@atxp/client 0.10.3 → 0.10.5

package/dist/node_modules/@modelcontextprotocol/sdk/dist/esm/server/auth/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sources":["../../../../../../../../../../node_modules/@modelcontextprotocol/sdk/dist/esm/server/auth/errors.js"],"sourcesContent":["/**\n * Base class for all OAuth errors\n */\nexport class OAuthError extends Error {\n    constructor(message, errorUri) {\n        super(message);\n        this.errorUri = errorUri;\n        this.name = this.constructor.name;\n    }\n    /**\n     * Converts the error to a standard OAuth error response object\n     */\n    toResponseObject() {\n        const response = {\n            error: this.errorCode,\n            error_description: this.message\n        };\n        if (this.errorUri) {\n            response.error_uri = this.errorUri;\n        }\n        return response;\n    }\n    get errorCode() {\n        return this.constructor.errorCode;\n    }\n}\n/**\n * Invalid request error - The request is missing a required parameter,\n * includes an invalid parameter value, includes a parameter more than once,\n * or is otherwise malformed.\n */\nexport class InvalidRequestError extends OAuthError {\n}\nInvalidRequestError.errorCode = \"invalid_request\";\n/**\n * Invalid client error - Client authentication failed (e.g., unknown client, no client\n * authentication included, or unsupported authentication method).\n */\nexport class InvalidClientError extends OAuthError {\n}\nInvalidClientError.errorCode = \"invalid_client\";\n/**\n * Invalid grant error - The provided authorization grant or refresh token is\n * invalid, expired, revoked, does not match the redirection URI used in the\n * authorization request, or was issued to another client.\n */\nexport class InvalidGrantError extends OAuthError {\n}\nInvalidGrantError.errorCode = \"invalid_grant\";\n/**\n * Unauthorized client error - The authenticated client is not authorized to use\n * this authorization grant type.\n */\nexport class UnauthorizedClientError extends OAuthError {\n}\nUnauthorizedClientError.errorCode = \"unauthorized_client\";\n/**\n * Unsupported grant type error - The authorization grant type is not supported\n * by the authorization server.\n */\nexport class UnsupportedGrantTypeError extends OAuthError {\n}\nUnsupportedGrantTypeError.errorCode = \"unsupported_grant_type\";\n/**\n * Invalid scope error - The requested scope is invalid, unknown, malformed, or\n * exceeds the scope granted by the resource owner.\n */\nexport class InvalidScopeError extends OAuthError {\n}\nInvalidScopeError.errorCode = \"invalid_scope\";\n/**\n * Access denied error - The resource owner or authorization server denied the request.\n */\nexport class AccessDeniedError extends OAuthError {\n}\nAccessDeniedError.errorCode = \"access_denied\";\n/**\n * Server error - The authorization server encountered an unexpected condition\n * that prevented it from fulfilling the request.\n */\nexport class ServerError extends OAuthError {\n}\nServerError.errorCode = \"server_error\";\n/**\n * Temporarily unavailable error - The authorization server is currently unable to\n * handle the request due to a temporary overloading or maintenance of the server.\n */\nexport class TemporarilyUnavailableError extends OAuthError {\n}\nTemporarilyUnavailableError.errorCode = \"temporarily_unavailable\";\n/**\n * Unsupported response type error - The authorization server does not support\n * obtaining an authorization code using this method.\n */\nexport class UnsupportedResponseTypeError extends OAuthError {\n}\nUnsupportedResponseTypeError.errorCode = \"unsupported_response_type\";\n/**\n * Unsupported token type error - The authorization server does not support\n * the requested token type.\n */\nexport class UnsupportedTokenTypeError extends OAuthError {\n}\nUnsupportedTokenTypeError.errorCode = \"unsupported_token_type\";\n/**\n * Invalid token error - The access token provided is expired, revoked, malformed,\n * or invalid for other reasons.\n */\nexport class InvalidTokenError extends OAuthError {\n}\nInvalidTokenError.errorCode = \"invalid_token\";\n/**\n * Method not allowed error - The HTTP method used is not allowed for this endpoint.\n * (Custom, non-standard error)\n */\nexport class MethodNotAllowedError extends OAuthError {\n}\nMethodNotAllowedError.errorCode = \"method_not_allowed\";\n/**\n * Too many requests error - Rate limit exceeded.\n * (Custom, non-standard error based on RFC 6585)\n */\nexport class TooManyRequestsError extends OAuthError {\n}\nTooManyRequestsError.errorCode = \"too_many_requests\";\n/**\n * Invalid client metadata error - The client metadata is invalid.\n * (Custom error for dynamic client registration - RFC 7591)\n */\nexport class InvalidClientMetadataError extends OAuthError {\n}\nInvalidClientMetadataError.errorCode = \"invalid_client_metadata\";\n/**\n * Insufficient scope error - The request requires higher privileges than provided by the access token.\n */\nexport class InsufficientScopeError extends OAuthError {\n}\nInsufficientScopeError.errorCode = \"insufficient_scope\";\n/**\n * A utility class for defining one-off error codes\n */\nexport class CustomOAuthError extends OAuthError {\n    constructor(customErrorCode, message, errorUri) {\n        super(message, errorUri);\n        this.customErrorCode = customErrorCode;\n    }\n    get errorCode() {\n        return this.customErrorCode;\n    }\n}\n/**\n * A full list of all OAuthErrors, enabling parsing from error responses\n */\nexport const OAUTH_ERRORS = {\n    [InvalidRequestError.errorCode]: InvalidRequestError,\n    [InvalidClientError.errorCode]: InvalidClientError,\n    [InvalidGrantError.errorCode]: InvalidGrantError,\n    [UnauthorizedClientError.errorCode]: UnauthorizedClientError,\n    [UnsupportedGrantTypeError.errorCode]: UnsupportedGrantTypeError,\n    [InvalidScopeError.errorCode]: InvalidScopeError,\n    [AccessDeniedError.errorCode]: AccessDeniedError,\n    [ServerError.errorCode]: ServerError,\n    [TemporarilyUnavailableError.errorCode]: TemporarilyUnavailableError,\n    [UnsupportedResponseTypeError.errorCode]: UnsupportedResponseTypeError,\n    [UnsupportedTokenTypeError.errorCode]: UnsupportedTokenTypeError,\n    [InvalidTokenError.errorCode]: InvalidTokenError,\n    [MethodNotAllowedError.errorCode]: MethodNotAllowedError,\n    [TooManyRequestsError.errorCode]: TooManyRequestsError,\n    [InvalidClientMetadataError.errorCode]: InvalidClientMetadataError,\n    [InsufficientScopeError.errorCode]: