@ashx-j/lunr 0.2.25 → 0.2.27

package/dist/node-runtime/chunk-EBLAZVSA.js

@@ -0,0 +1,4170 @@
+import { createRequire as __lunrRequire } from "node:module"; const require = __lunrRequire(import.meta.url);
+import {
+  AjvJsonSchemaValidator,
+  CallToolResultSchema,
+  Client,
+  ContentBlockSchema,
+  CreateMessageRequestSchema,
+  ElicitRequestSchema,
+  ElicitationCompleteNotificationSchema,
+  EmbeddedResourceSchema,
+  ErrorCode,
+  ImplementationSchema,
+  JSONRPCMessageSchema,
+  LATEST_PROTOCOL_VERSION,
+  McpError,
+  RequestIdSchema,
+  ResourceLinkSchema,
+  StdioClientTransport,
+  ToolSchema,
+  UrlElicitationRequiredError,
+  isInitializedNotification,
+  isJSONRPCRequest,
+  isJSONRPCResultResponse
+} from "./chunk-VSUEAI7O.js";
+import {
+  abortable,
+  computeServerHash,
+  extractToolUiStreamMode,
+  getAgentPath,
+  getMetadataCachePath,
+  getMissingConfiguredDirectToolServers,
+  interpolateEnvRecord,
+  isServerCacheValid,
+  loadMcpConfig,
+  loadMetadataCache,
+  openUrl,
+  parallelLimit,
+  reconstructToolMetadata,
+  resolveBearerToken,
+  resolveConfigPath,
+  saveMetadataCache,
+  serializeResources,
+  serializeTools,
+  throwIfAborted,
+  truncateAtWord
+} from "./chunk-B2IBAXNX.js";
+import {
+  formatToolName,
+  isToolExcluded,
+  resourceNameToToolName,
+  serverStreamResultPatchNotificationSchema
+} from "./chunk-ARC4KOTI.js";
+import {
+  NEVER,
+  ZodIssueCode,
+  any,
+  array,
+  boolean,
+  coerce_exports,
+  external_exports,
+  literal,
+  looseObject,
+  number,
+  object,
+  string,
+  url
+} from "./chunk-BI3DHYCN.js";
+import {
+  __commonJS,
+  __require,
+  __toESM
+} from "./chunk-BRJX2PRC.js";
+
+// node_modules/content-type/index.js
+var require_content_type = __commonJS({
+  "node_modules/content-type/index.js"(exports) {
+    "use strict";
+    var PARAM_REGEXP = /; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g, TEXT_REGEXP = /^[\u000b\u0020-\u007e\u0080-\u00ff]+$/, TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/, QESC_REGEXP = /\\([\u000b\u0020-\u00ff])/g, QUOTE_REGEXP = /([\\"])/g, TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+    exports.format = format;
+    exports.parse = parse;
+    function format(obj) {
+      if (!obj || typeof obj != "object")
+        throw new TypeError("argument obj is required");
+      var parameters = obj.parameters, type = obj.type;
+      if (!type || !TYPE_REGEXP.test(type))
+        throw new TypeError("invalid type");
+      var string2 = type;
+      if (parameters && typeof parameters == "object")
+        for (var param, params = Object.keys(parameters).sort(), i2 = 0; i2 < params.length; i2++) {
+          if (param = params[i2], !TOKEN_REGEXP.test(param))
+            throw new TypeError("invalid parameter name");
+          string2 += "; " + param + "=" + qstring(parameters[param]);
+        }
+      return string2;
+    }
+    function parse(string2) {
+      if (!string2)
+        throw new TypeError("argument string is required");
+      var header = typeof string2 == "object" ? getcontenttype(string2) : string2;
+      if (typeof header != "string")
+        throw new TypeError("argument string is required to be a string");
+      var index = header.indexOf(";"), type = index !== -1 ? header.slice(0, index).trim() : header.trim();
+      if (!TYPE_REGEXP.test(type))
+        throw new TypeError("invalid media type");
+      var obj = new ContentType(type.toLowerCase());
+      if (index !== -1) {
+        var key, match, value;
+        for (PARAM_REGEXP.lastIndex = index; match = PARAM_REGEXP.exec(header); ) {
+          if (match.index !== index)
+            throw new TypeError("invalid parameter format");
+          index += match[0].length, key = match[1].toLowerCase(), value = match[2], value.charCodeAt(0) === 34 && (value = value.slice(1, -1), value.indexOf("\\") !== -1 && (value = value.replace(QESC_REGEXP, "$1"))), obj.parameters[key] = value;
+        }
+        if (index !== header.length)
+          throw new TypeError("invalid parameter format");
+      }
+      return obj;
+    }
+    function getcontenttype(obj) {
+      var header;
+      if (typeof obj.getHeader == "function" ? header = obj.getHeader("content-type") : typeof obj.headers == "object" && (header = obj.headers && obj.headers["content-type"]), typeof header != "string")
+        throw new TypeError("content-type header is missing from object");
+      return header;
+    }
+    function qstring(val) {
+      var str = String(val);
+      if (TOKEN_REGEXP.test(str))
+        return str;
+      if (str.length > 0 && !TEXT_REGEXP.test(str))
+        throw new TypeError("invalid parameter value");
+      return '"' + str.replace(QUOTE_REGEXP, "\\$1") + '"';
+    }
+    function ContentType(type) {
+      this.parameters = /* @__PURE__ */ Object.create(null), this.type = type;
+    }
+  }
+});
+
+// node_modules/pkce-challenge/dist/index.node.js
+var crypto2;
+crypto2 = globalThis.crypto?.webcrypto ?? // Node.js [18-16] REPL
+globalThis.crypto ?? // Node.js >18
+import("node:crypto").then((m) => m.webcrypto);
+async function getRandomValues(size) {
+  return (await crypto2).getRandomValues(new Uint8Array(size));
+}
+async function random(size) {
+  let mask = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~", evenDistCutoff = Math.pow(2, 8) - Math.pow(2, 8) % mask.length, result = "";
+  for (; result.length < size; ) {
+    let randomBytes = await getRandomValues(size - result.length);
+    for (let randomByte of randomBytes)
+      randomByte < evenDistCutoff && (result += mask[randomByte % mask.length]);
+  }
+  return result;
+}
+async function generateVerifier(length) {
+  return await random(length);
+}
+async function generateChallenge(code_verifier) {
+  let buffer = await (await crypto2).subtle.digest("SHA-256", new TextEncoder().encode(code_verifier));
+  return btoa(String.fromCharCode(...new Uint8Array(buffer))).replace(/\//g, "_").replace(/\+/g, "-").replace(/=/g, "");
+}
+async function pkceChallenge(length) {
+  if (length || (length = 43), length < 43 || length > 128)
+    throw `Expected a length between 43 and 128. Received ${length}.`;
+  let verifier = await generateVerifier(length), challenge = await generateChallenge(verifier);
+  return {
+    code_verifier: verifier,
+    code_challenge: challenge
+  };
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
+var SafeUrlSchema = url().superRefine((val, ctx) => {
+  if (!URL.canParse(val))
+    return ctx.addIssue({
+      code: ZodIssueCode.custom,
+      message: "URL must be parseable",
+      fatal: !0
+    }), NEVER;
+}).refine((url2) => {
+  let u2 = new URL(url2);
+  return u2.protocol !== "javascript:" && u2.protocol !== "data:" && u2.protocol !== "vbscript:";
+}, { message: "URL cannot use javascript:, data:, or vbscript: scheme" }), OAuthProtectedResourceMetadataSchema = looseObject({
+  resource: string().url(),
+  authorization_servers: array(SafeUrlSchema).optional(),
+  jwks_uri: string().url().optional(),
+  scopes_supported: array(string()).optional(),
+  bearer_methods_supported: array(string()).optional(),
+  resource_signing_alg_values_supported: array(string()).optional(),
+  resource_name: string().optional(),
+  resource_documentation: string().optional(),
+  resource_policy_uri: string().url().optional(),
+  resource_tos_uri: string().url().optional(),
+  tls_client_certificate_bound_access_tokens: boolean().optional(),
+  authorization_details_types_supported: array(string()).optional(),
+  dpop_signing_alg_values_supported: array(string()).optional(),
+  dpop_bound_access_tokens_required: boolean().optional()
+}), OAuthMetadataSchema = looseObject({
+  issuer: string(),
+  authorization_endpoint: SafeUrlSchema,
+  token_endpoint: SafeUrlSchema,
+  registration_endpoint: SafeUrlSchema.optional(),
+  scopes_supported: array(string()).optional(),
+  response_types_supported: array(string()),
+  response_modes_supported: array(string()).optional(),
+  grant_types_supported: array(string()).optional(),
+  token_endpoint_auth_methods_supported: array(string()).optional(),
+  token_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+  service_documentation: SafeUrlSchema.optional(),
+  revocation_endpoint: SafeUrlSchema.optional(),
+  revocation_endpoint_auth_methods_supported: array(string()).optional(),
+  revocation_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+  introspection_endpoint: string().optional(),
+  introspection_endpoint_auth_methods_supported: array(string()).optional(),
+  introspection_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+  code_challenge_methods_supported: array(string()).optional(),
+  client_id_metadata_document_supported: boolean().optional()
+}), OpenIdProviderMetadataSchema = looseObject({
+  issuer: string(),
+  authorization_endpoint: SafeUrlSchema,
+  token_endpoint: SafeUrlSchema,
+  userinfo_endpoint: SafeUrlSchema.optional(),
+  jwks_uri: SafeUrlSchema,
+  registration_endpoint: SafeUrlSchema.optional(),
+  scopes_supported: array(string()).optional(),
+  response_types_supported: array(string()),
+  response_modes_supported: array(string()).optional(),
+  grant_types_supported: array(string()).optional(),
+  acr_values_supported: array(string()).optional(),
+  subject_types_supported: array(string()),
+  id_token_signing_alg_values_supported: array(string()),
+  id_token_encryption_alg_values_supported: array(string()).optional(),
+  id_token_encryption_enc_values_supported: array(string()).optional(),
+  userinfo_signing_alg_values_supported: array(string()).optional(),
+  userinfo_encryption_alg_values_supported: array(string()).optional(),
+  userinfo_encryption_enc_values_supported: array(string()).optional(),
+  request_object_signing_alg_values_supported: array(string()).optional(),
+  request_object_encryption_alg_values_supported: array(string()).optional(),
+  request_object_encryption_enc_values_supported: array(string()).optional(),
+  token_endpoint_auth_methods_supported: array(string()).optional(),
+  token_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+  display_values_supported: array(string()).optional(),
+  claim_types_supported: array(string()).optional(),
+  claims_supported: array(string()).optional(),
+  service_documentation: string().optional(),
+  claims_locales_supported: array(string()).optional(),
+  ui_locales_supported: array(string()).optional(),
+  claims_parameter_supported: boolean().optional(),
+  request_parameter_supported: boolean().optional(),
+  request_uri_parameter_supported: boolean().optional(),
+  require_request_uri_registration: boolean().optional(),
+  op_policy_uri: SafeUrlSchema.optional(),
+  op_tos_uri: SafeUrlSchema.optional(),
+  client_id_metadata_document_supported: boolean().optional()
+}), OpenIdProviderDiscoveryMetadataSchema = object({
+  ...OpenIdProviderMetadataSchema.shape,
+  ...OAuthMetadataSchema.pick({
+    code_challenge_methods_supported: !0
+  }).shape
+}), OAuthTokensSchema = object({
+  access_token: string(),
+  id_token: string().optional(),
+  // Optional for OAuth 2.1, but necessary in OpenID Connect
+  token_type: string(),
+  expires_in: coerce_exports.number().optional(),
+  scope: string().optional(),
+  refresh_token: string().optional()
+}).strip(), OAuthErrorResponseSchema = object({
+  error: string(),
+  error_description: string().optional(),
+  error_uri: string().optional()
+}), OptionalSafeUrlSchema = SafeUrlSchema.optional().or(literal("").transform(() => {
+})), OAuthClientMetadataSchema = object({
+  redirect_uris: array(SafeUrlSchema),
+  token_endpoint_auth_method: string().optional(),
+  grant_types: array(string()).optional(),
+  response_types: array(string()).optional(),
+  client_name: string().optional(),
+  client_uri: SafeUrlSchema.optional(),
+  logo_uri: OptionalSafeUrlSchema,
+  scope: string().optional(),
+  contacts: array(string()).optional(),
+  tos_uri: OptionalSafeUrlSchema,
+  policy_uri: string().optional(),
+  jwks_uri: SafeUrlSchema.optional(),
+  jwks: any().optional(),
+  software_id: string().optional(),
+  software_version: string().optional(),
+  software_statement: string().optional()
+}).strip(), OAuthClientInformationSchema = object({
+  client_id: string(),
+  client_secret: string().optional(),
+  client_id_issued_at: number().optional(),
+  client_secret_expires_at: number().optional()
+}).strip(), OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema), OAuthClientRegistrationErrorSchema = object({
+  error: string(),
+  error_description: string().optional()
+}).strip(), OAuthTokenRevocationRequestSchema = object({
+  token: string(),
+  token_type_hint: string().optional()
+}).strip();
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth-utils.js
+function resourceUrlFromServerUrl(url2) {
+  let resourceURL = typeof url2 == "string" ? new URL(url2) : new URL(url2.href);
+  return resourceURL.hash = "", resourceURL;
+}
+function checkResourceAllowed({ requestedResource, configuredResource }) {
+  let requested = typeof requestedResource == "string" ? new URL(requestedResource) : new URL(requestedResource.href), configured = typeof configuredResource == "string" ? new URL(configuredResource) : new URL(configuredResource.href);
+  if (requested.origin !== configured.origin || requested.pathname.length < configured.pathname.length)
+    return !1;
+  let requestedPath = requested.pathname.endsWith("/") ? requested.pathname : requested.pathname + "/", configuredPath = configured.pathname.endsWith("/") ? configured.pathname : configured.pathname + "/";
+  return requestedPath.startsWith(configuredPath);
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/server/auth/errors.js
+var OAuthError = class extends Error {
+  constructor(message, errorUri) {
+    super(message), this.errorUri = errorUri, this.name = this.constructor.name;
+  }
+  /**
+   * Converts the error to a standard OAuth error response object
+   */
+  toResponseObject() {
+    let response = {
+      error: this.errorCode,
+      error_description: this.message
+    };
+    return this.errorUri && (response.error_uri = this.errorUri), response;
+  }
+  get errorCode() {
+    return this.constructor.errorCode;
+  }
+}, InvalidRequestError = class extends OAuthError {
+};
+InvalidRequestError.errorCode = "invalid_request";
+var InvalidClientError = class extends OAuthError {
+};
+InvalidClientError.errorCode = "invalid_client";
+var InvalidGrantError = class extends OAuthError {
+};
+InvalidGrantError.errorCode = "invalid_grant";
+var UnauthorizedClientError = class extends OAuthError {
+};
+UnauthorizedClientError.errorCode = "unauthorized_client";
+var UnsupportedGrantTypeError = class extends OAuthError {
+};
+UnsupportedGrantTypeError.errorCode = "unsupported_grant_type";
+var InvalidScopeError = class extends OAuthError {
+};
+InvalidScopeError.errorCode = "invalid_scope";
+var AccessDeniedError = class extends OAuthError {
+};
+AccessDeniedError.errorCode = "access_denied";
+var ServerError = class extends OAuthError {
+};
+ServerError.errorCode = "server_error";
+var TemporarilyUnavailableError = class extends OAuthError {
+};
+TemporarilyUnavailableError.errorCode = "temporarily_unavailable";
+var UnsupportedResponseTypeError = class extends OAuthError {
+};
+UnsupportedResponseTypeError.errorCode = "unsupported_response_type";
+var UnsupportedTokenTypeError = class extends OAuthError {
+};
+UnsupportedTokenTypeError.errorCode = "unsupported_token_type";
+var InvalidTokenError = class extends OAuthError {
+};
+InvalidTokenError.errorCode = "invalid_token";
+var MethodNotAllowedError = class extends OAuthError {
+};
+MethodNotAllowedError.errorCode = "method_not_allowed";
+var TooManyRequestsError = class extends OAuthError {
+};
+TooManyRequestsError.errorCode = "too_many_requests";
+var InvalidClientMetadataError = class extends OAuthError {
+};
+InvalidClientMetadataError.errorCode = "invalid_client_metadata";
+var InsufficientScopeError = class extends OAuthError {
+};
+InsufficientScopeError.errorCode = "insufficient_scope";
+var InvalidTargetError = class extends OAuthError {
+};
+InvalidTargetError.errorCode = "invalid_target";
+var OAUTH_ERRORS = {
+  [InvalidRequestError.errorCode]: InvalidRequestError,
+  [InvalidClientError.errorCode]: InvalidClientError,
+  [InvalidGrantError.errorCode]: InvalidGrantError,
+  [UnauthorizedClientError.errorCode]: UnauthorizedClientError,
+  [UnsupportedGrantTypeError.errorCode]: UnsupportedGrantTypeError,
+  [InvalidScopeError.errorCode]: InvalidScopeError,
+  [AccessDeniedError.errorCode]: AccessDeniedError,
+  [ServerError.errorCode]: ServerError,
+  [TemporarilyUnavailableError.errorCode]: TemporarilyUnavailableError,
+  [UnsupportedResponseTypeError.errorCode]: UnsupportedResponseTypeError,
+  [UnsupportedTokenTypeError.errorCode]: UnsupportedTokenTypeError,
+  [InvalidTokenError.errorCode]: InvalidTokenError,
+  [MethodNotAllowedError.errorCode]: MethodNotAllowedError,
+  [TooManyRequestsError.errorCode]: TooManyRequestsError,
+  [InvalidClientMetadataError.errorCode]: InvalidClientMetadataError,
+  [InsufficientScopeError.errorCode]: InsufficientScopeError,
+  [InvalidTargetError.errorCode]: InvalidTargetError
+};
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/client/auth.js
+var UnauthorizedError = class extends Error {
+  constructor(message) {
+    super(message ?? "Unauthorized");
+  }
+};
+function isClientAuthMethod(method) {
+  return ["client_secret_basic", "client_secret_post", "none"].includes(method);
+}
+var AUTHORIZATION_CODE_RESPONSE_TYPE = "code", AUTHORIZATION_CODE_CHALLENGE_METHOD = "S256";
+function selectClientAuthMethod(clientInformation, supportedMethods) {
+  let hasClientSecret = clientInformation.client_secret !== void 0;
+  return "token_endpoint_auth_method" in clientInformation && clientInformation.token_endpoint_auth_method && isClientAuthMethod(clientInformation.token_endpoint_auth_method) && (supportedMethods.length === 0 || supportedMethods.includes(clientInformation.token_endpoint_auth_method)) ? clientInformation.token_endpoint_auth_method : supportedMethods.length === 0 ? hasClientSecret ? "client_secret_basic" : "none" : hasClientSecret && supportedMethods.includes("client_secret_basic") ? "client_secret_basic" : hasClientSecret && supportedMethods.includes("client_secret_post") ? "client_secret_post" : supportedMethods.includes("none") ? "none" : hasClientSecret ? "client_secret_post" : "none";
+}
+function applyClientAuthentication(method, clientInformation, headers, params) {
+  let { client_id, client_secret } = clientInformation;
+  switch (method) {
+    case "client_secret_basic":
+      applyBasicAuth(client_id, client_secret, headers);
+      return;
+    case "client_secret_post":
+      applyPostAuth(client_id, client_secret, params);
+      return;
+    case "none":
+      applyPublicAuth(client_id, params);
+      return;
+    default:
+      throw new Error(`Unsupported client authentication method: ${method}`);
+  }
+}
+function applyBasicAuth(clientId, clientSecret, headers) {
+  if (!clientSecret)
+    throw new Error("client_secret_basic authentication requires a client_secret");
+  let credentials = btoa(`${clientId}:${clientSecret}`);
+  headers.set("Authorization", `Basic ${credentials}`);
+}
+function applyPostAuth(clientId, clientSecret, params) {
+  params.set("client_id", clientId), clientSecret && params.set("client_secret", clientSecret);
+}
+function applyPublicAuth(clientId, params) {
+  params.set("client_id", clientId);
+}
+async function parseErrorResponse(input) {
+  let statusCode = input instanceof Response ? input.status : void 0, body = input instanceof Response ? await input.text() : input;
+  try {
+    let result = OAuthErrorResponseSchema.parse(JSON.parse(body)), { error, error_description, error_uri } = result, errorClass = OAUTH_ERRORS[error] || ServerError;
+    return new errorClass(error_description || "", error_uri);
+  } catch (error) {
+    let errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ""}Invalid OAuth error response: ${error}. Raw body: ${body}`;
+    return new ServerError(errorMessage);
+  }
+}
+async function auth(provider, options) {
+  try {
+    return await authInternal(provider, options);
+  } catch (error) {
+    if (error instanceof InvalidClientError || error instanceof UnauthorizedClientError)
+      return await provider.invalidateCredentials?.("all"), await authInternal(provider, options);
+    if (error instanceof InvalidGrantError)
+      return await provider.invalidateCredentials?.("tokens"), await authInternal(provider, options);
+    throw error;
+  }
+}
+async function authInternal(provider, { serverUrl, authorizationCode, scope, resourceMetadataUrl, fetchFn }) {
+  let cachedState = await provider.discoveryState?.(), resourceMetadata, authorizationServerUrl, metadata, effectiveResourceMetadataUrl = resourceMetadataUrl;
+  if (!effectiveResourceMetadataUrl && cachedState?.resourceMetadataUrl && (effectiveResourceMetadataUrl = new URL(cachedState.resourceMetadataUrl)), cachedState?.authorizationServerUrl) {
+    if (authorizationServerUrl = cachedState.authorizationServerUrl, resourceMetadata = cachedState.resourceMetadata, metadata = cachedState.authorizationServerMetadata ?? await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn }), !resourceMetadata)
+      try {
+        resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl }, fetchFn);
+      } catch {
+      }
+    (metadata !== cachedState.authorizationServerMetadata || resourceMetadata !== cachedState.resourceMetadata) && await provider.saveDiscoveryState?.({
+      authorizationServerUrl: String(authorizationServerUrl),
+      resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
+      resourceMetadata,
+      authorizationServerMetadata: metadata
+    });
+  } else {
+    let serverInfo = await discoverOAuthServerInfo(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl, fetchFn });
+    authorizationServerUrl = serverInfo.authorizationServerUrl, metadata = serverInfo.authorizationServerMetadata, resourceMetadata = serverInfo.resourceMetadata, await provider.saveDiscoveryState?.({
+      authorizationServerUrl: String(authorizationServerUrl),
+      resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
+      resourceMetadata,
+      authorizationServerMetadata: metadata
+    });
+  }
+  let resource = await selectResourceURL(serverUrl, provider, resourceMetadata), resolvedScope = scope || resourceMetadata?.scopes_supported?.join(" ") || provider.clientMetadata.scope, clientInformation = await Promise.resolve(provider.clientInformation());
+  if (!clientInformation) {
+    if (authorizationCode !== void 0)
+      throw new Error("Existing OAuth client information is required when exchanging an authorization code");
+    let supportsUrlBasedClientId = metadata?.client_id_metadata_document_supported === !0, clientMetadataUrl = provider.clientMetadataUrl;
+    if (clientMetadataUrl && !isHttpsUrl(clientMetadataUrl))
+      throw new InvalidClientMetadataError(`clientMetadataUrl must be a valid HTTPS URL with a non-root pathname, got: ${clientMetadataUrl}`);
+    if (supportsUrlBasedClientId && clientMetadataUrl)
+      clientInformation = {
+        client_id: clientMetadataUrl
+      }, await provider.saveClientInformation?.(clientInformation);
+    else {
+      if (!provider.saveClientInformation)
+        throw new Error("OAuth client information must be saveable for dynamic registration");
+      let fullInformation = await registerClient(authorizationServerUrl, {
+        metadata,
+        clientMetadata: provider.clientMetadata,
+        scope: resolvedScope,
+        fetchFn
+      });
+      await provider.saveClientInformation(fullInformation), clientInformation = fullInformation;
+    }
+  }
+  let nonInteractiveFlow = !provider.redirectUrl;
+  if (authorizationCode !== void 0 || nonInteractiveFlow) {
+    let tokens2 = await fetchToken(provider, authorizationServerUrl, {
+      metadata,
+      resource,
+      authorizationCode,
+      fetchFn
+    });
+    return await provider.saveTokens(tokens2), "AUTHORIZED";
+  }
+  let tokens = await provider.tokens();
+  if (tokens?.refresh_token)
+    try {
+      let newTokens = await refreshAuthorization(authorizationServerUrl, {
+        metadata,
+        clientInformation,
+        refreshToken: tokens.refresh_token,
+        resource,
+        addClientAuthentication: provider.addClientAuthentication,
+        fetchFn
+      });
+      return await provider.saveTokens(newTokens), "AUTHORIZED";
+    } catch (error) {
+      if (!(!(error instanceof OAuthError) || error instanceof ServerError))
+        throw error;
+    }
+  let state = provider.state ? await provider.state() : void 0, { authorizationUrl, codeVerifier } = await startAuthorization(authorizationServerUrl, {
+    metadata,
+    clientInformation,
+    state,
+    redirectUrl: provider.redirectUrl,
+    scope: resolvedScope,
+    resource
+  });
+  return await provider.saveCodeVerifier(codeVerifier), await provider.redirectToAuthorization(authorizationUrl), "REDIRECT";
+}
+function isHttpsUrl(value) {
+  if (!value)
+    return !1;
+  try {
+    let url2 = new URL(value);
+    return url2.protocol === "https:" && url2.pathname !== "/";
+  } catch {
+    return !1;
+  }
+}
+async function selectResourceURL(serverUrl, provider, resourceMetadata) {
+  let defaultResource = resourceUrlFromServerUrl(serverUrl);
+  if (provider.validateResourceURL)
+    return await provider.validateResourceURL(defaultResource, resourceMetadata?.resource);
+  if (resourceMetadata) {
+    if (!checkResourceAllowed({ requestedResource: defaultResource, configuredResource: resourceMetadata.resource }))
+      throw new Error(`Protected resource ${resourceMetadata.resource} does not match expected ${defaultResource} (or origin)`);
+    return new URL(resourceMetadata.resource);
+  }
+}
+function extractWWWAuthenticateParams(res) {
+  let authenticateHeader = res.headers.get("WWW-Authenticate");
+  if (!authenticateHeader)
+    return {};
+  let [type, scheme] = authenticateHeader.split(" ");
+  if (type.toLowerCase() !== "bearer" || !scheme)
+    return {};
+  let resourceMetadataMatch = extractFieldFromWwwAuth(res, "resource_metadata") || void 0, resourceMetadataUrl;
+  if (resourceMetadataMatch)
+    try {
+      resourceMetadataUrl = new URL(resourceMetadataMatch);
+    } catch {
+    }
+  let scope = extractFieldFromWwwAuth(res, "scope") || void 0, error = extractFieldFromWwwAuth(res, "error") || void 0;
+  return {
+    resourceMetadataUrl,
+    scope,
+    error
+  };
+}
+function extractFieldFromWwwAuth(response, fieldName) {
+  let wwwAuthHeader = response.headers.get("WWW-Authenticate");
+  if (!wwwAuthHeader)
+    return null;
+  let pattern = new RegExp(`${fieldName}=(?:"([^"]+)"|([^\\s,]+))`), match = wwwAuthHeader.match(pattern);
