brand) === true;
+}
+//# sourceMappingURL=errors.js.map

package/dist/auth/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAMA,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;AAExD,sFAAsF;AACtF,MAAM,OAAO,SAAU,SAAQ,KAAK;IAKvB,IAAI;IAJN,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IACf,WAAW,CAAsB;IAE1C,YACW,IAAmB,EAC5B,OAAiD;QAEjD,KAAK,CACH,OAAO,EAAE,WAAW;YAClB;gBACE,eAAe,EAAE,+BAA+B;gBAChD,aAAa,EAAE,sBAAsB;gBACrC,aAAa,EAAE,eAAe;gBAC9B,uBAAuB,EAAE,mCAAmC;aAC7D,CAAC,IAAI,CAAC,EACT,OAAO,CACR,CAAC;oBAZO,IAAI;QAab,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,WAAW,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,KAAK,YAAY,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC;AACtE,CAAC"}

package/dist/auth/types.d.ts

@@ -0,0 +1,28 @@
+/** Implemented by integrations; the HTTP adapter supplies the resolved resource. */
+export interface AuthProvider<Identity extends object = object> {
+    readonly type: symbol;
+    readonly resource?: string;
+    readonly authorizationServers: readonly string[];
+    verify(accessToken: string, options: AuthVerifyOptions): Promise<Identity>;
+}
+export interface AuthVerifyOptions {
+    readonly signal: AbortSignal;
+    readonly resource: string;
+}
+export interface AuthMetadata {
+    readonly resource?: string;
+    readonly authorizationServers: readonly string[];
+}
+/** An opaque, single-use authorization for one server invocation. Always dispose it. */
+export interface AuthScope {
+    readonly signal: AbortSignal;
+    dispose(): void;
+}
+export type AuthReadonly<T> = T extends readonly (infer Item)[] ? readonly AuthReadonly<Item>[] : T extends object ? {
+    readonly [Key in keyof T]: AuthReadonly<T[Key]>;
+} : T;
+export interface AuthIdentity {
+    readonly type: symbol;
+    readonly value: object;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,MAAM,WAAW,YAAY,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;CAClD;AAED,wFAAwF;AACxF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE,GAC3D,SAAS,YAAY,CAAC,IAAI,CAAC,EAAE,GAC7B,CAAC,SAAS,MAAM,GACd;IAAE,QAAQ,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;CAAE,GACnD,CAAC,CAAC;AAER,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB"}

package/dist/auth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":""}

package/dist/auth/url.d.ts

@@ -0,0 +1,3 @@
+/** Canonical external URL; HTTP is permitted only for local development. */
+export declare function authUrl(value: string): string;
+//# sourceMappingURL=url.d.ts.map

package/dist/auth/url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/auth/url.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAoB7C"}

package/dist/auth/url.js

@@ -0,0 +1,18 @@
+/** Canonical external URL; HTTP is permitted only for local development. */
+export function authUrl(value) {
+    const url = new URL(value);
+    if (
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: Reject control characters that URL parsing would silently remove.
+    /[\u0000-\u0020\u007f]/.test(value) ||
+        !/^https?:\/\/[^/]/i.test(value) ||
+        (url.protocol !== "https:" &&
+            !(url.protocol === "http:" &&
+                ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))) ||
+        url.username ||
+        url.password ||
+        value.includes("#") ||
+        value.includes("?"))
+        throw new TypeError("Auth URLs must use HTTPS without credentials, query, or fragment (HTTP loopback is allowed)");
+    return value;
+}
+//# sourceMappingURL=url.js.map

package/dist/auth/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../src/auth/url.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B;IACE,6HAA6H;IAC7H,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QACnC,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAChC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CACC,GAAG,CAAC,QAAQ,KAAK,OAAO;gBACxB,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC3D,CAAC;QACJ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnB,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAEnB,MAAM,IAAI,SAAS,CACjB,6FAA6F,CAC9F,CAAC;IACJ,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/connection.d.ts

@@ -0,0 +1,12 @@
+import { type ErrorHandler } from "./diagnostics.js";
+import type { Dispatcher } from "./dispatcher.js";
+import type { Server } from "./server.js";
+import type { RequestTransport, Transport } from "./transport.js";
+export declare function createConnection(dispatch: Dispatcher, onError?: ErrorHandler, onClose?: () => void): ConnectionLifecycle;
+interface ConnectionLifecycle {
+    listen(transport: Transport): Promise<void>;
+    listenRequests(transport: RequestTransport, server: Server): Promise<void>;
+    close(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=connection.d.ts.map

package/dist/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../src/connection.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,YAAY,EAAe,MAAM,kBAAkB,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAOlD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EACV,gBAAgB,EAChB,SAAS,EAEV,MAAM,gBAAgB,CAAC;AAGxB,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,UAAU,EACpB,OAAO,CAAC,EAAE,YAAY,EACtB,OAAO,CAAC,EAAE,MAAM,IAAI,GACnB,mBAAmB,CAErB;AAED,UAAU,mBAAmB;IAC3B,MAAM,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}

