stitchkit 0.93.0 → 0.94.1

package/dist/tools/mcp-stdio-signals.d.ts

@@ -1,33 +0,0 @@
-import type { ProcessSignalName, SignalSource } from '../server/process-signals.js';
-import type { McpStdioHandle } from './mcp-stdio.js';
-export type StdioProcessSignalsErrorPhase = 'prepare' | 'close' | 'complete';
-export interface StdioProcessSignalsOptions {
-    /** Defaults to `['SIGINT', 'SIGTERM']`; duplicates are ignored. */
-    signals?: readonly ProcessSignalName[];
-    signalSource?: SignalSource;
-    /** Runs before the transport closes. Failure is reported and close still runs. */
-    onClose?: (signal: ProcessSignalName) => void | Promise<void>;
-    /** Runs after the official stdio handle has closed. */
-    onComplete?: () => void | Promise<void>;
-    onError?: (phase: StdioProcessSignalsErrorPhase, error: unknown) => void;
-    /** A later signal cannot force stdio close, so it always means escalation. */
-    onRepeatedSignal?: (signal: ProcessSignalName) => void;
-    /** Called when another listener prevents restoration of the default disposition. */
-    onEscalationBlocked?: (signal: ProcessSignalName) => void;
-}
-export interface StdioProcessSignalsBinding {
-    /** Resolves after close, or `undefined` when an idle binding is removed. */
-    readonly promise: Promise<void>;
-    /** Remove listeners. Idempotent; does not cancel an already-running close. */
-    close(): void;
-}
-export type StdioCloseTarget = Pick<McpStdioHandle, 'close'>;
-/**
- * Bind process signals to one close-only stdio MCP handle.
- *
- * Unlike managed HTTP shutdown, stdio exposes no deadline or force method. A
- * later signal therefore removes this binding and restores the signal's default
- * disposition instead of pretending an AbortSignal can affect `close()`.
- */
-export declare function bindStdioProcessSignals(handle: StdioCloseTarget, options?: StdioProcessSignalsOptions): StdioProcessSignalsBinding;
-//# sourceMappingURL=mcp-stdio-signals.d.ts.map

package/dist/tools/mcp-stdio-signals.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-stdio-signals.d.ts","sourceRoot":"","sources":["../../src/tools/mcp-stdio-signals.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACjF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,MAAM,6BAA6B,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;AAE7E,MAAM,WAAW,0BAA0B;IACzC,mEAAmE;IACnE,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,kFAAkF;IAClF,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,6BAA6B,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACzE,8EAA8E;IAC9E,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACvD,oFAAoF;IACpF,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,CAAC;CAC3D;AAED,MAAM,WAAW,0BAA0B;IACzC,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,8EAA8E;IAC9E,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAI7D;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,gBAAgB,EACxB,OAAO,GAAE,0BAA+B,GACvC,0BAA0B,CAkG5B"}

package/dist/tools/mcp-stdio.d.ts

@@ -1,20 +0,0 @@
-import { type McpServerBuildConfig } from './mcp.js';
-import type { McpLegacyPolicy } from './mcp-handler.js';
-import type { McpSurfaceRegistry } from './mcp-prepare.js';
-export interface StdioAuthConfig<TAuth> {
-    /** Identity for the single stdio connection. */
-    auth: TAuth | Promise<TAuth>;
-    /** Serve a legacy opening handshake or require the modern protocol. Default: `serve`. */
-    legacy?: McpLegacyPolicy;
-}
-export type StdioMcpServerConfig<TAuth, TSurfaces extends McpSurfaceRegistry = McpSurfaceRegistry> = McpServerBuildConfig<TAuth, TSurfaces> & StdioAuthConfig<TAuth>;
-/** Framework-owned lifecycle handle for one stdio MCP connection. */
-export interface McpStdioHandle {
-    close(): Promise<void>;
-}
-/**
- * Serve one dual-era MCP connection over process stdio. The official SDK owns
- * opening-era negotiation and transport shutdown; Stitchkit owns the surface.
- */
-export declare function createStdioMcpServer<TAuth>(config: StdioMcpServerConfig<TAuth>): Promise<McpStdioHandle>;
-//# sourceMappingURL=mcp-stdio.d.ts.map

package/dist/tools/mcp-stdio.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-stdio.d.ts","sourceRoot":"","sources":["../../src/tools/mcp-stdio.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,KAAK,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAClE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,MAAM,WAAW,eAAe,CAAC,KAAK;IACpC,gDAAgD;IAChD,IAAI,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,yFAAyF;IACzF,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED,MAAM,MAAM,oBAAoB,CAC9B,KAAK,EACL,SAAS,SAAS,kBAAkB,GAAG,kBAAkB,IACvD,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;AAEpE,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC7B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAC9C,MAAM,EAAE,oBAAoB,CAAC,KAAK,CAAC,GAClC,OAAO,CAAC,cAAc,CAAC,CAMzB"}

