web-comments 0.1.0 → 1.0.1

package/dist/connectors/mcp.js

@@ -0,0 +1,895 @@
+import {
+  CommentsError
+} from "../chunks/chunk-RRSB326L.js";
+import "../chunks/chunk-WSFCRVEQ.js";
+
+// src/connectors/mcp/pages.ts
+function escapeHtml(value) {
+  return value.replace(
+    /[&<>"']/g,
+    (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[char]
+  );
+}
+var STYLE = `
+:root { color-scheme: light dark; --bg: #f8f8f8; --card: #fff; --ink: #131313; --muted: #505050; --line: #e1e1e1; --accent: #3b63fb; --accent-ink: #fff; --quiet: #e9e9e9; }
+@media (prefers-color-scheme: dark) { :root { --bg: #111; --card: #1d1d1d; --ink: #f2f2f2; --muted: #b0b0b0; --line: #333; --accent: #5d89ff; --quiet: #2c2c2c; } }
+* { box-sizing: border-box; }
+body { margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 24px; background: var(--bg); color: var(--ink);
+  font: 15px/1.5 adobe-clean, "Source Sans Pro", ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif; }
+main { width: 100%; max-width: 400px; background: var(--card); border: 1px solid var(--line); border-radius: 16px; padding: 28px; }
+.product { margin: 0 0 20px; font-size: 13px; color: var(--muted); }
+h1 { margin: 0 0 8px; font-size: 22px; line-height: 1.25; font-weight: 700; }
+p { margin: 0 0 16px; color: var(--muted); }
+ul { margin: 0 0 20px; padding: 0 0 0 20px; color: var(--muted); }
+li { margin: 4px 0; }
+.who { display: flex; align-items: center; gap: 12px; margin: 0 0 20px; padding: 12px; border-radius: 10px; background: var(--quiet); }
+.who img, .who .initial { width: 32px; height: 32px; border-radius: 50%; flex: none; object-fit: cover; }
+.who .initial { display: grid; place-items: center; background: var(--accent); color: var(--accent-ink); font-weight: 700; }
+.who strong { display: block; color: var(--ink); }
+.who span { font-size: 13px; color: var(--muted); }
+.actions { display: flex; gap: 12px; justify-content: flex-end; }
+button, a.button { font: inherit; font-weight: 700; border-radius: 999px; padding: 7px 18px; border: 2px solid transparent; cursor: pointer; text-decoration: none; }
+button.primary, a.button { background: var(--accent); color: var(--accent-ink); }
+button.secondary { background: transparent; color: var(--ink); border-color: var(--line); }
+button:focus-visible, a.button:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+`;
+function shell(title, product, body) {
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(title)}</title><style>${STYLE}</style></head><body><main><p class="product">${escapeHtml(product)}</p>${body}</main></body></html>`;
+}
+function consentPage(input) {
+  const { who } = input;
+  const avatar = who.avatarUrl?.startsWith("https://") ? `<img src="${escapeHtml(who.avatarUrl)}" alt="">` : `<div class="initial" aria-hidden="true">${escapeHtml((who.name.trim()[0] ?? "?").toUpperCase())}</div>`;
+  return shell(
+    `Allow ${input.app}?`,
+    input.product,
+    `<h1>Allow ${escapeHtml(input.app)} to use comments on ${escapeHtml(input.host)}?</h1>
+<p>It will be able to, as you:</p>
+<ul><li>read comment threads, with their screenshots and the elements they're on</li><li>reply to them, and resolve or reopen them</li></ul>
+<div class="who">${avatar}<div><strong>${escapeHtml(who.name)}</strong>${who.email ? `<span>${escapeHtml(who.email)}</span>` : ""}</div></div>
+<p>You'll go back to ${escapeHtml(input.appHost)}. Only allow apps you trust.</p>
+<form method="post" action="${escapeHtml(input.action)}" class="actions">
+<input type="hidden" name="consent" value="${escapeHtml(input.consentId)}">
+<button type="submit" name="decision" value="deny" class="secondary">Cancel</button>
+<button type="submit" name="decision" value="allow" class="primary">Allow</button>
+</form>`
+  );
+}
+function messagePage(product, title, message, link) {
+  return shell(
+    title,
+    product,
+    `<h1>${escapeHtml(title)}</h1><p>${escapeHtml(message)}</p>${link ? `<div class="actions"><a class="button" href="${escapeHtml(link.href)}">${escapeHtml(link.label)}</a></div>` : ""}`
+  );
+}
