@ashx-j/lunr 0.2.26 → 0.2.27

package/dist/node-runtime/{chunk-4SBQAI4T.js → chunk-EBLAZVSA.js}

@@ -1,23 +1,8 @@
 import { createRequire as __lunrRequire } from "node:module"; const require = __lunrRequire(import.meta.url);
 import {
   AjvJsonSchemaValidator,
-  Client,
-  StdioClientTransport
-} from "./chunk-LWJXTA6Z.js";
-import {
-  McpOAuthProvider,
-  StreamableHTTPClientTransport,
-  UnauthorizedError,
-  auth,
-  createFetchWithInit,
-  createParser,
-  extractOAuthConfig,
-  extractWWWAuthenticateParams,
-  normalizeHeaders,
-  supportsOAuth
-} from "./chunk-7IQGBKBJ.js";
-import {
   CallToolResultSchema,
+  Client,
   ContentBlockSchema,
   CreateMessageRequestSchema,
   ElicitRequestSchema,
@@ -26,16 +11,22 @@ import {
   ErrorCode,
   ImplementationSchema,
   JSONRPCMessageSchema,
+  LATEST_PROTOCOL_VERSION,
   McpError,
   RequestIdSchema,
   ResourceLinkSchema,
+  StdioClientTransport,
   ToolSchema,
-  UrlElicitationRequiredError
-} from "./chunk-2IDTZAG5.js";
+  UrlElicitationRequiredError,
+  isInitializedNotification,
+  isJSONRPCRequest,
+  isJSONRPCResultResponse
+} from "./chunk-VSUEAI7O.js";
 import {
   abortable,
   computeServerHash,
   extractToolUiStreamMode,
+  getAgentPath,
   getMetadataCachePath,
   getMissingConfiguredDirectToolServers,
   interpolateEnvRecord,
@@ -52,10 +43,7 @@ import {
   serializeTools,
   throwIfAborted,
   truncateAtWord
-} from "./chunk-LWYIVUGV.js";
-import {
-  getAgentPath
-} from "./chunk-4HXHDDCF.js";
+} from "./chunk-B2IBAXNX.js";
 import {
   formatToolName,
   isToolExcluded,
@@ -63,14 +51,1999 @@ import {
   serverStreamResultPatchNotificationSchema
 } from "./chunk-ARC4KOTI.js";
 import {
-  external_exports
+  NEVER,
+  ZodIssueCode,
+  any,
+  array,
+  boolean,
+  coerce_exports,
+  external_exports,
+  literal,
+  looseObject,
+  number,
+  object,
+  string,
+  url
 } from "./chunk-BI3DHYCN.js";
 import {
-  __require
+  __commonJS,
+  __require,
+  __toESM
 } from "./chunk-BRJX2PRC.js";
 
+// node_modules/content-type/index.js
+var require_content_type = __commonJS({
+  "node_modules/content-type/index.js"(exports) {
+    "use strict";
+    var PARAM_REGEXP = /; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g, TEXT_REGEXP = /^[\u000b\u0020-\u007e\u0080-\u00ff]+$/, TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/, QESC_REGEXP = /\\([\u000b\u0020-\u00ff])/g, QUOTE_REGEXP = /([\\"])/g, TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+    exports.format = format;
+    exports.parse = parse;
+    function format(obj) {
+      if (!obj || typeof obj != "object")
+        throw new TypeError("argument obj is required");
+      var parameters = obj.parameters, type = obj.type;
+      if (!type || !TYPE_REGEXP.test(type))
+        throw new TypeError("invalid type");
+      var string2 = type;
+      if (parameters && typeof parameters == "object")
+        for (var param, params = Object.keys(parameters).sort(), i2 = 0; i2 < params.length; i2++) {
+          if (param = params[i2], !TOKEN_REGEXP.test(param))
+            throw new TypeError("invalid parameter name");
+          string2 += "; " + param + "=" + qstring(parameters[param]);
+        }
+      return string2;
+    }
+    function parse(string2) {
+      if (!string2)
+        throw new TypeError("argument string is required");
+      var header = typeof string2 == "object" ? getcontenttype(string2) : string2;
+      if (typeof header != "string")
+        throw new TypeError("argument string is required to be a string");
+      var index = header.indexOf(";"), type = index !== -1 ? header.slice(0, index).trim() : header.trim();
+      if (!TYPE_REGEXP.test(type))
+        throw new TypeError("invalid media type");
+      var obj = new ContentType(type.toLowerCase());
+      if (index !== -1) {
+        var key, match, value;
+        for (PARAM_REGEXP.lastIndex = index; match = PARAM_REGEXP.exec(header); ) {
+          if (match.index !== index)
+            throw new TypeError("invalid parameter format");
+          index += match[0].length, key = match[1].toLowerCase(), value = match[2], value.charCodeAt(0) === 34 && (value = value.slice(1, -1), value.indexOf("\\") !== -1 && (value = value.replace(QESC_REGEXP, "$1"))), obj.parameters[key] = value;
+        }
+        if (index !== header.length)
+          throw new TypeError("invalid parameter format");
+      }
+      return obj;
+    }
+    function getcontenttype(obj) {
+      var header;
+      if (typeof obj.getHeader == "function" ? header = obj.getHeader("content-type") : typeof obj.headers == "object" && (header = obj.headers && obj.headers["content-type"]), typeof header != "string")
+        throw new TypeError("content-type header is missing from object");
+      return header;
+    }
+    function qstring(val) {
+      var str = String(val);
+      if (TOKEN_REGEXP.test(str))
+        return str;
+      if (str.length > 0 && !TEXT_REGEXP.test(str))
+        throw new TypeError("invalid parameter value");
+      return '"' + str.replace(QUOTE_REGEXP, "\\$1") + '"';
+    }
+    function ContentType(type) {
+      this.parameters = /* @__PURE__ */ Object.create(null), this.type = type;
+    }
+  }
+});
+
+// node_modules/pkce-challenge/dist/index.node.js
+var crypto2;
+crypto2 = globalThis.crypto?.webcrypto ?? // Node.js [18-16] REPL
+globalThis.crypto ?? // Node.js >18
+import("node:crypto").then((m) => m.webcrypto);
+async function getRandomValues(size) {
+  return (await crypto2).getRandomValues(new Uint8Array(size));
+}
+async function random(size) {
+  let mask = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~", evenDistCutoff = Math.pow(2, 8) - Math.pow(2, 8) % mask.length, result = "";
+  for (; result.length < size; ) {
+    let randomBytes = await getRandomValues(size - result.length);
+    for (let randomByte of randomBytes)
+      randomByte < evenDistCutoff && (result += mask[randomByte % mask.length]);
+  }
+  return result;
+}
+async function generateVerifier(length) {
+  return await random(length);
+}
+async function generateChallenge(code_verifier) {
+  let buffer = await (await crypto2).subtle.digest("SHA-256", new TextEncoder().encode(code_verifier));
+  return btoa(String.fromCharCode(...new Uint8Array(buffer))).replace(/\//g, "_").replace(/\+/g, "-").replace(/=/g, "");
+}
+async function pkceChallenge(length) {
+  if (length || (length = 43), length < 43 || length > 128)
+    throw `Expected a length between 43 and 128. Received ${length}.`;
+  let verifier = await generateVerifier(length), challenge = await generateChallenge(verifier);
+  return {
+    code_verifier: verifier,
+    code_challenge: challenge
+  };
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
+var SafeUrlSchema = url().superRefine((val, ctx) => {
+  if (!URL.canParse(val))
+    return ctx.addIssue({
+      code: ZodIssueCode.custom,
+      message: "URL must be parseable",
+      fatal: !0
+    }), NEVER;
+}).refine((url2) => {
+  let u2 = new URL(url2);
+  return u2.protocol !== "javascript:" && u2.protocol !== "data:" && u2.protocol !== "vbscript:";
+}, { message: "URL cannot use javascript:, data:, or vbscript: scheme" }), OAuthProtectedResourceMetadataSchema = looseObject({
+  resource: string().url(),
+  authorization_servers: array(SafeUrlSchema).optional(),
+  jwks_uri: string().url().optional(),
+  scopes_supported: array(string()).optional(),
+  bearer_methods_supported: array(string()).optional(),
+  resource_signing_alg_values_supported: array(string()).optional(),
+  resource_name: string().optional(),
+  resource_documentation: string().optional(),
+  resource_policy_uri: string().url().optional(),
+  resource_tos_uri: string().url().optional(),
+  tls_client_certificate_bound_access_tokens: boolean().optional(),
+  authorization_details_types_supported: array(string()).optional(),
+  dpop_signing_alg_values_supported: array(string()).optional(),
+  dpop_bound_access_tokens_required: boolean().optional()
+}), OAuthMetadataSchema = looseObject({
+  issuer: string(),
+  authorization_endpoint: SafeUrlSchema,
+  token_endpoint: SafeUrlSchema,
+  registration_endpoint: SafeUrlSchema.optional(),
+  scopes_supported: array(string()).optional(),
+  response_types_supported: array(string()),
+  response_modes_supported: array(string()).optional(),
+  grant_types_supported: array(string()).optional(),
+  token_endpoint_auth_methods_supported: array(string()).optional(),
+  token_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+  service_documentation: SafeUrlSchema.optional(),
+  revocation_endpoint: SafeUrlSchema.optional(),
+  revocation_endpoint_auth_methods_supported: array(string()).optional(),
+  revocation_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+  introspection_endpoint: string().optional(),
+  introspection_endpoint_auth_methods_supported: array(string()).optional(),
+  introspection_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+  code_challenge_methods_supported: array(string()).optional(),
+  client_id_metadata_document_supported: boolean().optional()
+}), OpenIdProviderMetadataSchema = looseObject({
+  issuer: string(),
+  authorization_endpoint: SafeUrlSchema,
+  token_endpoint: SafeUrlSchema,
+  userinfo_endpoint: SafeUrlSchema.optional(),
+  jwks_uri: SafeUrlSchema,
+  registration_endpoint: SafeUrlSchema.optional(),
+  scopes_supported: array(string()).optional(),
+  response_types_supported: array(string()),
+  response_modes_supported: array(string()).optional(),
+  grant_types_supported: array(string()).optional(),
+  acr_values_supported: array(string()).optional(),
+  subject_types_supported: array(string()),
+  id_token_signing_alg_values_supported: array(string()),
+  id_token_encryption_alg_values_supported: array(string()).optional(),
+  id_token_encryption_enc_values_supported: array(string()).optional(),
+  userinfo_signing_alg_values_supported: array(string()).optional(),
+  userinfo_encryption_alg_values_supported: array(string()).optional(),
+  userinfo_encryption_enc_values_supported: array(string()).optional(),
+  request_object_signing_alg_values_supported: array(string()).optional(),
+  request_object_encryption_alg_values_supported: array(string()).optional(),
+  request_object_encryption_enc_values_supported: array(string()).optional(),
+  token_endpoint_auth_methods_supported: array(string()).optional(),
+  token_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+  display_values_supported: array(string()).optional(),
+  claim_types_supported: array(string()).optional(),
+  claims_supported: array(string()).optional(),
+  service_documentation: string().optional(),
+  claims_locales_supported: array(string()).optional(),
+  ui_locales_supported: array(string()).optional(),
+  claims_parameter_supported: boolean().optional(),
+  request_parameter_supported: boolean().optional(),
+  request_uri_parameter_supported: boolean().optional(),
+  require_request_uri_registration: boolean().optional(),
+  op_policy_uri: SafeUrlSchema.optional(),
+  op_tos_uri: SafeUrlSchema.optional(),
+  client_id_metadata_document_supported: boolean().optional()
+}), OpenIdProviderDiscoveryMetadataSchema = object({
+  ...OpenIdProviderMetadataSchema.shape,
+  ...OAuthMetadataSchema.pick({
+    code_challenge_methods_supported: !0
+  }).shape
+}), OAuthTokensSchema = object({
+  access_token: string(),
+  id_token: string().optional(),
+  // Optional for OAuth 2.1, but necessary in OpenID Connect
+  token_type: string(),
+  expires_in: coerce_exports.number().optional(),
+  scope: string().optional(),
+  refresh_token: string().optional()
+}).strip(), OAuthErrorResponseSchema = object({
+  error: string(),
+  error_description: string().optional(),
+  error_uri: string().optional()
+}), OptionalSafeUrlSchema = SafeUrlSchema.optional().or(literal("").transform(() => {
+})), OAuthClientMetadataSchema = object({
+  redirect_uris: array(SafeUrlSchema),
+  token_endpoint_auth_method: string().optional(),
+  grant_types: array(string()).optional(),
+  response_types: array(string()).optional(),
+  client_name: string().optional(),
+  client_uri: SafeUrlSchema.optional(),
+  logo_uri: OptionalSafeUrlSchema,
+  scope: string().optional(),
+  contacts: array(string()).optional(),
+  tos_uri: OptionalSafeUrlSchema,
+  policy_uri: string().optional(),
+  jwks_uri: SafeUrlSchema.optional(),
+  jwks: any().optional(),
+  software_id: string().optional(),
+  software_version: string().optional(),
+  software_statement: string().optional()
+}).strip(), OAuthClientInformationSchema = object({
+  client_id: string(),
+  client_secret: string().optional(),
+  client_id_issued_at: number().optional(),
+  client_secret_expires_at: number().optional()
+}).strip(), OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema), OAuthClientRegistrationErrorSchema = object({
+  error: string(),
+  error_description: string().optional()
+}).strip(), OAuthTokenRevocationRequestSchema = object({
+  token: string(),
+  token_type_hint: string().optional()
+}).strip();
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth-utils.js
+function resourceUrlFromServerUrl(url2) {
+  let resourceURL = typeof url2 == "string" ? new URL(url2) : new URL(url2.href);
