mcp-expose 1.0.0 → 1.1.0

package/dist/adonisjs/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/adonisjs/index.ts","../../src/core/dispatch.ts","../../src/core/node.ts","../../src/core/schema.ts","../../src/core/route-tool.ts","../../src/core/server.ts"],"sourcesContent":["import { Route } from '@adonisjs/core/http';\nimport type { IncomingMessage } from 'node:http';\nimport { createFetchDispatcher } from '../core/dispatch.js';\nimport { loopbackBaseUrl, normalizeHeaders, readRawBody } from '../core/node.js';\nimport { createRouteTool } from '../core/route-tool.js';\nimport { McpServer } from '../core/server.js';\nimport type { McpServerOptions, McpToolDefinition, RouteToolOptions, ToolContext } from '../core/types.js';\n\ndeclare module '@adonisjs/core/http' {\n  interface Route {\n    /**\n     * Expose this route as an MCP tool:\n     *\n     *   router.get('/orders/:id', [OrdersController, 'show']).use(middleware.auth()).mcp({ description: 'Get an order' })\n     */\n    mcp(options?: RouteToolOptions): this;\n  }\n}\n\n/** Routes marked with `.mcp()`, keyed by route instance. */\nconst marked = new Map<Route, RouteToolOptions>();\n\nRoute.macro('mcp', function (this: Route, options: RouteToolOptions = {}) {\n  marked.set(this, options);\n  return this;\n});\n\n/** Mark a route without the macro (same as `route.mcp(options)`). */\nexport function mcpTool<T extends Route>(route: T, options: RouteToolOptions = {}): T {\n  marked.set(route, options);\n  return route;\n}\n\ninterface RouterLike {\n  any(pattern: string, handler: (ctx: AdonisContext) => unknown): { as(name: string): unknown };\n  toJSON(): Record<string, { pattern: string; methods: string[] }[]>;\n}\n\ninterface AdonisContext {\n  request: {\n    request: IncomingMessage;\n    method(): string;\n    ip(): string;\n    headers(): Record<string, string | string[] | undefined>;\n    body(): unknown;\n    raw(): string | null;\n  };\n  response: {\n    status(code: number): unknown;\n    header(key: string, value: string): unknown;\n    send(body: unknown): unknown;\n  };\n}\n\nexport interface AdonisMcpOptions extends McpServerOptions {\n  /** Path of the MCP endpoint. @default '/mcp' */\n  path?: string;\n  /** Base URL for internal calls. Defaults to loopback on the port the MCP request arrived on. */\n  baseUrl?: string;\n  /** Extra hand-written tools (see `defineTool`). */\n  tools?: McpToolDefinition[];\n  /**\n   * Called with the MCP route so you can add middleware to the endpoint itself,\n   * e.g. `(route) => route.use(middleware.auth())`.\n   */\n  configureRoute?: (route: Route) => void;\n}\n\nfunction isEmptyObject(v: unknown): boolean {\n  return typeof v === 'object' && v !== null && !Array.isArray(v) && Object.keys(v).length === 0;\n}\n\n/**\n * Add an MCP endpoint to an AdonisJS (v6 / v7) router, usually in `start/routes.ts`:\n *\n *   import router from '@adonisjs/core/services/router'\n *   import { mountMcp } from 'mcp-expose/adonisjs'\n *\n *   router.get('/orders/:id', [OrdersController, 'show']).use(middleware.auth()).mcp({ description: 'Get an order' })\n *   mountMcp(router, { name: 'shop-api' })\n *\n * Group prefixes, route middleware (auth, throttle) and VineJS validators all\n * apply, because every tool call goes through the router like a normal request.\n */\nexport function mountMcp(router: RouterLike, options: AdonisMcpOptions): McpServer {\n  const path = options.path ?? '/mcp';\n  const server = new McpServer(options);\n  const dispatch = createFetchDispatcher({\n    baseUrl: options.baseUrl ?? ((ctx) => loopbackBaseUrl(ctx.raw as IncomingMessage)),\n  });\n\n  for (const t of options.tools ?? []) server.addTool(t);\n  server.onLoad(() => {\n    // Only routes registered on this router (after commit, with group prefixes applied).\n    const registered = new Set<string>();\n    for (const routes of Object.values(router.toJSON())) {\n      for (const r of routes) for (const m of r.methods) registered.add(`${m} ${r.pattern}`);\n    }\n    const seen = new Set<string>();\n    for (const [route, opts] of marked) {\n      if (route.isDeleted()) continue;\n      const { pattern, methods } = route.toJSON();\n      for (const method of methods) {\n        const key = `${method} ${pattern}`;\n        if (method === 'HEAD' || !registered.has(key) || seen.has(key)) continue;\n        seen.add(key);\n        server.addTool(createRouteTool({ method, path: pattern }, opts, dispatch, options));\n      }\n    }\n  });\n\n  const route = router.any(path, async (ctx: AdonisContext) => {\n    const req = ctx.request.request;\n    let body = ctx.request.body();\n    if (ctx.request.method() === 'POST' && (body === undefined || isEmptyObject(body))) {\n      // No bodyparser for this route (or a non-JSON content type): read it ourselves.\n      const raw = ctx.request.raw();\n      body = raw ?? (req.readable && !req.readableEnded ? await readRawBody(req) : body);\n    }\n    const toolCtx: ToolContext = {\n      headers: normalizeHeaders(ctx.request.headers()),\n      clientIp: ctx.request.ip(),\n      raw: req,\n    };\n    const out = await server.handleHttp({ method: ctx.request.method(), headers: toolCtx.headers, body }, toolCtx);\n    ctx.response.status(out.status);\n    for (const [k, v] of Object.entries(out.headers)) ctx.response.header(k, v);\n    ctx.response.send(out.body ?? '');\n  }) as unknown as Route;\n  route.as('mcp_expose.endpoint');\n  options.configureRoute?.(route);\n  return server;\n}\n","import type { Dispatcher, RouteRequest, ToolContext } from './types.js';\n\nexport function buildUrl(base: string, req: Pick<RouteRequest, 'path' | 'query'>): string {\n  const url = new URL(base.replace(/\\/+$/, '') + req.path);\n  for (const [k, v] of Object.entries(req.query)) {\n    for (const item of Array.isArray(v) ? v : [v]) url.searchParams.append(k, item);\n  }\n  return url.toString();\n}\n\nexport interface FetchDispatcherOptions {\n  /**\n   * Base URL of the API, e.g. `http://127.0.0.1:3000` or `https://api.example.com/v1`.\n   * A function lets adapters resolve it per call (e.g. from the local port).\n   */\n  baseUrl: string | ((ctx: ToolContext) => string);\n  /** Custom fetch implementation. Defaults to the global `fetch`. */\n  fetch?: typeof fetch;\n  /** Per-request timeout in ms. @default 30_000 */\n  timeoutMs?: number;\n}\n\n/**\n * Dispatches tool calls as real HTTP requests. Used for loopback calls into the\n * host app (Express, Koa, NestJS) and for standalone gateways in front of any API.\n */\nexport function createFetchDispatcher(opts: FetchDispatcherOptions): Dispatcher {\n  const doFetch = opts.fetch ?? fetch;\n  return async (req, ctx) => {\n    const base = typeof opts.baseUrl === 'function' ? opts.baseUrl(ctx) : opts.baseUrl;\n    const res = await doFetch(buildUrl(base, req), {\n      method: req.method,\n      headers: req.headers,\n      body:\n        req.body === undefined || req.method === 'GET' || req.method === 'HEAD' ? undefined : JSON.stringify(req.body),\n      signal: AbortSignal.timeout(opts.timeoutMs ?? 30_000),\n    });\n    const headers: Record<string, string> = {};\n    res.headers.forEach((v, k) => (headers[k] = v));\n    return { status: res.status, headers, body: await res.text() };\n  };\n}\n","import type { IncomingMessage, ServerResponse } from 'node:http';\nimport type { McpHttpResponse } from './server.js';\n\n/** Flatten Node's IncomingHttpHeaders into lower-cased single strings. */\nexport function normalizeHeaders(headers: Record<string, string | string[] | undefined>): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    if (v === undefined) continue;\n    out[k.toLowerCase()] = Array.isArray(v) ? v.join(', ') : String(v);\n  }\n  return out;\n}\n\n/** Read and return the raw body of a Node request (for frameworks without a JSON body parser). */\nexport function readRawBody(req: IncomingMessage, limit = 4 * 1024 * 1024): Promise<string> {\n  return new Promise((resolve, reject) => {\n    let size = 0;\n    const chunks: Buffer[] = [];\n    req.on('data', (c: Buffer) => {\n      size += c.length;\n      if (size > limit) {\n        reject(new Error('Request body too large'));\n        req.destroy();\n      } else chunks.push(c);\n    });\n    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));\n    req.on('error', reject);\n  });\n}\n\n/** Base URL that reaches the same server the MCP request arrived on. */\nexport function loopbackBaseUrl(req: IncomingMessage): string {\n  const socket = req.socket as IncomingMessage['socket'] & {\n    encrypted?: boolean;\n    server?: { address(): { address: string } | string | null };\n  };\n  const port = socket.localPort;\n  const encrypted = socket.encrypted;\n  // Prefer the address the server is bound to: when it listens on all\n  // interfaces this yields 127.0.0.1, so internal calls come from loopback\n  // (which `trust proxy: 'loopback'` style settings rely on).\n  const bound = socket.server?.address();\n  let host = (typeof bound === 'object' && bound?.address) || socket.localAddress || '127.0.0.1';\n  if (host.startsWith('::ffff:')) host = host.slice(7);\n  if (host === '::' || host === '0.0.0.0') host = '127.0.0.1';\n  if (host.includes(':')) host = `[${host}]`;\n  return `${encrypted ? 'https' : 'http'}://${host}:${port}`;\n}\n\nexport function writeNodeResponse(res: ServerResponse, out: McpHttpResponse): void {\n  res.statusCode = out.status;\n  for (const [k, v] of Object.entries(out.headers)) res.setHeader(k, v);\n  res.end(out.body);\n}\n","import type { JsonSchema, McpToolDefinition, SchemaLike } from './types.js';\n\ninterface StandardSchemaV1 {\n  '~standard': {\n    validate?: (value: unknown) => unknown;\n    jsonSchema?: { input?: (opts: { target: string }) => unknown };\n  };\n}\n\nfunction isStandard(s: unknown): s is StandardSchemaV1 {\n  return typeof s === 'object' && s !== null && '~standard' in s;\n}\n\n/** Convert any supported schema flavour into a plain JSON Schema object. */\nexport function toJsonSchema(schema: SchemaLike | undefined): JsonSchema | undefined {\n  if (schema === undefined || schema === null) return undefined;\n  let out: unknown;\n  if (isStandard(schema) && typeof schema['~standard'].jsonSchema?.input === 'function') {\n    out = schema['~standard'].jsonSchema.input({ target: 'draft-2020-12' });\n  } else if (typeof (schema as { toJSONSchema?: unknown }).toJSONSchema === 'function') {\n    out = (schema as { toJSONSchema(): unknown }).toJSONSchema();\n  } else if (isStandard(schema)) {\n    throw new Error(\n      'mcp-expose: this schema library does not support JSON Schema export. Pass a plain JSON Schema instead.',\n    );\n  } else {\n    out = schema;\n  }\n  const { $schema: _ignored, ...rest } = out as JsonSchema;\n  return rest;\n}\n\n/** Build a validator from a Standard Schema, if the input is one. */\nexport function toValidator(schema: SchemaLike | undefined): McpToolDefinition['validate'] {\n  if (!isStandard(schema) || typeof schema['~standard'].validate !== 'function') return undefined;\n  const validate = schema['~standard'].validate;\n  return async (value) => {\n    const result = (await validate(value)) as {\n      value?: unknown;\n      issues?: { message: string; path?: (PropertyKey | { key: PropertyKey })[] }[];\n    };\n    if (!result.issues) return { ok: true, value: result.value };\n    const message = result.issues\n      .map((i) => {\n        const path = (i.path ?? []).map((p) => (typeof p === 'object' ? String(p.key) : String(p))).join('.');\n        return path ? `${path}: ${i.message}` : i.message;\n      })\n      .join('; ');\n    return { ok: false, message };\n  };\n}\n\n/** Very small structural check used when no Standard Schema validator exists. */\nexport function checkRequired(schema: JsonSchema, args: Record<string, unknown>): string | undefined {\n  const missing = (schema.required ?? []).filter((k) => args[k] === undefined);\n  return missing.length ? `Missing required argument(s): ${missing.join(', ')}` : undefined;\n}\n","import { checkRequired, toJsonSchema, toValidator } from './schema.js';\nimport type {\n  Dispatcher,\n  JsonSchema,\n  McpServerOptions,\n  McpToolDefinition,\n  RouteResponse,\n  RouteSpec,\n  RouteToolOptions,\n  ToolAnnotations,\n  ToolContext,\n  ToolResult,\n} from './types.js';\n\nexport const DEFAULT_FORWARD_HEADERS = ['authorization', 'cookie', 'x-api-key', 'accept-language'];\nconst BODY_METHODS = new Set(['POST', 'PUT', 'PATCH']);\nconst PARAM_RE = /:([A-Za-z0-9_]+)\\??|\\{([A-Za-z0-9_]+)\\}/g;\n\n/** Names of the path parameters in a route path (`/a/:id/{slug}` -> ['id', 'slug']). */\nexport function pathParams(path: string): string[] {\n  return [...path.matchAll(PARAM_RE)].map((m) => (m[1] ?? m[2]) as string);\n}\n\n/**\n * Encode one path-parameter value. Rejects empty, `.` and `..` values: after URL\n * normalisation they would change which route is called (e.g. `/orders/../admin`),\n * letting an agent reach routes that were never exposed as tools.\n */\nfunction encodeSegment(name: string, value: unknown): string {\n  const raw = String(value);\n  if (raw === '' || raw === '.' || raw === '..') {\n    throw new Error(`Invalid value for path parameter \"${name}\": ${JSON.stringify(raw)}`);\n  }\n  return encodeURIComponent(raw);\n}\n\n/** Replace path placeholders with URL-encoded values. Missing optional params drop their segment. */\nexport function interpolatePath(path: string, values: Record<string, unknown>): string {\n  return path\n    .replace(/\\/:([A-Za-z0-9_]+)\\?/g, (_, k: string) =>\n      values[k] === undefined ? '' : `/${encodeSegment(k, values[k])}`,\n    )\n    .replace(PARAM_RE, (_, a?: string, b?: string) => {\n      const k = (a ?? b) as string;\n      return encodeSegment(k, values[k]);\n    });\n}\n\n/** Join path segments, normalising slashes. */\nexport function joinPaths(...parts: (string | undefined)[]): string {\n  const joined = parts\n    .filter((p): p is string => !!p && p !== '/')\n    .map((p) => p.replace(/^\\/+|\\/+$/g, ''))\n    .filter(Boolean)\n    .join('/');\n  return `/${joined}`;\n}\n\n/** `GET /users/:id/orders` -> `get_users_by_id_orders` */\nexport function toolNameFromRoute(method: string, path: string): string {\n  const segments = path\n    .split('/')\n    .filter(Boolean)\n    .map((s) => {\n      const m = /^(?::([A-Za-z0-9_]+)\\??|\\{([A-Za-z0-9_]+)\\})$/.exec(s);\n      return m ? `by_${m[1] ?? m[2]}` : s;\n    });\n  return sanitizeToolName([method.toLowerCase(), ...segments].join('_'));\n}\n\nexport function sanitizeToolName(name: string): string {\n  return name\n    .replace(/[^A-Za-z0-9_-]+/g, '_')\n    .replace(/_+/g, '_')\n    .replace(/^_|_$/g, '')\n    .slice(0, 64);\n}\n\nfunction defaultAnnotations(method: string): ToolAnnotations {\n  switch (method) {\n    case 'GET':\n    case 'HEAD':\n      return { readOnlyHint: true, openWorldHint: false };\n    case 'DELETE':\n      return { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false };\n    case 'PUT':\n      return { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false };\n    default:\n      return { readOnlyHint: false, destructiveHint: false, openWorldHint: false };\n  }\n}\n\ninterface ArgMapping {\n  params: string[];\n  query: Set<string>;\n  body: Set<string>;\n  /** Body schema is not an object: the whole body is passed under the `body` key. */\n  wholeBody: boolean;\n  bodyMethod: boolean;\n}\n\n/**\n * Build the flat input schema an agent sees, and remember which argument goes\n * to the path, query string or body when the tool is called.