@ashx-j/lunr-dev 0.2.13-dev.8.1 → 0.2.19-dev.10.1

package/dist/node-runtime/chunk-U6C7VTR5.js

@@ -0,0 +1,2033 @@
+import { createRequire as __lunrRequire } from "node:module"; const require = __lunrRequire(import.meta.url);
+import {
+  getAgentPath
+} from "./chunk-4HXHDDCF.js";
+import {
+  JSONRPCMessageSchema,
+  LATEST_PROTOCOL_VERSION,
+  isInitializedNotification,
+  isJSONRPCRequest,
+  isJSONRPCResultResponse
+} from "./chunk-2IDTZAG5.js";
+import {
+  NEVER,
+  ZodIssueCode,
+  any,
+  array,
+  boolean,
+  coerce_exports,
+  literal,
+  looseObject,
+  number,
+  object,
+  string,
+  url
+} from "./chunk-BI3DHYCN.js";
+import {
+  __commonJS,
+  __toESM
+} from "./chunk-BRJX2PRC.js";
+
+// node_modules/content-type/index.js
+var require_content_type = __commonJS({
+  "node_modules/content-type/index.js"(exports) {
+    "use strict";
+    var PARAM_REGEXP = /; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g, TEXT_REGEXP = /^[\u000b\u0020-\u007e\u0080-\u00ff]+$/, TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/, QESC_REGEXP = /\\([\u000b\u0020-\u00ff])/g, QUOTE_REGEXP = /([\\"])/g, TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+    exports.format = format;
+    exports.parse = parse;
+    function format(obj) {
+      if (!obj || typeof obj != "object")
+        throw new TypeError("argument obj is required");
+      var parameters = obj.parameters, type = obj.type;
+      if (!type || !TYPE_REGEXP.test(type))
+        throw new TypeError("invalid type");
+      var string2 = type;
+      if (parameters && typeof parameters == "object")
+        for (var param, params = Object.keys(parameters).sort(), i = 0; i < params.length; i++) {
+          if (param = params[i], !TOKEN_REGEXP.test(param))
+            throw new TypeError("invalid parameter name");
+          string2 += "; " + param + "=" + qstring(parameters[param]);
+        }
+      return string2;
+    }
+    function parse(string2) {
+      if (!string2)
+        throw new TypeError("argument string is required");
+      var header = typeof string2 == "object" ? getcontenttype(string2) : string2;
+      if (typeof header != "string")
+        throw new TypeError("argument string is required to be a string");
+      var index = header.indexOf(";"), type = index !== -1 ? header.slice(0, index).trim() : header.trim();
+      if (!TYPE_REGEXP.test(type))
+        throw new TypeError("invalid media type");
+      var obj = new ContentType(type.toLowerCase());
+      if (index !== -1) {
+        var key, match, value;
+        for (PARAM_REGEXP.lastIndex = index; match = PARAM_REGEXP.exec(header); ) {
+          if (match.index !== index)
+            throw new TypeError("invalid parameter format");
+          index += match[0].length, key = match[1].toLowerCase(), value = match[2], value.charCodeAt(0) === 34 && (value = value.slice(1, -1), value.indexOf("\\") !== -1 && (value = value.replace(QESC_REGEXP, "$1"))), obj.parameters[key] = value;
+        }
+        if (index !== header.length)
+          throw new TypeError("invalid parameter format");
+      }
+      return obj;
+    }
+    function getcontenttype(obj) {
+      var header;
+      if (typeof obj.getHeader == "function" ? header = obj.getHeader("content-type") : typeof obj.headers == "object" && (header = obj.headers && obj.headers["content-type"]), typeof header != "string")
+        throw new TypeError("content-type header is missing from object");
+      return header;
+    }
+    function qstring(val) {
+      var str = String(val);
+      if (TOKEN_REGEXP.test(str))
+        return str;
+      if (str.length > 0 && !TEXT_REGEXP.test(str))
+        throw new TypeError("invalid parameter value");
+      return '"' + str.replace(QUOTE_REGEXP, "\\$1") + '"';
+    }
+    function ContentType(type) {
+      this.parameters = /* @__PURE__ */ Object.create(null), this.type = type;
+    }
+  }
+});
+
+// node_modules/pkce-challenge/dist/index.node.js
+var crypto2;
+crypto2 = globalThis.crypto?.webcrypto ?? // Node.js [18-16] REPL
+globalThis.crypto ?? // Node.js >18
+import("node:crypto").then((m) => m.webcrypto);
+async function getRandomValues(size) {
+  return (await crypto2).getRandomValues(new Uint8Array(size));
+}
+async function random(size) {
+  let mask = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~", evenDistCutoff = Math.pow(2, 8) - Math.pow(2, 8) % mask.length, result = "";
+  for (; result.length < size; ) {
+    let randomBytes = await getRandomValues(size - result.length);
+    for (let randomByte of randomBytes)
+      randomByte < evenDistCutoff && (result += mask[randomByte % mask.length]);
+  }
+  return result;
+}
+async function generateVerifier(length) {
+  return await random(length);
+}
+async function generateChallenge(code_verifier) {
+  let buffer = await (await crypto2).subtle.digest("SHA-256", new TextEncoder().encode(code_verifier));
+  return btoa(String.fromCharCode(...new Uint8Array(buffer))).replace(/\//g, "_").replace(/\+/g, "-").replace(/=/g, "");
+}
+async function pkceChallenge(length) {
+  if (length || (length = 43), length < 43 || length > 128)
+    throw `Expected a length between 43 and 128. Received ${length}.`;
+  let verifier = await generateVerifier(length), challenge = await generateChallenge(verifier);
+  return {
+    code_verifier: verifier,
+    code_challenge: challenge
+  };
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
+var SafeUrlSchema = url().superRefine((val, ctx) => {
+  if (!URL.canParse(val))
+    return ctx.addIssue({
+      code: ZodIssueCode.custom,
+      message: "URL must be parseable",
+      fatal: !0
+    }), NEVER;
+}).refine((url2) => {
+  let u = new URL(url2);
+  return u.protocol !== "javascript:" && u.protocol !== "data:" && u.protocol !== "vbscript:";
+}, { message: "URL cannot use javascript:, data:, or vbscript: scheme" }), OAuthProtectedResourceMetadataSchema = looseObject({
+  resource: string().url(),
+  authorization_servers: array(SafeUrlSchema).optional(),
+  jwks_uri: string().url().optional(),
+  scopes_supported: array(string()).optional(),
+  bearer_methods_supported: array(string()).optional(),
+  resource_signing_alg_values_supported: array(string()).optional(),
+  resource_name: string().optional(),
+  resource_documentation: string().optional(),
+  resource_policy_uri: string().url().optional(),
+  resource_tos_uri: string().url().optional(),
+  tls_client_certificate_bound_access_tokens: boolean().optional(),
+  authorization_details_types_supported: array(string()).optional(),
+  dpop_signing_alg_values_supported: array(string()).optional(),
+  dpop_bound_access_tokens_required: boolean().optional()
+}), OAuthMetadataSchema = looseObject({
+  issuer: string(),
+  authorization_endpoint: SafeUrlSchema,
+  token_endpoint: SafeUrlSchema,
+  registration_endpoint: SafeUrlSchema.optional(),
+  scopes_supported: array(string()).optional(),
+  response_types_supported: array(string()),
+  response_modes_supported: array(string()).optional(),
+  grant_types_supported: array(string()).optional(),
+  token_endpoint_auth_methods_supported: array(string()).optional(),
+  token_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+  service_documentation: SafeUrlSchema.optional(),
+  revocation_endpoint: SafeUrlSchema.optional(),
+  revocation_endpoint_auth_methods_supported: array(string()).optional(),
+  revocation_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+  introspection_endpoint: string().optional(),
+  introspection_endpoint_auth_methods_supported: array(string()).optional(),
+  introspection_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+  code_challenge_methods_supported: array(string()).optional(),
+  client_id_metadata_document_supported: boolean().optional()
+}), OpenIdProviderMetadataSchema = looseObject({
+  issuer: string(),
+  authorization_endpoint: SafeUrlSchema,
+  token_endpoint: SafeUrlSchema,
+  userinfo_endpoint: SafeUrlSchema.optional(),
+  jwks_uri: SafeUrlSchema,
+  registration_endpoint: SafeUrlSchema.optional(),
+  scopes_supported: array(string()).optional(),
+  response_types_supported: array(string()),
+  response_modes_supported: array(string()).optional(),
+  grant_types_supported: array(string()).optional(),
+  acr_values_supported: array(string()).optional(),
+  subject_types_supported: array(string()),
+  id_token_signing_alg_values_supported: array(string()),
+  id_token_encryption_alg_values_supported: array(string()).optional(),
+  id_token_encryption_enc_values_supported: array(string()).optional(),
+  userinfo_signing_alg_values_supported: array(string()).optional(),
+  userinfo_encryption_alg_values_supported: array(string()).optional(),
+  userinfo_encryption_enc_values_supported: array(string()).optional(),
+  request_object_signing_alg_values_supported: array(string()).optional(),
+  request_object_encryption_alg_values_supported: array(string()).optional(),
+  request_object_encryption_enc_values_supported: array(string()).optional(),
+  token_endpoint_auth_methods_supported: array(string()).optional(),
+  token_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+  display_values_supported: array(string()).optional(),
+  claim_types_supported: array(string()).optional(),
+  claims_supported: array(string()).optional(),
+  service_documentation: string().optional(),
+  claims_locales_supported: array(string()).optional(),
+  ui_locales_supported: array(string()).optional(),
+  claims_parameter_supported: boolean().optional(),
+  request_parameter_supported: boolean().optional(),
+  request_uri_parameter_supported: boolean().optional(),
+  require_request_uri_registration: boolean().optional(),
+  op_policy_uri: SafeUrlSchema.optional(),
+  op_tos_uri: SafeUrlSchema.optional(),
+  client_id_metadata_document_supported: boolean().optional()
+}), OpenIdProviderDiscoveryMetadataSchema = object({
+  ...OpenIdProviderMetadataSchema.shape,
+  ...OAuthMetadataSchema.pick({
+    code_challenge_methods_supported: !0
+  }).shape
+}), OAuthTokensSchema = object({
+  access_token: string(),
+  id_token: string().optional(),
+  // Optional for OAuth 2.1, but necessary in OpenID Connect
+  token_type: string(),
+  expires_in: coerce_exports.number().optional(),
+  scope: string().optional(),
+  refresh_token: string().optional()
+}).strip(), OAuthErrorResponseSchema = object({
+  error: string(),
+  error_description: string().optional(),
+  error_uri: string().optional()
+}), OptionalSafeUrlSchema = SafeUrlSchema.optional().or(literal("").transform(() => {
+})), OAuthClientMetadataSchema = object({
+  redirect_uris: array(SafeUrlSchema),
+  token_endpoint_auth_method: string().optional(),
+  grant_types: array(string()).optional(),
+  response_types: array(string()).optional(),
+  client_name: string().optional(),
+  client_uri: SafeUrlSchema.optional(),
+  logo_uri: OptionalSafeUrlSchema,
+  scope: string().optional(),
+  contacts: array(string()).optional(),
+  tos_uri: OptionalSafeUrlSchema,
+  policy_uri: string().optional(),
+  jwks_uri: SafeUrlSchema.optional(),
+  jwks: any().optional(),
+  software_id: string().optional(),
+  software_version: string().optional(),
+  software_statement: string().optional()
+}).strip(), OAuthClientInformationSchema = object({
+  client_id: string(),
+  client_secret: string().optional(),
+  client_id_issued_at: number().optional(),
+  client_secret_expires_at: number().optional()
+}).strip(), OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema), OAuthClientRegistrationErrorSchema = object({
+  error: string(),
+  error_description: string().optional()
+}).strip(), OAuthTokenRevocationRequestSchema = object({
+  token: string(),
+  token_type_hint: string().optional()
+}).strip();
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth-utils.js
+function resourceUrlFromServerUrl(url2) {
+  let resourceURL = typeof url2 == "string" ? new URL(url2) : new URL(url2.href);
+  return resourceURL.hash = "", resourceURL;
+}
+function checkResourceAllowed({ requestedResource, configuredResource }) {
+  let requested = typeof requestedResource == "string" ? new URL(requestedResource) : new URL(requestedResource.href), configured = typeof configuredResource == "string" ? new URL(configuredResource) : new URL(configuredResource.href);
+  if (requested.origin !== configured.origin || requested.pathname.length < configured.pathname.length)
+    return !1;
+  let requestedPath = requested.pathname.endsWith("/") ? requested.pathname : requested.pathname + "/", configuredPath = configured.pathname.endsWith("/") ? configured.pathname : configured.pathname + "/";