+  return resourceURL.hash = "", resourceURL;
+}
+function checkResourceAllowed({ requestedResource, configuredResource }) {
+  let requested = typeof requestedResource == "string" ? new URL(requestedResource) : new URL(requestedResource.href), configured = typeof configuredResource == "string" ? new URL(configuredResource) : new URL(configuredResource.href);
+  if (requested.origin !== configured.origin || requested.pathname.length < configured.pathname.length)
+    return !1;
+  let requestedPath = requested.pathname.endsWith("/") ? requested.pathname : requested.pathname + "/", configuredPath = configured.pathname.endsWith("/") ? configured.pathname : configured.pathname + "/";
+  return requestedPath.startsWith(configuredPath);
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/server/auth/errors.js
+var OAuthError = class extends Error {
+  constructor(message, errorUri) {
+    super(message), this.errorUri = errorUri, this.name = this.constructor.name;
+  }
+  /**
+   * Converts the error to a standard OAuth error response object
+   */
+  toResponseObject() {
+    let response = {
+      error: this.errorCode,
+      error_description: this.message
+    };
+    return this.errorUri && (response.error_uri = this.errorUri), response;
+  }
+  get errorCode() {
+    return this.constructor.errorCode;
+  }
+}, InvalidRequestError = class extends OAuthError {
+};
+InvalidRequestError.errorCode = "invalid_request";
+var InvalidClientError = class extends OAuthError {
+};
+InvalidClientError.errorCode = "invalid_client";
+var InvalidGrantError = class extends OAuthError {
+};
+InvalidGrantError.errorCode = "invalid_grant";
+var UnauthorizedClientError = class extends OAuthError {
+};
+UnauthorizedClientError.errorCode = "unauthorized_client";
+var UnsupportedGrantTypeError = class extends OAuthError {
+};
+UnsupportedGrantTypeError.errorCode = "unsupported_grant_type";
+var InvalidScopeError = class extends OAuthError {
+};
+InvalidScopeError.errorCode = "invalid_scope";
+var AccessDeniedError = class extends OAuthError {
+};
+AccessDeniedError.errorCode = "access_denied";
+var ServerError = class extends OAuthError {
+};
+ServerError.errorCode = "server_error";
+var TemporarilyUnavailableError = class extends OAuthError {
+};
+TemporarilyUnavailableError.errorCode = "temporarily_unavailable";
+var UnsupportedResponseTypeError = class extends OAuthError {
+};
+UnsupportedResponseTypeError.errorCode = "unsupported_response_type";
+var UnsupportedTokenTypeError = class extends OAuthError {
+};
+UnsupportedTokenTypeError.errorCode = "unsupported_token_type";
+var InvalidTokenError = class extends OAuthError {
+};
+InvalidTokenError.errorCode = "invalid_token";
+var MethodNotAllowedError = class extends OAuthError {
+};
+MethodNotAllowedError.errorCode = "method_not_allowed";
+var TooManyRequestsError = class extends OAuthError {
+};
+TooManyRequestsError.errorCode = "too_many_requests";
+var InvalidClientMetadataError = class extends OAuthError {
+};
+InvalidClientMetadataError.errorCode = "invalid_client_metadata";
+var InsufficientScopeError = class extends OAuthError {
+};
+InsufficientScopeError.errorCode = "insufficient_scope";
+var InvalidTargetError = class extends OAuthError {
+};
+InvalidTargetError.errorCode = "invalid_target";
+var OAUTH_ERRORS = {
+  [InvalidRequestError.errorCode]: InvalidRequestError,
+  [InvalidClientError.errorCode]: InvalidClientError,
+  [InvalidGrantError.errorCode]: InvalidGrantError,
+  [UnauthorizedClientError.errorCode]: UnauthorizedClientError,
+  [UnsupportedGrantTypeError.errorCode]: UnsupportedGrantTypeError,
+  [InvalidScopeError.errorCode]: InvalidScopeError,
+  [AccessDeniedError.errorCode]: AccessDeniedError,
+  [ServerError.errorCode]: ServerError,
+  [TemporarilyUnavailableError.errorCode]: TemporarilyUnavailableError,
+  [UnsupportedResponseTypeError.errorCode]: UnsupportedResponseTypeError,
+  [UnsupportedTokenTypeError.errorCode]: UnsupportedTokenTypeError,
+  [InvalidTokenError.errorCode]: InvalidTokenError,
+  [MethodNotAllowedError.errorCode]: MethodNotAllowedError,
+  [TooManyRequestsError.errorCode]: TooManyRequestsError,
+  [InvalidClientMetadataError.errorCode]: InvalidClientMetadataError,
+  [InsufficientScopeError.errorCode]: InsufficientScopeError,
+  [InvalidTargetError.errorCode]: InvalidTargetError
+};
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/client/auth.js
+var UnauthorizedError = class extends Error {
+  constructor(message) {
+    super(message ?? "Unauthorized");
+  }
+};
+function isClientAuthMethod(method) {
+  return ["client_secret_basic", "client_secret_post", "none"].includes(method);
+}
+var AUTHORIZATION_CODE_RESPONSE_TYPE = "code", AUTHORIZATION_CODE_CHALLENGE_METHOD = "S256";
+function selectClientAuthMethod(clientInformation, supportedMethods) {
+  let hasClientSecret = clientInformation.client_secret !== void 0;
+  return "token_endpoint_auth_method" in clientInformation && clientInformation.token_endpoint_auth_method && isClientAuthMethod(clientInformation.token_endpoint_auth_method) && (supportedMethods.length === 0 || supportedMethods.includes(clientInformation.token_endpoint_auth_method)) ? clientInformation.token_endpoint_auth_method : supportedMethods.length === 0 ? hasClientSecret ? "client_secret_basic" : "none" : hasClientSecret && supportedMethods.includes("client_secret_basic") ? "client_secret_basic" : hasClientSecret && supportedMethods.includes("client_secret_post") ? "client_secret_post" : supportedMethods.includes("none") ? "none" : hasClientSecret ? "client_secret_post" : "none";
+}
+function applyClientAuthentication(method, clientInformation, headers, params) {
+  let { client_id, client_secret } = clientInformation;
+  switch (method) {
+    case "client_secret_basic":
+      applyBasicAuth(client_id, client_secret, headers);
+      return;
+    case "client_secret_post":
+      applyPostAuth(client_id, client_secret, params);
+      return;
+    case "none":
+      applyPublicAuth(client_id, params);
+      return;
+    default:
+      throw new Error(`Unsupported client authentication method: ${method}`);
+  }
+}
+function applyBasicAuth(clientId, clientSecret, headers) {
+  if (!clientSecret)
+    throw new Error("client_secret_basic authentication requires a client_secret");
+  let credentials = btoa(`${clientId}:${clientSecret}`);
+  headers.set("Authorization", `Basic ${credentials}`);
+}
+function applyPostAuth(clientId, clientSecret, params) {
+  params.set("client_id", clientId), clientSecret && params.set("client_secret", clientSecret);
+}
+function applyPublicAuth(clientId, params) {
+  params.set("client_id", clientId);
+}
+async function parseErrorResponse(input) {
+  let statusCode = input instanceof Response ? input.status : void 0, body = input instanceof Response ? await input.text() : input;
+  try {
+    let result = OAuthErrorResponseSchema.parse(JSON.parse(body)), { error, error_description, error_uri } = result, errorClass = OAUTH_ERRORS[error] || ServerError;
+    return new errorClass(error_description || "", error_uri);
+  } catch (error) {
+    let errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ""}Invalid OAuth error response: ${error}. Raw body: ${body}`;
+    return new ServerError(errorMessage);
+  }
+}
+async function auth(provider, options) {
+  try {
+    return await authInternal(provider, options);
+  } catch (error) {
+    if (error instanceof InvalidClientError || error instanceof UnauthorizedClientError)
+      return await provider.invalidateCredentials?.("all"), await authInternal(provider, options);
+    if (error instanceof InvalidGrantError)
+      return await provider.invalidateCredentials?.("tokens"), await authInternal(provider, options);
+    throw error;
+  }
+}
+async function authInternal(provider, { serverUrl, authorizationCode, scope, resourceMetadataUrl, fetchFn }) {
+  let cachedState = await provider.discoveryState?.(), resourceMetadata, authorizationServerUrl, metadata, effectiveResourceMetadataUrl = resourceMetadataUrl;
+  if (!effectiveResourceMetadataUrl && cachedState?.resourceMetadataUrl && (effectiveResourceMetadataUrl = new URL(cachedState.resourceMetadataUrl)), cachedState?.authorizationServerUrl) {
+    if (authorizationServerUrl = cachedState.authorizationServerUrl, resourceMetadata = cachedState.resourceMetadata, metadata = cachedState.authorizationServerMetadata ?? await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn }), !resourceMetadata)
+      try {
+        resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl }, fetchFn);
+      } catch {
+      }
+    (metadata !== cachedState.authorizationServerMetadata || resourceMetadata !== cachedState.resourceMetadata) && await provider.saveDiscoveryState?.({
+      authorizationServerUrl: String(authorizationServerUrl),
+      resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
+      resourceMetadata,
+      authorizationServerMetadata: metadata
+    });
+  } else {
+    let serverInfo = await discoverOAuthServerInfo(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl, fetchFn });
+    authorizationServerUrl = serverInfo.authorizationServerUrl, metadata = serverInfo.authorizationServerMetadata, resourceMetadata = serverInfo.resourceMetadata, await provider.saveDiscoveryState?.({
+      authorizationServerUrl: String(authorizationServerUrl),
+      resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
+      resourceMetadata,
+      authorizationServerMetadata: metadata
+    });
+  }
+  let resource = await selectResourceURL(serverUrl, provider, resourceMetadata), resolvedScope = scope || resourceMetadata?.scopes_supported?.join(" ") || provider.clientMetadata.scope, clientInformation = await Promise.resolve(provider.clientInformation());
+  if (!clientInformation) {
+    if (authorizationCode !== void 0)
+      throw new Error("Existing OAuth client information is required when exchanging an authorization code");
+    let supportsUrlBasedClientId = metadata?.client_id_metadata_document_supported === !0, clientMetadataUrl = provider.clientMetadataUrl;
+    if (clientMetadataUrl && !isHttpsUrl(clientMetadataUrl))
+      throw new InvalidClientMetadataError(`clientMetadataUrl must be a valid HTTPS URL with a non-root pathname, got: ${clientMetadataUrl}`);
+    if (supportsUrlBasedClientId && clientMetadataUrl)
+      clientInformation = {
+        client_id: clientMetadataUrl
+      }, await provider.saveClientInformation?.(clientInformation);
+    else {
+      if (!provider.saveClientInformation)
+        throw new Error("OAuth client information must be saveable for dynamic registration");
+      let fullInformation = await registerClient(authorizationServerUrl, {
+        metadata,
+        clientMetadata: provider.clientMetadata,
+        scope: resolvedScope,
+        fetchFn
+      });
+      await provider.saveClientInformation(fullInformation), clientInformation = fullInformation;
+    }
+  }
+  let nonInteractiveFlow = !provider.redirectUrl;
+  if (authorizationCode !== void 0 || nonInteractiveFlow) {
+    let tokens2 = await fetchToken(provider, authorizationServerUrl, {
+      metadata,
+      resource,
+      authorizationCode,
+      fetchFn
+    });
+    return await provider.saveTokens(tokens2), "AUTHORIZED";
+  }
+  let tokens = await provider.tokens();
+  if (tokens?.refresh_token)
+    try {
+      let newTokens = await refreshAuthorization(authorizationServerUrl, {
+        metadata,
+        clientInformation,
+        refreshToken: tokens.refresh_token,
+        resource,
+        addClientAuthentication: provider.addClientAuthentication,
+        fetchFn
+      });
+      return await provider.saveTokens(newTokens), "AUTHORIZED";
+    } catch (error) {
+      if (!(!(error instanceof OAuthError) || error instanceof ServerError))
+        throw error;
+    }
+  let state = provider.state ? await provider.state() : void 0, { authorizationUrl, codeVerifier } = await startAuthorization(authorizationServerUrl, {
+    metadata,
+    clientInformation,
+    state,
+    redirectUrl: provider.redirectUrl,
+    scope: resolvedScope,
+    resource
+  });
+  return await provider.saveCodeVerifier(codeVerifier), await provider.redirectToAuthorization(authorizationUrl), "REDIRECT";
+}
+function isHttpsUrl(value) {
+  if (!value)
+    return !1;
+  try {
+    let url2 = new URL(value);
+    return url2.protocol === "https:" && url2.pathname !== "/";
+  } catch {
+    return !1;
+  }
+}
+async function selectResourceURL(serverUrl, provider, resourceMetadata) {
+  let defaultResource = resourceUrlFromServerUrl(serverUrl);
+  if (provider.validateResourceURL)
+    return await provider.validateResourceURL(defaultResource, resourceMetadata?.resource);
+  if (resourceMetadata) {
+    if (!checkResourceAllowed({ requestedResource: defaultResource, configuredResource: resourceMetadata.resource }))
+      throw new Error(`Protected resource ${resourceMetadata.resource} does not match expected ${defaultResource} (or origin)`);
+    return new URL(resourceMetadata.resource);
+  }
+}
+function extractWWWAuthenticateParams(res) {
+  let authenticateHeader = res.headers.get("WWW-Authenticate");
