@alvin0/ai-agent-sdk-mcp 0.1.0

package/dist/client-D7Th3S7z.js

@@ -0,0 +1,1250 @@
+import { Client, InsufficientScopeError, SSEClientTransport, StreamableHTTPClientTransport, UnauthorizedError } from "@modelcontextprotocol/client";
+import { ToolRegistry } from "@alvin0/ai-agent-sdk-core/tools";
+import { isJsonValue, waitForSettlement } from "@alvin0/ai-agent-sdk-core";
+
+//#region src/client/result.ts
+var McpRemoteToolError = class extends Error {
+	result;
+	constructor(serverName, toolName, result) {
+		super(`MCP tool '${serverName}/${toolName}' failed: ${resultText(result)}`);
+		this.name = "McpRemoteToolError";
+		this.result = result;
+	}
+};
+var McpConnectionError = class extends Error {
+	stage;
+	failure;
+	cleanup;
+	code = "MCP_CONNECT_FAILED";
+	constructor(stage, failure, cleanup, cause) {
+		super(`MCP connection failed during ${stage}`, { cause });
+		this.stage = stage;
+		this.failure = failure;
+		this.cleanup = cleanup;
+		this.name = "McpConnectionError";
+	}
+};
+function connectionFailureStage(status) {
+	if (status === "authentication-failed" || status === "authentication-required" || status === "oauth-authorization-required" || status === "scope-authorization-required") return "authentication";
+	if (status === "connecting") return "handshake";
+	return "unknown";
+}
+function protocolState(client, transport, fallback) {
+	const version = client.getNegotiatedProtocolVersion();
+	return Object.freeze({
+		era: client.getProtocolEra() ?? "legacy",
+		...version === void 0 ? {} : { version },
+		transport,
+		fallback
+	});
+}
+function normalizeResult(result) {
+	const content = result.content.map((block, index) => {
+		if (!isJsonValue(block)) throw new TypeError(`MCP result content[${index}] is not lossless JSON`);
+		return block;
+	});
+	const structured = result.structuredContent;
+	if (structured !== void 0 && !isJsonValue(structured)) throw new TypeError("MCP structuredContent is not lossless JSON");
+	return {
+		content,
+		...structured === void 0 ? {} : { structuredContent: structured }
+	};
+}
+function renderMcpResult(value) {
+	if (!isJsonObject$1(value) || !Array.isArray(value.content)) return [{
+		type: "text",
+		text: value === void 0 ? "(no output)" : JSON.stringify(value, null, 2)
+	}];
+	const blocks = value.content.flatMap((block) => renderRemoteBlock(block));
+	return blocks.length === 0 ? [{
+		type: "text",
+		text: "(no output)"
+	}] : blocks;
+}
+function renderRemoteBlock(value) {
+	if (!isJsonObject$1(value) || typeof value.type !== "string") return [{
+		type: "text",
+		text: JSON.stringify(value)
+	}];
+	if (value.type === "text" && typeof value.text === "string") return [{
+		type: "text",
+		text: value.text
+	}];
+	if (value.type === "image" && typeof value.data === "string" && typeof value.mimeType === "string" && isImageMediaType(value.mimeType)) return [{
+		type: "image",
+		source: {
+			kind: "base64",
+			mediaType: value.mimeType,
+			data: value.data
+		}
+	}];
+	if (value.type === "resource" && isJsonObject$1(value.resource) && typeof value.resource.text === "string") return [{
+		type: "text",
+		text: value.resource.text
+	}];
+	if (value.type === "resource_link" && typeof value.uri === "string") return [{
+		type: "text",
+		text: `[MCP resource: ${typeof value.name === "string" ? value.name : value.uri}](${value.uri})`
+	}];
+	return [{
+		type: "text",
+		text: JSON.stringify(value, null, 2)
+	}];
+}
+function resultText(result) {
+	return result.content.filter((block) => typeof block === "object" && block !== null && "type" in block && block.type === "text" && "text" in block && typeof block.text === "string").map((block) => block.text).join("\n").trim() || "remote tool returned an error";
+}
+function isJsonObject$1(value) {
+	return isJsonValue(value) && typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isImageMediaType(value) {
+	return value === "image/jpeg" || value === "image/png" || value === "image/gif" || value === "image/webp";
+}
+
+//#endregion
+//#region src/common/integration-operation.ts
+const MCP_INTEGRATION_OPERATIONS = Object.freeze({
+	"mcp-http-client": Object.freeze([
+		"connect",
+		"authenticate",
+		"catalog-refresh",
+		"reconnect",
+		"tool-call",
+		"close"
+	]),
+	"mcp-stdio-client": Object.freeze([
+		"connect",
+		"catalog-refresh",
+		"reconnect",
+		"tool-call",
+		"close"
+	]),
+	"mcp-web-server": Object.freeze([
+		"request",
+		"tool-call",
+		"agent-call"
+	]),
+	"mcp-stdio-server": Object.freeze([
+		"request",
+		"tool-call",
+		"agent-call",
+		"close"
+	])
+});
+const START_MESSAGE = "SDK integration operation started";
+const ATTEMPT_START_MESSAGE = "SDK integration attempt started";
+const SUCCESS_MESSAGE = "SDK integration operation completed";
+const FAILURE_MESSAGE = "SDK integration operation failed";
+const ABORT_MESSAGE = "SDK integration operation aborted";
+function beginIntegrationOperation(logger, family, operation) {
+	assertIdentity(operation, 64, "integration operation");
+	const operationId = operationIdentity();
+	const startedAt = monotonicNow();
+	emit(logger, "info", START_MESSAGE, {
+		integrationSchemaVersion: 1,
+		integrationFamily: family,
+		integrationOperation: operation,
+		operationId,
+		kind: "logical-start"
+	});
+	let terminal = false;
+	const finish = (status, errorCode) => {
+		if (terminal) return;
+		terminal = true;
+		const fields = {
+			integrationSchemaVersion: 1,
+			integrationFamily: family,
+			integrationOperation: operation,
+			operationId,
+			kind: "logical-terminal",
+			status,
+			durationMs: durationSince(startedAt),
+			...errorCode === void 0 ? {} : { errorCode: boundedCode(errorCode) }
+		};
+		emit(logger, status === "error" ? "error" : "info", status === "success" ? SUCCESS_MESSAGE : status === "error" ? FAILURE_MESSAGE : ABORT_MESSAGE, fields);
