mcp-trellis 0.2.1 → 2.1.0

package/dist/adapters/node-request.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Node request-side plumbing for the `(req, res)` adapter: origin
+ * resolution, Web `Request` construction, and bounded body reading.
+ * Response-side glue (`sendWebResponse`, `asNodeHandler`) lives in `node.ts`.
+ */
+export type NodeRequestLike = {
+    method?: string | undefined;
+    url?: string | undefined;
+    headers: Record<string, string | string[] | undefined>;
+    body?: unknown;
+    /** Destroy the underlying socket — called only after a 413 has flushed. */
+    destroy?: (() => void) | undefined;
+    [Symbol.asyncIterator]?: () => AsyncIterator<Uint8Array | string>;
+};
+export type ToWebRequestOptions = {
+    /** Absolute origin, e.g. https://app.example.com. */
+    origin: string;
+    /** Pre-read body. Overrides `req.body` when supplied. */
+    body?: unknown;
+};
+export type ResolveOriginOptions = {
+    /** Trust last `X-Forwarded-Host` / `X-Forwarded-Proto` hop. */
+    trustProxy?: boolean;
+};
+/**
+ * A Host (or `X-Forwarded-*`) header that can't safely become an origin —
+ * missing, carrying a path/query/fragment/credentials, malformed, or a
+ * non-`http(s)` scheme. Distinct from a generic `Error` so `asNodeHandler`
+ * can answer this with a client-facing 400 instead of the same 500 it gives
+ * an actual unexpected failure.
+ */
+export declare class InvalidOriginError extends Error {
+}
+/**
+ * Derive origin from Host, or from forwarded headers when `trustProxy`.
+ * Always parsed through `URL` and rejected unless it is a bare `host[:port]`
+ * over http(s): a Host carrying a path (`evil.test/../trusted.test`) or
+ * credentials (`user:pass@evil.test`) must not become an origin-shaped string.
+ */
+export declare const resolveOrigin: (req: NodeRequestLike, options?: ResolveOriginOptions) => string;
+export declare const toWebRequest: (req: NodeRequestLike, options: ToWebRequestOptions) => Request;
+export declare const requestPath: (req: NodeRequestLike) => string;
+/** True for a path under an `…/oauth` segment — the default OAuth mount. */
+export declare const isOAuthPath: (path: string) => boolean;
+/** OAuth routes under `…/oauth/…` get the 64 KiB cap; everything else gets 1 MiB. */
+export declare const bodyLimitForPath: (path: string) => number;
+/**
+ * Prefer `req.body`; else drain the stream (raw `http.createServer`), capped
+ * at `maxBytes`. Throws `BodyTooLargeError` past the cap without destroying
+ * the socket — `asNodeHandler` writes 413 first, then destroys after flush.
+ */
+export declare const readNodeBody: (req: NodeRequestLike, maxBytes?: number) => Promise<unknown>;
+//# sourceMappingURL=node-request.d.ts.map

package/dist/adapters/node-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-request.d.ts","sourceRoot":"","sources":["../../src/adapters/node-request.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,2EAA2E;IAC3E,OAAO,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IACnC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,aAAa,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC;CACnE,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,+DAA+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAQF;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;CAAG;AAOhD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,eAAe,EAAE,UAAS,oBAAyB,KAAG,MA+BxF,CAAC;AA6CF,eAAO,MAAM,YAAY,GAAI,KAAK,eAAe,EAAE,SAAS,mBAAmB,KAAG,OAkCjF,CAAC;AAMF,eAAO,MAAM,WAAW,GAAI,KAAK,eAAe,KAAG,MAA+C,CAAC;AAEnG,4EAA4E;AAC5E,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,KAAG,OAAuC,CAAC;AAEnF,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG,MACuB,CAAC;AAqBxE;;;;GAIG;AACH,eAAO,MAAM,YAAY,GACvB,KAAK,eAAe,EACpB,WAAU,MAA+B,KACxC,OAAO,CAAC,OAAO,CAcjB,CAAC"}