package/dist/tools/mcp-trace.d.ts

@@ -1,12 +0,0 @@
-import { type ServerContext } from '@modelcontextprotocol/server';
-/**
- * Run one SDK-dispatched MCP request inside an isolated propagation context.
- *
- * `method: 'MCP'` and `path: '/mcp/<tool>'` are written here deliberately, and
- * they are NOT the fabricated transport fields that `kind: 'job'` exists to
- * replace. An MCP tool call arrives as a request, over a transport, naming an
- * operation — it has a verb-shaped thing to say and a path-shaped thing to say.
- * Background work has neither, which is why it now records their absence.
- */
-export declare function runInMcpRequestContext<T>(context: ServerContext, toolName: string, body: () => Promise<T>): Promise<T>;
-//# sourceMappingURL=mcp-trace.d.ts.map

package/dist/tools/mcp-trace.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-trace.d.ts","sourceRoot":"","sources":["../../src/tools/mcp-trace.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,aAAa,EAGnB,MAAM,8BAA8B,CAAC;AAQtC;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EACtC,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACrB,OAAO,CAAC,CAAC,CAAC,CA0BZ"}

package/dist/tools/mcp.d.ts

@@ -1,152 +0,0 @@
-import { McpServer, type ServerOptions } from '@modelcontextprotocol/server';
-import type { ServiceDef, StitchLogger } from '../server/types.js';
-import { type ErrorHintFn, type ToolCallHooks, type ToolLifecycle } from './execute.js';
-import { type McpResourceDef } from './mcp-app.js';
-import { type McpCatalogStamp } from './mcp-catalog.js';
-import { type McpSchemaValidationConfig, type McpSurfaceRegistry, type PreparedMcpServerSurface, type PreparedMcpSurface, type ValidateMcpSchemasConfig } from './mcp-prepare.js';
-import { type McpRoundRuntime } from './mcp-round.js';
-import { type ToolExtend } from './mount.js';
-import type { RuntimeToolDefinition } from './runtime-tool.js';
-export interface McpMountConfig {
-    context?: Record<string, unknown>;
-    /** Tool-call observability hooks. */
-    hooks?: ToolCallHooks;
-    /**
-     * Auth / scope gate and result transform for every tool call — the tool-side
-     * twin of `createServer`'s `beforeHandle` / `afterHandle`. Pass the same
-     * `createAuthHook` result here as on the HTTP server to guard tools too;
-     * without it a tool call bypasses the HTTP `beforeHandle` auth gate.
-     */
-    lifecycle?: ToolLifecycle;
-    extend?: ToolExtend;
-    /** Validation policy applied to the exact advertised MCP schemas. */
-    schemaValidation?: McpSchemaValidationConfig;
-    /** Logger for the `'warn'` policy — defaults to `console`. */
-    logger?: StitchLogger;
-    /** Coerce JSON-stringified arrays/objects in tool arguments. Default: true. */
-    coerceJsonArgs?: boolean;
-    /** Flatten discriminated union inputs into a single object. Default: false. */
-    flattenUnionInput?: boolean;
-    /** Global error hint injected into every failed tool result. */
-    errorHint?: ErrorHintFn;
-    /** Report output keys the contract schema removed — → ADR 0037. */
-    onOutputStrip?: (toolName: string, paths: string[]) => void;
-}
-interface PreparedMcpMountConfig extends McpMountConfig {
-    multiRoundRuntime?: McpRoundRuntime;
-    /** The catalog this surface advertises, stamped onto listings and results. */
-    catalog?: McpCatalogStamp;
-}
-/**
- * Validate that every contract tool in `services` can be advertised on the MCP
- * surface — object-shaped, JSON Schema-compatible input / output, no tool-name
- * collision across services. The build-time check behind `mountMcp` — also
- * callable on its own (a startup assertion, a test) to fail a deploy before
- * the first request.
- */
-export declare function validateMcpSchemas(config: ValidateMcpSchemasConfig): void;
-export declare function mountMcp(mcpServer: McpServer, services: ServiceDef | ServiceDef[], config?: McpMountConfig): void;
-/** Register a prepared immutable surface onto one fresh server/runtime. */
-export declare function mountPreparedMcp(mcpServer: McpServer, prepared: PreparedMcpSurface, config?: PreparedMcpMountConfig): void;
-/**
- * Transport-neutral build config for an MCP server — everything needed to turn
- * contract services into a live `McpServer`, minus how the identity is
- * resolved. `createMcpHandler` (HTTP) and `createStdioMcpServer` (stdio) each
- * add their own `auth` on top.
- */
-export interface McpServerSharedConfig<TAuth> {
-    /** MCP server identity (name + version). */
-    serverInfo: {
-        name: string;
-        version: string;
-    };
-    /** Context merged into every contract handler (`mountMcp` context). */
-    context?: (auth: TAuth) => Record<string, unknown>;
-    /** Tool-call observability hooks — `afterToolCall` fires for every result
-     *  (success and error), so the consuming app can log MCP tool outcomes;
