@agentcomms/events-daemon 0.16.0 → 0.18.0

package/dist/{mcp-DXXb3Vv3-B0sHZfig.mjs → mcp-DIH4cS6P-YuKZfqTg.mjs}

@@ -1,5 +1,5 @@
 import process$1 from "node:process";
-//#region ../../node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -31,7 +31,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-//#region ../../node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/dialects-DoSzNhcb.mjs
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/dialects-DoSzNhcb.mjs
 /**
 * Canonical `$schema` URIs per supported dialect (http + https variants, trailing-`#` stripped).
 */
@@ -7465,7 +7465,8 @@ const OAuthMetadataSchema = looseObject({
 	introspection_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
 	code_challenge_methods_supported: array(string()).optional(),
 	client_id_metadata_document_supported: boolean().optional(),
-	authorization_response_iss_parameter_supported: boolean().optional().catch(void 0)
+	authorization_response_iss_parameter_supported: boolean().optional().catch(void 0),
+	dpop_signing_alg_values_supported: array(string()).optional()
 });
 /**
 * OpenID Connect Discovery 1.0 Provider Metadata
@@ -7529,7 +7530,8 @@ const OAuthTokensSchema = object({
 	token_type: string(),
 	expires_in: number().optional(),
 	scope: string().optional(),
-	refresh_token: string().optional()
+	refresh_token: string().optional(),
+	issuer: string().optional().catch(void 0)
 }).strip();
 /**
 * RFC 8693 §2.2.1 Token Exchange response for ID-JAG tokens.
@@ -7586,7 +7588,8 @@ const OAuthClientInformationSchema = object({
 	client_id: string(),
 	client_secret: string().optional(),
 	client_id_issued_at: number$1().optional(),
-	client_secret_expires_at: number$1().optional()
+	client_secret_expires_at: number$1().optional(),
+	issuer: string().optional().catch(void 0)
 }).strip();
 /**
 * RFC 7591 OAuth 2.0 Dynamic Client Registration full response (client information plus metadata)
@@ -7607,7 +7610,7 @@ const OAuthTokenRevocationRequestSchema = object({
 	token_type_hint: string().optional()
 }).strip();
 //#endregion
-//#region ../../node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/src-CX2iR2pK.mjs
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/src-Cqbh3MYc.mjs
 /**
 * Cross-bundle `instanceof` support for the SDK error classes.
 *
@@ -7872,8 +7875,18 @@ var SdkError = class extends Error {
 		if (typeof this !== "function") throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");
 		return brandedHasInstance(this, value);
 	}
-	constructor(code, message, data) {
-		super(message);
+	/**
+	* @param code - Stable string code identifying the failure ({@linkcode SdkErrorCode}).
+	* @param message - Human-readable description.
+	* @param data - Optional structured payload (for example the HTTP status carried by
+	* {@linkcode SdkHttpError}). Opaque to the SDK: a `cause` key inside `data` is not
+	* promoted to `Error.cause`.
+	* @param options - Standard `ErrorOptions`, forwarded to `Error`. Pass the underlying
+	* failure as `{ cause }` so it is reachable through the `Error.cause` chain that
+	* loggers and error trackers walk.
+	*/
+	constructor(code, message, data, options) {
+		super(message, options);
 		this.code = code;
 		this.data = data;
 		this.name = "SdkError";
@@ -7900,8 +7913,11 @@ var SdkHttpError = class extends SdkError {
 	static {
 		Object.defineProperty(this, "mcpBrand", { value: "mcp.SdkHttpError" });
 	}
-	constructor(code, message, data) {
-		super(code, message, data);
+	/**
+	* @param options - Standard `ErrorOptions`, forwarded to `Error` (see {@linkcode SdkError}).
+	*/
+	constructor(code, message, data, options) {
+		super(code, message, data, options);
 		this.name = "SdkHttpError";
 	}
 	get status() {
@@ -10554,7 +10570,7 @@ function build() {
 	const subscriptionsListenParamsShape = { notifications: SubscriptionFilterSchema$1 };
 	const SubscriptionsListenRequestSchema$1 = wireRequest("subscriptions/listen", subscriptionsListenParamsShape);
 	/**
-	* Anchor SubscriptionsListenResultMeta — required subscriptionId stamp on
+	* Anchor SubscriptionsListenResultMetaObject — required subscriptionId stamp on
 	* the graceful-close result. Extends `ResultMetaObject` since spec PR
 	* #3002 (composed, so the serverInfo key and its leniency stay single-sourced).
