alepha 0.23.0 → 0.24.0

package/dist/mcp/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../src/mcp/helpers/jsonrpc.ts","../../src/mcp/errors/McpError.ts","../../src/mcp/providers/McpServerProvider.ts","../../src/mcp/primitives/$prompt.ts","../../src/mcp/primitives/$resource.ts","../../src/mcp/primitives/$tool.ts","../../src/mcp/transports/StreamableHttpMcpTransport.ts","../../src/mcp/index.ts"],"sourcesContent":["import { AlephaError } from \"alepha\";\nimport type {\n  JsonRpcError,\n  JsonRpcNotification,\n  JsonRpcRequest,\n  JsonRpcResponse,\n} from \"../interfaces/McpTypes.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport const JSONRPC_VERSION = \"2.0\" as const;\n\n/**\n * The latest MCP protocol revision Alepha targets.\n * See {@link SUPPORTED_PROTOCOL_VERSIONS} for the full negotiation list.\n */\nexport const MCP_PROTOCOL_VERSION = \"2025-11-25\" as const;\n\n/**\n * Protocol versions Alepha will accept during `initialize` negotiation,\n * highest preference first. The server echoes back whichever version the\n * client requested if it appears here, otherwise picks the first entry.\n */\nexport const SUPPORTED_PROTOCOL_VERSIONS = [\n  \"2025-11-25\",\n  \"2025-06-18\",\n  \"2025-03-26\",\n  \"2024-11-05\",\n] as const;\n\nexport type SupportedProtocolVersion =\n  (typeof SUPPORTED_PROTOCOL_VERSIONS)[number];\n\nexport const isSupportedProtocolVersion = (\n  v: unknown,\n): v is SupportedProtocolVersion =>\n  typeof v === \"string\" &&\n  (SUPPORTED_PROTOCOL_VERSIONS as readonly string[]).includes(v);\n\nexport const JsonRpcErrorCodes = {\n  PARSE_ERROR: -32700,\n  INVALID_REQUEST: -32600,\n  METHOD_NOT_FOUND: -32601,\n  INVALID_PARAMS: -32602,\n  INTERNAL_ERROR: -32603,\n} as const;\n\n// ---------------------------------------------------------------------------------------------------------------------\n// Response Builders\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport function createResponse(\n  id: string | number,\n  result: unknown,\n): JsonRpcResponse {\n  return {\n    jsonrpc: JSONRPC_VERSION,\n    id,\n    result,\n  };\n}\n\nexport function createErrorResponse(\n  id: string | number,\n  error: JsonRpcError,\n): JsonRpcResponse {\n  return {\n    jsonrpc: JSONRPC_VERSION,\n    id,\n    error,\n  };\n}\n\nexport function createNotification(\n  method: string,\n  params?: Record<string, unknown>,\n): JsonRpcNotification {\n  return {\n    jsonrpc: JSONRPC_VERSION,\n    method,\n    params,\n  };\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n// Error Builders\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport function createParseError(message = \"Parse error\"): JsonRpcError {\n  return {\n    code: JsonRpcErrorCodes.PARSE_ERROR,\n    message,\n  };\n}\n\nexport function createInvalidRequestError(\n  message = \"Invalid request\",\n): JsonRpcError {\n  return {\n    code: JsonRpcErrorCodes.INVALID_REQUEST,\n    message,\n  };\n}\n\nexport function createMethodNotFoundError(method: string): JsonRpcError {\n  return {\n    code: JsonRpcErrorCodes.METHOD_NOT_FOUND,\n    message: `Method not found: ${method}`,\n  };\n}\n\nexport function createInvalidParamsError(message: string): JsonRpcError {\n  return {\n    code: JsonRpcErrorCodes.INVALID_PARAMS,\n    message,\n  };\n}\n\nexport function createInternalError(message: string): JsonRpcError {\n  return {\n    code: JsonRpcErrorCodes.INTERNAL_ERROR,\n    message,\n  };\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n// Message Parsing\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport function parseMessage(data: string): JsonRpcRequest {\n  let parsed: unknown;\n\n  try {\n    parsed = JSON.parse(data);\n  } catch {\n    throw new JsonRpcParseError(\"Invalid JSON\");\n  }\n\n  if (!isValidJsonRpcRequest(parsed)) {\n    throw new JsonRpcParseError(\"Invalid JSON-RPC request\");\n  }\n\n  return parsed;\n}\n\nexport function isValidJsonRpcRequest(value: unknown): value is JsonRpcRequest {\n  if (typeof value !== \"object\" || value === null) {\n    return false;\n  }\n\n  const obj = value as Record<string, unknown>;\n\n  if (obj.jsonrpc !== JSONRPC_VERSION) {\n    return false;\n  }\n\n  if (typeof obj.method !== \"string\") {\n    return false;\n  }\n\n  if (\n    obj.id !== undefined &&\n    typeof obj.id !== \"string\" &&\n    typeof obj.id !== \"number\"\n  ) {\n    return false;\n  }\n\n  if (obj.params !== undefined && typeof obj.params !== \"object\") {\n    return false;\n  }\n\n  return true;\n}\n\nexport function isNotification(request: JsonRpcRequest): boolean {\n  return request.id === undefined;\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n// Errors\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class JsonRpcParseError extends AlephaError {\n  name = \"JsonRpcParseError\";\n}\n","import { JsonRpcErrorCodes } from \"../helpers/jsonrpc.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * MCP-specific error codes (application-specific codes in the -32000 to -32099 range).\n */\nexport const McpErrorCodes = {\n  UNAUTHORIZED: -32001,\n  FORBIDDEN: -32003,\n} as const;\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class McpError extends Error {\n  name = \"McpError\";\n  code: number;\n\n  constructor(\n    message: string,\n    code: number = JsonRpcErrorCodes.INTERNAL_ERROR,\n  ) {\n    super(message);\n    this.code = code;\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class McpMethodNotFoundError extends McpError {\n  name = \"McpMethodNotFoundError\";\n\n  constructor(method: string) {\n    super(`Method not found: ${method}`, JsonRpcErrorCodes.METHOD_NOT_FOUND);\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class McpToolNotFoundError extends McpError {\n  name = \"McpToolNotFoundError\";\n  tool: string;\n\n  constructor(tool: string) {\n    super(`Tool not found: ${tool}`, JsonRpcErrorCodes.METHOD_NOT_FOUND);\n    this.tool = tool;\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class McpResourceNotFoundError extends McpError {\n  name = \"McpResourceNotFoundError\";\n  uri: string;\n\n  constructor(uri: string) {\n    super(`Resource not found: ${uri}`, JsonRpcErrorCodes.METHOD_NOT_FOUND);\n    this.uri = uri;\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class McpPromptNotFoundError extends McpError {\n  name = \"McpPromptNotFoundError\";\n  prompt: string;\n\n  constructor(prompt: string) {\n    super(`Prompt not found: ${prompt}`, JsonRpcErrorCodes.METHOD_NOT_FOUND);\n    this.prompt = prompt;\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class McpInvalidParamsError extends McpError {\n  name = \"McpInvalidParamsError\";\n\n  constructor(message: string) {\n    super(message, JsonRpcErrorCodes.INVALID_PARAMS);\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class McpUnauthorizedError extends McpError {\n  name = \"McpUnauthorizedError\";\n\n  constructor(message = \"Unauthorized\") {\n    super(message, McpErrorCodes.UNAUTHORIZED);\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class McpForbiddenError extends McpError {\n  name = \"McpForbiddenError\";\n\n  constructor(message = \"Forbidden\") {\n    super(message, McpErrorCodes.FORBIDDEN);\n  }\n}\n","import { $inject, Alepha, TypeBoxError } from \"alepha\";\nimport { $logger } from \"alepha/logger\";\nimport {\n  McpError,\n  McpMethodNotFoundError,\n  McpPromptNotFoundError,\n  McpResourceNotFoundError,\n  McpToolNotFoundError,\n} from \"../errors/McpError.ts\";\nimport {\n  createErrorResponse,\n  createInternalError,\n  createResponse,\n  isSupportedProtocolVersion,\n  MCP_PROTOCOL_VERSION,\n  SUPPORTED_PROTOCOL_VERSIONS,\n} from \"../helpers/jsonrpc.ts\";\nimport type {\n  JsonRpcRequest,\n  JsonRpcResponse,\n  McpCapabilities,\n  McpContent,\n  McpContext,\n  McpInitializeResult,\n  McpPromptDescriptor,\n  McpPromptGetResult,\n  McpPromptMessage,\n  McpResourceContent,\n  McpResourceDescriptor,\n  McpResourceReadResult,\n  McpServerInfo,\n  McpToolCallResult,\n  McpToolDescriptor,\n} from \"../interfaces/McpTypes.ts\";\nimport type { PromptPrimitive } from \"../primitives/$prompt.ts\";\nimport type { ResourcePrimitive } from \"../primitives/$resource.ts\";\nimport type { ToolPrimitive } from \"../primitives/$tool.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * Core MCP server provider that handles protocol messages.\n *\n * This provider maintains registries of tools, resources, and prompts,\n * and routes incoming JSON-RPC requests to the appropriate handlers.\n *\n * It is transport-agnostic - actual communication is handled by\n * transport providers like StdioMcpTransport or SseMcpTransport.\n */\nexport class McpServerProvider {\n  protected readonly log = $logger();\n  protected readonly alepha = $inject(Alepha);\n\n  protected readonly tools = new Map<string, ToolPrimitive<any>>();\n  protected readonly resources = new Map<string, ResourcePrimitive>();\n  protected readonly prompts = new Map<string, PromptPrimitive<any>>();\n\n  protected initialized = false;\n\n  /**\n   * Protocol version negotiated with the client during `initialize`.\n   * Used by transports to validate the `MCP-Protocol-Version` header on\n   * subsequent HTTP requests (per spec 2025-06-18+).\n   */\n  public negotiatedVersion: string = MCP_PROTOCOL_VERSION;\n\n  /**\n   * Server identity returned during `initialize`. Consumers may override\n   * fields directly (e.g. `mcpServer.serverInfo = { name: \"lore-mcp\",\n   * version: \"0.20.3\", description: \"...\" }`) — the `description` field\n   * is supported per spec 2025-11-25 (minor change #2).\n   */\n  public serverInfo: McpServerInfo = {\n    name: \"alepha-mcp\",\n    version: \"1.0.0\",\n  };\n\n  // -----------------------------------------------------------------------------------------------------------------\n  // Registration Methods\n  // -----------------------------------------------------------------------------------------------------------------\n\n  /**\n   * Register a tool with the MCP server.\n   */\n  public registerTool(tool: ToolPrimitive<any>): void {\n    this.log.trace(`Registering MCP tool: ${tool.name}`);\n    this.tools.set(tool.name, tool);\n  }\n\n  /**\n   * Register a resource with the MCP server.\n   */\n  public registerResource(resource: ResourcePrimitive): void {\n    this.log.trace(`Registering MCP resource: ${resource.uri}`);\n    this.resources.set(resource.uri, resource);\n  }\n\n  /**\n   * Register a prompt with the MCP server.\n   */\n  public registerPrompt(prompt: PromptPrimitive<any>): void {\n    this.log.trace(`Registering MCP prompt: ${prompt.name}`);\n    this.prompts.set(prompt.name, prompt);\n  }\n\n  // -----------------------------------------------------------------------------------------------------------------\n  // Getters\n  // -----------------------------------------------------------------------------------------------------------------\n\n  /**\n   * Get the server capabilities based on registered primitives.\n   */\n  public getCapabilities(): McpCapabilities {\n    return {\n      tools: this.tools.size > 0 ? {} : undefined,\n      resources: this.resources.size > 0 ? {} : undefined,\n      prompts: this.prompts.size > 0 ? {} : undefined,\n    };\n  }\n\n  /**\n   * Get all registered tools.\n   */\n  public getTools(): ToolPrimitive<any>[] {\n    return Array.from(this.tools.values());\n  }\n\n  /**\n   * Get all registered resources.\n   */\n  public getResources(): ResourcePrimitive[] {\n    return Array.from(this.resources.values());\n  }\n\n  /**\n   * Get all registered prompts.\n   */\n  public getPrompts(): PromptPrimitive<any>[] {\n    return Array.from(this.prompts.values());\n  }\n\n  /**\n   * Get a tool by name.\n   */\n  public getTool(name: string): ToolPrimitive<any> | undefined {\n    return this.tools.get(name);\n  }\n\n  /**\n   * Get a resource by URI.\n   */\n  public getResource(uri: string): ResourcePrimitive | undefined {\n    return this.resources.get(uri);\n  }\n\n  /**\n   * Get a prompt by name.\n   */\n  public getPrompt(name: string): PromptPrimitive<any> | undefined {\n    return this.prompts.get(name);\n  }\n\n  // -----------------------------------------------------------------------------------------------------------------\n  // Message Handling\n  // -----------------------------------------------------------------------------------------------------------------\n\n  /**\n   * Handle an incoming JSON-RPC request.\n   *\n   * @param request - The parsed JSON-RPC request\n   * @param context - Optional context from the transport layer (headers, auth, etc.)\n   * @returns The JSON-RPC response, or null for notifications\n   */\n  public async handleMessage(\n    request: JsonRpcRequest,\n    context?: McpContext,\n  ): Promise<JsonRpcResponse | null> {\n    const id = request.id;\n\n    // Notifications have no id and expect no response\n    if (id === undefined) {\n      await this.handleNotification(request);\n      return null;\n    }\n\n    try {\n      const result = await this.handleRequest(request, context);\n      return createResponse(id, result);\n    } catch (error) {\n      this.log.error(\"MCP request failed\", error);\n      // Preserve error code from McpError instances\n      if (error instanceof McpError) {\n        return createErrorResponse(id, {\n          code: error.code,\n          message: error.message,\n        });\n      }\n      return createErrorResponse(\n        id,\n        createInternalError((error as Error).message),\n      );\n    }\n  }\n\n  /**\n   * Handle a JSON-RPC request that expects a response.\n   */\n  protected async handleRequest(\n    request: JsonRpcRequest,\n    context?: McpContext,\n  ): Promise<unknown> {\n    const { method, params = {} } = request;\n\n    switch (method) {\n      case \"initialize\":\n        return this.handleInitialize(params);\n      case \"ping\":\n        return this.handlePing();\n      case \"tools/list\":\n        return this.handleToolsList();\n      case \"tools/call\":\n        return this.handleToolsCall(params, context);\n      case \"resources/list\":\n        return this.handleResourcesList();\n      case \"resources/read\":\n        return this.handleResourcesRead(params, context);\n      case \"prompts/list\":\n        return this.handlePromptsList();\n      case \"prompts/get\":\n        return this.handlePromptsGet(params, context);\n      default:\n        throw new McpMethodNotFoundError(method);\n    }\n  }\n\n  /**\n   * Handle a notification (no response expected).\n   */\n  protected async handleNotification(request: JsonRpcRequest): Promise<void> {\n    const { method } = request;\n\n    switch (method) {\n      case \"notifications/initialized\":\n        this.log.debug(\"MCP client initialized\");\n        break;\n      case \"notifications/cancelled\":\n        this.log.debug(\"MCP request cancelled\", request.params);\n        break;\n      default:\n        this.log.debug(`Unknown MCP notification: ${method}`);\n    }\n  }\n\n  // -----------------------------------------------------------------------------------------------------------------\n  // Protocol Handlers\n  // -----------------------------------------------------------------------------------------------------------------\n\n  protected handleInitialize(\n    params: Record<string, unknown>,\n  ): McpInitializeResult {\n    const requested = params.protocolVersion;\n    // Echo the client's version when supported, otherwise reply with our\n    // preferred version (highest entry in SUPPORTED_PROTOCOL_VERSIONS).\n    // The client can then decide to retry, downgrade, or disconnect.\n    const negotiated = isSupportedProtocolVersion(requested)\n      ? requested\n      : SUPPORTED_PROTOCOL_VERSIONS[0];\n\n    this.log.info(\"MCP client initializing\", {\n      clientInfo: params.clientInfo,\n      requestedProtocolVersion: requested,\n      negotiatedProtocolVersion: negotiated,\n    });\n\n    this.initialized = true;\n    this.negotiatedVersion = negotiated;\n\n    return {\n      protocolVersion: negotiated,\n      capabilities: this.getCapabilities(),\n      serverInfo: this.serverInfo,\n    };\n  }\n\n  protected handlePing(): Record<string, never> {\n    return {};\n  }\n\n  protected handleToolsList(): { tools: McpToolDescriptor[] } {\n    return {\n      tools: Array.from(this.tools.values()).map((t) => t.toDescriptor()),\n    };\n  }\n\n  protected async handleToolsCall(\n    params: Record<string, unknown>,\n    context?: McpContext,\n  ): Promise<McpToolCallResult> {\n    const name = params.name as string;\n    const args = (params.arguments ?? {}) as Record<string, unknown>;\n\n    const tool = this.tools.get(name);\n    if (!tool) {\n      // McpToolNotFoundError is intentionally a JSON-RPC protocol error,\n      // not a tool execution error — see SEP-1303 (only validation/runtime\n      // failures of an existing tool are reported via isError: true).\n      throw new McpToolNotFoundError(name);\n    }\n\n    try {\n      const result = await tool.execute(args, context);\n\n      // A tool WITHOUT an output schema may return raw MCP content blocks\n      // (e.g. an `image` block) instead of JSON — used for binary payloads\n      // like attachment previews. Recognized by the CallToolResult shape\n      // (`{ content: McpContent[] }`); passed through verbatim. Tools that\n      // declare an output schema always go through the structured path\n      // below, so a JSON result that happens to carry a `content` array is\n      // never mistaken for raw content.\n      if (!tool.hasOutputSchema()) {\n        const raw = this.asRawToolContent(result);\n        if (raw) {\n          return raw;\n        }\n      }\n\n      const callResult: McpToolCallResult = {\n        content: [\n          {\n            type: \"text\",\n            text:\n              typeof result === \"string\"\n                ? result\n                : JSON.stringify(result ?? null),\n          },\n        ],\n      };\n\n      // Spec 2025-06-18: when the tool declares an outputSchema, the server\n      // MUST populate `structuredContent` with the validated result. The\n      // text-stringified `content` block remains as a back-compat fallback.\n      if (tool.hasOutputSchema() && result !== undefined) {\n        callResult.structuredContent = result;\n      }\n\n      return callResult;\n    } catch (error) {\n      // Spec 2025-11-25 / SEP-1303: input-validation failures (and other\n      // tool-runtime errors) are returned as Tool Execution Errors, not\n      // JSON-RPC protocol errors, so the model can self-correct.\n      // For TypeBox validation errors we surface the failing path so the\n      // model knows which argument was malformed.