+	};
+	return {
+		attempt(attemptNumber) {
+			if (!Number.isSafeInteger(attemptNumber) || attemptNumber < 1) throw new TypeError("integration attemptNumber must be a positive safe integer");
+			const attemptId = operationIdentity(), attemptStartedAt = monotonicNow();
+			emit(logger, "info", ATTEMPT_START_MESSAGE, {
+				integrationSchemaVersion: 1,
+				integrationFamily: family,
+				integrationOperation: operation,
+				operationId,
+				kind: "attempt-start",
+				attemptId,
+				attemptNumber
+			});
+			let attemptTerminal = false;
+			const finishAttempt = (status, errorCode) => {
+				if (attemptTerminal) return;
+				attemptTerminal = true;
+				emit(logger, status === "error" ? "error" : "info", status === "success" ? SUCCESS_MESSAGE : status === "error" ? FAILURE_MESSAGE : ABORT_MESSAGE, {
+					integrationSchemaVersion: 1,
+					integrationFamily: family,
+					integrationOperation: operation,
+					operationId,
+					kind: "attempt-terminal",
+					attemptId,
+					attemptNumber,
+					status,
+					durationMs: durationSince(attemptStartedAt),
+					...errorCode === void 0 ? {} : { errorCode: boundedCode(errorCode) }
+				});
+			};
+			return {
+				success: () => finishAttempt("success"),
+				fail: (code) => finishAttempt("error", code),
+				abort: () => finishAttempt("aborted")
+			};
+		},
+		success: () => finish("success"),
+		fail: (code) => finish("error", code),
+		abort: () => finish("aborted")
+	};
+}
+function integrationErrorCode(error) {
+	if (typeof error === "object" && error !== null) {
+		const code = Object.getOwnPropertyDescriptor(error, "code");
+		if (code !== void 0 && "value" in code && typeof code.value === "string") return boundedCode(code.value);
+		const name = Object.getOwnPropertyDescriptor(error, "name");
+		if (name !== void 0 && "value" in name && typeof name.value === "string") return boundedCode(name.value);
+	}
+	return "INTEGRATION_ERROR";
+}
+function emit(logger, level, message, fields) {
+	try {
+		logger?.[level](message, fields);
+	} catch {}
+}
+function operationIdentity() {
+	return globalThis.crypto.randomUUID();
+}
+function monotonicNow() {
+	return globalThis.performance?.now() ?? Date.now();
+}
+function durationSince(startedAt) {
+	const value = monotonicNow() - startedAt;
+	return Number.isFinite(value) ? Math.max(0, value) : 0;
+}
+function boundedCode(value) {
+	const normalized = value.replace(/[^A-Za-z0-9_.:-]/g, "_");
+	return (normalized.length === 0 ? "INTEGRATION_ERROR" : normalized).slice(0, 128);
+}
+function assertIdentity(value, limit, label) {
+	if (value.length === 0 || value.length > limit) throw new TypeError(`${label} must contain 1-${limit} characters`);
+}
+
+//#endregion
+//#region src/common/support-error.ts
+const NO_USAGE = Object.freeze({
+	logicalCalls: 0,
+	attempts: 0,
+	complete: 0,
+	partial: 0,
+	estimated: 0,
+	missing: 0,
+	notApplicable: 0,
+	possiblyBilledAttemptsWithoutUsage: 0
+});
+function mcpSupportError(code, stage, message) {
+	return Object.freeze({
+		code,
+		stage,
+		message,
+		usageCoverage: NO_USAGE,
+		possiblyBilledAttemptsWithoutUsage: 0
+	});
+}
+
+//#endregion
+//#region src/client/close.ts
+/** Run every cleanup task under one deadline and retain only support-safe outcomes. */
+async function executeMcpClosePlan(plan) {
+	const operation = beginIntegrationOperation(plan.logger, plan.family, "close");
+	const attempt = operation.attempt(1);
+	const states = plan.tasks.map(() => "pending");
+	const tasks = plan.tasks.map(async (task, index) => {
+		try {
+			await Promise.resolve().then(task);
+			states[index] = "succeeded";
+		} catch {
+			states[index] = "failed";
+		}
+	});
+	let aborted = plan.signal?.aborted === true;
+	let removeAbort = () => void 0;
+	const abortObserved = plan.signal === void 0 ? new Promise(() => void 0) : new Promise((resolve) => {
+		const observe = () => {
+			aborted = true;
+			resolve();
+		};
+		plan.signal?.addEventListener("abort", observe, { once: true });
+		removeAbort = () => plan.signal?.removeEventListener("abort", observe);
+		if (plan.signal?.aborted === true) observe();
+	});
+	await Promise.race([waitForSettlement(Promise.all(tasks), plan.timeoutMs), abortObserved]);
+	removeAbort();
+	const unsettledOperations = states.filter((state) => state === "pending").length;
+	const failed = states.includes("failed");
+	const error = aborted && unsettledOperations > 0 ? mcpSupportError("MCP_CLOSE_ABORTED", "mcp-close", "MCP cleanup was interrupted before it settled") : unsettledOperations > 0 ? mcpSupportError("MCP_CLOSE_TIMEOUT", "mcp-close", "MCP cleanup did not settle before its deadline") : failed ? mcpSupportError("MCP_CLOSE_FAILED", "mcp-close", "MCP cleanup failed") : void 0;
+	if (error === void 0) {
+		attempt.success();
+		operation.success();
+	} else {
+		attempt.fail(error.code);
+		operation.fail(error.code);
+	}
+	return Object.freeze({
+		state: "closed",
+		deadlineReached: !aborted && unsettledOperations > 0,
+		unsettledOperations,
+		...error === void 0 ? {} : { error }
+	});
+}
+
+//#endregion
+//#region src/client/config.ts
+/** Internal defaults shared by MCP client lifecycle, HTTP policy, and reconnect code. */
+const MCP_CLIENT_DEFAULTS = Object.freeze({
+	toolCallTimeoutMs: 12e4,
+	operationTimeoutMs: 12e4,
+	closeTimeoutMs: 3e4,
+	maxTools: 1024,
+	maxCatalogBytes: 4194304,
+	maxToolResultBytes: 4194304,
+	maxTransportBytes: 16777216,
+	maxRedirectHops: 10
+});
+const MCP_RECONNECT_DEFAULTS = Object.freeze({
+	enabled: true,
+	initialDelayMs: 500,
+	maxDelayMs: 3e4,
+	maxAttempts: 10
+});
+const MCP_HTTP_REDIRECT_STATUSES = Object.freeze([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+
+//#endregion
+//#region src/client/runtime-helpers.ts
+function resolveMcpReconnectOptions(input) {
+	if (input === false) return Object.freeze({
