@clipform/mcp-server 4.0.0 → 4.1.0

package/dist/{chunk-MSLK3FRO.js → chunk-5A66GD3U.js}

@@ -29,7 +29,7 @@ import {
   union,
   unknown,
   url
-} from "./chunk-54RZGUSA.js";
+} from "./chunk-5RUWQOYD.js";
 import {
   GUIDE_TYPES,
   QUIZ_VARIANTS,
@@ -38,13 +38,13 @@ import {
   getGuideUri,
   guideFallbackText,
   registerResources
-} from "./chunk-5MJGBBKA.js";
+} from "./chunk-TXUWAYBZ.js";
 import {
   ANON_PREVIEW_NOTICE,
   FULL_CAPS,
   anonPreviewNotice,
   capsFromToolsets
-} from "./chunk-S6RYUVDM.js";
+} from "./chunk-PDI6VJYQ.js";
 import {
   ACTIVE_NODE_TYPES,
   CONTACT_FIELDS,
@@ -66,7 +66,7 @@ import {
   resolveFormType,
   structuredResult,
   textResult
-} from "./chunk-JRASOR5T.js";
+} from "./chunk-4IAURGG7.js";
 import {
   getMcpAuth,
   runWithMcpAuth,
@@ -132,6 +132,7 @@ function declaredDialect(schema, remedy) {
 
 // ../../node_modules/.pnpm/@modelcontextprotocol+core@2.3.1/node_modules/@modelcontextprotocol/core/dist/auth-BNDyLTqp.mjs
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
+var DEFAULT_NEGOTIATED_PROTOCOL_VERSION = "2025-03-26";
 var SUPPORTED_PROTOCOL_VERSIONS = [
   LATEST_PROTOCOL_VERSION,
   "2025-06-18",
@@ -1098,6 +1099,29 @@ function brandedHasInstance(cls, value) {
   }
   return Function.prototype[Symbol.hasInstance].call(cls, value);
 }
+var OAuthErrorCode = /* @__PURE__ */ (function(OAuthErrorCode$1) {
+  OAuthErrorCode$1["InvalidRequest"] = "invalid_request";
+  OAuthErrorCode$1["InvalidClient"] = "invalid_client";
+  OAuthErrorCode$1["InvalidGrant"] = "invalid_grant";
+  OAuthErrorCode$1["UnauthorizedClient"] = "unauthorized_client";
+  OAuthErrorCode$1["UnsupportedGrantType"] = "unsupported_grant_type";
+  OAuthErrorCode$1["InvalidScope"] = "invalid_scope";
+  OAuthErrorCode$1["AccessDenied"] = "access_denied";
+  OAuthErrorCode$1["ServerError"] = "server_error";
+  OAuthErrorCode$1["TemporarilyUnavailable"] = "temporarily_unavailable";
+  OAuthErrorCode$1["UnsupportedResponseType"] = "unsupported_response_type";
+  OAuthErrorCode$1["UnsupportedTokenType"] = "unsupported_token_type";
+  OAuthErrorCode$1["InvalidToken"] = "invalid_token";
+  OAuthErrorCode$1["MethodNotAllowed"] = "method_not_allowed";
+  OAuthErrorCode$1["TooManyRequests"] = "too_many_requests";
+  OAuthErrorCode$1["InvalidClientMetadata"] = "invalid_client_metadata";
+  OAuthErrorCode$1["InvalidRedirectUri"] = "invalid_redirect_uri";
+  OAuthErrorCode$1["InsufficientScope"] = "insufficient_scope";
+  OAuthErrorCode$1["InvalidTarget"] = "invalid_target";
+  OAuthErrorCode$1["InvalidDpopProof"] = "invalid_dpop_proof";
+  OAuthErrorCode$1["UseDpopNonce"] = "use_dpop_nonce";
+  return OAuthErrorCode$1;
+})({});
 var OAuthError = class OAuthError2 extends Error {
   static {
     Object.defineProperty(this, "mcpBrand", { value: "mcp.OAuthError" });
@@ -1221,6 +1245,10 @@ var SdkHttpError = class extends SdkError {
     return this.data.statusText;
   }
 };
+var REQUIRED_CLIENT_CAPABILITIES_BY_METHOD = {};
+function requiredClientCapabilitiesForRequest(method) {
+  return Object.hasOwn(REQUIRED_CLIENT_CAPABILITIES_BY_METHOD, method) ? REQUIRED_CLIENT_CAPABILITIES_BY_METHOD[method] : void 0;
+}
 function isPlainObject$7(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -1261,6 +1289,7 @@ function missingClientCapabilities(required, declared) {
   return Object.keys(missing).length > 0 ? missing : void 0;
 }
 var FIRST_MODERN_PROTOCOL_VERSION = "2026-07-28";
+var SUPPORTED_MODERN_PROTOCOL_VERSIONS = [FIRST_MODERN_PROTOCOL_VERSION];
 function isModernProtocolVersion(version) {
   return version >= FIRST_MODERN_PROTOCOL_VERSION;
 }
@@ -3826,6 +3855,25 @@ function isExtensionReusedRequestMethod(method) {
   return method === "tasks/get" || method === "tasks/cancel";
 }
 var ALL_CODECS = [rev2025Codec, rev2026Codec];
+function isPlainObject$3(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function requestMetaOf(params) {
+  if (!isPlainObject$3(params)) return void 0;
+  const meta = params["_meta"];
+  return isPlainObject$3(meta) ? meta : void 0;
+}
+function hasEnvelopeClaim(params) {
+  const meta = requestMetaOf(params);
+  return meta !== void 0 && PROTOCOL_VERSION_META_KEY in meta;
+}
+function envelopeClaimVersion(params) {
+  const value = requestMetaOf(params)?.[PROTOCOL_VERSION_META_KEY];
+  return typeof value === "string" ? value : void 0;
+}
+function validateEnvelopeMeta(meta) {
+  return codecForVersion(MODERN_WIRE_REVISION).validateEnvelopeMeta(meta);
+}
 var schemas_exports = /* @__PURE__ */ __exportAll({
   AnnotationsSchema: () => AnnotationsSchema,
   AudioContentSchema: () => AudioContentSchema,
@@ -3999,12 +4047,14 @@ var isJSONRPCNotification = (value) => JSONRPCNotificationSchema.safeParse(value
 var isJSONRPCResultResponse = (value) => JSONRPCResultResponseSchema.safeParse(value).success;
 var isJSONRPCErrorResponse = (value) => JSONRPCErrorResponseSchema.safeParse(value).success;
 var isInputRequiredResult = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && value.resultType === "input_required";
+var isInitializeRequest = (value) => InitializeRequestSchema.safeParse(value).success;
 function assertCompleteRequestPrompt(request) {
   if (request.params.ref.type !== "ref/prompt") throw new TypeError(`Expected CompleteRequestPrompt, but got ${request.params.ref.type}`);