+  if (!authenticateHeader)
+    return {};
+  let [type, scheme] = authenticateHeader.split(" ");
+  if (type.toLowerCase() !== "bearer" || !scheme)
+    return {};
+  let resourceMetadataMatch = extractFieldFromWwwAuth(res, "resource_metadata") || void 0, resourceMetadataUrl;
+  if (resourceMetadataMatch)
+    try {
+      resourceMetadataUrl = new URL(resourceMetadataMatch);
+    } catch {
+    }
+  let scope = extractFieldFromWwwAuth(res, "scope") || void 0, error = extractFieldFromWwwAuth(res, "error") || void 0;
+  return {
+    resourceMetadataUrl,
+    scope,
+    error
+  };
+}
+function extractFieldFromWwwAuth(response, fieldName) {
+  let wwwAuthHeader = response.headers.get("WWW-Authenticate");
+  if (!wwwAuthHeader)
+    return null;
+  let pattern = new RegExp(`${fieldName}=(?:"([^"]+)"|([^\\s,]+))`), match = wwwAuthHeader.match(pattern);
+  return match ? match[1] || match[2] : null;
+}
+async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn = fetch) {
+  let response = await discoverMetadataWithFallback(serverUrl, "oauth-protected-resource", fetchFn, {
+    protocolVersion: opts?.protocolVersion,
+    metadataUrl: opts?.resourceMetadataUrl
+  });
+  if (!response || response.status === 404)
+    throw await response?.body?.cancel(), new Error("Resource server does not implement OAuth 2.0 Protected Resource Metadata.");
+  if (!response.ok)
+    throw await response.body?.cancel(), new Error(`HTTP ${response.status} trying to load well-known OAuth protected resource metadata.`);
+  return OAuthProtectedResourceMetadataSchema.parse(await response.json());
+}
+async function fetchWithCorsRetry(url2, headers, fetchFn = fetch) {
+  try {
+    return await fetchFn(url2, { headers });
+  } catch (error) {
+    if (error instanceof TypeError)
+      return headers ? fetchWithCorsRetry(url2, void 0, fetchFn) : void 0;
+    throw error;
+  }
+}
+function buildWellKnownPath(wellKnownPrefix, pathname = "", options = {}) {
+  return pathname.endsWith("/") && (pathname = pathname.slice(0, -1)), options.prependPathname ? `${pathname}/.well-known/${wellKnownPrefix}` : `/.well-known/${wellKnownPrefix}${pathname}`;
+}
+async function tryMetadataDiscovery(url2, protocolVersion, fetchFn = fetch) {
+  return await fetchWithCorsRetry(url2, {
+    "MCP-Protocol-Version": protocolVersion
+  }, fetchFn);
+}
+function shouldAttemptFallback(response, pathname) {
+  return !response || response.status >= 400 && response.status < 500 && pathname !== "/";
+}
+async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, opts) {
+  let issuer = new URL(serverUrl), protocolVersion = opts?.protocolVersion ?? LATEST_PROTOCOL_VERSION, url2;
+  if (opts?.metadataUrl)
+    url2 = new URL(opts.metadataUrl);
+  else {
+    let wellKnownPath = buildWellKnownPath(wellKnownType, issuer.pathname);
+    url2 = new URL(wellKnownPath, opts?.metadataServerUrl ?? issuer), url2.search = issuer.search;
+  }
+  let response = await tryMetadataDiscovery(url2, protocolVersion, fetchFn);
+  if (!opts?.metadataUrl && shouldAttemptFallback(response, issuer.pathname)) {
+    let rootUrl = new URL(`/.well-known/${wellKnownType}`, issuer);
+    response = await tryMetadataDiscovery(rootUrl, protocolVersion, fetchFn);
+  }
+  return response;
+}
+function buildDiscoveryUrls(authorizationServerUrl) {
+  let url2 = typeof authorizationServerUrl == "string" ? new URL(authorizationServerUrl) : authorizationServerUrl, hasPath = url2.pathname !== "/", urlsToTry = [];
+  if (!hasPath)
+    return urlsToTry.push({
+      url: new URL("/.well-known/oauth-authorization-server", url2.origin),
+      type: "oauth"
+    }), urlsToTry.push({
+      url: new URL("/.well-known/openid-configuration", url2.origin),
+      type: "oidc"
+    }), urlsToTry;
+  let pathname = url2.pathname;
+  return pathname.endsWith("/") && (pathname = pathname.slice(0, -1)), urlsToTry.push({
+    url: new URL(`/.well-known/oauth-authorization-server${pathname}`, url2.origin),
+    type: "oauth"
+  }), urlsToTry.push({
+    url: new URL(`/.well-known/openid-configuration${pathname}`, url2.origin),
+    type: "oidc"
+  }), urlsToTry.push({
+    url: new URL(`${pathname}/.well-known/openid-configuration`, url2.origin),
+    type: "oidc"
+  }), urlsToTry;
+}
+async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn = fetch, protocolVersion = LATEST_PROTOCOL_VERSION } = {}) {
+  let headers = {
+    "MCP-Protocol-Version": protocolVersion,
+    Accept: "application/json"
+  }, urlsToTry = buildDiscoveryUrls(authorizationServerUrl);
+  for (let { url: endpointUrl, type } of urlsToTry) {
+    let response = await fetchWithCorsRetry(endpointUrl, headers, fetchFn);
+    if (response) {
+      if (!response.ok) {
+        if (await response.body?.cancel(), response.status >= 400 && response.status < 500)
+          continue;
+        throw new Error(`HTTP ${response.status} trying to load ${type === "oauth" ? "OAuth" : "OpenID provider"} metadata from ${endpointUrl}`);
+      }
+      return type === "oauth" ? OAuthMetadataSchema.parse(await response.json()) : OpenIdProviderDiscoveryMetadataSchema.parse(await response.json());
+    }
+  }
+}
+async function discoverOAuthServerInfo(serverUrl, opts) {
+  let resourceMetadata, authorizationServerUrl;
+  try {
+    resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: opts?.resourceMetadataUrl }, opts?.fetchFn), resourceMetadata.authorization_servers && resourceMetadata.authorization_servers.length > 0 && (authorizationServerUrl = resourceMetadata.authorization_servers[0]);
+  } catch {
+  }
+  authorizationServerUrl || (authorizationServerUrl = String(new URL("/", serverUrl)));
+  let authorizationServerMetadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn: opts?.fetchFn });
+  return {
+    authorizationServerUrl,
+    authorizationServerMetadata,
+    resourceMetadata
+  };
+}
+async function startAuthorization(authorizationServerUrl, { metadata, clientInformation, redirectUrl, scope, state, resource }) {
+  let authorizationUrl;
+  if (metadata) {
+    if (authorizationUrl = new URL(metadata.authorization_endpoint), !metadata.response_types_supported.includes(AUTHORIZATION_CODE_RESPONSE_TYPE))
+      throw new Error(`Incompatible auth server: does not support response type ${AUTHORIZATION_CODE_RESPONSE_TYPE}`);
+    if (metadata.code_challenge_methods_supported && !metadata.code_challenge_methods_supported.includes(AUTHORIZATION_CODE_CHALLENGE_METHOD))
+      throw new Error(`Incompatible auth server: does not support code challenge method ${AUTHORIZATION_CODE_CHALLENGE_METHOD}`);
+  } else
+    authorizationUrl = new URL("/authorize", authorizationServerUrl);
+  let challenge = await pkceChallenge(), codeVerifier = challenge.code_verifier, codeChallenge = challenge.code_challenge;
+  return authorizationUrl.searchParams.set("response_type", AUTHORIZATION_CODE_RESPONSE_TYPE), authorizationUrl.searchParams.set("client_id", clientInformation.client_id), authorizationUrl.searchParams.set("code_challenge", codeChallenge), authorizationUrl.searchParams.set("code_challenge_method", AUTHORIZATION_CODE_CHALLENGE_METHOD), authorizationUrl.searchParams.set("redirect_uri", String(redirectUrl)), state && authorizationUrl.searchParams.set("state", state), scope && authorizationUrl.searchParams.set("scope", scope), scope?.includes("offline_access") && authorizationUrl.searchParams.append("prompt", "consent"), resource && authorizationUrl.searchParams.set("resource", resource.href), { authorizationUrl, codeVerifier };
+}
+function prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, redirectUri) {
+  return new URLSearchParams({
+    grant_type: "authorization_code",
+    code: authorizationCode,
+    code_verifier: codeVerifier,
+    redirect_uri: String(redirectUri)
+  });
+}
+async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequestParams, clientInformation, addClientAuthentication, resource, fetchFn }) {
+  let tokenUrl = metadata?.token_endpoint ? new URL(metadata.token_endpoint) : new URL("/token", authorizationServerUrl), headers = new Headers({
+    "Content-Type": "application/x-www-form-urlencoded",
+    Accept: "application/json"
+  });
+  if (resource && tokenRequestParams.set("resource", resource.href), addClientAuthentication)
+    await addClientAuthentication(headers, tokenRequestParams, tokenUrl, metadata);
+  else if (clientInformation) {
+    let supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? [], authMethod = selectClientAuthMethod(clientInformation, supportedMethods);
+    applyClientAuthentication(authMethod, clientInformation, headers, tokenRequestParams);
+  }
+  let response = await (fetchFn ?? fetch)(tokenUrl, {
+    method: "POST",
+    headers,
+    body: tokenRequestParams
+  });
+  if (!response.ok)
+    throw await parseErrorResponse(response);
+  return OAuthTokensSchema.parse(await response.json());
+}
+async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
+  let tokenRequestParams = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken
+  }), tokens = await executeTokenRequest(authorizationServerUrl, {
+    metadata,
+    tokenRequestParams,
+    clientInformation,
+    addClientAuthentication,
+    resource,
+    fetchFn
+  });
+  return { refresh_token: refreshToken, ...tokens };
+}
+async function fetchToken(provider, authorizationServerUrl, { metadata, resource, authorizationCode, fetchFn } = {}) {
+  let scope = provider.clientMetadata.scope, tokenRequestParams;
+  if (provider.prepareTokenRequest && (tokenRequestParams = await provider.prepareTokenRequest(scope)), !tokenRequestParams) {
+    if (!authorizationCode)
+      throw new Error("Either provider.prepareTokenRequest() or authorizationCode is required");
+    if (!provider.redirectUrl)
+      throw new Error("redirectUrl is required for authorization_code flow");
+    let codeVerifier = await provider.codeVerifier();
+    tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, provider.redirectUrl);
+  }
+  let clientInformation = await provider.clientInformation();
+  return executeTokenRequest(authorizationServerUrl, {
+    metadata,
+    tokenRequestParams,
+    clientInformation: clientInformation ?? void 0,
+    addClientAuthentication: provider.addClientAuthentication,
+    resource,
+    fetchFn
+  });
+}
+async function registerClient(authorizationServerUrl, { metadata, clientMetadata, scope, fetchFn }) {
+  let registrationUrl;
+  if (metadata) {
+    if (!metadata.registration_endpoint)
+      throw new Error("Incompatible auth server: does not support dynamic client registration");
+    registrationUrl = new URL(metadata.registration_endpoint);
+  } else
+    registrationUrl = new URL("/register", authorizationServerUrl);
+  let response = await (fetchFn ?? fetch)(registrationUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      ...clientMetadata,
+      ...scope !== void 0 ? { scope } : {}
+    })
+  });
+  if (!response.ok)
+    throw await parseErrorResponse(response);
+  return OAuthClientInformationFullSchema.parse(await response.json());
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
+var import_content_type = __toESM(require_content_type(), 1);
+function mediaTypeEssence(header) {
+  if (header)
+    try {
+      return import_content_type.default.parse(header).type;
+    } catch {
+      let essence = (header.split(";", 1)[0] ?? "").trim().toLowerCase();
+      return essence === "" || header.slice(essence.length).includes(",") ? void 0 : essence;
+    }
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/transport.js
+function normalizeHeaders(headers) {
+  return headers ? headers instanceof Headers ? Object.fromEntries(headers.entries()) : Array.isArray(headers) ? Object.fromEntries(headers) : { ...headers } : {};
+}
+function createFetchWithInit(baseFetch = fetch, baseInit) {
+  return baseInit ? async (url2, init) => {
+    let mergedInit = {
+      ...baseInit,
+      ...init,
+      // Headers need special handling - merge instead of replace
+      headers: init?.headers ? { ...normalizeHeaders(baseInit.headers), ...normalizeHeaders(init.headers) } : baseInit.headers
+    };
+    return baseFetch(url2, mergedInit);
+  } : baseFetch;
+}
+
+// node_modules/eventsource-parser/dist/index.js
+var ParseError = class extends Error {
+  constructor(message, options) {
+    super(message), this.name = "ParseError", this.type = options.type, this.field = options.field, this.value = options.value, this.line = options.line;
+  }
+}, LF = 10, CR = 13, SPACE = 32;
+function noop(_arg) {
+}
+function createParser(config) {
+  if (typeof config == "function")
+    throw new TypeError(
+      "`config` must be an object, got a function instead. Did you mean `createParser({onEvent: fn})`?"
+    );
+  let { onEvent = noop, onError = noop, onRetry = noop, onComment, maxBufferSize } = config, pendingFragments = [], pendingFragmentsLength = 0, isFirstChunk = !0, id, data = "", dataLines = 0, eventType, terminated = !1;
+  function feed(chunk) {
+    if (terminated)
+      throw new Error(
+        "Cannot feed parser: it was terminated after exceeding the configured max buffer size. Call `reset()` to resume parsing."