+
+// src/connectors/mcp/oauth.ts
+var SCOPE = "comments";
+var CODE_TTL = 5 * 60;
+var CONSENT_TTL = 10 * 60;
+var TOKEN_PREFIX = { access: "wcm_at_", refresh: "wcm_rt_" };
+function endpoints(base) {
+  return {
+    resource: base,
+    issuer: base,
+    authorize: `${base}/authorize`,
+    token: `${base}/token`,
+    register: `${base}/register`,
+    revoke: `${base}/revoke`,
+    jwks: `${base}/jwks`,
+    resourceMetadata: `${base}/.well-known/oauth-protected-resource`
+  };
+}
+var CORS = {
+  "access-control-allow-origin": "*",
+  "access-control-allow-methods": "GET, POST, OPTIONS",
+  "access-control-allow-headers": "authorization, content-type, mcp-protocol-version, mcp-session-id, last-event-id",
+  "access-control-expose-headers": "www-authenticate, mcp-session-id",
+  "access-control-max-age": "86400"
+};
+function json(body, status = 200, headers = {}) {
+  return Response.json(body, {
+    status,
+    headers: { ...CORS, "cache-control": "no-store", ...headers }
+  });
+}
+function oauthError(error, description, status = 400) {
+  return json({ error, error_description: description }, status);
+}
+function protectedResourceMetadata(base) {
+  const at = endpoints(base);
+  return json({
+    resource: at.resource,
+    authorization_servers: [at.issuer],
+    scopes_supported: [SCOPE],
+    bearer_methods_supported: ["header"],
+    resource_name: "web-comments"
+  });
+}
+function authorizationServerMetadata(base, oidc) {
+  const at = endpoints(base);
+  return json({
+    issuer: at.issuer,
+    authorization_endpoint: at.authorize,
+    token_endpoint: at.token,
+    registration_endpoint: at.register,
+    revocation_endpoint: at.revoke,
+    scopes_supported: [SCOPE],
+    response_types_supported: ["code"],
+    response_modes_supported: ["query"],
+    grant_types_supported: ["authorization_code", "refresh_token"],
+    token_endpoint_auth_methods_supported: ["none"],
+    revocation_endpoint_auth_methods_supported: ["none"],
+    code_challenge_methods_supported: ["S256"],
+    authorization_response_iss_parameter_supported: true,
+    client_id_metadata_document_supported: true,
+    ...oidc ? {
+      jwks_uri: at.jwks,
+      subject_types_supported: ["public"],
+      id_token_signing_alg_values_supported: ["none"]
+    } : {}
+  });
+}
+function jwks() {
+  return json({ keys: [] });
+}
+function randomToken(bytes = 32) {
+  return base64url(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+function base64url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function sha256(text2) {
+  const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text2));
+  return base64url(new Uint8Array(hash));
+}
+async function readJson(storage, key) {
+  const value = await storage.get(key);
+  return value === null ? null : JSON.parse(value);
+}
+async function grantOf(storage, token2) {
+  if (!token2.startsWith(TOKEN_PREFIX.access)) return null;
+  const record = await readJson(storage, `token:${await sha256(token2)}`);
+  if (record?.kind !== "access") return null;
+  const { kind: _, ...grant } = record;
+  return grant;
+}
+function looksLikeOurToken(token2) {
+  return token2.startsWith(TOKEN_PREFIX.access) || token2.startsWith(TOKEN_PREFIX.refresh);
+}
+async function issueTokens(storage, grant, options) {
+  const access = TOKEN_PREFIX.access + randomToken();
+  const refresh = TOKEN_PREFIX.refresh + randomToken();
+  await storage.set(
+    `token:${await sha256(access)}`,
+    JSON.stringify({ kind: "access", ...grant }),
+    { ttlSeconds: options.accessTokenTtl }
+  );
+  await storage.set(
+    `token:${await sha256(refresh)}`,
+    JSON.stringify({ kind: "refresh", ...grant }),
+    { ttlSeconds: options.refreshTokenTtl }
+  );
+  return json({
+    access_token: access,
+    token_type: "Bearer",
+    expires_in: options.accessTokenTtl,
+    refresh_token: refresh,
+    scope: grant.scope
+  });
+}
+function isLoopback(url) {
+  return ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+}
+function allowedRedirect(uri) {
