@augmentcode/auggie 1.2.0-prerelease.202610260922 → 1.2.0-prerelease.202610261519

package/auggie-v2.mjs.d/extensions/mcp/index.js

@@ -21,7 +21,7 @@ ${i.join(`
 `)}
 When the user's request requires one of these servers, call attach-mcp-server immediately; it attaches directly without requiring user approval.`)}return n.join(`
 
-`)}function sr(t){let e={name:oo,label:oo,description:GM(),parameters:jg.Unsafe(DM),execute:(n,o,i,s,a)=>qM(t,a,o)},r={name:Nr,label:Nr,description:"Execute a discovered MCP tool by its original name, using the tool_name and mcp_server returned by find-tool.",parameters:jg.Unsafe(LM),execute:(n,o,i)=>HM(t,o,i,{toolCallId:n})};Lg(oo,"mcp"),Lg(Nr,"mcp"),t.registerTool(e),t.registerTool(r),$r(e),$r(r),Ug.debug("Registered tool-search gateway (find-tool, execute-tool)")}import{redactSecrets as gk}from"@augmentcode/auggie-v2";import{logger as zq,logPublic as Nq}from"@hermes/logger";import{logger as XM}from"@hermes/logger";import{logger as ZM}from"@hermes/logger";function pn(t){return new Promise(e=>setTimeout(e,t))}var Hg=ZM.child({prefix:"pi-mcp"}),mi={maxTries:3,initialMs:500,mult:2,maxMs:2e3},wd=3e4,ar=200,mt=class extends Error{statusCode;statusText;responseBody;constructor(e,r,n){super(`${e} ${r}: ${n}`),this.name="McpRegistryHttpError",this.statusCode=e,this.statusText=r,this.responseBody=n}};function bd(t){return t instanceof mt?t.statusCode>=500:!0}async function hn(t){let e;for(let r=0;r<mi.maxTries;r++)try{return await t()}catch(n){if(e=n,!bd(n))throw n;if(r<mi.maxTries-1){let o=Math.min(mi.initialMs*mi.mult**r,mi.maxMs);await pn(o)}}throw e}var Ra=class{apiKey;apiUrl;fetchImpl;timeoutMs;constructor(e,r,n){this.apiKey=e.apiKey,this.apiUrl=e.apiUrl.replace(/\/+$/,""),this.fetchImpl=r,this.timeoutMs=n??wd}async callApi(e,r){let o=await(this.fetchImpl??fetch)(`${this.apiUrl}${e}`,{method:"POST",headers:{Authorization:`Bearer ${this.apiKey}`,"Content-Type":"application/json"},body:r===void 0?"{}":JSON.stringify({product_type:r}),signal:AbortSignal.timeout(this.timeoutMs)});if(!o.ok){let i=await o.text().catch(()=>""),s=i.length>ar?`${i.slice(0,ar)}\u2026[truncated]`:i;throw new mt(o.status,o.statusText,s)}return await o.json()}getMcpTenantConfigs(e){return hn(()=>this.callApi("/settings/get-mcp-tenant-configs",e))}getMcpUserConfigs(e){return hn(()=>this.callApi("/settings/get-mcp-user-configs",e))}};async function Gg(t,e){let r=[],[n,o]=await Promise.allSettled([t.getMcpTenantConfigs(e),t.getMcpUserConfigs(e)]),i={},s={};if(n.status==="fulfilled")i=n.value;else{let a=`Failed to fetch tenant MCP configs: ${String(n.reason)}`;Hg.warn(a),r.push({message:a})}if(o.status==="fulfilled")s=o.value;else{let a=`Failed to fetch user MCP configs: ${String(o.reason)}`;Hg.warn(a),r.push({message:a})}return{tenant:i,user:s,diagnostics:r}}function BM(t){return t.replace(/[^A-Za-z0-9]/g,"_").toUpperCase()}var Zg=32;function WM(t){let e=t.toUpperCase();return e=e.replace(/[^A-Za-z0-9]/g,"_"),e=e.replace(/_+/g,"_"),e=e.replace(/^_+|_+$/g,""),e.length>Zg&&(e=e.slice(0,Zg)),e=e.replace(/_+$/,""),e}function Bg(t,e){let r=e?WM(e):"",n=BM(t);return r?`AUGMENT_MCP_${r}_${n}_OAUTH_CREDENTIALS`:`AUGMENT_MCP_${n}_OAUTH_CREDENTIALS`}function Wg(t){let e={accessToken:t.accessToken,refreshToken:t.refreshToken,clientSecret:t.clientSecret};return t.expiresAt!==void 0&&(e.expiresAt=t.expiresAt),t.resource&&(e.resource=t.resource),t.serverMetadata&&(e.serverMetadata=t.serverMetadata),t.client&&(e.client=t.client),JSON.stringify(e)}var VM=1e12,KM=/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-](\d{2}):(\d{2}))$/;function JM(t){let e=KM.exec(t);if(!e)return;let r=Number(e[1]),n=Number(e[2]),o=Number(e[3]),i=Number(e[4]),s=Number(e[5]),a=Number(e[6]),c=Number(e[7]??0),u=Number(e[8]??0),f=[31,r%4===0&&(r%100!==0||r%400===0)?29:28,31,30,31,30,31,31,30,31,30,31][n-1];if(f===void 0||o<1||o>f||i>23||s>59||a>59||c>23||u>59)return;let p=Date.parse(t);return Number.isNaN(p)?void 0:p}function YM(t){if(typeof t=="number"&&Number.isFinite(t))return t>0&&t<VM?t*1e3:t;if(typeof t=="string")return JM(t)}function Vg(t){let e=JSON.parse(t),r=typeof e.accessToken=="string"?e.accessToken:"",n=typeof e.refreshToken=="string"?e.refreshToken:void 0;if(!r&&!n)throw new Error("Invalid OAuth secret: missing or invalid accessToken");return{accessToken:r,refreshToken:n,clientSecret:typeof e.clientSecret=="string"?e.clientSecret:void 0,expiresAt:YM(e.expiresAt),resource:typeof e.resource=="string"?e.resource:void 0,serverMetadata:e.serverMetadata&&typeof e.serverMetadata=="object"?e.serverMetadata:void 0,client:e.client&&typeof e.client=="object"?e.client:void 0}}var Wt=XM.child({prefix:"pi-mcp"}),Z=class extends Error{constructor(){super("MCP OAuth credential persistence failed"),this.name="TokenPersistenceError"}},so=class extends Error{},Jg=[100,500],QM=Jg.length+1,e0=t=>new Promise(e=>{setTimeout(e,t)});function Kg(t){return t.replace(/[^a-zA-Z0-9_-]/g,"-")}var Cd="augment.mcp-access-token.",t0=JSON.stringify({retired:!0}),Ca=3;function Vt(t){return`${Cd}${t}`}function Pa(t){return`legacy:${t}`}function At(t){return t?.id?Bg(t.id,t.name):void 0}function vi(t){if(t)return{type:t.type??null,id:t.id??null,name:t.name??null,url:Yg(t.url),auth:null,registrySource:t.registrySource??null,vfsSource:t.vfsSource??null}}function Yg(t){if(typeof t!="string")return null;try{return new URL(t).toString()}catch{return t}}function _i(t){if(typeof t=="string")try{return _i(JSON.parse(t))??t}catch{return t}if(typeof t!="object"||t===null||Array.isArray(t))return t===void 0?void 0:JSON.stringify(t);let e=t;return JSON.stringify({type:e.type??null,id:e.id??null,name:e.name??null,url:Yg(e.url),auth:null,registrySource:e.registrySource??null,vfsSource:e.vfsSource??null})}function Mt(t){return _i(vi(t))}function r0(t){return _i(vi(t))}function n0(t){if(t.credentialState==="active"||t.credentialState==="retired")return t.credentialState;if(t.retired===!0)return"retired"}function io(t){try{let e=JSON.parse(t);return{credentialIdentity:_i(e.credentialIdentity),state:n0(e)}}catch{return{}}}function gi(t,e){let r={...t,type:"oauth",credentialIdentity:vi(e)};return JSON.stringify(r)}function mn(t,e){let r=Wg({accessToken:t.accessToken,refreshToken:t.refreshToken,clientSecret:t.client.client_secret,expiresAt:t.expiresAt,resource:t.resource,serverMetadata:t.serverMetadata,client:t.client});return JSON.stringify({...JSON.parse(r),credentialIdentity:vi(e),credentialState:"active"})}function o0(t){return JSON.stringify({credentialIdentity:vi(t),credentialState:"retired",retired:!0})}function i0(t,e){let r;try{r=JSON.parse(t)}catch{return}if(typeof r!="object"||r===null)return;let n=r,o=r0(e),i=_i(n.credentialIdentity);if(!(o&&(i===void 0?e?.auth!=="oauth":i!==o))&&!(typeof n.accessToken!="string"||n.accessToken.length===0||typeof n.serverMetadata!="object"||n.serverMetadata===null||typeof n.client!="object"||n.client===null))return{identityMatched:o!==void 0&&i===o,token:n}}function Rd(t){try{let e=Vg(t),r=e.serverMetadata,n=e.client;if(!r||!n||!e.accessToken&&!e.refreshToken||typeof r.authorization_endpoint!="string"||typeof r.token_endpoint!="string"||typeof n.client_id!="string")return;let o;return e.clientSecret?o=e.clientSecret:typeof n.client_secret=="string"&&(o=n.client_secret),{accessToken:e.accessToken,refreshToken:e.refreshToken,expiresAt:e.expiresAt,resource:e.resource,serverMetadata:{issuer:typeof r.issuer=="string"?r.issuer:r.authorization_endpoint,authorization_endpoint:r.authorization_endpoint,token_endpoint:r.token_endpoint},client:{client_id:n.client_id,...o?{client_secret:o}:{}}}}catch{return}}var yi=class{_memory=new Yn;_getClient;_shouldPersist;_dirtyGenerations=new Map;_durableQueues=new Map;_registryMemoryWriteGenerations=new Map;_registryMemoryAuthorities=new Map;_registryMemoryCommittedAuthorities=new Map;_delay;_nextGeneration=0;constructor(e,r,n,o=e0){if(this._getClient=e,this._shouldPersist=r,this._delay=typeof n=="function"?n:o,n&&typeof n!="function"){this._memory.seed(n);for(let[i,s]of n.credentialIdentities??[]){let a=Mt(s);a&&this._registryMemoryCommittedAuthorities.set(i,a)}}}get(e){return this._memory.get(e)}commit(e,r,n){this._memory.commit(e,r,n);let o=Mt(n);o?this._registryMemoryCommittedAuthorities.set(e,o):this._registryMemoryCommittedAuthorities.delete(e)}hasCredentialIdentity(e,r){return this._memory.hasCredentialIdentity(e,r)}reconcileCredentialIdentity(e,r,n){if(!this._memory.reconcileCredentialIdentity(e,r,n))return!1;let o=Mt(n);return o?this._registryMemoryCommittedAuthorities.set(e,o):this._registryMemoryCommittedAuthorities.delete(e),!0}clearLocalCredential(e){this._memory.clearLocalCredential(e),this._dirtyGenerations.delete(e),this._registryMemoryCommittedAuthorities.delete(e),this._registryMemoryWriteGenerations.set(e,(this._registryMemoryWriteGenerations.get(e)??0)+1),this._registryMemoryAuthorities.delete(e)}set(e,r,n){if(n?.id){let o=this._beginRegistryMemoryWrite(e,n);this._persist(e,r,n,!0,()=>{this._commitRegistryMemoryWrite(e,r,n,o)}).catch(()=>{Wt.error(`Failed to persist MCP OAuth token for "${e}"; authoritative memory was not changed`)});return}this._memory.set(e,r),this._registryMemoryCommittedAuthorities.delete(e),this._persist(e,r,n,!0).then(o=>{o&&this._memory.get(e)===r&&this.commit(e,r,n)}).catch(()=>{Wt.error(`Failed to persist MCP OAuth token for "${e}"; stored in-memory only`)})}async setAndPersist(e,r,n){if(n?.id){let i=this._beginRegistryMemoryWrite(e,n);await this._persist(e,r,n,!1,()=>{this._commitRegistryMemoryWrite(e,r,n,i)});return}let o=await this._persist(e,r,n,!1);this.commit(e,r,o?n:void 0)}_beginRegistryMemoryWrite(e,r){let n=Mt(r);if(!n)throw new Z;let o=(this._registryMemoryWriteGenerations.get(e)??0)+1;return this._registryMemoryWriteGenerations.set(e,o),this._registryMemoryAuthorities.set(e,n),{generation:o,identity:n,retirementGeneration:this._memory.credentialRetirementGeneration(e)}}_commitRegistryMemoryWrite(e,r,n,o){this._registryMemoryWriteGenerations.get(e)!==o.generation||this._registryMemoryAuthorities.get(e)!==o.identity||this._memory.credentialRetirementGeneration(e)!==o.retirementGeneration||(this._memory.commit(e,r,n),this._registryMemoryCommittedAuthorities.set(e,o.identity))}persist(e,r,n){return this._persist(e,r,n,!1)}async captureAuthenticatedIdentityVersion(e){let r=At(e),n=Mt(e),o=this._getClient();if(!(!r||!n||!o||!e))try{return await this._enqueueWrite(r,()=>this._captureAuthenticatedIdentityVersion({client:o,key:r,identity:n,registry:e}))}catch{throw new Z}}async _captureAuthenticatedIdentityVersion(e){for(let r=0;r<Ca;r+=1){let n=await this._captureIdentityVersionAttempt(e);if(n!==void 0)return n}throw new Z}async _captureIdentityVersionAttempt(e){let{client:r,key:n,identity:o,registry:i}=e,s=await r.getUserSecretWithVersion(n);if(!s)return"0";let a=io(s.value);if(a.state==="retired")return s.version;if(a.credentialIdentity!==void 0&&a.credentialIdentity!==o)throw new Z;if(a.credentialIdentity===o&&a.state==="active")return s.version;let c=Rd(s.value);if(!c)throw new Z;try{await r.upsertUserSecret(n,mn(c,i),s.version)}catch(u){if(!this._isVersionConflict(u))throw u}}async captureRefreshIdentityVersion(e){let r=At(e),n=Mt(e),o=this._getClient();if(!r||!n||!o){if(e?.id)throw new Z;return}try{return await this._enqueueWrite(r,async()=>{let i=await o.getUserSecretWithVersion(r);if(!i)throw new Z;let s=io(i.value);if(s.state!=="active"||s.credentialIdentity!==n||!Rd(i.value))throw new Z;return i.version})}catch{throw new Z}}persistAuthenticated(e,r,n,o){return this._persistAuthenticated(e,r,n,o)}persistRefresh(e,r,n,o){return this._persistAuthenticated(e,r,n,o)}async _persistAuthenticated(e,r,n,o){let i=this._getClient(),s=At(n),a=n&&s&&i&&o!==void 0?this._enqueueWrite(s,()=>i.upsertUserSecret(s,mn(r,n),o)):void 0,c=this._shouldPersist()&&i?()=>this._writeLegacyKey(e,r,!1,n):void 0;if(a)return this._drainRegistryWrites(e,a,c,void 0,n);if(n?.id||this._shouldPersist()&&!i)throw new Z;if(c)return{revision:await this._asPersistenceResult(c()),domain:Pa(e)}}restoreAfterSupersededRefresh(e,r,n,o,i,s){return this.restoreAfterSupersededAuthentication(e,r,n,o,i,s)}async restoreAfterSupersededAuthentication(e,r,n,o,i,s=o){let a=this._getClient(),c=At(o),u;if(c&&o){if(!a||!s||i?.domain!==`private:${o.id}`||At(s)!==c)throw new Z;if(u=await this._enqueueWrite(c,()=>this._restoreRegistryCredential({client:a,key:c,persistedToken:r,currentToken:n,persistedIdentity:o,currentIdentity:s,persistedRevision:i})),!u)return}if(!c&&At(s))throw new Z;if(!this._shouldPersist())return u;if(!a)throw new Z;if(c&&o){try{await this._enqueueWrite(Vt(e),()=>this._restoreLegacyCredential({client:a,key:Vt(e),persistedToken:r,currentToken:n,persistedIdentity:o,currentIdentity:s}))}catch{Wt.error(`Failed to mirror restored MCP OAuth token for "${e}" to the legacy key`)}return u}if(i?.domain!==Pa(e))throw new Z;try{return await this._enqueueWrite(Vt(e),()=>this._restoreLegacyCredentialExact({client:a,key:Vt(e),serverName:e,persistedToken:r,currentToken:n,persistedIdentity:o,currentIdentity:s,persistedRevision:i}))}catch{throw new Z}}async _restoreLegacyCredentialExact(e){let{client:r,key:n,serverName:o,persistedToken:i,currentToken:s,persistedIdentity:a,currentIdentity:c,persistedRevision:u}=e,d=await r.getUserSecretWithVersion(n);if(!(!d||d.version!==u.revision||d.value!==gi(i,a)))try{return{revision:await r.upsertUserSecret(n,gi(s,c),u.revision),domain:Pa(o)}}catch(l){if(this._isVersionConflict(l))return;throw l}}async _restoreRegistryCredential(e){let{client:r,key:n,persistedToken:o,currentToken:i,persistedIdentity:s,currentIdentity:a,persistedRevision:c}=e,u=await r.getUserSecretWithVersion(n);if(!(!u||u.version!==c.revision||u.value!==mn(o,s)))try{return{revision:await r.upsertUserSecret(n,mn(i,a),c.revision),domain:`private:${a.id}`}}catch(d){if(this._isVersionConflict(d))return;throw d}}async _restoreLegacyCredential(e){let{client:r,key:n,persistedToken:o,currentToken:i,persistedIdentity:s,currentIdentity:a}=e,c=await r.getUserSecretWithVersion(n);if(!(!c||c.value!==gi(o,s)))try{await r.upsertUserSecret(n,gi(i,a),c.version)}catch(u){if(!this._isVersionConflict(u))throw u}}async _drainRegistryWrites(e,r,n,o,i){let s;try{s=await r}catch{throw new Z}if(o?.(),i?.id&&!s)throw new Z;try{await n?.()}catch{Wt.error(`Failed to mirror MCP OAuth token for "${e}" to the legacy key`)}return i?.id&&s?{revision:s,domain:`private:${i.id}`}:void 0}async _writeRegistryCredential(e,r,n,o){let i=Mt(o);if(!i)throw new Z;for(let s=0;s<Ca;s+=1){let a=await e.getUserSecretWithVersion(r),c=a?io(a.value):{};if(c.state==="retired"||c.credentialIdentity!==void 0&&c.credentialIdentity!==i)throw new Z;try{return await this._upsertUserSecretOnce(e,r,mn(n,o),a?.version??"0")}catch(u){if(!this._isVersionConflict(u))throw u}}throw new Z}async _retireRegistryCredential(e,r,n){let o=Mt(n);if(!o)throw new Z;for(let i=0;i<Ca;i+=1){let s=await e.getUserSecretWithVersion(r),a=s?io(s.value):{};if(a.state==="retired"||a.credentialIdentity!==void 0&&a.credentialIdentity!==o)return;if(s&&a.credentialIdentity===void 0)throw new Z;try{await this._upsertUserSecretOnce(e,r,o0(n),s?.version??"0");return}catch(c){if(!this._isVersionConflict(c))throw c}}throw new Z}_isVersionConflict(e){return e instanceof mt&&(e.statusCode===412||e.statusCode===400&&e.responseBody.includes("version mismatch"))}async _persist(e,r,n,o,i){let s=this._getClient(),a=At(n),c=a&&n&&s?this._enqueueWrite(a,()=>{let d=this._getClient();if(!d)throw new Error("MCP secrets client unavailable");return this._writeRegistryCredential(d,a,r,n)},{credentialShape:"registry",operation:"write"}):void 0,u=this._shouldPersist()&&s?()=>this._writeLegacyKey(e,r,o,n):void 0;if(c)return this._drainRegistryWrites(e,c,u,i,n);if(n?.id||this._shouldPersist()&&!s)throw new Z;if(u)return{revision:await this._asPersistenceResult(u()),domain:Pa(e)}}snapshot(){return this._memory.snapshot()}async _asPersistenceResult(e){try{return await e}catch{throw new Z}}_enqueueWrite(e,r,n){let o=Kg(e),i=++this._nextGeneration;n?.onGeneration?.(i);let s=this._durableQueues.get(o),a=s??{latestGeneration:i,latestMutationGeneration:n?i:0,tail:Promise.resolve()};a.latestGeneration=i,n&&(a.latestMutationGeneration=i),s||this._durableQueues.set(o,a);let c=()=>this._runPersistence(a,i,r,n),u=s?a.tail.catch(()=>{}).then(c):c();return a.tail=u,u.finally(()=>{a.latestGeneration===i&&this._durableQueues.get(o)?.tail===u&&this._durableQueues.delete(o)}).catch(()=>{}),u}async _runPersistence(e,r,n,o){let i=o?QM:1;for(let s=0;s<i;s+=1){if(this._isLegacyPersistenceGateClosed(o))throw new so;try{return await n()}catch(a){this._throwIfPersistenceCanceled(e,r,o);let c=this._persistenceRetryDelay(a,s,o);if(c===void 0)throw a;await this._delay(c)}}throw new Z}_isLegacyPersistenceGateClosed(e){return e?.credentialShape==="legacy"&&!this._shouldPersist()}_throwIfPersistenceCanceled(e,r,n){if(n!==void 0&&e.latestMutationGeneration!==r||this._isLegacyPersistenceGateClosed(n))throw new so}_persistenceRetryDelay(e,r,n){let o=n?Jg[r]:void 0,i=!(e instanceof Z)&&bd(e);if(o===void 0||!i){n&&Wt.warn("MCP OAuth credential persistence exhausted retries",{attempts:r+1,credentialShape:n.credentialShape,operation:n.operation});return}return o}_upsertUserSecretOnce(e,r,n,o){return typeof e.upsertUserSecretOnce=="function"?e.upsertUserSecretOnce(r,n,o):e.upsertUserSecret(r,n,o)}_deleteUserSecretOnce(e,r){return typeof e.deleteUserSecretOnce=="function"?e.deleteUserSecretOnce(r):e.deleteUserSecret(r)}_writeLegacyKey(e,r,n,o){let i=0,s=this._enqueueWrite(Vt(e),async()=>{let a=this._getClient();if(!a)throw new Error("MCP secrets client unavailable");let c=await this._upsertUserSecretOnce(a,Vt(e),gi(r,o));return this._dirtyGenerations.get(e)===i&&this._dirtyGenerations.delete(e),c},{credentialShape:"legacy",operation:"write",onGeneration:a=>{i=a,this._dirtyGenerations.set(e,a)}});return s.catch(a=>{(a instanceof so||!n)&&this._dirtyGenerations.get(e)===i&&this._dirtyGenerations.delete(e)}),s}retireCredential(e,r,n){let o=Mt(r),i=this._registryMemoryCommittedAuthorities.get(e),s=n?.preserveNameState===!0&&(i===void 0||i!==o),a=(this._registryMemoryWriteGenerations.get(e)??0)+1;this._registryMemoryWriteGenerations.set(e,a),this._registryMemoryAuthorities.delete(e);let c=this._getClient(),u=At(r),d;u&&r&&(c?d=this._enqueueWrite(u,()=>{let p=this._getClient();if(!p)throw new Error("MCP secrets client unavailable");return this._retireRegistryCredential(p,u,r)},{credentialShape:"registry",operation:"delete"}):d=Promise.reject(new Z));let l=this._shouldPersist()&&!s,f;return l&&(c?f=this._enqueueWrite(Vt(e),async()=>{let p=await c.upsertUserSecret(Vt(e),t0)}):f=Promise.reject(new Z)),this._awaitRetirements(e,d,f).then(()=>{this._registryMemoryWriteGenerations.get(e)===a&&(this._memory.retireCredential(e,r,{preserveNameState:s}),s||(this._dirtyGenerations.delete(e),this._registryMemoryCommittedAuthorities.delete(e)))})}async _awaitRetirements(e,r,n){let[o,i]=await Promise.allSettled([r,n]);if(o.status==="rejected"&&Wt.error(`Failed to retire MCP OAuth credential identity for "${e}" durably`),i.status==="rejected"&&Wt.error(`Failed to retire legacy MCP OAuth credential for "${e}" durably`),o.status==="rejected")throw o.reason;if(i.status==="rejected")throw i.reason}delete(e,r){if(this._memory.delete(e),this._memory.clearAuthRequired(e),this._dirtyGenerations.delete(e),this._registryMemoryWriteGenerations.set(e,(this._registryMemoryWriteGenerations.get(e)??0)+1),this._registryMemoryAuthorities.delete(e),this._registryMemoryCommittedAuthorities.delete(e),this._retireRegistryKey(r),!this._shouldPersist()){this._dirtyGenerations.delete(e);return}let n=Vt(e);if(!this._canScheduleDurableOperation(n)){this._dirtyGenerations.delete(e);return}let o=0;this._enqueueWrite(n,async()=>{let s=this._getClient();if(!s)throw new Error("MCP secrets client unavailable");await this._deleteUserSecretOnce(s,n)},{credentialShape:"legacy",operation:"delete",onGeneration:s=>{o=s,this._dirtyGenerations.set(e,s)}}).then(()=>{this._dirtyGenerations.get(e)===o&&this._dirtyGenerations.delete(e)}).catch(s=>{s instanceof so&&this._dirtyGenerations.get(e)===o&&this._dirtyGenerations.delete(e)})}_retireRegistryKey(e){let r=At(e);!r||!e||!this._canScheduleDurableOperation(r)||this._enqueueWrite(r,async()=>{let n=this._getClient();if(!n)throw new Error("MCP secrets client unavailable");await this._retireRegistryCredential(n,r,e)},{credentialShape:"registry",operation:"delete"}).catch(()=>{Wt.error(`Failed to retire MCP OAuth registry credential "${r}" durably; cleared in-memory only`)})}_canScheduleDurableOperation(e){return!!(this._getClient()??this._durableQueues.get(Kg(e)))}markAuthRequired(e){this._memory.markAuthRequired(e)}isAuthRequired(e){return this._memory.isAuthRequired(e)}clearAuthRequired(e){this._memory.clearAuthRequired(e)}hasInFlightWrite(e){return this._dirtyGenerations.has(e)}async _loadRegistryToken(e,r){let n=At(r),o=Mt(r);if(!n||!o||!r)return{identityRejected:!1};try{return await this._enqueueWrite(n,()=>this._readRegistryToken({client:e,key:n,expectedIdentity:o,registry:r}))}catch{return{identityRejected:!0}}}async _readRegistryToken(e){for(let r=0;r<Ca;r+=1){let n=await this._readRegistryTokenAttempt(e);if(n!==void 0)return n}return{identityRejected:!0}}async _readRegistryTokenAttempt(e){let{client:r,key:n,expectedIdentity:o,registry:i}=e,s=await r.getUserSecretWithVersion(n);if(!s)return{identityRejected:!1,authorityVersion:"0"};let a=io(s.value);if(a.state==="retired"||(a.credentialIdentity===void 0?i.auth!=="oauth":a.credentialIdentity!==o))return{identityRejected:!0};let c=Rd(s.value);if(!c)return{identityRejected:!0};if(a.credentialIdentity===o&&a.state==="active")return{identityRejected:!1,token:c};try{return await r.upsertUserSecret(n,mn(c,i),s.version),{identityRejected:!1,token:c}}catch(u){return this._isVersionConflict(u)?void 0:{identityRejected:!0}}}async _importLegacyToken(e,r,n,o){let i=At(n),s=Mt(n);if(!i||!s||!n||o===void 0)return;let a=await this._loadLegacyToken(e,r,n);if(a)try{return await this._enqueueWrite(i,async()=>{let c=await e.getUserSecretWithVersion(i);if((c?.version??"0")===o){if(c){let u=io(c.value);if(u.state==="retired"||u.credentialIdentity!==void 0&&u.credentialIdentity!==s)return}return await e.upsertUserSecret(i,mn(a.token,n),o),{identityMatched:!0,token:a.token}}})}catch{return}}async _loadLegacyToken(e,r,n){try{let o=await e.getSecret(Vt(r));return o?i0(o,n):void 0}catch{return}}async ensureLoaded(e,r){if(this._memory.get(e)||!this._shouldPersist()||this.hasInFlightWrite(e))return;let o=this._getClient();if(!o)return;let i=this._memory.credentialRetirementGeneration(e),s=await this._loadRegistryToken(o,r);if(s.identityRejected)return;let a=s.token?{identityMatched:!0,token:s.token}:void 0;if(!(this._memory.get(e)||this.hasInFlightWrite(e)||this._memory.credentialRetirementGeneration(e)!