package/dist/adapters/node-request.js

@@ -0,0 +1,165 @@
+/**
+ * Node request-side plumbing for the `(req, res)` adapter: origin
+ * resolution, Web `Request` construction, and bounded body reading.
+ * Response-side glue (`sendWebResponse`, `asNodeHandler`) lives in `node.ts`.
+ */
+import { BodyTooLargeError, DEFAULT_MCP_BODY_LIMIT, DEFAULT_OAUTH_BODY_LIMIT, isNodeReadable, readBoundedNodeBody, } from "../http/body.js";
+import { isJsonObject } from "../util/json.js";
+const headerValue = (value) => Array.isArray(value) ? value[0] : value;
+const lastForwarded = (value) => value?.split(",").pop()?.trim();
+/**
+ * A Host (or `X-Forwarded-*`) header that can't safely become an origin —
+ * missing, carrying a path/query/fragment/credentials, malformed, or a
+ * non-`http(s)` scheme. Distinct from a generic `Error` so `asNodeHandler`
+ * can answer this with a client-facing 400 instead of the same 500 it gives
+ * an actual unexpected failure.
+ */
+export class InvalidOriginError extends Error {
+}
+/** A bare `host[:port]` must not carry any of these — they'd mean a path, query, fragment, or credentials smuggled into what should be just the authority. */
+const HOST_HEADER_STRUCTURAL_CHARS = /[/?#@\\]/;
+const ALLOWED_ORIGIN_PROTOCOLS = new Set(["http:", "https:"]);
+/**
+ * Derive origin from Host, or from forwarded headers when `trustProxy`.
+ * Always parsed through `URL` and rejected unless it is a bare `host[:port]`
+ * over http(s): a Host carrying a path (`evil.test/../trusted.test`) or
+ * credentials (`user:pass@evil.test`) must not become an origin-shaped string.
+ */
+export const resolveOrigin = (req, options = {}) => {
+    const trustProxy = options.trustProxy === true;
+    const proto = trustProxy
+        ? lastForwarded(headerValue(req.headers["x-forwarded-proto"])) || "https"
+        : "https";
+    const host = trustProxy
+        ? lastForwarded(headerValue(req.headers["x-forwarded-host"])) || headerValue(req.headers.host)
+        : headerValue(req.headers.host);
+    if (!host) {
+        throw new InvalidOriginError("Cannot resolve origin: pass options.origin or set Host" +
+            (trustProxy ? " / X-Forwarded-Host" : ""));
+    }
+    if (HOST_HEADER_STRUCTURAL_CHARS.test(host)) {
+        throw new InvalidOriginError(`Cannot resolve origin: Host header "${host}" must be a bare host[:port], not a full URL`);
+    }
+    let parsed;
+    try {
+        parsed = new URL(`${proto}://${host}`);
+    }
+    catch {
+        throw new InvalidOriginError(`Cannot resolve origin: Host header "${host}" is not valid`);
+    }
+    if (!ALLOWED_ORIGIN_PROTOCOLS.has(parsed.protocol)) {
+        throw new InvalidOriginError(`Cannot resolve origin: unsupported protocol "${parsed.protocol}"`);
+    }
+    return parsed.origin;
+};
+const isPlainRecord = (value) => isJsonObject(value) && !(value instanceof Uint8Array);
+const isFormContentType = (contentType) => (contentType ?? "").toLowerCase().includes("application/x-www-form-urlencoded");
+const appendFormValue = (params, key, value) => {
+    if (Array.isArray(value)) {
+        for (const entry of value)
+            appendFormValue(params, key, entry);
+        return;
+    }
+    if (value === undefined || value === null)
+        return;
+    params.append(key, typeof value === "string" ? value : String(value));
+};
+/** Re-serialize a pre-parsed `express.urlencoded()`-shaped body back to `a=1&b=2`. */
+const objectToUrlEncoded = (body) => {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(body))
+        appendFormValue(params, key, value);
+    return params.toString();
+};
+/**
+ * `req.body` from a body-parsing middleware (Express `json()`/`urlencoded()`,
+ * multer, …) arrives as an already-parsed object, not raw bytes — the
+ * `Content-Type` header says what shape it round-trips back to. A form body
+ * must be re-encoded as a form, or `/token` and `/consent` behind
+ * `express.urlencoded()` receive one unparseable JSON-shaped key.
+ */
+const toBodyInit = (body, contentType) => {
+    if (body === undefined || body === null)
+        return undefined;
+    if (typeof body === "string")
+        return body;
+    if (body instanceof Uint8Array) {
+        return body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength);
+    }
+    if (isPlainRecord(body) && isFormContentType(contentType)) {
+        return objectToUrlEncoded(body);
+    }
+    return JSON.stringify(body);
+};
+const BODYLESS_METHODS = new Set(["GET", "HEAD"]);
+export const toWebRequest = (req, options) => {
+    // Never trust an absolute-form request target — rebase onto the validated origin.
+    const target = new URL(req.url ?? "/", options.origin);
+    const url = `${options.origin}${target.pathname}${target.search}`;
+    const headers = new Headers(Object.entries(req.headers)
+        .map(([key, value]) => {
+        const resolved = headerValue(value);
+        return resolved === undefined ? null : [key, resolved];
+    })
+        .filter((entry) => entry !== null));
+    const method = (req.method ?? "GET").toUpperCase();
+    if (BODYLESS_METHODS.has(method)) {
+        return new Request(url, { method, headers });
+    }
+    const body = options.body !== undefined ? options.body : req.body;
+    const bodyInit = toBodyInit(body, headers.get("content-type") ?? undefined);
+    if (isPlainRecord(body)) {
+        // The re-serialized body's byte length no longer matches whatever
+        // Content-Length the original (already-parsed) request declared — a
+        // stale header here can make the body-size precheck reject a body well
+        // within the cap, or let an oversized one slip past it (still caught by
+        // the streaming fallback either way).
+        headers.delete("content-length");
+        headers.delete("transfer-encoding");
+    }
+    return new Request(url, {
+        method,
+        headers,
+        ...(bodyInit !== undefined ? { body: bodyInit } : {}),
+    });
+};
+const isAsyncIterable = (value) => typeof value?.[Symbol.asyncIterator] ===
+    "function";
+export const requestPath = (req) => (req.url ?? "/").split("?")[0] ?? "/";
+/** True for a path under an `…/oauth` segment — the default OAuth mount. */
+export const isOAuthPath = (path) => /\/oauth(?:\/|$)/.test(path);
+/** OAuth routes under `…/oauth/…` get the 64 KiB cap; everything else gets 1 MiB. */
+export const bodyLimitForPath = (path) => isOAuthPath(path) ? DEFAULT_OAUTH_BODY_LIMIT : DEFAULT_MCP_BODY_LIMIT;
+const enforcePresetBodySize = (body, maxBytes) => {
+    if (typeof body === "string" && new TextEncoder().encode(body).byteLength > maxBytes) {
+        throw new BodyTooLargeError(maxBytes);
+    }
+    if (body instanceof Uint8Array && body.byteLength > maxBytes) {
+        throw new BodyTooLargeError(maxBytes);
+    }
+};
+const emptyToUndefined = (bytes) => bytes.byteLength > 0 ? bytes : undefined;
+const asBodyStream = (req) => {
+    if (isNodeReadable(req) || isAsyncIterable(req)) {
+        return req;
+    }
+    return undefined;
+};
+/**
+ * Prefer `req.body`; else drain the stream (raw `http.createServer`), capped
+ * at `maxBytes`. Throws `BodyTooLargeError` past the cap without destroying
+ * the socket — `asNodeHandler` writes 413 first, then destroys after flush.
+ */
+export const readNodeBody = async (req, maxBytes = DEFAULT_MCP_BODY_LIMIT) => {
+    if (req.body !== undefined && req.body !== null) {
+        enforcePresetBodySize(req.body, maxBytes);
+        return req.body;
+    }
+    const stream = asBodyStream(req);
+    if (!stream)
+        return undefined;
+    return emptyToUndefined(await readBoundedNodeBody(stream, maxBytes, {
+        contentLength: headerValue(req.headers["content-length"]),
+    }));
+};
+//# sourceMappingURL=node-request.js.map