 	*/
@@ -10827,7 +10843,8 @@ function build() {
 		ListResourceTemplatesResultResponseSchema: wireResultResponse(ListResourceTemplatesResultSchema$1),
 		ReadResourceResultResponseSchema: wireResultResponse(union([ReadResourceResultSchema$1, InputRequiredResultSchema])),
 		CompleteResultResponseSchema: wireResultResponse(CompleteResultSchema$1),
-		DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1)
+		DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1),
+		SubscriptionsListenResultResponseSchema: wireResultResponse(SubscriptionsListenResultSchema$1)
 	};
 }
 let memo;
@@ -11460,6 +11477,8 @@ const rev2026Codec = {
 			const rawInputRequests = raw["inputRequests"];
 			const inputRequests = isPlainObject$4(rawInputRequests) ? rawInputRequests : {};
 			const requestState = raw["requestState"];
+			const metaParse = raw["_meta"] === void 0 ? void 0 : buildSchemas2026().ResultMetaSchema.safeParse(raw["_meta"]);
+			const meta = metaParse?.success ? metaParse.data : void 0;
 			if (Object.keys(inputRequests).length === 0 && typeof requestState !== "string") return {
 				kind: "invalid",
 				error: new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${method}: input_required carries neither inputRequests nor requestState (every input_required result must include at least one of the two)`, {
@@ -11470,7 +11489,8 @@ const rev2026Codec = {
 			return {
 				kind: "input_required",
 				inputRequests,
-				...typeof requestState === "string" && { requestState }
+				...typeof requestState === "string" && { requestState },
+				...meta !== void 0 && { _meta: meta }
 			};
 		}
 		if (rawResultType !== "complete") return {
@@ -11568,6 +11588,10 @@ function isSpecRequestMethod(method) {
 function isSpecNotificationMethod(method) {
 	return ALL_CODECS.some((codec) => codec.hasNotificationMethod(method));
 }
+/** The names SEP-2663 re-defines for the Tasks extension on the era that removed them from core. */
+function isExtensionReusedRequestMethod(method) {
+	return method === "tasks/get" || method === "tasks/cancel";
+}
 const ALL_CODECS = [rev2025Codec, rev2026Codec];
 var schemas_exports = /* @__PURE__ */ __exportAll({
 	AnnotationsSchema: () => AnnotationsSchema,
@@ -12599,6 +12623,8 @@ var Protocol = class {
 	_transport;
 	_requestMessageId = 0;
 	_requestHandlers = /* @__PURE__ */ new Map();
+	/** Methods registered with an explicit schema; the era gate in `_onrequest` reads it for the Tasks extension names. */
+	_customSchemaRequestMethods = /* @__PURE__ */ new Set();
 	_requestHandlerAbortControllers = /* @__PURE__ */ new Map();
 	_notificationHandlers = /* @__PURE__ */ new Map();
 	_responseHandlers = /* @__PURE__ */ new Map();
@@ -12729,7 +12755,7 @@ var Protocol = class {
 		return this._requestHandlers.get(method);
 	}
 	async _oncancel(notification) {
-		if (!notification.params.requestId) return;
+		if (notification.params.requestId === void 0) return;
 		this._requestHandlerAbortControllers.get(notification.params.requestId)?.abort(notification.params.reason);
 	}
 	_setupTimeout(messageId, timeout, maxTotalTimeout, onTimeout, resetTimeoutOnProgress = false) {
@@ -12876,7 +12902,7 @@ var Protocol = class {
 				return;
 			}
 		}
-		if (isSpecRequestMethod(request.method) && !codec.hasRequestMethod(request.method)) {
+		if (isSpecRequestMethod(request.method) && !codec.hasRequestMethod(request.method) && !(isExtensionReusedRequestMethod(request.method) && this._customSchemaRequestMethods.has(request.method))) {
 			sendErrorResponse(ProtocolErrorCode.MethodNotFound, "Method not found");
 			return;
 		}
@@ -13009,8 +13035,11 @@ var Protocol = class {
 	}
 	request(request, schemaOrOptions, maybeOptions) {