+  if (typeof uri !== "string" || uri.length > 2048) return false;
+  let url;
+  try {
+    url = new URL(uri);
+  } catch {
+    return false;
+  }
+  if (url.hash) return false;
+  if (url.protocol === "https:") return true;
+  if (url.protocol === "http:") return isLoopback(url);
+  return !["javascript:", "data:", "file:", "blob:", "about:", "vbscript:"].includes(url.protocol);
+}
+function registered(client, uri) {
+  if (client.redirect_uris.includes(uri)) return true;
+  let asked;
+  try {
+    asked = new URL(uri);
+  } catch {
+    return false;
+  }
+  if (asked.protocol !== "http:" || !isLoopback(asked)) return false;
+  return client.redirect_uris.some((known) => {
+    const url = new URL(known);
+    if (url.protocol !== "http:" || !isLoopback(url)) return false;
+    url.port = asked.port;
+    return url.href === asked.href;
+  });
+}
+function text(value, max) {
+  return typeof value === "string" && value.trim() ? value.trim().slice(0, max) : void 0;
+}
+async function register(request, storage) {
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return oauthError("invalid_client_metadata", "send the client's metadata as JSON");
+  }
+  const uris = body.redirect_uris;
+  if (!Array.isArray(uris) || uris.length === 0 || uris.length > 10 || !uris.every(allowedRedirect)) {
+    return oauthError(
+      "invalid_redirect_uri",
+      "redirect_uris must be HTTPS, loopback HTTP or an app's own scheme"
+    );
+  }
+  const client = {
+    client_id: `wcm_client_${randomToken(16)}`,
+    redirect_uris: uris,
+    ...text(body.client_name, 100) ? { client_name: text(body.client_name, 100) } : {},
+    ...text(body.client_uri, 500) ? { client_uri: text(body.client_uri, 500) } : {}
+  };
+  await storage.set(`client:${client.client_id}`, JSON.stringify(client));
+  return json(
+    {
+      ...client,
+      client_id_issued_at: Math.floor(Date.now() / 1e3),
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      scope: SCOPE
+    },
+    201
+  );
+}
+async function clientOf(storage, clientId) {
+  if (!clientId.startsWith("https://")) {
+    return readJson(storage, `client:${clientId}`);
+  }
+  const cached = await readJson(storage, `cimd:${clientId}`);
+  if (cached) return cached;
+  let document;
+  try {
+    const response = await fetch(clientId, {
+      headers: { accept: "application/json" },
+      redirect: "error",
+      signal: AbortSignal.timeout(5e3)
+    });
+    if (!response.ok) return null;
+    const body = await response.text();
+    if (body.length > 1e4) return null;
+    document = JSON.parse(body);
+  } catch {
+    return null;
+  }
+  const uris = document.redirect_uris;
+  if (document.client_id !== clientId) return null;
+  if (!Array.isArray(uris) || uris.length === 0 || !uris.every(allowedRedirect)) return null;
+  const client = {
+    client_id: clientId,
+    redirect_uris: uris,
+    ...text(document.client_name, 100) ? { client_name: text(document.client_name, 100) } : {},
+    ...text(document.client_uri, 500) ? { client_uri: text(document.client_uri, 500) } : {}
+  };
+  await storage.set(`cimd:${clientId}`, JSON.stringify(client), { ttlSeconds: 24 * 60 * 60 });
+  return client;
+}
+function clientName(client) {
+  if (client.client_name) return client.client_name;
+  try {
+    return new URL(client.client_uri ?? client.client_id).hostname;
+  } catch {
+    return "An app";
+  }
+}
+function redirectWith(uri, issuer, params) {
+  const url = new URL(uri);
+  for (const [key, value] of Object.entries(params))
+    if (value !== null) url.searchParams.set(key, value);
+  url.searchParams.set("iss", issuer);
+  return new Response(null, {
+    status: 302,
+    headers: { location: url.href, "cache-control": "no-store" }
+  });
+}
+var PAGE_HEADERS = {
+  "content-type": "text/html; charset=utf-8",
+  "cache-control": "no-store",
+  "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; img-src https: data:; frame-ancestors 'none'; base-uri 'none'",
+  "x-frame-options": "DENY",
+  // Not no-referrer: under it, browsers send the consent form's Origin as "null".
