@agentcomms/resend 0.17.0 → 0.18.0

package/dist/index.d.mts

@@ -4322,7 +4322,7 @@ declare namespace external_d_exports {
   export { $brand, $input, $output, BRAND, CompileOptions, GlobalMeta, INVALID, Infer$1 as Infer, IssueData, JSONType, NEVER, $RefinementCtx as RefinementCtx, SafeExtendShape, Schema, TimePrecision, TypeOf, ZodAny, ZodArray, ZodBase64, ZodBase64URL, ZodBigInt, ZodBigIntFormat, ZodBoolean, ZodCIDRv4, ZodCIDRv6, ZodCUID, ZodCUID2, ZodCatch, ZodCodec, ZodCoercedBigInt, ZodCoercedBoolean, ZodCoercedDate, ZodCoercedNumber, ZodCoercedString, ZodCompileAsyncError, ZodCompileUnsupportedError, ZodCreditCard, ZodCustom, ZodCustomStringFormat, ZodDate, ZodDefault, ZodDiscriminatedUnion, ZodE164, ZodEmail, ZodEmoji, ZodEnum, ZodError, ZodErrorMap, ZodExactOptional, ZodFile, ZodFirstPartySchemaTypes, ZodFirstPartyTypeKind, ZodFlattenedError, ZodFloat32, ZodFloat64, ZodFormattedError, ZodFunction, ZodGUID, ZodIBAN, ZodIPv4, ZodIPv6, ZodISODate, ZodISODateTime, ZodISODuration, ZodISOTime, ZodInstanceOf, ZodInt, ZodInt32, ZodInt64, ZodIntersection, ZodIssue, ZodIssueCode, ZodJSONSchema, ZodJSONSchemaInternals, ZodJWT, ZodKSUID, ZodLazy, ZodLiteral, ZodMAC, ZodMap, ZodNaN, ZodNanoID, ZodNever, ZodNonOptional, ZodNull, ZodNullable, ZodNumber, ZodNumberFormat, ZodObject, ZodOptional, ZodPipe, ZodPrefault, ZodPreprocess, ZodPromise, ZodRawShape$1 as ZodRawShape, ZodReadonly, ZodRealError, ZodRecord, ZodSafeParseError, ZodSafeParseResult, ZodSafeParseSuccess, ZodSchema, ZodSet, ZodStandardSchemaWithJSON, ZodString, ZodStringFormat, ZodSuccess, ZodSymbol, ZodTemplateLiteral, ZodTransform, ZodTuple, ZodType, ZodTypeAny, ZodUInt32, ZodUInt64, ZodULID, ZodURL, ZodUUID, ZodUndefined, ZodUnion, ZodUnknown, ZodVoid, ZodXID, ZodXor, _ZodBigInt, _ZodBoolean, _ZodDate, _ZodNumber, _ZodString, _ZodType, _default, _function, any, array, base64, base64url, bigint$1 as bigint, boolean$1 as boolean, _catch as catch, check, cidrv4, cidrv6, clone, codec, coerce_d_exports as coerce, compile, config, index_d_exports$1 as core, creditCard, cuid, cuid2, currencyCode, custom, date$2 as date, decode, decodeAsync, deepPartial, describe, discriminatedUnion, e164, email, emoji, encode, encodeAsync, _endsWith as endsWith, _enum as enum, exactOptional, file, flattenError, float32, float64, formatError, fromJSONSchema, _function as function, getDiscriminatedOption, getErrorMap, globalRegistry, _gt as gt, _gte as gte, guid, hash, hex, hostname, httpUrl, iban, _includes as includes, output$1 as infer, inferFlattenedErrors, inferFormattedError, input, _instanceof as instanceof, int, int32, int64, intersection, invertCodec, ipv4, ipv6, iso_d_exports as iso, json, jwt, keyof, ksuid, lazy, _length as length, literal, index_d_exports$2 as locales, looseObject, looseRecord, _lowercase as lowercase, _lt as lt, _lte as lte, mac, map, _maxLength as maxLength, _maxSize as maxSize, memoizer, meta, _mime as mime, _minLength as minLength, _minSize as minSize, _multipleOf as multipleOf, nan, nanoid, nativeEnum, _negative as negative, never, _nonnegative as nonnegative, nonoptional, _nonpositive as nonpositive, _normalize as normalize, _null as null, nullable, nullish, number$1 as number, object, optional, output, _overwrite as overwrite, parse, parseAsync, partialRecord, pipe, _positive as positive, prefault, preprocess, prettifyError, promise, _properties as properties, _property as property, readonly, record, refine, _regex as