package/dist/adapters/node-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-request.js","sourceRoot":"","sources":["../../src/adapters/node-request.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,cAAc,EACd,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAwB/C,MAAM,WAAW,GAAG,CAAC,KAAoC,EAAsB,EAAE,CAC/E,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAE1C,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAsB,EAAE,CACtE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;CAAG;AAEhD,8JAA8J;AAC9J,MAAM,4BAA4B,GAAG,UAAU,CAAC;AAEhD,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAoB,EAAE,UAAgC,EAAE,EAAU,EAAE;IAChG,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,UAAU;QACtB,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,OAAO;QACzE,CAAC,CAAC,OAAO,CAAC;IACZ,MAAM,IAAI,GAAG,UAAU;QACrB,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9F,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,kBAAkB,CAC1B,wDAAwD;YACtD,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC,CAC5C,CAAC;IACJ,CAAC;IACD,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,kBAAkB,CAC1B,uCAAuC,IAAI,8CAA8C,CAC1F,CAAC;IACJ,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,uCAAuC,IAAI,gBAAgB,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,kBAAkB,CAC1B,gDAAgD,MAAM,CAAC,QAAQ,GAAG,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,KAAc,EAAoC,EAAE,CACzE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,CAAC;AAExD,MAAM,iBAAiB,GAAG,CAAC,WAA+B,EAAW,EAAE,CACrE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;AAElF,MAAM,eAAe,GAAG,CAAC,MAAuB,EAAE,GAAW,EAAE,KAAc,EAAQ,EAAE;IACrF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,KAAK;YAAE,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO;IAClD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACxE,CAAC,CAAC;AAEF,sFAAsF;AACtF,MAAM,kBAAkB,GAAG,CAAC,IAA6B,EAAU,EAAE;IACnE,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,CAAC,IAAa,EAAE,WAAoB,EAAwB,EAAE;IAC/E,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,YAAY,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAgB,CAAC;IAC9F,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAoB,EAAE,OAA4B,EAAW,EAAE;IAC1F,kFAAkF;IAClF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,OAAO,CACzB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAA2B,EAAE;QAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAChE,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAClE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC,CAAC;IAC5E,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,kEAAkE;QAClE,oEAAoE;QACpE,uEAAuE;QACvE,wEAAwE;QACxE,sCAAsC;QACtC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE;QACtB,MAAM;QACN,OAAO;QACP,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,KAAc,EAAmC,EAAE,CAC1E,OAAQ,KAAqD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC;IACrF,UAAU,CAAC;AAEb,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAoB,EAAU,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;AAEnG,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEnF,qFAAqF;AACrF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAU,EAAE,CACvD,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,sBAAsB,CAAC;AAExE,MAAM,qBAAqB,GAAG,CAAC,IAAa,EAAE,QAAgB,EAAQ,EAAE;IACtE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ,EAAE,CAAC;QACrF,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,IAAI,YAAY,UAAU,IAAI,IAAI,CAAC,UAAU,GAAG,QAAQ,EAAE,CAAC;QAC7D,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,KAAiB,EAA0B,EAAE,CACrE,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAE3C,MAAM,YAAY,GAAG,CAAC,GAAoB,EAAkD,EAAE;IAC5F,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,GAAyC,CAAC;IACnD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAoB,EACpB,WAAmB,sBAAsB,EACvB,EAAE;IACpB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAChD,qBAAqB,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,OAAO,gBAAgB,CACrB,MAAM,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE;QAC1C,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;KAC1D,CAAC,CACH,CAAC;AACJ,CAAC,CAAC"}