 		const codec = this._resolveOutboundCodec(request.method);
+		if (isStandardSchema(schemaOrOptions)) {
+			if (!isExtensionReusedRequestMethod(request.method)) this._assertOutboundRequestInEra(codec, request.method);
+			return this._requestWithSchemaViaCodec(codec, request, schemaOrOptions, maybeOptions);
+		}
 		this._assertOutboundRequestInEra(codec, request.method);
-		if (isStandardSchema(schemaOrOptions)) return this._requestWithSchemaViaCodec(codec, request, schemaOrOptions, maybeOptions);
 		const validate = codecResultValidator(codec, request.method);
 		if (validate === void 0) throw new TypeError(`'${request.method}' is not a spec method; pass a result schema as the second argument to request().`);
 		return this._requestWithSchemaViaCodec(codec, request, validate, schemaOrOptions);
@@ -13128,19 +13157,20 @@ var Protocol = class {
 			const cancel = (reason) => {
 				if (responseReceived) return;
 				this._progressHandlers.delete(messageId);
-				if (requestAbort === void 0) this._transport?.send(this._envelopeOutbound({
-					jsonrpc: "2.0",
-					method: "notifications/cancelled",
-					params: {
-						requestId: messageId,
-						reason: String(reason)
-					}
-				}), {
-					relatedRequestId,
-					resumptionToken,
-					onresumptiontoken
-				}).catch((error) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error}`)));
-				else requestAbort.abort();
+				if (requestAbort === void 0) {
+					if (request.method !== "initialize") this._transport?.send(this._envelopeOutbound({
+						jsonrpc: "2.0",
+						method: "notifications/cancelled",
+						params: {
+							requestId: messageId,
+							reason: String(reason)
+						}
+					}), {
+						relatedRequestId,
+						resumptionToken,
+						onresumptiontoken
+					}).catch((error) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error}`)));
+				} else requestAbort.abort();
 				reject(reason instanceof SdkError ? reason : new SdkError(SdkErrorCode.RequestTimeout, String(reason)));
 			};
 			this._responseHandlers.set(messageId, (response) => {
@@ -13202,7 +13232,7 @@ var Protocol = class {
 	* Emits a notification, which is a one-way message that does not expect a response.
 	*/
 	async notification(notification, options) {
-		return this._notificationViaCodec(this._resolveOutboundCodec(notification.method), notification, options);
+		return await this._notificationViaCodec(this._resolveOutboundCodec(notification.method), notification, options);
 	}
 	/**
 	* The notification funnel proper, keyed by the resolved era codec —
@@ -13220,7 +13250,7 @@ var Protocol = class {
 			jsonrpc: "2.0",
 			...notification
 		});
-		if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && !options?.relatedRequestId) {
+		if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && options?.relatedRequestId === void 0) {
 			if (this._pendingDebouncedNotifications.has(notification.method)) return;
 			this._pendingDebouncedNotifications.add(notification.method);
 			Promise.resolve().then(() => {
@@ -13253,6 +13283,8 @@ var Protocol = class {
 			return maybeHandler(parsed.data, ctx);
 		};
 		else throw new TypeError("setRequestHandler: handler is required");
+		if (typeof schemasOrHandler === "function") this._customSchemaRequestMethods.delete(method);
+		else this._customSchemaRequestMethods.add(method);
 		this._requestHandlers.set(method, this._wrapHandler(method, stored));
 	}
 	/**
@@ -13281,6 +13313,7 @@ var Protocol = class {
 	*/
 	removeRequestHandler(method) {
 		this._requestHandlers.delete(method);
+		this._customSchemaRequestMethods.delete(method);
 	}
 	/**
 	* Asserts that a request handler has not already been set for the given method, in preparation for a new one being automatically installed.