+      );
+    if (isFirstChunk && (isFirstChunk = !1, chunk.charCodeAt(0) === 239 && chunk.charCodeAt(1) === 187 && chunk.charCodeAt(2) === 191 && (chunk = chunk.slice(3))), pendingFragments.length === 0) {
+      let trailing2 = processLines(chunk);
+      trailing2 !== "" && (pendingFragments.push(trailing2), pendingFragmentsLength = trailing2.length), checkBufferSize();
+      return;
+    }
+    if (chunk.indexOf(`
+`) === -1 && chunk.indexOf("\r") === -1) {
+      pendingFragments.push(chunk), pendingFragmentsLength += chunk.length, checkBufferSize();
+      return;
+    }
+    pendingFragments.push(chunk);
+    let input = pendingFragments.join("");
+    pendingFragments.length = 0, pendingFragmentsLength = 0;
+    let trailing = processLines(input);
+    trailing !== "" && (pendingFragments.push(trailing), pendingFragmentsLength = trailing.length), checkBufferSize();
+  }
+  function checkBufferSize() {
+    maxBufferSize !== void 0 && (pendingFragmentsLength + data.length <= maxBufferSize || (terminated = !0, pendingFragments.length = 0, pendingFragmentsLength = 0, id = void 0, data = "", dataLines = 0, eventType = void 0, onError(
+      new ParseError(`Buffered data exceeded max buffer size of ${maxBufferSize} characters`, {
+        type: "max-buffer-size-exceeded"
+      })
+    )));
+  }
+  function processLines(chunk) {
+    let searchIndex = 0;
+    if (chunk.indexOf("\r") === -1) {
+      let lfIndex = chunk.indexOf(`
+`, searchIndex);
+      for (; lfIndex !== -1; ) {
+        if (searchIndex === lfIndex) {
+          dataLines > 0 && onEvent({ id, event: eventType, data }), id = void 0, data = "", dataLines = 0, eventType = void 0, searchIndex = lfIndex + 1, lfIndex = chunk.indexOf(`
+`, searchIndex);
+          continue;
+        }
+        let firstCharCode = chunk.charCodeAt(searchIndex);
+        if (isDataPrefix(chunk, searchIndex, firstCharCode)) {
+          let valueStart = chunk.charCodeAt(searchIndex + 5) === SPACE ? searchIndex + 6 : searchIndex + 5, value = chunk.slice(valueStart, lfIndex);
+          if (dataLines === 0 && chunk.charCodeAt(lfIndex + 1) === LF) {
+            onEvent({ id, event: eventType, data: value }), id = void 0, data = "", eventType = void 0, searchIndex = lfIndex + 2, lfIndex = chunk.indexOf(`
+`, searchIndex);
+            continue;
+          }
+          data = dataLines === 0 ? value : `${data}
+${value}`, dataLines++;
+        } else isEventPrefix(chunk, searchIndex, firstCharCode) ? eventType = chunk.slice(
+          chunk.charCodeAt(searchIndex + 6) === SPACE ? searchIndex + 7 : searchIndex + 6,
+          lfIndex
+        ) || void 0 : parseLine(chunk, searchIndex, lfIndex);
+        searchIndex = lfIndex + 1, lfIndex = chunk.indexOf(`
+`, searchIndex);
+      }
+      return chunk.slice(searchIndex);
+    }
+    for (; searchIndex < chunk.length; ) {
+      let crIndex = chunk.indexOf("\r", searchIndex), lfIndex = chunk.indexOf(`
+`, searchIndex), lineEnd = -1;
+      if (crIndex !== -1 && lfIndex !== -1 ? lineEnd = crIndex < lfIndex ? crIndex : lfIndex : crIndex !== -1 ? crIndex === chunk.length - 1 ? lineEnd = -1 : lineEnd = crIndex : lfIndex !== -1 && (lineEnd = lfIndex), lineEnd === -1)
+        break;
+      parseLine(chunk, searchIndex, lineEnd), searchIndex = lineEnd + 1, chunk.charCodeAt(searchIndex - 1) === CR && chunk.charCodeAt(searchIndex) === LF && searchIndex++;
+    }
+    return chunk.slice(searchIndex);
+  }
+  function parseLine(chunk, start, end) {
+    if (start === end) {
+      dispatchEvent();
+      return;
+    }
+    let firstCharCode = chunk.charCodeAt(start);
+    if (isDataPrefix(chunk, start, firstCharCode)) {
+      let valueStart = chunk.charCodeAt(start + 5) === SPACE ? start + 6 : start + 5, value2 = chunk.slice(valueStart, end);
+      data = dataLines === 0 ? value2 : `${data}
+${value2}`, dataLines++;
+      return;
+    }
+    if (isEventPrefix(chunk, start, firstCharCode)) {
+      eventType = chunk.slice(chunk.charCodeAt(start + 6) === SPACE ? start + 7 : start + 6, end) || void 0;
+      return;
+    }
+    if (firstCharCode === 105 && chunk.charCodeAt(start + 1) === 100 && chunk.charCodeAt(start + 2) === 58) {
+      let value2 = chunk.slice(chunk.charCodeAt(start + 3) === SPACE ? start + 4 : start + 3, end);
+      id = value2.includes("\0") ? void 0 : value2;
+      return;
+    }
+    if (firstCharCode === 58) {
+      if (onComment) {
+        let line2 = chunk.slice(start, end);
+        onComment(line2.slice(chunk.charCodeAt(start + 1) === SPACE ? 2 : 1));
+      }
+      return;
+    }
+    let line = chunk.slice(start, end), fieldSeparatorIndex = line.indexOf(":");
+    if (fieldSeparatorIndex === -1) {
+      processField(line, "", line);
+      return;
+    }
+    let field = line.slice(0, fieldSeparatorIndex), offset = line.charCodeAt(fieldSeparatorIndex + 1) === SPACE ? 2 : 1, value = line.slice(fieldSeparatorIndex + offset);
+    processField(field, value, line);
+  }
+  function processField(field, value, line) {
+    switch (field) {
+      case "event":
+        eventType = value || void 0;
+        break;
+      case "data":
+        data = dataLines === 0 ? value : `${data}
+${value}`, dataLines++;
+        break;
+      case "id":
+        id = value.includes("\0") ? void 0 : value;
+        break;
+      case "retry":
+        /^\d+$/.test(value) ? onRetry(parseInt(value, 10)) : onError(
+          new ParseError(`Invalid \`retry\` value: "${value}"`, {
+            type: "invalid-retry",
+            value,
+            line
+          })
+        );
+        break;
+      default:
+        onError(
+          new ParseError(
+            `Unknown field "${field.length > 20 ? `${field.slice(0, 20)}\u2026` : field}"`,
+            { type: "unknown-field", field, value, line }
+          )
+        );
+        break;
+    }
+  }
+  function dispatchEvent() {
+    dataLines > 0 && onEvent({
+      id,
+      event: eventType,
+      data
+    }), id = void 0, data = "", dataLines = 0, eventType = void 0;
+  }
+  function reset(options = {}) {
+    if (options.consume && pendingFragments.length > 0) {
+      let incompleteLine = pendingFragments.join("");
+      parseLine(incompleteLine, 0, incompleteLine.length);
+    }
+    isFirstChunk = !0, id = void 0, data = "", dataLines = 0, eventType = void 0, pendingFragments.length = 0, pendingFragmentsLength = 0, terminated = !1;
+  }
+  return { feed, reset };
+}
+function isDataPrefix(chunk, i2, firstCharCode) {
+  return firstCharCode === 100 && chunk.charCodeAt(i2 + 1) === 97 && chunk.charCodeAt(i2 + 2) === 116 && chunk.charCodeAt(i2 + 3) === 97 && chunk.charCodeAt(i2 + 4) === 58;
+}
+function isEventPrefix(chunk, i2, firstCharCode) {
+  return firstCharCode === 101 && chunk.charCodeAt(i2 + 1) === 118 && chunk.charCodeAt(i2 + 2) === 101 && chunk.charCodeAt(i2 + 3) === 110 && chunk.charCodeAt(i2 + 4) === 116 && chunk.charCodeAt(i2 + 5) === 58;
+}
+
+// node_modules/eventsource-parser/dist/stream.js
+var EventSourceParserStream = class extends TransformStream {
+  constructor({ onError, onRetry, onComment, maxBufferSize } = {}) {
+    let parser;
+    super({
+      start(controller) {
+        parser = createParser({
+          onEvent: (event) => {
+            controller.enqueue(event);
+          },
+          onError(error) {
+            typeof onError == "function" && onError(error), (onError === "terminate" || error.type === "max-buffer-size-exceeded") && controller.error(error);
+          },
+          onRetry,
+          onComment,
+          maxBufferSize
+        });
+      },
+      transform(chunk) {
+        parser.feed(chunk);
+      }
+    });
+  }
+};
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/client/streamableHttp.js
+var DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS = {
+  initialReconnectionDelay: 1e3,
+  maxReconnectionDelay: 3e4,
+  reconnectionDelayGrowFactor: 1.5,
+  maxRetries: 2
+}, StreamableHTTPError = class extends Error {
+  constructor(code, message) {
+    super(`Streamable HTTP error: ${message}`), this.code = code;
+  }
+}, StreamableHTTPClientTransport = class {
+  constructor(url2, opts) {
+    this._hasCompletedAuthFlow = !1, this._url = url2, this._resourceMetadataUrl = void 0, this._scope = void 0, this._requestInit = opts?.requestInit, this._authProvider = opts?.authProvider, this._fetch = opts?.fetch, this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit), this._sessionId = opts?.sessionId, this._reconnectionOptions = opts?.reconnectionOptions ?? DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS;
+  }
+  async _authThenStart() {
+    if (!this._authProvider)
+      throw new UnauthorizedError("No auth provider");
+    let result;
+    try {
+      result = await auth(this._authProvider, {
+        serverUrl: this._url,
+        resourceMetadataUrl: this._resourceMetadataUrl,
+        scope: this._scope,
+        fetchFn: this._fetchWithInit
+      });
+    } catch (error) {
+      throw this.onerror?.(error), error;
+    }
+    if (result !== "AUTHORIZED")
+      throw new UnauthorizedError();
+    return await this._startOrAuthSse({ resumptionToken: void 0 });
+  }
+  async _commonHeaders() {
+    let headers = {};
+    if (this._authProvider) {
+      let tokens = await this._authProvider.tokens();
+      tokens && (headers.Authorization = `Bearer ${tokens.access_token}`);
+    }
+    this._sessionId && (headers["mcp-session-id"] = this._sessionId), this._protocolVersion && (headers["mcp-protocol-version"] = this._protocolVersion);
+    let extraHeaders = normalizeHeaders(this._requestInit?.headers);
+    return new Headers({
+      ...headers,
+      ...extraHeaders
+    });
+  }
+  async _startOrAuthSse(options) {
+    let { resumptionToken } = options;
+    try {
+      let headers = await this._commonHeaders();
+      headers.set("Accept", "text/event-stream"), resumptionToken && headers.set("last-event-id", resumptionToken);
+      let response = await (this._fetch ?? fetch)(this._url, {
+        method: "GET",
+        headers,
+        signal: this._abortController?.signal
+      });
+      if (!response.ok) {
+        if (await response.body?.cancel(), response.status === 401 && this._authProvider)
+          return await this._authThenStart();
+        if (response.status === 405)
+          return;
+        throw new StreamableHTTPError(response.status, `Failed to open SSE stream: ${response.statusText}`);
+      }
+      this._handleSseStream(response.body, options, !0);
+    } catch (error) {
+      throw this.onerror?.(error), error;
+    }
+  }
+  /**
+   * Calculates the next reconnection delay using  backoff algorithm
+   *
+   * @param attempt Current reconnection attempt count for the specific stream
+   * @returns Time to wait in milliseconds before next reconnection attempt
+   */
+  _getNextReconnectionDelay(attempt) {
+    if (this._serverRetryMs !== void 0)
+      return this._serverRetryMs;
+    let initialDelay = this._reconnectionOptions.initialReconnectionDelay, growFactor = this._reconnectionOptions.reconnectionDelayGrowFactor, maxDelay = this._reconnectionOptions.maxReconnectionDelay;
+    return Math.min(initialDelay * Math.pow(growFactor, attempt), maxDelay);
+  }
+  /**
+   * Schedule a reconnection attempt using server-provided retry interval or backoff
+   *
+   * @param lastEventId The ID of the last received event for resumability
+   * @param attemptCount Current reconnection attempt count for this specific stream
+   */
+  _scheduleReconnection(options, attemptCount = 0) {
+    let maxRetries = this._reconnectionOptions.maxRetries;
+    if (attemptCount >= maxRetries) {
+      this.onerror?.(new Error(`Maximum reconnection attempts (${maxRetries}) exceeded.`));
+      return;
+    }
+    let delay = this._getNextReconnectionDelay(attemptCount);
+    this._reconnectionTimeout = setTimeout(() => {
+      this._startOrAuthSse(options).catch((error) => {
+        this.onerror?.(new Error(`Failed to reconnect SSE stream: ${error instanceof Error ? error.message : String(error)}`)), this._scheduleReconnection(options, attemptCount + 1);
+      });
+    }, delay);
+  }
+  _handleSseStream(stream, options, isReconnectable) {
+    if (!stream)
+      return;
+    let { onresumptiontoken, replayMessageId } = options, lastEventId, hasPrimingEvent = !1, receivedResponse = !1;
+    (async () => {
+      try {
+        let reader = stream.pipeThrough(new TextDecoderStream()).pipeThrough(new EventSourceParserStream({
+          onRetry: (retryMs) => {
+            this._serverRetryMs = retryMs;
+          }
+        })).getReader();
+        for (; ; ) {
+          let { value: event, done } = await reader.read();
+          if (done)
+            break;
+          if (event.id && (lastEventId = event.id, hasPrimingEvent = !0, onresumptiontoken?.(event.id)), !!event.data && (!event.event || event.event === "message"))
+            try {
+              let message = JSONRPCMessageSchema.parse(JSON.parse(event.data));
+              isJSONRPCResultResponse(message) && (receivedResponse = !0, replayMessageId !== void 0 && (message.id = replayMessageId)), this.onmessage?.(message);
+            } catch (error) {
+              this.onerror?.(error);
+            }
+        }
+        (isReconnectable || hasPrimingEvent) && !receivedResponse && this._abortController && !this._abortController.signal.aborted && this._scheduleReconnection({
+          resumptionToken: lastEventId,
+          onresumptiontoken,
+          replayMessageId
+        }, 0);
+      } catch (error) {
+        if (this.onerror?.(new Error(`SSE stream disconnected: ${error}`)), (isReconnectable || hasPrimingEvent) && !receivedResponse && this._abortController && !this._abortController.signal.aborted)
+          try {
+            this._scheduleReconnection({
+              resumptionToken: lastEventId,
+              onresumptiontoken,
+              replayMessageId
+            }, 0);
+          } catch (error2) {
+            this.onerror?.(new Error(`Failed to reconnect: ${error2 instanceof Error ? error2.message : String(error2)}`));
+          }
+      }
+    })();
+  }
+  async start() {
+    if (this._abortController)
+      throw new Error("StreamableHTTPClientTransport already started! If using Client class, note that connect() calls start() automatically.");
+    this._abortController = new AbortController();
+  }
+  /**
+   * Call this method after the user has finished authorizing via their user agent and is redirected back to the MCP client application. This will exchange the authorization code for an access token, enabling the next connection attempt to successfully auth.
+   */
+  async finishAuth(authorizationCode) {
+    if (!this._authProvider)
+      throw new UnauthorizedError("No auth provider");
+    if (await auth(this._authProvider, {
+      serverUrl: this._url,
+      authorizationCode,
+      resourceMetadataUrl: this._resourceMetadataUrl,
+      scope: this._scope,
+      fetchFn: this._fetchWithInit
+    }) !== "AUTHORIZED")
+      throw new UnauthorizedError("Failed to authorize");
+  }
+  async close() {
+    this._reconnectionTimeout && (clearTimeout(this._reconnectionTimeout), this._reconnectionTimeout = void 0), this._abortController?.abort(), this.onclose?.();
+  }
+  async send(message, options) {
+    try {
+      let { resumptionToken, onresumptiontoken } = options || {};
+      if (resumptionToken) {
+        this._startOrAuthSse({ resumptionToken, replayMessageId: isJSONRPCRequest(message) ? message.id : void 0 }).catch((err) => this.onerror?.(err));
+        return;
+      }
+      let headers = await this._commonHeaders();
+      headers.set("content-type", "application/json"), headers.set("accept", "application/json, text/event-stream");
+      let init = {
+        ...this._requestInit,
+        method: "POST",
+        headers,
+        body: JSON.stringify(message),
+        signal: this._abortController?.signal
+      }, response = await (this._fetch ?? fetch)(this._url, init), sessionId = response.headers.get("mcp-session-id");
+      if (sessionId && (this._sessionId = sessionId), !response.ok) {
+        let text = await response.text().catch(() => null);
+        if (response.status === 401 && this._authProvider) {
+          if (this._hasCompletedAuthFlow)
+            throw new StreamableHTTPError(401, "Server returned 401 after successful authentication");
+          let { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+          if (this._resourceMetadataUrl = resourceMetadataUrl, this._scope = scope, await auth(this._authProvider, {
+            serverUrl: this._url,
+            resourceMetadataUrl: this._resourceMetadataUrl,
+            scope: this._scope,
+            fetchFn: this._fetchWithInit
+          }) !== "AUTHORIZED")
+            throw new UnauthorizedError();
+          return this._hasCompletedAuthFlow = !0, this.send(message);
+        }
+        if (response.status === 403 && this._authProvider) {
+          let { resourceMetadataUrl, scope, error } = extractWWWAuthenticateParams(response);
+          if (error === "insufficient_scope") {
+            let wwwAuthHeader = response.headers.get("WWW-Authenticate");
+            if (this._lastUpscopingHeader === wwwAuthHeader)
+              throw new StreamableHTTPError(403, "Server returned 403 after trying upscoping");
+            if (scope && (this._scope = scope), resourceMetadataUrl && (this._resourceMetadataUrl = resourceMetadataUrl), this._lastUpscopingHeader = wwwAuthHeader ?? void 0, await auth(this._authProvider, {
+              serverUrl: this._url,
+              resourceMetadataUrl: this._resourceMetadataUrl,
+              scope: this._scope,
+              fetchFn: this._fetch
+            }) !== "AUTHORIZED")
+              throw new UnauthorizedError();
+            return this.send(message);
+          }
+        }
+        throw new StreamableHTTPError(response.status, `Error POSTing to endpoint: ${text}`);
+      }
+      if (this._hasCompletedAuthFlow = !1, this._lastUpscopingHeader = void 0, response.status === 202) {
+        await response.body?.cancel(), isInitializedNotification(message) && this._startOrAuthSse({ resumptionToken: void 0 }).catch((err) => this.onerror?.(err));
+        return;
+      }
+      let hasRequests = (Array.isArray(message) ? message : [message]).filter((msg) => "method" in msg && "id" in msg && msg.id !== void 0).length > 0, contentType2 = response.headers.get("content-type"), responseMediaType = mediaTypeEssence(contentType2);
+      if (hasRequests)
+        if (responseMediaType === "text/event-stream")
+          this._handleSseStream(response.body, { onresumptiontoken }, !1);
+        else if (responseMediaType === "application/json") {
+          let data = await response.json(), responseMessages = Array.isArray(data) ? data.map((msg) => JSONRPCMessageSchema.parse(msg)) : [JSONRPCMessageSchema.parse(data)];
+          for (let msg of responseMessages)
+            this.onmessage?.(msg);
+        } else
+          throw await response.body?.cancel(), new StreamableHTTPError(-1, `Unexpected content type: ${contentType2}`);
+      else
+        await response.body?.cancel();
+    } catch (error) {
+      throw this.onerror?.(error), error;
+    }
+  }
+  get sessionId() {
+    return this._sessionId;
+  }
+  /**
+   * Terminates the current session by sending a DELETE request to the server.
