import { HttpServerResponse } from "effect/unstable/http";import { Effect } from "effect"; import type { McpJwtVerificationError } from "../mcp-auth"; export const CORS_ALLOW_ORIGIN = { "access-control-allow-origin": "*" } as const; type UnauthorizedAuth = {  readonly reason: "missing_bearer" | "invalid_token";  readonly description?: string;}; const quoteAuthParam = (value: string) =>  `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`; const bearerChallenge = (auth: UnauthorizedAuth, protectedResourceMetadataUrl: string) => {  const params =    auth.reason === "missing_bearer"      ? [`resource_metadata=${quoteAuthParam(protectedResourceMetadataUrl)}`]      : [          'error="invalid_token"',          `error_description=${quoteAuthParam(            auth.description ?? "The access token is invalid or expired",          )}`,          `resource_metadata=${quoteAuthParam(protectedResourceMetadataUrl)}`,        ];   return `Bearer ${params.join(", ")}`;}; export const jsonResponse = (body: unknown, status = 200) =>  HttpServerResponse.jsonUnsafe(body, { status, headers: CORS_ALLOW_ORIGIN }); export const jsonRpcError = (status: number, code: number, message: string) =>  HttpServerResponse.jsonUnsafe(    { jsonrpc: "2.0", error: { code, message }, id: null },    { status, headers: CORS_ALLOW_ORIGIN },  ); export const jsonRpcWebResponse = (status: number, code: number, message: string) =>  new Response(JSON.stringify({ jsonrpc: "2.0", error: { code, message }, id: null }), {    status,    headers: { ...CORS_ALLOW_ORIGIN, "content-type": "application/json" },  }); export const unauthorized = (auth: UnauthorizedAuth, protectedResourceMetadataUrl: string) =>  HttpServerResponse.jsonUnsafe(    { error: "unauthorized" },    {      status: 401,      headers: {        ...CORS_ALLOW_ORIGIN,        "www-authenticate": bearerChallenge(auth, protectedResourceMetadataUrl),      },    },  ); export const authTemporarilyUnavailable = (error: McpJwtVerificationError) =>  Effect.gen(function* () {    yield* Effect.annotateCurrentSpan({      "mcp.auth.outcome": "system_error",      "mcp.auth.system_error.reason": error.reason,      "mcp.auth.system_error.message": String(error.cause).slice(0, 500),    });    return jsonRpcError(503, -32001, "Authentication temporarily unavailable - please retry");  });