mcp-trellis 1.0.0 → 2.1.0

package/README.md

@@ -1,122 +1,92 @@
 # mcp-trellis
 
-[![CI](https://github.com/amir1824/mcp-trellis/actions/workflows/ci.yml/badge.svg)](https://github.com/amir1824/mcp-trellis/actions/workflows/ci.yml)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-
-**Host-agnostic MCP + OAuth ports** — you bring the runtime and IdP; the library owns the connector protocol.
-
-Web-standard `Request` → `Response`. Same handler on Cloudflare Workers, Next.js App Router, Deno, Bun, and Node HTTP via `mcp-trellis/node`. Zero runtime dependencies.
-
-## Why mcp-trellis
-
-The whole connector stack in one package — MCP handler **and** OAuth 2.1 authorization server — with no database and no vendor signup. You own login, token minting, and storage; the library owns the protocol.
+**Existing SaaS → authenticated AI connector SDK.**
 
-| | mcp-trellis | Official MCP SDK | `workers-oauth-provider` | `@mcpauth/auth` | Auth0 / Clerk / Authlete |
-|---|---|---|---|---|---|
-| MCP handler | ✅ | ✅ | ❌ | ❌ | ❌ |
-| OAuth 2.1 authorization server | ✅ | ❌ bring your own | ✅ | ✅ | ✅ |
-| Runtime | any Web-standard | any Web-standard | Workers only | Node | — |
-| Database | none | — | KV (optional) | **required** | — |
-| Runtime dependencies | **zero** | several | several | several | — |
-| Self-hosted | ✅ | ✅ | ✅ | ✅ | ❌ SaaS |
-| Named connector profiles (Claude / Gemini / Codex), enforced | ✅ | ❌ | ❌ | ❌ | ❌ |
+Claude, ChatGPT and Gemini against the login and data you already have. No new
+database. No auth vendor. One TypeScript package.
 
-Prefer the official SDK when you already have a separate AS. Prefer
-`workers-oauth-provider` when you want Cloudflare's Workers-only
-implementation. Prefer a managed IdP when you'd rather pay than operate one.
+mcp-trellis is the **vendor-neutral embedded BYO-auth** path: MCP handler and
+self-hosted OAuth AS in one npm install. Contrast composition stacks such as
+**xmcp + Scalekit** (or WorkOS / Descope connectors) that split the MCP runtime
+and the identity product across 2–3 packages.
 
-Named alternatives in the same problem space:
+Your app already knows who the user is. Connecting an AI client still means
+wiring OAuth discovery, registration, consent, PKCE and token exchange.
+**mcp-trellis handles that protocol work**, while your app keeps login, token
+verification and data permissions.
 
-- **`@mcpauth/auth` / `getmcpauth` / `mcp-auth`** — OAuth for MCP, typically
-  with a DB or a different runtime/stack assumption. mcp-trellis is the
-  **zero-dependency** option that ships the MCP handler **and** the OAuth 2.1
-  AS in one package.
-- **`fastmcp-oauth`** — OAuth helpers around FastMCP. mcp-trellis is host-agnostic
-  (`Request`/`Response`) and not tied to a particular MCP framework.
-
-## Requirements
-
-- **Node ≥ 20** for Node hosts (global WebCrypto in ESM)
-- Or any runtime with WebCrypto + `fetch` (Workers, Deno, Bun)
+```mermaid
+flowchart LR
+  A[Existing app: login + user data] --> B[mcp-trellis: OAuth + MCP]
+  B --> C[AI client: user-scoped tools]
+```
 