InsufficientScopeError,\n};\n//# sourceMappingURL=errors.js.map"],"names":[],"mappings":"AAAA;AACA;AACA;AACO,MAAM,UAAU,SAAS,KAAK,CAAC;AACtC,IAAI,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE;AACnC,QAAQ,KAAK,CAAC,OAAO,CAAC;AACtB,QAAQ,IAAI,CAAC,QAAQ,GAAG,QAAQ;AAChC,QAAQ,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI;AACzC,IAAI;AACJ;AACA;AACA;AACA,IAAI,gBAAgB,GAAG;AACvB,QAAQ,MAAM,QAAQ,GAAG;AACzB,YAAY,KAAK,EAAE,IAAI,CAAC,SAAS;AACjC,YAAY,iBAAiB,EAAE,IAAI,CAAC;AACpC,SAAS;AACT,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE;AAC3B,YAAY,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ;AAC9C,QAAQ;AACR,QAAQ,OAAO,QAAQ;AACvB,IAAI;AACJ,IAAI,IAAI,SAAS,GAAG;AACpB,QAAQ,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS;AACzC,IAAI;AACJ;AACA;AACA;AACA;AACA;AACA;AACO,MAAM,mBAAmB,SAAS,UAAU,CAAC;AACpD;AACA,mBAAmB,CAAC,SAAS,GAAG,iBAAiB;AACjD;AACA;AACA;AACA;AACO,MAAM,kBAAkB,SAAS,UAAU,CAAC;AACnD;AACA,kBAAkB,CAAC,SAAS,GAAG,gBAAgB;AAC/C;AACA;AACA;AACA;AACA;AACO,MAAM,iBAAiB,SAAS,UAAU,CAAC;AAClD;AACA,iBAAiB,CAAC,SAAS,GAAG,eAAe;AAC7C;AACA;AACA;AACA;AACO,MAAM,uBAAuB,SAAS,UAAU,CAAC;AACxD;AACA,uBAAuB,CAAC,SAAS,GAAG,qBAAqB;AACzD;AACA;AACA;AACA;AACO,MAAM,yBAAyB,SAAS,UAAU,CAAC;AAC1D;AACA,yBAAyB,CAAC,SAAS,GAAG,wBAAwB;AAC9D;AACA;AACA;AACA;AACO,MAAM,iBAAiB,SAAS,UAAU,CAAC;AAClD;AACA,iBAAiB,CAAC,SAAS,GAAG,eAAe;AAC7C;AACA;AACA;AACO,MAAM,iBAAiB,SAAS,UAAU,CAAC;AAClD;AACA,iBAAiB,CAAC,SAAS,GAAG,eAAe;AAC7C;AACA;AACA;AACA;AACO,MAAM,WAAW,SAAS,UAAU,CAAC;AAC5C;AACA,WAAW,CAAC,SAAS,GAAG,cAAc;AACtC;AACA;AACA;AACA;AACO,MAAM,2BAA2B,SAAS,UAAU,CAAC;AAC5D;AACA,2BAA2B,CAAC,SAAS,GAAG,yBAAyB;AACjE;AACA;AACA;AACA;AACO,MAAM,4BAA4B,SAAS,UAAU,CAAC;AAC7D;AACA,4BAA4B,CAAC,SAAS,GAAG,2BAA2B;AACpE;AACA;AACA;AACA;AACO,MAAM,yBAAyB,SAAS,UAAU,CAAC;AAC1D;AACA,yBAAyB,CAAC,SAAS,GAAG,wBAAwB;AAC9D;AACA;AACA;AACA;AACO,MAAM,iBAAiB,SAAS,UAAU,CAAC;AAClD;AACA,iBAAiB,CAAC,SAAS,GAAG,eAAe;AAC7C;AACA;AACA;AACA;AACO,MAAM,qBAAqB,SAAS,UAAU,CAAC;AACtD;AACA,qBAAqB,CAAC,SAAS,GAAG,oBAAoB;AACtD;AACA;AACA;AACA;AACO,MAAM,oBAAoB,SAAS,UAAU,CAAC;AACrD;AACA,oBAAoB,CAAC,SAAS,GAAG,mBAAmB;AACpD;AACA;AACA;AACA;AACO,MAAM,0BAA0B,SAAS,UAAU,CAAC;AAC3D;AACA,0BAA0B,CAAC,SAAS,GAAG,yBAAyB;AAChE;AACA;AACA;AACO,MAAM,sBAAsB,SAAS,UAAU,CAAC;AACvD;AACA,sBAAsB,CAAC,SAAS,GAAG,oBAAoB;AAavD;AACA;AACA;AACY,MAAC,YAAY,GAAG;AAC5B,IAAI,CAAC,mBAAmB,CAAC,SAAS,GAAG,mBAAmB;AACxD,IAAI,CAAC,kBAAkB,CAAC,SAAS,GAAG,kBAAkB;AACtD,IAAI,CAAC,iBAAiB,CAAC,SAAS,GAAG,iBAAiB;AACpD,IAAI,CAAC,uBAAuB,CAAC,SAAS,GAAG,uBAAuB;AAChE,IAAI,CAAC,yBAAyB,CAAC,SAAS,GAAG,yBAAyB;AACpE,IAAI,CAAC,iBAAiB,CAAC,SAAS,GAAG,iBAAiB;AACpD,IAAI,CAAC,iBAAiB,CAAC,SAAS,GAAG,iBAAiB;AACpD,IAAI,CAAC,WAAW,CAAC,SAAS,GAAG,WAAW;AACxC,IAAI,CAAC,2BAA2B,CAAC,SAAS,GAAG,2BAA2B;AACxE,IAAI,CAAC,4BAA4B,CAAC,SAAS,GAAG,4BAA4B;AAC1E,IAAI,CAAC,yBAAyB,CAAC,SAAS,GAAG,yBAAyB;AACpE,IAAI,CAAC,iBAAiB,CAAC,SAAS,GAAG,iBAAiB;AACpD,IAAI,CAAC,qBAAqB,CAAC,SAAS,GAAG,qBAAqB;AAC5D,IAAI,CAAC,oBAAoB,CAAC,SAAS,GAAG,oBAAoB;AAC1D,IAAI,CAAC,0BAA0B,CAAC,SAAS,GAAG,0BAA0B;AACtE,IAAI,CAAC,sBAAsB,CAAC,SAAS,GAAG,sBAAsB;AAC9D;;;;","x_google_ignoreList":[0]}
+{"version":3,"file":"errors.js","sources":["../../../../../../../../../../node_modules/@modelcontextprotocol/sdk/dist/esm/server/auth/errors.js"],"sourcesContent":["/**\n * Base class for all OAuth errors\n */\nexport class OAuthError extends Error {\n    constructor(message, errorUri) {\n        super(message);\n        this.errorUri = errorUri;\n        this.name = this.constructor.name;\n    }\n    /**\n     * Converts the error to a standard OAuth error response object\n     */\n    toResponseObject() {\n        const response = {\n            error: this.errorCode,\n            error_description: this.message\n        };\n        if (this.errorUri) {\n            response.error_uri = this.errorUri;\n        }\n        return response;\n    }\n    get errorCode() {\n        return this.constructor.errorCode;\n    }\n}\n/**\n * Invalid request error - The request is missing a required parameter,\n * includes an invalid parameter value, includes a parameter more than once,\n * or is otherwise malformed.\n */\nexport class InvalidRequestError extends OAuthError {\n}\nInvalidRequestError.errorCode = 'invalid_request';\n/**\n * Invalid client error - Client authentication failed (e.g., unknown client, no client\n * authentication included, or unsupported authentication method).\n */\nexport class InvalidClientError extends OAuthError {\n}\nInvalidClientError.errorCode = 'invalid_client';\n/**\n * Invalid grant error - The provided authorization grant or refresh token is\n * invalid, expired, revoked, does not match the redirection URI used in the\n * authorization request, or was issued to another client.\n */\nexport class InvalidGrantError extends OAuthError {\n}\nInvalidGrantError.errorCode = 'invalid_grant';\n/**\n * Unauthorized client error - The authenticated client is not authorized to use\n * this authorization grant type.\n */\nexport class UnauthorizedClientError extends OAuthError {\n}\nUnauthorizedClientError.errorCode = 'unauthorized_client';\n/**\n * Unsupported grant type error - The authorization grant type is not supported\n * by the authorization server.\n */\nexport class UnsupportedGrantTypeError extends OAuthError {\n}\nUnsupportedGrantTypeError.errorCode = 'unsupported_grant_type';\n/**\n * Invalid scope error - The requested scope is invalid, unknown, malformed, or\n * exceeds the scope granted by the resource owner.\n */\nexport class InvalidScopeError extends OAuthError {\n}\nInvalidScopeError.errorCode = 'invalid_scope';\n/**\n * Access denied error - The resource owner or authorization server denied the request.\n */\nexport class AccessDeniedError extends OAuthError {\n}\nAccessDeniedError.errorCode = 'access_denied';\n/**\n * Server error - The authorization server encountered an unexpected condition\n * that prevented it from fulfilling the request.\n */\nexport class ServerError extends OAuthError {\n}\nServerError.errorCode = 'server_error';\n/**\n * Temporarily unavailable error - The authorization server is currently unable to\n * handle the request due to a temporary overloading or maintenance of the server.\n */\nexport class TemporarilyUnavailableError extends OAuthError {\n}\nTemporarilyUnavailableError.errorCode = 'temporarily_unavailable';\n/**\n * Unsupported response type error - The authorization server does not support\n * obtaining an authorization code using this method.\n */\nexport class UnsupportedResponseTypeError extends OAuthError {\n}\nUnsupportedResponseTypeError.errorCode = 'unsupported_response_type';\n/**\n * Unsupported token type error - The authorization server does not support\n * the requested token type.\n */\nexport class UnsupportedTokenTypeError extends OAuthError {\n}\nUnsupportedTokenTypeError.errorCode = 'unsupported_token_type';\n/**\n * Invalid token error - The access token provided is expired, revoked, malformed,\n * or invalid for other reasons.\n */\nexport class InvalidTokenError extends OAuthError {\n}\nInvalidTokenError.errorCode = 'invalid_token';\n/**\n * Method not allowed error - The HTTP method used is not allowed for this endpoint.\n * (Custom, non-standard error)\n */\nexport class MethodNotAllowedError extends OAuthError {\n}\nMethodNotAllowedError.errorCode = 'method_not_allowed';\n/**\n * Too many requests error - Rate limit exceeded.\n * (Custom, non-standard error based on RFC 6585)\n */\nexport class TooManyRequestsError extends OAuthError {\n}\nTooManyRequestsError.errorCode = 'too_many_requests';\n/**\n * Invalid client metadata error - The client metadata is invalid.\n * (Custom error for dynamic client registration - RFC 7591)\n */\nexport class InvalidClientMetadataError extends OAuthError {\n}\nInvalidClientMetadataError.errorCode = 'invalid_client_metadata';\n/**\n * Insufficient scope error - The request requires higher privileges than provided by the access token.