+  return match ? match[1] || match[2] : null;
+}
+async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn = fetch) {
+  let response = await discoverMetadataWithFallback(serverUrl, "oauth-protected-resource", fetchFn, {
+    protocolVersion: opts?.protocolVersion,
+    metadataUrl: opts?.resourceMetadataUrl
+  });
+  if (!response || response.status === 404)
+    throw await response?.body?.cancel(), new Error("Resource server does not implement OAuth 2.0 Protected Resource Metadata.");
+  if (!response.ok)
+    throw await response.body?.cancel(), new Error(`HTTP ${response.status} trying to load well-known OAuth protected resource metadata.`);
+  return OAuthProtectedResourceMetadataSchema.parse(await response.json());
+}
+async function fetchWithCorsRetry(url2, headers, fetchFn = fetch) {
+  try {
+    return await fetchFn(url2, { headers });
+  } catch (error) {
+    if (error instanceof TypeError)
+      return headers ? fetchWithCorsRetry(url2, void 0, fetchFn) : void 0;
+    throw error;
+  }
+}
+function buildWellKnownPath(wellKnownPrefix, pathname = "", options = {}) {
+  return pathname.endsWith("/") && (pathname = pathname.slice(0, -1)), options.prependPathname ? `${pathname}/.well-known/${wellKnownPrefix}` : `/.well-known/${wellKnownPrefix}${pathname}`;
+}
+async function tryMetadataDiscovery(url2, protocolVersion, fetchFn = fetch) {
+  return await fetchWithCorsRetry(url2, {
+    "MCP-Protocol-Version": protocolVersion
+  }, fetchFn);
+}
+function shouldAttemptFallback(response, pathname) {
+  return !response || response.status >= 400 && response.status < 500 && pathname !== "/";
+}
+async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, opts) {
+  let issuer = new URL(serverUrl), protocolVersion = opts?.protocolVersion ?? LATEST_PROTOCOL_VERSION, url2;
+  if (opts?.metadataUrl)
+    url2 = new URL(opts.metadataUrl);
+  else {
+    let wellKnownPath = buildWellKnownPath(wellKnownType, issuer.pathname);
+    url2 = new URL(wellKnownPath, opts?.metadataServerUrl ?? issuer), url2.search = issuer.search;
+  }
+  let response = await tryMetadataDiscovery(url2, protocolVersion, fetchFn);
+  if (!opts?.metadataUrl && shouldAttemptFallback(response, issuer.pathname)) {
+    let rootUrl = new URL(`/.well-known/${wellKnownType}`, issuer);
+    response = await tryMetadataDiscovery(rootUrl, protocolVersion, fetchFn);
+  }
+  return response;
+}
+function buildDiscoveryUrls(authorizationServerUrl) {
+  let url2 = typeof authorizationServerUrl == "string" ? new URL(authorizationServerUrl) : authorizationServerUrl, hasPath = url2.pathname !== "/", urlsToTry = [];
+  if (!hasPath)
+    return urlsToTry.push({
+      url: new URL("/.well-known/oauth-authorization-server", url2.origin),
+      type: "oauth"
+    }), urlsToTry.push({
+      url: new URL("/.well-known/openid-configuration", url2.origin),
+      type: "oidc"
+    }), urlsToTry;
+  let pathname = url2.pathname;
+  return pathname.endsWith("/") && (pathname = pathname.slice(0, -1)), urlsToTry.push({
+    url: new URL(`/.well-known/oauth-authorization-server${pathname}`, url2.origin),
+    type: "oauth"
+  }), urlsToTry.push({
+    url: new URL(`/.well-known/openid-configuration${pathname}`, url2.origin),
+    type: "oidc"
+  }), urlsToTry.push({
+    url: new URL(`${pathname}/.well-known/openid-configuration`, url2.origin),
+    type: "oidc"
+  }), urlsToTry;
+}
+async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn = fetch, protocolVersion = LATEST_PROTOCOL_VERSION } = {}) {
+  let headers = {
+    "MCP-Protocol-Version": protocolVersion,
+    Accept: "application/json"
+  }, urlsToTry = buildDiscoveryUrls(authorizationServerUrl);
+  for (let { url: endpointUrl, type } of urlsToTry) {
+    let response = await fetchWithCorsRetry(endpointUrl, headers, fetchFn);
+    if (response) {
+      if (!response.ok) {
+        if (await response.body?.cancel(), response.status >= 400 && response.status < 500)
+          continue;
+        throw new Error(`HTTP ${response.status} trying to load ${type === "oauth" ? "OAuth" : "OpenID provider"} metadata from ${endpointUrl}`);
+      }
+      return type === "oauth" ? OAuthMetadataSchema.parse(await response.json()) : OpenIdProviderDiscoveryMetadataSchema.parse(await response.json());
+    }
+  }
+}
+async function discoverOAuthServerInfo(serverUrl, opts) {
+  let resourceMetadata, authorizationServerUrl;
+  try {
+    resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: opts?.resourceMetadataUrl }, opts?.fetchFn), resourceMetadata.authorization_servers && resourceMetadata.authorization_servers.length > 0 && (authorizationServerUrl = resourceMetadata.authorization_servers[0]);
+  } catch {
+  }
+  authorizationServerUrl || (authorizationServerUrl = String(new URL("/", serverUrl)));
+  let authorizationServerMetadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn: opts?.fetchFn });
+  return {
+    authorizationServerUrl,
+    authorizationServerMetadata,
+    resourceMetadata
+  };
+}
+async function startAuthorization(authorizationServerUrl, { metadata, clientInformation, redirectUrl, scope, state, resource }) {
+  let authorizationUrl;
+  if (metadata) {
+    if (authorizationUrl = new URL(metadata.authorization_endpoint), !metadata.response_types_supported.includes(AUTHORIZATION_CODE_RESPONSE_TYPE))
+      throw new Error(`Incompatible auth server: does not support response type ${AUTHORIZATION_CODE_RESPONSE_TYPE}`);
+    if (metadata.code_challenge_methods_supported && !metadata.code_challenge_methods_supported.includes(AUTHORIZATION_CODE_CHALLENGE_METHOD))
+      throw new Error(`Incompatible auth server: does not support code challenge method ${AUTHORIZATION_CODE_CHALLENGE_METHOD}`);
+  } else
+    authorizationUrl = new URL("/authorize", authorizationServerUrl);
+  let challenge = await pkceChallenge(), codeVerifier = challenge.code_verifier, codeChallenge = challenge.code_challenge;
+  return authorizationUrl.searchParams.set("response_type", AUTHORIZATION_CODE_RESPONSE_TYPE), authorizationUrl.searchParams.set("client_id", clientInformation.client_id), authorizationUrl.searchParams.set("code_challenge", codeChallenge), authorizationUrl.searchParams.set("code_challenge_method", AUTHORIZATION_CODE_CHALLENGE_METHOD), authorizationUrl.searchParams.set("redirect_uri", String(redirectUrl)), state && authorizationUrl.searchParams.set("state", state), scope && authorizationUrl.searchParams.set("scope", scope), scope?.includes("offline_access") && authorizationUrl.searchParams.append("prompt", "consent"), resource && authorizationUrl.searchParams.set("resource", resource.href), { authorizationUrl, codeVerifier };
+}
+function prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, redirectUri) {
+  return new URLSearchParams({
+    grant_type: "authorization_code",
+    code: authorizationCode,
+    code_verifier: codeVerifier,
+    redirect_uri: String(redirectUri)
+  });
+}
+async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequestParams, clientInformation, addClientAuthentication, resource, fetchFn }) {
+  let tokenUrl = metadata?.token_endpoint ? new URL(metadata.token_endpoint) : new URL("/token", authorizationServerUrl), headers = new Headers({
+    "Content-Type": "application/x-www-form-urlencoded",
+    Accept: "application/json"
+  });
+  if (resource && tokenRequestParams.set("resource", resource.href), addClientAuthentication)
+    await addClientAuthentication(headers, tokenRequestParams, tokenUrl, metadata);
+  else if (clientInformation) {
+    let supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? [], authMethod = selectClientAuthMethod(clientInformation, supportedMethods);
+    applyClientAuthentication(authMethod, clientInformation, headers, tokenRequestParams);
+  }
+  let response = await (fetchFn ?? fetch)(tokenUrl, {
+    method: "POST",
+    headers,
+    body: tokenRequestParams
+  });
+  if (!response.ok)
+    throw await parseErrorResponse(response);
+  return OAuthTokensSchema.parse(await response.json());
+}
+async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
+  let tokenRequestParams = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken
+  }), tokens = await executeTokenRequest(authorizationServerUrl, {
+    metadata,
+    tokenRequestParams,
+    clientInformation,
+    addClientAuthentication,
+    resource,
+    fetchFn
+  });
+  return { refresh_token: refreshToken, ...tokens };
+}
+async function fetchToken(provider, authorizationServerUrl, { metadata, resource, authorizationCode, fetchFn } = {}) {
+  let scope = provider.clientMetadata.scope, tokenRequestParams;
+  if (provider.prepareTokenRequest && (tokenRequestParams = await provider.prepareTokenRequest(scope)), !tokenRequestParams) {
+    if (!authorizationCode)
+      throw new Error("Either provider.prepareTokenRequest() or authorizationCode is required");
+    if (!provider.redirectUrl)
+      throw new Error("redirectUrl is required for authorization_code flow");
+    let codeVerifier = await provider.codeVerifier();
+    tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, provider.redirectUrl);
+  }
+  let clientInformation = await provider.clientInformation();
+  return executeTokenRequest(authorizationServerUrl, {
+    metadata,
+    tokenRequestParams,
+    clientInformation: clientInformation ?? void 0,
+    addClientAuthentication: provider.addClientAuthentication,
+    resource,
+    fetchFn
+  });
+}
+async function registerClient(authorizationServerUrl, { metadata, clientMetadata, scope, fetchFn }) {
+  let registrationUrl;
+  if (metadata) {
+    if (!metadata.registration_endpoint)
+      throw new Error("Incompatible auth server: does not support dynamic client registration");
+    registrationUrl = new URL(metadata.registration_endpoint);
+  } else
+    registrationUrl = new URL("/register", authorizationServerUrl);
+  let response = await (fetchFn ?? fetch)(registrationUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      ...clientMetadata,
+      ...scope !== void 0 ? { scope } : {}
+    })
+  });
+  if (!response.ok)
+    throw await parseErrorResponse(response);
+  return OAuthClientInformationFullSchema.parse(await response.json());
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
+var import_content_type = __toESM(require_content_type(), 1);
+function mediaTypeEssence(header) {
+  if (header)
+    try {
+      return import_content_type.default.parse(header).type;
+    } catch {
+      let essence = (header.split(";", 1)[0] ?? "").trim().toLowerCase();
+      return essence === "" || header.slice(essence.length).includes(",") ? void 0 : essence;
+    }
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/transport.js
+function normalizeHeaders(headers) {
+  return headers ? headers instanceof Headers ? Object.fromEntries(headers.entries()) : Array.isArray(headers) ? Object.fromEntries(headers) : { ...headers } : {};
+}
+function createFetchWithInit(baseFetch = fetch, baseInit) {
+  return baseInit ? async (url2, init) => {
+    let mergedInit = {
+      ...baseInit,
+      ...init,
+      // Headers need special handling - merge instead of replace
+      headers: init?.headers ? { ...normalizeHeaders(baseInit.headers), ...normalizeHeaders(init.headers) } : baseInit.headers
+    };
+    return baseFetch(url2, mergedInit);
+  } : baseFetch;
+}
+
+// node_modules/eventsource-parser/dist/index.js
+var ParseError = class extends Error {
+  constructor(message, options) {
+    super(message), this.name = "ParseError", this.type = options.type, this.field = options.field, this.value = options.value, this.line = options.line;
+  }
+}, LF = 10, CR = 13, SPACE = 32;
+function noop(_arg) {
+}
+function createParser(config) {
+  if (typeof config == "function")
+    throw new TypeError(
+      "`config` must be an object, got a function instead. Did you mean `createParser({onEvent: fn})`?"
+    );
+  let { onEvent = noop, onError = noop, onRetry = noop, onComment, maxBufferSize } = config, pendingFragments = [], pendingFragmentsLength = 0, isFirstChunk = !0, id, data = "", dataLines = 0, eventType, terminated = !1;
+  function feed(chunk) {
+    if (terminated)
+      throw new Error(
+        "Cannot feed parser: it was terminated after exceeding the configured max buffer size. Call `reset()` to resume parsing."
+      );
+    if (isFirstChunk && (isFirstChunk = !1, chunk.charCodeAt(0) === 239 && chunk.charCodeAt(1) === 187 && chunk.charCodeAt(2) === 191 && (chunk = chunk.slice(3))), pendingFragments.length === 0) {
+      let trailing2 = processLines(chunk);
+      trailing2 !== "" && (pendingFragments.push(trailing2), pendingFragmentsLength = trailing2.length), checkBufferSize();
+      return;
+    }
+    if (chunk.indexOf(`
+`) === -1 && chunk.indexOf("\r") === -1) {
+      pendingFragments.push(chunk), pendingFragmentsLength += chunk.length, checkBufferSize();
+      return;
+    }
+    pendingFragments.push(chunk);
+    let input = pendingFragments.join("");
+    pendingFragments.length = 0, pendingFragmentsLength = 0;
+    let trailing = processLines(input);
+    trailing !== "" && (pendingFragments.push(trailing), pendingFragmentsLength = trailing.length), checkBufferSize();
+  }
+  function checkBufferSize() {
+    maxBufferSize !== void 0 && (pendingFragmentsLength + data.length <= maxBufferSize || (terminated = !0, pendingFragments.length = 0, pendingFragmentsLength = 0, id = void 0, data = "", dataLines = 0, eventType = void 0, onError(
+      new ParseError(`Buffered data exceeded max buffer size of ${maxBufferSize} characters`, {
+        type: "max-buffer-size-exceeded"
+      })
+    )));
+  }
+  function processLines(chunk) {
+    let searchIndex = 0;
+    if (chunk.indexOf("\r") === -1) {
+      let lfIndex = chunk.indexOf(`
+`, searchIndex);
+      for (; lfIndex !== -1; ) {
+        if (searchIndex === lfIndex) {
+          dataLines > 0 && onEvent({ id, event: eventType, data }), id = void 0, data = "", dataLines = 0, eventType = void 0, searchIndex = lfIndex + 1, lfIndex = chunk.indexOf(`
+`, searchIndex);
+          continue;
+        }
+        let firstCharCode = chunk.charCodeAt(searchIndex);
+        if (isDataPrefix(chunk, searchIndex, firstCharCode)) {
+          let valueStart = chunk.charCodeAt(searchIndex + 5) === SPACE ? searchIndex + 6 : searchIndex + 5, value = chunk.slice(valueStart, lfIndex);
+          if (dataLines === 0 && chunk.charCodeAt(lfIndex + 1) === LF) {
+            onEvent({ id, event: eventType, data: value }), id = void 0, data = "", eventType = void 0, searchIndex = lfIndex + 2, lfIndex = chunk.indexOf(`
+`, searchIndex);
+            continue;
+          }
+          data = dataLines === 0 ? value : `${data}
+${value}`, dataLines++;
+        } else isEventPrefix(chunk, searchIndex, firstCharCode) ? eventType = chunk.slice(
+          chunk.charCodeAt(searchIndex + 6) === SPACE ? searchIndex + 7 : searchIndex + 6,
+          lfIndex
+        ) || void 0 : parseLine(chunk, searchIndex, lfIndex);
+        searchIndex = lfIndex + 1, lfIndex = chunk.indexOf(`
+`, searchIndex);
+      }
+      return chunk.slice(searchIndex);
+    }
+    for (; searchIndex < chunk.length; ) {
+      let crIndex = chunk.indexOf("\r", searchIndex), lfIndex = chunk.indexOf(`
+`, searchIndex), lineEnd = -1;
+      if (crIndex !== -1 && lfIndex !== -1 ? lineEnd = crIndex < lfIndex ? crIndex : lfIndex : crIndex !== -1 ? crIndex === chunk.length - 1 ? lineEnd = -1 : lineEnd = crIndex : lfIndex !== -1 && (lineEnd = lfIndex), lineEnd === -1)
+        break;
+      parseLine(chunk, searchIndex, lineEnd), searchIndex = lineEnd + 1, chunk.charCodeAt(searchIndex - 1) === CR && chunk.charCodeAt(searchIndex) === LF && searchIndex++;
+    }
+    return chunk.slice(searchIndex);
+  }
+  function parseLine(chunk, start, end) {
+    if (start === end) {
+      dispatchEvent();
+      return;
+    }
+    let firstCharCode = chunk.charCodeAt(start);
+    if (isDataPrefix(chunk, start, firstCharCode)) {
+      let valueStart = chunk.charCodeAt(start + 5) === SPACE ? start + 6 : start + 5, value2 = chunk.slice(valueStart, end);
+      data = dataLines === 0 ? value2 : `${data}
+${value2}`, dataLines++;
+      return;
+    }
+    if (isEventPrefix(chunk, start, firstCharCode)) {
+      eventType = chunk.slice(chunk.charCodeAt(start + 6) === SPACE ? start + 7 : start + 6, end) || void 0;
+      return;
+    }
+    if (firstCharCode === 105 && chunk.charCodeAt(start + 1) === 100 && chunk.charCodeAt(start + 2) === 58) {
+      let value2 = chunk.slice(chunk.charCodeAt(start + 3) === SPACE ? start + 4 : start + 3, end);
+      id = value2.includes("\0") ? void 0 : value2;
+      return;
+    }
+    if (firstCharCode === 58) {
+      if (onComment) {
+        let line2 = chunk.slice(start, end);
+        onComment(line2.slice(chunk.charCodeAt(start + 1) === SPACE ? 2 : 1));
+      }
+      return;
+    }
+    let line = chunk.slice(start, end), fieldSeparatorIndex = line.indexOf(":");
+    if (fieldSeparatorIndex === -1) {
+      processField(line, "", line);
+      return;
+    }
+    let field = line.slice(0, fieldSeparatorIndex), offset = line.charCodeAt(fieldSeparatorIndex + 1) === SPACE ? 2 : 1, value = line.slice(fieldSeparatorIndex + offset);
+    processField(field, value, line);
+  }
+  function processField(field, value, line) {
+    switch (field) {
+      case "event":
+        eventType = value || void 0;
+        break;
+      case "data":
+        data = dataLines === 0 ? value : `${data}
+${value}`, dataLines++;
+        break;
+      case "id":
+        id = value.includes("\0") ? void 0 : value;
+        break;
+      case "retry":
+        /^\d+$/.test(value) ? onRetry(parseInt(value, 10)) : onError(
+          new ParseError(`Invalid \`retry\` value: "${value}"`, {
+            type: "invalid-retry",
+            value,
+            line
+          })
+        );
+        break;
+      default:
+        onError(
+          new ParseError(
+            `Unknown field "${field.length > 20 ? `${field.slice(0, 20)}\u2026` : field}"`,
+            { type: "unknown-field", field, value, line }
+          )
+        );
+        break;
+    }
+  }
+  function dispatchEvent() {
+    dataLines > 0 && onEvent({
+      id,
+      event: eventType,
+      data
+    }), id = void 0, data = "", dataLines = 0, eventType = void 0;
+  }
+  function reset(options = {}) {
+    if (options.consume && pendingFragments.length > 0) {
+      let incompleteLine = pendingFragments.join("");
+      parseLine(incompleteLine, 0, incompleteLine.length);
+    }
+    isFirstChunk = !0, id = void 0, data = "", dataLines = 0, eventType = void 0, pendingFragments.length = 0, pendingFragmentsLength = 0, terminated = !1;
+  }
+  return { feed, reset };
+}
+function isDataPrefix(chunk, i2, firstCharCode) {
+  return firstCharCode === 100 && chunk.charCodeAt(i2 + 1) === 97 && chunk.charCodeAt(i2 + 2) === 116 && chunk.charCodeAt(i2 + 3) === 97 && chunk.charCodeAt(i2 + 4) === 58;
+}
+function isEventPrefix(chunk, i2, firstCharCode) {
+  return firstCharCode === 101 && chunk.charCodeAt(i2 + 1) === 118 && chunk.charCodeAt(i2 + 2) === 101 && chunk.charCodeAt(i2 + 3) === 110 && chunk.charCodeAt(i2 + 4) === 116 && chunk.charCodeAt(i2 + 5) === 58;
+}
+
+// node_modules/eventsource-parser/dist/stream.js
+var EventSourceParserStream = class extends TransformStream {
+  constructor({ onError, onRetry, onComment, maxBufferSize } = {}) {
+    let parser;
+    super({
+      start(controller) {
+        parser = createParser({
+          onEvent: (event) => {
+            controller.enqueue(event);
+          },
+          onError(error) {
+            typeof onError == "function" && onError(error), (onError === "terminate" || error.type === "max-buffer-size-exceeded") && controller.error(error);
+          },
+          onRetry,
+          onComment,
+          maxBufferSize
+        });
+      },
+      transform(chunk) {
+        parser.feed(chunk);
+      }
+    });
+  }
+};
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/client/streamableHttp.js
+var DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS = {
+  initialReconnectionDelay: 1e3,
+  maxReconnectionDelay: 3e4,
+  reconnectionDelayGrowFactor: 1.5,
+  maxRetries: 2
+}, StreamableHTTPError = class extends Error {
+  constructor(code, message) {
+    super(`Streamable HTTP error: ${message}`), this.code = code;
+  }
+}, StreamableHTTPClientTransport = class {
+  constructor(url2, opts) {
+    this._hasCompletedAuthFlow = !1, this._url = url2, this._resourceMetadataUrl = void 0, this._scope = void 0, this._requestInit = opts?.requestInit, this._authProvider = opts?.authProvider, this._fetch = opts?.fetch, this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit), this._sessionId = opts?.sessionId, this._reconnectionOptions = opts?.reconnectionOptions ?? DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS;
+  }
+  async _authThenStart() {
+    if (!this._authProvider)
+      throw new UnauthorizedError("No auth provider");
+    let result;
+    try {
+      result = await auth(this._authProvider, {
+        serverUrl: this._url,
+        resourceMetadataUrl: this._resourceMetadataUrl,
+        scope: this._scope,
+        fetchFn: this._fetchWithInit
+      });
+    } catch (error) {
+      throw this.onerror?.(error), error;
+    }
+    if (result !== "AUTHORIZED")
+      throw new UnauthorizedError();
+    return await this._startOrAuthSse({ resumptionToken: void 0 });
+  }
+  async _commonHeaders() {
+    let headers = {};
+    if (this._authProvider) {
+      let tokens = await this._authProvider.tokens();
+      tokens && (headers.Authorization = `Bearer ${tokens.access_token}`);
+    }
+    this._sessionId && (headers["mcp-session-id"] = this._sessionId), this._protocolVersion && (headers["mcp-protocol-version"] = this._protocolVersion);
+    let extraHeaders = normalizeHeaders(this._requestInit?.headers);
+    return new Headers({
+      ...headers,
+      ...extraHeaders
+    });
+  }
+  async _startOrAuthSse(options) {
+    let { resumptionToken } = options;
+    try {
+      let headers = await this._commonHeaders();
+      headers.set("Accept", "text/event-stream"), resumptionToken && headers.set("last-event-id", resumptionToken);
+      let response = await (this._fetch ?? fetch)(this._url, {
+        method: "GET",
+        headers,
+        signal: this._abortController?.signal
+      });
+      if (!response.ok) {
+        if (await response.body?.cancel(), response.status === 401 && this._authProvider)
+          return await this._authThenStart();
+        if (response.status === 405)
+          return;
+        throw new StreamableHTTPError(response.status, `Failed to open SSE stream: ${response.statusText}`);
+      }
+      this._handleSseStream(response.body, options, !0);
+    } catch (error) {
+      throw this.onerror?.(error), error;
+    }
+  }
+  /**
+   * Calculates the next reconnection delay using  backoff algorithm
+   *
+   * @param attempt Current reconnection attempt count for the specific stream
+   * @returns Time to wait in milliseconds before next reconnection attempt
+   */
+  _getNextReconnectionDelay(attempt) {
+    if (this._serverRetryMs !== void 0)
+      return this._serverRetryMs;
+    let initialDelay = this._reconnectionOptions.initialReconnectionDelay, growFactor = this._reconnectionOptions.reconnectionDelayGrowFactor, maxDelay = this._reconnectionOptions.maxReconnectionDelay;
+    return Math.min(initialDelay * Math.pow(growFactor, attempt), maxDelay);
+  }
+  /**
+   * Schedule a reconnection attempt using server-provided retry interval or backoff
+   *
+   * @param lastEventId The ID of the last received event for resumability
+   * @param attemptCount Current reconnection attempt count for this specific stream
+   */
+  _scheduleReconnection(options, attemptCount = 0) {
+    let maxRetries = this._reconnectionOptions.maxRetries;
+    if (attemptCount >= maxRetries) {
+      this.onerror?.(new Error(`Maximum reconnection attempts (${maxRetries}) exceeded.`));
+      return;
+    }
+    let delay = this._getNextReconnectionDelay(attemptCount);
+    this._reconnectionTimeout = setTimeout(() => {
+      this._startOrAuthSse(options).catch((error) => {
+        this.onerror?.(new Error(`Failed to reconnect SSE stream: ${error instanceof Error ? error.message : String(error)}`)), this._scheduleReconnection(options, attemptCount + 1);
+      });
+    }, delay);
+  }
+  _handleSseStream(stream, options, isReconnectable) {
+    if (!stream)
+      return;
+    let { onresumptiontoken, replayMessageId } = options, lastEventId, hasPrimingEvent = !1, receivedResponse = !1;
+    (async () => {
+      try {
+        let reader = stream.pipeThrough(new TextDecoderStream()).pipeThrough(new EventSourceParserStream({
+          onRetry: (retryMs) => {
+            this._serverRetryMs = retryMs;
+          }
+        })).getReader();
+        for (; ; ) {
+          let { value: event, done } = await reader.read();
+          if (done)
+            break;
+          if (event.id && (lastEventId = event.id, hasPrimingEvent = !0, onresumptiontoken?.(event.id)), !!event.data && (!event.event || event.event === "message"))
+            try {
+              let message = JSONRPCMessageSchema.parse(JSON.parse(event.data));
+              isJSONRPCResultResponse(message) && (receivedResponse = !0, replayMessageId !== void 0 && (message.id = replayMessageId)), this.onmessage?.(message);
+            } catch (error) {
+              this.onerror?.(error);
+            }
+        }
+        (isReconnectable || hasPrimingEvent) && !receivedResponse && this._abortController && !this._abortController.signal.aborted && this._scheduleReconnection({
+          resumptionToken: lastEventId,
+          onresumptiontoken,
+          replayMessageId
+        }, 0);
+      } catch (error) {
+        if (this.onerror?.(new Error(`SSE stream disconnected: ${error}`)), (isReconnectable || hasPrimingEvent) && !receivedResponse && this._abortController && !this._abortController.signal.aborted)
+          try {
+            this._scheduleReconnection({
+              resumptionToken: lastEventId,
+              onresumptiontoken,
+              replayMessageId
+            }, 0);
+          } catch (error2) {
+            this.onerror?.(new Error(`Failed to reconnect: ${error2 instanceof Error ? error2.message : String(error2)}`));
+          }
+      }
+    })();
+  }
+  async start() {
+    if (this._abortController)
+      throw new Error("StreamableHTTPClientTransport already started! If using Client class, note that connect() calls start() automatically.");
+    this._abortController = new AbortController();
+  }
+  /**
+   * Call this method after the user has finished authorizing via their user agent and is redirected back to the MCP client application. This will exchange the authorization code for an access token, enabling the next connection attempt to successfully auth.