 }
 function assertCompleteRequestResourceTemplate(request) {
   if (request.params.ref.type !== "ref/resource") throw new TypeError(`Expected CompleteRequestResourceTemplate, but got ${request.params.ref.type}`);
 }
+var MCP_PARAM_HEADER_PREFIX = "Mcp-Param-";
 var X_MCP_HEADER_KEY = "x-mcp-header";
 var RFC9110_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
 var PERMITTED_X_MCP_HEADER_TYPES = /* @__PURE__ */ new Set([
@@ -4089,6 +4139,72 @@ var OBJECT_VALUED_SUBSCHEMA_KEYWORDS = /* @__PURE__ */ new Set([
 function pathName(path) {
   return path.length === 0 ? "<root>" : path.join(".");
 }
+var BASE64_SENTINEL_PREFIX = "=?base64?";
+var BASE64_SENTINEL_SUFFIX = "?=";
+var BASE64_CANONICAL = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+var CANONICAL_DECIMAL = /^-?\d+(\.\d+)?$/;
+function mcpParamPrimitiveToString(value) {
+  if (typeof value === "string") return value;
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) return void 0;
+    if (Number.isInteger(value) && !Number.isSafeInteger(value)) return void 0;
+    return String(value);
+  }
+}
+function base64ToUtf8(b64) {
+  const bin = atob(b64);
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.codePointAt(i);
+  return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+}
+function decodeMcpParamValue(value) {
+  if (!(value.startsWith(BASE64_SENTINEL_PREFIX) && value.endsWith(BASE64_SENTINEL_SUFFIX))) return value;
+  const b64 = value.slice(9, value.length - 2);
+  if (!BASE64_CANONICAL.test(b64)) return void 0;
+  try {
+    return base64ToUtf8(b64);
+  } catch {
+    return;
+  }
+}
+function valueAtPath(root, path) {
+  let node = root;
+  for (const key of path) {
+    if (node === null || typeof node !== "object") return void 0;
+    node = node[key];
+  }
+  return node;
+}
+function validateMcpParamHeaders(declarations, args, headers) {
+  for (const decl of declarations) {
+    const headerKey = `${MCP_PARAM_HEADER_PREFIX}${decl.headerName}`;
+    const headerValue = headers.get(headerKey);
+    const bodyRaw = valueAtPath(args, decl.path);
+    if (bodyRaw === void 0 || bodyRaw === null) continue;
+    const bodyString = mcpParamPrimitiveToString(bodyRaw);
+    if (bodyString === void 0) continue;
+    if (headerValue === null) return paramHeaderMismatchRejection("param-header-missing", headerKey, `the body carries ${pathName(decl.path)}=${JSON.stringify(bodyRaw)} but the ${headerKey} header is absent`);
+    const decoded = decodeMcpParamValue(headerValue);
+    if (decoded === void 0) return paramHeaderMismatchRejection("param-header-invalid-encoding", headerKey, `the ${headerKey} header carries an invalid Base64 sentinel value`);
+    if (!((decl.type === "integer" || decl.type === "number") && CANONICAL_DECIMAL.test(decoded) && typeof bodyRaw === "number" ? Number(decoded) === bodyRaw : decoded === bodyString)) return paramHeaderMismatchRejection("param-header-mismatch", headerKey, `the ${headerKey} header decodes to ${JSON.stringify(decoded)} but the body carries ${pathName(decl.path)}=${JSON.stringify(bodyRaw)}`);
+  }
+}
+function paramHeaderMismatchRejection(cell, header, body) {
+  return {
+    kind: "reject",
+    rung: "param-header-validation",
+    cell,
+    httpStatus: 400,
+    code: HEADER_MISMATCH_ERROR_CODE,
+    message: `Bad Request: the request headers and body disagree: ${body}`,
+    data: { mismatch: {
+      header,
+      body
+    } },
+    settled: true
+  };
+}
 var HEADER_MISMATCH_ERROR_CODE = -32020;
 var INBOUND_VALIDATION_LADDER = [
   {
@@ -4176,6 +4292,232 @@ var LADDER_ERROR_HTTP_STATUS = {
   [ProtocolErrorCode.MissingRequiredClientCapability]: 400,
   [HEADER_MISMATCH_ERROR_CODE]: 400
 };
+function httpStatusForErrorCode(code, origin) {
+  if (origin === "in-band") return code === ProtocolErrorCode.MissingRequiredClientCapability ? 400 : 200;
+  return LADDER_ERROR_HTTP_STATUS[code] ?? 400;
+}
+function rejection(rung, cell, httpStatus, error, settled) {
+  return {
+    kind: "reject",
+    rung,
+    cell,
+    httpStatus,
+    code: error.code,
+    message: error.message,
+    ...error.data !== void 0 && { data: error.data },
+    settled
+  };
+}
+function crossCheckMismatch(cell, header, body, rung = "era-classification") {
+  return rejection(rung, cell, 400, new ProtocolError(HEADER_MISMATCH_ERROR_CODE, `Bad Request: the request headers and body disagree: ${body}`, { mismatch: {
+    header,
+    body
+  } }), true);
+}
+var MCP_NAME_HEADER_SOURCE = {
+  "tools/call": "name",
+  "prompts/get": "name",
+  "resources/read": "uri",
+  "tasks/get": "taskId",
+  "tasks/update": "taskId",
+  "tasks/cancel": "taskId"
+};
+function mcpNameSource(method, params) {
+  const field = Object.hasOwn(MCP_NAME_HEADER_SOURCE, method) ? MCP_NAME_HEADER_SOURCE[method] : void 0;
+  if (field === void 0) return;
+  const raw = isPlainObject$2(params) ? params[field] : void 0;
+  return {
+    field,
+    value: typeof raw === "string" ? raw : void 0
+  };
+}
+function stripHttpOws(value) {
+  let start = 0;
+  while (start < value.length) {
+    const code = value.codePointAt(start);
+    if (code !== 9 && code !== 32) break;
+    start += 1;
+  }
+  let end = value.length;
+  while (end > start) {
+    const code = value.codePointAt(end - 1);