\n */\nexport class InsufficientScopeError extends OAuthError {\n}\nInsufficientScopeError.errorCode = 'insufficient_scope';\n/**\n * Invalid target error - The requested resource is invalid, missing, unknown, or malformed.\n * (Custom error for resource indicators - RFC 8707)\n */\nexport class InvalidTargetError extends OAuthError {\n}\nInvalidTargetError.errorCode = 'invalid_target';\n/**\n * A utility class for defining one-off error codes\n */\nexport class CustomOAuthError extends OAuthError {\n    constructor(customErrorCode, message, errorUri) {\n        super(message, errorUri);\n        this.customErrorCode = customErrorCode;\n    }\n    get errorCode() {\n        return this.customErrorCode;\n    }\n}\n/**\n * A full list of all OAuthErrors, enabling parsing from error responses\n */\nexport const OAUTH_ERRORS = {\n    [InvalidRequestError.errorCode]: InvalidRequestError,\n    [InvalidClientError.errorCode]: InvalidClientError,\n    [InvalidGrantError.errorCode]: InvalidGrantError,\n    [UnauthorizedClientError.errorCode]: UnauthorizedClientError,\n    [UnsupportedGrantTypeError.errorCode]: UnsupportedGrantTypeError,\n    [InvalidScopeError.errorCode]: InvalidScopeError,\n    [AccessDeniedError.errorCode]: AccessDeniedError,\n    [ServerError.errorCode]: ServerError,\n    [TemporarilyUnavailableError.errorCode]: TemporarilyUnavailableError,\n    [UnsupportedResponseTypeError.errorCode]: UnsupportedResponseTypeError,\n    [UnsupportedTokenTypeError.errorCode]: UnsupportedTokenTypeError,\n    [InvalidTokenError.errorCode]: InvalidTokenError,\n    [MethodNotAllowedError.errorCode]: MethodNotAllowedError,\n    [TooManyRequestsError.errorCode]: TooManyRequestsError,\n    [InvalidClientMetadataError.errorCode]: InvalidClientMetadataError,\n    [InsufficientScopeError.errorCode]: InsufficientScopeError,\n    [InvalidTargetError.errorCode]: InvalidTargetError\n};\n//# sourceMappingURL=errors.js.map"],"names":[],"mappings":"AAAA;AACA;AACA;AACO,MAAM,UAAU,SAAS,KAAK,CAAC;AACtC,IAAI,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE;AACnC,QAAQ,KAAK,CAAC,OAAO,CAAC;AACtB,QAAQ,IAAI,CAAC,QAAQ,GAAG,QAAQ;AAChC,QAAQ,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI;AACzC,IAAI;AACJ;AACA;AACA;AACA,IAAI,gBAAgB,GAAG;AACvB,QAAQ,MAAM,QAAQ,GAAG;AACzB,YAAY,KAAK,EAAE,IAAI,CAAC,SAAS;AACjC,YAAY,iBAAiB,EAAE,IAAI,CAAC;AACpC,SAAS;AACT,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE;AAC3B,YAAY,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ;AAC9C,QAAQ;AACR,QAAQ,OAAO,QAAQ;AACvB,IAAI;AACJ,IAAI,IAAI,SAAS,GAAG;AACpB,QAAQ,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS;AACzC,IAAI;AACJ;AACA;AACA;AACA;AACA;AACA;AACO,MAAM,mBAAmB,SAAS,UAAU,CAAC;AACpD;AACA,mBAAmB,CAAC,SAAS,GAAG,iBAAiB;AACjD;AACA;AACA;AACA;AACO,MAAM,kBAAkB,SAAS,UAAU,CAAC;AACnD;AACA,kBAAkB,CAAC,SAAS,GAAG,gBAAgB;AAC/C;AACA;AACA;AACA;AACA;AACO,MAAM,iBAAiB,SAAS,UAAU,CAAC;AAClD;AACA,iBAAiB,CAAC,SAAS,GAAG,eAAe;AAC7C;AACA;AACA;AACA;AACO,MAAM,uBAAuB,SAAS,UAAU,CAAC;AACxD;AACA,uBAAuB,CAAC,SAAS,GAAG,qBAAqB;AACzD;AACA;AACA;AACA;AACO,MAAM,yBAAyB,SAAS,UAAU,CAAC;AAC1D;AACA,yBAAyB,CAAC,SAAS,GAAG,wBAAwB;AAC9D;AACA;AACA;AACA;AACO,MAAM,iBAAiB,SAAS,UAAU,CAAC;AAClD;AACA,iBAAiB,CAAC,SAAS,GAAG,eAAe;AAC7C;AACA;AACA;AACO,MAAM,iBAAiB,SAAS,UAAU,CAAC;AAClD;AACA,iBAAiB,CAAC,SAAS,GAAG,eAAe;AAC7C;AACA;AACA;AACA;AACO,MAAM,WAAW,SAAS,UAAU,CAAC;AAC5C;AACA,WAAW,CAAC,SAAS,GAAG,cAAc;AACtC;AACA;AACA;AACA;AACO,MAAM,2BAA2B,SAAS,UAAU,CAAC;AAC5D;AACA,2BAA2B,CAAC,SAAS,GAAG,yBAAyB;AACjE;AACA;AACA;AACA;AACO,MAAM,4BAA4B,SAAS,UAAU,CAAC;AAC7D;AACA,4BAA4B,CAAC,SAAS,GAAG,2BAA2B;AACpE;AACA;AACA;AACA;AACO,MAAM,yBAAyB,SAAS,UAAU,CAAC;AAC1D;AACA,yBAAyB,CAAC,SAAS,GAAG,wBAAwB;AAC9D;AACA;AACA;AACA;AACO,MAAM,iBAAiB,SAAS,UAAU,CAAC;AAClD;AACA,iBAAiB,CAAC,SAAS,GAAG,eAAe;AAC7C;AACA;AACA;AACA;AACO,MAAM,qBAAqB,SAAS,UAAU,CAAC;AACtD;AACA,qBAAqB,CAAC,SAAS,GAAG,oBAAoB;AACtD;AACA;AACA;AACA;AACO,MAAM,oBAAoB,SAAS,UAAU,CAAC;AACrD;AACA,oBAAoB,CAAC,SAAS,GAAG,mBAAmB;AACpD;AACA;AACA;AACA;AACO,MAAM,0BAA0B,SAAS,UAAU,CAAC;AAC3D;AACA,0BAA0B,CAAC,SAAS,GAAG,yBAAyB;AAChE;AACA;AACA;AACO,MAAM,sBAAsB,SAAS,UAAU,CAAC;AACvD;AACA,sBAAsB,CAAC,SAAS,GAAG,oBAAoB;AACvD;AACA;AACA;AACA;AACO,MAAM,kBAAkB,SAAS,UAAU,CAAC;AACnD;AACA,kBAAkB,CAAC,SAAS,GAAG,gBAAgB;AAa/C;AACA;AACA;AACY,MAAC,YAAY,GAAG;AAC5B,IAAI,CAAC,mBAAmB,CAAC,SAAS,GAAG,mBAAmB;AACxD,IAAI,CAAC,kBAAkB,CAAC,SAAS,GAAG,kBAAkB;AACtD,IAAI,CAAC,iBAAiB,CAAC,SAAS,GAAG,iBAAiB;AACpD,IAAI,CAAC,uBAAuB,CAAC,SAAS,GAAG,uBAAuB;AAChE,IAAI,CAAC,yBAAyB,CAAC,SAAS,GAAG,yBAAyB;AACpE,IAAI,CAAC,iBAAiB,CAAC,SAAS,GAAG,iBAAiB;AACpD,IAAI,CAAC,iBAAiB,CAAC,SAAS,GAAG,iBAAiB;AACpD,IAAI,CAAC,WAAW,CAAC,SAAS,GAAG,WAAW;AACxC,IAAI,CAAC,2BAA2B,CAAC,SAAS,GAAG,2BAA2B;AACxE,IAAI,CAAC,4BAA4B,CAAC,SAAS,GAAG,4BAA4B;AAC1E,IAAI,CAAC,yBAAyB,CAAC,SAAS,GAAG,yBAAyB;AACpE,IAAI,CAAC,iBAAiB,CAAC,SAAS,GAAG,iBAAiB;AACpD,IAAI,CAAC,qBAAqB,CAAC,SAAS,GAAG,qBAAqB;AAC5D,IAAI,CAAC,oBAAoB,CAAC,SAAS,GAAG,oBAAoB;AAC1D,IAAI,CAAC,0BAA0B,CAAC,SAAS,GAAG,0BAA0B;AACtE,IAAI,CAAC,sBAAsB,CAAC,SAAS,GAAG,sBAAsB;AAC9D,IAAI,CAAC,kBAAkB,CAAC,SAAS,GAAG;AACpC;;;;","x_google_ignoreList":[0]}

package/dist/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js

@@ -0,0 +1,85 @@
+import { safeParse as safeParse$1 } from '../../../../../zod/v4/core/parse.js';
+
+// zod-compat.ts
+// ----------------------------------------------------
+// Unified types + helpers to accept Zod v3 and v4 (Mini)
+// ----------------------------------------------------
+// --- Runtime detection ---
+function isZ4Schema(s) {
+    // Present on Zod 4 (Classic & Mini) schemas; absent on Zod 3
+    const schema = s;
+    return !!schema._zod;
+}
+// --- Unified parsing ---
+function safeParse(schema, data) {
+    if (isZ4Schema(schema)) {
+        // Mini exposes top-level safeParse
+        const result = safeParse$1(schema, data);
+        return result;
+    }
+    const v3Schema = schema;
+    const result = v3Schema.safeParse(data);
+    return result;
+}
+// --- Shape extraction ---
+function getObjectShape(schema) {
+    if (!schema)
+        return undefined;
+    // Zod v3 exposes `.shape`; Zod v4 keeps the shape on `_zod.def.shape`
+    let rawShape;
+    if (isZ4Schema(schema)) {
+        const v4Schema = schema;
+        rawShape = v4Schema._zod?.def?.shape;
+    }
+    else {
+        const v3Schema = schema;
+        rawShape = v3Schema.shape;
+    }
+    if (!rawShape)
+        return undefined;
+    if (typeof rawShape === 'function') {
+        try {
+            return rawShape();
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return rawShape;
+}
+/**
+ * Gets the literal value from a schema, if it's a literal schema.
+ * Works with both Zod v3 and v4.
+ * Returns undefined if the schema is not a literal or the value cannot be determined.
+ */
+function getLiteralValue(schema) {
+    if (isZ4Schema(schema)) {
+        const v4Schema = schema;
+        const def = v4Schema._zod?.def;
+        if (def) {
+            // Try various ways to get the literal value
+            if (def.value !== undefined)
+                return def.value;
+            if (Array.isArray(def.values) && def.values.length > 0) {
+                return def.values[0];
+            }
+        }
+    }
+    const v3Schema = schema;
+    const def = v3Schema._def;