package/dist/adapters/node.d.ts

@@ -1,29 +1,17 @@
 /**
  * Node HTTP `(req, res)` adapter — Express, Cloud Functions, `http.createServer`, etc.
  * Bridges duck-typed Node request/response objects to Web `Request`/`Response`.
+ * Request-side plumbing (origin resolution, `toWebRequest`, body reading)
+ * lives in `node-request.ts` and is re-exported below unchanged.
  */
-import { isAllowedOrigin, type OriginAllowlistOptions } from "./origins.js";
-export { isAllowedOrigin, type OriginAllowlistOptions };
-export type NodeRequestLike = {
-    method?: string;
-    url?: string;
-    headers: Record<string, string | string[] | undefined>;
-    body?: unknown;
-};
+import { type OriginAllowlistOptions } from "../http/origins.js";
+import { type NodeRequestLike } from "./node-request.js";
+export { isAllowedOrigin, isAllowedRequestOrigin, type OriginAllowlistOptions, } from "../http/origins.js";
+export { bodyLimitForPath, InvalidOriginError, type NodeRequestLike, type ResolveOriginOptions, readNodeBody, resolveOrigin, type ToWebRequestOptions, toWebRequest, } from "./node-request.js";
 export type NodeResponseLike = {
     statusCode: number;
     setHeader: (name: string, value: string | number | readonly string[]) => void;
-    end: (chunk?: string | Uint8Array) => void;
-};
-export type ToWebRequestOptions = {
-    /** Absolute origin, e.g. https://app.example.com. */
-    origin: string;
-    /** Pre-read body. Overrides `req.body` when supplied. */
-    body?: unknown;
-};
-export type ResolveOriginOptions = {
-    /** Trust last `X-Forwarded-Host` / `X-Forwarded-Proto` hop. */
-    trustProxy?: boolean;
+    end: (chunk?: string | Uint8Array, callback?: () => void) => void;
 };
 export type AsNodeHandlerOptions = OriginAllowlistOptions & {
     /**
@@ -34,11 +22,15 @@ export type AsNodeHandlerOptions = OriginAllowlistOptions & {
     origin?: string;
     trustProxy?: boolean;
 };
-/** Derive origin from Host, or from forwarded headers when trustProxy. */
-export declare const resolveOrigin: (req: NodeRequestLike, options?: ResolveOriginOptions) => string;
-export declare const toWebRequest: (req: NodeRequestLike, options: ToWebRequestOptions) => Request;
-/** Prefer `req.body`; else drain the stream (raw `http.createServer`). */
-export declare const readNodeBody: (req: NodeRequestLike) => Promise<unknown>;
+/**
+ * Unlike every other header, `Set-Cookie` cannot be folded into one
+ * comma-joined value — a cookie's own `Expires` attribute contains a comma.
+ * The Fetch `Headers` object accordingly keeps duplicates apart internally
+ * and exposes them via `getSetCookie()`, but `forEach`/`entries()` still
+ * yields one `"set-cookie"` pair per cookie — calling `res.setHeader` once
+ * per pair (as for any other header) makes each call overwrite the last,
+ * silently dropping every cookie but the final one.
+ */
 export declare const sendWebResponse: (res: NodeResponseLike, response: Response) => Promise<void>;
 /** One-liner: Node `(req, res)` → MCP / OAuth Web handler. */
 export declare const asNodeHandler: (mcp: {

