agentfootprint 7.13.0 → 7.15.0

package/dist/esm/hosting/types.d.ts

@@ -0,0 +1,206 @@
+/**
+ * hosting/types — the two ports an agent needs to stand up and stay up.
+ *
+ * `AgentHost` is "something can call me". `SessionLifecycle` is "the
+ * conversation outlives the request". Both are deliberately written in the
+ * vocabulary every transport and every store already has — an input, a reply,
+ * a session id, a stored blob — and in nothing else.
+ *
+ * **The rule these types are written under:** no runtime, product or protocol
+ * gets a field, a name or an assumption here. A port shaped around one
+ * provider's request envelope stops being a port and becomes that provider's
+ * SDK with extra steps, and every later adapter pays for it. If a decision only
+ * makes sense for one place you might deploy, it belongs in the adapter for
+ * that place, not in this file. `nodeHost` is the first adapter and it does not
+ * get special treatment either: its paths, its status codes and its JSON body
+ * shape all live in `nodeHost.ts`, and nothing in this file knows they exist.
+ *
+ * Pattern: Ports & adapters (hexagonal). Role: the port side, exclusively.
+ */
+import type { Agent } from '../core/Agent.js';
+import type { AgentRunCheckpoint } from '../core/runCheckpoint.js';
+/**
+ * Something a host can do BEYOND the baseline of "accept a request, deliver one
+ * reply". Read it from {@link AgentHost.capabilities} and branch on it — never
+ * assume it, and never infer it from the adapter's name.
+ *
+ * The union starts at exactly what a shipped adapter can honour today. A name
+ * is added when an adapter can actually keep the promise, never in anticipation
+ * of a transport that does not exist yet: a capability nobody implements is a
+ * promise the library cannot keep, and pre-minting one for an imagined future
+ * transport would bake that transport's assumptions in before it arrives.
+ */
+export type HostCapability = 'streaming';
+/**
+ * One inbound request, as the transport described it.
+ */
+export interface HostRequest {
+    /** What the caller is asking. */
+    readonly input: string;
+    /**
+     * The conversation this request CLAIMS to belong to — caller data, exactly as
+     * the transport declared it (a JSON field, a header, a path segment).
+     *
+     * It is **not identity** and must never be trusted as identity on its own:
+     * anyone who can reach the host can put any string here, including someone
+     * else's. Authenticate the caller by your own means, then check that the
+     * authenticated principal is allowed this session, before you serve it.
+     */
+    readonly sessionId?: string;
+    /**
+     * Transport headers with lower-cased names, as delivered. Present so a
+     * handler can map its own conventions (a correlation id, a tenant) without
+     * the port having to guess which ones matter.
+     */
+    readonly headers?: Readonly<Record<string, string>>;
+    /** Aborted when the caller goes away. */
+    readonly signal?: AbortSignal;
+}
+/**
+ * The one reply a request gets. Exactly one of {@link HostReply.complete} or
+ * {@link HostReply.fail} ends it; a second call is ignored rather than allowed
+ * to corrupt the wire.
+ */
+export interface HostReply {
+    /** Deliver the final answer and end the reply. */
+    complete(output: string): void;
+    /**
+     * A piece of the answer, as it is produced.
+     *
+     * Optional on the TYPE so a minimal adapter need not implement it — every
+     * shipped adapter does. Whether the caller SEES the pieces as they arrive is
+     * the whole difference between hosts, and that is what `'streaming'` in
+     * {@link AgentHost.capabilities} reports. A host without it buffers what it is
+     * handed and the authoritative `complete(output)` is what the caller
+     * receives; the buffer is settled by the completion, never sent alongside it,
+     * because a chunk is a preview of the same text and delivering both would
+     * hand the caller the answer twice.
+     *
+     * Handler code is identical either way: emit freely, complete once.
+     */
+    emit?(chunk: string): void;
+    /** End the reply with a failure. */
+    fail(error: Error): void;
+}
+/**
+ * What you hand {@link AgentHost.serve}. Throwing is treated exactly like
+ * calling `reply.fail(err)` — a handler that throws is a failed request, never
+ * a hung one.
+ */
+export type HostHandler = (request: HostRequest, reply: HostReply) => void | Promise<void>;
+/** A live host. */
+export interface HostHandle {
+    /**
+     * Stop taking new requests, let the in-flight ones finish, then release the
+     * transport. Idempotent, so a shutdown hook and an explicit close can
+     * coexist. Requests arriving after it are refused with a
+     * {@link HostClosedError} naming the adapter.
+     */
+    close(): Promise<void>;
+}
+/**