+		...MCP_RECONNECT_DEFAULTS,
+		enabled: false
+	});
+	const resolved = {
+		enabled: input?.enabled ?? MCP_RECONNECT_DEFAULTS.enabled,
+		initialDelayMs: input?.initialDelayMs ?? MCP_RECONNECT_DEFAULTS.initialDelayMs,
+		maxDelayMs: input?.maxDelayMs ?? MCP_RECONNECT_DEFAULTS.maxDelayMs,
+		maxAttempts: input?.maxAttempts ?? MCP_RECONNECT_DEFAULTS.maxAttempts
+	};
+	timeoutMilliseconds(resolved.initialDelayMs, "reconnect.initialDelayMs");
+	timeoutMilliseconds(resolved.maxDelayMs, "reconnect.maxDelayMs");
+	if (resolved.initialDelayMs > resolved.maxDelayMs) throw new TypeError("reconnect.initialDelayMs must be less than or equal to reconnect.maxDelayMs");
+	if (!Number.isInteger(resolved.maxAttempts) || resolved.maxAttempts < 1) throw new TypeError("reconnect.maxAttempts must be a positive integer");
+	return Object.freeze(resolved);
+}
+function authenticationKindOf(provider, headers) {
+	if (provider === void 0) return headers.has("authorization") ? "bearer" : "none";
+	return isOAuthClientProvider(provider) ? "oauth" : "bearer";
+}
+function isOAuthClientProvider(provider) {
+	if (typeof provider !== "object" || provider === null) return false;
+	const candidate = provider;
+	return typeof candidate.clientInformation === "function" && typeof candidate.tokens === "function" && typeof candidate.saveTokens === "function" && typeof candidate.redirectToAuthorization === "function" && typeof candidate.saveCodeVerifier === "function" && typeof candidate.codeVerifier === "function";
+}
+function filterRemoteTools(tools, filter) {
+	const allow = filter?.allow === void 0 ? void 0 : new Set(filter.allow);
+	const deny = new Set(filter?.deny ?? []);
+	return tools.filter((tool) => (allow === void 0 || allow.has(tool.name)) && !deny.has(tool.name));
+}
+function publicToolName(serverName, remoteName, prefixed) {
+	return prefixed ? `mcp__${serverName}__${remoteName}` : remoteName;
+}
+function isJsonObject(value) {
+	return isJsonValue(value) && typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function assertServerName(name) {
+	if (!/^[A-Za-z][A-Za-z0-9_-]{0,63}$/.test(name)) throw new TypeError("MCP serverName must match /^[A-Za-z][A-Za-z0-9_-]{0,63}$/");
+}
+function positiveSafeInteger(value, field) {
+	if (!Number.isSafeInteger(value) || value < 1) throw new TypeError(`${field} must be a positive safe integer`);
+	return value;
+}
+function timeoutMilliseconds(value, field) {
+	if (!Number.isSafeInteger(value) || value < 1 || value > 2147483647) throw new RangeError(`${field} must be an integer between 1 and 2147483647 milliseconds`);
+	return value;
+}
+function serializedBytes(value) {
+	const serialized = JSON.stringify(value);
+	if (serialized === void 0) throw new TypeError("MCP value is not JSON serializable");
+	return new TextEncoder().encode(serialized).byteLength;
+}
+var McpOperationTimeoutError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "McpOperationTimeoutError";
+	}
+};
+function createAbortTimeoutScope(timeoutMs, message, callerSignal) {
+	timeoutMilliseconds(timeoutMs, "timeoutMs");
+	const controller = new AbortController();
+	const timeout = new McpOperationTimeoutError(message);
+	const timer = setTimeout(() => controller.abort(timeout), timeoutMs);
+	const signal = callerSignal === void 0 ? controller.signal : AbortSignal.any([callerSignal, controller.signal]);
+	let active = true;
+	const dispose = () => {
+		if (!active) return;
+		active = false;
+		clearTimeout(timer);
+		signal.removeEventListener("abort", dispose);
+	};
+	signal.addEventListener("abort", dispose, { once: true });
+	if (signal.aborted) dispose();
+	return Object.freeze({
+		signal,
+		dispose
+	});
+}
+function withAbortTimeout(operation, timeoutMs, message, callerSignal) {
+	const scope = createAbortTimeoutScope(timeoutMs, message, callerSignal);
+	let pending;
+	try {
+		scope.signal.throwIfAborted();
+		pending = Promise.resolve(operation(scope.signal));
+	} catch (error) {
+		scope.dispose();
+		return Promise.reject(error);
+	}
+	return raceAbort(pending, scope.signal).finally(scope.dispose);
+}
+function raceAbort(promise, signal) {
+	if (signal.aborted) {
+		promise.catch(() => void 0);
+		return Promise.reject(signal.reason ?? /* @__PURE__ */ new Error("MCP operation aborted"));
+	}
+	return new Promise((resolve, reject) => {
+		const abort = () => {
+			signal.removeEventListener("abort", abort);
+			reject(signal.reason ?? /* @__PURE__ */ new Error("MCP operation aborted"));
+		};
+		signal.addEventListener("abort", abort, { once: true });
+		promise.then((value) => {
+			signal.removeEventListener("abort", abort);
+			resolve(value);
+		}, (error) => {
+			signal.removeEventListener("abort", abort);
+			reject(error);
+		});
+	});
+}
+function errorOf(value) {
+	return value instanceof Error ? value : new Error(String(value));
+}
+
+//#endregion
+//#region src/client/connection.ts
+/** MCP client lifecycle and remote-tool bridge for Universal runtimes. */
+function isOAuthCapableTransport(transport) {
+	return transport instanceof StreamableHTTPClientTransport || transport instanceof SSEClientTransport;
+}
+function transportKindOf(transport) {
+	if (transport instanceof StreamableHTTPClientTransport) return "streamable-http";
+	if (transport instanceof SSEClientTransport) return "sse";
+	return "custom";
+}
+function shouldTryLegacyTransport(error) {
+	if (UnauthorizedError.isInstance(error) || InsufficientScopeError.isInstance(error)) return false;
+	return !(error instanceof Error && error.name === "AbortError");
+}
+/**
+* Owns one MCP server connection across transport generations.
+*
+* The ToolCatalog object is stable for the lifetime of this connection. A
+* successful list refresh swaps its registrations synchronously; a failed
+* refresh leaves the last-known-good catalog intact.