+    if (def) {
+        if (def.value !== undefined)
+            return def.value;
+        if (Array.isArray(def.values) && def.values.length > 0) {
+            return def.values[0];
+        }
+    }
+    // Fallback: check for direct value property (some Zod versions)
+    const directValue = schema.value;
+    if (directValue !== undefined)
+        return directValue;
+    return undefined;
+}
+
+export { getLiteralValue, getObjectShape, isZ4Schema, safeParse };
+//# sourceMappingURL=zod-compat.js.map

package/dist/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod-compat.js","sources":["../../../../../../../../../node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js"],"sourcesContent":["// zod-compat.ts\n// ----------------------------------------------------\n// Unified types + helpers to accept Zod v3 and v4 (Mini)\n// ----------------------------------------------------\nimport * as z3rt from 'zod/v3';\nimport * as z4mini from 'zod/v4-mini';\n// --- Runtime detection ---\nexport function isZ4Schema(s) {\n    // Present on Zod 4 (Classic & Mini) schemas; absent on Zod 3\n    const schema = s;\n    return !!schema._zod;\n}\n// --- Schema construction ---\nexport function objectFromShape(shape) {\n    const values = Object.values(shape);\n    if (values.length === 0)\n        return z4mini.object({}); // default to v4 Mini\n    const allV4 = values.every(isZ4Schema);\n    const allV3 = values.every(s => !isZ4Schema(s));\n    if (allV4)\n        return z4mini.object(shape);\n    if (allV3)\n        return z3rt.object(shape);\n    throw new Error('Mixed Zod versions detected in object shape.');\n}\n// --- Unified parsing ---\nexport function safeParse(schema, data) {\n    if (isZ4Schema(schema)) {\n        // Mini exposes top-level safeParse\n        const result = z4mini.safeParse(schema, data);\n        return result;\n    }\n    const v3Schema = schema;\n    const result = v3Schema.safeParse(data);\n    return result;\n}\nexport async function safeParseAsync(schema, data) {\n    if (isZ4Schema(schema)) {\n        // Mini exposes top-level safeParseAsync\n        const result = await z4mini.safeParseAsync(schema, data);\n        return result;\n    }\n    const v3Schema = schema;\n    const result = await v3Schema.safeParseAsync(data);\n    return result;\n}\n// --- Shape extraction ---\nexport function getObjectShape(schema) {\n    if (!schema)\n        return undefined;\n    // Zod v3 exposes `.shape`; Zod v4 keeps the shape on `_zod.def.shape`\n    let rawShape;\n    if (isZ4Schema(schema)) {\n        const v4Schema = schema;\n        rawShape = v4Schema._zod?.def?.shape;\n    }\n    else {\n        const v3Schema = schema;\n        rawShape = v3Schema.shape;\n    }\n    if (!rawShape)\n        return undefined;\n    if (typeof rawShape === 'function') {\n        try {\n            return rawShape();\n        }\n        catch {\n            return undefined;\n        }\n    }\n    return rawShape;\n}\n// --- Schema normalization ---\n/**\n * Normalizes a schema to an object schema. Handles both:\n * - Already-constructed object schemas (v3 or v4)\n * - Raw shapes that need to be wrapped into object schemas\n */\nexport function normalizeObjectSchema(schema) {\n    if (!schema)\n        return undefined;\n    // First check if it's a raw shape (Record<string, AnySchema>)\n    // Raw shapes don't have _def or _zod properties and aren't schemas themselves\n    if (typeof schema === 'object') {\n        // Check if it's actually a ZodRawShapeCompat (not a schema instance)\n        // by checking if it lacks schema-like internal properties\n        const asV3 = schema;\n        const asV4 = schema;\n        // If it's not a schema instance (no _def or _zod), it might be a raw shape\n        if (!asV3._def && !asV4._zod) {\n            // Check if all values are schemas (heuristic to confirm it's a raw shape)\n            const values = Object.values(schema);\n            if (values.length > 0 &&\n                values.every(v => typeof v === 'object' &&\n                    v !== null &&\n                    (v._def !== undefined ||\n                        v._zod !== undefined ||\n                        typeof v.parse === 'function'))) {\n                return objectFromShape(schema);\n            }\n        }\n    }\n    // If we get here, it should be an AnySchema (not a raw shape)\n    // Check if it's already an object schema\n    if (isZ4Schema(schema)) {\n        // Check if it's a v4 object\n        const v4Schema = schema;\n        const def = v4Schema._zod?.def;\n        if (def && (def.type === 'object' || def.shape !== undefined)) {\n            return schema;\n        }\n    }\n    else {\n        // Check if it's a v3 object\n        const v3Schema = schema;\n        if (v3Schema.shape !== undefined) {\n            return schema;\n        }\n    }\n    return undefined;\n}\n// --- Error message extraction ---\n/**\n * Safely extracts an error message from a parse result error.\n * Zod errors can have different structures, so we handle various cases.\n */\nexport function getParseErrorMessage(error) {\n    if (error && typeof error === 'object') {\n        // Try common error structures\n        if ('message' in error && typeof error.message === 'string') {\n            return error.message;\n        }\n        if ('issues' in error && Array.isArray(error.issues) && error.issues.length > 0) {\n            const firstIssue = error.issues[0];\n            if (firstIssue && typeof firstIssue === 'object' && 'message' in firstIssue) {\n                return String(firstIssue.message);\n            }\n        }\n        // Fallback: try to stringify the error\n        try {\n            return JSON.stringify(error);\n        }\n        catch {\n            return String(error);\n        }\n    }\n    return String(error);\n}\n// --- Schema metadata access ---\n/**\n * Gets the description from a schema, if available.\n * Works with both Zod v3 and v4.\n *\n * Both versions expose a `.description` getter that returns the description\n * from their respective internal storage (v3: _def, v4: globalRegistry).\n */\nexport function getSchemaDescription(schema) {\n    return schema.description;\n}\n/**\n * Checks if a schema is optional.\n * Works with both Zod v3 and v4.\n */\nexport function isSchemaOptional(schema) {\n    if (isZ4Schema(schema)) {\n        const v4Schema = schema;\n        return v4Schema._zod?.def?.type === 'optional';\n    }\n    const v3Schema = schema;\n    // v3 has isOptional() method\n    if (typeof schema.isOptional === 'function') {\n        return schema.isOptional();\n    }\n    return v3Schema._def?.typeName === 'ZodOptional';\n}\n/**\n * Gets the literal value from a schema, if it's a literal schema.\n * Works with both Zod v3 and v4.\n * Returns undefined if the schema is not a literal or the value cannot be determined.\n */\nexport function getLiteralValue(schema) {\n    if (isZ4Schema(schema)) {\n        const v4Schema = schema;\n        const def = v4Schema._zod?.def;\n        if (def) {\n            // Try various ways to get the literal value\n            if (def.value !