-## Install
+## The 30-second example
 
 ```bash
 npm install mcp-trellis
 ```
 
-## Quick start
-
-One call mounts the MCP endpoint, the OAuth authorization server, and both discovery documents:
-
 ```ts
 import { createMcpApp } from "mcp-trellis";
+import { existingAuth, projectsForUser } from "./your-app.js";
 
-const app = createMcpApp({
-  serverInfo: { name: "demo", version: "1.0.0" },
+export const mcp = createMcpApp<{ userId: string }>({
+  serverInfo: { name: "my-saas", version: "1.0.0" },
   clients: ["claude"],
-  tools: [
-    {
-      name: "echo",
-      description: "Echo text back",
-      inputSchema: {
-        type: "object",
-        properties: { text: { type: "string" } },
-        required: ["text"],
-      },
-      scope: "mcp",
-      handler: (_ctx, args) => String(args.text ?? ""),
-    },
-  ],
-  auth: {
-    codeSecret: process.env.OAUTH_CODE_SECRET!,
-    resolveUser: async (req) => getSession(req),
-    loginUrl: (_req, next) => `/login?next=${encodeURIComponent(next)}`,
-    mintAccessToken: async ({ userId, scope, resource }) => ({
-      // Embed `resource` as the token audience (RFC 8707).
-      accessToken: await issueUserToken(userId, { aud: resource, scope }),
-      expiresIn: 3600,
-    }),
-    verifyToken: async (token) => {
-      const claims = await readUserToken(token);
-      if (!claims) return null;
-      return {
-        userId: claims.sub,
-        scopes: claims.scope.split(" "),
-        audience: claims.aud,
-      };
-    },
-  },
+  // existingAuth must include codeStore (required since 2.0) plus the usual ports.
+  auth: existingAuth,
+  context: (_request, principal) => ({ userId: principal!.id }),
+  tools: [{
+    name: "list_my_projects",
+    description: "List the signed-in user's projects",
+    inputSchema: { type: "object", properties: {} },
+    scope: "mcp",
+    handler: async ({ userId }) => JSON.stringify(await projectsForUser(userId)),
+  }],
 });
-
-export default { fetch: (req: Request) => app.fetch(req) };
 ```
 
-You return the token's `audience`; **the library rejects tokens minted for a different resource** before any tool runs. Details: [docs/security.md](docs/security.md).
+This shows the integration shape: `your-app.js` is your application's auth/data adapter, not a supplied module. Production needs a shared `codeStore` (see [examples/stores.ts](examples/stores.ts)). **[Run the complete Node demo](examples/saas-demo/README.md)** for working login, token handling and two users with different projects. Node ≥20 is required.
 
-A real `/authorize` walk includes an approval step: a resolved session doesn't redirect straight back with a code, it renders a consent screen first (built in, or your own via `consent`). First-time integrators clicking through by hand should expect an HTML page there, not an immediate redirect — see [Consent](docs/guide.md#consent).
+[![npm](https://img.shields.io/npm/v/mcp-trellis)](https://www.npmjs.com/package/mcp-trellis)
+[![CI](https://github.com/amir1824/mcp-trellis/actions/workflows/ci.yml/badge.svg)](https://github.com/amir1824/mcp-trellis/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 
-Smoke-test with `initialize` (public — no Bearer needed):
+## When should I use this?
 
-```bash
-curl -s http://127.0.0.1:8787/mcp \
-  -H 'content-type: application/json' \
-  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18"}}'
-```
+- Your TypeScript app already has login and user data, and you want to expose user-scoped tools through remote MCP.
+- You want the MCP handler and OAuth authorization endpoints in one package, with zero runtime dependencies.
+- You want to reuse your runtime and existing storage. The library does not require a new database; production deployments still need appropriate replay, token and session storage.
 