+*/
+var McpClientConnection = class {
+	kind = "tool-source";
+	apiVersion = 1;
+	id;
+	serverName;
+	tools;
+	options;
+	transportFactory;
+	fallbackTransportFactory;
+	authenticationKind;
+	integrationFamily;
+	toolCallTimeoutMs;
+	operationTimeoutMs;
+	closeTimeoutMs;
+	maxTools;
+	maxCatalogBytes;
+	maxToolResultBytes;
+	reconnect;
+	registry = new ToolRegistry();
+	toolDisposers = [];
+	current;
+	pendingAuthorization;
+	connecting;
+	syncTail = Promise.resolve();
+	pendingToolSyncs = 0;
+	reconnectTimer;
+	reconnectAttempts = 0;
+	catalogRevision = 0;
+	connectedAt;
+	closed = false;
+	closeTask;
+	currentState;
+	constructor(options, transportFactory, runtime = {}) {
+		assertServerName(options.serverName);
+		this.toolCallTimeoutMs = timeoutMilliseconds(options.toolCallTimeoutMs ?? MCP_CLIENT_DEFAULTS.toolCallTimeoutMs, "toolCallTimeoutMs");
+		this.operationTimeoutMs = timeoutMilliseconds(options.operationTimeoutMs ?? MCP_CLIENT_DEFAULTS.operationTimeoutMs, "operationTimeoutMs");
+		this.closeTimeoutMs = timeoutMilliseconds(options.closeTimeoutMs ?? MCP_CLIENT_DEFAULTS.closeTimeoutMs, "closeTimeoutMs");
+		this.maxTools = positiveSafeInteger(options.maxTools ?? MCP_CLIENT_DEFAULTS.maxTools, "maxTools");
+		this.maxCatalogBytes = positiveSafeInteger(options.maxCatalogBytes ?? MCP_CLIENT_DEFAULTS.maxCatalogBytes, "maxCatalogBytes");
+		this.maxToolResultBytes = positiveSafeInteger(options.maxToolResultBytes ?? MCP_CLIENT_DEFAULTS.maxToolResultBytes, "maxToolResultBytes");
+		const toolFilter = options.toolFilter === void 0 ? void 0 : Object.freeze({
+			...options.toolFilter.allow === void 0 ? {} : { allow: Object.freeze([...options.toolFilter.allow]) },
+			...options.toolFilter.deny === void 0 ? {} : { deny: Object.freeze([...options.toolFilter.deny]) }
+		});
+		this.reconnect = resolveMcpReconnectOptions(options.reconnect);
+		this.options = Object.freeze({
+			...options,
+			...toolFilter === void 0 ? {} : { toolFilter }
+		});
+		this.transportFactory = transportFactory;
+		this.fallbackTransportFactory = runtime.fallbackTransportFactory;
+		this.authenticationKind = runtime.authenticationKind ?? "unknown";
+		this.integrationFamily = runtime.integrationFamily ?? "mcp-http-client";
+		this.serverName = options.serverName;
+		this.id = options.serverName;
+		this.tools = this.registry;
+		this.currentState = Object.freeze({
+			status: "idle",
+			serverName: options.serverName,
+			attempt: 0,
+			catalogRevision: 0
+		});
+	}
+	get state() {
+		return this.currentState;
+	}
+	snapshot(options) {
+		options.signal.throwIfAborted();
+		return Object.freeze({
+			revision: String(this.catalogRevision),
+			tools: Object.freeze(this.registry.names().map((name) => this.registry.get(name)))
+		});
+	}
+	async withClient(operation) {
+		const generation = this.current;
+		if (generation === void 0) throw new Error(`MCP server '${this.serverName}' is not connected`);
+		const message = `MCP operation on '${this.serverName}' exceeded ${this.operationTimeoutMs}ms`;
+		try {
+			return await withAbortTimeout((signal) => Promise.resolve().then(() => operation(generation, signal)), this.operationTimeoutMs, message);
+		} catch (error) {
+			if (error instanceof McpOperationTimeoutError && this.current === generation) {
+				this.current = void 0;
+				this.clearTools();
+				await this.closeGeneration(generation);
+				if (!this.closed) this.scheduleReconnect(error);
+			}
+			throw error;
+		}
+	}
+	/** Connect, negotiate capabilities, and publish the first tool snapshot. */
+	connect() {
+		if (this.closed) return Promise.reject(/* @__PURE__ */ new Error(`MCP client '${this.serverName}' is closed`));
+		if (this.current !== void 0 && (this.currentState.status === "ready" || this.currentState.status === "scope-authorization-required")) return Promise.resolve();
+		if (this.pendingAuthorization !== void 0) return Promise.reject(/* @__PURE__ */ new Error(`MCP client '${this.serverName}' is waiting for its OAuth callback`));
+		if (this.connecting !== void 0) return this.connecting;
+		if (this.reconnectTimer !== void 0) {
+			clearTimeout(this.reconnectTimer);
+			this.reconnectTimer = void 0;
+		}
+		const tracked = this.connectGeneration(this.currentState.status === "reconnecting").finally(() => {
+			if (this.connecting === tracked) this.connecting = void 0;
+		});
+		this.connecting = tracked;
+		return tracked;
+	}
+	/** Force a fresh tools/list and atomically replace the published snapshot. */
+	refreshTools(options = {}) {
+		const generation = this.current;
+		if (generation === void 0) return Promise.reject(/* @__PURE__ */ new Error(`MCP server '${this.serverName}' is not connected`));
+		return this.enqueueToolSync(generation, void 0, options.signal);
+	}
+	/**
+	* Validate an OAuth callback, exchange its authorization code on the pending
+	* HTTP transport, then reconnect with a fresh transport generation.
+	*/
+	async finishOAuth(callbackParams, options) {
+		if (this.closed) throw new Error(`MCP client '${this.serverName}' is closed`);
+		const pending = this.pendingAuthorization;
+		if (pending === void 0) throw new Error(`MCP client '${this.serverName}' has no pending OAuth authorization`);
+		if (options.expectedState.length === 0 || callbackParams.get("state") !== options.expectedState) throw new Error(`MCP client '${this.serverName}' rejected an OAuth callback with mismatched state`);
+		if (callbackParams.has("error")) throw new Error(`MCP client '${this.serverName}' OAuth authorization was denied or failed`);
+		const operation = beginIntegrationOperation(this.options.logger, this.integrationFamily, "authenticate");
+		const attempt = operation.attempt(1);
+		this.pendingAuthorization = void 0;
+		try {
+			await withAbortTimeout(() => pending.transport.finishAuth(callbackParams), this.operationTimeoutMs, `MCP OAuth callback exceeded ${this.operationTimeoutMs}ms`, options.signal);
+			attempt.success();
+			operation.success();
+		} catch (error) {
+			attempt.fail(integrationErrorCode(error));
+			operation.fail(integrationErrorCode(error));
+			const failure = errorOf(error);
+			this.publish("failed", this.reconnectAttempts, failure);
+			throw failure;
+		} finally {
+			await this.closeGeneration(pending.client);
+		}
+		await this.connect();
+	}
+	/** Stop reconnecting, close the live generation, and unregister its tools. */
+	async close() {
+		await this.closeWithReport();
+	}
+	closeWithReport(options = {}) {
+		if (this.closeTask !== void 0) return this.closeTask;
+		this.closeTask = this.performClose(options.signal);
+		return this.closeTask;
+	}
+	async performClose(signal) {
+		this.closed = true;
+		if (this.reconnectTimer !== void 0) clearTimeout(this.reconnectTimer);
+		this.reconnectTimer = void 0;
+		const generation = this.current;
+		this.current = void 0;