\n      if (error instanceof TypeBoxError) {\n        const path = error.value?.path || \"/\";\n        const message = error.value?.message || error.message;\n        return {\n          content: [\n            {\n              type: \"text\",\n              text: `Validation error at ${path}: ${message}`,\n            },\n          ],\n          structuredContent: {\n            errors: [{ path, message }],\n          },\n          isError: true,\n        };\n      }\n\n      return {\n        content: [\n          {\n            type: \"text\",\n            text: `Error: ${(error as Error).message}`,\n          },\n        ],\n        isError: true,\n      };\n    }\n  }\n\n  /**\n   * Recognize a tool handler's return value as a pre-built MCP tool result —\n   * i.e. it already carries a `content` array of content blocks (text, image,\n   * audio, resource, resource_link). Returns the normalized\n   * {@link McpToolCallResult} when matched, or `undefined` to fall back to the\n   * default JSON/text encoding. Only ever consulted for tools that did NOT\n   * declare an output schema (see {@link handleToolCall}).\n   */\n  protected asRawToolContent(result: unknown): McpToolCallResult | undefined {\n    if (!result || typeof result !== \"object\") {\n      return undefined;\n    }\n    const candidate = result as {\n      content?: unknown;\n      isError?: unknown;\n      _meta?: unknown;\n    };\n    if (!Array.isArray(candidate.content) || candidate.content.length === 0) {\n      return undefined;\n    }\n    const allBlocks = candidate.content.every(\n      (block): block is McpContent =>\n        !!block &&\n        typeof block === \"object\" &&\n        typeof (block as { type?: unknown }).type === \"string\",\n    );\n    if (!allBlocks) {\n      return undefined;\n    }\n    return {\n      content: candidate.content as McpContent[],\n      isError:\n        typeof candidate.isError === \"boolean\" ? candidate.isError : undefined,\n      _meta:\n        candidate._meta && typeof candidate._meta === \"object\"\n          ? (candidate._meta as Record<string, unknown>)\n          : undefined,\n    };\n  }\n\n  protected handleResourcesList(): { resources: McpResourceDescriptor[] } {\n    return {\n      resources: Array.from(this.resources.values()).map((r) =>\n        r.toDescriptor(),\n      ),\n    };\n  }\n\n  protected async handleResourcesRead(\n    params: Record<string, unknown>,\n    context?: McpContext,\n  ): Promise<McpResourceReadResult> {\n    const uri = params.uri as string;\n\n    const resource = this.resources.get(uri);\n    if (!resource) {\n      throw new McpResourceNotFoundError(uri);\n    }\n\n    const content = await resource.read(context);\n\n    const resourceContent: McpResourceContent = {\n      uri,\n      mimeType: resource.mimeType,\n    };\n\n    if (content.text !== undefined) {\n      resourceContent.text = content.text;\n    }\n\n    if (content.blob !== undefined) {\n      // Convert binary to base64 for transport\n      resourceContent.blob = Buffer.from(content.blob).toString(\"base64\");\n    }\n\n    return {\n      contents: [resourceContent],\n    };\n  }\n\n  protected handlePromptsList(): { prompts: McpPromptDescriptor[] } {\n    return {\n      prompts: Array.from(this.prompts.values()).map((p) => p.toDescriptor()),\n    };\n  }\n\n  protected async handlePromptsGet(\n    params: Record<string, unknown>,\n    context?: McpContext,\n  ): Promise<McpPromptGetResult> {\n    const name = params.name as string;\n    const args = (params.arguments ?? {}) as Record<string, string>;\n\n    const prompt = this.prompts.get(name);\n    if (!prompt) {\n      throw new McpPromptNotFoundError(name);\n    }\n\n    const messages = await prompt.get(args, context);\n\n    const mcpMessages: McpPromptMessage[] = messages.map((msg) => ({\n      role: msg.role,\n      content: {\n        type: \"text\" as const,\n        text: msg.content,\n      },\n    }));\n\n    return {\n      description: prompt.description,\n      messages: mcpMessages,\n    };\n  }\n}\n","import {\n  $inject,\n  type Async,\n  createPrimitive,\n  KIND,\n  Primitive,\n  type Static,\n  type TObject,\n  t,\n} from \"alepha\";\nimport type {\n  McpContext,\n  McpIcon,\n  McpPromptArgument,\n  McpPromptDescriptor,\n  PromptHandlerArgs,\n  PromptMessage,\n} from \"../interfaces/McpTypes.ts\";\nimport { McpServerProvider } from \"../providers/McpServerProvider.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * Creates an MCP prompt primitive for defining reusable prompt templates.\n *\n * Prompts allow you to define templated messages that can be filled in\n * with arguments at runtime. They're useful for creating consistent\n * interaction patterns.\n *\n * @example\n * ```ts\n * class Prompts {\n *   greeting = $prompt({\n *     description: \"Generate a personalized greeting\",\n *     args: t.object({\n *       name: t.text({ description: \"Name of the person to greet\" }),\n *       style: t.optional(t.enum([\"formal\", \"casual\"])),\n *     }),\n *     handler: async ({ args }) => [\n *       {\n *         role: \"user\",\n *         content: args.style === \"formal\"\n *           ? `Please greet ${args.name} in a formal manner.`\n *           : `Say hi to ${args.name}!`,\n *       },\n *     ],\n *   });\n *\n *   codeReview = $prompt({\n *     description: \"Request a code review\",\n *     args: t.object({\n *       code: t.text({ description: \"The code to review\" }),\n *       language: t.text({ description: \"Programming language\" }),\n *     }),\n *     handler: async ({ args }) => [\n *       {\n *         role: \"user\",\n *         content: `Please review this ${args.language} code:\\n\\n${args.code}`,\n *       },\n *     ],\n *   });\n * }\n * ```\n */\nexport const $prompt = <T extends TObject>(\n  options: PromptPrimitiveOptions<T>,\n): PromptPrimitive<T> => {\n  return createPrimitive(PromptPrimitive<T>, options);\n};\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface PromptPrimitiveOptions<T extends TObject> {\n  /**\n   * The name of the prompt.\n   *\n   * If not provided, defaults to the property key where the prompt is declared.\n   *\n   * @example \"greeting\"\n   * @example \"code-review\"\n   */\n  name?: string;\n\n  /**\n   * Human-friendly display title (spec 2025-11-25). Distinct from `name`,\n   * which remains the programmatic identifier.\n   */\n  title?: string;\n\n  /**\n   * Description of what this prompt does.\n   *\n   * Helps users understand the purpose of the prompt.\n   *\n   * @example \"Generate a personalized greeting message\"\n   */\n  description?: string;\n\n  /**\n   * Optional icons surfaced in client UIs (spec 2025-11-25 / SEP-973).\n   */\n  icons?: McpIcon[];\n\n  /**\n   * TypeBox schema defining the prompt arguments.\n   *\n   * Each property in the schema becomes an argument that can be\n   * filled in when the prompt is used.\n   */\n  args?: T;\n\n  /**\n   * Handler function that generates the prompt messages.\n   *\n   * Receives the validated arguments and returns an array of messages.\n   *\n   * @param args - Object containing validated arguments\n   * @returns Array of prompt messages\n   */\n  handler: (args: PromptHandlerArgs<T>) => Async<PromptMessage[]>;\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class PromptPrimitive<T extends TObject> extends Primitive<\n  PromptPrimitiveOptions<T>\n> {\n  protected readonly mcpServer = $inject(McpServerProvider);\n\n  /**\n   * Returns the name of the prompt.\n   */\n  public get name(): string {\n    return this.options.name ?? this.config.propertyKey;\n  }\n\n  /**\n   * Returns the description of the prompt.\n   */\n  public get description(): string | undefined {\n    return this.options.description;\n  }\n\n  protected onInit(): void {\n    this.mcpServer.registerPrompt(this);\n  }\n\n  /**\n   * Get the prompt messages with the given arguments.\n   *\n   * @param rawArgs - Raw arguments to validate and pass to the handler\n   * @param context - Optional context from the transport layer\n   * @returns Array of prompt messages\n   */\n  public async get(\n    rawArgs: unknown,\n    context?: McpContext,\n  ): Promise<PromptMessage[]> {\n    let args = (rawArgs ?? {}) as Static<T>;\n\n    if (this.options.args) {\n      args = this.alepha.codec.decode(this.options.args, rawArgs ?? {});\n    }\n\n    return this.options.handler({ args, context });\n  }\n\n  /**\n   * Convert the prompt to an MCP prompt descriptor for protocol messages.\n   */\n  public toDescriptor(): McpPromptDescriptor {\n    const descriptor: McpPromptDescriptor = {\n      name: this.name,\n      description: this.description,\n      arguments: this.options.args\n        ? this.schemaToArguments(this.options.args)\n        : [],\n    };\n    if (this.options.title) descriptor.title = this.options.title;\n    if (this.options.icons && this.options.icons.length > 0) {\n      descriptor.icons = this.options.icons;\n    }\n    return descriptor;\n  }\n\n  /**\n   * Convert a TypeBox schema to an array of prompt arguments.\n   */\n  protected schemaToArguments(schema: TObject): McpPromptArgument[] {\n    const args: McpPromptArgument[] = [];\n\n    for (const [name, propSchema] of Object.entries(schema.properties)) {\n      const prop = propSchema as Record<string, unknown>;\n      args.push({\n        name,\n        description: prop.description as string | undefined,\n        required: !t.schema.isOptional(propSchema),\n      });\n    }\n\n    return args;\n  }\n}\n\n$prompt[KIND] = PromptPrimitive;\n","import { $inject, createPrimitive, KIND, Primitive } from \"alepha\";\nimport type {\n  McpContext,\n  McpIcon,\n  McpResourceDescriptor,\n  ResourceContent,\n  ResourceHandler,\n} from \"../interfaces/McpTypes.ts\";\nimport { McpServerProvider } from \"../providers/McpServerProvider.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * Creates an MCP resource primitive for exposing read-only data.\n *\n * Resources represent any kind of data that an LLM might want to read,\n * such as files, database records, API responses, or computed data.\n *\n * **Key Features**\n * - URI-based identification for resources\n * - Support for text and binary content\n * - MIME type specification\n * - Lazy loading via handler function\n *\n * @example\n * ```ts\n * class ProjectResources {\n *   readme = $resource({\n *     uri: \"file:///readme\",\n *     description: \"Project README file\",\n *     mimeType: \"text/markdown\",\n *     handler: async () => ({\n *       text: await fs.readFile(\"README.md\", \"utf-8\"),\n *     }),\n *   });\n *\n *   config = $resource({\n *     uri: \"config://app\",\n *     name: \"Application Configuration\",\n *     mimeType: \"application/json\",\n *     handler: async () => ({\n *       text: JSON.stringify(this.configService.getConfig()),\n *     }),\n *   });\n * }\n * ```\n */\nexport const $resource = (\n  options: ResourcePrimitiveOptions,\n): ResourcePrimitive => {\n  return createPrimitive(ResourcePrimitive, options);\n};\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface ResourcePrimitiveOptions {\n  /**\n   * The URI that identifies this resource.\n   *\n   * URIs should follow a consistent scheme for your application.\n   * Common patterns:\n   * - `file:///path/to/file` - File system resources\n   * - `db://table/id` - Database records\n   * - `api://endpoint` - API responses\n   * - `config://name` - Configuration values\n   *\n   * @example \"file:///readme.md\"\n   * @example \"db://users/123\"\n   */\n  uri: string;\n\n  /**\n   * Human-readable name for the resource.\n   *\n   * If not provided, defaults to the property key where the resource is declared.\n   *\n   * @example \"Project README\"\n   * @example \"User Profile\"\n   */\n  name?: string;\n\n  /**\n   * Human-friendly display title (spec 2025-11-25). Distinct from `name`,\n   * which remains the programmatic identifier.\n   */\n  title?: string;\n\n  /**\n   * Optional icons surfaced in client UIs (spec 2025-11-25 / SEP-973).\n   */\n  icons?: McpIcon[];\n\n  /**\n   * Description of what this resource contains.\n   *\n   * Helps the LLM understand the purpose and content of the resource.\n   *\n   * @example \"The main README file for the project\"\n   */\n  description?: string;\n\n  /**\n   * MIME type of the resource content.\n   *\n   * Helps clients understand how to interpret the content.\n   *\n   * @default \"text/plain\"\n   * @example \"text/markdown\"\n   * @example \"application/json\"\n   */\n  mimeType?: string;\n\n  /**\n   * Handler function that returns the resource content.\n   *\n   * Called when the resource is read. Can return text or binary content.\n   *\n   * @returns Resource content with either `text` or `blob` property\n   */\n  handler: ResourceHandler;\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class ResourcePrimitive extends Primitive<ResourcePrimitiveOptions> {\n  protected readonly mcpServer = $inject(McpServerProvider);\n\n  /**\n   * Returns the name of the resource.\n   */\n  public get name(): string {\n    return this.options.name ?? this.config.propertyKey;\n  }\n\n  /**\n   * Returns the URI of the resource.\n   */\n  public get uri(): string {\n    return this.options.uri;\n  }\n\n  /**\n   * Returns the description of the resource.\n   */\n  public get description(): string | undefined {\n    return this.options.description;\n  }\n\n  /**\n   * Returns the MIME type of the resource.\n   */\n  public get mimeType(): string {\n    return this.options.mimeType ?? \"text/plain\";\n  }\n\n  protected onInit(): void {\n    this.mcpServer.registerResource(this);\n  }\n\n  /**\n   * Read the resource content.\n   *\n   * @param context - Optional context from the transport layer\n   * @returns The resource content\n   */\n  public async read(context?: McpContext): Promise<ResourceContent> {\n    return this.options.handler({ context });\n  }\n\n  /**\n   * Convert the resource to an MCP resource descriptor for protocol messages.\n   */\n  public toDescriptor(): McpResourceDescriptor {\n    const descriptor: McpResourceDescriptor = {\n      uri: this.uri,\n      name: this.name,\n      description: this.description,\n      mimeType: this.mimeType,\n    };\n    if (this.options.title) descriptor.title = this.options.title;\n    if (this.options.icons && this.options.icons.length > 0) {\n      descriptor.icons = this.options.icons;\n    }\n    return descriptor;\n  }\n}\n\n$resource[KIND] = ResourcePrimitive;\n","import {\n  $inject,\n  type Async,\n  createPrimitive,\n  KIND,\n  Primitive,\n  type TObject,\n  type TSchema,\n  t,\n} from \"alepha\";\nimport type {\n  McpContext,\n  McpIcon,\n  McpJsonSchema,\n  McpToolAnnotations,\n  McpToolDescriptor,\n  ToolHandlerArgs,\n  ToolHandlerResult,\n  ToolPrimitiveSchema,\n} from \"../interfaces/McpTypes.ts\";\nimport { McpServerProvider } from \"../providers/McpServerProvider.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * Creates an MCP tool primitive for defining callable functions.\n *\n * Tools are the primary way for LLMs to interact with external systems through MCP.\n * Each tool has a name, description, typed parameters, and a handler function.\n *\n * **Key Features**\n * - Full TypeScript inference for parameters and results\n * - Automatic schema validation using TypeBox\n * - JSON Schema generation for MCP protocol\n * - Integration with MCP server provider\n *\n * @example\n * ```ts\n * class CalculatorTools {\n *   add = $tool({\n *     description: \"Add two numbers together\",\n *     schema: {\n *       params: t.object({\n *         a: t.number(),\n *         b: t.number(),\n *       }),\n *       result: t.number(),\n *     },\n *     handler: async ({ params }) => {\n *       return params.a + params.b;\n *     },\n *   });\n *\n *   greet = $tool({\n *     description: \"Generate a greeting message\",\n *     schema: {\n *       params: t.object({\n *         name: t.text(),\n *       }),\n *       result: t.text(),\n *     },\n *     handler: async ({ params }) => {\n *       return `Hello, ${params.name}!`;\n *     },\n *   });\n * }\n * ```\n */\nexport const $tool = <T extends ToolPrimitiveSchema>(\n  options: ToolPrimitiveOptions<T>,\n): ToolPrimitive<T> => {\n  return createPrimitive(ToolPrimitive<T>, options);\n};\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface ToolPrimitiveOptions<T extends ToolPrimitiveSchema> {\n  /**\n   * The name of the tool.\n   *\n   * If not provided, defaults to the property key where the tool is declared.\n   * Names should be descriptive and use kebab-case or snake_case.\n   *\n   * @example \"calculate-sum\"\n   * @example \"get_weather\"\n   */\n  name?: string;\n\n  /**\n   * Human-friendly display title (spec 2025-11-25). Distinct from `name`,\n   * which remains the programmatic identifier. Clients use `title` in\n   * tool palettes / picker UIs.\n   *\n   * @example \"Search Lore\"\n   */\n  title?: string;\n\n  /**\n   * A human-readable description of what the tool does.\n   *\n   * This description is sent to the LLM to help it understand\n   * when and how to use the tool. Be clear and specific.\n   *\n   * @example \"Calculate the sum of two numbers\"\n   * @example \"Retrieve current weather data for a given location\"\n   */\n  description: string;\n\n  /**\n   * Behavior hints (spec 2025-03-26+). Clients use these to gate UI prompts\n   * (e.g. require confirmation before a tool with `destructiveHint: true`).\n   * None are guarantees — they are heuristics for the client, not the model.\n   */\n  annotations?: McpToolAnnotations;\n\n  /**\n   * Icons surfaced in client tool palettes / picker UIs (spec 2025-11-25).\n   */\n  icons?: McpIcon[];\n\n  /**\n   * TypeBox schema defining the tool's parameters and result type.\n   *\n   * - **params**: TObject schema for input parameters (optional)\n   * - **result**: TSchema for the return value (optional)\n   *\n   * Schemas provide:\n   * - Type inference for handler function\n   * - Runtime validation of inputs\n   * - JSON Schema generation for MCP protocol\n   */\n  schema?: T;\n\n  /**\n   * The handler function that executes when the tool is called.\n   *\n   * Receives validated parameters and returns the result.\n   * Errors thrown here are caught and returned as MCP errors.\n   *\n   * @param args - Object containing validated params\n   * @returns The tool result (can be async)\n   */\n  handler: (args: ToolHandlerArgs<T>) => Async<ToolHandlerResult<T>>;\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class ToolPrimitive<T extends ToolPrimitiveSchema> extends Primitive<\n  ToolPrimitiveOptions<T>\n> {\n  protected readonly mcpServer = $inject(McpServerProvider);\n\n  /**\n   * Returns the name of the tool.\n   */\n  public get name(): string {\n    return this.options.name ?? this.config.propertyKey;\n  }\n\n  /**\n   * Returns the description of the tool.\n   */\n  public get description(): string {\n    return this.options.description;\n  }\n\n  /**\n   * Whether the tool declared a result schema. When true, `tools/call`\n   * responses include `structuredContent` populated with the validated\n   * result (spec 2025-06-18).\n   */\n  public hasOutputSchema(): boolean {\n    return !!this.options.schema?.result;\n  }\n\n  protected onInit(): void {\n    this.mcpServer.registerTool(this);\n  }\n\n  /**\n   * Execute the tool with the given parameters.