@ashx-j/lunr-dev 0.2.13-dev.7.1 → 0.2.16-dev.9.1

package/dist/node-runtime/chunk-4TLO4PO2.js

@@ -0,0 +1,3427 @@
+import { createRequire as __lunrRequire } from "node:module"; const require = __lunrRequire(import.meta.url);
+import {
+  getAgentPath
+} from "./chunk-4HXHDDCF.js";
+import {
+  NEVER,
+  ZodIssueCode,
+  _enum,
+  _null,
+  any,
+  array,
+  boolean,
+  coerce_exports,
+  custom,
+  discriminatedUnion,
+  intersection,
+  iso_exports,
+  literal,
+  looseObject,
+  number,
+  object,
+  optional,
+  preprocess,
+  record,
+  string,
+  union,
+  unknown,
+  url
+} from "./chunk-BI3DHYCN.js";
+import {
+  __commonJS,
+  __toESM
+} from "./chunk-BRJX2PRC.js";
+
+// node_modules/content-type/index.js
+var require_content_type = __commonJS({
+  "node_modules/content-type/index.js"(exports) {
+    "use strict";
+    var PARAM_REGEXP = /; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g, TEXT_REGEXP = /^[\u000b\u0020-\u007e\u0080-\u00ff]+$/, TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/, QESC_REGEXP = /\\([\u000b\u0020-\u00ff])/g, QUOTE_REGEXP = /([\\"])/g, TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+    exports.format = format;
+    exports.parse = parse;
+    function format(obj) {
+      if (!obj || typeof obj != "object")
+        throw new TypeError("argument obj is required");
+      var parameters = obj.parameters, type = obj.type;
+      if (!type || !TYPE_REGEXP.test(type))
+        throw new TypeError("invalid type");
+      var string2 = type;
+      if (parameters && typeof parameters == "object")
+        for (var param, params = Object.keys(parameters).sort(), i = 0; i < params.length; i++) {
+          if (param = params[i], !TOKEN_REGEXP.test(param))
+            throw new TypeError("invalid parameter name");
+          string2 += "; " + param + "=" + qstring(parameters[param]);
+        }
+      return string2;
+    }
+    function parse(string2) {
+      if (!string2)
+        throw new TypeError("argument string is required");
+      var header = typeof string2 == "object" ? getcontenttype(string2) : string2;
+      if (typeof header != "string")
+        throw new TypeError("argument string is required to be a string");
+      var index = header.indexOf(";"), type = index !== -1 ? header.slice(0, index).trim() : header.trim();
+      if (!TYPE_REGEXP.test(type))
+        throw new TypeError("invalid media type");
+      var obj = new ContentType(type.toLowerCase());
+      if (index !== -1) {
+        var key, match, value;
+        for (PARAM_REGEXP.lastIndex = index; match = PARAM_REGEXP.exec(header); ) {
+          if (match.index !== index)
+            throw new TypeError("invalid parameter format");
+          index += match[0].length, key = match[1].toLowerCase(), value = match[2], value.charCodeAt(0) === 34 && (value = value.slice(1, -1), value.indexOf("\\") !== -1 && (value = value.replace(QESC_REGEXP, "$1"))), obj.parameters[key] = value;
+        }
+        if (index !== header.length)
+          throw new TypeError("invalid parameter format");
+      }
+      return obj;
+    }
+    function getcontenttype(obj) {
+      var header;
+      if (typeof obj.getHeader == "function" ? header = obj.getHeader("content-type") : typeof obj.headers == "object" && (header = obj.headers && obj.headers["content-type"]), typeof header != "string")
+        throw new TypeError("content-type header is missing from object");
+      return header;
+    }
+    function qstring(val) {
+      var str = String(val);
+      if (TOKEN_REGEXP.test(str))
+        return str;
+      if (str.length > 0 && !TEXT_REGEXP.test(str))
+        throw new TypeError("invalid parameter value");
+      return '"' + str.replace(QUOTE_REGEXP, "\\$1") + '"';
+    }
+    function ContentType(type) {
+      this.parameters = /* @__PURE__ */ Object.create(null), this.type = type;
+    }
+  }
+});
+
+// node_modules/pkce-challenge/dist/index.node.js
+var crypto2;
+crypto2 = globalThis.crypto?.webcrypto ?? // Node.js [18-16] REPL
+globalThis.crypto ?? // Node.js >18
+import("node:crypto").then((m) => m.webcrypto);
+async function getRandomValues(size) {
+  return (await crypto2).getRandomValues(new Uint8Array(size));
+}
+async function random(size) {
+  let mask = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~", evenDistCutoff = Math.pow(2, 8) - Math.pow(2, 8) % mask.length, result = "";
+  for (; result.length < size; ) {
+    let randomBytes = await getRandomValues(size - result.length);
+    for (let randomByte of randomBytes)
+      randomByte < evenDistCutoff && (result += mask[randomByte % mask.length]);
+  }
+  return result;
+}
+async function generateVerifier(length) {
+  return await random(length);
+}
+async function generateChallenge(code_verifier) {
+  let buffer = await (await crypto2).subtle.digest("SHA-256", new TextEncoder().encode(code_verifier));
+  return btoa(String.fromCharCode(...new Uint8Array(buffer))).replace(/\//g, "_").replace(/\+/g, "-").replace(/=/g, "");
+}
+async function pkceChallenge(length) {
+  if (length || (length = 43), length < 43 || length > 128)
+    throw `Expected a length between 43 and 128. Received ${length}.`;
+  let verifier = await generateVerifier(length), challenge = await generateChallenge(verifier);
+  return {
+    code_verifier: verifier,
+    code_challenge: challenge
+  };
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
+var LATEST_PROTOCOL_VERSION = "2025-11-25";
+var SUPPORTED_PROTOCOL_VERSIONS = [LATEST_PROTOCOL_VERSION, "2025-06-18", "2025-03-26", "2024-11-05", "2024-10-07"], RELATED_TASK_META_KEY = "io.modelcontextprotocol/related-task", JSONRPC_VERSION = "2.0", AssertObjectSchema = custom((v) => v !== null && (typeof v == "object" || typeof v == "function")), ProgressTokenSchema = union([string(), number().int()]), CursorSchema = string(), TaskCreationParamsSchema = looseObject({
+  /**
+   * Requested duration in milliseconds to retain task from creation.
+   */
+  ttl: number().optional(),
+  /**
+   * Time in milliseconds to wait between task status requests.
+   */
+  pollInterval: number().optional()
+}), TaskMetadataSchema = object({
+  ttl: number().optional()
+}), RelatedTaskMetadataSchema = object({
+  taskId: string()
+}), RequestMetaSchema = looseObject({
+  /**
+   * If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.
+   */
+  progressToken: ProgressTokenSchema.optional(),
+  /**
+   * If specified, this request is related to the provided task.
+   */
+  [RELATED_TASK_META_KEY]: RelatedTaskMetadataSchema.optional()
+}), BaseRequestParamsSchema = object({
+  /**
+   * See [General fields: `_meta`](/specification/draft/basic/index#meta) for notes on `_meta` usage.
+   */
+  _meta: RequestMetaSchema.optional()
+}), TaskAugmentedRequestParamsSchema = BaseRequestParamsSchema.extend({
+  /**
+   * If specified, the caller is requesting task-augmented execution for this request.
+   * The request will return a CreateTaskResult immediately, and the actual result can be
+   * retrieved later via tasks/result.
+   *
+   * Task augmentation is subject to capability negotiation - receivers MUST declare support
+   * for task augmentation of specific request types in their capabilities.
+   */
+  task: TaskMetadataSchema.optional()
+}), isTaskAugmentedRequestParams = (value) => TaskAugmentedRequestParamsSchema.safeParse(value).success, RequestSchema = object({
+  method: string(),
+  params: BaseRequestParamsSchema.loose().optional()
+}), NotificationsParamsSchema = object({
+  /**
+   * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
+   * for notes on _meta usage.
+   */
+  _meta: RequestMetaSchema.optional()
+}), NotificationSchema = object({
+  method: string(),
+  params: NotificationsParamsSchema.loose().optional()
+}), ResultSchema = looseObject({
+  /**
+   * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
+   * for notes on _meta usage.
+   */
+  _meta: RequestMetaSchema.optional()
+}), RequestIdSchema = union([string(), number().int()]), JSONRPCRequestSchema = object({
+  jsonrpc: literal(JSONRPC_VERSION),
+  id: RequestIdSchema,
+  ...RequestSchema.shape
+}).strict(), isJSONRPCRequest = (value) => JSONRPCRequestSchema.safeParse(value).success, JSONRPCNotificationSchema = object({
+  jsonrpc: literal(JSONRPC_VERSION),
+  ...NotificationSchema.shape
+}).strict(), isJSONRPCNotification = (value) => JSONRPCNotificationSchema.safeParse(value).success, JSONRPCResultResponseSchema = object({
+  jsonrpc: literal(JSONRPC_VERSION),
+  id: RequestIdSchema,
+  result: ResultSchema
+}).strict(), isJSONRPCResultResponse = (value) => JSONRPCResultResponseSchema.safeParse(value).success;
+var ErrorCode;
+(function(ErrorCode2) {
+  ErrorCode2[ErrorCode2.ConnectionClosed = -32e3] = "ConnectionClosed", ErrorCode2[ErrorCode2.RequestTimeout = -32001] = "RequestTimeout", ErrorCode2[ErrorCode2.ParseError = -32700] = "ParseError", ErrorCode2[ErrorCode2.InvalidRequest = -32600] = "InvalidRequest", ErrorCode2[ErrorCode2.MethodNotFound = -32601] = "MethodNotFound", ErrorCode2[ErrorCode2.InvalidParams = -32602] = "InvalidParams", ErrorCode2[ErrorCode2.InternalError = -32603] = "InternalError", ErrorCode2[ErrorCode2.UrlElicitationRequired = -32042] = "UrlElicitationRequired";
+})(ErrorCode || (ErrorCode = {}));
+var JSONRPCErrorResponseSchema = object({
+  jsonrpc: literal(JSONRPC_VERSION),
+  id: RequestIdSchema.optional(),
+  error: object({
+    /**
+     * The error type that occurred.
+     */
+    code: number().int(),
+    /**
+     * A short description of the error. The message SHOULD be limited to a concise single sentence.
+     */
+    message: string(),
+    /**
+     * Additional information about the error. The value of this member is defined by the sender (e.g. detailed error information, nested errors etc.).
+     */
+    data: unknown().optional()
+  })
+}).strict();
+var isJSONRPCErrorResponse = (value) => JSONRPCErrorResponseSchema.safeParse(value).success;
+var JSONRPCMessageSchema = union([
+  JSONRPCRequestSchema,
+  JSONRPCNotificationSchema,
+  JSONRPCResultResponseSchema,
+  JSONRPCErrorResponseSchema
+]), JSONRPCResponseSchema = union([JSONRPCResultResponseSchema, JSONRPCErrorResponseSchema]), EmptyResultSchema = ResultSchema.strict(), CancelledNotificationParamsSchema = NotificationsParamsSchema.extend({
+  /**
+   * The ID of the request to cancel.
+   *
+   * This MUST correspond to the ID of a request previously issued in the same direction.
+   */
+  requestId: RequestIdSchema.optional(),
+  /**
+   * An optional string describing the reason for the cancellation. This MAY be logged or presented to the user.
+   */
+  reason: string().optional()
+}), CancelledNotificationSchema = NotificationSchema.extend({
+  method: literal("notifications/cancelled"),
+  params: CancelledNotificationParamsSchema
+}), IconSchema = object({
+  /**
+   * URL or data URI for the icon.
+   */
+  src: string(),
+  /**
+   * Optional MIME type for the icon.
+   */
+  mimeType: string().optional(),
+  /**
+   * Optional array of strings that specify sizes at which the icon can be used.
+   * Each string should be in WxH format (e.g., `"48x48"`, `"96x96"`) or `"any"` for scalable formats like SVG.
+   *
+   * If not provided, the client should assume that the icon can be used at any size.
+   */
+  sizes: array(string()).optional(),
+  /**
+   * Optional specifier for the theme this icon is designed for. `light` indicates
+   * the icon is designed to be used with a light background, and `dark` indicates
+   * the icon is designed to be used with a dark background.
+   *
+   * If not provided, the client should assume the icon can be used with any theme.
+   */
+  theme: _enum(["light", "dark"]).optional()
+}), IconsSchema = object({
+  /**
+   * Optional set of sized icons that the client can display in a user interface.
+   *
+   * Clients that support rendering icons MUST support at least the following MIME types:
+   * - `image/png` - PNG images (safe, universal compatibility)
+   * - `image/jpeg` (and `image/jpg`) - JPEG images (safe, universal compatibility)
+   *
+   * Clients that support rendering icons SHOULD also support:
+   * - `image/svg+xml` - SVG images (scalable but requires security precautions)
+   * - `image/webp` - WebP images (modern, efficient format)
+   */
+  icons: array(IconSchema).optional()
+}), BaseMetadataSchema = object({
+  /** Intended for programmatic or logical use, but used as a display name in past specs or fallback */
+  name: string(),
+  /**
+   * Intended for UI and end-user contexts — optimized to be human-readable and easily understood,
+   * even by those unfamiliar with domain-specific terminology.
+   *
+   * If not provided, the name should be used for display (except for Tool,
+   * where `annotations.title` should be given precedence over using `name`,
+   * if present).
+   */
+  title: string().optional()
+}), ImplementationSchema = BaseMetadataSchema.extend({
+  ...BaseMetadataSchema.shape,
+  ...IconsSchema.shape,
+  version: string(),
+  /**
+   * An optional URL of the website for this implementation.
+   */
+  websiteUrl: string().optional(),
+  /**
+   * An optional human-readable description of what this implementation does.
+   *
+   * This can be used by clients or servers to provide context about their purpose
+   * and capabilities. For example, a server might describe the types of resources
+   * or tools it provides, while a client might describe its intended use case.
+   */
+  description: string().optional()
+}), FormElicitationCapabilitySchema = intersection(object({
+  applyDefaults: boolean().optional()
+}), record(string(), unknown())), ElicitationCapabilitySchema = preprocess((value) => value && typeof value == "object" && !Array.isArray(value) && Object.keys(value).length === 0 ? { form: {} } : value, intersection(object({
+  form: FormElicitationCapabilitySchema.optional(),
+  url: AssertObjectSchema.optional()
+}), record(string(), unknown()).optional())), ClientTasksCapabilitySchema = looseObject({
+  /**
+   * Present if the client supports listing tasks.
+   */
+  list: AssertObjectSchema.optional(),
+  /**
+   * Present if the client supports cancelling tasks.
+   */
+  cancel: AssertObjectSchema.optional(),
+  /**
+   * Capabilities for task creation on specific request types.
+   */
+  requests: looseObject({
+    /**
+     * Task support for sampling requests.
+     */
+    sampling: looseObject({
+      createMessage: AssertObjectSchema.optional()
+    }).optional(),
+    /**
+     * Task support for elicitation requests.
+     */
+    elicitation: looseObject({
+      create: AssertObjectSchema.optional()
+    }).optional()
+  }).optional()
+}), ServerTasksCapabilitySchema = looseObject({
+  /**
+   * Present if the server supports listing tasks.
+   */
+  list: AssertObjectSchema.optional(),
+  /**
+   * Present if the server supports cancelling tasks.
+   */
+  cancel: AssertObjectSchema.optional(),
+  /**
+   * Capabilities for task creation on specific request types.
+   */
+  requests: looseObject({
+    /**
+     * Task support for tool requests.
+     */
+    tools: looseObject({
+      call: AssertObjectSchema.optional()
+    }).optional()
+  }).optional()
+}), ClientCapabilitiesSchema = object({
+  /**
+   * Experimental, non-standard capabilities that the client supports.
+   */
+  experimental: record(string(), AssertObjectSchema).optional(),
+  /**
+   * Present if the client supports sampling from an LLM.
+   */
+  sampling: object({
+    /**
+     * Present if the client supports context inclusion via includeContext parameter.
+     * If not declared, servers SHOULD only use `includeContext: "none"` (or omit it).
+     */
+    context: AssertObjectSchema.optional(),
+    /**
+     * Present if the client supports tool use via tools and toolChoice parameters.
+     */
+    tools: AssertObjectSchema.optional()
+  }).optional(),
+  /**
+   * Present if the client supports eliciting user input.
+   */
+  elicitation: ElicitationCapabilitySchema.optional(),
+  /**
+   * Present if the client supports listing roots.
+   */
+  roots: object({
+    /**
+     * Whether the client supports issuing notifications for changes to the roots list.
+     */
+    listChanged: boolean().optional()
+  }).optional(),
+  /**
+   * Present if the client supports task creation.
+   */
+  tasks: ClientTasksCapabilitySchema.optional(),
+  /**
+   * Extensions that the client supports. Keys are extension identifiers (vendor-prefix/extension-name).
+   */
+  extensions: record(string(), AssertObjectSchema).optional()
+}), InitializeRequestParamsSchema = BaseRequestParamsSchema.extend({
+  /**
+   * The latest version of the Model Context Protocol that the client supports. The client MAY decide to support older versions as well.
+   */
+  protocolVersion: string(),
+  capabilities: ClientCapabilitiesSchema,
+  clientInfo: ImplementationSchema
+}), InitializeRequestSchema = RequestSchema.extend({
+  method: literal("initialize"),
+  params: InitializeRequestParamsSchema
+});
+var ServerCapabilitiesSchema = object({
+  /**
+   * Experimental, non-standard capabilities that the server supports.
+   */
+  experimental: record(string(), AssertObjectSchema).optional(),
+  /**
+   * Present if the server supports sending log messages to the client.
+   */
+  logging: AssertObjectSchema.optional(),
+  /**
+   * Present if the server supports sending completions to the client.
+   */
+  completions: AssertObjectSchema.optional(),
+  /**
+   * Present if the server offers any prompt templates.
+   */
+  prompts: object({
+    /**
+     * Whether this server supports issuing notifications for changes to the prompt list.
+     */
+    listChanged: boolean().optional()
+  }).optional(),
+  /**
+   * Present if the server offers any resources to read.
+   */
+  resources: object({
+    /**
+     * Whether this server supports clients subscribing to resource updates.
+     */
+    subscribe: boolean().optional(),
+    /**
+     * Whether this server supports issuing notifications for changes to the resource list.
+     */
+    listChanged: boolean().optional()
+  }).optional(),
+  /**
+   * Present if the server offers any tools to call.
+   */
+  tools: object({
+    /**
+     * Whether this server supports issuing notifications for changes to the tool list.
+     */
+    listChanged: boolean().optional()
+  }).optional(),
+  /**
+   * Present if the server supports task creation.