+		const tasks = [];
+		if (generation !== void 0) {
+			try {
+				const transport = generation.transport;
+				if (transport instanceof StreamableHTTPClientTransport && transport.sessionId !== void 0) tasks.push(() => transport.terminateSession());
+			} catch {}
+			tasks.push(() => generation.close());
+		}
+		const pending = this.pendingAuthorization;
+		this.pendingAuthorization = void 0;
+		if (pending !== void 0 && pending.client !== generation) tasks.push(() => pending.client.close());
+		const connecting = this.connecting;
+		if (connecting !== void 0) tasks.push(() => connecting);
+		if (this.pendingToolSyncs > 0) tasks.push(() => this.syncTail);
+		const report = await executeMcpClosePlan({
+			...this.options.logger === void 0 ? {} : { logger: this.options.logger },
+			family: this.integrationFamily,
+			...signal === void 0 ? {} : { signal },
+			timeoutMs: this.closeTimeoutMs,
+			tasks
+		});
+		this.clearTools();
+		this.publish("closed", this.reconnectAttempts);
+		return report;
+	}
+	async connectGeneration(reconnecting) {
+		const attempt = reconnecting ? this.reconnectAttempts : 0;
+		const operation = beginIntegrationOperation(this.options.logger, this.integrationFamily, reconnecting ? "reconnect" : "connect");
+		this.publish(reconnecting ? "reconnecting" : "connecting", attempt);
+		const factories = [this.transportFactory, this.fallbackTransportFactory].filter((factory) => factory !== void 0);
+		let lastFailure;
+		for (let index = 0; index < factories.length; index++) {
+			const physicalAttempt = operation.attempt(index + 1);
+			let generation;
+			try {
+				generation = this.createGeneration();
+			} catch (error) {
+				const code = integrationErrorCode(error);
+				physicalAttempt.fail(code);
+				operation.fail(code);
+				throw error;
+			}
+			let starting = true;
+			let transport;
+			this.current = generation;
+			generation.onclose = () => {
+				if (!starting) this.generationDown(generation);
+			};
+			try {
+				const openedTransport = factories[index]();
+				transport = openedTransport;
+				await withAbortTimeout(() => generation.connect(openedTransport), this.operationTimeoutMs, `MCP connection '${this.serverName}' exceeded ${this.operationTimeoutMs}ms`, this.options.signal);
+				if (this.current !== generation || this.closed) throw new Error(`MCP connection '${this.serverName}' closed during startup`);
+				await this.enqueueToolSync(generation, void 0, this.options.signal);
+				if (this.current !== generation || this.closed) throw new Error(`MCP connection '${this.serverName}' closed during tool discovery`);
+				this.connectedAt = Date.now();
+				starting = false;
+				this.publish("ready", this.reconnectAttempts, void 0, { protocol: protocolState(generation, transportKindOf(transport), index > 0) });
+				physicalAttempt.success();
+				operation.success();
+				if (this.authenticationKind !== "none" && this.authenticationKind !== "unknown") {
+					const authentication = beginIntegrationOperation(this.options.logger, this.integrationFamily, "authenticate");
+					authentication.attempt(1).success();
+					authentication.success();
+				}
+				return;
+			} catch (error) {
+				physicalAttempt.fail(integrationErrorCode(error));
+				starting = false;
+				const failure = errorOf(error);
+				lastFailure = failure;
+				if (this.current === generation) this.current = void 0;
+				if (UnauthorizedError.isInstance(error)) {
+					if (this.authenticationKind === "oauth" && isOAuthCapableTransport(transport)) {
+						this.pendingAuthorization = {
+							client: generation,
+							transport
+						};
+						this.publish("oauth-authorization-required", this.reconnectAttempts, failure, { authorization: {
+							kind: "oauth",
+							reason: "authorization-code-required"
+						} });
+						operation.fail(integrationErrorCode(error));
+						this.logAuthenticationFailure(error);
+						throw failure;
+					}
+					await this.closeGeneration(generation);
+					const status = this.authenticationKind === "bearer" ? "authentication-failed" : "authentication-required";
+					this.publish(status, this.reconnectAttempts, failure, { authorization: {
+						kind: this.authenticationKind,
+						reason: this.authenticationKind === "bearer" ? "invalid-credentials" : "credentials-required"
+					} });
+					operation.fail(integrationErrorCode(error));
+					this.logAuthenticationFailure(error);
+					throw failure;
+				}
+				await this.closeGeneration(generation);
+				if (index + 1 < factories.length && shouldTryLegacyTransport(error)) continue;
+				if (!this.closed) this.scheduleReconnect(failure);
+				operation.fail(integrationErrorCode(error));
+				throw failure;
+			}
+		}
+		const failure = lastFailure ?? /* @__PURE__ */ new Error(`MCP connection '${this.serverName}' has no transport candidate`);
+		if (!this.closed) this.scheduleReconnect(failure);
+		operation.fail(integrationErrorCode(failure));
+		throw failure;
+	}
+	createGeneration() {
+		let generation;
+		generation = new Client({
+			name: this.options.clientName ?? "ai-agent-sdk",
+			version: this.options.clientVersion ?? "0.0.0"
+		}, this.clientOptions((error, items) => {
+			if (this.current !== generation || this.closed) return;
+			if (error !== null || items === null) {
+				try {
+					this.options.onStateChange?.(Object.freeze({
+						...this.currentState,
+						...error === null ? {} : { error },
+						...error === null ? {} : { supportError: mcpSupportError(integrationErrorCode(error), "mcp-client", "MCP client operation failed") }
+					}));
+				} catch {}
+				return;
+			}
+			this.enqueueToolSync(generation, items).catch((error) => {
+				try {
+					this.options.onStateChange?.(Object.freeze({
+						...this.currentState,
+						error: errorOf(error),
+						supportError: mcpSupportError(integrationErrorCode(error), "mcp-client", "MCP client operation failed")
+					}));
+				} catch {}
+			});
+		}));
+		return generation;
+	}
+	clientOptions(onToolsChanged) {
+		return {
+			capabilities: {},
+			versionNegotiation: { mode: this.options.protocol ?? "auto" },
+			listChanged: { tools: {
+				autoRefresh: true,
+				onChanged: onToolsChanged
+			} }
+		};
+	}
+	generationDown(generation) {
+		if (this.closed || this.current !== generation) return;
+		this.current = void 0;
+		this.scheduleReconnect(/* @__PURE__ */ new Error(`MCP connection '${this.serverName}' closed`));
+	}
+	scheduleReconnect(error) {
+		if (this.closed || this.reconnectTimer !== void 0) return;
+		const policy = this.reconnect;
+		if (!policy.enabled) {
+			this.publish("failed", this.reconnectAttempts, error);
+			return;
+		}
+		if (this.connectedAt !== void 0 && Date.now() - this.connectedAt >= policy.maxDelayMs) this.reconnectAttempts = 0;
+		this.connectedAt = void 0;