@@ -13371,7 +13404,8 @@ function manualInputRequiredValue(decoded) {
 	return {
 		resultType: "input_required",
 		inputRequests: decoded.inputRequests,
-		...decoded.requestState !== void 0 && { requestState: decoded.requestState }
+		...decoded.requestState !== void 0 && { requestState: decoded.requestState },
+		...decoded._meta !== void 0 && { _meta: decoded._meta }
 	};
 }
 /*!
@@ -13623,7 +13657,7 @@ function normalizeRawShapeSchema(schema) {
 	return schema;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/ajvProvider-CEoC__sr.mjs
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/ajvProvider-CEoC__sr.mjs
 var require_code$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.regexpCode = exports.getEsmExportName = exports.getProperty = exports.safeStringify = exports.stringify = exports.strConcat = exports.addCodeArg = exports.str = exports._ = exports.nil = exports._Code = exports.Name = exports.IDENTIFIER = exports._CodeOrName = void 0;
@@ -20758,7 +20792,7 @@ var AjvJsonSchemaValidator = class {
 };
 import_ajv.Ajv;
 //#endregion
-//#region ../../node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/mcp-DXXb3Vv3.mjs
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/mcp-DIH4cS6P.mjs
 const COMPLETABLE_SYMBOL = Symbol.for("mcp.completable");
 /**
 * Checks if a schema is completable (has completion metadata).
@@ -20772,6 +20806,10 @@ function isCompletable(schema) {
 function getCompleter(schema) {
 	return schema[COMPLETABLE_SYMBOL]?.complete;
 }
+/** @internal */
+function supportsScopeChallengeResolver(transport) {
+	return typeof transport === "object" && transport !== null && "setScopeChallengeResolver" in transport && typeof transport.setScopeChallengeResolver === "function";
+}
 /**
 * Default handler re-entries per originating request — tighter than the
 * client driver's 10 because the shim holds a live wire request open.
@@ -20980,6 +21018,11 @@ var Server = class extends Protocol {
 		if (modernProtocolVersions(this._supportedProtocolVersions).length > 0) this.setRequestHandler("server/discover", () => this._ondiscover());
 		if (this._capabilities.logging) this._registerLoggingHandler();
 	}
+	/** Attaches to the given transport; rejects while this instance is connected to another one. */
+	async connect(transport) {
+		if (this.transport !== void 0) throw new SdkError(SdkErrorCode.AlreadyConnected, "Use a separate Server instance per connection: this instance is already connected to a transport. To connect it to a new transport, call close() first.");
+		await super.connect(transport);
+	}
 	/**
 	* Registers the built-in `logging/setLevel` request handler.
 	*
@@ -21525,6 +21568,30 @@ var Server = class extends Protocol {
 function discoverAdvertisedCapabilities(capabilities) {
 	return { ...capabilities };
 }
+function toolInputElementCount(value, max) {
+	let count = 0;
+	const stack = [value];
+	while (stack.length > 0) {
+		const node = stack.pop();
+		if (node === null || typeof node !== "object") continue;
+		if (Array.isArray(node)) for (const child of node) {
+			if (++count > max) return count;
+			if (child !== null && typeof child === "object") stack.push(child);
+		}
+		else for (const key in node) {
+			if (!Object.prototype.hasOwnProperty.call(node, key)) continue;
+			if (++count > max) return count;
+			const child = node[key];
+			if (child !== null && typeof child === "object") stack.push(child);
+		}
+	}
+	return count;
+}
+function resolveMaxToolInputElements(value) {
+	if (value === void 0 || value === Infinity) return void 0;
+	if (typeof value !== "number" || Number.isNaN(value) || value < 1) throw new RangeError(`maxToolInputElements must be a number of at least 1, or Infinity, got ${String(value)}`);
+	return value;
+}
 /**
 * High-level MCP server that provides a simpler API for working with resources, tools, and prompts.
 * For advanced usage (like sending notifications or setting custom request handlers), use the underlying
@@ -21543,16 +21610,12 @@ var McpServer = class {
 	* The underlying {@linkcode Server} instance, useful for advanced operations like sending notifications.
 	*/
 	server;
+	_maxToolInputElements;
 	_registeredResources = {};
 	_registeredResourceTemplates = {};
 	_registeredTools = {};
 	_registeredPrompts = {};
-	/**
-	* Per-tool JSON-converted `inputSchema`, memoized so the SEP-2243
-	* registration-time scan and the pre-dispatch validation step share one
-	* conversion instead of paying it twice per request under the
-	* per-request-factory `createMcpHandler` model.