package/dist/adapters/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/adapters/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC5B,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,CAAC;AAExD,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,KAAK,IAAI,CAAC;IAC9E,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,KAAK,IAAI,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,+DAA+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,sBAAsB,GAAG;IAC1D;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AASF,0EAA0E;AAC1E,eAAO,MAAM,aAAa,GACxB,KAAK,eAAe,EACpB,UAAS,oBAAyB,KACjC,MAgBF,CAAC;AAcF,eAAO,MAAM,YAAY,GACvB,KAAK,eAAe,EACpB,SAAS,mBAAmB,KAC3B,OAwBF,CAAC;AAiBF,0EAA0E;AAC1E,eAAO,MAAM,YAAY,GACvB,KAAK,eAAe,KACnB,OAAO,CAAC,OAAO,CAWjB,CAAC;AAEF,eAAO,MAAM,eAAe,GAC1B,KAAK,gBAAgB,EACrB,UAAU,QAAQ,KACjB,OAAO,CAAC,IAAI,CAId,CAAC;AAaF,8DAA8D;AAC9D,eAAO,MAAM,aAAa,GACxB,KAAK;IAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,EACvD,UAAU,oBAAoB,MAyBhB,KAAK,eAAe,EAAE,KAAK,gBAAgB,KAAG,OAAO,CAAC,IAAI,CAezE,CAAC"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/adapters/node.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAElF,OAAO,EAIL,KAAK,eAAe,EAKrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,YAAY,EACZ,aAAa,EACb,KAAK,mBAAmB,EACxB,YAAY,GACb,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,KAAK,IAAI,CAAC;IAC9E,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;CACnE,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,sBAAsB,GAAG;IAC1D;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAU,KAAK,gBAAgB,EAAE,UAAU,QAAQ,KAAG,OAAO,CAAC,IAAI,CAS7F,CAAC;AAkDF,8DAA8D;AAC9D,eAAO,MAAM,aAAa,GACxB,KAAK;IAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,EACvD,UAAU,oBAAoB,MAIhB,KAAK,eAAe,EAAE,KAAK,gBAAgB,KAAG,OAAO,CAAC,IAAI,CA2BzE,CAAC"}