+		this.reconnectAttempts += 1;
+		if (this.reconnectAttempts > policy.maxAttempts) {
+			this.clearTools();
+			this.publish("failed", policy.maxAttempts, error);
+			return;
+		}
+		const delay = Math.min(policy.maxDelayMs, policy.initialDelayMs * 2 ** (this.reconnectAttempts - 1));
+		this.publish("reconnecting", this.reconnectAttempts, error);
+		this.reconnectTimer = setTimeout(() => {
+			this.reconnectTimer = void 0;
+			this.connect().catch(() => void 0);
+		}, delay);
+		this.reconnectTimer.unref?.();
+	}
+	enqueueToolSync(generation, supplied, callerSignal) {
+		this.pendingToolSyncs += 1;
+		const tracked = this.syncTail.then(async () => {
+			if (this.closed || this.current !== generation) return;
+			const operation = beginIntegrationOperation(this.options.logger, this.integrationFamily, "catalog-refresh");
+			const attempt = operation.attempt(1);
+			try {
+				const tools = supplied ?? (await withAbortTimeout((signal) => generation.listTools(void 0, {
+					cacheMode: "refresh",
+					signal
+				}), this.operationTimeoutMs, `MCP tool discovery exceeded ${this.operationTimeoutMs}ms`, callerSignal)).tools;
+				if (this.closed || this.current !== generation) {
+					attempt.abort();
+					operation.abort();
+					return;
+				}
+				this.swapTools(tools);
+				attempt.success();
+				operation.success();
+			} catch (error) {
+				attempt.fail(integrationErrorCode(error));
+				operation.fail(integrationErrorCode(error));
+				throw error;
+			}
+		}).finally(() => {
+			this.pendingToolSyncs -= 1;
+		});
+		this.syncTail = tracked.catch(() => void 0);
+		return tracked;
+	}
+	swapTools(remoteTools) {
+		if (remoteTools.length > this.maxTools) throw new RangeError(`MCP server '${this.serverName}' exceeds the ${this.maxTools}-tool limit`);
+		if (serializedBytes(remoteTools) > this.maxCatalogBytes) throw new RangeError(`MCP server '${this.serverName}' catalog exceeds the ${this.maxCatalogBytes}-byte limit`);
+		const next = new ToolRegistry();
+		const seen = /* @__PURE__ */ new Set();
+		for (const remote of filterRemoteTools(remoteTools, this.options.toolFilter)) {
+			const name = publicToolName(this.serverName, remote.name, this.options.prefixToolNames !== false);
+			if (seen.has(name)) throw new Error(`MCP server '${this.serverName}' produced duplicate tool name '${name}'`);
+			seen.add(name);
+			next.register(this.bridgeTool(name, remote));
+		}
+		this.clearTools(false);
+		this.toolDisposers = next.names().map((name) => this.registry.register(next.get(name)));
+		this.bumpCatalogRevision();
+	}
+	bridgeTool(publicName, remote) {
+		const inputSchema = isJsonObject(remote.inputSchema) ? structuredClone(remote.inputSchema) : {
+			type: "object",
+			additionalProperties: true
+		};
+		return {
+			name: publicName,
+			description: remote.description?.trim() || `Tool '${remote.name}' from MCP server '${this.serverName}'.`,
+			parameters: inputSchema,
+			timeoutMs: this.toolCallTimeoutMs,
+			parse: (raw) => {
+				if (!isJsonObject(raw)) throw new TypeError("MCP tool arguments must be a JSON object");
+				return raw;
+			},
+			execute: async (args, context) => {
+				const generation = this.current;
+				if (generation === void 0) throw new Error(`MCP server '${this.serverName}' is not connected`);
+				const operation = beginIntegrationOperation(context.logger, this.integrationFamily, "tool-call");
+				const attempt = operation.attempt(1);
+				try {
+					const result = await raceAbort(generation.callTool({
+						name: remote.name,
+						arguments: args
+					}, {
+						signal: context.signal,
+						toolDefinition: remote,
+						timeout: this.toolCallTimeoutMs
+					}), context.signal);
+					if (serializedBytes(result) > this.maxToolResultBytes) throw new RangeError(`MCP tool '${this.serverName}/${remote.name}' result exceeds the ${this.maxToolResultBytes}-byte limit`);
+					if (result.isError === true) throw new McpRemoteToolError(this.serverName, remote.name, result);
+					const normalized = normalizeResult(result);
+					attempt.success();
+					operation.success();
+					return normalized;
+				} catch (error) {
+					if (context.signal.aborted) {
+						attempt.abort();
+						operation.abort();
+					} else {
+						attempt.fail(integrationErrorCode(error));
+						operation.fail(integrationErrorCode(error));
+					}
+					if (InsufficientScopeError.isInstance(error)) this.publish("scope-authorization-required", this.reconnectAttempts, errorOf(error), {
+						authorization: {
+							kind: this.authenticationKind,
+							reason: "insufficient-scope",
+							...error.requiredScope === void 0 ? {} : { requiredScope: error.requiredScope }
+						},
+						...this.currentState.protocol === void 0 ? {} : { protocol: this.currentState.protocol }
+					});
+					else if (UnauthorizedError.isInstance(error)) {
+						const transport = generation.transport;
+						if (this.current === generation) this.current = void 0;
+						if (this.authenticationKind === "oauth" && isOAuthCapableTransport(transport)) {
+							this.pendingAuthorization = {
+								client: generation,
+								transport
+							};
+							this.publish("oauth-authorization-required", this.reconnectAttempts, errorOf(error), {
+								authorization: {
+									kind: "oauth",
+									reason: "authorization-code-required"
+								},
+								...this.currentState.protocol === void 0 ? {} : { protocol: this.currentState.protocol }
+							});
+						} else {
+							await this.closeGeneration(generation);
+							this.publish(this.authenticationKind === "bearer" ? "authentication-failed" : "authentication-required", this.reconnectAttempts, errorOf(error), {
+								authorization: {
+									kind: this.authenticationKind,
+									reason: this.authenticationKind === "bearer" ? "invalid-credentials" : "credentials-required"
+								},
+								...this.currentState.protocol === void 0 ? {} : { protocol: this.currentState.protocol }
+							});
+						}
+					}
+					throw error;
+				}
+			},
+			render: (value) => renderMcpResult(value),
+			meta: () => ({
+				kind: "mcp",
+				serverName: this.serverName,
+				remoteToolName: remote.name
+			}),
+			...this.options.trustReadOnlyAnnotations === true && remote.annotations?.readOnlyHint === true ? { isConcurrencySafe: () => true } : {}
+		};
+	}
+	clearTools(recordRevision = true) {
+		if (this.toolDisposers.length === 0) return;
+		for (const dispose of this.toolDisposers) dispose();
+		this.toolDisposers = [];
+		if (recordRevision) this.bumpCatalogRevision();
+	}
+	bumpCatalogRevision() {
+		if (this.catalogRevision < Number.MAX_SAFE_INTEGER) this.catalogRevision += 1;
+		this.currentState = Object.freeze({
+			...this.currentState,
+			catalogRevision: this.catalogRevision
+		});
+		try {
+			this.options.onStateChange?.(this.currentState);