regex, regexes_d_exports as regexes, registry, safeDecode, safeDecodeAsync, safeEncode, safeEncodeAsync, safeParse, safeParseAsync, set, setErrorMap, _size as size, _slugify as slugify, _startsWith as startsWith, strictObject, string$1 as string, stringFormat, stringbool, success, superRefine, symbol, templateLiteral, toJSONSchema, _toLowerCase as toLowerCase, _toUpperCase as toUpperCase, toZod, transform, treeifyError, _trim as trim, tuple, uint32, uint64, ulid, _undefined as undefined, union, unknown, _uppercase as uppercase, url, util_d_exports as util, uuid, uuidv4, uuidv6, uuidv7, validate, validateAsync, _void as void, withParser, xid, xor };
 }
 //#endregion
-//#region ../core/dist/change-flow-B_bGbrkO.d.mts
+//#region ../core/dist/change-flow-j65bYTxL.d.mts
 //#region src/config-hooks.d.ts
 /**
  * Test-only pauses inside `ConfigStore.convertToVersion3`, for the tests that prove a write racing the conversion is
@@ -4428,6 +4428,25 @@ declare class CommsError extends Error {
   get exitCode(): number;
   get retryable(): boolean;
 }
+/**
+ * The file operations a lock is made of, one method each, so a test can count and interrupt every one of them: the
+ * create that is the attempt, the read that checks a holder, the touch that renews, the unlink that releases.
+ * `withFileLock` uses the real ones; `tryFileLock` takes another for a caller whose every step is counted.
+ */
+interface LockIo {
+  /** Creates `path` exclusively (`wx`, 0600) holding `body`: the one attempt to take the lock. */
+  create(path: string, body: string): Promise<void>;
+  /** The lock file's text: a holder's body. */
+  read(path: string): Promise<string>;
+  /** The lock file's modification time, in milliseconds: where a renewal shows. */
+  mtime(path: string): Promise<number>;
+  /** Sets the lock file's times to now: a renewal. */
+  touch(path: string): Promise<void>;
+  rename(from: string, to: string): Promise<void>;
+  link(from: string, to: string): Promise<void>;
+  /** Removes a lock file, or one moved aside; a missing one is no error. */
+  remove(path: string): Promise<void>;
+}
 //#endregion
 //#region src/cli-command.d.ts
 /**
@@ -4465,9 +4484,10 @@ declare class PrintedCommand {
   #private;
   /** The words, as the program is to receive them: this Node, its flags, the entry, then the CLI's own words. */
   readonly words: readonly string[];
-  /** The line to paste; null when one of the words has no printing that every Windows shell passes on alike. */
+  /** The line to paste; null when no supported common or labelled shell rendering is safe. */
   readonly line: string | null;
   readonly platform: NodeJS.Platform;
+  readonly shell?: "powershell" | undefined;
   constructor(gate: typeof GATE$1, words: readonly string[], platform: NodeJS.Platform, entry: string);
   /**
    * The real path of the file it runs, as it was checked when the command was located: a fact about then (D6). The
@@ -5072,25 +5092,6 @@ interface DisclosureBinding {
  * change to no owner at all, stored with `inboxId: ''`.
  */
 type OwnerScope = "owner" | "prospective" | "global";
-/**
- * The file operations a lock is made of, one method each, so a test can count and interrupt every one of them: the
- * create that is the attempt, the read that checks a holder, the touch that renews, the unlink that releases.
- * `withFileLock` uses the real ones; `tryFileLock` takes another for a caller whose every step is counted.