+ * The port: something that can carry requests to one handler and carry its
+ * replies back.
+ */
+export interface AgentHost {
+    /**
+     * Which adapter this is. Every refusal names it, so an error tells you WHO
+     * refused rather than leaving you to guess which layer you are looking at.
+     */
+    readonly name: string;
+    /** What this adapter can do beyond the baseline. Feature-detect; never assume. */
+    readonly capabilities: readonly HostCapability[];
+    /** Start serving. Resolves once the host is actually live. */
+    serve(handler: HostHandler): Promise<HostHandle>;
+}
+/**
+ * A conversation packed for storage.
+ *
+ * `format` names WHAT is inside, so a reader that does not know the shape
+ * refuses BY NAME instead of restoring a conversation it cannot actually read.
+ * Formats are ADDED, never redefined: an old runtime meeting a new format says
+ * so and stops, which is the only safe thing it can do with a payload it cannot
+ * interpret.
+ *
+ * `'conversation-v1'` stores a conversation and only a conversation. A run that
+ * paused mid-flow is a conversation PLUS an engine checkpoint, and this format
+ * has nowhere to put the second half — which is why `standingAgent` refuses to
+ * store a paused run rather than storing half of it. Carrying a pause would be
+ * a NEW format name in this same envelope, read by a runtime that knows it and
+ * refused by name everywhere else. That is what the version field is for.
+ */
+export interface CheckpointEnvelope {
+    /** Names the shape of `data`. Unknown values are refused, never guessed at. */
+    readonly format: 'conversation-v1';
+    /** The conversation itself — an `AgentRunCheckpoint` for `'conversation-v1'`. */
+    readonly data: AgentRunCheckpoint;
+    /** Wall-clock when it was packed. Diagnostic. */
+    readonly savedAt: number;
+}
+/**
+ * Why a session is being woken.
+ *
+ * One member, because one thing in this release can actually fire it: a request
+ * arrived for that session. Naming reasons nothing can produce would be an
+ * interface describing a system that does not exist.
+ */
+export type WakeReason = 'invoke';
+/**
+ * The port: where a conversation lives between requests.
+ *
+ * Deliberately two required methods. Anything a real store also wants — a TTL,
+ * a scan, a delete — is that store's own API, not a demand this port makes of
+ * every store that will ever implement it.
+ */
+export interface SessionLifecycle {
+    /** The stored conversation, or `undefined` for a session that has none yet. */
+    hydrate(sessionId: string): Promise<CheckpointEnvelope | undefined>;
+    /** Store the conversation for this session. Last write wins. */
+    persist(sessionId: string, envelope: CheckpointEnvelope): Promise<void>;
+    /**
+     * Called once per served request, before `hydrate`, for stores that need to
+     * spin something up before they can answer. Errors from it fail the request —
+     * a store that could not wake cannot be read from either.
+     */
+    onWake?(sessionId: string, reason: WakeReason): void | Promise<void>;
+}
+/**
+ * What to do when a request arrives for a session that already has a run in
+ * flight.
+ *
+ *  - `'reject'` (default) — refuse it, naming the run that is already going.
+ *    A user who double-submits gets one answer and one refusal, not two runs
+ *    racing to write the same conversation.
+ *  - `'enqueue'` — queue it. It starts after the active run has persisted, so
+ *    the second turn sees the first turn's stored state rather than the state
+ *    it was about to overwrite.
+ *
+ * This governs the SAME session only. A request for a different session is
+ * never refused — there is nothing wrong with it; it simply waits its turn.
+ */
+export type ConcurrentInvokePolicy = 'reject' | 'enqueue';
+/**
+ * Options for {@link standingAgent}.
+ *
+ * Generic in the host's own handle type so composing does not cost you what
+ * the adapter told you. `nodeHost` hands back the URL it actually bound —
+ * which is the only way to find out when you asked for port `0` — and passing
+ * it through `standingAgent` keeps that, without the port having to know that
+ * "a URL" is a thing some adapters have.
+ */
+export interface StandingAgentOptions<TH extends HostHandle = HostHandle> {
+    /**
+     * The agent that answers. ONE instance, shared by every session — which is
+     * why the composer runs one request at a time (see
+     * {@link ConcurrentInvokePolicy}).
+     */
+    readonly agent: Agent;
+    /** Where conversations live between requests. */
+    readonly sessions: SessionLifecycle;
+    /** What carries requests in. */
+    readonly host: AgentHost & {
+        serve(handler: HostHandler): Promise<TH>;
+    };
+    /** Default `'reject'`. See {@link ConcurrentInvokePolicy}. */
+    readonly onConcurrentInvoke?: ConcurrentInvokePolicy;
+}