+		} catch {}
+	}
+	logAuthenticationFailure(error) {
+		const operation = beginIntegrationOperation(this.options.logger, this.integrationFamily, "authenticate");
+		const attempt = operation.attempt(1);
+		const code = integrationErrorCode(error);
+		attempt.fail(code);
+		operation.fail(code);
+	}
+	async closeGeneration(generation) {
+		return (await executeMcpClosePlan({
+			family: this.integrationFamily,
+			timeoutMs: this.closeTimeoutMs,
+			tasks: [() => generation.close()]
+		})).error === void 0;
+	}
+	publish(status, attempt, error, details = {}) {
+		this.currentState = Object.freeze({
+			status,
+			serverName: this.serverName,
+			attempt,
+			catalogRevision: this.catalogRevision,
+			...error === void 0 ? {} : { error },
+			...error === void 0 ? {} : { supportError: mcpSupportError(integrationErrorCode(error), "mcp-client", "MCP client operation failed") },
+			...details.authorization === void 0 ? {} : { authorization: Object.freeze(details.authorization) },
+			...details.protocol === void 0 ? {} : { protocol: Object.freeze(details.protocol) }
+		});
+		try {
+			this.options.onStateChange?.(this.currentState);
+		} catch {}
+	}
+};
+
+//#endregion
+//#region src/client/http-security.ts
+function snapshotHttpSecurityOptions(options) {
+	const allowedOrigins = options.allowedOrigins?.map((origin, index) => {
+		let url;
+		try {
+			url = new URL(origin);
+		} catch {
+			throw new TypeError(`allowedOrigins[${index}] must be an absolute URL`);
+		}
+		if (url.username.length > 0 || url.password.length > 0) throw new TypeError(`allowedOrigins[${index}] must not contain credentials`);
+		if (url.protocol !== "http:" && url.protocol !== "https:") throw new TypeError(`allowedOrigins[${index}] must use http or https`);
+		return url.origin;
+	});
+	return Object.freeze({
+		...allowedOrigins === void 0 ? {} : { allowedOrigins: Object.freeze([...new Set(allowedOrigins)]) },
+		requireHttps: options.requireHttps !== false,
+		allowPrivateNetwork: options.allowPrivateNetwork === true,
+		allowRedirects: options.allowRedirects === true,
+		...options.validateEndpoint === void 0 ? {} : { validateEndpoint: options.validateEndpoint },
+		maxTransportBytes: positiveSafeInteger(options.maxTransportBytes ?? MCP_CLIENT_DEFAULTS.maxTransportBytes, "maxTransportBytes"),
+		timeoutMs: timeoutMilliseconds(options.operationTimeoutMs ?? MCP_CLIENT_DEFAULTS.operationTimeoutMs, "operationTimeoutMs"),
+		teardownTimeoutMs: timeoutMilliseconds(options.closeTimeoutMs ?? MCP_CLIENT_DEFAULTS.closeTimeoutMs, "closeTimeoutMs")
+	});
+}
+function validateHttpEndpoint(value, options) {
+	const url = new URL(value);
+	if (url.username.length > 0 || url.password.length > 0) throw new TypeError("MCP HTTP endpoint URL must not contain credentials");
+	if (url.protocol !== "http:" && url.protocol !== "https:") throw new TypeError("MCP HTTP endpoint URL must use http or https");
+	if (!options.allowPrivateNetwork && isPrivateHostname(url.hostname)) throw new TypeError(`MCP HTTP endpoint host '${url.hostname}' is private or local`);
+	if (options.requireHttps && url.protocol !== "https:") throw new TypeError("MCP HTTP endpoint URL must use https under the configured policy");
+	if (options.allowedOrigins !== void 0 && !options.allowedOrigins.includes(url.origin)) throw new TypeError(`MCP HTTP endpoint origin '${url.origin}' is not allowed`);
+	return url;
+}
+function createGuardedMcpFetch(baseFetch, options) {
+	if (typeof baseFetch !== "function") throw new TypeError("MCP HTTP transport requires fetch");
+	return ((input, init) => {
+		const scope = createAbortTimeoutScope(options.timeoutMs, `MCP HTTP operation exceeded its ${options.timeoutMs}ms deadline`, init?.signal ?? void 0);
+		const pending = (async () => {
+			const signal = scope.signal;
+			signal.throwIfAborted();
+			let currentUrl = validateHttpEndpoint(input, options);
+			await validateBeforeFetch(currentUrl, options, signal);
+			let requestInit = {
+				...init,
+				signal,
+				redirect: "manual"
+			};
+			let response;
+			for (let hop = 0;; hop++) {
+				signal.throwIfAborted();
+				const fetching = Promise.resolve(baseFetch(currentUrl, requestInit));
+				try {
+					response = await raceAbort(fetching, signal);
+				} catch (error) {
+					fetching.then((late) => cancelResponse(late, options.teardownTimeoutMs), () => void 0).catch(() => void 0);
+					throw error;
+				}
+				if (response.type === "opaqueredirect") {
+					await cancelResponse(response, options.teardownTimeoutMs);
+					throw new Error("MCP HTTP transport rejected an opaque redirect");
+				}
+				if (!MCP_HTTP_REDIRECT_STATUSES.includes(response.status)) break;
+				if (!options.allowRedirects) {
+					await cancelResponse(response, options.teardownTimeoutMs);
+					throw new Error("MCP HTTP transport rejected a redirect");
+				}
+				if (hop >= MCP_CLIENT_DEFAULTS.maxRedirectHops) {
+					await cancelResponse(response, options.teardownTimeoutMs);
+					throw new Error(`MCP HTTP transport exceeded the ${MCP_CLIENT_DEFAULTS.maxRedirectHops}-redirect limit`);
+				}
+				const location = response.headers.get("location");
+				if (location === null) {
+					await cancelResponse(response, options.teardownTimeoutMs);
+					throw new Error("MCP HTTP transport received a redirect without a location");
+				}
+				await cancelResponse(response, options.teardownTimeoutMs);
+				const nextUrl = validateHttpEndpoint(new URL(location, currentUrl), options);
+				await validateBeforeFetch(nextUrl, options, signal);
+				const crossesOrigin = nextUrl.origin !== currentUrl.origin;
+				requestInit = redirectInit(requestInit, response.status, crossesOrigin);
+				currentUrl = nextUrl;
+			}
+			if (response.url.length > 0) try {
+				if (validateHttpEndpoint(response.url, options).origin !== currentUrl.origin) throw new Error("MCP HTTP transport response escaped the validated origin");
+			} catch (error) {
+				await cancelResponse(response, options.teardownTimeoutMs);
+				throw error;
+			}
+			const declared = Number(response.headers.get("content-length"));
+			if (Number.isFinite(declared) && declared > options.maxTransportBytes) {
+				if (response.body !== null) await waitForSettlement(response.body.cancel().catch(() => void 0), options.teardownTimeoutMs);
+				throw new Error(`MCP HTTP response exceeds the ${options.maxTransportBytes}-byte limit`);
+			}
+			if (response.body === null) {
+				scope.dispose();
+				return response;
+			}
+			const limited = limitedResponseBody(response.body, options.maxTransportBytes, options.teardownTimeoutMs, signal, scope.dispose);
+			return new Response(limited, {
+				status: response.status,
+				statusText: response.statusText,
+				headers: response.headers
+			});
+		})();
+		return raceAbort(pending, scope.signal).catch((error) => {