\n */\nexport function buildInputSchema(\n  route: RouteSpec,\n  opts: RouteToolOptions,\n): { schema: JsonSchema; mapping: ArgMapping } {\n  const method = route.method.toUpperCase();\n  const params = pathParams(route.path);\n  const mapping: ArgMapping = {\n    params,\n    query: new Set(),\n    body: new Set(),\n    wholeBody: false,\n    bodyMethod: BODY_METHODS.has(method),\n  };\n\n  if (opts.input) {\n    const schema = toJsonSchema(opts.input) as JsonSchema;\n    return { schema: { type: 'object', ...schema }, mapping };\n  }\n\n  const properties: Record<string, JsonSchema> = {};\n  const required = new Set<string>();\n\n  const paramSchema = toJsonSchema(opts.params);\n  for (const p of params) {\n    properties[p] = paramSchema?.properties?.[p] ?? { type: 'string', description: `Path parameter \"${p}\"` };\n    if (!route.path.includes(`:${p}?`)) required.add(p);\n  }\n\n  const querySchema = toJsonSchema(opts.query);\n  for (const [k, v] of Object.entries(querySchema?.properties ?? {})) {\n    properties[k] = v;\n    mapping.query.add(k);\n  }\n  for (const k of querySchema?.required ?? []) required.add(k);\n\n  const bodySchema = toJsonSchema(opts.body);\n  if (bodySchema) {\n    if (bodySchema.properties && (bodySchema.type === undefined || bodySchema.type === 'object')) {\n      for (const [k, v] of Object.entries(bodySchema.properties)) {\n        properties[k] = v;\n        mapping.body.add(k);\n      }\n      for (const k of bodySchema.required ?? []) required.add(k);\n    } else {\n      properties.body = bodySchema;\n      required.add('body');\n      mapping.wholeBody = true;\n    }\n  }\n\n  const schema: JsonSchema = { type: 'object', properties };\n  if (required.size) schema.required = [...required];\n  return { schema, mapping };\n}\n\nfunction splitArgs(args: Record<string, unknown>, mapping: ArgMapping) {\n  const pathValues: Record<string, unknown> = {};\n  const query: Record<string, string | string[]> = {};\n  let body: Record<string, unknown> | unknown | undefined;\n\n  for (const [k, v] of Object.entries(args)) {\n    if (v === undefined) continue;\n    if (mapping.params.includes(k)) {\n      pathValues[k] = v;\n    } else if (mapping.wholeBody && k === 'body') {\n      body = v;\n    } else if (mapping.query.has(k) || (!mapping.body.has(k) && !mapping.bodyMethod)) {\n      query[k] = Array.isArray(v) ? v.map(String) : typeof v === 'object' && v !== null ? JSON.stringify(v) : String(v);\n    } else {\n      body = { ...((body as Record<string, unknown>) ?? {}), [k]: v };\n    }\n  }\n  if (body === undefined && mapping.bodyMethod) body = {};\n  return { pathValues, query, body };\n}\n\nexport function responseToResult(res: RouteResponse, maxChars: number): ToolResult {\n  let text = res.body;\n  if (text.length > maxChars) text = `${text.slice(0, maxChars)}\\n…[truncated ${text.length - maxChars} chars]`;\n  const isError = res.status >= 400;\n  const result: ToolResult = {\n    content: [{ type: 'text', text: isError ? `HTTP ${res.status}\\n${text}` : text || `HTTP ${res.status}` }],\n  };\n  if (isError) {\n    result.isError = true;\n    return result;\n  }\n  if ((res.headers['content-type'] ?? '').includes('json') && text === res.body) {\n    try {\n      const parsed = JSON.parse(res.body);\n      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) result.structuredContent = parsed;\n    } catch {\n      /* not JSON after all */\n    }\n  }\n  return result;\n}\n\nexport function pickForwardHeaders(ctx: ToolContext, names: string[]): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const name of names) {\n    const v = ctx.headers[name.toLowerCase()];\n    if (v !== undefined) out[name.toLowerCase()] = v;\n  }\n  return out;\n}\n\n/**\n * Turn an HTTP route + options into an MCP tool whose handler calls the route\n * through `dispatch`, so auth guards, validation and rate limits all still apply.\n */\nexport function createRouteTool(\n  route: RouteSpec,\n  opts: RouteToolOptions,\n  dispatch: Dispatcher,\n  serverOpts: Pick<McpServerOptions, 'forwardHeaders' | 'maxResponseChars'> = {},\n): McpToolDefinition {\n  const method = route.method.toUpperCase();\n  const name = sanitizeToolName(opts.name ?? toolNameFromRoute(method, route.path));\n  const { schema, mapping } = buildInputSchema(route, opts);\n  const forward = serverOpts.forwardHeaders ?? DEFAULT_FORWARD_HEADERS;\n  const maxChars = serverOpts.maxResponseChars ?? 100_000;\n\n  return {\n    name,\n    title: opts.title,\n    description: opts.description ?? `${method} ${route.path}`,\n    inputSchema: schema,\n    annotations: { ...defaultAnnotations(method), ...opts.annotations },\n    validate: toValidator(opts.input),\n    async handler(args, ctx) {\n      const missing = opts.input ? undefined : checkRequired(schema, args);\n      if (missing) return { isError: true, content: [{ type: 'text', text: missing }] };\n\n      const { pathValues, query, body } = splitArgs(args, mapping);\n      const headers: Record<string, string> = {\n        accept: 'application/json',\n        ...pickForwardHeaders(ctx, forward),\n        ...opts.headers,\n        'x-mcp-tool': name,\n      };\n      if (ctx.clientIp) headers['x-forwarded-for'] = ctx.clientIp;\n      if (body !== undefined) headers['content-type'] = 'application/json';\n\n      let path: string;\n      try {\n        path = interpolatePath(route.path, pathValues);\n      } catch (err) {\n        return { isError: true, content: [{ type: 'text', text: (err as Error).message }] };\n      }\n      const res = await dispatch({ method, path, query, body, headers }, ctx);\n      return responseToResult(res, maxChars);\n    },\n  };\n}\n","import type { McpServerOptions, McpToolDefinition, ToolContext, ToolResult } from './types.js';\n\nexport const SUPPORTED_PROTOCOL_VERSIONS = ['2025-11-25', '2025-06-18', '2025-03-26', '2024-11-05'];\nexport const LATEST_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSIONS[0] as string;\n\ntype JsonRpcId = string | number | null;\ninterface JsonRpcRequest {\n  jsonrpc: '2.0';\n  id?: JsonRpcId;\n  method: string;\n  params?: Record<string, unknown>;\n}\nexport interface JsonRpcResponse {\n  jsonrpc: '2.0';\n  id: JsonRpcId;\n  result?: unknown;\n  error?: { code: number; message: string; data?: unknown };\n}\n\nconst PARSE_ERROR = -32700;\nconst INVALID_REQUEST = -32600;\nconst METHOD_NOT_FOUND = -32601;\nconst INVALID_PARAMS = -32602;\n\nconst ok = (id: JsonRpcId, result: unknown): JsonRpcResponse => ({ jsonrpc: '2.0', id, result });\nconst fail = (id: JsonRpcId, code: number, message: string): JsonRpcResponse => ({\n  jsonrpc: '2.0',\n  id,\n  error: { code, message },\n});\n\n/** Minimal HTTP request/response shapes, so each adapter can bridge its own framework. */\nexport interface McpHttpRequest {\n  method: string;\n  headers: Record<string, string>;\n  /** Parsed JSON body, or the raw string. */\n  body: unknown;\n}\nexport interface McpHttpResponse {\n  status: number;\n  headers: Record<string, string>;\n  body?: string;\n}\n\n/**\n * A stateless MCP server speaking the Streamable HTTP transport (JSON responses).\n * Holds the tool registry and answers JSON-RPC messages.\n */\nexport class McpServer {\n  private readonly tools = new Map<string, McpToolDefinition>();\n  private loaders: (() => void | Promise<void>)[] = [];\n\n  constructor(readonly options: McpServerOptions) {}\n\n  /** Register a tool. Throws on duplicate names. */\n  addTool(tool: McpToolDefinition): this {\n    if (this.tools.has(tool.name)) {\n      throw new Error(`mcp-expose: duplicate tool name \"${tool.name}\". Set an explicit \\`name\\`.`);\n    }\n    this.tools.set(tool.name, tool);\n    return this;\n  }\n\n  /** Register a function that adds tools lazily, right before the first MCP request is served. */\n  onLoad(loader: () => void | Promise<void>): this {\n    this.loaders.push(loader);\n    return this;\n  }\n\n  async listTools(): Promise<McpToolDefinition[]> {\n    await this.load();\n    return [...this.tools.values()];\n  }\n\n  private async load() {\n    if (!this.loaders.length) return;\n    const loaders = this.loaders;\n    this.loaders = [];\n    for (const l of loaders) await l();\n  }\n\n  /** Handle one JSON-RPC message (or a batch). Returns null when no response is due. */\n  async handleMessage(message: unknown, ctx: ToolContext): Promise<JsonRpcResponse | JsonRpcResponse[] | null> {\n    if (Array.isArray(message)) {\n      const results = (await Promise.all(message.map((m) => this.handleOne(m, ctx)))).filter(\n        (r): r is JsonRpcResponse => r !== null,\n      );\n      return results.length ? results : null;\n    }\n    return this.handleOne(message, ctx);\n  }\n\n  private async handleOne(message: unknown, ctx: ToolContext): Promise<JsonRpcResponse | null> {\n    const msg = message as Partial<JsonRpcRequest>;\n    if (!msg || typeof msg !== 'object' || msg.jsonrpc !== '2.0') {\n      return fail(null, INVALID_REQUEST, 'Invalid JSON-RPC message');\n    }\n    // Responses from the client or notifications: acknowledge, no reply.\n    if (typeof msg.method !== 'string' || msg.id === undefined) return null;\n    const id = msg.id;\n    const params = msg.params ?? {};\n\n    await this.load();\n    switch (msg.method) {\n      case 'initialize': {\n        const requested = params.protocolVersion as string | undefined;\n        const protocolVersion =\n          requested && SUPPORTED_PROTOCOL_VERSIONS.includes(requested) ? requested : LATEST_PROTOCOL_VERSION;\n        return ok(id, {\n          protocolVersion,\n          capabilities: { tools: { listChanged: false } },\n          serverInfo: { name: this.options.name, version: this.options.version ?? '1.0.0' },\n          ...(this.options.instructions ? { instructions: this.options.instructions } : {}),\n        });\n      }\n      case 'ping':\n        return ok(id, {});\n      case 'tools/list':\n        return ok(id, {\n          tools: [...this.tools.values()].map((t) => ({\n            name: t.name,\n            ...(t.title ? { title: t.title } : {}),\n            description: t.description,\n            inputSchema: t.inputSchema,\n            ...(t.annotations ? { annotations: t.annotations } : {}),\n          })),\n        });\n      case 'tools/call': {\n        const tool = this.tools.get(params.name as string);\n        if (!tool) return fail(id, INVALID_PARAMS, `Unknown tool: ${String(params.name)}`);\n        return ok(id, await this.callTool(tool, (params.arguments ?? {}) as Record<string, unknown>, ctx));\n      }\n      case 'resources/list':\n        return ok(id, { resources: [] });\n      case 'prompts/list':\n        return ok(id, { prompts: [] });\n      default:\n        return fail(id, METHOD_NOT_FOUND, `Method not found: ${msg.method}`);\n    }\n  }\n\n  private async callTool(\n    tool: McpToolDefinition,\n    args: Record<string, unknown>,\n    ctx: ToolContext,\n  ): Promise<ToolResult> {\n    try {\n      if (tool.validate) {\n        const v = await tool.validate(args);\n        if (!v.ok) return { isError: true, content: [{ type: 'text', text: `Invalid arguments: ${v.message}` }] };\n        args = v.value as Record<string, unknown>;\n      }\n      return await tool.handler(args, ctx);\n    } catch (err) {\n      // Tool failures are reported in-band so the model can react to them.\n      return { isError: true, content: [{ type: 'text', text: `Tool error: ${(err as Error).message}` }] };\n    }\n  }\n\n  /** Check the Origin header (DNS rebinding protection). */\n  isOriginAllowed(origin: string | undefined): boolean {\n    if (!origin) return true;\n    const allowed = this.options.allowedOrigins;\n    if (allowed === '*') return true;\n    return (allowed ?? []).includes(origin);\n  }\n\n  /**\n   * Framework-neutral Streamable HTTP handler. Adapters convert their request\n   * into McpHttpRequest, call this, and write the McpHttpResponse back.\n   */\n  async handleHttp(req: McpHttpRequest, ctx: ToolContext): Promise<McpHttpResponse> {\n    const json = { 'content-type': 'application/json' };\n    if (!this.isOriginAllowed(req.headers.origin)) {\n      return { status: 403, headers: json, body: JSON.stringify(fail(null, INVALID_REQUEST, 'Origin not allowed')) };\n    }\n    if (req.method.toUpperCase() !== 'POST') {\n      // Stateless server: no standalone SSE stream and no sessions to delete.\n      return { status: 405, headers: { allow: 'POST' } };\n    }\n    let body = req.body;\n    if (typeof body === 'string' || body instanceof Uint8Array) {\n      try {\n        body = JSON.parse(typeof body === 'string' ? body : new TextDecoder().decode(body));\n      } catch {\n        return { status: 400, headers: json, body: JSON.stringify(fail(null, PARSE_ERROR, 'Parse error')) };\n      }\n    }\n    const response = await this.handleMessage(body, ctx);\n    if (response === null) return { status: 202, headers: {} };\n    return { status: 200, headers: json, body: JSON.stringify(response) };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;kBAAsB;;;ACEf,SAASA,SAASC,MAAcC,KAAyC;AAC9E,QAAMC,MAAM,IAAIC,IAAIH,KAAKI,QAAQ,QAAQ,EAAA,IAAMH,IAAII,IAAI;AACvD,aAAW,CAACC,GAAGC,CAAAA,KAAMC,OAAOC,QAAQR,IAAIS,KAAK,GAAG;AAC9C,eAAWC,QAAQC,MAAMC,QAAQN,CAAAA,IAAKA,IAAI;MAACA;MAAIL,KAAIY,aAAaC,OAAOT,GAAGK,IAAAA;EAC5E;AACA,SAAOT,IAAIc,SAAQ;AACrB;AANgBjB;AAwBT,SAASkB,sBAAsBC,MAA4B;AAChE,QAAMC,UAAUD,KAAKE,SAASA;AAC9B,SAAO,OAAOnB,KAAKoB,QAAAA;AACjB,UAAMrB,OAAO,OAAOkB,KAAKI,YAAY,aAAaJ,KAAKI,QAAQD,GAAAA,IAAOH,KAAKI;AAC3E,UAAMC,MAAM,MAAMJ,QAAQpB,SAASC,MAAMC,GAAAA,GAAM;MAC7CuB,QAAQvB,IAAIuB;MACZC,SAASxB,IAAIwB;MACbC,MACEzB,IAAIyB,SAASC,UAAa1B,IAAIuB,WAAW,SAASvB,IAAIuB,WAAW,SAASG,SAAYC,KAAKC,UAAU5B,IAAIyB,IAAI;MAC/GI,QAAQC,YAAYC,QAAQd,KAAKe,aAAa,GAAA;IAChD,CAAA;AACA,UAAMR,UAAkC,CAAC;AACzCF,QAAIE,QAAQS,QAAQ,CAAC3B,GAAGD,MAAOmB,QAAQnB,CAAAA,IAAKC,CAAAA;AAC5C,WAAO;MAAE4B,QAAQZ,IAAIY;MAAQV;MAASC,MAAM,MAAMH,IAAIa,KAAI;IAAG;EAC/D;AACF;AAfgBnB;;;ACtBT,SAASoB,iBAAiBC,SAAsD;AACrF,QAAMC,MAA8B,CAAC;AACrC,aAAW,CAACC,GAAGC,CAAAA,KAAMC,OAAOC,QAAQL,OAAAA,GAAU;AAC5C,QAAIG,MAAMG,OAAW;AACrBL,QAAIC,EAAEK,YAAW,CAAA,IAAMC,MAAMC,QAAQN,CAAAA,IAAKA,EAAEO,KAAK,IAAA,IAAQC,OAAOR,CAAAA;EAClE;AACA,SAAOF;AACT;AAPgBF;AAUT,SAASa,YAAYC,KAAsBC,QAAQ,IAAI,OAAO,MAAI;AACvE,SAAO,IAAIC,QAAQ,CAACC,SAASC,WAAAA;AAC3B,QAAIC,OAAO;AACX,UAAMC,SAAmB,CAAA;AACzBN,QAAIO,GAAG,QAAQ,CAACC,MAAAA;AACdH,cAAQG,EAAEC;AACV,UAAIJ,OAAOJ,OAAO;AAChBG,eAAO,IAAIM,MAAM,wBAAA,CAAA;AACjBV,YAAIW,QAAO;MACb,MAAOL,QAAOM,KAAKJ,CAAAA;IACrB,CAAA;AACAR,QAAIO,GAAG,OAAO,MAAMJ,QAAQU,OAAOC,OAAOR,MAAAA,EAAQS,SAAS,MAAA,CAAA,CAAA;AAC3Df,QAAIO,GAAG,SAASH,MAAAA;EAClB,CAAA;AACF;AAdgBL;AAiBT,SAASiB,gBAAgBhB,KAAoB;AAClD,QAAMiB,SAASjB,IAAIiB;AAInB,QAAMC,OAAOD,OAAOE;AACpB,QAAMC,YAAYH,OAAOG;AAIzB,QAAMC,QAAQJ,OAAOK,QAAQC,QAAAA;AAC7B,MAAIC,OAAQ,OAAOH,UAAU,YAAYA,OAAOE,WAAYN,OAAOQ,gBAAgB;AACnF,MAAID,KAAKE,WAAW,SAAA,EAAYF,QAAOA,KAAKG,MAAM,CAAA;AAClD,MAAIH,SAAS,QAAQA,SAAS,UAAWA,QAAO;AAChD,MAAIA,KAAKI,SAAS,GAAA,EAAMJ,QAAO,IAAIA,IAAAA;AACnC,SAAO,GAAGJ,YAAY,UAAU,MAAA,MAAYI,IAAAA,IAAQN,IAAAA;AACtD;AAhBgBF;;;ACtBhB,SAASa,WAAWC,GAAU;AAC5B,SAAO,OAAOA,MAAM,YAAYA,MAAM,QAAQ,eAAeA;AAC/D;AAFSD;AAKF,SAASE,aAAaC,QAA8B;AACzD,MAAIA,WAAWC,UAAaD,WAAW,KAAM,QAAOC;AACpD,MAAIC;AACJ,MAAIL,WAAWG,MAAAA,KAAW,OAAOA,OAAO,WAAA,EAAaG,YAAYC,UAAU,YAAY;AACrFF,UAAMF,OAAO,WAAA,EAAaG,WAAWC,MAAM;MAAEC,QAAQ;IAAgB,CAAA;EACvE,WAAW,OAAQL,OAAsCM,iBAAiB,YAAY;AACpFJ,UAAOF,OAAuCM,aAAY;EAC5D,WAAWT,WAAWG,MAAAA,GAAS;AAC7B,UAAM,IAAIO,MACR,wGAAA;EAEJ,OAAO;AACLL,UAAMF;EACR;AACA,QAAM,EAAEQ,SAASC,UAAU,GAAGC,KAAAA,IAASR;AACvC,SAAOQ;AACT;AAhBgBX;AAmBT,SAASY,YAAYX,QAA8B;AACxD,MAAI,CAACH,WAAWG,MAAAA,KAAW,OAAOA,OAAO,WAAA,EAAaY,aAAa,WAAY,QAAOX;AACtF,QAAMW,WAAWZ,OAAO,WAAA,EAAaY;AACrC,SAAO,OAAOC,UAAAA;AACZ,UAAMC,SAAU,MAAMF,SAASC,KAAAA;AAI/B,QAAI,CAACC,OAAOC,OAAQ,QAAO;MAAEC,IAAI;MAAMH,OAAOC,OAAOD;IAAM;AAC3D,UAAMI,UAAUH,OAAOC,OACpBG,IAAI,CAACC,MAAAA;AACJ,YAAMC,QAAQD,EAAEC,QAAQ,CAAA,GAAIF,IAAI,CAACG,MAAO,OAAOA,MAAM,WAAWC,OAAOD,EAAEE,GAAG,IAAID,OAAOD,CAAAA,CAAAA,EAAKG,KAAK,GAAA;AACjG,aAAOJ,OAAO,GAAGA,IAAAA,KAASD,EAAEF,OAAO,KAAKE,EAAEF;IAC5C,CAAA,EACCO,KAAK,IAAA;AACR,WAAO;MAAER,IAAI;MAAOC;IAAQ;EAC9B;AACF;AAjBgBN;AAoBT,SAASc,cAAczB,QAAoB0B,MAA6B;AAC7E,QAAMC,WAAW3B,OAAO4B,YAAY,CAAA,GAAIC,OAAO,CAACC,MAAMJ,KAAKI,CAAAA,MAAO7B,MAAAA;AAClE,SAAO0B,QAAQI,SAAS,iCAAiCJ,QAAQH,KAAK,IAAA,CAAA,KAAUvB;AAClF;AAHgBwB;;;ACvCT,IAAMO,0BAA0B;EAAC;EAAiB;EAAU;EAAa;;AAChF,IAAMC,eAAe,oBAAIC,IAAI;EAAC;EAAQ;EAAO;CAAQ;AACrD,IAAMC,WAAW;AAGV,SAASC,WAAWC,MAAY;AACrC,SAAO;OAAIA,KAAKC,SAASH,QAAAA;IAAWI,IAAI,CAACC,MAAOA,EAAE,CAAA,KAAMA,EAAE,CAAA,CAAE;AAC9D;AAFgBJ;AAShB,SAASK,cAAcC,MAAcC,OAAc;AACjD,QAAMC,MAAMC,OAAOF,KAAAA;AACnB,MAAIC,QAAQ,MAAMA,QAAQ,OAAOA,QAAQ,MAAM;AAC7C,UAAM,IAAIE,MAAM,qCAAqCJ,IAAAA,MAAUK,KAAKC,UAAUJ,GAAAA,CAAAA,EAAM;EACtF;AACA,SAAOK,mBAAmBL,GAAAA;AAC5B;AANSH;AASF,SAASS,gBAAgBb,MAAcc,QAA+B;AAC3E,SAAOd,KACJe,QAAQ,yBAAyB,CAACC,GAAGC,MACpCH,OAAOG,CAAAA,MAAOC,SAAY,KAAK,IAAId,cAAca,GAAGH,OAAOG,CAAAA,CAAE,CAAA,EAAG,EAEjEF,QAAQjB,UAAU,CAACkB,GAAGG,GAAYC,MAAAA;AACjC,UAAMH,IAAKE,KAAKC;AAChB,WAAOhB,cAAca,GAAGH,OAAOG,CAAAA,CAAE;EACnC,CAAA;AACJ;AATgBJ;AAsBT,SAASQ,kBAAkBC,QAAgBC,MAAY;AAC5D,QAAMC,WAAWD,KACdE,MAAM,GAAA,EACNC,OAAOC,OAAAA,EACPC,IAAI,CAACC,MAAAA;AACJ,UAAMC,IAAI,gDAAgDC,KAAKF,CAAAA;AAC/D,WAAOC,IAAI,MAAMA,EAAE,CAAA,KAAMA,EAAE,CAAA,CAAE,KAAKD;EACpC,CAAA;AACF,SAAOG,iBAAiB;IAACV,OAAOW,YAAW;OAAOT;IAAUU,KAAK,GAAA,CAAA;AACnE;AATgBb;AAWT,SAASW,iBAAiBG,MAAY;AAC3C,SAAOA,KACJC,QAAQ,oBAAoB,GAAA,EAC5BA,QAAQ,OAAO,GAAA,EACfA,QAAQ,UAAU,EAAA,EAClBC,MAAM,GAAG,EAAA;AACd;AANgBL;AAQhB,SAASM,mBAAmBhB,QAAc;AACxC,UAAQA,QAAAA;IACN,KAAK;IACL,KAAK;AACH,aAAO;QAAEiB,cAAc;QAAMC,eAAe;MAAM;IACpD,KAAK;AACH,aAAO;QAAED,cAAc;QAAOE,iBAAiB;QAAMC,gBAAgB;QAAMF,eAAe;MAAM;IAClG,KAAK;AACH,aAAO;QAAED,cAAc;QAAOE,iBAAiB;QAAOC,gBAAgB;QAAMF,eAAe;MAAM;IACnG;AACE,aAAO;QAAED,cAAc;QAAOE,iBAAiB;QAAOD,eAAe;MAAM;EAC/E;AACF;AAZSF;AA2BF,SAASK,iBACdC,OACAC,MAAsB;AAEtB,QAAMvB,SAASsB,MAAMtB,OAAOwB,YAAW;AACvC,QAAMC,SAASC,WAAWJ,MAAMrB,IAAI;AACpC,QAAM0B,UAAsB;IAC1BF;IACAG,OAAO,oBAAIC,IAAAA;IACXC,MAAM,oBAAID,IAAAA;IACVE,WAAW;IACXC,YAAYC,aAAaC,IAAIlC,MAAAA;EAC/B;AAEA,MAAIuB,KAAKY,OAAO;AACd,UAAMC,UAASC,aAAad,KAAKY,KAAK;AACtC,WAAO;MAAEC,QAAQ;QAAEE,MAAM;QAAU,GAAGF;MAAO;MAAGT;IAAQ;EAC1D;AAEA,QAAMY,aAAyC,CAAC;AAChD,QAAMC,WAAW,oBAAIX,IAAAA;AAErB,QAAMY,cAAcJ,aAAad,KAAKE,MAAM;AAC5C,aAAWiB,KAAKjB,QAAQ;AACtBc,eAAWG,CAAAA,IAAKD,aAAaF,aAAaG,CAAAA,KAAM;MAAEJ,MAAM;MAAUK,aAAa,mBAAmBD,CAAAA;IAAK;AACvG,QAAI,CAACpB,MAAMrB,KAAK2C,SAAS,IAAIF,CAAAA,GAAI,EAAGF,UAASK,IAAIH,CAAAA;EACnD;AAEA,QAAMI,cAAcT,aAAad,KAAKK,KAAK;AAC3C,aAAW,CAACmB,GAAGC,CAAAA,KAAMC,OAAOC,QAAQJ,aAAaP,cAAc,CAAC,CAAA,GAAI;AAClEA,eAAWQ,CAAAA,IAAKC;AAChBrB,YAAQC,MAAMiB,IAAIE,CAAAA;EACpB;AACA,aAAWA,KAAKD,aAAaN,YAAY,CAAA,EAAIA,UAASK,IAAIE,CAAAA;AAE1D,QAAMI,aAAad,aAAad,KAAKO,IAAI;AACzC,MAAIqB,YAAY;AACd,QAAIA,WAAWZ,eAAeY,WAAWb,SAASc,UAAaD,WAAWb,SAAS,WAAW;AAC5F,iBAAW,CAACS,GAAGC,CAAAA,KAAMC,OAAOC,QAAQC,WAAWZ,UAAU,GAAG;AAC1DA,mBAAWQ,CAAAA,IAAKC;AAChBrB,gBAAQG,KAAKe,IAAIE,CAAAA;MACnB;AACA,iBAAWA,KAAKI,WAAWX,YAAY,CAAA,EAAIA,UAASK,IAAIE,CAAAA;IAC1D,OAAO;AACLR,iBAAWT,OAAOqB;AAClBX,eAASK,IAAI,MAAA;AACblB,cAAQI,YAAY;IACtB;EACF;AAEA,QAAMK,SAAqB;IAAEE,MAAM;IAAUC;EAAW;AACxD,MAAIC,SAASa,KAAMjB,QAAOI,WAAW;OAAIA;;AACzC,SAAO;IAAEJ;IAAQT;EAAQ;AAC3B;AArDgBN;AAuDhB,SAASiC,UAAUC,MAA+B5B,SAAmB;AACnE,QAAM6B,aAAsC,CAAC;AAC7C,QAAM5B,QAA2C,CAAC;AAClD,MAAIE;AAEJ,aAAW,CAACiB,GAAGC,CAAAA,KAAMC,OAAOC,QAAQK,IAAAA,GAAO;AACzC,QAAIP,MAAMI,OAAW;AACrB,QAAIzB,QAAQF,OAAOmB,SAASG,CAAAA,GAAI;AAC9BS,iBAAWT,CAAAA,IAAKC;IAClB,WAAWrB,QAAQI,aAAagB,MAAM,QAAQ;AAC5CjB,aAAOkB;IACT,WAAWrB,QAAQC,MAAMM,IAAIa,CAAAA,KAAO,CAACpB,QAAQG,KAAKI,IAAIa,CAAAA,KAAM,CAACpB,QAAQK,YAAa;AAChFJ,YAAMmB,CAAAA,IAAKU,MAAMC,QAAQV,CAAAA,IAAKA,EAAE1C,IAAIqD,MAAAA,IAAU,OAAOX,MAAM,YAAYA,MAAM,OAAOY,KAAKC,UAAUb,CAAAA,IAAKW,OAAOX,CAAAA;IACjH,OAAO;AACLlB,aAAO;QAAE,GAAKA,QAAoC,CAAC;QAAI,CAACiB,CAAAA,GAAIC;MAAE;IAChE;EACF;AACA,MAAIlB,SAASsB,UAAazB,QAAQK,WAAYF,QAAO,CAAC;AACtD,SAAO;IAAE0B;IAAY5B;IAAOE;EAAK;AACnC;AAnBSwB;AAqBF,SAASQ,iBAAiBC,KAAoBC,UAAgB;AACnE,MAAIC,OAAOF,IAAIjC;AACf,MAAImC,KAAKC,SAASF,SAAUC,QAAO,GAAGA,KAAKlD,MAAM,GAAGiD,QAAAA,CAAAA;mBAA0BC,KAAKC,SAASF,QAAAA;AAC5F,QAAMG,UAAUJ,IAAIK,UAAU;AAC9B,QAAMC,SAAqB;IACzBC,SAAS;MAAC;QAAEhC,MAAM;QAAQ2B,MAAME,UAAU,QAAQJ,IAAIK,MAAM;EAAKH,IAAAA,KAASA,QAAQ,QAAQF,IAAIK,MAAM;MAAG;;EACzG;AACA,MAAID,SAAS;AACXE,WAAOF,UAAU;AACjB,WAAOE;EACT;AACA,OAAKN,IAAIQ,QAAQ,cAAA,KAAmB,IAAI3B,SAAS,MAAA,KAAWqB,SAASF,IAAIjC,MAAM;AAC7E,QAAI;AACF,YAAM0C,SAASZ,KAAKa,MAAMV,IAAIjC,IAAI;AAClC,UAAI0C,UAAU,OAAOA,WAAW,YAAY,CAACf,MAAMC,QAAQc,MAAAA,EAASH,QAAOK,oBAAoBF;IACjG,QAAQ;IAER;EACF;AACA,SAAOH;AACT;AApBgBP;AAsBT,SAASa,mBAAmBC,KAAkBC,OAAe;AAClE,QAAMC,MAA8B,CAAC;AACrC,aAAWjE,QAAQgE,OAAO;AACxB,UAAM7B,IAAI4B,IAAIL,QAAQ1D,KAAKF,YAAW,CAAA;AACtC,QAAIqC,MAAMI,OAAW0B,KAAIjE,KAAKF,YAAW,CAAA,IAAMqC;EACjD;AACA,SAAO8B;AACT;AAPgBH;AAaT,SAASI,gBACdzD,OACAC,MACAyD,UACAC,aAA4E,CAAC,GAAC;AAE9E,QAAMjF,SAASsB,MAAMtB,OAAOwB,YAAW;AACvC,QAAMX,OAAOH,iBAAiBa,KAAKV,QAAQd,kBAAkBC,QAAQsB,MAAMrB,IAAI,CAAA;AAC/E,QAAM,EAAEmC,QAAQT,QAAO,IAAKN,iBAAiBC,OAAOC,IAAAA;AACpD,QAAM2D,UAAUD,WAAWE,kBAAkBC;AAC7C,QAAMpB,WAAWiB,WAAWI,oBAAoB;AAEhD,SAAO;IACLxE;IACAyE,OAAO/D,KAAK+D;IACZ3C,aAAapB,KAAKoB,eAAe,GAAG3C,MAAAA,IAAUsB,MAAMrB,IAAI;IACxDsF,aAAanD;IACboD,aAAa;MAAE,GAAGxE,mBAAmBhB,MAAAA;MAAS,GAAGuB,KAAKiE;IAAY;IAClEC,UAAUC,YAAYnE,KAAKY,KAAK;IAChC,MAAMwD,QAAQpC,MAAMqB,KAAG;AACrB,YAAMgB,UAAUrE,KAAKY,QAAQiB,SAAYyC,cAAczD,QAAQmB,IAAAA;AAC/D,UAAIqC,QAAS,QAAO;QAAEzB,SAAS;QAAMG,SAAS;UAAC;YAAEhC,MAAM;YAAQ2B,MAAM2B;UAAQ;;MAAG;AAEhF,YAAM,EAAEpC,YAAY5B,OAAOE,KAAI,IAAKwB,UAAUC,MAAM5B,OAAAA;AACpD,YAAM4C,UAAkC;QACtCuB,QAAQ;QACR,GAAGnB,mBAAmBC,KAAKM,OAAAA;QAC3B,GAAG3D,KAAKgD;QACR,cAAc1D;MAChB;AACA,UAAI+D,IAAImB,SAAUxB,SAAQ,iBAAA,IAAqBK,IAAImB;AACnD,UAAIjE,SAASsB,OAAWmB,SAAQ,cAAA,IAAkB;AAElD,UAAItE;AACJ,UAAI;AACFA,eAAO+F,gBAAgB1E,MAAMrB,MAAMuD,UAAAA;MACrC,SAASyC,KAAK;AACZ,eAAO;UAAE9B,SAAS;UAAMG,SAAS;YAAC;cAAEhC,MAAM;cAAQ2B,MAAOgC,IAAcC;YAAQ;;QAAG;MACpF;AACA,YAAMnC,MAAM,MAAMiB,SAAS;QAAEhF;QAAQC;QAAM2B;QAAOE;QAAMyC;MAAQ,GAAGK,GAAAA;AACnE,aAAOd,iBAAiBC,KAAKC,QAAAA;IAC/B;EACF;AACF;AA3CgBe;;;ACtNT,IAAMoB,8BAA8B;EAAC;EAAc;EAAc;EAAc;;AAC/E,IAAMC,0BAA0BD,4BAA4B,CAAA;AAgBnE,IAAME,cAAc;AACpB,IAAMC,kBAAkB;AACxB,IAAMC,mBAAmB;AACzB,IAAMC,iBAAiB;AAEvB,IAAMC,KAAK,wBAACC,IAAeC,YAAsC;EAAEC,SAAS;EAAOF;EAAIC;AAAO,IAAnF;AACX,IAAME,OAAO,wBAACH,IAAeI,MAAcC,aAAsC;EAC/EH,SAAS;EACTF;EACAM,OAAO;IAAEF;IAAMC;EAAQ;AACzB,IAJa;AAuBN,IAAME,YAAN,MAAMA;EA9Cb,OA8CaA;;;;EACMC,QAAQ,oBAAIC,IAAAA;EACrBC,UAA0C,CAAA;EAElD,YAAqBC,SAA2B;SAA3BA,UAAAA;EAA4B;;EAGjDC,QAAQC,MAA+B;AACrC,QAAI,KAAKL,MAAMM,IAAID,KAAKE,IAAI,GAAG;AAC7B,YAAM,IAAIC,MAAM,oCAAoCH,KAAKE,IAAI,8BAA8B;IAC7F;AACA,SAAKP,MAAMS,IAAIJ,KAAKE,MAAMF,IAAAA;AAC1B,WAAO;EACT;;EAGAK,OAAOC,QAA0C;AAC/C,SAAKT,QAAQU,KAAKD,MAAAA;AAClB,WAAO;EACT;EAEA,MAAME,YAA0C;AAC9C,UAAM,KAAKC,KAAI;AACf,WAAO;SAAI,KAAKd,MAAMe,OAAM;;EAC9B;EAEA,MAAcD,OAAO;AACnB,QAAI,CAAC,KAAKZ,QAAQc,OAAQ;AAC1B,UAAMd,UAAU,KAAKA;AACrB,SAAKA,UAAU,CAAA;AACf,eAAWe,KAAKf,QAAS,OAAMe,EAAAA;EACjC;;EAGA,MAAMC,cAAcrB,SAAkBsB,KAAuE;AAC3G,QAAIC,MAAMC,QAAQxB,OAAAA,GAAU;AAC1B,YAAMyB,WAAW,MAAMC,QAAQC,IAAI3B,QAAQ4B,IAAI,CAACC,MAAM,KAAKC,UAAUD,GAAGP,GAAAA,CAAAA,CAAAA,GAAQS,OAC9E,CAACC,MAA4BA,MAAM,IAAA;AAErC,aAAOP,QAAQN,SAASM,UAAU;IACpC;AACA,WAAO,KAAKK,UAAU9B,SAASsB,GAAAA;EACjC;EAEA,MAAcQ,UAAU9B,SAAkBsB,KAAmD;AAC3F,UAAMW,MAAMjC;AACZ,QAAI,CAACiC,OAAO,OAAOA,QAAQ,YAAYA,IAAIpC,YAAY,OAAO;AAC5D,aAAOC,KAAK,MAAMP,iBAAiB,0BAAA;IACrC;AAEA,QAAI,OAAO0C,IAAIC,WAAW,YAAYD,IAAItC,OAAOwC,OAAW,QAAO;AACnE,UAAMxC,KAAKsC,IAAItC;AACf,UAAMyC,SAASH,IAAIG,UAAU,CAAC;AAE9B,UAAM,KAAKnB,KAAI;AACf,YAAQgB,IAAIC,QAAM;MAChB,KAAK,cAAc;AACjB,cAAMG,YAAYD,OAAOE;AACzB,cAAMA,kBACJD,aAAajD,4BAA4BmD,SAASF,SAAAA,IAAaA,YAAYhD;AAC7E,eAAOK,GAAGC,IAAI;UACZ2C;UACAE,cAAc;YAAErC,OAAO;cAAEsC,aAAa;YAAM;UAAE;UAC9CC,YAAY;YAAEhC,MAAM,KAAKJ,QAAQI;YAAMiC,SAAS,KAAKrC,QAAQqC,WAAW;UAAQ;UAChF,GAAI,KAAKrC,QAAQsC,eAAe;YAAEA,cAAc,KAAKtC,QAAQsC;UAAa,IAAI,CAAC;QACjF,CAAA;MACF;MACA,KAAK;AACH,eAAOlD,GAAGC,IAAI,CAAC,CAAA;MACjB,KAAK;AACH,eAAOD,GAAGC,IAAI;UACZQ,OAAO;eAAI,KAAKA,MAAMe,OAAM;YAAIU,IAAI,CAACiB,OAAO;YAC1CnC,MAAMmC,EAAEnC;YACR,GAAImC,EAAEC,QAAQ;cAAEA,OAAOD,EAAEC;YAAM,IAAI,CAAC;YACpCC,aAAaF,EAAEE;YACfC,aAAaH,EAAEG;YACf,GAAIH,EAAEI,cAAc;cAAEA,aAAaJ,EAAEI;YAAY,IAAI,CAAC;UACxD,EAAA;QACF,CAAA;MACF,KAAK,cAAc;AACjB,cAAMzC,OAAO,KAAKL,MAAM+C,IAAId,OAAO1B,IAAI;AACvC,YAAI,CAACF,KAAM,QAAOV,KAAKH,IAAIF,gBAAgB,iBAAiB0D,OAAOf,OAAO1B,IAAI,CAAA,EAAG;AACjF,eAAOhB,GAAGC,IAAI,MAAM,KAAKyD,SAAS5C,MAAO4B,OAAOiB,aAAa,CAAC,GAA+B/B,GAAAA,CAAAA;MAC/F;MACA,KAAK;AACH,eAAO5B,GAAGC,IAAI;UAAE2D,WAAW,CAAA;QAAG,CAAA;MAChC,KAAK;AACH,eAAO5D,GAAGC,IAAI;UAAE4D,SAAS,CAAA;QAAG,CAAA;MAC9B;AACE,eAAOzD,KAAKH,IAAIH,kBAAkB,qBAAqByC,IAAIC,MAAM,EAAE;IACvE;EACF;EAEA,MAAckB,SACZ5C,MACAgD,MACAlC,KACqB;AACrB,QAAI;AACF,UAAId,KAAKiD,UAAU;AACjB,cAAMC,IAAI,MAAMlD,KAAKiD,SAASD,IAAAA;AAC9B,YAAI,CAACE,EAAEhE,GAAI,QAAO;UAAEiE,SAAS;UAAMC,SAAS;YAAC;cAAEC,MAAM;cAAQC,MAAM,sBAAsBJ,EAAE1D,OAAO;YAAG;;QAAG;AACxGwD,eAAOE,EAAEK;MACX;AACA,aAAO,MAAMvD,KAAKwD,QAAQR,MAAMlC,GAAAA;IAClC,SAAS2C,KAAK;AAEZ,aAAO;QAAEN,SAAS;QAAMC,SAAS;UAAC;YAAEC,MAAM;YAAQC,MAAM,eAAgBG,IAAcjE,OAAO;UAAG;;MAAG;IACrG;EACF;;EAGAkE,gBAAgBC,QAAqC;AACnD,QAAI,CAACA,OAAQ,QAAO;AACpB,UAAMC,UAAU,KAAK9D,QAAQ+D;AAC7B,QAAID,YAAY,IAAK,QAAO;AAC5B,YAAQA,WAAW,CAAA,GAAI7B,SAAS4B,MAAAA;EAClC;;;;;EAMA,MAAMG,WAAWC,KAAqBjD,KAA4C;AAChF,UAAMkD,OAAO;MAAE,gBAAgB;IAAmB;AAClD,QAAI,CAAC,KAAKN,gBAAgBK,IAAIE,QAAQN,MAAM,GAAG;AAC7C,aAAO;QAAEO,QAAQ;QAAKD,SAASD;QAAMG,MAAMC,KAAKC,UAAU/E,KAAK,MAAMP,iBAAiB,oBAAA,CAAA;MAAuB;IAC/G;AACA,QAAIgF,IAAIrC,OAAO4C,YAAW,MAAO,QAAQ;AAEvC,aAAO;QAAEJ,QAAQ;QAAKD,SAAS;UAAEM,OAAO;QAAO;MAAE;IACnD;AACA,QAAIJ,OAAOJ,IAAII;AACf,QAAI,OAAOA,SAAS,YAAYA,gBAAgBK,YAAY;AAC1D,UAAI;AACFL,eAAOC,KAAKK,MAAM,OAAON,SAAS,WAAWA,OAAO,IAAIO,YAAAA,EAAcC,OAAOR,IAAAA,CAAAA;MAC/E,QAAQ;AACN,eAAO;UAAED,QAAQ;UAAKD,SAASD;UAAMG,MAAMC,KAAKC,UAAU/E,KAAK,MAAMR,aAAa,aAAA,CAAA;QAAgB;MACpG;IACF;AACA,UAAM8F,WAAW,MAAM,KAAK/D,cAAcsD,MAAMrD,GAAAA;AAChD,QAAI8D,aAAa,KAAM,QAAO;MAAEV,QAAQ;MAAKD,SAAS,CAAC;IAAE;AACzD,WAAO;MAAEC,QAAQ;MAAKD,SAASD;MAAMG,MAAMC,KAAKC,UAAUO,QAAAA;IAAU;EACtE;AACF;;;AL5KA,IAAMC,SAAS,oBAAIC,IAAAA;AAEnBC,kBAAMC,MAAM,OAAO,SAAuBC,UAA4B,CAAC,GAAC;AACtEJ,SAAOK,IAAI,MAAMD,OAAAA;AACjB,SAAO;AACT,CAAA;AAGO,SAASE,QAAyBC,OAAUH,UAA4B,CAAC,GAAC;AAC/EJ,SAAOK,IAAIE,OAAOH,OAAAA;AAClB,SAAOG;AACT;AAHgBD;AAwChB,SAASE,cAAcC,GAAU;AAC/B,SAAO,OAAOA,MAAM,YAAYA,MAAM,QAAQ,CAACC,MAAMC,QAAQF,CAAAA,KAAMG,OAAOC,KAAKJ,CAAAA,EAAGK,WAAW;AAC/F;AAFSN;AAgBF,SAASO,SAASC,QAAoBZ,SAAyB;AACpE,QAAMa,OAAOb,QAAQa,QAAQ;AAC7B,QAAMC,SAAS,IAAIC,UAAUf,OAAAA;AAC7B,QAAMgB,WAAWC,sBAAsB;IACrCC,SAASlB,QAAQkB,YAAY,CAACC,QAAQC,gBAAgBD,IAAIE,GAAG;EAC/D,CAAA;AAEA,aAAWC,KAAKtB,QAAQuB,SAAS,CAAA,EAAIT,QAAOU,QAAQF,CAAAA;AACpDR,SAAOW,OAAO,MAAA;AAEZ,UAAMC,aAAa,oBAAIC,IAAAA;AACvB,eAAWC,UAAUpB,OAAOqB,OAAOjB,OAAOkB,OAAM,CAAA,GAAK;AACnD,iBAAWC,KAAKH,OAAQ,YAAWI,KAAKD,EAAEE,QAASP,YAAWQ,IAAI,GAAGF,CAAAA,IAAKD,EAAEI,OAAO,EAAE;IACvF;AACA,UAAMC,OAAO,oBAAIT,IAAAA;AACjB,eAAW,CAACxB,QAAOkC,IAAAA,KAASzC,QAAQ;AAClC,UAAIO,OAAMmC,UAAS,EAAI;AACvB,YAAM,EAAEH,SAASF,QAAO,IAAK9B,OAAM2B,OAAM;AACzC,iBAAWS,UAAUN,SAAS;AAC5B,cAAMO,MAAM,GAAGD,MAAAA,IAAUJ,OAAAA;AACzB,YAAII,WAAW,UAAU,CAACb,WAAWe,IAAID,GAAAA,KAAQJ,KAAKK,IAAID,GAAAA,EAAM;AAChEJ,aAAKF,IAAIM,GAAAA;AACT1B,eAAOU,QAAQkB,gBAAgB;UAAEH;UAAQ1B,MAAMsB;QAAQ,GAAGE,MAAMrB,UAAUhB,OAAAA,CAAAA;MAC5E;IACF;EACF,CAAA;AAEA,QAAMG,QAAQS,OAAO+B,IAAI9B,MAAM,OAAOM,QAAAA;AACpC,UAAMyB,MAAMzB,IAAI0B,QAAQA;AACxB,QAAIC,OAAO3B,IAAI0B,QAAQC,KAAI;AAC3B,QAAI3B,IAAI0B,QAAQN,OAAM,MAAO,WAAWO,SAASC,UAAa3C,cAAc0C,IAAAA,IAAQ;AAElF,YAAMzB,MAAMF,IAAI0B,QAAQxB,IAAG;AAC3ByB,aAAOzB,QAAQuB,IAAII,YAAY,CAACJ,IAAIK,gBAAgB,MAAMC,YAAYN,GAAAA,IAAOE;IAC/E;AACA,UAAMK,UAAuB;MAC3BC,SAASC,iBAAiBlC,IAAI0B,QAAQO,QAAO,CAAA;MAC7CE,UAAUnC,IAAI0B,QAAQU,GAAE;MACxBlC,KAAKuB;IACP;AACA,UAAMY,MAAM,MAAM1C,OAAO2C,WAAW;MAAElB,QAAQpB,IAAI0B,QAAQN,OAAM;MAAIa,SAASD,QAAQC;MAASN;IAAK,GAAGK,OAAAA;AACtGhC,QAAIuC,SAASC,OAAOH,IAAIG,MAAM;AAC9B,eAAW,CAACC,GAAGvD,CAAAA,KAAMG,OAAOqD,QAAQL,IAAIJ,OAAO,EAAGjC,KAAIuC,SAASI,OAAOF,GAAGvD,CAAAA;AACzEc,QAAIuC,SAASK,KAAKP,IAAIV,QAAQ,EAAA;EAChC,CAAA;AACA3C,QAAM6D,GAAG,qBAAA;AACThE,UAAQiE,iBAAiB9D,KAAAA;AACzB,SAAOW;AACT;AAhDgBH;","names":["buildUrl","base","req","url","URL","replace","path","k","v","Object","entries","query","item","Array","isArray","searchParams","append","toString","createFetchDispatcher","opts","doFetch","fetch","ctx","baseUrl","res","method","headers","body","undefined","JSON","stringify","signal","AbortSignal","timeout","timeoutMs","forEach","status","text","normalizeHeaders","headers","out","k","v","Object","entries","undefined","toLowerCase","Array","isArray","join","String","readRawBody","req","limit","Promise","resolve","reject","size","chunks","on","c","length","Error","destroy","push","Buffer","concat","toString","loopbackBaseUrl","socket","port","localPort","encrypted","bound","server","address","host","localAddress","startsWith","slice","includes","isStandard","s","toJsonSchema","schema","undefined","out","jsonSchema","input","target","toJSONSchema","Error","$schema","_ignored","rest","toValidator","validate","value","result","issues","ok","message","map","i","path","p","String","key","join","checkRequired","args","missing","required","filter","k","length","DEFAULT_FORWARD_HEADERS","BODY_METHODS","Set","PARAM_RE","pathParams","path","matchAll","map","m","encodeSegment","name","value","raw","String","Error","JSON","stringify","encodeURIComponent","interpolatePath","values","replace","_","k","undefined","a","b","toolNameFromRoute","method","path","segments","split","filter","Boolean","map","s","m","exec","sanitizeToolName","toLowerCase","join","name","replace","slice","defaultAnnotations","readOnlyHint","openWorldHint","destructiveHint","idempotentHint","buildInputSchema","route","opts","toUpperCase","params","pathParams","mapping","query","Set","body","wholeBody","bodyMethod","BODY_METHODS","has","input","schema","toJsonSchema","type","properties","required","paramSchema","p","description","includes","add","querySchema","k","v","Object","entries","bodySchema","undefined","size","splitArgs","args","pathValues","Array","isArray","String","JSON","stringify","responseToResult","res","maxChars","text","length","isError","status","result","content","headers","parsed","parse","structuredContent","pickForwardHeaders","ctx","names","out","createRouteTool","dispatch","serverOpts","forward","forwardHeaders","DEFAULT_FORWARD_HEADERS","maxResponseChars","title","inputSchema","annotations","validate","toValidator","handler","missing","checkRequired","accept","clientIp","interpolatePath","err","message","SUPPORTED_PROTOCOL_VERSIONS","LATEST_PROTOCOL_VERSION","PARSE_ERROR","INVALID_REQUEST","METHOD_NOT_FOUND","INVALID_PARAMS","ok","id","result","jsonrpc","fail","code","message","error","McpServer","tools","Map","loaders","options","addTool","tool","has","name","Error","set","onLoad","loader","push","listTools","load","values","length","l","handleMessage","ctx","Array","isArray","results","Promise","all","map","m","handleOne","filter","r","msg","method","undefined","params","requested","protocolVersion","includes","capabilities","listChanged","serverInfo","version","instructions","t","title","description","inputSchema","annotations","get","String","callTool","arguments","resources","prompts","args","validate","v","isError","content","type","text","value","handler","err","isOriginAllowed","origin","allowed","allowedOrigins","handleHttp","req","json","headers","status","body","JSON","stringify","toUpperCase","allow","Uint8Array","parse","TextDecoder","decode","response","marked","Map","Route","macro","options","set","mcpTool","route","isEmptyObject","v","Array","isArray","Object","keys","length","mountMcp","router","path","server","McpServer","dispatch","createFetchDispatcher","baseUrl","ctx","loopbackBaseUrl","raw","t","tools","addTool","onLoad","registered","Set","routes","values","toJSON","r","m","methods","add","pattern","seen","opts","isDeleted","method","key","has","createRouteTool","any","req","request","body","undefined","readable","readableEnded","readRawBody","toolCtx","headers","normalizeHeaders","clientIp","ip","out","handleHttp","response","status","k","entries","header","send","as","configureRoute"]}