package/dist/connection.js

@@ -0,0 +1,151 @@
+import { INVALID_REQUEST, PARSE_ERROR, } from "@toolgrain/protocol";
+import { reportError } from "./diagnostics.js";
+import { executeRequest } from "./execute-request.js";
+import { createLegacyConnection } from "./legacy/connection.js";
+import { createPendingRequests } from "./pending-requests.js";
+import { decode } from "./protocol/decode.js";
+import { protocolError } from "./protocol/responses.js";
+import { claimTransport } from "./transport-ownership.js";
+export function createConnection(dispatch, onError, onClose) {
+    return new Connection(dispatch, onError, onClose);
+}
+/** Owns transport attachment, serialized writes, and connection shutdown. */
+class Connection {
+    dispatch;
+    onError;
+    onClose;
+    state = "idle";
+    transport;
+    closePromise;
+    writes = Promise.resolve();
+    requests = createPendingRequests(() => this.isOpen());
+    legacy = createLegacyConnection();
+    constructor(dispatch, onError, onClose) {
+        this.dispatch = dispatch;
+        this.onError = onError;
+        this.onClose = onClose;
+    }
+    // Public methods remain safe to call detached from the returned server.
+    listen = (transport) => this.attach(transport, () => transport.start(this.transportCallbacks));
+    listenRequests = (transport, server) => this.attach(transport, () => transport.start(server, {
+        onError: this.transportCallbacks.onError,
+        onClose: this.transportCallbacks.onClose,
+    }));
+    attach = async (transport, start) => {
+        if (this.state !== "idle")
+            throw new Error("Server can only attach one transport and cannot restart after closing");
+        claimTransport(transport);
+        this.state = "starting";
+        this.transport = transport;
+        try {
+            await start();
+            if (!this.isOpen())
+                throw new Error("Transport closed during startup");
+            this.state = "listening";
+        }
+        catch (error) {
+            await this.terminate(error);
+            throw error;
+        }
+    };
+    close = () => {
+        if (this.closePromise)
+            return this.closePromise;
+        this.state = "closed";
+        this.closePromise = Promise.resolve().then(async () => {
+            const transport = this.transport;
+            this.transport = undefined;
+            await transport?.close();
+        });
+        // Aborting runs handler listeners synchronously; a nested close reuses this promise.
+        this.onClose?.();
+        this.requests.clear();
+        return this.closePromise;
+    };
+    transportCallbacks = {
+        onMessage: (message) => {
+            void this.receive(message).catch((error) => this.terminate(error));
+        },
+        onParseError: () => {
+            if (this.isOpen())
+                void this.send(this.legacy.errorResponse(protocolError(PARSE_ERROR, "Parse error")));
+        },
+        onError: (error) => {
+            void this.terminate(error);
+        },
+        onClose: () => {
+            void this.close().catch((error) => this.report(error));
+        },
+    };
+    isOpen() {
+        return this.state === "starting" || this.state === "listening";
+    }
+    report(error) {
+        reportError(this.onError, error);
+    }
+    async terminate(error) {
+        this.report(error);
+        try {
+            await this.close();
+        }
+        catch (failure) {
+            this.report(failure);
+        }
+    }
+    send(message, isActive = () => this.isOpen()) {
+        const write = this.writes.then(async () => {
+            if (this.isOpen() &&
+                isActive() &&
+                this.transport &&
+                "send" in this.transport)
+                await this.transport.send(message);
+        });
+        this.writes = write.catch((error) => this.terminate(error));
+        return this.writes;
+    }
+    async receive(message) {
+        if (!this.isOpen())
+            return;
+        const incoming = decode(message);
+        switch (incoming.kind) {
+            case "ignore":
+                return;
+            case "cancel":
+                if (this.legacy.canCancel(incoming.id))
+                    this.requests.cancel(incoming.id);
+                return;
+            case "notification":
+                this.legacy.notification(incoming.notification);
+                return;
+            case "error":
+                await this.send(this.legacy.errorResponse(incoming.response));
+                return;
+            case "request":
+                await this.handleRequest(incoming.request);
+        }
+    }
+    async handleRequest(request) {
+        const prepared = this.legacy.prepare(request);
+        if (prepared.error) {
+            await this.send(prepared.error);
+            return;
+        }
+        const pending = this.requests.begin(request.id);
+        if (!pending) {
+            await this.send(protocolError(INVALID_REQUEST, "Request ID is already in use", request.id));
+            return;
+        }
+        const initialization = this.legacy.begin(request, prepared.protocolVersion);
+        try {
+            const response = await executeRequest(this.dispatch, request, { signal: pending.signal, client: this.legacy.client() }, (error) => this.report(error), prepared.protocolVersion);
+            initialization?.respond(response);
+            if (response)
+                await this.send(response, pending.isActive);
+        }
+        finally {
+            initialization?.finish();
+            pending.finish();
+        }
+    }
+}
+//# sourceMappingURL=connection.js.map