-	*/
+	/** Per-tool JSON-converted `inputSchema`, filled on first use by `toolInputSchemaJson()`. */
 	_toolInputSchemaJson = {};
 	/**
 	* The JSON-serialized `inputSchema` of a registered tool, or `undefined`
@@ -21577,6 +21640,7 @@ var McpServer = class {
 	}
 	constructor(serverInfo, options) {
 		this.server = new Server(serverInfo, options);
+		this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
 		if (options?.capabilities?.tools) this.setToolRequestHandlers();
 		if (options?.capabilities?.resources) this.setResourceRequestHandlers();
 		if (options?.capabilities?.prompts) this.setPromptRequestHandlers();
@@ -21594,6 +21658,7 @@ var McpServer = class {
 	* ```
 	*/
 	async connect(transport) {
+		if (supportsScopeChallengeResolver(transport)) transport.setScopeChallengeResolver((context) => this.resolveScopeChallenge(context));
 		return await this.server.connect(transport);
 	}
 	/**
@@ -21602,6 +21667,40 @@ var McpServer = class {
 	async close() {
 		await this.server.close();
 	}
+	/** @internal */
+	resolveScopeChallenge = (context) => {
+		switch (context.request.method) {
+			case "tools/call": {
+				const toolName = context.request.params?.name;
+				if (typeof toolName !== "string") return;
+				const tool = this._registeredTools[toolName];
+				if (tool === void 0 || !tool.enabled) return;
+				return tool.scopeChallenge?.(context);
+			}
+			case "resources/read": {
+				const resourceUri = context.request.params?.uri;
+				if (typeof resourceUri !== "string") return;
+				let uri;
+				try {
+					uri = new URL(resourceUri);
+				} catch {
+					return;
+				}
+				const resource = this._registeredResources[uri.toString()];
+				if (resource !== void 0) return resource.enabled ? resource.scopeChallenge?.(context) : void 0;
+				for (const template of Object.values(this._registeredResourceTemplates)) if (template.resourceTemplate.uriTemplate.match(uri.toString())) return template.enabled ? template.scopeChallenge?.(context) : void 0;
+				return;
+			}
+			case "prompts/get": {
+				const promptName = context.request.params?.name;
+				if (typeof promptName !== "string") return;
+				const prompt = this._registeredPrompts[promptName];
+				if (prompt === void 0 || !prompt.enabled) return;
+				return prompt.scopeChallenge?.(context);
+			}
+			default: return;
+		}
+	};
 	_toolHandlersInitialized = false;
 	setToolRequestHandlers() {
 		if (this._toolHandlersInitialized) return;
@@ -21613,7 +21712,7 @@ var McpServer = class {
 				name,
 				title: tool.title,
 				description: tool.description,
-				inputSchema: tool.inputSchema ? standardSchemaToJsonSchema(tool.inputSchema, "input") : EMPTY_OBJECT_JSON_SCHEMA,
+				inputSchema: tool.inputSchema ? convertListedInputSchema(name, tool.inputSchema) : EMPTY_OBJECT_JSON_SCHEMA,
 				annotations: tool.annotations,
 				icons: tool.icons,
 				execution: tool.execution,
@@ -21658,6 +21757,7 @@ var McpServer = class {
 	* Validates tool input arguments against the tool's input schema.