+   */
+  async finishAuth(authorizationCode) {
+    if (!this._authProvider)
+      throw new UnauthorizedError("No auth provider");
+    if (await auth(this._authProvider, {
+      serverUrl: this._url,
+      authorizationCode,
+      resourceMetadataUrl: this._resourceMetadataUrl,
+      scope: this._scope,
+      fetchFn: this._fetchWithInit
+    }) !== "AUTHORIZED")
+      throw new UnauthorizedError("Failed to authorize");
+  }
+  async close() {
+    this._reconnectionTimeout && (clearTimeout(this._reconnectionTimeout), this._reconnectionTimeout = void 0), this._abortController?.abort(), this.onclose?.();
+  }
+  async send(message, options) {
+    try {
+      let { resumptionToken, onresumptiontoken } = options || {};
+      if (resumptionToken) {
+        this._startOrAuthSse({ resumptionToken, replayMessageId: isJSONRPCRequest(message) ? message.id : void 0 }).catch((err) => this.onerror?.(err));
+        return;
+      }
+      let headers = await this._commonHeaders();
+      headers.set("content-type", "application/json"), headers.set("accept", "application/json, text/event-stream");
+      let init = {
+        ...this._requestInit,
+        method: "POST",
+        headers,
+        body: JSON.stringify(message),
+        signal: this._abortController?.signal
+      }, response = await (this._fetch ?? fetch)(this._url, init), sessionId = response.headers.get("mcp-session-id");
+      if (sessionId && (this._sessionId = sessionId), !response.ok) {
+        let text = await response.text().catch(() => null);
+        if (response.status === 401 && this._authProvider) {
+          if (this._hasCompletedAuthFlow)
+            throw new StreamableHTTPError(401, "Server returned 401 after successful authentication");
+          let { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+          if (this._resourceMetadataUrl = resourceMetadataUrl, this._scope = scope, await auth(this._authProvider, {
+            serverUrl: this._url,
+            resourceMetadataUrl: this._resourceMetadataUrl,
+            scope: this._scope,
+            fetchFn: this._fetchWithInit
+          }) !== "AUTHORIZED")
+            throw new UnauthorizedError();
+          return this._hasCompletedAuthFlow = !0, this.send(message);
+        }
+        if (response.status === 403 && this._authProvider) {
+          let { resourceMetadataUrl, scope, error } = extractWWWAuthenticateParams(response);
+          if (error === "insufficient_scope") {
+            let wwwAuthHeader = response.headers.get("WWW-Authenticate");
+            if (this._lastUpscopingHeader === wwwAuthHeader)
+              throw new StreamableHTTPError(403, "Server returned 403 after trying upscoping");
+            if (scope && (this._scope = scope), resourceMetadataUrl && (this._resourceMetadataUrl = resourceMetadataUrl), this._lastUpscopingHeader = wwwAuthHeader ?? void 0, await auth(this._authProvider, {
+              serverUrl: this._url,
+              resourceMetadataUrl: this._resourceMetadataUrl,
+              scope: this._scope,
+              fetchFn: this._fetch
+            }) !== "AUTHORIZED")
+              throw new UnauthorizedError();
+            return this.send(message);
+          }
+        }
+        throw new StreamableHTTPError(response.status, `Error POSTing to endpoint: ${text}`);
+      }
+      if (this._hasCompletedAuthFlow = !1, this._lastUpscopingHeader = void 0, response.status === 202) {
+        await response.body?.cancel(), isInitializedNotification(message) && this._startOrAuthSse({ resumptionToken: void 0 }).catch((err) => this.onerror?.(err));
+        return;
+      }
+      let hasRequests = (Array.isArray(message) ? message : [message]).filter((msg) => "method" in msg && "id" in msg && msg.id !== void 0).length > 0, contentType2 = response.headers.get("content-type"), responseMediaType = mediaTypeEssence(contentType2);
+      if (hasRequests)
+        if (responseMediaType === "text/event-stream")
+          this._handleSseStream(response.body, { onresumptiontoken }, !1);
+        else if (responseMediaType === "application/json") {
+          let data = await response.json(), responseMessages = Array.isArray(data) ? data.map((msg) => JSONRPCMessageSchema.parse(msg)) : [JSONRPCMessageSchema.parse(data)];
+          for (let msg of responseMessages)
+            this.onmessage?.(msg);
+        } else
+          throw await response.body?.cancel(), new StreamableHTTPError(-1, `Unexpected content type: ${contentType2}`);
+      else
+        await response.body?.cancel();
+    } catch (error) {
+      throw this.onerror?.(error), error;
+    }
+  }
+  get sessionId() {
+    return this._sessionId;
+  }
+  /**
+   * Terminates the current session by sending a DELETE request to the server.
+   *
+   * Clients that no longer need a particular session
+   * (e.g., because the user is leaving the client application) SHOULD send an
+   * HTTP DELETE to the MCP endpoint with the Mcp-Session-Id header to explicitly
+   * terminate the session.
+   *
+   * The server MAY respond with HTTP 405 Method Not Allowed, indicating that
+   * the server does not allow clients to terminate sessions.
+   */
+  async terminateSession() {
+    if (this._sessionId)
+      try {
+        let headers = await this._commonHeaders(), init = {
+          ...this._requestInit,
+          method: "DELETE",
+          headers,
+          signal: this._abortController?.signal
+        }, response = await (this._fetch ?? fetch)(this._url, init);
+        if (await response.body?.cancel(), !response.ok && response.status !== 405)
+          throw new StreamableHTTPError(response.status, `Failed to terminate session: ${response.statusText}`);
+        this._sessionId = void 0;
+      } catch (error) {
+        throw this.onerror?.(error), error;
+      }
+  }
+  setProtocolVersion(version) {
+    this._protocolVersion = version;
+  }
+  get protocolVersion() {
+    return this._protocolVersion;
+  }
+  /**
+   * Resume an SSE stream from a previous event ID.
+   * Opens a GET SSE connection with Last-Event-ID header to replay missed events.
+   *
+   * @param lastEventId The event ID to resume from
+   * @param options Optional callback to receive new resumption tokens
+   */
+  async resumeStream(lastEventId, options) {
+    await this._startOrAuthSse({
+      resumptionToken: lastEventId,
+      onresumptiontoken: options?.onresumptiontoken
+    });
+  }
+};
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.js
+import open from "open";
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-auth.js
+import { createHash } from "crypto";
+import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync } from "fs";
+import { join } from "path";
+function getAuthBaseDir() {
+  let override = process.env.MCP_OAUTH_DIR?.trim();
+  return override || getAgentPath("mcp-oauth");
+}
+function getServerDir(serverName) {
+  if (typeof serverName != "string")
+    throw new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);
+  let storageKey = createHash("sha256").update(serverName, "utf8").digest("hex");
+  return join(getAuthBaseDir(), `sha256-${storageKey}`);
+}
+function getAuthEntryFilePath(serverName) {
+  return join(getServerDir(serverName), "tokens.json");
+}
+function ensureServerDir(serverName) {
+  let dir = getServerDir(serverName);
+  existsSync(dir) || mkdirSync(dir, { recursive: !0, mode: 448 });
+}
+function readAuthEntry(serverName) {
+  let filePath = getAuthEntryFilePath(serverName);
+  try {
+    if (!existsSync(filePath))
+      return;
+    let data = readFileSync(filePath, "utf-8");
+    return JSON.parse(data);
+  } catch (error) {
+    console.error(`Failed to read auth entry for ${serverName}:`, error);
+    return;
+  }
+}
+function writeAuthEntry(serverName, entry) {
+  ensureServerDir(serverName);
+  let filePath = getAuthEntryFilePath(serverName);
+  writeFileSync(filePath, JSON.stringify(entry, null, 2), { mode: 384 });
+}
+function getAuthEntry(serverName) {
+  return readAuthEntry(serverName);
+}
+function getAuthForUrl(serverName, serverUrl) {
+  let entry = getAuthEntry(serverName);
+  if (entry && entry.serverUrl && entry.serverUrl === serverUrl)
+    return entry;
+}
+function saveAuthEntry(serverName, entry, serverUrl) {
+  serverUrl && (entry.serverUrl = serverUrl), writeAuthEntry(serverName, entry);
+}
+function removeAuthEntry(serverName) {
+  try {
+    let filePath = getAuthEntryFilePath(serverName);
+    existsSync(filePath) && writeFileSync(filePath, "{}", { mode: 384 });
+    let dir = getServerDir(serverName);
+    if (existsSync(dir))
+      try {
+        rmSync(dir, { recursive: !0 });
+      } catch {
+      }
+  } catch (error) {
+    console.error(`Failed to remove auth entry for ${serverName}:`, error);
+  }
+}
+function updateTokens(serverName, tokens, serverUrl) {
+  let entry = getAuthEntry(serverName) ?? {};
+  serverUrl && entry.serverUrl !== serverUrl && (delete entry.clientInfo, delete entry.codeVerifier, delete entry.oauthState), entry.tokens = tokens, saveAuthEntry(serverName, entry, serverUrl);
+}
+function updateClientInfo(serverName, clientInfo, serverUrl) {
+  let entry = getAuthEntry(serverName) ?? {};
+  serverUrl && entry.serverUrl !== serverUrl && (delete entry.tokens, delete entry.codeVerifier, delete entry.oauthState), entry.clientInfo = clientInfo, saveAuthEntry(serverName, entry, serverUrl);
+}
+function updateCodeVerifier(serverName, codeVerifier, serverUrl) {
+  let entry = getAuthEntry(serverName) ?? {};
+  serverUrl && entry.serverUrl !== serverUrl && (delete entry.tokens, delete entry.clientInfo, delete entry.oauthState), entry.codeVerifier = codeVerifier, saveAuthEntry(serverName, entry, serverUrl);
+}
+function updateOAuthState(serverName, state, serverUrl) {
+  let entry = getAuthEntry(serverName) ?? {};
+  serverUrl && entry.serverUrl !== serverUrl && (delete entry.tokens, delete entry.clientInfo, delete entry.codeVerifier), entry.oauthState = state, saveAuthEntry(serverName, entry, serverUrl);
+}
+function clearAllCredentials(serverName) {
+  removeAuthEntry(serverName);
+}
+function clearClientInfo(serverName) {
+  let entry = getAuthEntry(serverName);
+  entry && (delete entry.clientInfo, saveAuthEntry(serverName, entry));
+}
+function clearTokens(serverName) {
+  let entry = getAuthEntry(serverName);
+  entry && (delete entry.tokens, saveAuthEntry(serverName, entry));
+}
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-oauth-provider.js
+var DEFAULT_OAUTH_CALLBACK_PORT = 19876, DEFAULT_OAUTH_CALLBACK_PATH = "/callback", configuredOAuthCallbackPort = DEFAULT_OAUTH_CALLBACK_PORT;
+if (process.env.MCP_OAUTH_CALLBACK_PORT) {
+  let parsedPort = Number.parseInt(process.env.MCP_OAUTH_CALLBACK_PORT, 10);
+  Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535 && (configuredOAuthCallbackPort = parsedPort);
+}
+var oauthCallbackPort = configuredOAuthCallbackPort, oauthCallbackPath = DEFAULT_OAUTH_CALLBACK_PATH;
+function getConfiguredOAuthCallbackPort() {
+  return configuredOAuthCallbackPort;
+}
+function getOAuthCallbackPort() {
+  return oauthCallbackPort;
+}
+function setOAuthCallbackPort(port) {
+  oauthCallbackPort = port;
+}
+function getOAuthCallbackPath() {
+  return oauthCallbackPath;
+}
+function setOAuthCallbackPath(path) {
+  oauthCallbackPath = path.startsWith("/") ? path : `/${path}`;
+}
+var McpOAuthProvider = class {
+  serverName;
+  serverUrl;
+  config;
+  callbacks;
+  flowState;
+  redirectUrlSnapshot;
+  flowClientInfo;
+  flowClientInfoLoaded = !1;
+  constructor(serverName, serverUrl, config, callbacks, flowState) {
+    if (this.serverName = serverName, this.serverUrl = serverUrl, this.config = config, this.callbacks = callbacks, this.flowState = flowState, flowState) {
+      let info = flowState.clientInfo;
+      this.flowClientInfo = info?.clientSecretExpiresAt && info.clientSecretExpiresAt < Date.now() / 1e3 ? void 0 : info, this.flowClientInfoLoaded = !0;
+    }
+    this.redirectUrlSnapshot = config.grantType === "client_credentials" ? void 0 : config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`;
+  }
+  get usesClientCredentials() {
+    return this.config.grantType === "client_credentials";
+  }
+  /**
+   * The redirect URL for OAuth callbacks.
+   * This must match the redirect_uri in client metadata.
+   */
+  get redirectUrl() {
+    return this.redirectUrlSnapshot;
+  }
+  /**
+   * Client metadata for dynamic registration.
+   * Describes this client to the OAuth authorization server.
+   */
+  get clientMetadata() {
+    if (this.usesClientCredentials)
+      return {
+        client_name: this.config.clientName ?? "lunR",
+        ...this.config.clientUri ? { client_uri: this.config.clientUri } : {},
+        redirect_uris: [],
+        grant_types: ["client_credentials"],
+        token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none"
+      };
+    let redirectUrl = this.redirectUrl;
+    if (!redirectUrl)
+      throw new Error("redirectUrl is required for authorization_code flow");
+    return {
+      redirect_uris: [redirectUrl],
+      client_name: this.config.clientName ?? "lunR",
+      ...this.config.clientUri ? { client_uri: this.config.clientUri } : {},
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none",
+      ...this.config.scope !== void 0 ? { scope: this.config.scope } : {}
+    };
+  }
+  /**
+   * Get client information (for pre-registered or dynamically registered clients).
+   * Returns undefined if no client info exists or if the server URL has changed.
+   */
+  async clientInformation() {
+    if (this.config.clientId)
+      return {
+        client_id: this.config.clientId,
+        client_secret: this.config.clientSecret
+      };
+    if (!this.flowState || !this.flowClientInfoLoaded) {
+      let entry = await getAuthForUrl(this.serverName, this.serverUrl);
+      throwIfAborted(this.flowState?.signal);
+      let info = entry?.clientInfo;
+      this.flowClientInfo = info?.clientSecretExpiresAt && info.clientSecretExpiresAt < Date.now() / 1e3 ? void 0 : info, this.flowClientInfoLoaded = !0;
+    }
+    if (this.flowClientInfo)
+      return {
+        client_id: this.flowClientInfo.clientId,
+        client_secret: this.flowClientInfo.clientSecret
+      };
+  }
+  /**
+   * Save client information from dynamic registration.
+   */
+  async saveClientInformation(info) {
+    throwIfAborted(this.flowState?.signal);
+    let redirectUris = info.redirect_uris ?? (this.redirectUrl ? [this.redirectUrl] : void 0), clientInfo = {
+      clientId: info.client_id,
+      clientSecret: info.client_secret,
+      clientIdIssuedAt: info.client_id_issued_at,
+      clientSecretExpiresAt: info.client_secret_expires_at,
+      redirectUris
+    };
+    this.flowState && (this.flowClientInfo = clientInfo, this.flowClientInfoLoaded = !0), updateClientInfo(this.serverName, clientInfo, this.serverUrl);
+  }
+  /**
+   * Get stored OAuth tokens.
+   * Returns undefined if no tokens exist or if the server URL has changed.
+   */
+  async tokens() {
+    let entry = await getAuthForUrl(this.serverName, this.serverUrl);
+    if (entry?.tokens)
+      return {
+        access_token: entry.tokens.accessToken,
+        token_type: "Bearer",
+        refresh_token: entry.tokens.refreshToken,
+        expires_in: entry.tokens.expiresAt ? Math.max(0, Math.floor(entry.tokens.expiresAt - Date.now() / 1e3)) : void 0,
+        scope: entry.tokens.scope
+      };
+  }
+  /**
+   * Save OAuth tokens.
+   */
+  async saveTokens(tokens) {
+    throwIfAborted(this.flowState?.signal);
+    let storedTokens = {
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token,
+      expiresAt: tokens.expires_in ? Date.now() / 1e3 + tokens.expires_in : void 0,
+      scope: tokens.scope
+    };
+    this.flowState && this.flowClientInfo && updateClientInfo(this.serverName, this.flowClientInfo, this.serverUrl), updateTokens(this.serverName, storedTokens, this.serverUrl);
+  }
+  /**
+   * Redirect the user to the authorization URL.
+   * This opens the browser for the user to authenticate.
+   *
+   * Throws UnauthorizedError when called without owned or legacy flow state.
+   * That path is reached when the SDK
+   * falls through from a failed refresh into a fresh authorization_code
+   * flow, which library hosts cannot complete in-process.
+   */
+  async redirectToAuthorization(authorizationUrl) {
+    if (this.usesClientCredentials)
+      throw new Error("redirectToAuthorization is not used for client_credentials flow");
+    if (throwIfAborted(this.flowState?.signal), this.flowState) {
+      await this.callbacks.onRedirect(authorizationUrl);
+      return;
+    }
+    if (!(await getAuthForUrl(this.serverName, this.serverUrl))?.oauthState)
+      throw new UnauthorizedError(`Re-authentication required for MCP server: ${this.serverName}`);
+    await this.callbacks.onRedirect(authorizationUrl);
+  }
+  /**
+   * Save the PKCE code verifier.
+   */
+  async saveCodeVerifier(codeVerifier) {
+    if (throwIfAborted(this.flowState?.signal), this.flowState) {
+      this.flowState.codeVerifier = codeVerifier;
+      return;
+    }
+    updateCodeVerifier(this.serverName, codeVerifier, this.serverUrl);
+  }
+  /**
+   * Get the stored PKCE code verifier.
+   * @throws Error if no code verifier is stored
+   */
+  async codeVerifier() {
+    if (throwIfAborted(this.flowState?.signal), this.flowState) {
+      if (!this.flowState.codeVerifier)
+        throw new Error(`No code verifier saved for MCP server: ${this.serverName}`);
+      return this.flowState.codeVerifier;
+    }
+    if (this.usesClientCredentials)
+      throw new Error("codeVerifier is not used for client_credentials flow");
+    let entry = await getAuthForUrl(this.serverName, this.serverUrl);
+    if (!entry?.codeVerifier)
+      throw new Error(`No code verifier saved for MCP server: ${this.serverName}`);
+    return entry.codeVerifier;
+  }
+  /**
+   * Save the OAuth state parameter for CSRF protection.
+   */
+  async saveState(state) {
+    if (throwIfAborted(this.flowState?.signal), this.flowState) {
+      this.flowState.oauthState = state;
+      return;
+    }
+    updateOAuthState(this.serverName, state, this.serverUrl);
+  }
+  /**
+   * Get the stored OAuth state parameter.
+   * @throws UnauthorizedError if no flow is in progress (see redirectToAuthorization)
+   */
+  async state() {
+    if (throwIfAborted(this.flowState?.signal), this.flowState)
+      return this.flowState.oauthState;
+    if (this.usesClientCredentials)
+      throw new Error("state is not used for client_credentials flow");
+    let entry = await getAuthForUrl(this.serverName, this.serverUrl);
+    if (!entry?.oauthState)
+      throw new UnauthorizedError(`Re-authentication required for MCP server: ${this.serverName}`);
+    return entry.oauthState;
+  }
+  /**
+   * Invalidate credentials when authentication fails.
+   * Clears tokens, client info, or all credentials based on the type.
+   */
+  async invalidateCredentials(type) {
+    switch (throwIfAborted(this.flowState?.signal), this.flowState && type !== "tokens" && (this.flowClientInfo = void 0, this.flowClientInfoLoaded = !0), type) {
+      case "all":
+        clearAllCredentials(this.serverName);
+        break;
+      case "client":
+        clearClientInfo(this.serverName);
+        break;
+      case "tokens":
+        clearTokens(this.serverName);
+        break;
+    }
+  }
+  /**
+   * Adds configured authorization-code scope without replacing the SDK's
+   * default token endpoint authentication behavior.