package/dist/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../src/connection.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,WAAW,GAEZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAqB,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAOxD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,MAAM,UAAU,gBAAgB,CAC9B,QAAoB,EACpB,OAAsB,EACtB,OAAoB;IAEpB,OAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAQD,6EAA6E;AAC7E,MAAM,UAAU;IASK,QAAQ;IACR,OAAO;IACP,OAAO;IAVlB,KAAK,GAAiD,MAAM,CAAC;IAC7D,SAAS,CAA2C;IACpD,YAAY,CAA4B;IACxC,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAClB,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,sBAAsB,EAAE,CAAC;IAEnD,YACmB,QAAoB,EACpB,OAAsB,EACtB,OAAoB;wBAFpB,QAAQ;uBACR,OAAO;uBACP,OAAO;IACvB,CAAC;IAEJ,wEAAwE;IAC/D,MAAM,GAAG,CAAC,SAAoB,EAAiB,EAAE,CACxD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAEhE,cAAc,GAAG,CACxB,SAA2B,EAC3B,MAAc,EACC,EAAE,CACjB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,CAC1B,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE;QACtB,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,OAAO;QACxC,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,OAAO;KACzC,CAAC,CACH,CAAC;IAEa,MAAM,GAAG,KAAK,EAC7B,SAAuC,EACvC,KAA0B,EACX,EAAE;QACjB,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM;YACvB,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;QACJ,cAAc,CAAC,SAAS,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,KAAK,EAAE,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACvE,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEO,KAAK,GAAG,GAAkB,EAAE;QACnC,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QAChD,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;QACtB,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACpD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC3B,MAAM,SAAS,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,qFAAqF;QACrF,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACjB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC,CAAC;IAEe,kBAAkB,GAAuB;QACxD,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;YACrB,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,YAAY,EAAE,GAAG,EAAE;YACjB,IAAI,IAAI,CAAC,MAAM,EAAE;gBACf,KAAK,IAAI,CAAC,IAAI,CACZ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CACrE,CAAC;QACN,CAAC;QACD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,EAAE,GAAG,EAAE;YACZ,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;KACF,CAAC;IAEM,MAAM;QACZ,OAAO,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC;IACjE,CAAC;IAEO,MAAM,CAAC,KAAc;QAC3B,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,KAAc;QACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAEO,IAAI,CACV,OAAyB,EACzB,QAAQ,GAAkB,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE;QAE7C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACxC,IACE,IAAI,CAAC,MAAM,EAAE;gBACb,QAAQ,EAAE;gBACV,IAAI,CAAC,SAAS;gBACd,MAAM,IAAI,IAAI,CAAC,SAAS;gBAExB,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,OAAgB;QACpC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO;QAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACjC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtB,KAAK,QAAQ;gBACX,OAAO;YACT,KAAK,QAAQ;gBACX,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACpC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACpC,OAAO;YACT,KAAK,cAAc;gBACjB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAChD,OAAO;YACT,KAAK,OAAO;gBACV,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC9D,OAAO;YACT,KAAK,SAAS;gBACZ,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAgB;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,IAAI,CACb,aAAa,CACX,eAAe,EACf,8BAA8B,EAC9B,OAAO,CAAC,EAAE,CACX,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC5E,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,IAAI,CAAC,QAAQ,EACb,OAAO,EACP,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,EACxD,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAC7B,QAAQ,CAAC,eAAe,CACzB,CAAC;YACF,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,QAAQ;gBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5D,CAAC;gBAAS,CAAC;YACT,cAAc,EAAE,MAAM,EAAE,CAAC;YACzB,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}

package/dist/context/access.d.ts

@@ -0,0 +1,7 @@
+import type { ToolContext } from "../tools/context.js";
+type Access = (identity: symbol, name: string) => Promise<unknown>;
+/** Keep own auth properties and shared request data on dependency-aware views. */
+export declare function withContextAccess(ctx: ToolContext, access: Access): ToolContext;
+export declare function readContext<Value>(ctx: ToolContext, identity: symbol, name: string): Promise<Value>;
+export {};
+//# sourceMappingURL=access.d.ts.map

package/dist/context/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/context/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvD,KAAK,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEnE,kFAAkF;AAClF,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,MAAM,GACb,WAAW,CAOb;AAED,wBAAgB,WAAW,CAAC,KAAK,EAC/B,GAAG,EAAE,WAAW,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,KAAK,CAAC,CAahB"}