 	*/
 	async validateToolInput(tool, args, toolName) {
+		if (this._maxToolInputElements !== void 0 && toolInputElementCount(args, this._maxToolInputElements) > this._maxToolInputElements) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid arguments for tool ${toolName}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
 		if (!tool.inputSchema) return;
 		const parseResult = await validateStandardSchema(tool.inputSchema, args ?? {});
 		if (!parseResult.success) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Input validation error: Invalid arguments for tool ${toolName}: ${parseResult.error}`);
@@ -21767,7 +21867,10 @@ var McpServer = class {
 			}
 			for (const template of Object.values(this._registeredResourceTemplates)) {
 				const variables = template.resourceTemplate.uriTemplate.match(uri.toString());
-				if (variables) return attachCacheHintFallback(await template.readCallback(uri, variables, ctx), template.cacheHint);
+				if (variables) {
+					if (!template.enabled) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Resource template ${template.resourceTemplate.uriTemplate} disabled`);
+					return attachCacheHintFallback(await template.readCallback(uri, variables, ctx), template.cacheHint);
+				}
 			}
 			throw new ResourceNotFoundError(request.params.uri);
 		});
@@ -21798,36 +21901,32 @@ var McpServer = class {
 		this._promptHandlersInitialized = true;
 	}
 	registerResource(name, uriOrTemplate, config, readCallback) {
-		const cacheHint = config.cacheHint;
-		let metadata = config;
-		if (cacheHint !== void 0) {
-			assertValidCacheHint(cacheHint, `resource ${name}`);
-			const rest = { ...config };
-			delete rest.cacheHint;
-			metadata = rest;
-		}
+		const { cacheHint, scopeChallenge, ...resourceMetadata } = config;
+		const metadata = resourceMetadata;
+		if (cacheHint !== void 0) assertValidCacheHint(cacheHint, `resource ${name}`);
 		if (typeof uriOrTemplate === "string") {
 			if (this._registeredResources[uriOrTemplate]) throw new Error(`Resource ${uriOrTemplate} is already registered`);
-			const registeredResource = this._createRegisteredResource(name, config.title, uriOrTemplate, metadata, readCallback);
+			const registeredResource = this._createRegisteredResource(name, config.title, uriOrTemplate, metadata, scopeChallenge, readCallback);
 			if (cacheHint !== void 0) registeredResource.cacheHint = cacheHint;
 			this.setResourceRequestHandlers();
 			this.sendResourceListChanged();
 			return registeredResource;
 		} else {
 			if (this._registeredResourceTemplates[name]) throw new Error(`Resource template ${name} is already registered`);
-			const registeredResourceTemplate = this._createRegisteredResourceTemplate(name, config.title, uriOrTemplate, metadata, readCallback);
+			const registeredResourceTemplate = this._createRegisteredResourceTemplate(name, config.title, uriOrTemplate, metadata, scopeChallenge, readCallback);
 			if (cacheHint !== void 0) registeredResourceTemplate.cacheHint = cacheHint;
 			this.setResourceRequestHandlers();
 			this.sendResourceListChanged();
 			return registeredResourceTemplate;
 		}
 	}
-	_createRegisteredResource(name, title, uri, metadata, readCallback) {
+	_createRegisteredResource(name, title, uri, metadata, scopeChallenge, readCallback) {
 		const registeredResource = {
 			name,
 			title,
 			metadata,
 			readCallback,
+			scopeChallenge,
 			enabled: true,
 			disable: () => registeredResource.update({ enabled: false }),
 			enable: () => registeredResource.update({ enabled: true }),
@@ -21841,6 +21940,7 @@ var McpServer = class {
 				if (updates.title !== void 0) registeredResource.title = updates.title;
 				if (updates.metadata !== void 0) registeredResource.metadata = updates.metadata;
 				if (updates.callback !== void 0) registeredResource.readCallback = updates.callback;
+				if (updates.scopeChallenge !== void 0) registeredResource.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
 				if (updates.enabled !== void 0) registeredResource.enabled = updates.enabled;
 				this.sendResourceListChanged();
 			}
@@ -21848,12 +21948,13 @@ var McpServer = class {
 		this._registeredResources[uri] = registeredResource;