+			scope.dispose();
+			throw error;
+		});
+	});
+}
+function limitedResponseBody(body, maxBytes, teardownTimeoutMs, signal, dispose) {
+	const reader = body.getReader();
+	let received = 0;
+	let settled = false;
+	let controller;
+	const settle = () => {
+		if (settled) return;
+		settled = true;
+		signal.removeEventListener("abort", abort);
+		dispose();
+	};
+	const abort = () => {
+		if (settled) return;
+		const reason = signal.reason ?? /* @__PURE__ */ new Error("MCP HTTP response body was aborted");
+		settle();
+		controller?.error(reason);
+		waitForSettlement(reader.cancel(reason).catch(() => void 0), teardownTimeoutMs);
+	};
+	return new ReadableStream({
+		type: void 0,
+		start(value) {
+			controller = value;
+			signal.addEventListener("abort", abort, { once: true });
+			if (signal.aborted) abort();
+		},
+		async pull(value) {
+			if (settled) return;
+			try {
+				const next = await raceAbort(reader.read(), signal);
+				if (next.done) {
+					settle();
+					value.close();
+					return;
+				}
+				received += next.value.byteLength;
+				if (received > maxBytes) {
+					const error = /* @__PURE__ */ new Error(`MCP HTTP response exceeds the ${maxBytes}-byte limit`);
+					settle();
+					value.error(error);
+					await waitForSettlement(reader.cancel(error).catch(() => void 0), teardownTimeoutMs);
+					return;
+				}
+				value.enqueue(next.value);
+			} catch (error) {
+				if (settled) return;
+				settle();
+				value.error(error);
+			}
+		},
+		async cancel(reason) {
+			settle();
+			await waitForSettlement(reader.cancel(reason).catch(() => void 0), teardownTimeoutMs);
+		}
+	});
+}
+async function validateBeforeFetch(url, options, signal) {
+	signal.throwIfAborted();
+	if (options.validateEndpoint === void 0) return;
+	const pending = Promise.resolve().then(() => {
+		signal.throwIfAborted();
+		return options.validateEndpoint?.(new URL(url), signal);
+	});
+	await raceAbort(pending, signal);
+	signal.throwIfAborted();
+}
+function redirectInit(previous, status, crossesOrigin) {
+	const method = (previous.method ?? "GET").toUpperCase();
+	const switchesToGet = status === 303 || (status === 301 || status === 302) && method === "POST";
+	if (!switchesToGet && typeof ReadableStream !== "undefined" && previous.body instanceof ReadableStream) throw new Error("MCP HTTP transport cannot replay a streaming body across a redirect");
+	const headers = crossesOrigin ? new Headers() : new Headers(previous.headers);
+	if (switchesToGet) {
+		headers.delete("content-length");
+		headers.delete("content-type");
+	}
+	return {
+		...previous,
+		redirect: "manual",
+		headers,
+		...switchesToGet ? {
+			method: "GET",
+			body: null
+		} : {}
+	};
+}
+async function cancelResponse(response, timeoutMs) {
+	if (response.body === null) return;
+	await waitForSettlement(response.body.cancel().catch(() => void 0), timeoutMs);
+}
+function mergeHeaders(base, extra) {
+	const headers = new Headers(base);
+	new Headers(extra).forEach((value, key) => {
+		headers.set(key, value);
+	});
+	return headers;
+}
+function isPrivateHostname(value) {
+	const hostname = value.toLowerCase().replace(/^\[|\]$/g, "");
+	if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local") || hostname.endsWith(".internal") || hostname.endsWith(".home.arpa") || !hostname.includes(".")) return true;
+	if (hostname.includes(":")) return true;
+	const octets = hostname.split(".").map(Number);
+	if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) return false;
+	const [first = 0, second = 0] = octets;
+	return first === 0 || first === 10 || first === 127 || first >= 224 || first === 100 && second >= 64 && second <= 127 || first === 169 && second === 254 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first === 198 && (second === 18 || second === 19);
+}
+
+//#endregion
+//#region src/client/http-client.ts
+/** Construct an HTTP client without opening the connection yet. */
+function createMcpHttpClient(options) {
+	const security = snapshotHttpSecurityOptions(options);
+	const url = validateHttpEndpoint(options.url, security);
+	const { url: _url, fetch: injectedFetch, headers, transport, legacySse, allowedOrigins: _allowedOrigins, requireHttps: _requireHttps, allowPrivateNetwork: _allowPrivateNetwork, allowRedirects: _allowRedirects, validateEndpoint: _validateEndpoint, maxTransportBytes: _maxTransportBytes, ...lifecycle } = options;
+	const legacyOptions = legacySse === false ? void 0 : legacySse;
+	const primaryFactory = () => {
+		const requestInit = { ...transport?.requestInit };
+		if (headers !== void 0) requestInit.headers = mergeHeaders(transport?.requestInit?.headers, headers);
+		const guardedFetch = createGuardedMcpFetch(transport?.fetch ?? injectedFetch ?? globalThis.fetch, security);
+		return new StreamableHTTPClientTransport(url, {
+			...transport,
+			fetch: guardedFetch,
+			...Object.keys(requestInit).length === 0 ? {} : { requestInit }
+		});
+	};
+	const fallbackFactory = legacySse === false ? void 0 : () => {
+		const fallbackUrl = validateHttpEndpoint(legacyOptions?.url ?? url, security);
+		const fallbackOptions = legacyOptions?.transport;
+		const requestInit = { ...fallbackOptions?.requestInit };
+		if (headers !== void 0) requestInit.headers = mergeHeaders(fallbackOptions?.requestInit?.headers, headers);
+		const guardedFetch = createGuardedMcpFetch(fallbackOptions?.fetch ?? transport?.fetch ?? injectedFetch ?? globalThis.fetch, security);
+		return new SSEClientTransport(fallbackUrl, {
+			...fallbackOptions,
+			...fallbackOptions?.authProvider === void 0 && transport?.authProvider !== void 0 ? { authProvider: transport.authProvider } : {},
+			fetch: guardedFetch,
+			...Object.keys(requestInit).length === 0 ? {} : { requestInit }
+		});
+	};
+	return new McpClientConnection(lifecycle, primaryFactory, {
+		authenticationKind: authenticationKindOf(transport?.authProvider, mergeHeaders(transport?.requestInit?.headers, headers)),
+		...fallbackFactory === void 0 ? {} : { fallbackTransportFactory: fallbackFactory },
+		integrationFamily: "mcp-http-client"
+	});
+}
+/** Construct and fully initialize an HTTP client. */
+async function connectMcpHttp(options) {
+	const connection = createMcpHttpClient(options);
+	try {
+		await connection.connect();
+		return connection;
+	} catch (error) {
+		const stage = connectionFailureStage(connection.state.status);
+		const cleanup = await connection.closeWithReport();
+		throw new McpConnectionError(stage, mcpSupportError("MCP_CONNECT_FAILED", stage, "MCP connection startup failed"), cleanup, error);
+	}
+}
+
+//#endregion
+export { McpConnectionError as a, resolveMcpReconnectOptions as i, createMcpHttpClient as n, McpRemoteToolError as o, McpClientConnection as r, connectMcpHttp as t };
+//# sourceMappingURL=client-D7Th3S7z.js.map