\n   *\n   * @param params - Raw parameters to validate and pass to the handler\n   * @param context - Optional context from the transport layer\n   * @returns The tool result\n   */\n  public async execute(\n    params: unknown,\n    context?: McpContext,\n  ): Promise<ToolHandlerResult<T>> {\n    let validatedParams: any = params ?? {};\n\n    // Validate params using alepha.codec if schema provided\n    if (this.options.schema?.params) {\n      validatedParams = this.alepha.codec.decode(\n        this.options.schema.params,\n        validatedParams,\n      );\n    }\n\n    const result = await this.options.handler({\n      params: validatedParams,\n      context,\n    });\n\n    // Validate and encode result if schema provided\n    if (this.options.schema?.result && result !== undefined) {\n      return this.alepha.codec.encode(\n        this.options.schema.result,\n        result,\n      ) as ToolHandlerResult<T>;\n    }\n\n    return result as ToolHandlerResult<T>;\n  }\n\n  /**\n   * Convert the tool to an MCP tool descriptor for protocol messages.\n   *\n   * Emits the spec 2025-11-25 surface: `title`, `annotations`, `icons`,\n   * and (when `schema.result` is defined) `outputSchema` so the server\n   * can populate `structuredContent` on call results.\n   */\n  public toDescriptor(): McpToolDescriptor {\n    const inputSchema: McpJsonSchema = this.options.schema?.params\n      ? this.schemaToJsonSchema(this.options.schema.params)\n      : { type: \"object\", properties: {}, required: [] };\n\n    const descriptor: McpToolDescriptor = {\n      name: this.name,\n      description: this.description,\n      inputSchema,\n    };\n\n    if (this.options.title) descriptor.title = this.options.title;\n    if (this.options.annotations)\n      descriptor.annotations = this.options.annotations;\n    if (this.options.icons && this.options.icons.length > 0) {\n      descriptor.icons = this.options.icons;\n    }\n\n    // Output schema is emitted when the tool declares `schema.result`,\n    // unlocking structured content on tools/call responses.\n    if (this.options.schema?.result) {\n      const out = this.propertyToJsonSchema(this.options.schema.result);\n      // The result schema may be a primitive — wrap so the descriptor\n      // value is always a JSON Schema object with `type`.\n      descriptor.outputSchema = (\n        typeof out === \"object\" && out !== null && \"type\" in out\n          ? out\n          : { type: \"object\", properties: {}, required: [] }\n      ) as McpJsonSchema;\n    }\n\n    return descriptor;\n  }\n\n  /**\n   * Convert a TypeBox schema to JSON Schema format.\n   *\n   * Emits the 2020-12 dialect annotation at the root (spec 2025-11-25 /\n   * SEP-1613 — JSON Schema 2020-12 is the default dialect for MCP).\n   * The TypeBox shapes Alepha emits today are already 2020-12-compatible;\n   * this is just the dialect declaration.\n   */\n  protected schemaToJsonSchema(\n    schema: TObject,\n    options?: { root?: boolean },\n  ): McpJsonSchema {\n    const properties: Record<string, unknown> = {};\n    const required: string[] = [];\n\n    for (const [key, propSchema] of Object.entries(schema.properties)) {\n      properties[key] = this.propertyToJsonSchema(propSchema as TSchema);\n\n      // Check if property is required (not optional)\n      if (!t.schema.isOptional(propSchema as TSchema)) {\n        required.push(key);\n      }\n    }\n\n    const result: McpJsonSchema = {\n      type: \"object\",\n      properties,\n      required,\n    };\n\n    // Annotate the dialect on the root schema only (avoid noise on nested\n    // sub-schemas where MCP doesn't expect $schema).\n    if (options?.root !== false) {\n      result.$schema = \"https://json-schema.org/draft/2020-12/schema\";\n    }\n\n    return result;\n  }\n\n  /**\n   * Convert a single property schema to JSON Schema format.\n   */\n  protected propertyToJsonSchema(schema: TSchema): Record<string, unknown> {\n    const result: Record<string, unknown> = {};\n\n    // Check for description on all types\n    if (\"description\" in schema) {\n      result.description = schema.description;\n    }\n\n    if (t.schema.isString(schema)) {\n      result.type = \"string\";\n      if (\"minLength\" in schema) result.minLength = schema.minLength;\n      if (\"maxLength\" in schema) result.maxLength = schema.maxLength;\n      if (\"pattern\" in schema) result.pattern = schema.pattern;\n      if (\"enum\" in schema) result.enum = schema.enum;\n    } else if (t.schema.isNumber(schema)) {\n      result.type = \"number\";\n      if (\"minimum\" in schema) result.minimum = schema.minimum;\n      if (\"maximum\" in schema) result.maximum = schema.maximum;\n    } else if (t.schema.isInteger(schema)) {\n      result.type = \"integer\";\n      if (\"minimum\" in schema) result.minimum = schema.minimum;\n      if (\"maximum\" in schema) result.maximum = schema.maximum;\n    } else if (t.schema.isBoolean(schema)) {\n      result.type = \"boolean\";\n    } else if (t.schema.isArray(schema)) {\n      result.type = \"array\";\n      if (\"items\" in schema) {\n        result.items = this.propertyToJsonSchema(schema.items as TSchema);\n      }\n    } else if (t.schema.isObject(schema)) {\n      Object.assign(result, this.schemaToJsonSchema(schema, { root: false }));\n    } else if (t.schema.isUnsafe(schema) || t.schema.isOptional(schema)) {\n      // Handle Unsafe types (like t.enum) and optional wrappers by checking the underlying type property\n      const schemaAny = schema as { type?: string; enum?: unknown[] };\n      if (schemaAny.type === \"string\") {\n        result.type = \"string\";\n        if (\"enum\" in schema) result.enum = schema.enum;\n        if (\"pattern\" in schema) result.pattern = schema.pattern;\n      } else if (schemaAny.type === \"number\") {\n        result.type = \"number\";\n      } else if (schemaAny.type === \"integer\") {\n        result.type = \"integer\";\n      } else if (schemaAny.type === \"boolean\") {\n        result.type = \"boolean\";\n      } else if (schemaAny.type === \"array\") {\n        result.type = \"array\";\n      } else if (schemaAny.type === \"object\") {\n        result.type = \"object\";\n      } else {\n        // Fallback\n        result.type = \"string\";\n      }\n    } else {\n      // Fallback for other types\n      result.type = \"string\";\n    }\n\n    return result;\n  }\n}\n\n$tool[KIND] = ToolPrimitive;\n","import { $atom, $inject, $state, t } from \"alepha\";\nimport { $logger } from \"alepha/logger\";\nimport { $route } from \"alepha/server\";\nimport {\n  createErrorResponse,\n  createParseError,\n  JsonRpcParseError,\n  parseMessage,\n} from \"../helpers/jsonrpc.ts\";\nimport type { McpContext } from \"../interfaces/McpTypes.ts\";\nimport { McpServerProvider } from \"../providers/McpServerProvider.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport const mcpStreamableHttpOptions = $atom({\n  name: \"alepha.mcp.streamableHttp.options\",\n  description: \"Configuration options for the MCP Streamable HTTP transport.\",\n  schema: t.object({\n    /**\n     * Path for the MCP endpoint. Single endpoint for both requests and\n     * (optional) server-streamed responses, per spec 2025-03-26+.\n     */\n    path: t.text({ default: \"/mcp\" }),\n    /**\n     * Allow-list of `Origin` header values accepted on incoming requests.\n     * Empty array (default) means \"allow any\". When set, browser-originated\n     * requests with a non-matching `Origin` are rejected with 403 Forbidden,\n     * blocking DNS-rebinding attacks against localhost MCP servers.\n     *\n     * Server-to-server callers (no `Origin` header) are always allowed.\n     *\n     * Spec 2025-11-25, PR #1439.\n     */\n    allowedOrigins: t.array(t.text(), { default: [] }),\n    /**\n     * When true, an unauthenticated POST to the MCP endpoint is rejected\n     * with `401 Unauthorized` and an RFC 9728 `WWW-Authenticate` challenge\n     * instead of being dispatched. MCP clients (Claude, etc.) rely on that\n     * challenge to discover the OAuth authorization server.\n     *\n     * The transport stays OAuth-agnostic: it only knows \"auth is required\".\n     * `$realm({ features: { oauth: true } })` flips this on automatically.\n     *\n     * @default false\n     */\n    requireAuth: t.boolean({ default: false }),\n    /**\n     * Path of the RFC 9728 protected-resource metadata document, advertised\n     * (as an absolute URL, resolved against the request origin) in the\n     * `WWW-Authenticate` challenge emitted when {@link requireAuth} rejects\n     * a request.\n     */\n    resourceMetadataPath: t.text({\n      default: \"/.well-known/oauth-protected-resource\",\n    }),\n  }),\n  default: {\n    path: \"/mcp\",\n    allowedOrigins: [],\n    requireAuth: false,\n    resourceMetadataPath: \"/.well-known/oauth-protected-resource\",\n  },\n});\n\n// Backward-compat alias for the legacy atom name. Prefer\n// `mcpStreamableHttpOptions` going forward; this re-export keeps existing\n// consumer imports compiling and will be removed once they migrate.\nexport const mcpSseOptions = mcpStreamableHttpOptions;\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * Streamable HTTP transport for MCP communication.\n *\n * Implements the 2025-03-26+ Streamable HTTP transport: a single `/mcp`\n * endpoint that accepts JSON-RPC over POST and returns either\n * `application/json` (single response, the default) or\n * `text/event-stream` (when the server wants to stream multiple messages).\n *\n * Designed for serverless deployment (Cloudflare Workers, etc.) — there is\n * no long-lived GET stream. GET on the endpoint returns 405 Method Not\n * Allowed; clients that want server-initiated push must rely on the POST\n * response stream when the server upgrades to SSE for that particular call.\n *\n * Spec compliance:\n * - 2025-06-18: validates `MCP-Protocol-Version` header on every request\n *   after `initialize` against the version negotiated and stored on\n *   `McpServerProvider`.\n * - 2025-11-25: rejects requests with a non-allow-listed `Origin` header\n *   (PR #1439). See {@link mcpStreamableHttpOptions.allowedOrigins}.\n *\n * @example\n * ```ts\n * import { Alepha, run } from \"alepha\";\n * import { AlephaServer } from \"alepha/server\";\n * import { AlephaMcp, StreamableHttpMcpTransport } from \"alepha/mcp\";\n *\n * class MyTools {\n *   // ... tool definitions\n * }\n *\n * run(\n *   Alepha.create()\n *     .with(AlephaServer)\n *     .with(AlephaMcp)\n *     .with(StreamableHttpMcpTransport)\n *     .with(MyTools)\n * );\n * ```\n */\nexport class StreamableHttpMcpTransport {\n  protected readonly log = $logger();\n  protected readonly options = $state(mcpStreamableHttpOptions);\n  protected readonly mcpServer = $inject(McpServerProvider);\n\n  /**\n   * GET on the MCP endpoint is not supported in this transport. Returning\n   * 405 (rather than serving the legacy two-endpoint SSE pattern) is the\n   * spec-allowed response for servers that don't offer server-initiated\n   * push outside of an active POST.\n   */\n  notAllowed = $route({\n    method: \"GET\",\n    path: this.options.path,\n    handler: (request) => {\n      request.reply.status = 405;\n      request.reply.headers.allow = \"POST\";\n      request.reply.headers[\"content-type\"] = \"application/json\";\n      request.reply.body = JSON.stringify({\n        error: \"Method Not Allowed. Use POST for MCP messages.\",\n      });\n    },\n  });\n\n  /**\n   * POST endpoint for client-to-server JSON-RPC messages.\n   * Returns `application/json` for single responses; tools that need to\n   * stream progress would upgrade to `text/event-stream` (deferred until a\n   * concrete need exists).\n   */\n  message = $route({\n    method: \"POST\",\n    path: this.options.path,\n    schema: {\n      body: t.json(),\n    },\n    handler: async (request) => {\n      try {\n        // Origin allow-list check (spec 2025-11-25 / PR #1439).\n        const originRaw = request.headers.origin;\n        const origin = Array.isArray(originRaw) ? originRaw[0] : originRaw;\n        if (\n          origin &&\n          this.options.allowedOrigins.length > 0 &&\n          !this.options.allowedOrigins.includes(origin)\n        ) {\n          this.log.warn(\"Rejected MCP request with non-allowed Origin\", {\n            origin,\n            allowed: this.options.allowedOrigins,\n          });\n          request.reply.status = 403;\n          request.reply.headers[\"content-type\"] = \"application/json\";\n          request.reply.body = JSON.stringify({\n            error: \"Forbidden: Origin not allowed\",\n          });\n          return;\n        }\n\n        // RFC 9728 / MCP auth (spec 2025-06-18+): when the endpoint is\n        // OAuth-protected, an unauthenticated request is rejected with 401\n        // and a `WWW-Authenticate` challenge pointing at the protected-\n        // resource metadata. MCP clients (Claude, etc.) follow that\n        // `resource_metadata` URL to discover the authorization server —\n        // without it, discovery never starts. The URL MUST be absolute.\n        if (this.options.requireAuth && !request.user) {\n          const url =\n            typeof request.url === \"string\"\n              ? new URL(request.url)\n              : request.url;\n          const resourceMetadataUrl = `${url.protocol}//${url.host}${this.options.resourceMetadataPath}`;\n          this.log.debug(\"Rejecting unauthenticated MCP request\", {\n            resourceMetadataUrl,\n          });\n          request.reply.status = 401;\n          request.reply.headers[\"www-authenticate\"] =\n            `Bearer resource_metadata=\"${resourceMetadataUrl}\"`;\n          request.reply.headers[\"content-type\"] = \"application/json\";\n          request.reply.body = JSON.stringify({\n            error: \"Unauthorized\",\n          });\n          return;\n        }\n\n        const body =\n          typeof request.body === \"string\"\n            ? request.body\n            : JSON.stringify(request.body);\n\n        this.log.debug(\"MCP request body\", {\n          body,\n          bodyType: typeof request.body,\n        });\n\n        const rpcRequest = parseMessage(body);\n\n        // Build context from request headers\n        const headers = { ...request.headers } as Record<\n          string,\n          string | string[] | undefined\n        >;\n\n        // Spec 2025-06-18+: every HTTP request after `initialize` MUST carry\n        // an `MCP-Protocol-Version` header matching the negotiated version.\n        // Reject mismatches with 400 so the client doesn't silently drift.\n        if (rpcRequest.method !== \"initialize\") {\n          const headerRaw = headers[\"mcp-protocol-version\"];\n          const headerVersion = Array.isArray(headerRaw)\n            ? headerRaw[0]\n            : headerRaw;\n          if (\n            headerVersion &&\n            headerVersion !== this.mcpServer.negotiatedVersion\n          ) {\n            this.log.warn(\"MCP-Protocol-Version header mismatch\", {\n              header: headerVersion,\n              negotiated: this.mcpServer.negotiatedVersion,\n            });\n            request.reply.status = 400;\n            request.reply.headers[\"content-type\"] = \"application/json\";\n            request.reply.body = JSON.stringify({\n              error: `MCP-Protocol-Version mismatch: expected ${this.mcpServer.negotiatedVersion}, got ${headerVersion}`,\n            });\n            return;\n          }\n        }\n\n        const context: McpContext = { headers };\n\n        const response = await this.mcpServer.handleMessage(\n          rpcRequest,\n          context,\n        );\n\n        if (response) {\n          request.reply.headers[\"content-type\"] = \"application/json\";\n          request.reply.body = JSON.stringify(response);\n        } else {\n          request.reply.status = 204;\n        }\n      } catch (error) {\n        if (error instanceof JsonRpcParseError) {\n          request.reply.status = 400;\n          request.reply.headers[\"content-type\"] = \"application/json\";\n          request.reply.body = JSON.stringify(\n            createErrorResponse(0, createParseError(error.message)),\n          );\n        } else {\n          this.log.error(\"Failed to process MCP message\", error);\n          request.reply.status = 500;\n          request.reply.body = JSON.stringify({\n            error: (error as Error).message,\n          });\n        }\n      }\n    },\n  });\n}\n\n/**\n * @deprecated Use {@link StreamableHttpMcpTransport}. The 2024-11-05\n * two-endpoint HTTP+SSE pattern was replaced by Streamable HTTP in spec\n * 2025-03-26. This alias is preserved for one release to ease migration.\n */\nexport const SseMcpTransport = StreamableHttpMcpTransport;\n","import { $module } from \"alepha\";\nimport { $prompt } from \"./primitives/$prompt.ts\";\nimport { $resource } from \"./primitives/$resource.ts\";\nimport { $tool } from \"./primitives/$tool.ts\";\nimport { McpServerProvider } from \"./providers/McpServerProvider.ts\";\nimport { StreamableHttpMcpTransport } from \"./transports/StreamableHttpMcpTransport.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport {\n  McpError,\n  McpErrorCodes,\n  McpForbiddenError,\n  McpInvalidParamsError,\n  McpMethodNotFoundError,\n  McpPromptNotFoundError,\n  McpResourceNotFoundError,\n  McpToolNotFoundError,\n  McpUnauthorizedError,\n} from \"./errors/McpError.ts\";\nexport {\n  createErrorResponse,\n  createInternalError,\n  createInvalidParamsError,\n  createInvalidRequestError,\n  createMethodNotFoundError,\n  createNotification,\n  createParseError,\n  createResponse,\n  isNotification,\n  isSupportedProtocolVersion,\n  isValidJsonRpcRequest,\n  JSONRPC_VERSION,\n  JsonRpcErrorCodes,\n  JsonRpcParseError,\n  MCP_PROTOCOL_VERSION,\n  parseMessage,\n  SUPPORTED_PROTOCOL_VERSIONS,\n  type SupportedProtocolVersion,\n} from \"./helpers/jsonrpc.ts\";\nexport type {\n  JsonRpcError,\n  JsonRpcNotification,\n  // JSON-RPC types\n  JsonRpcRequest,\n  JsonRpcResponse,\n  // MCP protocol types\n  McpCapabilities,\n  McpClientInfo,\n  McpContent,\n  // Context type for auth/headers\n  McpContext,\n  McpInitializeParams,\n  McpInitializeResult,\n  McpJsonSchema,\n  McpPromptArgument,\n  McpPromptContent,\n  // Prompt types\n  McpPromptDescriptor,\n  McpPromptGetParams,\n  McpPromptGetResult,\n  McpPromptMessage,\n  McpResourceContent,\n  // Resource types\n  McpResourceDescriptor,\n  McpResourceReadParams,\n  McpResourceReadResult,\n  McpServerInfo,\n  McpToolCallParams,\n  McpToolCallResult,\n  // Tool types\n  McpToolDescriptor,\n  PromptHandler,\n  PromptHandlerArgs,\n  PromptMessage,\n  ResourceContent,\n  ResourceHandler,\n  ResourceHandlerArgs,\n  ToolHandler,\n  ToolHandlerArgs,\n  ToolHandlerResult,\n  // Handler types\n  ToolPrimitiveSchema,\n} from \"./interfaces/McpTypes.ts\";\nexport type { PromptPrimitiveOptions } from \"./primitives/$prompt.ts\";\nexport { $prompt, PromptPrimitive } from \"./primitives/$prompt.ts\";\nexport type { ResourcePrimitiveOptions } from \"./primitives/$resource.ts\";\nexport { $resource, ResourcePrimitive } from \"./primitives/$resource.ts\";\nexport type { ToolPrimitiveOptions } from \"./primitives/$tool.ts\";\nexport { $tool, ToolPrimitive } from \"./primitives/$tool.ts\";\nexport { McpServerProvider } from \"./providers/McpServerProvider.ts\";\nexport {\n  mcpSseOptions,\n  mcpStreamableHttpOptions,\n  SseMcpTransport,\n  StreamableHttpMcpTransport,\n} from \"./transports/StreamableHttpMcpTransport.