+   */
+  tasks: ServerTasksCapabilitySchema.optional(),
+  /**
+   * Extensions that the server supports. Keys are extension identifiers (vendor-prefix/extension-name).
+   */
+  extensions: record(string(), AssertObjectSchema).optional()
+}), InitializeResultSchema = ResultSchema.extend({
+  /**
+   * The version of the Model Context Protocol that the server wants to use. This may not match the version that the client requested. If the client cannot support this version, it MUST disconnect.
+   */
+  protocolVersion: string(),
+  capabilities: ServerCapabilitiesSchema,
+  serverInfo: ImplementationSchema,
+  /**
+   * Instructions describing how to use the server and its features.
+   *
+   * This can be used by clients to improve the LLM's understanding of available tools, resources, etc. It can be thought of like a "hint" to the model. For example, this information MAY be added to the system prompt.
+   */
+  instructions: string().optional()
+}), InitializedNotificationSchema = NotificationSchema.extend({
+  method: literal("notifications/initialized"),
+  params: NotificationsParamsSchema.optional()
+}), isInitializedNotification = (value) => InitializedNotificationSchema.safeParse(value).success, PingRequestSchema = RequestSchema.extend({
+  method: literal("ping"),
+  params: BaseRequestParamsSchema.optional()
+}), ProgressSchema = object({
+  /**
+   * The progress thus far. This should increase every time progress is made, even if the total is unknown.
+   */
+  progress: number(),
+  /**
+   * Total number of items to process (or total progress required), if known.
+   */
+  total: optional(number()),
+  /**
+   * An optional message describing the current progress.
+   */
+  message: optional(string())
+}), ProgressNotificationParamsSchema = object({
+  ...NotificationsParamsSchema.shape,
+  ...ProgressSchema.shape,
+  /**
+   * The progress token which was given in the initial request, used to associate this notification with the request that is proceeding.
+   */
+  progressToken: ProgressTokenSchema
+}), ProgressNotificationSchema = NotificationSchema.extend({
+  method: literal("notifications/progress"),
+  params: ProgressNotificationParamsSchema
+}), PaginatedRequestParamsSchema = BaseRequestParamsSchema.extend({
+  /**
+   * An opaque token representing the current pagination position.
+   * If provided, the server should return results starting after this cursor.
+   */
+  cursor: CursorSchema.optional()
+}), PaginatedRequestSchema = RequestSchema.extend({
+  params: PaginatedRequestParamsSchema.optional()
+}), PaginatedResultSchema = ResultSchema.extend({
+  /**
+   * An opaque token representing the pagination position after the last returned result.
+   * If present, there may be more results available.
+   */
+  nextCursor: CursorSchema.optional()
+}), TaskStatusSchema = _enum(["working", "input_required", "completed", "failed", "cancelled"]), TaskSchema = object({
+  taskId: string(),
+  status: TaskStatusSchema,
+  /**
+   * Time in milliseconds to keep task results available after completion.
+   * If null, the task has unlimited lifetime until manually cleaned up.
+   */
+  ttl: union([number(), _null()]),
+  /**
+   * ISO 8601 timestamp when the task was created.
+   */
+  createdAt: string(),
+  /**
+   * ISO 8601 timestamp when the task was last updated.
+   */
+  lastUpdatedAt: string(),
+  pollInterval: optional(number()),
+  /**
+   * Optional diagnostic message for failed tasks or other status information.
+   */
+  statusMessage: optional(string())
+}), CreateTaskResultSchema = ResultSchema.extend({
+  task: TaskSchema
+}), TaskStatusNotificationParamsSchema = NotificationsParamsSchema.merge(TaskSchema), TaskStatusNotificationSchema = NotificationSchema.extend({
+  method: literal("notifications/tasks/status"),
+  params: TaskStatusNotificationParamsSchema
+}), GetTaskRequestSchema = RequestSchema.extend({
+  method: literal("tasks/get"),
+  params: BaseRequestParamsSchema.extend({
+    taskId: string()
+  })
+}), GetTaskResultSchema = ResultSchema.merge(TaskSchema), GetTaskPayloadRequestSchema = RequestSchema.extend({
+  method: literal("tasks/result"),
+  params: BaseRequestParamsSchema.extend({
+    taskId: string()
+  })
+}), GetTaskPayloadResultSchema = ResultSchema.loose(), ListTasksRequestSchema = PaginatedRequestSchema.extend({
+  method: literal("tasks/list")
+}), ListTasksResultSchema = PaginatedResultSchema.extend({
+  tasks: array(TaskSchema)
+}), CancelTaskRequestSchema = RequestSchema.extend({
+  method: literal("tasks/cancel"),
+  params: BaseRequestParamsSchema.extend({
+    taskId: string()
+  })
+}), CancelTaskResultSchema = ResultSchema.merge(TaskSchema), ResourceContentsSchema = object({
+  /**
+   * The URI of this resource.
+   */
+  uri: string(),
+  /**
+   * The MIME type of this resource, if known.
+   */
+  mimeType: optional(string()),
+  /**
+   * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
+   * for notes on _meta usage.
+   */
+  _meta: record(string(), unknown()).optional()
+}), TextResourceContentsSchema = ResourceContentsSchema.extend({
+  /**
+   * The text of the item. This must only be set if the item can actually be represented as text (not binary data).
+   */
+  text: string()
+}), Base64Schema = string().refine((val) => {
+  try {
+    return atob(val), !0;
+  } catch {
+    return !1;
+  }
+}, { message: "Invalid Base64 string" }), BlobResourceContentsSchema = ResourceContentsSchema.extend({
+  /**
+   * A base64-encoded string representing the binary data of the item.
+   */
+  blob: Base64Schema
+}), RoleSchema = _enum(["user", "assistant"]), AnnotationsSchema = object({
+  /**
+   * Intended audience(s) for the resource.
+   */
+  audience: array(RoleSchema).optional(),
+  /**
+   * Importance hint for the resource, from 0 (least) to 1 (most).
+   */
+  priority: number().min(0).max(1).optional(),
+  /**
+   * ISO 8601 timestamp for the most recent modification.
+   */
+  lastModified: iso_exports.datetime({ offset: !0 }).optional()
+}), ResourceSchema = object({
+  ...BaseMetadataSchema.shape,
+  ...IconsSchema.shape,
+  /**
+   * The URI of this resource.
+   */
+  uri: string(),
+  /**
+   * A description of what this resource represents.
+   *
+   * This can be used by clients to improve the LLM's understanding of available resources. It can be thought of like a "hint" to the model.
+   */
+  description: optional(string()),
+  /**
+   * The MIME type of this resource, if known.
+   */
+  mimeType: optional(string()),
+  /**
+   * The size of the raw resource content, in bytes (i.e., before base64 encoding or any tokenization), if known.
+   *
+   * This can be used by Hosts to display file sizes and estimate context window usage.
+   */
+  size: optional(number()),
+  /**
+   * Optional annotations for the client.
+   */
+  annotations: AnnotationsSchema.optional(),
+  /**
+   * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
+   * for notes on _meta usage.
+   */
+  _meta: optional(looseObject({}))
+}), ResourceTemplateSchema = object({
+  ...BaseMetadataSchema.shape,
+  ...IconsSchema.shape,
+  /**
+   * A URI template (according to RFC 6570) that can be used to construct resource URIs.
+   */
+  uriTemplate: string(),
+  /**
+   * A description of what this template is for.
+   *
+   * This can be used by clients to improve the LLM's understanding of available resources. It can be thought of like a "hint" to the model.
+   */
+  description: optional(string()),
+  /**
+   * The MIME type for all resources that match this template. This should only be included if all resources matching this template have the same type.
+   */
+  mimeType: optional(string()),
+  /**
+   * Optional annotations for the client.
+   */
+  annotations: AnnotationsSchema.optional(),
+  /**
+   * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
+   * for notes on _meta usage.
+   */
+  _meta: optional(looseObject({}))
+}), ListResourcesRequestSchema = PaginatedRequestSchema.extend({
+  method: literal("resources/list")
+}), ListResourcesResultSchema = PaginatedResultSchema.extend({
+  resources: array(ResourceSchema)
+}), ListResourceTemplatesRequestSchema = PaginatedRequestSchema.extend({
+  method: literal("resources/templates/list")
+}), ListResourceTemplatesResultSchema = PaginatedResultSchema.extend({
+  resourceTemplates: array(ResourceTemplateSchema)
+}), ResourceRequestParamsSchema = BaseRequestParamsSchema.extend({
+  /**
+   * The URI of the resource to read. The URI can use any protocol; it is up to the server how to interpret it.
+   *
+   * @format uri
+   */
+  uri: string()
+}), ReadResourceRequestParamsSchema = ResourceRequestParamsSchema, ReadResourceRequestSchema = RequestSchema.extend({
+  method: literal("resources/read"),
+  params: ReadResourceRequestParamsSchema
+}), ReadResourceResultSchema = ResultSchema.extend({
+  contents: array(union([TextResourceContentsSchema, BlobResourceContentsSchema]))
+}), ResourceListChangedNotificationSchema = NotificationSchema.extend({
+  method: literal("notifications/resources/list_changed"),
+  params: NotificationsParamsSchema.optional()
+}), SubscribeRequestParamsSchema = ResourceRequestParamsSchema, SubscribeRequestSchema = RequestSchema.extend({
+  method: literal("resources/subscribe"),
+  params: SubscribeRequestParamsSchema
+}), UnsubscribeRequestParamsSchema = ResourceRequestParamsSchema, UnsubscribeRequestSchema = RequestSchema.extend({
+  method: literal("resources/unsubscribe"),
+  params: UnsubscribeRequestParamsSchema
+}), ResourceUpdatedNotificationParamsSchema = NotificationsParamsSchema.extend({
+  /**
+   * The URI of the resource that has been updated. This might be a sub-resource of the one that the client actually subscribed to.
+   */
+  uri: string()
+}), ResourceUpdatedNotificationSchema = NotificationSchema.extend({
+  method: literal("notifications/resources/updated"),
+  params: ResourceUpdatedNotificationParamsSchema
+}), PromptArgumentSchema = object({
+  /**
+   * The name of the argument.
+   */
+  name: string(),
+  /**
+   * A human-readable description of the argument.
+   */
+  description: optional(string()),
+  /**
+   * Whether this argument must be provided.
+   */
+  required: optional(boolean())
+}), PromptSchema = object({
+  ...BaseMetadataSchema.shape,
+  ...IconsSchema.shape,
+  /**
+   * An optional description of what this prompt provides
+   */
+  description: optional(string()),
+  /**
+   * A list of arguments to use for templating the prompt.
+   */
+  arguments: optional(array(PromptArgumentSchema)),
+  /**
+   * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
+   * for notes on _meta usage.
+   */
+  _meta: optional(looseObject({}))
+}), ListPromptsRequestSchema = PaginatedRequestSchema.extend({
+  method: literal("prompts/list")
+}), ListPromptsResultSchema = PaginatedResultSchema.extend({
+  prompts: array(PromptSchema)
+}), GetPromptRequestParamsSchema = BaseRequestParamsSchema.extend({
+  /**
+   * The name of the prompt or prompt template.
+   */
+  name: string(),
+  /**
+   * Arguments to use for templating the prompt.
+   */
+  arguments: record(string(), string()).optional()
+}), GetPromptRequestSchema = RequestSchema.extend({
+  method: literal("prompts/get"),
+  params: GetPromptRequestParamsSchema
+}), TextContentSchema = object({
+  type: literal("text"),
+  /**
+   * The text content of the message.
+   */
+  text: string(),
+  /**
+   * Optional annotations for the client.
+   */
+  annotations: AnnotationsSchema.optional(),
+  /**
+   * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
+   * for notes on _meta usage.
+   */
+  _meta: record(string(), unknown()).optional()
+}), ImageContentSchema = object({
+  type: literal("image"),
+  /**
+   * The base64-encoded image data.
+   */
+  data: Base64Schema,
+  /**
+   * The MIME type of the image. Different providers may support different image types.
+   */
+  mimeType: string(),
+  /**
+   * Optional annotations for the client.
+   */
+  annotations: AnnotationsSchema.optional(),
+  /**
+   * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
+   * for notes on _meta usage.
+   */
+  _meta: record(string(), unknown()).optional()
+}), AudioContentSchema = object({
+  type: literal("audio"),
+  /**
+   * The base64-encoded audio data.
+   */
+  data: Base64Schema,
+  /**
+   * The MIME type of the audio. Different providers may support different audio types.
+   */
+  mimeType: string(),
+  /**
+   * Optional annotations for the client.
+   */
+  annotations: AnnotationsSchema.optional(),
+  /**
+   * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
+   * for notes on _meta usage.
+   */
+  _meta: record(string(), unknown()).optional()
+}), ToolUseContentSchema = object({
+  type: literal("tool_use"),
+  /**
+   * The name of the tool to invoke.
+   * Must match a tool name from the request's tools array.
+   */
+  name: string(),
+  /**
+   * Unique identifier for this tool call.
+   * Used to correlate with ToolResultContent in subsequent messages.
+   */
+  id: string(),
+  /**
+   * Arguments to pass to the tool.
+   * Must conform to the tool's inputSchema.
+   */
+  input: record(string(), unknown()),
+  /**
+   * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
+   * for notes on _meta usage.
+   */
+  _meta: record(string(), unknown()).optional()
+}), EmbeddedResourceSchema = object({
+  type: literal("resource"),
+  resource: union([TextResourceContentsSchema, BlobResourceContentsSchema]),
+  /**
+   * Optional annotations for the client.
+   */
+  annotations: AnnotationsSchema.optional(),
+  /**
+   * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
+   * for notes on _meta usage.
+   */
+  _meta: record(string(), unknown()).optional()
+}), ResourceLinkSchema = ResourceSchema.extend({
+  type: literal("resource_link")
+}), ContentBlockSchema = union([
+  TextContentSchema,
+  ImageContentSchema,
+  AudioContentSchema,
+  ResourceLinkSchema,
+  EmbeddedResourceSchema
+]), PromptMessageSchema = object({
+  role: RoleSchema,
+  content: ContentBlockSchema
+}), GetPromptResultSchema = ResultSchema.extend({
+  /**
+   * An optional description for the prompt.
+   */
+  description: string().optional(),
+  messages: array(PromptMessageSchema)
+}), PromptListChangedNotificationSchema = NotificationSchema.extend({
+  method: literal("notifications/prompts/list_changed"),
+  params: NotificationsParamsSchema.optional()
+}), ToolAnnotationsSchema = object({
+  /**
+   * A human-readable title for the tool.
+   */
+  title: string().optional(),
+  /**
+   * If true, the tool does not modify its environment.
+   *
+   * Default: false
+   */
+  readOnlyHint: boolean().optional(),
+  /**
+   * If true, the tool may perform destructive updates to its environment.
+   * If false, the tool performs only additive updates.
+   *
+   * (This property is meaningful only when `readOnlyHint == false`)
+   *
+   * Default: true
+   */
+  destructiveHint: boolean().optional(),
+  /**
+   * If true, calling the tool repeatedly with the same arguments
+   * will have no additional effect on the its environment.
+   *
+   * (This property is meaningful only when `readOnlyHint == false`)
+   *
+   * Default: false
+   */
+  idempotentHint: boolean().optional(),
+  /**
+   * If true, this tool may interact with an "open world" of external
+   * entities. If false, the tool's domain of interaction is closed.
+   * For example, the world of a web search tool is open, whereas that
+   * of a memory tool is not.
+   *
+   * Default: true
+   */
+  openWorldHint: boolean().optional()
+}), ToolExecutionSchema = object({
+  /**
+   * Indicates the tool's preference for task-augmented execution.
+   * - "required": Clients MUST invoke the tool as a task
+   * - "optional": Clients MAY invoke the tool as a task or normal request
+   * - "forbidden": Clients MUST NOT attempt to invoke the tool as a task
+   *
+   * If not present, defaults to "forbidden".
+   */
+  taskSupport: _enum(["required", "optional", "forbidden"]).optional()
+}), ToolSchema = object({
+  ...BaseMetadataSchema.shape,
+  ...IconsSchema.shape,
+  /**
+   * A human-readable description of the tool.
+   */
+  description: string().optional(),
+  /**
+   * A JSON Schema 2020-12 object defining the expected parameters for the tool.
+   * Must have type: 'object' at the root level per MCP spec.
+   */
+  inputSchema: object({
+    type: literal("object"),
+    properties: record(string(), AssertObjectSchema).optional(),
+    required: array(string()).optional()
+  }).catchall(unknown()),
+  /**
+   * An optional JSON Schema 2020-12 object defining the structure of the tool's output
+   * returned in the structuredContent field of a CallToolResult.
+   * Must have type: 'object' at the root level per MCP spec.
+   */
+  outputSchema: object({
+    type: literal("object"),
+    properties: record(string(), AssertObjectSchema).optional(),
+    required: array(string()).optional()
+  }).catchall(unknown()).optional(),
+  /**
+   * Optional additional tool information.
+   */
+  annotations: ToolAnnotationsSchema.optional(),
+  /**
+   * Execution-related properties for this tool.
+   */
+  execution: ToolExecutionSchema.optional(),
+  /**
+   * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
+   * for notes on _meta usage.
+   */
+  _meta: record(string(), unknown()).optional()
+}), ListToolsRequestSchema = PaginatedRequestSchema.extend({
+  method: literal("tools/list")
+}), ListToolsResultSchema = PaginatedResultSchema.extend({
+  tools: array(ToolSchema)
+}), CallToolResultSchema = ResultSchema.extend({
+  /**
+   * A list of content objects that represent the result of the tool call.
+   *
+   * If the Tool does not define an outputSchema, this field MUST be present in the result.
+   * For backwards compatibility, this field is always present, but it may be empty.
+   */
+  content: array(ContentBlockSchema).default([]),
+  /**
+   * An object containing structured tool output.
+   *
+   * If the Tool defines an outputSchema, this field MUST be present in the result, and contain a JSON object that matches the schema.
+   */
+  structuredContent: record(string(), unknown()).optional(),
+  /**
+   * Whether the tool call ended in an error.
+   *
+   * If not set, this is assumed to be false (the call was successful).
+   *
+   * Any errors that originate from the tool SHOULD be reported inside the result
+   * object, with `isError` set to true, _not_ as an MCP protocol-level error
+   * response. Otherwise, the LLM would not be able to see that an error occurred
+   * and self-correct.
+   *
+   * However, any errors in _finding_ the tool, an error indicating that the
+   * server does not support tool calls, or any other exceptional conditions,
+   * should be reported as an MCP error response.
+   */
+  isError: boolean().optional()
+}), CompatibilityCallToolResultSchema = CallToolResultSchema.or(ResultSchema.extend({
+  toolResult: unknown()
+})), CallToolRequestParamsSchema = TaskAugmentedRequestParamsSchema.extend({
+  /**
+   * The name of the tool to call.