-     *  `onToolError` adds the raw thrown value behind a failed one. */
-    hooks?: ToolCallHooks;
-    /** Auth / scope gate and result transform for every tool call — pass the
-     *  same `createAuthHook` result used for the HTTP `beforeHandle` to guard
-     *  tools with the identical rules. */
-    lifecycle?: ToolLifecycle;
-    /** Add extra tool arguments resolved into handler context (e.g. a `tenantId`
-     *  for one API key serving many tenants). Same `ToolExtend` accepted by
-     *  `mountMcp` — without this, the batteries-path (`createMcpHandler`) could not
-     *  reach it and a consumer had to hand-wrap every service. */
-    extend?: ToolExtend;
-    /** Validation policy applied to the exact advertised MCP schemas. */
-    schemaValidation?: McpSchemaValidationConfig;
-    /** Logger for schema-incompatibility warnings — defaults to `console`. */
-    logger?: StitchLogger;
-    /** Explicit unprotected SDK escape hatch. Prefer `runtimeTools`; registrations
-     *  here do not receive stitchkit validation, lifecycle, context or hooks. */
-    rawTools?: (server: McpServer, auth: TAuth) => void;
-    /** MCP Apps UI resources (`ui://…`) served for tools that declare `ui`. */
-    resources?: McpResourceDef[];
-    /** Server instructions — a short (≤2KB) hint to the host on when and how to
-     *  use these tools. Surfaced to MCP tool-search. */
-    instructions?: string;
-    /** Explicit modern MCP cache policy. Omitted operations stay zero/private. */
-    cache?: {
-        operations?: NonNullable<ServerOptions['cacheHints']>;
-    };
-    /** Signed multi-round continuation policy for tools declaring `mcp.inputRequired`. */
-    multiRound?: {
-        state: {
-            /** Shared HMAC key, at least 32 bytes. */
-            key: Uint8Array | string;
-            /** Continuation lifetime. Default 10 minutes. */
-            ttlSeconds?: number;
-            /** Stable authenticated principal bound into every continuation. */
-            principal: (auth: TAuth) => string;
-        };
-        /** Legacy stdio shim and round limits owned by the official SDK. */
-        serving?: NonNullable<ServerOptions['inputRequired']>;
-    };
-    /** Coerce JSON-stringified arrays/objects in tool arguments. Default: true. */
-    coerceJsonArgs?: boolean;
-    /** Flatten discriminated union inputs into a single object. Default: false. */
-    flattenUnionInput?: boolean;
-    /** Global error hint injected into every failed tool result. */
-    errorHint?: ErrorHintFn;
-    /** Report output keys the contract schema removed — → ADR 0037. */
-    onOutputStrip?: (toolName: string, paths: string[]) => void;
-}
-export interface DirectMcpSurfaceConfig<TAuth> {
-    /** Contract services exposed as MCP tools — may depend on the identity. */
-    services: ServiceDef[] | ((auth: TAuth) => ServiceDef[]);
-    /** Framework-managed runtime tools — may depend on the identity. */
-    runtimeTools?: readonly RuntimeToolDefinition[] | ((auth: TAuth) => readonly RuntimeToolDefinition[]);
-    surfaces?: never;
-    selectSurface?: never;
-}
-export interface FiniteMcpSurfaceConfig<TAuth, TSurfaces extends McpSurfaceRegistry> {
-    /** Finite immutable surfaces, all prepared eagerly exactly once. */
-    surfaces: TSurfaces;
-    /** Select one declared surface for the resolved identity. */
-    selectSurface: (auth: TAuth) => Extract<keyof TSurfaces, string>;
-    services?: never;
-    runtimeTools?: never;
-}
-/**
- * Transport-neutral MCP build config. Use direct services for a static or truly
- * identity-dynamic surface; use `surfaces` for a bounded role/plan registry.
- */
-export type McpServerBuildConfig<TAuth, TSurfaces extends McpSurfaceRegistry = McpSurfaceRegistry> = McpServerSharedConfig<TAuth> & (DirectMcpSurfaceConfig<TAuth> | FiniteMcpSurfaceConfig<TAuth, TSurfaces>);
-/**
- * Build an `McpServer` from contract services for a resolved identity.
- * Transport-agnostic — the shared core behind every MCP transport.
- */
-export declare function buildMcpServer(config: McpServerBuildConfig<undefined>): McpServer;
-export declare function buildMcpServer<TAuth>(config: McpServerBuildConfig<TAuth>, auth: TAuth): McpServer;
-/** Build one fresh server from a deterministic surface prepared by its owner. */
-export declare function buildMcpServerFromPrepared<TAuth>(config: McpServerBuildConfig<TAuth>, auth: TAuth, prepared: PreparedMcpServerSurface): McpServer;
-/**
- * Register one MCP Apps UI resource on an `McpServer`. The `read` callback's
- * HTML is served under the resource `uri` with the apps MIME type; any `ui`
- * metadata (CSP, border, domain) is attached to the content's `_meta.ui`.
- */
-export declare function mountMcpResource(server: McpServer, resource: McpResourceDef): void;
-export {};
-//# sourceMappingURL=mcp.d.ts.map