+  "referrer-policy": "same-origin",
+  "x-content-type-options": "nosniff"
+};
+function fromThisOrigin(request) {
+  const site = request.headers.get("sec-fetch-site");
+  if (site) return site === "same-origin";
+  const origin = request.headers.get("origin");
+  return origin === null || origin === new URL(request.url).origin;
+}
+function page(html, status = 200) {
+  return new Response(html, { status, headers: PAGE_HEADERS });
+}
+async function authorize(request, context, options) {
+  const at = endpoints(context.url);
+  const storage = context.storage;
+  const url = new URL(request.url);
+  if (request.method === "POST") return decide(request, context, options);
+  const query = url.searchParams;
+  const clientId = query.get("client_id") ?? "";
+  const redirectUri = query.get("redirect_uri") ?? "";
+  const client = clientId ? await clientOf(storage, clientId) : null;
+  if (!client) {
+    return page(
+      messagePage(
+        options.name,
+        "Unknown app",
+        "This app isn't registered here. Try connecting it again."
+      ),
+      400
+    );
+  }
+  if (!registered(client, redirectUri)) {
+    return page(
+      messagePage(
+        options.name,
+        "Unknown address",
+        "This app asked to come back to an address it didn't register."
+      ),
+      400
+    );
+  }
+  const state = query.get("state");
+  const fail = (error, description) => redirectWith(redirectUri, at.issuer, { error, error_description: description, state });
+  if (query.get("response_type") !== "code") {
+    return fail("unsupported_response_type", "only the authorization code flow is supported");
+  }
+  const codeChallenge = query.get("code_challenge") ?? "";
+  if (query.get("code_challenge_method") !== "S256" || !/^[A-Za-z0-9_-]{43,128}$/.test(codeChallenge)) {
+    return fail("invalid_request", "PKCE with S256 is required");
+  }
+  const resource = query.get("resource") ?? at.resource;
+  if (resource !== at.resource) return fail("invalid_target", `the resource is ${at.resource}`);
+  const who = await context.identify(request);
+  if (!who) {
+    const login = context.loginUrl(request);
+    if (login) return Response.redirect(new URL(login, request.url).href, 302);
+    return page(
+      messagePage(
+        options.name,
+        "Sign in first",
+        `Sign in to ${url.host} in this browser, then come back to this page.`,
+        { label: "Try again", href: url.href }
+      ),
+      401
+    );
+  }
+  const consentId = randomToken(18);
+  const consent = {
+    clientId,
+    redirectUri,
+    state,
+    codeChallenge,
+    resource,
+    scope: SCOPE,
+    identityId: who.id
+  };
+  await storage.set(`consent:${consentId}`, JSON.stringify(consent), { ttlSeconds: CONSENT_TTL });
+  return page(
+    consentPage({
+      product: options.name,
+      host: url.host,
+      app: clientName(client),
+      appHost: new URL(redirectUri).host || new URL(redirectUri).protocol,
+      who,
+      action: at.authorize,
+      consentId
+    })
+  );
+}
+async function decide(request, context, options) {
+  const at = endpoints(context.url);
+  if (!fromThisOrigin(request)) {
+    return page(
+      messagePage(options.name, "Not allowed", "This approval didn't come from this site."),
+      403
+    );
+  }
+  const form = await request.formData();
+  const consentId = String(form.get("consent") ?? "");
+  const consent = consentId ? await readJson(context.storage, `consent:${consentId}`) : null;
+  if (!consent) {
+    return page(
+      messagePage(options.name, "This request expired", "Go back to the app and connect again."),
+      400
+    );
+  }
+  await context.storage.delete(`consent:${consentId}`);
+  const who = await context.identify(request);
+  if (!who || who.id !== consent.identityId) {
+    return page(
+      messagePage(
+        options.name,
+        "Signed in as someone else",
+        "Go back to the app and connect again."