+   */
+  name: string(),
+  /**
+   * Arguments to pass to the tool.
+   */
+  arguments: record(string(), unknown()).optional()
+}), CallToolRequestSchema = RequestSchema.extend({
+  method: literal("tools/call"),
+  params: CallToolRequestParamsSchema
+}), ToolListChangedNotificationSchema = NotificationSchema.extend({
+  method: literal("notifications/tools/list_changed"),
+  params: NotificationsParamsSchema.optional()
+}), ListChangedOptionsBaseSchema = object({
+  /**
+   * If true, the list will be refreshed automatically when a list changed notification is received.
+   * The callback will be called with the updated list.
+   *
+   * If false, the callback will be called with null items, allowing manual refresh.
+   *
+   * @default true
+   */
+  autoRefresh: boolean().default(!0),
+  /**
+   * Debounce time in milliseconds for list changed notification processing.
+   *
+   * Multiple notifications received within this timeframe will only trigger one refresh.
+   * Set to 0 to disable debouncing.
+   *
+   * @default 300
+   */
+  debounceMs: number().int().nonnegative().default(300)
+}), LoggingLevelSchema = _enum(["debug", "info", "notice", "warning", "error", "critical", "alert", "emergency"]), SetLevelRequestParamsSchema = BaseRequestParamsSchema.extend({
+  /**
+   * The level of logging that the client wants to receive from the server. The server should send all logs at this level and higher (i.e., more severe) to the client as notifications/logging/message.
+   */
+  level: LoggingLevelSchema
+}), SetLevelRequestSchema = RequestSchema.extend({
+  method: literal("logging/setLevel"),
+  params: SetLevelRequestParamsSchema
+}), LoggingMessageNotificationParamsSchema = NotificationsParamsSchema.extend({
+  /**
+   * The severity of this log message.
+   */
+  level: LoggingLevelSchema,
+  /**
+   * An optional name of the logger issuing this message.
+   */
+  logger: string().optional(),
+  /**
+   * The data to be logged, such as a string message or an object. Any JSON serializable type is allowed here.
+   */
+  data: unknown()
+}), LoggingMessageNotificationSchema = NotificationSchema.extend({
+  method: literal("notifications/message"),
+  params: LoggingMessageNotificationParamsSchema
+}), ModelHintSchema = object({
+  /**
+   * A hint for a model name.
+   */
+  name: string().optional()
+}), ModelPreferencesSchema = object({
+  /**
+   * Optional hints to use for model selection.
+   */
+  hints: array(ModelHintSchema).optional(),
+  /**
+   * How much to prioritize cost when selecting a model.
+   */
+  costPriority: number().min(0).max(1).optional(),
+  /**
+   * How much to prioritize sampling speed (latency) when selecting a model.
+   */
+  speedPriority: number().min(0).max(1).optional(),
+  /**
+   * How much to prioritize intelligence and capabilities when selecting a model.
+   */
+  intelligencePriority: number().min(0).max(1).optional()
+}), ToolChoiceSchema = object({
+  /**
+   * Controls when tools are used:
+   * - "auto": Model decides whether to use tools (default)
+   * - "required": Model MUST use at least one tool before completing
+   * - "none": Model MUST NOT use any tools
+   */
+  mode: _enum(["auto", "required", "none"]).optional()
+}), ToolResultContentSchema = object({
+  type: literal("tool_result"),
+  toolUseId: string().describe("The unique identifier for the corresponding tool call."),
+  content: array(ContentBlockSchema).default([]),
+  structuredContent: object({}).loose().optional(),
+  isError: boolean().optional(),
+  /**
+   * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
+   * for notes on _meta usage.
+   */
+  _meta: record(string(), unknown()).optional()
+}), SamplingContentSchema = discriminatedUnion("type", [TextContentSchema, ImageContentSchema, AudioContentSchema]), SamplingMessageContentBlockSchema = discriminatedUnion("type", [
+  TextContentSchema,
+  ImageContentSchema,
+  AudioContentSchema,
+  ToolUseContentSchema,
+  ToolResultContentSchema
+]), SamplingMessageSchema = object({
+  role: RoleSchema,
+  content: union([SamplingMessageContentBlockSchema, array(SamplingMessageContentBlockSchema)]),
+  /**
+   * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
+   * for notes on _meta usage.
+   */
+  _meta: record(string(), unknown()).optional()
+}), CreateMessageRequestParamsSchema = TaskAugmentedRequestParamsSchema.extend({
+  messages: array(SamplingMessageSchema),
+  /**
+   * The server's preferences for which model to select. The client MAY modify or omit this request.
+   */
+  modelPreferences: ModelPreferencesSchema.optional(),
+  /**
+   * An optional system prompt the server wants to use for sampling. The client MAY modify or omit this prompt.
+   */
+  systemPrompt: string().optional(),
+  /**
+   * A request to include context from one or more MCP servers (including the caller), to be attached to the prompt.
+   * The client MAY ignore this request.
+   *
+   * Default is "none". Values "thisServer" and "allServers" are soft-deprecated. Servers SHOULD only use these values if the client
+   * declares ClientCapabilities.sampling.context. These values may be removed in future spec releases.
+   */
+  includeContext: _enum(["none", "thisServer", "allServers"]).optional(),
+  temperature: number().optional(),
+  /**
+   * The requested maximum number of tokens to sample (to prevent runaway completions).
+   *
+   * The client MAY choose to sample fewer tokens than the requested maximum.
+   */
+  maxTokens: number().int(),
+  stopSequences: array(string()).optional(),
+  /**
+   * Optional metadata to pass through to the LLM provider. The format of this metadata is provider-specific.
+   */
+  metadata: AssertObjectSchema.optional(),
+  /**
+   * Tools that the model may use during generation.
+   * The client MUST return an error if this field is provided but ClientCapabilities.sampling.tools is not declared.
+   */
+  tools: array(ToolSchema).optional(),
+  /**
+   * Controls how the model uses tools.
+   * The client MUST return an error if this field is provided but ClientCapabilities.sampling.tools is not declared.
+   * Default is `{ mode: "auto" }`.
+   */
+  toolChoice: ToolChoiceSchema.optional()
+}), CreateMessageRequestSchema = RequestSchema.extend({
+  method: literal("sampling/createMessage"),
+  params: CreateMessageRequestParamsSchema
+}), CreateMessageResultSchema = ResultSchema.extend({
+  /**
+   * The name of the model that generated the message.
+   */
+  model: string(),
+  /**
+   * The reason why sampling stopped, if known.
+   *
+   * Standard values:
+   * - "endTurn": Natural end of the assistant's turn
+   * - "stopSequence": A stop sequence was encountered
+   * - "maxTokens": Maximum token limit was reached
+   *
+   * This field is an open string to allow for provider-specific stop reasons.
+   */
+  stopReason: optional(_enum(["endTurn", "stopSequence", "maxTokens"]).or(string())),
+  role: RoleSchema,
+  /**
+   * Response content. Single content block (text, image, or audio).
+   */
+  content: SamplingContentSchema
+}), CreateMessageResultWithToolsSchema = ResultSchema.extend({
+  /**
+   * The name of the model that generated the message.
+   */
+  model: string(),
+  /**
+   * The reason why sampling stopped, if known.
+   *
+   * Standard values:
+   * - "endTurn": Natural end of the assistant's turn
+   * - "stopSequence": A stop sequence was encountered
+   * - "maxTokens": Maximum token limit was reached
+   * - "toolUse": The model wants to use one or more tools
+   *
+   * This field is an open string to allow for provider-specific stop reasons.
+   */
+  stopReason: optional(_enum(["endTurn", "stopSequence", "maxTokens", "toolUse"]).or(string())),
+  role: RoleSchema,
+  /**
+   * Response content. May be a single block or array. May include ToolUseContent if stopReason is "toolUse".
+   */
+  content: union([SamplingMessageContentBlockSchema, array(SamplingMessageContentBlockSchema)])
+}), BooleanSchemaSchema = object({
+  type: literal("boolean"),
+  title: string().optional(),
+  description: string().optional(),
+  default: boolean().optional()
+}), StringSchemaSchema = object({
+  type: literal("string"),
+  title: string().optional(),
+  description: string().optional(),
+  minLength: number().optional(),
+  maxLength: number().optional(),
+  format: _enum(["email", "uri", "date", "date-time"]).optional(),
+  default: string().optional()
+}), NumberSchemaSchema = object({
+  type: _enum(["number", "integer"]),
+  title: string().optional(),
+  description: string().optional(),
+  minimum: number().optional(),
+  maximum: number().optional(),
+  default: number().optional()
+}), UntitledSingleSelectEnumSchemaSchema = object({
+  type: literal("string"),
+  title: string().optional(),
+  description: string().optional(),
+  enum: array(string()),
+  default: string().optional()
+}), TitledSingleSelectEnumSchemaSchema = object({
+  type: literal("string"),
+  title: string().optional(),
+  description: string().optional(),
+  oneOf: array(object({
+    const: string(),
+    title: string()
+  })),
+  default: string().optional()
+}), LegacyTitledEnumSchemaSchema = object({
+  type: literal("string"),
+  title: string().optional(),
+  description: string().optional(),
+  enum: array(string()),
+  enumNames: array(string()).optional(),
+  default: string().optional()
+}), SingleSelectEnumSchemaSchema = union([UntitledSingleSelectEnumSchemaSchema, TitledSingleSelectEnumSchemaSchema]), UntitledMultiSelectEnumSchemaSchema = object({
+  type: literal("array"),
+  title: string().optional(),
+  description: string().optional(),
+  minItems: number().optional(),
+  maxItems: number().optional(),
+  items: object({
+    type: literal("string"),
+    enum: array(string())
+  }),
+  default: array(string()).optional()
+}), TitledMultiSelectEnumSchemaSchema = object({
+  type: literal("array"),
+  title: string().optional(),
+  description: string().optional(),
+  minItems: number().optional(),
+  maxItems: number().optional(),
+  items: object({
+    anyOf: array(object({
+      const: string(),
+      title: string()
+    }))
+  }),
+  default: array(string()).optional()
+}), MultiSelectEnumSchemaSchema = union([UntitledMultiSelectEnumSchemaSchema, TitledMultiSelectEnumSchemaSchema]), EnumSchemaSchema = union([LegacyTitledEnumSchemaSchema, SingleSelectEnumSchemaSchema, MultiSelectEnumSchemaSchema]), PrimitiveSchemaDefinitionSchema = union([EnumSchemaSchema, BooleanSchemaSchema, StringSchemaSchema, NumberSchemaSchema]), ElicitRequestFormParamsSchema = TaskAugmentedRequestParamsSchema.extend({
+  /**
+   * The elicitation mode.
+   *
+   * Optional for backward compatibility. Clients MUST treat missing mode as "form".
+   */
+  mode: literal("form").optional(),
+  /**
+   * The message to present to the user describing what information is being requested.
+   */
+  message: string(),
+  /**
+   * A restricted subset of JSON Schema.
+   * Only top-level properties are allowed, without nesting.
+   */
+  requestedSchema: object({
+    type: literal("object"),
+    properties: record(string(), PrimitiveSchemaDefinitionSchema),
+    required: array(string()).optional()
+  })
+}), ElicitRequestURLParamsSchema = TaskAugmentedRequestParamsSchema.extend({
+  /**
+   * The elicitation mode.
+   */
+  mode: literal("url"),
+  /**
+   * The message to present to the user explaining why the interaction is needed.
+   */
+  message: string(),
+  /**
+   * The ID of the elicitation, which must be unique within the context of the server.
+   * The client MUST treat this ID as an opaque value.
+   */
+  elicitationId: string(),
+  /**
+   * The URL that the user should navigate to.
+   */
+  url: string().url()
+}), ElicitRequestParamsSchema = union([ElicitRequestFormParamsSchema, ElicitRequestURLParamsSchema]), ElicitRequestSchema = RequestSchema.extend({
+  method: literal("elicitation/create"),
+  params: ElicitRequestParamsSchema
+}), ElicitationCompleteNotificationParamsSchema = NotificationsParamsSchema.extend({
+  /**
+   * The ID of the elicitation that completed.
+   */
+  elicitationId: string()
+}), ElicitationCompleteNotificationSchema = NotificationSchema.extend({
+  method: literal("notifications/elicitation/complete"),
+  params: ElicitationCompleteNotificationParamsSchema
+}), ElicitResultSchema = ResultSchema.extend({
+  /**
+   * The user action in response to the elicitation.
+   * - "accept": User submitted the form/confirmed the action
+   * - "decline": User explicitly decline the action
+   * - "cancel": User dismissed without making an explicit choice
+   */
+  action: _enum(["accept", "decline", "cancel"]),
+  /**
+   * The submitted form data, only present when action is "accept".
+   * Contains values matching the requested schema.
+   * Per MCP spec, content is "typically omitted" for decline/cancel actions.
+   * We normalize null to undefined for leniency while maintaining type compatibility.
+   */
+  content: preprocess((val) => val === null ? void 0 : val, record(string(), union([string(), number(), boolean(), array(string())])).optional())
+}), ResourceTemplateReferenceSchema = object({
+  type: literal("ref/resource"),
+  /**
+   * The URI or URI template of the resource.
+   */
+  uri: string()
+});
+var PromptReferenceSchema = object({
+  type: literal("ref/prompt"),
+  /**
+   * The name of the prompt or prompt template
+   */
+  name: string()
+}), CompleteRequestParamsSchema = BaseRequestParamsSchema.extend({
+  ref: union([PromptReferenceSchema, ResourceTemplateReferenceSchema]),
+  /**
+   * The argument's information
+   */
+  argument: object({
+    /**
+     * The name of the argument
+     */
+    name: string(),
+    /**
+     * The value of the argument to use for completion matching.
+     */
+    value: string()
+  }),
+  context: object({
+    /**
+     * Previously-resolved variables in a URI template or prompt.
+     */
+    arguments: record(string(), string()).optional()
+  }).optional()
+}), CompleteRequestSchema = RequestSchema.extend({
+  method: literal("completion/complete"),
+  params: CompleteRequestParamsSchema
+});
+var CompleteResultSchema = ResultSchema.extend({
+  completion: looseObject({
+    /**
+     * An array of completion values. Must not exceed 100 items.
+     */
+    values: array(string()).max(100),
+    /**
+     * The total number of completion options available. This can exceed the number of values actually sent in the response.
+     */
+    total: optional(number().int()),
+    /**
+     * Indicates whether there are additional completion options beyond those provided in the current response, even if the exact total is unknown.
+     */
+    hasMore: optional(boolean())
+  })
+}), RootSchema = object({
+  /**
+   * The URI identifying the root. This *must* start with file:// for now.
+   */
+  uri: string().startsWith("file://"),
+  /**
+   * An optional name for the root.
+   */
+  name: string().optional(),
+  /**
+   * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
+   * for notes on _meta usage.