+  return requestedPath.startsWith(configuredPath);
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/server/auth/errors.js
+var OAuthError = class extends Error {
+  constructor(message, errorUri) {
+    super(message), this.errorUri = errorUri, this.name = this.constructor.name;
+  }
+  /**
+   * Converts the error to a standard OAuth error response object
+   */
+  toResponseObject() {
+    let response = {
+      error: this.errorCode,
+      error_description: this.message
+    };
+    return this.errorUri && (response.error_uri = this.errorUri), response;
+  }
+  get errorCode() {
+    return this.constructor.errorCode;
+  }
+}, InvalidRequestError = class extends OAuthError {
+};
+InvalidRequestError.errorCode = "invalid_request";
+var InvalidClientError = class extends OAuthError {
+};
+InvalidClientError.errorCode = "invalid_client";
+var InvalidGrantError = class extends OAuthError {
+};
+InvalidGrantError.errorCode = "invalid_grant";
+var UnauthorizedClientError = class extends OAuthError {
+};
+UnauthorizedClientError.errorCode = "unauthorized_client";
+var UnsupportedGrantTypeError = class extends OAuthError {
+};
+UnsupportedGrantTypeError.errorCode = "unsupported_grant_type";
+var InvalidScopeError = class extends OAuthError {
+};
+InvalidScopeError.errorCode = "invalid_scope";
+var AccessDeniedError = class extends OAuthError {
+};
+AccessDeniedError.errorCode = "access_denied";
+var ServerError = class extends OAuthError {
+};
+ServerError.errorCode = "server_error";
+var TemporarilyUnavailableError = class extends OAuthError {
+};
+TemporarilyUnavailableError.errorCode = "temporarily_unavailable";
+var UnsupportedResponseTypeError = class extends OAuthError {
+};
+UnsupportedResponseTypeError.errorCode = "unsupported_response_type";
+var UnsupportedTokenTypeError = class extends OAuthError {
+};
+UnsupportedTokenTypeError.errorCode = "unsupported_token_type";
+var InvalidTokenError = class extends OAuthError {
+};
+InvalidTokenError.errorCode = "invalid_token";
+var MethodNotAllowedError = class extends OAuthError {
+};
+MethodNotAllowedError.errorCode = "method_not_allowed";
+var TooManyRequestsError = class extends OAuthError {
+};
+TooManyRequestsError.errorCode = "too_many_requests";
+var InvalidClientMetadataError = class extends OAuthError {
+};
+InvalidClientMetadataError.errorCode = "invalid_client_metadata";
+var InsufficientScopeError = class extends OAuthError {
+};
+InsufficientScopeError.errorCode = "insufficient_scope";
+var InvalidTargetError = class extends OAuthError {
+};
+InvalidTargetError.errorCode = "invalid_target";
+var OAUTH_ERRORS = {
+  [InvalidRequestError.errorCode]: InvalidRequestError,
+  [InvalidClientError.errorCode]: InvalidClientError,
+  [InvalidGrantError.errorCode]: InvalidGrantError,
+  [UnauthorizedClientError.errorCode]: UnauthorizedClientError,
+  [UnsupportedGrantTypeError.errorCode]: UnsupportedGrantTypeError,
+  [InvalidScopeError.errorCode]: InvalidScopeError,
+  [AccessDeniedError.errorCode]: AccessDeniedError,
+  [ServerError.errorCode]: ServerError,
+  [TemporarilyUnavailableError.errorCode]: TemporarilyUnavailableError,
+  [UnsupportedResponseTypeError.errorCode]: UnsupportedResponseTypeError,
+  [UnsupportedTokenTypeError.errorCode]: UnsupportedTokenTypeError,
+  [InvalidTokenError.errorCode]: InvalidTokenError,
+  [MethodNotAllowedError.errorCode]: MethodNotAllowedError,
+  [TooManyRequestsError.errorCode]: TooManyRequestsError,
+  [InvalidClientMetadataError.errorCode]: InvalidClientMetadataError,
+  [InsufficientScopeError.errorCode]: InsufficientScopeError,
+  [InvalidTargetError.errorCode]: InvalidTargetError
+};
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/client/auth.js
+var UnauthorizedError = class extends Error {
+  constructor(message) {
+    super(message ?? "Unauthorized");
+  }
+};
+function isClientAuthMethod(method) {
+  return ["client_secret_basic", "client_secret_post", "none"].includes(method);
+}
+var AUTHORIZATION_CODE_RESPONSE_TYPE = "code", AUTHORIZATION_CODE_CHALLENGE_METHOD = "S256";
+function selectClientAuthMethod(clientInformation, supportedMethods) {
+  let hasClientSecret = clientInformation.client_secret !== void 0;
+  return "token_endpoint_auth_method" in clientInformation && clientInformation.token_endpoint_auth_method && isClientAuthMethod(clientInformation.token_endpoint_auth_method) && (supportedMethods.length === 0 || supportedMethods.includes(clientInformation.token_endpoint_auth_method)) ? clientInformation.token_endpoint_auth_method : supportedMethods.length === 0 ? hasClientSecret ? "client_secret_basic" : "none" : hasClientSecret && supportedMethods.includes("client_secret_basic") ? "client_secret_basic" : hasClientSecret && supportedMethods.includes("client_secret_post") ? "client_secret_post" : supportedMethods.includes("none") ? "none" : hasClientSecret ? "client_secret_post" : "none";
+}
+function applyClientAuthentication(method, clientInformation, headers, params) {
+  let { client_id, client_secret } = clientInformation;
+  switch (method) {
+    case "client_secret_basic":
+      applyBasicAuth(client_id, client_secret, headers);
+      return;
+    case "client_secret_post":
+      applyPostAuth(client_id, client_secret, params);
+      return;
+    case "none":
+      applyPublicAuth(client_id, params);
+      return;
+    default:
+      throw new Error(`Unsupported client authentication method: ${method}`);
+  }
+}
+function applyBasicAuth(clientId, clientSecret, headers) {
+  if (!clientSecret)
+    throw new Error("client_secret_basic authentication requires a client_secret");
+  let credentials = btoa(`${clientId}:${clientSecret}`);
+  headers.set("Authorization", `Basic ${credentials}`);
+}
+function applyPostAuth(clientId, clientSecret, params) {
+  params.set("client_id", clientId), clientSecret && params.set("client_secret", clientSecret);
+}
+function applyPublicAuth(clientId, params) {
+  params.set("client_id", clientId);
+}
+async function parseErrorResponse(input) {
+  let statusCode = input instanceof Response ? input.status : void 0, body = input instanceof Response ? await input.text() : input;
+  try {
+    let result = OAuthErrorResponseSchema.parse(JSON.parse(body)), { error, error_description, error_uri } = result, errorClass = OAUTH_ERRORS[error] || ServerError;
+    return new errorClass(error_description || "", error_uri);
+  } catch (error) {
+    let errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ""}Invalid OAuth error response: ${error}. Raw body: ${body}`;
+    return new ServerError(errorMessage);
+  }
+}
+async function auth(provider, options) {
+  try {
+    return await authInternal(provider, options);
+  } catch (error) {
+    if (error instanceof InvalidClientError || error instanceof UnauthorizedClientError)
+      return await provider.invalidateCredentials?.("all"), await authInternal(provider, options);
+    if (error instanceof InvalidGrantError)
+      return await provider.invalidateCredentials?.("tokens"), await authInternal(provider, options);
+    throw error;
+  }
+}
+async function authInternal(provider, { serverUrl, authorizationCode, scope, resourceMetadataUrl, fetchFn }) {
+  let cachedState = await provider.discoveryState?.(), resourceMetadata, authorizationServerUrl, metadata, effectiveResourceMetadataUrl = resourceMetadataUrl;
+  if (!effectiveResourceMetadataUrl && cachedState?.resourceMetadataUrl && (effectiveResourceMetadataUrl = new URL(cachedState.resourceMetadataUrl)), cachedState?.authorizationServerUrl) {
+    if (authorizationServerUrl = cachedState.authorizationServerUrl, resourceMetadata = cachedState.resourceMetadata, metadata = cachedState.authorizationServerMetadata ?? await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn }), !resourceMetadata)
+      try {
+        resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl }, fetchFn);
+      } catch {
+      }
+    (metadata !== cachedState.authorizationServerMetadata || resourceMetadata !== cachedState.resourceMetadata) && await provider.saveDiscoveryState?.({
+      authorizationServerUrl: String(authorizationServerUrl),
+      resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
+      resourceMetadata,
+      authorizationServerMetadata: metadata
+    });
+  } else {
+    let serverInfo = await discoverOAuthServerInfo(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl, fetchFn });
+    authorizationServerUrl = serverInfo.authorizationServerUrl, metadata = serverInfo.authorizationServerMetadata, resourceMetadata = serverInfo.resourceMetadata, await provider.saveDiscoveryState?.({
+      authorizationServerUrl: String(authorizationServerUrl),
+      resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
+      resourceMetadata,
+      authorizationServerMetadata: metadata
+    });
+  }
+  let resource = await selectResourceURL(serverUrl, provider, resourceMetadata), resolvedScope = scope || resourceMetadata?.scopes_supported?.join(" ") || provider.clientMetadata.scope, clientInformation = await Promise.resolve(provider.clientInformation());
+  if (!clientInformation) {
+    if (authorizationCode !== void 0)
+      throw new Error("Existing OAuth client information is required when exchanging an authorization code");
+    let supportsUrlBasedClientId = metadata?.client_id_metadata_document_supported === !0, clientMetadataUrl = provider.clientMetadataUrl;
+    if (clientMetadataUrl && !isHttpsUrl(clientMetadataUrl))
+      throw new InvalidClientMetadataError(`clientMetadataUrl must be a valid HTTPS URL with a non-root pathname, got: ${clientMetadataUrl}`);
+    if (supportsUrlBasedClientId && clientMetadataUrl)
+      clientInformation = {
+        client_id: clientMetadataUrl
+      }, await provider.saveClientInformation?.(clientInformation);
+    else {
+      if (!provider.saveClientInformation)
+        throw new Error("OAuth client information must be saveable for dynamic registration");
+      let fullInformation = await registerClient(authorizationServerUrl, {
+        metadata,
+        clientMetadata: provider.clientMetadata,
+        scope: resolvedScope,
+        fetchFn
+      });
+      await provider.saveClientInformation(fullInformation), clientInformation = fullInformation;
+    }
+  }
+  let nonInteractiveFlow = !provider.redirectUrl;
+  if (authorizationCode !== void 0 || nonInteractiveFlow) {
+    let tokens2 = await fetchToken(provider, authorizationServerUrl, {
+      metadata,
+      resource,
+      authorizationCode,
+      fetchFn
+    });
+    return await provider.saveTokens(tokens2), "AUTHORIZED";
+  }
+  let tokens = await provider.tokens();
+  if (tokens?.refresh_token)
+    try {
+      let newTokens = await refreshAuthorization(authorizationServerUrl, {
+        metadata,
+        clientInformation,
+        refreshToken: tokens.refresh_token,
+        resource,
+        addClientAuthentication: provider.addClientAuthentication,
+        fetchFn
+      });
+      return await provider.saveTokens(newTokens), "AUTHORIZED";
+    } catch (error) {
+      if (!(!(error instanceof OAuthError) || error instanceof ServerError))
+        throw error;
+    }
+  let state = provider.state ? await provider.state() : void 0, { authorizationUrl, codeVerifier } = await startAuthorization(authorizationServerUrl, {
+    metadata,
+    clientInformation,
+    state,
+    redirectUrl: provider.redirectUrl,
+    scope: resolvedScope,
+    resource
+  });
+  return await provider.saveCodeVerifier(codeVerifier), await provider.redirectToAuthorization(authorizationUrl), "REDIRECT";
+}
+function isHttpsUrl(value) {
+  if (!value)
+    return !1;
+  try {
+    let url2 = new URL(value);
+    return url2.protocol === "https:" && url2.pathname !== "/";
+  } catch {
+    return !1;
+  }
+}
+async function selectResourceURL(serverUrl, provider, resourceMetadata) {
+  let defaultResource = resourceUrlFromServerUrl(serverUrl);
+  if (provider.validateResourceURL)
+    return await provider.validateResourceURL(defaultResource, resourceMetadata?.resource);
+  if (resourceMetadata) {
+    if (!checkResourceAllowed({ requestedResource: defaultResource, configuredResource: resourceMetadata.resource }))
+      throw new Error(`Protected resource ${resourceMetadata.resource} does not match expected ${defaultResource} (or origin)`);
+    return new URL(resourceMetadata.resource);
+  }
+}
+function extractWWWAuthenticateParams(res) {
+  let authenticateHeader = res.headers.get("WWW-Authenticate");
+  if (!authenticateHeader)
+    return {};
+  let [type, scheme] = authenticateHeader.split(" ");