+   *
+   * Clients that no longer need a particular session
+   * (e.g., because the user is leaving the client application) SHOULD send an
+   * HTTP DELETE to the MCP endpoint with the Mcp-Session-Id header to explicitly
+   * terminate the session.
+   *
+   * The server MAY respond with HTTP 405 Method Not Allowed, indicating that
+   * the server does not allow clients to terminate sessions.
+   */
+  async terminateSession() {
+    if (this._sessionId)
+      try {
+        let headers = await this._commonHeaders(), init = {
+          ...this._requestInit,
+          method: "DELETE",
+          headers,
+          signal: this._abortController?.signal
+        }, response = await (this._fetch ?? fetch)(this._url, init);
+        if (await response.body?.cancel(), !response.ok && response.status !== 405)
+          throw new StreamableHTTPError(response.status, `Failed to terminate session: ${response.statusText}`);
+        this._sessionId = void 0;
+      } catch (error) {
+        throw this.onerror?.(error), error;
+      }
+  }
+  setProtocolVersion(version) {
+    this._protocolVersion = version;
+  }
+  get protocolVersion() {
+    return this._protocolVersion;
+  }
+  /**
+   * Resume an SSE stream from a previous event ID.
+   * Opens a GET SSE connection with Last-Event-ID header to replay missed events.
+   *
+   * @param lastEventId The event ID to resume from
+   * @param options Optional callback to receive new resumption tokens
+   */
+  async resumeStream(lastEventId, options) {
+    await this._startOrAuthSse({
+      resumptionToken: lastEventId,
+      onresumptiontoken: options?.onresumptiontoken
+    });
+  }
+};
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.js
+import open from "open";
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-auth.js
+import { createHash } from "crypto";
+import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync } from "fs";
+import { join } from "path";
+function getAuthBaseDir() {
+  let override = process.env.MCP_OAUTH_DIR?.trim();
+  return override || getAgentPath("mcp-oauth");
+}
+function getServerDir(serverName) {
+  if (typeof serverName != "string")
+    throw new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);
+  let storageKey = createHash("sha256").update(serverName, "utf8").digest("hex");
+  return join(getAuthBaseDir(), `sha256-${storageKey}`);
+}
+function getAuthEntryFilePath(serverName) {
+  return join(getServerDir(serverName), "tokens.json");
+}
+function ensureServerDir(serverName) {
+  let dir = getServerDir(serverName);
+  existsSync(dir) || mkdirSync(dir, { recursive: !0, mode: 448 });
+}
+function readAuthEntry(serverName) {
+  let filePath = getAuthEntryFilePath(serverName);
+  try {
+    if (!existsSync(filePath))
+      return;
+    let data = readFileSync(filePath, "utf-8");
+    return JSON.parse(data);
+  } catch (error) {
+    console.error(`Failed to read auth entry for ${serverName}:`, error);
+    return;
+  }
+}
+function writeAuthEntry(serverName, entry) {
+  ensureServerDir(serverName);
+  let filePath = getAuthEntryFilePath(serverName);
+  writeFileSync(filePath, JSON.stringify(entry, null, 2), { mode: 384 });
+}
+function getAuthEntry(serverName) {
+  return readAuthEntry(serverName);
+}
+function getAuthForUrl(serverName, serverUrl) {
+  let entry = getAuthEntry(serverName);
+  if (entry && entry.serverUrl && entry.serverUrl === serverUrl)
+    return entry;
+}
+function saveAuthEntry(serverName, entry, serverUrl) {
+  serverUrl && (entry.serverUrl = serverUrl), writeAuthEntry(serverName, entry);
+}
+function removeAuthEntry(serverName) {
+  try {
+    let filePath = getAuthEntryFilePath(serverName);
+    existsSync(filePath) && writeFileSync(filePath, "{}", { mode: 384 });
+    let dir = getServerDir(serverName);
+    if (existsSync(dir))
+      try {
+        rmSync(dir, { recursive: !0 });
+      } catch {
+      }
+  } catch (error) {
+    console.error(`Failed to remove auth entry for ${serverName}:`, error);
+  }
+}
+function updateTokens(serverName, tokens, serverUrl) {
+  let entry = getAuthEntry(serverName) ?? {};
+  serverUrl && entry.serverUrl !== serverUrl && (delete entry.clientInfo, delete entry.codeVerifier, delete entry.oauthState), entry.tokens = tokens, saveAuthEntry(serverName, entry, serverUrl);
+}
+function updateClientInfo(serverName, clientInfo, serverUrl) {
+  let entry = getAuthEntry(serverName) ?? {};
+  serverUrl && entry.serverUrl !== serverUrl && (delete entry.tokens, delete entry.codeVerifier, delete entry.oauthState), entry.clientInfo = clientInfo, saveAuthEntry(serverName, entry, serverUrl);
+}
+function updateCodeVerifier(serverName, codeVerifier, serverUrl) {
+  let entry = getAuthEntry(serverName) ?? {};
+  serverUrl && entry.serverUrl !== serverUrl && (delete entry.tokens, delete entry.clientInfo, delete entry.oauthState), entry.codeVerifier = codeVerifier, saveAuthEntry(serverName, entry, serverUrl);
+}
+function updateOAuthState(serverName, state, serverUrl) {
+  let entry = getAuthEntry(serverName) ?? {};
+  serverUrl && entry.serverUrl !== serverUrl && (delete entry.tokens, delete entry.clientInfo, delete entry.codeVerifier), entry.oauthState = state, saveAuthEntry(serverName, entry, serverUrl);
+}
+function clearAllCredentials(serverName) {
+  removeAuthEntry(serverName);
+}
+function clearClientInfo(serverName) {
+  let entry = getAuthEntry(serverName);
+  entry && (delete entry.clientInfo, saveAuthEntry(serverName, entry));
+}
+function clearTokens(serverName) {
+  let entry = getAuthEntry(serverName);
+  entry && (delete entry.tokens, saveAuthEntry(serverName, entry));
+}
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-oauth-provider.js
+var DEFAULT_OAUTH_CALLBACK_PORT = 19876, DEFAULT_OAUTH_CALLBACK_PATH = "/callback", configuredOAuthCallbackPort = DEFAULT_OAUTH_CALLBACK_PORT;
+if (process.env.MCP_OAUTH_CALLBACK_PORT) {
+  let parsedPort = Number.parseInt(process.env.MCP_OAUTH_CALLBACK_PORT, 10);
+  Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535 && (configuredOAuthCallbackPort = parsedPort);
+}
+var oauthCallbackPort = configuredOAuthCallbackPort, oauthCallbackPath = DEFAULT_OAUTH_CALLBACK_PATH;
+function getConfiguredOAuthCallbackPort() {
+  return configuredOAuthCallbackPort;
+}
+function getOAuthCallbackPort() {
+  return oauthCallbackPort;
+}
+function setOAuthCallbackPort(port) {
+  oauthCallbackPort = port;
+}
+function getOAuthCallbackPath() {
+  return oauthCallbackPath;
+}
+function setOAuthCallbackPath(path) {
+  oauthCallbackPath = path.startsWith("/") ? path : `/${path}`;
+}
+var McpOAuthProvider = class {
+  serverName;
+  serverUrl;
+  config;
+  callbacks;
+  flowState;
+  redirectUrlSnapshot;
+  flowClientInfo;
+  flowClientInfoLoaded = !1;
+  constructor(serverName, serverUrl, config, callbacks, flowState) {
+    if (this.serverName = serverName, this.serverUrl = serverUrl, this.config = config, this.callbacks = callbacks, this.flowState = flowState, flowState) {
+      let info = flowState.clientInfo;
+      this.flowClientInfo = info?.clientSecretExpiresAt && info.clientSecretExpiresAt < Date.now() / 1e3 ? void 0 : info, this.flowClientInfoLoaded = !0;
+    }
+    this.redirectUrlSnapshot = config.grantType === "client_credentials" ? void 0 : config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`;
+  }
+  get usesClientCredentials() {
+    return this.config.grantType === "client_credentials";
+  }
+  /**
+   * The redirect URL for OAuth callbacks.
+   * This must match the redirect_uri in client metadata.
+   */
+  get redirectUrl() {
+    return this.redirectUrlSnapshot;
+  }
+  /**
+   * Client metadata for dynamic registration.
+   * Describes this client to the OAuth authorization server.
+   */
+  get clientMetadata() {
+    if (this.usesClientCredentials)
+      return {
+        client_name: this.config.clientName ?? "lunR",
+        ...this.config.clientUri ? { client_uri: this.config.clientUri } : {},
+        redirect_uris: [],
+        grant_types: ["client_credentials"],
+        token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none"
+      };
+    let redirectUrl = this.redirectUrl;
+    if (!redirectUrl)
+      throw new Error("redirectUrl is required for authorization_code flow");
+    return {
+      redirect_uris: [redirectUrl],
+      client_name: this.config.clientName ?? "lunR",
+      ...this.config.clientUri ? { client_uri: this.config.clientUri } : {},
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none",
+      ...this.config.scope !== void 0 ? { scope: this.config.scope } : {}
+    };
+  }
+  /**
+   * Get client information (for pre-registered or dynamically registered clients).
+   * Returns undefined if no client info exists or if the server URL has changed.
+   */
+  async clientInformation() {
+    if (this.config.clientId)
+      return {
+        client_id: this.config.clientId,
+        client_secret: this.config.clientSecret
+      };
+    if (!this.flowState || !this.flowClientInfoLoaded) {
+      let entry = await getAuthForUrl(this.serverName, this.serverUrl);
+      throwIfAborted(this.flowState?.signal);
+      let info = entry?.clientInfo;
+      this.flowClientInfo = info?.clientSecretExpiresAt && info.clientSecretExpiresAt < Date.now() / 1e3 ? void 0 : info, this.flowClientInfoLoaded = !0;
+    }
+    if (this.flowClientInfo)
+      return {
+        client_id: this.flowClientInfo.clientId,
+        client_secret: this.flowClientInfo.clientSecret
+      };
+  }
+  /**
+   * Save client information from dynamic registration.
+   */
+  async saveClientInformation(info) {
+    throwIfAborted(this.flowState?.signal);
+    let redirectUris = info.redirect_uris ?? (this.redirectUrl ? [this.redirectUrl] : void 0), clientInfo = {
+      clientId: info.client_id,
+      clientSecret: info.client_secret,
+      clientIdIssuedAt: info.client_id_issued_at,
+      clientSecretExpiresAt: info.client_secret_expires_at,
+      redirectUris
+    };
+    this.flowState && (this.flowClientInfo = clientInfo, this.flowClientInfoLoaded = !0), updateClientInfo(this.serverName, clientInfo, this.serverUrl);
+  }
+  /**
+   * Get stored OAuth tokens.
+   * Returns undefined if no tokens exist or if the server URL has changed.
+   */
+  async tokens() {
+    let entry = await getAuthForUrl(this.serverName, this.serverUrl);
+    if (entry?.tokens)
+      return {
+        access_token: entry.tokens.accessToken,
+        token_type: "Bearer",
+        refresh_token: entry.tokens.refreshToken,
+        expires_in: entry.tokens.expiresAt ? Math.max(0, Math.floor(entry.tokens.expiresAt - Date.now() / 1e3)) : void 0,
+        scope: entry.tokens.scope
+      };
+  }
+  /**
+   * Save OAuth tokens.
+   */
+  async saveTokens(tokens) {
+    throwIfAborted(this.flowState?.signal);
+    let storedTokens = {
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token,
+      expiresAt: tokens.expires_in ? Date.now() / 1e3 + tokens.expires_in : void 0,
+      scope: tokens.scope
+    };
+    this.flowState && this.flowClientInfo && updateClientInfo(this.serverName, this.flowClientInfo, this.serverUrl), updateTokens(this.serverName, storedTokens, this.serverUrl);
+  }
+  /**
+   * Redirect the user to the authorization URL.
+   * This opens the browser for the user to authenticate.
+   *
+   * Throws UnauthorizedError when called without owned or legacy flow state.
+   * That path is reached when the SDK
+   * falls through from a failed refresh into a fresh authorization_code
+   * flow, which library hosts cannot complete in-process.
+   */
+  async redirectToAuthorization(authorizationUrl) {
+    if (this.usesClientCredentials)
+      throw new Error("redirectToAuthorization is not used for client_credentials flow");
+    if (throwIfAborted(this.flowState?.signal), this.flowState) {
+      await this.callbacks.onRedirect(authorizationUrl);
+      return;
+    }
+    if (!(await getAuthForUrl(this.serverName, this.serverUrl))?.oauthState)
+      throw new UnauthorizedError(`Re-authentication required for MCP server: ${this.serverName}`);
+    await this.callbacks.onRedirect(authorizationUrl);
+  }
+  /**
+   * Save the PKCE code verifier.