+   */
+  addClientAuthentication = async (headers, params, _url2, metadata) => {
+    params.get("grant_type") === "authorization_code" && !params.has("scope") && this.config.scope && params.set("scope", this.config.scope);
+    let clientInfo = await this.clientInformation();
+    if (!clientInfo)
+      return;
+    let supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? [], hasClientSecret = clientInfo.client_secret !== void 0, authMethod;
+    if (supportedMethods.length === 0 ? authMethod = hasClientSecret ? "client_secret_post" : "none" : hasClientSecret && supportedMethods.includes("client_secret_basic") ? authMethod = "client_secret_basic" : hasClientSecret && supportedMethods.includes("client_secret_post") ? authMethod = "client_secret_post" : supportedMethods.includes("none") ? authMethod = "none" : authMethod = hasClientSecret ? "client_secret_post" : "none", authMethod === "client_secret_basic") {
+      if (!clientInfo.client_secret)
+        throw new Error("client_secret_basic authentication requires a client_secret");
+      headers.set("Authorization", `Basic ${Buffer.from(`${clientInfo.client_id}:${clientInfo.client_secret}`).toString("base64")}`);
+      return;
+    }
+    params.has("client_id") || params.set("client_id", clientInfo.client_id), authMethod === "client_secret_post" && clientInfo.client_secret && !params.has("client_secret") && params.set("client_secret", clientInfo.client_secret);
+  };
+  prepareTokenRequest(scope) {
+    if (!this.usesClientCredentials)
+      return;
+    let params = new URLSearchParams({ grant_type: "client_credentials" }), requestedScope = scope ?? this.config.scope;
+    return requestedScope && params.set("scope", requestedScope), params;
+  }
+};
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-callback-server.js
+import { createServer } from "http";
+var HTML_SUCCESS = `<!DOCTYPE html>
+<html>
+<head>
+  <title>lunR - Authorization Successful</title>
+  <style>
+    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }
+    .container { text-align: center; padding: 2rem; }
+    h1 { color: #4ade80; margin-bottom: 1rem; }
+    p { color: #aaa; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>Authorization Successful</h1>
+    <p>You can close this window and return to lunR.</p>
+  </div>
+  <script>setTimeout(() => window.close(), 2000);</script>
+</body>
+</html>`;
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+var HTML_ERROR = (error) => `<!DOCTYPE html>
+<html>
+<head>
+  <title>lunR - Authorization Failed</title>
+  <style>
+    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }
+    .container { text-align: center; padding: 2rem; }
+    h1 { color: #f87171; margin-bottom: 1rem; }
+    p { color: #aaa; }
+    .error { color: #fca5a5; font-family: monospace; margin-top: 1rem; padding: 1rem; background: rgba(248,113,113,0.1); border-radius: 0.5rem; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>Authorization Failed</h1>
+    <p>An error occurred during authorization.</p>
+    <div class="error">${escapeHtml(error)}</div>
+  </div>
+</body>
+</html>`, server, bindingPromise, pendingAuths = /* @__PURE__ */ new Map(), reservedAuthStates = /* @__PURE__ */ new Set(), callbackOwners = /* @__PURE__ */ new Set(), CALLBACK_TIMEOUT_MS = 300 * 1e3, DEFAULT_OAUTH_CALLBACK_HOST = "localhost", callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST;
+function handleRequest(req, res) {
+  let url2 = new URL(req.url || "/", `http://${req.headers.host}`);
+  if (url2.pathname !== getOAuthCallbackPath()) {
+    res.writeHead(404, { "Content-Type": "text/plain" }), res.end("Not found");
+    return;
+  }
+  let code = url2.searchParams.get("code"), state = url2.searchParams.get("state"), error = url2.searchParams.get("error"), errorDescription = url2.searchParams.get("error_description");
+  if (!state) {
+    let errorMsg = "Missing required state parameter - potential CSRF attack";
+    res.writeHead(400, { "Content-Type": "text/html" }), res.end(HTML_ERROR(errorMsg));
+    return;
+  }
+  let pending = pendingAuths.get(state), isReserved = reservedAuthStates.has(state);
+  if (error) {
+    if (!pending && !isReserved) {
+      let errorMsg2 = "Invalid or expired state parameter - potential CSRF attack";
+      res.writeHead(400, { "Content-Type": "text/html" }), res.end(HTML_ERROR(errorMsg2));
+      return;
+    }
+    let errorMsg = errorDescription || error;
+    res.writeHead(200, { "Content-Type": "text/html" }), res.end(HTML_ERROR(errorMsg)), reservedAuthStates.delete(state), pending && (clearTimeout(pending.timeout), pendingAuths.delete(state), setTimeout(() => pending.reject(new Error(errorMsg)), 0));
+    return;
+  }
+  if (!pending) {
+    let errorMsg = "Invalid or expired state parameter - potential CSRF attack";
+    res.writeHead(400, { "Content-Type": "text/html" }), res.end(HTML_ERROR(errorMsg));
+    return;
+  }
+  if (!code) {
+    res.writeHead(400, { "Content-Type": "text/html" }), res.end(HTML_ERROR("No authorization code provided"));
+    return;
+  }
+  clearTimeout(pending.timeout), pendingAuths.delete(state), pending.resolve(code), res.writeHead(200, { "Content-Type": "text/html" }), res.end(HTML_SUCCESS);
+}
+async function withCallbackLock(action) {
+  for (; bindingPromise; )
+    await bindingPromise.catch(() => {
+    });
+  let operation = action();
+  bindingPromise = operation;
+  try {
+    await operation;
+  } finally {
+    bindingPromise === operation && (bindingPromise = void 0);
+  }
+}
+function acquireCallbackServerOwner() {
+  let owner = /* @__PURE__ */ Symbol("MCP OAuth owner");
+  return callbackOwners.add(owner), owner;
+}
+async function releaseCallbackServerOwner(owner) {
+  await withCallbackLock(async () => {
+    callbackOwners.delete(owner), callbackOwners.size === 0 && await stopCallbackServerLocked();
+  });
+}
+async function ensureCallbackServer(options = {}) {
+  await withCallbackLock(async () => {
+    if (throwIfAborted(options.signal), options.owner && !callbackOwners.has(options.owner))
+      throw new Error("MCP OAuth session closed");
+    await ensureCallbackServerLocked(options), throwIfAborted(options.signal);
+  });
+}
+async function ensureCallbackServerLocked(options = {}) {
+  let requiredPort = options.port ?? getConfiguredOAuthCallbackPort(), strictPort = options.strictPort === !0, requestedHost = options.callbackHost ?? DEFAULT_OAUTH_CALLBACK_HOST, rawRequestedPath = options.callbackPath ?? DEFAULT_OAUTH_CALLBACK_PATH, requestedPath = rawRequestedPath.startsWith("/") ? rawRequestedPath : `/${rawRequestedPath}`;
+  if (options.reserveState && !options.oauthState)
+    throw new Error("OAuth callback reservation requires an oauthState");
+  let reservedState, previousServer = server, needsStrictRebind = !!(previousServer && strictPort && getOAuthCallbackPort() !== requiredPort), needsHostSwitch = !!(previousServer && callbackServerHost !== requestedHost), needsPathSwitch = !!(previousServer && getOAuthCallbackPath() !== requestedPath);
+  if (previousServer) {
+    if (!needsStrictRebind && !needsHostSwitch) {
+      if (needsPathSwitch) {
+        if (pendingAuths.size > 0 || reservedAuthStates.size > 0)
+          throw new Error(`OAuth callback server is using path ${getOAuthCallbackPath()}, but callback path ${requestedPath} is required and cannot be switched while authorizations are pending`);
+        setOAuthCallbackPath(requestedPath);
+      }
+      options.reserveState && options.oauthState && !options.signal?.aborted && (reservedAuthStates.add(options.oauthState), reservedState = options.oauthState);
+      return;
+    }
+    if (pendingAuths.size > 0 || reservedAuthStates.size > 0)
+      throw new Error(`OAuth callback server is running on ${callbackServerHost}:${getOAuthCallbackPort()}, but strict callback endpoint ${requestedHost}:${requiredPort} is required and cannot be switched while authorizations are pending`);
+  }
+  let candidateServer = createServer(handleRequest), listenPort = strictPort ? requiredPort : 0;
+  try {
+    if (await new Promise((resolve2, reject) => {
+      candidateServer.once("error", (err) => {
+        reject(err);
+      }), candidateServer.listen(listenPort, requestedHost, () => {
+        resolve2();
+      });
+    }), strictPort)
+      setOAuthCallbackPort(requiredPort);
+    else {
+      let address = candidateServer.address();
+      if (!address || typeof address == "string" || typeof address.port != "number")
+        throw new Error("OAuth callback server did not report an assigned port");
+      setOAuthCallbackPort(address.port);
+    }
+    previousServer && (needsStrictRebind || needsHostSwitch) && await new Promise((resolve2) => {
+      previousServer.close(() => resolve2());
+    }), callbackServerHost = requestedHost, setOAuthCallbackPath(requestedPath), server = candidateServer, options.reserveState && options.oauthState && !options.signal?.aborted && (reservedAuthStates.add(options.oauthState), reservedState = options.oauthState), server.unref();
+  } catch (error) {
+    reservedState && reservedAuthStates.delete(reservedState);
+    let nodeError = error;
+    throw await new Promise((resolve2) => {
+      candidateServer.close(() => resolve2());
+    }), strictPort && nodeError.code === "EADDRINUSE" ? new Error(`OAuth callback port ${requiredPort} is already in use. Pre-registered OAuth clients require an exact redirect URI; set MCP_OAUTH_CALLBACK_PORT to your registered port or free port ${requiredPort}`, { cause: error }) : error;
+  }
+}
+function releaseCallbackServer(oauthState) {
+  reservedAuthStates.delete(oauthState);
+}
+function waitForCallback(oauthState) {
+  return reservedAuthStates.delete(oauthState), new Promise((resolve2, reject) => {
+    let timeout = setTimeout(() => {
+      pendingAuths.has(oauthState) && (pendingAuths.delete(oauthState), reject(new Error("OAuth callback timeout - authorization took too long")));
+    }, CALLBACK_TIMEOUT_MS);
+    pendingAuths.set(oauthState, { resolve: resolve2, reject, timeout });
+  });
+}
+function cancelPendingCallback(oauthState) {
+  reservedAuthStates.delete(oauthState);
+  let pending = pendingAuths.get(oauthState);
+  pending && (clearTimeout(pending.timeout), pendingAuths.delete(oauthState), pending.reject(new Error("Authorization cancelled")));
+}
+async function stopCallbackServerLocked() {
+  server && (await new Promise((resolve2) => {
+    server.close(() => {
+      resolve2();
+    });
+  }), server = void 0), setOAuthCallbackPort(getConfiguredOAuthCallbackPort()), callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST, setOAuthCallbackPath(DEFAULT_OAUTH_CALLBACK_PATH);
+  let pendingList = Array.from(pendingAuths.entries());
+  pendingAuths.clear(), reservedAuthStates.clear(), setTimeout(() => {
+    for (let [, pending] of pendingList)
+      clearTimeout(pending.timeout), pending.reject(new Error("OAuth callback server stopped"));
+  }, 0);
+}
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.js
+var MANUAL_AUTH_TIMEOUT_MS = 300 * 1e3;
+function generateState() {
+  return Array.from(crypto.getRandomValues(new Uint8Array(32))).map((b2) => b2.toString(16).padStart(2, "0")).join("");
+}
+function extractOAuthConfig(definition) {
+  if (definition.oauth === !1)
+    return {};
+  let config = {};
+  if (definition.oauth?.grantType !== void 0 && (config.grantType = definition.oauth.grantType), definition.oauth?.clientId !== void 0 && (config.clientId = definition.oauth.clientId), definition.oauth?.clientSecret !== void 0 && (config.clientSecret = definition.oauth.clientSecret), definition.oauth?.scope !== void 0 && (config.scope = definition.oauth.scope), definition.oauth?.redirectUri !== void 0) {
+    if (typeof definition.oauth.redirectUri != "string")
+      throw new Error("OAuth redirectUri must be a string");
+    let redirectUri = definition.oauth.redirectUri.trim();
+    if (!redirectUri)
+      throw new Error("OAuth redirectUri must not be empty");
+    config.redirectUri = redirectUri;
+  }
+  if (definition.oauth?.clientName !== void 0) {
+    if (typeof definition.oauth.clientName != "string")
+      throw new Error("OAuth clientName must be a string");
+    let clientName = definition.oauth.clientName.trim();
+    if (!clientName)
+      throw new Error("OAuth clientName must not be empty");
+    config.clientName = clientName;
+  }
+  if (definition.oauth?.clientUri !== void 0) {
+    if (typeof definition.oauth.clientUri != "string")
+      throw new Error("OAuth clientUri must be a string");
+    let clientUri = definition.oauth.clientUri.trim();
+    if (!clientUri)
+      throw new Error("OAuth clientUri must not be empty");
+    config.clientUri = clientUri;
+  }
+  return config;
+}
+function parseOAuthRedirectUri(redirectUri) {
+  let url2;
+  try {
+    url2 = new URL(redirectUri);
+  } catch (error) {
+    throw new Error(`Invalid OAuth redirectUri: ${redirectUri}`, { cause: error });
+  }
+  let hostname = url2.hostname.toLowerCase(), isLocalhost = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
+  if (url2.protocol !== "http:" || !isLocalhost)
+    throw new Error("OAuth redirectUri must be an http:// localhost or loopback URI");
+  if (url2.username || url2.password)
+    throw new Error("OAuth redirectUri must not include username or password");
+  if (url2.hash)
+    throw new Error("OAuth redirectUri must not include a fragment");
+  if (!url2.port)
+    throw new Error("OAuth redirectUri must include an explicit numeric port");
+  let port = Number.parseInt(url2.port, 10);
+  if (!Number.isInteger(port) || port <= 0 || port > 65535)
+    throw new Error("OAuth redirectUri must include an explicit numeric port");
+  return { port, callbackHost: hostname === "[::1]" ? "::1" : hostname, callbackPath: url2.pathname };
+}
+function getSearchParamsFromInput(input) {
+  try {
+    let url2 = new URL(input), params = new URLSearchParams(url2.search);
+    if (url2.hash) {
+      let hash = url2.hash.startsWith("#") ? url2.hash.slice(1) : url2.hash, hashParams = new URLSearchParams(hash);
+      for (let [key, value] of hashParams)
+        params.has(key) || params.set(key, value);
+    }
+    return params;
+  } catch {
+    let query = input.includes("?") ? input.slice(input.indexOf("?") + 1) : input, params = new URLSearchParams(query.startsWith("#") ? query.slice(1) : query);
+    return params.has("code") || params.has("state") || params.has("error") ? params : void 0;
+  }
+}
+function parseAuthorizationCodeInput(input, expectedState) {
+  let trimmed = input.trim();
+  if (!trimmed)
+    throw new Error("Authorization code or redirect URL is required");
+  let params = getSearchParamsFromInput(trimmed);
+  if (params) {
+    let error = params.get("error");
+    if (error) {
+      let description = params.get("error_description");
+      throw new Error(description ? `${error}: ${description}` : error);
+    }
+    let state = params.get("state");
+    if (expectedState && !state)
+      throw new Error("OAuth state missing from redirect URL");
+    if (expectedState && state !== expectedState)
+      throw new Error("OAuth state mismatch - potential CSRF attack");
+    let code = params.get("code");
+    if (code)
+      return code;
+  }
+  if (/^[A-Za-z0-9._~+/=-]+$/.test(trimmed))
+    return trimmed;
+  throw new Error("Could not find an OAuth authorization code in the provided input");
+}
+function createMcpAuthFlow() {
+  let owner = acquireCallbackServerOwner(), flows = /* @__PURE__ */ new Map(), authenticating = /* @__PURE__ */ new Map(), shutdownPromise, closed = !1;
+  function assertOpen() {
+    if (closed)
+      throw new Error("MCP OAuth session closed");
+  }
+  async function clearPendingAuth(serverName, flow = flows.get(serverName)) {
+    flow && (flow.cleanup || (flow.cleanup = (async () => {
+      flows.get(serverName) === flow && flows.delete(serverName), flow.timer && clearTimeout(flow.timer), flow.controller.abort(new Error("Authorization cancelled")), cancelPendingCallback(flow.state.oauthState), releaseCallbackServer(flow.state.oauthState), await flow.transport?.close().catch(() => {
+      });
+    })()), await flow.cleanup);
+  }
+  async function startAuth(serverName, serverUrl, definition) {
+    assertOpen();
+    let previous = flows.get(serverName);
+    if (previous && await clearPendingAuth(serverName, previous), assertOpen(), flows.has(serverName))
+      throw new Error(`OAuth flow already pending for server: ${serverName}`);
+    let controller = new AbortController(), flow = { controller, state: { oauthState: generateState(), signal: controller.signal } };
+    flows.set(serverName, flow);
+    let signal = controller.signal, fetchFn = (input, init) => fetch(input, {
+      ...init,
+      signal: init?.signal ? AbortSignal.any([init.signal, signal]) : signal
+    });
+    try {
+      let config = definition ? extractOAuthConfig(definition) : {}, storedAuth = await getAuthForUrl(serverName, serverUrl);
+      if (throwIfAborted(signal), flow.state.clientInfo = storedAuth?.clientInfo, config.grantType !== "client_credentials") {
+        if (!config.redirectUri && !config.clientId) {
+          let registeredRedirect = storedAuth?.clientInfo?.redirectUris?.[0];
+          registeredRedirect && (config.redirectUri = registeredRedirect);
+        }
+        let redirect = config.redirectUri ? parseOAuthRedirectUri(config.redirectUri) : void 0;
+        await ensureCallbackServer({
+          owner,
+          signal,
+          strictPort: !!(config.clientId || storedAuth?.clientInfo) || config.redirectUri !== void 0,
+          oauthState: flow.state.oauthState,
+          reserveState: !0,
+          ...redirect ? { port: redirect.port, callbackHost: redirect.callbackHost, callbackPath: redirect.callbackPath } : {}
+        }), throwIfAborted(signal);
+      }
+      let capturedUrl, authProvider = new McpOAuthProvider(serverName, serverUrl, config, {
+        onRedirect: (url2) => {
+          throwIfAborted(signal), capturedUrl = url2;
+        }
+      }, flow.state), result = await abortable(auth(authProvider, { serverUrl, fetchFn }), signal);
+      if (throwIfAborted(signal), result === "AUTHORIZED")
+        return await clearPendingAuth(serverName, flow), { authorizationUrl: "" };
+      if (config.grantType === "client_credentials" || !capturedUrl)
+        throw new UnauthorizedError("OAuth authorization URL was not provided");
+      return flow.transport = new StreamableHTTPClientTransport(new URL(serverUrl), { authProvider, fetch: fetchFn }), flow.timer = setTimeout(() => {
+        clearPendingAuth(serverName, flow);
+      }, MANUAL_AUTH_TIMEOUT_MS), flow.timer.unref?.(), { authorizationUrl: capturedUrl.toString() };
+    } catch (error) {
+      throw await clearPendingAuth(serverName, flow), error;
+    }
+  }
+  async function completeAuthFromInput(serverName, input) {
+    assertOpen();
+    let flow = flows.get(serverName);
+    if (!flow)
+      throw new Error(`No pending OAuth flow for server: ${serverName}`);
+    return completeAuth(serverName, parseAuthorizationCodeInput(input, flow.state.oauthState));
+  }
+  async function completeAuth(serverName, code) {
+    assertOpen();
+    let flow = flows.get(serverName);
+    if (!flow?.transport)
+      throw new Error(`No pending OAuth flow for server: ${serverName}`);
+    try {
+      return await abortable(flow.transport.finishAuth(code), flow.state.signal), throwIfAborted(flow.state.signal), "authenticated";
+    } finally {
+      await clearPendingAuth(serverName, flow);
+    }
+  }
+  async function authenticate(serverName, serverUrl, definition, options = {}) {
+    assertOpen();
+    let pending = authenticating.get(serverName);
+    if (pending)
+      return pending;
+    let operation = (async () => {
+      let { authorizationUrl } = await startAuth(serverName, serverUrl, definition);
+      if (!authorizationUrl)
+        return "authenticated";
+      assertOpen();
+      let flow = flows.get(serverName);
+      if (!flow)
+        throw new Error(`No pending OAuth flow for server: ${serverName}`);
+      let callback = waitForCallback(flow.state.oauthState);
+      callback.catch(() => {
+      });
+      try {
+        options.onAuthorizationUrl ? await abortable(Promise.resolve(options.onAuthorizationUrl(authorizationUrl)), flow.state.signal) : console.log(`MCP Auth: Open this URL to authenticate ${serverName}:
+${authorizationUrl}`), throwIfAborted(flow.state.signal);
+        try {
+          await abortable(open(authorizationUrl), flow.state.signal);
+        } catch (error) {
+          throwIfAborted(flow.state.signal), console.warn(`MCP Auth: Failed to open browser for ${serverName}; waiting for manual callback`, { error });
+        }
+        let code = await callback;
+        return await completeAuth(serverName, code);
+      } catch (error) {
+        throw await clearPendingAuth(serverName, flow), error;
+      }
+    })();
+    authenticating.set(serverName, operation);
+    try {
+      return await operation;
+    } finally {
+      authenticating.get(serverName) === operation && authenticating.delete(serverName);
+    }
+  }
+  async function removeAuth(serverName) {
+    assertOpen(), await clearPendingAuth(serverName), clearAllCredentials(serverName);
+  }
+  function shutdown() {
+    return shutdownPromise || (closed = !0, shutdownPromise = (async () => {
+      await Promise.all([...flows].map(([name, flow]) => clearPendingAuth(name, flow))), await releaseCallbackServerOwner(owner);
+    })()), shutdownPromise;
+  }
+  return { startAuth, completeAuth, completeAuthFromInput, authenticate, removeAuth, shutdown };
+}
+function supportsOAuth(definition) {
+  return !definition.url || definition.auth === !1 || definition.oauth === !1 ? !1 : definition.auth === "oauth" ? !0 : definition.headers && Object.keys(definition.headers).length > 0 ? !1 : definition.auth === void 0;
+}
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/init.js
+import { existsSync as existsSync3 } from "node:fs";
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/errors.js
+var McpUiError = class extends Error {
+  code;
+  context;
+  recoveryHint;
+  cause;
+  constructor(message, options) {
+    super(message), this.name = "McpUiError", this.code = options.code, this.context = options.context ?? {}, this.recoveryHint = options.recoveryHint, this.cause = options.cause, Error.captureStackTrace && Error.captureStackTrace(this, this.constructor);
+  }
+  toJSON() {
+    return {
+      name: this.name,
+      code: this.code,
+      message: this.message,
+      context: this.context,
+      recoveryHint: this.recoveryHint,
+      stack: this.stack
+    };
+  }
+}, ResourceFetchError = class extends McpUiError {
+  constructor(uri, reason, options) {
+    super(`Failed to fetch UI resource "${uri}": ${reason}`, {
+      code: "RESOURCE_FETCH_ERROR",
+      context: { uri, server: options?.server },
+      recoveryHint: "Check that the MCP server is connected and the resource URI is valid.",
+      cause: options?.cause
+    }), this.name = "ResourceFetchError";
+  }
+}, ResourceParseError = class extends McpUiError {
+  constructor(uri, reason, options) {
+    super(`Invalid UI resource "${uri}": ${reason}`, {
+      code: "RESOURCE_PARSE_ERROR",
+      context: { uri, server: options?.server, mimeType: options?.mimeType },
+      recoveryHint: "Ensure the resource returns valid HTML with the correct MIME type."
+    }), this.name = "ResourceParseError";
+  }
+};
+var ConsentError = class extends McpUiError {
+  denied;
+  constructor(server2, options) {
+    let message = options.denied ? `Tool calls for "${server2}" were denied for this session` : `Tool call approval required for "${server2}"`;
+    super(message, {
+      code: options.denied ? "CONSENT_DENIED" : "CONSENT_REQUIRED",
+      context: { server: server2 },
+      recoveryHint: options.denied ? "The user denied tool access. Start a new session to try again." : "Prompt the user for consent before calling tools."
+    }), this.name = "ConsentError", this.denied = options.denied ?? !1;
+  }
+};
+var ServerError2 = class extends McpUiError {
+  constructor(reason, options) {
+    super(`UI server error: ${reason}`, {
+      code: "SERVER_ERROR",
+      context: { port: options?.port },
+      recoveryHint: "Check if the port is available. Another process may be using it.",
+      cause: options?.cause
+    }), this.name = "ServerError";
+  }
+};
+function wrapError(error, context) {
+  if (error instanceof McpUiError)
+    return new McpUiError(error.message, {
+      code: error.code,
+      context: { ...error.context, ...context },
+      recoveryHint: error.recoveryHint,
+      cause: error.cause
+    });
+  let cause = error instanceof Error ? error : void 0, message = error instanceof Error ? error.message : String(error);
+  return new McpUiError(message, {
+    code: "UNKNOWN_ERROR",
+    context,
+    cause
+  });
+}
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/logger.js
+var LEVEL_PRIORITY = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3
+}, LEVEL_PREFIX = {
+  debug: "[MCP-UI:DEBUG]",
+  info: "[MCP-UI]",
+  warn: "[MCP-UI:WARN]",
+  error: "[MCP-UI:ERROR]"
+}, Logger = class {
+  minLevel = "info";
+  handlers = [];
+  defaultContext = {};
+  setLevel(level) {
+    this.minLevel = level;
+  }
+  setDefaultContext(context) {
+    this.defaultContext = context;
+  }
+  addHandler(handler) {
+    this.handlers.push(handler);
+  }
+  clearHandlers() {
+    this.handlers = [];
+  }
+  shouldLog(level) {
+    return LEVEL_PRIORITY[level] >= LEVEL_PRIORITY[this.minLevel];
+  }
+  emit(level, message, context, error) {
+    if (!this.shouldLog(level))
+      return;
+    let entry = {
+      level,
+      message,
+      context: { ...this.defaultContext, ...context },
+      error,
+      timestamp: /* @__PURE__ */ new Date()
+    }, prefix = LEVEL_PREFIX[level], contextStr = formatContext(entry.context), fullMessage = contextStr ? `${prefix} ${message} ${contextStr}` : `${prefix} ${message}`;
+    level === "error" ? console.error(fullMessage, error ?? "") : level === "warn" ? console.warn(fullMessage) : level === "debug" ? console.debug(fullMessage) : console.log(fullMessage);
+    for (let handler of this.handlers)
+      try {
+        handler(entry);
+      } catch {
+      }
+  }
+  debug(message, context) {
+    this.emit("debug", message, context);
+  }
+  info(message, context) {
+    this.emit("info", message, context);
+  }
+  warn(message, context) {
+    this.emit("warn", message, context);
+  }
+  error(message, error, context) {
+    this.emit("error", message, context, error);
+  }
+  /**
+   * Create a child logger with additional default context.
+   */
+  child(context) {
+    return new ChildLogger(this, context);
+  }
+}, ChildLogger = class _ChildLogger {
+  parent;
+  context;
+  constructor(parent, context) {
+    this.parent = parent, this.context = context;
+  }
+  debug(message, context) {
+    this.parent.debug(message, { ...this.context, ...context });
+  }
+  info(message, context) {
+    this.parent.info(message, { ...this.context, ...context });
+  }
+  warn(message, context) {
+    this.parent.warn(message, { ...this.context, ...context });
+  }
+  error(message, error, context) {
+    this.parent.error(message, error, { ...this.context, ...context });
+  }
+  child(context) {
+    return new _ChildLogger(this.parent, { ...this.context, ...context });
+  }
+};
+function formatContext(context) {
+  if (!context || Object.keys(context).length === 0)
+    return "";
+  let parts = [];
+  for (let [key, value] of Object.entries(context))
+    value != null && parts.push(`${key}=${typeof value == "string" ? value : JSON.stringify(value)}`);
+  return parts.length > 0 ? `(${parts.join(", ")})` : "";
+}
+var logger = new Logger();
+(process.env.MCP_UI_DEBUG === "1" || process.env.MCP_UI_DEBUG === "true") && logger.setLevel("debug");
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/consent-manager.js
+var ConsentManager = class {
+  mode;
+  approvedServers = /* @__PURE__ */ new Set();
+  deniedServers = /* @__PURE__ */ new Set();
+  log = logger.child({ component: "ConsentManager" });
+  constructor(mode = "once-per-server") {
+    this.mode = mode, this.log.debug("Initialized", { mode });
+  }
+  requiresPrompt(serverName) {
+    return this.mode === "never" ? !1 : this.deniedServers.has(serverName) || this.mode === "always" ? !0 : !this.approvedServers.has(serverName);
+  }
+  shouldCacheConsent() {
+    return this.mode !== "always";
+  }
+  registerDecision(serverName, approved) {
+    if (this.deniedServers.delete(serverName), this.approvedServers.delete(serverName), approved) {
+      this.approvedServers.add(serverName), this.log.debug("Consent granted", { server: serverName });
+      return;
+    }
+    this.deniedServers.add(serverName), this.log.debug("Consent denied", { server: serverName });
+  }
+  ensureApproved(serverName) {
+    if (this.mode !== "never") {
+      if (this.deniedServers.has(serverName))
+        throw new ConsentError(serverName, { denied: !0 });
+      if (!this.approvedServers.has(serverName))
+        throw new ConsentError(serverName, { requiresApproval: !0 });
+      this.mode === "always" && this.approvedServers.delete(serverName);
+    }
+  }
+  clear(serverName) {
+    if (serverName) {
+      this.approvedServers.delete(serverName), this.deniedServers.delete(serverName), this.log.debug("Cleared consent for server", { server: serverName });
+      return;
+    }
+    this.approvedServers.clear(), this.deniedServers.clear(), this.log.debug("Cleared all consent records");
+  }
+};
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/lifecycle.js
+var McpLifecycleManager = class {
+  manager;
+  keepAliveServers = /* @__PURE__ */ new Map();
+  allServers = /* @__PURE__ */ new Map();
+  serverSettings = /* @__PURE__ */ new Map();
+  globalIdleTimeout = 600 * 1e3;
+  healthCheckInterval;
+  onReconnect;
+  onIdleShutdown;
+  constructor(manager) {
+    this.manager = manager;
+  }
+  /**
+   * Set callback to be invoked after a successful auto-reconnect.