- */
-interface LockIo {
-  /** Creates `path` exclusively (`wx`, 0600) holding `body`: the one attempt to take the lock. */
-  create(path: string, body: string): Promise<void>;
-  /** The lock file's text: a holder's body. */
-  read(path: string): Promise<string>;
-  /** The lock file's modification time, in milliseconds: where a renewal shows. */
-  mtime(path: string): Promise<number>;
-  /** Sets the lock file's times to now: a renewal. */
-  touch(path: string): Promise<void>;
-  rename(from: string, to: string): Promise<void>;
-  link(from: string, to: string): Promise<void>;
-  /** Removes a lock file, or one moved aside; a missing one is no error. */
-  remove(path: string): Promise<void>;
-}
 //#endregion
 //#region src/approval-io.d.ts
 /**
@@ -6301,7 +6302,7 @@ export declare const PACKAGE_NAME = "@agentcomms/resend";
  */
 export declare const RESEND_CALLER: CliCommandCaller;
 //#endregion
-//#region ../../node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/types-DUs7mGBv.d.mts
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/types-DUs7mGBv.d.mts
 //#region ../../node_modules/.pnpm/json-schema-typed@8.0.2/node_modules/json-schema-typed/draft_2020_12.d.ts
 type MaybeReadonlyArray<T> = Array<T> | ReadonlyArray<T>;
 type ValueOf<T> = T[keyof T];
@@ -7400,7 +7401,7 @@ declare namespace index_d_exports {
   export { $brand, $input, $output, BRAND, CompileOptions, GlobalMeta, INVALID, Infer$1 as Infer, IssueData, JSONType, NEVER, $RefinementCtx as RefinementCtx, SafeExtendShape, Schema, TimePrecision, TypeOf, ZodAny, ZodArray, ZodBase64, ZodBase64URL, ZodBigInt, ZodBigIntFormat, ZodBoolean, ZodCIDRv4, ZodCIDRv6, ZodCUID, ZodCUID2, ZodCatch, ZodCodec, ZodCoercedBigInt, ZodCoercedBoolean, ZodCoercedDate, ZodCoercedNumber, ZodCoercedString, ZodCompileAsyncError, ZodCompileUnsupportedError, ZodCreditCard, ZodCustom, ZodCustomStringFormat, ZodDate, ZodDefault, ZodDiscriminatedUnion, ZodE164, ZodEmail, ZodEmoji, ZodEnum, ZodError, ZodErrorMap, ZodExactOptional, ZodFile, ZodFirstPartySchemaTypes, ZodFirstPartyTypeKind, ZodFlattenedError, ZodFloat32, ZodFloat64, ZodFormattedError, ZodFunction, ZodGUID, ZodIBAN, ZodIPv4, ZodIPv6, ZodISODate, ZodISODateTime, ZodISODuration, ZodISOTime, ZodInstanceOf, ZodInt, ZodInt32, ZodInt64, ZodIntersection, ZodIssue, ZodIssueCode, ZodJSONSchema, ZodJSONSchemaInternals, ZodJWT, ZodKSUID, ZodLazy, ZodLiteral, ZodMAC, ZodMap, ZodNaN, ZodNanoID, ZodNever, ZodNonOptional, ZodNull, ZodNullable, ZodNumber, ZodNumberFormat, ZodObject, ZodOptional, ZodPipe, ZodPrefault, ZodPreprocess, ZodPromise, ZodRawShape$1 as ZodRawShape, ZodReadonly, ZodRealError, ZodRecord, ZodSafeParseError, ZodSafeParseResult, ZodSafeParseSuccess, ZodSchema, ZodSet, ZodStandardSchemaWithJSON, ZodString, ZodStringFormat, ZodSuccess, ZodSymbol, ZodTemplateLiteral, ZodTransform, ZodTuple, ZodType, ZodTypeAny, ZodUInt32, ZodUInt64, ZodULID, ZodURL, ZodUUID, ZodUndefined, ZodUnion, ZodUnknown, ZodVoid, ZodXID, ZodXor, _ZodBigInt, _ZodBoolean, _ZodDate, _ZodNumber, _ZodString, _ZodType, _default, _function, any, array, base64, base64url, bigint$1 as bigint, boolean$1 as boolean, _catch as