+      ),
+      403
+    );
+  }
+  if (form.get("decision") !== "allow") {
+    return redirectWith(consent.redirectUri, at.issuer, {
+      error: "access_denied",
+      error_description: "the request was declined",
+      state: consent.state
+    });
+  }
+  const client = await clientOf(context.storage, consent.clientId);
+  if (!client) {
+    return page(
+      messagePage(options.name, "Unknown app", "This app isn't registered here anymore."),
+      400
+    );
+  }
+  const code = randomToken();
+  const grant = {
+    identity: who,
+    clientId: consent.clientId,
+    clientName: clientName(client),
+    site: context.site,
+    resource: consent.resource,
+    scope: consent.scope
+  };
+  await context.storage.set(
+    `code:${await sha256(code)}`,
+    JSON.stringify({
+      ...grant,
+      redirectUri: consent.redirectUri,
+      codeChallenge: consent.codeChallenge
+    }),
+    { ttlSeconds: CODE_TTL }
+  );
+  return redirectWith(consent.redirectUri, at.issuer, { code, state: consent.state });
+}
+async function token(request, context, options) {
+  const at = endpoints(context.url);
+  const storage = context.storage;
+  let params;
+  const type = request.headers.get("content-type") ?? "";
+  if (type.includes("application/x-www-form-urlencoded")) {
+    params = new URLSearchParams(await request.text());
+  } else if (type.includes("application/json")) {
+    params = new URLSearchParams(
+      await request.json().catch(() => ({}))
+    );
+  } else {
+    return oauthError("invalid_request", "send the request as application/x-www-form-urlencoded");
+  }
+  const clientId = params.get("client_id") ?? "";
+  const resource = params.get("resource");
+  if (resource !== null && resource !== at.resource) {
+    return oauthError("invalid_target", `the resource is ${at.resource}`);
+  }
+  if (params.get("grant_type") === "authorization_code") {
+    const code = params.get("code") ?? "";
+    const key = `code:${await sha256(code)}`;
+    const record = code ? await readJson(storage, key) : null;
+    if (record) await storage.delete(key);
+    if (!record || record.clientId !== clientId || record.site !== context.site) {
+      return oauthError("invalid_grant", "the code is unknown, used or expired");
+    }
+    if (params.get("redirect_uri") !== record.redirectUri) {
+      return oauthError("invalid_grant", "redirect_uri doesn't match the authorization request");
+    }
+    const verifier = params.get("code_verifier") ?? "";
+    if (!/^[A-Za-z0-9._~-]{43,128}$/.test(verifier) || await sha256(verifier) !== record.codeChallenge) {
+      return oauthError("invalid_grant", "code_verifier doesn't match the code challenge");
+    }
+    const { redirectUri: _, codeChallenge: __, ...grant } = record;
+    return issueTokens(storage, grant, options);
+  }
+  if (params.get("grant_type") === "refresh_token") {
+    const refresh = params.get("refresh_token") ?? "";
+    const key = `token:${await sha256(refresh)}`;
+    const record = refresh.startsWith(TOKEN_PREFIX.refresh) ? await readJson(storage, key) : null;
+    if (record?.kind !== "refresh" || record.clientId !== clientId || record.site !== context.site) {
+      return oauthError("invalid_grant", "the refresh token is unknown, used or expired");
+    }
+    await storage.delete(key);
+    const { kind: _, ...grant } = record;
+    return issueTokens(storage, grant, options);
+  }
+  return oauthError("unsupported_grant_type", "use authorization_code or refresh_token");
+}
+async function revoke(request, storage) {
+  const params = new URLSearchParams(await request.text());
+  const value = params.get("token") ?? "";
+  if (looksLikeOurToken(value)) await storage.delete(`token:${await sha256(value)}`);
+  return json({});
+}
+async function handleOAuth(request, path, context, options) {
+  if (request.method === "OPTIONS" && path !== "/authorize") {
+    return new Response(null, { status: 204, headers: CORS });
+  }
+  switch (path) {
+    case "/.well-known/oauth-protected-resource":
+      return protectedResourceMetadata(context.url);
+    case "/.well-known/oauth-authorization-server":
+      return authorizationServerMetadata(context.url, false);
+    case "/.well-known/openid-configuration":
+      return authorizationServerMetadata(context.url, true);
+    case "/jwks":
+      return jwks();
+    case "/authorize":
+      if (request.method !== "GET" && request.method !== "POST") break;
+      return authorize(request, context, options);
+    case "/register":
+      if (request.method !== "POST") break;
+      return register(request, context.storage);
+    case "/token":
+      if (request.method !== "POST") break;
+      return token(request, context, options);