+   */
+  _meta: record(string(), unknown()).optional()
+}), ListRootsRequestSchema = RequestSchema.extend({
+  method: literal("roots/list"),
+  params: BaseRequestParamsSchema.optional()
+}), ListRootsResultSchema = ResultSchema.extend({
+  roots: array(RootSchema)
+}), RootsListChangedNotificationSchema = NotificationSchema.extend({
+  method: literal("notifications/roots/list_changed"),
+  params: NotificationsParamsSchema.optional()
+}), ClientRequestSchema = union([
+  PingRequestSchema,
+  InitializeRequestSchema,
+  CompleteRequestSchema,
+  SetLevelRequestSchema,
+  GetPromptRequestSchema,
+  ListPromptsRequestSchema,
+  ListResourcesRequestSchema,
+  ListResourceTemplatesRequestSchema,
+  ReadResourceRequestSchema,
+  SubscribeRequestSchema,
+  UnsubscribeRequestSchema,
+  CallToolRequestSchema,
+  ListToolsRequestSchema,
+  GetTaskRequestSchema,
+  GetTaskPayloadRequestSchema,
+  ListTasksRequestSchema,
+  CancelTaskRequestSchema
+]), ClientNotificationSchema = union([
+  CancelledNotificationSchema,
+  ProgressNotificationSchema,
+  InitializedNotificationSchema,
+  RootsListChangedNotificationSchema,
+  TaskStatusNotificationSchema
+]), ClientResultSchema = union([
+  EmptyResultSchema,
+  CreateMessageResultSchema,
+  CreateMessageResultWithToolsSchema,
+  ElicitResultSchema,
+  ListRootsResultSchema,
+  GetTaskResultSchema,
+  ListTasksResultSchema,
+  CreateTaskResultSchema
+]), ServerRequestSchema = union([
+  PingRequestSchema,
+  CreateMessageRequestSchema,
+  ElicitRequestSchema,
+  ListRootsRequestSchema,
+  GetTaskRequestSchema,
+  GetTaskPayloadRequestSchema,
+  ListTasksRequestSchema,
+  CancelTaskRequestSchema
+]), ServerNotificationSchema = union([
+  CancelledNotificationSchema,
+  ProgressNotificationSchema,
+  LoggingMessageNotificationSchema,
+  ResourceUpdatedNotificationSchema,
+  ResourceListChangedNotificationSchema,
+  ToolListChangedNotificationSchema,
+  PromptListChangedNotificationSchema,
+  TaskStatusNotificationSchema,
+  ElicitationCompleteNotificationSchema
+]), ServerResultSchema = union([
+  EmptyResultSchema,
+  InitializeResultSchema,
+  CompleteResultSchema,
+  GetPromptResultSchema,
+  ListPromptsResultSchema,
+  ListResourcesResultSchema,
+  ListResourceTemplatesResultSchema,
+  ReadResourceResultSchema,
+  CallToolResultSchema,
+  ListToolsResultSchema,
+  GetTaskResultSchema,
+  ListTasksResultSchema,
+  CreateTaskResultSchema
+]), McpError = class _McpError extends Error {
+  constructor(code, message, data) {
+    super(`MCP error ${code}: ${message}`), this.code = code, this.data = data, this.name = "McpError";
+  }
+  /**
+   * Factory method to create the appropriate error type based on the error code and data
+   */
+  static fromError(code, message, data) {
+    if (code === ErrorCode.UrlElicitationRequired && data) {
+      let errorData = data;
+      if (errorData.elicitations)
+        return new UrlElicitationRequiredError(errorData.elicitations, message);
+    }
+    return new _McpError(code, message, data);
+  }
+}, UrlElicitationRequiredError = class extends McpError {
+  constructor(elicitations, message = `URL elicitation${elicitations.length > 1 ? "s" : ""} required`) {
+    super(ErrorCode.UrlElicitationRequired, message, {
+      elicitations
+    });
+  }
+  get elicitations() {
+    return this.data?.elicitations ?? [];
+  }
+};
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
+var SafeUrlSchema = url().superRefine((val, ctx) => {
+  if (!URL.canParse(val))
+    return ctx.addIssue({
+      code: ZodIssueCode.custom,
+      message: "URL must be parseable",
+      fatal: !0
+    }), NEVER;
+}).refine((url2) => {
+  let u = new URL(url2);
+  return u.protocol !== "javascript:" && u.protocol !== "data:" && u.protocol !== "vbscript:";
+}, { message: "URL cannot use javascript:, data:, or vbscript: scheme" }), OAuthProtectedResourceMetadataSchema = looseObject({
+  resource: string().url(),
+  authorization_servers: array(SafeUrlSchema).optional(),
+  jwks_uri: string().url().optional(),
+  scopes_supported: array(string()).optional(),
+  bearer_methods_supported: array(string()).optional(),
+  resource_signing_alg_values_supported: array(string()).optional(),
+  resource_name: string().optional(),
+  resource_documentation: string().optional(),
+  resource_policy_uri: string().url().optional(),
+  resource_tos_uri: string().url().optional(),
+  tls_client_certificate_bound_access_tokens: boolean().optional(),
+  authorization_details_types_supported: array(string()).optional(),
+  dpop_signing_alg_values_supported: array(string()).optional(),
+  dpop_bound_access_tokens_required: boolean().optional()
+}), OAuthMetadataSchema = looseObject({
+  issuer: string(),
+  authorization_endpoint: SafeUrlSchema,
+  token_endpoint: SafeUrlSchema,
+  registration_endpoint: SafeUrlSchema.optional(),
+  scopes_supported: array(string()).optional(),
+  response_types_supported: array(string()),
+  response_modes_supported: array(string()).optional(),
+  grant_types_supported: array(string()).optional(),
+  token_endpoint_auth_methods_supported: array(string()).optional(),
+  token_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+  service_documentation: SafeUrlSchema.optional(),
+  revocation_endpoint: SafeUrlSchema.optional(),
+  revocation_endpoint_auth_methods_supported: array(string()).optional(),
+  revocation_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+  introspection_endpoint: string().optional(),
+  introspection_endpoint_auth_methods_supported: array(string()).optional(),
+  introspection_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+  code_challenge_methods_supported: array(string()).optional(),
+  client_id_metadata_document_supported: boolean().optional()
+}), OpenIdProviderMetadataSchema = looseObject({
+  issuer: string(),
+  authorization_endpoint: SafeUrlSchema,
+  token_endpoint: SafeUrlSchema,
+  userinfo_endpoint: SafeUrlSchema.optional(),
+  jwks_uri: SafeUrlSchema,
+  registration_endpoint: SafeUrlSchema.optional(),
+  scopes_supported: array(string()).optional(),
+  response_types_supported: array(string()),
+  response_modes_supported: array(string()).optional(),
+  grant_types_supported: array(string()).optional(),
+  acr_values_supported: array(string()).optional(),
+  subject_types_supported: array(string()),
+  id_token_signing_alg_values_supported: array(string()),
+  id_token_encryption_alg_values_supported: array(string()).optional(),
+  id_token_encryption_enc_values_supported: array(string()).optional(),
+  userinfo_signing_alg_values_supported: array(string()).optional(),
+  userinfo_encryption_alg_values_supported: array(string()).optional(),
+  userinfo_encryption_enc_values_supported: array(string()).optional(),
+  request_object_signing_alg_values_supported: array(string()).optional(),
+  request_object_encryption_alg_values_supported: array(string()).optional(),
+  request_object_encryption_enc_values_supported: array(string()).optional(),
+  token_endpoint_auth_methods_supported: array(string()).optional(),
+  token_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+  display_values_supported: array(string()).optional(),
+  claim_types_supported: array(string()).optional(),
+  claims_supported: array(string()).optional(),
+  service_documentation: string().optional(),
+  claims_locales_supported: array(string()).optional(),
+  ui_locales_supported: array(string()).optional(),
+  claims_parameter_supported: boolean().optional(),
+  request_parameter_supported: boolean().optional(),
+  request_uri_parameter_supported: boolean().optional(),
+  require_request_uri_registration: boolean().optional(),
+  op_policy_uri: SafeUrlSchema.optional(),
+  op_tos_uri: SafeUrlSchema.optional(),
+  client_id_metadata_document_supported: boolean().optional()
+}), OpenIdProviderDiscoveryMetadataSchema = object({
+  ...OpenIdProviderMetadataSchema.shape,
+  ...OAuthMetadataSchema.pick({
+    code_challenge_methods_supported: !0
+  }).shape
+}), OAuthTokensSchema = object({
+  access_token: string(),
+  id_token: string().optional(),
+  // Optional for OAuth 2.1, but necessary in OpenID Connect
+  token_type: string(),
+  expires_in: coerce_exports.number().optional(),
+  scope: string().optional(),
+  refresh_token: string().optional()
+}).strip(), OAuthErrorResponseSchema = object({
+  error: string(),
+  error_description: string().optional(),
+  error_uri: string().optional()
+}), OptionalSafeUrlSchema = SafeUrlSchema.optional().or(literal("").transform(() => {
+})), OAuthClientMetadataSchema = object({
+  redirect_uris: array(SafeUrlSchema),
+  token_endpoint_auth_method: string().optional(),
+  grant_types: array(string()).optional(),
+  response_types: array(string()).optional(),
+  client_name: string().optional(),
+  client_uri: SafeUrlSchema.optional(),
+  logo_uri: OptionalSafeUrlSchema,
+  scope: string().optional(),
+  contacts: array(string()).optional(),
+  tos_uri: OptionalSafeUrlSchema,
+  policy_uri: string().optional(),
+  jwks_uri: SafeUrlSchema.optional(),
+  jwks: any().optional(),
+  software_id: string().optional(),
+  software_version: string().optional(),
+  software_statement: string().optional()
+}).strip(), OAuthClientInformationSchema = object({
+  client_id: string(),
+  client_secret: string().optional(),
+  client_id_issued_at: number().optional(),
+  client_secret_expires_at: number().optional()
+}).strip(), OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema), OAuthClientRegistrationErrorSchema = object({
+  error: string(),
+  error_description: string().optional()
+}).strip(), OAuthTokenRevocationRequestSchema = object({
+  token: string(),
+  token_type_hint: string().optional()
+}).strip();
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth-utils.js
+function resourceUrlFromServerUrl(url2) {
+  let resourceURL = typeof url2 == "string" ? new URL(url2) : new URL(url2.href);
+  return resourceURL.hash = "", resourceURL;
+}
+function checkResourceAllowed({ requestedResource, configuredResource }) {
+  let requested = typeof requestedResource == "string" ? new URL(requestedResource) : new URL(requestedResource.href), configured = typeof configuredResource == "string" ? new URL(configuredResource) : new URL(configuredResource.href);
+  if (requested.origin !== configured.origin || requested.pathname.length < configured.pathname.length)
+    return !1;
+  let requestedPath = requested.pathname.endsWith("/") ? requested.pathname : requested.pathname + "/", configuredPath = configured.pathname.endsWith("/") ? configured.pathname : configured.pathname + "/";
+  return requestedPath.startsWith(configuredPath);
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/server/auth/errors.js
+var OAuthError = class extends Error {
+  constructor(message, errorUri) {
+    super(message), this.errorUri = errorUri, this.name = this.constructor.name;
+  }
+  /**
+   * Converts the error to a standard OAuth error response object
+   */
+  toResponseObject() {
+    let response = {
+      error: this.errorCode,
+      error_description: this.message
+    };
+    return this.errorUri && (response.error_uri = this.errorUri), response;
+  }
+  get errorCode() {
+    return this.constructor.errorCode;
+  }
+}, InvalidRequestError = class extends OAuthError {
+};
+InvalidRequestError.errorCode = "invalid_request";
+var InvalidClientError = class extends OAuthError {
+};
+InvalidClientError.errorCode = "invalid_client";
+var InvalidGrantError = class extends OAuthError {
+};
+InvalidGrantError.errorCode = "invalid_grant";
+var UnauthorizedClientError = class extends OAuthError {
+};
+UnauthorizedClientError.errorCode = "unauthorized_client";
+var UnsupportedGrantTypeError = class extends OAuthError {
+};
+UnsupportedGrantTypeError.errorCode = "unsupported_grant_type";
+var InvalidScopeError = class extends OAuthError {
+};
+InvalidScopeError.errorCode = "invalid_scope";
+var AccessDeniedError = class extends OAuthError {
+};
+AccessDeniedError.errorCode = "access_denied";
+var ServerError = class extends OAuthError {
+};
+ServerError.errorCode = "server_error";
+var TemporarilyUnavailableError = class extends OAuthError {
+};
+TemporarilyUnavailableError.errorCode = "temporarily_unavailable";
+var UnsupportedResponseTypeError = class extends OAuthError {
+};
+UnsupportedResponseTypeError.errorCode = "unsupported_response_type";
+var UnsupportedTokenTypeError = class extends OAuthError {
+};
+UnsupportedTokenTypeError.errorCode = "unsupported_token_type";
+var InvalidTokenError = class extends OAuthError {
+};
+InvalidTokenError.errorCode = "invalid_token";
+var MethodNotAllowedError = class extends OAuthError {
+};
+MethodNotAllowedError.errorCode = "method_not_allowed";
+var TooManyRequestsError = class extends OAuthError {
+};
+TooManyRequestsError.errorCode = "too_many_requests";
+var InvalidClientMetadataError = class extends OAuthError {
+};
+InvalidClientMetadataError.errorCode = "invalid_client_metadata";
+var InsufficientScopeError = class extends OAuthError {
+};
+InsufficientScopeError.errorCode = "insufficient_scope";
+var InvalidTargetError = class extends OAuthError {
+};
+InvalidTargetError.errorCode = "invalid_target";
+var OAUTH_ERRORS = {
+  [InvalidRequestError.errorCode]: InvalidRequestError,
+  [InvalidClientError.errorCode]: InvalidClientError,
+  [InvalidGrantError.errorCode]: InvalidGrantError,
+  [UnauthorizedClientError.errorCode]: UnauthorizedClientError,
+  [UnsupportedGrantTypeError.errorCode]: UnsupportedGrantTypeError,
+  [InvalidScopeError.errorCode]: InvalidScopeError,
+  [AccessDeniedError.errorCode]: AccessDeniedError,
+  [ServerError.errorCode]: ServerError,
+  [TemporarilyUnavailableError.errorCode]: TemporarilyUnavailableError,
+  [UnsupportedResponseTypeError.errorCode]: UnsupportedResponseTypeError,
+  [UnsupportedTokenTypeError.errorCode]: UnsupportedTokenTypeError,
+  [InvalidTokenError.errorCode]: InvalidTokenError,
+  [MethodNotAllowedError.errorCode]: MethodNotAllowedError,
+  [TooManyRequestsError.errorCode]: TooManyRequestsError,
+  [InvalidClientMetadataError.errorCode]: InvalidClientMetadataError,
+  [InsufficientScopeError.errorCode]: InsufficientScopeError,
+  [InvalidTargetError.errorCode]: InvalidTargetError
+};
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/client/auth.js
+var UnauthorizedError = class extends Error {
+  constructor(message) {
+    super(message ?? "Unauthorized");
+  }
+};
+function isClientAuthMethod(method) {
+  return ["client_secret_basic", "client_secret_post", "none"].includes(method);
+}
+var AUTHORIZATION_CODE_RESPONSE_TYPE = "code", AUTHORIZATION_CODE_CHALLENGE_METHOD = "S256";
+function selectClientAuthMethod(clientInformation, supportedMethods) {
+  let hasClientSecret = clientInformation.client_secret !== void 0;
+  return "token_endpoint_auth_method" in clientInformation && clientInformation.token_endpoint_auth_method && isClientAuthMethod(clientInformation.token_endpoint_auth_method) && (supportedMethods.length === 0 || supportedMethods.includes(clientInformation.token_endpoint_auth_method)) ? clientInformation.token_endpoint_auth_method : supportedMethods.length === 0 ? hasClientSecret ? "client_secret_basic" : "none" : hasClientSecret && supportedMethods.includes("client_secret_basic") ? "client_secret_basic" : hasClientSecret && supportedMethods.includes("client_secret_post") ? "client_secret_post" : supportedMethods.includes("none") ? "none" : hasClientSecret ? "client_secret_post" : "none";
+}
+function applyClientAuthentication(method, clientInformation, headers, params) {
+  let { client_id, client_secret } = clientInformation;
+  switch (method) {
+    case "client_secret_basic":
+      applyBasicAuth(client_id, client_secret, headers);
+      return;
+    case "client_secret_post":
+      applyPostAuth(client_id, client_secret, params);
+      return;
+    case "none":
+      applyPublicAuth(client_id, params);
+      return;
+    default:
+      throw new Error(`Unsupported client authentication method: ${method}`);
+  }
+}
+function applyBasicAuth(clientId, clientSecret, headers) {
+  if (!clientSecret)
+    throw new Error("client_secret_basic authentication requires a client_secret");
+  let credentials = btoa(`${clientId}:${clientSecret}`);
+  headers.set("Authorization", `Basic ${credentials}`);
+}
+function applyPostAuth(clientId, clientSecret, params) {
+  params.set("client_id", clientId), clientSecret && params.set("client_secret", clientSecret);
+}
+function applyPublicAuth(clientId, params) {
+  params.set("client_id", clientId);
+}
+async function parseErrorResponse(input) {
+  let statusCode = input instanceof Response ? input.status : void 0, body = input instanceof Response ? await input.text() : input;
+  try {
+    let result = OAuthErrorResponseSchema.parse(JSON.parse(body)), { error, error_description, error_uri } = result, errorClass = OAUTH_ERRORS[error] || ServerError;
+    return new errorClass(error_description || "", error_uri);
+  } catch (error) {
+    let errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ""}Invalid OAuth error response: ${error}. Raw body: ${body}`;
+    return new ServerError(errorMessage);
+  }
+}
+async function auth(provider, options) {
+  try {
+    return await authInternal(provider, options);
+  } catch (error) {
+    if (error instanceof InvalidClientError || error instanceof UnauthorizedClientError)
+      return await provider.invalidateCredentials?.("all"), await authInternal(provider, options);
+    if (error instanceof InvalidGrantError)
+      return await provider.invalidateCredentials?.("tokens"), await authInternal(provider, options);
+    throw error;
+  }
+}
+async function authInternal(provider, { serverUrl, authorizationCode, scope, resourceMetadataUrl, fetchFn }) {
+  let cachedState = await provider.discoveryState?.(), resourceMetadata, authorizationServerUrl, metadata, effectiveResourceMetadataUrl = resourceMetadataUrl;
+  if (!effectiveResourceMetadataUrl && cachedState?.resourceMetadataUrl && (effectiveResourceMetadataUrl = new URL(cachedState.resourceMetadataUrl)), cachedState?.authorizationServerUrl) {