+    if (code !== 9 && code !== 32) break;
+    end -= 1;
+  }
+  return start === 0 && end === value.length ? value : value.slice(start, end);
+}
+function validateStandardRequestHeaders(request, route) {
+  if (route.messageKind !== "request") return;
+  const method = route.message.method;
+  if (request.protocolVersionHeader === void 0) {
+    const claimed = route.classification.revision;
+    return crossCheckMismatch("version-header-missing", "(missing)", claimed === void 0 ? "the body carries a modern per-request envelope but the required MCP-Protocol-Version header is absent" : `the body envelope names protocol version ${claimed} but the required MCP-Protocol-Version header is absent`, "standard-header-validation");
+  }
+  if (request.mcpMethodHeader === void 0) return crossCheckMismatch("method-header-missing", "(missing)", `the body names method ${method} but the required Mcp-Method header is absent`, "standard-header-validation");
+  const source = mcpNameSource(method, route.message.params);
+  if (source === void 0) return;
+  const { field: sourceField, value: bodyValue } = source;
+  if (request.mcpNameHeader === void 0) {
+    if (bodyValue === void 0) return;
+    return crossCheckMismatch("name-header-missing", "(missing)", `the body carries params.${sourceField}="${bodyValue}" but the required Mcp-Name header is absent`, "standard-header-validation");
+  }
+  const normalizedNameHeader = stripHttpOws(request.mcpNameHeader);
+  const decoded = decodeMcpParamValue(normalizedNameHeader);
+  if (decoded === void 0) return crossCheckMismatch("name-header-invalid-encoding", normalizedNameHeader, "the Mcp-Name header carries an invalid Base64 sentinel value", "standard-header-validation");
+  if (bodyValue !== void 0 && decoded !== bodyValue) return crossCheckMismatch("name-header-mismatch", normalizedNameHeader, `the body carries params.${sourceField}="${bodyValue}" but the Mcp-Name header names "${decoded}"`, "standard-header-validation");
+}
+function isPlainObject$2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function classificationForClaim(claimedVersion) {
+  if (claimedVersion === void 0) return { era: "modern" };
+  return {
+    era: isModernProtocolVersion(claimedVersion) ? "modern" : "legacy",
+    revision: claimedVersion
+  };
+}
+function carriesValidModernEnvelopeClaim(params) {
+  if (!hasEnvelopeClaim(params)) return false;
+  const claimedVersion = envelopeClaimVersion(params);
+  if (claimedVersion === void 0 || !isModernProtocolVersion(claimedVersion)) return false;
+  const meta = requestMetaOf(params);
+  return meta !== void 0 && validateEnvelopeMeta(meta).length === 0;
+}
+function classifyBatch(body) {
+  if (body.length === 0) return rejection("jsonrpc-shape", "empty-batch", 400, new ProtocolError(ProtocolErrorCode.InvalidRequest, "Bad Request: empty JSON-RPC batch"), true);
+  for (const element of body) {
+    if (hasEnvelopeClaim(isPlainObject$2(element) ? element["params"] : void 0)) return rejection("jsonrpc-shape", "batch-with-modern-element", 400, new ProtocolError(ProtocolErrorCode.InvalidRequest, "Bad Request: JSON-RPC batches may not contain requests for protocol revision 2026-07-28 or later"), true);
+    if (!(isJSONRPCRequest(element) || isJSONRPCNotification(element) || isJSONRPCResultResponse(element) || isJSONRPCErrorResponse(element))) return rejection("jsonrpc-shape", "batch-with-invalid-element", 400, new ProtocolError(ProtocolErrorCode.InvalidRequest, "Bad Request: JSON-RPC batch contains an invalid message"), true);
+  }
+  return {
+    kind: "legacy",
+    reason: "batch"
+  };
+}
+function classifyRequestBody(request, body) {
+  const params = body.params;
+  const method = body.method;
+  const headerVersion = request.protocolVersionHeader;
+  const headerNamesModern = headerVersion !== void 0 && isModernProtocolVersion(headerVersion);
+  if (method === "initialize" && !carriesValidModernEnvelopeClaim(params)) {
+    if (headerNamesModern) return crossCheckMismatch("initialize-with-modern-header", headerVersion, "an initialize request (legacy handshake) was sent with a modern MCP-Protocol-Version header");
+    const requestedVersion = isPlainObject$2(params) && typeof params["protocolVersion"] === "string" ? params["protocolVersion"] : void 0;
+    return {
+      kind: "legacy",
+      reason: "initialize",
+      ...requestedVersion !== void 0 && { requestedVersion }
+    };
+  }
+  if (hasEnvelopeClaim(params)) {
+    const meta = requestMetaOf(params);
+    const firstIssue = (meta === void 0 ? [] : validateEnvelopeMeta(meta))[0];
+    if (firstIssue !== void 0) return rejection("envelope", "envelope-invalid", 400, new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid _meta envelope for protocol revision 2026-07-28: ${firstIssue.key}: ${firstIssue.problem}`, { envelope: firstIssue }), true);
+    const claimedVersion = envelopeClaimVersion(params);
+    if (headerVersion !== void 0 && claimedVersion !== void 0 && headerVersion !== claimedVersion) return crossCheckMismatch("header-body-version-mismatch", headerVersion, `the body envelope names protocol version ${claimedVersion} but the MCP-Protocol-Version header names ${headerVersion}`);