package/dist/tools/mcp.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/tools/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,SAAS,EAET,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AAItC,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,aAAa,EAEnB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,WAAW,CAAC;AACpE,OAAO,EACL,KAAK,eAAe,EAIrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,yBAAyB,EAE9B,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EAGvB,KAAK,wBAAwB,EAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,eAAe,EAAuC,MAAM,aAAa,CAAC;AAExF,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAG5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAE5D,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,qCAAqC;IACrC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;IAC7C,8DAA8D;IAC9D,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,gEAAgE;IAChE,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;CAC7D;AAED,UAAU,sBAAuB,SAAQ,cAAc;IACrD,iBAAiB,CAAC,EAAE,eAAe,CAAC;IACpC,8EAA8E;IAC9E,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAOzE;AAED,wBAAgB,QAAQ,CACtB,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,UAAU,GAAG,UAAU,EAAE,EACnC,MAAM,GAAE,cAAmB,GAC1B,IAAI,CAWN;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,kBAAkB,EAC5B,MAAM,GAAE,sBAA2B,GAClC,IAAI,CAiFN;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB,CAAC,KAAK;IAC1C,4CAA4C;IAC5C,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,uEAAuE;IACvE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD;;uEAEmE;IACnE,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;0CAEsC;IACtC,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;kEAG8D;IAC9D,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;IAC7C,0EAA0E;IAC1E,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;iFAC6E;IAC7E,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC;IACpD,2EAA2E;IAC3E,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;IAC7B;wDACoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,KAAK,CAAC,EAAE;QACN,UAAU,CAAC,EAAE,WAAW,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC;KACvD,CAAC;IACF,sFAAsF;IACtF,UAAU,CAAC,EAAE;QACX,KAAK,EAAE;YACL,0CAA0C;YAC1C,GAAG,EAAE,UAAU,GAAG,MAAM,CAAC;YACzB,iDAAiD;YACjD,UAAU,CAAC,EAAE,MAAM,CAAC;YACpB,oEAAoE;YACpE,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,MAAM,CAAC;SACpC,CAAC;QACF,oEAAoE;QACpE,OAAO,CAAC,EAAE,WAAW,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;KACvD,CAAC;IACF,+EAA+E;IAC/E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,gEAAgE;IAChE,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;CAC7D;AAED,MAAM,WAAW,sBAAsB,CAAC,KAAK;IAC3C,2EAA2E;IAC3E,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,UAAU,EAAE,CAAC,CAAC;IACzD,oEAAoE;IACpE,YAAY,CAAC,EACT,SAAS,qBAAqB,EAAE,GAChC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,SAAS,qBAAqB,EAAE,CAAC,CAAC;IACxD,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,aAAa,CAAC,EAAE,KAAK,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB,CAAC,KAAK,EAAE,SAAS,SAAS,kBAAkB;IACjF,oEAAoE;IACpE,QAAQ,EAAE,SAAS,CAAC;IACpB,6DAA6D;IAC7D,aAAa,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,MAAM,SAAS,EAAE,MAAM,CAAC,CAAC;IACjE,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,CAC9B,KAAK,EACL,SAAS,SAAS,kBAAkB,GAAG,kBAAkB,IACvD,qBAAqB,CAAC,KAAK,CAAC,GAC9B,CAAC,sBAAsB,CAAC,KAAK,CAAC,GAAG,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAE7E;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,oBAAoB,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;AACnF,wBAAgB,cAAc,CAAC,KAAK,EAClC,MAAM,EAAE,oBAAoB,CAAC,KAAK,CAAC,EACnC,IAAI,EAAE,KAAK,GACV,SAAS,CAAC;AAwCb,iFAAiF;AACjF,wBAAgB,0BAA0B,CAAC,KAAK,EAC9C,MAAM,EAAE,oBAAoB,CAAC,KAAK,CAAC,EACnC,IAAI,EAAE,KAAK,EACX,QAAQ,EAAE,wBAAwB,GACjC,SAAS,CAqEX;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAmBlF"}

package/dist/tools/mount-download.d.ts

@@ -1,41 +0,0 @@
-/**
- * `mountDownload` — a generic native MCP tool that saves a result URL to the
- * local filesystem. The app injects how to resolve the URL from the call's
- * args; the fetch / extension / write mechanics live here. → ADR 0019.
- */
-import type { McpServer } from '@modelcontextprotocol/server';
-import { z } from 'zod';
-import type { ManagedFileBoundary } from '../files/boundary.js';
-export interface DownloadToolConfig {
-    /** Tool name. Default `'download'`. */
-    name?: string;
-    description: string;
-    /** Tool input shape (e.g. `{ url: z.string().optional(), id: z.string().optional() }`). */
-    inputSchema: z.ZodRawShape;
-    /** Resolve the args to a media URL — `null` when there is nothing to download. */
-    resolveUrl: (args: Record<string, unknown>) => Promise<string | null> | string | null;
-    /** Managed boundary that owns every persisted download. */
-    files: ManagedFileBoundary;
-    /** Optional canonical relative destination path. */
-    pathFromArgs?: (args: Record<string, unknown>) => string | undefined;
-    /**
-     * Allow downloading from private / internal / loopback hosts. Default `false`
-     * — the SSRF guard, since the URL comes from model-controlled args. Enable
-     * only in a trusted network.
-     */
-    allowPrivateHosts?: boolean;
-    /** Max bytes to read before aborting (memory cap). Default 100 MB. */
-    maxBytes?: number;
-    /**
-     * Deadline for producing response headers (DNS, connects and redirects share
-     * it). Default 15 seconds.
-     */
-    timeoutMs?: number;
-}
-/**
- * Register a native "download" tool — resolves a URL from the args, fetches it
- * and writes it to disk with a content-type / URL-derived extension. Returns
- * the saved path / size / mime.
- */
-export declare function mountDownload(server: McpServer, config: DownloadToolConfig): void;
-//# sourceMappingURL=mount-download.d.ts.map