+    if (authorizationServerUrl = cachedState.authorizationServerUrl, resourceMetadata = cachedState.resourceMetadata, metadata = cachedState.authorizationServerMetadata ?? await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn }), !resourceMetadata)
+      try {
+        resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl }, fetchFn);
+      } catch {
+      }
+    (metadata !== cachedState.authorizationServerMetadata || resourceMetadata !== cachedState.resourceMetadata) && await provider.saveDiscoveryState?.({
+      authorizationServerUrl: String(authorizationServerUrl),
+      resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
+      resourceMetadata,
+      authorizationServerMetadata: metadata
+    });
+  } else {
+    let serverInfo = await discoverOAuthServerInfo(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl, fetchFn });
+    authorizationServerUrl = serverInfo.authorizationServerUrl, metadata = serverInfo.authorizationServerMetadata, resourceMetadata = serverInfo.resourceMetadata, await provider.saveDiscoveryState?.({
+      authorizationServerUrl: String(authorizationServerUrl),
+      resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
+      resourceMetadata,
+      authorizationServerMetadata: metadata
+    });
+  }
+  let resource = await selectResourceURL(serverUrl, provider, resourceMetadata), resolvedScope = scope || resourceMetadata?.scopes_supported?.join(" ") || provider.clientMetadata.scope, clientInformation = await Promise.resolve(provider.clientInformation());
+  if (!clientInformation) {
+    if (authorizationCode !== void 0)
+      throw new Error("Existing OAuth client information is required when exchanging an authorization code");
+    let supportsUrlBasedClientId = metadata?.client_id_metadata_document_supported === !0, clientMetadataUrl = provider.clientMetadataUrl;
+    if (clientMetadataUrl && !isHttpsUrl(clientMetadataUrl))
+      throw new InvalidClientMetadataError(`clientMetadataUrl must be a valid HTTPS URL with a non-root pathname, got: ${clientMetadataUrl}`);
+    if (supportsUrlBasedClientId && clientMetadataUrl)
+      clientInformation = {
+        client_id: clientMetadataUrl
+      }, await provider.saveClientInformation?.(clientInformation);
+    else {
+      if (!provider.saveClientInformation)
+        throw new Error("OAuth client information must be saveable for dynamic registration");
+      let fullInformation = await registerClient(authorizationServerUrl, {
+        metadata,
+        clientMetadata: provider.clientMetadata,
+        scope: resolvedScope,
+        fetchFn
+      });
+      await provider.saveClientInformation(fullInformation), clientInformation = fullInformation;
+    }
+  }
+  let nonInteractiveFlow = !provider.redirectUrl;
+  if (authorizationCode !== void 0 || nonInteractiveFlow) {
+    let tokens2 = await fetchToken(provider, authorizationServerUrl, {
+      metadata,
+      resource,
+      authorizationCode,
+      fetchFn
+    });
+    return await provider.saveTokens(tokens2), "AUTHORIZED";
+  }
+  let tokens = await provider.tokens();
+  if (tokens?.refresh_token)
+    try {
+      let newTokens = await refreshAuthorization(authorizationServerUrl, {
+        metadata,
+        clientInformation,
+        refreshToken: tokens.refresh_token,
+        resource,
+        addClientAuthentication: provider.addClientAuthentication,
+        fetchFn
+      });
+      return await provider.saveTokens(newTokens), "AUTHORIZED";
+    } catch (error) {
+      if (!(!(error instanceof OAuthError) || error instanceof ServerError))
+        throw error;
+    }
+  let state = provider.state ? await provider.state() : void 0, { authorizationUrl, codeVerifier } = await startAuthorization(authorizationServerUrl, {
+    metadata,
+    clientInformation,
+    state,
+    redirectUrl: provider.redirectUrl,
+    scope: resolvedScope,
+    resource
+  });
+  return await provider.saveCodeVerifier(codeVerifier), await provider.redirectToAuthorization(authorizationUrl), "REDIRECT";
+}
+function isHttpsUrl(value) {
+  if (!value)
+    return !1;
+  try {
+    let url2 = new URL(value);
+    return url2.protocol === "https:" && url2.pathname !== "/";
+  } catch {
+    return !1;
+  }
+}
+async function selectResourceURL(serverUrl, provider, resourceMetadata) {
+  let defaultResource = resourceUrlFromServerUrl(serverUrl);
+  if (provider.validateResourceURL)
+    return await provider.validateResourceURL(defaultResource, resourceMetadata?.resource);
+  if (resourceMetadata) {
+    if (!checkResourceAllowed({ requestedResource: defaultResource, configuredResource: resourceMetadata.resource }))
+      throw new Error(`Protected resource ${resourceMetadata.resource} does not match expected ${defaultResource} (or origin)`);
+    return new URL(resourceMetadata.resource);
+  }
+}
+function extractWWWAuthenticateParams(res) {
+  let authenticateHeader = res.headers.get("WWW-Authenticate");
+  if (!authenticateHeader)
+    return {};
+  let [type, scheme] = authenticateHeader.split(" ");
+  if (type.toLowerCase() !== "bearer" || !scheme)
+    return {};
+  let resourceMetadataMatch = extractFieldFromWwwAuth(res, "resource_metadata") || void 0, resourceMetadataUrl;
+  if (resourceMetadataMatch)
+    try {
+      resourceMetadataUrl = new URL(resourceMetadataMatch);
+    } catch {
+    }
+  let scope = extractFieldFromWwwAuth(res, "scope") || void 0, error = extractFieldFromWwwAuth(res, "error") || void 0;
+  return {
+    resourceMetadataUrl,
+    scope,
+    error
+  };
+}
+function extractFieldFromWwwAuth(response, fieldName) {
+  let wwwAuthHeader = response.headers.get("WWW-Authenticate");
+  if (!wwwAuthHeader)
+    return null;
+  let pattern = new RegExp(`${fieldName}=(?:"([^"]+)"|([^\\s,]+))`), match = wwwAuthHeader.match(pattern);
+  return match ? match[1] || match[2] : null;
+}
+async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn = fetch) {
+  let response = await discoverMetadataWithFallback(serverUrl, "oauth-protected-resource", fetchFn, {
+    protocolVersion: opts?.protocolVersion,
+    metadataUrl: opts?.resourceMetadataUrl
+  });
+  if (!response || response.status === 404)
+    throw await response?.body?.cancel(), new Error("Resource server does not implement OAuth 2.0 Protected Resource Metadata.");
+  if (!response.ok)
+    throw await response.body?.cancel(), new Error(`HTTP ${response.status} trying to load well-known OAuth protected resource metadata.`);
+  return OAuthProtectedResourceMetadataSchema.parse(await response.json());
+}
+async function fetchWithCorsRetry(url2, headers, fetchFn = fetch) {
+  try {
+    return await fetchFn(url2, { headers });
+  } catch (error) {
+    if (error instanceof TypeError)
+      return headers ? fetchWithCorsRetry(url2, void 0, fetchFn) : void 0;
+    throw error;
+  }
+}
+function buildWellKnownPath(wellKnownPrefix, pathname = "", options = {}) {
+  return pathname.endsWith("/") && (pathname = pathname.slice(0, -1)), options.prependPathname ? `${pathname}/.well-known/${wellKnownPrefix}` : `/.well-known/${wellKnownPrefix}${pathname}`;
+}
+async function tryMetadataDiscovery(url2, protocolVersion, fetchFn = fetch) {
+  return await fetchWithCorsRetry(url2, {
+    "MCP-Protocol-Version": protocolVersion
+  }, fetchFn);
+}
+function shouldAttemptFallback(response, pathname) {
+  return !response || response.status >= 400 && response.status < 500 && pathname !== "/";
+}
+async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, opts) {
+  let issuer = new URL(serverUrl), protocolVersion = opts?.protocolVersion ?? LATEST_PROTOCOL_VERSION, url2;
+  if (opts?.metadataUrl)
+    url2 = new URL(opts.metadataUrl);
+  else {
+    let wellKnownPath = buildWellKnownPath(wellKnownType, issuer.pathname);
+    url2 = new URL(wellKnownPath, opts?.metadataServerUrl ?? issuer), url2.search = issuer.search;
+  }
+  let response = await tryMetadataDiscovery(url2, protocolVersion, fetchFn);
+  if (!opts?.metadataUrl && shouldAttemptFallback(response, issuer.pathname)) {
+    let rootUrl = new URL(`/.well-known/${wellKnownType}`, issuer);
+    response = await tryMetadataDiscovery(rootUrl, protocolVersion, fetchFn);
+  }
+  return response;
+}
+function buildDiscoveryUrls(authorizationServerUrl) {
+  let url2 = typeof authorizationServerUrl == "string" ? new URL(authorizationServerUrl) : authorizationServerUrl, hasPath = url2.pathname !== "/", urlsToTry = [];
+  if (!hasPath)
+    return urlsToTry.push({
+      url: new URL("/.well-known/oauth-authorization-server", url2.origin),
+      type: "oauth"
+    }), urlsToTry.push({
+      url: new URL("/.well-known/openid-configuration", url2.origin),
+      type: "oidc"
+    }), urlsToTry;
+  let pathname = url2.pathname;
+  return pathname.endsWith("/") && (pathname = pathname.slice(0, -1)), urlsToTry.push({
+    url: new URL(`/.well-known/oauth-authorization-server${pathname}`, url2.origin),
+    type: "oauth"
+  }), urlsToTry.push({
+    url: new URL(`/.well-known/openid-configuration${pathname}`, url2.origin),
+    type: "oidc"
+  }), urlsToTry.push({
+    url: new URL(`${pathname}/.well-known/openid-configuration`, url2.origin),
+    type: "oidc"
+  }), urlsToTry;
+}
+async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn = fetch, protocolVersion = LATEST_PROTOCOL_VERSION } = {}) {
+  let headers = {
+    "MCP-Protocol-Version": protocolVersion,
+    Accept: "application/json"
+  }, urlsToTry = buildDiscoveryUrls(authorizationServerUrl);
+  for (let { url: endpointUrl, type } of urlsToTry) {
+    let response = await fetchWithCorsRetry(endpointUrl, headers, fetchFn);
+    if (response) {
+      if (!response.ok) {
+        if (await response.body?.cancel(), response.status >= 400 && response.status < 500)
+          continue;
+        throw new Error(`HTTP ${response.status} trying to load ${type === "oauth" ? "OAuth" : "OpenID provider"} metadata from ${endpointUrl}`);
+      }
+      return type === "oauth" ? OAuthMetadataSchema.parse(await response.json()) : OpenIdProviderDiscoveryMetadataSchema.parse(await response.json());
+    }
+  }
+}
+async function discoverOAuthServerInfo(serverUrl, opts) {
+  let resourceMetadata, authorizationServerUrl;
+  try {
+    resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: opts?.resourceMetadataUrl }, opts?.fetchFn), resourceMetadata.authorization_servers && resourceMetadata.authorization_servers.length > 0 && (authorizationServerUrl = resourceMetadata.authorization_servers[0]);
+  } catch {
+  }
+  authorizationServerUrl || (authorizationServerUrl = String(new URL("/", serverUrl)));
+  let authorizationServerMetadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn: opts?.fetchFn });
+  return {
+    authorizationServerUrl,
+    authorizationServerMetadata,
+    resourceMetadata
+  };
+}
+async function startAuthorization(authorizationServerUrl, { metadata, clientInformation, redirectUrl, scope, state, resource }) {
+  let authorizationUrl;
+  if (metadata) {
+    if (authorizationUrl = new URL(metadata.authorization_endpoint), !metadata.response_types_supported.includes(AUTHORIZATION_CODE_RESPONSE_TYPE))
+      throw new Error(`Incompatible auth server: does not support response type ${AUTHORIZATION_CODE_RESPONSE_TYPE}`);
+    if (metadata.code_challenge_methods_supported && !metadata.code_challenge_methods_supported.includes(AUTHORIZATION_CODE_CHALLENGE_METHOD))
+      throw new Error(`Incompatible auth server: does not support code challenge method ${AUTHORIZATION_CODE_CHALLENGE_METHOD}`);
+  } else
+    authorizationUrl = new URL("/authorize", authorizationServerUrl);
+  let challenge = await pkceChallenge(), codeVerifier = challenge.code_verifier, codeChallenge = challenge.code_challenge;
+  return authorizationUrl.searchParams.set("response_type", AUTHORIZATION_CODE_RESPONSE_TYPE), authorizationUrl.searchParams.set("client_id", clientInformation.client_id), authorizationUrl.searchParams.set("code_challenge", codeChallenge), authorizationUrl.searchParams.set("code_challenge_method", AUTHORIZATION_CODE_CHALLENGE_METHOD), authorizationUrl.searchParams.set("redirect_uri", String(redirectUrl)), state && authorizationUrl.searchParams.set("state", state), scope && authorizationUrl.searchParams.set("scope", scope), scope?.includes("offline_access") && authorizationUrl.searchParams.append("prompt", "consent"), resource && authorizationUrl.searchParams.set("resource", resource.href), { authorizationUrl, codeVerifier };
+}
+function prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, redirectUri) {
+  return new URLSearchParams({
+    grant_type: "authorization_code",
+    code: authorizationCode,
+    code_verifier: codeVerifier,
+    redirect_uri: String(redirectUri)
+  });
+}
+async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequestParams, clientInformation, addClientAuthentication, resource, fetchFn }) {
+  let tokenUrl = metadata?.token_endpoint ? new URL(metadata.token_endpoint) : new URL("/token", authorizationServerUrl), headers = new Headers({
+    "Content-Type": "application/x-www-form-urlencoded",
+    Accept: "application/json"
+  });
+  if (resource && tokenRequestParams.set("resource", resource.href), addClientAuthentication)
+    await addClientAuthentication(headers, tokenRequestParams, tokenUrl, metadata);
+  else if (clientInformation) {
+    let supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? [], authMethod = selectClientAuthMethod(clientInformation, supportedMethods);
+    applyClientAuthentication(authMethod, clientInformation, headers, tokenRequestParams);
+  }
+  let response = await (fetchFn ?? fetch)(tokenUrl, {
+    method: "POST",
+    headers,
+    body: tokenRequestParams
+  });
+  if (!response.ok)
+    throw await parseErrorResponse(response);
+  return OAuthTokensSchema.parse(await response.json());
+}
+async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
+  let tokenRequestParams = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken
+  }), tokens = await executeTokenRequest(authorizationServerUrl, {
+    metadata,
+    tokenRequestParams,
+    clientInformation,
+    addClientAuthentication,
+    resource,
+    fetchFn
+  });
+  return { refresh_token: refreshToken, ...tokens };
+}
+async function fetchToken(provider, authorizationServerUrl, { metadata, resource, authorizationCode, fetchFn } = {}) {
+  let scope = provider.clientMetadata.scope, tokenRequestParams;
+  if (provider.prepareTokenRequest && (tokenRequestParams = await provider.prepareTokenRequest(scope)), !tokenRequestParams) {
+    if (!authorizationCode)
+      throw new Error("Either provider.prepareTokenRequest() or authorizationCode is required");
+    if (!provider.redirectUrl)
+      throw new Error("redirectUrl is required for authorization_code flow");
+    let codeVerifier = await provider.codeVerifier();
+    tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, provider.redirectUrl);
+  }
+  let clientInformation = await provider.clientInformation();
+  return executeTokenRequest(authorizationServerUrl, {
+    metadata,
+    tokenRequestParams,
+    clientInformation: clientInformation ?? void 0,
+    addClientAuthentication: provider.addClientAuthentication,
+    resource,
+    fetchFn
+  });
+}
+async function registerClient(authorizationServerUrl, { metadata, clientMetadata, scope, fetchFn }) {
+  let registrationUrl;
+  if (metadata) {
+    if (!metadata.registration_endpoint)
+      throw new Error("Incompatible auth server: does not support dynamic client registration");
+    registrationUrl = new URL(metadata.registration_endpoint);
+  } else
+    registrationUrl = new URL("/register", authorizationServerUrl);
+  let response = await (fetchFn ?? fetch)(registrationUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      ...clientMetadata,
+      ...scope !== void 0 ? { scope } : {}
+    })
+  });
+  if (!response.ok)
+    throw await parseErrorResponse(response);
+  return OAuthClientInformationFullSchema.parse(await response.json());
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
+var import_content_type = __toESM(require_content_type(), 1);
+function mediaTypeEssence(header) {
+  if (header)
+    try {
+      return import_content_type.default.parse(header).type;
+    } catch {
+      let essence = (header.split(";", 1)[0] ?? "").trim().toLowerCase();
+      return essence === "" || header.slice(essence.length).includes(",") ? void 0 : essence;
+    }
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/transport.js
+function normalizeHeaders(headers) {
+  return headers ? headers instanceof Headers ? Object.fromEntries(headers.entries()) : Array.isArray(headers) ? Object.fromEntries(headers) : { ...headers } : {};
+}
+function createFetchWithInit(baseFetch = fetch, baseInit) {
+  return baseInit ? async (url2, init) => {
+    let mergedInit = {
+      ...baseInit,
+      ...init,
+      // Headers need special handling - merge instead of replace
+      headers: init?.headers ? { ...normalizeHeaders(baseInit.headers), ...normalizeHeaders(init.headers) } : baseInit.headers
+    };
+    return baseFetch(url2, mergedInit);
+  } : baseFetch;
+}
+
+// node_modules/eventsource-parser/dist/index.js
+var ParseError = class extends Error {
+  constructor(message, options) {
+    super(message), this.name = "ParseError", this.type = options.type, this.field = options.field, this.value = options.value, this.line = options.line;
+  }
+}, LF = 10, CR = 13, SPACE = 32;
+function noop(_arg) {
+}
+function createParser(config) {
+  if (typeof config == "function")
+    throw new TypeError(
+      "`config` must be an object, got a function instead. Did you mean `createParser({onEvent: fn})`?"
+    );
+  let { onEvent = noop, onError = noop, onRetry = noop, onComment, maxBufferSize } = config, pendingFragments = [], pendingFragmentsLength = 0, isFirstChunk = !0, id, data = "", dataLines = 0, eventType, terminated = !1;
+  function feed(chunk) {
+    if (terminated)
+      throw new Error(
+        "Cannot feed parser: it was terminated after exceeding the configured max buffer size. Call `reset()` to resume parsing."