+    if (request.mcpMethodHeader !== void 0 && request.mcpMethodHeader !== method) return crossCheckMismatch("method-header-mismatch", request.mcpMethodHeader, `the body names method ${method} but the Mcp-Method header names ${request.mcpMethodHeader}`);
+    return {
+      kind: "modern",
+      messageKind: "request",
+      message: body,
+      classification: classificationForClaim(claimedVersion)
+    };
+  }
+  if (headerNamesModern) {
+    const meta = requestMetaOf(params);
+    const missingFromEnvelope = validateEnvelopeMeta(meta ?? {}).filter((issue) => issue.problem === "missing").map((issue) => issue.key);
+    const missing = meta === void 0 ? ["_meta"] : missingFromEnvelope.length > 0 ? missingFromEnvelope : [PROTOCOL_VERSION_META_KEY];
+    return rejection("envelope", "modern-header-without-claim", 400, new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid params: the MCP-Protocol-Version header names protocol revision ${headerVersion}, but the request is missing the required per-request envelope key(s): ${missing.join(", ")}`, { envelope: { missing } }), true);
+  }
+  return {
+    kind: "legacy",
+    reason: "no-claim",
+    ...headerVersion !== void 0 && { requestedVersion: headerVersion }
+  };
+}
+function classifyNotificationBody(request, body) {
+  const params = body.params;
+  const method = body.method;
+  const headerVersion = request.protocolVersionHeader;
+  const headerNamesModern = headerVersion !== void 0 && isModernProtocolVersion(headerVersion);
+  if (hasEnvelopeClaim(params)) {
+    const claimedVersion = envelopeClaimVersion(params);
+    if (claimedVersion === void 0) {
+      const meta = requestMetaOf(params);
+      const claimIssue = (meta === void 0 ? [] : validateEnvelopeMeta(meta)).find((issue) => issue.key === PROTOCOL_VERSION_META_KEY) ?? {
+        key: PROTOCOL_VERSION_META_KEY,
+        problem: "expected a protocol version string"
+      };
+      return rejection("envelope", "notification-envelope-invalid", 400, new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid _meta envelope for protocol revision 2026-07-28: ${claimIssue.key}: ${claimIssue.problem}`, { envelope: claimIssue }), true);
+    }
+    if (headerVersion !== void 0 && headerVersion !== claimedVersion) return crossCheckMismatch("notification-header-body-version-mismatch", headerVersion, `the notification envelope names protocol version ${claimedVersion} but the MCP-Protocol-Version header names ${headerVersion}`);
+    const classification = classificationForClaim(claimedVersion);
+    if (classification.era === "modern" && request.mcpMethodHeader !== void 0 && request.mcpMethodHeader !== method) return crossCheckMismatch("notification-method-header-mismatch", request.mcpMethodHeader, `the notification body names method ${method} but the Mcp-Method header names ${request.mcpMethodHeader}`);
+    return {
+      kind: "modern",
+      messageKind: "notification",
+      message: body,
+      classification
+    };
+  }
+  if (headerNamesModern) {
+    if (request.mcpMethodHeader !== void 0 && request.mcpMethodHeader !== method) return crossCheckMismatch("notification-method-header-mismatch", request.mcpMethodHeader, `the notification body names method ${method} but the Mcp-Method header names ${request.mcpMethodHeader}`);
+    return {
+      kind: "modern",
+      messageKind: "notification",
+      message: body,
+      classification: {
+        era: "modern",
+        revision: headerVersion
+      }
+    };
+  }
+  return {
+    kind: "legacy",
+    reason: "notification",
+    ...headerVersion !== void 0 && { requestedVersion: headerVersion }
+  };
+}
+function classifyInboundRequest(request) {
+  request = {
+    ...request,
+    ...request.protocolVersionHeader !== void 0 && { protocolVersionHeader: stripHttpOws(request.protocolVersionHeader) },
+    ...request.mcpMethodHeader !== void 0 && { mcpMethodHeader: stripHttpOws(request.mcpMethodHeader) },
+    ...request.mcpNameHeader !== void 0 && { mcpNameHeader: stripHttpOws(request.mcpNameHeader) }
+  };
+  if (request.httpMethod.toUpperCase() !== "POST") return {
+    kind: "legacy",
+    reason: "http-method"
+  };
+  const body = request.body;
+  if (Array.isArray(body)) return classifyBatch(body);
+  if (isJSONRPCResultResponse(body) || isJSONRPCErrorResponse(body)) return {
+    kind: "legacy",
+    reason: "response"
+  };
+  if (isPlainObject$2(body) && isJSONRPCRequest(body)) return classifyRequestBody(request, body);
+  if (isPlainObject$2(body) && isJSONRPCNotification(body)) return classifyNotificationBody(request, body);
+  return rejection("jsonrpc-shape", "invalid-json-rpc-body", 400, new ProtocolError(ProtocolErrorCode.InvalidRequest, "Bad Request: the request body is not a valid JSON-RPC message"), true);
+}
+function modernOnlyStrictRejection(route, supportedVersions) {
+  switch (route.reason) {
+    case "http-method":
+      return rejection("http-method", "modern-only-method-not-allowed", 405, new ProtocolError(-32e3, "Method not allowed."), true);
+    case "batch":
+      return rejection("jsonrpc-shape", "modern-only-batch-not-supported", 400, new ProtocolError(ProtocolErrorCode.InvalidRequest, "Bad Request: JSON-RPC batches are not supported by this endpoint"), true);
+    case "response":