-```json
-{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-06-18","capabilities":{"tools":{}},"serverInfo":{"name":"demo","version":"1.0.0"},"instructions":""}}
-```
+## When should I not use this?
+
+- You need a managed identity provider, a user database, or a login system built for you.
+- You already have an MCP server and authorization server that meet your needs.
+- You need protocol features or client combinations absent from the [verified support table](docs/compatibility.md).
+- You only need a local stdio tool with no remote authorization flow.
+
+## Run a real tool
+
+The [Project desk demo](examples/saas-demo/README.md) proves the local flow: app login → OAuth consent → access token → `list_my_projects`. Alice sees her two projects; Bob sees his own. It uses fictional data and an independent app session.
+
+**Live Claude / ChatGPT recordings are still pending.** Automated OAuth tests are not evidence that a current vendor client has connected successfully.
+
+## Clients and compatibility
+
+| Profile | Implemented server flow | Live client evidence |
+|---|---|---|
+| Claude (`claude`) | Dynamic registration, public client, PKCE | Pending |
+| ChatGPT / Codex (`codex`) | Public client, PKCE; configure exact hosted callback as needed | Pending for each product |
+| Gemini Enterprise (`gemini`) | Pre-registered client; secret basic/post; requires `clientStore` | Pending; does not imply every Gemini product |
+
+Protocol versions implemented: `2024-11-05`, `2025-03-26`, `2025-06-18`; default `2025-06-18`. See [test evidence and verification checklist](docs/compatibility.md), [client configuration](docs/guide.md#clients) and [troubleshooting](docs/troubleshooting.md).
 
-## Clients
+## Integrate with your app
 
-| Client | Registration | Token endpoint auth | Notes |
-|--------|--------------|---------------------|-------|
-| `claude` | Dynamic (DCR), public + PKCE | `none` | Claude Custom Connectors callback allowlisted |
-| `gemini` | **Pre-registered**, confidential | `client_secret_basic`, `client_secret_post` | Supply `auth.clientStore` |
-| `codex` | OAuth 2.1 per MCP auth spec, public + PKCE | `none` | ChatGPT / Codex share one contract |
+Implement `resolveUser`, `loginUrl`, `mintAccessToken` and `verifyToken` using your app's existing auth. Mint tokens for the requested MCP resource and return their verified `audience`; the library rejects an audience mismatch before executing tools. A logged-in user still sees an OAuth consent screen. Your data layer must enforce ownership and tenant permissions. Browser callers that send an `Origin` header need `allowedRequestOrigins` (fail-closed by default) — see [security.md](docs/security.md).
 
-Pre-registered clients, DCR enforcement, and `clientStore` wiring: [docs/guide.md#clients](docs/guide.md#clients).
+[Node demo](examples/saas-demo/README.md) · [Host recipes](docs/guide.md) · [Security responsibilities](docs/security.md) · [npm](https://www.npmjs.com/package/mcp-trellis)
 
 ## Architecture
 

package/dist/adapters/node-request.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Node request-side plumbing for the `(req, res)` adapter: origin
+ * resolution, Web `Request` construction, and bounded body reading.
+ * Response-side glue (`sendWebResponse`, `asNodeHandler`) lives in `node.ts`.
+ */
+export type NodeRequestLike = {
+    method?: string | undefined;
+    url?: string | undefined;
+    headers: Record<string, string | string[] | undefined>;
+    body?: unknown;
+    /** Destroy the underlying socket — called only after a 413 has flushed. */
+    destroy?: (() => void) | undefined;
+    [Symbol.asyncIterator]?: () => AsyncIterator<Uint8Array | string>;
+};
+export type ToWebRequestOptions = {
+    /** Absolute origin, e.g. https://app.example.com. */
+    origin: string;
+    /** Pre-read body. Overrides `req.body` when supplied. */
+    body?: unknown;
+};
+export type ResolveOriginOptions = {
+    /** Trust last `X-Forwarded-Host` / `X-Forwarded-Proto` hop. */
+    trustProxy?: boolean;
+};
+/**
+ * A Host (or `X-Forwarded-*`) header that can't safely become an origin —
+ * missing, carrying a path/query/fragment/credentials, malformed, or a
+ * non-`http(s)` scheme. Distinct from a generic `Error` so `asNodeHandler`
+ * can answer this with a client-facing 400 instead of the same 500 it gives
+ * an actual unexpected failure.
+ */
+export declare class InvalidOriginError extends Error {
+}
+/**
+ * Derive origin from Host, or from forwarded headers when `trustProxy`.
+ * Always parsed through `URL` and rejected unless it is a bare `host[:port]`
+ * over http(s): a Host carrying a path (`evil.test/../trusted.test`) or
+ * credentials (`user:pass@evil.test`) must not become an origin-shaped string.
+ */
+export declare const resolveOrigin: (req: NodeRequestLike, options?: ResolveOriginOptions) => string;
+export declare const toWebRequest: (req: NodeRequestLike, options: ToWebRequestOptions) => Request;
+export declare const requestPath: (req: NodeRequestLike) => string;
+/** True for a path under an `…/oauth` segment — the default OAuth mount. */
+export declare const isOAuthPath: (path: string) => boolean;
+/** OAuth routes under `…/oauth/…` get the 64 KiB cap; everything else gets 1 MiB. */
+export declare const bodyLimitForPath: (path: string) => number;
+/**
+ * Prefer `req.body`; else drain the stream (raw `http.createServer`), capped
+ * at `maxBytes`. Throws `BodyTooLargeError` past the cap without destroying
+ * the socket — `asNodeHandler` writes 413 first, then destroys after flush.
+ */
+export declare const readNodeBody: (req: NodeRequestLike, maxBytes?: number) => Promise<unknown>;
+//# sourceMappingURL=node-request.d.ts.map

