mcp-trellis 1.0.0 → 2.1.0

package/dist/{body.js → http/body.js}

@@ -33,30 +33,47 @@ const concatBytes = (chunks, total) => {
 };
 const toBytes = (chunk) => typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk;
 /**
- * Reads a Web `Request` body as text, rejecting early on an honest
- * oversized `Content-Length`, then aborting mid-stream — before the whole
- * body is buffered — if a chunked body (no `Content-Length`) exceeds
- * `maxBytes`. Falls back to `request.text()` when `request.body` is null
- * (some runtimes don't expose a streaming body), still enforcing the cap.
+ * Reads a bounded body as raw bytes, rejecting early on an honest oversized
+ * `Content-Length`, then aborting mid-stream — before the whole body is
+ * buffered — if a chunked body (no `Content-Length`) exceeds `maxBytes`.
+ * Falls back to `source.arrayBuffer()` (or `source.text()`) when
+ * `source.body` is null (some runtimes don't expose a streaming body),
+ * still enforcing the cap.
+ *
+ * Optional `signal` cancels the active reader on abort — needed when a hop
+ * timeout must stop a stalled stream (a locked `body.cancel()` is a no-op).
  */
-export const readBoundedText = async (request, maxBytes) => {
-    const declared = declaredContentLength(request.headers);
+export const readBoundedBytes = async (source, maxBytes, signal) => {
+    if (signal?.aborted)
+        throw new Error("body read aborted");
+    const declared = declaredContentLength(source.headers);
     if (declared !== null && declared > maxBytes) {
         throw new BodyTooLargeError(maxBytes);
     }
-    const reader = request.body?.getReader();
+    const reader = source.body?.getReader();
     if (!reader) {
-        const text = await request.text();
-        if (new TextEncoder().encode(text).byteLength > maxBytes) {
+        // ponytail: no stream → arrayBuffer/text ignore signal; fine for request
+        // bodies. CIMD always has a stream on Node/undici. Upgrade: race abort
+        // or refuse the fallback when signal is required.
+        const bytes = source.arrayBuffer
+            ? new Uint8Array(await source.arrayBuffer())
+            : new TextEncoder().encode(await source.text());
+        if (bytes.byteLength > maxBytes)
             throw new BodyTooLargeError(maxBytes);
-        }
-        return text;
+        return bytes;
     }
+    const onAbort = () => {
+        void reader.cancel().catch(() => { });
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
     const chunks = [];
     let total = 0;
     try {
         for (;;) {
             const { done, value } = await reader.read();
+            // Cancel may settle read() as done — still treat abort as failure.
+            if (signal?.aborted)
+                throw new Error("body read aborted");
             if (done)
                 break;
             // ponytail: one oversized chunk can briefly allocate maxBytes + highWaterMark
@@ -68,10 +85,13 @@ export const readBoundedText = async (request, maxBytes) => {
         }
     }
     finally {
+        signal?.removeEventListener("abort", onAbort);
         await reader.cancel().catch(() => { });
     }
-    return new TextDecoder().decode(concatBytes(chunks, total));
+    return concatBytes(chunks, total);
 };
+/** `readBoundedBytes`, decoded as UTF-8 — for JSON / form / text bodies. */
+export const readBoundedText = async (source, maxBytes, signal) => new TextDecoder().decode(await readBoundedBytes(source, maxBytes, signal));
 export const isNodeReadable = (value) => typeof value?.on === "function" &&
     typeof value?.pause === "function" &&
     typeof value?.removeListener === "function";

package/dist/http/body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.js","sourceRoot":"","sources":["../../src/http/body.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACrB;IAArB,YAAqB,QAAgB;QACnC,KAAK,CAAC,wBAAwB,QAAQ,QAAQ,CAAC,CAAC;QAD7B,aAAQ,GAAR,QAAQ,CAAQ;QAEnC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,mGAAmG;AACnG,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC,CAAC,QAAQ;AAEzD,uGAAuG;AACvG,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,CAAC,SAAS;AAEzD,MAAM,qBAAqB,GAAG,CAAC,OAE9B,EAAiB,EAAE;IAClB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,MAAoB,EAAE,KAAa,EAAc,EAAE;IACtE,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAC9B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC;IACnC,CAAC,EAAE,CAAC,CAAC,CAAC;IACN,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,KAA0B,EAAc,EAAE,CACzD,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAgBtE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,MAAyB,EACzB,QAAgB,EAChB,MAAoB,EACC,EAAE;IACvB,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAE1D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;QAC7C,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,yEAAyE;QACzE,uEAAuE;QACvE,kDAAkD;QAClD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW;YAC9B,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5C,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,UAAU,GAAG,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC;IACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3D,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,mEAAmE;YACnE,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAC1D,IAAI,IAAI;gBAAE,MAAM;YAChB,8EAA8E;YAC9E,kEAAkE;YAClE,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,QAAQ;gBAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,MAAyB,EACzB,QAAgB,EAChB,MAAoB,EACH,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAqBjG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAc,EAA6B,EAAE,CAC1E,OAAQ,KAAiC,EAAE,EAAE,KAAK,UAAU;IAC5D,OAAQ,KAAoC,EAAE,KAAK,KAAK,UAAU;IAClE,OAAQ,KAA6C,EAAE,cAAc,KAAK,UAAU,CAAC;AAEvF,MAAM,cAAc,GAAG,CAAC,MAAwB,EAAE,QAAgB,EAAuB,EAAE,CACzF,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,MAAM,GAAG,CAAC,KAA0B,EAAQ,EAAE;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,EAAE,CAAC;QACV,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE;QACnC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAsC,CAAC,CAAC;QACtE,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,KAAqC,CAAC,CAAC;QACpE,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAuC,CAAC,CAAC;IAC1E,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,GAAU,EAAQ,EAAE;QAChC,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,CAAC;QACV,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1B,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEL,MAAM,qBAAqB,GAAG,KAAK,EACjC,MAA0C,EAC1C,QAAgB,EACK,EAAE;IACvB,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5D,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,MAA6D,EAC7D,QAAgB,EAChB,UAAkC,EAAE,EACf,EAAE;IACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7E,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;QACrD,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpE,OAAO,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC,CAAC"}