+{"version":3,"sources":["../../src/adonisjs/index.ts","../../src/core/dispatch.ts","../../src/core/node.ts","../../src/core/schema.ts","../../src/core/route-tool.ts","../../src/core/oauth.ts","../../src/core/server.ts"],"sourcesContent":["import { Route } from '@adonisjs/core/http';\nimport type { IncomingMessage } from 'node:http';\nimport { createFetchDispatcher } from '../core/dispatch.js';\nimport { loopbackBaseUrl, normalizeHeaders, readRawBody } from '../core/node.js';\nimport { createRouteTool } from '../core/route-tool.js';\nimport { McpServer } from '../core/server.js';\nimport type { McpServerOptions, McpToolDefinition, RouteToolOptions, ToolContext } from '../core/types.js';\n\ndeclare module '@adonisjs/core/http' {\n  interface Route {\n    /**\n     * Expose this route as an MCP tool:\n     *\n     *   router.get('/orders/:id', [OrdersController, 'show']).use(middleware.auth()).mcp({ description: 'Get an order' })\n     */\n    mcp(options?: RouteToolOptions): this;\n  }\n}\n\n/** Routes marked with `.mcp()`, keyed by route instance. */\nconst marked = new Map<Route, RouteToolOptions>();\n\nRoute.macro('mcp', function (this: Route, options: RouteToolOptions = {}) {\n  marked.set(this, options);\n  return this;\n});\n\n/** Mark a route without the macro (same as `route.mcp(options)`). */\nexport function mcpTool<T extends Route>(route: T, options: RouteToolOptions = {}): T {\n  marked.set(route, options);\n  return route;\n}\n\ninterface RouterLike {\n  any(pattern: string, handler: (ctx: AdonisContext) => unknown): { as(name: string): unknown };\n  toJSON(): Record<string, { pattern: string; methods: string[] }[]>;\n}\n\ninterface AdonisContext {\n  request: {\n    request: IncomingMessage;\n    method(): string;\n    ip(): string;\n    headers(): Record<string, string | string[] | undefined>;\n    body(): unknown;\n    raw(): string | null;\n  };\n  response: {\n    status(code: number): unknown;\n    header(key: string, value: string): unknown;\n    send(body: unknown): unknown;\n  };\n}\n\nexport interface AdonisMcpOptions extends McpServerOptions {\n  /** Path of the MCP endpoint. @default '/mcp' */\n  path?: string;\n  /** Base URL for internal calls. Defaults to loopback on the port the MCP request arrived on. */\n  baseUrl?: string;\n  /** Extra hand-written tools (see `defineTool`). */\n  tools?: McpToolDefinition[];\n  /**\n   * Called with the MCP route so you can add middleware to the endpoint itself,\n   * e.g. `(route) => route.use(middleware.auth())`.\n   */\n  configureRoute?: (route: Route) => void;\n}\n\nfunction isEmptyObject(v: unknown): boolean {\n  return typeof v === 'object' && v !== null && !Array.isArray(v) && Object.keys(v).length === 0;\n}\n\n/**\n * Add an MCP endpoint to an AdonisJS (v6 / v7) router, usually in `start/routes.ts`:\n *\n *   import router from '@adonisjs/core/services/router'\n *   import { mountMcp } from 'mcp-expose/adonisjs'\n *\n *   router.get('/orders/:id', [OrdersController, 'show']).use(middleware.auth()).mcp({ description: 'Get an order' })\n *   mountMcp(router, { name: 'shop-api' })\n *\n * Group prefixes, route middleware (auth, throttle) and VineJS validators all\n * apply, because every tool call goes through the router like a normal request.\n */\nexport function mountMcp(router: RouterLike, options: AdonisMcpOptions): McpServer {\n  const path = options.path ?? '/mcp';\n  const server = new McpServer(options);\n  const dispatch = createFetchDispatcher({\n    baseUrl: options.baseUrl ?? ((ctx) => loopbackBaseUrl(ctx.raw as IncomingMessage)),\n  });\n\n  for (const t of options.tools ?? []) server.addTool(t);\n  server.onLoad(() => {\n    // Only routes registered on this router (after commit, with group prefixes applied).\n    const registered = new Set<string>();\n    for (const routes of Object.values(router.toJSON())) {\n      for (const r of routes) for (const m of r.methods) registered.add(`${m} ${r.pattern}`);\n    }\n    const seen = new Set<string>();\n    for (const [route, opts] of marked) {\n      if (route.isDeleted()) continue;\n      const { pattern, methods } = route.toJSON();\n      for (const method of methods) {\n        const key = `${method} ${pattern}`;\n        if (method === 'HEAD' || !registered.has(key) || seen.has(key)) continue;\n        seen.add(key);\n        server.addTool(createRouteTool({ method, path: pattern }, opts, dispatch, options));\n      }\n    }\n  });\n\n  const route = router.any(path, async (ctx: AdonisContext) => {\n    const req = ctx.request.request;\n    let body = ctx.request.body();\n    if (ctx.request.method() === 'POST' && (body === undefined || isEmptyObject(body))) {\n      // No bodyparser for this route (or a non-JSON content type): read it ourselves.\n      const raw = ctx.request.raw();\n      body = raw ?? (req.readable && !req.readableEnded ? await readRawBody(req) : body);\n    }\n    const toolCtx: ToolContext = {\n      headers: normalizeHeaders(ctx.request.headers()),\n      clientIp: ctx.request.ip(),\n      raw: req,\n    };\n    const out = await server.handleHttp({ method: ctx.request.method(), headers: toolCtx.headers, body }, toolCtx);\n    ctx.response.status(out.status);\n    for (const [k, v] of Object.entries(out.headers)) ctx.response.header(k, v);\n    ctx.response.send(out.body ?? '');\n  }) as unknown as Route;\n  route.as('mcp_expose.endpoint');\n  options.configureRoute?.(route);\n\n  // OAuth Protected Resource Metadata: public, without `configureRoute` middleware.\n  server.oauthMetadataPaths.forEach((p, i) => {\n    router\n      .any(p, async (ctx: AdonisContext) => {\n        const out = await server.handleMetadataHttp({ method: ctx.request.method() });\n        ctx.response.status(out.status);\n        for (const [k, v] of Object.entries(out.headers)) ctx.response.header(k, v);\n        ctx.response.send(out.body ?? '');\n      })\n      .as(`mcp_expose.oauth_metadata_${i}`);\n  });\n  return server;\n}\n","import type { Dispatcher, RouteRequest, ToolContext } from './types.js';\n\nexport function buildUrl(base: string, req: Pick<RouteRequest, 'path' | 'query'>): string {\n  const url = new URL(base.replace(/\\/+$/, '') + req.path);\n  for (const [k, v] of Object.entries(req.query)) {\n    for (const item of Array.isArray(v) ? v : [v]) url.searchParams.append(k, item);\n  }\n  return url.toString();\n}\n\nexport interface FetchDispatcherOptions {\n  /**\n   * Base URL of the API, e.g. `http://127.0.0.1:3000` or `https://api.example.com/v1`.\n   * A function lets adapters resolve it per call (e.g. from the local port).\n   */\n  baseUrl: string | ((ctx: ToolContext) => string);\n  /** Custom fetch implementation. Defaults to the global `fetch`. */\n  fetch?: typeof fetch;\n  /** Per-request timeout in ms. @default 30_000 */\n  timeoutMs?: number;\n}\n\n/**\n * Dispatches tool calls as real HTTP requests. Used for loopback calls into the\n * host app (Express, Koa, NestJS) and for standalone gateways in front of any API.\n */\nexport function createFetchDispatcher(opts: FetchDispatcherOptions): Dispatcher {\n  const doFetch = opts.fetch ?? fetch;\n  return async (req, ctx) => {\n    const base = typeof opts.baseUrl === 'function' ? opts.baseUrl(ctx) : opts.baseUrl;\n    const res = await doFetch(buildUrl(base, req), {\n      method: req.method,\n      headers: req.headers,\n      body:\n        req.body === undefined || req.method === 'GET' || req.method === 'HEAD' ? undefined : JSON.stringify(req.body),\n      signal: AbortSignal.timeout(opts.timeoutMs ?? 30_000),\n    });\n    const headers: Record<string, string> = {};\n    res.headers.forEach((v, k) => (headers[k] = v));\n    return { status: res.status, headers, body: await res.text() };\n  };\n}\n","import type { IncomingMessage, ServerResponse } from 'node:http';\nimport type { McpHttpResponse } from './server.js';\n\n/** Flatten Node's IncomingHttpHeaders into lower-cased single strings. */\nexport function normalizeHeaders(headers: Record<string, string | string[] | undefined>): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    if (v === undefined) continue;\n    out[k.toLowerCase()] = Array.isArray(v) ? v.join(', ') : String(v);\n  }\n  return out;\n}\n\n/** Read and return the raw body of a Node request (for frameworks without a JSON body parser). */\nexport function readRawBody(req: IncomingMessage, limit = 4 * 1024 * 1024): Promise<string> {\n  return new Promise((resolve, reject) => {\n    let size = 0;\n    const chunks: Buffer[] = [];\n    req.on('data', (c: Buffer) => {\n      size += c.length;\n      if (size > limit) {\n        reject(new Error('Request body too large'));\n        req.destroy();\n      } else chunks.push(c);\n    });\n    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));\n    req.on('error', reject);\n  });\n}\n\n/** Base URL that reaches the same server the MCP request arrived on. */\nexport function loopbackBaseUrl(req: IncomingMessage): string {\n  const socket = req.socket as IncomingMessage['socket'] & {\n    encrypted?: boolean;\n    server?: { address(): { address: string } | string | null };\n  };\n  const port = socket.localPort;\n  const encrypted = socket.encrypted;\n  // Prefer the address the server is bound to: when it listens on all\n  // interfaces this yields 127.0.0.1, so internal calls come from loopback\n  // (which `trust proxy: 'loopback'` style settings rely on).\n  const bound = socket.server?.address();\n  let host = (typeof bound === 'object' && bound?.address) || socket.localAddress || '127.0.0.1';\n  if (host.startsWith('::ffff:')) host = host.slice(7);\n  if (host === '::' || host === '0.0.0.0') host = '127.0.0.1';\n  if (host.includes(':')) host = `[${host}]`;\n  return `${encrypted ? 'https' : 'http'}://${host}:${port}`;\n}\n\nexport function writeNodeResponse(res: ServerResponse, out: McpHttpResponse): void {\n  res.statusCode = out.status;\n  for (const [k, v] of Object.entries(out.headers)) res.setHeader(k, v);\n  res.end(out.body);\n}\n","import type { JsonSchema, McpToolDefinition, SchemaLike } from './types.js';\n\ninterface StandardSchemaV1 {\n  '~standard': {\n    validate?: (value: unknown) => unknown;\n    jsonSchema?: { input?: (opts: { target: string }) => unknown };\n  };\n}\n\nfunction isStandard(s: unknown): s is StandardSchemaV1 {\n  return typeof s === 'object' && s !== null && '~standard' in s;\n}\n\n/** Convert any supported schema flavour into a plain JSON Schema object. */\nexport function toJsonSchema(schema: SchemaLike | undefined): JsonSchema | undefined {\n  if (schema === undefined || schema === null) return undefined;\n  let out: unknown;\n  if (isStandard(schema) && typeof schema['~standard'].jsonSchema?.input === 'function') {\n    out = schema['~standard'].jsonSchema.input({ target: 'draft-2020-12' });\n  } else if (typeof (schema as { toJSONSchema?: unknown }).toJSONSchema === 'function') {\n    out = (schema as { toJSONSchema(): unknown }).toJSONSchema();\n  } else if (isStandard(schema)) {\n    throw new Error(\n      'mcp-expose: this schema library does not support JSON Schema export. Pass a plain JSON Schema instead.',\n    );\n  } else {\n    out = schema;\n  }\n  const { $schema: _ignored, ...rest } = out as JsonSchema;\n  return rest;\n}\n\n/** Build a validator from a Standard Schema, if the input is one. */\nexport function toValidator(schema: SchemaLike | undefined): McpToolDefinition['validate'] {\n  if (!isStandard(schema) || typeof schema['~standard'].validate !== 'function') return undefined;\n  const validate = schema['~standard'].validate;\n  return async (value) => {\n    const result = (await validate(value)) as {\n      value?: unknown;\n      issues?: { message: string; path?: (PropertyKey | { key: PropertyKey })[] }[];\n    };\n    if (!result.issues) return { ok: true, value: result.value };\n    const message = result.issues\n      .map((i) => {\n        const path = (i.path ?? []).map((p) => (typeof p === 'object' ? String(p.key) : String(p))).join('.');\n        return path ? `${path}: ${i.message}` : i.message;\n      })\n      .join('; ');\n    return { ok: false, message };\n  };\n}\n\n/** Very small structural check used when no Standard Schema validator exists. */\nexport function checkRequired(schema: JsonSchema, args: Record<string, unknown>): string | undefined {\n  const missing = (schema.required ?? []).filter((k) => args[k] === undefined);\n  return missing.length ? `Missing required argument(s): ${missing.join(', ')}` : undefined;\n}\n","import { checkRequired, toJsonSchema, toValidator } from './schema.js';\nimport type {\n  Dispatcher,\n  JsonSchema,\n  McpServerOptions,\n  McpToolDefinition,\n  RouteResponse,\n  RouteSpec,\n  RouteToolOptions,\n  ToolAnnotations,\n  ToolContext,\n  ToolResult,\n} from './types.js';\n\nexport const DEFAULT_FORWARD_HEADERS = ['authorization', 'cookie', 'x-api-key', 'accept-language'];\nconst BODY_METHODS = new Set(['POST', 'PUT', 'PATCH']);\nconst PARAM_RE = /:([A-Za-z0-9_]+)\\??|\\{([A-Za-z0-9_]+)\\}/g;\n\n/** Names of the path parameters in a route path (`/a/:id/{slug}` -> ['id', 'slug']). */\nexport function pathParams(path: string): string[] {\n  return [...path.matchAll(PARAM_RE)].map((m) => (m[1] ?? m[2]) as string);\n}\n\n/**\n * Encode one path-parameter value. Rejects empty, `.` and `..` values: after URL\n * normalisation they would change which route is called (e.g. `/orders/../admin`),\n * letting an agent reach routes that were never exposed as tools.\n */\nfunction encodeSegment(name: string, value: unknown): string {\n  const raw = String(value);\n  if (raw === '' || raw === '.' || raw === '..') {\n    throw new Error(`Invalid value for path parameter \"${name}\": ${JSON.stringify(raw)}`);\n  }\n  return encodeURIComponent(raw);\n}\n\n/** Replace path placeholders with URL-encoded values. Missing optional params drop their segment. */\nexport function interpolatePath(path: string, values: Record<string, unknown>): string {\n  return path\n    .replace(/\\/:([A-Za-z0-9_]+)\\?