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * Model Context Protocol for AI tool integration.\n *\n * **Features:**\n * - MCP resource definitions\n * - MCP tool definitions\n * - MCP prompt definitions\n * - JSON-RPC protocol\n * - Streamable HTTP transport (spec 2025-03-26+)\n *\n * @module alepha.mcp\n */\nexport const AlephaMcp = $module({\n  name: \"alepha.mcp\",\n  primitives: [$tool, $resource, $prompt],\n  services: [McpServerProvider],\n  // Transports are opt-in — user wires the one(s) they need via alepha.with(StreamableHttpMcpTransport).\n  variants: [StreamableHttpMcpTransport],\n});\n"],"mappings":";;;;AAYA,MAAa,kBAAkB;;;;;AAM/B,MAAa,uBAAuB;;;;;;AAOpC,MAAa,8BAA8B;CACzC;CACA;CACA;CACA;AACF;AAKA,MAAa,8BACX,MAEA,OAAO,MAAM,YACZ,4BAAkD,SAAS,CAAC;AAE/D,MAAa,oBAAoB;CAC/B,aAAa;CACb,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,gBAAgB;AAClB;AAMA,SAAgB,eACd,IACA,QACiB;CACjB,OAAO;EACL,SAAA;EACA;EACA;CACF;AACF;AAEA,SAAgB,oBACd,IACA,OACiB;CACjB,OAAO;EACL,SAAA;EACA;EACA;CACF;AACF;AAEA,SAAgB,mBACd,QACA,QACqB;CACrB,OAAO;EACL,SAAA;EACA;EACA;CACF;AACF;AAMA,SAAgB,iBAAiB,UAAU,eAA6B;CACtE,OAAO;EACL,MAAM,kBAAkB;EACxB;CACF;AACF;AAEA,SAAgB,0BACd,UAAU,mBACI;CACd,OAAO;EACL,MAAM,kBAAkB;EACxB;CACF;AACF;AAEA,SAAgB,0BAA0B,QAA8B;CACtE,OAAO;EACL,MAAM,kBAAkB;EACxB,SAAS,qBAAqB;CAChC;AACF;AAEA,SAAgB,yBAAyB,SAA+B;CACtE,OAAO;EACL,MAAM,kBAAkB;EACxB;CACF;AACF;AAEA,SAAgB,oBAAoB,SAA+B;CACjE,OAAO;EACL,MAAM,kBAAkB;EACxB;CACF;AACF;AAMA,SAAgB,aAAa,MAA8B;CACzD,IAAI;CAEJ,IAAI;EACF,SAAS,KAAK,MAAM,IAAI;CAC1B,QAAQ;EACN,MAAM,IAAI,kBAAkB,cAAc;CAC5C;CAEA,IAAI,CAAC,sBAAsB,MAAM,GAC/B,MAAM,IAAI,kBAAkB,0BAA0B;CAGxD,OAAO;AACT;AAEA,SAAgB,sBAAsB,OAAyC;CAC7E,IAAI,OAAO,UAAU,YAAY,UAAU,MACzC,OAAO;CAGT,MAAM,MAAM;CAEZ,IAAI,IAAI,YAAA,OACN,OAAO;CAGT,IAAI,OAAO,IAAI,WAAW,UACxB,OAAO;CAGT,IACE,IAAI,OAAO,KAAA,KACX,OAAO,IAAI,OAAO,YAClB,OAAO,IAAI,OAAO,UAElB,OAAO;CAGT,IAAI,IAAI,WAAW,KAAA,KAAa,OAAO,IAAI,WAAW,UACpD,OAAO;CAGT,OAAO;AACT;AAEA,SAAgB,eAAe,SAAkC;CAC/D,OAAO,QAAQ,OAAO,KAAA;AACxB;AAMA,IAAa,oBAAb,cAAuC,YAAY;CACjD,OAAO;AACT;;;;;;ACpLA,MAAa,gBAAgB;CAC3B,cAAc;CACd,WAAW;AACb;AAIA,IAAa,WAAb,cAA8B,MAAM;CAClC,OAAO;CACP;CAEA,YACE,SACA,OAAe,kBAAkB,gBACjC;EACA,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;AAIA,IAAa,yBAAb,cAA4C,SAAS;CACnD,OAAO;CAEP,YAAY,QAAgB;EAC1B,MAAM,qBAAqB,UAAU,kBAAkB,gBAAgB;CACzE;AACF;AAIA,IAAa,uBAAb,cAA0C,SAAS;CACjD,OAAO;CACP;CAEA,YAAY,MAAc;EACxB,MAAM,mBAAmB,QAAQ,kBAAkB,gBAAgB;EACnE,KAAK,OAAO;CACd;AACF;AAIA,IAAa,2BAAb,cAA8C,SAAS;CACrD,OAAO;CACP;CAEA,YAAY,KAAa;EACvB,MAAM,uBAAuB,OAAO,kBAAkB,gBAAgB;EACtE,KAAK,MAAM;CACb;AACF;AAIA,IAAa,yBAAb,cAA4C,SAAS;CACnD,OAAO;CACP;CAEA,YAAY,QAAgB;EAC1B,MAAM,qBAAqB,UAAU,kBAAkB,gBAAgB;EACvE,KAAK,SAAS;CAChB;AACF;AAIA,IAAa,wBAAb,cAA2C,SAAS;CAClD,OAAO;CAEP,YAAY,SAAiB;EAC3B,MAAM,SAAS,kBAAkB,cAAc;CACjD;AACF;AAIA,IAAa,uBAAb,cAA0C,SAAS;CACjD,OAAO;CAEP,YAAY,UAAU,gBAAgB;EACpC,MAAM,SAAS,cAAc,YAAY;CAC3C;AACF;AAIA,IAAa,oBAAb,cAAuC,SAAS;CAC9C,OAAO;CAEP,YAAY,UAAU,aAAa;EACjC,MAAM,SAAS,cAAc,SAAS;CACxC;AACF;;;;;;;;;;;;ACpDA,IAAa,oBAAb,MAA+B;CAC7B,MAAyB,QAAQ;CACjC,SAA4B,QAAQ,MAAM;CAE1C,wBAA2B,IAAI,IAAgC;CAC/D,4BAA+B,IAAI,IAA+B;CAClE,0BAA6B,IAAI,IAAkC;CAEnE,cAAwB;;;;;;CAOxB,oBAAmC;;;;;;;CAQnC,aAAmC;EACjC,MAAM;EACN,SAAS;CACX;;;;CASA,aAAoB,MAAgC;EAClD,KAAK,IAAI,MAAM,yBAAyB,KAAK,MAAM;EACnD,KAAK,MAAM,IAAI,KAAK,MAAM,IAAI;CAChC;;;;CAKA,iBAAwB,UAAmC;EACzD,KAAK,IAAI,MAAM,6BAA6B,SAAS,KAAK;EAC1D,KAAK,UAAU,IAAI,SAAS,KAAK,QAAQ;CAC3C;;;;CAKA,eAAsB,QAAoC;EACxD,KAAK,IAAI,MAAM,2BAA2B,OAAO,MAAM;EACvD,KAAK,QAAQ,IAAI,OAAO,MAAM,MAAM;CACtC;;;;CASA,kBAA0C;EACxC,OAAO;GACL,OAAO,KAAK,MAAM,OAAO,IAAI,CAAC,IAAI,KAAA;GAClC,WAAW,KAAK,UAAU,OAAO,IAAI,CAAC,IAAI,KAAA;GAC1C,SAAS,KAAK,QAAQ,OAAO,IAAI,CAAC,IAAI,KAAA;EACxC;CACF;;;;CAKA,WAAwC;EACtC,OAAO,MAAM,KAAK,KAAK,MAAM,OAAO,CAAC;CACvC;;;;CAKA,eAA2C;EACzC,OAAO,MAAM,KAAK,KAAK,UAAU,OAAO,CAAC;CAC3C;;;;CAKA,aAA4C;EAC1C,OAAO,MAAM,KAAK,KAAK,QAAQ,OAAO,CAAC;CACzC;;;;CAKA,QAAe,MAA8C;EAC3D,OAAO,KAAK,MAAM,IAAI,IAAI;CAC5B;;;;CAKA,YAAmB,KAA4C;EAC7D,OAAO,KAAK,UAAU,IAAI,GAAG;CAC/B;;;;CAKA,UAAiB,MAAgD;EAC/D,OAAO,KAAK,QAAQ,IAAI,IAAI;CAC9B;;;;;;;;CAaA,MAAa,cACX,SACA,SACiC;EACjC,MAAM,KAAK,QAAQ;EAGnB,IAAI,OAAO,KAAA,GAAW;GACpB,MAAM,KAAK,mBAAmB,OAAO;GACrC,OAAO;EACT;EAEA,IAAI;GAEF,OAAO,eAAe,IAAI,MADL,KAAK,cAAc,SAAS,OAAO,CACxB;EAClC,SAAS,OAAO;GACd,KAAK,IAAI,MAAM,sBAAsB,KAAK;GAE1C,IAAI,iBAAiB,UACnB,OAAO,oBAAoB,IAAI;IAC7B,MAAM,MAAM;IACZ,SAAS,MAAM;GACjB,CAAC;GAEH,OAAO,oBACL,IACA,oBAAqB,MAAgB,OAAO,CAC9C;EACF;CACF;;;;CAKA,MAAgB,cACd,SACA,SACkB;EAClB,MAAM,EAAE,QAAQ,SAAS,CAAC,MAAM;EAEhC,QAAQ,QAAR;GACE,KAAK,cACH,OAAO,KAAK,iBAAiB,MAAM;GACrC,KAAK,QACH,OAAO,KAAK,WAAW;GACzB,KAAK,cACH,OAAO,KAAK,gBAAgB;GAC9B,KAAK,cACH,OAAO,KAAK,gBAAgB,QAAQ,OAAO;GAC7C,KAAK,kBACH,OAAO,KAAK,oBAAoB;GAClC,KAAK,kBACH,OAAO,KAAK,oBAAoB,QAAQ,OAAO;GACjD,KAAK,gBACH,OAAO,KAAK,kBAAkB;GAChC,KAAK,eACH,OAAO,KAAK,iBAAiB,QAAQ,OAAO;GAC9C,SACE,MAAM,IAAI,uBAAuB,MAAM;EAC3C;CACF;;;;CAKA,MAAgB,mBAAmB,SAAwC;EACzE,MAAM,EAAE,WAAW;EAEnB,QAAQ,QAAR;GACE,KAAK;IACH,KAAK,IAAI,MAAM,wBAAwB;IACvC;GACF,KAAK;IACH,KAAK,IAAI,MAAM,yBAAyB,QAAQ,MAAM;IACtD;GACF,SACE,KAAK,IAAI,MAAM,6BAA6B,QAAQ;EACxD;CACF;CAMA,iBACE,QACqB;EACrB,MAAM,YAAY,OAAO;EAIzB,MAAM,aAAa,2BAA2B,SAAS,IACnD,YACA,4BAA4B;EAEhC,KAAK,IAAI,KAAK,2BAA2B;GACvC,YAAY,OAAO;GACnB,0BAA0B;GAC1B,2BAA2B;EAC7B,CAAC;EAED,KAAK,cAAc;EACnB,KAAK,oBAAoB;EAEzB,OAAO;GACL,iBAAiB;GACjB,cAAc,KAAK,gBAAgB;GACnC,YAAY,KAAK;EACnB;CACF;CAEA,aAA8C;EAC5C,OAAO,CAAC;CACV;CAEA,kBAA4D;EAC1D,OAAO,EACL,OAAO,MAAM,KAAK,KAAK,MAAM,OAAO,CAAC,EAAE,KAAK,MAAM,EAAE,aAAa,CAAC,EACpE;CACF;CAEA,MAAgB,gBACd,QACA,SAC4B;EAC5B,MAAM,OAAO,OAAO;EACpB,MAAM,OAAQ,OAAO,aAAa,CAAC;EAEnC,MAAM,OAAO,KAAK,MAAM,IAAI,IAAI;EAChC,IAAI,CAAC,MAIH,MAAM,IAAI,qBAAqB,IAAI;EAGrC,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,QAAQ,MAAM,OAAO;GAS/C,IAAI,CAAC,KAAK,gBAAgB,GAAG;IAC3B,MAAM,MAAM,KAAK,iBAAiB,MAAM;IACxC,IAAI,KACF,OAAO;GAEX;GAEA,MAAM,aAAgC,EACpC,SAAS,CACP;IACE,MAAM;IACN,MACE,OAAO,WAAW,WACd,SACA,KAAK,UAAU,UAAU,IAAI;GACrC,CACF,EACF;GAKA,IAAI,KAAK,gBAAgB,KAAK,WAAW,KAAA,GACvC,WAAW,oBAAoB;GAGjC,OAAO;EACT,SAAS,OAAO;GAMd,IAAI,iBAAiB,cAAc;IACjC,MAAM,OAAO,MAAM,OAAO,QAAQ;IAClC,MAAM,UAAU,MAAM,OAAO,WAAW,MAAM;IAC9C,OAAO;KACL,SAAS,CACP;MACE,MAAM;MACN,MAAM,uBAAuB,KAAK,IAAI;KACxC,CACF;KACA,mBAAmB,EACjB,QAAQ,CAAC;MAAE;MAAM;KAAQ,CAAC,EAC5B;KACA,SAAS;IACX;GACF;GAEA,OAAO;IACL,SAAS,CACP;KACE,MAAM;KACN,MAAM,UAAW,MAAgB;IACnC,CACF;IACA,SAAS;GACX;EACF;CACF;;;;;;;;;CAUA,iBAA2B,QAAgD;EACzE,IAAI,CAAC,UAAU,OAAO,WAAW,UAC/B;EAEF,MAAM,YAAY;EAKlB,IAAI,CAAC,MAAM,QAAQ,UAAU,OAAO,KAAK,UAAU,QAAQ,WAAW,GACpE;EAQF,IAAI,CANc,UAAU,QAAQ,OACjC,UACC,CAAC,CAAC,SACF,OAAO,UAAU,YACjB,OAAQ,MAA6B,SAAS,QAErC,GACX;EAEF,OAAO;GACL,SAAS,UAAU;GACnB,SACE,OAAO,UAAU,YAAY,YAAY,UAAU,UAAU,KAAA;GAC/D,OACE,UAAU,SAAS,OAAO,UAAU,UAAU,WACzC,UAAU,QACX,KAAA;EACR;CACF;CAEA,sBAAwE;EACtE,OAAO,EACL,WAAW,MAAM,KAAK,KAAK,UAAU,OAAO,CAAC,EAAE,KAAK,MAClD,EAAE,aAAa,CACjB,EACF;CACF;CAEA,MAAgB,oBACd,QACA,SACgC;EAChC,MAAM,MAAM,OAAO;EAEnB,MAAM,WAAW,KAAK,UAAU,IAAI,GAAG;EACvC,IAAI,CAAC,UACH,MAAM,IAAI,yBAAyB,GAAG;EAGxC,MAAM,UAAU,MAAM,SAAS,KAAK,OAAO;EAE3C,MAAM,kBAAsC;GAC1C;GACA,UAAU,SAAS;EACrB;EAEA,IAAI,QAAQ,SAAS,KAAA,GACnB,gBAAgB,OAAO,QAAQ;EAGjC,IAAI,QAAQ,SAAS,KAAA,GAEnB,gBAAgB,OAAO,OAAO,KAAK,QAAQ,IAAI,EAAE,SAAS,QAAQ;EAGpE,OAAO,EACL,UAAU,CAAC,eAAe,EAC5B;CACF;CAEA,oBAAkE;EAChE,OAAO,EACL,SAAS,MAAM,KAAK,KAAK,QAAQ,OAAO,CAAC,EAAE,KAAK,MAAM,EAAE,aAAa,CAAC,EACxE;CACF;CAEA,MAAgB,iBACd,QACA,SAC6B;EAC7B,MAAM,OAAO,OAAO;EACpB,MAAM,OAAQ,OAAO,aAAa,CAAC;EAEnC,MAAM,SAAS,KAAK,QAAQ,IAAI,IAAI;EACpC,IAAI,CAAC,QACH,MAAM,IAAI,uBAAuB,IAAI;EAKvC,MAAM,eAAkC,MAFjB,OAAO,IAAI,MAAM,OAAO,GAEE,KAAK,SAAS;GAC7D,MAAM,IAAI;GACV,SAAS;IACP,MAAM;IACN,MAAM,IAAI;GACZ;EACF,EAAE;EAEF,OAAO;GACL,aAAa,OAAO;GACpB,UAAU;EACZ;CACF;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC9aA,MAAa,WACX,YACuB;CACvB,OAAO,gBAAgB,iBAAoB,OAAO;AACpD;AAwDA,IAAa,kBAAb,cAAwD,UAEtD;CACA,YAA+B,QAAQ,iBAAiB;;;;CAKxD,IAAW,OAAe;EACxB,OAAO,KAAK,QAAQ,QAAQ,KAAK,OAAO;CAC1C;;;;CAKA,IAAW,cAAkC;EAC3C,OAAO,KAAK,QAAQ;CACtB;CAEA,SAAyB;EACvB,KAAK,UAAU,eAAe,IAAI;CACpC;;;;;;;;CASA,MAAa,IACX,SACA,SAC0B;EAC1B,IAAI,OAAQ,WAAW,CAAC;EAExB,IAAI,KAAK,QAAQ,MACf,OAAO,KAAK,OAAO,MAAM,OAAO,KAAK,QAAQ,MAAM,WAAW,CAAC,CAAC;EAGlE,OAAO,KAAK,QAAQ,QAAQ;GAAE;GAAM;EAAQ,CAAC;CAC/C;;;;CAKA,eAA2C;EACzC,MAAM,aAAkC;GACtC,MAAM,KAAK;GACX,aAAa,KAAK;GAClB,WAAW,KAAK,QAAQ,OACpB,KAAK,kBAAkB,KAAK,QAAQ,IAAI,IACxC,CAAC;EACP;EACA,IAAI,KAAK,QAAQ,OAAO,WAAW,QAAQ,KAAK,QAAQ;EACxD,IAAI,KAAK,QAAQ,SAAS,KAAK,QAAQ,MAAM,SAAS,GACpD,WAAW,QAAQ,KAAK,QAAQ;EAElC,OAAO;CACT;;;;CAKA,kBAA4B,QAAsC;EAChE,MAAM,OAA4B,CAAC;EAEnC,KAAK,MAAM,CAAC,MAAM,eAAe,OAAO,QAAQ,OAAO,UAAU,GAAG;GAClE,MAAM,OAAO;GACb,KAAK,KAAK;IACR;IACA,aAAa,KAAK;IAClB,UAAU,CAAC,EAAE,OAAO,WAAW,UAAU;GAC3C,CAAC;EACH;EAEA,OAAO;CACT;AACF;AAEA,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC7JhB,MAAa,aACX,YACsB;CACtB,OAAO,gBAAgB,mBAAmB,OAAO;AACnD;AAyEA,IAAa,oBAAb,cAAuC,UAAoC;CACzE,YAA+B,QAAQ,iBAAiB;;;;CAKxD,IAAW,OAAe;EACxB,OAAO,KAAK,QAAQ,QAAQ,KAAK,OAAO;CAC1C;;;;CAKA,IAAW,MAAc;EACvB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,IAAW,cAAkC;EAC3C,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,IAAW,WAAmB;EAC5B,OAAO,KAAK,QAAQ,YAAY;CAClC;CAEA,SAAyB;EACvB,KAAK,UAAU,iBAAiB,IAAI;CACtC;;;;;;;CAQA,MAAa,KAAK,SAAgD;EAChE,OAAO,KAAK,QAAQ,QAAQ,EAAE,QAAQ,CAAC;CACzC;;;;CAKA,eAA6C;EAC3C,MAAM,aAAoC;GACxC,KAAK,KAAK;GACV,MAAM,KAAK;GACX,aAAa,KAAK;GAClB,UAAU,KAAK;EACjB;EACA,IAAI,KAAK,QAAQ,OAAO,WAAW,QAAQ,KAAK,QAAQ;EACxD,IAAI,KAAK,QAAQ,SAAS,KAAK,QAAQ,MAAM,SAAS,GACpD,WAAW,QAAQ,KAAK,QAAQ;EAElC,OAAO;CACT;AACF;AAEA,UAAU,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACvHlB,MAAa,SACX,YACqB;CACrB,OAAO,gBAAgB,eAAkB,OAAO;AAClD;AA2EA,IAAa,gBAAb,cAAkE,UAEhE;CACA,YAA+B,QAAQ,iBAAiB;;;;CAKxD,IAAW,OAAe;EACxB,OAAO,KAAK,QAAQ,QAAQ,KAAK,OAAO;CAC1C;;;;CAKA,IAAW,cAAsB;EAC/B,OAAO,KAAK,QAAQ;CACtB;;;;;;CAOA,kBAAkC;EAChC,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ;CAChC;CAEA,SAAyB;EACvB,KAAK,UAAU,aAAa,IAAI;CAClC;;;;;;;;CASA,MAAa,QACX,QACA,SAC+B;EAC/B,IAAI,kBAAuB,UAAU,CAAC;EAGtC,IAAI,KAAK,QAAQ,QAAQ,QACvB,kBAAkB,KAAK,OAAO,MAAM,OAClC,KAAK,QAAQ,OAAO,QACpB,eACF;EAGF,MAAM,SAAS,MAAM,KAAK,QAAQ,QAAQ;GACxC,QAAQ;GACR;EACF,CAAC;EAGD,IAAI,KAAK,QAAQ,QAAQ,UAAU,WAAW,KAAA,GAC5C,OAAO,KAAK,OAAO,MAAM,OACvB,KAAK,QAAQ,OAAO,QACpB,MACF;EAGF,OAAO;CACT;;;;;;;;CASA,eAAyC;EACvC,MAAM,cAA6B,KAAK,QAAQ,QAAQ,SACpD,KAAK,mBAAmB,KAAK,QAAQ,OAAO,MAAM,IAClD;GAAE,MAAM;GAAU,YAAY,CAAC;GAAG,UAAU,CAAC;EAAE;EAEnD,MAAM,aAAgC;GACpC,MAAM,KAAK;GACX,aAAa,KAAK;GAClB;EACF;EAEA,IAAI,KAAK,QAAQ,OAAO,WAAW,QAAQ,KAAK,QAAQ;EACxD,IAAI,KAAK,QAAQ,aACf,WAAW,cAAc,KAAK,QAAQ;EACxC,IAAI,KAAK,QAAQ,SAAS,KAAK,QAAQ,MAAM,SAAS,GACpD,WAAW,QAAQ,KAAK,QAAQ;EAKlC,IAAI,KAAK,QAAQ,QAAQ,QAAQ;GAC/B,MAAM,MAAM,KAAK,qBAAqB,KAAK,QAAQ,OAAO,MAAM;GAGhE,WAAW,eACT,OAAO,QAAQ,YAAY,QAAQ,QAAQ,UAAU,MACjD,MACA;IAAE,MAAM;IAAU,YAAY,CAAC;IAAG,UAAU,CAAC;GAAE;EAEvD;EAEA,OAAO;CACT;;;;;;;;;CAUA,mBACE,QACA,SACe;EACf,MAAM,aAAsC,CAAC;EAC7C,MAAM,WAAqB,CAAC;EAE5B,KAAK,MAAM,CAAC,KAAK,eAAe,OAAO,QAAQ,OAAO,UAAU,GAAG;GACjE,WAAW,OAAO,KAAK,qBAAqB,UAAqB;GAGjE,IAAI,CAAC,EAAE,OAAO,WAAW,UAAqB,GAC5C,SAAS,KAAK,GAAG;EAErB;EAEA,MAAM,SAAwB;GAC5B,MAAM;GACN;GACA;EACF;EAIA,IAAI,SAAS,SAAS,OACpB,OAAO,UAAU;EAGnB,OAAO;CACT;;;;CAKA,qBAA+B,QAA0C;EACvE,MAAM,SAAkC,CAAC;EAGzC,IAAI,iBAAiB,QACnB,OAAO,cAAc,OAAO;EAG9B,IAAI,EAAE,OAAO,SAAS,MAAM,GAAG;GAC7B,OAAO,OAAO;GACd,IAAI,eAAe,QAAQ,OAAO,YAAY,OAAO;GACrD,IAAI,eAAe,QAAQ,OAAO,YAAY,OAAO;GACrD,IAAI,aAAa,QAAQ,OAAO,UAAU,OAAO;GACjD,IAAI,UAAU,QAAQ,OAAO,OAAO,OAAO;EAC7C,OAAO,IAAI,EAAE,OAAO,SAAS,MAAM,GAAG;GACpC,OAAO,OAAO;GACd,IAAI,aAAa,QAAQ,OAAO,UAAU,OAAO;GACjD,IAAI,aAAa,QAAQ,OAAO,UAAU,OAAO;EACnD,OAAO,IAAI,EAAE,OAAO,UAAU,MAAM,GAAG;GACrC,OAAO,OAAO;GACd,IAAI,aAAa,QAAQ,OAAO,UAAU,OAAO;GACjD,IAAI,aAAa,QAAQ,OAAO,UAAU,OAAO;EACnD,OAAO,IAAI,EAAE,OAAO,UAAU,MAAM,GAClC,OAAO,OAAO;OACT,IAAI,EAAE,OAAO,QAAQ,MAAM,GAAG;GACnC,OAAO,OAAO;GACd,IAAI,WAAW,QACb,OAAO,QAAQ,KAAK,qBAAqB,OAAO,KAAgB;EAEpE,OAAO,IAAI,EAAE,OAAO,SAAS,MAAM,GACjC,OAAO,OAAO,QAAQ,KAAK,mBAAmB,QAAQ,EAAE,MAAM,MAAM,CAAC,CAAC;OACjE,IAAI,EAAE,OAAO,SAAS,MAAM,KAAK,EAAE,OAAO,WAAW,MAAM,GAAG;GAEnE,MAAM,YAAY;GAClB,IAAI,UAAU,SAAS,UAAU;IAC/B,OAAO,OAAO;IACd,IAAI,UAAU,QAAQ,OAAO,OAAO,OAAO;IAC3C,IAAI,aAAa,QAAQ,OAAO,UAAU,OAAO;GACnD,OAAO,IAAI,UAAU,SAAS,UAC5B,OAAO,OAAO;QACT,IAAI,UAAU,SAAS,WAC5B,OAAO,OAAO;QACT,IAAI,UAAU,SAAS,WAC5B,OAAO,OAAO;QACT,IAAI,UAAU,SAAS,SAC5B,OAAO,OAAO;QACT,IAAI,UAAU,SAAS,UAC5B,OAAO,OAAO;QAGd,OAAO,OAAO;EAElB,OAEE,OAAO,OAAO;EAGhB,OAAO;CACT;AACF;AAEA,MAAM,QAAQ;;;AC1Vd,MAAa,2BAA2B,MAAM;CAC5C,MAAM;CACN,aAAa;CACb,QAAQ,EAAE,OAAO;;;;;EAKf,MAAM,EAAE,KAAK,EAAE,SAAS,OAAO,CAAC;;;;;;;;;;;EAWhC,gBAAgB,EAAE,MAAM,EAAE,KAAK,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;;;;;;;;;;;;EAYjD,aAAa,EAAE,QAAQ,EAAE,SAAS,MAAM,CAAC;;;;;;;EAOzC,sBAAsB,EAAE,KAAK,EAC3B,SAAS,wCACX,CAAC;CACH,CAAC;CACD,SAAS;EACP,MAAM;EACN,gBAAgB,CAAC;EACjB,aAAa;EACb,sBAAsB;CACxB;AACF,CAAC;AAKD,MAAa,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2C7B,IAAa,6BAAb,MAAwC;CACtC,MAAyB,QAAQ;CACjC,UAA6B,OAAO,wBAAwB;CAC5D,YAA+B,QAAQ,iBAAiB;;;;;;;CAQxD,aAAa,OAAO;EAClB,QAAQ;EACR,MAAM,KAAK,QAAQ;EACnB,UAAU,YAAY;GACpB,QAAQ,MAAM,SAAS;GACvB,QAAQ,MAAM,QAAQ,QAAQ;GAC9B,QAAQ,MAAM,QAAQ,kBAAkB;GACxC,QAAQ,MAAM,OAAO,KAAK,UAAU,EAClC,OAAO,iDACT,CAAC;EACH;CACF,CAAC;;;;;;;CAQD,UAAU,OAAO;EACf,QAAQ;EACR,MAAM,KAAK,QAAQ;EACnB,QAAQ,EACN,MAAM,EAAE,KAAK,EACf;EACA,SAAS,OAAO,YAAY;GAC1B,IAAI;IAEF,MAAM,YAAY,QAAQ,QAAQ;IAClC,MAAM,SAAS,MAAM,QAAQ,SAAS,IAAI,UAAU,KAAK;IACzD,IACE,UACA,KAAK,QAAQ,eAAe,SAAS,KACrC,CAAC,KAAK,QAAQ,eAAe,SAAS,MAAM,GAC5C;KACA,KAAK,IAAI,KAAK,gDAAgD;MAC5D;MACA,SAAS,KAAK,QAAQ;KACxB,CAAC;KACD,QAAQ,MAAM,SAAS;KACvB,QAAQ,MAAM,QAAQ,kBAAkB;KACxC,QAAQ,MAAM,OAAO,KAAK,UAAU,EAClC,OAAO,gCACT,CAAC;KACD;IACF;IAQA,IAAI,KAAK,QAAQ,eAAe,CAAC,QAAQ,MAAM;KAC7C,MAAM,MACJ,OAAO,QAAQ,QAAQ,WACnB,IAAI,IAAI,QAAQ,GAAG,IACnB,QAAQ;KACd,MAAM,sBAAsB,GAAG,IAAI,SAAS,IAAI,IAAI,OAAO,KAAK,QAAQ;KACxE,KAAK,IAAI,MAAM,yCAAyC,EACtD,oBACF,CAAC;KACD,QAAQ,MAAM,SAAS;KACvB,QAAQ,MAAM,QAAQ,sBACpB,6BAA6B,oBAAoB;KACnD,QAAQ,MAAM,QAAQ,kBAAkB;KACxC,QAAQ,MAAM,OAAO,KAAK,UAAU,EAClC,OAAO,eACT,CAAC;KACD;IACF;IAEA,MAAM,OACJ,OAAO,QAAQ,SAAS,WACpB,QAAQ,OACR,KAAK,UAAU,QAAQ,IAAI;IAEjC,KAAK,IAAI,MAAM,oBAAoB;KACjC;KACA,UAAU,OAAO,QAAQ;IAC3B,CAAC;IAED,MAAM,aAAa,aAAa,IAAI;IAGpC,MAAM,UAAU,EAAE,GAAG,QAAQ,QAAQ;IAQrC,IAAI,WAAW,WAAW,cAAc;KACtC,MAAM,YAAY,QAAQ;KAC1B,MAAM,gBAAgB,MAAM,QAAQ,SAAS,IACzC,UAAU,KACV;KACJ,IACE,iBACA,kBAAkB,KAAK,UAAU,mBACjC;MACA,KAAK,IAAI,KAAK,wCAAwC;OACpD,QAAQ;OACR,YAAY,KAAK,UAAU;MAC7B,CAAC;MACD,QAAQ,MAAM,SAAS;MACvB,QAAQ,MAAM,QAAQ,kBAAkB;MACxC,QAAQ,MAAM,OAAO,KAAK,UAAU,EAClC,OAAO,2CAA2C,KAAK,UAAU,kBAAkB,QAAQ,gBAC7F,CAAC;MACD;KACF;IACF;IAEA,MAAM,UAAsB,EAAE,QAAQ;IAEtC,MAAM,WAAW,MAAM,KAAK,UAAU,cACpC,YACA,OACF;IAEA,IAAI,UAAU;KACZ,QAAQ,MAAM,QAAQ,kBAAkB;KACxC,QAAQ,MAAM,OAAO,KAAK,UAAU,QAAQ;IAC9C,OACE,QAAQ,MAAM,SAAS;GAE3B,SAAS,OAAO;IACd,IAAI,iBAAiB,mBAAmB;KACtC,QAAQ,MAAM,SAAS;KACvB,QAAQ,MAAM,QAAQ,kBAAkB;KACxC,QAAQ,MAAM,OAAO,KAAK,UACxB,oBAAoB,GAAG,iBAAiB,MAAM,OAAO,CAAC,CACxD;IACF,OAAO;KACL,KAAK,IAAI,MAAM,iCAAiC,KAAK;KACrD,QAAQ,MAAM,SAAS;KACvB,QAAQ,MAAM,OAAO,KAAK,UAAU,EAClC,OAAQ,MAAgB,QAC1B,CAAC;IACH;GACF;EACF;CACF,CAAC;AACH;;;;;;AAOA,MAAa,kBAAkB;;;;;;;;;;;;;;;ACjK/B,MAAa,YAAY,QAAQ;CAC/B,MAAM;CACN,YAAY;EAAC;EAAO;EAAW;CAAO;CACtC,UAAU,CAAC,iBAAiB;CAE5B,UAAU,CAAC,0BAA0B;AACvC,CAAC"}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/mcp/helpers/jsonrpc.ts","../../src/mcp/errors/McpError.ts","../../src/mcp/providers/McpServerProvider.ts","../../src/mcp/primitives/$prompt.ts","../../src/mcp/primitives/$resource.ts","../../src/mcp/primitives/$tool.ts","../../src/mcp/transports/StreamableHttpMcpTransport.ts","../../src/mcp/index.ts"],"sourcesContent":["import { AlephaError } from \"alepha\";\nimport type {\n  JsonRpcError,\n  JsonRpcNotification,\n  JsonRpcRequest,\n  JsonRpcResponse,\n} from \"../interfaces/McpTypes.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport const JSONRPC_VERSION = \"2.0\" as const;\n\n/**\n * The latest MCP protocol revision Alepha targets.\n * See {@link SUPPORTED_PROTOCOL_VERSIONS} for the full negotiation list.\n */\nexport const MCP_PROTOCOL_VERSION = \"2025-11-25\" as const;\n\n/**\n * Protocol versions Alepha will accept during `initialize` negotiation,\n * highest preference first. The server echoes back whichever version the\n * client requested if it appears here, otherwise picks the first entry.\n */\nexport const SUPPORTED_PROTOCOL_VERSIONS = [\n  \"2025-11-25\",\n  \"2025-06-18\",\n  \"2025-03-26\",\n  \"2024-11-05\",\n] as const;\n\nexport type SupportedProtocolVersion =\n  (typeof SUPPORTED_PROTOCOL_VERSIONS)[number];\n\nexport const isSupportedProtocolVersion = (\n  v: unknown,\n): v is SupportedProtocolVersion =>\n  typeof v === \"string\" &&\n  (SUPPORTED_PROTOCOL_VERSIONS as readonly string[]).includes(v);\n\nexport const JsonRpcErrorCodes = {\n  PARSE_ERROR: -32700,\n  INVALID_REQUEST: -32600,\n  METHOD_NOT_FOUND: -32601,\n  INVALID_PARAMS: -32602,\n  INTERNAL_ERROR: -32603,\n} as const;\n\n// ---------------------------------------------------------------------------------------------------------------------\n// Response Builders\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport function createResponse(\n  id: string | number,\n  result: unknown,\n): JsonRpcResponse {\n  return {\n    jsonrpc: JSONRPC_VERSION,\n    id,\n    result,\n  };\n}\n\nexport function createErrorResponse(\n  id: string | number,\n  error: JsonRpcError,\n): JsonRpcResponse {\n  return {\n    jsonrpc: JSONRPC_VERSION,\n    id,\n    error,\n  };\n}\n\nexport function createNotification(\n  method: string,\n  params?: Record<string, unknown>,\n): JsonRpcNotification {\n  return {\n    jsonrpc: JSONRPC_VERSION,\n    method,\n    params,\n  };\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n// Error Builders\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport function createParseError(message = \"Parse error\"): JsonRpcError {\n  return {\n    code: JsonRpcErrorCodes.PARSE_ERROR,\n    message,\n  };\n}\n\nexport function createInvalidRequestError(\n  message = \"Invalid request\",\n): JsonRpcError {\n  return {\n    code: JsonRpcErrorCodes.INVALID_REQUEST,\n    message,\n  };\n}\n\nexport function createMethodNotFoundError(method: string): JsonRpcError {\n  return {\n    code: JsonRpcErrorCodes.METHOD_NOT_FOUND,\n    message: `Method not found: ${method}`,\n  };\n}\n\nexport function createInvalidParamsError(message: string): JsonRpcError {\n  return {\n    code: JsonRpcErrorCodes.INVALID_PARAMS,\n    message,\n  };\n}\n\nexport function createInternalError(message: string): JsonRpcError {\n  return {\n    code: JsonRpcErrorCodes.INTERNAL_ERROR,\n    message,\n  };\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n// Message Parsing\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport function parseMessage(data: string): JsonRpcRequest {\n  let parsed: unknown;\n\n  try {\n    parsed = JSON.parse(data);\n  } catch {\n    throw new JsonRpcParseError(\"Invalid JSON\");\n  }\n\n  if (!isValidJsonRpcRequest(parsed)) {\n    throw new JsonRpcParseError(\"Invalid JSON-RPC request\");\n  }\n\n  return parsed;\n}\n\nexport function isValidJsonRpcRequest(value: unknown): value is JsonRpcRequest {\n  if (typeof value !