package/dist/adapters/node-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-request.d.ts","sourceRoot":"","sources":["../../src/adapters/node-request.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,2EAA2E;IAC3E,OAAO,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IACnC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,aAAa,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC;CACnE,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,+DAA+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAQF;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;CAAG;AAOhD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,eAAe,EAAE,UAAS,oBAAyB,KAAG,MA+BxF,CAAC;AA6CF,eAAO,MAAM,YAAY,GAAI,KAAK,eAAe,EAAE,SAAS,mBAAmB,KAAG,OAkCjF,CAAC;AAMF,eAAO,MAAM,WAAW,GAAI,KAAK,eAAe,KAAG,MAA+C,CAAC;AAEnG,4EAA4E;AAC5E,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,KAAG,OAAuC,CAAC;AAEnF,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG,MACuB,CAAC;AAqBxE;;;;GAIG;AACH,eAAO,MAAM,YAAY,GACvB,KAAK,eAAe,EACpB,WAAU,MAA+B,KACxC,OAAO,CAAC,OAAO,CAcjB,CAAC"}

package/dist/adapters/node-request.js

@@ -0,0 +1,165 @@
+/**
+ * Node request-side plumbing for the `(req, res)` adapter: origin
+ * resolution, Web `Request` construction, and bounded body reading.
+ * Response-side glue (`sendWebResponse`, `asNodeHandler`) lives in `node.ts`.
+ */
+import { BodyTooLargeError, DEFAULT_MCP_BODY_LIMIT, DEFAULT_OAUTH_BODY_LIMIT, isNodeReadable, readBoundedNodeBody, } from "../http/body.js";
+import { isJsonObject } from "../util/json.js";
+const headerValue = (value) => Array.isArray(value) ? value[0] : value;
+const lastForwarded = (value) => value?.split(",").pop()?.trim();
+/**
+ * A Host (or `X-Forwarded-*`) header that can't safely become an origin —
+ * missing, carrying a path/query/fragment/credentials, malformed, or a
+ * non-`http(s)` scheme. Distinct from a generic `Error` so `asNodeHandler`
+ * can answer this with a client-facing 400 instead of the same 500 it gives
+ * an actual unexpected failure.
+ */
+export class InvalidOriginError extends Error {
+}
+/** A bare `host[:port]` must not carry any of these — they'd mean a path, query, fragment, or credentials smuggled into what should be just the authority. */
+const HOST_HEADER_STRUCTURAL_CHARS = /[/?#@\\]/;
+const ALLOWED_ORIGIN_PROTOCOLS = new Set(["http:", "https:"]);
+/**
+ * Derive origin from Host, or from forwarded headers when `trustProxy`.
+ * Always parsed through `URL` and rejected unless it is a bare `host[:port]`
+ * over http(s): a Host carrying a path (`evil.test/../trusted.test`) or
+ * credentials (`user:pass@evil.test`) must not become an origin-shaped string.
+ */
+export const resolveOrigin = (req, options = {}) => {
+    const trustProxy = options.trustProxy === true;
+    const proto = trustProxy
+        ? lastForwarded(headerValue(req.headers["x-forwarded-proto"])) || "https"
+        : "https";
+    const host = trustProxy
+        ? lastForwarded(headerValue(req.headers["x-forwarded-host"])) || headerValue(req.headers.host)
+        : headerValue(req.headers.host);
+    if (!host) {
+        throw new InvalidOriginError("Cannot resolve origin: pass options.origin or set Host" +
+            (trustProxy ? " / X-Forwarded-Host" : ""));
+    }
+    if (HOST_HEADER_STRUCTURAL_CHARS.test(host)) {
+        throw new InvalidOriginError(`Cannot resolve origin: Host header "${host}" must be a bare host[:port], not a full URL`);
+    }
+    let parsed;
+    try {
+        parsed = new URL(`${proto}://${host}`);
+    }
+    catch {
+        throw new InvalidOriginError(`Cannot resolve origin: Host header "${host}" is not valid`);
+    }
+    if (!ALLOWED_ORIGIN_PROTOCOLS.has(parsed.protocol)) {
+        throw new InvalidOriginError(`Cannot resolve origin: unsupported protocol "${parsed.protocol}"`);
+    }
+    return parsed.origin;
+};
+const isPlainRecord = (value) => isJsonObject(value) && !(value instanceof Uint8Array);
+const isFormContentType = (contentType) => (contentType ?? "").toLowerCase().includes("application/x-www-form-urlencoded");
+const appendFormValue = (params, key, value) => {
+    if (Array.isArray(value)) {
+        for (const entry of value)
+            appendFormValue(params, key, entry);
+        return;
+    }
+    if (value === undefined || value === null)
+        return;
+    params.append(key, typeof value === "string" ? value : String(value));
+};