+   * Use this to update tool metadata when a server reconnects.
+   */
+  setReconnectCallback(callback) {
+    this.onReconnect = callback;
+  }
+  markKeepAlive(name, definition) {
+    this.keepAliveServers.set(name, definition);
+  }
+  registerServer(name, definition, settings) {
+    this.allServers.set(name, definition), settings?.idleTimeout !== void 0 && this.serverSettings.set(name, settings);
+  }
+  setGlobalIdleTimeout(minutes) {
+    this.globalIdleTimeout = minutes * 60 * 1e3;
+  }
+  setIdleShutdownCallback(callback) {
+    this.onIdleShutdown = callback;
+  }
+  startHealthChecks(intervalMs = 3e4) {
+    this.healthCheckInterval = setInterval(() => {
+      this.checkConnections();
+    }, intervalMs), this.healthCheckInterval.unref();
+  }
+  async checkConnections() {
+    for (let [name, definition] of this.keepAliveServers) {
+      let connection = this.manager.getConnection(name);
+      if (!connection || connection.status !== "connected")
+        try {
+          await this.manager.connect(name, definition), logger.debug(`Reconnected to ${name}`), this.onReconnect?.(name);
+        } catch (error) {
+          console.error(`MCP: Failed to reconnect to ${name}:`, error);
+        }
+    }
+    for (let [name] of this.allServers) {
+      if (this.keepAliveServers.has(name))
+        continue;
+      let timeout = this.getIdleTimeout(name);
+      timeout > 0 && this.manager.isIdle(name, timeout) && (await this.manager.close(name), this.onIdleShutdown?.(name));
+    }
+  }
+  getIdleTimeout(name) {
+    let perServer = this.serverSettings.get(name)?.idleTimeout;
+    return perServer !== void 0 ? perServer * 60 * 1e3 : this.globalIdleTimeout;
+  }
+  async gracefulShutdown() {
+    this.healthCheckInterval && clearInterval(this.healthCheckInterval), await this.manager.closeAll();
+  }
+};
+
+// node_modules/eventsource/dist/index.js
+var ErrorEvent = class extends Event {
+  /**
+   * Constructs a new `ErrorEvent` instance. This is typically not called directly,
+   * but rather emitted by the `EventSource` object when an error occurs.
+   *
+   * @param type - The type of the event (should be "error")
+   * @param errorEventInitDict - Optional properties to include in the error event
+   */
+  constructor(type, errorEventInitDict) {
+    var _a, _b;
+    super(type), this.code = (_a = errorEventInitDict?.code) != null ? _a : void 0, this.message = (_b = errorEventInitDict?.message) != null ? _b : void 0;
+  }
+  /**
+   * Node.js "hides" the `message` and `code` properties of the `ErrorEvent` instance,
+   * when it is `console.log`'ed. This makes it harder to debug errors. To ease debugging,
+   * we explicitly include the properties in the `inspect` method.
+   *
+   * This is automatically called by Node.js when you `console.log` an instance of this class.
+   *
+   * @param _depth - The current depth
+   * @param options - The options passed to `util.inspect`
+   * @param inspect - The inspect function to use (prevents having to import it from `util`)
+   * @returns A string representation of the error
+   */
+  [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")](_depth, options, inspect) {
+    return inspect(inspectableError(this), options);
+  }
+  /**
+   * Deno "hides" the `message` and `code` properties of the `ErrorEvent` instance,
+   * when it is `console.log`'ed. This makes it harder to debug errors. To ease debugging,
+   * we explicitly include the properties in the `inspect` method.
+   *
+   * This is automatically called by Deno when you `console.log` an instance of this class.
+   *
+   * @param inspect - The inspect function to use (prevents having to import it from `util`)
+   * @param options - The options passed to `Deno.inspect`
+   * @returns A string representation of the error
+   */
+  [/* @__PURE__ */ Symbol.for("Deno.customInspect")](inspect, options) {
+    return inspect(inspectableError(this), options);
+  }
+};
+function syntaxError(message) {
+  let DomException = globalThis.DOMException;
+  return typeof DomException == "function" ? new DomException(message, "SyntaxError") : new SyntaxError(message);
+}
+function flattenError(err) {
+  return err instanceof Error ? "errors" in err && Array.isArray(err.errors) ? err.errors.map(flattenError).join(", ") : "cause" in err && err.cause instanceof Error ? `${err}: ${flattenError(err.cause)}` : err.message : `${err}`;
+}
+function inspectableError(err) {
+  return {
+    type: err.type,
+    message: err.message,
+    code: err.code,
+    defaultPrevented: err.defaultPrevented,
+    cancelable: err.cancelable,
+    timeStamp: err.timeStamp
+  };
+}
+var __typeError = (msg) => {
+  throw TypeError(msg);
+}, __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg), __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj)), __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value), __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), member.set(obj, value), value), __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method), _readyState, _url, _redirectUrl, _withCredentials, _fetch, _reconnectInterval, _reconnectTimer, _lastEventId, _controller, _parser, _onError, _onMessage, _onOpen, _EventSource_instances, connect_fn, _onFetchResponse, _onFetchError, getRequestOptions_fn, _onEvent, _onRetryChange, failConnection_fn, scheduleReconnect_fn, _reconnect, EventSource = class extends EventTarget {
+  constructor(url2, eventSourceInitDict) {
+    var _a, _b;
+    super(), __privateAdd(this, _EventSource_instances), this.CONNECTING = 0, this.OPEN = 1, this.CLOSED = 2, __privateAdd(this, _readyState), __privateAdd(this, _url), __privateAdd(this, _redirectUrl), __privateAdd(this, _withCredentials), __privateAdd(this, _fetch), __privateAdd(this, _reconnectInterval), __privateAdd(this, _reconnectTimer), __privateAdd(this, _lastEventId, null), __privateAdd(this, _controller), __privateAdd(this, _parser), __privateAdd(this, _onError, null), __privateAdd(this, _onMessage, null), __privateAdd(this, _onOpen, null), __privateAdd(this, _onFetchResponse, async (response) => {
+      var _a2;
+      __privateGet(this, _parser).reset();
+      let { body, redirected, status, headers } = response;
+      if (status === 204) {
+        __privateMethod(this, _EventSource_instances, failConnection_fn).call(this, "Server sent HTTP 204, not reconnecting", 204), this.close();
+        return;
+      }
+      if (redirected ? __privateSet(this, _redirectUrl, new URL(response.url)) : __privateSet(this, _redirectUrl, void 0), status !== 200) {
+        __privateMethod(this, _EventSource_instances, failConnection_fn).call(this, `Non-200 status code (${status})`, status);
+        return;
+      }
+      if (!(headers.get("content-type") || "").startsWith("text/event-stream")) {
+        __privateMethod(this, _EventSource_instances, failConnection_fn).call(this, 'Invalid content type, expected "text/event-stream"', status);
+        return;
+      }
+      if (__privateGet(this, _readyState) === this.CLOSED)
+        return;
+      __privateSet(this, _readyState, this.OPEN);
+      let openEvent = new Event("open");
+      if ((_a2 = __privateGet(this, _onOpen)) == null || _a2.call(this, openEvent), this.dispatchEvent(openEvent), typeof body != "object" || !body || !("getReader" in body)) {
+        __privateMethod(this, _EventSource_instances, failConnection_fn).call(this, "Invalid response body, expected a web ReadableStream", status), this.close();
+        return;
+      }
+      let decoder = new TextDecoder(), reader = body.getReader(), open3 = !0;
+      do {
+        let { done, value } = await reader.read();
+        value && __privateGet(this, _parser).feed(decoder.decode(value, { stream: !done })), done && (open3 = !1, __privateGet(this, _parser).reset(), __privateMethod(this, _EventSource_instances, scheduleReconnect_fn).call(this));
+      } while (open3);
+    }), __privateAdd(this, _onFetchError, (err) => {
+      __privateSet(this, _controller, void 0), !(err.name === "AbortError" || err.type === "aborted") && __privateMethod(this, _EventSource_instances, scheduleReconnect_fn).call(this, flattenError(err));
+    }), __privateAdd(this, _onEvent, (event) => {
+      typeof event.id == "string" && __privateSet(this, _lastEventId, event.id);
+      let messageEvent = new MessageEvent(event.event || "message", {
+        data: event.data,
+        origin: __privateGet(this, _redirectUrl) ? __privateGet(this, _redirectUrl).origin : __privateGet(this, _url).origin,
+        lastEventId: event.id || ""
+      });
+      __privateGet(this, _onMessage) && (!event.event || event.event === "message") && __privateGet(this, _onMessage).call(this, messageEvent), this.dispatchEvent(messageEvent);
+    }), __privateAdd(this, _onRetryChange, (value) => {
+      __privateSet(this, _reconnectInterval, value);
+    }), __privateAdd(this, _reconnect, () => {
+      __privateSet(this, _reconnectTimer, void 0), __privateGet(this, _readyState) === this.CONNECTING && __privateMethod(this, _EventSource_instances, connect_fn).call(this);
+    });
+    try {
+      if (url2 instanceof URL)
+        __privateSet(this, _url, url2);
+      else if (typeof url2 == "string")
+        __privateSet(this, _url, new URL(url2, getBaseURL()));
+      else
+        throw new Error("Invalid URL");
+    } catch {
+      throw syntaxError("An invalid or illegal string was specified");
+    }
+    __privateSet(this, _parser, createParser({
+      onEvent: __privateGet(this, _onEvent),
+      onRetry: __privateGet(this, _onRetryChange)
+    })), __privateSet(this, _readyState, this.CONNECTING), __privateSet(this, _reconnectInterval, 3e3), __privateSet(this, _fetch, (_a = eventSourceInitDict?.fetch) != null ? _a : globalThis.fetch), __privateSet(this, _withCredentials, (_b = eventSourceInitDict?.withCredentials) != null ? _b : !1), __privateMethod(this, _EventSource_instances, connect_fn).call(this);
+  }
+  /**
+   * Returns the state of this EventSource object's connection. It can have the values described below.
+   *
+   * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/readyState)
+   *
+   * Note: typed as `number` instead of `0 | 1 | 2` for compatibility with the `EventSource` interface,
+   * defined in the TypeScript `dom` library.
+   *
+   * @public
+   */
+  get readyState() {
+    return __privateGet(this, _readyState);
+  }
+  /**
+   * Returns the URL providing the event stream.
+   *
+   * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/url)
+   *
+   * @public
+   */
+  get url() {
+    return __privateGet(this, _url).href;
+  }
+  /**
+   * Returns true if the credentials mode for connection requests to the URL providing the event stream is set to "include", and false otherwise.
+   *
+   * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/withCredentials)
+   */
+  get withCredentials() {
+    return __privateGet(this, _withCredentials);
+  }
+  /** [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/error_event) */
+  get onerror() {
+    return __privateGet(this, _onError);
+  }
+  set onerror(value) {
+    __privateSet(this, _onError, value);
+  }
+  /** [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/message_event) */
+  get onmessage() {
+    return __privateGet(this, _onMessage);
+  }
+  set onmessage(value) {
+    __privateSet(this, _onMessage, value);
+  }
+  /** [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/open_event) */
+  get onopen() {
+    return __privateGet(this, _onOpen);
+  }
+  set onopen(value) {
+    __privateSet(this, _onOpen, value);
+  }
+  addEventListener(type, listener, options) {
+    let listen = listener;
+    super.addEventListener(type, listen, options);
+  }
+  removeEventListener(type, listener, options) {
+    let listen = listener;
+    super.removeEventListener(type, listen, options);
+  }
+  /**
+   * Aborts any instances of the fetch algorithm started for this EventSource object, and sets the readyState attribute to CLOSED.
+   *
+   * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/close)
+   *
+   * @public
+   */
+  close() {
+    __privateGet(this, _reconnectTimer) && clearTimeout(__privateGet(this, _reconnectTimer)), __privateGet(this, _readyState) !== this.CLOSED && (__privateGet(this, _controller) && __privateGet(this, _controller).abort(), __privateSet(this, _readyState, this.CLOSED), __privateSet(this, _controller, void 0));
+  }
+};
+_readyState = /* @__PURE__ */ new WeakMap(), _url = /* @__PURE__ */ new WeakMap(), _redirectUrl = /* @__PURE__ */ new WeakMap(), _withCredentials = /* @__PURE__ */ new WeakMap(), _fetch = /* @__PURE__ */ new WeakMap(), _reconnectInterval = /* @__PURE__ */ new WeakMap(), _reconnectTimer = /* @__PURE__ */ new WeakMap(), _lastEventId = /* @__PURE__ */ new WeakMap(), _controller = /* @__PURE__ */ new WeakMap(), _parser = /* @__PURE__ */ new WeakMap(), _onError = /* @__PURE__ */ new WeakMap(), _onMessage = /* @__PURE__ */ new WeakMap(), _onOpen = /* @__PURE__ */ new WeakMap(), _EventSource_instances = /* @__PURE__ */ new WeakSet(), /**
+* Connect to the given URL and start receiving events
+*
+* @internal
+*/
+connect_fn = function() {
+  __privateSet(this, _readyState, this.CONNECTING), __privateSet(this, _controller, new AbortController()), __privateGet(this, _fetch)(__privateGet(this, _url), __privateMethod(this, _EventSource_instances, getRequestOptions_fn).call(this)).then(__privateGet(this, _onFetchResponse)).catch(__privateGet(this, _onFetchError));
+}, _onFetchResponse = /* @__PURE__ */ new WeakMap(), _onFetchError = /* @__PURE__ */ new WeakMap(), /**
+* Get request options for the `fetch()` request
+*
+* @returns The request options
+* @internal
+*/
+getRequestOptions_fn = function() {
+  var _a;
+  let init = {
+    // [spec] Let `corsAttributeState` be `Anonymous`…
+    // [spec] …will have their mode set to "cors"…
+    mode: "cors",
+    redirect: "follow",
+    headers: { Accept: "text/event-stream", ...__privateGet(this, _lastEventId) ? { "Last-Event-ID": __privateGet(this, _lastEventId) } : void 0 },
+    cache: "no-store",
+    signal: (_a = __privateGet(this, _controller)) == null ? void 0 : _a.signal
+  };
+  return "window" in globalThis && (init.credentials = this.withCredentials ? "include" : "same-origin"), init;
+}, _onEvent = /* @__PURE__ */ new WeakMap(), _onRetryChange = /* @__PURE__ */ new WeakMap(), /**
+* Handles the process referred to in the EventSource specification as "failing a connection".
+*
+* @param error - The error causing the connection to fail
+* @param code - The HTTP status code, if available
+* @internal
+*/
+failConnection_fn = function(message, code) {
+  var _a;
+  __privateGet(this, _readyState) !== this.CLOSED && __privateSet(this, _readyState, this.CLOSED);
+  let errorEvent = new ErrorEvent("error", { code, message });
+  (_a = __privateGet(this, _onError)) == null || _a.call(this, errorEvent), this.dispatchEvent(errorEvent);
+}, /**
+* Schedules a reconnection attempt against the EventSource endpoint.
+*
+* @param message - The error causing the connection to fail
+* @param code - The HTTP status code, if available
+* @internal
+*/
+scheduleReconnect_fn = function(message, code) {
+  var _a;
+  if (__privateGet(this, _readyState) === this.CLOSED)
+    return;
+  __privateSet(this, _readyState, this.CONNECTING);
+  let errorEvent = new ErrorEvent("error", { code, message });
+  (_a = __privateGet(this, _onError)) == null || _a.call(this, errorEvent), this.dispatchEvent(errorEvent), __privateSet(this, _reconnectTimer, setTimeout(__privateGet(this, _reconnect), __privateGet(this, _reconnectInterval)));
+}, _reconnect = /* @__PURE__ */ new WeakMap(), /**
+* ReadyState representing an EventSource currently trying to connect
+*
+* @public
+*/
+EventSource.CONNECTING = 0, /**
+* ReadyState representing an EventSource connection that is open (eg connected)
+*
+* @public
+*/
+EventSource.OPEN = 1, /**
+* ReadyState representing an EventSource connection that is closed (eg disconnected)
+*
+* @public
+*/
+EventSource.CLOSED = 2;
+function getBaseURL() {
+  let doc = "document" in globalThis ? globalThis.document : void 0;
+  return doc && typeof doc == "object" && "baseURI" in doc && typeof doc.baseURI == "string" ? doc.baseURI : void 0;
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/client/sse.js
+var SseError = class extends Error {
+  constructor(code, message, event) {
+    super(`SSE error: ${message}`), this.code = code, this.event = event;
+  }
+}, SSEClientTransport = class {
+  constructor(url2, opts) {
+    this._url = url2, this._resourceMetadataUrl = void 0, this._scope = void 0, this._eventSourceInit = opts?.eventSourceInit, this._requestInit = opts?.requestInit, this._authProvider = opts?.authProvider, this._fetch = opts?.fetch, this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit);
+  }
+  async _authThenStart() {
+    if (!this._authProvider)
+      throw new UnauthorizedError("No auth provider");
+    let result;
+    try {
+      result = await auth(this._authProvider, {
+        serverUrl: this._url,
+        resourceMetadataUrl: this._resourceMetadataUrl,
+        scope: this._scope,
+        fetchFn: this._fetchWithInit
+      });
+    } catch (error) {
+      throw this.onerror?.(error), error;
+    }
+    if (result !== "AUTHORIZED")
+      throw new UnauthorizedError();
+    return await this._startOrAuth();
+  }
+  async _commonHeaders() {
+    let headers = {};
+    if (this._authProvider) {
+      let tokens = await this._authProvider.tokens();
+      tokens && (headers.Authorization = `Bearer ${tokens.access_token}`);
+    }
+    this._protocolVersion && (headers["mcp-protocol-version"] = this._protocolVersion);
+    let extraHeaders = normalizeHeaders(this._requestInit?.headers);
+    return new Headers({
+      ...headers,
+      ...extraHeaders
+    });
+  }
+  _startOrAuth() {
+    let fetchImpl = this?._eventSourceInit?.fetch ?? this._fetch ?? fetch;
+    return new Promise((resolve2, reject) => {
+      this._eventSource = new EventSource(this._url.href, {
+        ...this._eventSourceInit,
+        fetch: async (url2, init) => {
+          let headers = await this._commonHeaders();
+          headers.set("Accept", "text/event-stream");
+          let response = await fetchImpl(url2, {
+            ...init,
+            headers
+          });
+          if (response.status === 401 && response.headers.has("www-authenticate")) {
+            let { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+            this._resourceMetadataUrl = resourceMetadataUrl, this._scope = scope;
+          }
+          return response;
+        }
+      }), this._abortController = new AbortController(), this._eventSource.onerror = (event) => {
+        if (event.code === 401 && this._authProvider) {
+          this._authThenStart().then(resolve2, reject);
+          return;
+        }
+        let error = new SseError(event.code, event.message, event);
+        reject(error), this.onerror?.(error);
+      }, this._eventSource.onopen = () => {
+      }, this._eventSource.addEventListener("endpoint", (event) => {
+        let messageEvent = event;
+        try {
+          if (this._endpoint = new URL(messageEvent.data, this._url), this._endpoint.origin !== this._url.origin)
+            throw new Error(`Endpoint origin does not match connection origin: ${this._endpoint.origin}`);
+        } catch (error) {
+          reject(error), this.onerror?.(error), this.close();
+          return;
+        }
+        resolve2();
+      }), this._eventSource.onmessage = (event) => {
+        let messageEvent = event, message;
+        try {
+          message = JSONRPCMessageSchema.parse(JSON.parse(messageEvent.data));
+        } catch (error) {
+          this.onerror?.(error);
+          return;
+        }
+        this.onmessage?.(message);
+      };
+    });
+  }
+  async start() {
+    if (this._eventSource)
+      throw new Error("SSEClientTransport already started! If using Client class, note that connect() calls start() automatically.");
+    return await this._startOrAuth();
+  }
+  /**
+   * Call this method after the user has finished authorizing via their user agent and is redirected back to the MCP client application. This will exchange the authorization code for an access token, enabling the next connection attempt to successfully auth.