package/dist/tools/mount-download.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mount-download.d.ts","sourceRoot":"","sources":["../../src/tools/mount-download.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAO7D,MAAM,WAAW,kBAAkB;IACjC,uCAAuC;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,2FAA2F;IAC3F,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC;IAC3B,kFAAkF;IAClF,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;IACtF,2DAA2D;IAC3D,KAAK,EAAE,mBAAmB,CAAC;IAC3B,oDAAoD;IACpD,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,GAAG,SAAS,CAAC;IACrE;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAmCjF"}

package/dist/tools/mount-upload.d.ts

@@ -1,21 +0,0 @@
-/**
- * `mountUpload` — a generic native MCP tool that uploads a local file. The app
- * injects how to read + send the file (`upload`); the tool wiring lives here.
- * → ADR 0019.
- */
-import type { McpServer } from '@modelcontextprotocol/server';
-import type { ManagedFileBoundary, ManagedFileSource } from '../files/boundary.js';
-export interface UploadToolConfig {
-    /** Tool name. Default `'upload'`. */
-    name?: string;
-    description: string;
-    files: ManagedFileBoundary;
-    /** Upload one bounded source, returning whatever the transport yields. */
-    upload: (source: ManagedFileSource) => Promise<unknown>;
-}
-/**
- * Register a native "upload" tool — takes a local `path`, hands it to
- * `config.upload` (which reads + sends it) and returns the result.
- */
-export declare function mountUpload(server: McpServer, config: UploadToolConfig): void;
-//# sourceMappingURL=mount-upload.d.ts.map

package/dist/tools/mount-upload.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mount-upload.d.ts","sourceRoot":"","sources":["../../src/tools/mount-upload.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAOhF,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,0EAA0E;IAC1E,MAAM,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,GAAG,IAAI,CA6B7E"}

package/dist/tools/mount-wait.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mount-wait.d.ts","sourceRoot":"","sources":["../../src/tools/mount-wait.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC;IAC3B,mEAAmE;IACnE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,yCAAyC;IACzC,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAClC,uDAAuD;IACvD,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,GAAG,SAAS,CAAC;IACxE,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACpF;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI,CA8DzE"}

package/dist/tools/native-mcp.d.ts

@@ -1,20 +0,0 @@
-import { type CallToolResult, type McpServer } from '@modelcontextprotocol/server';
-import { executeToolMethod, type ToolCallHooks, type ToolLifecycle } from './execute.js';
-import { type McpCatalogStamp } from './mcp-catalog.js';
-import type { PreparedRuntimeMcpTool } from './mcp-prepare.js';
-import type { McpRoundRuntime } from './mcp-round.js';
-interface NativeMcpRuntimeConfig {
-    context?: Record<string, unknown>;
-    hooks?: ToolCallHooks;
-    lifecycle?: ToolLifecycle;
-    coerceJsonArgs?: boolean;
-    onOutputStrip?: (toolName: string, paths: string[]) => void;
-    multiRoundRuntime?: McpRoundRuntime;
-    /** The catalog this surface advertises, stamped onto listings and results. */
-    catalog?: McpCatalogStamp;
-    formatResult: (result: Awaited<ReturnType<typeof executeToolMethod>>, mode: PreparedRuntimeMcpTool['descriptor']['outputMode'], toolName: string) => CallToolResult;
-}
-/** Mount immutable runtime-tool descriptors onto one fresh MCP server/runtime. */
-export declare function mountPreparedRuntimeMcp(server: McpServer, tools: readonly PreparedRuntimeMcpTool[], config: NativeMcpRuntimeConfig): void;
-export {};
-//# sourceMappingURL=native-mcp.d.ts.map

package/dist/tools/native-mcp.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"native-mcp.d.ts","sourceRoot":"","sources":["../../src/tools/native-mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EAEnB,KAAK,SAAS,EACf,MAAM,8BAA8B,CAAC;AAItC,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AACtF,OAAO,EAAE,KAAK,eAAe,EAA0C,MAAM,eAAe,CAAC;AAC7F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAKnD,UAAU,sBAAsB;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;IAC5D,iBAAiB,CAAC,EAAE,eAAe,CAAC;IACpC,8EAA8E;IAC9E,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,YAAY,EAAE,CACZ,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,EACrD,IAAI,EAAE,sBAAsB,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,EACxD,QAAQ,EAAE,MAAM,KACb,cAAc,CAAC;CACrB;AAED,kFAAkF;AAClF,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,SAAS,sBAAsB,EAAE,EACxC,MAAM,EAAE,sBAAsB,GAC7B,IAAI,CAwHN"}