== undefined)\n                return def.value;\n            if (Array.isArray(def.values) && def.values.length > 0) {\n                return def.values[0];\n            }\n        }\n    }\n    const v3Schema = schema;\n    const def = v3Schema._def;\n    if (def) {\n        if (def.value !== undefined)\n            return def.value;\n        if (Array.isArray(def.values) && def.values.length > 0) {\n            return def.values[0];\n        }\n    }\n    // Fallback: check for direct value property (some Zod versions)\n    const directValue = schema.value;\n    if (directValue !== undefined)\n        return directValue;\n    return undefined;\n}\n//# sourceMappingURL=zod-compat.js.map"],"names":["z4mini.safeParse"],"mappings":";;AAAA;AACA;AACA;AACA;AAGA;AACO,SAAS,UAAU,CAAC,CAAC,EAAE;AAC9B;AACA,IAAI,MAAM,MAAM,GAAG,CAAC;AACpB,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI;AACxB;AAcA;AACO,SAAS,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE;AACxC,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE;AAC5B;AACA,QAAQ,MAAM,MAAM,GAAGA,WAAgB,CAAC,MAAM,EAAE,IAAI,CAAC;AACrD,QAAQ,OAAO,MAAM;AACrB,IAAI;AACJ,IAAI,MAAM,QAAQ,GAAG,MAAM;AAC3B,IAAI,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC;AAC3C,IAAI,OAAO,MAAM;AACjB;AAWA;AACO,SAAS,cAAc,CAAC,MAAM,EAAE;AACvC,IAAI,IAAI,CAAC,MAAM;AACf,QAAQ,OAAO,SAAS;AACxB;AACA,IAAI,IAAI,QAAQ;AAChB,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE;AAC5B,QAAQ,MAAM,QAAQ,GAAG,MAAM;AAC/B,QAAQ,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK;AAC5C,IAAI;AACJ,SAAS;AACT,QAAQ,MAAM,QAAQ,GAAG,MAAM;AAC/B,QAAQ,QAAQ,GAAG,QAAQ,CAAC,KAAK;AACjC,IAAI;AACJ,IAAI,IAAI,CAAC,QAAQ;AACjB,QAAQ,OAAO,SAAS;AACxB,IAAI,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE;AACxC,QAAQ,IAAI;AACZ,YAAY,OAAO,QAAQ,EAAE;AAC7B,QAAQ;AACR,QAAQ,MAAM;AACd,YAAY,OAAO,SAAS;AAC5B,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,QAAQ;AACnB;AAwGA;AACA;AACA;AACA;AACA;AACO,SAAS,eAAe,CAAC,MAAM,EAAE;AACxC,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE;AAC5B,QAAQ,MAAM,QAAQ,GAAG,MAAM;AAC/B,QAAQ,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG;AACtC,QAAQ,IAAI,GAAG,EAAE;AACjB;AACA,YAAY,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;AACvC,gBAAgB,OAAO,GAAG,CAAC,KAAK;AAChC,YAAY,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;AACpE,gBAAgB,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACpC,YAAY;AACZ,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,QAAQ,GAAG,MAAM;AAC3B,IAAI,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI;AAC7B,IAAI,IAAI,GAAG,EAAE;AACb,QAAQ,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;AACnC,YAAY,OAAO,GAAG,CAAC,KAAK;AAC5B,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;AAChE,YAAY,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAChC,QAAQ;AACR,IAAI;AACJ;AACA,IAAI,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK;AACpC,IAAI,IAAI,WAAW,KAAK,SAAS;AACjC,QAAQ,OAAO,WAAW;AAC1B,IAAI,OAAO,SAAS;AACpB;;;;","x_google_ignoreList":[0]}

package/dist/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js

@@ -0,0 +1,30 @@
+import { getObjectShape, getLiteralValue, safeParse } from './zod-compat.js';
+import '../../../../../zod-to-json-schema/dist/esm/parsers/string.js';
+
+// zod-json-schema-compat.ts
+// ----------------------------------------------------
+// JSON Schema conversion for both Zod v3 and Zod v4 (Mini)
+// v3 uses your vendored converter; v4 uses Mini's toJSONSchema
+// ----------------------------------------------------
+function getMethodLiteral(schema) {
+    const shape = getObjectShape(schema);
+    const methodSchema = shape?.method;
+    if (!methodSchema) {
+        throw new Error('Schema is missing a method literal');
+    }
+    const value = getLiteralValue(methodSchema);
+    if (typeof value !== 'string') {
+        throw new Error('Schema method literal must be a string');
+    }
+    return value;
+}
+function parseWithCompat(schema, data) {
+    const result = safeParse(schema, data);
+    if (!result.success) {
+        throw result.error;
+    }
+    return result.data;
+}
+
+export { getMethodLiteral, parseWithCompat };
+//# sourceMappingURL=zod-json-schema-compat.js.map

package/dist/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod-json-schema-compat.js","sources":["../../../../../../../../../node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js"],"sourcesContent":["// zod-json-schema-compat.ts\n// ----------------------------------------------------\n// JSON Schema conversion for both Zod v3 and Zod v4 (Mini)\n// v3 uses your vendored converter; v4 uses Mini's toJSONSchema\n// ----------------------------------------------------\nimport * as z4mini from 'zod/v4-mini';\nimport { getObjectShape, safeParse, isZ4Schema, getLiteralValue } from './zod-compat.js';\nimport { zodToJsonSchema } from 'zod-to-json-schema';\nfunction mapMiniTarget(t) {\n    if (!t)\n        return 'draft-7';\n    if (t === 'jsonSchema7' || t === 'draft-7')\n        return 'draft-7';\n    if (t === 'jsonSchema2019-09' || t === 'draft-2020-12')\n        return 'draft-2020-12';\n    return 'draft-7'; // fallback\n}\nexport function toJsonSchemaCompat(schema, opts) {\n    if (isZ4Schema(schema)) {\n        // v4 branch — use Mini's built-in toJSONSchema\n        return z4mini.toJSONSchema(schema, {\n            target: mapMiniTarget(opts?.target),\n            io: opts?.pipeStrategy ?? 'input'\n        });\n    }\n    // v3 branch — use vendored converter\n    return zodToJsonSchema(schema, {\n        strictUnions: opts?.strictUnions ?? true,\n        pipeStrategy: opts?.pipeStrategy ?? 'input'\n    });\n}\nexport function getMethodLiteral(schema) {\n    const shape = getObjectShape(schema);\n    const methodSchema = shape?.method;\n    if (!methodSchema) {\n        throw new Error('Schema is missing a method literal');\n    }\n    const value = getLiteralValue(methodSchema);\n    if (typeof value !== 'string') {\n        throw new Error('Schema method literal must be a string');\n    }\n    return value;\n}\nexport function parseWithCompat(schema, data) {\n    const result = safeParse(schema, data);\n    if (!result.success) {\n        throw result.error;\n    }\n    return result.data;\n}\n//# sourceMappingURL=zod-json-schema-compat.js.map"],"names":[],"mappings":";;;AAAA;AACA;AACA;AACA;AACA;AA2BO,SAAS,gBAAgB,CAAC,MAAM,EAAE;AACzC,IAAI,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC;AACxC,IAAI,MAAM,YAAY,GAAG,KAAK,EAAE,MAAM;AACtC,IAAI,IAAI,CAAC,YAAY,EAAE;AACvB,QAAQ,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC;AAC7D,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG,eAAe,CAAC,YAAY,CAAC;AAC/C,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;AACnC,QAAQ,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC;AACjE,IAAI;AACJ,IAAI,OAAO,KAAK;AAChB;AACO,SAAS,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE;AAC9C,IAAI,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC;AAC1C,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;AACzB,QAAQ,MAAM,MAAM,CAAC,KAAK;AAC1B,IAAI;AACJ,IAAI,OAAO,MAAM,CAAC,IAAI;AACtB;;;;","x_google_ignoreList":[0]}

package/dist/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth-utils.js

@@ -7,7 +7,7 @@
  * Keeps everything else unchanged (scheme, domain, port, path, query).