package/dist/http/http.d.ts

@@ -0,0 +1,42 @@
+/** JSON `error` body / audit reason when a host port throws. */
+export declare const INTERNAL_ERROR = "internal_error";
+/** A caught value's audit-safe message — an `Error`'s own message, else its `String()` form. */
+export declare const errorReason: (caught: unknown) => string;
+/** Default cap on how long a response waits for an audit sink. */
+export declare const DEFAULT_AUDIT_TIMEOUT_MS = 1000;
+/**
+ * Run an audit sink so it can neither fail nor stall the response: errors
+ * are swallowed, and the wait is capped at `timeoutMs`. The timer is cleared
+ * as soon as the sink settles — a fast sink must not leave a pending timer
+ * holding the process (or a serverless invocation) open. Shared by the MCP
+ * `safeAudit` and OAuth `safeOAuthAudit`.
+ */
+export declare const runAuditBounded: (sink: () => void | Promise<void>, timeoutMs: number) => Promise<void>;
+export declare const corsHeaders: (extra?: Record<string, string>) => Record<string, string>;
+export type JsonResponseOptions = {
+    /** Include permissive CORS headers. Default true (MCP). OAuth token set false. */
+    cors?: boolean;
+};
+/** Single-object JSON response — keeps the call site under the ≤3-params rule. */
+export type JsonResponseInput = {
+    data: unknown;
+    status?: number;
+    headers?: Record<string, string>;
+    cors?: boolean;
+};
+export declare const jsonResponse: (input: JsonResponseInput) => Response;
+export declare const emptyResponse: (status: number) => Response;
+export declare const optionsResponse: (options?: JsonResponseOptions) => Response;
+/** Reflect a validated browser Origin on MCP CORS instead of `*`. */
+export declare const withReflectedCorsOrigin: (response: Response, origin: string) => Response;
+export declare const methodNotAllowed: (message?: string, options?: JsonResponseOptions) => Response;
+export declare const GET_ONLY: ReadonlySet<string>;
+export declare const POST_ONLY: ReadonlySet<string>;
+/** For endpoints that must not send permissive CORS headers (`/token`, `/revoke`, `/consent`). */
+export declare const NO_CORS: JsonResponseOptions;
+/**
+ * OPTIONS → 204; allowed verb → null (continue); otherwise → 405.
+ * Shared by OAuth handlers that all need the same method gate.
+ */
+export declare const requireHttpMethod: (request: Request, allowed: ReadonlySet<string>, options?: JsonResponseOptions) => Response | null;
+//# sourceMappingURL=http.d.ts.map

package/dist/http/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/http/http.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C,gGAAgG;AAChG,eAAO,MAAM,WAAW,GAAI,QAAQ,OAAO,KAAG,MACa,CAAC;AAE5D,kEAAkE;AAClE,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAC1B,MAAM,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAChC,WAAW,MAAM,KAChB,OAAO,CAAC,IAAI,CAiBd,CAAC;AAEF,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAUhF,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG;IAChC,kFAAkF;IAClF,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,YAAY,GAAI,OAAO,iBAAiB,KAAG,QAWvD,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,KAAG,QAI3C,CAAC;AAEL,eAAO,MAAM,eAAe,GAAI,UAAU,mBAAmB,KAAG,QAO5D,CAAC;AAEL,qEAAqE;AACrE,eAAO,MAAM,uBAAuB,GAAI,UAAU,QAAQ,EAAE,QAAQ,MAAM,KAAG,QAU5E,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAC3B,gBAA8B,EAC9B,UAAU,mBAAmB,KAC5B,QAKC,CAAC;AAEL,eAAO,MAAM,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAoB,CAAC;AAC9D,eAAO,MAAM,SAAS,EAAE,WAAW,CAAC,MAAM,CAAqB,CAAC;AAChE,kGAAkG;AAClG,eAAO,MAAM,OAAO,EAAE,mBAAqC,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAC5B,SAAS,OAAO,EAChB,SAAS,WAAW,CAAC,MAAM,CAAC,EAC5B,UAAU,mBAAmB,KAC5B,QAAQ,GAAG,IAIb,CAAC"}