+   */
+  async finishAuth(authorizationCode) {
+    if (!this._authProvider)
+      throw new UnauthorizedError("No auth provider");
+    if (await auth(this._authProvider, {
+      serverUrl: this._url,
+      authorizationCode,
+      resourceMetadataUrl: this._resourceMetadataUrl,
+      scope: this._scope,
+      fetchFn: this._fetchWithInit
+    }) !== "AUTHORIZED")
+      throw new UnauthorizedError("Failed to authorize");
+  }
+  async close() {
+    this._abortController?.abort(), this._eventSource?.close(), this.onclose?.();
+  }
+  async send(message) {
+    if (!this._endpoint)
+      throw new Error("Not connected");
+    try {
+      let headers = await this._commonHeaders();
+      headers.set("content-type", "application/json");
+      let init = {
+        ...this._requestInit,
+        method: "POST",
+        headers,
+        body: JSON.stringify(message),
+        signal: this._abortController?.signal
+      }, response = await (this._fetch ?? fetch)(this._endpoint, init);
+      if (!response.ok) {
+        let text = await response.text().catch(() => null);
+        if (response.status === 401 && this._authProvider) {
+          let { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+          if (this._resourceMetadataUrl = resourceMetadataUrl, this._scope = scope, await auth(this._authProvider, {
+            serverUrl: this._url,
+            resourceMetadataUrl: this._resourceMetadataUrl,
+            scope: this._scope,
+            fetchFn: this._fetchWithInit
+          }) !== "AUTHORIZED")
+            throw new UnauthorizedError();
+          return this.send(message);
+        }
+        throw new Error(`Error POSTing to endpoint (HTTP ${response.status}): ${text}`);
+      }
+      await response.body?.cancel();
+    } catch (error) {
+      throw this.onerror?.(error), error;
+    }
+  }
+  setProtocolVersion(version) {
+    this._protocolVersion = version;
+  }
+};
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/npx-resolver.js
+import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync, readdirSync, statSync, writeFileSync as writeFileSync2, renameSync, mkdirSync as mkdirSync2, openSync, readSync, closeSync } from "node:fs";
+import { join as join2, dirname, extname, resolve, sep } from "node:path";
+import { spawn, spawnSync } from "node:child_process";
+var CACHE_VERSION = 1, CACHE_TTL_MS = 1440 * 60 * 1e3;
+async function resolveNpxBinary(command, args) {
+  let parsed = command === "npx" ? parseNpxArgs(args) : command === "npm" ? parseNpmExecArgs(args) : null;
+  if (!parsed)
+    return null;
+  let cacheKey = JSON.stringify([command, ...args]), cached = loadCache()?.entries?.[cacheKey];
+  if (cached && Date.now() - cached.resolvedAt < CACHE_TTL_MS && existsSync2(cached.resolvedBin))
+    return { binPath: cached.resolvedBin, extraArgs: parsed.extraArgs, isJs: cached.isJs };
+  let resolved = resolveFromNpmCache(parsed.packageSpec, parsed.binName);
+  if (resolved)
+    return saveCacheEntry(cacheKey, resolved), { binPath: resolved.resolvedBin, extraArgs: parsed.extraArgs, isJs: resolved.isJs };
+  await forceNpxCache(parsed.packageSpec);
+  let resolvedAfterInstall = resolveFromNpmCache(parsed.packageSpec, parsed.binName);
+  return resolvedAfterInstall ? (saveCacheEntry(cacheKey, resolvedAfterInstall), { binPath: resolvedAfterInstall.resolvedBin, extraArgs: parsed.extraArgs, isJs: resolvedAfterInstall.isJs }) : null;
+}
+function parseNpxArgs(args) {
+  let separatorIndex = args.indexOf("--"), before = separatorIndex >= 0 ? args.slice(0, separatorIndex) : args, after = separatorIndex >= 0 ? args.slice(separatorIndex + 1) : [], positionals = [], packageSpec, sawPackageFlag = !1, foundFirstPositional = !1;
+  for (let i2 = 0; i2 < before.length; i2++) {
+    let arg = before[i2];
+    if (foundFirstPositional) {
+      positionals.push(arg);
+      continue;
+    }
+    if (!(arg === "-y" || arg === "--yes")) {
+      if (arg === "-p" || arg === "--package") {
+        let value = before[i2 + 1];
+        if (!value || value.startsWith("-"))
+          return null;
+        packageSpec || (packageSpec = value), sawPackageFlag = !0, i2++;
+        continue;
+      }
+      if (arg.startsWith("--package=")) {
+        let value = arg.slice(10);
+        if (!value)
+          return null;
+        packageSpec || (packageSpec = value), sawPackageFlag = !0;
+        continue;
+      }
+      if (arg.startsWith("-"))
+        return null;
+      positionals.push(arg), foundFirstPositional = !0;
+    }
+  }
+  let separatedAfter = separatorIndex >= 0 && after.length > 0 ? ["--", ...after] : after;
+  if (sawPackageFlag) {
+    let binName = positionals[0];
+    if (!packageSpec || !binName)
+      return null;
+    let extraArgs2 = positionals.slice(1).concat(separatedAfter);
+    return { packageSpec, binName, extraArgs: extraArgs2 };
+  }
+  let packagePositional = positionals[0];
+  if (!packagePositional)
+    return null;
+  let extraArgs = positionals.slice(1).concat(separatedAfter);
+  return { packageSpec: packagePositional, extraArgs };
+}
+function parseNpmExecArgs(args) {
+  if (args[0] !== "exec")
+    return null;
+  let execArgs = args.slice(1), separatorIndex = execArgs.indexOf("--");
+  if (separatorIndex < 0)
+    return null;
+  let before = execArgs.slice(0, separatorIndex), after = execArgs.slice(separatorIndex + 1), packageSpec;
+  for (let i2 = 0; i2 < before.length; i2++) {
+    let arg = before[i2];
+    if (!(arg === "-y" || arg === "--yes")) {
+      if (arg === "--package") {
+        let value = before[i2 + 1];
+        if (!value || value.startsWith("-"))
+          return null;
+        packageSpec || (packageSpec = value), i2++;
+        continue;
+      }
+      if (arg.startsWith("--package=")) {
+        let value = arg.slice(10);
+        if (!value)
+          return null;
+        packageSpec || (packageSpec = value);
+        continue;
+      }
+      if (arg.startsWith("-"))
+        return null;
+    }
+  }
+  let binName = after[0];
+  if (!packageSpec || !binName)
+    return null;
+  let extraArgs = after.slice(1);
+  return { packageSpec, binName, extraArgs };
+}
+function resolveFromNpmCache(packageSpec, binName) {
+  let cacheDir = getNpmCacheDir();
+  if (!cacheDir)
+    return null;
+  let packageName = extractPackageName(packageSpec);
+  if (!packageName)
+    return null;
+  let packageDir = findCachedPackageDir(cacheDir, packageName);
+  if (!packageDir)
+    return null;
+  let packageJsonPath = join2(packageDir, "package.json");
+  if (!existsSync2(packageJsonPath))
+    return null;
+  let pkg = null;
+  try {
+    pkg = JSON.parse(readFileSync2(packageJsonPath, "utf-8"));
+  } catch {
+    return null;
+  }
+  let binField = pkg?.bin;
+  if (!binField)
+    return null;
+  let candidates = buildBinCandidates(packageName, binName), chosenBinName, binRel;
+  if (typeof binField == "string")
+    chosenBinName = defaultBinName(packageName), binRel = binField;
+  else {
+    for (let candidate of candidates)
+      if (binField[candidate]) {
+        chosenBinName = candidate, binRel = binField[candidate];
+        break;
+      }
+    if (!binRel) {
+      let firstEntry = Object.entries(binField)[0];
+      firstEntry && (chosenBinName = firstEntry[0], binRel = firstEntry[1]);
+    }
+  }
+  if (!binRel)
+    return null;
+  let nodeModulesDir = findNodeModulesDir(packageDir), binLink = chosenBinName ? join2(nodeModulesDir, ".bin", chosenBinName) : null, resolvedBin = binLink && existsSync2(binLink) ? safeRealpath(binLink) : "";
+  if (!resolvedBin && (resolvedBin = resolve(packageDir, binRel), !existsSync2(resolvedBin)))
+    return null;
+  let isJs = detectJsBinary(resolvedBin);
+  return {
+    resolvedBin,
+    resolvedAt: Date.now(),
+    packageVersion: pkg?.version,
+    isJs
+  };
+}
+var FORCE_CACHE_TIMEOUT_MS = 3e4;
+async function forceNpxCache(packageSpec) {
+  try {
+    await new Promise((resolve2, reject) => {
+      let proc = spawn("npm", ["exec", "--yes", "--package", packageSpec, "--", "node", "-e", "1"], { stdio: "ignore" }), timer = setTimeout(() => {
+        proc.kill(), reject(new Error("timeout"));
+      }, FORCE_CACHE_TIMEOUT_MS);
+      timer.unref(), proc.on("close", () => {
+        clearTimeout(timer), resolve2();
+      }), proc.on("error", (err) => {
+        clearTimeout(timer), reject(err);
+      });
+    });
+  } catch {
+  }
+}
+function buildBinCandidates(packageName, explicitBin) {
+  let candidates = [];
+  if (explicitBin && candidates.push(explicitBin), packageName.startsWith("@")) {
+    let namePart = packageName.split("/")[1] ?? "", scopePart = packageName.split("/")[0]?.replace("@", "") ?? "";
+    namePart && candidates.push(namePart), scopePart && namePart && candidates.push(`${scopePart}-${namePart}`);
+  } else
+    candidates.push(packageName);
+  return [...new Set(candidates.filter(Boolean))];
+}
+function extractPackageName(spec) {
+  let trimmed = spec.trim();
+  if (!trimmed)
+    return null;
+  if (trimmed.startsWith("@")) {
+    let slashIndex = trimmed.indexOf("/");
+    if (slashIndex < 0)
+      return null;
+    let atIndex2 = trimmed.lastIndexOf("@");
+    return atIndex2 > slashIndex ? trimmed.slice(0, atIndex2) : trimmed;
+  }
+  let atIndex = trimmed.indexOf("@");
+  return atIndex >= 0 ? trimmed.slice(0, atIndex) : trimmed;
+}
+function defaultBinName(packageName) {
+  return packageName.startsWith("@") ? packageName.split("/")[1] ?? packageName.replace("@", "").replace("/", "-") : packageName;
+}
+function findCachedPackageDir(cacheDir, packageName) {
+  let npxDir = join2(cacheDir, "_npx");
+  if (!existsSync2(npxDir))
+    return null;
+  let packagePathParts = packageName.startsWith("@") ? packageName.split("/") : [packageName], candidates = readdirSync(npxDir, { withFileTypes: !0 }).filter((entry) => entry.isDirectory()).map((entry) => {
+    let full = join2(npxDir, entry.name), mtime = safeStatMtime(full);
+    return { name: entry.name, mtime };
+  }).sort((a2, b2) => b2.mtime - a2.mtime);
+  for (let entry of candidates) {
+    let pkgDir = join2(npxDir, entry.name, "node_modules", ...packagePathParts);
+    if (existsSync2(join2(pkgDir, "package.json")))
+      return pkgDir;
+  }
+  return null;
+}
+function findNodeModulesDir(packageDir) {
+  let parts = packageDir.split(sep), idx = parts.lastIndexOf("node_modules");
+  return idx >= 0 ? parts.slice(0, idx + 1).join(sep) : join2(packageDir, "..");
+}
+function detectJsBinary(binPath) {
+  let ext = extname(binPath).toLowerCase();
+  if (ext === ".js" || ext === ".mjs" || ext === ".cjs")
+    return !0;
+  try {
+    let fd = openSync(binPath, "r");
+    try {
+      let buf = Buffer.alloc(256);
+      readSync(fd, buf, 0, 256, 0);
+      let firstLine = buf.toString("utf-8").split(`
+`)[0] ?? "";
+      return firstLine.startsWith("#!") && firstLine.includes("node");
+    } finally {
+      closeSync(fd);
+    }
+  } catch {
+    return !1;
+  }
+}
+var npmCacheDirCached;
+function getNpmCacheDir() {
+  if (npmCacheDirCached !== void 0)
+    return npmCacheDirCached;
+  if (process.env.NPM_CONFIG_CACHE)
+    return npmCacheDirCached = process.env.NPM_CONFIG_CACHE, npmCacheDirCached;
+  try {
+    let result = spawnSync("npm", ["config", "get", "cache"], { encoding: "utf-8" });
+    if (result.status === 0)
+      return npmCacheDirCached = String(result.stdout).trim() || null, npmCacheDirCached;
+  } catch {
+    return npmCacheDirCached = null, null;
+  }
+  return npmCacheDirCached = null, null;
+}
+function getNpxCachePath() {
+  return getAgentPath("mcp-npx-cache.json");
+}
+function loadCache() {
+  let cachePath = getNpxCachePath();
+  if (!existsSync2(cachePath))
+    return null;
+  try {
+    let raw = JSON.parse(readFileSync2(cachePath, "utf-8"));
+    return !raw || typeof raw != "object" || raw.version !== CACHE_VERSION || !raw.entries || typeof raw.entries != "object" ? null : raw;
+  } catch {
+    return null;
+  }
+}
+function saveCacheEntry(key, entry) {
+  let cachePath = getNpxCachePath(), dir = dirname(cachePath);
+  mkdirSync2(dir, { recursive: !0 });
+  let merged = { version: CACHE_VERSION, entries: {} };
+  try {
+    if (existsSync2(cachePath)) {
+      let existing = JSON.parse(readFileSync2(cachePath, "utf-8"));
+      existing && existing.version === CACHE_VERSION && existing.entries && (merged.entries = { ...existing.entries });
+    }
+  } catch {
+  }
+  merged.entries[key] = entry;
+  let tmpPath = `${cachePath}.${process.pid}.tmp`;
+  writeFileSync2(tmpPath, JSON.stringify(merged, null, 2), "utf-8"), renameSync(tmpPath, cachePath);
+}
+function safeRealpath(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return "";
+  }
+}
+function safeStatMtime(path) {
+  try {
+    return statSync(path).mtimeMs;
+  } catch {
+    return 0;
+  }
+}
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/sampling-handler.js
+import { complete } from "@ashx-j/lunr-ai/compat";
+function registerSamplingHandler(client, options) {
+  client.setRequestHandler(CreateMessageRequestSchema, (request) => handleSamplingRequest(options, request));
+}
+async function handleSamplingRequest(options, request) {
+  let params = request.params;
+  if ("task" in params && params.task)
+    throw new Error("MCP sampling tasks are not supported");
+  if (params.includeContext && params.includeContext !== "none")
+    throw new Error("MCP sampling context inclusion is not supported");
+  if (params.tools?.length)
+    throw new Error("MCP sampling tool use is not supported");
+  if (params.toolChoice)
+    throw new Error("MCP sampling tool choice is not supported");
+  if (params.stopSequences?.length)
+    throw new Error("MCP sampling stop sequences are not supported");
+  let messages = params.messages.map(convertSamplingMessage), { model, apiKey, headers } = await resolveSamplingModel(options, params.modelPreferences);
+  await confirmSampling(options, "Approve MCP sampling request", formatRequestApproval(options.serverName, `${model.provider}/${model.id}`, params.systemPrompt, messages));
+  let result = await complete(model, {
+    systemPrompt: params.systemPrompt,
+    messages
+  }, {
+    apiKey,
+    headers,
+    maxTokens: params.maxTokens,
+    temperature: params.temperature,
+    metadata: params.metadata,
+    signal: options.getSignal()
+  }), converted = convertAssistantResult(result);
+  return await confirmSampling(options, "Return MCP sampling response", formatResponseApproval(options.serverName, converted)), converted;
+}
+function formatRequestApproval(serverName, modelName, systemPrompt, messages) {
+  let lines = [`${serverName} wants to sample ${messages.length} message${messages.length === 1 ? "" : "s"} with ${modelName}.`];
+  systemPrompt && lines.push(`System: ${truncateAtWord(systemPrompt, 400)}`);
+  for (let [index, message] of messages.entries())
+    lines.push(`${index + 1}. ${message.role}: ${truncateAtWord(messageText(message), 400)}`);
+  return lines.join(`
+
+`);
+}
+function formatResponseApproval(serverName, response) {
+  let text = response.content.type === "text" ? response.content.text : `[${response.content.type} content]`;
+  return `${serverName} will receive this response from ${response.model}:
+
+${truncateAtWord(text, 1e3)}`;
+}
+function messageText(message) {
+  return typeof message.content == "string" ? message.content : message.content.map((block) => block.type === "text" ? block.text : block.type === "image" ? `[image: ${block.mimeType}]` : block.type === "thinking" ? "[thinking]" : block.type === "toolCall" ? `[tool call: ${block.name}]` : "[content]").join(`
+`);
+}
+async function resolveSamplingModel(options, modelPreferences) {
+  let candidates = [], availableModels = options.modelRegistry.getAvailable();
+  for (let hint of modelPreferences?.hints ?? []) {
+    let normalizedHint = hint.name?.trim().toLowerCase();
+    if (normalizedHint)
+      for (let model of availableModels)
+        [`${model.provider}/${model.id}`, model.id, model.name].some((name) => name.toLowerCase().includes(normalizedHint)) && addSamplingCandidate(candidates, model);
+  }
+  let currentModel = options.getCurrentModel();
+  currentModel && addSamplingCandidate(candidates, currentModel);
+  for (let model of availableModels)
+    addSamplingCandidate(candidates, model);
+  let errors = [];
+  for (let model of candidates) {
+    let auth2 = await options.modelRegistry.getApiKeyAndHeaders(model);
+    if (auth2.ok === !1) {
+      errors.push(`${model.provider}/${model.id}: ${auth2.error}`);
+      continue;
+    }
+    return { model, apiKey: auth2.apiKey, headers: auth2.headers };
+  }
+  throw errors.length > 0 ? new Error(`No configured auth for MCP sampling model. ${errors.join("; ")}`) : new Error("No Pi model is available for MCP sampling");
+}
+function addSamplingCandidate(candidates, model) {
+  candidates.some((candidate) => candidate.provider === model.provider && candidate.id === model.id) || candidates.push(model);
+}
+async function confirmSampling(options, title, message) {
+  if (options.autoApprove)
+    return;
+  if (!options.ui)
+    throw new Error("MCP sampling requires interactive approval. Set settings.samplingAutoApprove to true to allow it without UI.");
+  if (!await options.ui.confirm(title, message))
+    throw new Error("MCP sampling request was declined");
+}
+function convertSamplingMessage(message) {
+  let blocks = Array.isArray(message.content) ? message.content : [message.content];
+  return message.role === "user" ? {
+    role: "user",
+    content: blocks.map(convertUserContent),
+    timestamp: Date.now()
+  } : {
+    role: "assistant",
+    content: blocks.map(convertAssistantContent),
+    api: "mcp-sampling",
+    provider: "mcp",
+    model: "sampling-request",
+    usage: zeroUsage(),
+    stopReason: "stop",
+    timestamp: Date.now()
+  };
+}
+function convertUserContent(block) {
+  if (block.type === "text")
+    return { type: "text", text: block.text };
+  throw new Error(`MCP sampling ${block.type} content is not supported`);
+}
+function convertAssistantContent(block) {
+  if (block.type === "text")
+    return { type: "text", text: block.text };
+  throw new Error(`MCP sampling assistant ${block.type} content is not supported`);
+}
+function convertAssistantResult(message) {
+  if (message.stopReason === "error")
+    throw new Error(message.errorMessage ?? "MCP sampling model call failed");
+  if (message.stopReason === "aborted")
+    throw new Error(message.errorMessage ?? "MCP sampling model call was aborted");
+  let text = message.content.map((block) => {
+    if (block.type === "text")
+      return block.text;
+    if (block.type !== "thinking")
+      throw new Error(`MCP sampling result ${block.type} content is not supported`);
+  }).filter((value) => value !== void 0).join(`
+
+`).trim();
+  if (!text)
+    throw new Error("MCP sampling result did not contain text content");
+  return {
+    role: "assistant",
+    content: { type: "text", text },
+    model: `${message.provider}/${message.model}`,
+    stopReason: mapStopReason(message.stopReason)
+  };
+}
+function mapStopReason(reason) {
+  return reason === "stop" ? "endTurn" : reason === "length" ? "maxTokens" : reason === "toolUse" ? "toolUse" : reason;
+}
+function zeroUsage() {
+  return {
+    input: 0,
+    output: 0,
+    cacheRead: 0,
+    cacheWrite: 0,
+    totalTokens: 0,
+    cost: {
+      input: 0,
+      output: 0,
+      cacheRead: 0,
+      cacheWrite: 0,
+      total: 0
+    }
+  };
+}
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/elicitation-handler.js
+import open2 from "open";
+function registerElicitationHandler(client, options) {
+  client.setRequestHandler(ElicitRequestSchema, (request) => handleElicitationRequest(options, request));
+}
+async function handleElicitationRequest(options, request) {
+  return request.params.mode === "url" ? handleUrlElicitation(options, request.params) : handleFormElicitation(options, request.params);
+}
+async function handleFormElicitation(options, params) {
+  let decision = await options.ui.select(`MCP Input Request
+Server: ${options.serverName}
+
+${params.message}`, ["Continue", "Decline"]);
+  if (decision === void 0)
+    return { action: "cancel" };
+  if (decision === "Decline")
+    return { action: "decline" };
+  let values = {}, properties = Object.entries(params.requestedSchema.properties);
+  for (let [name, schema] of properties) {
+    let value = await collectValidField(options.ui, params, name, schema);
+    if (!("value" in value))
+      return { action: "cancel" };
+    values[name] = value.value;
+  }
+  for (; ; ) {
+    let content = coerceAndValidateFormValues(params, values), action = await options.ui.select(formatReview(options.serverName, properties, content), properties.length > 0 ? ["Submit", "Edit", "Decline"] : ["Submit", "Decline"]);
+    if (action === void 0)
+      return { action: "cancel" };
+    if (action === "Decline")
+      return { action: "decline" };
+    if (action === "Submit")
+      return { action: "accept", content };
+    let labels = properties.map(([name2, schema2]) => `${schema2.title ?? humanizeName(name2)} (${name2})`), selected = await options.ui.select("Choose a field to edit", labels);
+    if (selected === void 0)
+      return { action: "cancel" };
+    let property = properties[labels.indexOf(selected)];
+    if (!property)
+      continue;
+    let [name, schema] = property, value = await collectValidField(options.ui, params, name, schema, values[name]);
+    if (!("value" in value))
+      return { action: "cancel" };
+    values[name] = value.value;
+  }
+}
+async function collectValidField(ui, params, name, schema, current) {
+  let required = params.requestedSchema.required?.includes(name) === !0;
+  for (; ; ) {
+    let result = await collectField(ui, params, name, schema, current);
+    if (!("value" in result))
+      return result;
+    try {
+      return coerceAndValidateFormValues({
+        ...params,
+        requestedSchema: {
+          type: "object",
+          properties: { [name]: schema },
+          ...required ? { required: [name] } : {}
+        }
+      }, { [name]: result.value }), result;
+    } catch (error) {
+      ui.notify(error instanceof Error ? error.message : String(error), "error"), current = result.value;
+    }
+  }
+}
+async function collectField(ui, params, name, schema, current) {
+  let required = params.requestedSchema.required?.includes(name) === !0, title = [schema.title ?? humanizeName(name), required ? "(required)" : "", schema.description].filter(Boolean).join(" ");
+  if (schema.type === "string" && ("enum" in schema || "oneOf" in schema)) {
+    let choices = "oneOf" in schema ? schema.oneOf.map((option) => ({ value: option.const, display: formatChoice(option.const, option.title) })) : schema.enum.map((value, index) => ({
+      value,
+      display: formatChoice(value, "enumNames" in schema ? schema.enumNames?.[index] : void 0)
+    })), displays = uniqueLabels(choices.map((choice) => choice.display)), actions2 = [...displays], useDefault = schema.default === void 0 ? void 0 : uniqueAction("Use default", actions2);
+    useDefault && actions2.push(useDefault);
+    let omit = required ? void 0 : uniqueAction("Omit", actions2);
+    omit && actions2.push(omit);
+    let action2 = await ui.select(title, actions2);
+    return action2 === void 0 ? { cancelled: !0 } : action2 === useDefault ? { cancelled: !1, value: schema.default } : action2 === omit ? { cancelled: !1, value: void 0 } : { cancelled: !1, value: choices[displays.indexOf(action2)]?.value };
+  }
+  if (schema.type === "boolean") {
+    let actions2 = ["Yes", "No"];
+    schema.default !== void 0 && actions2.push("Use default"), required || actions2.push("Omit");
+    let action2 = await ui.select(title, actions2);
+    return action2 === void 0 ? { cancelled: !0 } : action2 === "Use default" ? { cancelled: !1, value: schema.default } : action2 === "Omit" ? { cancelled: !1, value: void 0 } : { cancelled: !1, value: action2 === "Yes" };
+  }
+  if (schema.type === "array") {
+    let actions2 = ["Choose values"];
+    schema.default !== void 0 && actions2.push("Use default"), required || actions2.push("Omit");
+    let action2 = await ui.select(title, actions2);
+    if (action2 === void 0)
+      return { cancelled: !0 };
+    if (action2 === "Use default")
+      return { cancelled: !1, value: schema.default };
+    if (action2 === "Omit")
+      return { cancelled: !1, value: void 0 };
+    let choices = extractMultiSelectOptions(schema), selected = new Set(Array.isArray(current) ? current : []);
+    for (; ; ) {
+      let displays = uniqueLabels(choices.map((choice2) => selected.has(choice2.value) ? `\u2713 ${choice2.display}` : choice2.display)), done = uniqueAction("Done", displays), picked = await ui.select(title, [...displays, done]);
+      if (picked === void 0)
+        return { cancelled: !0 };
+      if (picked === done)
+        return { cancelled: !1, value: [...selected] };
+      let choice = choices[displays.indexOf(picked)];
+      choice && (selected.has(choice.value) ? selected.delete(choice.value) : selected.add(choice.value));
+    }
+  }
+  let actions = ["Enter value"];
+  schema.default !== void 0 && actions.push("Use default"), required || actions.push("Omit");
+  let action = await ui.select(title, actions);
+  if (action === void 0)
+    return { cancelled: !0 };
+  if (action === "Use default")
+    return { cancelled: !1, value: schema.default };
+  if (action === "Omit")
+    return { cancelled: !1, value: void 0 };
+  let entered = await ui.input(title, current === void 0 ? void 0 : String(current));
+  return entered === void 0 ? { cancelled: !0 } : { cancelled: !1, value: entered };
+}
+function coerceAndValidateFormValues(params, values) {
+  let output = {}, required = new Set(params.requestedSchema.required ?? []);
+  for (let [name, schema] of Object.entries(params.requestedSchema.properties)) {
+    let value = values[name];
+    if (value === void 0) {
+      if (required.has(name))
+        throw new Error(`Missing required elicitation field: ${name}`);
+      continue;
+    }
+    if (schema.type === "string") {
+      let stringValue = String(value), limits = schema;
+      if (limits.minLength !== void 0 && stringValue.length < limits.minLength)
+        throw new Error(`Elicitation field ${name} is shorter than minimum length ${limits.minLength}`);
+      if (limits.maxLength !== void 0 && stringValue.length > limits.maxLength)
+        throw new Error(`Elicitation field ${name} is longer than maximum length ${limits.maxLength}`);
+      if ("enum" in schema && !schema.enum.includes(stringValue))
+        throw new Error(`Elicitation field ${name} is not an allowed value`);
+      if ("oneOf" in schema && !schema.oneOf.some((option) => option.const === stringValue))
+        throw new Error(`Elicitation field ${name} is not an allowed value`);
+      output[name] = stringValue;
+      continue;
+    }
+    if (schema.type === "number" || schema.type === "integer") {
+      if (typeof value == "string" && value.trim() === "")
+        throw new Error(`Elicitation field ${name} must be a number`);
+      let numberValue = typeof value == "number" ? value : Number(value);
+      if (!Number.isFinite(numberValue))
+        throw new Error(`Elicitation field ${name} must be a number`);
+      if (schema.type === "integer" && !Number.isInteger(numberValue))
+        throw new Error(`Elicitation field ${name} must be an integer`);
+      if (schema.minimum !== void 0 && numberValue < schema.minimum)
+        throw new Error(`Elicitation field ${name} is below minimum ${schema.minimum}`);
+      if (schema.maximum !== void 0 && numberValue > schema.maximum)
+        throw new Error(`Elicitation field ${name} is above maximum ${schema.maximum}`);
+      output[name] = numberValue;
+      continue;
+    }
+    if (schema.type === "boolean") {
+      output[name] = typeof value == "boolean" ? value : value === "true";
+      continue;
+    }
+    if (schema.type === "array") {
+      if (!Array.isArray(value))
+        throw new Error(`Elicitation field ${name} must be a list`);
+      let allowed = new Set(extractMultiSelectOptions(schema).map((option) => option.value)), arrayValue = value.map(String);
+      if (schema.minItems !== void 0 && arrayValue.length < schema.minItems)
+        throw new Error(`Elicitation field ${name} has fewer than ${schema.minItems} selections`);
+      if (schema.maxItems !== void 0 && arrayValue.length > schema.maxItems)
+        throw new Error(`Elicitation field ${name} has more than ${schema.maxItems} selections`);
+      if (arrayValue.some((item) => !allowed.has(item)))
+        throw new Error(`Elicitation field ${name} contains an invalid selection`);
+      output[name] = arrayValue;
+    }
+  }
+  let validation = new AjvJsonSchemaValidator().getValidator(params.requestedSchema)(output);
+  if (!validation.valid)
+    throw new Error(`Invalid elicitation response: ${validation.errorMessage}`);
+  return output;
+}
+function formatChoice(value, title) {
+  return title && title !== value ? `${title} (${value})` : value;
+}
+function uniqueLabels(labels) {
+  let used = /* @__PURE__ */ new Set();
+  return labels.map((label) => {
+    let unique = label;
+    for (; used.has(unique); )
+      unique += "\u2026";
+    return used.add(unique), unique;
+  });
+}
+function uniqueAction(label, choices) {
+  let unique = label;
+  for (; choices.includes(unique); )
+    unique += "\u2026";
+  return unique;
+}
+function extractMultiSelectOptions(schema) {
+  let items = schema.items;
+  return items.anyOf ? items.anyOf.map((option) => ({ value: option.const, display: formatChoice(option.const, option.title) })) : (items.enum ?? []).map((value) => ({ value, display: value }));
+}
+function formatReview(serverName, properties, content) {
+  let rows = properties.map(([name, schema]) => `${schema.title ?? humanizeName(name)}: ${content[name] === void 0 ? "(omitted)" : String(content[name])}`);
+  return [`Review input for ${serverName}`, "", ...rows].join(`
+`);
+}
+async function handleUrlElicitation(options, params) {
+  if (!options.allowUrl)
+    throw new McpError(ErrorCode.InvalidParams, "URL elicitation is not supported");
+  let parsed;
+  try {
+    parsed = new URL(params.url);
+  } catch {
+    throw new McpError(ErrorCode.InvalidParams, "URL elicitation supplied an invalid URL");
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+    throw new McpError(ErrorCode.InvalidParams, "URL elicitation only supports HTTP and HTTPS URLs");
+  let decision = await options.ui.select([
+    "MCP Browser Request",
+    `Server: ${options.serverName}`,
+    "",
+    params.message,
+    "",
+    `Host: ${parsed.host}`,
+    `Full URL: ${params.url}`,
+    "",
+    "Open this URL in your browser?"