package/dist/esm/hosting/types.js

@@ -0,0 +1,21 @@
+/**
+ * hosting/types — the two ports an agent needs to stand up and stay up.
+ *
+ * `AgentHost` is "something can call me". `SessionLifecycle` is "the
+ * conversation outlives the request". Both are deliberately written in the
+ * vocabulary every transport and every store already has — an input, a reply,
+ * a session id, a stored blob — and in nothing else.
+ *
+ * **The rule these types are written under:** no runtime, product or protocol
+ * gets a field, a name or an assumption here. A port shaped around one
+ * provider's request envelope stops being a port and becomes that provider's
+ * SDK with extra steps, and every later adapter pays for it. If a decision only
+ * makes sense for one place you might deploy, it belongs in the adapter for
+ * that place, not in this file. `nodeHost` is the first adapter and it does not
+ * get special treatment either: its paths, its status codes and its JSON body
+ * shape all live in `nodeHost.ts`, and nothing in this file knows they exist.
+ *
+ * Pattern: Ports & adapters (hexagonal). Role: the port side, exclusively.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/esm/hosting/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/hosting/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG"}

package/dist/esm/hosting-providers.d.ts

@@ -0,0 +1,50 @@
+/**
+ * agentfootprint/hosting-providers — adapters for the two hosting ports.
+ *
+ *   agentfootprint/hosting            ← the PORTS (`AgentHost`, `SessionLifecycle`),
+ *                                       the composer, and the local adapters
+ *   agentfootprint/hosting-providers  ← adapters for somewhere you deploy (this file)
+ *
+ * Same split as `agentfootprint/memory` ↔ `agentfootprint/memory-providers`, and
+ * for the same reason. `agentfootprint/hosting` promises that not one field,
+ * name or assumption in it comes from any cloud, and a test greps its sources
+ * for vendor names to keep that honest — including the barrel. So the cloud
+ * adapters get their own subpath, and the port subpath stays a file you can
+ * read without learning anybody's product names.
+ *
+ * One subpath that grows: an adapter for the next runtime lands here beside
+ * this one rather than minting `agentfootprint/hosting-<vendor>`.
+ *
+ * ── What ships here ──────────────────────────────────────────────────────────
+ *   • `agentCoreRuntimeHost({ port?, hostname?, busy? })` — an `AgentHost` for
+ *     AWS Bedrock AgentCore Runtime's container contract: `POST /invocations`,
+ *     `GET /ping`, port 8080, and the conversation id read from the
+ *     `X-Amzn-Bedrock-AgentCore-Runtime-Session-Id` header.
+ *   • `agentCoreSessions({ store })` — a `SessionLifecycle` whose checkpoint
+ *     home you choose at construction: a JSON file in the runtime's own session
+ *     storage (survives a stop/resume, needs no SDK), or one AgentCore Memory
+ *     event per persist (outlives the session).
+ *
+ * ── How much of this is verified ─────────────────────────────────────────────
+ * `agentCoreRuntimeHost` is plain HTTP with no SDK on its path, and it passes
+ * the same host conformance suite as `nodeHost` over a real socket — that is
+ * real verification, not a mapping asserted in prose.
+ *
+ * Everything that talks to AWS — `agentCoreSessions({ store: 'memory' })` — is
+ * **contract-mapped and injection-tested**: the SDK calls are exercised through
+ * the `_client` seam and no test pretends to have reached AWS. Real-cloud
+ * verification lands with a field deployment.
+ *
+ * @example  An agent in an AgentCore Runtime container
+ *   import { standingAgent } from 'agentfootprint/hosting';
+ *   import { agentCoreRuntimeHost, agentCoreSessions } from 'agentfootprint/hosting-providers';
+ *
+ *   const handle = await standingAgent({
+ *     agent,
+ *     host: agentCoreRuntimeHost(),
+ *     sessions: agentCoreSessions({ store: 'session-storage' }),
+ *   });
+ *   process.on('SIGTERM', () => void handle.close());
+ */
+export { agentCoreRuntimeHost, agentCoreRuntimeWire, agentCoreSessions, DEFAULT_SESSION_STORAGE_PATH, } from './adapters/hosting/agentcore.js';
+export type { AgentCoreRuntimeHostOptions, AgentCoreSessionsOptions, AgentCoreSessionStore, AgentCoreFileSessionsOptions, AgentCoreMemorySessionsOptions, AgentCoreSessionClientLike, AgentCoreSessionEvent, BedrockAgentCoreSessionSdkModule, } from './adapters/hosting/agentcore.js';