+   */
+  async saveCodeVerifier(codeVerifier) {
+    if (throwIfAborted(this.flowState?.signal), this.flowState) {
+      this.flowState.codeVerifier = codeVerifier;
+      return;
+    }
+    updateCodeVerifier(this.serverName, codeVerifier, this.serverUrl);
+  }
+  /**
+   * Get the stored PKCE code verifier.
+   * @throws Error if no code verifier is stored
+   */
+  async codeVerifier() {
+    if (throwIfAborted(this.flowState?.signal), this.flowState) {
+      if (!this.flowState.codeVerifier)
+        throw new Error(`No code verifier saved for MCP server: ${this.serverName}`);
+      return this.flowState.codeVerifier;
+    }
+    if (this.usesClientCredentials)
+      throw new Error("codeVerifier is not used for client_credentials flow");
+    let entry = await getAuthForUrl(this.serverName, this.serverUrl);
+    if (!entry?.codeVerifier)
+      throw new Error(`No code verifier saved for MCP server: ${this.serverName}`);
+    return entry.codeVerifier;
+  }
+  /**
+   * Save the OAuth state parameter for CSRF protection.
+   */
+  async saveState(state) {
+    if (throwIfAborted(this.flowState?.signal), this.flowState) {
+      this.flowState.oauthState = state;
+      return;
+    }
+    updateOAuthState(this.serverName, state, this.serverUrl);
+  }
+  /**
+   * Get the stored OAuth state parameter.
+   * @throws UnauthorizedError if no flow is in progress (see redirectToAuthorization)
+   */
+  async state() {
+    if (throwIfAborted(this.flowState?.signal), this.flowState)
+      return this.flowState.oauthState;
+    if (this.usesClientCredentials)
+      throw new Error("state is not used for client_credentials flow");
+    let entry = await getAuthForUrl(this.serverName, this.serverUrl);
+    if (!entry?.oauthState)
+      throw new UnauthorizedError(`Re-authentication required for MCP server: ${this.serverName}`);
+    return entry.oauthState;
+  }
+  /**
+   * Invalidate credentials when authentication fails.
+   * Clears tokens, client info, or all credentials based on the type.
+   */
+  async invalidateCredentials(type) {
+    switch (throwIfAborted(this.flowState?.signal), this.flowState && type !== "tokens" && (this.flowClientInfo = void 0, this.flowClientInfoLoaded = !0), type) {
+      case "all":
+        clearAllCredentials(this.serverName);
+        break;
+      case "client":
+        clearClientInfo(this.serverName);
+        break;
+      case "tokens":
+        clearTokens(this.serverName);
+        break;
+    }
+  }
+  /**
+   * Adds configured authorization-code scope without replacing the SDK's
+   * default token endpoint authentication behavior.
+   */
+  addClientAuthentication = async (headers, params, _url2, metadata) => {
+    params.get("grant_type") === "authorization_code" && !params.has("scope") && this.config.scope && params.set("scope", this.config.scope);
+    let clientInfo = await this.clientInformation();
+    if (!clientInfo)
+      return;
+    let supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? [], hasClientSecret = clientInfo.client_secret !== void 0, authMethod;
+    if (supportedMethods.length === 0 ? authMethod = hasClientSecret ? "client_secret_post" : "none" : hasClientSecret && supportedMethods.includes("client_secret_basic") ? authMethod = "client_secret_basic" : hasClientSecret && supportedMethods.includes("client_secret_post") ? authMethod = "client_secret_post" : supportedMethods.includes("none") ? authMethod = "none" : authMethod = hasClientSecret ? "client_secret_post" : "none", authMethod === "client_secret_basic") {
+      if (!clientInfo.client_secret)
+        throw new Error("client_secret_basic authentication requires a client_secret");
+      headers.set("Authorization", `Basic ${Buffer.from(`${clientInfo.client_id}:${clientInfo.client_secret}`).toString("base64")}`);
+      return;
+    }
+    params.has("client_id") || params.set("client_id", clientInfo.client_id), authMethod === "client_secret_post" && clientInfo.client_secret && !params.has("client_secret") && params.set("client_secret", clientInfo.client_secret);
+  };
+  prepareTokenRequest(scope) {
+    if (!this.usesClientCredentials)
+      return;
+    let params = new URLSearchParams({ grant_type: "client_credentials" }), requestedScope = scope ?? this.config.scope;
+    return requestedScope && params.set("scope", requestedScope), params;
+  }
+};
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-callback-server.js
+import { createServer } from "http";
+var HTML_SUCCESS = `<!DOCTYPE html>
+<html>
+<head>
+  <title>lunR - Authorization Successful</title>
+  <style>
+    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }
+    .container { text-align: center; padding: 2rem; }
+    h1 { color: #4ade80; margin-bottom: 1rem; }
+    p { color: #aaa; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>Authorization Successful</h1>
+    <p>You can close this window and return to lunR.</p>
+  </div>
+  <script>setTimeout(() => window.close(), 2000);</script>
+</body>
+</html>`;
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+var HTML_ERROR = (error) => `<!DOCTYPE html>
+<html>
+<head>
+  <title>lunR - Authorization Failed</title>
+  <style>
+    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }
+    .container { text-align: center; padding: 2rem; }
+    h1 { color: #f87171; margin-bottom: 1rem; }
+    p { color: #aaa; }
+    .error { color: #fca5a5; font-family: monospace; margin-top: 1rem; padding: 1rem; background: rgba(248,113,113,0.1); border-radius: 0.5rem; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>Authorization Failed</h1>
+    <p>An error occurred during authorization.</p>
+    <div class="error">${escapeHtml(error)}</div>
+  </div>
+</body>
+</html>`, server, bindingPromise, pendingAuths = /* @__PURE__ */ new Map(), reservedAuthStates = /* @__PURE__ */ new Set(), callbackOwners = /* @__PURE__ */ new Set(), CALLBACK_TIMEOUT_MS = 300 * 1e3, DEFAULT_OAUTH_CALLBACK_HOST = "localhost", callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST;
+function handleRequest(req, res) {
+  let url2 = new URL(req.url || "/", `http://${req.headers.host}`);
+  if (url2.pathname !== getOAuthCallbackPath()) {
+    res.writeHead(404, { "Content-Type": "text/plain" }), res.end("Not found");
+    return;
+  }
+  let code = url2.searchParams.get("code"), state = url2.searchParams.get("state"), error = url2.searchParams.get("error"), errorDescription = url2.searchParams.get("error_description");
+  if (!state) {
+    let errorMsg = "Missing required state parameter - potential CSRF attack";
+    res.writeHead(400, { "Content-Type": "text/html" }), res.end(HTML_ERROR(errorMsg));
+    return;
+  }
+  let pending = pendingAuths.get(state), isReserved = reservedAuthStates.has(state);
+  if (error) {
+    if (!pending && !isReserved) {
+      let errorMsg2 = "Invalid or expired state parameter - potential CSRF attack";
+      res.writeHead(400, { "Content-Type": "text/html" }), res.end(HTML_ERROR(errorMsg2));
+      return;
+    }
+    let errorMsg = errorDescription || error;
+    res.writeHead(200, { "Content-Type": "text/html" }), res.end(HTML_ERROR(errorMsg)), reservedAuthStates.delete(state), pending && (clearTimeout(pending.timeout), pendingAuths.delete(state), setTimeout(() => pending.reject(new Error(errorMsg)), 0));
+    return;
+  }
+  if (!pending) {
+    let errorMsg = "Invalid or expired state parameter - potential CSRF attack";
+    res.writeHead(400, { "Content-Type": "text/html" }), res.end(HTML_ERROR(errorMsg));
+    return;
+  }
+  if (!code) {
+    res.writeHead(400, { "Content-Type": "text/html" }), res.end(HTML_ERROR("No authorization code provided"));
+    return;
+  }
+  clearTimeout(pending.timeout), pendingAuths.delete(state), pending.resolve(code), res.writeHead(200, { "Content-Type": "text/html" }), res.end(HTML_SUCCESS);
+}
+async function withCallbackLock(action) {
+  for (; bindingPromise; )
+    await bindingPromise.catch(() => {
+    });
+  let operation = action();
+  bindingPromise = operation;
+  try {
+    await operation;
+  } finally {
+    bindingPromise === operation && (bindingPromise = void 0);
+  }
+}
+function acquireCallbackServerOwner() {
+  let owner = /* @__PURE__ */ Symbol("MCP OAuth owner");
+  return callbackOwners.add(owner), owner;
+}
+async function releaseCallbackServerOwner(owner) {
+  await withCallbackLock(async () => {
+    callbackOwners.delete(owner), callbackOwners.size === 0 && await stopCallbackServerLocked();
+  });
+}
+async function ensureCallbackServer(options = {}) {
+  await withCallbackLock(async () => {
+    if (throwIfAborted(options.signal), options.owner && !callbackOwners.has(options.owner))
+      throw new Error("MCP OAuth session closed");
+    await ensureCallbackServerLocked(options), throwIfAborted(options.signal);
+  });
+}
+async function ensureCallbackServerLocked(options = {}) {
+  let requiredPort = options.port ?? getConfiguredOAuthCallbackPort(), strictPort = options.strictPort === !0, requestedHost = options.callbackHost ?? DEFAULT_OAUTH_CALLBACK_HOST, rawRequestedPath = options.callbackPath ?? DEFAULT_OAUTH_CALLBACK_PATH, requestedPath = rawRequestedPath.startsWith("/") ? rawRequestedPath : `/${rawRequestedPath}`;
+  if (options.reserveState && !options.oauthState)
+    throw new Error("OAuth callback reservation requires an oauthState");
+  let reservedState, previousServer = server, needsStrictRebind = !!(previousServer && strictPort && getOAuthCallbackPort() !== requiredPort), needsHostSwitch = !!(previousServer && callbackServerHost !== requestedHost), needsPathSwitch = !!(previousServer && getOAuthCallbackPath() !== requestedPath);
+  if (previousServer) {
+    if (!needsStrictRebind && !needsHostSwitch) {
+      if (needsPathSwitch) {
+        if (pendingAuths.size > 0 || reservedAuthStates.size > 0)
+          throw new Error(`OAuth callback server is using path ${getOAuthCallbackPath()}, but callback path ${requestedPath} is required and cannot be switched while authorizations are pending`);
+        setOAuthCallbackPath(requestedPath);
+      }
+      options.reserveState && options.oauthState && !options.signal?.aborted && (reservedAuthStates.add(options.oauthState), reservedState = options.oauthState);
+      return;
+    }
+    if (pendingAuths.size > 0 || reservedAuthStates.size > 0)
+      throw new Error(`OAuth callback server is running on ${callbackServerHost}:${getOAuthCallbackPort()}, but strict callback endpoint ${requestedHost}:${requiredPort} is required and cannot be switched while authorizations are pending`);
+  }
+  let candidateServer = createServer(handleRequest), listenPort = strictPort ? requiredPort : 0;
+  try {
+    if (await new Promise((resolve2, reject) => {
+      candidateServer.once("error", (err) => {
+        reject(err);
+      }), candidateServer.listen(listenPort, requestedHost, () => {
+        resolve2();
+      });
+    }), strictPort)
+      setOAuthCallbackPort(requiredPort);
+    else {
+      let address = candidateServer.address();
+      if (!address || typeof address == "string" || typeof address.port != "number")
+        throw new Error("OAuth callback server did not report an assigned port");
+      setOAuthCallbackPort(address.port);
+    }
+    previousServer && (needsStrictRebind || needsHostSwitch) && await new Promise((resolve2) => {
+      previousServer.close(() => resolve2());
+    }), callbackServerHost = requestedHost, setOAuthCallbackPath(requestedPath), server = candidateServer, options.reserveState && options.oauthState && !options.signal?.aborted && (reservedAuthStates.add(options.oauthState), reservedState = options.oauthState), server.unref();
+  } catch (error) {
+    reservedState && reservedAuthStates.delete(reservedState);
+    let nodeError = error;
+    throw await new Promise((resolve2) => {
+      candidateServer.close(() => resolve2());
+    }), strictPort && nodeError.code === "EADDRINUSE" ? new Error(`OAuth callback port ${requiredPort} is already in use. Pre-registered OAuth clients require an exact redirect URI; set MCP_OAUTH_CALLBACK_PORT to your registered port or free port ${requiredPort}`, { cause: error }) : error;
+  }
+}
+function releaseCallbackServer(oauthState) {
+  reservedAuthStates.delete(oauthState);
+}
+function waitForCallback(oauthState) {
+  return reservedAuthStates.delete(oauthState), new Promise((resolve2, reject) => {
+    let timeout = setTimeout(() => {
+      pendingAuths.has(oauthState) && (pendingAuths.delete(oauthState), reject(new Error("OAuth callback timeout - authorization took too long")));
+    }, CALLBACK_TIMEOUT_MS);
+    pendingAuths.set(oauthState, { resolve: resolve2, reject, timeout });
+  });
+}
+function cancelPendingCallback(oauthState) {
+  reservedAuthStates.delete(oauthState);
+  let pending = pendingAuths.get(oauthState);