  */
 function resourceUrlFromServerUrl(url) {
-    const resourceURL = typeof url === "string" ? new URL(url) : new URL(url.href);
+    const resourceURL = typeof url === 'string' ? new URL(url) : new URL(url.href);
     resourceURL.hash = ''; // Remove fragment
     return resourceURL;
 }
@@ -21,8 +21,8 @@ function resourceUrlFromServerUrl(url) {
  * @returns true if the requested resource matches the configured resource, false otherwise
  */
 function checkResourceAllowed({ requestedResource, configuredResource }) {
-    const requested = typeof requestedResource === "string" ? new URL(requestedResource) : new URL(requestedResource.href);
-    const configured = typeof configuredResource === "string" ? new URL(configuredResource) : new URL(configuredResource.href);
+    const requested = typeof requestedResource === 'string' ? new URL(requestedResource) : new URL(requestedResource.href);
+    const configured = typeof configuredResource === 'string' ? new URL(configuredResource) : new URL(configuredResource.href);
     // Compare the origin (scheme, domain, and port)
     if (requested.origin !== configured.origin) {
         return false;

package/dist/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-utils.js","sources":["../../../../../../../../../node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth-utils.js"],"sourcesContent":["/**\n * Utilities for handling OAuth resource URIs.\n */\n/**\n * Converts a server URL to a resource URL by removing the fragment.\n * RFC 8707 section 2 states that resource URIs \"MUST NOT include a fragment component\".\n * Keeps everything else unchanged (scheme, domain, port, path, query).\n */\nexport function resourceUrlFromServerUrl(url) {\n    const resourceURL = typeof url === \"string\" ? new URL(url) : new URL(url.href);\n    resourceURL.hash = ''; // Remove fragment\n    return resourceURL;\n}\n/**\n * Checks if a requested resource URL matches a configured resource URL.\n * A requested resource matches if it has the same scheme, domain, port,\n * and its path starts with the configured resource's path.\n *\n * @param requestedResource The resource URL being requested\n * @param configuredResource The resource URL that has been configured\n * @returns true if the requested resource matches the configured resource, false otherwise\n */\nexport function checkResourceAllowed({ requestedResource, configuredResource }) {\n    const requested = typeof requestedResource === \"string\" ? new URL(requestedResource) : new URL(requestedResource.href);\n    const configured = typeof configuredResource === \"string\" ? new URL(configuredResource) : new URL(configuredResource.href);\n    // Compare the origin (scheme, domain, and port)\n    if (requested.origin !== configured.origin) {\n        return false;\n    }\n    // Handle cases like requested=/foo and configured=/foo/\n    if (requested.pathname.length < configured.pathname.length) {\n        return false;\n    }\n    // Check if the requested path starts with the configured path\n    // Ensure both paths end with / for proper comparison\n    // This ensures that if we have paths like \"/api\" and \"/api/users\",\n    // we properly detect that \"/api/users\" is a subpath of \"/api\"\n    // By adding a trailing slash if missing, we avoid false positives\n    // where paths like \"/api123\" would incorrectly match \"/api\"\n    const requestedPath = requested.pathname.endsWith('/') ? requested.pathname : requested.pathname + '/';\n    const configuredPath = configured.pathname.endsWith('/') ? configured.pathname : configured.pathname + '/';\n    return requestedPath.startsWith(configuredPath);\n}\n//# sourceMappingURL=auth-utils.js.map"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,wBAAwB,CAAC,GAAG,EAAE;AAC9C,IAAI,MAAM,WAAW,GAAG,OAAO,GAAG,KAAK,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;AAClF,IAAI,WAAW,CAAC,IAAI,GAAG,EAAE,CAAC;AAC1B,IAAI,OAAO,WAAW;AACtB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,oBAAoB,CAAC,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,EAAE;AAChF,IAAI,MAAM,SAAS,GAAG,OAAO,iBAAiB,KAAK,QAAQ,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC;AAC1H,IAAI,MAAM,UAAU,GAAG,OAAO,kBAAkB,KAAK,QAAQ,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC;AAC9H;AACA,IAAI,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE;AAChD,QAAQ,OAAO,KAAK;AACpB,IAAI;AACJ;AACA,IAAI,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE;AAChE,QAAQ,OAAO,KAAK;AACpB,IAAI;AACJ;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,GAAG,GAAG;AAC1G,IAAI,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,GAAG,GAAG;AAC9G,IAAI,OAAO,aAAa,CAAC,UAAU,CAAC,cAAc,CAAC;AACnD;;;;","x_google_ignoreList":[0]}
+{"version":3,"file":"auth-utils.js","sources":["../../../../../../../../../node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth-utils.js"],"sourcesContent":["/**\n * Utilities for handling OAuth resource URIs.\n */\n/**\n * Converts a server URL to a resource URL by removing the fragment.\n * RFC 8707 section 2 states that resource URIs \"MUST NOT include a fragment component\".\n * Keeps everything else unchanged (scheme, domain, port, path, query).\n */\nexport function resourceUrlFromServerUrl(url) {\n    const resourceURL = typeof url === 'string' ? new URL(url) : new URL(url.href);\n    resourceURL.hash = ''; // Remove fragment\n    return resourceURL;\n}\n/**\n * Checks if a requested resource URL matches a configured resource URL.\n * A requested resource matches if it has the same scheme, domain, port,\n * and its path starts with the configured resource's path.\n *\n * @param requestedResource The resource URL being requested\n * @param configuredResource The resource URL that has been configured\n * @returns true if the requested resource matches the configured resource, false otherwise\n */\nexport function checkResourceAllowed({ requestedResource, configuredResource }) {\n    const requested = typeof requestedResource === 'string' ? new URL(requestedResource) : new URL(requestedResource.href);\n    const configured = typeof configuredResource === 'string' ? new URL(configuredResource) : new URL(configuredResource.href);\n    // Compare the origin (scheme, domain, and port)\n    if (requested.origin !== configured.origin) {\n        return false;\n    }\n    // Handle cases like requested=/foo and configured=/foo/\n    if (requested.pathname.length < configured.pathname.length) {\n        return false;\n    }\n    // Check if the requested path starts with the configured path\n    // Ensure both paths end with / for proper comparison\n    // This ensures that if we have paths like \"/api\" and \"/api/users\",\n    // we properly detect that \"/api/users\" is a subpath of \"/api\"\n    // By adding a trailing slash if missing, we avoid false positives\n    // where paths like \"/api123\" would incorrectly match \"/api\"\n    const requestedPath = requested.pathname.endsWith('/') ? requested.pathname : requested.pathname + '/';\n    const configuredPath = configured.pathname.endsWith('/') ? configured.pathname : configured.pathname + '/';\n    return requestedPath.startsWith(configuredPath);\n}\n//# sourceMappingURL=auth-utils.js.map"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,wBAAwB,CAAC,GAAG,EAAE;AAC9C,IAAI,MAAM,WAAW,GAAG,OAAO,GAAG,KAAK,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;AAClF,IAAI,WAAW,CAAC,IAAI,GAAG,EAAE,CAAC;AAC1B,IAAI,OAAO,WAAW;AACtB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,oBAAoB,CAAC,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,EAAE;AAChF,IAAI,MAAM,SAAS,GAAG,OAAO,iBAAiB,KAAK,QAAQ,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC;AAC1H,IAAI,MAAM,UAAU,GAAG,OAAO,kBAAkB,KAAK,QAAQ,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC;AAC9H;AACA,IAAI,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE;AAChD,QAAQ,OAAO,KAAK;AACpB,IAAI;AACJ;AACA,IAAI,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE;AAChE,QAAQ,OAAO,KAAK;AACpB,IAAI;AACJ;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,GAAG,GAAG;AAC1G,IAAI,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,GAAG,GAAG;AAC9G,IAAI,OAAO,aAAa,CAAC,UAAU,CAAC,cAAc,CAAC;AACnD;;;;","x_google_ignoreList":[0]}