+      );
+    if (isFirstChunk && (isFirstChunk = !1, chunk.charCodeAt(0) === 239 && chunk.charCodeAt(1) === 187 && chunk.charCodeAt(2) === 191 && (chunk = chunk.slice(3))), pendingFragments.length === 0) {
+      let trailing2 = processLines(chunk);
+      trailing2 !== "" && (pendingFragments.push(trailing2), pendingFragmentsLength = trailing2.length), checkBufferSize();
+      return;
+    }
+    if (chunk.indexOf(`
+`) === -1 && chunk.indexOf("\r") === -1) {
+      pendingFragments.push(chunk), pendingFragmentsLength += chunk.length, checkBufferSize();
+      return;
+    }
+    pendingFragments.push(chunk);
+    let input = pendingFragments.join("");
+    pendingFragments.length = 0, pendingFragmentsLength = 0;
+    let trailing = processLines(input);
+    trailing !== "" && (pendingFragments.push(trailing), pendingFragmentsLength = trailing.length), checkBufferSize();
+  }
+  function checkBufferSize() {
+    maxBufferSize !== void 0 && (pendingFragmentsLength + data.length <= maxBufferSize || (terminated = !0, pendingFragments.length = 0, pendingFragmentsLength = 0, id = void 0, data = "", dataLines = 0, eventType = void 0, onError(
+      new ParseError(`Buffered data exceeded max buffer size of ${maxBufferSize} characters`, {
+        type: "max-buffer-size-exceeded"
+      })
+    )));
+  }
+  function processLines(chunk) {
+    let searchIndex = 0;
+    if (chunk.indexOf("\r") === -1) {
+      let lfIndex = chunk.indexOf(`
+`, searchIndex);
+      for (; lfIndex !== -1; ) {
+        if (searchIndex === lfIndex) {
+          dataLines > 0 && onEvent({ id, event: eventType, data }), id = void 0, data = "", dataLines = 0, eventType = void 0, searchIndex = lfIndex + 1, lfIndex = chunk.indexOf(`
+`, searchIndex);
+          continue;
+        }
+        let firstCharCode = chunk.charCodeAt(searchIndex);
+        if (isDataPrefix(chunk, searchIndex, firstCharCode)) {
+          let valueStart = chunk.charCodeAt(searchIndex + 5) === SPACE ? searchIndex + 6 : searchIndex + 5, value = chunk.slice(valueStart, lfIndex);
+          if (dataLines === 0 && chunk.charCodeAt(lfIndex + 1) === LF) {
+            onEvent({ id, event: eventType, data: value }), id = void 0, data = "", eventType = void 0, searchIndex = lfIndex + 2, lfIndex = chunk.indexOf(`
+`, searchIndex);
+            continue;
+          }
+          data = dataLines === 0 ? value : `${data}
+${value}`, dataLines++;
+        } else isEventPrefix(chunk, searchIndex, firstCharCode) ? eventType = chunk.slice(
+          chunk.charCodeAt(searchIndex + 6) === SPACE ? searchIndex + 7 : searchIndex + 6,
+          lfIndex
+        ) || void 0 : parseLine(chunk, searchIndex, lfIndex);
+        searchIndex = lfIndex + 1, lfIndex = chunk.indexOf(`
+`, searchIndex);
+      }
+      return chunk.slice(searchIndex);
+    }
+    for (; searchIndex < chunk.length; ) {
+      let crIndex = chunk.indexOf("\r", searchIndex), lfIndex = chunk.indexOf(`
+`, searchIndex), lineEnd = -1;
+      if (crIndex !== -1 && lfIndex !== -1 ? lineEnd = crIndex < lfIndex ? crIndex : lfIndex : crIndex !== -1 ? crIndex === chunk.length - 1 ? lineEnd = -1 : lineEnd = crIndex : lfIndex !== -1 && (lineEnd = lfIndex), lineEnd === -1)
+        break;
+      parseLine(chunk, searchIndex, lineEnd), searchIndex = lineEnd + 1, chunk.charCodeAt(searchIndex - 1) === CR && chunk.charCodeAt(searchIndex) === LF && searchIndex++;
+    }
+    return chunk.slice(searchIndex);
+  }
+  function parseLine(chunk, start, end) {
+    if (start === end) {
+      dispatchEvent();
+      return;
+    }
+    let firstCharCode = chunk.charCodeAt(start);
+    if (isDataPrefix(chunk, start, firstCharCode)) {
+      let valueStart = chunk.charCodeAt(start + 5) === SPACE ? start + 6 : start + 5, value2 = chunk.slice(valueStart, end);
+      data = dataLines === 0 ? value2 : `${data}
+${value2}`, dataLines++;
+      return;
+    }
+    if (isEventPrefix(chunk, start, firstCharCode)) {
+      eventType = chunk.slice(chunk.charCodeAt(start + 6) === SPACE ? start + 7 : start + 6, end) || void 0;
+      return;
+    }
+    if (firstCharCode === 105 && chunk.charCodeAt(start + 1) === 100 && chunk.charCodeAt(start + 2) === 58) {
+      let value2 = chunk.slice(chunk.charCodeAt(start + 3) === SPACE ? start + 4 : start + 3, end);
+      id = value2.includes("\0") ? void 0 : value2;
+      return;
+    }
+    if (firstCharCode === 58) {
+      if (onComment) {
+        let line2 = chunk.slice(start, end);
+        onComment(line2.slice(chunk.charCodeAt(start + 1) === SPACE ? 2 : 1));
+      }
+      return;
+    }
+    let line = chunk.slice(start, end), fieldSeparatorIndex = line.indexOf(":");
+    if (fieldSeparatorIndex === -1) {
+      processField(line, "", line);
+      return;
+    }
+    let field = line.slice(0, fieldSeparatorIndex), offset = line.charCodeAt(fieldSeparatorIndex + 1) === SPACE ? 2 : 1, value = line.slice(fieldSeparatorIndex + offset);
+    processField(field, value, line);
+  }
+  function processField(field, value, line) {
+    switch (field) {
+      case "event":
+        eventType = value || void 0;
+        break;
+      case "data":
+        data = dataLines === 0 ? value : `${data}
+${value}`, dataLines++;
+        break;
+      case "id":
+        id = value.includes("\0") ? void 0 : value;
+        break;
+      case "retry":
+        /^\d+$/.test(value) ? onRetry(parseInt(value, 10)) : onError(
+          new ParseError(`Invalid \`retry\` value: "${value}"`, {
+            type: "invalid-retry",
+            value,
+            line
+          })
+        );
+        break;
+      default:
+        onError(
+          new ParseError(
+            `Unknown field "${field.length > 20 ? `${field.slice(0, 20)}\u2026` : field}"`,
+            { type: "unknown-field", field, value, line }
+          )
+        );
+        break;
+    }
+  }
+  function dispatchEvent() {
+    dataLines > 0 && onEvent({
+      id,
+      event: eventType,
+      data
+    }), id = void 0, data = "", dataLines = 0, eventType = void 0;
+  }
+  function reset(options = {}) {
+    if (options.consume && pendingFragments.length > 0) {
+      let incompleteLine = pendingFragments.join("");
+      parseLine(incompleteLine, 0, incompleteLine.length);
+    }
+    isFirstChunk = !0, id = void 0, data = "", dataLines = 0, eventType = void 0, pendingFragments.length = 0, pendingFragmentsLength = 0, terminated = !1;
+  }
+  return { feed, reset };
+}
+function isDataPrefix(chunk, i, firstCharCode) {
+  return firstCharCode === 100 && chunk.charCodeAt(i + 1) === 97 && chunk.charCodeAt(i + 2) === 116 && chunk.charCodeAt(i + 3) === 97 && chunk.charCodeAt(i + 4) === 58;
+}
+function isEventPrefix(chunk, i, firstCharCode) {
+  return firstCharCode === 101 && chunk.charCodeAt(i + 1) === 118 && chunk.charCodeAt(i + 2) === 101 && chunk.charCodeAt(i + 3) === 110 && chunk.charCodeAt(i + 4) === 116 && chunk.charCodeAt(i + 5) === 58;
+}
+
+// node_modules/eventsource-parser/dist/stream.js
+var EventSourceParserStream = class extends TransformStream {
+  constructor({ onError, onRetry, onComment, maxBufferSize } = {}) {
+    let parser;
+    super({
+      start(controller) {
+        parser = createParser({
+          onEvent: (event) => {
+            controller.enqueue(event);
+          },
+          onError(error) {
+            typeof onError == "function" && onError(error), (onError === "terminate" || error.type === "max-buffer-size-exceeded") && controller.error(error);
+          },
+          onRetry,
+          onComment,
+          maxBufferSize
+        });
+      },
+      transform(chunk) {
+        parser.feed(chunk);
+      }
+    });
+  }
+};
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/client/streamableHttp.js
+var DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS = {
+  initialReconnectionDelay: 1e3,
+  maxReconnectionDelay: 3e4,
+  reconnectionDelayGrowFactor: 1.5,
+  maxRetries: 2
+}, StreamableHTTPError = class extends Error {
+  constructor(code, message) {
+    super(`Streamable HTTP error: ${message}`), this.code = code;
+  }
+}, StreamableHTTPClientTransport = class {
+  constructor(url2, opts) {
+    this._hasCompletedAuthFlow = !1, this._url = url2, this._resourceMetadataUrl = void 0, this._scope = void 0, this._requestInit = opts?.requestInit, this._authProvider = opts?.authProvider, this._fetch = opts?.fetch, this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit), this._sessionId = opts?.sessionId, this._reconnectionOptions = opts?.reconnectionOptions ?? DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS;
+  }
+  async _authThenStart() {
+    if (!this._authProvider)
+      throw new UnauthorizedError("No auth provider");
+    let result;
+    try {
+      result = await auth(this._authProvider, {
+        serverUrl: this._url,
+        resourceMetadataUrl: this._resourceMetadataUrl,
+        scope: this._scope,
+        fetchFn: this._fetchWithInit
+      });
+    } catch (error) {
+      throw this.onerror?.(error), error;
+    }
+    if (result !== "AUTHORIZED")
+      throw new UnauthorizedError();
+    return await this._startOrAuthSse({ resumptionToken: void 0 });
+  }
+  async _commonHeaders() {
+    let headers = {};
+    if (this._authProvider) {
+      let tokens = await this._authProvider.tokens();
+      tokens && (headers.Authorization = `Bearer ${tokens.access_token}`);
+    }
+    this._sessionId && (headers["mcp-session-id"] = this._sessionId), this._protocolVersion && (headers["mcp-protocol-version"] = this._protocolVersion);
+    let extraHeaders = normalizeHeaders(this._requestInit?.headers);
+    return new Headers({
+      ...headers,
+      ...extraHeaders
+    });
+  }
+  async _startOrAuthSse(options) {
+    let { resumptionToken } = options;
+    try {
+      let headers = await this._commonHeaders();
+      headers.set("Accept", "text/event-stream"), resumptionToken && headers.set("last-event-id", resumptionToken);
+      let response = await (this._fetch ?? fetch)(this._url, {
+        method: "GET",
+        headers,
+        signal: this._abortController?.signal
+      });
+      if (!response.ok) {
+        if (await response.body?.cancel(), response.status === 401 && this._authProvider)
+          return await this._authThenStart();
+        if (response.status === 405)
+          return;
+        throw new StreamableHTTPError(response.status, `Failed to open SSE stream: ${response.statusText}`);
+      }
+      this._handleSseStream(response.body, options, !0);
+    } catch (error) {
+      throw this.onerror?.(error), error;
+    }
+  }
+  /**
+   * Calculates the next reconnection delay using  backoff algorithm
+   *
+   * @param attempt Current reconnection attempt count for the specific stream
+   * @returns Time to wait in milliseconds before next reconnection attempt
+   */
+  _getNextReconnectionDelay(attempt) {
+    if (this._serverRetryMs !== void 0)
+      return this._serverRetryMs;
+    let initialDelay = this._reconnectionOptions.initialReconnectionDelay, growFactor = this._reconnectionOptions.reconnectionDelayGrowFactor, maxDelay = this._reconnectionOptions.maxReconnectionDelay;
+    return Math.min(initialDelay * Math.pow(growFactor, attempt), maxDelay);
+  }
+  /**
+   * Schedule a reconnection attempt using server-provided retry interval or backoff
+   *
+   * @param lastEventId The ID of the last received event for resumability
+   * @param attemptCount Current reconnection attempt count for this specific stream
+   */
+  _scheduleReconnection(options, attemptCount = 0) {
+    let maxRetries = this._reconnectionOptions.maxRetries;
+    if (attemptCount >= maxRetries) {
+      this.onerror?.(new Error(`Maximum reconnection attempts (${maxRetries}) exceeded.`));
+      return;
+    }
+    let delay = this._getNextReconnectionDelay(attemptCount);
+    this._reconnectionTimeout = setTimeout(() => {
+      this._startOrAuthSse(options).catch((error) => {
+        this.onerror?.(new Error(`Failed to reconnect SSE stream: ${error instanceof Error ? error.message : String(error)}`)), this._scheduleReconnection(options, attemptCount + 1);
+      });
+    }, delay);
+  }
+  _handleSseStream(stream, options, isReconnectable) {
+    if (!stream)
+      return;
+    let { onresumptiontoken, replayMessageId } = options, lastEventId, hasPrimingEvent = !1, receivedResponse = !1;
+    (async () => {
+      try {
+        let reader = stream.pipeThrough(new TextDecoderStream()).pipeThrough(new EventSourceParserStream({
+          onRetry: (retryMs) => {
+            this._serverRetryMs = retryMs;
+          }
+        })).getReader();
+        for (; ; ) {
+          let { value: event, done } = await reader.read();
+          if (done)
+            break;
+          if (event.id && (lastEventId = event.id, hasPrimingEvent = !0, onresumptiontoken?.(event.id)), !!event.data && (!event.event || event.event === "message"))
+            try {
+              let message = JSONRPCMessageSchema.parse(JSON.parse(event.data));
+              isJSONRPCResultResponse(message) && (receivedResponse = !0, replayMessageId !== void 0 && (message.id = replayMessageId)), this.onmessage?.(message);
+            } catch (error) {
+              this.onerror?.(error);
+            }
+        }
+        (isReconnectable || hasPrimingEvent) && !receivedResponse && this._abortController && !this._abortController.signal.aborted && this._scheduleReconnection({
+          resumptionToken: lastEventId,
+          onresumptiontoken,
+          replayMessageId
+        }, 0);
+      } catch (error) {
+        if (this.onerror?.(new Error(`SSE stream disconnected: ${error}`)), (isReconnectable || hasPrimingEvent) && !receivedResponse && this._abortController && !this._abortController.signal.aborted)
+          try {
+            this._scheduleReconnection({
+              resumptionToken: lastEventId,
+              onresumptiontoken,
+              replayMessageId
+            }, 0);
+          } catch (error2) {
+            this.onerror?.(new Error(`Failed to reconnect: ${error2 instanceof Error ? error2.message : String(error2)}`));
+          }
+      }
+    })();
+  }
+  async start() {
+    if (this._abortController)
+      throw new Error("StreamableHTTPClientTransport already started! If using Client class, note that connect() calls start() automatically.");
+    this._abortController = new AbortController();
+  }
+  /**
+   * Call this method after the user has finished authorizing via their user agent and is redirected back to the MCP client application. This will exchange the authorization code for an access token, enabling the next connection attempt to successfully auth.
+   */
+  async finishAuth(authorizationCode) {
+    if (!this._authProvider)
+      throw new UnauthorizedError("No auth provider");
+    if (await auth(this._authProvider, {
+      serverUrl: this._url,
+      authorizationCode,
+      resourceMetadataUrl: this._resourceMetadataUrl,
+      scope: this._scope,
+      fetchFn: this._fetchWithInit
+    }) !== "AUTHORIZED")
+      throw new UnauthorizedError("Failed to authorize");
+  }
+  async close() {
+    this._reconnectionTimeout && (clearTimeout(this._reconnectionTimeout), this._reconnectionTimeout = void 0), this._abortController?.abort(), this.onclose?.();
+  }
+  async send(message, options) {
+    try {
+      let { resumptionToken, onresumptiontoken } = options || {};
+      if (resumptionToken) {
+        this._startOrAuthSse({ resumptionToken, replayMessageId: isJSONRPCRequest(message) ? message.id : void 0 }).catch((err) => this.onerror?.(err));
+        return;
+      }
+      let headers = await this._commonHeaders();
+      headers.set("content-type", "application/json"), headers.set("accept", "application/json, text/event-stream");
+      let init = {
+        ...this._requestInit,
+        method: "POST",
+        headers,
+        body: JSON.stringify(message),
+        signal: this._abortController?.signal
+      }, response = await (this._fetch ?? fetch)(this._url, init), sessionId = response.headers.get("mcp-session-id");
+      if (sessionId && (this._sessionId = sessionId), !response.ok) {
+        let text = await response.text().catch(() => null);
+        if (response.status === 401 && this._authProvider) {
+          if (this._hasCompletedAuthFlow)
+            throw new StreamableHTTPError(401, "Server returned 401 after successful authentication");
+          let { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+          if (this._resourceMetadataUrl = resourceMetadataUrl, this._scope = scope, await auth(this._authProvider, {
+            serverUrl: this._url,
+            resourceMetadataUrl: this._resourceMetadataUrl,
+            scope: this._scope,
+            fetchFn: this._fetchWithInit
+          }) !== "AUTHORIZED")
+            throw new UnauthorizedError();
+          return this._hasCompletedAuthFlow = !0, this.send(message);
+        }
+        if (response.status === 403 && this._authProvider) {
+          let { resourceMetadataUrl, scope, error } = extractWWWAuthenticateParams(response);
+          if (error === "insufficient_scope") {
+            let wwwAuthHeader = response.headers.get("WWW-Authenticate");
+            if (this._lastUpscopingHeader === wwwAuthHeader)
+              throw new StreamableHTTPError(403, "Server returned 403 after trying upscoping");
+            if (scope && (this._scope = scope), resourceMetadataUrl && (this._resourceMetadataUrl = resourceMetadataUrl), this._lastUpscopingHeader = wwwAuthHeader ?? void 0, await auth(this._authProvider, {
+              serverUrl: this._url,
+              resourceMetadataUrl: this._resourceMetadataUrl,
+              scope: this._scope,
+              fetchFn: this._fetch
+            }) !== "AUTHORIZED")
+              throw new UnauthorizedError();
+            return this.send(message);
+          }
+        }
+        throw new StreamableHTTPError(response.status, `Error POSTing to endpoint: ${text}`);
+      }
+      if (this._hasCompletedAuthFlow = !1, this._lastUpscopingHeader = void 0, response.status === 202) {
+        await response.body?.cancel(), isInitializedNotification(message) && this._startOrAuthSse({ resumptionToken: void 0 }).catch((err) => this.onerror?.(err));
+        return;
+      }
+      let hasRequests = (Array.isArray(message) ? message : [message]).filter((msg) => "method" in msg && "id" in msg && msg.id !== void 0).length > 0, contentType2 = response.headers.get("content-type"), responseMediaType = mediaTypeEssence(contentType2);
+      if (hasRequests)
+        if (responseMediaType === "text/event-stream")
+          this._handleSseStream(response.body, { onresumptiontoken }, !1);
+        else if (responseMediaType === "application/json") {
+          let data = await response.json(), responseMessages = Array.isArray(data) ? data.map((msg) => JSONRPCMessageSchema.parse(msg)) : [JSONRPCMessageSchema.parse(data)];
+          for (let msg of responseMessages)
+            this.onmessage?.(msg);
+        } else
+          throw await response.body?.cancel(), new StreamableHTTPError(-1, `Unexpected content type: ${contentType2}`);
+      else
+        await response.body?.cancel();
+    } catch (error) {
+      throw this.onerror?.(error), error;
+    }
+  }
+  get sessionId() {
+    return this._sessionId;
+  }
+  /**
+   * Terminates the current session by sending a DELETE request to the server.
+   *
+   * Clients that no longer need a particular session
+   * (e.g., because the user is leaving the client application) SHOULD send an
+   * HTTP DELETE to the MCP endpoint with the Mcp-Session-Id header to explicitly
+   * terminate the session.
+   *
+   * The server MAY respond with HTTP 405 Method Not Allowed, indicating that
+   * the server does not allow clients to terminate sessions.
+   */
+  async terminateSession() {
+    if (this._sessionId)
+      try {
+        let headers = await this._commonHeaders(), init = {
+          ...this._requestInit,
+          method: "DELETE",
+          headers,
+          signal: this._abortController?.signal
+        }, response = await (this._fetch ?? fetch)(this._url, init);
+        if (await response.body?.cancel(), !response.ok && response.status !== 405)
+          throw new StreamableHTTPError(response.status, `Failed to terminate session: ${response.statusText}`);
+        this._sessionId = void 0;
+      } catch (error) {
+        throw this.onerror?.(error), error;
+      }
+  }
+  setProtocolVersion(version) {
+    this._protocolVersion = version;
+  }
+  get protocolVersion() {
+    return this._protocolVersion;
+  }
+  /**
+   * Resume an SSE stream from a previous event ID.
+   * Opens a GET SSE connection with Last-Event-ID header to replay missed events.