+  if (type.toLowerCase() !== "bearer" || !scheme)
+    return {};
+  let resourceMetadataMatch = extractFieldFromWwwAuth(res, "resource_metadata") || void 0, resourceMetadataUrl;
+  if (resourceMetadataMatch)
+    try {
+      resourceMetadataUrl = new URL(resourceMetadataMatch);
+    } catch {
+    }
+  let scope = extractFieldFromWwwAuth(res, "scope") || void 0, error = extractFieldFromWwwAuth(res, "error") || void 0;
+  return {
+    resourceMetadataUrl,
+    scope,
+    error
+  };
+}
+function extractFieldFromWwwAuth(response, fieldName) {
+  let wwwAuthHeader = response.headers.get("WWW-Authenticate");
+  if (!wwwAuthHeader)
+    return null;
+  let pattern = new RegExp(`${fieldName}=(?:"([^"]+)"|([^\\s,]+))`), match = wwwAuthHeader.match(pattern);
+  return match ? match[1] || match[2] : null;
+}
+async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn = fetch) {
+  let response = await discoverMetadataWithFallback(serverUrl, "oauth-protected-resource", fetchFn, {
+    protocolVersion: opts?.protocolVersion,
+    metadataUrl: opts?.resourceMetadataUrl
+  });
+  if (!response || response.status === 404)
+    throw await response?.body?.cancel(), new Error("Resource server does not implement OAuth 2.0 Protected Resource Metadata.");
+  if (!response.ok)
+    throw await response.body?.cancel(), new Error(`HTTP ${response.status} trying to load well-known OAuth protected resource metadata.`);
+  return OAuthProtectedResourceMetadataSchema.parse(await response.json());
+}
+async function fetchWithCorsRetry(url2, headers, fetchFn = fetch) {
+  try {
+    return await fetchFn(url2, { headers });
+  } catch (error) {
+    if (error instanceof TypeError)
+      return headers ? fetchWithCorsRetry(url2, void 0, fetchFn) : void 0;
+    throw error;
+  }
+}
+function buildWellKnownPath(wellKnownPrefix, pathname = "", options = {}) {
+  return pathname.endsWith("/") && (pathname = pathname.slice(0, -1)), options.prependPathname ? `${pathname}/.well-known/${wellKnownPrefix}` : `/.well-known/${wellKnownPrefix}${pathname}`;
+}
+async function tryMetadataDiscovery(url2, protocolVersion, fetchFn = fetch) {
+  return await fetchWithCorsRetry(url2, {
+    "MCP-Protocol-Version": protocolVersion
+  }, fetchFn);
+}
+function shouldAttemptFallback(response, pathname) {
+  return !response || response.status >= 400 && response.status < 500 && pathname !== "/";
+}
+async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, opts) {
+  let issuer = new URL(serverUrl), protocolVersion = opts?.protocolVersion ?? LATEST_PROTOCOL_VERSION, url2;
+  if (opts?.metadataUrl)
+    url2 = new URL(opts.metadataUrl);
+  else {
+    let wellKnownPath = buildWellKnownPath(wellKnownType, issuer.pathname);
+    url2 = new URL(wellKnownPath, opts?.metadataServerUrl ?? issuer), url2.search = issuer.search;
+  }
+  let response = await tryMetadataDiscovery(url2, protocolVersion, fetchFn);
+  if (!opts?.metadataUrl && shouldAttemptFallback(response, issuer.pathname)) {
+    let rootUrl = new URL(`/.well-known/${wellKnownType}`, issuer);
+    response = await tryMetadataDiscovery(rootUrl, protocolVersion, fetchFn);
+  }
+  return response;
+}
+function buildDiscoveryUrls(authorizationServerUrl) {
+  let url2 = typeof authorizationServerUrl == "string" ? new URL(authorizationServerUrl) : authorizationServerUrl, hasPath = url2.pathname !== "/", urlsToTry = [];
+  if (!hasPath)
+    return urlsToTry.push({
+      url: new URL("/.well-known/oauth-authorization-server", url2.origin),
+      type: "oauth"
+    }), urlsToTry.push({
+      url: new URL("/.well-known/openid-configuration", url2.origin),
+      type: "oidc"
+    }), urlsToTry;
+  let pathname = url2.pathname;
+  return pathname.endsWith("/") && (pathname = pathname.slice(0, -1)), urlsToTry.push({
+    url: new URL(`/.well-known/oauth-authorization-server${pathname}`, url2.origin),
+    type: "oauth"
+  }), urlsToTry.push({
+    url: new URL(`/.well-known/openid-configuration${pathname}`, url2.origin),
+    type: "oidc"
+  }), urlsToTry.push({
+    url: new URL(`${pathname}/.well-known/openid-configuration`, url2.origin),
+    type: "oidc"
+  }), urlsToTry;
+}
+async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn = fetch, protocolVersion = LATEST_PROTOCOL_VERSION } = {}) {
+  let headers = {
+    "MCP-Protocol-Version": protocolVersion,
+    Accept: "application/json"
+  }, urlsToTry = buildDiscoveryUrls(authorizationServerUrl);
+  for (let { url: endpointUrl, type } of urlsToTry) {
+    let response = await fetchWithCorsRetry(endpointUrl, headers, fetchFn);
+    if (response) {
+      if (!response.ok) {
+        if (await response.body?.cancel(), response.status >= 400 && response.status < 500)
+          continue;
+        throw new Error(`HTTP ${response.status} trying to load ${type === "oauth" ? "OAuth" : "OpenID provider"} metadata from ${endpointUrl}`);
+      }
+      return type === "oauth" ? OAuthMetadataSchema.parse(await response.json()) : OpenIdProviderDiscoveryMetadataSchema.parse(await response.json());
+    }
+  }
+}
+async function discoverOAuthServerInfo(serverUrl, opts) {
+  let resourceMetadata, authorizationServerUrl;
+  try {
+    resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: opts?.resourceMetadataUrl }, opts?.fetchFn), resourceMetadata.authorization_servers && resourceMetadata.authorization_servers.length > 0 && (authorizationServerUrl = resourceMetadata.authorization_servers[0]);
+  } catch {
+  }
+  authorizationServerUrl || (authorizationServerUrl = String(new URL("/", serverUrl)));
+  let authorizationServerMetadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn: opts?.fetchFn });
+  return {
+    authorizationServerUrl,
+    authorizationServerMetadata,
+    resourceMetadata
+  };
+}
+async function startAuthorization(authorizationServerUrl, { metadata, clientInformation, redirectUrl, scope, state, resource }) {
+  let authorizationUrl;
+  if (metadata) {
+    if (authorizationUrl = new URL(metadata.authorization_endpoint), !metadata.response_types_supported.includes(AUTHORIZATION_CODE_RESPONSE_TYPE))
+      throw new Error(`Incompatible auth server: does not support response type ${AUTHORIZATION_CODE_RESPONSE_TYPE}`);
+    if (metadata.code_challenge_methods_supported && !metadata.code_challenge_methods_supported.includes(AUTHORIZATION_CODE_CHALLENGE_METHOD))
+      throw new Error(`Incompatible auth server: does not support code challenge method ${AUTHORIZATION_CODE_CHALLENGE_METHOD}`);
+  } else
+    authorizationUrl = new URL("/authorize", authorizationServerUrl);
+  let challenge = await pkceChallenge(), codeVerifier = challenge.code_verifier, codeChallenge = challenge.code_challenge;
+  return authorizationUrl.searchParams.set("response_type", AUTHORIZATION_CODE_RESPONSE_TYPE), authorizationUrl.searchParams.set("client_id", clientInformation.client_id), authorizationUrl.searchParams.set("code_challenge", codeChallenge), authorizationUrl.searchParams.set("code_challenge_method", AUTHORIZATION_CODE_CHALLENGE_METHOD), authorizationUrl.searchParams.set("redirect_uri", String(redirectUrl)), state && authorizationUrl.searchParams.set("state", state), scope && authorizationUrl.searchParams.set("scope", scope), scope?.includes("offline_access") && authorizationUrl.searchParams.append("prompt", "consent"), resource && authorizationUrl.searchParams.set("resource", resource.href), { authorizationUrl, codeVerifier };
+}
+function prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, redirectUri) {
+  return new URLSearchParams({
+    grant_type: "authorization_code",
+    code: authorizationCode,
+    code_verifier: codeVerifier,
+    redirect_uri: String(redirectUri)
+  });
+}
+async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequestParams, clientInformation, addClientAuthentication, resource, fetchFn }) {
+  let tokenUrl = metadata?.token_endpoint ? new URL(metadata.token_endpoint) : new URL("/token", authorizationServerUrl), headers = new Headers({
+    "Content-Type": "application/x-www-form-urlencoded",
+    Accept: "application/json"
+  });
+  if (resource && tokenRequestParams.set("resource", resource.href), addClientAuthentication)
+    await addClientAuthentication(headers, tokenRequestParams, tokenUrl, metadata);
+  else if (clientInformation) {
+    let supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? [], authMethod = selectClientAuthMethod(clientInformation, supportedMethods);
+    applyClientAuthentication(authMethod, clientInformation, headers, tokenRequestParams);
+  }
+  let response = await (fetchFn ?? fetch)(tokenUrl, {
+    method: "POST",
+    headers,
+    body: tokenRequestParams
+  });
+  if (!response.ok)
+    throw await parseErrorResponse(response);
+  return OAuthTokensSchema.parse(await response.json());
+}
+async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
+  let tokenRequestParams = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken
+  }), tokens = await executeTokenRequest(authorizationServerUrl, {
+    metadata,
+    tokenRequestParams,
+    clientInformation,
+    addClientAuthentication,
+    resource,
+    fetchFn
+  });
+  return { refresh_token: refreshToken, ...tokens };
+}
+async function fetchToken(provider, authorizationServerUrl, { metadata, resource, authorizationCode, fetchFn } = {}) {
+  let scope = provider.clientMetadata.scope, tokenRequestParams;
+  if (provider.prepareTokenRequest && (tokenRequestParams = await provider.prepareTokenRequest(scope)), !tokenRequestParams) {
+    if (!authorizationCode)
+      throw new Error("Either provider.prepareTokenRequest() or authorizationCode is required");
+    if (!provider.redirectUrl)
+      throw new Error("redirectUrl is required for authorization_code flow");
+    let codeVerifier = await provider.codeVerifier();
+    tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, provider.redirectUrl);
+  }
+  let clientInformation = await provider.clientInformation();
+  return executeTokenRequest(authorizationServerUrl, {
+    metadata,
+    tokenRequestParams,
+    clientInformation: clientInformation ?? void 0,
+    addClientAuthentication: provider.addClientAuthentication,
+    resource,
+    fetchFn
+  });
+}
+async function registerClient(authorizationServerUrl, { metadata, clientMetadata, scope, fetchFn }) {
+  let registrationUrl;
+  if (metadata) {
+    if (!metadata.registration_endpoint)
+      throw new Error("Incompatible auth server: does not support dynamic client registration");
+    registrationUrl = new URL(metadata.registration_endpoint);
+  } else
+    registrationUrl = new URL("/register", authorizationServerUrl);
+  let response = await (fetchFn ?? fetch)(registrationUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      ...clientMetadata,
+      ...scope !== void 0 ? { scope } : {}
+    })
+  });
+  if (!response.ok)
+    throw await parseErrorResponse(response);
+  return OAuthClientInformationFullSchema.parse(await response.json());
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
+var import_content_type = __toESM(require_content_type(), 1);
+function mediaTypeEssence(header) {
+  if (header)
+    try {
+      return import_content_type.default.parse(header).type;
+    } catch {
+      let essence = (header.split(";", 1)[0] ?? "").trim().toLowerCase();
+      return essence === "" || header.slice(essence.length).includes(",") ? void 0 : essence;
+    }
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/transport.js
+function normalizeHeaders(headers) {
+  return headers ? headers instanceof Headers ? Object.fromEntries(headers.entries()) : Array.isArray(headers) ? Object.fromEntries(headers) : { ...headers } : {};
+}
+function createFetchWithInit(baseFetch = fetch, baseInit) {
+  return baseInit ? async (url2, init) => {
+    let mergedInit = {
+      ...baseInit,
+      ...init,
+      // Headers need special handling - merge instead of replace
+      headers: init?.headers ? { ...normalizeHeaders(baseInit.headers), ...normalizeHeaders(init.headers) } : baseInit.headers
+    };
+    return baseFetch(url2, mergedInit);
+  } : baseFetch;
+}
+
+// node_modules/eventsource-parser/dist/index.js
+var ParseError = class extends Error {
+  constructor(message, options) {
+    super(message), this.name = "ParseError", this.type = options.type, this.field = options.field, this.value = options.value, this.line = options.line;
+  }
+}, LF = 10, CR = 13, SPACE = 32;
+function noop(_arg) {
+}
+function createParser(config) {
+  if (typeof config == "function")
+    throw new TypeError(
+      "`config` must be an object, got a function instead. Did you mean `createParser({onEvent: fn})`?"