package/dist/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js

@@ -1,174 +1,178 @@
-import { string as stringType, NEVER, object as objectType, boolean as booleanType, array as arrayType, number as numberType, any as anyType } from '../../../../../zod/v3/types.js';
-import { ZodIssueCode } from '../../../../../zod/v3/ZodError.js';
+import { url, looseObject, boolean, array, string, object, literal, any, number as number$1 } from '../../../../../zod/v4/classic/schemas.js';
+import { ZodIssueCode } from '../../../../../zod/v4/classic/compat.js';
+import { NEVER } from '../../../../../zod/v4/core/core.js';
+import { number } from '../../../../../zod/v4/classic/coerce.js';
 
 /**
  * Reusable URL validation that disallows javascript: scheme
  */
-const SafeUrlSchema = stringType().url()
+const SafeUrlSchema = url()
     .superRefine((val, ctx) => {
     if (!URL.canParse(val)) {
         ctx.addIssue({
             code: ZodIssueCode.custom,
-            message: "URL must be parseable",
-            fatal: true,
+            message: 'URL must be parseable',
+            fatal: true
         });
         return NEVER;
     }
-}).refine((url) => {
+})
+    .refine(url => {
     const u = new URL(url);
     return u.protocol !== 'javascript:' && u.protocol !== 'data:' && u.protocol !== 'vbscript:';
-}, { message: "URL cannot use javascript:, data:, or vbscript: scheme" });
+}, { message: 'URL cannot use javascript:, data:, or vbscript: scheme' });
 /**
  * RFC 9728 OAuth Protected Resource Metadata
  */
-const OAuthProtectedResourceMetadataSchema = objectType({
-    resource: stringType().url(),
-    authorization_servers: arrayType(SafeUrlSchema).optional(),
-    jwks_uri: stringType().url().optional(),
-    scopes_supported: arrayType(stringType()).optional(),
-    bearer_methods_supported: arrayType(stringType()).optional(),
-    resource_signing_alg_values_supported: arrayType(stringType()).optional(),
-    resource_name: stringType().optional(),
-    resource_documentation: stringType().optional(),
-    resource_policy_uri: stringType().url().optional(),
-    resource_tos_uri: stringType().url().optional(),
-    tls_client_certificate_bound_access_tokens: booleanType().optional(),
-    authorization_details_types_supported: arrayType(stringType()).optional(),
-    dpop_signing_alg_values_supported: arrayType(stringType()).optional(),
-    dpop_bound_access_tokens_required: booleanType().optional(),
-})
-    .passthrough();
+const OAuthProtectedResourceMetadataSchema = looseObject({
+    resource: string().url(),
+    authorization_servers: array(SafeUrlSchema).optional(),
+    jwks_uri: string().url().optional(),
+    scopes_supported: array(string()).optional(),
+    bearer_methods_supported: array(string()).optional(),
+    resource_signing_alg_values_supported: array(string()).optional(),
+    resource_name: string().optional(),
+    resource_documentation: string().optional(),
+    resource_policy_uri: string().url().optional(),
+    resource_tos_uri: string().url().optional(),
+    tls_client_certificate_bound_access_tokens: boolean().optional(),
+    authorization_details_types_supported: array(string()).optional(),
+    dpop_signing_alg_values_supported: array(string()).optional(),
+    dpop_bound_access_tokens_required: boolean().optional()
+});
 /**
  * RFC 8414 OAuth 2.0 Authorization Server Metadata
  */
-const OAuthMetadataSchema = objectType({
-    issuer: stringType(),
+const OAuthMetadataSchema = looseObject({
+    issuer: string(),
     authorization_endpoint: SafeUrlSchema,
     token_endpoint: SafeUrlSchema,
     registration_endpoint: SafeUrlSchema.optional(),
-    scopes_supported: arrayType(stringType()).optional(),
-    response_types_supported: arrayType(stringType()),
-    response_modes_supported: arrayType(stringType()).optional(),
-    grant_types_supported: arrayType(stringType()).optional(),
-    token_endpoint_auth_methods_supported: arrayType(stringType()).optional(),
-    token_endpoint_auth_signing_alg_values_supported: arrayType(stringType())
-        .optional(),
+    scopes_supported: array(string()).optional(),
+    response_types_supported: array(string()),
+    response_modes_supported: array(string()).optional(),
+    grant_types_supported: array(string()).optional(),
+    token_endpoint_auth_methods_supported: array(string()).optional(),
+    token_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
     service_documentation: SafeUrlSchema.optional(),
     revocation_endpoint: SafeUrlSchema.optional(),
-    revocation_endpoint_auth_methods_supported: arrayType(stringType()).optional(),
-    revocation_endpoint_auth_signing_alg_values_supported: arrayType(stringType())
-        .optional(),
-    introspection_endpoint: stringType().optional(),
-    introspection_endpoint_auth_methods_supported: arrayType(stringType())
-        .optional(),
-    introspection_endpoint_auth_signing_alg_values_supported: arrayType(stringType())
-        .optional(),
-    code_challenge_methods_supported: arrayType(stringType()).optional(),
-})
-    .passthrough();
+    revocation_endpoint_auth_methods_supported: array(string()).optional(),
+    revocation_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+    introspection_endpoint: string().optional(),
+    introspection_endpoint_auth_methods_supported: array(string()).optional(),
+    introspection_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+    code_challenge_methods_supported: array(string()).optional(),
+    client_id_metadata_document_supported: boolean().optional()
+});
 /**
  * OpenID Connect Discovery 1.0 Provider Metadata
  * see: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
  */
-const OpenIdProviderMetadataSchema = objectType({
-    issuer: stringType(),
+const OpenIdProviderMetadataSchema = looseObject({
+    issuer: string(),
     authorization_endpoint: SafeUrlSchema,
     token_endpoint: SafeUrlSchema,
     userinfo_endpoint: SafeUrlSchema.optional(),
     jwks_uri: SafeUrlSchema,
     registration_endpoint: SafeUrlSchema.optional(),
-    scopes_supported: arrayType(stringType()).optional(),
-    response_types_supported: arrayType(stringType()),
-    response_modes_supported: arrayType(stringType()).optional(),
-    grant_types_supported: arrayType(stringType()).optional(),
-    acr_values_supported: arrayType(stringType()).optional(),
-    subject_types_supported: arrayType(stringType()),
-    id_token_signing_alg_values_supported: arrayType(stringType()),
-    id_token_encryption_alg_values_supported: arrayType(stringType()).optional(),
-    id_token_encryption_enc_values_supported: arrayType(stringType()).optional(),
-    userinfo_signing_alg_values_supported: arrayType(stringType()).optional(),
-    userinfo_encryption_alg_values_supported: arrayType(stringType()).optional(),
-    userinfo_encryption_enc_values_supported: arrayType(stringType()).optional(),
-    request_object_signing_alg_values_supported: arrayType(stringType()).optional(),
-    request_object_encryption_alg_values_supported: arrayType(stringType())
-        .optional(),
-    request_object_encryption_enc_values_supported: arrayType(stringType())
-        .optional(),
-    token_endpoint_auth_methods_supported: arrayType(stringType()).optional(),
-    token_endpoint_auth_signing_alg_values_supported: arrayType(stringType())