== \"object\" || value === null) {\n    return false;\n  }\n\n  const obj = value as Record<string, unknown>;\n\n  if (obj.jsonrpc !== JSONRPC_VERSION) {\n    return false;\n  }\n\n  if (typeof obj.method !== \"string\") {\n    return false;\n  }\n\n  if (\n    obj.id !== undefined &&\n    typeof obj.id !== \"string\" &&\n    typeof obj.id !== \"number\"\n  ) {\n    return false;\n  }\n\n  if (obj.params !== undefined && typeof obj.params !== \"object\") {\n    return false;\n  }\n\n  return true;\n}\n\nexport function isNotification(request: JsonRpcRequest): boolean {\n  return request.id === undefined;\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n// Errors\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class JsonRpcParseError extends AlephaError {\n  name = \"JsonRpcParseError\";\n}\n","import { JsonRpcErrorCodes } from \"../helpers/jsonrpc.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * MCP-specific error codes (application-specific codes in the -32000 to -32099 range).\n */\nexport const McpErrorCodes = {\n  UNAUTHORIZED: -32001,\n  FORBIDDEN: -32003,\n} as const;\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class McpError extends Error {\n  name = \"McpError\";\n  code: number;\n\n  constructor(\n    message: string,\n    code: number = JsonRpcErrorCodes.INTERNAL_ERROR,\n  ) {\n    super(message);\n    this.code = code;\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class McpMethodNotFoundError extends McpError {\n  name = \"McpMethodNotFoundError\";\n\n  constructor(method: string) {\n    super(`Method not found: ${method}`, JsonRpcErrorCodes.METHOD_NOT_FOUND);\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class McpToolNotFoundError extends McpError {\n  name = \"McpToolNotFoundError\";\n  tool: string;\n\n  constructor(tool: string) {\n    super(`Tool not found: ${tool}`, JsonRpcErrorCodes.METHOD_NOT_FOUND);\n    this.tool = tool;\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class McpResourceNotFoundError extends McpError {\n  name = \"McpResourceNotFoundError\";\n  uri: string;\n\n  constructor(uri: string) {\n    super(`Resource not found: ${uri}`, JsonRpcErrorCodes.METHOD_NOT_FOUND);\n    this.uri = uri;\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class McpPromptNotFoundError extends McpError {\n  name = \"McpPromptNotFoundError\";\n  prompt: string;\n\n  constructor(prompt: string) {\n    super(`Prompt not found: ${prompt}`, JsonRpcErrorCodes.METHOD_NOT_FOUND);\n    this.prompt = prompt;\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class McpInvalidParamsError extends McpError {\n  name = \"McpInvalidParamsError\";\n\n  constructor(message: string) {\n    super(message, JsonRpcErrorCodes.INVALID_PARAMS);\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class McpUnauthorizedError extends McpError {\n  name = \"McpUnauthorizedError\";\n\n  constructor(message = \"Unauthorized\") {\n    super(message, McpErrorCodes.UNAUTHORIZED);\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class McpForbiddenError extends McpError {\n  name = \"McpForbiddenError\";\n\n  constructor(message = \"Forbidden\") {\n    super(message, McpErrorCodes.FORBIDDEN);\n  }\n}\n","import { $inject, Alepha, TypeBoxError } from \"alepha\";\nimport { $logger } from \"alepha/logger\";\nimport {\n  McpError,\n  McpMethodNotFoundError,\n  McpPromptNotFoundError,\n  McpResourceNotFoundError,\n  McpToolNotFoundError,\n} from \"../errors/McpError.ts\";\nimport {\n  createErrorResponse,\n  createInternalError,\n  createResponse,\n  isSupportedProtocolVersion,\n  MCP_PROTOCOL_VERSION,\n  SUPPORTED_PROTOCOL_VERSIONS,\n} from \"../helpers/jsonrpc.ts\";\nimport type {\n  JsonRpcRequest,\n  JsonRpcResponse,\n  McpCapabilities,\n  McpContent,\n  McpContext,\n  McpInitializeResult,\n  McpPromptDescriptor,\n  McpPromptGetResult,\n  McpPromptMessage,\n  McpResourceContent,\n  McpResourceDescriptor,\n  McpResourceReadResult,\n  McpServerInfo,\n  McpToolCallResult,\n  McpToolDescriptor,\n} from \"../interfaces/McpTypes.ts\";\nimport type { PromptPrimitive } from \"../primitives/$prompt.ts\";\nimport type { ResourcePrimitive } from \"../primitives/$resource.ts\";\nimport type { ToolPrimitive } from \"../primitives/$tool.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * Core MCP server provider that handles protocol messages.\n *\n * This provider maintains registries of tools, resources, and prompts,\n * and routes incoming JSON-RPC requests to the appropriate handlers.\n *\n * It is transport-agnostic - actual communication is handled by\n * transport providers like StdioMcpTransport or SseMcpTransport.\n */\nexport class McpServerProvider {\n  protected readonly log = $logger();\n  protected readonly alepha = $inject(Alepha);\n\n  protected readonly tools = new Map<string, ToolPrimitive<any>>();\n  protected readonly resources = new Map<string, ResourcePrimitive>();\n  protected readonly prompts = new Map<string, PromptPrimitive<any>>();\n\n  protected initialized = false;\n\n  /**\n   * Protocol version negotiated with the client during `initialize`.\n   * Used by transports to validate the `MCP-Protocol-Version` header on\n   * subsequent HTTP requests (per spec 2025-06-18+).\n   */\n  public negotiatedVersion: string = MCP_PROTOCOL_VERSION;\n\n  /**\n   * Server identity returned during `initialize`. Consumers may override\n   * fields directly (e.g. `mcpServer.serverInfo = { name: \"lore-mcp\",\n   * version: \"0.20.3\", description: \"...\" }`) — the `description` field\n   * is supported per spec 2025-11-25 (minor change #2).\n   */\n  public serverInfo: McpServerInfo = {\n    name: \"alepha-mcp\",\n    version: \"1.0.0\",\n  };\n\n  // -----------------------------------------------------------------------------------------------------------------\n  // Registration Methods\n  // -----------------------------------------------------------------------------------------------------------------\n\n  /**\n   * Register a tool with the MCP server.\n   */\n  public registerTool(tool: ToolPrimitive<any>): void {\n    this.log.trace(`Registering MCP tool: ${tool.name}`);\n    this.tools.set(tool.name, tool);\n  }\n\n  /**\n   * Register a resource with the MCP server.\n   */\n  public registerResource(resource: ResourcePrimitive): void {\n    this.log.trace(`Registering MCP resource: ${resource.uri}`);\n    this.resources.set(resource.uri, resource);\n  }\n\n  /**\n   * Register a prompt with the MCP server.\n   */\n  public registerPrompt(prompt: PromptPrimitive<any>): void {\n    this.log.trace(`Registering MCP prompt: ${prompt.name}`);\n    this.prompts.set(prompt.name, prompt);\n  }\n\n  // -----------------------------------------------------------------------------------------------------------------\n  // Getters\n  // -----------------------------------------------------------------------------------------------------------------\n\n  /**\n   * Get the server capabilities based on registered primitives.\n   */\n  public getCapabilities(): McpCapabilities {\n    return {\n      tools: this.tools.size > 0 ? {} : undefined,\n      resources: this.resources.size > 0 ? {} : undefined,\n      prompts: this.prompts.size > 0 ? {} : undefined,\n    };\n  }\n\n  /**\n   * Get all registered tools.\n   */\n  public getTools(): ToolPrimitive<any>[] {\n    return Array.from(this.tools.values());\n  }\n\n  /**\n   * Get all registered resources.\n   */\n  public getResources(): ResourcePrimitive[] {\n    return Array.from(this.resources.values());\n  }\n\n  /**\n   * Get all registered prompts.\n   */\n  public getPrompts(): PromptPrimitive<any>[] {\n    return Array.from(this.prompts.values());\n  }\n\n  /**\n   * Get a tool by name.\n   */\n  public getTool(name: string): ToolPrimitive<any> | undefined {\n    return this.tools.get(name);\n  }\n\n  /**\n   * Get a resource by URI.\n   */\n  public getResource(uri: string): ResourcePrimitive | undefined {\n    return this.resources.get(uri);\n  }\n\n  /**\n   * Get a prompt by name.\n   */\n  public getPrompt(name: string): PromptPrimitive<any> | undefined {\n    return this.prompts.get(name);\n  }\n\n  // -----------------------------------------------------------------------------------------------------------------\n  // Message Handling\n  // -----------------------------------------------------------------------------------------------------------------\n\n  /**\n   * Handle an incoming JSON-RPC request.\n   *\n   * @param request - The parsed JSON-RPC request\n   * @param context - Optional context from the transport layer (headers, auth, etc.)\n   * @returns The JSON-RPC response, or null for notifications\n   */\n  public async handleMessage(\n    request: JsonRpcRequest,\n    context?: McpContext,\n  ): Promise<JsonRpcResponse | null> {\n    const id = request.id;\n\n    // Notifications have no id and expect no response\n    if (id === undefined) {\n      await this.handleNotification(request);\n      return null;\n    }\n\n    try {\n      const result = await this.handleRequest(request, context);\n      return createResponse(id, result);\n    } catch (error) {\n      this.log.error(\"MCP request failed\", error);\n      // Preserve error code from McpError instances\n      if (error instanceof McpError) {\n        return createErrorResponse(id, {\n          code: error.code,\n          message: error.message,\n        });\n      }\n      return createErrorResponse(\n        id,\n        createInternalError((error as Error).message),\n      );\n    }\n  }\n\n  /**\n   * Handle a JSON-RPC request that expects a response.\n   */\n  protected async handleRequest(\n    request: JsonRpcRequest,\n    context?: McpContext,\n  ): Promise<unknown> {\n    const { method, params = {} } = request;\n\n    switch (method) {\n      case \"initialize\":\n        return this.handleInitialize(params);\n      case \"ping\":\n        return this.handlePing();\n      case \"tools/list\":\n        return this.handleToolsList();\n      case \"tools/call\":\n        return this.handleToolsCall(params, context);\n      case \"resources/list\":\n        return this.handleResourcesList();\n      case \"resources/read\":\n        return this.handleResourcesRead(params, context);\n      case \"prompts/list\":\n        return this.handlePromptsList();\n      case \"prompts/get\":\n        return this.handlePromptsGet(params, context);\n      default:\n        throw new McpMethodNotFoundError(method);\n    }\n  }\n\n  /**\n   * Handle a notification (no response expected).\n   */\n  protected async handleNotification(request: JsonRpcRequest): Promise<void> {\n    const { method } = request;\n\n    switch (method) {\n      case \"notifications/initialized\":\n        this.log.debug(\"MCP client initialized\");\n        break;\n      case \"notifications/cancelled\":\n        this.log.debug(\"MCP request cancelled\", request.params);\n        break;\n      default:\n        this.log.debug(`Unknown MCP notification: ${method}`);\n    }\n  }\n\n  // -----------------------------------------------------------------------------------------------------------------\n  // Protocol Handlers\n  // -----------------------------------------------------------------------------------------------------------------\n\n  protected handleInitialize(\n    params: Record<string, unknown>,\n  ): McpInitializeResult {\n    const requested = params.protocolVersion;\n    // Echo the client's version when supported, otherwise reply with our\n    // preferred version (highest entry in SUPPORTED_PROTOCOL_VERSIONS).\n    // The client can then decide to retry, downgrade, or disconnect.\n    const negotiated = isSupportedProtocolVersion(requested)\n      ? requested\n      : SUPPORTED_PROTOCOL_VERSIONS[0];\n\n    this.log.info(\"MCP client initializing\", {\n      clientInfo: params.clientInfo,\n      requestedProtocolVersion: requested,\n      negotiatedProtocolVersion: negotiated,\n    });\n\n    this.initialized = true;\n    this.negotiatedVersion = negotiated;\n\n    return {\n      protocolVersion: negotiated,\n      capabilities: this.getCapabilities(),\n      serverInfo: this.serverInfo,\n    };\n  }\n\n  protected handlePing(): Record<string, never> {\n    return {};\n  }\n\n  protected handleToolsList(): { tools: McpToolDescriptor[] } {\n    return {\n      tools: Array.from(this.tools.values()).map((t) => t.toDescriptor()),\n    };\n  }\n\n  protected async handleToolsCall(\n    params: Record<string, unknown>,\n    context?: McpContext,\n  ): Promise<McpToolCallResult> {\n    const name = params.name as string;\n    const args = (params.arguments ?? {}) as Record<string, unknown>;\n\n    const tool = this.tools.get(name);\n    if (!tool) {\n      // McpToolNotFoundError is intentionally a JSON-RPC protocol error,\n      // not a tool execution error — see SEP-1303 (only validation/runtime\n      // failures of an existing tool are reported via isError: true).\n      throw new McpToolNotFoundError(name);\n    }\n\n    try {\n      const result = await tool.execute(args, context);\n\n      // A tool WITHOUT an output schema may return raw MCP content blocks\n      // (e.g. an `image` block) instead of JSON — used for binary payloads\n      // like attachment previews. Recognized by the CallToolResult shape\n      // (`{ content: McpContent[] }`); passed through verbatim. Tools that\n      // declare an output schema always go through the structured path\n      // below, so a JSON result that happens to carry a `content` array is\n      // never mistaken for raw content.\n      if (!tool.hasOutputSchema()) {\n        const raw = this.asRawToolContent(result);\n        if (raw) {\n          return raw;\n        }\n      }\n\n      const callResult: McpToolCallResult = {\n        content: [\n          {\n            type: \"text\",\n            text:\n              typeof result === \"string\"\n                ? result\n                : JSON.stringify(result ?? null),\n          },\n        ],\n      };\n\n      // Spec 2025-06-18: when the tool declares an outputSchema, the server\n      // MUST populate `structuredContent` with the validated result. The\n      // text-stringified `content` block remains as a back-compat fallback.\n      if (tool.hasOutputSchema() && result !== undefined) {\n        callResult.structuredContent = result;\n      }\n\n      return callResult;\n    } catch (error) {\n      // Spec 2025-11-25 / SEP-1303: input-validation failures (and other\n      // tool-runtime errors) are returned as Tool Execution Errors, not\n      // JSON-RPC protocol errors, so the model can self-correct.\n      // For TypeBox validation errors we surface the failing path so the\n      // model knows which argument was malformed.\n      if (error instanceof TypeBoxError) {\n        const path = error.value?.path || \"/\";\n        const message = error.value?.message || error.message;\n        return {\n          content: [\n            {\n              type: \"text\",\n              text: `Validation error at ${path}: ${message}`,\n            },\n          ],\n          structuredContent: {\n            errors: [{ path, message }],\n          },\n          isError: true,\n        };\n      }\n\n      return {\n        content: [\n          {\n            type: \"text\",\n            text: `Error: ${(error as Error).message}`,\n          },\n        ],\n        isError: true,\n      };\n    }\n  }\n\n  /**\n   * Recognize a tool handler's return value as a pre-built MCP tool result —\n   * i.e. it already carries a `content` array of content blocks (text, image,\n   * audio, resource, resource_link). Returns the normalized\n   * {@link McpToolCallResult} when matched, or `undefined` to fall back to the\n   * default JSON/text encoding. Only ever consulted for tools that did NOT\n   * declare an output schema (see {@link handleToolCall}).\n   */\n  protected asRawToolContent(result: unknown): McpToolCallResult | undefined {\n    if (!result || typeof result !== \"object\") {\n      return undefined;\n    }\n    const candidate = result as {\n      content?: unknown;\n      isError?: unknown;\n      _meta?: unknown;\n    };\n    if (!Array.isArray(candidate.content) || candidate.content.length === 0) {\n      return undefined;\n    }\n    const allBlocks = candidate.content.every(\n      (block): block is McpContent =>\n        !!block &&\n        typeof block === \"object\" &&\n        typeof (block as { type?: unknown }).type === \"string\",\n    );\n    if (!allBlocks) {\n      return undefined;\n    }\n    return {\n      content: candidate.content as McpContent[],\n      isError:\n        typeof candidate.isError === \"boolean\" ? candidate.isError : undefined,\n      _meta:\n        candidate._meta && typeof candidate._meta === \"object\"\n          ? (candidate._meta as Record<string, unknown>)\n          : undefined,\n    };\n  }\n\n  protected handleResourcesList(): { resources: McpResourceDescriptor[] } {\n    return {\n      resources: Array.from(this.resources.values()).map((r) =>\n        r.toDescriptor(),\n      ),\n    };\n  }\n\n  protected async handleResourcesRead(\n    params: Record<string, unknown>,\n    context?: McpContext,\n  ): Promise<McpResourceReadResult> {\n    const uri = params.uri as string;\n\n    const resource = this.resources.get(uri);\n    if (!resource) {\n      throw new McpResourceNotFoundError(uri);\n    }\n\n    const content = await resource.read(context);\n\n    const resourceContent: McpResourceContent = {\n      uri,\n      mimeType: resource.mimeType,\n    };\n\n    if (content.text !== undefined) {\n      resourceContent.text = content.text;\n    }\n\n    if (content.blob !== undefined) {\n      // Convert binary to base64 for transport\n      resourceContent.blob = Buffer.from(content.blob).toString(\"base64\");\n    }\n\n    return {\n      contents: [resourceContent],\n    };\n  }\n\n  protected handlePromptsList(): { prompts: McpPromptDescriptor[] } {\n    return {\n      prompts: Array.from(this.prompts.values()).map((p) => p.toDescriptor()),\n    };\n  }\n\n  protected async handlePromptsGet(\n    params: Record<string, unknown>,\n    context?: McpContext,\n  ): Promise<McpPromptGetResult> {\n    const name = params.name as string;\n    const args = (params.arguments ?? {}) as Record<string, string>;\n\n    const prompt = this.prompts.get(name);\n    if (!prompt) {\n      throw new McpPromptNotFoundError(name);\n    }\n\n    const messages = await prompt.get(args, context);\n\n    const mcpMessages: McpPromptMessage[] = messages.map((msg) => ({\n      role: msg.role,\n      content: {\n        type: \"text\" as const,\n        text: msg.content,\n      },\n    }));\n\n    return {\n      description: prompt.description,\n      messages: mcpMessages,\n    };\n  }\n}\n","import {\n  $inject,\n  type Async,\n  createPrimitive,\n  KIND,\n  Primitive,\n  type Static,\n  type TObject,\n  z,\n} from \"alepha\";\nimport type {\n  McpContext,\n  McpIcon,\n  McpPromptArgument,\n  McpPromptDescriptor,\n  PromptHandlerArgs,\n  PromptMessage,\n} from \"../interfaces/McpTypes.ts\";\nimport { McpServerProvider } from \"../providers/McpServerProvider.