==i)){if(!a){if(this._memory.isCredentialRetired(e))return;a=r?.id?await this._importLegacyToken(o,e,r,s.authorityVersion):await this._loadLegacyToken(o,e,r)}if(!a){Wt.debug(`Backend secret for MCP server "${e}" is not a usable OAuth token; ignoring`);return}this._memory.get(e)||this.hasInFlightWrite(e)||this._memory.credentialRetirementGeneration(e)!==i||(this.commit(e,a.token,a.identityMatched?r:void 0),Wt.debug(`Seeded MCP OAuth token for "${e}" from backend`))}}};var Xg="Augment Code",Qg="https://augmentcode.com",ey="https://storage.googleapis.com/augment-bazel-data/public/auth0/2024-10-15-auth0-augment-logo-512x512.png";var a0=1e3,c0=500;function xd(t,e=Date.now()){return t.expiresAt!==void 0&&e+2e4>=t.expiresAt}function Si(t,e=Date.now()){return t.expiresAt!==void 0&&t.expiresAt<=e}var Pd=class extends Error{constructor(){super("OAuth token response contained no access token"),Object.defineProperty(this,"name",{value:"MalformedRefreshResponseError",configurable:!0})}};function ty(t){return new URLSearchParams({k:t}).toString().slice(2)}function u0(t,e){let r=`${ty(t)}:${ty(e)}`;return`Basic ${btoa(r)}`}function iy(t){let e=t.client.client_secret;return e?.trim()?e:void 0}function d0(t){return t.client.token_endpoint_auth_method==="none"||!iy(t)?"none":t.client.token_endpoint_auth_method==="client_secret_basic"?"basic":"body"}function l0(t){return t==="basic"?"body":t==="body"?"basic":void 0}function f0(t){try{let e=JSON.parse(t);return typeof e.error=="string"?e.error:void 0}catch{return}}var p0=401,sy=500;function kd(t,...e){return t.status<sy&&t.oauthErrorCode!==void 0&&e.includes(t.oauthErrorCode)}function ry(t){return kd(t,"invalid_client","unauthorized")?!0:t.oauthErrorCode===void 0&&t.status===p0}async function ny(t,e,r){let n={"Content-Type":"application/x-www-form-urlencoded"},o=new URLSearchParams({grant_type:"refresh_token",refresh_token:t.refreshToken});r&&o.set("resource",r);let i=iy(t);e==="basic"&&i?n.Authorization=u0(t.client.client_id,i):(o.set("client_id",t.client.client_id),e==="body"&&i&&o.set("client_secret",i));let s=await fetch(t.serverMetadata.token_endpoint,{method:"POST",headers:n,body:o.toString(),signal:AbortSignal.timeout(1e4)});if(!s.ok){let c=await s.text().catch(()=>""),u=f0(c),d=c.slice(0,c0);throw new gn(s.status,s.statusText,d,u)}let a=await s.json();if(!a.access_token)throw new Pd;return{accessToken:a.access_token,refreshToken:a.refresh_token||t.refreshToken,expiresAt:a.expires_in?Date.now()+a.expires_in*a0:void 0,tokenType:a.token_type??t.tokenType,scope:a.scope??t.scope,serverMetadata:t.serverMetadata,client:t.client,resource:t.resource}}async function oy(t,e){try{return await ny(t,e,t.resource)}catch(r){if(r instanceof gn&&t.resource&&kd(r,"invalid_target"))return await ny(t,e,void 0);throw r}}var gn=class t extends Error{status;statusText;body;oauthErrorCode;clientAuthPlacementsExhausted;constructor(e,r,n,o,i=!1){super(`Token refresh failed: ${e} ${r}${n?` \u2014 ${n}`:""}`),this.name="RefreshHttpError",this.status=e,this.statusText=r,this.body=n,this.oauthErrorCode=o,this.clientAuthPlacementsExhausted=i}withClientAuthPlacementsExhausted(){return new t(this.status,this.statusText,this.body,this.oauthErrorCode,!0)}};function Ed(t){return!(t instanceof gn)||t.status>=sy?!1:kd(t,"invalid_grant","invalid_client")||t.clientAuthPlacementsExhausted}async function Td(t){if(!t.refreshToken)throw new Error("No refresh token available");let e=t,r=d0(t);try{return await oy(e,r)}catch(n){let o=l0(r);if(!(n instanceof gn)||!o||!ry(n))throw n;try{return await oy(e,o)}catch(i){throw i instanceof gn&&ry(i)?i.withClientAuthPlacementsExhausted():i}}}import{logger as a$}from"@hermes/logger";var $d;(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))&&($d="oauth4webapi/v3.8.6");function lo(t,e){if(t==null)return!1;try{return t instanceof e||Object.getPrototypeOf(t)[Symbol.toStringTag]===e.prototype[Symbol.toStringTag]}catch{return!1}}var Kt="ERR_INVALID_ARG_VALUE",Xe="ERR_INVALID_ARG_TYPE";function he(t,e,r){let n=new TypeError(t,{cause:r});return Object.assign(n,{code:e}),n}var Dd=Symbol(),h0=Symbol(),m0=Symbol(),vn=Symbol();var ay=Symbol();var g0=new TextEncoder,y0=new TextDecoder;function Id(t){return typeof t=="string"?g0.encode(t):y0.decode(t)}var Od;Uint8Array.prototype.toBase64?Od=t=>(t instanceof ArrayBuffer&&(t=new Uint8Array(t)),t.toBase64({alphabet:"base64url",omitPadding:!0})):Od=e=>{e instanceof ArrayBuffer&&(e=new Uint8Array(e));let r=[];for(let n=0;n<e.byteLength;n+=32768)r.push(String.fromCharCode.apply(null,e.subarray(n,n+32768)));return btoa(r.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")};var zd;Uint8Array.fromBase64?zd=t=>{try{return Uint8Array.fromBase64(t,{alphabet:"base64url"})}catch(e){throw he("The input to be decoded is not correctly encoded.",Kt,e)}}:zd=t=>{try{let e=atob(t.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"")),r=new Uint8Array(e.length);for(let n=0;n<e.length;n++)r[n]=e.charCodeAt(n);return r}catch(e){throw he("The input to be decoded is not correctly encoded.",Kt,e)}};function ka(t){return typeof t=="string"?zd(t):Od(t)}var co=class extends Error{code;constructor(e,r){super(e,r),this.name=this.constructor.name,this.code=K0,Error.captureStackTrace?.(this,this.constructor)}},wi=class extends Error{code;constructor(e,r){super(e,r),this.name=this.constructor.name,r?.code&&(this.code=r?.code),Error.captureStackTrace?.(this,this.constructor)}};function O(t,e,r){return new wi(t,{code:e,cause:r})}function Ea(t){return!(t===null||typeof t!="object"||Array.isArray(t))}function Ld(t){lo(t,Headers)&&(t=Object.fromEntries(t.entries()));let e=new Headers(t??{});if($d&&!e.has("user-agent")&&e.set("user-agent",$d),e.has("authorization"))throw he('"options.headers" must not include the "authorization" header name',Kt);return e}function jd(t,e){if(e!==void 0){if(typeof e=="function"&&(e=e(t.href)),!(e instanceof AbortSignal))throw he('"options.signal" must return or be an instance of AbortSignal',Xe);return e}}function v0(t){return t.includes("//")?t.replace("//","/"):t}function _0(t,e,r=!1){return t.pathname==="/"?t.pathname=e:t.pathname=v0(`${e}/${r?t.pathname:t.pathname.replace(/(\/)$/,"")}`),t}async function S0(t,e,r,n){if(!(t instanceof URL))throw he(`"${e}" must be an instance of URL`,Xe);vy(t,n?.[Dd]!==!0);let o=r(new URL(t.href)),i=Ld(n?.headers);return i.set("accept","application/json"),(n?.[vn]||fetch)(o.href,{body:void 0,headers:Object.fromEntries(i.entries()),method:"GET",redirect:"manual",signal:jd(o,n?.signal)})}function ao(t,e,r,n,o){try{if(typeof t!="number"||!Number.isFinite(t))throw he(`${r} must be a number`,Xe,o);if(t>0)return;if(e){if(t!==0)throw he(`${r} must be a non-negative number`,Kt,o);return}throw he(`${r} must be a positive number`,Kt,o)}catch(i){throw n?O(i.message,n,o):i}}function $e(t,e,r,n){try{if(typeof t!="string")throw he(`${e} must be a string`,Xe,n);if(t.length===0)throw he(`${e} must not be empty`,Kt,n)}catch(o){throw r?O(o.message,r,n):o}}async function dy(t,e){let r=t;if(!(r instanceof URL)&&r!==Ma)throw he('"expectedIssuerIdentifier" must be an instance of URL',Xe);if(!lo(e,Response))throw he('"response" must be an instance of Response',Xe);if(e.status!==200)throw O('"response" is not a conform Authorization Server Metadata response (unexpected HTTP status code)',Wd,e);Ci(e);let n=await za(e);if($e(n.issuer,'"response" body "issuer" property',V,{body:n}),r!==Ma&&new URL(n.issuer).href!==r.href)throw O('"response" body "issuer" property does not match the expected value',Ia,{expected:r.href,body:n,attribute:"issuer"});return n}function ly(t){b0(t,"application/json")}function w0(t,...e){let r='"response" content-type must be ';if(e.length>2){let n=e.pop();r+=`${e.join(", ")}, or ${n}`}else e.length===2?r+=`${e[0]} or ${e[1]}`:r+=e[0];return O(r,Y0,t)}function b0(t,e){if(O0(t)!==e)throw w0(t,e)}function Fd(){return ka(crypto.getRandomValues(new Uint8Array(32)))}function fy(){return Fd()}function py(){return Fd()}function hy(){return Fd()}async function my(t){return $e(t,"codeVerifier"),ka(await crypto.subtle.digest("SHA-256",Id(t)))}function Ud(t){let e=t?.[h0];return typeof e=="number"&&Number.isFinite(e)?e:0}function qd(t){let e=t?.[m0];return typeof e=="number"&&Number.isFinite(e)&&Math.sign(e)!==-1?e:30}function Hd(){return Math.floor(Date.now()/1e3)}function $a(t){if(typeof t!="object"||t===null)throw he('"as" must be an object',Xe);$e(t.issuer,'"as.issuer"')}function Gd(t){if(typeof t!="object"||t===null)throw he('"client" must be an object',Xe);$e(t.client_id,'"client.client_id"')}function cy(t){return encodeURIComponent(t).replace(/(?:[-_.!~*'()]|%20)/g,e=>{switch(e){case"-":case"_":case".":case"!":case"~":case"*":case"'":case"(":case")":return`%${e.charCodeAt(0).toString(16).toUpperCase()}`;case"%20":return"+";default:throw new Error}})}function Zd(t){return $e(t,'"clientSecret"'),(e,r,n,o)=>{n.set("client_id",r.client_id),n.set("client_secret",t)}}function gy(t){return $e(t,'"clientSecret"'),(e,r,n,o)=>{let i=cy(r.client_id),s=cy(t),a=btoa(`${i}:${s}`);o.set("authorization",`Basic ${a}`)}}function yy(){return(t,e,r,n)=>{r.set("client_id",e.client_id)}}var R0=URL.parse?(t,e)=>URL.parse(t,e):(t,e)=>{try{return new URL(t,e)}catch{return null}};function vy(t,e){if(e&&t.protocol!=="https:")throw O("only requests to HTTPS are allowed",X0,t);if(t.protocol!=="https:"&&t.protocol!=="http:")throw O("only HTTP and HTTPS requests are allowed",Q0,t)}function uy(t,e,r,n){let o;if(typeof t!="string"||!(o=R0(t)))throw O(`authorization server metadata does not contain a valid ${r?`"as.mtls_endpoint_aliases.${e}"`:`"as.${e}"`}`,t===void 0?e$:t$,{attribute:r?`mtls_endpoint_aliases.${e}`:e});return vy(o,n),o}function _y(t,e,r,n){return r&&t.mtls_endpoint_aliases&&e in t.mtls_endpoint_aliases?uy(t.mtls_endpoint_aliases[e],e,r,n):uy(t[e],e,r,n)}var uo=class extends Error{cause;code;error;status;error_description;response;constructor(e,r){super(e,r),this.name=this.constructor.name,this.code=V0,this.cause=r.cause,this.error=r.cause.error,this.status=r.response.status,this.error_description=r.cause.error_description,Object.defineProperty(this,"response",{enumerable:!1,value:r.response}),Error.captureStackTrace?.(this,this.constructor)}},bi=class extends Error{cause;code;error;error_description;constructor(e,r){super(e,r),this.name=this.constructor.name,this.code=J0,this.cause=r.cause,this.error=r.cause.get("error"),this.error_description=r.cause.get("error_description")??void 0,Error.captureStackTrace?.(this,this.constructor)}},Ri=class extends Error{cause;code;response;status;constructor(e,r){super(e,r),this.name=this.constructor.name,this.code=W0,this.cause=r.cause,this.status=r.response.status,this.response=r.response,Object.defineProperty(this,"response",{enumerable:!1}),Error.captureStackTrace?.(this,this.constructor)}},Ta="[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+",C0="[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}",P0='"((?:[^"\\\\]|\\\\[\\s\\S])*)"',x0="("+Ta+")\\s*=\\s*"+P0,k0="("+Ta+")\\s*=\\s*("+Ta+")",E0=new RegExp("^[,\\s]*("+Ta+")"),T0=new RegExp("^[,\\s]*"+x0+"[,\\s]*(.*)"),A0=new RegExp("^[,\\s]*"+k0+"[,\\s]*(.*)"),M0=new RegExp("^("+C0+")(?:$|[,\\s])(.*)");function $0(t){if(!lo(t,Response))throw he('"response" must be an instance of Response',Xe);let e=t.headers.get("www-authenticate");if(e===null)return;let r=[],n=e;for(;n;){let o=n.match(E0),i=o?.[1].toLowerCase();if(!i)return;let s=n.substring(o[0].length);if(s&&!s.match(/^[\s,]/))return;let a=s.match(/^\s+(.*)$/),c=!!a;n=a?a[1]:void 0;let u={},d;if(c)for(;n;){let f,p;if(o=n.match(T0)){if([,f,p,n]=o,p.includes("\\"))try{p=JSON.parse(`"${p}"`)}catch{}u[f.toLowerCase()]=p;continue}if(o=n.match(A0)){[,f,p,n]=o,u[f.toLowerCase()]=p;continue}if(o=n.match(M0)){if(Object.keys(u).length)break;[,d,n]=o;break}return}else n=s||void 0;let l={scheme:i,parameters:u};d&&(l.token68=d),r.push(l)}if(r.length)return r}async function I0(t){if(t.status>399&&t.status<500){Ci(t),ly(t);try{let e=await t.clone().json();if(Ea(e)&&typeof e.error=="string"&&e.error.length)return e}catch{}}}async function Sy(t,e,r){if(t.status!==e){L0(t);let n;throw(n=await I0(t))?(await t.body?.cancel(),new uo("server responded with an error in the response body",{cause:n,response:t})):O(`"response" is not a conform ${r} response (unexpected HTTP status code)`,Wd,t)}}function wy(t){if(!Bd.has(t))throw he('"options.DPoP" is not a valid DPoPHandle',Kt)}function O0(t){return t.headers.get("content-type")?.split(";")[0]}async function z0(t,e,r,n,o,i,s){return await r(t,e,o,i),i.set("content-type","application/x-www-form-urlencoded;charset=UTF-8"),(s?.[vn]||fetch)(n.href,{body:o,headers:Object.fromEntries(i.entries()),method:"POST",redirect:"manual",signal:jd(n,s?.signal)})}async function N0(t,e,r,n,o,i){let s=_y(t,"token_endpoint",e.use_mtls_endpoint_aliases,i?.[Dd]!==!0);o.set("grant_type",n);let a=Ld(i?.headers);a.set("accept","application/json"),i?.DPoP!==void 0&&(wy(i.DPoP),await i.DPoP.addProof(s,a,"POST"));let c=await z0(t,e,r,s,o,a,i);return i?.DPoP?.cacheNonce(c,s),c}var by=new WeakMap,D0=new WeakMap;function Ry(t){if(!t.id_token)return;let e=by.get(t);if(!e)throw he('"ref" was already garbage collected or did not resolve from the proper sources',Kt);return e}async function Cy(t,e,r,n,o,i){if($a(t),Gd(e),!lo(r,Response))throw he('"response" must be an instance of Response',Xe);await Sy(r,200,"Token Endpoint"),Ci(r);let s=await za(r);if($e(s.access_token,'"response" body "access_token" property',V,{body:s}),$e(s.token_type,'"response" body "token_type" property',V,{body:s}),s.token_type=s.token_type.toLowerCase(),s.expires_in!==void 0){let a=typeof s.expires_in!="number"?parseFloat(s.expires_in):s.expires_in;ao(a,!0,'"response" body "expires_in" property',V,{body:s}),s.expires_in=a}if(s.refresh_token!==void 0&&$e(s.refresh_token,'"response" body "refresh_token" property',V,{body:s}),s.scope!==void 0&&typeof s.scope!="string")throw O('"response" body "scope" property must be a string',V,{body:s});if(s.id_token!==void 0){$e(s.id_token,'"response" body "id_token" property',V,{body:s});let a=["aud","exp","iat","iss","sub"];e.require_auth_time===!0&&a.push("auth_time"),e.default_max_age!==void 0&&(ao(e.default_max_age,!0,'"client.default_max_age"'),a.push("auth_time")),n?.length&&a.push(...n);let{claims:c,jwt:u}=await r$(s.id_token,n$.bind(void 0,e.id_token_signed_response_alg,t.id_token_signing_alg_values_supported,"RS256"),Ud(e),qd(e),o).then(G0.bind(void 0,a)).then(F0.bind(void 0,t)).then(j0.bind(void 0,e.client_id));if(Array.isArray(c.aud)&&c.aud.length!==1){if(c.azp===void 0)throw O('ID Token "aud" (audience) claim includes additional untrusted audiences',Dr,{claims:c,claim:"aud"});if(c.azp!==e.client_id)throw O('unexpected ID Token "azp" (authorized party) claim value',Dr,{expected:e.client_id,claims:c,claim:"azp"})}c.auth_time!==void 0&&ao(c.auth_time,!0,'ID Token "auth_time" (authentication time)',V,{claims:c}),D0.set(r,u),by.set(s,c)}if(i?.[s.token_type]!==void 0)i[s.token_type](r,s);else if(s.token_type!=="dpop"&&s.token_type!=="bearer")throw new co("unsupported `token_type` value",{cause:{body:s}});return s}function L0(t){let e;if(e=$0(t))throw new Ri("server responded with a challenge in the WWW-Authenticate HTTP Header",{cause:e,response:t})}function j0(t,e){if(Array.isArray(e.claims.aud)){if(!e.claims.aud.includes(t))throw O('unexpected JWT "aud" (audience) claim value',Dr,{expected:t,claims:e.claims,claim:"aud"})}else if(e.claims.aud!==t)throw O('unexpected JWT "aud" (audience) claim value',Dr,{expected:t,claims:e.claims,claim:"aud"});return e}function F0(t,e){let r=t[s$]?.(e)??t.issuer;if(e.claims.iss!==r)throw O('unexpected JWT "iss" (issuer) claim value',Dr,{expected:r,claims:e.claims,claim:"iss"});return e}var Bd=new WeakSet;function U0(t){return Bd.add(t),t}var q0=Symbol();async function Py(t,e,r,n,o,i,s){if($a(t),Gd(e),!Bd.has(n))throw he('"callbackParameters" must be an instance of URLSearchParams obtained from "validateAuthResponse()", or "validateJwtAuthResponse()',Kt);$e(o,'"redirectUri"');let a=yn(n,"code");if(!a)throw O('no authorization code in "callbackParameters"',V);let c=new URLSearchParams(s?.additionalParameters);return c.set("redirect_uri",o),c.set("code",a),i!==q0&&($e(i,'"codeVerifier"'),c.set("code_verifier",i)),N0(t,e,r,"authorization_code",c,s)}var H0={aud:"audience",c_hash:"code hash",client_id:"client id",exp:"expiration time",iat:"issued at",iss:"issuer",jti:"jwt id",nonce:"nonce",s_hash:"state hash",sub:"subject",ath:"access token hash",htm:"http method",htu:"http uri",cnf:"confirmation",auth_time:"authentication time"};function G0(t,e){for(let r of t)if(e.claims[r]===void 0)throw O(`JWT "${r}" (${H0[r]}) claim missing`,V,{claims:e.claims});return e}var Ad=Symbol(),Md=Symbol();async function xy(t,e,r,n){return typeof n?.expectedNonce=="string"||typeof n?.maxAge=="number"||n?.requireIdToken?Z0(t,e,r,n.expectedNonce,n.maxAge,n[ay],n.recognizedTokenTypes):B0(t,e,r,n?.[ay],n?.recognizedTokenTypes)}async function Z0(t,e,r,n,o,i,s){let a=[];switch(n){case void 0:n=Ad;break;case Ad:break;default:$e(n,'"expectedNonce" argument'),a.push("nonce")}switch(o??=e.default_max_age,o){case void 0:o=Md;break;case Md:break;default:ao(o,!0,'"maxAge" argument'),a.push("auth_time")}let c=await Cy(t,e,r,a,i,s);$e(c.id_token,'"response" body "id_token" property',V,{body:c});let u=Ry(c);if(o!==Md){let d=Hd()+Ud(e),l=qd(e);if(u.auth_time+o<d-l)throw O("too much time has elapsed since the last End-User authentication",Aa,{claims:u,now:d,tolerance:l,claim:"auth_time"})}if(n===Ad){if(u.nonce!==void 0)throw O('unexpected ID Token "nonce" claim value',Dr,{expected:void 0,claims:u,claim:"nonce"})}else if(u.nonce!==n)throw O('unexpected ID Token "nonce" claim value',Dr,{expected:n,claims:u,claim:"nonce"});return c}async function B0(t,e,r,n,o){let i=await Cy(t,e,r,void 0,n,o),s=Ry(i);if(s){if(e.default_max_age!==void 0){ao(e.default_max_age,!0,'"client.default_max_age"');let a=Hd()+Ud(e),c=qd(e);if(s.auth_time+e.default_max_age<a-c)throw O("too much time has elapsed since the last End-User authentication",Aa,{claims:s,now:a,tolerance:c,claim:"auth_time"})}if(s.nonce!==void 0)throw O('unexpected ID Token "nonce" claim value',Dr,{expected:void 0,claims:s,claim:"nonce"})}return i}var W0="OAUTH_WWW_AUTHENTICATE_CHALLENGE",V0="OAUTH_RESPONSE_BODY_ERROR",K0="OAUTH_UNSUPPORTED_OPERATION",J0="OAUTH_AUTHORIZATION_RESPONSE_ERROR";var Nd="OAUTH_PARSE_ERROR",V="OAUTH_INVALID_RESPONSE";var Y0="OAUTH_RESPONSE_IS_NOT_JSON",Wd="OAUTH_RESPONSE_IS_NOT_CONFORM",X0="OAUTH_HTTP_REQUEST_FORBIDDEN",Q0="OAUTH_REQUEST_PROTOCOL_FORBIDDEN",Aa="OAUTH_JWT_TIMESTAMP_CHECK_FAILED",Dr="OAUTH_JWT_CLAIM_COMPARISON_FAILED",Ia="OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED";var e$="OAUTH_MISSING_SERVER_METADATA",t$="OAUTH_INVALID_SERVER_METADATA";function Ci(t){if(t.bodyUsed)throw he('"response" body has been used already',Kt)}async function r$(t,e,r,n,o){let{0:i,1:s,length:a}=t.split(".");if(a===5)if(o!==void 0)t=await o(t),{0:i,1:s,length:a}=t.split(".");else throw new co("JWE decryption is not configured",{cause:t});if(a!==3)throw O("Invalid JWT",V,t);let c;try{c=JSON.parse(Id(ka(i)))}catch(l){throw O("failed to parse JWT Header body as base64url encoded JSON",Nd,l)}if(!Ea(c))throw O("JWT Header must be a top level object",V,t);if(e(c),c.crit!==void 0)throw new co('no JWT "crit" header parameter extensions are supported',{cause:{header:c}});let u;try{u=JSON.parse(Id(ka(s)))}catch(l){throw O("failed to parse JWT Payload body as base64url encoded JSON",Nd,l)}if(!Ea(u))throw O("JWT Payload must be a top level object",V,t);let d=Hd()+r;if(u.exp!==void 0){if(typeof u.exp!="number")throw O('unexpected JWT "exp" (expiration time) claim type',V,{claims:u});if(u.exp<=d-n)throw O('unexpected JWT "exp" (expiration time) claim value, expiration is past current timestamp',Aa,{claims:u,now:d,tolerance:n,claim:"exp"})}if(u.iat!==void 0&&typeof u.iat!="number")throw O('unexpected JWT "iat" (issued at) claim type',V,{claims:u});if(u.iss!==void 0&&typeof u.iss!="string")throw O('unexpected JWT "iss" (issuer) claim type',V,{claims:u});if(u.nbf!==void 0){if(typeof u.nbf!="number")throw O('unexpected JWT "nbf" (not before) claim type',V,{claims:u});if(u.nbf>d+n)throw O('unexpected JWT "nbf" (not before) claim value',Aa,{claims:u,now:d,tolerance:n,claim:"nbf"})}if(u.aud!==void 0&&typeof u.aud!="string"&&!Array.isArray(u.aud))throw O('unexpected JWT "aud" (audience) claim type',V,{claims:u});return{header:c,claims:u,jwt:t}}function n$(t,e,r,n){if(t!==void 0){if(typeof t=="string"?n.alg!==t:!t.includes(n.alg))throw O('unexpected JWT "alg" header parameter',V,{header:n,expected:t,reason:"client configuration"});return}if(Array.isArray(e)){if(!e.includes(n.alg))throw O('unexpected JWT "alg" header parameter',V,{header:n,expected:e,reason:"authorization server metadata"});return}if(r!==void 0){if(typeof r=="string"?n.alg!==r:typeof r=="function"?!r(n.alg):!r.includes(n.alg))throw O('unexpected JWT "alg" header parameter',V,{header:n,expected:r,reason:"default value"});return}throw O('missing client or server configuration to verify used JWT "alg" header parameter',void 0,{client:t,issuer:e,fallback:r})}function yn(t,e){let{0:r,length:n}=t.getAll(e);if(n>1)throw O(`"${e}" parameter must be provided only once`,V);return r}var o$=Symbol(),i$=Symbol();function ky(t,e,r,n){if($a(t),Gd(e),r instanceof URL&&(r=r.searchParams),!(r instanceof URLSearchParams))throw he('"parameters" must be an instance of URLSearchParams, or URL',Xe);if(yn(r,"response"))throw O('"parameters" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()',V,{parameters:r});let o=yn(r,"iss"),i=yn(r,"state");if(!o&&t.authorization_response_iss_parameter_supported)throw O('response parameter "iss" (issuer) missing',V,{parameters:r});if(o&&o!==t.issuer)throw O('unexpected "iss" (issuer) response parameter value',V,{expected:t.issuer,parameters:r});switch(n){case void 0:case i$:if(i!==void 0)throw O('unexpected "state" response parameter encountered',V,{expected:void 0,parameters:r});break;case o$:break;default:if($e(n,'"expectedState" argument'),i!==n)throw O(i===void 0?'response parameter "state" missing':'unexpected "state" response parameter value',V,{expected:n,parameters:r})}if(yn(r,"error"))throw new bi("authorization response from the server is an error",{cause:r});let a=yn(r,"id_token"),c=yn(r,"token");if(a!==void 0||c!==void 0)throw new co("implicit and hybrid flows are not supported");return U0(new URLSearchParams(r))}async function Ey(t,e,r){$a(t);let n=_y(t,"registration_endpoint",e.use_mtls_endpoint_aliases,r?.[Dd]!==!0),o=Ld(r?.headers);o.set("accept","application/json"),o.set("content-type","application/json");let i="POST";r?.DPoP&&(wy(r.DPoP),await r.DPoP.addProof(n,o,i,r.initialAccessToken)),r?.initialAccessToken&&o.set("authorization",`${o.has("dpop")?"DPoP":"Bearer"} ${r.initialAccessToken}`);let s=await(r?.