+/** Re-serialize a pre-parsed `express.urlencoded()`-shaped body back to `a=1&b=2`. */
+const objectToUrlEncoded = (body) => {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(body))
+        appendFormValue(params, key, value);
+    return params.toString();
+};
+/**
+ * `req.body` from a body-parsing middleware (Express `json()`/`urlencoded()`,
+ * multer, …) arrives as an already-parsed object, not raw bytes — the
+ * `Content-Type` header says what shape it round-trips back to. A form body
+ * must be re-encoded as a form, or `/token` and `/consent` behind
+ * `express.urlencoded()` receive one unparseable JSON-shaped key.
+ */
+const toBodyInit = (body, contentType) => {
+    if (body === undefined || body === null)
+        return undefined;
+    if (typeof body === "string")
+        return body;
+    if (body instanceof Uint8Array) {
+        return body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength);
+    }
+    if (isPlainRecord(body) && isFormContentType(contentType)) {
+        return objectToUrlEncoded(body);
+    }
+    return JSON.stringify(body);
+};
+const BODYLESS_METHODS = new Set(["GET", "HEAD"]);
+export const toWebRequest = (req, options) => {
+    // Never trust an absolute-form request target — rebase onto the validated origin.
+    const target = new URL(req.url ?? "/", options.origin);
+    const url = `${options.origin}${target.pathname}${target.search}`;
+    const headers = new Headers(Object.entries(req.headers)
+        .map(([key, value]) => {
+        const resolved = headerValue(value);
+        return resolved === undefined ? null : [key, resolved];
+    })
+        .filter((entry) => entry !== null));
+    const method = (req.method ?? "GET").toUpperCase();
+    if (BODYLESS_METHODS.has(method)) {
+        return new Request(url, { method, headers });
+    }
+    const body = options.body !== undefined ? options.body : req.body;
+    const bodyInit = toBodyInit(body, headers.get("content-type") ?? undefined);
+    if (isPlainRecord(body)) {
+        // The re-serialized body's byte length no longer matches whatever
+        // Content-Length the original (already-parsed) request declared — a
+        // stale header here can make the body-size precheck reject a body well
+        // within the cap, or let an oversized one slip past it (still caught by
+        // the streaming fallback either way).
+        headers.delete("content-length");
+        headers.delete("transfer-encoding");
+    }
+    return new Request(url, {
+        method,
+        headers,
+        ...(bodyInit !== undefined ? { body: bodyInit } : {}),
+    });
+};
+const isAsyncIterable = (value) => typeof value?.[Symbol.asyncIterator] ===
+    "function";
+export const requestPath = (req) => (req.url ?? "/").split("?")[0] ?? "/";
+/** True for a path under an `…/oauth` segment — the default OAuth mount. */
+export const isOAuthPath = (path) => /\/oauth(?:\/|$)/.test(path);
+/** OAuth routes under `…/oauth/…` get the 64 KiB cap; everything else gets 1 MiB. */
+export const bodyLimitForPath = (path) => isOAuthPath(path) ? DEFAULT_OAUTH_BODY_LIMIT : DEFAULT_MCP_BODY_LIMIT;
+const enforcePresetBodySize = (body, maxBytes) => {
+    if (typeof body === "string" && new TextEncoder().encode(body).byteLength > maxBytes) {
+        throw new BodyTooLargeError(maxBytes);
+    }
+    if (body instanceof Uint8Array && body.byteLength > maxBytes) {
+        throw new BodyTooLargeError(maxBytes);
+    }
+};
+const emptyToUndefined = (bytes) => bytes.byteLength > 0 ? bytes : undefined;
+const asBodyStream = (req) => {
+    if (isNodeReadable(req) || isAsyncIterable(req)) {
+        return req;
+    }
+    return undefined;
+};
+/**
+ * Prefer `req.body`; else drain the stream (raw `http.createServer`), capped
+ * at `maxBytes`. Throws `BodyTooLargeError` past the cap without destroying
+ * the socket — `asNodeHandler` writes 413 first, then destroys after flush.
+ */
+export const readNodeBody = async (req, maxBytes = DEFAULT_MCP_BODY_LIMIT) => {
+    if (req.body !== undefined && req.body !== null) {
+        enforcePresetBodySize(req.body, maxBytes);
+        return req.body;
+    }
+    const stream = asBodyStream(req);
+    if (!stream)
+        return undefined;
+    return emptyToUndefined(await readBoundedNodeBody(stream, maxBytes, {
+        contentLength: headerValue(req.headers["content-length"]),
+    }));
+};
+//# sourceMappingURL=node-request.js.map