package/dist/http/http.js

@@ -0,0 +1,100 @@
+/** JSON `error` body / audit reason when a host port throws. */
+export const INTERNAL_ERROR = "internal_error";
+/** A caught value's audit-safe message — an `Error`'s own message, else its `String()` form. */
+export const errorReason = (caught) => caught instanceof Error ? caught.message : String(caught);
+/** Default cap on how long a response waits for an audit sink. */
+export const DEFAULT_AUDIT_TIMEOUT_MS = 1000;
+/**
+ * Run an audit sink so it can neither fail nor stall the response: errors
+ * are swallowed, and the wait is capped at `timeoutMs`. The timer is cleared
+ * as soon as the sink settles — a fast sink must not leave a pending timer
+ * holding the process (or a serverless invocation) open. Shared by the MCP
+ * `safeAudit` and OAuth `safeOAuthAudit`.
+ */
+export const runAuditBounded = async (sink, timeoutMs) => {
+    const settled = (async () => {
+        try {
+            await sink();
+        }
+        catch {
+            // Intentionally ignored.
+        }
+    })();
+    let timer;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(resolve, timeoutMs);
+    });
+    try {
+        await Promise.race([settled, timeout]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+};
+export const corsHeaders = (extra) => ({
+    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, MCP-Protocol-Version",
+    // Response headers are opaque to browser JS by default unless explicitly
+    // exposed — without this, a browser-based MCP client reading a 401 can
+    // see the status but not WWW-Authenticate itself, i.e. not the
+    // resource_metadata URL RFC 9728 discovery depends on.
+    "Access-Control-Expose-Headers": "WWW-Authenticate",
+    ...extra,
+});
+export const jsonResponse = (input) => {
+    const cors = input.cors !== false;
+    return new Response(JSON.stringify(input.data), {
+        status: input.status ?? 200,
+        headers: {
+            "Content-Type": "application/json",
+            "Cache-Control": "no-store",
+            ...(cors ? corsHeaders() : {}),
+            ...input.headers,
+        },
+    });
+};
+export const emptyResponse = (status) => new Response(null, {
+    status,
+    headers: { ...corsHeaders(), "Cache-Control": "no-store" },
+});
+export const optionsResponse = (options) => new Response(null, {
+    status: 204,
+    headers: options?.cors === false
+        ? { "Cache-Control": "no-store" }
+        : { ...corsHeaders(), "Cache-Control": "no-store" },
+});
+/** Reflect a validated browser Origin on MCP CORS instead of `*`. */
+export const withReflectedCorsOrigin = (response, origin) => {
+    const headers = new Headers(response.headers);
+    if (!headers.has("Access-Control-Allow-Origin"))
+        return response;
+    headers.set("Access-Control-Allow-Origin", origin);
+    headers.set("Vary", "Origin");
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+};
+export const methodNotAllowed = (message = "Method not allowed", options) => jsonResponse({
+    data: { error: message },
+    status: 405,
+    ...(options?.cors !== undefined ? { cors: options.cors } : {}),
+});
+export const GET_ONLY = new Set(["GET"]);
+export const POST_ONLY = new Set(["POST"]);
+/** For endpoints that must not send permissive CORS headers (`/token`, `/revoke`, `/consent`). */
+export const NO_CORS = { cors: false };
+/**
+ * OPTIONS → 204; allowed verb → null (continue); otherwise → 405.
+ * Shared by OAuth handlers that all need the same method gate.
+ */
+export const requireHttpMethod = (request, allowed, options) => {
+    if (request.method === "OPTIONS")
+        return optionsResponse(options);
+    if (allowed.has(request.method))
+        return null;
+    return methodNotAllowed(undefined, options);
+};
+//# sourceMappingURL=http.js.map

package/dist/http/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/http/http.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C,gGAAgG;AAChG,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAe,EAAU,EAAE,CACrD,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAE5D,kEAAkE;AAClE,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,IAAgC,EAChC,SAAiB,EACF,EAAE;IACjB,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,KAAgD,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC5C,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACzC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAA8B,EAA0B,EAAE,CAAC,CAAC;IACtF,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAAE,mDAAmD;IACnF,yEAAyE;IACzE,uEAAuE;IACvE,+DAA+D;IAC/D,uDAAuD;IACvD,+BAA+B,EAAE,kBAAkB;IACnD,GAAG,KAAK;CACT,CAAC,CAAC;AAeH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAwB,EAAY,EAAE;IACjE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC;IAClC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;QAC9C,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG;QAC3B,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,GAAG,KAAK,CAAC,OAAO;SACjB;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAY,EAAE,CACxD,IAAI,QAAQ,CAAC,IAAI,EAAE;IACjB,MAAM;IACN,OAAO,EAAE,EAAE,GAAG,WAAW,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;CAC3D,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAA6B,EAAY,EAAE,CACzE,IAAI,QAAQ,CAAC,IAAI,EAAE;IACjB,MAAM,EAAE,GAAG;IACX,OAAO,EACL,OAAO,EAAE,IAAI,KAAK,KAAK;QACrB,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE;QACjC,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;CACxD,CAAC,CAAC;AAEL,qEAAqE;AACrE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,QAAkB,EAAE,MAAc,EAAY,EAAE;IACtF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9B,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,OAAO,GAAG,oBAAoB,EAC9B,OAA6B,EACnB,EAAE,CACZ,YAAY,CAAC;IACX,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;IACxB,MAAM,EAAE,GAAG;IACX,GAAG,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAC/D,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAChE,kGAAkG;AAClG,MAAM,CAAC,MAAM,OAAO,GAAwB,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,OAAgB,EAChB,OAA4B,EAC5B,OAA6B,EACZ,EAAE;IACnB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC,CAAC"}