package/dist/esm/hosting-providers.js

@@ -0,0 +1,50 @@
+/**
+ * agentfootprint/hosting-providers — adapters for the two hosting ports.
+ *
+ *   agentfootprint/hosting            ← the PORTS (`AgentHost`, `SessionLifecycle`),
+ *                                       the composer, and the local adapters
+ *   agentfootprint/hosting-providers  ← adapters for somewhere you deploy (this file)
+ *
+ * Same split as `agentfootprint/memory` ↔ `agentfootprint/memory-providers`, and
+ * for the same reason. `agentfootprint/hosting` promises that not one field,
+ * name or assumption in it comes from any cloud, and a test greps its sources
+ * for vendor names to keep that honest — including the barrel. So the cloud
+ * adapters get their own subpath, and the port subpath stays a file you can
+ * read without learning anybody's product names.
+ *
+ * One subpath that grows: an adapter for the next runtime lands here beside
+ * this one rather than minting `agentfootprint/hosting-<vendor>`.
+ *
+ * ── What ships here ──────────────────────────────────────────────────────────
+ *   • `agentCoreRuntimeHost({ port?, hostname?, busy? })` — an `AgentHost` for
+ *     AWS Bedrock AgentCore Runtime's container contract: `POST /invocations`,
+ *     `GET /ping`, port 8080, and the conversation id read from the
+ *     `X-Amzn-Bedrock-AgentCore-Runtime-Session-Id` header.
+ *   • `agentCoreSessions({ store })` — a `SessionLifecycle` whose checkpoint
+ *     home you choose at construction: a JSON file in the runtime's own session
+ *     storage (survives a stop/resume, needs no SDK), or one AgentCore Memory
+ *     event per persist (outlives the session).
+ *
+ * ── How much of this is verified ─────────────────────────────────────────────
+ * `agentCoreRuntimeHost` is plain HTTP with no SDK on its path, and it passes
+ * the same host conformance suite as `nodeHost` over a real socket — that is
+ * real verification, not a mapping asserted in prose.
+ *
+ * Everything that talks to AWS — `agentCoreSessions({ store: 'memory' })` — is
+ * **contract-mapped and injection-tested**: the SDK calls are exercised through
+ * the `_client` seam and no test pretends to have reached AWS. Real-cloud
+ * verification lands with a field deployment.
+ *
+ * @example  An agent in an AgentCore Runtime container
+ *   import { standingAgent } from 'agentfootprint/hosting';
+ *   import { agentCoreRuntimeHost, agentCoreSessions } from 'agentfootprint/hosting-providers';
+ *
+ *   const handle = await standingAgent({
+ *     agent,
+ *     host: agentCoreRuntimeHost(),
+ *     sessions: agentCoreSessions({ store: 'session-storage' }),
+ *   });
+ *   process.on('SIGTERM', () => void handle.close());
+ */
+export { agentCoreRuntimeHost, agentCoreRuntimeWire, agentCoreSessions, DEFAULT_SESSION_STORAGE_PATH, } from './adapters/hosting/agentcore.js';
+//# sourceMappingURL=hosting-providers.js.map

package/dist/esm/hosting-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosting-providers.js","sourceRoot":"","sources":["../../src/hosting-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC"}

package/dist/esm/lib/mcp/gatewayTransport.d.ts

@@ -0,0 +1,103 @@
+/**
+ * gatewayTransport — an MCP transport whose auth headers are vended per
+ * request, not per connection.
+ *
+ *   const gateway = await mcpClient({
+ *     name: 'gateway',
+ *     transport: gatewayTransport({ url, credentials, service: 'gateway' }),
+ *   });
+ *
+ * ── Why this exists ──────────────────────────────────────────────────────────
+ * The `http` transport takes headers once and reuses them for the life of the
+ * connection. That is right for a static API key and wrong for anything with an
+ * expiry: a standing agent outlives its bearer token, and the failure mode is a
+ * burst of 401s an hour into a session that worked perfectly when you tested
+ * it. Managed gateways — AgentCore's among them — hand out exactly that kind of
+ * token, so "get a fresh one before each request" is not an optimisation, it is
+ * the only way the connection stays up.
+ *
+ * Nothing here is vendor-specific. It is the {@link CredentialProvider} port on
+ * one side and Streamable HTTP on the other; who vends is your choice.
+ *
+ * ── The secrecy invariant, and how it is kept ────────────────────────────────
+ * **A vended token is used once and dropped.** It is not cached between
+ * requests, not stored on the transport object, not put in an event payload,
+ * not written to a log, and not included in any error this module throws —
+ * including the errors it throws WHILE holding one. A test asserts that: a
+ * hostile logger subscribed to everything the library can say never sees the
+ * header value.
+ *
+ * That is why the vend happens inside `fetch` rather than at construction. A
+ * token resolved at construction has to live somewhere for the connection to
+ * use it later, and "somewhere" is what leaks.
+ *
+ * Pattern: Adapter + Decorator over `fetch`. Role: Layer-3 tool integration.
+ */
+import { type CredentialProvider } from '../../identity/types.js';
+import type { McpGatewayTransport } from './types.js';
+/** Options for {@link gatewayTransport}. */
+export interface GatewayTransportOptions {
+    /** The MCP endpoint URL. */
+    readonly url: string;
+    /** Who vends the token — any `CredentialProvider`. */
+    readonly credentials: CredentialProvider;
+    /**
+     * The downstream service id the provider understands. Default `'gateway'`.
+     * `staticTokens({ gateway: '...' })` and `agentCoreIdentity()` both key on it.
+     */
+    readonly service?: string;
+    /** OAuth scopes to request, when the provider uses them. */
+    readonly scopes?: readonly string[];
+    /** `machine` (2-legged, the default) or `user` (3-legged, on behalf of a user). */
+    readonly mode?: 'machine' | 'user';
+    /**
+     * Extra headers sent alongside the vended ones. Applied FIRST, so a vended
+     * auth header always wins. **Put no secrets here** — these are held for the
+     * life of the transport, which is what the vended ones exist to avoid.
+     */
+    readonly headers?: Readonly<Record<string, string>>;
+}
+/**
+ * Describe an MCP connection whose auth headers are vended per request.
+ *
+ * @example  A managed gateway with a token vault behind it
+ *   import { agentCoreIdentity } from 'agentfootprint/identity';
+ *   import { gatewayTransport, mcpClient } from 'agentfootprint/tool-providers';
+ *
+ *   const gateway = await mcpClient({
+ *     name: 'gateway',
+ *     transport: gatewayTransport({
+ *       url: process.env.GATEWAY_MCP_URL!,
+ *       credentials: agentCoreIdentity({ region: 'us-west-2' }),
+ *       service: 'gateway',
+ *     }),
+ *   });
+ *   const agent = Agent.create({ provider, model }).tools(await gateway.tools()).build();
+ */
+export declare function gatewayTransport(options: GatewayTransportOptions): McpGatewayTransport;
+/**
+ * Raised when the provider needs a human to authorize before it can vend.
+ *
+ * The URL is carried so the caller can surface it (pause the run, show a
+ * link); **the token is not, because there is not one yet** — that is the whole
+ * meaning of this error.
+ */
+export declare class GatewayAuthorizationRequiredError extends Error {
+    readonly code: "ERR_GATEWAY_AUTHORIZATION_REQUIRED";
+    /** Send the user here, then retry. */
+    readonly authorizationUrl: string;
+    constructor(service: string, authorizationUrl: string);
+}
+/** Just the part of `fetch` this module needs, so it is trivially injectable in tests. */
+export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+/**
+ * Build the `fetch` the MCP SDK will use: one that vends a credential, applies
+ * it to this one request, and keeps nothing.
+ *
+ * Exported for tests — the secrecy invariant is asserted against this function
+ * directly, because that is where a leak would happen and driving a whole SDK
+ * to reach it would test less while looking like it tested more.
+ *
+ * @internal
+ */
+export declare function createVendingFetch(transport: McpGatewayTransport, baseFetch?: FetchLike): FetchLike;