+    );
+  let { onEvent = noop, onError = noop, onRetry = noop, onComment, maxBufferSize } = config, pendingFragments = [], pendingFragmentsLength = 0, isFirstChunk = !0, id, data = "", dataLines = 0, eventType, terminated = !1;
+  function feed(chunk) {
+    if (terminated)
+      throw new Error(
+        "Cannot feed parser: it was terminated after exceeding the configured max buffer size. Call `reset()` to resume parsing."
+      );
+    if (isFirstChunk && (isFirstChunk = !1, chunk.charCodeAt(0) === 239 && chunk.charCodeAt(1) === 187 && chunk.charCodeAt(2) === 191 && (chunk = chunk.slice(3))), pendingFragments.length === 0) {
+      let trailing2 = processLines(chunk);
+      trailing2 !== "" && (pendingFragments.push(trailing2), pendingFragmentsLength = trailing2.length), checkBufferSize();
+      return;
+    }
+    if (chunk.indexOf(`
+`) === -1 && chunk.indexOf("\r") === -1) {
+      pendingFragments.push(chunk), pendingFragmentsLength += chunk.length, checkBufferSize();
+      return;
+    }
+    pendingFragments.push(chunk);
+    let input = pendingFragments.join("");
+    pendingFragments.length = 0, pendingFragmentsLength = 0;
+    let trailing = processLines(input);
+    trailing !== "" && (pendingFragments.push(trailing), pendingFragmentsLength = trailing.length), checkBufferSize();
+  }
+  function checkBufferSize() {
+    maxBufferSize !== void 0 && (pendingFragmentsLength + data.length <= maxBufferSize || (terminated = !0, pendingFragments.length = 0, pendingFragmentsLength = 0, id = void 0, data = "", dataLines = 0, eventType = void 0, onError(
+      new ParseError(`Buffered data exceeded max buffer size of ${maxBufferSize} characters`, {
+        type: "max-buffer-size-exceeded"
+      })
+    )));
+  }
+  function processLines(chunk) {
+    let searchIndex = 0;
+    if (chunk.indexOf("\r") === -1) {
+      let lfIndex = chunk.indexOf(`
+`, searchIndex);
+      for (; lfIndex !== -1; ) {
+        if (searchIndex === lfIndex) {
+          dataLines > 0 && onEvent({ id, event: eventType, data }), id = void 0, data = "", dataLines = 0, eventType = void 0, searchIndex = lfIndex + 1, lfIndex = chunk.indexOf(`
+`, searchIndex);
+          continue;
+        }
+        let firstCharCode = chunk.charCodeAt(searchIndex);
+        if (isDataPrefix(chunk, searchIndex, firstCharCode)) {
+          let valueStart = chunk.charCodeAt(searchIndex + 5) === SPACE ? searchIndex + 6 : searchIndex + 5, value = chunk.slice(valueStart, lfIndex);
+          if (dataLines === 0 && chunk.charCodeAt(lfIndex + 1) === LF) {
+            onEvent({ id, event: eventType, data: value }), id = void 0, data = "", eventType = void 0, searchIndex = lfIndex + 2, lfIndex = chunk.indexOf(`
+`, searchIndex);
+            continue;
+          }
+          data = dataLines === 0 ? value : `${data}
+${value}`, dataLines++;
+        } else isEventPrefix(chunk, searchIndex, firstCharCode) ? eventType = chunk.slice(
+          chunk.charCodeAt(searchIndex + 6) === SPACE ? searchIndex + 7 : searchIndex + 6,
+          lfIndex
+        ) || void 0 : parseLine(chunk, searchIndex, lfIndex);
+        searchIndex = lfIndex + 1, lfIndex = chunk.indexOf(`
+`, searchIndex);
+      }
+      return chunk.slice(searchIndex);
+    }
+    for (; searchIndex < chunk.length; ) {
+      let crIndex = chunk.indexOf("\r", searchIndex), lfIndex = chunk.indexOf(`
+`, searchIndex), lineEnd = -1;
+      if (crIndex !== -1 && lfIndex !== -1 ? lineEnd = crIndex < lfIndex ? crIndex : lfIndex : crIndex !== -1 ? crIndex === chunk.length - 1 ? lineEnd = -1 : lineEnd = crIndex : lfIndex !== -1 && (lineEnd = lfIndex), lineEnd === -1)
+        break;
+      parseLine(chunk, searchIndex, lineEnd), searchIndex = lineEnd + 1, chunk.charCodeAt(searchIndex - 1) === CR && chunk.charCodeAt(searchIndex) === LF && searchIndex++;
+    }
+    return chunk.slice(searchIndex);
+  }
+  function parseLine(chunk, start, end) {
+    if (start === end) {
+      dispatchEvent();
+      return;
+    }
+    let firstCharCode = chunk.charCodeAt(start);
+    if (isDataPrefix(chunk, start, firstCharCode)) {
+      let valueStart = chunk.charCodeAt(start + 5) === SPACE ? start + 6 : start + 5, value2 = chunk.slice(valueStart, end);
+      data = dataLines === 0 ? value2 : `${data}
+${value2}`, dataLines++;
+      return;
+    }
+    if (isEventPrefix(chunk, start, firstCharCode)) {
+      eventType = chunk.slice(chunk.charCodeAt(start + 6) === SPACE ? start + 7 : start + 6, end) || void 0;
+      return;
+    }
+    if (firstCharCode === 105 && chunk.charCodeAt(start + 1) === 100 && chunk.charCodeAt(start + 2) === 58) {
+      let value2 = chunk.slice(chunk.charCodeAt(start + 3) === SPACE ? start + 4 : start + 3, end);
+      id = value2.includes("\0") ? void 0 : value2;
+      return;
+    }
+    if (firstCharCode === 58) {
+      if (onComment) {
+        let line2 = chunk.slice(start, end);
+        onComment(line2.slice(chunk.charCodeAt(start + 1) === SPACE ? 2 : 1));
+      }
+      return;
+    }
+    let line = chunk.slice(start, end), fieldSeparatorIndex = line.indexOf(":");
+    if (fieldSeparatorIndex === -1) {
+      processField(line, "", line);
+      return;
+    }
+    let field = line.slice(0, fieldSeparatorIndex), offset = line.charCodeAt(fieldSeparatorIndex + 1) === SPACE ? 2 : 1, value = line.slice(fieldSeparatorIndex + offset);
+    processField(field, value, line);
+  }
+  function processField(field, value, line) {
+    switch (field) {
+      case "event":
+        eventType = value || void 0;
+        break;
+      case "data":
+        data = dataLines === 0 ? value : `${data}
+${value}`, dataLines++;
+        break;
+      case "id":
+        id = value.includes("\0") ? void 0 : value;
+        break;
+      case "retry":
+        /^\d+$/.test(value) ? onRetry(parseInt(value, 10)) : onError(
+          new ParseError(`Invalid \`retry\` value: "${value}"`, {
+            type: "invalid-retry",
+            value,
+            line
+          })
+        );
+        break;
+      default:
+        onError(
+          new ParseError(
+            `Unknown field "${field.length > 20 ? `${field.slice(0, 20)}\u2026` : field}"`,
+            { type: "unknown-field", field, value, line }
+          )
+        );
+        break;
+    }
+  }
+  function dispatchEvent() {
+    dataLines > 0 && onEvent({
+      id,
+      event: eventType,
+      data
+    }), id = void 0, data = "", dataLines = 0, eventType = void 0;
+  }
+  function reset(options = {}) {
+    if (options.consume && pendingFragments.length > 0) {
+      let incompleteLine = pendingFragments.join("");
+      parseLine(incompleteLine, 0, incompleteLine.length);
+    }
+    isFirstChunk = !0, id = void 0, data = "", dataLines = 0, eventType = void 0, pendingFragments.length = 0, pendingFragmentsLength = 0, terminated = !1;
+  }
+  return { feed, reset };
+}
+function isDataPrefix(chunk, i, firstCharCode) {
+  return firstCharCode === 100 && chunk.charCodeAt(i + 1) === 97 && chunk.charCodeAt(i + 2) === 116 && chunk.charCodeAt(i + 3) === 97 && chunk.charCodeAt(i + 4) === 58;
+}
+function isEventPrefix(chunk, i, firstCharCode) {
+  return firstCharCode === 101 && chunk.charCodeAt(i + 1) === 118 && chunk.charCodeAt(i + 2) === 101 && chunk.charCodeAt(i + 3) === 110 && chunk.charCodeAt(i + 4) === 116 && chunk.charCodeAt(i + 5) === 58;
+}
+
+// node_modules/eventsource-parser/dist/stream.js
+var EventSourceParserStream = class extends TransformStream {
+  constructor({ onError, onRetry, onComment, maxBufferSize } = {}) {
+    let parser;
+    super({
+      start(controller) {
+        parser = createParser({
+          onEvent: (event) => {
+            controller.enqueue(event);
+          },
+          onError(error) {
+            typeof onError == "function" && onError(error), (onError === "terminate" || error.type === "max-buffer-size-exceeded") && controller.error(error);
+          },
+          onRetry,
+          onComment,
+          maxBufferSize
+        });
+      },
+      transform(chunk) {
+        parser.feed(chunk);
+      }
+    });
+  }
+};
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/client/streamableHttp.js
+var DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS = {
+  initialReconnectionDelay: 1e3,
+  maxReconnectionDelay: 3e4,
+  reconnectionDelayGrowFactor: 1.5,
+  maxRetries: 2
+}, StreamableHTTPError = class extends Error {
+  constructor(code, message) {
+    super(`Streamable HTTP error: ${message}`), this.code = code;
+  }
+}, StreamableHTTPClientTransport = class {
+  constructor(url2, opts) {
+    this._hasCompletedAuthFlow = !1, this._url = url2, this._resourceMetadataUrl = void 0, this._scope = void 0, this._requestInit = opts?.requestInit, this._authProvider = opts?.authProvider, this._fetch = opts?.fetch, this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit), this._sessionId = opts?.sessionId, this._reconnectionOptions = opts?.reconnectionOptions ?? DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS;
+  }
+  async _authThenStart() {
+    if (!this._authProvider)
+      throw new UnauthorizedError("No auth provider");
+    let result;
+    try {
+      result = await auth(this._authProvider, {
+        serverUrl: this._url,
+        resourceMetadataUrl: this._resourceMetadataUrl,
+        scope: this._scope,
+        fetchFn: this._fetchWithInit
+      });
+    } catch (error) {
+      throw this.onerror?.(error), error;
+    }
+    if (result !== "AUTHORIZED")
+      throw new UnauthorizedError();
+    return await this._startOrAuthSse({ resumptionToken: void 0 });
+  }
+  async _commonHeaders() {
+    let headers = {};
+    if (this._authProvider) {
+      let tokens = await this._authProvider.tokens();
+      tokens && (headers.Authorization = `Bearer ${tokens.access_token}`);
+    }
+    this._sessionId && (headers["mcp-session-id"] = this._sessionId), this._protocolVersion && (headers["mcp-protocol-version"] = this._protocolVersion);
+    let extraHeaders = normalizeHeaders(this._requestInit?.headers);
+    return new Headers({
+      ...headers,
+      ...extraHeaders
+    });
+  }
+  async _startOrAuthSse(options) {
+    let { resumptionToken } = options;
+    try {
+      let headers = await this._commonHeaders();
+      headers.set("Accept", "text/event-stream"), resumptionToken && headers.set("last-event-id", resumptionToken);
+      let response = await (this._fetch ?? fetch)(this._url, {
+        method: "GET",
+        headers,
+        signal: this._abortController?.signal
+      });
+      if (!response.ok) {
+        if (await response.body?.cancel(), response.status === 401 && this._authProvider)