+  ].join(`
+`), ["Open", "Decline"]);
+  if (decision === void 0)
+    return { action: "cancel" };
+  if (decision === "Decline")
+    return { action: "decline" };
+  try {
+    await open2(params.url);
+  } catch (error) {
+    return options.ui.notify(`Could not open MCP elicitation URL: ${error instanceof Error ? error.message : String(error)}`, "error"), { action: "cancel" };
+  }
+  return options.onUrlAccepted?.(params.elicitationId), options.ui.notify("Opened browser for MCP elicitation.", "info"), { action: "accept" };
+}
+function humanizeName(name) {
+  return name.replace(/[_-]+/g, " ").replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/^./, (char) => char.toUpperCase());
+}
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/server-manager.js
+var McpServerManager = class {
+  defaultCwd;
+  connections = /* @__PURE__ */ new Map();
+  connectPromises = /* @__PURE__ */ new Map();
+  pendingConnections = /* @__PURE__ */ new Map();
+  closing = !1;
+  uiStreamListeners = /* @__PURE__ */ new Map();
+  samplingConfig;
+  elicitationConfig;
+  acceptedUrlElicitations = /* @__PURE__ */ new Map();
+  defaultRequestTimeoutMs;
+  /** Default cwd for stdio servers without an explicit config `cwd`. */
+  constructor(defaultCwd) {
+    this.defaultCwd = defaultCwd;
+  }
+  setSamplingConfig(config) {
+    this.samplingConfig = config;
+  }
+  setElicitationConfig(config) {
+    this.elicitationConfig = config;
+  }
+  setDefaultRequestTimeoutMs(timeoutMs) {
+    this.defaultRequestTimeoutMs = normalizeRequestTimeoutMs(timeoutMs);
+  }
+  getRequestOptions(name, signal) {
+    let connection = this.connections.get(name);
+    return this.buildRequestOptions(connection?.definition, signal);
+  }
+  getResolvedRequestTimeoutMs(definition) {
+    return definition?.requestTimeoutMs !== void 0 ? normalizeRequestTimeoutMs(definition.requestTimeoutMs) : this.defaultRequestTimeoutMs;
+  }
+  buildRequestOptions(definition, signal) {
+    let timeout = this.getResolvedRequestTimeoutMs(definition);
+    if (!(!signal && timeout === void 0))
+      return {
+        ...signal ? { signal } : {},
+        ...timeout !== void 0 ? { timeout } : {}
+      };
+  }
+  async connect(name, definition, signal) {
+    if (throwIfAborted(signal), this.closing)
+      throw new Error("MCP server manager is closed");
+    if (this.connectPromises.has(name))
+      return abortable(this.connectPromises.get(name), signal);
+    let existing = this.connections.get(name);
+    if (existing?.status === "connected")
+      return existing.lastUsedAt = Date.now(), existing;
+    let promise = this.createConnection(name, definition, signal).then(async (connection) => {
+      if (this.closing || signal?.aborted)
+        throw await this.disposeConnection(connection), throwIfAborted(signal), new Error("MCP server manager closed during connection");
+      return this.connections.set(name, connection), connection;
+    });
+    this.connectPromises.set(name, promise);
+    try {
+      return await promise;
+    } finally {
+      this.connectPromises.get(name) === promise && this.connectPromises.delete(name);
+    }
+  }
+  async createConnection(name, definition, signal) {
+    throwIfAborted(signal);
+    let client = this.createClient(name), transport;
+    if (definition.command) {
+      let command = definition.command, args = definition.args ?? [];
+      if (command === "npx" || command === "npm") {
+        let resolved = await resolveNpxBinary(command, args);
+        resolved && (command = resolved.isJs ? "node" : resolved.binPath, args = resolved.isJs ? [resolved.binPath, ...resolved.extraArgs] : resolved.extraArgs, logger.debug(`${name} resolved to ${resolved.binPath} (skipping npm parent)`));
+      }
+      transport = new StdioClientTransport({
+        command,
+        args,
+        env: resolveEnv(definition.env),
+        cwd: resolveConfigPath(definition.cwd) ?? this.defaultCwd,
+        stderr: definition.debug ? "inherit" : "ignore"
+      });
+    } else if (definition.url)
+      transport = await this.createHttpTransport(definition, name, signal);
+    else
+      throw new Error(`Server ${name} has no command or url`);
+    let requestOptions = this.buildRequestOptions(definition, signal), pending = { client, transport };
+    this.pendingConnections.set(name, pending);
+    try {
+      await client.connect(transport, requestOptions), this.attachAdapterNotificationHandlers(name, client);
+      let [tools, resources] = await Promise.all([
+        this.fetchAllTools(client, requestOptions),
+        this.fetchAllResources(client, requestOptions)
+      ]);
+      return {
+        client,
+        transport,
+        definition,
+        tools,
+        resources,
+        lastUsedAt: Date.now(),
+        inFlight: 0,
+        status: "connected"
+      };
+    } catch (error) {
+      if (error instanceof UnauthorizedError && supportsOAuth(definition))
+        return await client.close().catch(() => {
+        }), await transport.close().catch(() => {
+        }), {
+          client,
+          transport,
+          definition,
+          tools: [],
+          resources: [],
+          lastUsedAt: Date.now(),
+          inFlight: 0,
+          status: "needs-auth"
+        };
+      throw await client.close().catch(() => {
+      }), await transport.close().catch(() => {
+      }), error;
+    } finally {
+      this.pendingConnections.get(name) === pending && this.pendingConnections.delete(name);
+    }
+  }
+  buildClientCapabilities() {
+    return {
+      ...this.samplingConfig ? { sampling: {} } : {},
+      ...this.elicitationConfig ? {
+        elicitation: {
+          form: {},
+          ...this.elicitationConfig.allowUrl ? { url: {} } : {}
+        }
+      } : {}
+    };
+  }
+  createClient(serverName) {
+    let capabilities = this.buildClientCapabilities(), client = new Client({ name: `lunR-mcp-${serverName}`, version: "1.0.0" }, Object.keys(capabilities).length > 0 ? { capabilities } : void 0);
+    return this.samplingConfig && registerSamplingHandler(client, { ...this.samplingConfig, serverName }), this.elicitationConfig && (registerElicitationHandler(client, {
+      ...this.elicitationConfig,
+      serverName,
+      onUrlAccepted: (elicitationId) => this.rememberUrlElicitation(serverName, elicitationId)
+    }), this.elicitationConfig.allowUrl && client.setNotificationHandler(ElicitationCompleteNotificationSchema, (notification) => {
+      this.acceptedUrlElicitations.get(serverName)?.delete(notification.params.elicitationId) && this.elicitationConfig?.ui.notify(`MCP browser interaction for ${serverName} completed. You can retry the tool now.`, "info");
+    })), client;
+  }
+  async handleUrlElicitationRequired(serverName, error) {
+    if (!this.elicitationConfig?.allowUrl)
+      return "cancel";
+    for (let params of error.elicitations) {
+      let result = await handleUrlElicitation({
+        ...this.elicitationConfig,
+        serverName,
+        onUrlAccepted: (elicitationId) => this.rememberUrlElicitation(serverName, elicitationId)
+      }, params);
+      if (result.action !== "accept")
+        return result.action;
+    }
+    return "accept";
+  }
+  rememberUrlElicitation(serverName, elicitationId) {
+    let accepted = this.acceptedUrlElicitations.get(serverName);
+    accepted || (accepted = /* @__PURE__ */ new Set(), this.acceptedUrlElicitations.set(serverName, accepted)), accepted.add(elicitationId);
+  }
+  async createHttpTransport(definition, serverName, signal) {
+    throwIfAborted(signal);
+    let url2 = new URL(definition.url), headers = resolveHeaders(definition.headers) ?? {};
+    if (definition.auth === "bearer") {
+      let token = resolveBearerToken(definition);
+      token && (headers.Authorization = `Bearer ${token}`);
+    }
+    let requestInit = Object.keys(headers).length > 0 ? { headers } : void 0, authProvider;
+    if (supportsOAuth(definition)) {
+      let oauthConfig = extractOAuthConfig(definition);
+      authProvider = new McpOAuthProvider(serverName, definition.url, oauthConfig, {
+        onRedirect: async (_authUrl) => {
+        }
+      });
+    }
+    let streamableTransport = new StreamableHTTPClientTransport(url2, {
+      requestInit,
+      authProvider
+    });
+    try {
+      let testClient = new Client({ name: "lunR-mcp-probe", version: "2.1.2" });
+      return await testClient.connect(streamableTransport, this.buildRequestOptions(definition, signal)), await testClient.close().catch(() => {
+      }), await streamableTransport.close().catch(() => {
+      }), new StreamableHTTPClientTransport(url2, { requestInit, authProvider });
+    } catch (error) {
+      if (await streamableTransport.close().catch(() => {
+      }), signal?.aborted && throwIfAborted(signal), error instanceof UnauthorizedError)
+        throw error;
+      return new SSEClientTransport(url2, { requestInit, authProvider });
+    }
+  }
+  async fetchAllTools(client, requestOptions) {
+    let allTools = [], cursor;
+    do {
+      let result = await client.listTools(cursor ? { cursor } : void 0, requestOptions);
+      allTools.push(...result.tools ?? []), cursor = result.nextCursor;
+    } while (cursor);
+    return allTools;
+  }
+  async fetchAllResources(client, requestOptions) {
+    try {
+      let allResources = [], cursor;
+      do {
+        let result = await client.listResources(cursor ? { cursor } : void 0, requestOptions);
+        allResources.push(...result.resources ?? []), cursor = result.nextCursor;
+      } while (cursor);
+      return allResources;
+    } catch {
+      return requestOptions?.signal?.aborted && throwIfAborted(requestOptions.signal), [];
+    }
+  }
+  attachAdapterNotificationHandlers(serverName, client) {
+    client.setNotificationHandler(serverStreamResultPatchNotificationSchema, (notification) => {
+      let listener = this.uiStreamListeners.get(notification.params.streamToken);
+      listener && listener(serverName, notification.params);
+    });
+  }
+  registerUiStreamListener(streamToken, listener) {
+    this.uiStreamListeners.set(streamToken, listener);
+  }
+  removeUiStreamListener(streamToken) {
+    this.uiStreamListeners.delete(streamToken);
+  }
+  async readResource(name, uri, signal) {
+    let connection = this.connections.get(name);
+    if (!connection || connection.status !== "connected")
+      throw new Error(`Server "${name}" is not connected`);
+    try {
+      return this.touch(name), this.incrementInFlight(name), await connection.client.readResource({ uri }, this.getRequestOptions(name, signal));
+    } finally {
+      this.decrementInFlight(name), this.touch(name);
+    }
+  }
+  async disposeConnection(connection) {
+    await connection.client.close().catch(() => {
+    }), await connection.transport.close().catch(() => {
+    });
+  }
+  async close(name) {
+    let connection = this.connections.get(name);
+    connection && (connection.status = "closed", this.connections.delete(name), this.acceptedUrlElicitations.delete(name), await this.disposeConnection(connection));
+  }
+  async closeAll() {
+    this.closing = !0;
+    let names = [...this.connections.keys()], pending = [...this.pendingConnections.values()];
+    await Promise.all([
+      ...names.map((name) => this.close(name)),
+      ...pending.map((connection) => this.disposeConnection(connection))
+    ]);
+  }
+  getConnection(name) {
+    return this.connections.get(name);
+  }
+  getAllConnections() {
+    return new Map(this.connections);
+  }
+  touch(name) {
+    let connection = this.connections.get(name);
+    connection && (connection.lastUsedAt = Date.now());
+  }
+  incrementInFlight(name) {
+    let connection = this.connections.get(name);
+    connection && (connection.inFlight = (connection.inFlight ?? 0) + 1);
+  }
+  decrementInFlight(name) {
+    let connection = this.connections.get(name);
+    connection && connection.inFlight && connection.inFlight--;
+  }
+  isIdle(name, timeoutMs) {
+    let connection = this.connections.get(name);
+    return !connection || connection.status !== "connected" || connection.inFlight > 0 ? !1 : Date.now() - connection.lastUsedAt > timeoutMs;
+  }
+};
+function resolveEnv(env) {
+  let resolved = {};
+  for (let [key, value] of Object.entries(process.env))
+    value !== void 0 && (resolved[key] = value);
+  if (!env)
+    return resolved;
+  let overrides = interpolateEnvRecord(env);
+  return overrides ? { ...resolved, ...overrides } : resolved;
+}
+function resolveHeaders(headers) {
+  return interpolateEnvRecord(headers);
+}
+function normalizeRequestTimeoutMs(timeoutMs) {
+  return typeof timeoutMs == "number" && Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : void 0;
+}
+
+// node_modules/@modelcontextprotocol/ext-apps/dist/src/app-bridge.js
+var ZQ = ((X) => typeof __require < "u" ? __require : typeof Proxy < "u" ? new Proxy(X, { get: (Y, Z) => (typeof __require < "u" ? __require : Y)[Z] }) : X)(function(X) {
+  if (typeof __require < "u") return __require.apply(this, arguments);
+  throw Error('Dynamic require of "' + X + '" is not supported');
+});
+var r = external_exports.union([external_exports.literal("light"), external_exports.literal("dark")]).describe("Color theme preference for the host environment."), B = external_exports.union([external_exports.literal("inline"), external_exports.literal("fullscreen"), external_exports.literal("pip")]).describe("Display mode for UI presentation."), HQ = external_exports.union([external_exports.literal("--color-background-primary"), external_exports.literal("--color-background-secondary"), external_exports.literal("--color-background-tertiary"), external_exports.literal("--color-background-inverse"), external_exports.literal("--color-background-ghost"), external_exports.literal("--color-background-info"), external_exports.literal("--color-background-danger"), external_exports.literal("--color-background-success"), external_exports.literal("--color-background-warning"), external_exports.literal("--color-background-disabled"), external_exports.literal("--color-text-primary"), external_exports.literal("--color-text-secondary"), external_exports.literal("--color-text-tertiary"), external_exports.literal("--color-text-inverse"), external_exports.literal("--color-text-ghost"), external_exports.literal("--color-text-info"), external_exports.literal("--color-text-danger"), external_exports.literal("--color-text-success"), external_exports.literal("--color-text-warning"), external_exports.literal("--color-text-disabled"), external_exports.literal("--color-border-primary"), external_exports.literal("--color-border-secondary"), external_exports.literal("--color-border-tertiary"), external_exports.literal("--color-border-inverse"), external_exports.literal("--color-border-ghost"), external_exports.literal("--color-border-info"), external_exports.literal("--color-border-danger"), external_exports.literal("--color-border-success"), external_exports.literal("--color-border-warning"), external_exports.literal("--color-border-disabled"), external_exports.literal("--color-ring-primary"), external_exports.literal("--color-ring-secondary"), external_exports.literal("--color-ring-inverse"), external_exports.literal("--color-ring-info"), external_exports.literal("--color-ring-danger"), external_exports.literal("--color-ring-success"), external_exports.literal("--color-ring-warning"), external_exports.literal("--font-sans"), external_exports.literal("--font-mono"), external_exports.literal("--font-weight-normal"), external_exports.literal("--font-weight-medium"), external_exports.literal("--font-weight-semibold"), external_exports.literal("--font-weight-bold"), external_exports.literal("--font-text-xs-size"), external_exports.literal("--font-text-sm-size"), external_exports.literal("--font-text-md-size"), external_exports.literal("--font-text-lg-size"), external_exports.literal("--font-heading-xs-size"), external_exports.literal("--font-heading-sm-size"), external_exports.literal("--font-heading-md-size"), external_exports.literal("--font-heading-lg-size"), external_exports.literal("--font-heading-xl-size"), external_exports.literal("--font-heading-2xl-size"), external_exports.literal("--font-heading-3xl-size"), external_exports.literal("--font-text-xs-line-height"), external_exports.literal("--font-text-sm-line-height"), external_exports.literal("--font-text-md-line-height"), external_exports.literal("--font-text-lg-line-height"), external_exports.literal("--font-heading-xs-line-height"), external_exports.literal("--font-heading-sm-line-height"), external_exports.literal("--font-heading-md-line-height"), external_exports.literal("--font-heading-lg-line-height"), external_exports.literal("--font-heading-xl-line-height"), external_exports.literal("--font-heading-2xl-line-height"), external_exports.literal("--font-heading-3xl-line-height"), external_exports.literal("--border-radius-xs"), external_exports.literal("--border-radius-sm"), external_exports.literal("--border-radius-md"), external_exports.literal("--border-radius-lg"), external_exports.literal("--border-radius-xl"), external_exports.literal("--border-radius-full"), external_exports.literal("--border-width-regular"), external_exports.literal("--shadow-hairline"), external_exports.literal("--shadow-sm"), external_exports.literal("--shadow-md"), external_exports.literal("--shadow-lg")]).describe("CSS variable keys available to MCP apps for theming."), RQ = external_exports.record(HQ.describe(`Style variables for theming MCP apps.
+
+Individual style keys are optional - hosts may provide any subset of these values.
+Values are strings containing CSS values (colors, sizes, font stacks, etc.).
+
+Note: This type uses \`Record<K, string | undefined>\` rather than \`Partial<Record<K, string>>\`
+for compatibility with Zod schema generation. Both are functionally equivalent for validation.`), external_exports.union([external_exports.string(), external_exports.undefined()]).describe(`Style variables for theming MCP apps.
+
+Individual style keys are optional - hosts may provide any subset of these values.
+Values are strings containing CSS values (colors, sizes, font stacks, etc.).
+
+Note: This type uses \`Record<K, string | undefined>\` rather than \`Partial<Record<K, string>>\`
+for compatibility with Zod schema generation. Both are functionally equivalent for validation.`)).describe(`Style variables for theming MCP apps.
+
+Individual style keys are optional - hosts may provide any subset of these values.
+Values are strings containing CSS values (colors, sizes, font stacks, etc.).
+
+Note: This type uses \`Record<K, string | undefined>\` rather than \`Partial<Record<K, string>>\`
+for compatibility with Zod schema generation. Both are functionally equivalent for validation.`), L = external_exports.object({ method: external_exports.literal("ui/open-link"), params: external_exports.object({ url: external_exports.string().describe("URL to open in the host's browser") }) }), P = external_exports.object({ isError: external_exports.boolean().optional().describe("True if the host failed to open the URL (e.g., due to security policy).") }).passthrough(), A = external_exports.object({ isError: external_exports.boolean().optional().describe("True if the download failed (e.g., user cancelled or host denied).") }).passthrough(), U = external_exports.object({ isError: external_exports.boolean().optional().describe("True if the host rejected or failed to deliver the message.") }).passthrough(), w = external_exports.object({ method: external_exports.literal("ui/notifications/sandbox-proxy-ready"), params: external_exports.object({}) }), O = external_exports.object({ connectDomains: external_exports.array(external_exports.string()).optional().describe(`Origins for network requests (fetch/XHR/WebSocket).
+
+- Maps to CSP \`connect-src\` directive
+- Empty or omitted \u2192 no network connections (secure default)`), resourceDomains: external_exports.array(external_exports.string()).optional().describe("Origins for static resources (images, scripts, stylesheets, fonts, media).\n\n- Maps to CSP `img-src`, `script-src`, `style-src`, `font-src`, `media-src` directives\n- Wildcard subdomains supported: `https://*.example.com`\n- Empty or omitted \u2192 no network resources (secure default)"), frameDomains: external_exports.array(external_exports.string()).optional().describe("Origins for nested iframes.\n\n- Maps to CSP `frame-src` directive\n- Empty or omitted \u2192 no nested iframes allowed (`frame-src 'none'`)"), baseUriDomains: external_exports.array(external_exports.string()).optional().describe("Allowed base URIs for the document.\n\n- Maps to CSP `base-uri` directive\n- Empty or omitted \u2192 only same origin allowed (`base-uri 'self'`)") }), z = external_exports.object({ camera: external_exports.object({}).optional().describe("Request camera access.\n\nMaps to Permission Policy `camera` feature."), microphone: external_exports.object({}).optional().describe("Request microphone access.\n\nMaps to Permission Policy `microphone` feature."), geolocation: external_exports.object({}).optional().describe("Request geolocation access.\n\nMaps to Permission Policy `geolocation` feature."), clipboardWrite: external_exports.object({}).optional().describe("Request clipboard write access.\n\nMaps to Permission Policy `clipboard-write` feature.") }), H = external_exports.object({ method: external_exports.literal("ui/notifications/size-changed"), params: external_exports.object({ width: external_exports.number().optional().describe("New width in pixels."), height: external_exports.number().optional().describe("New height in pixels.") }) }), R = external_exports.object({ method: external_exports.literal("ui/notifications/tool-input"), params: external_exports.object({ arguments: external_exports.record(external_exports.string(), external_exports.unknown().describe("Complete tool call arguments as key-value pairs.")).optional().describe("Complete tool call arguments as key-value pairs.") }) }), T = external_exports.object({ method: external_exports.literal("ui/notifications/tool-input-partial"), params: external_exports.object({ arguments: external_exports.record(external_exports.string(), external_exports.unknown().describe("Partial tool call arguments (incomplete, may change).")).optional().describe("Partial tool call arguments (incomplete, may change).") }) }), M = external_exports.object({ method: external_exports.literal("ui/notifications/tool-cancelled"), params: external_exports.object({ reason: external_exports.string().optional().describe('Optional reason for the cancellation (e.g., "user action", "timeout").') }) }), o = external_exports.object({ fonts: external_exports.string().optional() }), s = external_exports.object({ variables: RQ.optional().describe("CSS variables for theming the app."), css: o.optional().describe("CSS blocks that apps can inject.") }), C = external_exports.object({ method: external_exports.literal("ui/resource-teardown"), params: external_exports.object({}) }), S = external_exports.record(external_exports.string(), external_exports.unknown()), F = external_exports.object({ text: external_exports.object({}).optional().describe("Host supports text content blocks."), image: external_exports.object({}).optional().describe("Host supports image content blocks."), audio: external_exports.object({}).optional().describe("Host supports audio content blocks."), resource: external_exports.object({}).optional().describe("Host supports resource content blocks."), resourceLink: external_exports.object({}).optional().describe("Host supports resource link content blocks."), structuredContent: external_exports.object({}).optional().describe("Host supports structured content.") }), q = external_exports.object({ method: external_exports.literal("ui/notifications/request-teardown"), params: external_exports.object({}).optional() }), t = external_exports.object({ experimental: external_exports.object({}).optional().describe("Experimental features (structure TBD)."), openLinks: external_exports.object({}).optional().describe("Host supports opening external URLs."), downloadFile: external_exports.object({}).optional().describe("Host supports file downloads via ui/download-file."), serverTools: external_exports.object({ listChanged: external_exports.boolean().optional().describe("Host supports tools/list_changed notifications.") }).optional().describe("Host can proxy tool calls to the MCP server."), serverResources: external_exports.object({ listChanged: external_exports.boolean().optional().describe("Host supports resources/list_changed notifications.") }).optional().describe("Host can proxy resource reads to the MCP server."), logging: external_exports.object({}).optional().describe("Host accepts log messages."), sandbox: external_exports.object({ permissions: z.optional().describe("Permissions granted by the host (camera, microphone, geolocation)."), csp: O.optional().describe("CSP domains approved by the host.") }).optional().describe("Sandbox configuration applied by the host."), updateModelContext: F.optional().describe("Host accepts context updates (ui/update-model-context) to be included in the model's context for future turns."), message: F.optional().describe("Host supports receiving content messages (ui/message) from the view."), sampling: external_exports.object({ tools: external_exports.object({}).optional().describe("Host supports tool use via `tools` and `toolChoice` parameters.") }).optional().describe("Host supports LLM sampling (sampling/createMessage) from the view.\nMirrors the MCP `ClientCapabilities.sampling` shape so hosts can pass it through.") }), a = external_exports.object({ experimental: external_exports.object({}).optional().describe("Experimental features (structure TBD)."), tools: external_exports.object({ listChanged: external_exports.boolean().optional().describe("App supports tools/list_changed notifications.") }).optional().describe("App exposes MCP-style tools that the host can call."), availableDisplayModes: external_exports.array(B).optional().describe("Display modes the app supports.") }), y = external_exports.object({ method: external_exports.literal("ui/notifications/initialized"), params: external_exports.object({}).optional() }), TQ = external_exports.object({ csp: O.optional().describe("Content Security Policy configuration for UI resources."), permissions: z.optional().describe("Sandbox permissions requested by the UI resource."), domain: external_exports.string().optional().describe(`Dedicated origin for view sandbox.
+
+Useful when views need stable, dedicated origins for OAuth callbacks, CORS policies, or API key allowlists.
+
+**Host-dependent:** The format and validation rules for this field are determined by each host. Servers MUST consult host-specific documentation for the expected domain format. Common patterns include:
+- Hash-based subdomains (e.g., \`{hash}.claudemcpcontent.com\`)
+- URL-derived subdomains (e.g., \`www-example-com.oaiusercontent.com\`)
+
+If omitted, host uses default sandbox origin (typically per-conversation).`), prefersBorder: external_exports.boolean().optional().describe(`Visual boundary preference - true if view prefers a visible border.
+
+Boolean requesting whether a visible border and background is provided by the host. Specifying an explicit value for this is recommended because hosts' defaults may vary.