[vn]||fetch)(n.href,{body:JSON.stringify(e),headers:Object.fromEntries(o.entries()),method:i,redirect:"manual",signal:jd(n,r?.signal)});return r?.DPoP?.cacheNonce(s,n),s}async function Ty(t){if(!lo(t,Response))throw he('"response" must be an instance of Response',Xe);await Sy(t,201,"Dynamic Client Registration Endpoint"),Ci(t);let e=await za(t);return $e(e.client_id,'"response" body "client_id" property',V,{body:e}),e.client_secret!==void 0&&$e(e.client_secret,'"response" body "client_secret" property',V,{body:e}),e.client_secret&&ao(e.client_secret_expires_at,!0,'"response" body "client_secret_expires_at" property',V,{body:e}),e}async function Ay(t,e){return S0(t,"resourceIdentifier",r=>(_0(r,".well-known/oauth-protected-resource",!0),r),e)}async function Oa(t,e){let r=t;if(!(r instanceof URL)&&r!==Ma)throw he('"expectedResourceIdentifier" must be an instance of URL',Xe);if(!lo(e,Response))throw he('"response" must be an instance of Response',Xe);if(e.status!==200)throw O('"response" is not a conform Resource Server Metadata response (unexpected HTTP status code)',Wd,e);Ci(e);let n=await za(e);if($e(n.resource,'"response" body "resource" property',V,{body:n}),r!==Ma&&new URL(n.resource).href!==r.href)throw O('"response" body "resource" property does not match the expected value',Ia,{expected:r.href,body:n,attribute:"resource"});return n}async function za(t,e=ly){let r;try{r=await t.json()}catch(n){throw e(t),O('failed to parse "response" body as JSON',Nd,n)}if(!Ea(r))throw O('"response" body must be a top level object',V,{body:r});return r}var Ma=Symbol(),s$=Symbol();var Pi="TLS certificate not trusted. Configure system trust or NODE_EXTRA_CA_CERTS.",My={UNABLE_TO_GET_ISSUER_CERT:Pi,UNABLE_TO_GET_ISSUER_CERT_LOCALLY:Pi,UNABLE_TO_VERIFY_LEAF_SIGNATURE:Pi,DEPTH_ZERO_SELF_SIGNED_CERT:Pi,SELF_SIGNED_CERT_IN_CHAIN:Pi,CERT_HAS_EXPIRED:"TLS certificate expired. Check the system clock or contact the server administrator.",ERR_TLS_CERT_ALTNAME_INVALID:"TLS certificate hostname mismatch. Verify the server URL or contact the network administrator."};function xi(t){let e=new Set,r=t,n;for(let o=0;o<16&&!(typeof r!="object"||r===null||e.has(r));o++){if(e.add(r),"name"in r&&(r.name==="AbortError"||r.name==="TimeoutError")||"code"in r&&r.code==="ABORT_ERR")return;"code"in r&&typeof r.code=="string"&&Object.hasOwn(My,r.code)&&(n??=r.code),r="cause"in r?r.cause:void 0}return n}function ki(t){return Object.assign(new Error(My[t]),{code:t})}var Oy=a$.child({prefix:"pi-mcp"}),Ei=1e4,c$=1e3,u$=401,$y=200,d$="accounts.google.com",l$=/(?:^|[\s,])resource_metadata\s*=\s*"([^"]+)"/,f$=/(?:^|[\s,])resource_metadata\s*=\s*([^,\s]+)/,zy;function fo(){return zy??globalThis.fetch}function Ny(t){let e=AbortSignal.timeout(1e4),r=t?.signal?AbortSignal.any([t.signal,e]):e;return{...t,signal:r}}function Dy(t){let e=new URL(t.href);return e.search="",e.hash="",e}async function Kd(t){let e=Dy(t),r,n=o=>{r??=xi(o)};try{let o=await p$(e,n),i=o?.authorization_servers?.map(s=>new URL(s))??[e];for(let s of i){let a=await v$(s,n);if(a)return Object.assign(a,{resourceScopes:o?.scopes_supported,resourceIdentifier:o?.resource})}}catch(o){throw La(o)}throw r?ki(r):new Error("Failed to discover metadata URL")}async function p$(t,e){try{let r=await Ay(t,{signal:AbortSignal.timeout(Ei),[vn]:zy??void 0});return r.ok?await Oa(t,r):(r.body?.cancel().catch(()=>{}),await Ly(t,r.headers.get("www-authenticate"),e)??await Iy(t,e))}catch(r){return e(r),await Iy(t,e)}}async function Iy(t,e){for(let r of["HEAD","GET"])try{let n=await fo()(t,{method:r,signal:AbortSignal.timeout(Ei)});n.body?.cancel().catch(()=>{});let o=await Ly(t,n.headers.get("www-authenticate"),e);if(o)return o}catch(n){e(n)}}async function Ly(t,e,r){let n=y$(e);if(n)try{let o=await fo()(n,{signal:AbortSignal.timeout(Ei)});return await h$(t,o)}catch(o){r(o);return}}async function h$(t,e){let r=await e.text(),n={status:e.status,statusText:e.statusText,headers:e.headers};try{return await Oa(t,new Response(r,n))}catch(o){if(!(o instanceof wi)||o.code!==Ia)throw o;let i=m$(r);if(!i||!g$(i,t))throw o;return await Oa(i,new Response(r,n))}}function m$(t){try{let e=JSON.parse(t);return typeof e.resource!="string"?void 0:new URL(e.resource)}catch{return}}function g$(t,e){if(t.origin!==e.origin)return!1;let r=t.pathname.replace(/\/+$/,""),n=e.pathname.replace(/\/+$/,"");return r===n||n.startsWith(`${r}/`)}function y$(t){if(!t)return;let e=t.match(l$),r=t.match(f$),n=e?.[1]??r?.[1];if(n)try{return new URL(n)}catch{return}}async function v$(t,e){for(let r of _$(t))try{let n=new URL(r,t),o=await fo()(n,{signal:AbortSignal.timeout(Ei)});if(o.body?.cancel().catch(()=>{}),!o.ok)continue;return n}catch(n){e(n)}}function _$(t){let e=t.pathname.startsWith("/")?t.pathname.slice(1):t.pathname;return[...e.length>0?[new URL(`/.well-known/oauth-authorization-server/${e}`,t),new URL(`/.well-known/openid-configuration/${e}`,t),new URL(`/${e}/.well-known/openid-configuration`,t)]:[],new URL("/.well-known/oauth-authorization-server",t),new URL("/.well-known/openid-configuration",t)]}async function Jd(t){try{let e=await fo()(t,{signal:AbortSignal.timeout(Ei)}),r=await e.text(),n={status:e.status,statusText:e.statusText,headers:e.headers},o=await S$(new Response(r,n));if(!o)throw new Error("Missing issuer from discovery response");return await dy(o,new Response(r,n))}catch(e){throw La(e)}}async function S$(t){if(!t.ok)throw new Error("Invalid status code from discovery response");let e=await t.json();if(!e.issuer||typeof e.issuer!="string")throw new Error("Invalid issuer from discovery response");return new URL(e.issuer)}var Vd=class extends Error{issuer;constructor(e){super(`This MCP server's authorization server (\`${e}\`) does not support Dynamic Client Registration. Configure a static OAuth Client ID and Secret in the Advanced section.`),this.name="McpOAuthDcrUnsupportedError",this.issuer=e}};function w$(t){if(!t.clientId)throw new Error("clientId is required to build client from config");let e=t.clientSecret?.trim();return{client_id:t.clientId,...e?{client_secret:e}:{}}}async function Yd({config:t,serverMetadata:e,redirectUris:r,preferStaticClient:n=!1}){let o=t.clientId?.trim(),i=t.clientSecret?.trim();if(!!o&&(n||!!i||!e.registration_endpoint))return w$({...t,clientId:o});if(!e.registration_endpoint)throw new Vd(e.issuer);return await b$(e,r)}async function b$(t,e){try{let r=t.token_endpoint_auth_methods_supported?.includes("none")??!1,n=await Ey(t,{client_name:Xg,client_uri:Qg,logo_uri:ey,redirect_uris:e,grant_types:["authorization_code","refresh_token"],response_types:["code"],...r?{token_endpoint_auth_method:"none"}:{}},{[vn]:R$});return n.ok||Oy.error(`Dynamic client registration failed with HTTP status ${n.status} (${n.statusText})`),await Ty(n)}catch(r){throw La(r)}}async function R$(t,e){let r=await fo()(t,Ny(e)),n=await r.text(),o={status:r.status,statusText:r.statusText,headers:r.headers};if(r.ok||Oy.error(`Dynamic client registration error response body (HTTP ${r.status} ${r.statusText}): ${P$(n)}`),r.status===200&&(o.status=201,o.statusText="Created"),o.status===201)try{let i=JSON.parse(n);i.client_secret_expires_at||(i.client_secret_expires_at=0),"client_secret"in i&&!i.client_secret&&(i.client_secret=void 0),n=JSON.stringify(i)}catch{}return new Response(n,o)}function C$(t,e){let r=new Headers(e?.headers),n=r.get("content-type"),o=e;return n?.toLowerCase().startsWith("application/x-www-form-urlencoded;")&&(r.set("content-type","application/x-www-form-urlencoded"),o={...e,headers:r}),fo()(t,Ny(o))}function P$(t){try{let e=JSON.parse(t);for(let r of Object.keys(e))/secret|token/i.test(r)&&(e[r]="[REDACTED]");return JSON.stringify(e)}catch{return t.length>$y?`${t.slice(0,$y)}\u2026`:t}}async function Na(t,e,r,n,o,i,s){if(!r.authorization_endpoint)throw new Error("No authorization endpoint");let a=fy(),c=await my(a),u=py(),d,l=(o??r.scopes_supported?.join(" "))?.split(/\s+/).filter(Boolean),f=!1;!s?.disableOfflineAccessAugmentation&&l?.length&&!l.includes("offline_access")&&r.scopes_supported?.includes("offline_access")&&(l.push("offline_access"),f=!0);let p=l?.join(" ")||void 0,h=Dy(i??t).toString(),m=new URL(r.authorization_endpoint);return m.searchParams.set("response_type","code"),m.searchParams.set("client_id",e.client_id),m.searchParams.set("code_challenge",c),m.searchParams.set("code_challenge_method","S256"),m.searchParams.set("redirect_uri",n),m.searchParams.set("resource",h),m.searchParams.set("state",u),p&&m.searchParams.set("scope",p),l?.includes("offline_access")&&m.searchParams.set("prompt","consent"),m.hostname===d$&&(m.searchParams.set("access_type","offline"),m.searchParams.set("prompt","consent")),r.code_challenge_methods_supported?.includes("S256")||(d=hy(),m.searchParams.set("nonce",d)),{client:e,serverMetadata:r,redirectUri:n,codeVerifier:a,nonce:d,scope:p,state:u,resource:h,offlineAccessAugmented:f,authUri:m}}function Da(t,e){return e.offlineAccessAugmented===!0&&t.get("error")==="invalid_scope"&&t.get("state")===e.state}async function Xd(t){if(!t.resource)throw new Error("Cannot rebuild authorization state without a resource");let e=t.scope?.split(/\s+/).filter(r=>r&&r!=="offline_access").join(" ");return await Na(new URL(t.resource),t.client,t.serverMetadata,t.redirectUri,e||void 0,void 0,{disableOfflineAccessAugmentation:!0})}async function x$(t,e,r){let n=await Py(t.serverMetadata,t.client,r,e,t.redirectUri,t.codeVerifier,{[vn]:C$,...t.resource?{additionalParameters:{resource:t.resource}}:{}});return xy(t.serverMetadata,t.client,await k$(n))}async function Qd(t,e){try{let r=ky(e.serverMetadata,e.client,t,e.state),n=await T$(e.client,o=>x$(e,r,o));return $$(n,e.serverMetadata,e.client,void 0,e.resource)}catch(r){throw La(r)}}async function k$(t){let e=await t.text(),r={status:t.status,statusText:t.statusText,headers:t.headers};try{let n=JSON.parse(e);if("id_token"in n)return n.id_token=void 0,new Response(JSON.stringify(n),r)}catch{}return new Response(e,r)}function jy(t){let e=t.client_secret;return typeof e=="string"&&e.length>0?e:void 0}function E$(t){let e=jy(t);return e===void 0?yy():t.token_endpoint_auth_method==="client_secret_basic"?gy(e):Zd(e)}async function T$(t,e){try{return await e(E$(t))}catch(r){let n=A$(t);if(n&&M$(r))return await e(n);throw r}}function A$(t){let e=jy(t);if(t.token_endpoint_auth_method==="client_secret_basic"&&e!==void 0)return Zd(e)}function M$(t){return t instanceof uo?t.error==="invalid_client"||t.error==="unauthorized":t instanceof Ri?t.status===u$||t.cause.some(({parameters:e})=>{let{error:r}=e;return r==="invalid_client"||r==="unauthorized"}):!1}function $$(t,e,r,n,o){if(!t.access_token)throw new Error("OAuth token response contained no access token");return{accessToken:t.access_token,refreshToken:t.refresh_token||n,expiresAt:t.expires_in?Date.now()+t.expires_in*c$:void 0,tokenType:t.token_type,scope:t.scope,resource:o,serverMetadata:e,client:r}}function La(t){let e=xi(t);if(e)return ki(e);if(t instanceof uo||t instanceof bi){let r=t.error_description?` (${t.error_description})`:"";return new Error(`${t.message}${r}`,{cause:t})}return t instanceof Error?t:new Error(String(t))}var I$=/(authorization|auth[_-]?token|access[_-]?token|refresh[_-]?token|\btoken\b|secret|password|passwd|\bpwd\b|api[_-]?key|apikey|client[_-]?secret|private[_-]?key|cookie|session[_-]?id|credential|bearer)/i,Fy=/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/,Uy=/\b(bearer|token)\s+[A-Za-z0-9._~+/-]{12,}=*/i,qy=/\b(?=[A-Za-z0-9._-]*[A-Za-z])(?=[A-Za-z0-9._-]*\d)[A-Za-z0-9._-]{24,}\b/,_n="[redacted]",O$=/[.*+?^${}()|[\]\\]/g;function el(t,e){return e.chars-=t.length,e.chars<0?e.marker:e.redactText(t)}function z$(t,e,r){try{let n=Array.isArray(t);if(n&&t.length>r.nodes)return r.marker;let o=Object.getPrototypeOf(t);if(!n&&o!==null&&o!==Object.prototype)return r.marker;r.active.add(t);let i=Object.keys(t);if(i.length>r.nodes)return r.marker;let s=n?[]:Object.create(null);for(let a of i){if(n&&!/^(0|[1-9]\d*)$/.test(a))continue;let c=Object.getOwnPropertyDescriptor(t,a);Object.defineProperty(s,n?a:el(a,r),{value:c&&"value"in c?Hy(c.value,e+1,r):r.marker,enumerable:!0,configurable:!0,writable:!0})}return s}catch{return r.marker}finally{r.active.delete(t)}}function Hy(t,e,r){if(--r.nodes<0||e>16)return r.marker;if(typeof t=="string")return el(t,r);if(t===void 0)return t;if(t===null||typeof t=="boolean"||typeof t=="number"){if(typeof t=="number"&&!Number.isFinite(t))return r.marker;let n=JSON.stringify(t);return el(n,r)===n?t:r.marker}return typeof t!="object"||r.active.has(t)?r.marker:z$(t,e,r)}function rl(t){let e=[...new Set(t)].filter(Boolean);if(e.length>128||e.reduce((i,s)=>i+s.length,0)>262144)return{text:()=>"",value:()=>{}};let r=e.length?new RegExp(e.sort((i,s)=>s.length-i.length).map(i=>i.replace(O$,"\\$&")).join("|"),"g"):void 0,n=e.some(i=>_n.includes(i))?"":_n,o=i=>{if(i.length>262144)return n;let s=r?i.replace(r,()=>n):i;return e.some(a=>s.includes(a))?n:s};return{text:o,value:i=>Hy(i,0,{redactText:o,marker:n,nodes:1e4,chars:262144,active:new WeakSet})}}var N$=500,D$=8192,L$=6;function j$(t){return Fy.test(t)||Uy.test(t)||qy.test(t)}var F$=new RegExp(Fy.source,"g"),U$=new RegExp(Uy.source,"gi"),q$=new RegExp(qy.source,"g");function Gy(t,e){let r=[...t];return r.length<=e?t:`${r.slice(0,Math.max(e-3,0)).join("")}...`}function ja(t){return t&&Gy(t,D$).replace(F$,_n).replace(U$,r=>`${r.match(/^(bearer|token)\s+/i)?.[0]??""}${_n}`).replace(q$,_n)}function tl(t,e,r){if(e)return _n;if(typeof t=="string")return j$(t)?_n:t;if(t===null||typeof t!="object")return t;if(r>=L$)return"[truncated]";if(Array.isArray(t))return t.map(o=>tl(o,!1,r+1));let n={};for(let[o,i]of Object.entries(t))n[o]=tl(i,I$.test(o),r+1);return n}function Zy(t,e=N$){if(t==null)return;let r=tl(t,!1,0),n;try{n=JSON.stringify(r)}catch{return"[unserializable structured content]"}if(!(!n||n==="{}"||n==="[]"||n==='""'))return Gy(n,e)}var Wy={reportError:()=>{}},By=Symbol.for("__pi_mcp_error_reporter_slot__");function Vy(){let t=globalThis,e=t[By];return e||(e={reporter:null},t[By]=e),e}function Ky(t){let e=Vy(),r=e.reporter??Wy;return e.reporter=t,r}function H$(){return Vy().reporter??Wy}function Ti(t,e){try{H$().reportError(t,e)}catch{}}import{logger as G$}from"@hermes/logger";var nl=G$.child({prefix:"pi-mcp"});function Jy(t,e,r){let n=0,o=0,i=r?.authoritative?{}:{...t.headerSecrets};for(let[s,a]of Object.entries(e))typeof a=="string"&&a!==""?(i[s]=a,n++):a===null||a===""?s in i&&(delete i[s],o++):nl.warn(`Skipping malformed header-secret entry "${s}"`);t.headerSecrets=i,t.headerSecretFailures??={};for(let s of Object.keys(i))delete t.headerSecretFailures[s];nl.info(`Applied pushed MCP header secret update for ${n} key(s), deleted ${o}`)}function Yy(t){return async e=>{if(t.headerSecretFailures??={},!e.startsWith(Cd)){let o=t.headerSecrets[e];if(o!==void 0)return o;let i=t.headerSecretFailures[e];if(i==="missing"||i==="permission_denied")return{reason:i}}let r=t.secretsClient;if(r)try{let o=await r.getSecret(e);return o!==void 0?(delete t.headerSecretFailures[e],o):{reason:t.headerSecretFailures[e]??"missing"}}catch{return{reason:"transient"}}let n=t.headerSecretFailures[e];return n===void 0?void 0:{reason:n}}}function Xy(t,e,r){t.headerSecretFailures??={};let n=r?.authoritative?{}:{...t.headerSecretFailures},o={...t.headerSecrets};for(let[i,s]of Object.entries(e))(s==="missing"||s==="permission_denied"||s==="transient")&&(n[i]=s,delete o[i]);t.headerSecrets=o,t.headerSecretFailures=n,nl.info(`Applied MCP header secret failure update for ${Object.keys(n).length} key(s)`)}function Qy(t){return t.secretsClient!==void 0||Object.keys(t.headerSecrets).length>0||Object.keys(t.headerSecretFailures??{}).length>0}import{logger as Z$}from"@hermes/logger";var Ai=Z$.child({prefix:"pi-mcp"}),B$="$augment-",Mi=/\$augment-[a-zA-Z0-9_.-]+/g,W$=new RegExp(Mi.source);function Lr(t){return W$.test(t)}function Fa(t){return t.slice(B$.length)}function $i(t){let e=new Set;for(let r of Object.values(t))for(let n of r.matchAll(Mi))e.add(Fa(n[0]));return[...e].sort()}var V$=["permission_denied","missing","transient"];function ev(t){let e=new Set(t);return V$.find(r=>e.has(r))??"missing"}var gt=class extends Error{serverName;missingKeys;reason;constructor(e,r,n,o=n===void 0?"missing":"transient"){super(`MCP server "${e}" not started: missing secret(s) ${r.join(", ")}`,n===void 0?void 0:{cause:n}),this.name="McpSecretResolutionError",this.serverName=e,this.missingKeys=r,this.reason=o}};async function tv(t,e,r,n,o,i,s){let a=[...t.matchAll(Mi)];if(a.length===0)return t;let c=t;for(let u of a.reverse()){let d=u[0],l=u.index,f=Fa(d);try{let p=await r(f);if(p===void 0||typeof p=="object"){n.add(f),i.set(f,p===void 0?"missing":p.reason),Ai.warn(`Secret "${f}" unavailable for "${e}"; leaving reference as-is`);continue}let h=p;h.trim()===""&&(o.add(f),Ai.warn(`Secret "${f}" resolved empty for "${e}"`));let m=c.slice(0,l),g=s?s(h,m):h;c=m+g+c.slice(l+d.length),Ai.debug(`Resolved secret reference for "${e}"`)}catch(p){n.add(f),i.set(f,"transient"),Ai.error(`Failed to resolve secret "${f}" for "${e}" (${p instanceof Error?p.name:"non-Error"}); leaving reference as-is`)}}return c}async function rv({configEnv:t,localEnv:e,getSecret:r}){let n={},o=new Set,i=new Set,s=new Map;for(let[a,c]of Object.entries(t)){if(!Lr(c)){n[a]=c;continue}let u=e[a];if(u!==void 0){Ai.debug(`"${a}" references a secret but is already set in the local environment; using local value`),n[a]=u;continue}n[a]=await tv(c,a,r,o,i,s)}return{resolved:n,unresolvedKeys:[...o].sort(),emptyKeys:[...i].sort(),...s.size===0?{}:{failureReasons:Object.fromEntries([...s.entries()].sort(([a],[c])=>a.localeCompare(c)))}}}var K$=/["$`\\]/g;function J$(t){let e="unquoted",r=0;for(;r<t.length;){let n=t[r];if(e==="single"){n==="'"&&(e="unquoted"),r+=1;continue}if(e==="double"){if(n==="\\"){r+=2;continue}n==='"'&&(e="unquoted"),r+=1;continue}if(n==="\\"){r+=2;continue}n==="'"?e="single":n==='"'&&(e="double"),r+=1}return e}function Y$(t,e){let r=J$(e);if(r==="double")return t.replace(K$,"\\$&");let n=t.replaceAll("'","'\\''");return r==="single"?n:`'${n}'`}async function nv(t,e,r=!0){let n=new Set,o=new Set,i=new Map;return{resolved:await tv(t,"command",e,n,o,i,r?Y$:void 0),unresolvedKeys:[...n].sort(),emptyKeys:[...o].sort(),...i.size===0?{}:{failureReasons:Object.fromEntries([...i.entries()].sort(([a],[c])=>a.localeCompare(c)))}}}import{AsyncLocalStorage as Mq}from"node:async_hooks";var ov,ol=Object.freeze({status:"aborted"});function S(t,e,r){function n(a,c){if(a._zod||Object.defineProperty(a,"_zod",{value:{def:c,constr:s,traits:new Set},enumerable:!1}),a._zod.traits.has(t))return;a._zod.traits.add(t),e(a,c);let u=s.prototype,d=Object.keys(u);for(let l=0;l<d.length;l++){let f=d[l];f in a||(a[f]=u[f].bind(a))}}let o=r?.Parent??Object;class i extends o{}Object.defineProperty(i,"name",{value:t});function s(a){var c;let u=r?.Parent?new i:this;n(u,a),(c=u._zod).deferred??(c.deferred=[]);for(let d of u._zod.deferred)d();return u}return Object.defineProperty(s,"init",{value:n}),Object.defineProperty(s,Symbol.hasInstance,{value:a=>r?.Parent&&a instanceof r.Parent?!0:a?._zod?.traits?.has(t)}),Object.defineProperty(s,"name",{value:t}),s}var Jt=class extends Error{constructor(){super("Encountered Promise during synchronous parse. Use .parseAsync() instead.")}},po=class extends Error{constructor(e){super(`Encountered unidirectional transform during encode: ${e}`),this.name="ZodEncodeError"}};(ov=globalThis).__zod_globalConfig??(ov.__zod_globalConfig={});var ho=globalThis.__zod_globalConfig;function Qe(t){return t&&Object.assign(ho,t),ho}var H={};Wu(H,{BIGINT_FORMAT_RANGES:()=>cv,Class:()=>sl,NUMBER_FORMAT_RANGES:()=>fl,aborted:()=>Ur,allowsEval:()=>ul,assert:()=>rI,assertEqual:()=>X$,assertIs:()=>eI,assertNever:()=>tI,assertNotEqual:()=>Q$,assignProp:()=>jr,base64ToUint8Array:()=>dv,base64urlToUint8Array:()=>_I,cached:()=>go,captureStackTrace:()=>Ha,cleanEnum:()=>vI,cleanRegex:()=>Ni,clone:()=>yt,cloneDef:()=>oI,createTransparentProxy:()=>dI,defineLazy:()=>Y,esc:()=>qa,escapeRegex:()=>ur,explicitlyAborted:()=>pl,extend:()=>pI,finalizeIssue:()=>vt,floatSafeRemainder:()=>al,getElementAtPath:()=>iI,getEnumValues:()=>Oi,getLengthableOrigin:()=>Di,getParsedType:()=>uI,getSizableOrigin:()=>uv,hexToUint8Array:()=>wI,isObject:()=>Sn,isPlainObject:()=>Fr,issue:()=>yo,joinValues:()=>Ua,jsonStringifyReplacer:()=>mo,merge:()=>mI,mergeDefs:()=>cr,normalizeParams:()=>M,nullish:()=>zi,numKeys:()=>cI,objectClone:()=>nI,omit:()=>fI,optionalKeys:()=>ll,parsedType:()=>hl,partial:()=>gI,pick:()=>lI,prefixIssues:()=>dr,primitiveTypes:()=>av,promiseAllObject:()=>sI,propertyKeyTypes:()=>dl,randomString:()=>aI,required:()=>yI,safeExtend:()=>hI,shallowClone:()=>sv,slugify:()=>cl,stringifyPrimitive:()=>Ga,uint8ArrayToBase64:()=>lv,uint8ArrayToBase64url:()=>SI,uint8ArrayToHex:()=>bI,unwrapMessage:()=>Ii});function X$(t){return t}function Q$(t){return t}function eI(t){}function tI(t){throw new Error("Unexpected value in exhaustive check")}function rI(t){}function Oi(t){let e=Object.values(t).filter(n=>typeof n=="number");return Object.entries(t).filter(([n,o])=>e.indexOf(+n)===-1).map(([n,o])=>o)}function Ua(t,e="|"){return t.map(r=>Ga(r)).join(e)}function mo(t,e){return typeof e=="bigint"?e.toString():e}function go(t){return{get value(){{let r=t();return Object.defineProperty(this,"value",{value:r}),r}throw new Error("cached value already set")}}}function zi(t){return t==null}function Ni(t){let e=t.startsWith("^")?1:0,r=t.endsWith("$")?t.length-1:t.length;return t.slice(e,r)}function al(t,e){let r=t/e,n=Math.round(r),o=Number.EPSILON*Math.max(Math.abs(r),1);return Math.abs(r-n)<o?0:r-n}var iv=Symbol("evaluating");function Y(t,e,r){let n;Object.defineProperty(t,e,{get(){if(n!==iv)return n===void 0&&(n=iv,n=r()),n},set(o){Object.defineProperty(t,e,{value:o})},configurable:!0})}function nI(t){return Object.create(Object.getPrototypeOf(t),Object.getOwnPropertyDescriptors(t))}function jr(t,e,r){Object.defineProperty(t,e,{value:r,writable:!0,enumerable:!0,configurable:!0})}function cr(...t){let e={};for(let r of t){let n=Object.getOwnPropertyDescriptors(r);Object.assign(e,n)}return Object.defineProperties({},e)}function oI(t){return cr(t._zod.def)}function iI(t,e){return e?e.reduce((r,n)=>r?.[n],t):t}function sI(t){let e=Object.keys(t),r=e.map(n=>t[n]);return Promise.all(r).then(n=>{let o={};for(let i=0;i<e.length;i++)o[e[i]]=n[i];return o})}function aI(t=10){let e="abcdefghijklmnopqrstuvwxyz",r="";for(let n=0;n<t;n++)r+=e[Math.floor(Math.random()*e.length)];return r}function qa(t){return JSON.stringify(t)}function cl(t){return t.toLowerCase().trim().replace(/[^\w\s-]/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")}var Ha="captureStackTrace"in Error?Error.captureStackTrace:(...t)=>{};function Sn(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}var ul=go(()=>{if(ho.jitless||typeof navigator<"u"&&navigator?.userAgent?.includes("Cloudflare"))return!1;try{let t=Function;return new t(""),!0}catch{return!1}});function Fr(t){if(Sn(t)===!1)return!1;let e=t.constructor;if(e===void 0||typeof e!="function")return!0;let r=e.prototype;return!(Sn(r)===!1||Object.prototype.hasOwnProperty.call(r,"isPrototypeOf")===!1)}function sv(t){return Fr(t)?