package/dist/adapters/node.js

@@ -1,101 +1,65 @@
 /**
  * Node HTTP `(req, res)` adapter — Express, Cloud Functions, `http.createServer`, etc.
  * Bridges duck-typed Node request/response objects to Web `Request`/`Response`.
+ * Request-side plumbing (origin resolution, `toWebRequest`, body reading)
+ * lives in `node-request.ts` and is re-exported below unchanged.
+ */
+import { BodyTooLargeError } from "../http/body.js";
+import { INTERNAL_ERROR } from "../http/http.js";
+import { isAllowedOrigin } from "../http/origins.js";
+import { JSONRPC_PAYLOAD_TOO_LARGE, rpcError } from "../mcp/jsonrpc.js";
+import { bodyLimitForPath, InvalidOriginError, isOAuthPath, readNodeBody, requestPath, resolveOrigin, toWebRequest, } from "./node-request.js";
+export { isAllowedOrigin, isAllowedRequestOrigin, } from "../http/origins.js";
+export { bodyLimitForPath, InvalidOriginError, readNodeBody, resolveOrigin, toWebRequest, } from "./node-request.js";
+/**
+ * Unlike every other header, `Set-Cookie` cannot be folded into one
+ * comma-joined value — a cookie's own `Expires` attribute contains a comma.
+ * The Fetch `Headers` object accordingly keeps duplicates apart internally
+ * and exposes them via `getSetCookie()`, but `forEach`/`entries()` still
+ * yields one `"set-cookie"` pair per cookie — calling `res.setHeader` once
+ * per pair (as for any other header) makes each call overwrite the last,
+ * silently dropping every cookie but the final one.
  */
-import { INTERNAL_ERROR } from "../http.js";
-import { isAllowedOrigin, } from "./origins.js";
-export { isAllowedOrigin };
-const headerValue = (value) => (Array.isArray(value) ? value[0] : value);
-const lastForwarded = (value) => value?.split(",").pop()?.trim();
-/** Derive origin from Host, or from forwarded headers when trustProxy. */
-export const resolveOrigin = (req, options = {}) => {
-    const trustProxy = options.trustProxy === true;
-    const proto = trustProxy
-        ? lastForwarded(headerValue(req.headers["x-forwarded-proto"])) || "https"
-        : "https";
-    const host = trustProxy
-        ? lastForwarded(headerValue(req.headers["x-forwarded-host"])) ||
-            headerValue(req.headers.host)
-        : headerValue(req.headers.host);
-    if (!host) {
-        throw new Error("Cannot resolve origin: pass options.origin or set Host" +
-            (trustProxy ? " / X-Forwarded-Host" : ""));
-    }
-    return `${proto}://${host}`;
-};
-const toBodyInit = (body) => {
-    if (body === undefined || body === null)
-        return undefined;
-    if (typeof body === "string")
-        return body;
-    if (body instanceof Uint8Array) {
-        return body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength);
-    }
-    return JSON.stringify(body);
-};
-export const toWebRequest = (req, options) => {
-    // Never trust an absolute-form request target — rebase onto the validated origin.
-    const target = new URL(req.url ?? "/", options.origin);
-    const url = `${options.origin}${target.pathname}${target.search}`;
-    const headers = new Headers(Object.entries(req.headers)
-        .map(([key, value]) => {
-        const resolved = headerValue(value);
-        return resolved === undefined ? null : [key, resolved];
-    })
-        .filter((entry) => entry !== null));
-    const method = (req.method ?? "GET").toUpperCase();
-    if (method === "GET" || method === "HEAD") {
-        return new Request(url, { method, headers });
-    }
-    const body = options.body !== undefined ? options.body : req.body;
-    return new Request(url, {
-        method,
-        headers,
-        body: toBodyInit(body),
-    });
-};
-const isAsyncIterable = (value) => typeof value?.[Symbol.asyncIterator] === "function";
-const concatChunks = (chunks) => {
-    const total = chunks.reduce((sum, chunk) => sum + chunk.byteLength, 0);
-    const out = new Uint8Array(total);
-    chunks.reduce((offset, chunk) => {
-        out.set(chunk, offset);
-        return offset + chunk.byteLength;
-    }, 0);
-    return out;
-};
-/** Prefer `req.body`; else drain the stream (raw `http.createServer`). */
-export const readNodeBody = async (req) => {
-    if (req.body !== undefined && req.body !== null)
-        return req.body;
-    if (!isAsyncIterable(req))
-        return undefined;
-    const chunks = [];
-    for await (const chunk of req) {
-        chunks.push(typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk);
-    }
-    return chunks.length > 0 ? concatChunks(chunks) : undefined;
-};
 export const sendWebResponse = async (res, response) => {
     res.statusCode = response.status;
-    response.headers.forEach((value, key) => res.setHeader(key, value));
+    response.headers.forEach((value, key) => {
+        if (key.toLowerCase() === "set-cookie")
+            return;
+        res.setHeader(key, value);
+    });
+    const cookies = response.headers.getSetCookie();
+    if (cookies.length > 0)
+        res.setHeader("set-cookie", cookies);
     res.end(new Uint8Array(await response.arrayBuffer()));
 };
-/** Always answer — an unhandled rejection on `http.createServer` hangs the client. */
-const sendJsonError = (res, status, error) => {
-    res.statusCode = status;
+/**
+ * Always answer — an unhandled rejection on `http.createServer` hangs the
+ * client. `onFlushed` also closes the connection once the body is written.
+ */
+const sendJsonError = (res, error, onFlushed) => {
+    res.statusCode = error.status;
     res.setHeader("Content-Type", "application/json");
-    res.end(JSON.stringify({ error }));
+    if (onFlushed)
+        res.setHeader("Connection", "close");
+    res.end(error.body, onFlushed);
 };
-/** One-liner: Node `(req, res)` → MCP / OAuth Web handler. */
-export const asNodeHandler = (mcp, options) => {
+const ORIGIN_NOT_ALLOWED = { status: 400, body: JSON.stringify({ error: "origin not allowed" }) };
+const payloadTooLargeBody = (path) => isOAuthPath(path)
+    ? JSON.stringify({ error: "request body too large" })
+    : JSON.stringify(rpcError(null, JSONRPC_PAYLOAD_TOO_LARGE, "Payload too large"));
+/**
+ * Validates that `options` resolves to an origin `asNodeHandler` can trust —
+ * either an explicit `options.origin` already covered by `allowedOrigins`,
+ * or (Host-derived) an `allowedOrigins` that isn't empty. A forgettable Host
+ * spoof would otherwise leak straight into the AS issuer / PRM /
+ * WWW-Authenticate values every request produces.
+ */
+const assertNodeHandlerOptions = (options) => {
     const hostDerived = !options?.origin;
     if (hostDerived && options?.trustProxy !== true) {
         throw new Error("asNodeHandler requires options.origin or options.trustProxy: true");
     }
-    // Forgettable Host spoof → AS issuer / PRM / WWW-Authenticate. Require an
-    // explicit allowlist whenever origin comes from the request.
-    if (hostDerived && !options.allowedOrigins?.length) {
+    if (hostDerived && !options?.allowedOrigins?.length) {
         throw new Error('asNodeHandler with Host-derived origin requires options.allowedOrigins (use ["*"] to admit any Host)');
     }
     if (options?.origin &&
@@ -103,19 +67,36 @@ export const asNodeHandler = (mcp, options) => {
         !isAllowedOrigin(options.origin, options)) {
         throw new Error("asNodeHandler: options.origin is not in options.allowedOrigins");
     }
+};
+/** One-liner: Node `(req, res)` → MCP / OAuth Web handler. */
+export const asNodeHandler = (mcp, options) => {
+    assertNodeHandlerOptions(options);
     return async (req, res) => {
+        const path = requestPath(req);
         try {
             const origin = options?.origin ?? resolveOrigin(req, { trustProxy: true });
             if (!isAllowedOrigin(origin, options)) {
-                sendJsonError(res, 400, "origin not allowed");
+                sendJsonError(res, ORIGIN_NOT_ALLOWED);
                 return;
             }
-            const body = await readNodeBody(req);
+            const body = await readNodeBody(req, bodyLimitForPath(path));
             const request = toWebRequest(req, { origin, body });
             await sendWebResponse(res, await mcp.fetch(request));
         }
-        catch {
-            sendJsonError(res, 500, INTERNAL_ERROR);
+        catch (caught) {
+            if (caught instanceof BodyTooLargeError) {
+                sendJsonError(res, { status: 413, body: payloadTooLargeBody(path) }, () => {
+                    req.destroy?.();
+                });
+                return;
+            }
+            if (caught instanceof InvalidOriginError) {
+                // Bad client input (a malformed or missing Host / X-Forwarded-*),
+                // not a server fault — 400, not the generic 500 below.
+                sendJsonError(res, ORIGIN_NOT_ALLOWED);
+                return;
+            }
+            sendJsonError(res, { status: 500, body: JSON.stringify({ error: INTERNAL_ERROR }) });
         }
     };
 };