catch, check, cidrv4, cidrv6, clone, codec, coerce_d_exports as coerce, compile, config, index_d_exports$1 as core, creditCard, cuid, cuid2, currencyCode, custom, date$2 as date, decode, decodeAsync, deepPartial, external_d_exports as default, describe, discriminatedUnion, e164, email, emoji, encode, encodeAsync, _endsWith as endsWith, _enum as enum, exactOptional, file, flattenError, float32, float64, formatError, fromJSONSchema, _function as function, getDiscriminatedOption, getErrorMap, globalRegistry, _gt as gt, _gte as gte, guid, hash, hex, hostname, httpUrl, iban, _includes as includes, output$1 as infer, inferFlattenedErrors, inferFormattedError, input, _instanceof as instanceof, int, int32, int64, intersection, invertCodec, ipv4, ipv6, iso_d_exports as iso, json, jwt, keyof, ksuid, lazy, _length as length, literal, index_d_exports$2 as locales, looseObject, looseRecord, _lowercase as lowercase, _lt as lt, _lte as lte, mac, map, _maxLength as maxLength, _maxSize as maxSize, memoizer, meta, _mime as mime, _minLength as minLength, _minSize as minSize, _multipleOf as multipleOf, nan, nanoid, nativeEnum, _negative as negative, never, _nonnegative as nonnegative, nonoptional, _nonpositive as nonpositive, _normalize as normalize, _null as null, nullable, nullish, number$1 as number, object, optional, output, _overwrite as overwrite, parse, parseAsync, partialRecord, pipe, _positive as positive, prefault, preprocess, prettifyError, promise, _properties as properties, _property as property, readonly, record, refine, _regex as regex, regexes_d_exports as regexes, registry, safeDecode, safeDecodeAsync, safeEncode, safeEncodeAsync, safeParse, safeParseAsync, set, setErrorMap, _size as size, _slugify as slugify, _startsWith as startsWith, strictObject, string$1 as string, stringFormat, stringbool, success, superRefine, symbol, templateLiteral, toJSONSchema, _toLowerCase as toLowerCase, _toUpperCase as toUpperCase, toZod, transform, treeifyError, _trim as trim, tuple, uint32, uint64, ulid, _undefined as undefined, union, unknown, _uppercase as uppercase, url, util_d_exports as util, uuid, uuidv4, uuidv6, uuidv7, validate, validateAsync, _void as void, withParser, xid, xor, external_d_exports as z };
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@modelcontextprotocol+core@2.0.0/node_modules/@modelcontextprotocol/core/dist/auth-BWdKR39I.d.mts
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+core@2.3.1/node_modules/@modelcontextprotocol/core/dist/auth-Anm-lwWi.d.mts
 //#region src/types.d.ts
 type JSONValue = string | number | boolean | null | JSONObject | JSONArray;
 type JSONObject = {
@@ -7453,6 +7454,33 @@ declare const NotificationSchema: ZodObject<{
     }, $loose>>;
   }, $loose>>;
 }, $strip>;
+/**
+ * The contents of a result's `_meta` field (the 2026-07-28 `ResultMetaObject`).
+ * Loose — implementation-specific keys pass through.
+ *
+ * The serverInfo key identifies the server software producing the response
+ * (servers SHOULD include it on every response; the value is self-reported
+ * and intended for display, logging, and debugging). The getter defers the
+ * `ImplementationSchema` reference, which is declared later in this file.