{...t}:Array.isArray(t)?[...t]:t instanceof Map?new Map(t):t instanceof Set?new Set(t):t}function cI(t){let e=0;for(let r in t)Object.prototype.hasOwnProperty.call(t,r)&&e++;return e}var uI=t=>{let e=typeof t;switch(e){case"undefined":return"undefined";case"string":return"string";case"number":return Number.isNaN(t)?"nan":"number";case"boolean":return"boolean";case"function":return"function";case"bigint":return"bigint";case"symbol":return"symbol";case"object":return Array.isArray(t)?"array":t===null?"null":t.then&&typeof t.then=="function"&&t.catch&&typeof t.catch=="function"?"promise":typeof Map<"u"&&t instanceof Map?"map":typeof Set<"u"&&t instanceof Set?"set":typeof Date<"u"&&t instanceof Date?"date":typeof File<"u"&&t instanceof File?"file":"object";default:throw new Error(`Unknown data type: ${e}`)}},dl=new Set(["string","number","symbol"]),av=new Set(["string","number","bigint","boolean","symbol","undefined"]);function ur(t){return t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function yt(t,e,r){let n=new t._zod.constr(e??t._zod.def);return(!e||r?.parent)&&(n._zod.parent=t),n}function M(t){let e=t;if(!e)return{};if(typeof e=="string")return{error:()=>e};if(e?.message!==void 0){if(e?.error!==void 0)throw new Error("Cannot specify both `message` and `error` params");e.error=e.message}return delete e.message,typeof e.error=="string"?{...e,error:()=>e.error}:e}function dI(t){let e;return new Proxy({},{get(r,n,o){return e??(e=t()),Reflect.get(e,n,o)},set(r,n,o,i){return e??(e=t()),Reflect.set(e,n,o,i)},has(r,n){return e??(e=t()),Reflect.has(e,n)},deleteProperty(r,n){return e??(e=t()),Reflect.deleteProperty(e,n)},ownKeys(r){return e??(e=t()),Reflect.ownKeys(e)},getOwnPropertyDescriptor(r,n){return e??(e=t()),Reflect.getOwnPropertyDescriptor(e,n)},defineProperty(r,n,o){return e??(e=t()),Reflect.defineProperty(e,n,o)}})}function Ga(t){return typeof t=="bigint"?t.toString()+"n":typeof t=="string"?`"${t}"`:`${t}`}function ll(t){return Object.keys(t).filter(e=>t[e]._zod.optin==="optional"&&t[e]._zod.optout==="optional")}var fl={safeint:[Number.MIN_SAFE_INTEGER,Number.MAX_SAFE_INTEGER],int32:[-2147483648,2147483647],uint32:[0,4294967295],float32:[-34028234663852886e22,34028234663852886e22],float64:[-Number.MAX_VALUE,Number.MAX_VALUE]},cv={int64:[BigInt("-9223372036854775808"),BigInt("9223372036854775807")],uint64:[BigInt(0),BigInt("18446744073709551615")]};function lI(t,e){let r=t._zod.def,n=r.checks;if(n&&n.length>0)throw new Error(".pick() cannot be used on object schemas containing refinements");let i=cr(t._zod.def,{get shape(){let s={};for(let a in e){if(!(a in r.shape))throw new Error(`Unrecognized key: "${a}"`);e[a]&&(s[a]=r.shape[a])}return jr(this,"shape",s),s},checks:[]});return yt(t,i)}function fI(t,e){let r=t._zod.def,n=r.checks;if(n&&n.length>0)throw new Error(".omit() cannot be used on object schemas containing refinements");let i=cr(t._zod.def,{get shape(){let s={...t._zod.def.shape};for(let a in e){if(!(a in r.shape))throw new Error(`Unrecognized key: "${a}"`);e[a]&&delete s[a]}return jr(this,"shape",s),s},checks:[]});return yt(t,i)}function pI(t,e){if(!Fr(e))throw new Error("Invalid input to extend: expected a plain object");let r=t._zod.def.checks;if(r&&r.length>0){let i=t._zod.def.shape;for(let s in e)if(Object.getOwnPropertyDescriptor(i,s)!==void 0)throw new Error("Cannot overwrite keys on object schemas containing refinements. Use `.safeExtend()` instead.")}let o=cr(t._zod.def,{get shape(){let i={...t._zod.def.shape,...e};return jr(this,"shape",i),i}});return yt(t,o)}function hI(t,e){if(!Fr(e))throw new Error("Invalid input to safeExtend: expected a plain object");let r=cr(t._zod.def,{get shape(){let n={...t._zod.def.shape,...e};return jr(this,"shape",n),n}});return yt(t,r)}function mI(t,e){if(t._zod.def.checks?.length)throw new Error(".merge() cannot be used on object schemas containing refinements. Use .safeExtend() instead.");let r=cr(t._zod.def,{get shape(){let n={...t._zod.def.shape,...e._zod.def.shape};return jr(this,"shape",n),n},get catchall(){return e._zod.def.catchall},checks:e._zod.def.checks??[]});return yt(t,r)}function gI(t,e,r){let o=e._zod.def.checks;if(o&&o.length>0)throw new Error(".partial() cannot be used on object schemas containing refinements");let s=cr(e._zod.def,{get shape(){let a=e._zod.def.shape,c={...a};if(r)for(let u in r){if(!(u in a))throw new Error(`Unrecognized key: "${u}"`);r[u]&&(c[u]=t?new t({type:"optional",innerType:a[u]}):a[u])}else for(let u in a)c[u]=t?new t({type:"optional",innerType:a[u]}):a[u];return jr(this,"shape",c),c},checks:[]});return yt(e,s)}function yI(t,e,r){let n=cr(e._zod.def,{get shape(){let o=e._zod.def.shape,i={...o};if(r)for(let s in r){if(!(s in i))throw new Error(`Unrecognized key: "${s}"`);r[s]&&(i[s]=new t({type:"nonoptional",innerType:o[s]}))}else for(let s in o)i[s]=new t({type:"nonoptional",innerType:o[s]});return jr(this,"shape",i),i}});return yt(e,n)}function Ur(t,e=0){if(t.aborted===!0)return!0;for(let r=e;r<t.issues.length;r++)if(t.issues[r]?.continue!==!0)return!0;return!1}function pl(t,e=0){if(t.aborted===!0)return!0;for(let r=e;r<t.issues.length;r++)if(t.issues[r]?.continue===!1)return!0;return!1}function dr(t,e){return e.map(r=>{var n;return(n=r).path??(n.path=[]),r.path.unshift(t),r})}function Ii(t){return typeof t=="string"?t:t?.message}function vt(t,e,r){let n=t.message?t.message:Ii(t.inst?._zod.def?.error?.(t))??Ii(e?.error?.(t))??Ii(r.customError?.(t))??Ii(r.localeError?.(t))??"Invalid input",{inst:o,continue:i,input:s,...a}=t;return a.path??(a.path=[]),a.message=n,e?.reportInput&&(a.input=s),a}function uv(t){return t instanceof Set?"set":t instanceof Map?"map":t instanceof File?"file":"unknown"}function Di(t){return Array.isArray(t)?"array":typeof t=="string"?"string":"unknown"}function hl(t){let e=typeof t;switch(e){case"number":return Number.isNaN(t)?"nan":"number";case"object":{if(t===null)return"null";if(Array.isArray(t))return"array";let r=t;if(r&&Object.getPrototypeOf(r)!==Object.prototype&&"constructor"in r&&r.constructor)return r.constructor.name}}return e}function yo(...t){let[e,r,n]=t;return typeof e=="string"?{message:e,code:"custom",input:r,inst:n}:{...e}}function vI(t){return Object.entries(t).filter(([e,r])=>Number.isNaN(Number.parseInt(e,10))).map(e=>e[1])}function dv(t){let e=atob(t),r=new Uint8Array(e.length);for(let n=0;n<e.length;n++)r[n]=e.charCodeAt(n);return r}function lv(t){let e="";for(let r=0;r<t.length;r++)e+=String.fromCharCode(t[r]);return btoa(e)}function _I(t){let e=t.replace(/-/g,"+").replace(/_/g,"/"),r="=".repeat((4-e.length%4)%4);return dv(e+r)}function SI(t){return lv(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function wI(t){let e=t.replace(/^0x/,"");if(e.length%2!==0)throw new Error("Invalid hex string length");let r=new Uint8Array(e.length/2);for(let n=0;n<e.length;n+=2)r[n/2]=Number.parseInt(e.slice(n,n+2),16);return r}function bI(t){return Array.from(t).map(e=>e.toString(16).padStart(2,"0")).join("")}var sl=class{constructor(...e){}};var fv=(t,e)=>{t.name="$ZodError",Object.defineProperty(t,"_zod",{value:t._zod,enumerable:!1}),Object.defineProperty(t,"issues",{value:e,enumerable:!1}),t.message=JSON.stringify(e,mo,2),Object.defineProperty(t,"toString",{value:()=>t.message,enumerable:!1})},Za=S("$ZodError",fv),ml=S("$ZodError",fv,{Parent:Error});function gl(t,e=r=>r.message){let r={},n=[];for(let o of t.issues)o.path.length>0?(r[o.path[0]]=r[o.path[0]]||[],r[o.path[0]].push(e(o))):n.push(e(o));return{formErrors:n,fieldErrors:r}}function yl(t,e=r=>r.message){let r={_errors:[]},n=(o,i=[])=>{for(let s of o.issues)if(s.code==="invalid_union"&&s.errors.length)s.errors.map(a=>n({issues:a},[...i,...s.path]));else if(s.code==="invalid_key")n({issues:s.issues},[...i,...s.path]);else if(s.code==="invalid_element")n({issues:s.issues},[...i,...s.path]);else{let a=[...i,...s.path];if(a.length===0)r._errors.push(e(s));else{let c=r,u=0;for(;u<a.length;){let d=a[u];u===a.length-1?(c[d]=c[d]||{_errors:[]},c[d]._errors.push(e(s))):c[d]=c[d]||{_errors:[]},c=c[d],u++}}}};return n(t),r}var Ba=t=>(e,r,n,o)=>{let i=n?{...n,async:!1}:{async:!1},s=e._zod.run({value:r,issues:[]},i);if(s instanceof Promise)throw new Jt;if(s.issues.length){let a=new(o?.Err??t)(s.issues.map(c=>vt(c,i,Qe())));throw Ha(a,o?.callee),a}return s.value};var Wa=t=>async(e,r,n,o)=>{let i=n?{...n,async:!0}:{async:!0},s=e._zod.run({value:r,issues:[]},i);if(s instanceof Promise&&(s=await s),s.issues.length){let a=new(o?.Err??t)(s.issues.map(c=>vt(c,i,Qe())));throw Ha(a,o?.callee),a}return s.value};var Li=t=>(e,r,n)=>{let o=n?{...n,async:!1}:{async:!1},i=e._zod.run({value:r,issues:[]},o);if(i instanceof Promise)throw new Jt;return i.issues.length?{success:!1,error:new(t??Za)(i.issues.map(s=>vt(s,o,Qe())))}:{success:!0,data:i.value}},ji=Li(ml),Fi=t=>async(e,r,n)=>{let o=n?{...n,async:!0}:{async:!0},i=e._zod.run({value:r,issues:[]},o);return i instanceof Promise&&(i=await i),i.issues.length?{success:!1,error:new t(i.issues.map(s=>vt(s,o,Qe())))}:{success:!0,data:i.value}},Va=Fi(ml),pv=t=>(e,r,n)=>{let o=n?{...n,direction:"backward"}:{direction:"backward"};return Ba(t)(e,r,o)};var hv=t=>(e,r,n)=>Ba(t)(e,r,n);var mv=t=>async(e,r,n)=>{let o=n?{...n,direction:"backward"}:{direction:"backward"};return Wa(t)(e,r,o)};var gv=t=>async(e,r,n)=>Wa(t)(e,r,n);var yv=t=>(e,r,n)=>{let o=n?{...n,direction:"backward"}:{direction:"backward"};return Li(t)(e,r,o)};var vv=t=>(e,r,n)=>Li(t)(e,r,n);var _v=t=>async(e,r,n)=>{let o=n?{...n,direction:"backward"}:{direction:"backward"};return Fi(t)(e,r,o)};var Sv=t=>async(e,r,n)=>Fi(t)(e,r,n);var wv=/^[cC][0-9a-z]{6,}$/,bv=/^[0-9a-z]+$/,Rv=/^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/,Cv=/^[0-9a-vA-V]{20}$/,Pv=/^[A-Za-z0-9]{27}$/,xv=/^[a-zA-Z0-9_-]{21}$/,kv=/^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/;var Ev=/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/,vl=t=>t?new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${t}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`):/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;var Tv=/^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;var CI="^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$";function Av(){return new RegExp(CI,"u")}var Mv=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,$v=/^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;var Iv=/^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/,Ov=/^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,zv=/^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/,_l=/^[A-Za-z0-9_-]*$/;var Nv=/^https?$/,Dv=/^\+[1-9]\d{6,14}$/,Lv="(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))",jv=new RegExp(`^${Lv}$`);function Fv(t){let e="(?:[01]\\d|2[0-3]):[0-5]\\d";return typeof t.precision=="number"?t.precision===-1?`${e}`:t.precision===0?`${e}:[0-5]\\d`:`${e}:[0-5]\\d\\.\\d{${t.precision}}`:`${e}(?::[0-5]\\d(?:\\.\\d+)?)?`}function Uv(t){return new RegExp(`^${Fv(t)}$`)}function qv(t){let e=Fv({precision:t.precision}),r=["Z"];t.local&&r.push(""),t.offset&&r.push("([+-](?:[01]\\d|2[0-3]):[0-5]\\d)");let n=`${e}(?:${r.join("|")})`;return new RegExp(`^${Lv}T(?:${n})$`)}var Hv=t=>{let e=t?`[\\s\\S]{${t?.minimum??0},${t?.maximum??""}}`:"[\\s\\S]*";return new RegExp(`^${e}$`)},Gv=/^-?\d+n?$/,Zv=/^-?\d+$/,Sl=/^-?\d+(?:\.\d+)?$/,Bv=/^(?:true|false)$/i,Wv=/^null$/i;var Vv=/^[^A-Z]*$/,Kv=/^[^a-z]*$/;var Oe=S("$ZodCheck",(t,e)=>{var r;t._zod??(t._zod={}),t._zod.def=e,(r=t._zod).onattach??(r.onattach=[])}),Jv={number:"number",bigint:"bigint",object:"date"},wl=S("$ZodCheckLessThan",(t,e)=>{Oe.init(t,e);let r=Jv[typeof e.value];t._zod.onattach.push(n=>{let o=n._zod.bag,i=(e.inclusive?o.maximum:o.exclusiveMaximum)??Number.POSITIVE_INFINITY;e.value<i&&(e.inclusive?o.maximum=e.value:o.exclusiveMaximum=e.value)}),t._zod.check=n=>{(e.inclusive?n.value<=e.value:n.value<e.value)||n.issues.push({origin:r,code:"too_big",maximum:typeof e.value=="object"?e.value.getTime():e.value,input:n.value,inclusive:e.inclusive,inst:t,continue:!e.abort})}}),bl=S("$ZodCheckGreaterThan",(t,e)=>{Oe.init(t,e);let r=Jv[typeof e.value];t._zod.onattach.push(n=>{let o=n._zod.bag,i=(e.inclusive?o.minimum:o.exclusiveMinimum)??Number.NEGATIVE_INFINITY;e.value>i&&(e.inclusive?o.minimum=e.value:o.exclusiveMinimum=e.value)}),t._zod.check=n=>{(e.inclusive?n.value>=e.value:n.value>e.value)||n.issues.push({origin:r,code:"too_small",minimum:typeof e.value=="object"?e.value.getTime():e.value,input:n.value,inclusive:e.inclusive,inst:t,continue:!e.abort})}}),Yv=S("$ZodCheckMultipleOf",(t,e)=>{Oe.init(t,e),t._zod.onattach.push(r=>{var n;(n=r._zod.bag).multipleOf??(n.multipleOf=e.value)}),t._zod.check=r=>{if(typeof r.value!=typeof e.value)throw new Error("Cannot mix number and bigint in multiple_of check.");(typeof r.value=="bigint"?r.value%e.value===BigInt(0):al(r.value,e.value)===0)||r.issues.push({origin:typeof r.value,code:"not_multiple_of",divisor:e.value,input:r.value,inst:t,continue:!e.abort})}}),Xv=S("$ZodCheckNumberFormat",(t,e)=>{Oe.init(t,e),e.format=e.format||"float64";let r=e.format?.includes("int"),n=r?"int":"number",[o,i]=fl[e.format];t._zod.onattach.push(s=>{let a=s._zod.bag;a.format=e.format,a.minimum=o,a.maximum=i,r&&(a.pattern=Zv)}),t._zod.check=s=>{let a=s.value;if(r){if(!Number.isInteger(a)){s.issues.push({expected:n,format:e.format,code:"invalid_type",continue:!1,input:a,inst:t});return}if(!Number.isSafeInteger(a)){a>0?s.issues.push({input:a,code:"too_big",maximum:Number.MAX_SAFE_INTEGER,note:"Integers must be within the safe integer range.",inst:t,origin:n,inclusive:!0,continue:!e.abort}):s.issues.push({input:a,code:"too_small",minimum:Number.MIN_SAFE_INTEGER,note:"Integers must be within the safe integer range.",inst:t,origin:n,inclusive:!0,continue:!e.abort});return}}a<o&&s.issues.push({origin:"number",input:a,code:"too_small",minimum:o,inclusive:!0,inst:t,continue:!e.abort}),a>i&&s.issues.push({origin:"number",input:a,code:"too_big",maximum:i,inclusive:!0,inst:t,continue:!e.abort})}});var Qv=S("$ZodCheckMaxLength",(t,e)=>{var r;Oe.init(t,e),(r=t._zod.def).when??(r.when=n=>{let o=n.value;return!zi(o)&&o.length!==void 0}),t._zod.onattach.push(n=>{let o=n._zod.bag.maximum??Number.POSITIVE_INFINITY;e.maximum<o&&(n._zod.bag.maximum=e.maximum)}),t._zod.check=n=>{let o=n.value;if(o.length<=e.maximum)return;let s=Di(o);n.issues.push({origin:s,code:"too_big",maximum:e.maximum,inclusive:!0,input:o,inst:t,continue:!e.abort})}}),e_=S("$ZodCheckMinLength",(t,e)=>{var r;Oe.init(t,e),(r=t._zod.def).when??(r.when=n=>{let o=n.value;return!zi(o)&&o.length!==void 0}),t._zod.onattach.push(n=>{let o=n._zod.bag.minimum??Number.NEGATIVE_INFINITY;e.minimum>o&&(n._zod.bag.minimum=e.minimum)}),t._zod.check=n=>{let o=n.value;if(o.length>=e.minimum)return;let s=Di(o);n.issues.push({origin:s,code:"too_small",minimum:e.minimum,inclusive:!0,input:o,inst:t,continue:!e.abort})}}),t_=S("$ZodCheckLengthEquals",(t,e)=>{var r;Oe.init(t,e),(r=t._zod.def).when??(r.when=n=>{let o=n.value;return!zi(o)&&o.length!==void 0}),t._zod.onattach.push(n=>{let o=n._zod.bag;o.minimum=e.length,o.maximum=e.length,o.length=e.length}),t._zod.check=n=>{let o=n.value,i=o.length;if(i===e.length)return;let s=Di(o),a=i>e.length;n.issues.push({origin:s,...a?{code:"too_big",maximum:e.length}:{code:"too_small",minimum:e.length},inclusive:!0,exact:!0,input:n.value,inst:t,continue:!e.abort})}}),qi=S("$ZodCheckStringFormat",(t,e)=>{var r,n;Oe.init(t,e),t._zod.onattach.push(o=>{let i=o._zod.bag;i.format=e.format,e.pattern&&(i.patterns??(i.patterns=new Set),i.patterns.add(e.pattern))}),e.pattern?(r=t._zod).check??(r.check=o=>{e.pattern.lastIndex=0,!e.pattern.test(o.value)&&o.issues.push({origin:"string",code:"invalid_format",format:e.format,input:o.value,...e.pattern?{pattern:e.pattern.toString()}:{},inst:t,continue:!e.abort})}):(n=t._zod).check??(n.check=()=>{})}),r_=S("$ZodCheckRegex",(t,e)=>{qi.init(t,e),t._zod.check=r=>{e.pattern.lastIndex=0,!e.pattern.test(r.value)&&r.issues.push({origin:"string",code:"invalid_format",format:"regex",input:r.value,pattern:e.pattern.toString(),inst:t,continue:!e.abort})}}),n_=S("$ZodCheckLowerCase",(t,e)=>{e.pattern??(e.pattern=Vv),qi.init(t,e)}),o_=S("$ZodCheckUpperCase",(t,e)=>{e.pattern??(e.pattern=Kv),qi.init(t,e)}),i_=S("$ZodCheckIncludes",(t,e)=>{Oe.init(t,e);let r=ur(e.includes),n=new RegExp(typeof e.position=="number"?`^.{${e.position}}${r}`:r);e.pattern=n,t._zod.onattach.push(o=>{let i=o._zod.bag;i.patterns??(i.patterns=new Set),i.patterns.add(n)}),t._zod.check=o=>{o.value.includes(e.includes,e.position)||o.issues.push({origin:"string",code:"invalid_format",format:"includes",includes:e.includes,input:o.value,inst:t,continue:!e.abort})}}),s_=S("$ZodCheckStartsWith",(t,e)=>{Oe.init(t,e);let r=new RegExp(`^${ur(e.prefix)}.*`);e.pattern??(e.pattern=r),t._zod.onattach.push(n=>{let o=n._zod.bag;o.patterns??(o.patterns=new Set),o.patterns.add(r)}),t._zod.check=n=>{n.value.startsWith(e.prefix)||n.issues.push({origin:"string",code:"invalid_format",format:"starts_with",prefix:e.prefix,input:n.value,inst:t,continue:!e.abort})}}),a_=S("$ZodCheckEndsWith",(t,e)=>{Oe.init(t,e);let r=new RegExp(`.*${ur(e.suffix)}$`);e.pattern??(e.pattern=r),t._zod.onattach.push(n=>{let o=n._zod.bag;o.patterns??(o.patterns=new Set),o.patterns.add(r)}),t._zod.check=n=>{n.value.endsWith(e.suffix)||n.issues.push({origin:"string",code:"invalid_format",format:"ends_with",suffix:e.suffix,input:n.value,inst:t,continue:!e.abort})}});var c_=S("$ZodCheckOverwrite",(t,e)=>{Oe.init(t,e),t._zod.check=r=>{r.value=e.tx(r.value)}});var Ka=class{constructor(e=[]){this.content=[],this.indent=0,this&&(this.args=e)}indented(e){this.indent+=1,e(this),this.indent-=1}write(e){if(typeof e=="function"){e(this,{execution:"sync"}),e(this,{execution:"async"});return}let n=e.split(`
+`)}function sr(t){let e={name:oo,label:oo,description:GM(),parameters:jg.Unsafe(DM),execute:(n,o,i,s,a)=>qM(t,a,o)},r={name:Nr,label:Nr,description:"Execute a discovered MCP tool by its original name, using the tool_name and mcp_server returned by find-tool.",parameters:jg.Unsafe(LM),execute:(n,o,i)=>HM(t,o,i,{toolCallId:n})};Lg(oo,"mcp"),Lg(Nr,"mcp"),t.registerTool(e),t.registerTool(r),$r(e),$r(r),Ug.debug("Registered tool-search gateway (find-tool, execute-tool)")}import{redactSecrets as gk}from"@augmentcode/auggie-v2";import{logger as zq,logPublic as Nq}from"@hermes/logger";import{logger as XM}from"@hermes/logger";import{logger as ZM}from"@hermes/logger";function pn(t){return new Promise(e=>setTimeout(e,t))}var Hg=ZM.child({prefix:"pi-mcp"}),mi={maxTries:3,initialMs:500,mult:2,maxMs:2e3},wd=3e4,ar=200,mt=class extends Error{statusCode;statusText;responseBody;constructor(e,r,n){super(`${e} ${r}: ${n}`),this.name="McpRegistryHttpError",this.statusCode=e,this.statusText=r,this.responseBody=n}};function bd(t){return t instanceof mt?t.statusCode>=500:!0}async function hn(t){let e;for(let r=0;r<mi.maxTries;r++)try{return await t()}catch(n){if(e=n,!bd(n))throw n;if(r<mi.maxTries-1){let o=Math.min(mi.initialMs*mi.mult**r,mi.maxMs);await pn(o)}}throw e}var Ra=class{apiKey;apiUrl;fetchImpl;timeoutMs;constructor(e,r,n){this.apiKey=e.apiKey,this.apiUrl=e.apiUrl.replace(/\/+$/,""),this.fetchImpl=r,this.timeoutMs=n??wd}async callApi(e,r){let o=await(this.fetchImpl??fetch)(`${this.apiUrl}${e}`,{method:"POST",headers:{Authorization:`Bearer ${this.apiKey}`,"Content-Type":"application/json"},body:r===void 0?"{}":JSON.stringify({product_type:r}),signal:AbortSignal.timeout(this.timeoutMs)});if(!o.ok){let i=await o.text().catch(()=>""),s=i.length>ar?`${i.slice(0,ar)}\u2026[truncated]`:i;throw new mt(o.status,o.statusText,s)}return await o.json()}getMcpTenantConfigs(e){return hn(()=>this.callApi("/settings/get-mcp-tenant-configs",e))}getMcpUserConfigs(e){return hn(()=>this.callApi("/settings/get-mcp-user-configs",e))}};async function Gg(t,e){let r=[],[n,o]=await Promise.allSettled([t.getMcpTenantConfigs(e),t.getMcpUserConfigs(e)]),i={},s={};if(n.status==="fulfilled")i=n.value;else{let a=`Failed to fetch tenant MCP configs: ${String(n.reason)}`;Hg.warn(a),r.push({message:a})}if(o.status==="fulfilled")s=o.value;else{let a=`Failed to fetch user MCP configs: ${String(o.reason)}`;Hg.warn(a),r.push({message:a})}return{tenant:i,user:s,diagnostics:r}}function BM(t){return t.replace(/[^A-Za-z0-9]/g,"_").toUpperCase()}var Zg=32;function WM(t){let e=t.toUpperCase();return e=e.replace(/[^A-Za-z0-9]/g,"_"),e=e.replace(/_+/g,"_"),e=e.replace(/^_+|_+$/g,""),e.length>Zg&&(e=e.slice(0,Zg)),e=e.replace(/_+$/,""),e}function Bg(t,e){let r=e?WM(e):"",n=BM(t);return r?`AUGMENT_MCP_${r}_${n}_OAUTH_CREDENTIALS`:`AUGMENT_MCP_${n}_OAUTH_CREDENTIALS`}function Wg(t){let e={accessToken:t.accessToken,refreshToken:t.refreshToken,clientSecret:t.clientSecret};return t.expiresAt!==void 0&&(e.expiresAt=t.expiresAt),t.resource&&(e.resource=t.resource),t.serverMetadata&&(e.serverMetadata=t.serverMetadata),t.client&&(e.client=t.client),JSON.stringify(e)}var VM=1e12,KM=/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-](\d{2}):(\d{2}))$/;function JM(t){let e=KM.exec(t);if(!e)return;let r=Number(e[1]),n=Number(e[2]),o=Number(e[3]),i=Number(e[4]),s=Number(e[5]),a=Number(e[6]),c=Number(e[7]??0),u=Number(e[8]??0),f=[31,r%4===0&&(r%100!==0||r%400===0)?29:28,31,30,31,30,31,31,30,31,30,31][n-1];if(f===void 0||o<1||o>f||i>23||s>59||a>59||c>23||u>59)return;let p=Date.parse(t);return Number.isNaN(p)?void 0:p}function YM(t){if(typeof t=="number"&&Number.isFinite(t))return t>0&&t<VM?t*1e3:t;if(typeof t=="string")return JM(t)}function Vg(t){let e=JSON.parse(t),r=typeof e.accessToken=="string"?e.accessToken:"",n=typeof e.refreshToken=="string"?e.refreshToken:void 0;if(!r&&!n)throw new Error("Invalid OAuth secret: missing or invalid accessToken");return{accessToken:r,refreshToken:n,clientSecret:typeof e.clientSecret=="string"?e.clientSecret:void 0,expiresAt:YM(e.expiresAt),resource:typeof e.resource=="string"?e.resource:void 0,serverMetadata:e.serverMetadata&&typeof e.serverMetadata=="object"?e.serverMetadata:void 0,client:e.client&&typeof e.client=="object"?e.client:void 0}}var Wt=XM.child({prefix:"pi-mcp"}),Z=class extends Error{constructor(){super("MCP OAuth credential persistence failed"),this.name="TokenPersistenceError"}},so=class extends Error{},Jg=[100,500],QM=Jg.length+1,e0=t=>new Promise(e=>{setTimeout(e,t)});function Kg(t){return t.replace(/[^a-zA-Z0-9_-]/g,"-")}var Cd="augment.mcp-access-token.",t0=JSON.stringify({retired:!0}),Ca=3;function Vt(t){return`${Cd}${t}`}function Pa(t){return`legacy:${t}`}function At(t){return t?.id?Bg(t.id,t.name):void 0}function vi(t){if(t)return{type:t.type??null,id:t.id??null,name:t.name??null,url:Yg(t.url),auth:null,registrySource:t.registrySource??null,vfsSource:t.vfsSource??null}}function Yg(t){if(typeof t!="string")return null;try{return new URL(t).toString()}catch{return t}}function _i(t){if(typeof t=="string")try{return _i(JSON.parse(t))??t}catch{return t}if(typeof t!