+      return rejection("jsonrpc-shape", "modern-only-response-post", 400, new ProtocolError(ProtocolErrorCode.InvalidRequest, "Bad Request: JSON-RPC responses cannot be posted to this endpoint"), true);
+    case "notification":
+      return;
+    case "initialize":
+    case "no-claim": {
+      const requested = route.requestedVersion;
+      return rejection("era-classification", "modern-only-missing-envelope", 400, requested === void 0 ? new ProtocolError(ProtocolErrorCode.UnsupportedProtocolVersion, "Unsupported protocol version: the request did not name a protocol version", { supported: [...supportedVersions] }) : new UnsupportedProtocolVersionError({
+        supported: [...supportedVersions],
+        requested
+      }), true);
+    }
+  }
+}
 function parseSchema(schema, data) {
   return safeParse(schema, data);
 }
@@ -4737,6 +5079,9 @@ function withRequestStateValue(ctx, value) {
   };
 }
 var writeNegotiatedProtocolVersion;
+function setNegotiatedProtocolVersion(instance, version) {
+  writeNegotiatedProtocolVersion(instance, version);
+}
 var Protocol = class {
   _transport;
   _requestMessageId = 0;
@@ -5566,6 +5911,20 @@ var require_content_type = /* @__PURE__ */ __commonJSMin(((exports) => {
   }
 }));
 var import_content_type = /* @__PURE__ */ __toESM(require_content_type(), 1);
+function mediaTypeEssence(header) {
+  if (!header) return;
+  try {
+    return import_content_type.parse(header).type;
+  } catch {
+    const essence = (header.split(";", 1)[0] ?? "").trim().toLowerCase();
+    if (essence === "" || header.slice(essence.length).includes(",")) return;
+    return essence;
+  }
+}
+function isJsonContentType(header) {
+  if (header === "application/json") return true;
+  return mediaTypeEssence(header) === "application/json";
+}
 var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 var ReadBuffer = class {
   _buffer;
@@ -12689,10 +13048,317 @@ function isCompletable(schema) {
 function getCompleter(schema) {
   return schema[COMPLETABLE_SYMBOL]?.complete;
 }
+var DEFAULT_SSE_KEEP_ALIVE_MS = 15e3;
 var MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
+function armSseKeepAlive(intervalMs, onTick) {
+  if (!Number.isFinite(intervalMs) || intervalMs < 1) return;
+  const timer = setInterval(onTick, Math.min(intervalMs, MAX_TIMER_DELAY_MS));
+  timer.unref?.();
+  return timer;
+}
+var InMemoryServerEventBus = class {
+  _listeners = /* @__PURE__ */ new Set();
+  /**
+  * @param onerror - Optional callback for errors thrown by listeners
+  *   during dispatch.
+  */
+  constructor(onerror) {
+    this.onerror = onerror;
+  }
+  publish(event) {
+    for (const listener of this._listeners) try {
+      listener(event);
+    } catch (error) {
+      this.onerror?.(error instanceof Error ? error : new Error(String(error)));
+    }
+  }
+  subscribe(listener) {
+    this._listeners.add(listener);
+    let live = true;
+    return () => {
+      if (!live) return;
+      live = false;
+      this._listeners.delete(listener);
+    };
+  }
+  /** The number of currently registered listeners (test/introspection only — the routers track capacity via their own open-subscription set). */
+  get listenerCount() {
+    return this._listeners.size;
+  }
+};
+function createServerNotifier(bus) {
+  return {
+    toolsChanged: () => bus.publish({ kind: "tools_list_changed" }),
+    promptsChanged: () => bus.publish({ kind: "prompts_list_changed" }),
+    resourcesChanged: () => bus.publish({ kind: "resources_list_changed" }),
+    resourceUpdated: (uri) => bus.publish({
+      kind: "resource_updated",
+      uri
+    })
+  };
+}
+function listenFilterAccepts(filter, event) {
+  switch (event.kind) {
+    case "tools_list_changed":
+      return filter.toolsListChanged === true;
+    case "prompts_list_changed":
+      return filter.promptsListChanged === true;
+    case "resources_list_changed":
+      return filter.resourcesListChanged === true;
+    case "resource_updated":
+      return filter.resourceSubscriptions !== void 0 && filter.resourceSubscriptions.includes(event.uri);
+  }
+}
+function honoredSubset(requested, capabilities) {
+  const honored = {};
+  const allow = (bit) => capabilities === void 0 || bit === true;
+  if (requested.toolsListChanged === true && allow(capabilities?.tools?.listChanged)) honored.toolsListChanged = true;
+  if (requested.promptsListChanged === true && allow(capabilities?.prompts?.listChanged)) honored.promptsListChanged = true;
+  if (requested.resourcesListChanged === true && allow(capabilities?.resources?.listChanged)) honored.resourcesListChanged = true;
+  if (requested.resourceSubscriptions !== void 0 && requested.resourceSubscriptions.length > 0 && allow(capabilities?.resources?.subscribe)) honored.resourceSubscriptions = [...requested.resourceSubscriptions];
+  return honored;
+}
+function serverEventToNotification(event) {
+  switch (event.kind) {
+    case "tools_list_changed":
+      return { method: "notifications/tools/list_changed" };
+    case "prompts_list_changed":
+      return { method: "notifications/prompts/list_changed" };
+    case "resources_list_changed":
+      return { method: "notifications/resources/list_changed" };
+    case "resource_updated":
+      return {
+        method: "notifications/resources/updated",
+        params: { uri: event.uri }
+      };
+  }
+}
+var DEFAULT_MAX_SUBSCRIPTIONS = 1024;