+ */
+declare const ResultMetaObjectSchema: ZodObject<{
+  readonly "io.modelcontextprotocol/serverInfo": ZodCatch<ZodOptional<ZodObject<{
+    version: ZodString;
+    websiteUrl: ZodOptional<ZodString>;
+    description: ZodOptional<ZodString>;
+    icons: ZodOptional<ZodArray<ZodObject<{
+      src: ZodString;
+      mimeType: ZodOptional<ZodString>;
+      sizes: ZodOptional<ZodArray<ZodString>>;
+      theme: ZodOptional<ZodEnum<{
+        light: "light";
+        dark: "dark";
+      }>>;
+    }, $strip>>>;
+    name: ZodString;
+    title: ZodOptional<ZodString>;
+  }, $strip>>>;
+}, $loose>;
 declare const ResultSchema: ZodObject<{
   /**
    * See [MCP specification](https://modelcontextprotocol.io/specification/2026-07-28/basic/index#general-fields)
@@ -11131,7 +11159,7 @@ declare const ServerNotificationSchema: ZodUnion<readonly [ZodObject<{
   }, $strip>;
 }, $strip>]>;
 //#endregion
-//#region ../../node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/createMcpHandler-CLhGwQTn.d.mts
+//#region ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/createMcpHandler-D4NN8WsG.d.mts
 //#endregion
 //#region ../core-internal/src/errors/sdkErrors.d.ts
 /**
@@ -11257,7 +11285,17 @@ declare class SdkError extends Error {
    * silently matching nothing).
    */
   static isInstance<T$1 extends abstract new (...args: never[]) => unknown>(this: T$1, value: unknown): value is InstanceType<T$1>;
-  constructor(code: SdkErrorCode, message: string, data?: unknown | undefined);
+  /**
+   * @param code - Stable string code identifying the failure ({@linkcode SdkErrorCode}).
+   * @param message - Human-readable description.
+   * @param data - Optional structured payload (for example the HTTP status carried by
+   * {@linkcode SdkHttpError}). Opaque to the SDK: a `cause` key inside `data` is not
+   * promoted to `Error.cause`.
+   * @param options - Standard `ErrorOptions`, forwarded to `Error`. Pass the underlying
+   * failure as `{ cause }` so it is reachable through the `Error.cause` chain that
+   * loggers and error trackers walk.
+   */
+  constructor(code: SdkErrorCode, message: string, data?: unknown | undefined, options?: ErrorOptions);
 }
 type Primitive = string | number | boolean | bigint | null | undefined;
 type Flatten<T$1> = T$1 extends Primitive ? T$1 : T$1 extends Array<infer U> ? Array<Flatten<U>> : T$1 extends Set<infer U> ? Set<Flatten<U>> : T$1 extends Map<infer K, infer V> ? Map<Flatten<K>, Flatten<V>> : T$1 extends object ? { [K in keyof T$1]: Flatten<T$1[K]>; } : T$1;
@@ -11515,6 +11553,18 @@ interface AuthInfo {
    * If set, this MUST match the MCP server's resource identifier (minus hash fragment).
    */
   resource?: URL;
+  /**
+   * URL of the RFC 9728 Protected Resource Metadata document for the
+   * resource server that accepted this token.
+   *
+   * The bearer-auth helpers stamp their configured `resourceMetadataUrl`
+   * here when verification succeeds, so challenge responses built after
+   * authentication (for example per-operation `insufficient_scope` scope
+   * challenges) can advertise the same document as the authentication
+   * gate's own challenges without separate configuration. Verifiers may
+   * also populate it directly; a verifier-set value wins.
+   */
+  resourceMetadataUrl?: string;
   /**
    * Additional data associated with the token.
    * This field should be used for any additional data that needs to be attached to the auth info.
@@ -11573,6 +11623,11 @@ interface MessageExtraInfo {
    */
   closeStandaloneSSEStream?: () => void;
 }
+/**
+ * The contents of a result's `_meta` field (the 2026-07-28 `ResultMetaObject`):
+ * loose, with the optional self-reported serverInfo key typed when present.
+ */
+type ResultMetaObject = Infer<typeof ResultMetaObjectSchema>;
 /**
  * {@linkcode CreateMessageRequestParams} without tools - for backwards-compatible overload.
  * Excludes tools/toolChoice to indicate they should not be provided.