+  pending && (clearTimeout(pending.timeout), pendingAuths.delete(oauthState), pending.reject(new Error("Authorization cancelled")));
+}
+async function stopCallbackServerLocked() {
+  server && (await new Promise((resolve2) => {
+    server.close(() => {
+      resolve2();
+    });
+  }), server = void 0), setOAuthCallbackPort(getConfiguredOAuthCallbackPort()), callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST, setOAuthCallbackPath(DEFAULT_OAUTH_CALLBACK_PATH);
+  let pendingList = Array.from(pendingAuths.entries());
+  pendingAuths.clear(), reservedAuthStates.clear(), setTimeout(() => {
+    for (let [, pending] of pendingList)
+      clearTimeout(pending.timeout), pending.reject(new Error("OAuth callback server stopped"));
+  }, 0);
+}
+
+// packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/mcp-auth-flow.js
+var MANUAL_AUTH_TIMEOUT_MS = 300 * 1e3;
+function generateState() {
+  return Array.from(crypto.getRandomValues(new Uint8Array(32))).map((b2) => b2.toString(16).padStart(2, "0")).join("");
+}
+function extractOAuthConfig(definition) {
+  if (definition.oauth === !1)
+    return {};
+  let config = {};
+  if (definition.oauth?.grantType !== void 0 && (config.grantType = definition.oauth.grantType), definition.oauth?.clientId !== void 0 && (config.clientId = definition.oauth.clientId), definition.oauth?.clientSecret !== void 0 && (config.clientSecret = definition.oauth.clientSecret), definition.oauth?.scope !== void 0 && (config.scope = definition.oauth.scope), definition.oauth?.redirectUri !== void 0) {
+    if (typeof definition.oauth.redirectUri != "string")
+      throw new Error("OAuth redirectUri must be a string");
+    let redirectUri = definition.oauth.redirectUri.trim();
+    if (!redirectUri)
+      throw new Error("OAuth redirectUri must not be empty");
+    config.redirectUri = redirectUri;
+  }
+  if (definition.oauth?.clientName !== void 0) {
+    if (typeof definition.oauth.clientName != "string")
+      throw new Error("OAuth clientName must be a string");
+    let clientName = definition.oauth.clientName.trim();
+    if (!clientName)
+      throw new Error("OAuth clientName must not be empty");
+    config.clientName = clientName;
+  }
+  if (definition.oauth?.clientUri !== void 0) {
+    if (typeof definition.oauth.clientUri != "string")
+      throw new Error("OAuth clientUri must be a string");
+    let clientUri = definition.oauth.clientUri.trim();
+    if (!clientUri)
+      throw new Error("OAuth clientUri must not be empty");
+    config.clientUri = clientUri;
+  }
+  return config;
+}
+function parseOAuthRedirectUri(redirectUri) {
+  let url2;
+  try {
+    url2 = new URL(redirectUri);
+  } catch (error) {
+    throw new Error(`Invalid OAuth redirectUri: ${redirectUri}`, { cause: error });
+  }
+  let hostname = url2.hostname.toLowerCase(), isLocalhost = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
+  if (url2.protocol !== "http:" || !isLocalhost)
+    throw new Error("OAuth redirectUri must be an http:// localhost or loopback URI");
+  if (url2.username || url2.password)
+    throw new Error("OAuth redirectUri must not include username or password");
+  if (url2.hash)
+    throw new Error("OAuth redirectUri must not include a fragment");
+  if (!url2.port)
+    throw new Error("OAuth redirectUri must include an explicit numeric port");
+  let port = Number.parseInt(url2.port, 10);
+  if (!Number.isInteger(port) || port <= 0 || port > 65535)
+    throw new Error("OAuth redirectUri must include an explicit numeric port");
+  return { port, callbackHost: hostname === "[::1]" ? "::1" : hostname, callbackPath: url2.pathname };
+}
+function getSearchParamsFromInput(input) {
+  try {
+    let url2 = new URL(input), params = new URLSearchParams(url2.search);
+    if (url2.hash) {
+      let hash = url2.hash.startsWith("#") ? url2.hash.slice(1) : url2.hash, hashParams = new URLSearchParams(hash);
+      for (let [key, value] of hashParams)
+        params.has(key) || params.set(key, value);
+    }
+    return params;
+  } catch {
+    let query = input.includes("?") ? input.slice(input.indexOf("?") + 1) : input, params = new URLSearchParams(query.startsWith("#") ? query.slice(1) : query);
+    return params.has("code") || params.has("state") || params.has("error") ? params : void 0;
+  }
+}
+function parseAuthorizationCodeInput(input, expectedState) {
+  let trimmed = input.trim();
+  if (!trimmed)
+    throw new Error("Authorization code or redirect URL is required");
+  let params = getSearchParamsFromInput(trimmed);
+  if (params) {
+    let error = params.get("error");
+    if (error) {
+      let description = params.get("error_description");
+      throw new Error(description ? `${error}: ${description}` : error);
+    }
+    let state = params.get("state");
+    if (expectedState && !state)
+      throw new Error("OAuth state missing from redirect URL");
+    if (expectedState && state !== expectedState)
+      throw new Error("OAuth state mismatch - potential CSRF attack");
+    let code = params.get("code");
+    if (code)
+      return code;
+  }
+  if (/^[A-Za-z0-9._~+/=-]+$/.test(trimmed))
+    return trimmed;
+  throw new Error("Could not find an OAuth authorization code in the provided input");
+}
+function createMcpAuthFlow() {
+  let owner = acquireCallbackServerOwner(), flows = /* @__PURE__ */ new Map(), authenticating = /* @__PURE__ */ new Map(), shutdownPromise, closed = !1;
+  function assertOpen() {
+    if (closed)
+      throw new Error("MCP OAuth session closed");
+  }
+  async function clearPendingAuth(serverName, flow = flows.get(serverName)) {
+    flow && (flow.cleanup || (flow.cleanup = (async () => {
+      flows.get(serverName) === flow && flows.delete(serverName), flow.timer && clearTimeout(flow.timer), flow.controller.abort(new Error("Authorization cancelled")), cancelPendingCallback(flow.state.oauthState), releaseCallbackServer(flow.state.oauthState), await flow.transport?.close().catch(() => {
+      });
+    })()), await flow.cleanup);
+  }
+  async function startAuth(serverName, serverUrl, definition) {
+    assertOpen();
+    let previous = flows.get(serverName);
+    if (previous && await clearPendingAuth(serverName, previous), assertOpen(), flows.has(serverName))
+      throw new Error(`OAuth flow already pending for server: ${serverName}`);
+    let controller = new AbortController(), flow = { controller, state: { oauthState: generateState(), signal: controller.signal } };
+    flows.set(serverName, flow);
+    let signal = controller.signal, fetchFn = (input, init) => fetch(input, {
+      ...init,
+      signal: init?.signal ? AbortSignal.any([init.signal, signal]) : signal
+    });
+    try {
+      let config = definition ? extractOAuthConfig(definition) : {}, storedAuth = await getAuthForUrl(serverName, serverUrl);
+      if (throwIfAborted(signal), flow.state.clientInfo = storedAuth?.clientInfo, config.grantType !== "client_credentials") {
+        if (!config.redirectUri && !config.clientId) {
+          let registeredRedirect = storedAuth?.clientInfo?.redirectUris?.[0];
+          registeredRedirect && (config.redirectUri = registeredRedirect);
+        }
+        let redirect = config.redirectUri ? parseOAuthRedirectUri(config.redirectUri) : void 0;
+        await ensureCallbackServer({
+          owner,
+          signal,
+          strictPort: !!(config.clientId || storedAuth?.clientInfo) || config.redirectUri !== void 0,
+          oauthState: flow.state.oauthState,
+          reserveState: !0,
+          ...redirect ? { port: redirect.port, callbackHost: redirect.callbackHost, callbackPath: redirect.callbackPath } : {}
+        }), throwIfAborted(signal);
+      }
+      let capturedUrl, authProvider = new McpOAuthProvider(serverName, serverUrl, config, {
+        onRedirect: (url2) => {
+          throwIfAborted(signal), capturedUrl = url2;
+        }
+      }, flow.state), result = await abortable(auth(authProvider, { serverUrl, fetchFn }), signal);
+      if (throwIfAborted(signal), result === "AUTHORIZED")
+        return await clearPendingAuth(serverName, flow), { authorizationUrl: "" };
+      if (config.grantType === "client_credentials" || !capturedUrl)
+        throw new UnauthorizedError("OAuth authorization URL was not provided");
+      return flow.transport = new StreamableHTTPClientTransport(new URL(serverUrl), { authProvider, fetch: fetchFn }), flow.timer = setTimeout(() => {
+        clearPendingAuth(serverName, flow);
+      }, MANUAL_AUTH_TIMEOUT_MS), flow.timer.unref?.(), { authorizationUrl: capturedUrl.toString() };
+    } catch (error) {
+      throw await clearPendingAuth(serverName, flow), error;
+    }
+  }
+  async function completeAuthFromInput(serverName, input) {
+    assertOpen();
+    let flow = flows.get(serverName);
+    if (!flow)
+      throw new Error(`No pending OAuth flow for server: ${serverName}`);
+    return completeAuth(serverName, parseAuthorizationCodeInput(input, flow.state.oauthState));
+  }
+  async function completeAuth(serverName, code) {
+    assertOpen();
+    let flow = flows.get(serverName);
+    if (!flow?.transport)
+      throw new Error(`No pending OAuth flow for server: ${serverName}`);
+    try {
+      return await abortable(flow.transport.finishAuth(code), flow.state.signal), throwIfAborted(flow.state.signal), "authenticated";
+    } finally {
+      await clearPendingAuth(serverName, flow);
+    }
+  }
+  async function authenticate(serverName, serverUrl, definition, options = {}) {
+    assertOpen();
+    let pending = authenticating.get(serverName);
+    if (pending)
+      return pending;
+    let operation = (async () => {
+      let { authorizationUrl } = await startAuth(serverName, serverUrl, definition);
+      if (!authorizationUrl)
+        return "authenticated";
+      assertOpen();
+      let flow = flows.get(serverName);
+      if (!flow)
+        throw new Error(`No pending OAuth flow for server: ${serverName}`);
+      let callback = waitForCallback(flow.state.oauthState);
+      callback.catch(() => {
+      });
+      try {
+        options.onAuthorizationUrl ? await abortable(Promise.resolve(options.onAuthorizationUrl(authorizationUrl)), flow.state.signal) : console.log(`MCP Auth: Open this URL to authenticate ${serverName}:
+${authorizationUrl}`), throwIfAborted(flow.state.signal);
+        try {
+          await abortable(open(authorizationUrl), flow.state.signal);
+        } catch (error) {
+          throwIfAborted(flow.state.signal), console.warn(`MCP Auth: Failed to open browser for ${serverName}; waiting for manual callback`, { error });
+        }
+        let code = await callback;
+        return await completeAuth(serverName, code);
+      } catch (error) {
+        throw await clearPendingAuth(serverName, flow), error;
+      }
+    })();
+    authenticating.set(serverName, operation);
+    try {
+      return await operation;
+    } finally {
+      authenticating.get(serverName) === operation && authenticating.delete(serverName);
+    }
+  }
+  async function removeAuth(serverName) {
+    assertOpen(), await clearPendingAuth(serverName), clearAllCredentials(serverName);
+  }
+  function shutdown() {
+    return shutdownPromise || (closed = !0, shutdownPromise = (async () => {
+      await Promise.all([...flows].map(([name, flow]) => clearPendingAuth(name, flow))), await releaseCallbackServerOwner(owner);
+    })()), shutdownPromise;
+  }
+  return { startAuth, completeAuth, completeAuthFromInput, authenticate, removeAuth, shutdown };
+}
+function supportsOAuth(definition) {
+  return !definition.url || definition.auth === !1 || definition.oauth === !1 ? !1 : definition.auth === "oauth" ? !0 : definition.headers && Object.keys(definition.headers).length > 0 ? !1 : definition.auth === void 0;
+}
+
 // packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/init.js
-import { existsSync as existsSync2 } from "node:fs";
+import { existsSync as existsSync3 } from "node:fs";
 
 // packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/errors.js
 var McpUiError = class extends Error {
@@ -111,16 +2084,16 @@ var McpUiError = class extends Error {
 };
 var ConsentError = class extends McpUiError {
   denied;
-  constructor(server, options) {
-    let message = options.denied ? `Tool calls for "${server}" were denied for this session` : `Tool call approval required for "${server}"`;
+  constructor(server2, options) {
+    let message = options.denied ? `Tool calls for "${server2}" were denied for this session` : `Tool call approval required for "${server2}"`;
     super(message, {
       code: options.denied ? "CONSENT_DENIED" : "CONSENT_REQUIRED",
-      context: { server },
+      context: { server: server2 },
       recoveryHint: options.denied ? "The user denied tool access. Start a new session to try again." : "Prompt the user for consent before calling tools."