package/dist/http/origins.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Origin allowlisting — Host-derived Node origins (multi-tenant) and browser
+ * `Origin` headers on MCP (DNS rebinding / CSRF). Same predicate shape as
+ * redirect allowlisting — not secret comparison.
+ */
+export type OriginAllowlistOptions = {
+    /**
+     * Exact origins (`https://acme.example.com`) and/or `*.example.com`
+     * wildcards. Wildcards match https subdomains only (not the apex, not http).
+     * `"*"` admits any origin (loud opt-out).
+     *
+     * Empty/omitted list → admit all (only safe with a fixed `asNodeHandler`
+     * `origin`). Host-derived `asNodeHandler` requires a non-empty list at
+     * construction. Resolved origin outside the list → 400; a fixed `origin`
+     * absent from a non-empty list throws at construction.
+     */
+    allowedOrigins?: string[];
+};
+/**
+ * Host-derived / allowlist Origin check (Node `asNodeHandler` multi-tenant).
+ * Empty or omitted `allowedOrigins` → admit all (callers that derive origin
+ * from Host must require a non-empty list before reaching here).
+ * `"*"` admits any origin.
+ */
+export declare const isAllowedOrigin: (origin: string, options?: OriginAllowlistOptions) => boolean;
+/**
+ * Browser `Origin` on MCP Streamable HTTP (DNS rebinding / CSRF).
+ * No header → allow (native / server-to-server). Empty or omitted allowlist →
+ * deny any present Origin (secure default — opposite of `isAllowedOrigin`).
+ * `"*"` opts out.
+ */
+export declare const isAllowedRequestOrigin: (originHeader: string | null, allowedRequestOrigins?: string[]) => boolean;
+/** 403 when a present Origin fails the allowlist. `onDenied` runs first (audit). */
+export declare const requestOriginDenied: (request: Request, allowedRequestOrigins: string[] | undefined, onDenied?: () => Promise<void>) => Promise<Response | null>;
+/** When a non-wildcard allowlist admitted this Origin, reflect it on CORS. */
+export declare const reflectCorsIfNeeded: (response: Response, request: Request, allowedRequestOrigins: string[] | undefined) => Response;
+//# sourceMappingURL=origins.d.ts.map

package/dist/http/origins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../../src/http/origins.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,MAAM,sBAAsB,GAAG;IACnC;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,CAAC;AAyCF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,EAAE,UAAS,sBAA2B,KAAG,OAMtF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GACjC,cAAc,MAAM,GAAG,IAAI,EAC3B,wBAAwB,MAAM,EAAE,KAC/B,OAIF,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,mBAAmB,GAC9B,SAAS,OAAO,EAChB,uBAAuB,MAAM,EAAE,GAAG,SAAS,EAC3C,WAAW,MAAM,OAAO,CAAC,IAAI,CAAC,KAC7B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAMzB,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,GAC9B,UAAU,QAAQ,EAClB,SAAS,OAAO,EAChB,uBAAuB,MAAM,EAAE,GAAG,SAAS,KAC1C,QAMF,CAAC"}

package/dist/http/origins.js

@@ -0,0 +1,87 @@
+/**
+ * Origin allowlisting — Host-derived Node origins (multi-tenant) and browser
+ * `Origin` headers on MCP (DNS rebinding / CSRF). Same predicate shape as
+ * redirect allowlisting — not secret comparison.
+ */
+import { jsonResponse, withReflectedCorsOrigin } from "./http.js";
+const originOf = (value) => {
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return null;
+    }
+};
+const isExactOrigin = (origin, options) => {
+    const normalized = originOf(origin);
+    if (!normalized)
+        return false;
+    return Boolean(options.allowedOrigins?.some((entry) => {
+        if (entry.startsWith("*."))
+            return false;
+        return originOf(entry) === normalized;
+    }));
+};
+/** `*.example.com` matches `https://acme.example.com`, not the apex, not http. */
+const isWildcardSubdomain = (origin, options) => {
+    const patterns = options.allowedOrigins ?? [];
+    try {
+        const { protocol, hostname } = new URL(origin);
+        if (protocol !== "https:")
+            return false;
+        return patterns.some((entry) => {
+            if (!entry.startsWith("*."))
+                return false;
+            const suffix = entry.slice(1); // ".example.com"
+            return hostname.endsWith(suffix) && hostname.length > suffix.length;
+        });
+    }
+    catch {
+        return false;
+    }
+};
+const ORIGIN_PREDICATES = [isExactOrigin, isWildcardSubdomain];
+/**
+ * Host-derived / allowlist Origin check (Node `asNodeHandler` multi-tenant).
+ * Empty or omitted `allowedOrigins` → admit all (callers that derive origin
+ * from Host must require a non-empty list before reaching here).
+ * `"*"` admits any origin.
+ */
+export const isAllowedOrigin = (origin, options = {}) => {
+    if (!options.allowedOrigins || options.allowedOrigins.length === 0) {
+        return true;
+    }
+    if (options.allowedOrigins.includes("*"))
+        return true;
+    return ORIGIN_PREDICATES.some((predicate) => predicate(origin, options));
+};
+/**
+ * Browser `Origin` on MCP Streamable HTTP (DNS rebinding / CSRF).
+ * No header → allow (native / server-to-server). Empty or omitted allowlist →
+ * deny any present Origin (secure default — opposite of `isAllowedOrigin`).
+ * `"*"` opts out.
+ */
+export const isAllowedRequestOrigin = (originHeader, allowedRequestOrigins) => {
+    if (!originHeader)
+        return true;
+    if (!allowedRequestOrigins || allowedRequestOrigins.length === 0)
+        return false;
+    return isAllowedOrigin(originHeader, { allowedOrigins: allowedRequestOrigins });
+};
+/** 403 when a present Origin fails the allowlist. `onDenied` runs first (audit). */
+export const requestOriginDenied = async (request, allowedRequestOrigins, onDenied) => {
+    if (isAllowedRequestOrigin(request.headers.get("Origin"), allowedRequestOrigins)) {
+        return null;
+    }
+    await onDenied?.();
+    return jsonResponse({ data: { error: "origin not allowed" }, status: 403, cors: false });
+};
+/** When a non-wildcard allowlist admitted this Origin, reflect it on CORS. */
+export const reflectCorsIfNeeded = (response, request, allowedRequestOrigins) => {
+    const origin = request.headers.get("Origin");
+    if (!origin || !allowedRequestOrigins?.length || allowedRequestOrigins.includes("*")) {
+        return response;
+    }
+    return withReflectedCorsOrigin(response, origin);
+};
+//# sourceMappingURL=origins.js.map