+   *
+   * @param lastEventId The event ID to resume from
+   * @param options Optional callback to receive new resumption tokens
+   */
+  async resumeStream(lastEventId, options) {
+    await this._startOrAuthSse({
+      resumptionToken: lastEventId,
+      onresumptiontoken: options?.onresumptiontoken
+    });
+  }
+};
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.js
+import open from "open";
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-auth.js
+import { createHash } from "crypto";
+import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync } from "fs";
+import { join } from "path";
+function getAuthBaseDir() {
+  let override = process.env.MCP_OAUTH_DIR?.trim();
+  return override || getAgentPath("mcp-oauth");
+}
+function getServerDir(serverName) {
+  if (typeof serverName != "string")
+    throw new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);
+  let storageKey = createHash("sha256").update(serverName, "utf8").digest("hex");
+  return join(getAuthBaseDir(), `sha256-${storageKey}`);
+}
+function getAuthEntryFilePath(serverName) {
+  return join(getServerDir(serverName), "tokens.json");
+}
+function ensureServerDir(serverName) {
+  let dir = getServerDir(serverName);
+  existsSync(dir) || mkdirSync(dir, { recursive: !0, mode: 448 });
+}
+function readAuthEntry(serverName) {
+  let filePath = getAuthEntryFilePath(serverName);
+  try {
+    if (!existsSync(filePath))
+      return;
+    let data = readFileSync(filePath, "utf-8");
+    return JSON.parse(data);
+  } catch (error) {
+    console.error(`Failed to read auth entry for ${serverName}:`, error);
+    return;
+  }
+}
+function writeAuthEntry(serverName, entry) {
+  ensureServerDir(serverName);
+  let filePath = getAuthEntryFilePath(serverName);
+  writeFileSync(filePath, JSON.stringify(entry, null, 2), { mode: 384 });
+}
+function getAuthEntry(serverName) {
+  return readAuthEntry(serverName);
+}
+function getAuthForUrl(serverName, serverUrl) {
+  let entry = getAuthEntry(serverName);
+  if (entry && entry.serverUrl && entry.serverUrl === serverUrl)
+    return entry;
+}
+function saveAuthEntry(serverName, entry, serverUrl) {
+  serverUrl && (entry.serverUrl = serverUrl), writeAuthEntry(serverName, entry);
+}
+function removeAuthEntry(serverName) {
+  try {
+    let filePath = getAuthEntryFilePath(serverName);
+    existsSync(filePath) && writeFileSync(filePath, "{}", { mode: 384 });
+    let dir = getServerDir(serverName);
+    if (existsSync(dir))
+      try {
+        rmSync(dir, { recursive: !0 });
+      } catch {
+      }
+  } catch (error) {
+    console.error(`Failed to remove auth entry for ${serverName}:`, error);
+  }
+}
+function updateTokens(serverName, tokens, serverUrl) {
+  let entry = getAuthEntry(serverName) ?? {};
+  serverUrl && entry.serverUrl !== serverUrl && (delete entry.clientInfo, delete entry.codeVerifier, delete entry.oauthState), entry.tokens = tokens, saveAuthEntry(serverName, entry, serverUrl);
+}
+function updateClientInfo(serverName, clientInfo, serverUrl) {
+  let entry = getAuthEntry(serverName) ?? {};
+  serverUrl && entry.serverUrl !== serverUrl && (delete entry.tokens, delete entry.codeVerifier, delete entry.oauthState), entry.clientInfo = clientInfo, saveAuthEntry(serverName, entry, serverUrl);
+}
+function updateCodeVerifier(serverName, codeVerifier, serverUrl) {
+  let entry = getAuthEntry(serverName) ?? {};
+  serverUrl && entry.serverUrl !== serverUrl && (delete entry.tokens, delete entry.clientInfo, delete entry.oauthState), entry.codeVerifier = codeVerifier, saveAuthEntry(serverName, entry, serverUrl);
+}
+function clearCodeVerifier(serverName) {
+  let entry = getAuthEntry(serverName);
+  entry && (delete entry.codeVerifier, saveAuthEntry(serverName, entry));
+}
+function updateOAuthState(serverName, state, serverUrl) {
+  let entry = getAuthEntry(serverName) ?? {};
+  serverUrl && entry.serverUrl !== serverUrl && (delete entry.tokens, delete entry.clientInfo, delete entry.codeVerifier), entry.oauthState = state, saveAuthEntry(serverName, entry, serverUrl);
+}
+function getOAuthState(serverName) {
+  return getAuthEntry(serverName)?.oauthState;
+}
+function clearOAuthState(serverName) {
+  let entry = getAuthEntry(serverName);
+  entry && (delete entry.oauthState, saveAuthEntry(serverName, entry));
+}
+function isTokenExpired(serverName) {
+  let entry = getAuthEntry(serverName);
+  return entry?.tokens ? entry.tokens.expiresAt ? entry.tokens.expiresAt < Date.now() / 1e3 : !1 : null;
+}
+function hasStoredTokens(serverName) {
+  return !!getAuthEntry(serverName)?.tokens;
+}
+function clearAllCredentials(serverName) {
+  removeAuthEntry(serverName);
+}
+function clearClientInfo(serverName) {
+  let entry = getAuthEntry(serverName);
+  entry && (delete entry.clientInfo, saveAuthEntry(serverName, entry));
+}
+function clearTokens(serverName) {
+  let entry = getAuthEntry(serverName);
+  entry && (delete entry.tokens, saveAuthEntry(serverName, entry));
+}
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-oauth-provider.js
+var DEFAULT_OAUTH_CALLBACK_PORT = 19876, DEFAULT_OAUTH_CALLBACK_PATH = "/callback", configuredOAuthCallbackPort = DEFAULT_OAUTH_CALLBACK_PORT;
+if (process.env.MCP_OAUTH_CALLBACK_PORT) {
+  let parsedPort = Number.parseInt(process.env.MCP_OAUTH_CALLBACK_PORT, 10);
+  Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535 && (configuredOAuthCallbackPort = parsedPort);
+}
+var oauthCallbackPort = configuredOAuthCallbackPort, oauthCallbackPath = DEFAULT_OAUTH_CALLBACK_PATH;
+function getConfiguredOAuthCallbackPort() {
+  return configuredOAuthCallbackPort;
+}
+function getOAuthCallbackPort() {
+  return oauthCallbackPort;
+}
+function setOAuthCallbackPort(port) {
+  oauthCallbackPort = port;
+}
+function getOAuthCallbackPath() {
+  return oauthCallbackPath;
+}
+function setOAuthCallbackPath(path) {
+  oauthCallbackPath = path.startsWith("/") ? path : `/${path}`;
+}
+var McpOAuthProvider = class {
+  serverName;
+  serverUrl;
+  config;
+  callbacks;
+  redirectUrlSnapshot;
+  constructor(serverName, serverUrl, config, callbacks) {
+    this.serverName = serverName, this.serverUrl = serverUrl, this.config = config, this.callbacks = callbacks, this.redirectUrlSnapshot = config.grantType === "client_credentials" ? void 0 : config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`;
+  }
+  get usesClientCredentials() {
+    return this.config.grantType === "client_credentials";
+  }
+  /**
+   * The redirect URL for OAuth callbacks.
+   * This must match the redirect_uri in client metadata.
+   */
+  get redirectUrl() {
+    return this.redirectUrlSnapshot;
+  }
+  /**
+   * Client metadata for dynamic registration.
+   * Describes this client to the OAuth authorization server.
+   */
+  get clientMetadata() {
+    if (this.usesClientCredentials)
+      return {
+        client_name: this.config.clientName ?? "Pi Coding Agent",
+        client_uri: this.config.clientUri ?? "https://github.com/nicobailon/pi-mcp-adapter",
+        redirect_uris: [],
+        grant_types: ["client_credentials"],
+        token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none"
+      };
+    let redirectUrl = this.redirectUrl;
+    if (!redirectUrl)
+      throw new Error("redirectUrl is required for authorization_code flow");
+    return {
+      redirect_uris: [redirectUrl],
+      client_name: this.config.clientName ?? "Pi Coding Agent",
+      client_uri: this.config.clientUri ?? "https://github.com/nicobailon/pi-mcp-adapter",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none",
+      ...this.config.scope !== void 0 ? { scope: this.config.scope } : {}
+    };
+  }
+  /**
+   * Get client information (for pre-registered or dynamically registered clients).
+   * Returns undefined if no client info exists or if the server URL has changed.
+   */
+  async clientInformation() {
+    if (this.config.clientId)
+      return {
+        client_id: this.config.clientId,
+        client_secret: this.config.clientSecret
+      };
+    let entry = await getAuthForUrl(this.serverName, this.serverUrl);
+    if (entry?.clientInfo)
+      return entry.clientInfo.clientSecretExpiresAt && entry.clientInfo.clientSecretExpiresAt < Date.now() / 1e3 ? void 0 : {
+        client_id: entry.clientInfo.clientId,
+        client_secret: entry.clientInfo.clientSecret
+      };
+  }
+  /**
+   * Save client information from dynamic registration.
+   */
+  async saveClientInformation(info) {
+    let redirectUris = info.redirect_uris ?? (this.redirectUrl ? [this.redirectUrl] : void 0), clientInfo = {
+      clientId: info.client_id,
+      clientSecret: info.client_secret,
+      clientIdIssuedAt: info.client_id_issued_at,
+      clientSecretExpiresAt: info.client_secret_expires_at,
+      redirectUris
+    };
+    updateClientInfo(this.serverName, clientInfo, this.serverUrl);
+  }
+  /**
+   * Get stored OAuth tokens.
+   * Returns undefined if no tokens exist or if the server URL has changed.
+   */
+  async tokens() {
+    let entry = await getAuthForUrl(this.serverName, this.serverUrl);
+    if (entry?.tokens)
+      return {
+        access_token: entry.tokens.accessToken,
+        token_type: "Bearer",
+        refresh_token: entry.tokens.refreshToken,
+        expires_in: entry.tokens.expiresAt ? Math.max(0, Math.floor(entry.tokens.expiresAt - Date.now() / 1e3)) : void 0,
+        scope: entry.tokens.scope
+      };
+  }
+  /**
+   * Save OAuth tokens.
+   */
+  async saveTokens(tokens) {
+    let storedTokens = {
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token,
+      expiresAt: tokens.expires_in ? Date.now() / 1e3 + tokens.expires_in : void 0,
+      scope: tokens.scope
+    };
+    updateTokens(this.serverName, storedTokens, this.serverUrl);
+  }
+  /**
+   * Redirect the user to the authorization URL.
+   * This opens the browser for the user to authenticate.
+   *
+   * Throws UnauthorizedError when called outside of a user-initiated flow
+   * (no oauthState saved by startAuth). That path is reached when the SDK
+   * falls through from a failed refresh into a fresh authorization_code
+   * flow, which library hosts cannot complete in-process.
+   */
+  async redirectToAuthorization(authorizationUrl) {
+    if (this.usesClientCredentials)
+      throw new Error("redirectToAuthorization is not used for client_credentials flow");
+    if (!(await getAuthForUrl(this.serverName, this.serverUrl))?.oauthState)
+      throw new UnauthorizedError(`Re-authentication required for MCP server: ${this.serverName}`);
+    await this.callbacks.onRedirect(authorizationUrl);
+  }
+  /**
+   * Save the PKCE code verifier.
+   */
+  async saveCodeVerifier(codeVerifier) {
+    updateCodeVerifier(this.serverName, codeVerifier, this.serverUrl);
+  }
+  /**
+   * Get the stored PKCE code verifier.
+   * @throws Error if no code verifier is stored
+   */
+  async codeVerifier() {
+    if (this.usesClientCredentials)
+      throw new Error("codeVerifier is not used for client_credentials flow");
+    let entry = await getAuthForUrl(this.serverName, this.serverUrl);
+    if (!entry?.codeVerifier)
+      throw new Error(`No code verifier saved for MCP server: ${this.serverName}`);
+    return entry.codeVerifier;
+  }
+  /**
+   * Save the OAuth state parameter for CSRF protection.
+   */
+  async saveState(state) {
+    updateOAuthState(this.serverName, state, this.serverUrl);
+  }
+  /**
+   * Get the stored OAuth state parameter.
+   * @throws UnauthorizedError if no flow is in progress (see redirectToAuthorization)
+   */
+  async state() {
+    if (this.usesClientCredentials)
+      throw new Error("state is not used for client_credentials flow");
+    let entry = await getAuthForUrl(this.serverName, this.serverUrl);
+    if (!entry?.oauthState)
+      throw new UnauthorizedError(`Re-authentication required for MCP server: ${this.serverName}`);
+    return entry.oauthState;
+  }
+  /**
+   * Invalidate credentials when authentication fails.
+   * Clears tokens, client info, or all credentials based on the type.
+   */
+  async invalidateCredentials(type) {
+    switch (type) {
+      case "all":
+        clearAllCredentials(this.serverName);
+        break;
+      case "client":
+        clearClientInfo(this.serverName);
+        break;
+      case "tokens":
+        clearTokens(this.serverName);
+        break;
+    }
+  }
+  /**
+   * Adds configured authorization-code scope without replacing the SDK's
+   * default token endpoint authentication behavior.
+   */
+  addClientAuthentication = async (headers, params, _url, metadata) => {
+    params.get("grant_type") === "authorization_code" && !params.has("scope") && this.config.scope && params.set("scope", this.config.scope);
+    let clientInfo = await this.clientInformation();
+    if (!clientInfo)
+      return;
+    let supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? [], hasClientSecret = clientInfo.client_secret !== void 0, authMethod;
+    if (supportedMethods.length === 0 ? authMethod = hasClientSecret ? "client_secret_post" : "none" : hasClientSecret && supportedMethods.includes("client_secret_basic") ? authMethod = "client_secret_basic" : hasClientSecret && supportedMethods.includes("client_secret_post") ? authMethod = "client_secret_post" : supportedMethods.includes("none") ? authMethod = "none" : authMethod = hasClientSecret ? "client_secret_post" : "none", authMethod === "client_secret_basic") {
+      if (!clientInfo.client_secret)
+        throw new Error("client_secret_basic authentication requires a client_secret");
+      headers.set("Authorization", `Basic ${Buffer.from(`${clientInfo.client_id}:${clientInfo.client_secret}`).toString("base64")}`);
+      return;
+    }
+    params.has("client_id") || params.set("client_id", clientInfo.client_id), authMethod === "client_secret_post" && clientInfo.client_secret && !params.has("client_secret") && params.set("client_secret", clientInfo.client_secret);
+  };
+  prepareTokenRequest(scope) {
+    if (!this.usesClientCredentials)
+      return;
+    let params = new URLSearchParams({ grant_type: "client_credentials" }), requestedScope = scope ?? this.config.scope;
+    return requestedScope && params.set("scope", requestedScope), params;
+  }
+};
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-callback-server.js
+import { createServer } from "http";
+var HTML_SUCCESS = `<!DOCTYPE html>
+<html>
+<head>
+  <title>Pi - Authorization Successful</title>
+  <style>
+    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }
+    .container { text-align: center; padding: 2rem; }
+    h1 { color: #4ade80; margin-bottom: 1rem; }
+    p { color: #aaa; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>Authorization Successful</h1>
+    <p>You can close this window and return to Pi.</p>
+  </div>
+  <script>setTimeout(() => window.close(), 2000);</script>
+</body>
+</html>`;
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+var HTML_ERROR = (error) => `<!DOCTYPE html>
+<html>
+<head>
+  <title>Pi - Authorization Failed</title>
+  <style>
+    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }
+    .container { text-align: center; padding: 2rem; }
+    h1 { color: #f87171; margin-bottom: 1rem; }
+    p { color: #aaa; }
+    .error { color: #fca5a5; font-family: monospace; margin-top: 1rem; padding: 1rem; background: rgba(248,113,113,0.1); border-radius: 0.5rem; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>Authorization Failed</h1>
+    <p>An error occurred during authorization.</p>
+    <div class="error">${escapeHtml(error)}</div>
+  </div>
+</body>
+</html>`, server, bindingPromise, pendingAuths = /* @__PURE__ */ new Map(), reservedAuthStates = /* @__PURE__ */ new Set(), CALLBACK_TIMEOUT_MS = 300 * 1e3, DEFAULT_OAUTH_CALLBACK_HOST = "localhost", callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST;
+function handleRequest(req, res) {
+  let url2 = new URL(req.url || "/", `http://${req.headers.host}`);
+  if (url2.pathname !== getOAuthCallbackPath()) {
+    res.writeHead(404, { "Content-Type": "text/plain" }), res.end("Not found");
+    return;
+  }
+  let code = url2.searchParams.get("code"), state = url2.searchParams.get("state"), error = url2.searchParams.get("error"), errorDescription = url2.searchParams.get("error_description");
+  if (!state) {
+    let errorMsg = "Missing required state parameter - potential CSRF attack";
+    res.writeHead(400, { "Content-Type": "text/html" }), res.end(HTML_ERROR(errorMsg));
+    return;
+  }
+  let pending = pendingAuths.get(state), isReserved = reservedAuthStates.has(state);
+  if (error) {
+    if (!pending && !isReserved) {
+      let errorMsg2 = "Invalid or expired state parameter - potential CSRF attack";
+      res.writeHead(400, { "Content-Type": "text/html" }), res.end(HTML_ERROR(errorMsg2));
+      return;
+    }
+    let errorMsg = errorDescription || error;
+    res.writeHead(200, { "Content-Type": "text/html" }), res.end(HTML_ERROR(errorMsg)), reservedAuthStates.delete(state), pending && (clearTimeout(pending.timeout), pendingAuths.delete(state), setTimeout(() => pending.reject(new Error(errorMsg)), 0));
+    return;
+  }
+  if (!pending) {
+    let errorMsg = "Invalid or expired state parameter - potential CSRF attack";
+    res.writeHead(400, { "Content-Type": "text/html" }), res.end(HTML_ERROR(errorMsg));
+    return;
+  }
+  if (!code) {
+    res.writeHead(400, { "Content-Type": "text/html" }), res.end(HTML_ERROR("No authorization code provided"));
+    return;
+  }
+  clearTimeout(pending.timeout), pendingAuths.delete(state), pending.resolve(code), res.writeHead(200, { "Content-Type": "text/html" }), res.end(HTML_SUCCESS);
+}
+async function ensureCallbackServer(options = {}) {
+  for (; bindingPromise; )
+    await bindingPromise;
+  let operation = ensureCallbackServerLocked(options);
+  bindingPromise = operation;
+  try {
+    await operation;
+  } finally {
+    bindingPromise === operation && (bindingPromise = void 0);
+  }
+}
+async function ensureCallbackServerLocked(options = {}) {
+  let requiredPort = options.port ?? getConfiguredOAuthCallbackPort(), strictPort = options.strictPort === !0, requestedHost = options.callbackHost ?? DEFAULT_OAUTH_CALLBACK_HOST, rawRequestedPath = options.callbackPath ?? DEFAULT_OAUTH_CALLBACK_PATH, requestedPath = rawRequestedPath.startsWith("/") ? rawRequestedPath : `/${rawRequestedPath}`;
+  if (options.reserveState && !options.oauthState)
+    throw new Error("OAuth callback reservation requires an oauthState");
+  let reservedState, previousServer = server, needsStrictRebind = !!(previousServer && strictPort && getOAuthCallbackPort() !== requiredPort), needsHostSwitch = !!(previousServer && callbackServerHost !== requestedHost), needsPathSwitch = !!(previousServer && getOAuthCallbackPath() !== requestedPath);