+function jsonRpcError(id, code, message) {
+  return Response.json({
+    jsonrpc: "2.0",
+    error: {
+      code,
+      message
+    },
+    id
+  }, { status: 200 });
+}
+function stampSubscriptionId(notification, subscriptionId) {
+  return {
+    method: notification.method,
+    params: {
+      ...notification.params,
+      _meta: {
+        ...notification.params?._meta,
+        [SUBSCRIPTION_ID_META_KEY]: subscriptionId
+      }
+    }
+  };
+}
+function parseListenFilter(message) {
+  const outcome = codecForVersion(MODERN_WIRE_REVISION).validateRequest("subscriptions/listen", message);
+  return outcome.ok ? outcome.value.params?.notifications : void 0;
+}
+function createListenRouter(options) {
+  const { bus, onerror } = options;
+  const maxSubscriptions = options.maxSubscriptions ?? DEFAULT_MAX_SUBSCRIPTIONS;
+  const keepAliveMs = options.keepAliveMs ?? DEFAULT_SSE_KEEP_ALIVE_MS;
+  const open = /* @__PURE__ */ new Set();
+  function serve(message, signal, capabilities, serverInfo) {
+    if (open.size >= maxSubscriptions) {
+      onerror?.(/* @__PURE__ */ new Error(`subscriptions/listen refused: subscription limit reached (${maxSubscriptions})`));
+      return jsonRpcError(message.id, -32603, "Subscription limit reached");
+    }
+    const filter = parseListenFilter(message);
+    if (filter === void 0) return jsonRpcError(message.id, -32602, "Invalid params: 'notifications' is required and must be a valid SubscriptionFilter");
+    const honored = honoredSubset(filter, capabilities);
+    const subscriptionId = message.id;
+    const encoder = new TextEncoder();
+    let controller;
+    let closed = false;
+    let unsubscribe;
+    let keepAliveTimer;
+    let abortCleanup;
+    const writeFrame = (frame) => {
+      if (closed) return;
+      try {
+        controller.enqueue(encoder.encode(frame));
+      } catch (error) {
+        onerror?.(error instanceof Error ? error : new Error(String(error)));
+      }
+    };
+    const writeNotification = (method, params) => {
+      writeFrame(`event: message
+data: ${JSON.stringify({
+        jsonrpc: "2.0",
+        method,
+        params
+      })}
+
+`);
+    };
+    const teardown = (graceful) => {
+      if (closed) return;
+      if (graceful) writeFrame(`event: message
+data: ${JSON.stringify({
+        jsonrpc: "2.0",
+        id: subscriptionId,
+        result: {
+          resultType: "complete",
+          _meta: {
+            [SUBSCRIPTION_ID_META_KEY]: subscriptionId,
+            [SERVER_INFO_META_KEY]: serverInfo
+          }
+        }
+      })}
+
+`);
+      closed = true;
+      try {
+        unsubscribe?.();
+      } catch (error) {
+        onerror?.(error instanceof Error ? error : new Error(String(error)));
+      }
+      if (keepAliveTimer !== void 0) clearInterval(keepAliveTimer);
+      abortCleanup?.();
+      open.delete(teardown);
+      try {
+        controller.close();
+      } catch {
+      }
+    };
+    const readable = new ReadableStream({
+      start(streamController) {
+        controller = streamController;
+        const ack = stampSubscriptionId({
+          method: "notifications/subscriptions/acknowledged",
+          params: { notifications: honored }
+        }, subscriptionId);
+        writeNotification(ack.method, ack.params);
+        if (Object.keys(honored).length === 0) {
+          teardown(true);
+          return;
+        }
+        unsubscribe = bus.subscribe((event) => {
+          if (closed || !listenFilterAccepts(honored, event)) return;
+          const note = stampSubscriptionId(serverEventToNotification(event), subscriptionId);
+          writeNotification(note.method, note.params);
+        });
+        keepAliveTimer = armSseKeepAlive(keepAliveMs, () => writeFrame(": keepalive\n\n"));
+        open.add(teardown);
+      },
+      cancel() {
+        teardown(false);
+      }
+    });
+    if (signal !== void 0) if (signal.aborted) teardown(false);
+    else {
+      const onAbort = () => teardown(false);
+      signal.addEventListener("abort", onAbort, { once: true });
+      abortCleanup = () => signal.removeEventListener("abort", onAbort);
+    }
+    return new Response(readable, {
+      status: 200,
+      headers: {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache, no-transform",
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no"
+      }
+    });
+  }
+  return {
+    serve,
+    closeAll() {
+      for (const teardown of open) teardown(true);
+    },
+    get openCount() {
+      return open.size;
+    }
+  };
+}
+function headerQuotedValue(value) {
+  return value.replaceAll(/[\\"]/g, String.raw`\$&`).replaceAll(/[^\u0020-\u007E]/g, " ");
+}
+function buildWwwAuthenticateHeader(errorCode, description, requiredScopes, resourceMetadataUrl) {
+  let header = `Bearer error="${headerQuotedValue(errorCode)}", error_description="${headerQuotedValue(description)}"`;
+  if (requiredScopes.length > 0) header += `, scope="${headerQuotedValue(requiredScopes.join(" "))}"`;
+  if (resourceMetadataUrl) header += `, resource_metadata="${headerQuotedValue(resourceMetadataUrl)}"`;
+  return header;
+}
+function bearerAuthChallengeResponse(error, options) {
+  const { requiredScopes = [], resourceMetadataUrl } = options ?? {};
+  if (!(error instanceof OAuthError)) {