+    case "/revoke":
+      if (request.method !== "POST") break;
+      return revoke(request, context.storage);
+    default:
+      return null;
+  }
+  return json({ error: "invalid_request", error_description: "method not allowed" }, 405, {
+    allow: path === "/authorize" ? "GET, POST" : "POST"
+  });
+}
+
+// src/connectors/mcp/index.ts
+var VERSION = "1.0.1";
+var PROTOCOL_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
+function mcp(options = {}) {
+  const oauth = {
+    name: options.name ?? "web-comments",
+    accessTokenTtl: options.accessTokenTtl ?? 60 * 60,
+    refreshTokenTtl: options.refreshTokenTtl ?? 30 * 24 * 60 * 60
+  };
+  return {
+    name: "mcp",
+    rootPaths: (basePath) => [
+      `/.well-known/oauth-protected-resource${basePath}/mcp`,
+      `/.well-known/oauth-authorization-server${basePath}/mcp`,
+      `/.well-known/openid-configuration${basePath}/mcp`
+    ],
+    async fetch(request, context) {
+      const { pathname } = new URL(request.url);
+      const ownPath = new URL(context.url).pathname;
+      let path;
+      if (pathname === ownPath || pathname.startsWith(`${ownPath}/`)) {
+        path = pathname.slice(ownPath.length) || "/";
+      } else {
+        path = pathname.slice(0, pathname.length - ownPath.length);
+      }
+      if (path === "/") return serve(request, context, oauth);
+      return await handleOAuth(request, path, context, oauth) ?? Response.json({ error: "not_found" }, { status: 404, headers: CORS });
+    }
+  };
+}
+var rpcError = (id, code, message) => ({
+  jsonrpc: "2.0",
+  id: id ?? null,
+  error: { code, message }
+});
+async function serve(request, context, options) {
+  if (request.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS });
+  if (request.method !== "POST") {
+    return new Response(null, { status: 405, headers: { ...CORS, allow: "POST, OPTIONS" } });
+  }
+  const actor = await authenticate(request, context);
+  if (!actor) {
+    const given = request.headers.get("authorization");
+    const at = endpoints(context.url);
+    return Response.json(
+      { error: "invalid_token", error_description: "sign in with OAuth to use comments" },
+      {
+        status: 401,
+        headers: {
+          ...CORS,
+          "www-authenticate": `Bearer resource_metadata="${at.resourceMetadata}", scope="comments"${given ? ', error="invalid_token"' : ""}`
+        }
+      }
+    );
+  }
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return Response.json(rpcError(null, -32700, "Parse error"), { status: 400, headers: CORS });
+  }
+  const batch = Array.isArray(body);
+  const messages = batch ? body : [body];
+  const actions = context.as(actor);
+  const replies = [];
+  for (const message of messages) {
+    const reply = await answer(message, actions, context, options);
+    if (reply) replies.push(reply);
+  }
+  if (replies.length === 0) return new Response(null, { status: 202, headers: CORS });
+  return Response.json(batch ? replies : replies[0], { headers: CORS });
+}
+async function authenticate(request, context) {
+  const header = request.headers.get("authorization") ?? "";
+  const token2 = /^Bearer\s+(.+)$/i.exec(header)?.[1]?.trim();
+  if (token2 && looksLikeOurToken(token2)) {
+    const grant = await grantOf(context.storage, token2);
+    if (!grant || grant.site !== context.site || grant.resource !== endpoints(context.url).resource) {
+      return null;
+    }
+    return {
+      ...grant.identity,
+      name: `${grant.identity.name} (${grant.clientName})`,
+      kind: "agent"
+    };
+  }
+  return context.identify(request);
+}
+async function answer(message, actions, context, options) {
+  if (message?.jsonrpc !== "2.0" || typeof message.method !== "string") {
+    return message && typeof message === "object" && "id" in message && !("result" in message || "error" in message) ? rpcError(message.id, -32600, "Invalid Request") : null;
+  }
+  const { id, method, params = {} } = message;
+  const isNotification = id === void 0;
+  const ok = (result) => isNotification ? null : { jsonrpc: "2.0", id, result };
+  switch (method) {
+    case "initialize": {
+      const asked = typeof params.protocolVersion === "string" ? params.protocolVersion : "";
+      return ok({
+        protocolVersion: PROTOCOL_VERSIONS.includes(asked) ? asked : PROTOCOL_VERSIONS[0],
+        capabilities: { tools: { listChanged: false } },
+        serverInfo: { name: options.name, title: "Comments", version: VERSION },
+        instructions: "Comments people left on this site's pages, each pinned to an element. List the open ones, read one (with its screenshots, the element's selector and HTML), make the change it asks for, then reply saying what you did and resolve it."