package/dist/tools/native-result.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"native-result.d.ts","sourceRoot":"","sources":["../../src/tools/native-result.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2FAA2F;IAC3F,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,UAAQ,GAAG,gBAAgB,CAG1E"}

package/dist/tools/oauth-metadata.d.ts

@@ -1,28 +0,0 @@
-import type { RawRoute } from '../server/types.js';
-/**
- * OAuth 2.0 Protected Resource Metadata (RFC 9728). An MCP server acting as a
- * resource server publishes this so a client, after a `401`, can discover which
- * authorization server(s) issue tokens for it.
- */
-export interface ProtectedResourceConfig {
-    /** Canonical resource identifier — the MCP server URL (RFC 8707 audience). */
-    resource: string;
-    /** Issuer URL(s) of the authorization server(s) that mint tokens for it. */
-    authorizationServers: string[];
-    /** Scopes the resource understands — advertised, not enforced here. */
-    scopesSupported?: string[];
-}
-/** Well-known prefix for the protected-resource metadata document (RFC 9728). */
-export declare const PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource";
-/** Absolute URL of the protected-resource metadata for a given resource. */
-export declare function protectedResourceMetadataUrl(resource: string): string;
-/** The `WWW-Authenticate` header value a protected `401` must carry (RFC 9728 §5.1). */
-export declare function wwwAuthenticateHeader(resource: string): string;
-/**
- * A `RawRoute` serving the RFC 9728 protected-resource metadata at the path
- * advertised by `protectedResourceMetadataUrl(config.resource)`. Mount it
- * alongside the MCP handler; set the matching `protectedResource` on
- * `createMcpHandler` so the `401` points here.
- */
-export declare function oauthProtectedResourceRoute(config: ProtectedResourceConfig): RawRoute;
-//# sourceMappingURL=oauth-metadata.d.ts.map

package/dist/tools/oauth-metadata.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-metadata.d.ts","sourceRoot":"","sources":["../../src/tools/oauth-metadata.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,0CAA0C,CAAC;AAa/E,4EAA4E;AAC5E,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9D;AASD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,uBAAuB,GAAG,QAAQ,CAqBrF"}