package/dist/adapters/node-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-request.js","sourceRoot":"","sources":["../../src/adapters/node-request.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,cAAc,EACd,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAwB/C,MAAM,WAAW,GAAG,CAAC,KAAoC,EAAsB,EAAE,CAC/E,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAE1C,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAsB,EAAE,CACtE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;CAAG;AAEhD,8JAA8J;AAC9J,MAAM,4BAA4B,GAAG,UAAU,CAAC;AAEhD,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAoB,EAAE,UAAgC,EAAE,EAAU,EAAE;IAChG,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,UAAU;QACtB,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,OAAO;QACzE,CAAC,CAAC,OAAO,CAAC;IACZ,MAAM,IAAI,GAAG,UAAU;QACrB,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9F,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,kBAAkB,CAC1B,wDAAwD;YACtD,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC,CAC5C,CAAC;IACJ,CAAC;IACD,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,kBAAkB,CAC1B,uCAAuC,IAAI,8CAA8C,CAC1F,CAAC;IACJ,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,uCAAuC,IAAI,gBAAgB,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,kBAAkB,CAC1B,gDAAgD,MAAM,CAAC,QAAQ,GAAG,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,KAAc,EAAoC,EAAE,CACzE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,CAAC;AAExD,MAAM,iBAAiB,GAAG,CAAC,WAA+B,EAAW,EAAE,CACrE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;AAElF,MAAM,eAAe,GAAG,CAAC,MAAuB,EAAE,GAAW,EAAE,KAAc,EAAQ,EAAE;IACrF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,KAAK;YAAE,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO;IAClD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACxE,CAAC,CAAC;AAEF,sFAAsF;AACtF,MAAM,kBAAkB,GAAG,CAAC,IAA6B,EAAU,EAAE;IACnE,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,CAAC,IAAa,EAAE,WAAoB,EAAwB,EAAE;IAC/E,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,YAAY,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAgB,CAAC;IAC9F,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAoB,EAAE,OAA4B,EAAW,EAAE;IAC1F,kFAAkF;IAClF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,OAAO,CACzB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAA2B,EAAE;QAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAChE,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAClE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC,CAAC;IAC5E,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,kEAAkE;QAClE,oEAAoE;QACpE,uEAAuE;QACvE,wEAAwE;QACxE,sCAAsC;QACtC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE;QACtB,MAAM;QACN,OAAO;QACP,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,KAAc,EAAmC,EAAE,CAC1E,OAAQ,KAAqD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC;IACrF,UAAU,CAAC;AAEb,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAoB,EAAU,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;AAEnG,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEnF,qFAAqF;AACrF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAU,EAAE,CACvD,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,sBAAsB,CAAC;AAExE,MAAM,qBAAqB,GAAG,CAAC,IAAa,EAAE,QAAgB,EAAQ,EAAE;IACtE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ,EAAE,CAAC;QACrF,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,IAAI,YAAY,UAAU,IAAI,IAAI,CAAC,UAAU,GAAG,QAAQ,EAAE,CAAC;QAC7D,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,KAAiB,EAA0B,EAAE,CACrE,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAE3C,MAAM,YAAY,GAAG,CAAC,GAAoB,EAAkD,EAAE;IAC5F,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,GAAyC,CAAC;IACnD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAoB,EACpB,WAAmB,sBAAsB,EACvB,EAAE;IACpB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAChD,qBAAqB,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,OAAO,gBAAgB,CACrB,MAAM,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE;QAC1C,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;KAC1D,CAAC,CACH,CAAC;AACJ,CAAC,CAAC"}