@@ -11666,6 +11721,8 @@ type DecodedResult = {
    */
   inputRequests: Record<string, unknown>;
   requestState?: string;
+  /** Result-level `_meta`, carried through so a manual caller sees it. */
+  _meta?: ResultMetaObject;
 } | {
   kind: 'invalid';
   error: SdkError;
@@ -12281,6 +12338,8 @@ declare abstract class Protocol<ContextT extends BaseContext> {
   private _transport?;
   private _requestMessageId;
   private _requestHandlers;
+  /** Methods registered with an explicit schema; the era gate in `_onrequest` reads it for the Tasks extension names. */
+  private _customSchemaRequestMethods;
   private _requestHandlerAbortControllers;
   private _notificationHandlers;
   private _responseHandlers;
@@ -12664,6 +12723,20 @@ declare class UriTemplate {
   match(uri: string): Variables | null;
 }
 //#endregion
+//#region src/server/scopeChallenge.d.ts
+/** OAuth scopes to request before handling an MCP request. */
+interface ScopeChallenge {
+  /** The exact, complete scope set to include in the challenge. Each scope must satisfy the OAuth `scope-token` grammar. */
+  scopes: readonly [string, ...string[]];
+  /** Optional human-readable detail satisfying the RFC 6750 `error-description` grammar. */
+  errorDescription?: string;
+}
+/** Determines whether an MCP request needs an OAuth scope challenge. */
+type ScopeChallengeHandler = (context: {
+  request: JSONRPCRequest;
+  authInfo?: AuthInfo;
+}) => ScopeChallenge | undefined | Promise<ScopeChallenge | undefined>;
+//#endregion
 //#region src/server/server.d.ts
 type ServerOptions = ProtocolOptions & {
   /**
@@ -12805,6 +12878,8 @@ declare class Server extends Protocol<ServerContext> {
    * Initializes this server with the given name and version information.
    */
   constructor(_serverInfo: Implementation, options?: ServerOptions);
+  /** Attaches to the given transport; rejects while this instance is connected to another one. */
+  connect(transport: Transport): Promise<void>;
   /**
    * Registers the built-in `logging/setLevel` request handler.
    *
@@ -13063,6 +13138,16 @@ declare class Server extends Protocol<ServerContext> {
 }
 //#endregion
 //#region src/server/mcp.d.ts
+/**
+ * Options for {@linkcode McpServer}: everything {@linkcode ServerOptions} accepts, plus `maxToolInputElements`.
+ */
+type McpServerOptions = ServerOptions & {
+  /**
+   * Largest combined number of array elements and object members a single `tools/call` `arguments` payload may contain.
+   * A number of at least 1; unset or `Infinity` means no limit.
+   */
+  maxToolInputElements?: number;
+};
 /**
  * High-level MCP server that provides a simpler API for working with resources, tools, and prompts.
  * For advanced usage (like sending notifications or setting custom request handlers), use the underlying
@@ -13081,16 +13166,12 @@ declare class McpServer {
    * The underlying {@linkcode Server} instance, useful for advanced operations like sending notifications.
    */
   readonly server: Server;
+  private readonly _maxToolInputElements;
   private _registeredResources;
   private _registeredResourceTemplates;
   private _registeredTools;
   private _registeredPrompts;
-  /**
-   * Per-tool JSON-converted `inputSchema`, memoized so the SEP-2243
-   * registration-time scan and the pre-dispatch validation step share one
-   * conversion instead of paying it twice per request under the
-   * per-request-factory `createMcpHandler` model.
-   */
+  /** Per-tool JSON-converted `inputSchema`, filled on first use by `toolInputSchemaJson()`. */
   private _toolInputSchemaJson;
   /**
    * The JSON-serialized `inputSchema` of a registered tool, or `undefined`
@@ -13101,7 +13182,7 @@ declare class McpServer {
    * @internal
    */
   toolInputSchemaJson(name: string): Record<string, unknown> | undefined;
-  constructor(serverInfo: Implementation, options?: ServerOptions);
+  constructor(serverInfo: Implementation, options?: McpServerOptions);
   /**
    * Attaches to the given transport, starts it, and starts listening for messages.
    *
@@ -13119,6 +13200,8 @@ declare class McpServer {
    * Closes the connection.