="object"||t===null||Array.isArray(t))return t===void 0?void 0:JSON.stringify(t);let e=t;return JSON.stringify({type:e.type??null,id:e.id??null,name:e.name??null,url:Yg(e.url),auth:null,registrySource:e.registrySource??null,vfsSource:e.vfsSource??null})}function Mt(t){return _i(vi(t))}function r0(t){return _i(vi(t))}function n0(t){if(t.credentialState==="active"||t.credentialState==="retired")return t.credentialState;if(t.retired===!0)return"retired"}function io(t){try{let e=JSON.parse(t);return{credentialIdentity:_i(e.credentialIdentity),state:n0(e)}}catch{return{}}}function gi(t,e){let r={...t,type:"oauth",credentialIdentity:vi(e)};return JSON.stringify(r)}function mn(t,e){let r=Wg({accessToken:t.accessToken,refreshToken:t.refreshToken,clientSecret:t.client.client_secret,expiresAt:t.expiresAt,resource:t.resource,serverMetadata:t.serverMetadata,client:t.client});return JSON.stringify({...JSON.parse(r),credentialIdentity:vi(e),credentialState:"active"})}function o0(t){return JSON.stringify({credentialIdentity:vi(t),credentialState:"retired",retired:!0})}function i0(t,e){let r;try{r=JSON.parse(t)}catch{return}if(typeof r!="object"||r===null)return;let n=r,o=r0(e),i=_i(n.credentialIdentity);if(!(o&&(i===void 0?e?.auth!=="oauth":i!==o))&&!(typeof n.accessToken!="string"||n.accessToken.length===0||typeof n.serverMetadata!="object"||n.serverMetadata===null||typeof n.client!="object"||n.client===null))return{identityMatched:o!==void 0&&i===o,token:n}}function Rd(t){try{let e=Vg(t),r=e.serverMetadata,n=e.client;if(!r||!n||!e.accessToken&&!e.refreshToken||typeof r.token_endpoint!="string"||typeof n.client_id!="string")return;let o;return e.clientSecret?o=e.clientSecret:typeof n.client_secret=="string"&&(o=n.client_secret),{accessToken:e.accessToken,refreshToken:e.refreshToken,expiresAt:e.expiresAt,resource:e.resource,serverMetadata:{issuer:typeof r.issuer=="string"?r.issuer:void 0,authorization_endpoint:typeof r.authorization_endpoint=="string"?r.authorization_endpoint:void 0,token_endpoint:r.token_endpoint},client:{client_id:n.client_id,...o?{client_secret:o}:{}}}}catch{return}}var yi=class{_memory=new Yn;_getClient;_shouldPersist;_dirtyGenerations=new Map;_durableQueues=new Map;_registryMemoryWriteGenerations=new Map;_registryMemoryAuthorities=new Map;_registryMemoryCommittedAuthorities=new Map;_delay;_nextGeneration=0;constructor(e,r,n,o=e0){if(this._getClient=e,this._shouldPersist=r,this._delay=typeof n=="function"?n:o,n&&typeof n!="function"){this._memory.seed(n);for(let[i,s]of n.credentialIdentities??[]){let a=Mt(s);a&&this._registryMemoryCommittedAuthorities.set(i,a)}}}get(e){return this._memory.get(e)}commit(e,r,n){this._memory.commit(e,r,n);let o=Mt(n);o?this._registryMemoryCommittedAuthorities.set(e,o):this._registryMemoryCommittedAuthorities.delete(e)}hasCredentialIdentity(e,r){return this._memory.hasCredentialIdentity(e,r)}reconcileCredentialIdentity(e,r,n){if(!this._memory.reconcileCredentialIdentity(e,r,n))return!1;let o=Mt(n);return o?this._registryMemoryCommittedAuthorities.set(e,o):this._registryMemoryCommittedAuthorities.delete(e),!0}clearLocalCredential(e){this._memory.clearLocalCredential(e),this._dirtyGenerations.delete(e),this._registryMemoryCommittedAuthorities.delete(e),this._registryMemoryWriteGenerations.set(e,(this._registryMemoryWriteGenerations.get(e)??0)+1),this._registryMemoryAuthorities.delete(e)}set(e,r,n){if(n?.id){let o=this._beginRegistryMemoryWrite(e,n);this._persist(e,r,n,!0,()=>{this._commitRegistryMemoryWrite(e,r,n,o)}).catch(()=>{Wt.error(`Failed to persist MCP OAuth token for "${e}"; authoritative memory was not changed`)});return}this._memory.set(e,r),this._registryMemoryCommittedAuthorities.delete(e),this._persist(e,r,n,!0).then(o=>{o&&this._memory.get(e)===r&&this.commit(e,r,n)}).catch(()=>{Wt.error(`Failed to persist MCP OAuth token for "${e}"; stored in-memory only`)})}async setAndPersist(e,r,n){if(n?.id){let i=this._beginRegistryMemoryWrite(e,n);await this._persist(e,r,n,!1,()=>{this._commitRegistryMemoryWrite(e,r,n,i)});return}let o=await this._persist(e,r,n,!1);this.commit(e,r,o?n:void 0)}_beginRegistryMemoryWrite(e,r){let n=Mt(r);if(!n)throw new Z;let o=(this._registryMemoryWriteGenerations.get(e)??0)+1;return this._registryMemoryWriteGenerations.set(e,o),this._registryMemoryAuthorities.set(e,n),{generation:o,identity:n,retirementGeneration:this._memory.credentialRetirementGeneration(e)}}_commitRegistryMemoryWrite(e,r,n,o){this._registryMemoryWriteGenerations.get(e)!==o.generation||this._registryMemoryAuthorities.get(e)!==o.identity||this._memory.credentialRetirementGeneration(e)!==o.retirementGeneration||(this._memory.commit(e,r,n),this._registryMemoryCommittedAuthorities.set(e,o.identity))}persist(e,r,n){return this._persist(e,r,n,!1)}async captureAuthenticatedIdentityVersion(e){let r=At(e),n=Mt(e),o=this._getClient();if(!(!r||!n||!o||!e))try{return await this._enqueueWrite(r,()=>this._captureAuthenticatedIdentityVersion({client:o,key:r,identity:n,registry:e}))}catch{throw new Z}}async _captureAuthenticatedIdentityVersion(e){for(let r=0;r<Ca;r+=1){let n=await this._captureIdentityVersionAttempt(e);if(n!==void 0)return n}throw new Z}async _captureIdentityVersionAttempt(e){let{client:r,key:n,identity:o,registry:i}=e,s=await r.getUserSecretWithVersion(n);if(!s)return"0";let a=io(s.value);if(a.state==="retired")return s.version;if(a.credentialIdentity!==void 0&&a.credentialIdentity!==o)throw new Z;if(a.credentialIdentity===o&&a.state==="active")return s.version;let c=Rd(s.value);if(!c)throw new Z;try{await r.upsertUserSecret(n,mn(c,i),s.version)}catch(u){if(!this._isVersionConflict(u))throw u}}async captureRefreshIdentityVersion(e){let r=At(e),n=Mt(e),o=this._getClient();if(!r||!n||!o){if(e?.id)throw new Z;return}try{return await this._enqueueWrite(r,async()=>{let i=await o.getUserSecretWithVersion(r);if(!i)throw new Z;let s=io(i.value);if(s.state!=="active"||s.credentialIdentity!==n||!Rd(i.value))throw new Z;return i.version})}catch{throw new Z}}persistAuthenticated(e,r,n,o){return this._persistAuthenticated(e,r,n,o)}persistRefresh(e,r,n,o){return this._persistAuthenticated(e,r,n,o)}async _persistAuthenticated(e,r,n,o){let i=this._getClient(),s=At(n),a=n&&s&&i&&o!==void 0?this._enqueueWrite(s,()=>i.upsertUserSecret(s,mn(r,n),o)):void 0,c=this._shouldPersist()&&i?()=>this._writeLegacyKey(e,r,!1,n):void 0;if(a)return this._drainRegistryWrites(e,a,c,void 0,n);if(n?.id||this._shouldPersist()&&!i)throw new Z;if(c)return{revision:await this._asPersistenceResult(c()),domain:Pa(e)}}restoreAfterSupersededRefresh(e,r,n,o,i,s){return this.restoreAfterSupersededAuthentication(e,r,n,o,i,s)}async restoreAfterSupersededAuthentication(e,r,n,o,i,s=o){let a=this._getClient(),c=At(o),u;if(c&&o){if(!a||!s||i?.domain!==`private:${o.id}`||At(s)!==c)throw new Z;if(u=await this._enqueueWrite(c,()=>this._restoreRegistryCredential({client:a,key:c,persistedToken:r,currentToken:n,persistedIdentity:o,currentIdentity:s,persistedRevision:i})),!u)return}if(!c&&At(s))throw new Z;if(!this._shouldPersist())return u;if(!a)throw new Z;if(c&&o){try{await this._enqueueWrite(Vt(e),()=>this._restoreLegacyCredential({client:a,key:Vt(e),persistedToken:r,currentToken:n,persistedIdentity:o,currentIdentity:s}))}catch{Wt.error(`Failed to mirror restored MCP OAuth token for "${e}" to the legacy key`)}return u}if(i?.domain!==Pa(e))throw new Z;try{return await this._enqueueWrite(Vt(e),()=>this._restoreLegacyCredentialExact({client:a,key:Vt(e),serverName:e,persistedToken:r,currentToken:n,persistedIdentity:o,currentIdentity:s,persistedRevision:i}))}catch{throw new Z}}async _restoreLegacyCredentialExact(e){let{client:r,key:n,serverName:o,persistedToken:i,currentToken:s,persistedIdentity:a,currentIdentity:c,persistedRevision:u}=e,d=await r.getUserSecretWithVersion(n);if(!(!d||d.version!==u.revision||d.value!==gi(i,a)))try{return{revision:await r.upsertUserSecret(n,gi(s,c),u.revision),domain:Pa(o)}}catch(l){if(this._isVersionConflict(l))return;throw l}}async _restoreRegistryCredential(e){let{client:r,key:n,persistedToken:o,currentToken:i,persistedIdentity:s,currentIdentity:a,persistedRevision:c}=e,u=await r.getUserSecretWithVersion(n);if(!(!u||u.version!==c.revision||u.value!==mn(o,s)))try{return{revision:await r.upsertUserSecret(n,mn(i,a),c.revision),domain:`private:${a.id}`}}catch(d){if(this._isVersionConflict(d))return;throw d}}async _restoreLegacyCredential(e){let{client:r,key:n,persistedToken:o,currentToken:i,persistedIdentity:s,currentIdentity:a}=e,c=await r.getUserSecretWithVersion(n);if(!(!c||c.value!==gi(o,s)))try{await r.upsertUserSecret(n,gi(i,a),c.version)}catch(u){if(!this._isVersionConflict(u))throw u}}async _drainRegistryWrites(e,r,n,o,i){let s;try{s=await r}catch{throw new Z}if(o?.(),i?.id&&!s)throw new Z;try{await n?.()}catch{Wt.error(`Failed to mirror MCP OAuth token for "${e}" to the legacy key`)}return i?.id&&s?{revision:s,domain:`private:${i.id}`}:void 0}async _writeRegistryCredential(e,r,n,o){let i=Mt(o);if(!i)throw new Z;for(let s=0;s<Ca;s+=1){let a=await e.getUserSecretWithVersion(r),c=a?io(a.value):{};if(c.state==="retired"||c.credentialIdentity!==void 0&&c.credentialIdentity!==i)throw new Z;try{return await this._upsertUserSecretOnce(e,r,mn(n,o),a?.version??"0")}catch(u){if(!this._isVersionConflict(u))throw u}}throw new Z}async _retireRegistryCredential(e,r,n){let o=Mt(n);if(!o)throw new Z;for(let i=0;i<Ca;i+=1){let s=await e.getUserSecretWithVersion(r),a=s?io(s.value):{};if(a.state==="retired"||a.credentialIdentity!==void 0&&a.credentialIdentity!==o)return;if(s&&a.credentialIdentity===void 0)throw new Z;try{await this._upsertUserSecretOnce(e,r,o0(n),s?.version??"0");return}catch(c){if(!this._isVersionConflict(c))throw c}}throw new Z}_isVersionConflict(e){return e instanceof mt&&(e.statusCode===412||e.statusCode===400&&e.responseBody.includes("version mismatch"))}async _persist(e,r,n,o,i){let s=this._getClient(),a=At(n),c=a&&n&&s?this._enqueueWrite(a,()=>{let d=this._getClient();if(!d)throw new Error("MCP secrets client unavailable");return this._writeRegistryCredential(d,a,r,n)},{credentialShape:"registry",operation:"write"}):void 0,u=this._shouldPersist()&&s?()=>this._writeLegacyKey(e,r,o,n):void 0;if(c)return this._drainRegistryWrites(e,c,u,i,n);if(n?.id||this._shouldPersist()&&!s)throw new Z;if(u)return{revision:await this._asPersistenceResult(u()),domain:Pa(e)}}snapshot(){return this._memory.snapshot()}async _asPersistenceResult(e){try{return await e}catch{throw new Z}}_enqueueWrite(e,r,n){let o=Kg(e),i=++this._nextGeneration;n?.onGeneration?.(i);let s=this._durableQueues.get(o),a=s??{latestGeneration:i,latestMutationGeneration:n?i:0,tail:Promise.resolve()};a.latestGeneration=i,n&&(a.latestMutationGeneration=i),s||this._durableQueues.set(o,a);let c=()=>this._runPersistence(a,i,r,n),u=s?a.tail.catch(()=>{}).then(c):c();return a.tail=u,u.finally(()=>{a.latestGeneration===i&&this._durableQueues.get(o)?.tail===u&&this._durableQueues.delete(o)}).catch(()=>{}),u}async _runPersistence(e,r,n,o){let i=o?QM:1;for(let s=0;s<i;s+=1){if(this._isLegacyPersistenceGateClosed(o))throw new so;try{return await n()}catch(a){this._throwIfPersistenceCanceled(e,r,o);let c=this._persistenceRetryDelay(a,s,o);if(c===void 0)throw a;await this._delay(c)}}throw new Z}_isLegacyPersistenceGateClosed(e){return e?.credentialShape==="legacy"&&!this._shouldPersist()}_throwIfPersistenceCanceled(e,r,n){if(n!==void 0&&e.latestMutationGeneration!==r||this._isLegacyPersistenceGateClosed(n))throw new so}_persistenceRetryDelay(e,r,n){let o=n?Jg[r]:void 0,i=!(e instanceof Z)&&bd(e);if(o===void 0||!i){n&&Wt.warn("MCP OAuth credential persistence exhausted retries",{attempts:r+1,credentialShape:n.credentialShape,operation:n.operation});return}return o}_upsertUserSecretOnce(e,r,n,o){return typeof e.upsertUserSecretOnce=="function"?e.upsertUserSecretOnce(r,n,o):e.upsertUserSecret(r,n,o)}_deleteUserSecretOnce(e,r){return typeof e.deleteUserSecretOnce=="function"?e.deleteUserSecretOnce(r):e.deleteUserSecret(r)}_writeLegacyKey(e,r,n,o){let i=0,s=this._enqueueWrite(Vt(e),async()=>{let a=this._getClient();if(!a)throw new Error("MCP secrets client unavailable");let c=await this._upsertUserSecretOnce(a,Vt(e),gi(r,o));return this._dirtyGenerations.get(e)===i&&this._dirtyGenerations.delete(e),c},{credentialShape:"legacy",operation:"write",onGeneration:a=>{i=a,this._dirtyGenerations.set(e,a)}});return s.catch(a=>{(a instanceof so||!n)&&this._dirtyGenerations.get(e)===i&&this._dirtyGenerations.delete(e)}),s}retireCredential(e,r,n){let o=Mt(r),i=this._registryMemoryCommittedAuthorities.get(e),s=n?.preserveNameState===!0&&(i===void 0||i!==o),a=(this._registryMemoryWriteGenerations.get(e)??0)+1;this._registryMemoryWriteGenerations.set(e,a),this._registryMemoryAuthorities.delete(e);let c=this._getClient(),u=At(r),d;u&&r&&(c?d=this._enqueueWrite(u,()=>{let p=this._getClient();if(!p)throw new Error("MCP secrets client unavailable");return this._retireRegistryCredential(p,u,r)},{credentialShape:"registry",operation:"delete"}):d=Promise.reject(new Z));let l=this._shouldPersist()&&!s,f;return l&&(c?f=this._enqueueWrite(Vt(e),async()=>{let p=await c.upsertUserSecret(Vt(e),t0)}):f=Promise.reject(new Z)),this._awaitRetirements(e,d,f).then(()=>{this._registryMemoryWriteGenerations.get(e)===a&&(this._memory.retireCredential(e,r,{preserveNameState:s}),s||(this._dirtyGenerations.delete(e),this._registryMemoryCommittedAuthorities.delete(e)))})}async _awaitRetirements(e,r,n){let[o,i]=await Promise.allSettled([r,n]);if(o.status==="rejected"&&Wt.error(`Failed to retire MCP OAuth credential identity for "${e}" durably`),i.status==="rejected"&&Wt.error(`Failed to retire legacy MCP OAuth credential for "${e}" durably`),o.status==="rejected")throw o.reason;if(i.status==="rejected")throw i.reason}delete(e,r){if(this._memory.delete(e),this._memory.clearAuthRequired(e),this._dirtyGenerations.delete(e),this._registryMemoryWriteGenerations.set(e,(this._registryMemoryWriteGenerations.get(e)??0)+1),this._registryMemoryAuthorities.delete(e),this._registryMemoryCommittedAuthorities.delete(e),this._retireRegistryKey(r),!this._shouldPersist()){this._dirtyGenerations.delete(e);return}let n=Vt(e);if(!this._canScheduleDurableOperation(n)){this._dirtyGenerations.delete(e);return}let o=0;this._enqueueWrite(n,async()=>{let s=this._getClient();if(!s)throw new Error("MCP secrets client unavailable");await this._deleteUserSecretOnce(s,n)},{credentialShape:"legacy",operation:"delete",onGeneration:s=>{o=s,this._dirtyGenerations.set(e,s)}}).then(()=>{this._dirtyGenerations.get(e)===o&&this._dirtyGenerations.delete(e)}).catch(s=>{s instanceof so&&this._dirtyGenerations.get(e)===o&&this._dirtyGenerations.delete(e)})}_retireRegistryKey(e){let r=At(e);!r||!e||!this._canScheduleDurableOperation(r)||this._enqueueWrite(r,async()=>{let n=this._getClient();if(!n)throw new Error("MCP secrets client unavailable");await this._retireRegistryCredential(n,r,e)},{credentialShape:"registry",operation:"delete"}).catch(()=>{Wt.error(`Failed to retire MCP OAuth registry credential "${r}" durably; cleared in-memory only`)})}_canScheduleDurableOperation(e){return!!(this._getClient()??this._durableQueues.get(Kg(e)))}markAuthRequired(e){this._memory.markAuthRequired(e)}isAuthRequired(e){return this._memory.isAuthRequired(e)}clearAuthRequired(e){this._memory.clearAuthRequired(e)}hasInFlightWrite(e){return this._dirtyGenerations.has(e)}async _loadRegistryToken(e,r){let n=At(r),o=Mt(r);if(!n||!o||!r)return{identityRejected:!1};try{return await this._enqueueWrite(n,()=>this._readRegistryToken({client:e,key:n,expectedIdentity:o,registry:r}))}catch{return{identityRejected:!0}}}async _readRegistryToken(e){for(let r=0;r<Ca;r+=1){let n=await this._readRegistryTokenAttempt(e);if(n!==void 0)return n}return{identityRejected:!0}}async _readRegistryTokenAttempt(e){let{client:r,key:n,expectedIdentity:o,registry:i}=e,s=await r.getUserSecretWithVersion(n);if(!s)return{identityRejected:!1,authorityVersion:"0"};let a=io(s.value);if(a.state==="retired"||(a.credentialIdentity===void 0?i.auth!=="oauth":a.credentialIdentity!==o))return{identityRejected:!0};let c=Rd(s.value);if(!c)return{identityRejected:!0};if(a.credentialIdentity===o&&a.state==="active")return{identityRejected:!1,token:c};try{return await r.upsertUserSecret(n,mn(c,i),s.version),{identityRejected:!1,token:c}}catch(u){return this._isVersionConflict(u)?void 0:{identityRejected:!0}}}async _importLegacyToken(e,r,n,o){let i=At(n),s=Mt(n);if(!i||!s||!n||o===void 0)return;let a=await this._loadLegacyToken(e,r,n);if(a)try{return await this._enqueueWrite(i,async()=>{let c=await e.getUserSecretWithVersion(i);if((c?.version??"0")===o){if(c){let u=io(c.value);if(u.state==="retired"||u.credentialIdentity!==void 0&&u.credentialIdentity!==s)return}return await e.upsertUserSecret(i,mn(a.token,n),o),{identityMatched:!0,token:a.token}}})}catch{return}}async _loadLegacyToken(e,r,n){try{let o=await e.getSecret(Vt(r));return o?i0(o,n):void 0}catch{return}}async ensureLoaded(e,r){if(this._memory.get(e)||!this._shouldPersist()||this.hasInFlightWrite(e))return;let o=this._getClient();if(!o)return;let i=this._memory.credentialRetirementGeneration(e),s=await this._loadRegistryToken(o,r);if(s.identityRejected)return;let a=s.token?{identityMatched:!0,token:s.token}:void 0;if(!(this._memory.get(e)||this.hasInFlightWrite(e)||this._memory.credentialRetirementGeneration(e)!==i)){if(!a){if(this._memory.isCredentialRetired(e))return;a=r?.id?await this._importLegacyToken(o,e,r,s.authorityVersion):await this._loadLegacyToken(o,e,r)}if(!a){Wt.debug(`Backend secret for MCP server "${e}" is not a usable OAuth token; ignoring`);return}this._memory.get(e)||this.hasInFlightWrite(e)||this._memory.credentialRetirementGeneration(e)!==i||(this.commit(e,a.token,a.identityMatched?r:void 0),Wt.debug(`Seeded MCP OAuth token for "${e}" from backend`))}}};var Xg="Augment Code",Qg="https://augmentcode.com",ey="https://storage.googleapis.com/augment-bazel-data/public/auth0/2024-10-15-auth0-augment-logo-512x512.png";var a0=1e3,c0=500;function xd(t,e=Date.now()){return t.expiresAt!==void 0&&e+2e4>=t.expiresAt}function Si(t,e=Date.now()){return t.expiresAt!==void 0&&t.expiresAt<=e}var Pd=class extends Error{constructor(){super("OAuth token response contained no access token"),Object.defineProperty(this,"name",{value:"MalformedRefreshResponseError",configurable:!0})}};function ty(t){return new URLSearchParams({k:t}).toString().slice(2)}function u0(t,e){let r=`${ty(t)}:${ty(e)}`;return`Basic ${btoa(r)}`}function iy(t){let e=t.client.client_secret;return e?.trim()?e:void 0}function d0(t){return t.client.token_endpoint_auth_method==="none"||!iy(t)?"none":t.client.token_endpoint_auth_method==="client_secret_basic"?"basic":"body"}function l0(t){return t==="basic"?"body":t==="body"?"basic":void 0}function f0(t){try{let e=JSON.parse(t);return typeof e.error=="string"?e.error:void 0}catch{return}}var p0=401,sy=500;function kd(t,...e){return t.status<sy&&t.oauthErrorCode!==void 0&&e.includes(t.oauthErrorCode)}function ry(t){return kd(t,"invalid_client","unauthorized")?!0:t.oauthErrorCode===void 0&&t.status===p0}async function ny(t,e,r){let n={"Content-Type":"application/x-www-form-urlencoded"},o=new URLSearchParams({grant_type:"refresh_token",refresh_token:t.refreshToken});r&&o.set("resource",r);let i=iy(t);e==="basic"&&i?n.Authorization=u0(t.client.client_id,i):(o.set("client_id",t.client.client_id),e==="body"&&i&&o.set("client_secret",i));let s=await fetch(t.serverMetadata.token_endpoint,{method:"POST",headers:n,body:o.toString(),signal:AbortSignal.timeout(1e4)});if(!s.ok){let c=await s.text().catch(()=>""),u=f0(c),d=c.slice(0,c0);throw new gn(s.status,s.statusText,d,u)}let a=await s.json();if(!a.access_token)throw new Pd;return{accessToken:a.access_token,refreshToken:a.refresh_token||t.refreshToken,expiresAt:a.expires_in?Date.now()+a.expires_in*a0:void 0,tokenType:a.token_type??t.tokenType,scope:a.scope??t.scope,serverMetadata:t.serverMetadata,client:t.client,resource:t.resource}}async function oy(t,e){try{return await ny(t,e,t.resource)}catch(r){if(r instanceof gn&&t.resource&&kd(r,"invalid_target"))return await ny(t,e,void 0);throw r}}var gn=class t extends Error{status;statusText;body;oauthErrorCode;clientAuthPlacementsExhausted;constructor(e,r,n,o,i=!1){super(`Token refresh failed: ${e} ${r}${n?` \u2014 ${n}`:""}`),this.name="RefreshHttpError",this.status=e,this.statusText=r,this.body=n,this.oauthErrorCode=o,this.clientAuthPlacementsExhausted=i}withClientAuthPlacementsExhausted(){return new t(this.status,this.statusText,this.body,this.oauthErrorCode,!0)}};function Ed(t){return!(t instanceof gn)||t.status>=sy?!1:kd(t,"invalid_grant","invalid_client")||t.clientAuthPlacementsExhausted}async function Td(t){if(!t.refreshToken)throw new Error("No refresh token available");let e=t,r=d0(t);try{return await oy(e,r)}catch(n){let o=l0(r);if(!(n instanceof gn)||!o||!ry(n))throw n;try{return await oy(e,o)}catch(i){throw i instanceof gn&&ry(i)?i.withClientAuthPlacementsExhausted():i}}}import{logger as a$}from"@hermes/logger";var $d;(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))&&($d="oauth4webapi/v3.8.6");function lo(t,e){if(t==null)return!1;try{return t instanceof e||Object.getPrototypeOf(t)[Symbol.toStringTag]===e.prototype[Symbol.toStringTag]}catch{return!1}}var Kt="ERR_INVALID_ARG_VALUE",Xe="ERR_INVALID_ARG_TYPE";function he(t,e,r){let n=new TypeError(t,{cause:r});return Object.assign(n,{code:e}),n}var Dd=Symbol(),h0=Symbol(),m0=Symbol(),vn=Symbol();var ay=Symbol();var g0=new TextEncoder,y0=new TextDecoder;function Id(t){return typeof t=="string"?g0.encode(t):y0.decode(t)}var Od;Uint8Array.prototype.toBase64?Od=t=>(t instanceof ArrayBuffer&&(t=new Uint8Array(t)),t.toBase64({alphabet:"base64url",omitPadding:!0})):Od=e=>{e instanceof ArrayBuffer&&(e=new Uint8Array(e));let r=[];for(let n=0;n<e.byteLength;n+=32768)r.push(String.fromCharCode.apply(null,e.subarray(n,n+32768)));return btoa(r.join("")).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")};var zd;Uint8Array.fromBase64?zd=t=>{try{return Uint8Array.fromBase64(t,{alphabet:"base64url"})}catch(e){throw he("The input to be decoded is not correctly encoded.",Kt,e)}}:zd=t=>{try{let e=atob(t.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"")),r=new Uint8Array(e.length);for(let n=0;n<e.length;n++)r[n]=e.charCodeAt(n);return r}catch(e){throw he("The input to be decoded is not correctly encoded.",Kt,e)}};function ka(t){return typeof t=="string"?zd(t):Od(t)}var co=class extends Error{code;constructor(e,r){super(e,r),this.name=this.constructor.name,this.code=K0,Error.captureStackTrace?.(this,this.constructor)}},wi=class extends Error{code;constructor(e,r){super(e,r),this.name=this.constructor.name,r?.code&&(this.code=r?.code),Error.captureStackTrace?.(this,this.constructor)}};function O(t,e,r){return new wi(t,{code:e,cause:r})}function Ea(t){return!(t===null||typeof t!="object"||Array.isArray(t))}function Ld(t){lo(t,Headers)&&(t=Object.fromEntries(t.entries()));let e=new Headers(t??