package/dist/adapters/node.d.ts

@@ -1,33 +1,18 @@
 /**
  * Node HTTP `(req, res)` adapter — Express, Cloud Functions, `http.createServer`, etc.
  * Bridges duck-typed Node request/response objects to Web `Request`/`Response`.
+ * Request-side plumbing (origin resolution, `toWebRequest`, body reading)
+ * lives in `node-request.ts` and is re-exported below unchanged.
  */
-import { isAllowedOrigin, type OriginAllowlistOptions } from "./origins.js";
-export { isAllowedOrigin, type OriginAllowlistOptions };
-export type NodeRequestLike = {
-    method?: string | undefined;
-    url?: string | undefined;
-    headers: Record<string, string | string[] | undefined>;
-    body?: unknown;
-    /** Destroy the underlying socket — called only after a 413 has flushed. */
-    destroy?: (() => void) | undefined;
-    [Symbol.asyncIterator]?: () => AsyncIterator<Uint8Array | string>;
-};
+import { type OriginAllowlistOptions } from "../http/origins.js";
+import { type NodeRequestLike } from "./node-request.js";
+export { isAllowedOrigin, isAllowedRequestOrigin, type OriginAllowlistOptions, } from "../http/origins.js";
+export { bodyLimitForPath, InvalidOriginError, type NodeRequestLike, type ResolveOriginOptions, readNodeBody, resolveOrigin, type ToWebRequestOptions, toWebRequest, } from "./node-request.js";
 export type NodeResponseLike = {
     statusCode: number;
     setHeader: (name: string, value: string | number | readonly string[]) => void;
     end: (chunk?: string | Uint8Array, callback?: () => void) => void;
 };
-export type ToWebRequestOptions = {
-    /** Absolute origin, e.g. https://app.example.com. */
-    origin: string;
-    /** Pre-read body. Overrides `req.body` when supplied. */
-    body?: unknown;
-};
-export type ResolveOriginOptions = {
-    /** Trust last `X-Forwarded-Host` / `X-Forwarded-Proto` hop. */
-    trustProxy?: boolean;
-};
 export type AsNodeHandlerOptions = OriginAllowlistOptions & {
     /**
      * Absolute origin. Required unless `trustProxy: true`.
@@ -37,17 +22,15 @@ export type AsNodeHandlerOptions = OriginAllowlistOptions & {
     origin?: string;
     trustProxy?: boolean;
 };
-/** Derive origin from Host, or from forwarded headers when trustProxy. */
-export declare const resolveOrigin: (req: NodeRequestLike, options?: ResolveOriginOptions) => string;
-export declare const toWebRequest: (req: NodeRequestLike, options: ToWebRequestOptions) => Request;
-/** OAuth routes under `…/oauth/…` get the 64 KiB cap; everything else gets 1 MiB. */
-export declare const bodyLimitForPath: (path: string) => number;
 /**
- * Prefer `req.body`; else drain the stream (raw `http.createServer`), capped
- * at `maxBytes`. Throws `BodyTooLargeError` past the cap without destroying
- * the socket — `asNodeHandler` writes 413 first, then destroys after flush.
+ * Unlike every other header, `Set-Cookie` cannot be folded into one
+ * comma-joined value — a cookie's own `Expires` attribute contains a comma.
+ * The Fetch `Headers` object accordingly keeps duplicates apart internally
+ * and exposes them via `getSetCookie()`, but `forEach`/`entries()` still
+ * yields one `"set-cookie"` pair per cookie — calling `res.setHeader` once
+ * per pair (as for any other header) makes each call overwrite the last,
+ * silently dropping every cookie but the final one.
  */
-export declare const readNodeBody: (req: NodeRequestLike, maxBytes?: number) => Promise<unknown>;
 export declare const sendWebResponse: (res: NodeResponseLike, response: Response) => Promise<void>;
 /** One-liner: Node `(req, res)` → MCP / OAuth Web handler. */
 export declare const asNodeHandler: (mcp: {