-        .optional(),
-    display_values_supported: arrayType(stringType()).optional(),
-    claim_types_supported: arrayType(stringType()).optional(),
-    claims_supported: arrayType(stringType()).optional(),
-    service_documentation: stringType().optional(),
-    claims_locales_supported: arrayType(stringType()).optional(),
-    ui_locales_supported: arrayType(stringType()).optional(),
-    claims_parameter_supported: booleanType().optional(),
-    request_parameter_supported: booleanType().optional(),
-    request_uri_parameter_supported: booleanType().optional(),
-    require_request_uri_registration: booleanType().optional(),
+    scopes_supported: array(string()).optional(),
+    response_types_supported: array(string()),
+    response_modes_supported: array(string()).optional(),
+    grant_types_supported: array(string()).optional(),
+    acr_values_supported: array(string()).optional(),
+    subject_types_supported: array(string()),
+    id_token_signing_alg_values_supported: array(string()),
+    id_token_encryption_alg_values_supported: array(string()).optional(),
+    id_token_encryption_enc_values_supported: array(string()).optional(),
+    userinfo_signing_alg_values_supported: array(string()).optional(),
+    userinfo_encryption_alg_values_supported: array(string()).optional(),
+    userinfo_encryption_enc_values_supported: array(string()).optional(),
+    request_object_signing_alg_values_supported: array(string()).optional(),
+    request_object_encryption_alg_values_supported: array(string()).optional(),
+    request_object_encryption_enc_values_supported: array(string()).optional(),
+    token_endpoint_auth_methods_supported: array(string()).optional(),
+    token_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
+    display_values_supported: array(string()).optional(),
+    claim_types_supported: array(string()).optional(),
+    claims_supported: array(string()).optional(),
+    service_documentation: string().optional(),
+    claims_locales_supported: array(string()).optional(),
+    ui_locales_supported: array(string()).optional(),
+    claims_parameter_supported: boolean().optional(),
+    request_parameter_supported: boolean().optional(),
+    request_uri_parameter_supported: boolean().optional(),
+    require_request_uri_registration: boolean().optional(),
     op_policy_uri: SafeUrlSchema.optional(),
     op_tos_uri: SafeUrlSchema.optional(),
-})
-    .passthrough();
+    client_id_metadata_document_supported: boolean().optional()
+});
 /**
  * OpenID Connect Discovery metadata that may include OAuth 2.0 fields
  * This schema represents the real-world scenario where OIDC providers
  * return a mix of OpenID Connect and OAuth 2.0 metadata fields
  */
-const OpenIdProviderDiscoveryMetadataSchema = OpenIdProviderMetadataSchema.merge(OAuthMetadataSchema.pick({
-    code_challenge_methods_supported: true,
-}));
+const OpenIdProviderDiscoveryMetadataSchema = object({
+    ...OpenIdProviderMetadataSchema.shape,
+    ...OAuthMetadataSchema.pick({
+        code_challenge_methods_supported: true
+    }).shape
+});
 /**
  * OAuth 2.1 token response
  */
-const OAuthTokensSchema = objectType({
-    access_token: stringType(),
-    id_token: stringType().optional(), // Optional for OAuth 2.1, but necessary in OpenID Connect
-    token_type: stringType(),
-    expires_in: numberType().optional(),
-    scope: stringType().optional(),
-    refresh_token: stringType().optional(),
+const OAuthTokensSchema = object({
+    access_token: string(),
+    id_token: string().optional(), // Optional for OAuth 2.1, but necessary in OpenID Connect
+    token_type: string(),
+    expires_in: number().optional(),
+    scope: string().optional(),
+    refresh_token: string().optional()
 })
     .strip();
 /**
  * OAuth 2.1 error response
  */
-const OAuthErrorResponseSchema = objectType({
-    error: stringType(),
-    error_description: stringType().optional(),
-    error_uri: stringType().optional(),
+const OAuthErrorResponseSchema = object({
+    error: string(),
+    error_description: string().optional(),
+    error_uri: string().optional()
 });
+/**
+ * Optional version of SafeUrlSchema that allows empty string for retrocompatibility on tos_uri and logo_uri
+ */
+const OptionalSafeUrlSchema = SafeUrlSchema.optional().or(literal('').transform(() => undefined));
 /**
  * RFC 7591 OAuth 2.0 Dynamic Client Registration metadata
  */
-const OAuthClientMetadataSchema = objectType({
-    redirect_uris: arrayType(SafeUrlSchema),
-    token_endpoint_auth_method: stringType().optional(),
-    grant_types: arrayType(stringType()).optional(),
-    response_types: arrayType(stringType()).optional(),
-    client_name: stringType().optional(),
+const OAuthClientMetadataSchema = object({
+    redirect_uris: array(SafeUrlSchema),
+    token_endpoint_auth_method: string().optional(),
+    grant_types: array(string()).optional(),
+    response_types: array(string()).optional(),
+    client_name: string().optional(),
     client_uri: SafeUrlSchema.optional(),
-    logo_uri: SafeUrlSchema.optional(),
-    scope: stringType().optional(),
-    contacts: arrayType(stringType()).optional(),
-    tos_uri: SafeUrlSchema.optional(),
-    policy_uri: stringType().optional(),
+    logo_uri: OptionalSafeUrlSchema,
+    scope: string().optional(),
+    contacts: array(string()).optional(),
+    tos_uri: OptionalSafeUrlSchema,
+    policy_uri: string().optional(),
     jwks_uri: SafeUrlSchema.optional(),
-    jwks: anyType().optional(),
-    software_id: stringType().optional(),
-    software_version: stringType().optional(),
-    software_statement: stringType().optional(),
-}).strip();
+    jwks: any().optional(),
+    software_id: string().optional(),
+    software_version: string().optional(),
+    software_statement: string().optional()
+})
+    .strip();
 /**
  * RFC 7591 OAuth 2.0 Dynamic Client Registration client information
  */
-const OAuthClientInformationSchema = objectType({
-    client_id: stringType(),
-    client_secret: stringType().optional(),
-    client_id_issued_at: numberType().optional(),
-    client_secret_expires_at: numberType().optional(),
-}).strip();
+const OAuthClientInformationSchema = object({
+    client_id: string(),
+    client_secret: string().optional(),
+    client_id_issued_at: number$1().optional(),
+    client_secret_expires_at: number$1().optional()
+})
+    .strip();
 /**
  * RFC 7591 OAuth 2.0 Dynamic Client Registration full response (client information plus metadata)
  */
@@ -176,17 +180,19 @@ const OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthCl
 /**
  * RFC 7591 OAuth 2.0 Dynamic Client Registration error response
  */
-objectType({
-    error: stringType(),
-    error_description: stringType().optional(),
-}).strip();
+object({
+    error: string(),
+    error_description: string().optional()
+})
+    .strip();
 /**
  * RFC 7009 OAuth 2.0 Token Revocation request
  */
-objectType({
-    token: stringType(),
-    token_type_hint: stringType().optional(),
-}).strip();
+object({
+    token: string(),
+    token_type_hint: string().optional()
+})
+    .strip();
 
-export { OAuthClientInformationFullSchema, OAuthClientInformationSchema, OAuthClientMetadataSchema, OAuthErrorResponseSchema, OAuthMetadataSchema, OAuthProtectedResourceMetadataSchema, OAuthTokensSchema, OpenIdProviderDiscoveryMetadataSchema, OpenIdProviderMetadataSchema, SafeUrlSchema };
+export { OAuthClientInformationFullSchema, OAuthClientInformationSchema, OAuthClientMetadataSchema, OAuthErrorResponseSchema, OAuthMetadataSchema, OAuthProtectedResourceMetadataSchema, OAuthTokensSchema, OpenIdProviderDiscoveryMetadataSchema, OpenIdProviderMetadataSchema, OptionalSafeUrlSchema, SafeUrlSchema };
 //# sourceMappingURL=auth.js.map