package/dist/esm/lib/mcp/gatewayTransport.js

@@ -0,0 +1,123 @@
+/**
+ * gatewayTransport — an MCP transport whose auth headers are vended per
+ * request, not per connection.
+ *
+ *   const gateway = await mcpClient({
+ *     name: 'gateway',
+ *     transport: gatewayTransport({ url, credentials, service: 'gateway' }),
+ *   });
+ *
+ * ── Why this exists ──────────────────────────────────────────────────────────
+ * The `http` transport takes headers once and reuses them for the life of the
+ * connection. That is right for a static API key and wrong for anything with an
+ * expiry: a standing agent outlives its bearer token, and the failure mode is a
+ * burst of 401s an hour into a session that worked perfectly when you tested
+ * it. Managed gateways — AgentCore's among them — hand out exactly that kind of
+ * token, so "get a fresh one before each request" is not an optimisation, it is
+ * the only way the connection stays up.
+ *
+ * Nothing here is vendor-specific. It is the {@link CredentialProvider} port on
+ * one side and Streamable HTTP on the other; who vends is your choice.
+ *
+ * ── The secrecy invariant, and how it is kept ────────────────────────────────
+ * **A vended token is used once and dropped.** It is not cached between
+ * requests, not stored on the transport object, not put in an event payload,
+ * not written to a log, and not included in any error this module throws —
+ * including the errors it throws WHILE holding one. A test asserts that: a
+ * hostile logger subscribed to everything the library can say never sees the
+ * header value.
+ *
+ * That is why the vend happens inside `fetch` rather than at construction. A
+ * token resolved at construction has to live somewhere for the connection to
+ * use it later, and "somewhere" is what leaks.
+ *
+ * Pattern: Adapter + Decorator over `fetch`. Role: Layer-3 tool integration.
+ */
+import { isCredentialIssued } from '../../identity/types.js';
+const DEFAULT_SERVICE = 'gateway';
+/**
+ * Describe an MCP connection whose auth headers are vended per request.
+ *
+ * @example  A managed gateway with a token vault behind it
+ *   import { agentCoreIdentity } from 'agentfootprint/identity';
+ *   import { gatewayTransport, mcpClient } from 'agentfootprint/tool-providers';
+ *
+ *   const gateway = await mcpClient({
+ *     name: 'gateway',
+ *     transport: gatewayTransport({
+ *       url: process.env.GATEWAY_MCP_URL!,
+ *       credentials: agentCoreIdentity({ region: 'us-west-2' }),
+ *       service: 'gateway',
+ *     }),
+ *   });
+ *   const agent = Agent.create({ provider, model }).tools(await gateway.tools()).build();
+ */
+export function gatewayTransport(options) {
+    if (!options.url)
+        throw new Error(`gatewayTransport requires 'url'.`);
+    if (!options.credentials)
+        throw new Error(`gatewayTransport requires 'credentials'.`);
+    return {
+        transport: 'gateway',
+        url: options.url,
+        credentials: options.credentials,
+        service: options.service ?? DEFAULT_SERVICE,
+        ...(options.scopes !== undefined && { scopes: options.scopes }),
+        ...(options.mode !== undefined && { mode: options.mode }),
+        ...(options.headers !== undefined && { headers: options.headers }),
+    };
+}
+/**
+ * Raised when the provider needs a human to authorize before it can vend.
+ *
+ * The URL is carried so the caller can surface it (pause the run, show a
+ * link); **the token is not, because there is not one yet** — that is the whole
+ * meaning of this error.
+ */
+export class GatewayAuthorizationRequiredError extends Error {
+    code = 'ERR_GATEWAY_AUTHORIZATION_REQUIRED';
+    /** Send the user here, then retry. */
+    authorizationUrl;
+    constructor(service, authorizationUrl) {
+        super(`[mcp] the credential provider needs a person to authorize '${service}' before it can ` +
+            `vend a token for this gateway. A transport cannot run a consent flow mid-request — ` +
+            `surface the authorization URL to the user (pause the run), then call the tool again ` +
+            `once they have authorized.`);
+        this.name = 'GatewayAuthorizationRequiredError';
+        this.authorizationUrl = authorizationUrl;
+    }
+}
+/**
+ * Build the `fetch` the MCP SDK will use: one that vends a credential, applies
+ * it to this one request, and keeps nothing.
+ *
+ * Exported for tests — the secrecy invariant is asserted against this function
+ * directly, because that is where a leak would happen and driving a whole SDK
+ * to reach it would test less while looking like it tested more.
+ *
+ * @internal
+ */
+export function createVendingFetch(transport, baseFetch = globalThis.fetch.bind(globalThis)) {
+    return async (input, init) => {
+        const result = await transport.credentials.getCredential({
+            service: transport.service,
+            ...(transport.scopes !== undefined && { scopes: transport.scopes }),
+            ...(transport.mode !== undefined && { mode: transport.mode }),
+        });
+        if (!isCredentialIssued(result)) {
+            throw new GatewayAuthorizationRequiredError(transport.service, result.authorizationUrl);
+        }
+        // Static headers first, vended ones last: a vended auth header always wins,
+        // so a stale static one can never quietly shadow the live credential.
+        const headers = new Headers(init?.headers ?? {});
+        for (const [key, value] of Object.entries(transport.headers ?? {}))
+            headers.set(key, value);
+        for (const [key, value] of Object.entries(result.credential.toHeaders())) {
+            headers.set(key, value);
+        }
+        // The vended value exists only inside this call, on this Headers object,
+        // for the duration of this request. Nothing above closes over it.
+        return baseFetch(input, { ...init, headers });
+    };
+}
+//# sourceMappingURL=gatewayTransport.js.map