+          return await this._authThenStart();
+        if (response.status === 405)
+          return;
+        throw new StreamableHTTPError(response.status, `Failed to open SSE stream: ${response.statusText}`);
+      }
+      this._handleSseStream(response.body, options, !0);
+    } catch (error) {
+      throw this.onerror?.(error), error;
+    }
+  }
+  /**
+   * Calculates the next reconnection delay using  backoff algorithm
+   *
+   * @param attempt Current reconnection attempt count for the specific stream
+   * @returns Time to wait in milliseconds before next reconnection attempt
+   */
+  _getNextReconnectionDelay(attempt) {
+    if (this._serverRetryMs !== void 0)
+      return this._serverRetryMs;
+    let initialDelay = this._reconnectionOptions.initialReconnectionDelay, growFactor = this._reconnectionOptions.reconnectionDelayGrowFactor, maxDelay = this._reconnectionOptions.maxReconnectionDelay;
+    return Math.min(initialDelay * Math.pow(growFactor, attempt), maxDelay);
+  }
+  /**
+   * Schedule a reconnection attempt using server-provided retry interval or backoff
+   *
+   * @param lastEventId The ID of the last received event for resumability
+   * @param attemptCount Current reconnection attempt count for this specific stream
+   */
+  _scheduleReconnection(options, attemptCount = 0) {
+    let maxRetries = this._reconnectionOptions.maxRetries;
+    if (attemptCount >= maxRetries) {
+      this.onerror?.(new Error(`Maximum reconnection attempts (${maxRetries}) exceeded.`));
+      return;
+    }
+    let delay = this._getNextReconnectionDelay(attemptCount);
+    this._reconnectionTimeout = setTimeout(() => {
+      this._startOrAuthSse(options).catch((error) => {
+        this.onerror?.(new Error(`Failed to reconnect SSE stream: ${error instanceof Error ? error.message : String(error)}`)), this._scheduleReconnection(options, attemptCount + 1);
+      });
+    }, delay);
+  }
+  _handleSseStream(stream, options, isReconnectable) {
+    if (!stream)
+      return;
+    let { onresumptiontoken, replayMessageId } = options, lastEventId, hasPrimingEvent = !1, receivedResponse = !1;
+    (async () => {
+      try {
+        let reader = stream.pipeThrough(new TextDecoderStream()).pipeThrough(new EventSourceParserStream({
+          onRetry: (retryMs) => {
+            this._serverRetryMs = retryMs;
+          }
+        })).getReader();
+        for (; ; ) {
+          let { value: event, done } = await reader.read();
+          if (done)
+            break;
+          if (event.id && (lastEventId = event.id, hasPrimingEvent = !0, onresumptiontoken?.(event.id)), !!event.data && (!event.event || event.event === "message"))
+            try {
+              let message = JSONRPCMessageSchema.parse(JSON.parse(event.data));
+              isJSONRPCResultResponse(message) && (receivedResponse = !0, replayMessageId !== void 0 && (message.id = replayMessageId)), this.onmessage?.(message);
+            } catch (error) {
+              this.onerror?.(error);
+            }
+        }
+        (isReconnectable || hasPrimingEvent) && !receivedResponse && this._abortController && !this._abortController.signal.aborted && this._scheduleReconnection({
+          resumptionToken: lastEventId,
+          onresumptiontoken,
+          replayMessageId
+        }, 0);
+      } catch (error) {
+        if (this.onerror?.(new Error(`SSE stream disconnected: ${error}`)), (isReconnectable || hasPrimingEvent) && !receivedResponse && this._abortController && !this._abortController.signal.aborted)
+          try {
+            this._scheduleReconnection({
+              resumptionToken: lastEventId,
+              onresumptiontoken,
+              replayMessageId
+            }, 0);
+          } catch (error2) {
+            this.onerror?.(new Error(`Failed to reconnect: ${error2 instanceof Error ? error2.message : String(error2)}`));
+          }
+      }
+    })();
+  }
+  async start() {
+    if (this._abortController)
+      throw new Error("StreamableHTTPClientTransport already started! If using Client class, note that connect() calls start() automatically.");
+    this._abortController = new AbortController();
+  }
+  /**
+   * Call this method after the user has finished authorizing via their user agent and is redirected back to the MCP client application. This will exchange the authorization code for an access token, enabling the next connection attempt to successfully auth.
+   */
+  async finishAuth(authorizationCode) {
+    if (!this._authProvider)
+      throw new UnauthorizedError("No auth provider");
+    if (await auth(this._authProvider, {
+      serverUrl: this._url,
+      authorizationCode,
+      resourceMetadataUrl: this._resourceMetadataUrl,
+      scope: this._scope,
+      fetchFn: this._fetchWithInit
+    }) !== "AUTHORIZED")
+      throw new UnauthorizedError("Failed to authorize");
+  }
+  async close() {
+    this._reconnectionTimeout && (clearTimeout(this._reconnectionTimeout), this._reconnectionTimeout = void 0), this._abortController?.abort(), this.onclose?.();
+  }
+  async send(message, options) {
+    try {
+      let { resumptionToken, onresumptiontoken } = options || {};
+      if (resumptionToken) {
+        this._startOrAuthSse({ resumptionToken, replayMessageId: isJSONRPCRequest(message) ? message.id : void 0 }).catch((err) => this.onerror?.(err));
+        return;
+      }
+      let headers = await this._commonHeaders();
+      headers.set("content-type", "application/json"), headers.set("accept", "application/json, text/event-stream");
+      let init = {
+        ...this._requestInit,
+        method: "POST",
+        headers,
+        body: JSON.stringify(message),
+        signal: this._abortController?.signal
+      }, response = await (this._fetch ?? fetch)(this._url, init), sessionId = response.headers.get("mcp-session-id");
+      if (sessionId && (this._sessionId = sessionId), !response.ok) {
+        let text = await response.text().catch(() => null);
+        if (response.status === 401 && this._authProvider) {
+          if (this._hasCompletedAuthFlow)
+            throw new StreamableHTTPError(401, "Server returned 401 after successful authentication");
+          let { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+          if (this._resourceMetadataUrl = resourceMetadataUrl, this._scope = scope, await auth(this._authProvider, {
+            serverUrl: this._url,
+            resourceMetadataUrl: this._resourceMetadataUrl,
+            scope: this._scope,
+            fetchFn: this._fetchWithInit
+          }) !== "AUTHORIZED")
+            throw new UnauthorizedError();
+          return this._hasCompletedAuthFlow = !0, this.send(message);
+        }
+        if (response.status === 403 && this._authProvider) {
+          let { resourceMetadataUrl, scope, error } = extractWWWAuthenticateParams(response);
+          if (error === "insufficient_scope") {
+            let wwwAuthHeader = response.headers.get("WWW-Authenticate");
+            if (this._lastUpscopingHeader === wwwAuthHeader)
+              throw new StreamableHTTPError(403, "Server returned 403 after trying upscoping");
+            if (scope && (this._scope = scope), resourceMetadataUrl && (this._resourceMetadataUrl = resourceMetadataUrl), this._lastUpscopingHeader = wwwAuthHeader ?? void 0, await auth(this._authProvider, {
+              serverUrl: this._url,
+              resourceMetadataUrl: this._resourceMetadataUrl,
+              scope: this._scope,
+              fetchFn: this._fetch
+            }) !== "AUTHORIZED")
+              throw new UnauthorizedError();
+            return this.send(message);
+          }
+        }
+        throw new StreamableHTTPError(response.status, `Error POSTing to endpoint: ${text}`);
+      }
+      if (this._hasCompletedAuthFlow = !1, this._lastUpscopingHeader = void 0, response.status === 202) {
+        await response.body?.cancel(), isInitializedNotification(message) && this._startOrAuthSse({ resumptionToken: void 0 }).catch((err) => this.onerror?.(err));
+        return;
+      }
+      let hasRequests = (Array.isArray(message) ? message : [message]).filter((msg) => "method" in msg && "id" in msg && msg.id !== void 0).length > 0, contentType2 = response.headers.get("content-type"), responseMediaType = mediaTypeEssence(contentType2);
+      if (hasRequests)
+        if (responseMediaType === "text/event-stream")
+          this._handleSseStream(response.body, { onresumptiontoken }, !1);
+        else if (responseMediaType === "application/json") {
+          let data = await response.json(), responseMessages = Array.isArray(data) ? data.map((msg) => JSONRPCMessageSchema.parse(msg)) : [JSONRPCMessageSchema.parse(data)];
+          for (let msg of responseMessages)
+            this.onmessage?.(msg);
+        } else
+          throw await response.body?.cancel(), new StreamableHTTPError(-1, `Unexpected content type: ${contentType2}`);
+      else
+        await response.body?.cancel();
+    } catch (error) {
+      throw this.onerror?.(error), error;
+    }
+  }
+  get sessionId() {
+    return this._sessionId;
+  }
+  /**
+   * Terminates the current session by sending a DELETE request to the server.
+   *
+   * Clients that no longer need a particular session
+   * (e.g., because the user is leaving the client application) SHOULD send an
+   * HTTP DELETE to the MCP endpoint with the Mcp-Session-Id header to explicitly
+   * terminate the session.
+   *
+   * The server MAY respond with HTTP 405 Method Not Allowed, indicating that
+   * the server does not allow clients to terminate sessions.
+   */
+  async terminateSession() {
+    if (this._sessionId)
+      try {
+        let headers = await this._commonHeaders(), init = {
+          ...this._requestInit,
+          method: "DELETE",
+          headers,
+          signal: this._abortController?.signal
+        }, response = await (this._fetch ?? fetch)(this._url, init);
+        if (await response.body?.cancel(), !response.ok && response.status !== 405)
+          throw new StreamableHTTPError(response.status, `Failed to terminate session: ${response.statusText}`);
+        this._sessionId = void 0;
+      } catch (error) {
+        throw this.onerror?.(error), error;
+      }
+  }
+  setProtocolVersion(version) {
+    this._protocolVersion = version;
+  }
+  get protocolVersion() {
+    return this._protocolVersion;
+  }
+  /**
+   * Resume an SSE stream from a previous event ID.
+   * Opens a GET SSE connection with Last-Event-ID header to replay missed events.