/g, (_, k: string) =>\n      values[k] === undefined ? '' : `/${encodeSegment(k, values[k])}`,\n    )\n    .replace(PARAM_RE, (_, a?: string, b?: string) => {\n      const k = (a ?? b) as string;\n      return encodeSegment(k, values[k]);\n    });\n}\n\n/** Join path segments, normalising slashes. */\nexport function joinPaths(...parts: (string | undefined)[]): string {\n  const joined = parts\n    .filter((p): p is string => !!p && p !== '/')\n    .map((p) => p.replace(/^\\/+|\\/+$/g, ''))\n    .filter(Boolean)\n    .join('/');\n  return `/${joined}`;\n}\n\n/** `GET /users/:id/orders` -> `get_users_by_id_orders` */\nexport function toolNameFromRoute(method: string, path: string): string {\n  const segments = path\n    .split('/')\n    .filter(Boolean)\n    .map((s) => {\n      const m = /^(?::([A-Za-z0-9_]+)\\??|\\{([A-Za-z0-9_]+)\\})$/.exec(s);\n      return m ? `by_${m[1] ?? m[2]}` : s;\n    });\n  return sanitizeToolName([method.toLowerCase(), ...segments].join('_'));\n}\n\nexport function sanitizeToolName(name: string): string {\n  return name\n    .replace(/[^A-Za-z0-9_-]+/g, '_')\n    .replace(/_+/g, '_')\n    .replace(/^_|_$/g, '')\n    .slice(0, 64);\n}\n\nfunction defaultAnnotations(method: string): ToolAnnotations {\n  switch (method) {\n    case 'GET':\n    case 'HEAD':\n      return { readOnlyHint: true, openWorldHint: false };\n    case 'DELETE':\n      return { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false };\n    case 'PUT':\n      return { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false };\n    default:\n      return { readOnlyHint: false, destructiveHint: false, openWorldHint: false };\n  }\n}\n\ninterface ArgMapping {\n  params: string[];\n  query: Set<string>;\n  body: Set<string>;\n  /** Body schema is not an object: the whole body is passed under the `body` key. */\n  wholeBody: boolean;\n  bodyMethod: boolean;\n}\n\n/**\n * Build the flat input schema an agent sees, and remember which argument goes\n * to the path, query string or body when the tool is called.\n */\nexport function buildInputSchema(\n  route: RouteSpec,\n  opts: RouteToolOptions,\n): { schema: JsonSchema; mapping: ArgMapping } {\n  const method = route.method.toUpperCase();\n  const params = pathParams(route.path);\n  const mapping: ArgMapping = {\n    params,\n    query: new Set(),\n    body: new Set(),\n    wholeBody: false,\n    bodyMethod: BODY_METHODS.has(method),\n  };\n\n  if (opts.input) {\n    const schema = toJsonSchema(opts.input) as JsonSchema;\n    return { schema: { type: 'object', ...schema }, mapping };\n  }\n\n  const properties: Record<string, JsonSchema> = {};\n  const required = new Set<string>();\n\n  const paramSchema = toJsonSchema(opts.params);\n  for (const p of params) {\n    properties[p] = paramSchema?.properties?.[p] ?? { type: 'string', description: `Path parameter \"${p}\"` };\n    if (!route.path.includes(`:${p}?`)) required.add(p);\n  }\n\n  const querySchema = toJsonSchema(opts.query);\n  for (const [k, v] of Object.entries(querySchema?.properties ?? {})) {\n    properties[k] = v;\n    mapping.query.add(k);\n  }\n  for (const k of querySchema?.required ?? []) required.add(k);\n\n  const bodySchema = toJsonSchema(opts.body);\n  if (bodySchema) {\n    if (bodySchema.properties && (bodySchema.type === undefined || bodySchema.type === 'object')) {\n      for (const [k, v] of Object.entries(bodySchema.properties)) {\n        properties[k] = v;\n        mapping.body.add(k);\n      }\n      for (const k of bodySchema.required ?? []) required.add(k);\n    } else {\n      properties.body = bodySchema;\n      required.add('body');\n      mapping.wholeBody = true;\n    }\n  }\n\n  const schema: JsonSchema = { type: 'object', properties };\n  if (required.size) schema.required = [...required];\n  return { schema, mapping };\n}\n\nfunction splitArgs(args: Record<string, unknown>, mapping: ArgMapping) {\n  const pathValues: Record<string, unknown> = {};\n  const query: Record<string, string | string[]> = {};\n  let body: Record<string, unknown> | unknown | undefined;\n\n  for (const [k, v] of Object.entries(args)) {\n    if (v === undefined) continue;\n    if (mapping.params.includes(k)) {\n      pathValues[k] = v;\n    } else if (mapping.wholeBody && k === 'body') {\n      body = v;\n    } else if (mapping.query.has(k) || (!mapping.body.has(k) && !mapping.bodyMethod)) {\n      query[k] = Array.isArray(v) ? v.map(String) : typeof v === 'object' && v !== null ? JSON.stringify(v) : String(v);\n    } else {\n      body = { ...((body as Record<string, unknown>) ?? {}), [k]: v };\n    }\n  }\n  if (body === undefined && mapping.bodyMethod) body = {};\n  return { pathValues, query, body };\n}\n\nexport function responseToResult(res: RouteResponse, maxChars: number): ToolResult {\n  let text = res.body;\n  if (text.length > maxChars) text = `${text.slice(0, maxChars)}\\n…[truncated ${text.length - maxChars} chars]`;\n  const isError = res.status >= 400;\n  const result: ToolResult = {\n    content: [{ type: 'text', text: isError ? `HTTP ${res.status}\\n${text}` : text || `HTTP ${res.status}` }],\n  };\n  if (isError) {\n    result.isError = true;\n    return result;\n  }\n  if ((res.headers['content-type'] ?? '').includes('json') && text === res.body) {\n    try {\n      const parsed = JSON.parse(res.body);\n      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) result.structuredContent = parsed;\n    } catch {\n      /* not JSON after all */\n    }\n  }\n  return result;\n}\n\nexport function pickForwardHeaders(ctx: ToolContext, names: string[]): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const name of names) {\n    const v = ctx.headers[name.toLowerCase()];\n    if (v !== undefined) out[name.toLowerCase()] = v;\n  }\n  return out;\n}\n\n/**\n * Turn an HTTP route + options into an MCP tool whose handler calls the route\n * through `dispatch`, so auth guards, validation and rate limits all still apply.\n */\nexport function createRouteTool(\n  route: RouteSpec,\n  opts: RouteToolOptions,\n  dispatch: Dispatcher,\n  serverOpts: Pick<McpServerOptions, 'forwardHeaders' | 'maxResponseChars'> = {},\n): McpToolDefinition {\n  const method = route.method.toUpperCase();\n  const name = sanitizeToolName(opts.name ?? toolNameFromRoute(method, route.path));\n  const { schema, mapping } = buildInputSchema(route, opts);\n  const forward = serverOpts.forwardHeaders ?? DEFAULT_FORWARD_HEADERS;\n  const maxChars = serverOpts.maxResponseChars ?? 100_000;\n\n  return {\n    name,\n    title: opts.title,\n    description: opts.description ?? `${method} ${route.path}`,\n    inputSchema: schema,\n    annotations: { ...defaultAnnotations(method), ...opts.annotations },\n    scopes: opts.scopes,\n    validate: toValidator(opts.input),\n    async handler(args, ctx) {\n      const missing = opts.input ? undefined : checkRequired(schema, args);\n      if (missing) return { isError: true, content: [{ type: 'text', text: missing }] };\n\n      const { pathValues, query, body } = splitArgs(args, mapping);\n      const headers: Record<string, string> = {\n        accept: 'application/json',\n        ...pickForwardHeaders(ctx, forward),\n        ...opts.headers,\n        'x-mcp-tool': name,\n      };\n      if (ctx.clientIp) headers['x-forwarded-for'] = ctx.clientIp;\n      if (body !== undefined) headers['content-type'] = 'application/json';\n\n      let path: string;\n      try {\n        path = interpolatePath(route.path, pathValues);\n      } catch (err) {\n        return { isError: true, content: [{ type: 'text', text: (err as Error).message }] };\n      }\n      const res = await dispatch({ method, path, query, body, headers }, ctx);\n      return responseToResult(res, maxChars);\n    },\n  };\n}\n","/**\n * OAuth 2.1 support per the MCP authorization spec: the MCP endpoint acts as an\n * OAuth *resource server*. It publishes Protected Resource Metadata (RFC 9728),\n * answers unauthenticated requests with a `WWW-Authenticate` challenge that\n * tells the client where to log in, and checks bearer tokens with a verifier\n * you provide (see `jwtVerifier` / `introspectionVerifier` in `mcp-expose/oauth`).\n *\n * Runtime-agnostic: no `node:*` imports.\n */\n\n/** Who the access token belongs to and what it allows. Available to tools as `ctx.auth`. */\nexport interface AuthInfo {\n  /** The raw access token. */\n  token: string;\n  /** Scopes granted to the token. */\n  scopes: string[];\n  /** Subject (user id), e.g. the JWT `sub` claim. */\n  subject?: string;\n  /** OAuth client the token was issued to. */\n  clientId?: string;\n  /** Expiry, in seconds since the epoch. Expired tokens are rejected. */\n  expiresAt?: number;\n  /** All claims / introspection fields. */\n  claims?: Record<string, unknown>;\n}\n\nexport interface VerifyTokenContext {\n  /** The canonical resource URL (`oauth.resource`). Tokens must be issued for it (audience). */\n  resource: string;\n  /** Lower-cased headers of the MCP request. */\n  headers: Record<string, string>;\n}\n\n/**\n * Checks an access token. Return its AuthInfo, or `undefined` / throw when the\n * token is invalid. It MUST check that the token was issued for this server\n * (audience = `ctx.resource`), or tokens meant for other services would be accepted.\n */\nexport type TokenVerifier = (\n  token: string,\n  ctx: VerifyTokenContext,\n) => AuthInfo | undefined | null | Promise<AuthInfo | undefined | null>;\n\nexport interface OAuthOptions {\n  /**\n   * Canonical, public URL of the MCP endpoint, e.g. `https://api.example.com/mcp`.\n   * Clients request tokens for this resource, and it must match the URL they connect to.\n   */\n  resource: string;\n  /** Issuer URLs of the authorization servers that issue tokens for this server. */\n  authorizationServers: string[];\n  /** Checks bearer tokens. */\n  verifyToken: TokenVerifier;\n  /** Scopes every token needs to use the MCP endpoint at all. */\n  requiredScopes?: string[];\n  /** Scopes advertised in the metadata. @default requiredScopes plus every tool's `scopes` */\n  scopesSupported?: string[];\n  /** Human-readable name shown by clients. */\n  resourceName?: string;\n  /** URL of documentation for developers. */\n  resourceDocumentation?: string;\n  /** Extra fields merged into the Protected Resource Metadata document. */\n  metadata?: Record<string, unknown>;\n}\n\nexport const PROTECTED_RESOURCE_WELL_KNOWN = '/.well-known/oauth-protected-resource';\n\n/**\n * Paths the metadata is served on, per RFC 9728: the well-known prefix with the\n * resource path appended (`/.well-known/oauth-protected-resource/mcp`), plus the\n * bare well-known path that older clients fall back to.\n */\nexport function protectedResourceMetadataPaths(resource: string): string[] {\n  const pathname = new URL(resource).pathname.replace(/\\/+$/, '');\n  return pathname\n    ? [PROTECTED_RESOURCE_WELL_KNOWN + pathname, PROTECTED_RESOURCE_WELL_KNOWN]\n    : [PROTECTED_RESOURCE_WELL_KNOWN];\n}\n\n/** Absolute URL of the metadata document, used in `WWW-Authenticate`. */\nexport function protectedResourceMetadataUrl(resource: string): string {\n  return new URL(protectedResourceMetadataPaths(resource)[0] as string, resource).href;\n}\n\nexport function validateOAuthOptions(o: OAuthOptions): void {\n  let url: URL;\n  try {\n    url = new URL(o.resource);\n  } catch {\n    throw new Error(`mcp-expose: oauth.resource must be an absolute URL, got ${JSON.stringify(o.resource)}`);\n  }\n  if (url.hash) throw new Error('mcp-expose: oauth.resource must not contain a fragment');\n  if (!o.authorizationServers?.length) throw new Error('mcp-expose: oauth.authorizationServers must not be empty');\n  if (typeof o.verifyToken !== 'function') throw new Error('mcp-expose: oauth.verifyToken is required');\n}\n\nconst quote = (v: string) => `\"${v.replace(/[\"\\\\]/g, '\\\\$&')}\"`;\n\n/** Build a `WWW-Authenticate: Bearer ...` challenge (RFC 6750 + RFC 9728). */\nexport function bearerChallenge(\n  resource: string,\n  params: { error?: string; errorDescription?: string; scope?: string[] } = {},\n): string {\n  const parts: string[] = [];\n  if (params.error) parts.push(`error=${quote(params.error)}`);\n  if (params.errorDescription) parts.push(`error_description=${quote(params.errorDescription)}`);\n  if (params.scope?.length) parts.push(`scope=${quote(params.scope.join(' '))}`);\n  parts.push(`resource_metadata=${quote(protectedResourceMetadataUrl(resource))}`);\n  return `Bearer ${parts.join(', ')}`;\n}\n\n/** Extract the token from `Authorization: Bearer <token>`. Tokens in the query string are never accepted. */\nexport function bearerToken(headers: Record<string, string>): string | undefined {\n  const m = /^Bearer[ ]+([^\\s,]+)\\s*$/i.exec(headers.authorization ?? '');\n  return m?.[1];\n}\n\nexport type AuthOutcome =\n  | { ok: true; auth: AuthInfo }\n  | { ok: false; status: 401 | 403; challenge: string; error: string; description: string };\n\n/** Authenticate one MCP request. */\nexport async function authenticate(o: OAuthOptions, headers: Record<string, string>): Promise<AuthOutcome> {\n  const token = bearerToken(headers);\n  if (!token) {\n    // No credentials: a bare challenge pointing at the metadata starts the client's login flow.\n    return {\n      ok: false,\n      status: 401,\n      error: 'unauthorized',\n      description: 'Authorization required',\n      challenge: bearerChallenge(o.resource, { scope: o.requiredScopes }),\n    };\n  }\n\n  let auth: AuthInfo | undefined | null;\n  try {\n    auth = await o.verifyToken(token, { resource: o.resource, headers });\n  } catch {\n    auth = undefined;\n  }\n  if (!auth) return deny(o, 401, 'invalid_token', 'The access token is invalid');\n  if (auth.expiresAt !== undefined && auth.expiresAt * 1000 <= Date.now()) {\n    return deny(o, 401, 'invalid_token', 'The access token has expired');\n  }\n  const missing = missingScopes(auth, o.requiredScopes);\n  if (missing.length) {\n    // Keep the scopes already granted in the challenge, so re-authorizing never drops access.\n    const scope = [...new Set([...(auth.scopes ?? []), ...(o.requiredScopes ?? [])])];\n    return deny(o, 403, 'insufficient_scope', `Missing scope: ${missing.join(' ')}`, scope);\n  }\n  return { ok: true, auth: { ...auth, scopes: auth.scopes ?? [] } };\n}\n\n/** A failed AuthOutcome with an RFC 6750 error challenge. */\nexport function deny(\n  o: OAuthOptions,\n  status: 401 | 403,\n  error: string,\n  description: string,\n  scope?: string[],\n): AuthOutcome & { ok: false } {\n  return {\n    ok: false,\n    status,\n    error,\n    description,\n    challenge: bearerChallenge(o.resource, { error, errorDescription: description, scope }),\n  };\n}\n\nexport function missingScopes(auth: AuthInfo | undefined, required: string[] | undefined): string[] {\n  if (!required?.length) return [];\n  const granted = new Set(auth?.scopes ?? []);\n  return required.filter((s) => !granted.has(s));\n}\n\n/** Parse a space-separated `scope` string or an array of scopes. */\nexport function parseScopes(value: unknown): string[] {\n  if (Array.isArray(value)) return value.map(String);\n  if (typeof value === 'string') return value.split(' ').filter(Boolean);\n  return [];\n}\n","import { authenticate, deny, missingScopes, protectedResourceMetadataPaths, validateOAuthOptions } from './oauth.js';\nimport type { McpServerOptions, McpToolDefinition, ToolContext, ToolResult } from './types.js';\n\nexport const SUPPORTED_PROTOCOL_VERSIONS = ['2025-11-25', '2025-06-18', '2025-03-26', '2024-11-05'];\nexport const LATEST_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSIONS[0] as string;\n\ntype JsonRpcId = string | number | null;\ninterface JsonRpcRequest {\n  jsonrpc: '2.0';\n  id?: JsonRpcId;\n  method: string;\n  params?: Record<string, unknown>;\n}\nexport interface JsonRpcResponse {\n  jsonrpc: '2.0';\n  id: JsonRpcId;\n  result?: unknown;\n  error?: { code: number; message: string; data?: unknown };\n}\n\nconst PARSE_ERROR = -32700;\nconst INVALID_REQUEST = -32600;\nconst METHOD_NOT_FOUND = -32601;\nconst INVALID_PARAMS = -32602;\n\nconst ok = (id: JsonRpcId, result: unknown): JsonRpcResponse => ({ jsonrpc: '2.0', id, result });\nconst fail = (id: JsonRpcId, code: number, message: string): JsonRpcResponse => ({\n  jsonrpc: '2.0',\n  id,\n  error: { code, message },\n});\n\n/** Minimal HTTP request/response shapes, so each adapter can bridge its own framework. */\nexport interface McpHttpRequest {\n  method: string;\n  headers: Record<string, string>;\n  /** Parsed JSON body, or the raw string. */\n  body: unknown;\n}\nexport interface McpHttpResponse {\n  status: number;\n  headers: Record<string, string>;\n  body?: string;\n}\n\n/**\n * A stateless MCP server speaking the Streamable HTTP transport (JSON responses).