package/dist/http/origins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origins.js","sourceRoot":"","sources":["../../src/http/origins.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAkBlE,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAiB,EAAE;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,aAAa,GAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACzD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,OAAO,CACZ,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACrC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,OAAO,QAAQ,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC;IACxC,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,mBAAmB,GAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC7B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;YAChD,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAsB,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;AAElF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,UAAkC,EAAE,EAAW,EAAE;IAC/F,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3E,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,YAA2B,EAC3B,qBAAgC,EACvB,EAAE;IACX,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC,qBAAqB,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,OAAO,eAAe,CAAC,YAAY,EAAE,EAAE,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAClF,CAAC,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,OAAgB,EAChB,qBAA2C,EAC3C,QAA8B,EACJ,EAAE;IAC5B,IAAI,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,qBAAqB,CAAC,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,EAAE,EAAE,CAAC;IACnB,OAAO,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3F,CAAC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,QAAkB,EAClB,OAAgB,EAChB,qBAA2C,EACjC,EAAE;IACZ,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,qBAAqB,EAAE,MAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC,CAAC"}

package/dist/{dispatch.d.ts → mcp/dispatch.d.ts}

@@ -3,5 +3,5 @@ export type { AuditEntry, McpHandlerOptions, McpPorts, Principal, ServerInfo, }
 export type McpHandler = {
     fetch: (request: Request) => Promise<Response>;
 };
-export declare const createMcpHandler: <TCtx>(options: McpHandlerOptions<TCtx>) => McpHandler;
+export declare const createMcpHandler: <TCtx>(handlerOptions: McpHandlerOptions<TCtx>) => McpHandler;
 //# sourceMappingURL=dispatch.d.ts.map

package/dist/mcp/dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../src/mcp/dispatch.ts"],"names":[],"mappings":"AAmBA,OAAO,EAIL,KAAK,iBAAiB,EAKvB,MAAM,cAAc,CAAC;AAGtB,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,SAAS,EACT,UAAU,GACX,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAChD,CAAC;AAkFF,eAAO,MAAM,gBAAgB,GAAI,IAAI,EAAE,gBAAgB,iBAAiB,CAAC,IAAI,CAAC,KAAG,UAwChF,CAAC"}