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * Creates an MCP prompt primitive for defining reusable prompt templates.\n *\n * Prompts allow you to define templated messages that can be filled in\n * with arguments at runtime. They're useful for creating consistent\n * interaction patterns.\n *\n * @example\n * ```ts\n * class Prompts {\n *   greeting = $prompt({\n *     description: \"Generate a personalized greeting\",\n *     args: z.object({\n *       name: z.text({ description: \"Name of the person to greet\" }),\n *       style: z.enum([\"formal\", \"casual\"]).optional(),\n *     }),\n *     handler: async ({ args }) => [\n *       {\n *         role: \"user\",\n *         content: args.style === \"formal\"\n *           ? `Please greet ${args.name} in a formal manner.`\n *           : `Say hi to ${args.name}!`,\n *       },\n *     ],\n *   });\n *\n *   codeReview = $prompt({\n *     description: \"Request a code review\",\n *     args: z.object({\n *       code: z.text({ description: \"The code to review\" }),\n *       language: z.text({ description: \"Programming language\" }),\n *     }),\n *     handler: async ({ args }) => [\n *       {\n *         role: \"user\",\n *         content: `Please review this ${args.language} code:\\n\\n${args.code}`,\n *       },\n *     ],\n *   });\n * }\n * ```\n */\nexport const $prompt = <T extends TObject>(\n  options: PromptPrimitiveOptions<T>,\n): PromptPrimitive<T> => {\n  return createPrimitive(PromptPrimitive<T>, options);\n};\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface PromptPrimitiveOptions<T extends TObject> {\n  /**\n   * The name of the prompt.\n   *\n   * If not provided, defaults to the property key where the prompt is declared.\n   *\n   * @example \"greeting\"\n   * @example \"code-review\"\n   */\n  name?: string;\n\n  /**\n   * Human-friendly display title (spec 2025-11-25). Distinct from `name`,\n   * which remains the programmatic identifier.\n   */\n  title?: string;\n\n  /**\n   * Description of what this prompt does.\n   *\n   * Helps users understand the purpose of the prompt.\n   *\n   * @example \"Generate a personalized greeting message\"\n   */\n  description?: string;\n\n  /**\n   * Optional icons surfaced in client UIs (spec 2025-11-25 / SEP-973).\n   */\n  icons?: McpIcon[];\n\n  /**\n   * TypeBox schema defining the prompt arguments.\n   *\n   * Each property in the schema becomes an argument that can be\n   * filled in when the prompt is used.\n   */\n  args?: T;\n\n  /**\n   * Handler function that generates the prompt messages.\n   *\n   * Receives the validated arguments and returns an array of messages.\n   *\n   * @param args - Object containing validated arguments\n   * @returns Array of prompt messages\n   */\n  handler: (args: PromptHandlerArgs<T>) => Async<PromptMessage[]>;\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class PromptPrimitive<T extends TObject> extends Primitive<\n  PromptPrimitiveOptions<T>\n> {\n  protected readonly mcpServer = $inject(McpServerProvider);\n\n  /**\n   * Returns the name of the prompt.\n   */\n  public get name(): string {\n    return this.options.name ?? this.config.propertyKey;\n  }\n\n  /**\n   * Returns the description of the prompt.\n   */\n  public get description(): string | undefined {\n    return this.options.description;\n  }\n\n  protected onInit(): void {\n    this.mcpServer.registerPrompt(this);\n  }\n\n  /**\n   * Get the prompt messages with the given arguments.\n   *\n   * @param rawArgs - Raw arguments to validate and pass to the handler\n   * @param context - Optional context from the transport layer\n   * @returns Array of prompt messages\n   */\n  public async get(\n    rawArgs: unknown,\n    context?: McpContext,\n  ): Promise<PromptMessage[]> {\n    let args = (rawArgs ?? {}) as Static<T>;\n\n    if (this.options.args) {\n      args = this.alepha.codec.decode(this.options.args, rawArgs ?? {});\n    }\n\n    return this.options.handler({ args, context });\n  }\n\n  /**\n   * Convert the prompt to an MCP prompt descriptor for protocol messages.\n   */\n  public toDescriptor(): McpPromptDescriptor {\n    const descriptor: McpPromptDescriptor = {\n      name: this.name,\n      description: this.description,\n      arguments: this.options.args\n        ? this.schemaToArguments(this.options.args)\n        : [],\n    };\n    if (this.options.title) descriptor.title = this.options.title;\n    if (this.options.icons && this.options.icons.length > 0) {\n      descriptor.icons = this.options.icons;\n    }\n    return descriptor;\n  }\n\n  /**\n   * Convert a TypeBox schema to an array of prompt arguments.\n   */\n  protected schemaToArguments(schema: TObject): McpPromptArgument[] {\n    const args: McpPromptArgument[] = [];\n\n    for (const [name, propSchema] of Object.entries(schema.properties)) {\n      // The description lives on the inner schema; peel optional/nullable/default\n      // wrappers so `z.number({ description }).optional()` still surfaces it.\n      const prop = z.schema.unwrap(propSchema) as Record<string, unknown>;\n      args.push({\n        name,\n        description: prop.description as string | undefined,\n        required: !z.schema.isOptional(propSchema),\n      });\n    }\n\n    return args;\n  }\n}\n\n$prompt[KIND] = PromptPrimitive;\n","import { $inject, createPrimitive, KIND, Primitive } from \"alepha\";\nimport type {\n  McpContext,\n  McpIcon,\n  McpResourceDescriptor,\n  ResourceContent,\n  ResourceHandler,\n} from \"../interfaces/McpTypes.ts\";\nimport { McpServerProvider } from \"../providers/McpServerProvider.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * Creates an MCP resource primitive for exposing read-only data.\n *\n * Resources represent any kind of data that an LLM might want to read,\n * such as files, database records, API responses, or computed data.\n *\n * **Key Features**\n * - URI-based identification for resources\n * - Support for text and binary content\n * - MIME type specification\n * - Lazy loading via handler function\n *\n * @example\n * ```ts\n * class ProjectResources {\n *   readme = $resource({\n *     uri: \"file:///readme\",\n *     description: \"Project README file\",\n *     mimeType: \"text/markdown\",\n *     handler: async () => ({\n *       text: await fs.readFile(\"README.md\", \"utf-8\"),\n *     }),\n *   });\n *\n *   config = $resource({\n *     uri: \"config://app\",\n *     name: \"Application Configuration\",\n *     mimeType: \"application/json\",\n *     handler: async () => ({\n *       text: JSON.stringify(this.configService.getConfig()),\n *     }),\n *   });\n * }\n * ```\n */\nexport const $resource = (\n  options: ResourcePrimitiveOptions,\n): ResourcePrimitive => {\n  return createPrimitive(ResourcePrimitive, options);\n};\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface ResourcePrimitiveOptions {\n  /**\n   * The URI that identifies this resource.\n   *\n   * URIs should follow a consistent scheme for your application.\n   * Common patterns:\n   * - `file:///path/to/file` - File system resources\n   * - `db://table/id` - Database records\n   * - `api://endpoint` - API responses\n   * - `config://name` - Configuration values\n   *\n   * @example \"file:///readme.md\"\n   * @example \"db://users/123\"\n   */\n  uri: string;\n\n  /**\n   * Human-readable name for the resource.\n   *\n   * If not provided, defaults to the property key where the resource is declared.\n   *\n   * @example \"Project README\"\n   * @example \"User Profile\"\n   */\n  name?: string;\n\n  /**\n   * Human-friendly display title (spec 2025-11-25). Distinct from `name`,\n   * which remains the programmatic identifier.\n   */\n  title?: string;\n\n  /**\n   * Optional icons surfaced in client UIs (spec 2025-11-25 / SEP-973).\n   */\n  icons?: McpIcon[];\n\n  /**\n   * Description of what this resource contains.\n   *\n   * Helps the LLM understand the purpose and content of the resource.\n   *\n   * @example \"The main README file for the project\"\n   */\n  description?: string;\n\n  /**\n   * MIME type of the resource content.\n   *\n   * Helps clients understand how to interpret the content.\n   *\n   * @default \"text/plain\"\n   * @example \"text/markdown\"\n   * @example \"application/json\"\n   */\n  mimeType?: string;\n\n  /**\n   * Handler function that returns the resource content.\n   *\n   * Called when the resource is read. Can return text or binary content.\n   *\n   * @returns Resource content with either `text` or `blob` property\n   */\n  handler: ResourceHandler;\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class ResourcePrimitive extends Primitive<ResourcePrimitiveOptions> {\n  protected readonly mcpServer = $inject(McpServerProvider);\n\n  /**\n   * Returns the name of the resource.\n   */\n  public get name(): string {\n    return this.options.name ?? this.config.propertyKey;\n  }\n\n  /**\n   * Returns the URI of the resource.\n   */\n  public get uri(): string {\n    return this.options.uri;\n  }\n\n  /**\n   * Returns the description of the resource.\n   */\n  public get description(): string | undefined {\n    return this.options.description;\n  }\n\n  /**\n   * Returns the MIME type of the resource.\n   */\n  public get mimeType(): string {\n    return this.options.mimeType ?? \"text/plain\";\n  }\n\n  protected onInit(): void {\n    this.mcpServer.registerResource(this);\n  }\n\n  /**\n   * Read the resource content.\n   *\n   * @param context - Optional context from the transport layer\n   * @returns The resource content\n   */\n  public async read(context?: McpContext): Promise<ResourceContent> {\n    return this.options.handler({ context });\n  }\n\n  /**\n   * Convert the resource to an MCP resource descriptor for protocol messages.\n   */\n  public toDescriptor(): McpResourceDescriptor {\n    const descriptor: McpResourceDescriptor = {\n      uri: this.uri,\n      name: this.name,\n      description: this.description,\n      mimeType: this.mimeType,\n    };\n    if (this.options.title) descriptor.title = this.options.title;\n    if (this.options.icons && this.options.icons.length > 0) {\n      descriptor.icons = this.options.icons;\n    }\n    return descriptor;\n  }\n}\n\n$resource[KIND] = ResourcePrimitive;\n","import {\n  $inject,\n  type Async,\n  createPrimitive,\n  KIND,\n  Primitive,\n  type TObject,\n  type TSchema,\n  z,\n} from \"alepha\";\nimport type {\n  McpContext,\n  McpIcon,\n  McpJsonSchema,\n  McpToolAnnotations,\n  McpToolDescriptor,\n  ToolHandlerArgs,\n  ToolHandlerResult,\n  ToolPrimitiveSchema,\n} from \"../interfaces/McpTypes.ts\";\nimport { McpServerProvider } from \"../providers/McpServerProvider.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * Creates an MCP tool primitive for defining callable functions.\n *\n * Tools are the primary way for LLMs to interact with external systems through MCP.\n * Each tool has a name, description, typed parameters, and a handler function.\n *\n * **Key Features**\n * - Full TypeScript inference for parameters and results\n * - Automatic schema validation using TypeBox\n * - JSON Schema generation for MCP protocol\n * - Integration with MCP server provider\n *\n * @example\n * ```ts\n * class CalculatorTools {\n *   add = $tool({\n *     description: \"Add two numbers together\",\n *     schema: {\n *       params: z.object({\n *         a: z.number(),\n *         b: z.number(),\n *       }),\n *       result: z.number(),\n *     },\n *     handler: async ({ params }) => {\n *       return params.a + params.b;\n *     },\n *   });\n *\n *   greet = $tool({\n *     description: \"Generate a greeting message\",\n *     schema: {\n *       params: z.object({\n *         name: z.text(),\n *       }),\n *       result: z.text(),\n *     },\n *     handler: async ({ params }) => {\n *       return `Hello, ${params.name}!`;\n *     },\n *   });\n * }\n * ```\n */\nexport const $tool = <T extends ToolPrimitiveSchema>(\n  options: ToolPrimitiveOptions<T>,\n): ToolPrimitive<T> => {\n  return createPrimitive(ToolPrimitive<T>, options);\n};\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface ToolPrimitiveOptions<T extends ToolPrimitiveSchema> {\n  /**\n   * The name of the tool.\n   *\n   * If not provided, defaults to the property key where the tool is declared.\n   * Names should be descriptive and use kebab-case or snake_case.\n   *\n   * @example \"calculate-sum\"\n   * @example \"get_weather\"\n   */\n  name?: string;\n\n  /**\n   * Human-friendly display title (spec 2025-11-25). Distinct from `name`,\n   * which remains the programmatic identifier. Clients use `title` in\n   * tool palettes / picker UIs.\n   *\n   * @example \"Search Lore\"\n   */\n  title?: string;\n\n  /**\n   * A human-readable description of what the tool does.\n   *\n   * This description is sent to the LLM to help it understand\n   * when and how to use the tool. Be clear and specific.\n   *\n   * @example \"Calculate the sum of two numbers\"\n   * @example \"Retrieve current weather data for a given location\"\n   */\n  description: string;\n\n  /**\n   * Behavior hints (spec 2025-03-26+). Clients use these to gate UI prompts\n   * (e.g. require confirmation before a tool with `destructiveHint: true`).\n   * None are guarantees — they are heuristics for the client, not the model.\n   */\n  annotations?: McpToolAnnotations;\n\n  /**\n   * Icons surfaced in client tool palettes / picker UIs (spec 2025-11-25).\n   */\n  icons?: McpIcon[];\n\n  /**\n   * TypeBox schema defining the tool's parameters and result type.\n   *\n   * - **params**: TObject schema for input parameters (optional)\n   * - **result**: TSchema for the return value (optional)\n   *\n   * Schemas provide:\n   * - Type inference for handler function\n   * - Runtime validation of inputs\n   * - JSON Schema generation for MCP protocol\n   */\n  schema?: T;\n\n  /**\n   * The handler function that executes when the tool is called.\n   *\n   * Receives validated parameters and returns the result.\n   * Errors thrown here are caught and returned as MCP errors.\n   *\n   * @param args - Object containing validated params\n   * @returns The tool result (can be async)\n   */\n  handler: (args: ToolHandlerArgs<T>) => Async<ToolHandlerResult<T>>;\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class ToolPrimitive<T extends ToolPrimitiveSchema> extends Primitive<\n  ToolPrimitiveOptions<T>\n> {\n  protected readonly mcpServer = $inject(McpServerProvider);\n\n  /**\n   * Returns the name of the tool.\n   */\n  public get name(): string {\n    return this.options.name ?? this.config.propertyKey;\n  }\n\n  /**\n   * Returns the description of the tool.\n   */\n  public get description(): string {\n    return this.options.description;\n  }\n\n  /**\n   * Whether the tool declared a result schema. When true, `tools/call`\n   * responses include `structuredContent` populated with the validated\n   * result (spec 2025-06-18).\n   */\n  public hasOutputSchema(): boolean {\n    return !!this.options.schema?.result;\n  }\n\n  protected onInit(): void {\n    this.mcpServer.registerTool(this);\n  }\n\n  /**\n   * Execute the tool with the given parameters.\n   *\n   * @param params - Raw parameters to validate and pass to the handler\n   * @param context - Optional context from the transport layer\n   * @returns The tool result\n   */\n  public async execute(\n    params: unknown,\n    context?: McpContext,\n  ): Promise<ToolHandlerResult<T>> {\n    let validatedParams: any = params ?? {};\n\n    // Validate params using alepha.codec if schema provided\n    if (this.options.schema?.params) {\n      validatedParams = this.alepha.codec.decode(\n        this.options.schema.params,\n        validatedParams,\n      );\n    }\n\n    const result = await this.options.handler({\n      params: validatedParams,\n      context,\n    });\n\n    // Validate and encode result if schema provided\n    if (this.options.schema?.result && result !== undefined) {\n      return this.alepha.codec.encode(\n        this.options.schema.result,\n        result,\n      ) as ToolHandlerResult<T>;\n    }\n\n    return result as ToolHandlerResult<T>;\n  }\n\n  /**\n   * Convert the tool to an MCP tool descriptor for protocol messages.\n   *\n   * Emits the spec 2025-11-25 surface: `title`, `annotations`, `icons`,\n   * and (when `schema.result` is defined) `outputSchema` so the server\n   * can populate `structuredContent` on call results.\n   */\n  public toDescriptor(): McpToolDescriptor {\n    const inputSchema: McpJsonSchema = this.options.schema?.params\n      ? this.schemaToJsonSchema(this.options.schema.params)\n      : { type: \"object\", properties: {}, required: [] };\n\n    const descriptor: McpToolDescriptor = {\n      name: this.name,\n      description: this.description,\n      inputSchema,\n    };\n\n    if (this.options.title) descriptor.title = this.options.title;\n    if (this.options.annotations)\n      descriptor.annotations = this.options.annotations;\n    if (this.options.icons && this.options.icons.length > 0) {\n      descriptor.icons = this.options.icons;\n    }\n\n    // Output schema is emitted when the tool declares `schema.result`,\n    // unlocking structured content on tools/call responses.\n    if (this.options.schema?.result) {\n      const out = this.propertyToJsonSchema(this.options.schema.result);\n      // The result schema may be a primitive — wrap so the descriptor\n      // value is always a JSON Schema object with `type`.\n      descriptor.outputSchema = (\n        typeof out === \"object\" && out !== null && \"type\" in out\n          ? out\n          : { type: \"object\", properties: {}, required: [] }\n      ) as McpJsonSchema;\n    }\n\n    return descriptor;\n  }\n\n  /**\n   * Convert a TypeBox schema to JSON Schema format.\n   *\n   * Emits the 2020-12 dialect annotation at the root (spec 2025-11-25 /\n   * SEP-1613 — JSON Schema 2020-12 is the default dialect for MCP).\n   * The TypeBox shapes Alepha emits today are already 2020-12-compatible;\n   * this is just the dialect declaration.\n   */\n  protected schemaToJsonSchema(\n    schema: TObject,\n    options?: { root?: boolean },\n  ): McpJsonSchema {\n    let json: any;\n    try {\n      json = z.toJSONSchema(schema as any);\n    } catch {\n      json = { type: \"object\", properties: {}, required: [] };\n    }\n\n    // Annotate the 2020-12 dialect on the root schema only (avoid noise on\n    // nested sub-schemas where MCP doesn't expect $schema).\n    if (options?.root === false) {\n      json.