+
+- \`true\`: request visible border + background
+- \`false\`: request no visible border + background
+- omitted: host decides border`) }), I = external_exports.object({ method: external_exports.literal("ui/request-display-mode"), params: external_exports.object({ mode: B.describe("The display mode being requested.") }) }), g = external_exports.object({ mode: B.describe("The display mode that was actually set. May differ from requested if not supported.") }).passthrough(), e = external_exports.union([external_exports.literal("model"), external_exports.literal("app")]).describe("Tool visibility scope - who can access the tool."), MQ = external_exports.object({ resourceUri: external_exports.string().optional(), visibility: external_exports.array(e).optional().describe(`Who can access this tool. Default: ["model", "app"]
+- "model": Tool visible to and callable by the agent
+- "app": Tool callable by the app from this server only`), csp: external_exports.never().optional(), permissions: external_exports.never().optional() }), OX = external_exports.object({ mimeTypes: external_exports.array(external_exports.string()).optional().describe('Array of supported MIME types for UI resources.\nMust include `"text/html;profile=mcp-app"` for MCP Apps support.') }), f = external_exports.object({ method: external_exports.literal("ui/download-file"), params: external_exports.object({ contents: external_exports.array(external_exports.union([EmbeddedResourceSchema, ResourceLinkSchema])).describe("Resource contents to download \u2014 embedded (inline data) or linked (host fetches). Uses standard MCP resource types.") }) }), k = external_exports.object({ method: external_exports.literal("ui/message"), params: external_exports.object({ role: external_exports.literal("user").describe('Message role, currently only "user" is supported.'), content: external_exports.array(ContentBlockSchema).describe("Message content blocks (text, image, etc.).") }) }), CQ = external_exports.object({ method: external_exports.literal("ui/notifications/sandbox-resource-ready"), params: external_exports.object({ html: external_exports.string().describe("HTML content to load into the inner iframe."), sandbox: external_exports.string().optional().describe("Optional override for the inner iframe's sandbox attribute."), csp: O.optional().describe("CSP configuration from resource metadata."), permissions: z.optional().describe("Sandbox permissions from resource metadata.") }) }), v = external_exports.object({ method: external_exports.literal("ui/notifications/tool-result"), params: CallToolResultSchema.describe("Standard MCP tool execution result.") }), x = external_exports.object({ toolInfo: external_exports.object({ id: RequestIdSchema.optional().describe("JSON-RPC id of the tools/call request."), tool: ToolSchema.describe("Tool definition including name, inputSchema, etc.") }).optional().describe("Metadata of the tool call that instantiated this App."), theme: r.optional().describe("Current color theme preference."), styles: s.optional().describe("Style configuration for theming the app."), displayMode: B.optional().describe("How the UI is currently displayed."), availableDisplayModes: external_exports.array(B).optional().describe("Display modes the host supports."), containerDimensions: external_exports.union([external_exports.object({ height: external_exports.number().describe("Fixed container height in pixels.") }), external_exports.object({ maxHeight: external_exports.union([external_exports.number(), external_exports.undefined()]).optional().describe("Maximum container height in pixels.") })]).and(external_exports.union([external_exports.object({ width: external_exports.number().describe("Fixed container width in pixels.") }), external_exports.object({ maxWidth: external_exports.union([external_exports.number(), external_exports.undefined()]).optional().describe("Maximum container width in pixels.") })])).optional().describe(`Container dimensions. Represents the dimensions of the iframe or other
+container holding the app. Specify either width or maxWidth, and either height or maxHeight.`), locale: external_exports.string().optional().describe("User's language and region preference in BCP 47 format."), timeZone: external_exports.string().optional().describe("User's timezone in IANA format."), userAgent: external_exports.string().optional().describe("Host application identifier."), platform: external_exports.union([external_exports.literal("web"), external_exports.literal("desktop"), external_exports.literal("mobile")]).optional().describe("Platform type for responsive design decisions."), deviceCapabilities: external_exports.object({ touch: external_exports.boolean().optional().describe("Whether the device supports touch input."), hover: external_exports.boolean().optional().describe("Whether the device supports hover interactions.") }).optional().describe("Device input capabilities."), safeAreaInsets: external_exports.object({ top: external_exports.number().describe("Top safe area inset in pixels."), right: external_exports.number().describe("Right safe area inset in pixels."), bottom: external_exports.number().describe("Bottom safe area inset in pixels."), left: external_exports.number().describe("Left safe area inset in pixels.") }).optional().describe("Mobile safe area boundaries in pixels.") }).passthrough(), b = external_exports.object({ method: external_exports.literal("ui/notifications/host-context-changed"), params: x.describe("Partial context update containing only changed fields.") }), d = external_exports.object({ method: external_exports.literal("ui/update-model-context"), params: external_exports.object({ content: external_exports.array(ContentBlockSchema).optional().describe("Context content blocks (text, image, etc.)."), structuredContent: external_exports.record(external_exports.string(), external_exports.unknown().describe("Structured content for machine-readable context data.")).optional().describe("Structured content for machine-readable context data.") }) }), u = external_exports.object({ method: external_exports.literal("ui/initialize"), params: external_exports.object({ appInfo: ImplementationSchema.describe("App identification (name and version)."), appCapabilities: a.describe("Features and capabilities this app provides."), protocolVersion: external_exports.string().describe("Protocol version this app supports.") }) }), h = external_exports.object({ protocolVersion: external_exports.string().describe('Negotiated protocol version string (e.g., "2025-11-21").'), hostInfo: ImplementationSchema.describe("Host application identification and version."), hostCapabilities: t.describe("Features and capabilities provided by the host."), hostContext: x.describe("Rich context about the host environment.") }).passthrough();
+var i = "ui/resourceUri", pQ = "text/html;profile=mcp-app";
+function FZ(X) {
+  let Z = X._meta?.ui?.resourceUri;
+  if (Z === void 0 && (Z = X._meta?.[i]), typeof Z == "string" && Z.startsWith("ui://")) return Z;
+  if (Z !== void 0) throw Error(`Invalid UI resource URI: ${JSON.stringify(Z)}`);
+}
+function AZ(X) {
+  if (!X) return "";
+  let Y = [];
+  return X.camera && Y.push("camera"), X.microphone && Y.push("microphone"), X.geolocation && Y.push("geolocation"), X.clipboardWrite && Y.push("clipboard-write"), Y.join("; ");
+}
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/tool-metadata.js
+function buildToolMetadata(tools, resources, definition, serverName, prefix) {
+  let metadata = [], failedTools = [];
+  for (let tool of tools) {
+    if (!tool?.name) {
+      failedTools.push("(unnamed)");
+      continue;
+    }
+    if (isToolExcluded(tool.name, serverName, prefix, definition.excludeTools))
+      continue;
+    let uiResourceUri;
+    try {
+      uiResourceUri = FZ({ _meta: tool._meta });
+    } catch {
+      failedTools.push(tool.name);
+    }
+    metadata.push({
+      name: formatToolName(tool.name, serverName, prefix),
+      originalName: tool.name,
+      description: tool.description ?? "",
+      inputSchema: tool.inputSchema,
+      uiResourceUri,
+      uiStreamMode: extractToolUiStreamMode(tool._meta)
+    });
+  }
+  if (definition.exposeResources !== !1)
+    for (let resource of resources) {
+      let baseName = `get_${resourceNameToToolName(resource.name)}`;
+      isToolExcluded(baseName, serverName, prefix, definition.excludeTools) || metadata.push({
+        name: formatToolName(baseName, serverName, prefix),
+        originalName: baseName,
+        description: resource.description ?? `Read resource: ${resource.uri}`,
+        resourceUri: resource.uri
+      });
+    }
+  return { metadata, failedTools };
+}
+function getToolNames(state, serverName) {
+  return state.toolMetadata.get(serverName)?.map((m) => m.name) ?? [];
+}
+function totalToolCount(state) {
+  let count = 0;
+  for (let metadata of state.toolMetadata.values())
+    count += metadata.length;
+  return count;
+}
+function findToolByName(metadata, toolName) {
+  if (!metadata)
+    return;
+  let exact = metadata.find((m) => m.name === toolName);
+  if (exact)
+    return exact;
+  let normalized = toolName.replace(/-/g, "_");
+  return metadata.find((m) => m.name.replace(/-/g, "_") === normalized);
+}
+function formatSchema(schema, indent = "  ") {
+  if (!schema || typeof schema != "object" || Array.isArray(schema))
+    return `${indent}(no schema)`;
+  let s2 = schema;
+  if (s2.type === "object" && s2.properties && typeof s2.properties == "object" && !Array.isArray(s2.properties)) {
+    let props = s2.properties, required = Array.isArray(s2.required) ? s2.required.filter((name) => typeof name == "string") : [];
+    if (Object.keys(props).length === 0)
+      return `${indent}(no parameters)`;
+    let lines2 = [];
+    for (let [name, propSchema] of Object.entries(props))
+      lines2.push(...formatProperty(name, propSchema, required.includes(name), indent));
+    return lines2.join(`
+`);
+  }
+  let lines = formatNestedSchema(s2, indent);
+  if (lines.length > 0)
+    return lines.join(`
+`);
+  let typeStr = formatType(s2);
+  return typeStr ? `${indent}(${typeStr})` : `${indent}(complex schema)`;
+}
+function formatProperty(name, schema, required, indent) {
+  if (!schema || typeof schema != "object" || Array.isArray(schema))
+    return [`${indent}${name}${required ? " *required*" : ""}`];
+  let s2 = schema, parts = [`${indent}${name}`], typeStr = formatType(s2);
+  return typeStr && parts.push(`(${typeStr})`), required && parts.push("*required*"), appendSchemaAnnotations(parts, s2), [parts.join(" "), ...formatNestedSchema(s2, `${indent}  `)];
+}
+function formatNestedSchema(schema, indent) {
+  let lines = [];
+  if (Array.isArray(schema.anyOf) && lines.push(...formatVariants("anyOf", schema.anyOf, indent)), Array.isArray(schema.oneOf) && lines.push(...formatVariants("oneOf", schema.oneOf, indent)), schema.items !== void 0 && lines.push(...formatProperty("items", schema.items, !1, indent)), schema.properties && typeof schema.properties == "object" && !Array.isArray(schema.properties)) {
+    let required = Array.isArray(schema.required) ? schema.required.filter((name) => typeof name == "string") : [];
+    for (let [name, propSchema] of Object.entries(schema.properties))
+      lines.push(...formatProperty(name, propSchema, required.includes(name), indent));
+  }
+  return lines;
+}
+function formatVariants(keyword, variants, indent) {
+  let lines = [`${indent}${keyword}:`];
+  for (let variant of variants) {
+    if (!variant || typeof variant != "object" || Array.isArray(variant)) {
+      lines.push(`${indent}  - ${JSON.stringify(variant)}`);
+      continue;
+    }
+    let s2 = variant, typeStr = formatType(s2) || "schema", parts = [`${indent}  - ${typeStr}`];
+    appendSchemaAnnotations(parts, s2), lines.push(parts.join(" ")), lines.push(...formatNestedSchema(s2, `${indent}    `));
+  }
+  return lines;
+}
+function formatType(schema) {
+  return Object.hasOwn(schema, "const") ? `const ${JSON.stringify(schema.const)}` : Array.isArray(schema.enum) ? `enum: ${schema.enum.map((v2) => JSON.stringify(v2)).join(", ")}` : Array.isArray(schema.type) ? schema.type.map((type) => String(type)).join(" | ") : schema.type ? String(schema.type) : schema.properties && typeof schema.properties == "object" && !Array.isArray(schema.properties) ? "object" : schema.items !== void 0 ? "array" : "";
+}
+function appendSchemaAnnotations(parts, schema) {
+  schema.description && typeof schema.description == "string" && parts.push(`- ${schema.description}`);
+  for (let key of ["minLength", "maxLength", "minimum", "maximum", "minItems", "maxItems", "format", "pattern"])
+    schema[key] !== void 0 && parts.push(`[${key}: ${JSON.stringify(schema[key])}]`);
+  schema.default !== void 0 && parts.push(`[default: ${JSON.stringify(schema.default)}]`);
+}
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/ui-resource-handler.js
+var UiResourceHandler = class {
+  manager;
+  log = logger.child({ component: "UiResourceHandler" });
+  constructor(manager) {
+    this.manager = manager;
+  }
+  async readUiResource(serverName, uri) {
+    let log = this.log.child({ server: serverName, uri });
+    if (!uri.startsWith("ui://"))
+      throw new ResourceParseError(uri, "URI must start with ui://", { server: serverName });
+    log.debug("Fetching UI resource");
+    let result;
+    try {
+      result = await this.manager.readResource(serverName, uri);
+    } catch (error) {
+      if (error instanceof UrlElicitationRequiredError)
+        throw error;
+      let message = error instanceof Error ? error.message : String(error);
+      throw log.error("Failed to read resource", error instanceof Error ? error : void 0), new ResourceFetchError(uri, message, {
+        server: serverName,
+        cause: error instanceof Error ? error : void 0
+      });
+    }
+    let content = selectContent(result, uri), mimeType = content.mimeType;
+    if (mimeType && !isHtmlMimeType(mimeType))
+      throw log.warn("Unsupported MIME type", { mimeType }), new ResourceParseError(uri, `unsupported MIME type "${mimeType}" (expected text/html or ${pQ})`, { server: serverName, mimeType });
+    let html = toHtml(content);
+    if (!html.trim())
+      throw log.warn("Resource content is empty"), new ResourceParseError(uri, "content is empty", { server: serverName });
+    let contentMeta = extractUiMeta(content._meta), listMeta = extractUiMeta(this.getListResourceMeta(serverName, uri));
+    return log.debug("Resource loaded successfully", {
+      contentLength: html.length,
+      hasCsp: !!contentMeta.csp || !!listMeta.csp
+    }), {
+      uri: content.uri ?? uri,
+      html,
+      mimeType: mimeType ?? pQ,
+      meta: {
+        csp: contentMeta.csp ?? listMeta.csp,
+        permissions: contentMeta.permissions ?? listMeta.permissions,
+        domain: contentMeta.domain ?? listMeta.domain,
+        prefersBorder: contentMeta.prefersBorder ?? listMeta.prefersBorder
+      }
+    };
+  }
+  getListResourceMeta(serverName, uri) {
+    let connection = this.manager.getConnection(serverName);
+    if (!connection?.resources?.length)
+      return;
+    let resource = connection.resources.find((entry) => entry.uri === uri);
+    if (!(!resource || !resource._meta || typeof resource._meta != "object"))
+      return resource._meta;
+  }
+};
+function selectContent(result, preferredUri) {
+  let contents = result.contents ?? [];
+  if (contents.length === 0)
+    throw new Error(`No contents returned for UI resource: ${preferredUri}`);
+  let byUri = contents.find((content) => content.uri === preferredUri);
+  if (byUri)
+    return byUri;
+  let byHtmlMime = contents.find((content) => content.mimeType && isHtmlMimeType(content.mimeType));
+  return byHtmlMime || contents[0];
+}
+function isHtmlMimeType(mimeType) {
+  let normalized = mimeType.toLowerCase();
+  return normalized.startsWith("text/html") || normalized === pQ.toLowerCase();
+}
+function toHtml(content) {
+  if (typeof content.text == "string")
+    return content.text;
+  if (typeof content.blob == "string")
+    return Buffer.from(content.blob, "base64").toString("utf-8");
+  throw new Error(`UI resource ${content.uri ?? "(unknown)"} did not include text or blob content`);
+}
+function extractUiMeta(meta) {
+  if (!meta || typeof meta != "object")
+    return {};
+  let ui = meta.ui;
+  if (!ui || typeof ui != "object")
+    return {};
+  let out = {};
+  return ui.csp && typeof ui.csp == "object" && (out.csp = ui.csp), ui.permissions && typeof ui.permissions == "object" && (out.permissions = ui.permissions), typeof ui.domain == "string" && (out.domain = ui.domain), typeof ui.prefersBorder == "boolean" && (out.prefersBorder = ui.prefersBorder), out;
+}
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/init.js
+var FAILURE_BACKOFF_MS = 60 * 1e3;
+function isTuiMode(ctx) {
+  return ctx.hasUI && ctx.mode === "tui";
+}
+async function initializeMcp(pi, ctx, options = {}) {
+  let signal = options.signal ?? ctx.signal;
+  throwIfAborted(signal);
+  let configPath = pi.getFlag("mcp-config"), config = loadMcpConfig(configPath, ctx.cwd, ctx.isProjectTrusted()), manager = new McpServerManager(ctx.cwd);
+  manager.setDefaultRequestTimeoutMs(config.settings?.requestTimeoutMs);
+  let samplingAutoApprove = config.settings?.samplingAutoApprove === !0;
+  config.settings?.sampling !== !1 && (ctx.hasUI || samplingAutoApprove) && manager.setSamplingConfig({
+    autoApprove: samplingAutoApprove,
+    ui: ctx.hasUI ? ctx.ui : void 0,
+    modelRegistry: ctx.modelRegistry,
+    getCurrentModel: () => ctx.model,
+    getSignal: () => ctx.signal
+  }), config.settings?.elicitation !== !1 && ctx.hasUI && manager.setElicitationConfig({
+    ui: ctx.ui,
+    allowUrl: isTuiMode(ctx)
+  });
+  let lifecycle = new McpLifecycleManager(manager), toolMetadata = /* @__PURE__ */ new Map(), failureTracker = /* @__PURE__ */ new Map(), uiResourceHandler = new UiResourceHandler(manager), consentManager = new ConsentManager("once-per-server"), ui = ctx.hasUI ? ctx.ui : void 0, state = {
+    authFlow: createMcpAuthFlow(),
+    manager,
+    lifecycle,
+    toolMetadata,
+    config,
+    failureTracker,
+    uiResourceHandler,
+    consentManager,
+    uiServer: null,
+    completedUiSessions: [],
+    openBrowser: (url2) => openUrl(pi, url2, process.env.BROWSER),
+    ui,
+    sendMessage: (message, options2) => pi.sendMessage(message, options2)
+  };
+  options.onState?.(state);
+  let serverEntries = Object.entries(config.mcpServers);
+  if (serverEntries.length === 0)
+    return state;
+  let idleSetting = typeof config.settings?.idleTimeout == "number" ? config.settings.idleTimeout : 10;
+  lifecycle.setGlobalIdleTimeout(idleSetting);
+  let cachePath = getMetadataCachePath(), cacheFileExists = existsSync3(cachePath), cache = loadMetadataCache(), bootstrapAll = !1;
+  cacheFileExists ? cache || (cache = { version: 1, servers: {} }, saveMetadataCache(cache)) : (bootstrapAll = !0, saveMetadataCache({ version: 1, servers: {} }));
+  let prefix = config.settings?.toolPrefix ?? "server";
+  for (let [name, definition] of serverEntries) {
+    let lifecycleMode = definition.lifecycle ?? "lazy", idleOverride = definition.idleTimeout ?? (lifecycleMode === "eager" ? 0 : void 0);
+    if (lifecycle.registerServer(name, definition, idleOverride !== void 0 ? { idleTimeout: idleOverride } : void 0), lifecycleMode === "keep-alive" && lifecycle.markKeepAlive(name, definition), cache?.servers?.[name] && isServerCacheValid(cache.servers[name], definition)) {
+      let metadata = reconstructToolMetadata(name, cache.servers[name], prefix, definition);
+      toolMetadata.set(name, metadata);
+    }
+  }
+  let startupServers = bootstrapAll ? serverEntries : serverEntries.filter(([, definition]) => {
+    let mode = definition.lifecycle ?? "lazy";
+    return mode === "keep-alive" || mode === "eager";
+  });
+  ctx.hasUI && startupServers.length > 0 && ctx.ui.setStatus("mcp", `MCP: connecting to ${startupServers.length} servers...`);
+  let results = await parallelLimit(startupServers, 10, async ([name, definition]) => {
+    try {
+      throwIfAborted(signal);
+      let connection = await manager.connect(name, definition, signal);
+      return connection.status === "needs-auth" ? { name, definition, connection: null, error: `OAuth authentication required. Run /mcp-auth ${name}.` } : { name, definition, connection, error: null };
+    } catch (error) {
+      let message = error instanceof Error ? error.message : String(error);
+      return { name, definition, connection: null, error: message };
+    }
+  });
+  throwIfAborted(signal);
+  for (let { name, definition, connection, error } of results) {
+    if (error || !connection) {
+      ctx.hasUI && ctx.ui.notify(`MCP: Failed to connect to ${name}: ${error}`, "error"), console.error(`MCP: Failed to connect to ${name}: ${error}`);
+      continue;
+    }
+    let { metadata, failedTools } = buildToolMetadata(connection.tools, connection.resources, definition, name, prefix);
+    toolMetadata.set(name, metadata), updateMetadataCache(state, name), failedTools.length > 0 && ctx.hasUI && ctx.ui.notify(`MCP: ${name} - ${failedTools.length} tools skipped`, "warning");
+  }
+  let connectedCount = results.filter((r2) => r2.connection).length, failedCount = results.filter((r2) => r2.error).length;
+  if (ctx.hasUI && connectedCount > 0) {
+    let totalTools = totalToolCount(state), msg = failedCount > 0 ? `MCP: ${connectedCount}/${startupServers.length} servers connected (${totalTools} tools)` : `MCP: ${connectedCount} servers connected (${totalTools} tools)`;
+    ctx.ui.notify(msg, "info");
+  }
+  if (process.env.MCP_DIRECT_TOOLS !== "__none__") {
+    let currentCache = loadMetadataCache(), missingCacheServers = getMissingConfiguredDirectToolServers(config, currentCache);
+    if (missingCacheServers.length > 0) {
+      let bootstrapResults = await parallelLimit(missingCacheServers.filter((name) => !results.some((r2) => r2.name === name && r2.connection)), 10, async (name) => {
+        let definition = config.mcpServers[name];
+        try {
+          throwIfAborted(signal);
+          let connection = await manager.connect(name, definition, signal);
+          if (connection.status === "needs-auth")
+            return { name, ok: !1 };
+          let { metadata } = buildToolMetadata(connection.tools, connection.resources, definition, name, prefix);
+          return toolMetadata.set(name, metadata), updateMetadataCache(state, name), { name, ok: !0 };
+        } catch (error) {
+          let message = error instanceof Error ? error.message : String(error);
+          return logger.debug(`MCP: direct-tools bootstrap failed for ${name}: ${message}`), { name, ok: !1 };
+        }
+      });
+      throwIfAborted(signal);
+      let bootstrapped = bootstrapResults.filter((r2) => r2.ok).map((r2) => r2.name);
+      bootstrapped.length > 0 && ctx.hasUI && ctx.ui.notify(`MCP: direct tools for ${bootstrapped.join(", ")} will be available after restart`, "info");
+    }
+  }
+  return lifecycle.setReconnectCallback((serverName) => {
+    updateServerMetadata(state, serverName), updateMetadataCache(state, serverName), state.failureTracker.delete(serverName), updateStatusBar(state);
+  }), lifecycle.setIdleShutdownCallback((serverName) => {
+    let idleMinutes = getEffectiveIdleTimeoutMinutes(state, serverName);
+    logger.debug(`${serverName} shut down (idle ${idleMinutes}m)`), updateStatusBar(state);
+  }), lifecycle.startHealthChecks(), state;
+}
+function updateServerMetadata(state, serverName) {
+  let connection = state.manager.getConnection(serverName);
+  if (!connection || connection.status !== "connected")
+    return;
+  let definition = state.config.mcpServers[serverName];
+  if (!definition)
+    return;
+  let prefix = state.config.settings?.toolPrefix ?? "server", { metadata } = buildToolMetadata(connection.tools, connection.resources, definition, serverName, prefix);
+  state.toolMetadata.set(serverName, metadata);
+}
+function updateMetadataCache(state, serverName) {
+  let connection = state.manager.getConnection(serverName);
+  if (!connection || connection.status !== "connected")
+    return;
+  let definition = state.config.mcpServers[serverName];
+  if (!definition)
+    return;
+  let configHash = computeServerHash(definition), existingEntry = loadMetadataCache()?.servers?.[serverName], tools = serializeTools(connection.tools), resources = definition.exposeResources === !1 ? [] : serializeResources(connection.resources);
+  definition.exposeResources !== !1 && resources.length === 0 && existingEntry?.resources?.length && existingEntry.configHash === configHash && (resources = existingEntry.resources);
+  let entry = {
+    configHash,
+    tools,
+    resources,
+    cachedAt: Date.now()
+  };
+  saveMetadataCache({ version: 1, servers: { [serverName]: entry } });
+}
+function flushMetadataCache(state) {
+  for (let [name, connection] of state.manager.getAllConnections())
+    connection.status === "connected" && updateMetadataCache(state, name);
+}
+function updateStatusBar(state) {
+  let ui = state.ui;
+  if (!ui)
+    return;
+  let total = Object.keys(state.config.mcpServers).length;
+  if (total === 0) {
+    ui.setStatus("mcp", void 0);
+    return;
+  }
+  let connectedCount = state.manager.getAllConnections().size;
+  ui.setStatus("mcp", ui.theme.fg("accent", `MCP: ${connectedCount}/${total} servers`));
+}
+function getFailureAgeSeconds(state, serverName) {
+  let failedAt = state.failureTracker.get(serverName);
+  if (!failedAt)
+    return null;
+  let ageMs = Date.now() - failedAt;
+  return ageMs > FAILURE_BACKOFF_MS ? null : Math.round(ageMs / 1e3);
+}
+async function lazyConnect(state, serverName, signal) {
+  let connection = state.manager.getConnection(serverName);
+  if (connection?.status === "needs-auth")
+    return !1;
+  if (connection?.status === "connected")
+    return updateServerMetadata(state, serverName), !0;
+  if (getFailureAgeSeconds(state, serverName) !== null)
+    return !1;
+  let definition = state.config.mcpServers[serverName];
+  if (!definition)
+    return !1;
+  try {
+    return state.ui && state.ui.setStatus("mcp", `MCP: connecting to ${serverName}...`), (await state.manager.connect(serverName, definition, signal)).status === "needs-auth" ? !1 : (state.failureTracker.delete(serverName), updateServerMetadata(state, serverName), updateMetadataCache(state, serverName), updateStatusBar(state), !0);
+  } catch (error) {
+    signal?.aborted && throwIfAborted(signal), state.failureTracker.set(serverName, Date.now());
+    let message = error instanceof Error ? error.message : String(error);
+    return logger.debug(`MCP: lazy connect failed for ${serverName}: ${message}`), updateStatusBar(state), !1;
+  }
+}
+function getEffectiveIdleTimeoutMinutes(state, serverName) {
+  let definition = state.config.mcpServers[serverName];
+  return definition ? typeof definition.idleTimeout == "number" ? definition.idleTimeout : (definition.lifecycle ?? "lazy") === "eager" ? 0 : typeof state.config.settings?.idleTimeout == "number" ? state.config.settings.idleTimeout : 10 : typeof state.config.settings?.idleTimeout == "number" ? state.config.settings.idleTimeout : 10;
+}
+
+export {
+  getAuthForUrl,
+  supportsOAuth,
+  ServerError2 as ServerError,
+  wrapError,
+  logger,
+  AZ,
+  buildToolMetadata,
+  getToolNames,
+  findToolByName,
+  formatSchema,
+  isTuiMode,
+  initializeMcp,
+  updateServerMetadata,
+  updateMetadataCache,
+  flushMetadataCache,
+  updateStatusBar,
+  getFailureAgeSeconds,
+  lazyConnect
+};
+/*! Bundled license information:
+
+content-type/index.js:
+  (*!
+   * content-type
+   * Copyright(c) 2015 Douglas Christopher Wilson
+   * MIT Licensed
+   *)
+*/