+   *
+   * @param lastEventId The event ID to resume from
+   * @param options Optional callback to receive new resumption tokens
+   */
+  async resumeStream(lastEventId, options) {
+    await this._startOrAuthSse({
+      resumptionToken: lastEventId,
+      onresumptiontoken: options?.onresumptiontoken
+    });
+  }
+};
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.js
+import open from "open";
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-auth.js
+import { createHash } from "crypto";
+import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync } from "fs";
+import { join } from "path";
+function getAuthBaseDir() {
+  let override = process.env.MCP_OAUTH_DIR?.trim();
+  return override || getAgentPath("mcp-oauth");
+}
+function getServerDir(serverName) {
+  if (typeof serverName != "string")
+    throw new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);
+  let storageKey = createHash("sha256").update(serverName, "utf8").digest("hex");
+  return join(getAuthBaseDir(), `sha256-${storageKey}`);
+}
+function getAuthEntryFilePath(serverName) {
+  return join(getServerDir(serverName), "tokens.json");
+}
+function ensureServerDir(serverName) {
+  let dir = getServerDir(serverName);
+  existsSync(dir) || mkdirSync(dir, { recursive: !0, mode: 448 });
+}
+function readAuthEntry(serverName) {
+  let filePath = getAuthEntryFilePath(serverName);
+  try {
+    if (!existsSync(filePath))
+      return;
+    let data = readFileSync(filePath, "utf-8");
+    return JSON.parse(data);
+  } catch (error) {
+    console.error(`Failed to read auth entry for ${serverName}:`, error);
+    return;
+  }
+}
+function writeAuthEntry(serverName, entry) {
+  ensureServerDir(serverName);
+  let filePath = getAuthEntryFilePath(serverName);
+  writeFileSync(filePath, JSON.stringify(entry, null, 2), { mode: 384 });
+}
+function getAuthEntry(serverName) {
+  return readAuthEntry(serverName);
+}
+function getAuthForUrl(serverName, serverUrl) {
+  let entry = getAuthEntry(serverName);
+  if (entry && entry.serverUrl && entry.serverUrl === serverUrl)
+    return entry;
+}
+function saveAuthEntry(serverName, entry, serverUrl) {
+  serverUrl && (entry.serverUrl = serverUrl), writeAuthEntry(serverName, entry);
+}
+function removeAuthEntry(serverName) {
+  try {
+    let filePath = getAuthEntryFilePath(serverName);
+    existsSync(filePath) && writeFileSync(filePath, "{}", { mode: 384 });
+    let dir = getServerDir(serverName);
+    if (existsSync(dir))
+      try {
+        rmSync(dir, { recursive: !0 });
+      } catch {
+      }
+  } catch (error) {
+    console.error(`Failed to remove auth entry for ${serverName}:`, error);
+  }
+}
+function updateTokens(serverName, tokens, serverUrl) {
+  let entry = getAuthEntry(serverName) ?? {};
+  serverUrl && entry.serverUrl !== serverUrl && (delete entry.clientInfo, delete entry.codeVerifier, delete entry.oauthState), entry.tokens = tokens, saveAuthEntry(serverName, entry, serverUrl);
+}
+function updateClientInfo(serverName, clientInfo, serverUrl) {
+  let entry = getAuthEntry(serverName) ?? {};
+  serverUrl && entry.serverUrl !== serverUrl && (delete entry.tokens, delete entry.codeVerifier, delete entry.oauthState), entry.clientInfo = clientInfo, saveAuthEntry(serverName, entry, serverUrl);
+}
+function updateCodeVerifier(serverName, codeVerifier, serverUrl) {
+  let entry = getAuthEntry(serverName) ?? {};
+  serverUrl && entry.serverUrl !== serverUrl && (delete entry.tokens, delete entry.clientInfo, delete entry.oauthState), entry.codeVerifier = codeVerifier, saveAuthEntry(serverName, entry, serverUrl);
+}
+function clearCodeVerifier(serverName) {
+  let entry = getAuthEntry(serverName);
+  entry && (delete entry.codeVerifier, saveAuthEntry(serverName, entry));
+}
+function updateOAuthState(serverName, state, serverUrl) {
+  let entry = getAuthEntry(serverName) ?? {};
+  serverUrl && entry.serverUrl !== serverUrl && (delete entry.tokens, delete entry.clientInfo, delete entry.codeVerifier), entry.oauthState = state, saveAuthEntry(serverName, entry, serverUrl);
+}
+function getOAuthState(serverName) {
+  return getAuthEntry(serverName)?.oauthState;
+}
+function clearOAuthState(serverName) {
+  let entry = getAuthEntry(serverName);
+  entry && (delete entry.oauthState, saveAuthEntry(serverName, entry));
+}
+function isTokenExpired(serverName) {
+  let entry = getAuthEntry(serverName);
+  return entry?.tokens ? entry.tokens.expiresAt ? entry.tokens.expiresAt < Date.now() / 1e3 : !1 : null;
+}
+function hasStoredTokens(serverName) {
+  return !!getAuthEntry(serverName)?.tokens;
+}
+function clearAllCredentials(serverName) {
+  removeAuthEntry(serverName);
+}
+function clearClientInfo(serverName) {
+  let entry = getAuthEntry(serverName);
+  entry && (delete entry.clientInfo, saveAuthEntry(serverName, entry));
+}
+function clearTokens(serverName) {
+  let entry = getAuthEntry(serverName);
+  entry && (delete entry.tokens, saveAuthEntry(serverName, entry));
+}
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-oauth-provider.js
+var DEFAULT_OAUTH_CALLBACK_PORT = 19876, DEFAULT_OAUTH_CALLBACK_PATH = "/callback", configuredOAuthCallbackPort = DEFAULT_OAUTH_CALLBACK_PORT;
+if (process.env.MCP_OAUTH_CALLBACK_PORT) {
+  let parsedPort = Number.parseInt(process.env.MCP_OAUTH_CALLBACK_PORT, 10);
+  Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535 && (configuredOAuthCallbackPort = parsedPort);
+}
+var oauthCallbackPort = configuredOAuthCallbackPort, oauthCallbackPath = DEFAULT_OAUTH_CALLBACK_PATH;
+function getConfiguredOAuthCallbackPort() {
+  return configuredOAuthCallbackPort;
+}
+function getOAuthCallbackPort() {
+  return oauthCallbackPort;
+}
+function setOAuthCallbackPort(port) {
+  oauthCallbackPort = port;
+}
+function getOAuthCallbackPath() {
+  return oauthCallbackPath;
+}
+function setOAuthCallbackPath(path) {
+  oauthCallbackPath = path.startsWith("/") ? path : `/${path}`;
+}
+var McpOAuthProvider = class {
+  serverName;
+  serverUrl;
+  config;
+  callbacks;
+  redirectUrlSnapshot;
+  constructor(serverName, serverUrl, config, callbacks) {
+    this.serverName = serverName, this.serverUrl = serverUrl, this.config = config, this.callbacks = callbacks, this.redirectUrlSnapshot = config.grantType === "client_credentials" ? void 0 : config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`;
+  }
+  get usesClientCredentials() {
+    return this.config.grantType === "client_credentials";
+  }
+  /**
+   * The redirect URL for OAuth callbacks.
+   * This must match the redirect_uri in client metadata.
+   */
+  get redirectUrl() {
+    return this.redirectUrlSnapshot;
+  }
+  /**
+   * Client metadata for dynamic registration.
+   * Describes this client to the OAuth authorization server.
+   */
+  get clientMetadata() {
+    if (this.usesClientCredentials)
+      return {
+        client_name: this.config.clientName ?? "Pi Coding Agent",
+        client_uri: this.config.clientUri ?? "https://github.com/nicobailon/pi-mcp-adapter",
+        redirect_uris: [],
+        grant_types: ["client_credentials"],
+        token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none"
+      };
+    let redirectUrl = this.redirectUrl;
+    if (!redirectUrl)
+      throw new Error("redirectUrl is required for authorization_code flow");
+    return {
+      redirect_uris: [redirectUrl],
+      client_name: this.config.clientName ?? "Pi Coding Agent",
+      client_uri: this.config.clientUri ?? "https://github.com/nicobailon/pi-mcp-adapter",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none",
+      ...this.config.scope !== void 0 ? { scope: this.config.scope } : {}
+    };
+  }
+  /**
+   * Get client information (for pre-registered or dynamically registered clients).
+   * Returns undefined if no client info exists or if the server URL has changed.
+   */
+  async clientInformation() {
+    if (this.config.clientId)
+      return {
+        client_id: this.config.clientId,
+        client_secret: this.config.clientSecret
+      };
+    let entry = await getAuthForUrl(this.serverName, this.serverUrl);
+    if (entry?.clientInfo)
+      return entry.clientInfo.clientSecretExpiresAt && entry.clientInfo.clientSecretExpiresAt < Date.now() / 1e3 ? void 0 : {
+        client_id: entry.clientInfo.clientId,
+        client_secret: entry.clientInfo.clientSecret
+      };
+  }
+  /**
+   * Save client information from dynamic registration.
+   */
+  async saveClientInformation(info) {
+    let redirectUris = info.redirect_uris ?? (this.redirectUrl ? [this.redirectUrl] : void 0), clientInfo = {
+      clientId: info.client_id,
+      clientSecret: info.client_secret,
+      clientIdIssuedAt: info.client_id_issued_at,
+      clientSecretExpiresAt: info.client_secret_expires_at,
+      redirectUris
+    };
+    updateClientInfo(this.serverName, clientInfo, this.serverUrl);
+  }
+  /**
+   * Get stored OAuth tokens.
+   * Returns undefined if no tokens exist or if the server URL has changed.
+   */
+  async tokens() {
+    let entry = await getAuthForUrl(this.serverName, this.serverUrl);
+    if (entry?.tokens)
+      return {
+        access_token: entry.tokens.accessToken,
+        token_type: "Bearer",
+        refresh_token: entry.tokens.refreshToken,
+        expires_in: entry.tokens.expiresAt ? Math.max(0, Math.floor(entry.tokens.expiresAt - Date.now() / 1e3)) : void 0,
+        scope: entry.tokens.scope
+      };
+  }
+  /**
+   * Save OAuth tokens.
+   */
+  async saveTokens(tokens) {
+    let storedTokens = {
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token,
+      expiresAt: tokens.expires_in ? Date.now() / 1e3 + tokens.expires_in : void 0,
+      scope: tokens.scope
+    };
+    updateTokens(this.serverName, storedTokens, this.serverUrl);
+  }
+  /**
+   * Redirect the user to the authorization URL.
+   * This opens the browser for the user to authenticate.
+   *
+   * Throws UnauthorizedError when called outside of a user-initiated flow
+   * (no oauthState saved by startAuth). That path is reached when the SDK
+   * falls through from a failed refresh into a fresh authorization_code
+   * flow, which library hosts cannot complete in-process.
+   */
+  async redirectToAuthorization(authorizationUrl) {
+    if (this.usesClientCredentials)
+      throw new Error("redirectToAuthorization is not used for client_credentials flow");
+    if (!(await getAuthForUrl(this.serverName, this.serverUrl))?.oauthState)
+      throw new UnauthorizedError(`Re-authentication required for MCP server: ${this.serverName}`);
+    await this.callbacks.onRedirect(authorizationUrl);
+  }
+  /**
+   * Save the PKCE code verifier.
+   */
+  async saveCodeVerifier(codeVerifier) {
+    updateCodeVerifier(this.serverName, codeVerifier, this.serverUrl);
+  }
+  /**
+   * Get the stored PKCE code verifier.
+   * @throws Error if no code verifier is stored
+   */
+  async codeVerifier() {
+    if (this.usesClientCredentials)
+      throw new Error("codeVerifier is not used for client_credentials flow");
+    let entry = await getAuthForUrl(this.serverName, this.serverUrl);
+    if (!entry?.codeVerifier)
+      throw new Error(`No code verifier saved for MCP server: ${this.serverName}`);
+    return entry.codeVerifier;
+  }
+  /**
+   * Save the OAuth state parameter for CSRF protection.
+   */
+  async saveState(state) {
+    updateOAuthState(this.serverName, state, this.serverUrl);
+  }
+  /**
+   * Get the stored OAuth state parameter.
+   * @throws UnauthorizedError if no flow is in progress (see redirectToAuthorization)
+   */
+  async state() {
+    if (this.usesClientCredentials)
+      throw new Error("state is not used for client_credentials flow");
+    let entry = await getAuthForUrl(this.serverName, this.serverUrl);
+    if (!entry?.oauthState)
+      throw new UnauthorizedError(`Re-authentication required for MCP server: ${this.serverName}`);
+    return entry.oauthState;
+  }
+  /**
+   * Invalidate credentials when authentication fails.
+   * Clears tokens, client info, or all credentials based on the type.