package/dist/adapters/node.js.map

@@ -1 +1 @@
-{"version":3,"file":"node.js","sourceRoot":"","sources":["../../src/adapters/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EACL,eAAe,GAEhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,eAAe,EAA+B,CAAC;AAqCxD,MAAM,WAAW,GAAG,CAClB,KAAoC,EAChB,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAEnE,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAsB,EAAE,CACtE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;AAElC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,GAAoB,EACpB,UAAgC,EAAE,EAC1B,EAAE;IACV,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,UAAU;QACtB,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,OAAO;QACzE,CAAC,CAAC,OAAO,CAAC;IACZ,MAAM,IAAI,GAAG,UAAU;QACrB,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAC3D,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/B,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,wDAAwD;YACtD,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC,CAC5C,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,IAAa,EAAwB,EAAE;IACzD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,YAAY,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CACtB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CACnB,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,GAAoB,EACpB,OAA4B,EACnB,EAAE;IACX,kFAAkF;IAClF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,OAAO,CACzB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAA2B,EAAE;QAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAChE,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAClE,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE;QACtB,MAAM;QACN,OAAO;QACP,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;KACvB,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,KAAc,EAAmC,EAAE,CAC1E,OAAQ,KAAqD,EAAE,CAC7D,MAAM,CAAC,aAAa,CACrB,KAAK,UAAU,CAAC;AAEnB,MAAM,YAAY,GAAG,CAAC,MAAoB,EAAc,EAAE;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAC9B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvB,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC;IACnC,CAAC,EAAE,CAAC,CAAC,CAAC;IACN,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAoB,EACF,EAAE;IACpB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IACjE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE5C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAyC,EAAE,CAAC;QACpE,MAAM,CAAC,IAAI,CACT,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,GAAqB,EACrB,QAAkB,EACH,EAAE;IACjB,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACpE,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC,CAAC;AAEF,sFAAsF;AACtF,MAAM,aAAa,GAAG,CACpB,GAAqB,EACrB,MAAc,EACd,KAAa,EACP,EAAE;IACR,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;IACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,GAAuD,EACvD,OAA8B,EAC9B,EAAE;IACF,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;IACrC,IAAI,WAAW,IAAI,OAAO,EAAE,UAAU,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,6DAA6D;IAC7D,IAAI,WAAW,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,IACE,OAAO,EAAE,MAAM;QACf,OAAO,CAAC,cAAc,EAAE,MAAM;QAC9B,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAiB,EAAE;QAC1E,IAAI,CAAC;YACH,MAAM,MAAM,GACV,OAAO,EAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBACtC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../../src/adapters/node.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,eAAe,EAA+B,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EAEX,YAAY,EACZ,WAAW,EACX,aAAa,EACb,YAAY,GACb,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,eAAe,EACf,sBAAsB,GAEvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAGlB,YAAY,EACZ,aAAa,EAEb,YAAY,GACb,MAAM,mBAAmB,CAAC;AAkB3B;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,GAAqB,EAAE,QAAkB,EAAiB,EAAE;IAChG,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,YAAY;YAAE,OAAO;QAC/C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7D,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,aAAa,GAAG,CACpB,GAAqB,EACrB,KAAuC,EACvC,SAAsB,EAChB,EAAE;IACR,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,IAAI,SAAS;QAAE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACjC,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC;AAElG,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAU,EAAE,CACnD,WAAW,CAAC,IAAI,CAAC;IACf,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;IACrD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,yBAAyB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAErF;;;;;;GAMG;AACH,MAAM,wBAAwB,GAAG,CAAC,OAAyC,EAAQ,EAAE;IACnF,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;IACrC,IAAI,WAAW,IAAI,OAAO,EAAE,UAAU,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,WAAW,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,IACE,OAAO,EAAE,MAAM;QACf,OAAO,CAAC,cAAc,EAAE,MAAM;QAC9B,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,GAAuD,EACvD,OAA8B,EAC9B,EAAE;IACF,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAElC,OAAO,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAiB,EAAE;QAC1E,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBACtC,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,IAAI,MAAM,YAAY,iBAAiB,EAAE,CAAC;gBACxC,aAAa,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE;oBACxE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBAClB,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,MAAM,YAAY,kBAAkB,EAAE,CAAC;gBACzC,kEAAkE;gBAClE,uDAAuD;gBACvD,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,aAAa,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/advanced.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `mcp-trellis/advanced` — low-level building blocks for hosts assembling
+ * their own MCP transport or OAuth flow. Less stable than the root and
+ * `mcp-trellis/oauth` entry points: these follow the internals more closely
+ * and may change in a minor release when the protocol work requires it.
+ */
+export { matchesAny, timingSafeEqual } from "./auth/bearer.js";
+export { corsHeaders, emptyResponse, methodNotAllowed, optionsResponse } from "./http/http.js";
+export { ASSUMED_HEADER_PROTOCOL_VERSION, pickProtocolVersion } from "./mcp/protocol.js";
+export { IGNORED_SCHEMA_KEYWORDS, JSON_SCHEMA_TYPES, missingObjectType, SUPPORTED_SCHEMA_KEYWORDS, unsupportedKeywords, validateAgainstSchema, } from "./mcp/validate.js";
+export { advertisedScopes, defaultScopes, registeredClientsRequired, unregisteredClientsAllowed, } from "./oauth/config.js";
+export { type ClientAuth, firstClientAuthError, readClientAuth, } from "./oauth/crypto/clientauth.js";
+export { type AuthCodeRecord, type CodeStore, consumeAuthCode, issueAuthCode, newClientId, } from "./oauth/crypto/codes.js";
+export { randomBase64Url, sha256Base64Url, verifyPkceS256 } from "./oauth/crypto/pkce.js";
+export { buildErrorRedirectUrl } from "./oauth/endpoints/callback.js";
+export { firstResourceError, normalizeConfiguredPath, resourceErrorInfo, } from "./oauth/policy/resource.js";
+export { firstScopeError, formatScope, parseScope, requestedScopes, scopeErrorInfo, } from "./oauth/policy/scope.js";
+//# sourceMappingURL=advanced.d.ts.map