+      });
+    }
+    case "ping":
+      return ok({});
+    case "tools/list":
+      return ok({ tools: TOOLS.map(({ run: _, ...tool }) => tool) });
+    case "tools/call": {
+      const tool = TOOLS.find((t) => t.name === params.name);
+      if (!tool)
+        return isNotification ? null : rpcError(id, -32602, `Unknown tool: ${String(params.name)}`);
+      const args = params.arguments ?? {};
+      try {
+        return ok(await tool.run(args, actions, context));
+      } catch (error) {
+        if (error instanceof CommentsError || error instanceof ToolInputError || error instanceof Error) {
+          return ok({ isError: true, content: [{ type: "text", text: error.message }] });
+        }
+        throw error;
+      }
+    }
+    default:
+      if (method.startsWith("notifications/")) return null;
+      return isNotification ? null : rpcError(id, -32601, `Method not found: ${method}`);
+  }
+}
+var ToolInputError = class extends Error {
+};
+function stringArg(args, name, required = false) {
+  const value = args[name];
+  if (value === void 0 || value === null || value === "") {
+    if (required) throw new ToolInputError(`${name} is required`);
+    return void 0;
+  }
+  if (typeof value !== "string") throw new ToolInputError(`${name} must be a string`);
+  return value;
+}
+function summary(thread) {
+  const [first, ...replies] = thread.comments;
+  return {
+    id: thread.id,
+    status: thread.status,
+    url: thread.url,
+    page: thread.page,
+    element: {
+      tag: thread.anchor.tag,
+      selector: thread.anchor.selector,
+      ...thread.anchor.text ? { text: thread.anchor.text } : {}
+    },
+    author: thread.author.name,
+    comment: first?.body ?? "",
+    replies: replies.length,
+    createdAt: thread.createdAt,
+    updatedAt: thread.updatedAt,
+    links: thread.links
+  };
+}
+function describe(thread) {
+  const lines = [
+    `Thread ${thread.id} (${thread.status})`,
+    `Page: ${thread.url}`,
+    `Element: <${thread.anchor.tag}> ${thread.anchor.selector}${thread.anchor.text ? ` "${thread.anchor.text}"` : ""}`
+  ];
+  if (thread.context) {
+    const { element, page: page2 } = thread.context;
+    lines.push(
+      `Page title: ${page2.title}`,
+      `Viewport: ${page2.viewport.width}x${page2.viewport.height}, scrolled to ${page2.scroll.x},${page2.scroll.y}`,
+      `Element box: ${Math.round(element.rect.width)}x${Math.round(element.rect.height)} at ${Math.round(element.rect.x)},${Math.round(element.rect.y)}`,
+      `Element HTML:
+${element.html}`
+    );
+  }
+  for (const link of thread.links)
+    lines.push(`${link.connector}: ${link.title ?? link.url} ${link.url}`);
+  lines.push("", "Comments:");
+  for (const comment of thread.comments) {
+    lines.push(`- ${comment.author.name} (${comment.createdAt}, ${comment.id}): ${comment.body}`);
+  }
+  return lines.join("\n");
+}
+function base64(bytes) {
+  const view = new Uint8Array(bytes);
+  let binary = "";
+  for (let i = 0; i < view.length; i += 32768) {
+    binary += String.fromCharCode(...view.subarray(i, i + 32768));
+  }
+  return btoa(binary);
+}
+var THREAD_ID = { type: "string", description: "The thread's id, from list_comment_threads." };
+var TOOLS = [
+  {
+    name: "list_comment_threads",
+    title: "List comment threads",
+    description: "Comment threads people left on this site's pages: what was said, on which page and element, by whom. Open ones by default.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        status: { type: "string", enum: ["open", "resolved", "all"], default: "open" },
+        page: {
+          type: "string",
+          description: "Only this page's threads: its page key, which by default is the path, e.g. /settings."