$schema = undefined;\n    } else {\n      json.$schema = \"https://json-schema.org/draft/2020-12/schema\";\n    }\n\n    return json as McpJsonSchema;\n  }\n\n  /**\n   * Convert a single property schema to JSON Schema format (zod-native).\n   */\n  protected propertyToJsonSchema(schema: TSchema): Record<string, unknown> {\n    try {\n      const json: any = z.toJSONSchema(schema as any);\n      json.$schema = undefined;\n      return json;\n    } catch {\n      return { type: \"string\" };\n    }\n  }\n}\n\n$tool[KIND] = ToolPrimitive;\n","import { $atom, $inject, $state, z } from \"alepha\";\nimport { $logger } from \"alepha/logger\";\nimport { $route } from \"alepha/server\";\nimport {\n  createErrorResponse,\n  createParseError,\n  JsonRpcParseError,\n  parseMessage,\n} from \"../helpers/jsonrpc.ts\";\nimport type { McpContext } from \"../interfaces/McpTypes.ts\";\nimport { McpServerProvider } from \"../providers/McpServerProvider.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport const mcpStreamableHttpOptions = $atom({\n  name: \"alepha.mcp.streamableHttp.options\",\n  description: \"Configuration options for the MCP Streamable HTTP transport.\",\n  schema: z.object({\n    /**\n     * Path for the MCP endpoint. Single endpoint for both requests and\n     * (optional) server-streamed responses, per spec 2025-03-26+.\n     */\n    path: z.text({ default: \"/mcp\" }),\n    /**\n     * Allow-list of `Origin` header values accepted on incoming requests.\n     * Empty array (default) means \"allow any\". When set, browser-originated\n     * requests with a non-matching `Origin` are rejected with 403 Forbidden,\n     * blocking DNS-rebinding attacks against localhost MCP servers.\n     *\n     * Server-to-server callers (no `Origin` header) are always allowed.\n     *\n     * Spec 2025-11-25, PR #1439.\n     */\n    allowedOrigins: z.array(z.text()).default([]),\n    /**\n     * When true, an unauthenticated POST to the MCP endpoint is rejected\n     * with `401 Unauthorized` and an RFC 9728 `WWW-Authenticate` challenge\n     * instead of being dispatched. MCP clients (Claude, etc.) rely on that\n     * challenge to discover the OAuth authorization server.\n     *\n     * The transport stays OAuth-agnostic: it only knows \"auth is required\".\n     * `$realm({ features: { oauth: true } })` flips this on automatically.\n     *\n     * @default false\n     */\n    requireAuth: z.boolean().default(false),\n    /**\n     * Path of the RFC 9728 protected-resource metadata document, advertised\n     * (as an absolute URL, resolved against the request origin) in the\n     * `WWW-Authenticate` challenge emitted when {@link requireAuth} rejects\n     * a request.\n     */\n    resourceMetadataPath: z.text({\n      default: \"/.well-known/oauth-protected-resource\",\n    }),\n  }),\n  default: {\n    path: \"/mcp\",\n    allowedOrigins: [],\n    requireAuth: false,\n    resourceMetadataPath: \"/.well-known/oauth-protected-resource\",\n  },\n});\n\n// Backward-compat alias for the legacy atom name. Prefer\n// `mcpStreamableHttpOptions` going forward; this re-export keeps existing\n// consumer imports compiling and will be removed once they migrate.\nexport const mcpSseOptions = mcpStreamableHttpOptions;\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * Streamable HTTP transport for MCP communication.\n *\n * Implements the 2025-03-26+ Streamable HTTP transport: a single `/mcp`\n * endpoint that accepts JSON-RPC over POST and returns either\n * `application/json` (single response, the default) or\n * `text/event-stream` (when the server wants to stream multiple messages).\n *\n * Designed for serverless deployment (Cloudflare Workers, etc.) — there is\n * no long-lived GET stream. GET on the endpoint returns 405 Method Not\n * Allowed; clients that want server-initiated push must rely on the POST\n * response stream when the server upgrades to SSE for that particular call.\n *\n * Spec compliance:\n * - 2025-06-18: validates `MCP-Protocol-Version` header on every request\n *   after `initialize` against the version negotiated and stored on\n *   `McpServerProvider`.\n * - 2025-11-25: rejects requests with a non-allow-listed `Origin` header\n *   (PR #1439). See {@link mcpStreamableHttpOptions.allowedOrigins}.\n *\n * @example\n * ```ts\n * import { Alepha, run } from \"alepha\";\n * import { AlephaServer } from \"alepha/server\";\n * import { AlephaMcp, StreamableHttpMcpTransport } from \"alepha/mcp\";\n *\n * class MyTools {\n *   // ... tool definitions\n * }\n *\n * run(\n *   Alepha.create()\n *     .with(AlephaServer)\n *     .with(AlephaMcp)\n *     .with(StreamableHttpMcpTransport)\n *     .with(MyTools)\n * );\n * ```\n */\nexport class StreamableHttpMcpTransport {\n  protected readonly log = $logger();\n  protected readonly options = $state(mcpStreamableHttpOptions);\n  protected readonly mcpServer = $inject(McpServerProvider);\n\n  /**\n   * GET on the MCP endpoint is not supported in this transport. Returning\n   * 405 (rather than serving the legacy two-endpoint SSE pattern) is the\n   * spec-allowed response for servers that don't offer server-initiated\n   * push outside of an active POST.\n   */\n  notAllowed = $route({\n    method: \"GET\",\n    path: this.options.path,\n    handler: (request) => {\n      request.reply.status = 405;\n      request.reply.headers.allow = \"POST\";\n      request.reply.headers[\"content-type\"] = \"application/json\";\n      request.reply.body = JSON.stringify({\n        error: \"Method Not Allowed. Use POST for MCP messages.\",\n      });\n    },\n  });\n\n  /**\n   * POST endpoint for client-to-server JSON-RPC messages.\n   * Returns `application/json` for single responses; tools that need to\n   * stream progress would upgrade to `text/event-stream` (deferred until a\n   * concrete need exists).\n   */\n  message = $route({\n    method: \"POST\",\n    path: this.options.path,\n    schema: {\n      body: z.json(),\n    },\n    handler: async (request) => {\n      try {\n        // Origin allow-list check (spec 2025-11-25 / PR #1439).\n        const originRaw = request.headers.origin;\n        const origin = Array.isArray(originRaw) ? originRaw[0] : originRaw;\n        if (\n          origin &&\n          this.options.allowedOrigins.length > 0 &&\n          !this.options.allowedOrigins.includes(origin)\n        ) {\n          this.log.warn(\"Rejected MCP request with non-allowed Origin\", {\n            origin,\n            allowed: this.options.allowedOrigins,\n          });\n          request.reply.status = 403;\n          request.reply.headers[\"content-type\"] = \"application/json\";\n          request.reply.body = JSON.stringify({\n            error: \"Forbidden: Origin not allowed\",\n          });\n          return;\n        }\n\n        // RFC 9728 / MCP auth (spec 2025-06-18+): when the endpoint is\n        // OAuth-protected, an unauthenticated request is rejected with 401\n        // and a `WWW-Authenticate` challenge pointing at the protected-\n        // resource metadata. MCP clients (Claude, etc.) follow that\n        // `resource_metadata` URL to discover the authorization server —\n        // without it, discovery never starts. The URL MUST be absolute.\n        if (this.options.requireAuth && !request.user) {\n          const url =\n            typeof request.url === \"string\"\n              ? new URL(request.url)\n              : request.url;\n          const resourceMetadataUrl = `${url.protocol}//${url.host}${this.options.resourceMetadataPath}`;\n          this.log.debug(\"Rejecting unauthenticated MCP request\", {\n            resourceMetadataUrl,\n          });\n          request.reply.status = 401;\n          request.reply.headers[\"www-authenticate\"] =\n            `Bearer resource_metadata=\"${resourceMetadataUrl}\"`;\n          request.reply.headers[\"content-type\"] = \"application/json\";\n          request.reply.body = JSON.stringify({\n            error: \"Unauthorized\",\n          });\n          return;\n        }\n\n        const body =\n          typeof request.body === \"string\"\n            ? request.body\n            : JSON.stringify(request.body);\n\n        this.log.debug(\"MCP request body\", {\n          body,\n          bodyType: typeof request.body,\n        });\n\n        const rpcRequest = parseMessage(body);\n\n        // Build context from request headers\n        const headers = { ...request.headers } as Record<\n          string,\n          string | string[] | undefined\n        >;\n\n        // Spec 2025-06-18+: every HTTP request after `initialize` MUST carry\n        // an `MCP-Protocol-Version` header matching the negotiated version.\n        // Reject mismatches with 400 so the client doesn't silently drift.\n        if (rpcRequest.method !== \"initialize\") {\n          const headerRaw = headers[\"mcp-protocol-version\"];\n          const headerVersion = Array.isArray(headerRaw)\n            ? headerRaw[0]\n            : headerRaw;\n          if (\n            headerVersion &&\n            headerVersion !== this.mcpServer.negotiatedVersion\n          ) {\n            this.log.warn(\"MCP-Protocol-Version header mismatch\", {\n              header: headerVersion,\n              negotiated: this.mcpServer.negotiatedVersion,\n            });\n            request.reply.status = 400;\n            request.reply.headers[\"content-type\"] = \"application/json\";\n            request.reply.body = JSON.stringify({\n              error: `MCP-Protocol-Version mismatch: expected ${this.mcpServer.negotiatedVersion}, got ${headerVersion}`,\n            });\n            return;\n          }\n        }\n\n        const context: McpContext = { headers };\n\n        const response = await this.mcpServer.handleMessage(\n          rpcRequest,\n          context,\n        );\n\n        if (response) {\n          request.reply.headers[\"content-type\"] = \"application/json\";\n          request.reply.body = JSON.stringify(response);\n        } else {\n          request.reply.status = 204;\n        }\n      } catch (error) {\n        if (error instanceof JsonRpcParseError) {\n          request.reply.status = 400;\n          request.reply.headers[\"content-type\"] = \"application/json\";\n          request.reply.body = JSON.stringify(\n            createErrorResponse(0, createParseError(error.message)),\n          );\n        } else {\n          this.log.error(\"Failed to process MCP message\", error);\n          request.reply.status = 500;\n          request.reply.body = JSON.stringify({\n            error: (error as Error).message,\n          });\n        }\n      }\n    },\n  });\n}\n\n/**\n * @deprecated Use {@link StreamableHttpMcpTransport}. The 2024-11-05\n * two-endpoint HTTP+SSE pattern was replaced by Streamable HTTP in spec\n * 2025-03-26. This alias is preserved for one release to ease migration.\n */\nexport const SseMcpTransport = StreamableHttpMcpTransport;\n","import { $module } from \"alepha\";\nimport { $prompt } from \"./primitives/$prompt.ts\";\nimport { $resource } from \"./primitives/$resource.ts\";\nimport { $tool } from \"./primitives/$tool.ts\";\nimport { McpServerProvider } from \"./providers/McpServerProvider.ts\";\nimport { StreamableHttpMcpTransport } from \"./transports/StreamableHttpMcpTransport.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport {\n  McpError,\n  McpErrorCodes,\n  McpForbiddenError,\n  McpInvalidParamsError,\n  McpMethodNotFoundError,\n  McpPromptNotFoundError,\n  McpResourceNotFoundError,\n  McpToolNotFoundError,\n  McpUnauthorizedError,\n} from \"./errors/McpError.ts\";\nexport {\n  createErrorResponse,\n  createInternalError,\n  createInvalidParamsError,\n  createInvalidRequestError,\n  createMethodNotFoundError,\n  createNotification,\n  createParseError,\n  createResponse,\n  isNotification,\n  isSupportedProtocolVersion,\n  isValidJsonRpcRequest,\n  JSONRPC_VERSION,\n  JsonRpcErrorCodes,\n  JsonRpcParseError,\n  MCP_PROTOCOL_VERSION,\n  parseMessage,\n  SUPPORTED_PROTOCOL_VERSIONS,\n  type SupportedProtocolVersion,\n} from \"./helpers/jsonrpc.ts\";\nexport type {\n  JsonRpcError,\n  JsonRpcNotification,\n  // JSON-RPC types\n  JsonRpcRequest,\n  JsonRpcResponse,\n  // MCP protocol types\n  McpCapabilities,\n  McpClientInfo,\n  McpContent,\n  // Context type for auth/headers\n  McpContext,\n  McpInitializeParams,\n  McpInitializeResult,\n  McpJsonSchema,\n  McpPromptArgument,\n  McpPromptContent,\n  // Prompt types\n  McpPromptDescriptor,\n  McpPromptGetParams,\n  McpPromptGetResult,\n  McpPromptMessage,\n  McpResourceContent,\n  // Resource types\n  McpResourceDescriptor,\n  McpResourceReadParams,\n  McpResourceReadResult,\n  McpServerInfo,\n  McpToolCallParams,\n  McpToolCallResult,\n  // Tool types\n  McpToolDescriptor,\n  PromptHandler,\n  PromptHandlerArgs,\n  PromptMessage,\n  ResourceContent,\n  ResourceHandler,\n  ResourceHandlerArgs,\n  ToolHandler,\n  ToolHandlerArgs,\n  ToolHandlerResult,\n  // Handler types\n  ToolPrimitiveSchema,\n} from \"./interfaces/McpTypes.ts\";\nexport type { PromptPrimitiveOptions } from \"./primitives/$prompt.ts\";\nexport { $prompt, PromptPrimitive } from \"./primitives/$prompt.ts\";\nexport type { ResourcePrimitiveOptions } from \"./primitives/$resource.ts\";\nexport { $resource, ResourcePrimitive } from \"./primitives/$resource.ts\";\nexport type { ToolPrimitiveOptions } from \"./primitives/$tool.ts\";\nexport { $tool, ToolPrimitive } from \"./primitives/$tool.ts\";\nexport { McpServerProvider } from \"./providers/McpServerProvider.ts\";\nexport {\n  mcpSseOptions,\n  mcpStreamableHttpOptions,\n  SseMcpTransport,\n  StreamableHttpMcpTransport,\n} from \"./transports/StreamableHttpMcpTransport.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * Model Context Protocol for AI tool integration.\n *\n * **Features:**\n * - MCP resource definitions\n * - MCP tool definitions\n * - MCP prompt definitions\n * - JSON-RPC protocol\n * - Streamable HTTP transport (spec 2025-03-26+)\n *\n * @module alepha.mcp\n */\nexport const AlephaMcp = $module({\n  name: \"alepha.mcp\",\n  primitives: [$tool, $resource, $prompt],\n  services: [McpServerProvider],\n  // Transports are opt-in — user wires the one(s) they need via alepha.with(StreamableHttpMcpTransport).\n  variants: [StreamableHttpMcpTransport],\n});\n"],"mappings":";;;;AAYA,MAAa,kBAAkB;;;;;AAM/B,MAAa,uBAAuB;;;;;;AAOpC,MAAa,8BAA8B;CACzC;CACA;CACA;CACA;AACF;AAKA,MAAa,8BACX,MAEA,OAAO,MAAM,YACZ,4BAAkD,SAAS,CAAC;AAE/D,MAAa,oBAAoB;CAC/B,aAAa;CACb,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,gBAAgB;AAClB;AAMA,SAAgB,eACd,IACA,QACiB;CACjB,OAAO;EACL,SAAA;EACA;EACA;CACF;AACF;AAEA,SAAgB,oBACd,IACA,OACiB;CACjB,OAAO;EACL,SAAA;EACA;EACA;CACF;AACF;AAEA,SAAgB,mBACd,QACA,QACqB;CACrB,OAAO;EACL,SAAA;EACA;EACA;CACF;AACF;AAMA,SAAgB,iBAAiB,UAAU,eAA6B;CACtE,OAAO;EACL,MAAM,kBAAkB;EACxB;CACF;AACF;AAEA,SAAgB,0BACd,UAAU,mBACI;CACd,OAAO;EACL,MAAM,kBAAkB;EACxB;CACF;AACF;AAEA,SAAgB,0BAA0B,QAA8B;CACtE,OAAO;EACL,MAAM,kBAAkB;EACxB,SAAS,qBAAqB;CAChC;AACF;AAEA,SAAgB,yBAAyB,SAA+B;CACtE,OAAO;EACL,MAAM,kBAAkB;EACxB;CACF;AACF;AAEA,SAAgB,oBAAoB,SAA+B;CACjE,OAAO;EACL,MAAM,kBAAkB;EACxB;CACF;AACF;AAMA,SAAgB,aAAa,MAA8B;CACzD,IAAI;CAEJ,IAAI;EACF,SAAS,KAAK,MAAM,IAAI;CAC1B,QAAQ;EACN,MAAM,IAAI,kBAAkB,cAAc;CAC5C;CAEA,IAAI,CAAC,sBAAsB,MAAM,GAC/B,MAAM,IAAI,kBAAkB,0BAA0B;CAGxD,OAAO;AACT;AAEA,SAAgB,sBAAsB,OAAyC;CAC7E,IAAI,OAAO,UAAU,YAAY,UAAU,MACzC,OAAO;CAGT,MAAM,MAAM;CAEZ,IAAI,IAAI,YAAA,OACN,OAAO;CAGT,IAAI,OAAO,IAAI,WAAW,UACxB,OAAO;CAGT,IACE,IAAI,OAAO,KAAA,KACX,OAAO,IAAI,OAAO,YAClB,OAAO,IAAI,OAAO,UAElB,OAAO;CAGT,IAAI,IAAI,WAAW,KAAA,KAAa,OAAO,IAAI,WAAW,UACpD,OAAO;CAGT,OAAO;AACT;AAEA,SAAgB,eAAe,SAAkC;CAC/D,OAAO,QAAQ,OAAO,KAAA;AACxB;AAMA,IAAa,oBAAb,cAAuC,YAAY;CACjD,OAAO;AACT;;;;;;ACpLA,MAAa,gBAAgB;CAC3B,cAAc;CACd,WAAW;AACb;AAIA,IAAa,WAAb,cAA8B,MAAM;CAClC,OAAO;CACP;CAEA,YACE,SACA,OAAe,kBAAkB,gBACjC;EACA,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;AAIA,IAAa,yBAAb,cAA4C,SAAS;CACnD,OAAO;CAEP,YAAY,QAAgB;EAC1B,MAAM,qBAAqB,UAAU,kBAAkB,gBAAgB;CACzE;AACF;AAIA,IAAa,uBAAb,cAA0C,SAAS;CACjD,OAAO;CACP;CAEA,YAAY,MAAc;EACxB,MAAM,mBAAmB,QAAQ,kBAAkB,gBAAgB;EACnE,KAAK,OAAO;CACd;AACF;AAIA,IAAa,2BAAb,cAA8C,SAAS;CACrD,OAAO;CACP;CAEA,YAAY,KAAa;EACvB,MAAM,uBAAuB,OAAO,kBAAkB,gBAAgB;EACtE,KAAK,MAAM;CACb;AACF;AAIA,IAAa,yBAAb,cAA4C,SAAS;CACnD,OAAO;CACP;CAEA,YAAY,QAAgB;EAC1B,MAAM,qBAAqB,UAAU,kBAAkB,gBAAgB;EACvE,KAAK,SAAS;CAChB;AACF;AAIA,IAAa,wBAAb,cAA2C,SAAS;CAClD,OAAO;CAEP,YAAY,SAAiB;EAC3B,MAAM,SAAS,kBAAkB,cAAc;CACjD;AACF;AAIA,IAAa,uBAAb,cAA0C,SAAS;CACjD,OAAO;CAEP,YAAY,UAAU,gBAAgB;EACpC,MAAM,SAAS,cAAc,YAAY;CAC3C;AACF;AAIA,IAAa,oBAAb,cAAuC,SAAS;CAC9C,OAAO;CAEP,YAAY,UAAU,aAAa;EACjC,MAAM,SAAS,cAAc,SAAS;CACxC;AACF;;;;;;;;;;;;ACpDA,IAAa,oBAAb,MAA+B;CAC7B,MAAyB,QAAQ;CACjC,SAA4B,QAAQ,MAAM;CAE1C,wBAA2B,IAAI,IAAgC;CAC/D,4BAA+B,IAAI,IAA+B;CAClE,0BAA6B,IAAI,IAAkC;CAEnE,cAAwB;;;;;;CAOxB,oBAAmC;;;;;;;CAQnC,aAAmC;EACjC,MAAM;EACN,SAAS;CACX;;;;CASA,aAAoB,MAAgC;EAClD,KAAK,IAAI,MAAM,yBAAyB,KAAK,MAAM;EACnD,KAAK,MAAM,IAAI,KAAK,MAAM,IAAI;CAChC;;;;CAKA,iBAAwB,UAAmC;EACzD,KAAK,IAAI,MAAM,6BAA6B,SAAS,KAAK;EAC1D,KAAK,UAAU,IAAI,SAAS,KAAK,QAAQ;CAC3C;;;;CAKA,eAAsB,QAAoC;EACxD,KAAK,IAAI,MAAM,2BAA2B,OAAO,MAAM;EACvD,KAAK,QAAQ,IAAI,OAAO,MAAM,MAAM;CACtC;;;;CASA,kBAA0C;EACxC,OAAO;GACL,OAAO,KAAK,MAAM,OAAO,IAAI,CAAC,IAAI,KAAA;GAClC,WAAW,KAAK,UAAU,OAAO,IAAI,CAAC,IAAI,KAAA;GAC1C,SAAS,KAAK,QAAQ,OAAO,IAAI,CAAC,IAAI,KAAA;EACxC;CACF;;;;CAKA,WAAwC;EACtC,OAAO,MAAM,KAAK,KAAK,MAAM,OAAO,CAAC;CACvC;;;;CAKA,eAA2C;EACzC,OAAO,MAAM,KAAK,KAAK,UAAU,OAAO,CAAC;CAC3C;;;;CAKA,aAA4C;EAC1C,OAAO,MAAM,KAAK,KAAK,QAAQ,OAAO,CAAC;CACzC;;;;CAKA,QAAe,MAA8C;EAC3D,OAAO,KAAK,MAAM,IAAI,IAAI;CAC5B;;;;CAKA,YAAmB,KAA4C;EAC7D,OAAO,KAAK,UAAU,IAAI,GAAG;CAC/B;;;;CAKA,UAAiB,MAAgD;EAC/D,OAAO,KAAK,QAAQ,IAAI,IAAI;CAC9B;;;;;;;;CAaA,MAAa,cACX,SACA,SACiC;EACjC,MAAM,KAAK,QAAQ;EAGnB,IAAI,OAAO,KAAA,GAAW;GACpB,MAAM,KAAK,mBAAmB,OAAO;GACrC,OAAO;EACT;EAEA,IAAI;GAEF,OAAO,eAAe,IAAI,MADL,KAAK,cAAc,SAAS,OAAO,CACxB;EAClC,SAAS,OAAO;GACd,KAAK,IAAI,MAAM,sBAAsB,KAAK;GAE1C,IAAI,iBAAiB,UACnB,OAAO,oBAAoB,IAAI;IAC7B,MAAM,MAAM;IACZ,SAAS,MAAM;GACjB,CAAC;GAEH,OAAO,oBACL,IACA,oBAAqB,MAAgB,OAAO,CAC9C;EACF;CACF;;;;CAKA,MAAgB,cACd,SACA,SACkB;EAClB,MAAM,EAAE,QAAQ,SAAS,CAAC,MAAM;EAEhC,QAAQ,QAAR;GACE,KAAK,cACH,OAAO,KAAK,iBAAiB,MAAM;GACrC,KAAK,QACH,OAAO,KAAK,WAAW;GACzB,KAAK,cACH,OAAO,KAAK,gBAAgB;GAC9B,KAAK,cACH,OAAO,KAAK,gBAAgB,QAAQ,OAAO;GAC7C,KAAK,kBACH,OAAO,KAAK,oBAAoB;GAClC,KAAK,kBACH,OAAO,KAAK,oBAAoB,QAAQ,OAAO;GACjD,KAAK,gBACH,OAAO,KAAK,kBAAkB;GAChC,KAAK,eACH,OAAO,KAAK,iBAAiB,QAAQ,OAAO;GAC9C,SACE,MAAM,IAAI,uBAAuB,MAAM;EAC3C;CACF;;;;CAKA,MAAgB,mBAAmB,SAAwC;EACzE,MAAM,EAAE,WAAW;EAEnB,QAAQ,QAAR;GACE,KAAK;IACH,KAAK,IAAI,MAAM,wBAAwB;IACvC;GACF,KAAK;IACH,KAAK,IAAI,MAAM,yBAAyB,QAAQ,MAAM;IACtD;GACF,SACE,KAAK,IAAI,MAAM,6BAA6B,QAAQ;EACxD;CACF;CAMA,iBACE,QACqB;EACrB,MAAM,YAAY,OAAO;EAIzB,MAAM,aAAa,2BAA2B,SAAS,IACnD,YACA,4BAA4B;EAEhC,KAAK,IAAI,KAAK,2BAA2B;GACvC,YAAY,OAAO;GACnB,0BAA0B;GAC1B,2BAA2B;EAC7B,CAAC;EAED,KAAK,cAAc;EACnB,KAAK,oBAAoB;EAEzB,OAAO;GACL,iBAAiB;GACjB,cAAc,KAAK,gBAAgB;GACnC,YAAY,KAAK;EACnB;CACF;CAEA,aAA8C;EAC5C,OAAO,CAAC;CACV;CAEA,kBAA4D;EAC1D,OAAO,EACL,OAAO,MAAM,KAAK,KAAK,