+  if (previousServer) {
+    if (!needsStrictRebind && !needsHostSwitch) {
+      if (needsPathSwitch) {
+        if (pendingAuths.size > 0 || reservedAuthStates.size > 0)
+          throw new Error(`OAuth callback server is using path ${getOAuthCallbackPath()}, but callback path ${requestedPath} is required and cannot be switched while authorizations are pending`);
+        setOAuthCallbackPath(requestedPath);
+      }
+      options.reserveState && options.oauthState && (reservedAuthStates.add(options.oauthState), reservedState = options.oauthState);
+      return;
+    }
+    if (pendingAuths.size > 0 || reservedAuthStates.size > 0)
+      throw new Error(`OAuth callback server is running on ${callbackServerHost}:${getOAuthCallbackPort()}, but strict callback endpoint ${requestedHost}:${requiredPort} is required and cannot be switched while authorizations are pending`);
+  }
+  let candidateServer = createServer(handleRequest), listenPort = strictPort ? requiredPort : 0;
+  try {
+    if (await new Promise((resolve, reject) => {
+      candidateServer.once("error", (err) => {
+        reject(err);
+      }), candidateServer.listen(listenPort, requestedHost, () => {
+        resolve();
+      });
+    }), strictPort)
+      setOAuthCallbackPort(requiredPort);
+    else {
+      let address = candidateServer.address();
+      if (!address || typeof address == "string" || typeof address.port != "number")
+        throw new Error("OAuth callback server did not report an assigned port");
+      setOAuthCallbackPort(address.port);
+    }
+    previousServer && (needsStrictRebind || needsHostSwitch) && await new Promise((resolve) => {
+      previousServer.close(() => resolve());
+    }), callbackServerHost = requestedHost, setOAuthCallbackPath(requestedPath), server = candidateServer, options.reserveState && options.oauthState && (reservedAuthStates.add(options.oauthState), reservedState = options.oauthState), server.unref();
+  } catch (error) {
+    reservedState && reservedAuthStates.delete(reservedState);
+    let nodeError = error;
+    throw await new Promise((resolve) => {
+      candidateServer.close(() => resolve());
+    }), strictPort && nodeError.code === "EADDRINUSE" ? new Error(`OAuth callback port ${requiredPort} is already in use. Pre-registered OAuth clients require an exact redirect URI; set MCP_OAUTH_CALLBACK_PORT to your registered port or free port ${requiredPort}`, { cause: error }) : error;
+  }
+}
+function releaseCallbackServer(oauthState) {
+  reservedAuthStates.delete(oauthState);
+}
+function waitForCallback(oauthState) {
+  return reservedAuthStates.delete(oauthState), new Promise((resolve, reject) => {
+    let timeout = setTimeout(() => {
+      pendingAuths.has(oauthState) && (pendingAuths.delete(oauthState), reject(new Error("OAuth callback timeout - authorization took too long")));
+    }, CALLBACK_TIMEOUT_MS);
+    pendingAuths.set(oauthState, { resolve, reject, timeout });
+  });
+}
+function cancelPendingCallback(oauthState) {
+  reservedAuthStates.delete(oauthState);
+  let pending = pendingAuths.get(oauthState);
+  pending && (clearTimeout(pending.timeout), pendingAuths.delete(oauthState), pending.reject(new Error("Authorization cancelled")));
+}
+async function stopCallbackServer() {
+  server && (await new Promise((resolve) => {
+    server.close(() => {
+      resolve();
+    });
+  }), server = void 0), setOAuthCallbackPort(getConfiguredOAuthCallbackPort()), callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST, setOAuthCallbackPath(DEFAULT_OAUTH_CALLBACK_PATH);
+  let pendingList = Array.from(pendingAuths.entries());
+  pendingAuths.clear(), reservedAuthStates.clear(), setTimeout(() => {
+    for (let [, pending] of pendingList)
+      clearTimeout(pending.timeout), pending.reject(new Error("OAuth callback server stopped"));
+  }, 0);
+}
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.js
+var pendingTransports = /* @__PURE__ */ new Map(), pendingAuthStates = /* @__PURE__ */ new Map(), pendingAuthCleanupTimers = /* @__PURE__ */ new Map(), pendingAuthentications = /* @__PURE__ */ new Map(), MANUAL_AUTH_TIMEOUT_MS = 300 * 1e3;
+function generateState() {
+  return Array.from(crypto.getRandomValues(new Uint8Array(32))).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function extractOAuthConfig(definition) {
+  if (definition.oauth === !1)
+    return {};
+  let config = {};
+  if (definition.oauth?.grantType !== void 0 && (config.grantType = definition.oauth.grantType), definition.oauth?.clientId !== void 0 && (config.clientId = definition.oauth.clientId), definition.oauth?.clientSecret !== void 0 && (config.clientSecret = definition.oauth.clientSecret), definition.oauth?.scope !== void 0 && (config.scope = definition.oauth.scope), definition.oauth?.redirectUri !== void 0) {
+    if (typeof definition.oauth.redirectUri != "string")
+      throw new Error("OAuth redirectUri must be a string");
+    let redirectUri = definition.oauth.redirectUri.trim();
+    if (!redirectUri)
+      throw new Error("OAuth redirectUri must not be empty");
+    config.redirectUri = redirectUri;
+  }
+  if (definition.oauth?.clientName !== void 0) {
+    if (typeof definition.oauth.clientName != "string")
+      throw new Error("OAuth clientName must be a string");
+    let clientName = definition.oauth.clientName.trim();
+    if (!clientName)
+      throw new Error("OAuth clientName must not be empty");
+    config.clientName = clientName;
+  }
+  if (definition.oauth?.clientUri !== void 0) {
+    if (typeof definition.oauth.clientUri != "string")
+      throw new Error("OAuth clientUri must be a string");
+    let clientUri = definition.oauth.clientUri.trim();
+    if (!clientUri)
+      throw new Error("OAuth clientUri must not be empty");
+    config.clientUri = clientUri;
+  }
+  return config;
+}
+function parseOAuthRedirectUri(redirectUri) {
+  let url2;
+  try {
+    url2 = new URL(redirectUri);
+  } catch (error) {
+    throw new Error(`Invalid OAuth redirectUri: ${redirectUri}`, { cause: error });
+  }
+  let hostname = url2.hostname.toLowerCase(), isLocalhost = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
+  if (url2.protocol !== "http:" || !isLocalhost)
+    throw new Error("OAuth redirectUri must be an http:// localhost or loopback URI");
+  if (url2.username || url2.password)
+    throw new Error("OAuth redirectUri must not include username or password");
+  if (url2.hash)
+    throw new Error("OAuth redirectUri must not include a fragment");
+  if (!url2.port)
+    throw new Error("OAuth redirectUri must include an explicit numeric port");
+  let port = Number.parseInt(url2.port, 10);
+  if (!Number.isInteger(port) || port <= 0 || port > 65535)
+    throw new Error("OAuth redirectUri must include an explicit numeric port");
+  return { port, callbackHost: hostname === "[::1]" ? "::1" : hostname, callbackPath: url2.pathname };
+}
+async function startAuth(serverName, serverUrl, definition) {
+  let config = definition ? extractOAuthConfig(definition) : {};
+  if (config.grantType === "client_credentials") {
+    let storedAuth = await getAuthForUrl(serverName, serverUrl);
+    storedAuth?.clientInfo && !storedAuth.tokens && !config.clientId && (clearClientInfo(serverName), clearCodeVerifier(serverName), await clearOAuthState(serverName));
+    let authProvider2 = new McpOAuthProvider(serverName, serverUrl, config, {
+      onRedirect: async () => {
+        throw new Error("Browser redirect is not used for client_credentials flow");
+      }
+    });
+    if (await auth(authProvider2, { serverUrl }) !== "AUTHORIZED")
+      throw new UnauthorizedError("Failed to authorize");
+    return { authorizationUrl: "" };
+  }
+  let redirectCallback = config.redirectUri !== void 0 ? parseOAuthRedirectUri(config.redirectUri) : void 0, oauthState = generateState();
+  try {
+    await ensureCallbackServer({
+      strictPort: !!config.clientId || config.redirectUri !== void 0,
+      oauthState,
+      reserveState: !0,
+      ...redirectCallback ? { port: redirectCallback.port, callbackHost: redirectCallback.callbackHost, callbackPath: redirectCallback.callbackPath } : {}
+    });
+  } catch (error) {
+    throw await clearOAuthState(serverName), error;
+  }
+  let capturedUrl, authProvider = new McpOAuthProvider(serverName, serverUrl, config, {
+    onRedirect: async (url2) => {
+      capturedUrl = url2;
+    }
+  });
+  try {
+    let storedAuth = await getAuthForUrl(serverName, serverUrl);
+    if (storedAuth?.clientInfo && !config.clientId)
+      if (!storedAuth.tokens)
+        clearClientInfo(serverName), clearCodeVerifier(serverName), await clearOAuthState(serverName);
+      else {
+        let redirectUris = storedAuth.clientInfo.redirectUris;
+        (!Array.isArray(redirectUris) || !redirectUris.includes(authProvider.redirectUrl ?? "")) && (clearClientInfo(serverName), clearTokens(serverName), clearCodeVerifier(serverName), await clearOAuthState(serverName));
+      }
+    if (await updateOAuthState(serverName, oauthState, serverUrl), await auth(authProvider, { serverUrl }) === "AUTHORIZED")
+      return releaseCallbackServer(oauthState), await clearOAuthState(serverName), { authorizationUrl: "" };
+    if (!capturedUrl)
+      throw new UnauthorizedError("OAuth authorization URL was not provided");
+    let pendingTransport = new StreamableHTTPClientTransport(new URL(serverUrl), { authProvider });
+    return await setPendingTransport(serverName, pendingTransport, oauthState), { authorizationUrl: capturedUrl.toString() };
+  } catch (error) {
+    throw await clearPendingAuth(serverName, oauthState), error;
+  }
+}
+async function setPendingTransport(serverName, transport, oauthState) {
+  await clearPendingAuth(serverName), pendingTransports.set(serverName, transport), pendingAuthStates.set(serverName, oauthState);
+  let cleanupTimer = setTimeout(() => {
+    clearPendingAuth(serverName, oauthState);
+  }, MANUAL_AUTH_TIMEOUT_MS);
+  cleanupTimer.unref?.(), pendingAuthCleanupTimers.set(serverName, cleanupTimer);
+}
+async function clearPendingAuth(serverName, oauthState) {
+  let pendingState = pendingAuthStates.get(serverName);
+  if (oauthState && pendingState && pendingState !== oauthState)
+    return;
+  let timer = pendingAuthCleanupTimers.get(serverName);
+  timer && (clearTimeout(timer), pendingAuthCleanupTimers.delete(serverName));
+  let transport = pendingTransports.get(serverName);
+  pendingTransports.delete(serverName), pendingAuthStates.delete(serverName);
+  let stateToRelease = pendingState ?? oauthState;
+  stateToRelease && (releaseCallbackServer(stateToRelease), await getOAuthState(serverName) === stateToRelease && await clearOAuthState(serverName)), transport && await transport.close().catch(() => {
+  });
+}
+function getSearchParamsFromInput(input) {
+  try {
+    let url2 = new URL(input), params = new URLSearchParams(url2.search);
+    if (url2.hash) {
+      let hash = url2.hash.startsWith("#") ? url2.hash.slice(1) : url2.hash, hashParams = new URLSearchParams(hash);
+      for (let [key, value] of hashParams)
+        params.has(key) || params.set(key, value);
+    }
+    return params;
+  } catch {
+    let query = input.includes("?") ? input.slice(input.indexOf("?") + 1) : input, params = new URLSearchParams(query.startsWith("#") ? query.slice(1) : query);
+    return params.has("code") || params.has("state") || params.has("error") ? params : void 0;
+  }
+}
+function parseAuthorizationCodeInput(input, expectedState) {
+  let trimmed = input.trim();
+  if (!trimmed)
+    throw new Error("Authorization code or redirect URL is required");
+  let params = getSearchParamsFromInput(trimmed);
+  if (params) {
+    let error = params.get("error");
+    if (error) {
+      let description = params.get("error_description");
+      throw new Error(description ? `${error}: ${description}` : error);
+    }
+    let state = params.get("state");
+    if (expectedState && !state)
+      throw new Error("OAuth state missing from redirect URL");
+    if (expectedState && state !== expectedState)
+      throw new Error("OAuth state mismatch - potential CSRF attack");
+    let code = params.get("code");
+    if (code)
+      return code;
+  }
+  if (/^[A-Za-z0-9._~+/=-]+$/.test(trimmed))
+    return trimmed;
+  throw new Error("Could not find an OAuth authorization code in the provided input");
+}
+async function completeAuthFromInput(serverName, input) {
+  let oauthState = await getOAuthState(serverName), code = parseAuthorizationCodeInput(input, oauthState);
+  return completeAuth(serverName, code);
+}
+async function completeAuth(serverName, authorizationCode) {
+  let transport = pendingTransports.get(serverName);
+  if (!transport)
+    throw new Error(`No pending OAuth flow for server: ${serverName}`);
+  let oauthState = await getOAuthState(serverName);
+  try {
+    return await transport.finishAuth(authorizationCode), "authenticated";
+  } finally {
+    await clearPendingAuth(serverName, oauthState);
+  }
+}
+async function authenticate(serverName, serverUrl, definition, options = {}) {
+  let inFlight = pendingAuthentications.get(serverName);
+  if (inFlight)
+    return inFlight;
+  let operation = (async () => {
+    let { authorizationUrl } = await startAuth(serverName, serverUrl, definition);
+    if (!authorizationUrl)
+      return "authenticated";
+    let oauthState = await getOAuthState(serverName);
+    if (!oauthState)
+      throw new Error("OAuth state not found - this should not happen");
+    let callbackPromise = waitForCallback(oauthState);
+    try {
+      options.onAuthorizationUrl ? await options.onAuthorizationUrl(authorizationUrl) : console.log(`MCP Auth: Open this URL to authenticate ${serverName}:
+${authorizationUrl}`);
+      try {
+        await open(authorizationUrl);
+      } catch (error) {
+        console.warn(`MCP Auth: Failed to open browser for ${serverName}; waiting for manual callback`, { error });
+      }
+      let code = await callbackPromise;
+      if (await getOAuthState(serverName) !== oauthState)
+        throw await clearOAuthState(serverName), new Error("OAuth state mismatch - potential CSRF attack");
+      return await clearOAuthState(serverName), await completeAuth(serverName, code);
+    } catch (error) {
+      throw cancelPendingCallback(oauthState), await clearPendingAuth(serverName, oauthState), error;
+    }
+  })();
+  pendingAuthentications.set(serverName, operation);
+  try {
+    return await operation;
+  } finally {
+    pendingAuthentications.get(serverName) === operation && pendingAuthentications.delete(serverName);
+  }
+}
+async function getValidToken(serverName, serverUrl) {
+  let entry = await getAuthForUrl(serverName, serverUrl);
+  if (!entry?.tokens)
+    return null;
+  let expired = await isTokenExpired(serverName);
+  if (expired === !1)
+    return entry.tokens;
+  if (expired === !0 && entry.tokens.refreshToken) {
+    console.log(`MCP Auth: Token expired for ${serverName}, attempting refresh`);
+    try {
+      let authProvider = new McpOAuthProvider(serverName, serverUrl, {}, {
+        onRedirect: async () => {
+        }
+      });
+      return await authProvider.clientInformation() ? await auth(authProvider, { serverUrl }) !== "AUTHORIZED" ? null : (await getAuthForUrl(serverName, serverUrl))?.tokens ?? null : (console.log(`MCP Auth: No client info for refresh for ${serverName}`), null);
+    } catch (error) {
+      return console.error(`MCP Auth: Token refresh failed for ${serverName}`, { error }), null;
+    }
+  }
+  return entry.tokens;
+}
+async function getAuthStatus(serverName) {
+  return await hasStoredTokens(serverName) ? await isTokenExpired(serverName) ? "expired" : "authenticated" : "not_authenticated";
+}
+async function removeAuth(serverName) {
+  let oauthState = await getOAuthState(serverName);
+  oauthState && cancelPendingCallback(oauthState), await clearPendingAuth(serverName, oauthState), clearAllCredentials(serverName), await clearOAuthState(serverName), console.log(`MCP Auth: Removed credentials for ${serverName}`);
+}
+function supportsOAuth(definition) {
+  return !definition.url || definition.auth === !1 || definition.oauth === !1 ? !1 : definition.auth === "oauth" ? !0 : definition.headers && Object.keys(definition.headers).length > 0 ? !1 : definition.auth === void 0;
+}
+async function initializeOAuth() {
+}
+async function shutdownOAuth() {
+  for (let serverName of Array.from(pendingTransports.keys()))
+    await clearPendingAuth(serverName);
+  await stopCallbackServer();
+}
+
+export {
+  LATEST_PROTOCOL_VERSION,
+  SUPPORTED_PROTOCOL_VERSIONS,
+  RELATED_TASK_META_KEY,
+  isTaskAugmentedRequestParams,
+  RequestIdSchema,
+  isJSONRPCRequest,
+  isJSONRPCNotification,
+  isJSONRPCResultResponse,
+  ErrorCode,
+  isJSONRPCErrorResponse,
+  JSONRPCMessageSchema,
+  EmptyResultSchema,
+  CancelledNotificationSchema,
+  ImplementationSchema,
+  InitializeResultSchema,
+  PingRequestSchema,
+  ProgressNotificationSchema,
+  CreateTaskResultSchema,
+  TaskStatusNotificationSchema,
+  GetTaskRequestSchema,
+  GetTaskResultSchema,
+  GetTaskPayloadRequestSchema,
+  ListTasksRequestSchema,
+  ListTasksResultSchema,
+  CancelTaskRequestSchema,
+  CancelTaskResultSchema,
+  ListResourcesResultSchema,
+  ListResourceTemplatesResultSchema,
+  ReadResourceResultSchema,
+  ResourceListChangedNotificationSchema,
+  ListPromptsResultSchema,
+  EmbeddedResourceSchema,
+  ResourceLinkSchema,
+  ContentBlockSchema,
+  GetPromptResultSchema,
+  PromptListChangedNotificationSchema,
+  ToolSchema,
+  ListToolsResultSchema,
+  CallToolResultSchema,
+  ToolListChangedNotificationSchema,
+  ListChangedOptionsBaseSchema,
+  CreateMessageRequestSchema,
+  CreateMessageResultSchema,
+  CreateMessageResultWithToolsSchema,
+  ElicitRequestSchema,
+  ElicitationCompleteNotificationSchema,
+  ElicitResultSchema,
+  CompleteResultSchema,
+  McpError,
+  UrlElicitationRequiredError,
+  normalizeHeaders,
+  createFetchWithInit,
+  UnauthorizedError,
+  auth,
+  extractWWWAuthenticateParams,
+  createParser,
+  StreamableHTTPClientTransport,
+  getAuthForUrl,
+  McpOAuthProvider,
+  extractOAuthConfig,
+  startAuth,
+  parseAuthorizationCodeInput,
+  completeAuthFromInput,
+  completeAuth,
+  authenticate,
+  getValidToken,
+  getAuthStatus,
+  removeAuth,
+  supportsOAuth,
+  initializeOAuth,
+  shutdownOAuth
+};
+/*! Bundled license information:
+
+content-type/index.js:
+  (*!
+   * content-type
+   * Copyright(c) 2015 Douglas Christopher Wilson
+   * MIT Licensed
+   *)
+*/