+    const serverError = new OAuthError(OAuthErrorCode.ServerError, "Internal Server Error");
+    return Response.json(serverError.toResponseObject(), { status: 500 });
+  }
+  switch (error.code) {
+    case OAuthErrorCode.InvalidToken: {
+      const challenge = buildWwwAuthenticateHeader(error.code, error.message, requiredScopes, resourceMetadataUrl);
+      return Response.json(error.toResponseObject(), {
+        status: 401,
+        headers: { "WWW-Authenticate": challenge }
+      });
+    }
+    case OAuthErrorCode.InsufficientScope: {
+      const challenge = buildWwwAuthenticateHeader(error.code, error.message, requiredScopes, resourceMetadataUrl);
+      return Response.json(error.toResponseObject(), {
+        status: 403,
+        headers: { "WWW-Authenticate": challenge }
+      });
+    }
+    case OAuthErrorCode.ServerError:
+      return Response.json(error.toResponseObject(), { status: 500 });
+    default:
+      return Response.json(error.toResponseObject(), { status: 400 });
+  }
+}
+function getOAuthProtectedResourceMetadataUrl(serverUrl) {
+  const metadataUrl = new URL(serverUrl);
+  metadataUrl.pathname = protectedResourceMetadataPath(serverUrl);
+  metadataUrl.hash = "";
+  return metadataUrl.href;
+}
+function protectedResourceMetadataPath(resourceServerUrl) {
+  const rsPath = stripTrailingSlash(resourceServerUrl.pathname);
+  return `/.well-known/oauth-protected-resource${rsPath === "/" ? "" : rsPath}`;
+}
+function stripTrailingSlash(path) {
+  return path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
+}
 function supportsScopeChallengeResolver(transport) {
   return typeof transport === "object" && transport !== null && "setScopeChallengeResolver" in transport && typeof transport.setScopeChallengeResolver === "function";
 }
+function assertScope(scope, location) {
+  if (typeof scope !== "string" || !/^[\u0021\u0023-\u005B\u005D-\u007E]+$/.test(scope)) throw new TypeError(`${location} must satisfy the OAuth scope-token grammar`);
+}
+function validateScopeChallenge(challenge) {
+  if (challenge === null || typeof challenge !== "object" || !Array.isArray(challenge.scopes) || challenge.scopes.length === 0) throw new TypeError("scope challenge must contain at least one scope");
+  for (const [index, scope] of challenge.scopes.entries()) assertScope(scope, `scope challenge scopes[${index}]`);
+  if (challenge.errorDescription !== void 0 && typeof challenge.errorDescription !== "string") throw new TypeError("scope challenge errorDescription must be a string");
+  if (challenge.errorDescription !== void 0 && !/^[\u0020-\u0021\u0023-\u005B\u005D-\u007E]+$/.test(challenge.errorDescription)) throw new TypeError("scope challenge errorDescription must satisfy the RFC 6750 error-description grammar");
+  return challenge;
+}
+async function findScopeChallenge(requests, authInfo, resolve) {
+  for (const request of requests) {
+    const challenge = await resolve({
+      request,
+      ...authInfo !== void 0 && { authInfo }
+    });
+    if (challenge !== void 0) return validateScopeChallenge(challenge);
+  }
+}
+function scopeChallengeResourceMetadataUrl(authInfo) {
+  if (authInfo?.resourceMetadataUrl !== void 0) return authInfo.resourceMetadataUrl;
+  if (authInfo?.resource?.protocol === "https:" || authInfo?.resource?.protocol === "http:") return getOAuthProtectedResourceMetadataUrl(authInfo.resource);
+}
+function createScopeChallengeResponse(challenge, resourceMetadataUrl) {
+  return bearerAuthChallengeResponse(new OAuthError(OAuthErrorCode.InsufficientScope, challenge.errorDescription ?? "Insufficient scope"), {
+    requiredScopes: [...challenge.scopes],
+    resourceMetadataUrl
+  });
+}
 var DEFAULT_LEGACY_SHIM_MAX_ROUNDS = 8;
 var DEFAULT_LEGACY_SHIM_ROUND_TIMEOUT_MS = 6e5;
 function resolveLegacyShimOptions(options) {
@@ -12830,6 +13496,15 @@ var INPUT_REQUIRED_CAPABLE_METHODS = /* @__PURE__ */ new Set([
 var writeClientIdentity;
 var installDiscoverHandler;
 var readServerIdentity;
+function seedClientIdentityFromEnvelope(server, identity) {
+  writeClientIdentity(server, identity);
+}
+function installModernOnlyHandlers(server, servedModernVersions) {
+  installDiscoverHandler(server, servedModernVersions);
+}
+function serverIdentityOf(server) {
+  return readServerIdentity(server);
+}
 var Server = class extends Protocol {
   _clientCapabilities;
   _clientVersion;
@@ -14090,26 +14765,1295 @@ function unwrapOptionalSchema(schema) {
 }
 
 // ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/index.mjs
-var DEFAULT_MAX_REQUEST_BODY_SIZE = 4 * 1024 * 1024;
+var PerRequestHTTPServerTransport = class {
+  onclose;
+  onerror;
+  onmessage;
+  _classification;
+  _responseMode;
+  _started = false;
+  _used = false;
+  _closed = false;
+  _terminalDelivered = false;
+  /**
+  * `true` only while the inbound message is being delivered synchronously
+  * to the connected protocol layer. The pre-handler gates (the era
+  * registry gate, the edge→instance handoff check, the missing-handler
+  * rejection) answer inside this window; request handlers always run
+  * after it (the protocol layer defers them to a microtask). An error
+  * sent inside the window is therefore ladder-originated, and an error
+  * sent after it is handler-produced.