package/dist/adapters/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/adapters/node.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE5E,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,CAAC;AAExD,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,2EAA2E;IAC3E,OAAO,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IACnC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,aAAa,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC;CACnE,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,KAAK,IAAI,CAAC;IAC9E,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;CACnE,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,+DAA+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,sBAAsB,GAAG;IAC1D;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAQF,0EAA0E;AAC1E,eAAO,MAAM,aAAa,GAAI,KAAK,eAAe,EAAE,UAAS,oBAAyB,KAAG,MAexF,CAAC;AAWF,eAAO,MAAM,YAAY,GAAI,KAAK,eAAe,EAAE,SAAS,mBAAmB,KAAG,OAyBjF,CAAC;AAQF,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG,MACkC,CAAC;AAWnF;;;;GAIG;AACH,eAAO,MAAM,YAAY,GACvB,KAAK,eAAe,EACpB,WAAU,MAA+B,KACxC,OAAO,CAAC,OAAO,CAmBjB,CAAC;AAEF,eAAO,MAAM,eAAe,GAAU,KAAK,gBAAgB,EAAE,UAAU,QAAQ,KAAG,OAAO,CAAC,IAAI,CAM7F,CAAC;AAoBF,8DAA8D;AAC9D,eAAO,MAAM,aAAa,GACxB,KAAK;IAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,EACvD,UAAU,oBAAoB,MAqBhB,KAAK,eAAe,EAAE,KAAK,gBAAgB,KAAG,OAAO,CAAC,IAAI,CAqBzE,CAAC"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/adapters/node.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAElF,OAAO,EAIL,KAAK,eAAe,EAKrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,YAAY,EACZ,aAAa,EACb,KAAK,mBAAmB,EACxB,YAAY,GACb,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,KAAK,IAAI,CAAC;IAC9E,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;CACnE,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,sBAAsB,GAAG;IAC1D;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAU,KAAK,gBAAgB,EAAE,UAAU,QAAQ,KAAG,OAAO,CAAC,IAAI,CAS7F,CAAC;AAkDF,8DAA8D;AAC9D,eAAO,MAAM,aAAa,GACxB,KAAK;IAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,EACvD,UAAU,oBAAoB,MAIhB,KAAK,eAAe,EAAE,KAAK,gBAAgB,KAAG,OAAO,CAAC,IAAI,CA2BzE,CAAC"}