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,aAAa,CAAC,EACpE;CACF;CAEA,MAAgB,gBACd,QACA,SAC4B;EAC5B,MAAM,OAAO,OAAO;EACpB,MAAM,OAAQ,OAAO,aAAa,CAAC;EAEnC,MAAM,OAAO,KAAK,MAAM,IAAI,IAAI;EAChC,IAAI,CAAC,MAIH,MAAM,IAAI,qBAAqB,IAAI;EAGrC,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,QAAQ,MAAM,OAAO;GAS/C,IAAI,CAAC,KAAK,gBAAgB,GAAG;IAC3B,MAAM,MAAM,KAAK,iBAAiB,MAAM;IACxC,IAAI,KACF,OAAO;GAEX;GAEA,MAAM,aAAgC,EACpC,SAAS,CACP;IACE,MAAM;IACN,MACE,OAAO,WAAW,WACd,SACA,KAAK,UAAU,UAAU,IAAI;GACrC,CACF,EACF;GAKA,IAAI,KAAK,gBAAgB,KAAK,WAAW,KAAA,GACvC,WAAW,oBAAoB;GAGjC,OAAO;EACT,SAAS,OAAO;GAMd,IAAI,iBAAiB,cAAc;IACjC,MAAM,OAAO,MAAM,OAAO,QAAQ;IAClC,MAAM,UAAU,MAAM,OAAO,WAAW,MAAM;IAC9C,OAAO;KACL,SAAS,CACP;MACE,MAAM;MACN,MAAM,uBAAuB,KAAK,IAAI;KACxC,CACF;KACA,mBAAmB,EACjB,QAAQ,CAAC;MAAE;MAAM;KAAQ,CAAC,EAC5B;KACA,SAAS;IACX;GACF;GAEA,OAAO;IACL,SAAS,CACP;KACE,MAAM;KACN,MAAM,UAAW,MAAgB;IACnC,CACF;IACA,SAAS;GACX;EACF;CACF;;;;;;;;;CAUA,iBAA2B,QAAgD;EACzE,IAAI,CAAC,UAAU,OAAO,WAAW,UAC/B;EAEF,MAAM,YAAY;EAKlB,IAAI,CAAC,MAAM,QAAQ,UAAU,OAAO,KAAK,UAAU,QAAQ,WAAW,GACpE;EAQF,IAAI,CANc,UAAU,QAAQ,OACjC,UACC,CAAC,CAAC,SACF,OAAO,UAAU,YACjB,OAAQ,MAA6B,SAAS,QAErC,GACX;EAEF,OAAO;GACL,SAAS,UAAU;GACnB,SACE,OAAO,UAAU,YAAY,YAAY,UAAU,UAAU,KAAA;GAC/D,OACE,UAAU,SAAS,OAAO,UAAU,UAAU,WACzC,UAAU,QACX,KAAA;EACR;CACF;CAEA,sBAAwE;EACtE,OAAO,EACL,WAAW,MAAM,KAAK,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,KAAK,MAClD,EAAE,aAAa,CACjB,EACF;CACF;CAEA,MAAgB,oBACd,QACA,SACgC;EAChC,MAAM,MAAM,OAAO;EAEnB,MAAM,WAAW,KAAK,UAAU,IAAI,GAAG;EACvC,IAAI,CAAC,UACH,MAAM,IAAI,yBAAyB,GAAG;EAGxC,MAAM,UAAU,MAAM,SAAS,KAAK,OAAO;EAE3C,MAAM,kBAAsC;GAC1C;GACA,UAAU,SAAS;EACrB;EAEA,IAAI,QAAQ,SAAS,KAAA,GACnB,gBAAgB,OAAO,QAAQ;EAGjC,IAAI,QAAQ,SAAS,KAAA,GAEnB,gBAAgB,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,QAAQ;EAGpE,OAAO,EACL,UAAU,CAAC,eAAe,EAC5B;CACF;CAEA,oBAAkE;EAChE,OAAO,EACL,SAAS,MAAM,KAAK,KAAK,QAAQ,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,aAAa,CAAC,EACxE;CACF;CAEA,MAAgB,iBACd,QACA,SAC6B;EAC7B,MAAM,OAAO,OAAO;EACpB,MAAM,OAAQ,OAAO,aAAa,CAAC;EAEnC,MAAM,SAAS,KAAK,QAAQ,IAAI,IAAI;EACpC,IAAI,CAAC,QACH,MAAM,IAAI,uBAAuB,IAAI;EAKvC,MAAM,eAAkC,MAFjB,OAAO,IAAI,MAAM,OAAO,EAAA,CAEE,KAAK,SAAS;GAC7D,MAAM,IAAI;GACV,SAAS;IACP,MAAM;IACN,MAAM,IAAI;GACZ;EACF,EAAE;EAEF,OAAO;GACL,aAAa,OAAO;GACpB,UAAU;EACZ;CACF;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC9aA,MAAa,WACX,YACuB;CACvB,OAAO,gBAAgB,iBAAoB,OAAO;AACpD;AAwDA,IAAa,kBAAb,cAAwD,UAEtD;CACA,YAA+B,QAAQ,iBAAiB;;;;CAKxD,IAAW,OAAe;EACxB,OAAO,KAAK,QAAQ,QAAQ,KAAK,OAAO;CAC1C;;;;CAKA,IAAW,cAAkC;EAC3C,OAAO,KAAK,QAAQ;CACtB;CAEA,SAAyB;EACvB,KAAK,UAAU,eAAe,IAAI;CACpC;;;;;;;;CASA,MAAa,IACX,SACA,SAC0B;EAC1B,IAAI,OAAQ,WAAW,CAAC;EAExB,IAAI,KAAK,QAAQ,MACf,OAAO,KAAK,OAAO,MAAM,OAAO,KAAK,QAAQ,MAAM,WAAW,CAAC,CAAC;EAGlE,OAAO,KAAK,QAAQ,QAAQ;GAAE;GAAM;EAAQ,CAAC;CAC/C;;;;CAKA,eAA2C;EACzC,MAAM,aAAkC;GACtC,MAAM,KAAK;GACX,aAAa,KAAK;GAClB,WAAW,KAAK,QAAQ,OACpB,KAAK,kBAAkB,KAAK,QAAQ,IAAI,IACxC,CAAC;EACP;EACA,IAAI,KAAK,QAAQ,OAAO,WAAW,QAAQ,KAAK,QAAQ;EACxD,IAAI,KAAK,QAAQ,SAAS,KAAK,QAAQ,MAAM,SAAS,GACpD,WAAW,QAAQ,KAAK,QAAQ;EAElC,OAAO;CACT;;;;CAKA,kBAA4B,QAAsC;EAChE,MAAM,OAA4B,CAAC;EAEnC,KAAK,MAAM,CAAC,MAAM,eAAe,OAAO,QAAQ,OAAO,UAAU,GAAG;GAGlE,MAAM,OAAO,EAAE,OAAO,OAAO,UAAU;GACvC,KAAK,KAAK;IACR;IACA,aAAa,KAAK;IAClB,UAAU,CAAC,EAAE,OAAO,WAAW,UAAU;GAC3C,CAAC;EACH;EAEA,OAAO;CACT;AACF;AAEA,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC/JhB,MAAa,aACX,YACsB;CACtB,OAAO,gBAAgB,mBAAmB,OAAO;AACnD;AAyEA,IAAa,oBAAb,cAAuC,UAAoC;CACzE,YAA+B,QAAQ,iBAAiB;;;;CAKxD,IAAW,OAAe;EACxB,OAAO,KAAK,QAAQ,QAAQ,KAAK,OAAO;CAC1C;;;;CAKA,IAAW,MAAc;EACvB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,IAAW,cAAkC;EAC3C,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,IAAW,WAAmB;EAC5B,OAAO,KAAK,QAAQ,YAAY;CAClC;CAEA,SAAyB;EACvB,KAAK,UAAU,iBAAiB,IAAI;CACtC;;;;;;;CAQA,MAAa,KAAK,SAAgD;EAChE,OAAO,KAAK,QAAQ,QAAQ,EAAE,QAAQ,CAAC;CACzC;;;;CAKA,eAA6C;EAC3C,MAAM,aAAoC;GACxC,KAAK,KAAK;GACV,MAAM,KAAK;GACX,aAAa,KAAK;GAClB,UAAU,KAAK;EACjB;EACA,IAAI,KAAK,QAAQ,OAAO,WAAW,QAAQ,KAAK,QAAQ;EACxD,IAAI,KAAK,QAAQ,SAAS,KAAK,QAAQ,MAAM,SAAS,GACpD,WAAW,QAAQ,KAAK,QAAQ;EAElC,OAAO;CACT;AACF;AAEA,UAAU,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACvHlB,MAAa,SACX,YACqB;CACrB,OAAO,gBAAgB,eAAkB,OAAO;AAClD;AA2EA,IAAa,gBAAb,cAAkE,UAEhE;CACA,YAA+B,QAAQ,iBAAiB;;;;CAKxD,IAAW,OAAe;EACxB,OAAO,KAAK,QAAQ,QAAQ,KAAK,OAAO;CAC1C;;;;CAKA,IAAW,cAAsB;EAC/B,OAAO,KAAK,QAAQ;CACtB;;;;;;CAOA,kBAAkC;EAChC,OAAO,CAAC,CAAC,KAAK,QAAQ,QAAQ;CAChC;CAEA,SAAyB;EACvB,KAAK,UAAU,aAAa,IAAI;CAClC;;;;;;;;CASA,MAAa,QACX,QACA,SAC+B;EAC/B,IAAI,kBAAuB,UAAU,CAAC;EAGtC,IAAI,KAAK,QAAQ,QAAQ,QACvB,kBAAkB,KAAK,OAAO,MAAM,OAClC,KAAK,QAAQ,OAAO,QACpB,eACF;EAGF,MAAM,SAAS,MAAM,KAAK,QAAQ,QAAQ;GACxC,QAAQ;GACR;EACF,CAAC;EAGD,IAAI,KAAK,QAAQ,QAAQ,UAAU,WAAW,KAAA,GAC5C,OAAO,KAAK,OAAO,MAAM,OACvB,KAAK,QAAQ,OAAO,QACpB,MACF;EAGF,OAAO;CACT;;;;;;;;CASA,eAAyC;EACvC,MAAM,cAA6B,KAAK,QAAQ,QAAQ,SACpD,KAAK,mBAAmB,KAAK,QAAQ,OAAO,MAAM,IAClD;GAAE,MAAM;GAAU,YAAY,CAAC;GAAG,UAAU,CAAC;EAAE;EAEnD,MAAM,aAAgC;GACpC,MAAM,KAAK;GACX,aAAa,KAAK;GAClB;EACF;EAEA,IAAI,KAAK,QAAQ,OAAO,WAAW,QAAQ,KAAK,QAAQ;EACxD,IAAI,KAAK,QAAQ,aACf,WAAW,cAAc,KAAK,QAAQ;EACxC,IAAI,KAAK,QAAQ,SAAS,KAAK,QAAQ,MAAM,SAAS,GACpD,WAAW,QAAQ,KAAK,QAAQ;EAKlC,IAAI,KAAK,QAAQ,QAAQ,QAAQ;GAC/B,MAAM,MAAM,KAAK,qBAAqB,KAAK,QAAQ,OAAO,MAAM;GAGhE,WAAW,eACT,OAAO,QAAQ,YAAY,QAAQ,QAAQ,UAAU,MACjD,MACA;IAAE,MAAM;IAAU,YAAY,CAAC;IAAG,UAAU,CAAC;GAAE;EAEvD;EAEA,OAAO;CACT;;;;;;;;;CAUA,mBACE,QACA,SACe;EACf,IAAI;EACJ,IAAI;GACF,OAAO,EAAE,aAAa,MAAa;EACrC,QAAQ;GACN,OAAO;IAAE,MAAM;IAAU,YAAY,CAAC;IAAG,UAAU,CAAC;GAAE;EACxD;EAIA,IAAI,SAAS,SAAS,OACpB,KAAK,UAAU,KAAA;OAEf,KAAK,UAAU;EAGjB,OAAO;CACT;;;;CAKA,qBAA+B,QAA0C;EACvE,IAAI;GACF,MAAM,OAAY,EAAE,aAAa,MAAa;GAC9C,KAAK,UAAU,KAAA;GACf,OAAO;EACT,QAAQ;GACN,OAAO,EAAE,MAAM,SAAS;EAC1B;CACF;AACF;AAEA,MAAM,QAAQ;;;AC/Rd,MAAa,2BAA2B,MAAM;CAC5C,MAAM;CACN,aAAa;CACb,QAAQ,EAAE,OAAO;;;;;EAKf,MAAM,EAAE,KAAK,EAAE,SAAS,OAAO,CAAC;;;;;;;;;;;EAWhC,gBAAgB,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;;;;;;;;;;;;EAY5C,aAAa,EAAE,QAAQ,CAAC,CAAC,QAAQ,KAAK;;;;;;;EAOtC,sBAAsB,EAAE,KAAK,EAC3B,SAAS,wCACX,CAAC;CACH,CAAC;CACD,SAAS;EACP,MAAM;EACN,gBAAgB,CAAC;EACjB,aAAa;EACb,sBAAsB;CACxB;AACF,CAAC;AAKD,MAAa,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2C7B,IAAa,6BAAb,MAAwC;CACtC,MAAyB,QAAQ;CACjC,UAA6B,OAAO,wBAAwB;CAC5D,YAA+B,QAAQ,iBAAiB;;;;;;;CAQxD,aAAa,OAAO;EAClB,QAAQ;EACR,MAAM,KAAK,QAAQ;EACnB,UAAU,YAAY;GACpB,QAAQ,MAAM,SAAS;GACvB,QAAQ,MAAM,QAAQ,QAAQ;GAC9B,QAAQ,MAAM,QAAQ,kBAAkB;GACxC,QAAQ,MAAM,OAAO,KAAK,UAAU,EAClC,OAAO,iDACT,CAAC;EACH;CACF,CAAC;;;;;;;CAQD,UAAU,OAAO;EACf,QAAQ;EACR,MAAM,KAAK,QAAQ;EACnB,QAAQ,EACN,MAAM,EAAE,KAAK,EACf;EACA,SAAS,OAAO,YAAY;GAC1B,IAAI;IAEF,MAAM,YAAY,QAAQ,QAAQ;IAClC,MAAM,SAAS,MAAM,QAAQ,SAAS,IAAI,UAAU,KAAK;IACzD,IACE,UACA,KAAK,QAAQ,eAAe,SAAS,KACrC,CAAC,KAAK,QAAQ,eAAe,SAAS,MAAM,GAC5C;KACA,KAAK,IAAI,KAAK,gDAAgD;MAC5D;MACA,SAAS,KAAK,QAAQ;KACxB,CAAC;KACD,QAAQ,MAAM,SAAS;KACvB,QAAQ,MAAM,QAAQ,kBAAkB;KACxC,QAAQ,MAAM,OAAO,KAAK,UAAU,EAClC,OAAO,gCACT,CAAC;KACD;IACF;IAQA,IAAI,KAAK,QAAQ,eAAe,CAAC,QAAQ,MAAM;KAC7C,MAAM,MACJ,OAAO,QAAQ,QAAQ,WACnB,IAAI,IAAI,QAAQ,GAAG,IACnB,QAAQ;KACd,MAAM,sBAAsB,GAAG,IAAI,SAAS,IAAI,IAAI,OAAO,KAAK,QAAQ;KACxE,KAAK,IAAI,MAAM,yCAAyC,EACtD,oBACF,CAAC;KACD,QAAQ,MAAM,SAAS;KACvB,QAAQ,MAAM,QAAQ,sBACpB,6BAA6B,oBAAoB;KACnD,QAAQ,MAAM,QAAQ,kBAAkB;KACxC,QAAQ,MAAM,OAAO,KAAK,UAAU,EAClC,OAAO,eACT,CAAC;KACD;IACF;IAEA,MAAM,OACJ,OAAO,QAAQ,SAAS,WACpB,QAAQ,OACR,KAAK,UAAU,QAAQ,IAAI;IAEjC,KAAK,IAAI,MAAM,oBAAoB;KACjC;KACA,UAAU,OAAO,QAAQ;IAC3B,CAAC;IAED,MAAM,aAAa,aAAa,IAAI;IAGpC,MAAM,UAAU,EAAE,GAAG,QAAQ,QAAQ;IAQrC,IAAI,WAAW,WAAW,cAAc;KACtC,MAAM,YAAY,QAAQ;KAC1B,MAAM,gBAAgB,MAAM,QAAQ,SAAS,IACzC,UAAU,KACV;KACJ,IACE,iBACA,kBAAkB,KAAK,UAAU,mBACjC;MACA,KAAK,IAAI,KAAK,wCAAwC;OACpD,QAAQ;OACR,YAAY,KAAK,UAAU;MAC7B,CAAC;MACD,QAAQ,MAAM,SAAS;MACvB,QAAQ,MAAM,QAAQ,kBAAkB;MACxC,QAAQ,MAAM,OAAO,KAAK,UAAU,EAClC,OAAO,2CAA2C,KAAK,UAAU,kBAAkB,QAAQ,gBAC7F,CAAC;MACD;KACF;IACF;IAEA,MAAM,UAAsB,EAAE,QAAQ;IAEtC,MAAM,WAAW,MAAM,KAAK,UAAU,cACpC,YACA,OACF;IAEA,IAAI,UAAU;KACZ,QAAQ,MAAM,QAAQ,kBAAkB;KACxC,QAAQ,MAAM,OAAO,KAAK,UAAU,QAAQ;IAC9C,OACE,QAAQ,MAAM,SAAS;GAE3B,SAAS,OAAO;IACd,IAAI,iBAAiB,mBAAmB;KACtC,QAAQ,MAAM,SAAS;KACvB,QAAQ,MAAM,QAAQ,kBAAkB;KACxC,QAAQ,MAAM,OAAO,KAAK,UACxB,oBAAoB,GAAG,iBAAiB,MAAM,OAAO,CAAC,CACxD;IACF,OAAO;KACL,KAAK,IAAI,MAAM,iCAAiC,KAAK;KACrD,QAAQ,MAAM,SAAS;KACvB,QAAQ,MAAM,OAAO,KAAK,UAAU,EAClC,OAAQ,MAAgB,QAC1B,CAAC;IACH;GACF;EACF;CACF,CAAC;AACH;;;;;;AAOA,MAAa,kBAAkB;;;;;;;;;;;;;;;ACjK/B,MAAa,YAAY,QAAQ;CAC/B,MAAM;CACN,YAAY;EAAC;EAAO;EAAW;CAAO;CACtC,UAAU,CAAC,iBAAiB;CAE5B,UAAU,CAAC,0BAA0B;AACvC,CAAC"}

package/dist/orm/core/index.browser.js

@@ -1,4 +1,4 @@
-import { $module, AlephaError, KIND, pageQuerySchema, pageSchema, pageSchema as pageSchema$1, t } from "alepha";
+import { $module, AlephaError, KIND, pageQuerySchema, pageSchema, pageSchema as pageSchema$1, z } from "alepha";
 import { AlephaDateTime } from "alepha/datetime";
 import { sql } from "drizzle-orm";
 //#region ../../src/orm/core/errors/DbError.ts
@@ -44,7 +44,8 @@ var DbColumnNotFoundError = class DbColumnNotFoundError extends DbError {
 		if (pgMatch) {
 			const column = pgMatch[1];
 			const table = pgMatch[2];
-			return new DbColumnNotFoundError(table ? `Column '${column}' does not exist in table '${table}'` : `Column '${column}' does not exist`, error, {
+			const msg = table ? `Column '${column}' does not exist in table '${table}'` : `Column '${column}' does not exist`;
+			return new DbColumnNotFoundError(msg, error, {
 				column,
 				table
 			});
@@ -53,7 +54,8 @@ var DbColumnNotFoundError = class DbColumnNotFoundError extends DbError {
 		if (sqliteMatch) {
 			const table = sqliteMatch[1];
 			const column = sqliteMatch[2];
-			return new DbColumnNotFoundError(table ? `Column '${column}' does not exist in table '${table}'` : `Column '${column}' does not exist`, error, {
+			const msg = table ? `Column '${column}' does not exist in table '${table}'` : `Column '${column}' does not exist`;
+			return new DbColumnNotFoundError(msg, error, {
 				column,
 				table
 			});
@@ -299,11 +301,11 @@ var DbTableNotFoundError = class DbTableNotFoundError extends DbError {
 *
 * @example
 * ```ts
-* import { t } from "alepha";
+* import { z } from "alepha";
 * import { PG_UPDATED_AT } from "../constants/PG_SYMBOLS";
 *
 * export const updatedAtSchema = pgAttr(
-*   t.datetime(), PG_UPDATED_AT,
+*   z.datetime(), PG_UPDATED_AT,
 * );
 * ```
 */
@@ -316,8 +318,8 @@ const pgAttr = (type, attr, value) => {
 */
 const getAttrFields = (schema, name) => {
 	const fields = [];
-	for (const key of Object.keys(schema.properties)) {
-		const value = schema.properties[key];
+	for (const key of Object.keys(schema.shape)) {
+		const value = schema.shape[key];
 		if (name in value) fields.push({
 			type: value,
 			key,
@@ -346,25 +348,26 @@ const PG_SERIAL = Symbol.for("Alepha.Postgres.Serial");
 //#region ../../src/orm/core/schemas/insertSchema.ts
 const insertSchema = (obj) => {
 	const newProperties = {};
-	for (const key in obj.properties) {
-		const prop = obj.properties[key];
+	for (const key in obj.shape) {
+		const prop = obj.shape[key];
 		if (PG_GENERATED in prop) continue;
-		if (PG_DEFAULT in prop || PG_ORGANIZATION in prop) newProperties[key] = t.optional(prop);
+		if (PG_DEFAULT in prop || PG_ORGANIZATION in prop) newProperties[key] = prop.optional();
+		else if (z.schema.isOptional(prop)) newProperties[key] = z.schema.unwrap(prop).nullable().optional();
 		else newProperties[key] = prop;
 	}
-	return t.object(newProperties, "options" in obj && typeof obj.options === "object" ? { ...obj.options } : {});
+	return z.object(newProperties);
 };
 //#endregion
 //#region ../../src/orm/core/schemas/updateSchema.ts
 const updateSchema = (schema) => {
 	const newProperties = {};
-	for (const key in schema.properties) {
-		const prop = schema.properties[key];
+	for (const key in schema.shape) {
+		const prop = schema.shape[key];
 		if (PG_GENERATED in prop) continue;
-		if (t.schema.isOptional(prop)) newProperties[key] = t.optional(t.union([prop, t.null()]));
+		if (z.schema.isOptional(prop)) newProperties[key] = z.union([prop, z.null()]).optional();
 		else newProperties[key] = prop;
 	}
-	return t.object(newProperties, "options" in schema && typeof schema.options === "object" ? { ...schema.options } : {});
+	return z.object(newProperties);
 };
 //#endregion
 //#region ../../src/orm/core/primitives/$entity.ts
@@ -373,15 +376,15 @@ const updateSchema = (schema) => {
 *
 * @example
 * ```ts
-* import { t } from "alepha";
+* import { z } from "alepha";
 * import { $entity } from "alepha/orm";
 *
 * const userEntity = $entity({
 *   name: "users",
-*   schema: t.object({
+*   schema: z.object({
 *     id: pg.primaryKey(),
-*     name: t.text(),
-*     email: t.email(),
+*     name: z.text(),
+*     email: z.email(),
 *   }),
 * });
 * ```
@@ -415,11 +418,15 @@ var EntityPrimitive = class EntityPrimitive {
 	get schema() {
 		return this.options.schema;
 	}
+	_insertSchema;
 	get insertSchema() {
-		return insertSchema(this.options.schema);
+		this._insertSchema ??= insertSchema(this.options.schema);
+		return this._insertSchema;
 	}
+	_updateSchema;
 	get updateSchema() {
-		return updateSchema(this.options.schema);
+		this._updateSchema ??= updateSchema(this.options.schema);
+		return this._updateSchema;
 	}
 };
 $entity[KIND] = EntityPrimitive;
@@ -430,20 +437,20 @@ var DatabaseTypeProvider = class {
 	/**
 	* Creates a primary key with an identity column.
 	*/
-	identityPrimaryKey = (identity, options) => pgAttr(pgAttr(pgAttr(t.integer(options), PG_PRIMARY_KEY), PG_IDENTITY, identity), PG_DEFAULT);
+	identityPrimaryKey = (identity) => pgAttr(pgAttr(pgAttr(z.integer(), PG_PRIMARY_KEY), PG_IDENTITY, identity), PG_DEFAULT);
 	/**
 	* Creates a primary key with a big identity column. (default)
 	*/
-	bigIdentityPrimaryKey = (identity, options) => pgAttr(pgAttr(pgAttr(t.int64(options), PG_PRIMARY_KEY), PG_IDENTITY, identity), PG_DEFAULT);
+	bigIdentityPrimaryKey = (identity) => pgAttr(pgAttr(pgAttr(z.int64(), PG_PRIMARY_KEY), PG_IDENTITY, identity), PG_DEFAULT);
 	/**
 	* Creates a primary key with a UUID column.
 	*/
-	uuidPrimaryKey = () => pgAttr(pgAttr(t.uuid(), PG_PRIMARY_KEY), PG_DEFAULT);
-	primaryKey(type, options, identity) {
-		if (!type || t.schema.isInteger(type)) return pgAttr(pgAttr(pgAttr(t.integer(options), PG_PRIMARY_KEY), PG_IDENTITY, identity), PG_DEFAULT);
-		if (t.schema.isString(type) && type.format === "uuid") return pgAttr(pgAttr(t.uuid(), PG_PRIMARY_KEY), PG_DEFAULT);
-		if (t.schema.isNumber(type) && type.format === "int64") return pgAttr(pgAttr(pgAttr(t.number(options), PG_PRIMARY_KEY), PG_IDENTITY, identity), PG_DEFAULT);
-		if (t.schema.isBigInt(type)) return pgAttr(pgAttr(pgAttr(t.bigint(options), PG_PRIMARY_KEY), PG_IDENTITY, identity), PG_DEFAULT);
+	uuidPrimaryKey = () => pgAttr(pgAttr(z.uuid(), PG_PRIMARY_KEY), PG_DEFAULT);
+	primaryKey(type, _options, identity) {
+		if (!type || z.schema.isInteger(type)) return pgAttr(pgAttr(pgAttr(z.integer(), PG_PRIMARY_KEY), PG_IDENTITY, identity), PG_DEFAULT);
+		if (z.schema.isString(type) && z.schema.format(type) === "uuid") return pgAttr(pgAttr(z.uuid(), PG_PRIMARY_KEY), PG_DEFAULT);
+		if (z.schema.isNumber(type) && z.schema.format(type) === "int64") return pgAttr(pgAttr(pgAttr(z.number(), PG_PRIMARY_KEY), PG_IDENTITY, identity), PG_DEFAULT);
+		if (z.schema.isBigInt(type)) return pgAttr(pgAttr(pgAttr(z.bigint(), PG_PRIMARY_KEY), PG_IDENTITY, identity), PG_DEFAULT);
 		throw new AlephaError(`Unsupported type for primary key: ${type}`);
 	}
 	/**
@@ -464,21 +471,21 @@ var DatabaseTypeProvider = class {
 	* @see {@link RepositoryPrimitive#save}
 	* @see {@link PgVersionMismatchError}
 	*/
-	version = (options = {}) => this.default(pgAttr(t.integer(options), PG_VERSION), 0);
+	version = () => this.default(pgAttr(z.integer(), PG_VERSION), 0);
 	/**
 	* Creates a column Created At. So just a datetime column with a default value of the current timestamp.
 	*/
-	createdAt = (options) => pgAttr(pgAttr(t.datetime(options), PG_CREATED_AT), PG_DEFAULT);
+	createdAt = () => pgAttr(pgAttr(z.datetime(), PG_CREATED_AT), PG_DEFAULT);
 	/**
 	* Creates a column Updated At. Like createdAt, but it is updated on every update of the row.
 	*/
-	updatedAt = (options) => pgAttr(pgAttr(t.datetime(options), PG_UPDATED_AT), PG_DEFAULT);
+	updatedAt = () => pgAttr(pgAttr(z.datetime(), PG_UPDATED_AT), PG_DEFAULT);
 	/**
 	* Creates a column Deleted At for soft delete functionality.
 	* This is used to mark rows as deleted without actually removing them from the database.
 	* The column is nullable - NULL means not deleted, timestamp means deleted.
 	*/
-	deletedAt = (options) => pgAttr(t.optional(t.datetime(options)), PG_DELETED_AT);
+	deletedAt = () => pgAttr(z.datetime().optional(), PG_DELETED_AT);
 	/**
 	* Creates an organization column for multi-tenant row scoping.
 	*
@@ -487,17 +494,24 @@ var DatabaseTypeProvider = class {
 	*
 	* @param options.nullable - When `false`, the column is NOT NULL in the database and
 	*   the ORM rejects inserts that arrive without an organization context.
-	*   Defaults to `true` (nullable) for backward compatibility: NULL rows are visible
-	*   to every tenant, which is the historic "global row" semantics.
+	*   Defaults to `true` (nullable) — unless `strict` is set, which flips the
+	*   default to non-nullable. NULL rows are visible to every tenant (the
+	*   historic "global row" semantics) only when the column is nullable AND
+	*   not strict.
+	* @param options.strict - Fail-closed tenant scoping for security-sensitive
+	*   tables. Refuses reads/writes with no resolved tenant (instead of a
+	*   fail-open "see/write everything") and drops the `OR org IS NULL` escape
+	*   so a scoped tenant never sees global rows. Defaults to `false`.
 	*/
 	organization = (options) => {
-		return pgAttr(options?.nullable ?? true ? t.optional(t.uuid()) : t.uuid(), PG_ORGANIZATION);
+		const strict = options?.strict ?? false;
+		return pgAttr(options?.nullable ?? !strict ? z.uuid().optional() : z.uuid(), PG_ORGANIZATION, { strict });
 	};
 	/**
 	* Creates a reference to another table or schema. Basically a foreign key.
 	*/
 	ref = (type, ref, actions) => {
-		const finalActions = actions ?? { onDelete: t.schema.isOptional(type) ? "set null" : "cascade" };
+		const finalActions = actions ?? { onDelete: z.schema.isOptional(type) ? "set null" : "cascade" };
 		return this.attr(type, PG_REF, {
 			ref,
 			actions: finalActions
@@ -507,8 +521,8 @@ var DatabaseTypeProvider = class {
 	* Creates a page schema for a given object schema.
 	* It's used by {@link Repository#paginate} method.
 	*/
-	page = (resource, options) => {
-		return pageSchema$1(resource, options);
+	page = (resource) => {
+		return pageSchema$1(resource);
 	};
 };
 /**
@@ -534,7 +548,7 @@ const db = new DatabaseTypeProvider();
 /**
 * @deprecated Use `pg.primaryKey()` instead.
 */
-const legacyIdSchema = pgAttr(pgAttr(pgAttr(t.integer(), PG_PRIMARY_KEY), PG_SERIAL), PG_DEFAULT);
+const legacyIdSchema = pgAttr(pgAttr(pgAttr(z.integer(), PG_PRIMARY_KEY), PG_SERIAL), PG_DEFAULT);
 //#endregion
 //#region ../../src/orm/core/index.browser.ts
 const AlephaOrm = $module({