 		return registeredResource;
 	}
-	_createRegisteredResourceTemplate(name, title, template, metadata, readCallback) {
+	_createRegisteredResourceTemplate(name, title, template, metadata, scopeChallenge, readCallback) {
 		const registeredResourceTemplate = {
 			resourceTemplate: template,
 			title,
 			metadata,
 			readCallback,
+			scopeChallenge,
 			enabled: true,
 			disable: () => registeredResourceTemplate.update({ enabled: false }),
 			enable: () => registeredResourceTemplate.update({ enabled: true }),
@@ -21867,6 +21968,7 @@ var McpServer = class {
 				if (updates.template !== void 0) registeredResourceTemplate.resourceTemplate = updates.template;
 				if (updates.metadata !== void 0) registeredResourceTemplate.metadata = updates.metadata;
 				if (updates.callback !== void 0) registeredResourceTemplate.readCallback = updates.callback;
+				if (updates.scopeChallenge !== void 0) registeredResourceTemplate.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
 				if (updates.enabled !== void 0) registeredResourceTemplate.enabled = updates.enabled;
 				this.sendResourceListChanged();
 			}
@@ -21876,7 +21978,7 @@ var McpServer = class {
 		if (Array.isArray(variableNames) && variableNames.some((v) => !!template.completeCallback(v))) this.setCompletionRequestHandler();
 		return registeredResourceTemplate;
 	}
-	_createRegisteredPrompt(name, title, description, argsSchema, callback, icons, _meta) {
+	_createRegisteredPrompt(name, title, description, argsSchema, callback, icons, scopeChallenge, _meta) {
 		let currentArgsSchema = argsSchema;
 		let currentCallback = callback;
 		const registeredPrompt = {
@@ -21884,6 +21986,7 @@ var McpServer = class {
 			description,
 			argsSchema,
 			icons,
+			scopeChallenge,
 			_meta,
 			handler: createPromptHandler(name, argsSchema, callback),
 			enabled: true,
@@ -21898,6 +22001,7 @@ var McpServer = class {
 				if (updates.title !== void 0) registeredPrompt.title = updates.title;
 				if (updates.description !== void 0) registeredPrompt.description = updates.description;
 				if (updates.icons !== void 0) registeredPrompt.icons = updates.icons;
+				if (updates.scopeChallenge !== void 0) registeredPrompt.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
 				if (updates._meta !== void 0) registeredPrompt._meta = updates._meta;
 				let needsHandlerRegen = false;
 				if (updates.argsSchema !== void 0) {
@@ -21925,24 +22029,25 @@ var McpServer = class {
 		}
 		return registeredPrompt;
 	}
-	_createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, _meta, handler) {
+	_createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, scopeChallenge, _meta, handler) {
 		validateAndWarnToolName(name);
-		if (inputSchema !== void 0) try {
-			const json = standardSchemaToJsonSchema(inputSchema, "input");
-			this._toolInputSchemaJson[name] = json;
-			const scan = scanXMcpHeaderDeclarations(json);
-			if (!scan.valid) console.warn(`[mcp-sdk] tool '${name}' carries an invalid x-mcp-header declaration and will be excluded by conforming Streamable HTTP clients: ${scan.reason}`);
-		} catch {}
 		let currentHandler = handler;
+		let outputSchemaJson;
 		const registeredTool = {
 			title,
 			description,
 			inputSchema,
 			outputSchema,
-			outputSchemaJson: convertOutputSchemaJson(outputSchema),
+			get outputSchemaJson() {
+				return outputSchemaJson ??= convertOutputSchemaJson(registeredTool.outputSchema);
+			},
+			set outputSchemaJson(value) {
+				outputSchemaJson = value;
+			},
 			annotations,
 			icons,
 			execution,
+			scopeChallenge,
 			_meta,
 			handler,
 			executor: createToolExecutor(inputSchema, handler),
@@ -21981,6 +22086,7 @@ var McpServer = class {
 				}
 				if (updates.annotations !== void 0) registeredTool.annotations = updates.annotations;
 				if (updates.icons !== void 0) registeredTool.icons = updates.icons;
+				if (updates.scopeChallenge !== void 0) registeredTool.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
 				if (updates._meta !== void 0) registeredTool._meta = updates._meta;
 				if (updates.enabled !== void 0) registeredTool.enabled = updates.enabled;