     }), this.name = "ConsentError", this.denied = options.denied ?? !1;
   }
 };
-var ServerError = class extends McpUiError {
+var ServerError2 = class extends McpUiError {
   constructor(reason, options) {
     super(`UI server error: ${reason}`, {
       code: "SERVER_ERROR",
@@ -410,7 +2383,7 @@ function inspectableError(err) {
 var __typeError = (msg) => {
   throw TypeError(msg);
 }, __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg), __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj)), __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value), __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), member.set(obj, value), value), __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method), _readyState, _url, _redirectUrl, _withCredentials, _fetch, _reconnectInterval, _reconnectTimer, _lastEventId, _controller, _parser, _onError, _onMessage, _onOpen, _EventSource_instances, connect_fn, _onFetchResponse, _onFetchError, getRequestOptions_fn, _onEvent, _onRetryChange, failConnection_fn, scheduleReconnect_fn, _reconnect, EventSource = class extends EventTarget {
-  constructor(url, eventSourceInitDict) {
+  constructor(url2, eventSourceInitDict) {
     var _a, _b;
     super(), __privateAdd(this, _EventSource_instances), this.CONNECTING = 0, this.OPEN = 1, this.CLOSED = 2, __privateAdd(this, _readyState), __privateAdd(this, _url), __privateAdd(this, _redirectUrl), __privateAdd(this, _withCredentials), __privateAdd(this, _fetch), __privateAdd(this, _reconnectInterval), __privateAdd(this, _reconnectTimer), __privateAdd(this, _lastEventId, null), __privateAdd(this, _controller), __privateAdd(this, _parser), __privateAdd(this, _onError, null), __privateAdd(this, _onMessage, null), __privateAdd(this, _onOpen, null), __privateAdd(this, _onFetchResponse, async (response) => {
       var _a2;
@@ -436,11 +2409,11 @@ var __typeError = (msg) => {
         __privateMethod(this, _EventSource_instances, failConnection_fn).call(this, "Invalid response body, expected a web ReadableStream", status), this.close();
         return;
       }
-      let decoder = new TextDecoder(), reader = body.getReader(), open2 = !0;
+      let decoder = new TextDecoder(), reader = body.getReader(), open3 = !0;
       do {
         let { done, value } = await reader.read();
-        value && __privateGet(this, _parser).feed(decoder.decode(value, { stream: !done })), done && (open2 = !1, __privateGet(this, _parser).reset(), __privateMethod(this, _EventSource_instances, scheduleReconnect_fn).call(this));
-      } while (open2);
+        value && __privateGet(this, _parser).feed(decoder.decode(value, { stream: !done })), done && (open3 = !1, __privateGet(this, _parser).reset(), __privateMethod(this, _EventSource_instances, scheduleReconnect_fn).call(this));
+      } while (open3);
     }), __privateAdd(this, _onFetchError, (err) => {
       __privateSet(this, _controller, void 0), !(err.name === "AbortError" || err.type === "aborted") && __privateMethod(this, _EventSource_instances, scheduleReconnect_fn).call(this, flattenError(err));
     }), __privateAdd(this, _onEvent, (event) => {
@@ -457,10 +2430,10 @@ var __typeError = (msg) => {
       __privateSet(this, _reconnectTimer, void 0), __privateGet(this, _readyState) === this.CONNECTING && __privateMethod(this, _EventSource_instances, connect_fn).call(this);
     });
     try {
-      if (url instanceof URL)
-        __privateSet(this, _url, url);
-      else if (typeof url == "string")
-        __privateSet(this, _url, new URL(url, getBaseURL()));
+      if (url2 instanceof URL)
+        __privateSet(this, _url, url2);
+      else if (typeof url2 == "string")
+        __privateSet(this, _url, new URL(url2, getBaseURL()));
       else
         throw new Error("Invalid URL");
     } catch {
@@ -620,8 +2593,8 @@ var SseError = class extends Error {
     super(`SSE error: ${message}`), this.code = code, this.event = event;
   }
 }, SSEClientTransport = class {
-  constructor(url, opts) {
-    this._url = url, this._resourceMetadataUrl = void 0, this._scope = void 0, this._eventSourceInit = opts?.eventSourceInit, this._requestInit = opts?.requestInit, this._authProvider = opts?.authProvider, this._fetch = opts?.fetch, this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit);
+  constructor(url2, opts) {
+    this._url = url2, this._resourceMetadataUrl = void 0, this._scope = void 0, this._eventSourceInit = opts?.eventSourceInit, this._requestInit = opts?.requestInit, this._authProvider = opts?.authProvider, this._fetch = opts?.fetch, this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit);
   }
   async _authThenStart() {
     if (!this._authProvider)
@@ -659,10 +2632,10 @@ var SseError = class extends Error {
     return new Promise((resolve2, reject) => {
       this._eventSource = new EventSource(this._url.href, {
         ...this._eventSourceInit,
-        fetch: async (url, init) => {
+        fetch: async (url2, init) => {
           let headers = await this._commonHeaders();
           headers.set("Accept", "text/event-stream");
-          let response = await fetchImpl(url, {
+          let response = await fetchImpl(url2, {
             ...init,
             headers
           });
@@ -764,8 +2737,8 @@ var SseError = class extends Error {
 };
 
 // packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/npx-resolver.js
-import { existsSync, readFileSync, realpathSync, readdirSync, statSync, writeFileSync, renameSync, mkdirSync, openSync, readSync, closeSync } from "node:fs";
-import { join, dirname, extname, resolve, sep } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync, readdirSync, statSync, writeFileSync as writeFileSync2, renameSync, mkdirSync as mkdirSync2, openSync, readSync, closeSync } from "node:fs";
+import { join as join2, dirname, extname, resolve, sep } from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 var CACHE_VERSION = 1, CACHE_TTL_MS = 1440 * 60 * 1e3;
 async function resolveNpxBinary(command, args) {
@@ -773,7 +2746,7 @@ async function resolveNpxBinary(command, args) {
   if (!parsed)
     return null;
   let cacheKey = JSON.stringify([command, ...args]), cached = loadCache()?.entries?.[cacheKey];
-  if (cached && Date.now() - cached.resolvedAt < CACHE_TTL_MS && existsSync(cached.resolvedBin))
+  if (cached && Date.now() - cached.resolvedAt < CACHE_TTL_MS && existsSync2(cached.resolvedBin))
     return { binPath: cached.resolvedBin, extraArgs: parsed.extraArgs, isJs: cached.isJs };
   let resolved = resolveFromNpmCache(parsed.packageSpec, parsed.binName);
   if (resolved)
@@ -868,12 +2841,12 @@ function resolveFromNpmCache(packageSpec, binName) {
   let packageDir = findCachedPackageDir(cacheDir, packageName);
   if (!packageDir)
     return null;
-  let packageJsonPath = join(packageDir, "package.json");
-  if (!existsSync(packageJsonPath))
+  let packageJsonPath = join2(packageDir, "package.json");
+  if (!existsSync2(packageJsonPath))
     return null;
   let pkg = null;
   try {
-    pkg = JSON.parse(readFileSync(packageJsonPath, "utf-8"));
+    pkg = JSON.parse(readFileSync2(packageJsonPath, "utf-8"));
   } catch {
     return null;
   }
@@ -896,8 +2869,8 @@ function resolveFromNpmCache(packageSpec, binName) {
   }
   if (!binRel)
     return null;
-  let nodeModulesDir = findNodeModulesDir(packageDir), binLink = chosenBinName ? join(nodeModulesDir, ".bin", chosenBinName) : null, resolvedBin = binLink && existsSync(binLink) ? safeRealpath(binLink) : "";
-  if (!resolvedBin && (resolvedBin = resolve(packageDir, binRel), !existsSync(resolvedBin)))
+  let nodeModulesDir = findNodeModulesDir(packageDir), binLink = chosenBinName ? join2(nodeModulesDir, ".bin", chosenBinName) : null, resolvedBin = binLink && existsSync2(binLink) ? safeRealpath(binLink) : "";
+  if (!resolvedBin && (resolvedBin = resolve(packageDir, binRel), !existsSync2(resolvedBin)))
     return null;
   let isJs = detectJsBinary(resolvedBin);
   return {
@@ -950,23 +2923,23 @@ function defaultBinName(packageName) {
   return packageName.startsWith("@") ? packageName.split("/")[1] ?? packageName.replace("@", "").replace("/", "-") : packageName;
 }
 function findCachedPackageDir(cacheDir, packageName) {
-  let npxDir = join(cacheDir, "_npx");
-  if (!existsSync(npxDir))
+  let npxDir = join2(cacheDir, "_npx");
+  if (!existsSync2(npxDir))
     return null;
   let packagePathParts = packageName.startsWith("@") ? packageName.split("/") : [packageName], candidates = readdirSync(npxDir, { withFileTypes: !0 }).filter((entry) => entry.isDirectory()).map((entry) => {
-    let full = join(npxDir, entry.name), mtime = safeStatMtime(full);
+    let full = join2(npxDir, entry.name), mtime = safeStatMtime(full);
     return { name: entry.name, mtime };
   }).sort((a2, b2) => b2.mtime - a2.mtime);
   for (let entry of candidates) {
-    let pkgDir = join(npxDir, entry.name, "node_modules", ...packagePathParts);
-    if (existsSync(join(pkgDir, "package.json")))
+    let pkgDir = join2(npxDir, entry.name, "node_modules", ...packagePathParts);
+    if (existsSync2(join2(pkgDir, "package.json")))
       return pkgDir;
   }
   return null;
 }
 function findNodeModulesDir(packageDir) {
   let parts = packageDir.split(sep), idx = parts.lastIndexOf("node_modules");
-  return idx >= 0 ? parts.slice(0, idx + 1).join(sep) : join(packageDir, "..");
+  return idx >= 0 ? parts.slice(0, idx + 1).join(sep) : join2(packageDir, "..");
 }
 function detectJsBinary(binPath) {
   let ext = extname(binPath).toLowerCase();
@@ -1007,10 +2980,10 @@ function getNpxCachePath() {
 }
 function loadCache() {
   let cachePath = getNpxCachePath();
-  if (!existsSync(cachePath))
+  if (!existsSync2(cachePath))
     return null;
   try {
-    let raw = JSON.parse(readFileSync(cachePath, "utf-8"));
+    let raw = JSON.parse(readFileSync2(cachePath, "utf-8"));
     return !raw || typeof raw != "object" || raw.version !== CACHE_VERSION || !raw.entries || typeof raw.entries != "object" ? null : raw;
   } catch {
     return null;
@@ -1018,18 +2991,18 @@ function loadCache() {
 }
 function saveCacheEntry(key, entry) {
   let cachePath = getNpxCachePath(), dir = dirname(cachePath);
-  mkdirSync(dir, { recursive: !0 });
+  mkdirSync2(dir, { recursive: !0 });
   let merged = { version: CACHE_VERSION, entries: {} };
   try {
-    if (existsSync(cachePath)) {
-      let existing = JSON.parse(readFileSync(cachePath, "utf-8"));
+    if (existsSync2(cachePath)) {
+      let existing = JSON.parse(readFileSync2(cachePath, "utf-8"));
       existing && existing.version === CACHE_VERSION && existing.entries && (merged.entries = { ...existing.entries });
     }
   } catch {
   }
   merged.entries[key] = entry;
   let tmpPath = `${cachePath}.${process.pid}.tmp`;
-  writeFileSync(tmpPath, JSON.stringify(merged, null, 2), "utf-8"), renameSync(tmpPath, cachePath);
+  writeFileSync2(tmpPath, JSON.stringify(merged, null, 2), "utf-8"), renameSync(tmpPath, cachePath);
 }
 function safeRealpath(path) {
   try {
@@ -1201,7 +3174,7 @@ function zeroUsage() {
 }
 
 // packages/coding-agent/dist/builtin-extensions/pi-mcp-adapter/elicitation-handler.js
-import open from "open";
+import open2 from "open";
 function registerElicitationHandler(client, options) {
   client.setRequestHandler(ElicitRequestSchema, (request) => handleElicitationRequest(options, request));
 }
@@ -1430,7 +3403,7 @@ async function handleUrlElicitation(options, params) {
   if (decision === "Decline")
     return { action: "decline" };
   try {
-    await open(params.url);
+    await open2(params.url);
   } catch (error) {
     return options.ui.notify(`Could not open MCP elicitation URL: ${error instanceof Error ? error.message : String(error)}`, "error"), { action: "cancel" };
   }
@@ -1571,7 +3544,7 @@ var McpServerManager = class {
     };
   }
   createClient(serverName) {
-    let capabilities = this.buildClientCapabilities(), client = new Client({ name: `pi-mcp-${serverName}`, version: "1.0.0" }, Object.keys(capabilities).length > 0 ? { capabilities } : void 0);
+    let capabilities = this.buildClientCapabilities(), client = new Client({ name: `lunR-mcp-${serverName}`, version: "1.0.0" }, Object.keys(capabilities).length > 0 ? { capabilities } : void 0);
     return this.samplingConfig && registerSamplingHandler(client, { ...this.samplingConfig, serverName }), this.elicitationConfig && (registerElicitationHandler(client, {
       ...this.elicitationConfig,
       serverName,
@@ -1600,7 +3573,7 @@ var McpServerManager = class {
   }
   async createHttpTransport(definition, serverName, signal) {
     throwIfAborted(signal);
-    let url = new URL(definition.url), headers = resolveHeaders(definition.headers) ?? {};
+    let url2 = new URL(definition.url), headers = resolveHeaders(definition.headers) ?? {};
     if (definition.auth === "bearer") {
       let token = resolveBearerToken(definition);
       token && (headers.Authorization = `Bearer ${token}`);
@@ -1613,20 +3586,20 @@ var McpServerManager = class {
         }
       });
     }
-    let streamableTransport = new StreamableHTTPClientTransport(url, {
+    let streamableTransport = new StreamableHTTPClientTransport(url2, {
       requestInit,
       authProvider
     });
     try {
-      let testClient = new Client({ name: "pi-mcp-probe", version: "2.1.2" });
+      let testClient = new Client({ name: "lunR-mcp-probe", version: "2.1.2" });
       return await testClient.connect(streamableTransport, this.buildRequestOptions(definition, signal)), await testClient.close().catch(() => {
       }), await streamableTransport.close().catch(() => {
-      }), new StreamableHTTPClientTransport(url, { requestInit, authProvider });
+      }), new StreamableHTTPClientTransport(url2, { requestInit, authProvider });
     } catch (error) {
       if (await streamableTransport.close().catch(() => {
       }), signal?.aborted && throwIfAborted(signal), error instanceof UnauthorizedError)
         throw error;
-      return new SSEClientTransport(url, { requestInit, authProvider });
+      return new SSEClientTransport(url2, { requestInit, authProvider });
     }
   }
   async fetchAllTools(client, requestOptions) {
@@ -1990,7 +3963,7 @@ function isTuiMode(ctx) {
 async function initializeMcp(pi, ctx, options = {}) {
   let signal = options.signal ?? ctx.signal;
   throwIfAborted(signal);
-  let configPath = pi.getFlag("mcp-config"), config = loadMcpConfig(configPath, ctx.cwd), manager = new McpServerManager(ctx.cwd);
+  let configPath = pi.getFlag("mcp-config"), config = loadMcpConfig(configPath, ctx.cwd, ctx.isProjectTrusted()), manager = new McpServerManager(ctx.cwd);
   manager.setDefaultRequestTimeoutMs(config.settings?.requestTimeoutMs);
   let samplingAutoApprove = config.settings?.samplingAutoApprove === !0;
   config.settings?.sampling !== !1 && (ctx.hasUI || samplingAutoApprove) && manager.setSamplingConfig({
@@ -2004,6 +3977,7 @@ async function initializeMcp(pi, ctx, options = {}) {
     allowUrl: isTuiMode(ctx)
   });
   let lifecycle = new McpLifecycleManager(manager), toolMetadata = /* @__PURE__ */ new Map(), failureTracker = /* @__PURE__ */ new Map(), uiResourceHandler = new UiResourceHandler(manager), consentManager = new ConsentManager("once-per-server"), ui = ctx.hasUI ? ctx.ui : void 0, state = {
+    authFlow: createMcpAuthFlow(),
     manager,
     lifecycle,
     toolMetadata,
@@ -2013,7 +3987,7 @@ async function initializeMcp(pi, ctx, options = {}) {
     consentManager,
     uiServer: null,
     completedUiSessions: [],
-    openBrowser: (url) => openUrl(pi, url, process.env.BROWSER),
+    openBrowser: (url2) => openUrl(pi, url2, process.env.BROWSER),
     ui,
     sendMessage: (message, options2) => pi.sendMessage(message, options2)
   };
@@ -2023,7 +3997,7 @@ async function initializeMcp(pi, ctx, options = {}) {
     return state;
   let idleSetting = typeof config.settings?.idleTimeout == "number" ? config.settings.idleTimeout : 10;
   lifecycle.setGlobalIdleTimeout(idleSetting);
-  let cachePath = getMetadataCachePath(), cacheFileExists = existsSync2(cachePath), cache = loadMetadataCache(), bootstrapAll = !1;
+  let cachePath = getMetadataCachePath(), cacheFileExists = existsSync3(cachePath), cache = loadMetadataCache(), bootstrapAll = !1;
   cacheFileExists ? cache || (cache = { version: 1, servers: {} }, saveMetadataCache(cache)) : (bootstrapAll = !0, saveMetadataCache({ version: 1, servers: {} }));
   let prefix = config.settings?.toolPrefix ?? "server";
   for (let [name, definition] of serverEntries) {
@@ -2166,7 +4140,9 @@ function getEffectiveIdleTimeoutMinutes(state, serverName) {
 }
 
 export {
-  ServerError,
+  getAuthForUrl,
+  supportsOAuth,
+  ServerError2 as ServerError,
   wrapError,
   logger,
   AZ,
@@ -2183,3 +4159,12 @@ export {
   getFailureAgeSeconds,
   lazyConnect
 };
+/*! Bundled license information:
+
+content-type/index.js:
+  (*!
+   * content-type
+   * Copyright(c) 2015 Douglas Christopher Wilson
+   * MIT Licensed
+   *)
+*/