package/dist/mcp/dispatch.js

@@ -0,0 +1,99 @@
+import { rejectQueryToken } from "../auth/bearer.js";
+import { BodyTooLargeError, DEFAULT_MCP_BODY_LIMIT, readBoundedText } from "../http/body.js";
+import { emptyResponse, errorReason, INTERNAL_ERROR, jsonResponse, methodNotAllowed, optionsResponse, } from "../http/http.js";
+import { reflectCorsIfNeeded, requestOriginDenied } from "../http/origins.js";
+import { JSONRPC_INTERNAL_ERROR, JSONRPC_PARSE_ERROR, JSONRPC_PAYLOAD_TOO_LARGE, protocolVersionHeaderError, rpcError, validateJsonRpcEnvelope, } from "./jsonrpc.js";
+import { DEFAULT_PUBLIC_METHODS, DENIAL_REASONS, isNotification, resolveWwwAuthenticate, safeAudit, unauthorized, } from "./methods.js";
+import { dispatchRpc } from "./rpc-handlers.js";
+const parseBody = async (request) => {
+    let text;
+    try {
+        text = await readBoundedText(request, DEFAULT_MCP_BODY_LIMIT);
+    }
+    catch (caught) {
+        if (caught instanceof BodyTooLargeError) {
+            return jsonResponse({
+                data: rpcError(null, JSONRPC_PAYLOAD_TOO_LARGE, "Payload too large"),
+                status: 413,
+            });
+        }
+        return jsonResponse({ data: rpcError(null, JSONRPC_PARSE_ERROR, "Parse error"), status: 400 });
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return jsonResponse({ data: rpcError(null, JSONRPC_PARSE_ERROR, "Parse error"), status: 400 });
+    }
+};
+/** Transport-level denial: no JSON-RPC method has been parsed yet. */
+const auditDenial = (options, error, startedAt) => safeAudit(options, { method: "", ok: false, error, durationMs: Date.now() - startedAt });
+const denyQueryStringToken = async (request, options, startedAt) => {
+    if (rejectQueryToken(new URL(request.url))) {
+        await auditDenial(options, DENIAL_REASONS.queryStringToken, startedAt);
+        return unauthorized(resolveWwwAuthenticate(options, request), "Token in query string is rejected. Use Authorization Bearer.");
+    }
+    return null;
+};
+const handleGet = async (request, options, startedAt) => {
+    const denied = await denyQueryStringToken(request, options, startedAt);
+    if (denied)
+        return denied;
+    if (!request.headers.get("authorization")) {
+        await auditDenial(options, DENIAL_REASONS.unauthorized, startedAt);
+        return unauthorized(resolveWwwAuthenticate(options, request));
+    }
+    return methodNotAllowed("Use POST for MCP");
+};
+const handlePost = async (request, options, startedAt) => {
+    const denied = await denyQueryStringToken(request, options, startedAt);
+    if (denied)
+        return denied;
+    const parsed = await parseBody(request);
+    if (parsed instanceof Response)
+        return parsed;
+    const envelope = validateJsonRpcEnvelope(parsed);
+    if (envelope instanceof Response)
+        return envelope;
+    const versionError = protocolVersionHeaderError(request, envelope);
+    if (versionError)
+        return versionError;
+    if (isNotification(envelope))
+        return emptyResponse(202);
+    return dispatchRpc({ req: request, body: envelope, options, startedAt });
+};
+export const createMcpHandler = (handlerOptions) => {
+    const options = {
+        ...handlerOptions,
+        publicMethods: handlerOptions.publicMethods ?? DEFAULT_PUBLIC_METHODS,
+    };
+    const HTTP_METHODS = {
+        OPTIONS: () => optionsResponse(),
+        GET: (request, startedAt) => handleGet(request, options, startedAt),
+        POST: (request, startedAt) => handlePost(request, options, startedAt),
+    };
+    return {
+        fetch: async (request) => {
+            const startedAt = Date.now();
+            try {
+                const originDenied = await requestOriginDenied(request, options.allowedRequestOrigins, () => auditDenial(options, DENIAL_REASONS.originNotAllowed, startedAt));
+                if (originDenied)
+                    return originDenied;
+                const handler = HTTP_METHODS[request.method];
+                const response = await (handler ? handler(request, startedAt) : methodNotAllowed());
+                return reflectCorsIfNeeded(response, request, options.allowedRequestOrigins);
+            }
+            catch (caught) {
+                // A host port (authenticate/context/audit) threw. `fetch` must never
+                // reject — the caller gets an honest 500, not an unhandled rejection
+                // whose shape depends on which runtime is hosting this.
+                await auditDenial(options, errorReason(caught) || INTERNAL_ERROR, startedAt);
+                return reflectCorsIfNeeded(jsonResponse({
+                    data: rpcError(null, JSONRPC_INTERNAL_ERROR, "Internal error"),
+                    status: 500,
+                }), request, options.allowedRequestOrigins);
+            }
+        },
+    };
+};
+//# sourceMappingURL=dispatch.js.map

package/dist/mcp/dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../src/mcp/dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EACL,aAAa,EACb,WAAW,EACX,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,QAAQ,EACR,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,cAAc,EAGd,sBAAsB,EACtB,SAAS,EACT,YAAY,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAchD,MAAM,SAAS,GAAG,KAAK,EAAE,OAAgB,EAA+B,EAAE;IACxE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,IAAI,MAAM,YAAY,iBAAiB,EAAE,CAAC;YACxC,OAAO,YAAY,CAAC;gBAClB,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,yBAAyB,EAAE,mBAAmB,CAAC;gBACpE,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;QACD,OAAO,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC,CAAC;AAEF,sEAAsE;AACtE,MAAM,WAAW,GAAG,CAClB,OAAgC,EAChC,KAAa,EACb,SAAiB,EACF,EAAE,CACjB,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;AAE3F,MAAM,oBAAoB,GAAG,KAAK,EAChC,OAAgB,EAChB,OAAgC,EAChC,SAAiB,EACS,EAAE;IAC5B,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QACvE,OAAO,YAAY,CACjB,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,EACxC,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,KAAK,EACrB,OAAgB,EAChB,OAAgC,EAChC,SAAiB,EACE,EAAE;IACrB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACvE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QAC1C,MAAM,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACnE,OAAO,YAAY,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;AAC9C,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,KAAK,EACtB,OAAgB,EAChB,OAAwC,EACxC,SAAiB,EACE,EAAE;IACrB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACvE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM,YAAY,QAAQ;QAAE,OAAO,MAAM,CAAC;IAE9C,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,QAAQ,YAAY,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAElD,MAAM,YAAY,GAAG,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnE,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,IAAI,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,WAAW,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;AAC3E,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAO,cAAuC,EAAc,EAAE;IAC5F,MAAM,OAAO,GAAoC;QAC/C,GAAG,cAAc;QACjB,aAAa,EAAE,cAAc,CAAC,aAAa,IAAI,sBAAsB;KACtE,CAAC;IAEF,MAAM,YAAY,GAAsC;QACtD,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE;QAChC,GAAG,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC;QACnE,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC;KACtE,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,OAAgB,EAAqB,EAAE;YACnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAC1F,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC,gBAAgB,EAAE,SAAS,CAAC,CACjE,CAAC;gBACF,IAAI,YAAY;oBAAE,OAAO,YAAY,CAAC;gBAEtC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;gBACpF,OAAO,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,qEAAqE;gBACrE,qEAAqE;gBACrE,wDAAwD;gBACxD,MAAM,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,cAAc,EAAE,SAAS,CAAC,CAAC;gBAC7E,OAAO,mBAAmB,CACxB,YAAY,CAAC;oBACX,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,EAAE,gBAAgB,CAAC;oBAC9D,MAAM,EAAE,GAAG;iBACZ,CAAC,EACF,OAAO,EACP,OAAO,CAAC,qBAAqB,CAC9B,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/{jsonrpc.d.ts → mcp/jsonrpc.d.ts}