package/dist/esm/lib/mcp/gatewayTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gatewayTransport.js","sourceRoot":"","sources":["../../../../src/lib/mcp/gatewayTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,kBAAkB,EAA2B,MAAM,yBAAyB,CAAC;AA0BtF,MAAM,eAAe,GAAG,SAAS,CAAC;AAElC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgC;IAC/D,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtE,IAAI,CAAC,OAAO,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACtF,OAAO;QACL,SAAS,EAAE,SAAS;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,eAAe;QAC3C,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAC/D,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QACzD,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;KACnE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IACjD,IAAI,GAAG,oCAA6C,CAAC;IAC9D,sCAAsC;IAC7B,gBAAgB,CAAS;IAElC,YAAY,OAAe,EAAE,gBAAwB;QACnD,KAAK,CACH,8DAA8D,OAAO,kBAAkB;YACrF,qFAAqF;YACrF,sFAAsF;YACtF,4BAA4B,CAC/B,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;QAChD,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;CACF;AAKD;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAA8B,EAC9B,YAAuB,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;IAExD,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,aAAa,CAAC;YACvD,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;YACnE,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,iCAAiC,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC1F,CAAC;QAED,4EAA4E;QAC5E,sEAAsE;QACtE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5F,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;YACzE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1B,CAAC;QAED,yEAAyE;QACzE,kEAAkE;QAClE,OAAO,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC;AACJ,CAAC"}

package/dist/esm/lib/mcp/index.d.ts

@@ -7,4 +7,5 @@
 export { mcpClient } from './mcpClient.js';
 export { mcpServe } from './mcpServe.js';
 export { mockMcpClient, type MockMcpClientOptions, type MockMcpTool } from './mockMcpClient.js';
-export type { McpClient, McpClientOptions, McpHttpTransport, McpStdioTransport, McpTransport, McpSdkClient, McpServeOptions, McpServeHandle, McpServeTransport, McpHttpServeTransport, McpStdioServeTransport, McpSdkServer, } from './types.js';
+export { gatewayTransport, GatewayAuthorizationRequiredError, type GatewayTransportOptions, } from './gatewayTransport.js';
+export type { McpClient, McpClientOptions, McpGatewayTransport, McpHttpTransport, McpStdioTransport, McpTransport, McpSdkClient, McpServeOptions, McpServeHandle, McpServeTransport, McpHttpServeTransport, McpStdioServeTransport, McpSdkServer, } from './types.js';