{});if($d&&!e.has("user-agent")&&e.set("user-agent",$d),e.has("authorization"))throw he('"options.headers" must not include the "authorization" header name',Kt);return e}function jd(t,e){if(e!==void 0){if(typeof e=="function"&&(e=e(t.href)),!(e instanceof AbortSignal))throw he('"options.signal" must return or be an instance of AbortSignal',Xe);return e}}function v0(t){return t.includes("//")?t.replace("//","/"):t}function _0(t,e,r=!1){return t.pathname==="/"?t.pathname=e:t.pathname=v0(`${e}/${r?t.pathname:t.pathname.replace(/(\/)$/,"")}`),t}async function S0(t,e,r,n){if(!(t instanceof URL))throw he(`"${e}" must be an instance of URL`,Xe);vy(t,n?.[Dd]!==!0);let o=r(new URL(t.href)),i=Ld(n?.headers);return i.set("accept","application/json"),(n?.[vn]||fetch)(o.href,{body:void 0,headers:Object.fromEntries(i.entries()),method:"GET",redirect:"manual",signal:jd(o,n?.signal)})}function ao(t,e,r,n,o){try{if(typeof t!="number"||!Number.isFinite(t))throw he(`${r} must be a number`,Xe,o);if(t>0)return;if(e){if(t!==0)throw he(`${r} must be a non-negative number`,Kt,o);return}throw he(`${r} must be a positive number`,Kt,o)}catch(i){throw n?O(i.message,n,o):i}}function $e(t,e,r,n){try{if(typeof t!="string")throw he(`${e} must be a string`,Xe,n);if(t.length===0)throw he(`${e} must not be empty`,Kt,n)}catch(o){throw r?O(o.message,r,n):o}}async function dy(t,e){let r=t;if(!(r instanceof URL)&&r!==Ma)throw he('"expectedIssuerIdentifier" must be an instance of URL',Xe);if(!lo(e,Response))throw he('"response" must be an instance of Response',Xe);if(e.status!==200)throw O('"response" is not a conform Authorization Server Metadata response (unexpected HTTP status code)',Wd,e);Ci(e);let n=await za(e);if($e(n.issuer,'"response" body "issuer" property',V,{body:n}),r!==Ma&&new URL(n.issuer).href!==r.href)throw O('"response" body "issuer" property does not match the expected value',Ia,{expected:r.href,body:n,attribute:"issuer"});return n}function ly(t){b0(t,"application/json")}function w0(t,...e){let r='"response" content-type must be ';if(e.length>2){let n=e.pop();r+=`${e.join(", ")}, or ${n}`}else e.length===2?r+=`${e[0]} or ${e[1]}`:r+=e[0];return O(r,Y0,t)}function b0(t,e){if(O0(t)!==e)throw w0(t,e)}function Fd(){return ka(crypto.getRandomValues(new Uint8Array(32)))}function fy(){return Fd()}function py(){return Fd()}function hy(){return Fd()}async function my(t){return $e(t,"codeVerifier"),ka(await crypto.subtle.digest("SHA-256",Id(t)))}function Ud(t){let e=t?.[h0];return typeof e=="number"&&Number.isFinite(e)?e:0}function qd(t){let e=t?.[m0];return typeof e=="number"&&Number.isFinite(e)&&Math.sign(e)!==-1?e:30}function Hd(){return Math.floor(Date.now()/1e3)}function $a(t){if(typeof t!="object"||t===null)throw he('"as" must be an object',Xe);$e(t.issuer,'"as.issuer"')}function Gd(t){if(typeof t!="object"||t===null)throw he('"client" must be an object',Xe);$e(t.client_id,'"client.client_id"')}function cy(t){return encodeURIComponent(t).replace(/(?:[-_.!~*'()]|%20)/g,e=>{switch(e){case"-":case"_":case".":case"!":case"~":case"*":case"'":case"(":case")":return`%${e.charCodeAt(0).toString(16).toUpperCase()}`;case"%20":return"+";default:throw new Error}})}function Zd(t){return $e(t,'"clientSecret"'),(e,r,n,o)=>{n.set("client_id",r.client_id),n.set("client_secret",t)}}function gy(t){return $e(t,'"clientSecret"'),(e,r,n,o)=>{let i=cy(r.client_id),s=cy(t),a=btoa(`${i}:${s}`);o.set("authorization",`Basic ${a}`)}}function yy(){return(t,e,r,n)=>{r.set("client_id",e.client_id)}}var R0=URL.parse?(t,e)=>URL.parse(t,e):(t,e)=>{try{return new URL(t,e)}catch{return null}};function vy(t,e){if(e&&t.protocol!=="https:")throw O("only requests to HTTPS are allowed",X0,t);if(t.protocol!=="https:"&&t.protocol!=="http:")throw O("only HTTP and HTTPS requests are allowed",Q0,t)}function uy(t,e,r,n){let o;if(typeof t!="string"||!(o=R0(t)))throw O(`authorization server metadata does not contain a valid ${r?`"as.mtls_endpoint_aliases.${e}"`:`"as.${e}"`}`,t===void 0?e$:t$,{attribute:r?`mtls_endpoint_aliases.${e}`:e});return vy(o,n),o}function _y(t,e,r,n){return r&&t.mtls_endpoint_aliases&&e in t.mtls_endpoint_aliases?uy(t.mtls_endpoint_aliases[e],e,r,n):uy(t[e],e,r,n)}var uo=class extends Error{cause;code;error;status;error_description;response;constructor(e,r){super(e,r),this.name=this.constructor.name,this.code=V0,this.cause=r.cause,this.error=r.cause.error,this.status=r.response.status,this.error_description=r.cause.error_description,Object.defineProperty(this,"response",{enumerable:!1,value:r.response}),Error.captureStackTrace?.(this,this.constructor)}},bi=class extends Error{cause;code;error;error_description;constructor(e,r){super(e,r),this.name=this.constructor.name,this.code=J0,this.cause=r.cause,this.error=r.cause.get("error"),this.error_description=r.cause.get("error_description")??void 0,Error.captureStackTrace?.(this,this.constructor)}},Ri=class extends Error{cause;code;response;status;constructor(e,r){super(e,r),this.name=this.constructor.name,this.code=W0,this.cause=r.cause,this.status=r.response.status,this.response=r.response,Object.defineProperty(this,"response",{enumerable:!1}),Error.captureStackTrace?.(this,this.constructor)}},Ta="[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+",C0="[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}",P0='"((?:[^"\\\\]|\\\\[\\s\\S])*)"',x0="("+Ta+")\\s*=\\s*"+P0,k0="("+Ta+")\\s*=\\s*("+Ta+")",E0=new RegExp("^[,\\s]*("+Ta+")"),T0=new RegExp("^[,\\s]*"+x0+"[,\\s]*(.*)"),A0=new RegExp("^[,\\s]*"+k0+"[,\\s]*(.*)"),M0=new RegExp("^("+C0+")(?:$|[,\\s])(.*)");function $0(t){if(!lo(t,Response))throw he('"response" must be an instance of Response',Xe);let e=t.headers.get("www-authenticate");if(e===null)return;let r=[],n=e;for(;n;){let o=n.match(E0),i=o?.[1].toLowerCase();if(!i)return;let s=n.substring(o[0].length);if(s&&!s.match(/^[\s,]/))return;let a=s.match(/^\s+(.*)$/),c=!!a;n=a?a[1]:void 0;let u={},d;if(c)for(;n;){let f,p;if(o=n.match(T0)){if([,f,p,n]=o,p.includes("\\"))try{p=JSON.parse(`"${p}"`)}catch{}u[f.toLowerCase()]=p;continue}if(o=n.match(A0)){[,f,p,n]=o,u[f.toLowerCase()]=p;continue}if(o=n.match(M0)){if(Object.keys(u).length)break;[,d,n]=o;break}return}else n=s||void 0;let l={scheme:i,parameters:u};d&&(l.token68=d),r.push(l)}if(r.length)return r}async function I0(t){if(t.status>399&&t.status<500){Ci(t),ly(t);try{let e=await t.clone().json();if(Ea(e)&&typeof e.error=="string"&&e.error.length)return e}catch{}}}async function Sy(t,e,r){if(t.status!==e){L0(t);let n;throw(n=await I0(t))?(await t.body?.cancel(),new uo("server responded with an error in the response body",{cause:n,response:t})):O(`"response" is not a conform ${r} response (unexpected HTTP status code)`,Wd,t)}}function wy(t){if(!Bd.has(t))throw he('"options.DPoP" is not a valid DPoPHandle',Kt)}function O0(t){return t.headers.get("content-type")?.split(";")[0]}async function z0(t,e,r,n,o,i,s){return await r(t,e,o,i),i.set("content-type","application/x-www-form-urlencoded;charset=UTF-8"),(s?.[vn]||fetch)(n.href,{body:o,headers:Object.fromEntries(i.entries()),method:"POST",redirect:"manual",signal:jd(n,s?.signal)})}async function N0(t,e,r,n,o,i){let s=_y(t,"token_endpoint",e.use_mtls_endpoint_aliases,i?.[Dd]!==!0);o.set("grant_type",n);let a=Ld(i?.headers);a.set("accept","application/json"),i?.DPoP!==void 0&&(wy(i.DPoP),await i.DPoP.addProof(s,a,"POST"));let c=await z0(t,e,r,s,o,a,i);return i?.DPoP?.cacheNonce(c,s),c}var by=new WeakMap,D0=new WeakMap;function Ry(t){if(!t.id_token)return;let e=by.get(t);if(!e)throw he('"ref" was already garbage collected or did not resolve from the proper sources',Kt);return e}async function Cy(t,e,r,n,o,i){if($a(t),Gd(e),!lo(r,Response))throw he('"response" must be an instance of Response',Xe);await Sy(r,200,"Token Endpoint"),Ci(r);let s=await za(r);if($e(s.access_token,'"response" body "access_token" property',V,{body:s}),$e(s.token_type,'"response" body "token_type" property',V,{body:s}),s.token_type=s.token_type.toLowerCase(),s.expires_in!==void 0){let a=typeof s.expires_in!="number"?parseFloat(s.expires_in):s.expires_in;ao(a,!0,'"response" body "expires_in" property',V,{body:s}),s.expires_in=a}if(s.refresh_token!==void 0&&$e(s.refresh_token,'"response" body "refresh_token" property',V,{body:s}),s.scope!==void 0&&typeof s.scope!="string")throw O('"response" body "scope" property must be a string',V,{body:s});if(s.id_token!==void 0){$e(s.id_token,'"response" body "id_token" property',V,{body:s});let a=["aud","exp","iat","iss","sub"];e.require_auth_time===!0&&a.push("auth_time"),e.default_max_age!==void 0&&(ao(e.default_max_age,!0,'"client.default_max_age"'),a.push("auth_time")),n?.length&&a.push(...n);let{claims:c,jwt:u}=await r$(s.id_token,n$.bind(void 0,e.id_token_signed_response_alg,t.id_token_signing_alg_values_supported,"RS256"),Ud(e),qd(e),o).then(G0.bind(void 0,a)).then(F0.bind(void 0,t)).then(j0.bind(void 0,e.client_id));if(Array.isArray(c.aud)&&c.aud.length!==1){if(c.azp===void 0)throw O('ID Token "aud" (audience) claim includes additional untrusted audiences',Dr,{claims:c,claim:"aud"});if(c.azp!==e.client_id)throw O('unexpected ID Token "azp" (authorized party) claim value',Dr,{expected:e.client_id,claims:c,claim:"azp"})}c.auth_time!==void 0&&ao(c.auth_time,!0,'ID Token "auth_time" (authentication time)',V,{claims:c}),D0.set(r,u),by.set(s,c)}if(i?.[s.token_type]!==void 0)i[s.token_type](r,s);else if(s.token_type!=="dpop"&&s.token_type!=="bearer")throw new co("unsupported `token_type` value",{cause:{body:s}});return s}function L0(t){let e;if(e=$0(t))throw new Ri("server responded with a challenge in the WWW-Authenticate HTTP Header",{cause:e,response:t})}function j0(t,e){if(Array.isArray(e.claims.aud)){if(!e.claims.aud.includes(t))throw O('unexpected JWT "aud" (audience) claim value',Dr,{expected:t,claims:e.claims,claim:"aud"})}else if(e.claims.aud!==t)throw O('unexpected JWT "aud" (audience) claim value',Dr,{expected:t,claims:e.claims,claim:"aud"});return e}function F0(t,e){let r=t[s$]?.(e)??t.issuer;if(e.claims.iss!==r)throw O('unexpected JWT "iss" (issuer) claim value',Dr,{expected:r,claims:e.claims,claim:"iss"});return e}var Bd=new WeakSet;function U0(t){return Bd.add(t),t}var q0=Symbol();async function Py(t,e,r,n,o,i,s){if($a(t),Gd(e),!Bd.has(n))throw he('"callbackParameters" must be an instance of URLSearchParams obtained from "validateAuthResponse()", or "validateJwtAuthResponse()',Kt);$e(o,'"redirectUri"');let a=yn(n,"code");if(!a)throw O('no authorization code in "callbackParameters"',V);let c=new URLSearchParams(s?.additionalParameters);return c.set("redirect_uri",o),c.set("code",a),i!==q0&&($e(i,'"codeVerifier"'),c.set("code_verifier",i)),N0(t,e,r,"authorization_code",c,s)}var H0={aud:"audience",c_hash:"code hash",client_id:"client id",exp:"expiration time",iat:"issued at",iss:"issuer",jti:"jwt id",nonce:"nonce",s_hash:"state hash",sub:"subject",ath:"access token hash",htm:"http method",htu:"http uri",cnf:"confirmation",auth_time:"authentication time"};function G0(t,e){for(let r of t)if(e.claims[r]===void 0)throw O(`JWT "${r}" (${H0[r]}) claim missing`,V,{claims:e.claims});return e}var Ad=Symbol(),Md=Symbol();async function xy(t,e,r,n){return typeof n?.expectedNonce=="string"||typeof n?.maxAge=="number"||n?.requireIdToken?Z0(t,e,r,n.expectedNonce,n.maxAge,n[ay],n.recognizedTokenTypes):B0(t,e,r,n?.[ay],n?.recognizedTokenTypes)}async function Z0(t,e,r,n,o,i,s){let a=[];switch(n){case void 0:n=Ad;break;case Ad:break;default:$e(n,'"expectedNonce" argument'),a.push("nonce")}switch(o??=e.default_max_age,o){case void 0:o=Md;break;case Md:break;default:ao(o,!0,'"maxAge" argument'),a.push("auth_time")}let c=await Cy(t,e,r,a,i,s);$e(c.id_token,'"response" body "id_token" property',V,{body:c});let u=Ry(c);if(o!==Md){let d=Hd()+Ud(e),l=qd(e);if(u.auth_time+o<d-l)throw O("too much time has elapsed since the last End-User authentication",Aa,{claims:u,now:d,tolerance:l,claim:"auth_time"})}if(n===Ad){if(u.nonce!==void 0)throw O('unexpected ID Token "nonce" claim value',Dr,{expected:void 0,claims:u,claim:"nonce"})}else if(u.nonce!==n)throw O('unexpected ID Token "nonce" claim value',Dr,{expected:n,claims:u,claim:"nonce"});return c}async function B0(t,e,r,n,o){let i=await Cy(t,e,r,void 0,n,o),s=Ry(i);if(s){if(e.default_max_age!==void 0){ao(e.default_max_age,!0,'"client.default_max_age"');let a=Hd()+Ud(e),c=qd(e);if(s.auth_time+e.default_max_age<a-c)throw O("too much time has elapsed since the last End-User authentication",Aa,{claims:s,now:a,tolerance:c,claim:"auth_time"})}if(s.nonce!==void 0)throw O('unexpected ID Token "nonce" claim value',Dr,{expected:void 0,claims:s,claim:"nonce"})}return i}var W0="OAUTH_WWW_AUTHENTICATE_CHALLENGE",V0="OAUTH_RESPONSE_BODY_ERROR",K0="OAUTH_UNSUPPORTED_OPERATION",J0="OAUTH_AUTHORIZATION_RESPONSE_ERROR";var Nd="OAUTH_PARSE_ERROR",V="OAUTH_INVALID_RESPONSE";var Y0="OAUTH_RESPONSE_IS_NOT_JSON",Wd="OAUTH_RESPONSE_IS_NOT_CONFORM",X0="OAUTH_HTTP_REQUEST_FORBIDDEN",Q0="OAUTH_REQUEST_PROTOCOL_FORBIDDEN",Aa="OAUTH_JWT_TIMESTAMP_CHECK_FAILED",Dr="OAUTH_JWT_CLAIM_COMPARISON_FAILED",Ia="OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED";var e$="OAUTH_MISSING_SERVER_METADATA",t$="OAUTH_INVALID_SERVER_METADATA";function Ci(t){if(t.bodyUsed)throw he('"response" body has been used already',Kt)}async function r$(t,e,r,n,o){let{0:i,1:s,length:a}=t.split(".");if(a===5)if(o!==void 0)t=await o(t),{0:i,1:s,length:a}=t.split(".");else throw new co("JWE decryption is not configured",{cause:t});if(a!==3)throw O("Invalid JWT",V,t);let c;try{c=JSON.parse(Id(ka(i)))}catch(l){throw O("failed to parse JWT Header body as base64url encoded JSON",Nd,l)}if(!Ea(c))throw O("JWT Header must be a top level object",V,t);if(e(c),c.crit!==void 0)throw new co('no JWT "crit" header parameter extensions are supported',{cause:{header:c}});let u;try{u=JSON.parse(Id(ka(s)))}catch(l){throw O("failed to parse JWT Payload body as base64url encoded JSON",Nd,l)}if(!Ea(u))throw O("JWT Payload must be a top level object",V,t);let d=Hd()+r;if(u.exp!==void 0){if(typeof u.exp!="number")throw O('unexpected JWT "exp" (expiration time) claim type',V,{claims:u});if(u.exp<=d-n)throw O('unexpected JWT "exp" (expiration time) claim value, expiration is past current timestamp',Aa,{claims:u,now:d,tolerance:n,claim:"exp"})}if(u.iat!==void 0&&typeof u.iat!="number")throw O('unexpected JWT "iat" (issued at) claim type',V,{claims:u});if(u.iss!==void 0&&typeof u.iss!="string")throw O('unexpected JWT "iss" (issuer) claim type',V,{claims:u});if(u.nbf!==void 0){if(typeof u.nbf!="number")throw O('unexpected JWT "nbf" (not before) claim type',V,{claims:u});if(u.nbf>d+n)throw O('unexpected JWT "nbf" (not before) claim value',Aa,{claims:u,now:d,tolerance:n,claim:"nbf"})}if(u.aud!==void 0&&typeof u.aud!="string"&&!Array.isArray(u.aud))throw O('unexpected JWT "aud" (audience) claim type',V,{claims:u});return{header:c,claims:u,jwt:t}}function n$(t,e,r,n){if(t!==void 0){if(typeof t=="string"?n.alg!==t:!t.includes(n.alg))throw O('unexpected JWT "alg" header parameter',V,{header:n,expected:t,reason:"client configuration"});return}if(Array.isArray(e)){if(!e.includes(n.alg))throw O('unexpected JWT "alg" header parameter',V,{header:n,expected:e,reason:"authorization server metadata"});return}if(r!==void 0){if(typeof r=="string"?n.alg!==r:typeof r=="function"?!r(n.alg):!r.includes(n.alg))throw O('unexpected JWT "alg" header parameter',V,{header:n,expected:r,reason:"default value"});return}throw O('missing client or server configuration to verify used JWT "alg" header parameter',void 0,{client:t,issuer:e,fallback:r})}function yn(t,e){let{0:r,length:n}=t.getAll(e);if(n>1)throw O(`"${e}" parameter must be provided only once`,V);return r}var o$=Symbol(),i$=Symbol();function ky(t,e,r,n){if($a(t),Gd(e),r instanceof URL&&(r=r.searchParams),!(r instanceof URLSearchParams))throw he('"parameters" must be an instance of URLSearchParams, or URL',Xe);if(yn(r,"response"))throw O('"parameters" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()',V,{parameters:r});let o=yn(r,"iss"),i=yn(r,"state");if(!o&&t.authorization_response_iss_parameter_supported)throw O('response parameter "iss" (issuer) missing',V,{parameters:r});if(o&&o!==t.issuer)throw O('unexpected "iss" (issuer) response parameter value',V,{expected:t.issuer,parameters:r});switch(n){case void 0:case i$:if(i!==void 0)throw O('unexpected "state" response parameter encountered',V,{expected:void 0,parameters:r});break;case o$:break;default:if($e(n,'"expectedState" argument'),i!==n)throw O(i===void 0?'response parameter "state" missing':'unexpected "state" response parameter value',V,{expected:n,parameters:r})}if(yn(r,"error"))throw new bi("authorization response from the server is an error",{cause:r});let a=yn(r,"id_token"),c=yn(r,"token");if(a!==void 0||c!==void 0)throw new co("implicit and hybrid flows are not supported");return U0(new URLSearchParams(r))}async function Ey(t,e,r){$a(t);let n=_y(t,"registration_endpoint",e.use_mtls_endpoint_aliases,r?.[Dd]!==!0),o=Ld(r?.headers);o.set("accept","application/json"),o.set("content-type","application/json");let i="POST";r?.DPoP&&(wy(r.DPoP),await r.DPoP.addProof(n,o,i,r.initialAccessToken)),r?.initialAccessToken&&o.set("authorization",`${o.has("dpop")?"DPoP":"Bearer"} ${r.initialAccessToken}`);let s=await(r?.[vn]||fetch)(n.href,{body:JSON.stringify(e),headers:Object.fromEntries(o.entries()),method:i,redirect:"manual",signal:jd(n,r?.signal)});return r?.DPoP?.cacheNonce(s,n),s}async function Ty(t){if(!lo(t,Response))throw he('"response" must be an instance of Response',Xe);await Sy(t,201,"Dynamic Client Registration Endpoint"),Ci(t);let e=await za(t);return $e(e.client_id,'"response" body "client_id" property',V,{body:e}),e.client_secret!==void 0&&$e(e.client_secret,'"response" body "client_secret" property',V,{body:e}),e.client_secret&&ao(e.client_secret_expires_at,!0,'"response" body "client_secret_expires_at" property',V,{body:e}),e}async function Ay(t,e){return S0(t,"resourceIdentifier",r=>(_0(r,".well-known/oauth-protected-resource",!0),r),e)}async function Oa(t,e){let r=t;if(!(r instanceof URL)&&r!==Ma)throw he('"expectedResourceIdentifier" must be an instance of URL',Xe);if(!lo(e,Response))throw he('"response" must be an instance of Response',Xe);if(e.status!==200)throw O('"response" is not a conform Resource Server Metadata response (unexpected HTTP status code)',Wd,e);Ci(e);let n=await za(e);if($e(n.resource,'"response" body "resource" property',V,{body:n}),r!==Ma&&new URL(n.resource).href!==r.href)throw O('"response" body "resource" property does not match the expected value',Ia,{expected:r.href,body:n,attribute:"resource"});return n}async function za(t,e=ly){let r;try{r=await t.json()}catch(n){throw e(t),O('failed to parse "response" body as JSON',Nd,n)}if(!Ea(r))throw O('"response" body must be a top level object',V,{body:r});return r}var Ma=Symbol(),s$=Symbol();var Pi="TLS certificate not trusted. Configure system trust or NODE_EXTRA_CA_CERTS.",My={UNABLE_TO_GET_ISSUER_CERT:Pi,UNABLE_TO_GET_ISSUER_CERT_LOCALLY:Pi,UNABLE_TO_VERIFY_LEAF_SIGNATURE:Pi,DEPTH_ZERO_SELF_SIGNED_CERT:Pi,SELF_SIGNED_CERT_IN_CHAIN:Pi,CERT_HAS_EXPIRED:"TLS certificate expired. Check the system clock or contact the server administrator.",ERR_TLS_CERT_ALTNAME_INVALID:"TLS certificate hostname mismatch. Verify the server URL or contact the network administrator."};function xi(t){let e=new Set,r=t,n;for(let o=0;o<16&&!(typeof r!="object"||r===null||e.has(r));o++){if(e.add(r),"name"in r&&(r.name==="AbortError"||r.name==="TimeoutError")||"code"in r&&r.code==="ABORT_ERR")return;"code"in r&&typeof r.code=="string"&&Object.hasOwn(My,r.code)&&(n??=r.code),r="cause"in r?r.cause:void 0}return n}function ki(t){return Object.assign(new Error(My[t]),{code:t})}var Oy=a$.child({prefix:"pi-mcp"}),Ei=1e4,c$=1e3,u$=401,$y=200,d$="accounts.google.com",l$=/(?:^|[\s,])resource_metadata\s*=\s*"([^"]+)"/,f$=/(?:^|[\s,])resource_metadata\s*=\s*([^,\s]+)/,zy;function fo(){return zy??globalThis.fetch}function Ny(t){let e=AbortSignal.timeout(1e4),r=t?.signal?AbortSignal.any([t.signal,e]):e;return{...t,signal:r}}function Dy(t){let e=new URL(t.href);return e.search="",e.hash="",e}async function Kd(t){let e=Dy(t),r,n=o=>{r??=xi(o)};try{let o=await p$(e,n),i=o?.authorization_servers?.map(s=>new URL(s))??[e];for(let s of i){let a=await v$(s,n);if(a)return Object.assign(a,{resourceScopes:o?.scopes_supported,resourceIdentifier:o?.resource})}}catch(o){throw La(o)}throw r?ki(r):new Error("Failed to discover metadata URL")}async function p$(t,e){try{let r=await Ay(t,{signal:AbortSignal.timeout(Ei),[vn]:zy??void 0});return r.ok?await Oa(t,r):(r.body?.cancel().catch(()=>{}),await Ly(t,r.headers.get("www-authenticate"),e)??await Iy(t,e))}catch(r){return e(r),await Iy(t,e)}}async function Iy(t,e){for(let r of["HEAD","GET"])try{let n=await fo()(t,{method:r,signal:AbortSignal.timeout(Ei)});n.body?.cancel().catch(()=>{});let o=await Ly(t,n.headers.get("www-authenticate"),e);if(o)return o}catch(n){e(n)}}async function Ly(t,e,r){let n=y$(e);if(n)try{let o=await fo()(n,{signal:AbortSignal.timeout(Ei)});return await h$(t,o)}catch(o){r(o);return}}async function h$(t,e){let r=await e.text(),n={status:e.status,statusText:e.statusText,headers:e.headers};try{return await Oa(t,new Response(r,n))}catch(o){if(!(o instanceof wi)||o.code!==Ia)throw o;let i=m$(r);if(!i||!g$(i,t))throw o;return await Oa(i,new Response(r,n))}}function m$(t){try{let e=JSON.parse(t);return typeof e.resource!="string"?void 0:new URL(e.resource)}catch{return}}function g$(t,e){if(t.origin!==e.origin)return!1;let r=t.pathname.replace(/\/+$/,""),n=e.pathname.replace(/\/+$/,"");return r===n||n.startsWith(`${r}/`)}function y$(t){if(!t)return;let e=t.match(l$),r=t.match(f$),n=e?.[1]??r?.[1];if(n)try{return new URL(n)}catch{return}}async function v$(t,e){for(let r of _$(t))try{let n=new URL(r,t),o=await fo()(n,{signal:AbortSignal.timeout(Ei)});if(o.body?.cancel().catch(()=>{}),!o.ok)continue;return n}catch(n){e(n)}}function _$(t){let e=t.pathname.startsWith("/")?t.pathname.slice(1):t.pathname;return[...e.length>0?[new URL(`/.well-known/oauth-authorization-server/${e}`,t),new URL(`/.well-known/openid-configuration/${e}`,t),new URL(`/${e}/.well-known/openid-configuration`,t)]:[],new URL("/.well-known/oauth-authorization-server",t),new URL("/.well-known/openid-configuration",t)]}async function Jd(t){try{let e=await fo()(t,{signal:AbortSignal.timeout(Ei)}),r=await e.text(),n={status:e.status,statusText:e.statusText,headers:e.headers},o=await S$(new Response(r,n));if(!o)throw new Error("Missing issuer from discovery response");return await dy(o,new Response(r,n))}catch(e){throw La(e)}}async function S$(t){if(!t.ok)throw new Error("Invalid status code from discovery response");let e=await t.json();if(!e.issuer||typeof e.issuer!="string")throw new Error("Invalid issuer from discovery response");return new URL(e.issuer)}var Vd=class extends Error{issuer;constructor(e){super(`This MCP server's authorization server (\`${e}\`) does not support Dynamic Client Registration. Configure a static OAuth Client ID and Secret in the Advanced section.