    */
   close(): Promise<void>;
+  /** @internal */
+  resolveScopeChallenge: ScopeChallengeHandler;
   private _toolHandlersInitialized;
   private setToolRequestHandlers;
   /**
@@ -13169,9 +13252,11 @@ declare class McpServer {
    */
   registerResource(name: string, uriOrTemplate: string, config: ResourceMetadata & {
     cacheHint?: CacheHint;
+    scopeChallenge?: ScopeChallengeHandler;
   }, readCallback: ReadResourceCallback): RegisteredResource;
   registerResource(name: string, uriOrTemplate: ResourceTemplate, config: ResourceMetadata & {
     cacheHint?: CacheHint;
+    scopeChallenge?: ScopeChallengeHandler;
   }, readCallback: ReadResourceTemplateCallback): RegisteredResourceTemplate;
   private _createRegisteredResource;
   private _createRegisteredResourceTemplate;
@@ -13210,6 +13295,8 @@ declare class McpServer {
     outputSchema?: OutputArgs;
     annotations?: ToolAnnotations;
     icons?: Icon[];
+    /** Determines whether this tool call needs an OAuth scope challenge. */
+    scopeChallenge?: ScopeChallengeHandler;
     _meta?: Record<string, unknown>;
   }, cb: ToolCallback<InputArgs>): RegisteredTool;
   /** @deprecated Wrap with `z.object({...})` instead. Raw-shape form: `inputSchema`/`outputSchema` may be a plain `{ field: z.string() }` record; it is auto-wrapped with `z.object()`. */
@@ -13220,6 +13307,7 @@ declare class McpServer {
     outputSchema?: OutputArgs;
     annotations?: ToolAnnotations;
     icons?: Icon[];
+    scopeChallenge?: ScopeChallengeHandler;
     _meta?: Record<string, unknown>;
   }, cb: LegacyToolCallback<InputArgs>): RegisteredTool;
   /**
@@ -13248,11 +13336,22 @@ declare class McpServer {
    * );
    * ```
    */
+  registerPrompt(name: string, config: {
+    title?: string;
+    description?: string;
+    argsSchema?: undefined;
+    icons?: Icon[];
+    /** Determines whether this prompt retrieval needs an OAuth scope challenge. */
+    scopeChallenge?: ScopeChallengeHandler;
+    _meta?: Record<string, unknown>;
+  }, cb: PromptCallback): RegisteredPrompt;
   registerPrompt<Args extends StandardSchemaWithJSON>(name: string, config: {
     title?: string;
     description?: string;
     argsSchema?: Args;
     icons?: Icon[];
+    /** Determines whether this prompt retrieval needs an OAuth scope challenge. */
+    scopeChallenge?: ScopeChallengeHandler;
     _meta?: Record<string, unknown>;
   }, cb: PromptCallback<Args>): RegisteredPrompt;
   /** @deprecated Wrap with `z.object({...})` instead. Raw-shape form: `argsSchema` may be a plain `{ field: z.string() }` record; it is auto-wrapped with `z.object()`. */
@@ -13261,6 +13360,7 @@ declare class McpServer {
     description?: string;
     argsSchema?: Args;
     icons?: Icon[];
+    scopeChallenge?: ScopeChallengeHandler;
     _meta?: Record<string, unknown>;
   }, cb: LegacyPromptCallback<Args>): RegisteredPrompt;
   /**
@@ -13371,7 +13471,7 @@ type RegisteredTool = {
   outputSchema?: StandardSchemaWithJSON;
   /**
    * @hidden
-   * The converted JSON Schema of `outputSchema`, memoised at registration (and on
+   * The converted JSON Schema of `outputSchema`, memoised on first use (and on
    * `update({outputSchema})`) so the `tools/call` handler passes the SAME advertised schema
    * `tools/list` emits to the wire codec's `projectCallToolResult` — the SEP-2106 `{result:…}`
    * wrap predicate follows the schema's root, never the runtime value shape. `undefined` when