package/dist/esm/lib/mcp/index.js

@@ -7,4 +7,5 @@
 export { mcpClient } from './mcpClient.js';
 export { mcpServe } from './mcpServe.js';
 export { mockMcpClient } from './mockMcpClient.js';
+export { gatewayTransport, GatewayAuthorizationRequiredError, } from './gatewayTransport.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/lib/mcp/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,aAAa,EAA+C,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,aAAa,EAA+C,MAAM,oBAAoB,CAAC;AAChG,OAAO,EACL,gBAAgB,EAChB,iCAAiC,GAElC,MAAM,uBAAuB,CAAC"}

package/dist/esm/lib/mcp/mcpClient.js

@@ -33,6 +33,7 @@
  * loads only when a consumer actually constructs a client. Tests
  * inject `_client` and skip the import path entirely.
  */
+import { createVendingFetch } from './gatewayTransport.js';
 import { lazyRequire } from '../lazyRequire.js';
 // Version-less identity. The MCP `clientInfo` field is informational
 // (server logs it); a hardcoded number drifts every release. Consumers
@@ -131,15 +132,22 @@ async function buildTransport(t) {
             ...(t.cwd !== undefined && { cwd: t.cwd }),
         });
     }
-    // http transport
+    // http + gateway transports both ride Streamable HTTP. They differ only in
+    // WHEN the auth headers are decided: `http` fixes them at construction,
+    // `gateway` vends them inside every request (see gatewayTransport.ts).
     let httpMod;
     try {
         httpMod = lazyRequire('@modelcontextprotocol/sdk/client/streamableHttp.js');
     }
     catch {
-        throw new Error('mcpClient(http) requires @modelcontextprotocol/sdk/client/streamableHttp.js — ' +
+        throw new Error(`mcpClient(${t.transport}) requires @modelcontextprotocol/sdk/client/streamableHttp.js — ` +
             'check that @modelcontextprotocol/sdk is installed at the latest version.');
     }
+    if (t.transport === 'gateway') {
+        return new httpMod.StreamableHTTPClientTransport(new URL(t.url), {
+            fetch: createVendingFetch(t),
+        });
+    }
     return new httpMod.StreamableHTTPClientTransport(new URL(t.url), {
         ...(t.headers && { requestInit: { headers: { ...t.headers } } }),
     });