+   */
+  async invalidateCredentials(type) {
+    switch (type) {
+      case "all":
+        clearAllCredentials(this.serverName);
+        break;
+      case "client":
+        clearClientInfo(this.serverName);
+        break;
+      case "tokens":
+        clearTokens(this.serverName);
+        break;
+    }
+  }
+  /**
+   * Adds configured authorization-code scope without replacing the SDK's
+   * default token endpoint authentication behavior.
+   */
+  addClientAuthentication = async (headers, params, _url, metadata) => {
+    params.get("grant_type") === "authorization_code" && !params.has("scope") && this.config.scope && params.set("scope", this.config.scope);
+    let clientInfo = await this.clientInformation();
+    if (!clientInfo)
+      return;
+    let supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? [], hasClientSecret = clientInfo.client_secret !== void 0, authMethod;
+    if (supportedMethods.length === 0 ? authMethod = hasClientSecret ? "client_secret_post" : "none" : hasClientSecret && supportedMethods.includes("client_secret_basic") ? authMethod = "client_secret_basic" : hasClientSecret && supportedMethods.includes("client_secret_post") ? authMethod = "client_secret_post" : supportedMethods.includes("none") ? authMethod = "none" : authMethod = hasClientSecret ? "client_secret_post" : "none", authMethod === "client_secret_basic") {
+      if (!clientInfo.client_secret)
+        throw new Error("client_secret_basic authentication requires a client_secret");
+      headers.set("Authorization", `Basic ${Buffer.from(`${clientInfo.client_id}:${clientInfo.client_secret}`).toString("base64")}`);
+      return;
+    }
+    params.has("client_id") || params.set("client_id", clientInfo.client_id), authMethod === "client_secret_post" && clientInfo.client_secret && !params.has("client_secret") && params.set("client_secret", clientInfo.client_secret);
+  };
+  prepareTokenRequest(scope) {
+    if (!this.usesClientCredentials)
+      return;
+    let params = new URLSearchParams({ grant_type: "client_credentials" }), requestedScope = scope ?? this.config.scope;
+    return requestedScope && params.set("scope", requestedScope), params;
+  }
+};
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-callback-server.js
+import { createServer } from "http";
+var HTML_SUCCESS = `<!DOCTYPE html>
+<html>
+<head>
+  <title>Pi - Authorization Successful</title>
+  <style>
+    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }
+    .container { text-align: center; padding: 2rem; }
+    h1 { color: #4ade80; margin-bottom: 1rem; }
+    p { color: #aaa; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>Authorization Successful</h1>
+    <p>You can close this window and return to Pi.</p>
+  </div>
+  <script>setTimeout(() => window.close(), 2000);</script>
+</body>
+</html>`;
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+var HTML_ERROR = (error) => `<!DOCTYPE html>
+<html>
+<head>
+  <title>Pi - Authorization Failed</title>
+  <style>
+    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }
+    .container { text-align: center; padding: 2rem; }
+    h1 { color: #f87171; margin-bottom: 1rem; }
+    p { color: #aaa; }
+    .error { color: #fca5a5; font-family: monospace; margin-top: 1rem; padding: 1rem; background: rgba(248,113,113,0.1); border-radius: 0.5rem; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>Authorization Failed</h1>
+    <p>An error occurred during authorization.</p>
+    <div class="error">${escapeHtml(error)}</div>
+  </div>
+</body>
+</html>`, server, bindingPromise, pendingAuths = /* @__PURE__ */ new Map(), reservedAuthStates = /* @__PURE__ */ new Set(), CALLBACK_TIMEOUT_MS = 300 * 1e3, DEFAULT_OAUTH_CALLBACK_HOST = "localhost", callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST;
+function handleRequest(req, res) {
+  let url2 = new URL(req.url || "/", `http://${req.headers.host}`);
+  if (url2.pathname !== getOAuthCallbackPath()) {
+    res.writeHead(404, { "Content-Type": "text/plain" }), res.end("Not found");
+    return;
+  }
+  let code = url2.searchParams.get("code"), state = url2.searchParams.get("state"), error = url2.searchParams.get("error"), errorDescription = url2.searchParams.get("error_description");
+  if (!state) {
+    let errorMsg = "Missing required state parameter - potential CSRF attack";
+    res.writeHead(400, { "Content-Type": "text/html" }), res.end(HTML_ERROR(errorMsg));
+    return;
+  }
+  let pending = pendingAuths.get(state), isReserved = reservedAuthStates.has(state);
+  if (error) {
+    if (!pending && !isReserved) {
+      let errorMsg2 = "Invalid or expired state parameter - potential CSRF attack";
+      res.writeHead(400, { "Content-Type": "text/html" }), res.end(HTML_ERROR(errorMsg2));
+      return;
+    }
+    let errorMsg = errorDescription || error;
+    res.writeHead(200, { "Content-Type": "text/html" }), res.end(HTML_ERROR(errorMsg)), reservedAuthStates.delete(state), pending && (clearTimeout(pending.timeout), pendingAuths.delete(state), setTimeout(() => pending.reject(new Error(errorMsg)), 0));
+    return;
+  }
+  if (!pending) {
+    let errorMsg = "Invalid or expired state parameter - potential CSRF attack";
+    res.writeHead(400, { "Content-Type": "text/html" }), res.end(HTML_ERROR(errorMsg));
+    return;
+  }
+  if (!code) {
+    res.writeHead(400, { "Content-Type": "text/html" }), res.end(HTML_ERROR("No authorization code provided"));
+    return;
+  }
+  clearTimeout(pending.timeout), pendingAuths.delete(state), pending.resolve(code), res.writeHead(200, { "Content-Type": "text/html" }), res.end(HTML_SUCCESS);
+}
+async function ensureCallbackServer(options = {}) {
+  for (; bindingPromise; )
+    await bindingPromise;
+  let operation = ensureCallbackServerLocked(options);
+  bindingPromise = operation;
+  try {
+    await operation;
+  } finally {
+    bindingPromise === operation && (bindingPromise = void 0);
+  }
+}
+async function ensureCallbackServerLocked(options = {}) {
+  let requiredPort = options.port ?? getConfiguredOAuthCallbackPort(), strictPort = options.strictPort === !0, requestedHost = options.callbackHost ?? DEFAULT_OAUTH_CALLBACK_HOST, rawRequestedPath = options.callbackPath ?? DEFAULT_OAUTH_CALLBACK_PATH, requestedPath = rawRequestedPath.startsWith("/") ? rawRequestedPath : `/${rawRequestedPath}`;
+  if (options.reserveState && !options.oauthState)
+    throw new Error("OAuth callback reservation requires an oauthState");
+  let reservedState, previousServer = server, needsStrictRebind = !!(previousServer && strictPort && getOAuthCallbackPort() !== requiredPort), needsHostSwitch = !!(previousServer && callbackServerHost !== requestedHost), needsPathSwitch = !!(previousServer && getOAuthCallbackPath() !== requestedPath);
+  if (previousServer) {
+    if (!needsStrictRebind && !needsHostSwitch) {
+      if (needsPathSwitch) {
+        if (pendingAuths.size > 0 || reservedAuthStates.size > 0)
+          throw new Error(`OAuth callback server is using path ${getOAuthCallbackPath()}, but callback path ${requestedPath} is required and cannot be switched while authorizations are pending`);
+        setOAuthCallbackPath(requestedPath);
+      }
+      options.reserveState && options.oauthState && (reservedAuthStates.add(options.oauthState), reservedState = options.oauthState);
+      return;
+    }
+    if (pendingAuths.size > 0 || reservedAuthStates.size > 0)
+      throw new Error(`OAuth callback server is running on ${callbackServerHost}:${getOAuthCallbackPort()}, but strict callback endpoint ${requestedHost}:${requiredPort} is required and cannot be switched while authorizations are pending`);
+  }
+  let candidateServer = createServer(handleRequest), listenPort = strictPort ? requiredPort : 0;
+  try {
+    if (await new Promise((resolve, reject) => {
+      candidateServer.once("error", (err) => {
+        reject(err);
+      }), candidateServer.listen(listenPort, requestedHost, () => {
+        resolve();
+      });
+    }), strictPort)
+      setOAuthCallbackPort(requiredPort);
+    else {
+      let address = candidateServer.address();
+      if (!address || typeof address == "string" || typeof address.port != "number")
+        throw new Error("OAuth callback server did not report an assigned port");
+      setOAuthCallbackPort(address.port);
+    }
+    previousServer && (needsStrictRebind || needsHostSwitch) && await new Promise((resolve) => {
+      previousServer.close(() => resolve());
+    }), callbackServerHost = requestedHost, setOAuthCallbackPath(requestedPath), server = candidateServer, options.reserveState && options.oauthState && (reservedAuthStates.add(options.oauthState), reservedState = options.oauthState), server.unref();
+  } catch (error) {
+    reservedState && reservedAuthStates.delete(reservedState);
+    let nodeError = error;
+    throw await new Promise((resolve) => {
+      candidateServer.close(() => resolve());
+    }), strictPort && nodeError.code === "EADDRINUSE" ? new Error(`OAuth callback port ${requiredPort} is already in use. Pre-registered OAuth clients require an exact redirect URI; set MCP_OAUTH_CALLBACK_PORT to your registered port or free port ${requiredPort}`, { cause: error }) : error;
+  }
+}
+function releaseCallbackServer(oauthState) {
+  reservedAuthStates.delete(oauthState);
+}
+function waitForCallback(oauthState) {
+  return reservedAuthStates.delete(oauthState), new Promise((resolve, reject) => {
+    let timeout = setTimeout(() => {
+      pendingAuths.has(oauthState) && (pendingAuths.delete(oauthState), reject(new Error("OAuth callback timeout - authorization took too long")));
+    }, CALLBACK_TIMEOUT_MS);
+    pendingAuths.set(oauthState, { resolve, reject, timeout });
+  });
+}
+function cancelPendingCallback(oauthState) {
+  reservedAuthStates.delete(oauthState);
+  let pending = pendingAuths.get(oauthState);
+  pending && (clearTimeout(pending.timeout), pendingAuths.delete(oauthState), pending.reject(new Error("Authorization cancelled")));
+}
+async function stopCallbackServer() {
+  server && (await new Promise((resolve) => {
+    server.close(() => {
+      resolve();
+    });
+  }), server = void 0), setOAuthCallbackPort(getConfiguredOAuthCallbackPort()), callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST, setOAuthCallbackPath(DEFAULT_OAUTH_CALLBACK_PATH);
+  let pendingList = Array.from(pendingAuths.entries());
+  pendingAuths.clear(), reservedAuthStates.clear(), setTimeout(() => {
+    for (let [, pending] of pendingList)
+      clearTimeout(pending.timeout), pending.reject(new Error("OAuth callback server stopped"));
+  }, 0);
+}
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.js
+var pendingTransports = /* @__PURE__ */ new Map(), pendingAuthStates = /* @__PURE__ */ new Map(), pendingAuthCleanupTimers = /* @__PURE__ */ new Map(), pendingAuthentications = /* @__PURE__ */ new Map(), MANUAL_AUTH_TIMEOUT_MS = 300 * 1e3;
+function generateState() {
+  return Array.from(crypto.getRandomValues(new Uint8Array(32))).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function extractOAuthConfig(definition) {
+  if (definition.oauth === !1)
+    return {};
+  let config = {};
+  if (definition.oauth?.grantType !== void 0 && (config.grantType = definition.oauth.grantType), definition.oauth?.clientId !== void 0 && (config.clientId = definition.oauth.clientId), definition.oauth?.clientSecret !== void 0 && (config.clientSecret = definition.oauth.clientSecret), definition.oauth?.scope !== void 0 && (config.scope = definition.oauth.scope), definition.oauth?.redirectUri !== void 0) {
+    if (typeof definition.oauth.redirectUri != "string")
+      throw new Error("OAuth redirectUri must be a string");
+    let redirectUri = definition.oauth.redirectUri.trim();
+    if (!redirectUri)
+      throw new Error("OAuth redirectUri must not be empty");
+    config.redirectUri = redirectUri;
+  }
+  if (definition.oauth?.clientName !== void 0) {
+    if (typeof definition.oauth.clientName != "string")