@@ -28,6 +28,15 @@ export declare const JSONRPC_INVALID_PARAMS = -32602;
 export declare const JSONRPC_INTERNAL_ERROR = -32603;
 export declare const JSONRPC_UNAUTHORIZED = -32001;
 export declare const JSONRPC_PAYLOAD_TOO_LARGE = -32002;
+/** Authenticated but missing required scope — paired with HTTP 403. */
+export declare const JSONRPC_INSUFFICIENT_SCOPE = -32003;
 export declare const rpcResult: (id: JsonRpcId, result: unknown) => JsonRpcSuccess;
 export declare const rpcError: (id: JsonRpcId, code: number, message: string) => JsonRpcFailure;
+/** Batch / jsonrpc version / shape — returns a Response or a validated request. */
+export declare const validateJsonRpcEnvelope: (parsed: unknown) => Response | JsonRpcRequest;
+/**
+ * Spec requires `MCP-Protocol-Version` past `initialize`. Unknown → 400.
+ * Missing → assume `2025-03-26` (header BC rule; see `protocol.ts`).
+ */
+export declare const protocolVersionHeaderError: (request: Request, jsonRpcRequest: JsonRpcRequest) => Response | null;
 //# sourceMappingURL=jsonrpc.d.ts.map

package/dist/mcp/jsonrpc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonrpc.d.ts","sourceRoot":"","sources":["../../src/mcp/jsonrpc.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;AAE/C,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,cAAc,CAAC;AAE9D,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAC1C,eAAO,MAAM,uBAAuB,SAAS,CAAC;AAC9C,eAAO,MAAM,wBAAwB,SAAS,CAAC;AAC/C,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAC7C,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAC7C,eAAO,MAAM,oBAAoB,SAAS,CAAC;AAC3C,eAAO,MAAM,yBAAyB,SAAS,CAAC;AAChD,uEAAuE;AACvE,eAAO,MAAM,0BAA0B,SAAS,CAAC;AAEjD,eAAO,MAAM,SAAS,GAAI,IAAI,SAAS,EAAE,QAAQ,OAAO,KAAG,cAIzD,CAAC;AAEH,eAAO,MAAM,QAAQ,GAAI,IAAI,SAAS,EAAE,MAAM,MAAM,EAAE,SAAS,MAAM,KAAG,cAItE,CAAC;AAwCH,mFAAmF;AACnF,eAAO,MAAM,uBAAuB,GAAI,QAAQ,OAAO,KAAG,QAAQ,GAAG,cAkBpE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,0BAA0B,GACrC,SAAS,OAAO,EAChB,gBAAgB,cAAc,KAC7B,QAAQ,GAAG,IAYb,CAAC"}