package/dist/esm/lib/mcp/mcpClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcpClient.js","sourceRoot":"","sources":["../../../../src/lib/mcp/mcpClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAIH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,qEAAqE;AACrE,uEAAuE;AACvE,mEAAmE;AACnE,MAAM,mBAAmB,GAAG;IAC1B,IAAI,EAAE,gBAAgB;IACtB,OAAO,EAAE,OAAO;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAsB;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhG,kEAAkE;IAClE,kDAAkD;IAClD,IAAI,KAAK,GAA2B,IAAI,CAAC;IACzC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,MAAM,UAAU,GAAG,CAAC,EAAU,EAAQ,EAAE;QACtC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,aAAa,IAAI,KAAK,EAAE,+DAA+D,CACxF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,IAA8B,EAAE;QACtD,sEAAsE;QACtE,0CAA0C;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM;YACxB,CAAC,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YACzD,CAAC,CAAC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,KAAK,CAAC,KAAK;YACT,UAAU,CAAC,OAAO,CAAC,CAAC;YACpB,IAAI,CAAC,KAAK;gBAAE,KAAK,GAAG,MAAM,UAAU,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,OAAO;YACX,UAAU,CAAC,SAAS,CAAC,CAAC;YACtB,KAAK,GAAG,MAAM,UAAU,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,KAAK;YACT,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sEAAsE;AAEtE,KAAK,UAAU,aAAa,CAC1B,SAAuB,EACvB,UAA8C,EAC9C,MAAoB;IAEpB,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,WAAW,CAAgB,2CAA2C,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,iDAAiD;YAC/C,qDAAqD;YACrD,yCAAyC,CAC5C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAiB,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,mBAAmB,EAAE;QAC7E,YAAY,EAAE,EAAE;KACjB,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;IACtD,6EAA6E;IAC7E,IAAI,MAAM;QAAE,MAAM,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;;QACvD,MAAM,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,CAAe;IAC3C,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QAC5B,IAAI,QAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,QAAQ,GAAG,WAAW,CAAkB,2CAA2C,CAAC,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,wEAAwE;gBACtE,0EAA0E,CAC7E,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,oBAAoB,CAAC;YACvC,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;YAC/B,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;YACnC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB;IACjB,IAAI,OAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAiB,oDAAoD,CAAC,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,gFAAgF;YAC9E,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,6BAA6B,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;QAC/D,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC;KACjE,CAAC,CAAC;AACL,CAAC;AAED,sEAAsE;AAEtE,SAAS,WAAW,CAClB,UAAkB,EAClB,GAAiB,EACjB,GAIC,EACD,MAAoB;IAEpB,MAAM,IAAI,GAAS;QACjB,MAAM,EAAE;YACN,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,aAAa,GAAG,CAAC,IAAI,EAAE;YACvD,WAAW,EAAE,GAAG,CAAC,WAAW;SAC7B;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACtB,4DAA4D;YAC5D,+DAA+D;YAC/D,6BAA6B;YAC7B,MAAM,OAAO,GACX,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC/D,CAAC,CAAE,IAAgC;gBACnC,CAAC,CAAC,EAAE,CAAC;YACT,oEAAoE;YACpE,qEAAqE;YACrE,oEAAoE;YACpE,oEAAoE;YACpE,6DAA6D;YAC7D,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM;gBACnB,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC;gBACnD,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/B,8DAA8D;YAC9D,6DAA6D;YAC7D,gEAAgE;YAChE,iEAAiE;YACjE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO;iBACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;iBAClE,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,aAAa,GAAG,CAAC,IAAI,cAAc,UAAU,yBAAyB,IAAI,EAAE,CAC7E,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"mcpClient.js","sourceRoot":"","sources":["../../../../src/lib/mcp/mcpClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAIH,OAAO,EAAE,kBAAkB,EAAkB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,qEAAqE;AACrE,uEAAuE;AACvE,mEAAmE;AACnE,MAAM,mBAAmB,GAAG;IAC1B,IAAI,EAAE,gBAAgB;IACtB,OAAO,EAAE,OAAO;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAsB;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhG,kEAAkE;IAClE,kDAAkD;IAClD,IAAI,KAAK,GAA2B,IAAI,CAAC;IACzC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,MAAM,UAAU,GAAG,CAAC,EAAU,EAAQ,EAAE;QACtC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,aAAa,IAAI,KAAK,EAAE,+DAA+D,CACxF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,IAA8B,EAAE;QACtD,sEAAsE;QACtE,0CAA0C;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM;YACxB,CAAC,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YACzD,CAAC,CAAC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,KAAK,CAAC,KAAK;YACT,UAAU,CAAC,OAAO,CAAC,CAAC;YACpB,IAAI,CAAC,KAAK;gBAAE,KAAK,GAAG,MAAM,UAAU,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,OAAO;YACX,UAAU,CAAC,SAAS,CAAC,CAAC;YACtB,KAAK,GAAG,MAAM,UAAU,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,KAAK;YACT,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sEAAsE;AAEtE,KAAK,UAAU,aAAa,CAC1B,SAAuB,EACvB,UAA8C,EAC9C,MAAoB;IAEpB,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,WAAW,CAAgB,2CAA2C,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,iDAAiD;YAC/C,qDAAqD;YACrD,yCAAyC,CAC5C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAiB,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,mBAAmB,EAAE;QAC7E,YAAY,EAAE,EAAE;KACjB,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;IACtD,6EAA6E;IAC7E,IAAI,MAAM;QAAE,MAAM,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;;QACvD,MAAM,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,CAAe;IAC3C,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QAC5B,IAAI,QAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,QAAQ,GAAG,WAAW,CAAkB,2CAA2C,CAAC,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,wEAAwE;gBACtE,0EAA0E,CAC7E,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,oBAAoB,CAAC;YACvC,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;YAC/B,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;YACnC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,OAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAiB,oDAAoD,CAAC,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,aAAa,CAAC,CAAC,SAAS,kEAAkE;YACxF,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,IAAI,OAAO,CAAC,6BAA6B,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;YAC/D,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,6BAA6B,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;QAC/D,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC;KACjE,CAAC,CAAC;AACL,CAAC;AAED,sEAAsE;AAEtE,SAAS,WAAW,CAClB,UAAkB,EAClB,GAAiB,EACjB,GAIC,EACD,MAAoB;IAEpB,MAAM,IAAI,GAAS;QACjB,MAAM,EAAE;YACN,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,aAAa,GAAG,CAAC,IAAI,EAAE;YACvD,WAAW,EAAE,GAAG,CAAC,WAAW;SAC7B;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACtB,4DAA4D;YAC5D,+DAA+D;YAC/D,6BAA6B;YAC7B,MAAM,OAAO,GACX,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC/D,CAAC,CAAE,IAAgC;gBACnC,CAAC,CAAC,EAAE,CAAC;YACT,oEAAoE;YACpE,qEAAqE;YACrE,oEAAoE;YACpE,oEAAoE;YACpE,6DAA6D;YAC7D,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM;gBACnB,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC;gBACnD,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/B,8DAA8D;YAC9D,6DAA6D;YAC7D,gEAAgE;YAChE,iEAAiE;YACjE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO;iBACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;iBAClE,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,aAAa,GAAG,CAAC,IAAI,cAAc,UAAU,yBAAyB,IAAI,EAAE,CAC7E,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}