`),this.name="McpOAuthDcrUnsupportedError",this.issuer=e}};function w$(t){if(!t.clientId)throw new Error("clientId is required to build client from config");let e=t.clientSecret?.trim();return{client_id:t.clientId,...e?{client_secret:e}:{}}}async function Yd({config:t,serverMetadata:e,redirectUris:r,preferStaticClient:n=!1}){let o=t.clientId?.trim(),i=t.clientSecret?.trim();if(!!o&&(n||!!i||!e.registration_endpoint))return w$({...t,clientId:o});if(!e.registration_endpoint)throw new Vd(e.issuer);return await b$(e,r)}async function b$(t,e){try{let r=t.token_endpoint_auth_methods_supported?.includes("none")??!1,n=await Ey(t,{client_name:Xg,client_uri:Qg,logo_uri:ey,redirect_uris:e,grant_types:["authorization_code","refresh_token"],response_types:["code"],...r?{token_endpoint_auth_method:"none"}:{}},{[vn]:R$});return n.ok||Oy.error(`Dynamic client registration failed with HTTP status ${n.status} (${n.statusText})`),await Ty(n)}catch(r){throw La(r)}}async function R$(t,e){let r=await fo()(t,Ny(e)),n=await r.text(),o={status:r.status,statusText:r.statusText,headers:r.headers};if(r.ok||Oy.error(`Dynamic client registration error response body (HTTP ${r.status} ${r.statusText}): ${P$(n)}`),r.status===200&&(o.status=201,o.statusText="Created"),o.status===201)try{let i=JSON.parse(n);i.client_secret_expires_at||(i.client_secret_expires_at=0),"client_secret"in i&&!i.client_secret&&(i.client_secret=void 0),n=JSON.stringify(i)}catch{}return new Response(n,o)}function C$(t,e){let r=new Headers(e?.headers),n=r.get("content-type"),o=e;return n?.toLowerCase().startsWith("application/x-www-form-urlencoded;")&&(r.set("content-type","application/x-www-form-urlencoded"),o={...e,headers:r}),fo()(t,Ny(o))}function P$(t){try{let e=JSON.parse(t);for(let r of Object.keys(e))/secret|token/i.test(r)&&(e[r]="[REDACTED]");return JSON.stringify(e)}catch{return t.length>$y?`${t.slice(0,$y)}\u2026`:t}}async function Na(t,e,r,n,o,i,s){if(!r.authorization_endpoint)throw new Error("No authorization endpoint");let a=fy(),c=await my(a),u=py(),d,l=(o??r.scopes_supported?.join(" "))?.split(/\s+/).filter(Boolean),f=!1;!s?.disableOfflineAccessAugmentation&&l?.length&&!l.includes("offline_access")&&r.scopes_supported?.includes("offline_access")&&(l.push("offline_access"),f=!0);let p=l?.join(" ")||void 0,h=Dy(i??t).toString(),m=new URL(r.authorization_endpoint);return m.searchParams.set("response_type","code"),m.searchParams.set("client_id",e.client_id),m.searchParams.set("code_challenge",c),m.searchParams.set("code_challenge_method","S256"),m.searchParams.set("redirect_uri",n),m.searchParams.set("resource",h),m.searchParams.set("state",u),p&&m.searchParams.set("scope",p),l?.includes("offline_access")&&m.searchParams.set("prompt","consent"),m.hostname===d$&&(m.searchParams.set("access_type","offline"),m.searchParams.set("prompt","consent")),r.code_challenge_methods_supported?.includes("S256")||(d=hy(),m.searchParams.set("nonce",d)),{client:e,serverMetadata:r,redirectUri:n,codeVerifier:a,nonce:d,scope:p,state:u,resource:h,offlineAccessAugmented:f,authUri:m}}function Da(t,e){return e.offlineAccessAugmented===!0&&t.get("error")==="invalid_scope"&&t.get("state")===e.state}async function Xd(t){if(!t.resource)throw new Error("Cannot rebuild authorization state without a resource");let e=t.scope?.split(/\s+/).filter(r=>r&&r!=="offline_access").join(" ");return await Na(new URL(t.resource),t.client,t.serverMetadata,t.redirectUri,e||void 0,void 0,{disableOfflineAccessAugmentation:!0})}async function x$(t,e,r){let n=await Py(t.serverMetadata,t.client,r,e,t.redirectUri,t.codeVerifier,{[vn]:C$,...t.resource?{additionalParameters:{resource:t.resource}}:{}});return xy(t.serverMetadata,t.client,await k$(n))}async function Qd(t,e){try{let r=ky(e.serverMetadata,e.client,t,e.state),n=await T$(e.client,o=>x$(e,r,o));return $$(n,e.serverMetadata,e.client,void 0,e.resource)}catch(r){throw La(r)}}async function k$(t){let e=await t.text(),r={status:t.status,statusText:t.statusText,headers:t.headers};try{let n=JSON.parse(e);if("id_token"in n)return n.id_token=void 0,new Response(JSON.stringify(n),r)}catch{}return new Response(e,r)}function jy(t){let e=t.client_secret;return typeof e=="string"&&e.length>0?e:void 0}function E$(t){let e=jy(t);return e===void 0?yy():t.token_endpoint_auth_method==="client_secret_basic"?gy(e):Zd(e)}async function T$(t,e){try{return await e(E$(t))}catch(r){let n=A$(t);if(n&&M$(r))return await e(n);throw r}}function A$(t){let e=jy(t);if(t.token_endpoint_auth_method==="client_secret_basic"&&e!==void 0)return Zd(e)}function M$(t){return t instanceof uo?t.error==="invalid_client"||t.error==="unauthorized":t instanceof Ri?t.status===u$||t.cause.some(({parameters:e})=>{let{error:r}=e;return r==="invalid_client"||r==="unauthorized"}):!1}function $$(t,e,r,n,o){if(!t.access_token)throw new Error("OAuth token response contained no access token");return{accessToken:t.access_token,refreshToken:t.refresh_token||n,expiresAt:t.expires_in?Date.now()+t.expires_in*c$:void 0,tokenType:t.token_type,scope:t.scope,resource:o,serverMetadata:e,client:r}}function La(t){let e=xi(t);if(e)return ki(e);if(t instanceof uo||t instanceof bi){let r=t.error_description?` (${t.error_description})`:"";return new Error(`${t.message}${r}`,{cause:t})}return t instanceof Error?t:new Error(String(t))}var I$=/(authorization|auth[_-]?token|access[_-]?token|refresh[_-]?token|\btoken\b|secret|password|passwd|\bpwd\b|api[_-]?key|apikey|client[_-]?secret|private[_-]?key|cookie|session[_-]?id|credential|bearer)/i,Fy=/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/,Uy=/\b(bearer|token)\s+[A-Za-z0-9._~+/-]{12,}=*/i,qy=/\b(?=[A-Za-z0-9._-]*[A-Za-z])(?=[A-Za-z0-9._-]*\d)[A-Za-z0-9._-]{24,}\b/,_n="[redacted]",O$=/[.*+?^${}()|[\]\\]/g;function el(t,e){return e.chars-=t.length,e.chars<0?e.marker:e.redactText(t)}function z$(t,e,r){try{let n=Array.isArray(t);if(n&&t.length>r.nodes)return r.marker;let o=Object.getPrototypeOf(t);if(!n&&o!==null&&o!==Object.prototype)return r.marker;r.active.add(t);let i=Object.keys(t);if(i.length>r.nodes)return r.marker;let s=n?[]:Object.create(null);for(let a of i){if(n&&!/^(0|[1-9]\d*)$/.test(a))continue;let c=Object.getOwnPropertyDescriptor(t,a);Object.defineProperty(s,n?a:el(a,r),{value:c&&"value"in c?Hy(c.value,e+1,r):r.marker,enumerable:!0,configurable:!0,writable:!0})}return s}catch{return r.marker}finally{r.active.delete(t)}}function Hy(t,e,r){if(--r.nodes<0||e>16)return r.marker;if(typeof t=="string")return el(t,r);if(t===void 0)return t;if(t===null||typeof t=="boolean"||typeof t=="number"){if(typeof t=="number"&&!Number.isFinite(t))return r.marker;let n=JSON.stringify(t);return el(n,r)===n?t:r.marker}return typeof t!="object"||r.active.has(t)?r.marker:z$(t,e,r)}function rl(t){let e=[...new Set(t)].filter(Boolean);if(e.length>128||e.reduce((i,s)=>i+s.length,0)>262144)return{text:()=>"",value:()=>{}};let r=e.length?new RegExp(e.sort((i,s)=>s.length-i.length).map(i=>i.replace(O$,"\\$&")).join("|"),"g"):void 0,n=e.some(i=>_n.includes(i))?"":_n,o=i=>{if(i.length>262144)return n;let s=r?i.replace(r,()=>n):i;return e.some(a=>s.includes(a))?n:s};return{text:o,value:i=>Hy(i,0,{redactText:o,marker:n,nodes:1e4,chars:262144,active:new WeakSet})}}var N$=500,D$=8192,L$=6;function j$(t){return Fy.test(t)||Uy.test(t)||qy.test(t)}var F$=new RegExp(Fy.source,"g"),U$=new RegExp(Uy.source,"gi"),q$=new RegExp(qy.source,"g");function Gy(t,e){let r=[...t];return r.length<=e?t:`${r.slice(0,Math.max(e-3,0)).join("")}...`}function ja(t){return t&&Gy(t,D$).replace(F$,_n).replace(U$,r=>`${r.match(/^(bearer|token)\s+/i)?.[0]??""}${_n}`).replace(q$,_n)}function tl(t,e,r){if(e)return _n;if(typeof t=="string")return j$(t)?_n:t;if(t===null||typeof t!="object")return t;if(r>=L$)return"[truncated]";if(Array.isArray(t))return t.map(o=>tl(o,!1,r+1));let n={};for(let[o,i]of Object.entries(t))n[o]=tl(i,I$.test(o),r+1);return n}function Zy(t,e=N$){if(t==null)return;let r=tl(t,!1,0),n;try{n=JSON.stringify(r)}catch{return"[unserializable structured content]"}if(!(!n||n==="{}"||n==="[]"||n==='""'))return Gy(n,e)}var Wy={reportError:()=>{}},By=Symbol.for("__pi_mcp_error_reporter_slot__");function Vy(){let t=globalThis,e=t[By];return e||(e={reporter:null},t[By]=e),e}function Ky(t){let e=Vy(),r=e.reporter??Wy;return e.reporter=t,r}function H$(){return Vy().reporter??Wy}function Ti(t,e){try{H$().reportError(t,e)}catch{}}import{logger as G$}from"@hermes/logger";var nl=G$.child({prefix:"pi-mcp"});function Jy(t,e,r){let n=0,o=0,i=r?.authoritative?{}:{...t.headerSecrets};for(let[s,a]of Object.entries(e))typeof a=="string"&&a!==""?(i[s]=a,n++):a===null||a===""?s in i&&(delete i[s],o++):nl.warn(`Skipping malformed header-secret entry "${s}"`);t.headerSecrets=i,t.headerSecretFailures??={};for(let s of Object.keys(i))delete t.headerSecretFailures[s];nl.info(`Applied pushed MCP header secret update for ${n} key(s), deleted ${o}`)}function Yy(t){return async e=>{if(t.headerSecretFailures??={},!e.startsWith(Cd)){let o=t.headerSecrets[e];if(o!==void 0)return o;let i=t.headerSecretFailures[e];if(i==="missing"||i==="permission_denied")return{reason:i}}let r=t.secretsClient;if(r)try{let o=await r.getSecret(e);return o!==void 0?(delete t.headerSecretFailures[e],o):{reason:t.headerSecretFailures[e]??"missing"}}catch{return{reason:"transient"}}let n=t.headerSecretFailures[e];return n===void 0?void 0:{reason:n}}}function Xy(t,e,r){t.headerSecretFailures??={};let n=r?.authoritative?{}:{...t.headerSecretFailures},o={...t.headerSecrets};for(let[i,s]of Object.entries(e))(s==="missing"||s==="permission_denied"||s==="transient")&&(n[i]=s,delete o[i]);t.headerSecrets=o,t.headerSecretFailures=n,nl.info(`Applied MCP header secret failure update for ${Object.keys(n).length} key(s)`)}function Qy(t){return t.secretsClient!==void 0||Object.keys(t.headerSecrets).length>0||Object.keys(t.headerSecretFailures??{}).length>0}import{logger as Z$}from"@hermes/logger";var Ai=Z$.child({prefix:"pi-mcp"}),B$="$augment-",Mi=/\$augment-[a-zA-Z0-9_.-]+/g,W$=new RegExp(Mi.source);function Lr(t){return W$.test(t)}function Fa(t){return t.slice(B$.length)}function $i(t){let e=new Set;for(let r of Object.values(t))for(let n of r.matchAll(Mi))e.add(Fa(n[0]));return[...e].sort()}var V$=["permission_denied","missing","transient"];function ev(t){let e=new Set(t);return V$.find(r=>e.has(r))??"missing"}var gt=class extends Error{serverName;missingKeys;reason;constructor(e,r,n,o=n===void 0?"missing":"transient"){super(`MCP server "${e}" not started: missing secret(s) ${r.join(", ")}`,n===void 0?void 0:{cause:n}),this.name="McpSecretResolutionError",this.serverName=e,this.missingKeys=r,this.reason=o}};async function tv(t,e,r,n,o,i,s){let a=[...t.matchAll(Mi)];if(a.length===0)return t;let c=t;for(let u of a.reverse()){let d=u[0],l=u.index,f=Fa(d);try{let p=await r(f);if(p===void 0||typeof p=="object"){n.add(f),i.set(f,p===void 0?"missing":p.reason),Ai.warn(`Secret "${f}" unavailable for "${e}"; leaving reference as-is`);continue}let h=p;h.trim()===""&&(o.add(f),Ai.warn(`Secret "${f}" resolved empty for "${e}"`));let m=c.slice(0,l),g=s?s(h,m):h;c=m+g+c.slice(l+d.length),Ai.debug(`Resolved secret reference for "${e}"`)}catch(p){n.add(f),i.set(f,"transient"),Ai.error(`Failed to resolve secret "${f}" for "${e}" (${p instanceof Error?p.name:"non-Error"}); leaving reference as-is`)}}return c}async function rv({configEnv:t,localEnv:e,getSecret:r}){let n={},o=new Set,i=new Set,s=new Map;for(let[a,c]of Object.entries(t)){if(!Lr(c)){n[a]=c;continue}let u=e[a];if(u!==void 0){Ai.debug(`"${a}" references a secret but is already set in the local environment; using local value`),n[a]=u;continue}n[a]=await tv(c,a,r,o,i,s)}return{resolved:n,unresolvedKeys:[...o].sort(),emptyKeys:[...i].sort(),...s.size===0?{}:{failureReasons:Object.fromEntries([...s.entries()].sort(([a],[c])=>a.localeCompare(c)))}}}var K$=/["$`\\]/g;function J$(t){let e="unquoted",r=0;for(;r<t.length;){let n=t[r];if(e==="single"){n==="'"&&(e="unquoted"),r+=1;continue}if(e==="double"){if(n==="\\"){r+=2;continue}n==='"'&&(e="unquoted"),r+=1;continue}if(n==="\\"){r+=2;continue}n==="'"?e="single":n==='"'&&(e="double"),r+=1}return e}function Y$(t,e){let r=J$(e);if(r==="double")return t.replace(K$,"\\$&");let n=t.replaceAll("'","'\\''");return r==="single"?n:`'${n}'`}async function nv(t,e,r=!0){let n=new Set,o=new Set,i=new Map;return{resolved:await tv(t,"command",e,n,o,i,r?Y$:void 0),unresolvedKeys:[...n].sort(),emptyKeys:[...o].sort(),...i.size===0?{}:{failureReasons:Object.fromEntries([...i.entries()].sort(([a],[c])=>a.localeCompare(c)))}}}import{AsyncLocalStorage as Mq}from"node:async_hooks";var ov,ol=Object.freeze({status:"aborted"});function S(t,e,r){function n(a,c){if(a._zod||Object.defineProperty(a,"_zod",{value:{def:c,constr:s,traits:new Set},enumerable:!1}),a._zod.traits.has(t))return;a._zod.traits.add(t),e(a,c);let u=s.prototype,d=Object.keys(u);for(let l=0;l<d.length;l++){let f=d[l];f in a||(a[f]=u[f].bind(a))}}let o=r?.Parent??Object;class i extends o{}Object.defineProperty(i,"name",{value:t});function s(a){var c;let u=r?.Parent?new i:this;n(u,a),(c=u._zod).deferred??(c.deferred=[]);for(let d of u._zod.deferred)d();return u}return Object.defineProperty(s,"init",{value:n}),Object.defineProperty(s,Symbol.hasInstance,{value:a=>r?.Parent&&a instanceof r.Parent?!0:a?._zod?.traits?.has(t)}),Object.defineProperty(s,"name",{value:t}),s}var Jt=class extends Error{constructor(){super("Encountered Promise during synchronous parse. Use .parseAsync() instead.")}},po=class extends Error{constructor(e){super(`Encountered unidirectional transform during encode: ${e}`),this.name="ZodEncodeError"}};(ov=globalThis).__zod_globalConfig??(ov.__zod_globalConfig={});var ho=globalThis.__zod_globalConfig;function Qe(t){return t&&Object.assign(ho,t),ho}var H={};Wu(H,{BIGINT_FORMAT_RANGES:()=>cv,Class:()=>sl,NUMBER_FORMAT_RANGES:()=>fl,aborted:()=>Ur,allowsEval:()=>ul,assert:()=>rI,assertEqual:()=>X$,assertIs:()=>eI,assertNever:()=>tI,assertNotEqual:()=>Q$,assignProp:()=>jr,base64ToUint8Array:()=>dv,base64urlToUint8Array:()=>_I,cached:()=>go,captureStackTrace:()=>Ha,cleanEnum:()=>vI,cleanRegex:()=>Ni,clone:()=>yt,cloneDef:()=>oI,createTransparentProxy:()=>dI,defineLazy:()=>Y,esc:()=>qa,escapeRegex:()=>ur,explicitlyAborted:()=>pl,extend:()=>pI,finalizeIssue:()=>vt,floatSafeRemainder:()=>al,getElementAtPath:()=>iI,getEnumValues:()=>Oi,getLengthableOrigin:()=>Di,getParsedType:()=>uI,getSizableOrigin:()=>uv,hexToUint8Array:()=>wI,isObject:()=>Sn,isPlainObject:()=>Fr,issue:()=>yo,joinValues:()=>Ua,jsonStringifyReplacer:()=>mo,merge:()=>mI,mergeDefs:()=>cr,normalizeParams:()=>M,nullish:()=>zi,numKeys:()=>cI,objectClone:()=>nI,omit:()=>fI,optionalKeys:()=>ll,parsedType:()=>hl,partial:()=>gI,pick:()=>lI,prefixIssues:()=>dr,primitiveTypes:()=>av,promiseAllObject:()=>sI,propertyKeyTypes:()=>dl,randomString:()=>aI,required:()=>yI,safeExtend:()=>hI,shallowClone:()=>sv,slugify:()=>cl,stringifyPrimitive:()=>Ga,uint8ArrayToBase64:()=>lv,uint8ArrayToBase64url:()=>SI,uint8ArrayToHex:()=>bI,unwrapMessage:()=>Ii});function X$(t){return t}function Q$(t){return t}function eI(t){}function tI(t){throw new Error("Unexpected value in exhaustive check")}function rI(t){}function Oi(t){let e=Object.values(t).filter(n=>typeof n=="number");return Object.entries(t).filter(([n,o])=>e.indexOf(+n)===-1).map(([n,o])=>o)}function Ua(t,e="|"){return t.map(r=>Ga(r)).join(e)}function mo(t,e){return typeof e=="bigint"?e.toString():e}function go(t){return{get value(){{let r=t();return Object.defineProperty(this,"value",{value:r}),r}throw new Error("cached value already set")}}}function zi(t){return t==null}function Ni(t){let e=t.startsWith("^")?1:0,r=t.endsWith("$")?t.length-1:t.length;return t.slice(e,r)}function al(t,e){let r=t/e,n=Math.round(r),o=Number.EPSILON*Math.max(Math.abs(r),1);return Math.abs(r-n)<o?0:r-n}var iv=Symbol("evaluating");function Y(t,e,r){let n;Object.defineProperty(t,e,{get(){if(n!==iv)return n===void 0&&(n=iv,n=r()),n},set(o){Object.defineProperty(t,e,{value:o})},configurable:!0})}function nI(t){return Object.create(Object.getPrototypeOf(t),Object.getOwnPropertyDescriptors(t))}function jr(t,e,r){Object.defineProperty(t,e,{value:r,writable:!0,enumerable:!0,configurable:!0})}function cr(...t){let e={};for(let r of t){let n=Object.getOwnPropertyDescriptors(r);Object.assign(e,n)}return Object.defineProperties({},e)}function oI(t){return cr(t._zod.def)}function iI(t,e){return e?e.reduce((r,n)=>r?.[n],t):t}function sI(t){let e=Object.keys(t),r=e.map(n=>t[n]);return Promise.all(r).then(n=>{let o={};for(let i=0;i<e.length;i++)o[e[i]]=n[i];return o})}function aI(t=10){let e="abcdefghijklmnopqrstuvwxyz",r="";for(let n=0;n<t;n++)r+=e[Math.floor(Math.random()*e.length)];return r}function qa(t){return JSON.stringify(t)}function cl(t){return t.toLowerCase().trim().replace(/[^\w\s-]/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")}var Ha="captureStackTrace"in Error?Error.captureStackTrace:(...t)=>{};function Sn(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}var ul=go(()=>{if(ho.jitless||typeof navigator<"u"&&navigator?.userAgent?.includes("Cloudflare"))return!1;try{let t=Function;return new t(""),!0}catch{return!1}});function Fr(t){if(Sn(t)===!1)return!1;let e=t.constructor;if(e===void 0||typeof e!="function")return!0;let r=e.prototype;return!(Sn(r)===!1||Object.prototype.hasOwnProperty.call(r,"isPrototypeOf")===!1)}function sv(t){return Fr(t)?{...t}:Array.isArray(t)?[...t]:t instanceof Map?new Map(t):t instanceof Set?new Set(t):t}function cI(t){let e=0;for(let r in t)Object.prototype.hasOwnProperty.call(t,r)&&e++;return e}var uI=t=>{let e=typeof t;switch(e){case"undefined":return"undefined";case"string":return"string";case"number":return Number.isNaN(t)?"nan":"number";case"boolean":return"boolean";case"function":return"function";case"bigint":return"bigint";case"symbol":return"symbol";case"object":return Array.isArray(t)?"array":t===null?"null":t.then&&typeof t.then=="function"&&t.catch&&typeof t.catch=="function"?"promise":typeof Map<"u"&&t instanceof Map?"map":typeof Set<"u"&&t instanceof Set?"set":typeof Date<"u"&&t instanceof Date?"date":typeof File<"u"&&t instanceof File?"file":"object";default:throw new Error(`Unknown data type: ${e}`)}},dl=new Set(["string","number","symbol"]),av=new Set(["string","number","bigint","boolean","symbol","undefined"]);function ur(t){return t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function yt(t,e,r){let n=new t._zod.constr(e??t._zod.def);return(!e||r?.parent)&&(n._zod.parent=t),n}function M(t){let e=t;if(!e)return{};if(typeof e=="string")return{error:()=>e};if(e?.message!==void 0){if(e?.error!==void 0)throw new Error("Cannot specify both `message` and `error` params");e.error=e.message}return delete e.message,typeof e.error=="string"?{...e,error:()=>e.error}:e}function dI(t){let e;return new Proxy({},{get(r,n,o){return e??(e=t()),Reflect.get(e,n,o)},set(r,n,o,i){return e??(e=t()),Reflect.set(e,n,o,i)},has(r,n){return e??(e=t()),Reflect.has(e,n)},deleteProperty(r,n){return e??(e=t()),Reflect.deleteProperty(e,n)},ownKeys(r){return e??(e=t()),Reflect.ownKeys(e)},getOwnPropertyDescriptor(r,n){return e??(e=t()),Reflect.getOwnPropertyDescriptor(e,n)},defineProperty(r,n,o){return e??(e=t()),Reflect.defineProperty(e,n,o)}})}function Ga(t){return typeof t=="bigint"?t.toString()+"n":typeof t=="string"?`"${t}"`:`${t}`}function ll(t){return Object.keys(t).filter(e=>t[e]._zod.optin==="optional"&&t[e]._zod.optout==="optional")}var fl={safeint:[Number.MIN_SAFE_INTEGER,Number.MAX_SAFE_INTEGER],int32:[-2147483648,2147483647],uint32:[0,4294967295],float32:[-34028234663852886e22,34028234663852886e22],float64:[-Number.MAX_VALUE,Number.MAX_VALUE]},cv={int64:[BigInt("-9223372036854775808"),BigInt("9223372036854775807")],uint64:[BigInt(0),BigInt("18446744073709551615")]};function lI(t,e){let r=t._zod.def,n=r.checks;if(n&&n.length>0)throw new Error(".pick() cannot be used on object schemas containing refinements");let i=cr(t._zod.def,{get shape(){let s={};for(let a in e){if(!(a in r.shape))throw new Error(`Unrecognized key: "${a}"`);e[a]&&(s[a]=r.shape[a])}return jr(this,"shape",s),s},checks:[]});return yt(t,i)}function fI(t,e){let r=t._zod.def,n=r.checks;if(n&&n.length>0)throw new Error(".omit() cannot be used on object schemas containing refinements");let i=cr(t._zod.def,{get shape(){let s={...t._zod.def.shape};for(let a in e){if(!(a in r.shape))throw new Error(`Unrecognized key: "${a}"`);e[a]&&delete s[a]}return jr(this,"shape",s),s},checks:[]});return yt(t,i)}function pI(t,e){if(!Fr(e))throw new Error("Invalid input to extend: expected a plain object");let r=t._zod.def.checks;if(r&&r.length>0){let i=t._zod.def.shape;for(let s in e)if(Object.getOwnPropertyDescriptor(i,s)!==void 0)throw new Error("Cannot overwrite keys on object schemas containing refinements. Use `.safeExtend()` instead.")}let o=cr(t._zod.def,{get shape(){let i={...t._zod.def.shape,...e};return jr(this,"shape",i),i}});return yt(t,o)}function hI(t,e){if(!Fr(e))throw new Error("Invalid input to safeExtend: expected a plain object");let r=cr(t._zod.def,{get shape(){let n={...t._zod.def.shape,...e};return jr(this,"shape",n),n}});return yt(t,r)}function mI(t,e){if(t._zod.def.checks?.length)throw new Error(".merge() cannot be used on object schemas containing refinements. Use .safeExtend() instead.");let r=cr(t._zod.def,{get shape(){let n={...t._zod.def.shape,...e._zod.def.shape};return jr(this,"shape",n),n},get catchall(){return e._zod.def.catchall},checks:e._zod.def.checks??[]});return yt(t,r)}function gI(t,e,r){let o=e._zod.def.checks;if(o&&o.length>0)throw new Error(".partial() cannot be used on object schemas containing refinements");let s=cr(e._zod.def,{get shape(){let a=e._zod.def.shape,c={...a};if(r)for(let u in r){if(!(u in a))throw new Error(`Unrecognized key: "${u}"`);r[u]&&(c[u]=t?new t({type:"optional",innerType:a[u]}):a[u])}else for(let u in a)c[u]=t?new t({type:"optional",innerType:a[u]}):a[u];return jr(this,"shape",c),c},checks:[]});return yt(e,s)}function yI(t,e,r){let n=cr(e._zod.def,{get shape(){let o=e._zod.def.shape,i={...o};if(r)for(let s in r){if(!(s in i))throw new Error(`Unrecognized key: "${s}"`);r[s]&&(i[s]=new t({type:"nonoptional",innerType:o[s]}))}else for(let s in o)i[s]=new t({type:"nonoptional",innerType:o[s]});return jr(this,"shape",i),i}});return yt(e,n)}function Ur(t,e=0){if(t.aborted===!0)return!0;for(let r=e;r<t.issues.length;r++)if(t.issues[r]?.continue!==!0)return!0;return!1}function pl(t,e=0){if(t.aborted===!0)return!0;for(let r=e;r<t.issues.length;r++)if(t.issues[r]?.continue===!1)return!0;return!1}function dr(t,e){return e.map(r=>{var n;return(n=r).path??(n.path=[]),r.path.unshift(t),r})}function Ii(t){return typeof t=="string"?t:t?.message}function vt(t,e,r){let n=t.message?t.message:Ii(t.inst?._zod.def?.error?.(t))??Ii(e?.error?.(t))??Ii(r.customError?.(t))??Ii(r.localeError?.