@@ -13381,6 +13481,7 @@ type RegisteredTool = {
   annotations?: ToolAnnotations;
   icons?: Icon[];
   execution?: ToolExecution;
+  scopeChallenge?: ScopeChallengeHandler;
   _meta?: Record<string, unknown>;
   handler: AnyToolHandler<StandardSchemaWithJSON | undefined>;
   /** @hidden */
@@ -13396,6 +13497,7 @@ type RegisteredTool = {
     outputSchema?: StandardSchemaWithJSON;
     annotations?: ToolAnnotations;
     icons?: Icon[];
+    scopeChallenge?: ScopeChallengeHandler | null;
     _meta?: Record<string, unknown>;
     callback?: ToolCallback<StandardSchemaWithJSON>;
     enabled?: boolean;
@@ -13420,6 +13522,7 @@ type RegisteredResource = {
   metadata?: ResourceMetadata;
   /** Cache hint applied to this resource's `resources/read` results on the 2026-07-28 revision. */
   cacheHint?: CacheHint;
+  scopeChallenge?: ScopeChallengeHandler;
   readCallback: ReadResourceCallback;
   enabled: boolean;
   enable(): void;
@@ -13429,6 +13532,7 @@ type RegisteredResource = {
     title?: string;
     uri?: string | null;
     metadata?: ResourceMetadata;
+    scopeChallenge?: ScopeChallengeHandler | null;
     callback?: ReadResourceCallback;
     enabled?: boolean;
   }): void;
@@ -13444,6 +13548,7 @@ type RegisteredResourceTemplate = {
   metadata?: ResourceMetadata;
   /** Cache hint applied to this template's `resources/read` results on the 2026-07-28 revision. */
   cacheHint?: CacheHint;
+  scopeChallenge?: ScopeChallengeHandler;
   readCallback: ReadResourceTemplateCallback;
   enabled: boolean;
   enable(): void;
@@ -13453,6 +13558,7 @@ type RegisteredResourceTemplate = {
     title?: string;
     template?: ResourceTemplate;
     metadata?: ResourceMetadata;
+    scopeChallenge?: ScopeChallengeHandler | null;
     callback?: ReadResourceTemplateCallback;
     enabled?: boolean;
   }): void;
@@ -13469,6 +13575,7 @@ type RegisteredPrompt = {
   description?: string;
   argsSchema?: StandardSchemaWithJSON;
   icons?: Icon[];
+  scopeChallenge?: ScopeChallengeHandler;
   _meta?: Record<string, unknown>;
   /** @hidden */
   handler: PromptHandler;
@@ -13481,6 +13588,7 @@ type RegisteredPrompt = {
     description?: string;
     argsSchema?: Args;
     icons?: Icon[];
+    scopeChallenge?: ScopeChallengeHandler | null;
     _meta?: Record<string, unknown>;
     callback?: PromptCallback<Args>;
     enabled?: boolean;

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { Bt as RESEND_DOWNLOAD_ORIGIN, Et as stripInvisible, H as CommsError, Ht as VERSION, It as PACKAGE_NAME, Lt as RESEND_CALLER, N as resendRequest, P as ResendContext, Rt as REFUSED, Vt as ROUTES, b as readBody, ft as neutralise, h as resendId, pt as newBoundary, v as addressesOf, y as attachmentRisks, z as keyPermissionOf, zt as RESEND_API_ORIGIN } from "./send-DEor7f1N.mjs";
-import { t as createResendMcpServer } from "./server-xhrQV9qo.mjs";
+import { Bt as RESEND_DOWNLOAD_ORIGIN, Et as stripInvisible, H as CommsError, Ht as VERSION, It as PACKAGE_NAME, Lt as RESEND_CALLER, N as resendRequest, P as ResendContext, Rt as REFUSED, Vt as ROUTES, b as readBody, ft as neutralise, h as resendId, pt as newBoundary, v as addressesOf, y as attachmentRisks, z as keyPermissionOf, zt as RESEND_API_ORIGIN } from "./send-D-SXJezp.mjs";
+import { t as createResendMcpServer } from "./server-BZOLLDTu.mjs";
 //#region src/operations/events.ts
 const BODY_LIMIT = 2e4;
 const STATUS = /* @__PURE__ */ new Set([