+        },
+        limit: { type: "integer", minimum: 1, maximum: 100, default: 50 }
+      },
+      additionalProperties: false
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+    async run(args, actions) {
+      const status = stringArg(args, "status") ?? "open";
+      if (!["open", "resolved", "all"].includes(status)) {
+        throw new ToolInputError('status must be "open", "resolved" or "all"');
+      }
+      const limit = args.limit === void 0 ? 50 : Number(args.limit);
+      if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+        throw new ToolInputError("limit must be a whole number from 1 to 100");
+      }
+      const page2 = stringArg(args, "page");
+      const threads = await actions.listThreads({
+        ...page2 ? { page: page2 } : {},
+        ...status === "all" ? {} : { status },
+        limit
+      });
+      const list = threads.map(summary);
+      const text2 = list.length === 0 ? `No ${status === "all" ? "" : `${status} `}comment threads.` : list.map(
+        (t) => `${t.id} [${t.status}] ${t.url}
+  on <${t.element.tag}> ${t.element.selector}${t.element.text ? ` "${t.element.text}"` : ""}
+  ${t.author}: ${t.comment}${t.replies ? `
+  (${t.replies} ${t.replies === 1 ? "reply" : "replies"})` : ""}`
+      ).join("\n\n");
+      return { content: [{ type: "text", text: text2 }], structuredContent: { threads: list } };
+    }
+  },
+  {
+    name: "get_comment_thread",
+    title: "Read a comment thread",
+    description: "One thread in full: every comment, the page and element it's on (selector, HTML, box), and screenshots of the element in its surroundings and of the whole viewport as the commenter saw them.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        thread_id: THREAD_ID,
+        screenshots: { type: "boolean", default: true, description: "Include the screenshots." }
+      },
+      required: ["thread_id"],
+      additionalProperties: false
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+    async run(args, actions, context) {
+      const thread = await actions.getThread(stringArg(args, "thread_id", true));
+      if (!thread) throw new ToolInputError("No such thread.");
+      const content = [{ type: "text", text: describe(thread) }];
+      if (args.screenshots !== false) {
+        for (const kind of ["element", "page"]) {
+          const shot = await context.screenshot(thread, kind);
+          if (!shot) continue;
+          content.push(
+            {
+              type: "text",
+              text: kind === "element" ? "The element, outlined:" : "The whole viewport:"
+            },
+            { type: "image", data: base64(shot.body), mimeType: shot.contentType }
+          );
+        }
+      }
+      return { content };
+    }
+  },
+  {
+    name: "reply_to_comment_thread",
+    title: "Reply to a comment thread",
+    description: "Adds a reply to a thread, as you on behalf of the person who connected you.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        thread_id: THREAD_ID,
+        body: { type: "string", description: "The reply, plain text." }
+      },
+      required: ["thread_id", "body"],
+      additionalProperties: false
+    },
+    annotations: {
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: false
+    },
+    async run(args, actions) {
+      const { comment } = await actions.reply(
+        stringArg(args, "thread_id", true),
+        stringArg(args, "body", true)
+      );
+      return { content: [{ type: "text", text: `Replied (${comment.id}).` }] };
+    }
+  },
+  {
+    name: "resolve_comment_thread",
+    title: "Resolve a comment thread",
+    description: "Marks a thread resolved, optionally replying first (say what was changed). Do this once what it asks for is done.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        thread_id: THREAD_ID,
+        reply: { type: "string", description: "A reply to leave before resolving it." }
+      },
+      required: ["thread_id"],
+      additionalProperties: false
+    },
+    annotations: {
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    },
+    async run(args, actions) {
+      const threadId = stringArg(args, "thread_id", true);
+      const reply = stringArg(args, "reply");
+      if (reply) await actions.reply(threadId, reply);
+      await actions.setStatus(threadId, "resolved");
+      return { content: [{ type: "text", text: `Resolved ${threadId}.` }] };
+    }
+  },
+  {
+    name: "reopen_comment_thread",
+    title: "Reopen a comment thread",
+    description: "Marks a resolved thread open again.",
+    inputSchema: {
+      type: "object",
+      properties: { thread_id: THREAD_ID },
+      required: ["thread_id"],
+      additionalProperties: false
+    },
+    annotations: {
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false
+    },
+    async run(args, actions) {
+      const threadId = stringArg(args, "thread_id", true);
+      await actions.setStatus(threadId, "open");
+      return { content: [{ type: "text", text: `Reopened ${threadId}.` }] };
+    }
+  }
+];
+export {
+  mcp
+};