(t))??"Invalid input",{inst:o,continue:i,input:s,...a}=t;return a.path??(a.path=[]),a.message=n,e?.reportInput&&(a.input=s),a}function uv(t){return t instanceof Set?"set":t instanceof Map?"map":t instanceof File?"file":"unknown"}function Di(t){return Array.isArray(t)?"array":typeof t=="string"?"string":"unknown"}function hl(t){let e=typeof t;switch(e){case"number":return Number.isNaN(t)?"nan":"number";case"object":{if(t===null)return"null";if(Array.isArray(t))return"array";let r=t;if(r&&Object.getPrototypeOf(r)!==Object.prototype&&"constructor"in r&&r.constructor)return r.constructor.name}}return e}function yo(...t){let[e,r,n]=t;return typeof e=="string"?{message:e,code:"custom",input:r,inst:n}:{...e}}function vI(t){return Object.entries(t).filter(([e,r])=>Number.isNaN(Number.parseInt(e,10))).map(e=>e[1])}function dv(t){let e=atob(t),r=new Uint8Array(e.length);for(let n=0;n<e.length;n++)r[n]=e.charCodeAt(n);return r}function lv(t){let e="";for(let r=0;r<t.length;r++)e+=String.fromCharCode(t[r]);return btoa(e)}function _I(t){let e=t.replace(/-/g,"+").replace(/_/g,"/"),r="=".repeat((4-e.length%4)%4);return dv(e+r)}function SI(t){return lv(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function wI(t){let e=t.replace(/^0x/,"");if(e.length%2!==0)throw new Error("Invalid hex string length");let r=new Uint8Array(e.length/2);for(let n=0;n<e.length;n+=2)r[n/2]=Number.parseInt(e.slice(n,n+2),16);return r}function bI(t){return Array.from(t).map(e=>e.toString(16).padStart(2,"0")).join("")}var sl=class{constructor(...e){}};var fv=(t,e)=>{t.name="$ZodError",Object.defineProperty(t,"_zod",{value:t._zod,enumerable:!1}),Object.defineProperty(t,"issues",{value:e,enumerable:!1}),t.message=JSON.stringify(e,mo,2),Object.defineProperty(t,"toString",{value:()=>t.message,enumerable:!1})},Za=S("$ZodError",fv),ml=S("$ZodError",fv,{Parent:Error});function gl(t,e=r=>r.message){let r={},n=[];for(let o of t.issues)o.path.length>0?(r[o.path[0]]=r[o.path[0]]||[],r[o.path[0]].push(e(o))):n.push(e(o));return{formErrors:n,fieldErrors:r}}function yl(t,e=r=>r.message){let r={_errors:[]},n=(o,i=[])=>{for(let s of o.issues)if(s.code==="invalid_union"&&s.errors.length)s.errors.map(a=>n({issues:a},[...i,...s.path]));else if(s.code==="invalid_key")n({issues:s.issues},[...i,...s.path]);else if(s.code==="invalid_element")n({issues:s.issues},[...i,...s.path]);else{let a=[...i,...s.path];if(a.length===0)r._errors.push(e(s));else{let c=r,u=0;for(;u<a.length;){let d=a[u];u===a.length-1?(c[d]=c[d]||{_errors:[]},c[d]._errors.push(e(s))):c[d]=c[d]||{_errors:[]},c=c[d],u++}}}};return n(t),r}var Ba=t=>(e,r,n,o)=>{let i=n?{...n,async:!1}:{async:!1},s=e._zod.run({value:r,issues:[]},i);if(s instanceof Promise)throw new Jt;if(s.issues.length){let a=new(o?.Err??t)(s.issues.map(c=>vt(c,i,Qe())));throw Ha(a,o?.callee),a}return s.value};var Wa=t=>async(e,r,n,o)=>{let i=n?{...n,async:!0}:{async:!0},s=e._zod.run({value:r,issues:[]},i);if(s instanceof Promise&&(s=await s),s.issues.length){let a=new(o?.Err??t)(s.issues.map(c=>vt(c,i,Qe())));throw Ha(a,o?.callee),a}return s.value};var Li=t=>(e,r,n)=>{let o=n?{...n,async:!1}:{async:!1},i=e._zod.run({value:r,issues:[]},o);if(i instanceof Promise)throw new Jt;return i.issues.length?{success:!1,error:new(t??Za)(i.issues.map(s=>vt(s,o,Qe())))}:{success:!0,data:i.value}},ji=Li(ml),Fi=t=>async(e,r,n)=>{let o=n?{...n,async:!0}:{async:!0},i=e._zod.run({value:r,issues:[]},o);return i instanceof Promise&&(i=await i),i.issues.length?{success:!1,error:new t(i.issues.map(s=>vt(s,o,Qe())))}:{success:!0,data:i.value}},Va=Fi(ml),pv=t=>(e,r,n)=>{let o=n?{...n,direction:"backward"}:{direction:"backward"};return Ba(t)(e,r,o)};var hv=t=>(e,r,n)=>Ba(t)(e,r,n);var mv=t=>async(e,r,n)=>{let o=n?{...n,direction:"backward"}:{direction:"backward"};return Wa(t)(e,r,o)};var gv=t=>async(e,r,n)=>Wa(t)(e,r,n);var yv=t=>(e,r,n)=>{let o=n?{...n,direction:"backward"}:{direction:"backward"};return Li(t)(e,r,o)};var vv=t=>(e,r,n)=>Li(t)(e,r,n);var _v=t=>async(e,r,n)=>{let o=n?{...n,direction:"backward"}:{direction:"backward"};return Fi(t)(e,r,o)};var Sv=t=>async(e,r,n)=>Fi(t)(e,r,n);var wv=/^[cC][0-9a-z]{6,}$/,bv=/^[0-9a-z]+$/,Rv=/^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/,Cv=/^[0-9a-vA-V]{20}$/,Pv=/^[A-Za-z0-9]{27}$/,xv=/^[a-zA-Z0-9_-]{21}$/,kv=/^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/;var Ev=/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/,vl=t=>t?new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${t}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`):/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;var Tv=/^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;var CI="^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$";function Av(){return new RegExp(CI,"u")}var Mv=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,$v=/^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;var Iv=/^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/,Ov=/^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,zv=/^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/,_l=/^[A-Za-z0-9_-]*$/;var Nv=/^https?$/,Dv=/^\+[1-9]\d{6,14}$/,Lv="(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))",jv=new RegExp(`^${Lv}$`);function Fv(t){let e="(?:[01]\\d|2[0-3]):[0-5]\\d";return typeof t.precision=="number"?t.precision===-1?`${e}`:t.precision===0?`${e}:[0-5]\\d`:`${e}:[0-5]\\d\\.\\d{${t.precision}}`:`${e}(?::[0-5]\\d(?:\\.\\d+)?)?`}function Uv(t){return new RegExp(`^${Fv(t)}$`)}function qv(t){let e=Fv({precision:t.precision}),r=["Z"];t.local&&r.push(""),t.offset&&r.push("([+-](?:[01]\\d|2[0-3]):[0-5]\\d)");let n=`${e}(?:${r.join("|")})`;return new RegExp(`^${Lv}T(?:${n})$`)}var Hv=t=>{let e=t?`[\\s\\S]{${t?.minimum??0},${t?.maximum??""}}`:"[\\s\\S]*";return new RegExp(`^${e}$`)},Gv=/^-?\d+n?$/,Zv=/^-?\d+$/,Sl=/^-?\d+(?:\.\d+)?$/,Bv=/^(?:true|false)$/i,Wv=/^null$/i;var Vv=/^[^A-Z]*$/,Kv=/^[^a-z]*$/;var Oe=S("$ZodCheck",(t,e)=>{var r;t._zod??(t._zod={}),t._zod.def=e,(r=t._zod).onattach??(r.onattach=[])}),Jv={number:"number",bigint:"bigint",object:"date"},wl=S("$ZodCheckLessThan",(t,e)=>{Oe.init(t,e);let r=Jv[typeof e.value];t._zod.onattach.push(n=>{let o=n._zod.bag,i=(e.inclusive?o.maximum:o.exclusiveMaximum)??Number.POSITIVE_INFINITY;e.value<i&&(e.inclusive?o.maximum=e.value:o.exclusiveMaximum=e.value)}),t._zod.check=n=>{(e.inclusive?n.value<=e.value:n.value<e.value)||n.issues.push({origin:r,code:"too_big",maximum:typeof e.value=="object"?e.value.getTime():e.value,input:n.value,inclusive:e.inclusive,inst:t,continue:!e.abort})}}),bl=S("$ZodCheckGreaterThan",(t,e)=>{Oe.init(t,e);let r=Jv[typeof e.value];t._zod.onattach.push(n=>{let o=n._zod.bag,i=(e.inclusive?o.minimum:o.exclusiveMinimum)??Number.NEGATIVE_INFINITY;e.value>i&&(e.inclusive?o.minimum=e.value:o.exclusiveMinimum=e.value)}),t._zod.check=n=>{(e.inclusive?n.value>=e.value:n.value>e.value)||n.issues.push({origin:r,code:"too_small",minimum:typeof e.value=="object"?e.value.getTime():e.value,input:n.value,inclusive:e.inclusive,inst:t,continue:!e.abort})}}),Yv=S("$ZodCheckMultipleOf",(t,e)=>{Oe.init(t,e),t._zod.onattach.push(r=>{var n;(n=r._zod.bag).multipleOf??(n.multipleOf=e.value)}),t._zod.check=r=>{if(typeof r.value!=typeof e.value)throw new Error("Cannot mix number and bigint in multiple_of check.");(typeof r.value=="bigint"?r.value%e.value===BigInt(0):al(r.value,e.value)===0)||r.issues.push({origin:typeof r.value,code:"not_multiple_of",divisor:e.value,input:r.value,inst:t,continue:!e.abort})}}),Xv=S("$ZodCheckNumberFormat",(t,e)=>{Oe.init(t,e),e.format=e.format||"float64";let r=e.format?.includes("int"),n=r?"int":"number",[o,i]=fl[e.format];t._zod.onattach.push(s=>{let a=s._zod.bag;a.format=e.format,a.minimum=o,a.maximum=i,r&&(a.pattern=Zv)}),t._zod.check=s=>{let a=s.value;if(r){if(!Number.isInteger(a)){s.issues.push({expected:n,format:e.format,code:"invalid_type",continue:!1,input:a,inst:t});return}if(!Number.isSafeInteger(a)){a>0?s.issues.push({input:a,code:"too_big",maximum:Number.MAX_SAFE_INTEGER,note:"Integers must be within the safe integer range.",inst:t,origin:n,inclusive:!0,continue:!e.abort}):s.issues.push({input:a,code:"too_small",minimum:Number.MIN_SAFE_INTEGER,note:"Integers must be within the safe integer range.",inst:t,origin:n,inclusive:!0,continue:!e.abort});return}}a<o&&s.issues.push({origin:"number",input:a,code:"too_small",minimum:o,inclusive:!0,inst:t,continue:!e.abort}),a>i&&s.issues.push({origin:"number",input:a,code:"too_big",maximum:i,inclusive:!0,inst:t,continue:!e.abort})}});var Qv=S("$ZodCheckMaxLength",(t,e)=>{var r;Oe.init(t,e),(r=t._zod.def).when??(r.when=n=>{let o=n.value;return!zi(o)&&o.length!==void 0}),t._zod.onattach.push(n=>{let o=n._zod.bag.maximum??Number.POSITIVE_INFINITY;e.maximum<o&&(n._zod.bag.maximum=e.maximum)}),t._zod.check=n=>{let o=n.value;if(o.length<=e.maximum)return;let s=Di(o);n.issues.push({origin:s,code:"too_big",maximum:e.maximum,inclusive:!0,input:o,inst:t,continue:!e.abort})}}),e_=S("$ZodCheckMinLength",(t,e)=>{var r;Oe.init(t,e),(r=t._zod.def).when??(r.when=n=>{let o=n.value;return!zi(o)&&o.length!==void 0}),t._zod.onattach.push(n=>{let o=n._zod.bag.minimum??Number.NEGATIVE_INFINITY;e.minimum>o&&(n._zod.bag.minimum=e.minimum)}),t._zod.check=n=>{let o=n.value;if(o.length>=e.minimum)return;let s=Di(o);n.issues.push({origin:s,code:"too_small",minimum:e.minimum,inclusive:!0,input:o,inst:t,continue:!e.abort})}}),t_=S("$ZodCheckLengthEquals",(t,e)=>{var r;Oe.init(t,e),(r=t._zod.def).when??(r.when=n=>{let o=n.value;return!zi(o)&&o.length!==void 0}),t._zod.onattach.push(n=>{let o=n._zod.bag;o.minimum=e.length,o.maximum=e.length,o.length=e.length}),t._zod.check=n=>{let o=n.value,i=o.length;if(i===e.length)return;let s=Di(o),a=i>e.length;n.issues.push({origin:s,...a?{code:"too_big",maximum:e.length}:{code:"too_small",minimum:e.length},inclusive:!0,exact:!0,input:n.value,inst:t,continue:!e.abort})}}),qi=S("$ZodCheckStringFormat",(t,e)=>{var r,n;Oe.init(t,e),t._zod.onattach.push(o=>{let i=o._zod.bag;i.format=e.format,e.pattern&&(i.patterns??(i.patterns=new Set),i.patterns.add(e.pattern))}),e.pattern?(r=t._zod).check??(r.check=o=>{e.pattern.lastIndex=0,!e.pattern.test(o.value)&&o.issues.push({origin:"string",code:"invalid_format",format:e.format,input:o.value,...e.pattern?{pattern:e.pattern.toString()}:{},inst:t,continue:!e.abort})}):(n=t._zod).check??(n.check=()=>{})}),r_=S("$ZodCheckRegex",(t,e)=>{qi.init(t,e),t._zod.check=r=>{e.pattern.lastIndex=0,!e.pattern.test(r.value)&&r.issues.push({origin:"string",code:"invalid_format",format:"regex",input:r.value,pattern:e.pattern.toString(),inst:t,continue:!e.abort})}}),n_=S("$ZodCheckLowerCase",(t,e)=>{e.pattern??(e.pattern=Vv),qi.init(t,e)}),o_=S("$ZodCheckUpperCase",(t,e)=>{e.pattern??(e.pattern=Kv),qi.init(t,e)}),i_=S("$ZodCheckIncludes",(t,e)=>{Oe.init(t,e);let r=ur(e.includes),n=new RegExp(typeof e.position=="number"?`^.{${e.position}}${r}`:r);e.pattern=n,t._zod.onattach.push(o=>{let i=o._zod.bag;i.patterns??(i.patterns=new Set),i.patterns.add(n)}),t._zod.check=o=>{o.value.includes(e.includes,e.position)||o.issues.push({origin:"string",code:"invalid_format",format:"includes",includes:e.includes,input:o.value,inst:t,continue:!e.abort})}}),s_=S("$ZodCheckStartsWith",(t,e)=>{Oe.init(t,e);let r=new RegExp(`^${ur(e.prefix)}.*`);e.pattern??(e.pattern=r),t._zod.onattach.push(n=>{let o=n._zod.bag;o.patterns??(o.patterns=new Set),o.patterns.add(r)}),t._zod.check=n=>{n.value.startsWith(e.prefix)||n.issues.push({origin:"string",code:"invalid_format",format:"starts_with",prefix:e.prefix,input:n.value,inst:t,continue:!e.abort})}}),a_=S("$ZodCheckEndsWith",(t,e)=>{Oe.init(t,e);let r=new RegExp(`.*${ur(e.suffix)}$`);e.pattern??(e.pattern=r),t._zod.onattach.push(n=>{let o=n._zod.bag;o.patterns??(o.patterns=new Set),o.patterns.add(r)}),t._zod.check=n=>{n.value.endsWith(e.suffix)||n.issues.push({origin:"string",code:"invalid_format",format:"ends_with",suffix:e.suffix,input:n.value,inst:t,continue:!e.abort})}});var c_=S("$ZodCheckOverwrite",(t,e)=>{Oe.init(t,e),t._zod.check=r=>{r.value=e.tx(r.value)}});var Ka=class{constructor(e=[]){this.content=[],this.indent=0,this&&(this.args=e)}indented(e){this.indent+=1,e(this),this.indent-=1}write(e){if(typeof e=="function"){e(this,{execution:"sync"}),e(this,{execution:"async"});return}let n=e.split(`
 `).filter(s=>s),o=Math.min(...n.map(s=>s.length-s.trimStart().length)),i=n.map(s=>s.slice(o)).map(s=>" ".repeat(this.indent*2)+s);for(let s of i)this.content.push(s)}compile(){let e=Function,r=this?.args,o=[...(this?.content??[""]).map(i=>`  ${i}`)];return new e(...r,o.join(`
 `))}};var d_={major:4,minor:4,patch:3};var re=S("$ZodType",(t,e)=>{var r;t??(t={}),t._zod.def=e,t._zod.bag=t._zod.bag||{},t._zod.version=d_;let n=[...t._zod.def.checks??[]];t._zod.traits.has("$ZodCheck")&&n.unshift(t);for(let o of n)for(let i of o._zod.onattach)i(t);if(n.length===0)(r=t._zod).deferred??(r.deferred=[]),t._zod.deferred?.push(()=>{t._zod.run=t._zod.parse});else{let o=(s,a,c)=>{let u=Ur(s),d;for(let l of a){if(l._zod.def.when){if(pl(s)||!l._zod.def.when(s))continue}else if(u)continue;let f=s.issues.length,p=l._zod.check(s);if(p instanceof Promise&&c?.async===!1)throw new Jt;if(d||p instanceof Promise)d=(d??Promise.resolve()).then(async()=>{await p,s.issues.length!==f&&(u||(u=Ur(s,f)))});else{if(s.issues.length===f)continue;u||(u=Ur(s,f))}}return d?d.then(()=>s):s},i=(s,a,c)=>{if(Ur(s))return s.aborted=!0,s;let u=o(a,n,c);if(u instanceof Promise){if(c.async===!1)throw new Jt;return u.then(d=>t._zod.parse(d,c))}return t._zod.parse(u,c)};t._zod.run=(s,a)=>{if(a.skipChecks)return t._zod.parse(s,a);if(a.direction==="backward"){let u=t._zod.parse({value:s.value,issues:[]},{...a,skipChecks:!0});return u instanceof Promise?u.then(d=>i(d,s,a)):i(u,s,a)}let c=t._zod.parse(s,a);if(c instanceof Promise){if(a.async===!1)throw new Jt;return c.then(u=>o(u,n,a))}return o(c,n,a)}}Y(t,"~standard",()=>({validate:o=>{try{let i=ji(t,o);return i.success?{value:i.data}:{issues:i.error?.issues}}catch{return Va(t,o).then(s=>s.success?{value:s.data}:{issues:s.error?.issues})}},vendor:"zod",version:1}))}),Xa=S("$ZodString",(t,e)=>{re.init(t,e),t._zod.pattern=[...t?._zod.bag?.patterns??[]].pop()??Hv(t._zod.bag),t._zod.parse=(r,n)=>{if(e.coerce)try{r.value=String(r.value)}catch{}return typeof r.value=="string"||r.issues.push({expected:"string",code:"invalid_type",input:r.value,inst:t}),r}}),ce=S("$ZodStringFormat",(t,e)=>{qi.init(t,e),Xa.init(t,e)}),__=S("$ZodGUID",(t,e)=>{e.pattern??(e.pattern=Ev),ce.init(t,e)}),S_=S("$ZodUUID",(t,e)=>{if(e.version){let n={v1:1,v2:2,v3:3,v4:4,v5:5,v6:6,v7:7,v8:8}[e.version];if(n===void 0)throw new Error(`Invalid UUID version: "${e.version}"`);e.pattern??(e.pattern=vl(n))}else e.pattern??(e.pattern=vl());ce.init(t,e)}),w_=S("$ZodEmail",(t,e)=>{e.pattern??(e.pattern=Tv),ce.init(t,e)}),b_=S("$ZodURL",(t,e)=>{ce.init(t,e),t._zod.check=r=>{try{let n=r.value.trim();if(!e.normalize&&e.protocol?.source===Nv.source&&!/^https?:\/\//i.test(n)){r.issues.push({code:"invalid_format",format:"url",note:"Invalid URL format",input:r.value,inst:t,continue:!e.abort});return}let o=new URL(n);e.hostname&&(e.hostname.lastIndex=0,e.hostname.test(o.hostname)||r.issues.push({code:"invalid_format",format:"url",note:"Invalid hostname",pattern:e.hostname.source,input:r.value,inst:t,continue:!e.abort})),e.protocol&&(e.protocol.lastIndex=0,e.protocol.test(o.protocol.endsWith(":")?o.protocol.slice(0,-1):o.protocol)||r.issues.push({code:"invalid_format",format:"url",note:"Invalid protocol",pattern:e.protocol.source,input:r.value,inst:t,continue:!e.abort})),e.normalize?r.value=o.href:r.value=n;return}catch{r.issues.push({code:"invalid_format",format:"url",input:r.value,inst:t,continue:!e.abort})}}}),R_=S("$ZodEmoji",(t,e)=>{e.pattern??(e.pattern=Av()),ce.init(t,e)}),C_=S("$ZodNanoID",(t,e)=>{e.pattern??(e.pattern=xv),ce.init(t,e)}),P_=S("$ZodCUID",(t,e)=>{e.pattern??(e.pattern=wv),ce.init(t,e)}),x_=S("$ZodCUID2",(t,e)=>{e.pattern??(e.pattern=bv),ce.init(t,e)}),k_=S("$ZodULID",(t,e)=>{e.pattern??(e.pattern=Rv),ce.init(t,e)}),E_=S("$ZodXID",(t,e)=>{e.pattern??(e.pattern=Cv),ce.init(t,e)}),T_=S("$ZodKSUID",(t,e)=>{e.pattern??(e.pattern=Pv),ce.init(t,e)}),A_=S("$ZodISODateTime",(t,e)=>{e.pattern??(e.pattern=qv(e)),ce.init(t,e)}),M_=S("$ZodISODate",(t,e)=>{e.pattern??(e.pattern=jv),ce.init(t,e)}),$_=S("$ZodISOTime",(t,e)=>{e.pattern??(e.pattern=Uv(e)),ce.init(t,e)}),I_=S("$ZodISODuration",(t,e)=>{e.pattern??(e.pattern=kv),ce.init(t,e)}),O_=S("$ZodIPv4",(t,e)=>{e.pattern??(e.pattern=Mv),ce.init(t,e),t._zod.bag.format="ipv4"}),z_=S("$ZodIPv6",(t,e)=>{e.pattern??(e.pattern=$v),ce.init(t,e),t._zod.bag.format="ipv6",t._zod.check=r=>{try{new URL(`http://[${r.value}]`)}catch{r.issues.push({code:"invalid_format",format:"ipv6",input:r.value,inst:t,continue:!e.abort})}}});var N_=S("$ZodCIDRv4",(t,e)=>{e.pattern??(e.pattern=Iv),ce.init(t,e)}),D_=S("$ZodCIDRv6",(t,e)=>{e.pattern??(e.pattern=Ov),ce.init(t,e),t._zod.check=r=>{let n=r.value.split("/");try{if(n.length!==2)throw new Error;let[o,i]=n;if(!i)throw new Error;let s=Number(i);if(`${s}`!==i)throw new Error;if(s<0||s>128)throw new Error;new URL(`http://[${o}]`)}catch{r.issues.push({code:"invalid_format",format:"cidrv6",input:r.value,inst:t,continue:!e.abort})}}});function L_(t){if(t==="")return!0;if(/\s/.test(t)||t.length%4!==0)return!1;try{return atob(t),!0}catch{return!1}}var j_=S("$ZodBase64",(t,e)=>{e.pattern??(e.pattern=zv),ce.init(t,e),t._zod.bag.contentEncoding="base64",t._zod.check=r=>{L_(r.value)||r.issues.push({code:"invalid_format",format:"base64",input:r.value,inst:t,continue:!e.abort})}});function kI(t){if(!_l.test(t))return!1;let e=t.replace(/[-_]/g,n=>n==="-"?"+":"/"),r=e.padEnd(Math.ceil(e.length/4)*4,"=");return L_(r)}var F_=S("$ZodBase64URL",(t,e)=>{e.pattern??(e.pattern=_l),ce.init(t,e),t._zod.bag.contentEncoding="base64url",t._zod.check=r=>{kI(r.value)||r.issues.push({code:"invalid_format",format:"base64url",input:r.value,inst:t,continue:!e.abort})}}),U_=S("$ZodE164",(t,e)=>{e.pattern??(e.pattern=Dv),ce.init(t,e)});function EI(t,e=null){try{let r=t.split(".");if(r.length!==3)return!1;let[n]=r;if(!n)return!1;let o=JSON.parse(atob(n));return!("typ"in o&&o?.typ!=="JWT"||!o.alg||e&&(!("alg"in o)||o.alg!==e))}catch{return!1}}var q_=S("$ZodJWT",(t,e)=>{ce.init(t,e),t._zod.check=r=>{EI(r.value,e.alg)||r.issues.push({code:"invalid_format",format:"jwt",input:r.value,inst:t,continue:!e.abort})}});var Cl=S("$ZodNumber",(t,e)=>{re.init(t,e),t._zod.pattern=t._zod.bag.pattern??Sl,t._zod.parse=(r,n)=>{if(e.coerce)try{r.value=Number(r.value)}catch{}let o=r.value;if(typeof o=="number"&&!Number.isNaN(o)&&Number.isFinite(o))return r;let i=typeof o=="number"?Number.isNaN(o)?"NaN":Number.isFinite(o)?void 0:"Infinity":void 0;return r.issues.push({expected:"number",code:"invalid_type",input:o,inst:t,...i?{received:i}:{}}),r}}),H_=S("$ZodNumberFormat",(t,e)=>{Xv.init(t,e),Cl.init(t,e)}),G_=S("$ZodBoolean",(t,e)=>{re.init(t,e),t._zod.pattern=Bv,t._zod.parse=(r,n)=>{if(e.coerce)try{r.value=!!r.value}catch{}let o=r.value;return typeof o=="boolean"||r.issues.push({expected:"boolean",code:"invalid_type",input:o,inst:t}),r}}),Z_=S("$ZodBigInt",(t,e)=>{re.init(t,e),t._zod.pattern=Gv,t._zod.parse=(r,n)=>{if(e.coerce)try{r.value=BigInt(r.value)}catch{}return typeof r.value=="bigint"||r.issues.push({expected:"bigint",code:"invalid_type",input:r.value,inst:t}),r}});var B_=S("$ZodNull",(t,e)=>{re.init(t,e),t._zod.pattern=Wv,t._zod.values=new Set([null]),t._zod.parse=(r,n)=>{let o=r.value;return o===null||r.issues.push({expected:"null",code:"invalid_type",input:o,inst:t}),r}}),W_=S("$ZodAny",(t,e)=>{re.init(t,e),t._zod.parse=r=>r}),V_=S("$ZodUnknown",(t,e)=>{re.init(t,e),t._zod.parse=r=>r}),K_=S("$ZodNever",(t,e)=>{re.init(t,e),t._zod.parse=(r,n)=>(r.issues.push({expected:"never",code:"invalid_type",input:r.value,inst:t}),r)});var J_=S("$ZodDate",(t,e)=>{re.init(t,e),t._zod.parse=(r,n)=>{if(e.coerce)try{r.value=new Date(r.value)}catch{}let o=r.value,i=o instanceof Date;return i&&!Number.isNaN(o.getTime())||r.issues.push({expected:"date",code:"invalid_type",input:o,...i?{received:"Invalid Date"}:{},inst:t}),r}});function l_(t,e,r){t.issues.length&&e.issues.push(...dr(r,t.issues)),e.value[r]=t.value}var Y_=S("$ZodArray",(t,e)=>{re.init(t,e),t._zod.parse=(r,n)=>{let o=r.value;if(!Array.isArray(o))return r.issues.push({expected:"array",code:"invalid_type",input:o,inst:t}),r;r.value=Array(o.length);let i=[];for(let s=0;s<o.length;s++){let a=o[s],c=e.element._zod.run({value:a,issues:[]},n);c instanceof Promise?i.push(c.then(u=>l_(u,r,s))):l_(c,r,s)}return i.length?Promise.all(i).then(()=>r):r}});function Ya(t,e,r,n,o,i){let s=r in n;if(t.issues.length){if(o&&i&&!s)return;e.issues.push(...dr(r,t.issues))}if(!s&&!o){t.issues.length||e.issues.push({code:"invalid_type",expected:"nonoptional",input:void 0,path:[r]});return}t.value===void 0?s&&(e.value[r]=void 0):e.value[r]=t.value}function X_(t){let e=Object.keys(t.shape);for(let n of e)if(!t.shape?.[n]?._zod?.traits?.has("$ZodType"))throw new Error(`Invalid element at key "${n}": expected a Zod schema`);let r=ll(t.shape);return{...t,keys:e,keySet:new Set(e),numKeys:e.length,optionalKeys:new Set(r)}}function Q_(t,e,r,n,o,i){let s=[],a=o.keySet,c=o.catchall._zod,u=c.def.type,d=c.optin==="optional",l=c.optout==="optional";for(let f in e){if(f==="__proto__"||a.has(f))continue;if(u==="never"){s.push(f);continue}let p=c.run({value:e[f],issues:[]},n);p instanceof Promise?t.push(p.then(h=>Ya(h,r,f,e,d,l))):Ya(p,r,f,e,d,l)}return s.length&&r.issues.push({code:"unrecognized_keys",keys:s,input:e,inst:i}),t.length?Promise.all(t).then(()=>r):r}var TI=S("$ZodObject",(t,e)=>{if(re.init(t,e),!Object.getOwnPropertyDescriptor(e,"shape")?.get){let a=e.shape;Object.defineProperty(e,"shape",{get:()=>{let c={...a};return Object.defineProperty(e,"shape",{value:c}),c}})}let n=go(()=>X_(e));Y(t._zod,"propValues",()=>{let a=e.shape,c={};for(let u in a){let d=a[u]._zod;if(d.values){c[u]??(c[u]=new Set);for(let l of d.values)c[u].add(l)}}return c});let o=Sn,i=e.catchall,s;t._zod.parse=(a,c)=>{s??(s=n.value);let u=a.value;if(!o(u))return a.issues.push({expected:"object",code:"invalid_type",input:u,inst:t}),a;a.value={};let d=[],l=s.shape;for(let f of s.keys){let p=l[f],h=p._zod.optin==="optional",m=p._zod.optout==="optional",g=p._zod.run({value:u[f],issues:[]},c);g instanceof Promise?d.push(g.then(v=>Ya(v,a,f,u,h,m))):Ya(g,a,f,u,h,m)}return i?Q_(d,u,a,c,n.value,t):d.length?Promise.all(d).then(()=>a):a}}),eS=S("$ZodObjectJIT",(t,e)=>{TI.init(t,e);let r=t._zod.parse,n=go(()=>X_(e)),o=f=>{let p=new Ka(["shape","payload","ctx"]),h=n.value,m=b=>{let R=qa(b);return`shape[${R}]._zod.run({ value: input[${R}], issues: [] }, ctx)`};p.write("const input = payload.value;");let g=Object.create(null),v=0;for(let b of h.keys)g[b]=`key_${v++}`;p.write("const newResult = {};");for(let b of h.keys){let R=g[b],_=qa(b),C=f[b],I=C?._zod?.optin==="optional",Q=C?._zod?.optout==="optional";p.write(`const ${R} = ${m(b)};`),I&&Q?p.write(`
         if (${R}.issues.length) {