package/dist/advanced.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advanced.d.ts","sourceRoot":"","sources":["../src/advanced.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,UAAU,EACf,oBAAoB,EACpB,cAAc,GACf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,eAAe,EACf,aAAa,EACb,WAAW,GACZ,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,eAAe,EACf,cAAc,GACf,MAAM,yBAAyB,CAAC"}

package/dist/advanced.js

@@ -0,0 +1,18 @@
+/**
+ * `mcp-trellis/advanced` — low-level building blocks for hosts assembling
+ * their own MCP transport or OAuth flow. Less stable than the root and
+ * `mcp-trellis/oauth` entry points: these follow the internals more closely
+ * and may change in a minor release when the protocol work requires it.
+ */
+export { matchesAny, timingSafeEqual } from "./auth/bearer.js";
+export { corsHeaders, emptyResponse, methodNotAllowed, optionsResponse } from "./http/http.js";
+export { ASSUMED_HEADER_PROTOCOL_VERSION, pickProtocolVersion } from "./mcp/protocol.js";
+export { IGNORED_SCHEMA_KEYWORDS, JSON_SCHEMA_TYPES, missingObjectType, SUPPORTED_SCHEMA_KEYWORDS, unsupportedKeywords, validateAgainstSchema, } from "./mcp/validate.js";
+export { advertisedScopes, defaultScopes, registeredClientsRequired, unregisteredClientsAllowed, } from "./oauth/config.js";
+export { firstClientAuthError, readClientAuth, } from "./oauth/crypto/clientauth.js";
+export { consumeAuthCode, issueAuthCode, newClientId, } from "./oauth/crypto/codes.js";
+export { randomBase64Url, sha256Base64Url, verifyPkceS256 } from "./oauth/crypto/pkce.js";
+export { buildErrorRedirectUrl } from "./oauth/endpoints/callback.js";
+export { firstResourceError, normalizeConfiguredPath, resourceErrorInfo, } from "./oauth/policy/resource.js";
+export { firstScopeError, formatScope, parseScope, requestedScopes, scopeErrorInfo, } from "./oauth/policy/scope.js";
+//# sourceMappingURL=advanced.js.map

package/dist/advanced.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advanced.js","sourceRoot":"","sources":["../src/advanced.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,oBAAoB,EACpB,cAAc,GACf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,eAAe,EACf,aAAa,EACb,WAAW,GACZ,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,eAAe,EACf,cAAc,GACf,MAAM,yBAAyB,CAAC"}