package/dist/mcp/jsonrpc.js

@@ -0,0 +1,88 @@
+import { jsonResponse } from "../http/http.js";
+import { PROTOCOL_VERSIONS } from "./protocol.js";
+export const JSONRPC_PARSE_ERROR = -32700;
+export const JSONRPC_INVALID_REQUEST = -32600;
+export const JSONRPC_METHOD_NOT_FOUND = -32601;
+export const JSONRPC_INVALID_PARAMS = -32602;
+export const JSONRPC_INTERNAL_ERROR = -32603;
+export const JSONRPC_UNAUTHORIZED = -32001;
+export const JSONRPC_PAYLOAD_TOO_LARGE = -32002;
+/** Authenticated but missing required scope — paired with HTTP 403. */
+export const JSONRPC_INSUFFICIENT_SCOPE = -32003;
+export const rpcResult = (id, result) => ({
+    jsonrpc: "2.0",
+    id,
+    result,
+});
+export const rpcError = (id, code, message) => ({
+    jsonrpc: "2.0",
+    id,
+    error: { code, message },
+});
+const isJsonRpcId = (id) => id === null || typeof id === "string" || typeof id === "number";
+/**
+ * RFC-shaped JSON-RPC id for an error response — omitted → `null`; valid ids
+ * echoed; invalid shapes → `null` so we never reflect an illegal id.
+ */
+const errorId = (jsonRpcRequest) => {
+    if (jsonRpcRequest.id === undefined)
+        return null;
+    return isJsonRpcId(jsonRpcRequest.id) ? jsonRpcRequest.id : null;
+};
+/** Runtime JSON-RPC Request shape — types alone do not enforce this. */
+const jsonRpcShapeError = (jsonRpcRequest) => {
+    if (jsonRpcRequest.id !== undefined && !isJsonRpcId(jsonRpcRequest.id)) {
+        return jsonResponse({
+            data: rpcError(null, JSONRPC_INVALID_REQUEST, "id must be string, number, or null"),
+            status: 400,
+        });
+    }
+    const orphanResult = jsonRpcRequest.method === undefined &&
+        jsonRpcRequest.id === undefined &&
+        "result" in jsonRpcRequest;
+    if (orphanResult)
+        return null;
+    if (typeof jsonRpcRequest.method !== "string" || jsonRpcRequest.method.length === 0) {
+        return jsonResponse({
+            data: rpcError(errorId(jsonRpcRequest), JSONRPC_INVALID_REQUEST, "method must be a non-empty string"),
+            status: 400,
+        });
+    }
+    return null;
+};
+/** Batch / jsonrpc version / shape — returns a Response or a validated request. */
+export const validateJsonRpcEnvelope = (parsed) => {
+    if (Array.isArray(parsed)) {
+        return jsonResponse({
+            data: rpcError(null, JSONRPC_INVALID_REQUEST, "Batch requests not supported"),
+            status: 400,
+        });
+    }
+    if (!parsed || typeof parsed !== "object") {
+        return jsonResponse({ data: rpcError(null, JSONRPC_PARSE_ERROR, "Parse error"), status: 400 });
+    }
+    const jsonRpcRequest = parsed;
+    if (jsonRpcRequest.jsonrpc !== "2.0") {
+        return jsonResponse({
+            data: rpcError(errorId(jsonRpcRequest), JSONRPC_INVALID_REQUEST, 'jsonrpc must be "2.0"'),
+            status: 400,
+        });
+    }
+    return jsonRpcShapeError(jsonRpcRequest) ?? jsonRpcRequest;
+};
+/**
+ * Spec requires `MCP-Protocol-Version` past `initialize`. Unknown → 400.
+ * Missing → assume `2025-03-26` (header BC rule; see `protocol.ts`).
+ */
+export const protocolVersionHeaderError = (request, jsonRpcRequest) => {
+    if (jsonRpcRequest.method === "initialize")
+        return null;
+    const header = request.headers.get("MCP-Protocol-Version");
+    if (!header || PROTOCOL_VERSIONS.has(header))
+        return null;
+    return jsonResponse({
+        data: rpcError(errorId(jsonRpcRequest), JSONRPC_INVALID_REQUEST, `Unsupported MCP-Protocol-Version: ${header}`),
+        status: 400,
+    });
+};
+//# sourceMappingURL=jsonrpc.js.map

package/dist/mcp/jsonrpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonrpc.js","sourceRoot":"","sources":["../../src/mcp/jsonrpc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AA2BlD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAK,CAAC;AAC1C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,KAAK,CAAC;AAC9C,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,KAAK,CAAC;AAC/C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAK,CAAC;AAC7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAK,CAAC;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAK,CAAC;AAC3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAK,CAAC;AAChD,uEAAuE;AACvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,KAAK,CAAC;AAEjD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,EAAa,EAAE,MAAe,EAAkB,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,KAAK;IACd,EAAE;IACF,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,EAAa,EAAE,IAAY,EAAE,OAAe,EAAkB,EAAE,CAAC,CAAC;IACzF,OAAO,EAAE,KAAK;IACd,EAAE;IACF,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;CACzB,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,EAAW,EAAmB,EAAE,CACnD,EAAE,KAAK,IAAI,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC;AAElE;;;GAGG;AACH,MAAM,OAAO,GAAG,CAAC,cAA8B,EAAa,EAAE;IAC5D,IAAI,cAAc,CAAC,EAAE,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,iBAAiB,GAAG,CAAC,cAA8B,EAAmB,EAAE;IAC5E,IAAI,cAAc,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;QACvE,OAAO,YAAY,CAAC;YAClB,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,EAAE,oCAAoC,CAAC;YACnF,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAChB,cAAc,CAAC,MAAM,KAAK,SAAS;QACnC,cAAc,CAAC,EAAE,KAAK,SAAS;QAC/B,QAAQ,IAAI,cAAc,CAAC;IAC7B,IAAI,YAAY;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,OAAO,cAAc,CAAC,MAAM,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpF,OAAO,YAAY,CAAC;YAClB,IAAI,EAAE,QAAQ,CACZ,OAAO,CAAC,cAAc,CAAC,EACvB,uBAAuB,EACvB,mCAAmC,CACpC;YACD,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,mFAAmF;AACnF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAe,EAA6B,EAAE;IACpF,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,YAAY,CAAC;YAClB,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,EAAE,8BAA8B,CAAC;YAC7E,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,cAAc,GAAG,MAAwB,CAAC;IAChD,IAAI,cAAc,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,YAAY,CAAC;YAClB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,uBAAuB,EAAE,uBAAuB,CAAC;YACzF,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,iBAAiB,CAAC,cAAc,CAAC,IAAI,cAAc,CAAC;AAC7D,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,OAAgB,EAChB,cAA8B,EACb,EAAE;IACnB,IAAI,cAAc,CAAC,MAAM,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,YAAY,CAAC;QAClB,IAAI,EAAE,QAAQ,CACZ,OAAO,CAAC,cAAc,CAAC,EACvB,uBAAuB,EACvB,qCAAqC,MAAM,EAAE,CAC9C;QACD,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC,CAAC"}