 				this.sendToolListChanged();
@@ -21993,13 +22099,13 @@ var McpServer = class {
 	}
 	registerTool(name, config, cb) {
 		if (this._registeredTools[name]) throw new Error(`Tool ${name} is already registered`);
-		const { title, description, inputSchema, outputSchema, annotations, icons, _meta } = config;
-		return this._createRegisteredTool(name, title, description, normalizeRawShapeSchema(inputSchema), normalizeRawShapeSchema(outputSchema), annotations, icons, void 0, _meta, cb);
+		const { title, description, inputSchema, outputSchema, annotations, icons, scopeChallenge, _meta } = config;
+		return this._createRegisteredTool(name, title, description, normalizeRawShapeSchema(inputSchema), normalizeRawShapeSchema(outputSchema), annotations, icons, void 0, scopeChallenge, _meta, cb);
 	}
 	registerPrompt(name, config, cb) {
 		if (this._registeredPrompts[name]) throw new Error(`Prompt ${name} is already registered`);
-		const { title, description, argsSchema, icons, _meta } = config;
-		const registeredPrompt = this._createRegisteredPrompt(name, title, description, normalizeRawShapeSchema(argsSchema), cb, icons, _meta);
+		const { title, description, argsSchema, icons, scopeChallenge, _meta } = config;
+		const registeredPrompt = this._createRegisteredPrompt(name, title, description, normalizeRawShapeSchema(argsSchema), cb, icons, scopeChallenge, _meta);
 		this.setPromptRequestHandlers();
 		this.sendPromptListChanged();
 		return registeredPrompt;
@@ -22069,6 +22175,13 @@ const EMPTY_OBJECT_JSON_SCHEMA = {
 	type: "object",
 	properties: {}
 };
+/** Converts a tool's `inputSchema` for `tools/list` and warns on an invalid SEP-2243 `x-mcp-header` declaration. */
+function convertListedInputSchema(name, inputSchema) {
+	const json = standardSchemaToJsonSchema(inputSchema, "input");
+	const scan = scanXMcpHeaderDeclarations(json);
+	if (!scan.valid) console.warn(`[mcp-sdk] tool '${name}' carries an invalid x-mcp-header declaration and will be excluded by conforming Streamable HTTP clients: ${scan.reason}`);
+	return json;
+}
 /**
 * Convert a registered `outputSchema` to JSON Schema, memoised on {@link RegisteredTool.outputSchemaJson}
 * so `tools/call` passes the SAME advertised schema to the wire codec's `projectCallToolResult` that
@@ -22091,7 +22204,7 @@ function createPromptHandler(name, argsSchema, callback) {
 	if (argsSchema) {
 		const typedCallback = callback;
 		return async (args, ctx) => {
-			const parseResult = await validateStandardSchema(argsSchema, args);
+			const parseResult = await validateStandardSchema(argsSchema, args ?? {});
 			if (!parseResult.success) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid arguments for prompt ${name}: ${parseResult.error}`);
 			return typedCallback(parseResult.data, ctx);
 		};

package/dist/records-DjE5a4_H.mjs

@@ -0,0 +1,2 @@
+import { n as RECORD_LAYOUTS } from "./records-DsUxYBwb.mjs";
+export { RECORD_LAYOUTS };

package/dist/{records-3rGS8spn.mjs → records-DsUxYBwb.mjs}

@@ -1,4 +1,4 @@
-import { t as canonicalSecretWebhookUrl } from "./webhook-target-BkA_wHIu.mjs";
+import { t as canonicalSecretWebhookUrl } from "./webhook-target-DyDTwWhV.mjs";
 import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from "node:crypto";
 import "node:fs/promises";
 import { FileSecretStore, KeychainSecretStore, canonicalJson, keychainNamespace, loadKeyringModule, sha256Hex, withFileLock } from "@agentcomms/core";
@@ -354,7 +354,7 @@ var EventSecretStore = class {
 			this.assertSelectedBackend();
 			const row = this.#database.prepare("SELECT secret_ref, retired_at FROM event_secret_masters WHERE key_id = ?").get(input.keyId);
 			if (row === void 0 || row.retired_at === null) throw new EventSecretError("EVENT_MASTER_UNKNOWN", "only a known retired event master may be destroyed");
-			const { RECORD_LAYOUTS } = await import("./records-DojbuTaG.mjs");
+			const { RECORD_LAYOUTS } = await import("./records-DjE5a4_H.mjs");
 			for (const layout of RECORD_LAYOUTS) {
 				const records = this.#database.prepare(`SELECT ${layout.sqlColumn} AS record FROM ${layout.table} WHERE ${layout.sqlColumn} IS NOT NULL`).all();
 				for (const record of records) {