+      throw new Error("OAuth clientName must be a string");
+    let clientName = definition.oauth.clientName.trim();
+    if (!clientName)
+      throw new Error("OAuth clientName must not be empty");
+    config.clientName = clientName;
+  }
+  if (definition.oauth?.clientUri !== void 0) {
+    if (typeof definition.oauth.clientUri != "string")
+      throw new Error("OAuth clientUri must be a string");
+    let clientUri = definition.oauth.clientUri.trim();
+    if (!clientUri)
+      throw new Error("OAuth clientUri must not be empty");
+    config.clientUri = clientUri;
+  }
+  return config;
+}
+function parseOAuthRedirectUri(redirectUri) {
+  let url2;
+  try {
+    url2 = new URL(redirectUri);
+  } catch (error) {
+    throw new Error(`Invalid OAuth redirectUri: ${redirectUri}`, { cause: error });
+  }
+  let hostname = url2.hostname.toLowerCase(), isLocalhost = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
+  if (url2.protocol !== "http:" || !isLocalhost)
+    throw new Error("OAuth redirectUri must be an http:// localhost or loopback URI");
+  if (url2.username || url2.password)
+    throw new Error("OAuth redirectUri must not include username or password");
+  if (url2.hash)
+    throw new Error("OAuth redirectUri must not include a fragment");
+  if (!url2.port)
+    throw new Error("OAuth redirectUri must include an explicit numeric port");
+  let port = Number.parseInt(url2.port, 10);
+  if (!Number.isInteger(port) || port <= 0 || port > 65535)
+    throw new Error("OAuth redirectUri must include an explicit numeric port");
+  return { port, callbackHost: hostname === "[::1]" ? "::1" : hostname, callbackPath: url2.pathname };
+}
+async function startAuth(serverName, serverUrl, definition) {
+  let config = definition ? extractOAuthConfig(definition) : {};
+  if (config.grantType === "client_credentials") {
+    let storedAuth = await getAuthForUrl(serverName, serverUrl);
+    storedAuth?.clientInfo && !storedAuth.tokens && !config.clientId && (clearClientInfo(serverName), clearCodeVerifier(serverName), await clearOAuthState(serverName));
+    let authProvider2 = new McpOAuthProvider(serverName, serverUrl, config, {
+      onRedirect: async () => {
+        throw new Error("Browser redirect is not used for client_credentials flow");
+      }
+    });
+    if (await auth(authProvider2, { serverUrl }) !== "AUTHORIZED")
+      throw new UnauthorizedError("Failed to authorize");
+    return { authorizationUrl: "" };
+  }
+  let redirectCallback = config.redirectUri !== void 0 ? parseOAuthRedirectUri(config.redirectUri) : void 0, oauthState = generateState();
+  try {
+    await ensureCallbackServer({
+      strictPort: !!config.clientId || config.redirectUri !== void 0,
+      oauthState,
+      reserveState: !0,
+      ...redirectCallback ? { port: redirectCallback.port, callbackHost: redirectCallback.callbackHost, callbackPath: redirectCallback.callbackPath } : {}
+    });
+  } catch (error) {
+    throw await clearOAuthState(serverName), error;
+  }
+  let capturedUrl, authProvider = new McpOAuthProvider(serverName, serverUrl, config, {
+    onRedirect: async (url2) => {
+      capturedUrl = url2;
+    }
+  });
+  try {
+    let storedAuth = await getAuthForUrl(serverName, serverUrl);
+    if (storedAuth?.clientInfo && !config.clientId)
+      if (!storedAuth.tokens)
+        clearClientInfo(serverName), clearCodeVerifier(serverName), await clearOAuthState(serverName);
+      else {
+        let redirectUris = storedAuth.clientInfo.redirectUris;
+        (!Array.isArray(redirectUris) || !redirectUris.includes(authProvider.redirectUrl ?? "")) && (clearClientInfo(serverName), clearTokens(serverName), clearCodeVerifier(serverName), await clearOAuthState(serverName));
+      }
+    if (await updateOAuthState(serverName, oauthState, serverUrl), await auth(authProvider, { serverUrl }) === "AUTHORIZED")
+      return releaseCallbackServer(oauthState), await clearOAuthState(serverName), { authorizationUrl: "" };
+    if (!capturedUrl)
+      throw new UnauthorizedError("OAuth authorization URL was not provided");
+    let pendingTransport = new StreamableHTTPClientTransport(new URL(serverUrl), { authProvider });
+    return await setPendingTransport(serverName, pendingTransport, oauthState), { authorizationUrl: capturedUrl.toString() };
+  } catch (error) {
+    throw await clearPendingAuth(serverName, oauthState), error;
+  }
+}
+async function setPendingTransport(serverName, transport, oauthState) {
+  await clearPendingAuth(serverName), pendingTransports.set(serverName, transport), pendingAuthStates.set(serverName, oauthState);
+  let cleanupTimer = setTimeout(() => {
+    clearPendingAuth(serverName, oauthState);
+  }, MANUAL_AUTH_TIMEOUT_MS);
+  cleanupTimer.unref?.(), pendingAuthCleanupTimers.set(serverName, cleanupTimer);
+}
+async function clearPendingAuth(serverName, oauthState) {
+  let pendingState = pendingAuthStates.get(serverName);
+  if (oauthState && pendingState && pendingState !== oauthState)
+    return;
+  let timer = pendingAuthCleanupTimers.get(serverName);
+  timer && (clearTimeout(timer), pendingAuthCleanupTimers.delete(serverName));
+  let transport = pendingTransports.get(serverName);
+  pendingTransports.delete(serverName), pendingAuthStates.delete(serverName);
+  let stateToRelease = pendingState ?? oauthState;
+  stateToRelease && (releaseCallbackServer(stateToRelease), await getOAuthState(serverName) === stateToRelease && await clearOAuthState(serverName)), transport && await transport.close().catch(() => {
+  });
+}
+function getSearchParamsFromInput(input) {
+  try {
+    let url2 = new URL(input), params = new URLSearchParams(url2.search);
+    if (url2.hash) {
+      let hash = url2.hash.startsWith("#") ? url2.hash.slice(1) : url2.hash, hashParams = new URLSearchParams(hash);
+      for (let [key, value] of hashParams)
+        params.has(key) || params.set(key, value);
+    }
+    return params;
+  } catch {
+    let query = input.includes("?") ? input.slice(input.indexOf("?") + 1) : input, params = new URLSearchParams(query.startsWith("#") ? query.slice(1) : query);
+    return params.has("code") || params.has("state") || params.has("error") ? params : void 0;
+  }
+}
+function parseAuthorizationCodeInput(input, expectedState) {
+  let trimmed = input.trim();
+  if (!trimmed)
+    throw new Error("Authorization code or redirect URL is required");
+  let params = getSearchParamsFromInput(trimmed);
+  if (params) {
+    let error = params.get("error");
+    if (error) {
+      let description = params.get("error_description");
+      throw new Error(description ? `${error}: ${description}` : error);
+    }
+    let state = params.get("state");
+    if (expectedState && !state)
+      throw new Error("OAuth state missing from redirect URL");
+    if (expectedState && state !== expectedState)
+      throw new Error("OAuth state mismatch - potential CSRF attack");
+    let code = params.get("code");
+    if (code)
+      return code;
+  }
+  if (/^[A-Za-z0-9._~+/=-]+$/.test(trimmed))
+    return trimmed;
+  throw new Error("Could not find an OAuth authorization code in the provided input");
+}
+async function completeAuthFromInput(serverName, input) {
+  let oauthState = await getOAuthState(serverName), code = parseAuthorizationCodeInput(input, oauthState);
+  return completeAuth(serverName, code);
+}
+async function completeAuth(serverName, authorizationCode) {
+  let transport = pendingTransports.get(serverName);
+  if (!transport)
+    throw new Error(`No pending OAuth flow for server: ${serverName}`);
+  let oauthState = await getOAuthState(serverName);
+  try {
+    return await transport.finishAuth(authorizationCode), "authenticated";
+  } finally {
+    await clearPendingAuth(serverName, oauthState);
+  }
+}
+async function authenticate(serverName, serverUrl, definition, options = {}) {
+  let inFlight = pendingAuthentications.get(serverName);
+  if (inFlight)
+    return inFlight;
+  let operation = (async () => {
+    let { authorizationUrl } = await startAuth(serverName, serverUrl, definition);
+    if (!authorizationUrl)
+      return "authenticated";
+    let oauthState = await getOAuthState(serverName);
+    if (!oauthState)
+      throw new Error("OAuth state not found - this should not happen");
+    let callbackPromise = waitForCallback(oauthState);
+    try {
+      options.onAuthorizationUrl ? await options.onAuthorizationUrl(authorizationUrl) : console.log(`MCP Auth: Open this URL to authenticate ${serverName}:
+${authorizationUrl}`);
+      try {
+        await open(authorizationUrl);
+      } catch (error) {
+        console.warn(`MCP Auth: Failed to open browser for ${serverName}; waiting for manual callback`, { error });
+      }
+      let code = await callbackPromise;
+      if (await getOAuthState(serverName) !== oauthState)
+        throw await clearOAuthState(serverName), new Error("OAuth state mismatch - potential CSRF attack");
+      return await clearOAuthState(serverName), await completeAuth(serverName, code);
+    } catch (error) {
+      throw cancelPendingCallback(oauthState), await clearPendingAuth(serverName, oauthState), error;
+    }
+  })();
+  pendingAuthentications.set(serverName, operation);
+  try {
+    return await operation;
+  } finally {
+    pendingAuthentications.get(serverName) === operation && pendingAuthentications.delete(serverName);
+  }
+}
+async function getValidToken(serverName, serverUrl) {
+  let entry = await getAuthForUrl(serverName, serverUrl);
+  if (!entry?.tokens)
+    return null;
+  let expired = await isTokenExpired(serverName);
+  if (expired === !1)
+    return entry.tokens;
+  if (expired === !0 && entry.tokens.refreshToken) {
+    console.log(`MCP Auth: Token expired for ${serverName}, attempting refresh`);
+    try {
+      let authProvider = new McpOAuthProvider(serverName, serverUrl, {}, {
+        onRedirect: async () => {
+        }
+      });
+      return await authProvider.clientInformation() ? await auth(authProvider, { serverUrl }) !== "AUTHORIZED" ? null : (await getAuthForUrl(serverName, serverUrl))?.tokens ?? null : (console.log(`MCP Auth: No client info for refresh for ${serverName}`), null);
+    } catch (error) {
+      return console.error(`MCP Auth: Token refresh failed for ${serverName}`, { error }), null;
+    }
+  }
+  return entry.tokens;
+}
+async function getAuthStatus(serverName) {
+  return await hasStoredTokens(serverName) ? await isTokenExpired(serverName) ? "expired" : "authenticated" : "not_authenticated";
+}
+async function removeAuth(serverName) {
+  let oauthState = await getOAuthState(serverName);
+  oauthState && cancelPendingCallback(oauthState), await clearPendingAuth(serverName, oauthState), clearAllCredentials(serverName), await clearOAuthState(serverName), console.log(`MCP Auth: Removed credentials for ${serverName}`);
+}
+function supportsOAuth(definition) {
+  return !definition.url || definition.auth === !1 || definition.oauth === !1 ? !1 : definition.auth === "oauth" ? !0 : definition.headers && Object.keys(definition.headers).length > 0 ? !1 : definition.auth === void 0;
+}
+async function initializeOAuth() {
+}
+async function shutdownOAuth() {
+  for (let serverName of Array.from(pendingTransports.keys()))
+    await clearPendingAuth(serverName);
+  await stopCallbackServer();
+}
+
+export {
+  normalizeHeaders,
+  createFetchWithInit,
+  UnauthorizedError,
+  auth,
+  extractWWWAuthenticateParams,
+  createParser,
+  StreamableHTTPClientTransport,
+  getAuthForUrl,
+  McpOAuthProvider,
+  extractOAuthConfig,
+  startAuth,
+  parseAuthorizationCodeInput,
+  completeAuthFromInput,
+  completeAuth,
+  authenticate,
+  getValidToken,
+  getAuthStatus,
+  removeAuth,
+  supportsOAuth,
+  initializeOAuth,
+  shutdownOAuth
+};
+/*! Bundled license information:
+
+content-type/index.js:
+  (*!
+   * content-type
+   * Copyright(c) 2015 Douglas Christopher Wilson
+   * MIT Licensed
+   *)
+*/