package/dist/tools/oauth-provider.d.ts

@@ -1,184 +0,0 @@
-import { z } from 'zod';
-import type { RawRoute } from '../server/types.js';
-/**
- * OpenID Connect DCR `application_type` (SEP-837). A `native` client (desktop /
- * CLI) may register an `http` loopback redirect; a `web` client may not — the
- * mismatch is the usual cause of a `redirect_uri` rejection for CLI clients.
- */
-export type ApplicationType = 'native' | 'web';
-/** A client as registered via DCR. Public clients (PKCE) carry no secret. */
-export interface RegisteredClient {
-    clientId: string;
-    redirectUris: string[];
-    clientName?: string;
-    /** The `application_type` the client declared, when it declared one. */
-    applicationType?: ApplicationType;
-}
-/** Metadata posted to `/register` (RFC 7591) before a client id is assigned. */
-export interface ClientMetadata {
-    redirectUris: string[];
-    clientName?: string;
-    tokenEndpointAuthMethod?: string;
-    /** `native` (desktop / CLI, loopback allowed) or `web` (https only). */
-    applicationType?: ApplicationType;
-}
-declare const CimdClientMetadataSchema: z.ZodObject<{
-    client_id: z.ZodURL;
-    redirect_uris: z.ZodArray<z.ZodURL>;
-    client_name: z.ZodString;
-    token_endpoint_auth_method: z.ZodLiteral<"none">;
-    application_type: z.ZodOptional<z.ZodEnum<{
-        native: "native";
-        web: "web";
-    }>>;
-}, z.core.$strip>;
-/** Validated Client ID Metadata Document (CIMD) wire shape. */
-export type CimdClientMetadata = z.infer<typeof CimdClientMetadataSchema>;
-export interface CimdFetchPolicy {
-    /** Maximum metadata document size. Default 64 KiB. */
-    maxBytes?: number;
-    /** DNS, connection and response timeout. Default 5 seconds. */
-    timeoutMs?: number;
-    /** Redirect hops, each re-resolved and re-validated. Default 3. */
-    maxRedirects?: number;
-}
-export interface CimdCachePolicy {
-    /**
-     * Maximum cache entries — positive and negative entries each get their OWN
-     * pool of this size, so a flood of failing lookups cannot evict warmed
-     * clients and warmed clients cannot reset a failing client's backoff.
-     * Default 256.
-     */
-    maxEntries?: number;
-    /** Freshness when the response carries no cache directives. Default 5 minutes. */
-    defaultTtlMs?: number;
-    /** Upper bound for origin-provided freshness. Default 1 hour. */
-    maxTtlMs?: number;
-    /** Short fail-closed cache for invalid/unavailable documents. Default 10 seconds. */
-    negativeTtlMs?: number;
-    /** Maximum uncached metadata resolutions per window, server-wide. Default 120. */
-    maxResolutions?: number;
-    /**
-     * Maximum uncached resolutions per window for ONE `client_id` — a single
-     * client whose document disables caching burns its own budget, not the
-     * server's. Default 10.
-     */
-    maxResolutionsPerClient?: number;
-    /** Resolution-rate window in milliseconds. Default 60 seconds. */
-    resolutionWindowMs?: number;
-}
-/** Injectable CIMD network boundary. Production uses the pinned-IP implementation. */
-export interface CimdFetchResponse {
-    status: number;
-    headers: Headers;
-    body: Uint8Array;
-    url: URL;
-}
-export interface CimdClientMetadataFetcher {
-    fetch(url: URL, headers: Record<string, string>): Promise<CimdFetchResponse>;
-}
-export interface CimdCacheEvent {
-    clientId: string;
-    status: 'hit' | 'miss' | 'revalidated' | 'negative';
-    freshnessMs?: number;
-}
-/** Build the production SSRF-safe, IP-pinned CIMD fetcher. */
-export declare function createSecureClientMetadataFetcher(policy?: CimdFetchPolicy): CimdClientMetadataFetcher;
-export interface OAuthClientRegistrationConfig {
-    /** Exact application-owned clients take precedence over network discovery. */
-    preRegistered?: {
-        get(clientId: string): Promise<RegisteredClient | null>;
-    };
-    /** URL-based metadata. Enabled with secure defaults when omitted. */
-    cimd?: false | {
-        cache?: CimdCachePolicy;
-        fetcher?: CimdClientMetadataFetcher;
-        /** Cache/revalidation telemetry; metadata contents are never emitted. */
-        onCacheEvent?: (event: CimdCacheEvent) => void;
-    };
-    /** Dynamic registration. Disabled when omitted or `false`. */
-    dcr?: false | {
-        register(metadata: ClientMetadata): Promise<RegisteredClient>;
-        get(clientId: string): Promise<RegisteredClient | null>;
-    };
-}
-/** State persisted between `/authorize` and `/token`, keyed by the auth code. */
-export interface AuthCodeData {
-    clientId: string;
-    redirectUri: string;
-    codeChallenge: string;
-    /** Always `S256` — `/authorize` rejects any other method (OAuth 2.1, public client). */
-    codeChallengeMethod: 'S256';
-    resource: string;
-    scope?: string;
-    userId: string;
-    expiresAt: number;
-}
-/** State persisted for a refresh token. */
-export interface RefreshData {
-    clientId: string;
-    resource: string;
-    scope?: string;
-    userId: string;
-}
-/** The parsed `/authorize` request handed to the domain login/consent step. */
-export interface AuthRequest {
-    clientId: string;
-    redirectUri: string;
-    scope?: string;
-    resource: string;
-    state?: string;
-    clientName?: string;
-    clientOrigin?: string;
-    applicationType?: ApplicationType;
-    /** True only for an HTTP loopback redirect used by a native client. */
-    isLoopbackRedirect: boolean;
-}
-export interface OAuthProviderConfig {
-    /** Authorization-server issuer — its own origin, e.g. `https://api.example.com`. */
-    issuer: string;
-    /** HMAC secret used to sign access-token JWTs. */
-    signingSecret: string;
-    /** Canonical resource id (MCP URL) — the access-token `aud`. */
-    resource: string;
-    /** Access-token lifetime in seconds. Default `3600`. */
-    accessTokenTtlSec?: number;
-    /** Scopes advertised in server metadata. */
-    scopesSupported?: string[];
-    /** Path prefix for the OAuth endpoints. Default `/oauth`. */
-    basePath?: string;
-    /** Client discovery policy. Default: CIMD enabled, DCR disabled. */
-    clientRegistration?: OAuthClientRegistrationConfig;
-    /** Single-use authorization-code store. `take` must atomically read+delete. */
-    codes: {
-        save(code: string, data: AuthCodeData): Promise<void>;
-        take(code: string): Promise<AuthCodeData | null>;
-    };
-    /** Optional refresh-token store. Omit to disable the refresh grant. */
-    refreshTokens?: {
-        save(token: string, data: RefreshData): Promise<void>;
-        take(token: string): Promise<RefreshData | null>;
-    };
-    /**
-     * Authenticate the user and capture consent for an `/authorize` request.
-     * Return the authenticated user and exact approved scope subset, or a
-     * `Response` to drive the browser through the domain's own login first.
-     */
-    authorizeUser(req: Request, authRequest: AuthRequest): Promise<{
-        userId: string;
-        approvedScopes: readonly string[];
-    } | Response>;
-}
-export declare function responseFreshness(headers: Headers, policy: CimdCachePolicy, now: number): {
-    freshnessMs: number;
-    store: boolean;
-};
-/**
- * Build the OAuth 2.1 authorization-server routes for an MCP resource. Mount the
- * returned routes in the server's `rawRoutes`, alongside
- * `oauthProtectedResourceRoute` and an MCP handler whose `protectedResource`
- * names this issuer.
- */
-export declare function mountOAuthProvider(config: OAuthProviderConfig): RawRoute[];
-export {};
-//# sourceMappingURL=oauth-provider.d.ts.map