\n * Holds the tool registry and answers JSON-RPC messages.\n */\nexport class McpServer {\n  private readonly tools = new Map<string, McpToolDefinition>();\n  private loaders: (() => void | Promise<void>)[] = [];\n\n  constructor(readonly options: McpServerOptions) {\n    if (options.oauth) validateOAuthOptions(options.oauth);\n  }\n\n  /** Register a tool. Throws on duplicate names. */\n  addTool(tool: McpToolDefinition): this {\n    if (this.tools.has(tool.name)) {\n      throw new Error(`mcp-expose: duplicate tool name \"${tool.name}\". Set an explicit \\`name\\`.`);\n    }\n    this.tools.set(tool.name, tool);\n    return this;\n  }\n\n  /** Register a function that adds tools lazily, right before the first MCP request is served. */\n  onLoad(loader: () => void | Promise<void>): this {\n    this.loaders.push(loader);\n    return this;\n  }\n\n  async listTools(): Promise<McpToolDefinition[]> {\n    await this.load();\n    return [...this.tools.values()];\n  }\n\n  private async load() {\n    if (!this.loaders.length) return;\n    const loaders = this.loaders;\n    this.loaders = [];\n    for (const l of loaders) await l();\n  }\n\n  /** Handle one JSON-RPC message (or a batch). Returns null when no response is due. */\n  async handleMessage(message: unknown, ctx: ToolContext): Promise<JsonRpcResponse | JsonRpcResponse[] | null> {\n    if (Array.isArray(message)) {\n      const results = (await Promise.all(message.map((m) => this.handleOne(m, ctx)))).filter(\n        (r): r is JsonRpcResponse => r !== null,\n      );\n      return results.length ? results : null;\n    }\n    return this.handleOne(message, ctx);\n  }\n\n  private async handleOne(message: unknown, ctx: ToolContext): Promise<JsonRpcResponse | null> {\n    const msg = message as Partial<JsonRpcRequest>;\n    if (!msg || typeof msg !== 'object' || msg.jsonrpc !== '2.0') {\n      return fail(null, INVALID_REQUEST, 'Invalid JSON-RPC message');\n    }\n    // Responses from the client or notifications: acknowledge, no reply.\n    if (typeof msg.method !== 'string' || msg.id === undefined) return null;\n    const id = msg.id;\n    const params = msg.params ?? {};\n\n    await this.load();\n    switch (msg.method) {\n      case 'initialize': {\n        const requested = params.protocolVersion as string | undefined;\n        const protocolVersion =\n          requested && SUPPORTED_PROTOCOL_VERSIONS.includes(requested) ? requested : LATEST_PROTOCOL_VERSION;\n        return ok(id, {\n          protocolVersion,\n          capabilities: { tools: { listChanged: false } },\n          serverInfo: { name: this.options.name, version: this.options.version ?? '1.0.0' },\n          ...(this.options.instructions ? { instructions: this.options.instructions } : {}),\n        });\n      }\n      case 'ping':\n        return ok(id, {});\n      case 'tools/list':\n        return ok(id, {\n          tools: [...this.tools.values()].map((t) => ({\n            name: t.name,\n            ...(t.title ? { title: t.title } : {}),\n            description: t.description,\n            inputSchema: t.inputSchema,\n            ...(t.annotations ? { annotations: t.annotations } : {}),\n          })),\n        });\n      case 'tools/call': {\n        const tool = this.tools.get(params.name as string);\n        if (!tool) return fail(id, INVALID_PARAMS, `Unknown tool: ${String(params.name)}`);\n        return ok(id, await this.callTool(tool, (params.arguments ?? {}) as Record<string, unknown>, ctx));\n      }\n      case 'resources/list':\n        return ok(id, { resources: [] });\n      case 'prompts/list':\n        return ok(id, { prompts: [] });\n      default:\n        return fail(id, METHOD_NOT_FOUND, `Method not found: ${msg.method}`);\n    }\n  }\n\n  private async callTool(\n    tool: McpToolDefinition,\n    args: Record<string, unknown>,\n    ctx: ToolContext,\n  ): Promise<ToolResult> {\n    try {\n      if (tool.validate) {\n        const v = await tool.validate(args);\n        if (!v.ok) return { isError: true, content: [{ type: 'text', text: `Invalid arguments: ${v.message}` }] };\n        args = v.value as Record<string, unknown>;\n      }\n      return await tool.handler(args, ctx);\n    } catch (err) {\n      // Tool failures are reported in-band so the model can react to them.\n      return { isError: true, content: [{ type: 'text', text: `Tool error: ${(err as Error).message}` }] };\n    }\n  }\n\n  /** Check the Origin header (DNS rebinding protection). */\n  isOriginAllowed(origin: string | undefined): boolean {\n    if (!origin) return true;\n    const allowed = this.options.allowedOrigins;\n    if (allowed === '*') return true;\n    return (allowed ?? []).includes(origin);\n  }\n\n  /**\n   * Paths on which adapters serve the OAuth Protected Resource Metadata\n   * (empty when `oauth` is not configured). They must be public: no auth middleware.\n   */\n  get oauthMetadataPaths(): string[] {\n    return this.options.oauth ? protectedResourceMetadataPaths(this.options.oauth.resource) : [];\n  }\n\n  /** The OAuth Protected Resource Metadata document (RFC 9728). */\n  async protectedResourceMetadata(): Promise<Record<string, unknown>> {\n    const o = this.options.oauth;\n    if (!o) throw new Error('mcp-expose: the oauth option is not configured');\n    await this.load();\n    const scopes = o.scopesSupported ?? [\n      ...new Set([...(o.requiredScopes ?? []), ...[...this.tools.values()].flatMap((t) => t.scopes ?? [])]),\n    ];\n    return {\n      resource: o.resource,\n      authorization_servers: o.authorizationServers,\n      ...(scopes.length ? { scopes_supported: scopes } : {}),\n      bearer_methods_supported: ['header'],\n      ...(o.resourceName ? { resource_name: o.resourceName } : {}),\n      ...(o.resourceDocumentation ? { resource_documentation: o.resourceDocumentation } : {}),\n      ...o.metadata,\n    };\n  }\n\n  /** HTTP handler for the metadata paths. Public and CORS-enabled so browser-based clients can read it. */\n  async handleMetadataHttp(req: Pick<McpHttpRequest, 'method'>): Promise<McpHttpResponse> {\n    const cors = { 'access-control-allow-origin': '*', 'access-control-allow-methods': 'GET, OPTIONS' };\n    const method = req.method.toUpperCase();\n    if (!this.options.oauth) return { status: 404, headers: {} };\n    if (method === 'OPTIONS') return { status: 204, headers: { ...cors, 'access-control-allow-headers': '*' } };\n    if (method !== 'GET' && method !== 'HEAD') return { status: 405, headers: { allow: 'GET, OPTIONS' } };\n    const body = JSON.stringify(await this.protectedResourceMetadata());\n    return {\n      status: 200,\n      headers: { ...cors, 'content-type': 'application/json', 'cache-control': 'public, max-age=3600' },\n      body: method === 'HEAD' ? undefined : body,\n    };\n  }\n\n  /**\n   * Framework-neutral Streamable HTTP handler. Adapters convert their request\n   * into McpHttpRequest, call this, and write the McpHttpResponse back.\n   */\n  async handleHttp(req: McpHttpRequest, ctx: ToolContext): Promise<McpHttpResponse> {\n    const json = { 'content-type': 'application/json' };\n    if (!this.isOriginAllowed(req.headers.origin)) {\n      return { status: 403, headers: json, body: JSON.stringify(fail(null, INVALID_REQUEST, 'Origin not allowed')) };\n    }\n    const oauth = this.options.oauth;\n    if (oauth) {\n      const outcome = await authenticate(oauth, req.headers);\n      if (!outcome.ok) return authError(outcome);\n      ctx = { ...ctx, auth: outcome.auth };\n    }\n    if (req.method.toUpperCase() !== 'POST') {\n      // Stateless server: no standalone SSE stream and no sessions to delete.\n      return { status: 405, headers: { allow: 'POST' } };\n    }\n    let body = req.body;\n    if (typeof body === 'string' || body instanceof Uint8Array) {\n      try {\n        body = JSON.parse(typeof body === 'string' ? body : new TextDecoder().decode(body));\n      } catch {\n        return { status: 400, headers: json, body: JSON.stringify(fail(null, PARSE_ERROR, 'Parse error')) };\n      }\n    }\n    if (oauth) {\n      // Per-tool scopes: answer 403 so the client can ask the user for more access (step-up).\n      await this.load();\n      const calls = (Array.isArray(body) ? body : [body]) as Partial<JsonRpcRequest>[];\n      for (const m of calls) {\n        if (m?.method !== 'tools/call') continue;\n        const tool = this.tools.get(m.params?.name as string);\n        const missing = missingScopes(ctx.auth, tool?.scopes);\n        if (missing.length) {\n          // Include the scopes already granted, so re-authorizing never drops access the user gave before.\n          const scope = [\n            ...new Set([...(ctx.auth?.scopes ?? []), ...(oauth.requiredScopes ?? []), ...(tool?.scopes ?? [])]),\n          ];\n          return authError(\n            deny(oauth, 403, 'insufficient_scope', `Tool \"${tool!.name}\" needs scope: ${missing.join(' ')}`, scope),\n          );\n        }\n      }\n    }\n    const response = await this.handleMessage(body, ctx);\n    if (response === null) return { status: 202, headers: {} };\n    return { status: 200, headers: json, body: JSON.stringify(response) };\n  }\n}\n\nfunction authError(o: { status: number; challenge: string; error: string; description: string }): McpHttpResponse {\n  return {\n    status: o.status,\n    headers: { 'content-type': 'application/json', 'www-authenticate': o.challenge },\n    body: JSON.stringify({ error: o.error, error_description: o.description }),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;kBAAsB;;;ACEf,SAASA,SAASC,MAAcC,KAAyC;AAC9E,QAAMC,MAAM,IAAIC,IAAIH,KAAKI,QAAQ,QAAQ,EAAA,IAAMH,IAAII,IAAI;AACvD,aAAW,CAACC,GAAGC,CAAAA,KAAMC,OAAOC,QAAQR,IAAIS,KAAK,GAAG;AAC9C,eAAWC,QAAQC,MAAMC,QAAQN,CAAAA,IAAKA,IAAI;MAACA;MAAIL,KAAIY,aAAaC,OAAOT,GAAGK,IAAAA;EAC5E;AACA,SAAOT,IAAIc,SAAQ;AACrB;AANgBjB;AAwBT,SAASkB,sBAAsBC,MAA4B;AAChE,QAAMC,UAAUD,KAAKE,SAASA;AAC9B,SAAO,OAAOnB,KAAKoB,QAAAA;AACjB,UAAMrB,OAAO,OAAOkB,KAAKI,YAAY,aAAaJ,KAAKI,QAAQD,GAAAA,IAAOH,KAAKI;AAC3E,UAAMC,MAAM,MAAMJ,QAAQpB,SAASC,MAAMC,GAAAA,GAAM;MAC7CuB,QAAQvB,IAAIuB;MACZC,SAASxB,IAAIwB;MACbC,MACEzB,IAAIyB,SAASC,UAAa1B,IAAIuB,WAAW,SAASvB,IAAIuB,WAAW,SAASG,SAAYC,KAAKC,UAAU5B,IAAIyB,IAAI;MAC/GI,QAAQC,YAAYC,QAAQd,KAAKe,aAAa,GAAA;IAChD,CAAA;AACA,UAAMR,UAAkC,CAAC;AACzCF,QAAIE,QAAQS,QAAQ,CAAC3B,GAAGD,MAAOmB,QAAQnB,CAAAA,IAAKC,CAAAA;AAC5C,WAAO;MAAE4B,QAAQZ,IAAIY;MAAQV;MAASC,MAAM,MAAMH,IAAIa,KAAI;IAAG;EAC/D;AACF;AAfgBnB;;;ACtBT,SAASoB,iBAAiBC,SAAsD;AACrF,QAAMC,MAA8B,CAAC;AACrC,aAAW,CAACC,GAAGC,CAAAA,KAAMC,OAAOC,QAAQL,OAAAA,GAAU;AAC5C,QAAIG,MAAMG,OAAW;AACrBL,QAAIC,EAAEK,YAAW,CAAA,IAAMC,MAAMC,QAAQN,CAAAA,IAAKA,EAAEO,KAAK,IAAA,IAAQC,OAAOR,CAAAA;EAClE;AACA,SAAOF;AACT;AAPgBF;AAUT,SAASa,YAAYC,KAAsBC,QAAQ,IAAI,OAAO,MAAI;AACvE,SAAO,IAAIC,QAAQ,CAACC,SAASC,WAAAA;AAC3B,QAAIC,OAAO;AACX,UAAMC,SAAmB,CAAA;AACzBN,QAAIO,GAAG,QAAQ,CAACC,MAAAA;AACdH,cAAQG,EAAEC;AACV,UAAIJ,OAAOJ,OAAO;AAChBG,eAAO,IAAIM,MAAM,wBAAA,CAAA;AACjBV,YAAIW,QAAO;MACb,MAAOL,QAAOM,KAAKJ,CAAAA;IACrB,CAAA;AACAR,QAAIO,GAAG,OAAO,MAAMJ,QAAQU,OAAOC,OAAOR,MAAAA,EAAQS,SAAS,MAAA,CAAA,CAAA;AAC3Df,QAAIO,GAAG,SAASH,MAAAA;EAClB,CAAA;AACF;AAdgBL;AAiBT,SAASiB,gBAAgBhB,KAAoB;AAClD,QAAMiB,SAASjB,IAAIiB;AAInB,QAAMC,OAAOD,OAAOE;AACpB,QAAMC,YAAYH,OAAOG;AAIzB,QAAMC,QAAQJ,OAAOK,QAAQC,QAAAA;AAC7B,MAAIC,OAAQ,OAAOH,UAAU,YAAYA,OAAOE,WAAYN,OAAOQ,gBAAgB;AACnF,MAAID,KAAKE,WAAW,SAAA,EAAYF,QAAOA,KAAKG,MAAM,CAAA;AAClD,MAAIH,SAAS,QAAQA,SAAS,UAAWA,QAAO;AAChD,MAAIA,KAAKI,SAAS,GAAA,EAAMJ,QAAO,IAAIA,IAAAA;AACnC,SAAO,GAAGJ,YAAY,UAAU,MAAA,MAAYI,IAAAA,IAAQN,IAAAA;AACtD;AAhBgBF;;;ACtBhB,SAASa,WAAWC,GAAU;AAC5B,SAAO,OAAOA,MAAM,YAAYA,MAAM,QAAQ,eAAeA;AAC/D;AAFSD;AAKF,SAASE,aAAaC,QAA8B;AACzD,MAAIA,WAAWC,UAAaD,WAAW,KAAM,QAAOC;AACpD,MAAIC;AACJ,MAAIL,WAAWG,MAAAA,KAAW,OAAOA,OAAO,WAAA,EAAaG,YAAYC,UAAU,YAAY;AACrFF,UAAMF,OAAO,WAAA,EAAaG,WAAWC,MAAM;MAAEC,QAAQ;IAAgB,CAAA;EACvE,WAAW,OAAQL,OAAsCM,iBAAiB,YAAY;AACpFJ,UAAOF,OAAuCM,aAAY;EAC5D,WAAWT,WAAWG,MAAAA,GAAS;AAC7B,UAAM,IAAIO,MACR,wGAAA;EAEJ,OAAO;AACLL,UAAMF;EACR;AACA,QAAM,EAAEQ,SAASC,UAAU,GAAGC,KAAAA,IAASR;AACvC,SAAOQ;AACT;AAhBgBX;AAmBT,SAASY,YAAYX,QAA8B;AACxD,MAAI,CAACH,WAAWG,MAAAA,KAAW,OAAOA,OAAO,WAAA,EAAaY,aAAa,WAAY,QAAOX;AACtF,QAAMW,WAAWZ,OAAO,WAAA,EAAaY;AACrC,SAAO,OAAOC,UAAAA;AACZ,UAAMC,SAAU,MAAMF,SAASC,KAAAA;AAI/B,QAAI,CAACC,OAAOC,OAAQ,QAAO;MAAEC,IAAI;MAAMH,OAAOC,OAAOD;IAAM;AAC3D,UAAMI,UAAUH,OAAOC,OACpBG,IAAI,CAACC,MAAAA;AACJ,YAAMC,QAAQD,EAAEC,QAAQ,CAAA,GAAIF,IAAI,CAACG,MAAO,OAAOA,MAAM,WAAWC,OAAOD,EAAEE,GAAG,IAAID,OAAOD,CAAAA,CAAAA,EAAKG,KAAK,GAAA;AACjG,aAAOJ,OAAO,GAAGA,IAAAA,KAASD,EAAEF,OAAO,KAAKE,EAAEF;IAC5C,CAAA,EACCO,KAAK,IAAA;AACR,WAAO;MAAER,IAAI;MAAOC;IAAQ;EAC9B;AACF;AAjBgBN;AAoBT,SAASc,cAAczB,QAAoB0B,MAA6B;AAC7E,QAAMC,WAAW3B,OAAO4B,YAAY,CAAA,GAAIC,OAAO,CAACC,MAAMJ,KAAKI,CAAAA,MAAO7B,MAAAA;AAClE,SAAO0B,QAAQI,SAAS,iCAAiCJ,QAAQH,KAAK,IAAA,CAAA,KAAUvB;AAClF;AAHgBwB;;;ACvCT,IAAMO,0BAA0B;EAAC;EAAiB;EAAU;EAAa;;AAChF,IAAMC,eAAe,oBAAIC,IAAI;EAAC;EAAQ;EAAO;CAAQ;AACrD,IAAMC,WAAW;AAGV,SAASC,WAAWC,MAAY;AACrC,SAAO;OAAIA,KAAKC,SAASH,QAAAA;IAAWI,IAAI,CAACC,MAAOA,EAAE,CAAA,KAAMA,EAAE,CAAA,CAAE;AAC9D;AAFgBJ;AAShB,SAASK,cAAcC,MAAcC,OAAc;AACjD,QAAMC,MAAMC,OAAOF,KAAAA;AACnB,MAAIC,QAAQ,MAAMA,QAAQ,OAAOA,QAAQ,MAAM;AAC7C,UAAM,IAAIE,MAAM,qCAAqCJ,IAAAA,MAAUK,KAAKC,UAAUJ,GAAAA,CAAAA,EAAM;EACtF;AACA,SAAOK,mBAAmBL,GAAAA;AAC5B;AANSH;AASF,SAASS,gBAAgBb,MAAcc,QAA+B;AAC3E,SAAOd,KACJe,QAAQ,yBAAyB,CAACC,GAAGC,MACpCH,OAAOG,CAAAA,MAAOC,SAAY,KAAK,IAAId,cAAca,GAAGH,OAAOG,CAAAA,CAAE,CAAA,EAAG,EAEjEF,QAAQjB,UAAU,CAACkB,GAAGG,GAAYC,MAAAA;AACjC,UAAMH,IAAKE,KAAKC;AAChB,WAAOhB,cAAca,GAAGH,OAAOG,CAAAA,CAAE;EACnC,CAAA;AACJ;AATgBJ;AAsBT,SAASQ,kBAAkBC,QAAgBC,MAAY;AAC5D,QAAMC,WAAWD,KACdE,MAAM,GAAA,EACNC,OAAOC,OAAAA,EACPC,IAAI,CAACC,MAAAA;AACJ,UAAMC,IAAI,gDAAgDC,KAAKF,CAAAA;AAC/D,WAAOC,IAAI,MAAMA,EAAE,CAAA,KAAMA,EAAE,CAAA,CAAE,KAAKD;EACpC,CAAA;AACF,SAAOG,iBAAiB;IAACV,OAAOW,YAAW;OAAOT;IAAUU,KAAK,GAAA,CAAA;AACnE;AATgBb;AAWT,SAASW,iBAAiBG,MAAY;AAC3C,SAAOA,KACJC,QAAQ,oBAAoB,GAAA,EAC5BA,QAAQ,OAAO,GAAA,EACfA,QAAQ,UAAU,EAAA,EAClBC,MAAM,GAAG,EAAA;AACd;AANgBL;AAQhB,SAASM,mBAAmBhB,QAAc;AACxC,UAAQA,QAAAA;IACN,KAAK;IACL,KAAK;AACH,aAAO;QAAEiB,cAAc;QAAMC,eAAe;MAAM;IACpD,KAAK;AACH,aAAO;QAAED,cAAc;QAAOE,iBAAiB;QAAMC,gBAAgB;QAAMF,eAAe;MAAM;IAClG,KAAK;AACH,aAAO;QAAED,cAAc;QAAOE,iBAAiB;QAAOC,gBAAgB;QAAMF,eAAe;MAAM;IACnG;AACE,aAAO;QAAED,cAAc;QAAOE,iBAAiB;QAAOD,eAAe;MAAM;EAC/E;AACF;AAZSF;AA2BF,SAASK,iBACdC,OACAC,MAAsB;AAEtB,QAAMvB,SAASsB,MAAMtB,OAAOwB,YAAW;AACvC,QAAMC,SAASC,WAAWJ,MAAMrB,IAAI;AACpC,QAAM0B,UAAsB;IAC1BF;IACAG,OAAO,oBAAIC,IAAAA;IACXC,MAAM,oBAAID,IAAAA;IACVE,WAAW;IACXC,YAAYC,aAAaC,IAAIlC,MAAAA;EAC/B;AAEA,MAAIuB,KAAKY,OAAO;AACd,UAAMC,UAASC,aAAad,KAAKY,KAAK;AACtC,WAAO;MAAEC,QAAQ;QAAEE,MAAM;QAAU,GAAGF;MAAO;MAAGT;IAAQ;EAC1D;AAEA,QAAMY,aAAyC,CAAC;AAChD,QAAMC,WAAW,oBAAIX,IAAAA;AAErB,QAAMY,cAAcJ,aAAad,KAAKE,MAAM;AAC5C,aAAWiB,KAAKjB,QAAQ;AACtBc,eAAWG,CAAAA,IAAKD,aAAaF,aAAaG,CAAAA,KAAM;MAAEJ,MAAM;MAAUK,aAAa,mBAAmBD,CAAAA;IAAK;AACvG,QAAI,CAACpB,MAAMrB,KAAK2C,SAAS,IAAIF,CAAAA,GAAI,EAAGF,UAASK,IAAIH,CAAAA;EACnD;AAEA,QAAMI,cAAcT,aAAad,KAAKK,KAAK;AAC3C,aAAW,CAACmB,GAAGC,CAAAA,KAAMC,OAAOC,QAAQJ,aAAaP,cAAc,CAAC,CAAA,GAAI;AAClEA,eAAWQ,CAAAA,IAAKC;AAChBrB,YAAQC,MAAMiB,IAAIE,CAAAA;EACpB;AACA,aAAWA,KAAKD,aAAaN,YAAY,CAAA,EAAIA,UAASK,IAAIE,CAAAA;AAE1D,QAAMI,aAAad,aAAad,KAAKO,IAAI;AACzC,MAAIqB,YAAY;AACd,QAAIA,WAAWZ,eAAeY,WAAWb,SAASc,UAAaD,WAAWb,SAAS,WAAW;AAC5F,iBAAW,CAACS,GAAGC,CAAAA,KAAMC,OAAOC,QAAQC,WAAWZ,UAAU,GAAG;AAC1DA,mBAAWQ,CAAAA,IAAKC;AAChBrB,gBAAQG,KAAKe,IAAIE,CAAAA;MACnB;AACA,iBAAWA,KAAKI,WAAWX,YAAY,CAAA,EAAIA,UAASK,IAAIE,CAAAA;IAC1D,OAAO;AACLR,iBAAWT,OAAOqB;AAClBX,eAASK,IAAI,MAAA;AACblB,cAAQI,YAAY;IACtB;EACF;AAEA,QAAMK,SAAqB;IAAEE,MAAM;IAAUC;EAAW;AACxD,MAAIC,SAASa,KAAMjB,QAAOI,WAAW;OAAIA;;AACzC,SAAO;IAAEJ;IAAQT;EAAQ;AAC3B;AArDgBN;AAuDhB,SAASiC,UAAUC,MAA+B5B,SAAmB;AACnE,QAAM6B,aAAsC,CAAC;AAC7C,QAAM5B,QAA2C,CAAC;AAClD,MAAIE;AAEJ,aAAW,CAACiB,GAAGC,CAAAA,KAAMC,OAAOC,QAAQK,IAAAA,GAAO;AACzC,QAAIP,MAAMI,OAAW;AACrB,QAAIzB,QAAQF,OAAOmB,SAASG,CAAAA,GAAI;AAC9BS,iBAAWT,CAAAA,IAAKC;IAClB,WAAWrB,QAAQI,aAAagB,MAAM,QAAQ;AAC5CjB,aAAOkB;IACT,WAAWrB,QAAQC,MAAMM,IAAIa,CAAAA,KAAO,CAACpB,QAAQG,KAAKI,IAAIa,CAAAA,KAAM,CAACpB,QAAQK,YAAa;AAChFJ,YAAMmB,CAAAA,IAAKU,MAAMC,QAAQV,CAAAA,IAAKA,EAAE1C,IAAIqD,MAAAA,IAAU,OAAOX,MAAM,YAAYA,MAAM,OAAOY,KAAKC,UAAUb,CAAAA,IAAKW,OAAOX,CAAAA;IACjH,OAAO;AACLlB,aAAO;QAAE,GAAKA,QAAoC,CAAC;QAAI,CAACiB,CAAAA,GAAIC;MAAE;IAChE;EACF;AACA,MAAIlB,SAASsB,UAAazB,QAAQK,WAAYF,QAAO,CAAC;AACtD,SAAO;IAAE0B;IAAY5B;IAAOE;EAAK;AACnC;AAnBSwB;AAqBF,SAASQ,iBAAiBC,KAAoBC,UAAgB;AACnE,MAAIC,OAAOF,IAAIjC;AACf,MAAImC,KAAKC,SAASF,SAAUC,QAAO,GAAGA,KAAKlD,MAAM,GAAGiD,QAAAA,CAAAA;mBAA0BC,KAAKC,SAASF,QAAAA;AAC5F,QAAMG,UAAUJ,IAAIK,UAAU;AAC9B,QAAMC,SAAqB;IACzBC,SAAS;MAAC;QAAEhC,MAAM;QAAQ2B,MAAME,UAAU,QAAQJ,IAAIK,MAAM;EAAKH,IAAAA,KAASA,QAAQ,QAAQF,IAAIK,MAAM;MAAG;;EACzG;AACA,MAAID,SAAS;AACXE,WAAOF,UAAU;AACjB,WAAOE;EACT;AACA,OAAKN,IAAIQ,QAAQ,cAAA,KAAmB,IAAI3B,SAAS,MAAA,KAAWqB,SAASF,IAAIjC,MAAM;AAC7E,QAAI;AACF,YAAM0C,SAASZ,KAAKa,MAAMV,IAAIjC,IAAI;AAClC,UAAI0C,UAAU,OAAOA,WAAW,YAAY,CAACf,MAAMC,QAAQc,MAAAA,EAASH,QAAOK,oBAAoBF;IACjG,QAAQ;IAER;EACF;AACA,SAAOH;AACT;AApBgBP;AAsBT,SAASa,mBAAmBC,KAAkBC,OAAe;AAClE,QAAMC,MAA8B,CAAC;AACrC,aAAWjE,QAAQgE,OAAO;AACxB,UAAM7B,IAAI4B,IAAIL,QAAQ1D,KAAKF,YAAW,CAAA;AACtC,QAAIqC,MAAMI,OAAW0B,KAAIjE,KAAKF,YAAW,CAAA,IAAMqC;EACjD;AACA,SAAO8B;AACT;AAPgBH;AAaT,SAASI,gBACdzD,OACAC,MACAyD,UACAC,aAA4E,CAAC,GAAC;AAE9E,QAAMjF,SAASsB,MAAMtB,OAAOwB,YAAW;AACvC,QAAMX,OAAOH,iBAAiBa,KAAKV,QAAQd,kBAAkBC,QAAQsB,MAAMrB,IAAI,CAAA;AAC/E,QAAM,EAAEmC,QAAQT,QAAO,IAAKN,iBAAiBC,OAAOC,IAAAA;AACpD,QAAM2D,UAAUD,WAAWE,kBAAkBC;AAC7C,QAAMpB,WAAWiB,WAAWI,oBAAoB;AAEhD,SAAO;IACLxE;IACAyE,OAAO/D,KAAK+D;IACZ3C,aAAapB,KAAKoB,eAAe,GAAG3C,MAAAA,IAAUsB,MAAMrB,IAAI;IACxDsF,aAAanD;IACboD,aAAa;MAAE,GAAGxE,mBAAmBhB,MAAAA;MAAS,GAAGuB,KAAKiE;IAAY;IAClEC,QAAQlE,KAAKkE;IACbC,UAAUC,YAAYpE,KAAKY,KAAK;IAChC,MAAMyD,QAAQrC,MAAMqB,KAAG;AACrB,YAAMiB,UAAUtE,KAAKY,QAAQiB,SAAY0C,cAAc1D,QAAQmB,IAAAA;AAC/D,UAAIsC,QAAS,QAAO;QAAE1B,SAAS;QAAMG,SAAS;UAAC;YAAEhC,MAAM;YAAQ2B,MAAM4B;UAAQ;;MAAG;AAEhF,YAAM,EAAErC,YAAY5B,OAAOE,KAAI,IAAKwB,UAAUC,MAAM5B,OAAAA;AACpD,YAAM4C,UAAkC;QACtCwB,QAAQ;QACR,GAAGpB,mBAAmBC,KAAKM,OAAAA;QAC3B,GAAG3D,KAAKgD;QACR,cAAc1D;MAChB;AACA,UAAI+D,IAAIoB,SAAUzB,SAAQ,iBAAA,IAAqBK,IAAIoB;AACnD,UAAIlE,SAASsB,OAAWmB,SAAQ,cAAA,IAAkB;AAElD,UAAItE;AACJ,UAAI;AACFA,eAAOgG,gBAAgB3E,MAAMrB,MAAMuD,UAAAA;MACrC,SAAS0C,KAAK;AACZ,eAAO;UAAE/B,SAAS;UAAMG,SAAS;YAAC;cAAEhC,MAAM;cAAQ2B,MAAOiC,IAAcC;YAAQ;;QAAG;MACpF;AACA,YAAMpC,MAAM,MAAMiB,SAAS;QAAEhF;QAAQC;QAAM2B;QAAOE;QAAMyC;MAAQ,GAAGK,GAAAA;AACnE,aAAOd,iBAAiBC,KAAKC,QAAAA;IAC/B;EACF;AACF;AA5CgBe;;;ACvJT,IAAMqB,gCAAgC;AAOtC,SAASC,+BAA+BC,UAAgB;AAC7D,QAAMC,WAAW,IAAIC,IAAIF,QAAAA,EAAUC,SAASE,QAAQ,QAAQ,EAAA;AAC5D,SAAOF,WACH;IAACH,gCAAgCG;IAAUH;MAC3C;IAACA;;AACP;AALgBC;AAQT,SAASK,6BAA6BJ,UAAgB;AAC3D,SAAO,IAAIE,IAAIH,+BAA+BC,QAAAA,EAAU,CAAA,GAAcA,QAAAA,EAAUK;AAClF;AAFgBD;AAIT,SAASE,qBAAqBC,GAAe;AAClD,MAAIC;AACJ,MAAI;AACFA,UAAM,IAAIN,IAAIK,EAAEP,QAAQ;EAC1B,QAAQ;AACN,UAAM,IAAIS,MAAM,2DAA2DC,KAAKC,UAAUJ,EAAEP,QAAQ,CAAA,EAAG;EACzG;AACA,MAAIQ,IAAII,KAAM,OAAM,IAAIH,MAAM,wDAAA;AAC9B,MAAI,CAACF,EAAEM,sBAAsBC,OAAQ,OAAM,IAAIL,MAAM,0DAAA;AACrD,MAAI,OAAOF,EAAEQ,gBAAgB,WAAY,OAAM,IAAIN,MAAM,2CAAA;AAC3D;AAVgBH;AAYhB,IAAMU,QAAQ,wBAACC,MAAc,IAAIA,EAAEd,QAAQ,UAAU,MAAA,CAAA,KAAvC;AAGP,SAASe,gBACdlB,UACAmB,SAA0E,CAAC,GAAC;AAE5E,QAAMC,QAAkB,CAAA;AACxB,MAAID,OAAOE,MAAOD,OAAME,KAAK,SAASN,MAAMG,OAAOE,KAAK,CAAA,EAAG;AAC3D,MAAIF,OAAOI,iBAAkBH,OAAME,KAAK,qBAAqBN,MAAMG,OAAOI,gBAAgB,CAAA,EAAG;AAC7F,MAAIJ,OAAOK,OAAOV,OAAQM,OAAME,KAAK,SAASN,MAAMG,OAAOK,MAAMC,KAAK,GAAA,CAAA,CAAA,EAAO;AAC7EL,QAAME,KAAK,qBAAqBN,MAAMZ,6BAA6BJ,QAAAA,CAAAA,CAAAA,EAAY;AAC/E,SAAO,UAAUoB,MAAMK,KAAK,IAAA,CAAA;AAC9B;AAVgBP;AAaT,SAASQ,YAAYC,SAA+B;AACzD,QAAMC,IAAI,4BAA4BC,KAAKF,QAAQG,iBAAiB,EAAA;AACpE,SAAOF,IAAI,CAAA;AACb;AAHgBF;AAUhB,eAAsBK,aAAaxB,GAAiBoB,SAA+B;AACjF,QAAMK,QAAQN,YAAYC,OAAAA;AAC1B,MAAI,CAACK,OAAO;AAEV,WAAO;MACLC,IAAI;MACJC,QAAQ;MACRb,OAAO;MACPc,aAAa;MACbC,WAAWlB,gBAAgBX,EAAEP,UAAU;QAAEwB,OAAOjB,EAAE8B;MAAe,CAAA;IACnE;EACF;AAEA,MAAIC;AACJ,MAAI;AACFA,WAAO,MAAM/B,EAAEQ,YAAYiB,OAAO;MAAEhC,UAAUO,EAAEP;MAAU2B;IAAQ,CAAA;EACpE,QAAQ;AACNW,WAAOC;EACT;AACA,MAAI,CAACD,KAAM,QAAOE,KAAKjC,GAAG,KAAK,iBAAiB,6BAAA;AAChD,MAAI+B,KAAKG,cAAcF,UAAaD,KAAKG,YAAY,OAAQC,KAAKC,IAAG,GAAI;AACvE,WAAOH,KAAKjC,GAAG,KAAK,iBAAiB,8BAAA;EACvC;AACA,QAAMqC,UAAUC,cAAcP,MAAM/B,EAAE8B,cAAc;AACpD,MAAIO,QAAQ9B,QAAQ;AAElB,UAAMU,QAAQ;SAAI,oBAAIsB,IAAI;WAAKR,KAAKS,UAAU,CAAA;WAASxC,EAAE8B,kBAAkB,CAAA;OAAI;;AAC/E,WAAOG,KAAKjC,GAAG,KAAK,sBAAsB,kBAAkBqC,QAAQnB,KAAK,GAAA,CAAA,IAAQD,KAAAA;EACnF;AACA,SAAO;IAAES,IAAI;IAAMK,MAAM;MAAE,GAAGA;MAAMS,QAAQT,KAAKS,UAAU,CAAA;IAAG;EAAE;AAClE;AA9BsBhB;AAiCf,SAASS,KACdjC,GACA2B,QACAb,OACAc,aACAX,OAAgB;AAEhB,SAAO;IACLS,IAAI;IACJC;IACAb;IACAc;IACAC,WAAWlB,gBAAgBX,EAAEP,UAAU;MAAEqB;MAAOE,kBAAkBY;MAAaX;IAAM,CAAA;EACvF;AACF;AAdgBgB;AAgBT,SAASK,cAAcP,MAA4BU,UAA8B;AACtF,MAAI,CAACA,UAAUlC,OAAQ,QAAO,CAAA;AAC9B,QAAMmC,UAAU,IAAIH,IAAIR,MAAMS,UAAU,CAAA,CAAE;AAC1C,SAAOC,SAASE,OAAO,CAACC,MAAM,CAACF,QAAQG,IAAID,CAAAA,CAAAA;AAC7C;AAJgBN;;;ACxKT,IAAMQ,8BAA8B;EAAC;EAAc;EAAc;EAAc;;AAC/E,IAAMC,0BAA0BD,4BAA4B,CAAA;AAgBnE,IAAME,cAAc;AACpB,IAAMC,kBAAkB;AACxB,IAAMC,mBAAmB;AACzB,IAAMC,iBAAiB;AAEvB,IAAMC,KAAK,wBAACC,IAAeC,YAAsC;EAAEC,SAAS;EAAOF;EAAIC;AAAO,IAAnF;AACX,IAAME,OAAO,wBAACH,IAAeI,MAAcC,aAAsC;EAC/EH,SAAS;EACTF;EACAM,OAAO;IAAEF;IAAMC;EAAQ;AACzB,IAJa;AAuBN,IAAME,YAAN,MAAMA;EAjDb,OAiDaA;;;;EACMC,QAAQ,oBAAIC,IAAAA;EACrBC,UAA0C,CAAA;EAElD,YAAqBC,SAA2B;SAA3BA,UAAAA;AACnB,QAAIA,QAAQC,MAAOC,sBAAqBF,QAAQC,KAAK;EACvD;;EAGAE,QAAQC,MAA+B;AACrC,QAAI,KAAKP,MAAMQ,IAAID,KAAKE,IAAI,GAAG;AAC7B,YAAM,IAAIC,MAAM,oCAAoCH,KAAKE,IAAI,8BAA8B;IAC7F;AACA,SAAKT,MAAMW,IAAIJ,KAAKE,MAAMF,IAAAA;AAC1B,WAAO;EACT;;EAGAK,OAAOC,QAA0C;AAC/C,SAAKX,QAAQY,KAAKD,MAAAA;AAClB,WAAO;EACT;EAEA,MAAME,YAA0C;AAC9C,UAAM,KAAKC,KAAI;AACf,WAAO;SAAI,KAAKhB,MAAMiB,OAAM;;EAC9B;EAEA,MAAcD,OAAO;AACnB,QAAI,CAAC,KAAKd,QAAQgB,OAAQ;AAC1B,UAAMhB,UAAU,KAAKA;AACrB,SAAKA,UAAU,CAAA;AACf,eAAWiB,KAAKjB,QAAS,OAAMiB,EAAAA;EACjC;;EAGA,MAAMC,cAAcvB,SAAkBwB,KAAuE;AAC3G,QAAIC,MAAMC,QAAQ1B,OAAAA,GAAU;AAC1B,YAAM2B,WAAW,MAAMC,QAAQC,IAAI7B,QAAQ8B,IAAI,CAACC,MAAM,KAAKC,UAAUD,GAAGP,GAAAA,CAAAA,CAAAA,GAAQS,OAC9E,CAACC,MAA4BA,MAAM,IAAA;AAErC,aAAOP,QAAQN,SAASM,UAAU;IACpC;AACA,WAAO,KAAKK,UAAUhC,SAASwB,GAAAA;EACjC;EAEA,MAAcQ,UAAUhC,SAAkBwB,KAAmD;AAC3F,UAAMW,MAAMnC;AACZ,QAAI,CAACmC,OAAO,OAAOA,QAAQ,YAAYA,IAAItC,YAAY,OAAO;AAC5D,aAAOC,KAAK,MAAMP,iBAAiB,0BAAA;IACrC;AAEA,QAAI,OAAO4C,IAAIC,WAAW,YAAYD,IAAIxC,OAAO0C,OAAW,QAAO;AACnE,UAAM1C,KAAKwC,IAAIxC;AACf,UAAM2C,SAASH,IAAIG,UAAU,CAAC;AAE9B,UAAM,KAAKnB,KAAI;AACf,YAAQgB,IAAIC,QAAM;MAChB,KAAK,cAAc;AACjB,cAAMG,YAAYD,OAAOE;AACzB,cAAMA,kBACJD,aAAanD,4BAA4BqD,SAASF,SAAAA,IAAaA,YAAYlD;AAC7E,eAAOK,GAAGC,IAAI;UACZ6C;UACAE,cAAc;YAAEvC,OAAO;cAAEwC,aAAa;YAAM;UAAE;UAC9CC,YAAY;YAAEhC,MAAM,KAAKN,QAAQM;YAAMiC,SAAS,KAAKvC,QAAQuC,WAAW;UAAQ;UAChF,GAAI,KAAKvC,QAAQwC,eAAe;YAAEA,cAAc,KAAKxC,QAAQwC;UAAa,IAAI,CAAC;QACjF,CAAA;MACF;MACA,KAAK;AACH,eAAOpD,GAAGC,IAAI,CAAC,CAAA;MACjB,KAAK;AACH,eAAOD,GAAGC,IAAI;UACZQ,OAAO;eAAI,KAAKA,MAAMiB,OAAM;YAAIU,IAAI,CAACiB,OAAO;YAC1CnC,MAAMmC,EAAEnC;YACR,GAAImC,EAAEC,QAAQ;cAAEA,OAAOD,EAAEC;YAAM,IAAI,CAAC;YACpCC,aAAaF,EAAEE;YACfC,aAAaH,EAAEG;YACf,GAAIH,EAAEI,cAAc;cAAEA,aAAaJ,EAAEI;YAAY,IAAI,CAAC;UACxD,EAAA;QACF,CAAA;MACF,KAAK,cAAc;AACjB,cAAMzC,OAAO,KAAKP,MAAMiD,IAAId,OAAO1B,IAAI;AACvC,YAAI,CAACF,KAAM,QAAOZ,KAAKH,IAAIF,gBAAgB,iBAAiB4D,OAAOf,OAAO1B,IAAI,CAAA,EAAG;AACjF,eAAOlB,GAAGC,IAAI,MAAM,KAAK2D,SAAS5C,MAAO4B,OAAOiB,aAAa,CAAC,GAA+B/B,GAAAA,CAAAA;MAC/F;MACA,KAAK;AACH,eAAO9B,GAAGC,IAAI;UAAE6D,WAAW,CAAA;QAAG,CAAA;MAChC,KAAK;AACH,eAAO9D,GAAGC,IAAI;UAAE8D,SAAS,CAAA;QAAG,CAAA;MAC9B;AACE,eAAO3D,KAAKH,IAAIH,kBAAkB,qBAAqB2C,IAAIC,MAAM,EAAE;IACvE;EACF;EAEA,MAAckB,SACZ5C,MACAgD,MACAlC,KACqB;AACrB,QAAI;AACF,UAAId,KAAKiD,UAAU;AACjB,cAAMC,IAAI,MAAMlD,KAAKiD,SAASD,IAAAA;AAC9B,YAAI,CAACE,EAAElE,GAAI,QAAO;UAAEmE,SAAS;UAAMC,SAAS;YAAC;cAAEC,MAAM;cAAQC,MAAM,sBAAsBJ,EAAE5D,OAAO;YAAG;;QAAG;AACxG0D,eAAOE,EAAEK;MACX;AACA,aAAO,MAAMvD,KAAKwD,QAAQR,MAAMlC,GAAAA;IAClC,SAAS2C,KAAK;AAEZ,aAAO;QAAEN,SAAS;QAAMC,SAAS;UAAC;YAAEC,MAAM;YAAQC,MAAM,eAAgBG,IAAcnE,OAAO;UAAG;;MAAG;IACrG;EACF;;EAGAoE,gBAAgBC,QAAqC;AACnD,QAAI,CAACA,OAAQ,QAAO;AACpB,UAAMC,UAAU,KAAKhE,QAAQiE;AAC7B,QAAID,YAAY,IAAK,QAAO;AAC5B,YAAQA,WAAW,CAAA,GAAI7B,SAAS4B,MAAAA;EAClC;;;;;EAMA,IAAIG,qBAA+B;AACjC,WAAO,KAAKlE,QAAQC,QAAQkE,+BAA+B,KAAKnE,QAAQC,MAAMmE,QAAQ,IAAI,CAAA;EAC5F;;EAGA,MAAMC,4BAA8D;AAClE,UAAMC,IAAI,KAAKtE,QAAQC;AACvB,QAAI,CAACqE,EAAG,OAAM,IAAI/D,MAAM,gDAAA;AACxB,UAAM,KAAKM,KAAI;AACf,UAAM0D,SAASD,EAAEE,mBAAmB;SAC/B,oBAAIC,IAAI;WAAKH,EAAEI,kBAAkB,CAAA;WAAQ;aAAI,KAAK7E,MAAMiB,OAAM;UAAI6D,QAAQ,CAAClC,MAAMA,EAAE8B,UAAU,CAAA,CAAE;OAAE;;AAEtG,WAAO;MACLH,UAAUE,EAAEF;MACZQ,uBAAuBN,EAAEO;MACzB,GAAIN,OAAOxD,SAAS;QAAE+D,kBAAkBP;MAAO,IAAI,CAAC;MACpDQ,0BAA0B;QAAC;;MAC3B,GAAIT,EAAEU,eAAe;QAAEC,eAAeX,EAAEU;MAAa,IAAI,CAAC;MAC1D,GAAIV,EAAEY,wBAAwB;QAAEC,wBAAwBb,EAAEY;MAAsB,IAAI,CAAC;MACrF,GAAGZ,EAAEc;IACP;EACF;;EAGA,MAAMC,mBAAmBC,KAA+D;AACtF,UAAMC,OAAO;MAAE,+BAA+B;MAAK,gCAAgC;IAAe;AAClG,UAAMzD,SAASwD,IAAIxD,OAAO0D,YAAW;AACrC,QAAI,CAAC,KAAKxF,QAAQC,MAAO,QAAO;MAAEwF,QAAQ;MAAKC,SAAS,CAAC;IAAE;AAC3D,QAAI5D,WAAW,UAAW,QAAO;MAAE2D,QAAQ;MAAKC,SAAS;QAAE,GAAGH;QAAM,gCAAgC;MAAI;IAAE;AAC1G,QAAIzD,WAAW,SAASA,WAAW,OAAQ,QAAO;MAAE2D,QAAQ;MAAKC,SAAS;QAAEC,OAAO;MAAe;IAAE;AACpG,UAAMC,OAAOC,KAAKC,UAAU,MAAM,KAAKzB,0BAAyB,CAAA;AAChE,WAAO;MACLoB,QAAQ;MACRC,SAAS;QAAE,GAAGH;QAAM,gBAAgB;QAAoB,iBAAiB;MAAuB;MAChGK,MAAM9D,WAAW,SAASC,SAAY6D;IACxC;EACF;;;;;EAMA,MAAMG,WAAWT,KAAqBpE,KAA4C;AAChF,UAAM8E,OAAO;MAAE,gBAAgB;IAAmB;AAClD,QAAI,CAAC,KAAKlC,gBAAgBwB,IAAII,QAAQ3B,MAAM,GAAG;AAC7C,aAAO;QAAE0B,QAAQ;QAAKC,SAASM;QAAMJ,MAAMC,KAAKC,UAAUtG,KAAK,MAAMP,iBAAiB,oBAAA,CAAA;MAAuB;IAC/G;AACA,UAAMgB,QAAQ,KAAKD,QAAQC;AAC3B,QAAIA,OAAO;AACT,YAAMgG,UAAU,MAAMC,aAAajG,OAAOqF,IAAII,OAAO;AACrD,UAAI,CAACO,QAAQ7G,GAAI,QAAO+G,UAAUF,OAAAA;AAClC/E,YAAM;QAAE,GAAGA;QAAKkF,MAAMH,QAAQG;MAAK;IACrC;AACA,QAAId,IAAIxD,OAAO0D,YAAW,MAAO,QAAQ;AAEvC,aAAO;QAAEC,QAAQ;QAAKC,SAAS;UAAEC,OAAO;QAAO;MAAE;IACnD;AACA,QAAIC,OAAON,IAAIM;AACf,QAAI,OAAOA,SAAS,YAAYA,gBAAgBS,YAAY;AAC1D,UAAI;AACFT,eAAOC,KAAKS,MAAM,OAAOV,SAAS,WAAWA,OAAO,IAAIW,YAAAA,EAAcC,OAAOZ,IAAAA,CAAAA;MAC/E,QAAQ;AACN,eAAO;UAAEH,QAAQ;UAAKC,SAASM;UAAMJ,MAAMC,KAAKC,UAAUtG,KAAK,MAAMR,aAAa,aAAA,CAAA;QAAgB;MACpG;IACF;AACA,QAAIiB,OAAO;AAET,YAAM,KAAKY,KAAI;AACf,YAAM4F,QAAStF,MAAMC,QAAQwE,IAAAA,IAAQA,OAAO;QAACA;;AAC7C,iBAAWnE,KAAKgF,OAAO;AACrB,YAAIhF,GAAGK,WAAW,aAAc;AAChC,cAAM1B,OAAO,KAAKP,MAAMiD,IAAIrB,EAAEO,QAAQ1B,IAAAA;AACtC,cAAMoG,UAAUC,cAAczF,IAAIkF,MAAMhG,MAAMmE,MAAAA;AAC9C,YAAImC,QAAQ3F,QAAQ;AAElB,gBAAM6F,QAAQ;eACT,oBAAInC,IAAI;iBAAKvD,IAAIkF,MAAM7B,UAAU,CAAA;iBAAStE,MAAMyE,kBAAkB,CAAA;iBAAStE,MAAMmE,UAAU,CAAA;aAAI;;AAEpG,iBAAO4B,UACLU,KAAK5G,OAAO,KAAK,sBAAsB,SAASG,KAAME,IAAI,kBAAkBoG,QAAQI,KAAK,GAAA,CAAA,IAAQF,KAAAA,CAAAA;QAErG;MACF;IACF;AACA,UAAMG,WAAW,MAAM,KAAK9F,cAAc2E,MAAM1E,GAAAA;AAChD,QAAI6F,aAAa,KAAM,QAAO;MAAEtB,QAAQ;MAAKC,SAAS,CAAC;IAAE;AACzD,WAAO;MAAED,QAAQ;MAAKC,SAASM;MAAMJ,MAAMC,KAAKC,UAAUiB,QAAAA;IAAU;EACtE;AACF;AAEA,SAASZ,UAAU7B,GAA4E;AAC7F,SAAO;IACLmB,QAAQnB,EAAEmB;IACVC,SAAS;MAAE,gBAAgB;MAAoB,oBAAoBpB,EAAE0C;IAAU;IAC/EpB,MAAMC,KAAKC,UAAU;MAAEnG,OAAO2E,EAAE3E;MAAOsH,mBAAmB3C,EAAE3B;IAAY,CAAA;EAC1E;AACF;AANSwD;;;ANpPT,IAAMe,SAAS,oBAAIC,IAAAA;AAEnBC,kBAAMC,MAAM,OAAO,SAAuBC,UAA4B,CAAC,GAAC;AACtEJ,SAAOK,IAAI,MAAMD,OAAAA;AACjB,SAAO;AACT,CAAA;AAGO,SAASE,QAAyBC,OAAUH,UAA4B,CAAC,GAAC;AAC/EJ,SAAOK,IAAIE,OAAOH,OAAAA;AAClB,SAAOG;AACT;AAHgBD;AAwChB,SAASE,cAAcC,GAAU;AAC/B,SAAO,OAAOA,MAAM,YAAYA,MAAM,QAAQ,CAACC,MAAMC,QAAQF,CAAAA,KAAMG,OAAOC,KAAKJ,CAAAA,EAAGK,WAAW;AAC/F;AAFSN;AAgBF,SAASO,SAASC,QAAoBZ,SAAyB;AACpE,QAAMa,OAAOb,QAAQa,QAAQ;AAC7B,QAAMC,SAAS,IAAIC,UAAUf,OAAAA;AAC7B,QAAMgB,WAAWC,sBAAsB;IACrCC,SAASlB,QAAQkB,YAAY,CAACC,QAAQC,gBAAgBD,IAAIE,GAAG;EAC/D,CAAA;AAEA,aAAWC,KAAKtB,QAAQuB,SAAS,CAAA,EAAIT,QAAOU,QAAQF,CAAAA;AACpDR,SAAOW,OAAO,MAAA;AAEZ,UAAMC,aAAa,oBAAIC,IAAAA;AACvB,eAAWC,UAAUpB,OAAOqB,OAAOjB,OAAOkB,OAAM,CAAA,GAAK;AACnD,iBAAWC,KAAKH,OAAQ,YAAWI,KAAKD,EAAEE,QAASP,YAAWQ,IAAI,GAAGF,CAAAA,IAAKD,EAAEI,OAAO,EAAE;IACvF;AACA,UAAMC,OAAO,oBAAIT,IAAAA;AACjB,eAAW,CAACxB,QAAOkC,IAAAA,KAASzC,QAAQ;AAClC,UAAIO,OAAMmC,UAAS,EAAI;AACvB,YAAM,EAAEH,SAASF,QAAO,IAAK9B,OAAM2B,OAAM;AACzC,iBAAWS,UAAUN,SAAS;AAC5B,cAAMO,MAAM,GAAGD,MAAAA,IAAUJ,OAAAA;AACzB,YAAII,WAAW,UAAU,CAACb,WAAWe,IAAID,GAAAA,KAAQJ,KAAKK,IAAID,GAAAA,EAAM;AAChEJ,aAAKF,IAAIM,GAAAA;AACT1B,eAAOU,QAAQkB,gBAAgB;UAAEH;UAAQ1B,MAAMsB;QAAQ,GAAGE,MAAMrB,UAAUhB,OAAAA,CAAAA;MAC5E;IACF;EACF,CAAA;AAEA,QAAMG,QAAQS,OAAO+B,IAAI9B,MAAM,OAAOM,QAAAA;AACpC,UAAMyB,MAAMzB,IAAI0B,QAAQA;AACxB,QAAIC,OAAO3B,IAAI0B,QAAQC,KAAI;AAC3B,QAAI3B,IAAI0B,QAAQN,OAAM,MAAO,WAAWO,SAASC,UAAa3C,cAAc0C,IAAAA,IAAQ;AAElF,YAAMzB,MAAMF,IAAI0B,QAAQxB,IAAG;AAC3ByB,aAAOzB,QAAQuB,IAAII,YAAY,CAACJ,IAAIK,gBAAgB,MAAMC,YAAYN,GAAAA,IAAOE;IAC/E;AACA,UAAMK,UAAuB;MAC3BC,SAASC,iBAAiBlC,IAAI0B,QAAQO,QAAO,CAAA;MAC7CE,UAAUnC,IAAI0B,QAAQU,GAAE;MACxBlC,KAAKuB;IACP;AACA,UAAMY,MAAM,MAAM1C,OAAO2C,WAAW;MAAElB,QAAQpB,IAAI0B,QAAQN,OAAM;MAAIa,SAASD,QAAQC;MAASN;IAAK,GAAGK,OAAAA;AACtGhC,QAAIuC,SAASC,OAAOH,IAAIG,MAAM;AAC9B,eAAW,CAACC,GAAGvD,CAAAA,KAAMG,OAAOqD,QAAQL,IAAIJ,OAAO,EAAGjC,KAAIuC,SAASI,OAAOF,GAAGvD,CAAAA;AACzEc,QAAIuC,SAASK,KAAKP,IAAIV,QAAQ,EAAA;EAChC,CAAA;AACA3C,QAAM6D,GAAG,qBAAA;AACThE,UAAQiE,iBAAiB9D,KAAAA;AAGzBW,SAAOoD,mBAAmBC,QAAQ,CAACC,GAAGC,MAAAA;AACpCzD,WACG+B,IAAIyB,GAAG,OAAOjD,QAAAA;AACb,YAAMqC,MAAM,MAAM1C,OAAOwD,mBAAmB;QAAE/B,QAAQpB,IAAI0B,QAAQN,OAAM;MAAG,CAAA;AAC3EpB,UAAIuC,SAASC,OAAOH,IAAIG,MAAM;AAC9B,iBAAW,CAACC,GAAGvD,CAAAA,KAAMG,OAAOqD,QAAQL,IAAIJ,OAAO,EAAGjC,KAAIuC,SAASI,OAAOF,GAAGvD,CAAAA;AACzEc,UAAIuC,SAASK,KAAKP,IAAIV,QAAQ,EAAA;IAChC,CAAA,EACCkB,GAAG,6BAA6BK,CAAAA,EAAG;EACxC,CAAA;AACA,SAAOvD;AACT;AA5DgBH;","names":["buildUrl","base","req","url","URL","replace","path","k","v","Object","entries","query","item","Array","isArray","searchParams","append","toString","createFetchDispatcher","opts","doFetch","fetch","ctx","baseUrl","res","method","headers","body","undefined","JSON","stringify","signal","AbortSignal","timeout","timeoutMs","forEach","status","text","normalizeHeaders","headers","out","k","v","Object","entries","undefined","toLowerCase","Array","isArray","join","String","readRawBody","req","limit","Promise","resolve","reject","size","chunks","on","c","length","Error","destroy","push","Buffer","concat","toString","loopbackBaseUrl","socket","port","localPort","encrypted","bound","server","address","host","localAddress","startsWith","slice","includes","isStandard","s","toJsonSchema","schema","undefined","out","jsonSchema","input","target","toJSONSchema","Error","$schema","_ignored","rest","toValidator","validate","value","result","issues","ok","message","map","i","path","p","String","key","join","checkRequired","args","missing","required","filter","k","length","DEFAULT_FORWARD_HEADERS","BODY_METHODS","Set","PARAM_RE","pathParams","path","matchAll","map","m","encodeSegment","name","value","raw","String","Error","JSON","stringify","encodeURIComponent","interpolatePath","values","replace","_","k","undefined","a","b","toolNameFromRoute","method","path","segments","split","filter","Boolean","map","s","m","exec","sanitizeToolName","toLowerCase","join","name","replace","slice","defaultAnnotations","readOnlyHint","openWorldHint","destructiveHint","idempotentHint","buildInputSchema","route","opts","toUpperCase","params","pathParams","mapping","query","Set","body","wholeBody","bodyMethod","BODY_METHODS","has","input","schema","toJsonSchema","type","properties","required","paramSchema","p","description","includes","add","querySchema","k","v","Object","entries","bodySchema","undefined","size","splitArgs","args","pathValues","Array","isArray","String","JSON","stringify","responseToResult","res","maxChars","text","length","isError","status","result","content","headers","parsed","parse","structuredContent","pickForwardHeaders","ctx","names","out","createRouteTool","dispatch","serverOpts","forward","forwardHeaders","DEFAULT_FORWARD_HEADERS","maxResponseChars","title","inputSchema","annotations","scopes","validate","toValidator","handler","missing","checkRequired","accept","clientIp","interpolatePath","err","message","PROTECTED_RESOURCE_WELL_KNOWN","protectedResourceMetadataPaths","resource","pathname","URL","replace","protectedResourceMetadataUrl","href","validateOAuthOptions","o","url","Error","JSON","stringify","hash","authorizationServers","length","verifyToken","quote","v","bearerChallenge","params","parts","error","push","errorDescription","scope","join","bearerToken","headers","m","exec","authorization","authenticate","token","ok","status","description","challenge","requiredScopes","auth","undefined","deny","expiresAt","Date","now","missing","missingScopes","Set","scopes","required","granted","filter","s","has","SUPPORTED_PROTOCOL_VERSIONS","LATEST_PROTOCOL_VERSION","PARSE_ERROR","INVALID_REQUEST","METHOD_NOT_FOUND","INVALID_PARAMS","ok","id","result","jsonrpc","fail","code","message","error","McpServer","tools","Map","loaders","options","oauth","validateOAuthOptions","addTool","tool","has","name","Error","set","onLoad","loader","push","listTools","load","values","length","l","handleMessage","ctx","Array","isArray","results","Promise","all","map","m","handleOne","filter","r","msg","method","undefined","params","requested","protocolVersion","includes","capabilities","listChanged","serverInfo","version","instructions","t","title","description","inputSchema","annotations","get","String","callTool","arguments","resources","prompts","args","validate","v","isError","content","type","text","value","handler","err","isOriginAllowed","origin","allowed","allowedOrigins","oauthMetadataPaths","protectedResourceMetadataPaths","resource","protectedResourceMetadata","o","scopes","scopesSupported","Set","requiredScopes","flatMap","authorization_servers","authorizationServers","scopes_supported","bearer_methods_supported","resourceName","resource_name","resourceDocumentation","resource_documentation","metadata","handleMetadataHttp","req","cors","toUpperCase","status","headers","allow","body","JSON","stringify","handleHttp","json","outcome","authenticate","authError","auth","Uint8Array","parse","TextDecoder","decode","calls","missing","missingScopes","scope","deny","join","response","challenge","error_description","marked","Map","Route","macro","options","set","mcpTool","route","isEmptyObject","v","Array","isArray","Object","keys","length","mountMcp","router","path","server","McpServer","dispatch","createFetchDispatcher","baseUrl","ctx","loopbackBaseUrl","raw","t","tools","addTool","onLoad","registered","Set","routes","values","toJSON","r","m","methods","add","pattern","seen","opts","isDeleted","method","key","has","createRouteTool","any","req","request","body","undefined","readable","readableEnded","readRawBody","toolCtx","headers","normalizeHeaders","clientIp","ip","out","handleHttp","response","status","k","entries","header","send","as","configureRoute","oauthMetadataPaths","forEach","p","i","handleMetadataHttp"]}

package/dist/adonisjs/index.d.cts

@@ -1,6 +1,7 @@
 import { Route } from '@adonisjs/core/http';
 import { IncomingMessage } from 'node:http';
-import { R as RouteToolOptions, M as McpServerOptions, a as McpToolDefinition, b as McpServer } from '../server-fzkb-wJo.cjs';
+import { R as RouteToolOptions, M as McpServerOptions, a as McpToolDefinition, b as McpServer } from '../server-BFQ_Hdh9.cjs';
+import '../oauth-8RmQamGP.cjs';
 
 declare module '@adonisjs/core/http' {
     interface Route {

package/dist/adonisjs/index.d.ts

@@ -1,6 +1,7 @@
 import { Route } from '@adonisjs/core/http';
 import { IncomingMessage } from 'node:http';
-import { R as RouteToolOptions, M as McpServerOptions, a as McpToolDefinition, b as McpServer } from '../server-fzkb-wJo.js';
+import { R as RouteToolOptions, M as McpServerOptions, a as McpToolDefinition, b as McpServer } from '../server-BRw1E2xy.js';
+import '../oauth-8RmQamGP.js';
 
 declare module '@adonisjs/core/http' {
     interface Route {

package/dist/adonisjs/index.js

@@ -346,6 +346,7 @@ function createRouteTool(route, opts, dispatch, serverOpts = {}) {
       ...defaultAnnotations(method),
       ...opts.annotations
     },
+    scopes: opts.scopes,
     validate: toValidator(opts.input),
     async handler(args, ctx) {
       const missing = opts.input ? void 0 : checkRequired(schema, args);
@@ -394,6 +395,115 @@ function createRouteTool(route, opts, dispatch, serverOpts = {}) {
 }
 __name(createRouteTool, "createRouteTool");
 
+// src/core/oauth.ts
+var PROTECTED_RESOURCE_WELL_KNOWN = "/.well-known/oauth-protected-resource";
+function protectedResourceMetadataPaths(resource) {
+  const pathname = new URL(resource).pathname.replace(/\/+$/, "");
+  return pathname ? [
+    PROTECTED_RESOURCE_WELL_KNOWN + pathname,
+    PROTECTED_RESOURCE_WELL_KNOWN
+  ] : [
+    PROTECTED_RESOURCE_WELL_KNOWN
+  ];
+}
+__name(protectedResourceMetadataPaths, "protectedResourceMetadataPaths");
+function protectedResourceMetadataUrl(resource) {
+  return new URL(protectedResourceMetadataPaths(resource)[0], resource).href;
+}
+__name(protectedResourceMetadataUrl, "protectedResourceMetadataUrl");
+function validateOAuthOptions(o) {
+  let url;
+  try {
+    url = new URL(o.resource);
+  } catch {
+    throw new Error(`mcp-expose: oauth.resource must be an absolute URL, got ${JSON.stringify(o.resource)}`);
+  }
+  if (url.hash) throw new Error("mcp-expose: oauth.resource must not contain a fragment");
+  if (!o.authorizationServers?.length) throw new Error("mcp-expose: oauth.authorizationServers must not be empty");
+  if (typeof o.verifyToken !== "function") throw new Error("mcp-expose: oauth.verifyToken is required");
+}
+__name(validateOAuthOptions, "validateOAuthOptions");
+var quote = /* @__PURE__ */ __name((v) => `"${v.replace(/["\\]/g, "\\$&")}"`, "quote");
+function bearerChallenge(resource, params = {}) {
+  const parts = [];
+  if (params.error) parts.push(`error=${quote(params.error)}`);
+  if (params.errorDescription) parts.push(`error_description=${quote(params.errorDescription)}`);
+  if (params.scope?.length) parts.push(`scope=${quote(params.scope.join(" "))}`);
+  parts.push(`resource_metadata=${quote(protectedResourceMetadataUrl(resource))}`);
+  return `Bearer ${parts.join(", ")}`;
+}
+__name(bearerChallenge, "bearerChallenge");
+function bearerToken(headers) {
+  const m = /^Bearer[ ]+([^\s,]+)\s*$/i.exec(headers.authorization ?? "");
+  return m?.[1];
+}
+__name(bearerToken, "bearerToken");
+async function authenticate(o, headers) {
+  const token = bearerToken(headers);
+  if (!token) {
+    return {
+      ok: false,
+      status: 401,
+      error: "unauthorized",
+      description: "Authorization required",
+      challenge: bearerChallenge(o.resource, {
+        scope: o.requiredScopes
+      })
+    };
+  }
+  let auth;
+  try {
+    auth = await o.verifyToken(token, {
+      resource: o.resource,
+      headers
+    });
+  } catch {
+    auth = void 0;
+  }
+  if (!auth) return deny(o, 401, "invalid_token", "The access token is invalid");
+  if (auth.expiresAt !== void 0 && auth.expiresAt * 1e3 <= Date.now()) {
+    return deny(o, 401, "invalid_token", "The access token has expired");
+  }
+  const missing = missingScopes(auth, o.requiredScopes);
+  if (missing.length) {
+    const scope = [
+      .../* @__PURE__ */ new Set([
+        ...auth.scopes ?? [],
+        ...o.requiredScopes ?? []
+      ])
+    ];
+    return deny(o, 403, "insufficient_scope", `Missing scope: ${missing.join(" ")}`, scope);
+  }
+  return {
+    ok: true,
+    auth: {
+      ...auth,
+      scopes: auth.scopes ?? []
+    }
+  };
+}
+__name(authenticate, "authenticate");
+function deny(o, status, error, description, scope) {
+  return {
+    ok: false,
+    status,
+    error,
+    description,
+    challenge: bearerChallenge(o.resource, {
+      error,
+      errorDescription: description,
+      scope
+    })
+  };
+}
+__name(deny, "deny");
+function missingScopes(auth, required) {
+  if (!required?.length) return [];
+  const granted = new Set(auth?.scopes ?? []);
+  return required.filter((s) => !granted.has(s));
+}
+__name(missingScopes, "missingScopes");
+
 // src/core/server.ts
 var SUPPORTED_PROTOCOL_VERSIONS = [
   "2025-11-25",
@@ -428,6 +538,7 @@ var McpServer = class {
   loaders = [];
   constructor(options) {
     this.options = options;
+    if (options.oauth) validateOAuthOptions(options.oauth);
   }
   /** Register a tool. Throws on duplicate names. */
   addTool(tool) {
@@ -562,6 +673,79 @@ var McpServer = class {
     return (allowed ?? []).includes(origin);
   }
   /**
+  * Paths on which adapters serve the OAuth Protected Resource Metadata
+  * (empty when `oauth` is not configured). They must be public: no auth middleware.
+  */
+  get oauthMetadataPaths() {
+    return this.options.oauth ? protectedResourceMetadataPaths(this.options.oauth.resource) : [];
+  }
+  /** The OAuth Protected Resource Metadata document (RFC 9728). */
+  async protectedResourceMetadata() {
+    const o = this.options.oauth;
+    if (!o) throw new Error("mcp-expose: the oauth option is not configured");
+    await this.load();
+    const scopes = o.scopesSupported ?? [
+      .../* @__PURE__ */ new Set([
+        ...o.requiredScopes ?? [],
+        ...[
+          ...this.tools.values()
+        ].flatMap((t) => t.scopes ?? [])
+      ])
+    ];
+    return {
+      resource: o.resource,
+      authorization_servers: o.authorizationServers,
+      ...scopes.length ? {
+        scopes_supported: scopes
+      } : {},
+      bearer_methods_supported: [
+        "header"
+      ],
+      ...o.resourceName ? {
+        resource_name: o.resourceName
+      } : {},
+      ...o.resourceDocumentation ? {
+        resource_documentation: o.resourceDocumentation
+      } : {},
+      ...o.metadata
+    };
+  }
+  /** HTTP handler for the metadata paths. Public and CORS-enabled so browser-based clients can read it. */
+  async handleMetadataHttp(req) {
+    const cors = {
+      "access-control-allow-origin": "*",
+      "access-control-allow-methods": "GET, OPTIONS"
+    };
+    const method = req.method.toUpperCase();
+    if (!this.options.oauth) return {
+      status: 404,
+      headers: {}
+    };
+    if (method === "OPTIONS") return {
+      status: 204,
+      headers: {
+        ...cors,
+        "access-control-allow-headers": "*"
+      }
+    };
+    if (method !== "GET" && method !== "HEAD") return {
+      status: 405,
+      headers: {
+        allow: "GET, OPTIONS"
+      }
+    };
+    const body = JSON.stringify(await this.protectedResourceMetadata());
+    return {
+      status: 200,
+      headers: {
+        ...cors,
+        "content-type": "application/json",
+        "cache-control": "public, max-age=3600"
+      },
+      body: method === "HEAD" ? void 0 : body
+    };
+  }
+  /**
   * Framework-neutral Streamable HTTP handler. Adapters convert their request
   * into McpHttpRequest, call this, and write the McpHttpResponse back.
   */
@@ -576,6 +760,15 @@ var McpServer = class {
         body: JSON.stringify(fail(null, INVALID_REQUEST, "Origin not allowed"))
       };
     }
+    const oauth = this.options.oauth;
+    if (oauth) {
+      const outcome = await authenticate(oauth, req.headers);
+      if (!outcome.ok) return authError(outcome);
+      ctx = {
+        ...ctx,
+        auth: outcome.auth
+      };
+    }
     if (req.method.toUpperCase() !== "POST") {
       return {
         status: 405,
@@ -596,6 +789,27 @@ var McpServer = class {
         };
       }
     }
+    if (oauth) {
+      await this.load();
+      const calls = Array.isArray(body) ? body : [
+        body
+      ];
+      for (const m of calls) {
+        if (m?.method !== "tools/call") continue;
+        const tool = this.tools.get(m.params?.name);
+        const missing = missingScopes(ctx.auth, tool?.scopes);
+        if (missing.length) {
+          const scope = [
+            .../* @__PURE__ */ new Set([
+              ...ctx.auth?.scopes ?? [],
+              ...oauth.requiredScopes ?? [],
+              ...tool?.scopes ?? []
+            ])
+          ];
+          return authError(deny(oauth, 403, "insufficient_scope", `Tool "${tool.name}" needs scope: ${missing.join(" ")}`, scope));
+        }
+      }
+    }
     const response = await this.handleMessage(body, ctx);
     if (response === null) return {
       status: 202,
@@ -608,6 +822,20 @@ var McpServer = class {
     };
   }
 };
+function authError(o) {
+  return {
+    status: o.status,
+    headers: {
+      "content-type": "application/json",
+      "www-authenticate": o.challenge
+    },
+    body: JSON.stringify({
+      error: o.error,
+      error_description: o.description
+    })
+  };
+}
+__name(authError, "authError");
 
 // src/adonisjs/index.ts
 var marked = /* @__PURE__ */ new Map();
@@ -674,6 +902,16 @@ function mountMcp(router, options) {
   });
   route.as("mcp_expose.endpoint");
   options.configureRoute?.(route);
+  server.oauthMetadataPaths.forEach((p, i) => {
+    router.any(p, async (ctx) => {
+      const out = await server.handleMetadataHttp({
+        method: ctx.request.method()
+      });
+      ctx.response.status(out.status);
+      for (const [k, v] of Object.entries(out.headers)) ctx.response.header(k, v);
+      ctx.response.send(out.body ?? "");
+    }).as(`mcp_expose.oauth_metadata_${i}`);
+  });
   return server;
 }
 __name(mountMcp, "mountMcp");