package/dist/tools/oauth-provider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../../src/tools/oauth-provider.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAIhD;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAaD,QAAA,MAAM,wBAAwB;;;;;;;;;iBAa5B,CAAC;AAEH,+DAA+D;AAC/D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,kEAAkE;IAClE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;CACV;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC9E;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,CAAC;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,8DAA8D;AAC9D,wBAAgB,iCAAiC,CAC/C,MAAM,GAAE,eAAoB,GAC3B,yBAAyB,CAc3B;AAED,MAAM,WAAW,6BAA6B;IAC5C,8EAA8E;IAC9E,aAAa,CAAC,EAAE;QACd,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;KACzD,CAAC;IACF,qEAAqE;IACrE,IAAI,CAAC,EACD,KAAK,GACL;QACE,KAAK,CAAC,EAAE,eAAe,CAAC;QACxB,OAAO,CAAC,EAAE,yBAAyB,CAAC;QACpC,yEAAyE;QACzE,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;KAChD,CAAC;IACN,8DAA8D;IAC9D,GAAG,CAAC,EACA,KAAK,GACL;QACE,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC9D,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;KACzD,CAAC;CACP;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,wFAAwF;IACxF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,uEAAuE;IACvE,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,aAAa,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,4CAA4C;IAC5C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,6BAA6B,CAAC;IACnD,+EAA+E;IAC/E,KAAK,EAAE;QACL,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;KAClD,CAAC;IACF,uEAAuE;IACvE,aAAa,CAAC,EAAE;QACd,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;KAClD,CAAC;IAEF;;;;OAIG;IACH,aAAa,CACX,GAAG,EAAE,OAAO,EACZ,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,QAAQ,CAAC,CAAC;CAC9E;AAyED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,eAAe,EACvB,GAAG,EAAE,MAAM,GACV;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAmCzC;AAgSD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,GAAG,QAAQ,EAAE,CA0Y1E"}

package/dist/tools/portable-formats.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"portable-formats.d.ts","sourceRoot":"","sources":["../../src/tools/portable-formats.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,MAAM,CAgB3D,CAAC;AAEH,MAAM,WAAW,iBAAiB;IAChC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAgBD,iFAAiF;AACjF,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,EACf,YAAY,GAAE,SAAS,MAAM,EAAO,GACnC,iBAAiB,EAAE,CAiErB"}

package/dist/tools/presentation.d.ts

@@ -1,22 +0,0 @@
-import { z } from 'zod';
-import { type ToolPresentationSchema } from './flatten.js';
-export interface ToolPresentationConfig {
-    paramsSchema?: z.ZodType;
-    inputSchema?: z.ZodType;
-    extendSchema?: Record<string, z.ZodType>;
-    flattenUnionInput?: boolean;
-    unrepresentable?: 'throw' | 'any';
-}
-/** Build the one model-facing document shared by MCP, agents and manifests. */
-export declare function buildToolPresentationSchema(config: ToolPresentationConfig): ToolPresentationSchema;
-export declare function isObjectPresentationSchema(schema: ToolPresentationSchema): boolean;
-/**
- * Metadata passed to the Zod identity carrier.
- *
- * The SDK supplies its own dialect and it is 2020-12, so the document has to
- * speak 2020-12: a draft-07 `definitions` block under a 2020-12 `$schema` is a
- * document that says one thing and does another, and a client that believes the
- * stamp cannot resolve a single `#/definitions/...` pointer in it.
- */
-export declare function presentationMetadata(schema: ToolPresentationSchema): ToolPresentationSchema;
-//# sourceMappingURL=presentation.d.ts.map

package/dist/tools/presentation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"presentation.d.ts","sourceRoot":"","sources":["../../src/tools/presentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,WAAW,CAAC;AAInB,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACzC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,eAAe,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;CACnC;AA+KD,+EAA+E;AAC/E,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,sBAAsB,GAC7B,sBAAsB,CAgDxB;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAElF;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,sBAAsB,GAAG,sBAAsB,CAE3F"}

package/dist/tools/schema.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/tools/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,GAAG,MAAM,EAAE,CAE5D;AAED;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;AAOpD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,CAAC,CAAC,SAAS,EACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GACrC,CAAC,CAAC,SAAS,CAEb;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,YAAY,CAC1B,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EACjC,WAAW,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAC/B,CAAC,CAAC,OAAO,CA8BX"}

package/dist/tools/untyped-properties.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"untyped-properties.d.ts","sourceRoot":"","sources":["../../src/tools/untyped-properties.ts"],"names":[],"mappings":"AAkBA,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AASD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,SAAK,GAAG,eAAe,EAAE,CA+DrF"}

package/dist/tools/upload-core.d.ts

@@ -1,4 +0,0 @@
-import type { ManagedFileBoundary, ManagedFileSource } from '../files/boundary.js';
-/** Read one bounded managed source and hand its immutable bytes to an uploader. */
-export declare function runUploadOperation<T>(files: ManagedFileBoundary, path: string, upload: (source: ManagedFileSource, signal?: AbortSignal) => T | Promise<T>, signal?: AbortSignal): Promise<T>;
-//# sourceMappingURL=upload-core.d.ts.map

package/dist/tools/upload-core.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"upload-core.d.ts","sourceRoot":"","sources":["../../src/tools/upload-core.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEhF,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAC3E,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,CAAC,CAAC,CAGZ"}