+  */
+  _dispatchWindowOpen = false;
+  _requestId;
+  _deferredResponse;
+  _sse;
+  _abortCleanup;
+  _keepAliveMs;
+  constructor(options) {
+    this._classification = options.classification;
+    this._responseMode = options.responseMode ?? "auto";
+    this._keepAliveMs = options.keepAliveMs ?? DEFAULT_SSE_KEEP_ALIVE_MS;
+  }
+  async start() {
+    if (this._started) throw new Error("PerRequestHTTPServerTransport is already started");
+    this._started = true;
+  }
+  /**
+  * Serves the single exchange: delivers the classified message to the
+  * connected server instance and resolves with the HTTP response.
+  *
+  * Throws when called a second time (the transport is strictly
+  * single-use), or before a server has been connected to the transport.
+  * The returned promise rejects with a connection-closed error when the
+  * transport is closed before a response was produced (for example because
+  * the client disconnected).
+  */
+  async handleMessage(message, extra) {
+    if (this._used) throw new Error("PerRequestHTTPServerTransport serves exactly one exchange; construct a new transport per request");
+    if (!this._started || this.onmessage === void 0) throw new Error("PerRequestHTTPServerTransport is not connected: connect a server to this transport before handling a message");
+    if (this._closed) throw new Error("PerRequestHTTPServerTransport is closed");
+    this._used = true;
+    const signal = extra?.request?.signal;
+    if (signal?.aborted) {
+      await this.close();
+      throw new SdkError(SdkErrorCode.ConnectionClosed, "The request was aborted before it could be handled");
+    }
+    const messageExtra = {
+      classification: this._classification,
+      ...extra?.request !== void 0 && { request: extra.request },
+      ...extra?.authInfo !== void 0 && { authInfo: extra.authInfo }
+    };
+    if (isJSONRPCRequest(message)) {
+      this._requestId = message.id;
+      let resolve;
+      let reject;
+      const promise = new Promise((promiseResolve, promiseReject) => {
+        resolve = promiseResolve;
+        reject = promiseReject;
+      });
+      this._deferredResponse = {
+        promise,
+        resolve,
+        reject,
+        settled: false
+      };
+      if (signal !== void 0) {
+        const onAbort = () => void this.close();
+        signal.addEventListener("abort", onAbort, { once: true });
+        this._abortCleanup = () => signal.removeEventListener("abort", onAbort);
+      }
+      this._dispatchWindowOpen = true;
+      try {
+        this.onmessage(message, messageExtra);
+      } finally {
+        this._dispatchWindowOpen = false;
+      }
+      if (this._responseMode === "sse" && !this._closed && !this._deferredResponse.settled) this.upgradeToSse();
+      return promise;
+    }
+    this.onmessage(message, messageExtra);
+    return new Response(null, { status: 202 });
+  }
+  async send(message, options) {
+    if (this._closed) return;
+    const isResponse = isJSONRPCResultResponse(message) || isJSONRPCErrorResponse(message);
+    const relatedId = isResponse ? message.id : options?.relatedRequestId;
+    if (this._requestId === void 0 || relatedId === void 0 || relatedId !== this._requestId) {
+      if (isResponse) this.onerror?.(/* @__PURE__ */ new Error(`Received a response for an unknown request id: ${String(message.id)}`));
+      return;
+    }
+    if (isResponse) {
+      if (this._terminalDelivered) return;
+      this._terminalDelivered = true;
+      const errorCode = isJSONRPCErrorResponse(message) ? message.error.code : void 0;
+      const ladderStatus = errorCode !== void 0 && (this._dispatchWindowOpen || errorCode === ProtocolErrorCode.MissingRequiredClientCapability) ? LADDER_ERROR_HTTP_STATUS[errorCode] : void 0;
+      if (ladderStatus !== void 0 && this._sse === void 0) {
+        this.settleResponse(Response.json(message, {
+          status: ladderStatus,
+          headers: { "Content-Type": "application/json" }
+        }));
+        queueMicrotask(() => void this.close());
+        return;
+      }
+      if (this._sse !== void 0 || this._responseMode === "sse") {
+        if (this._sse === void 0) this.upgradeToSse();
+        this.writeMessageFrame(message);
+        this.finalizeStream();
+        return;
+      }
+      this.settleResponse(Response.json(message, {
+        status: 200,
+        headers: { "Content-Type": "application/json" }
+      }));
+      queueMicrotask(() => void this.close());
+      return;
+    }
+    if (this._responseMode === "json") return;
+    if (this._sse === void 0) this.upgradeToSse();
+    this.writeMessageFrame(message);
+  }
+  /**
+  * Writes an SSE comment frame (a keep-alive heartbeat). Dropped when the
+  * exchange is not currently streaming.
+  */
+  writeCommentFrame(comment) {
+    if (this._closed || this._sse === void 0 || this._sse.closed) return;
+    const frame = comment.split("\n").map((line) => `: ${line}`).join("\n");
+    this.writeFrame(`${frame}
 
-// src/server.ts
-import { readFileSync } from "fs";
-import { dirname, join } from "path";
-import { fileURLToPath } from "url";
+`);
+  }
+  async close() {
+    if (this._closed) return;
+    this._closed = true;
+    this._abortCleanup?.();
+    this._abortCleanup = void 0;
+    if (this._sse?.keepAliveTimer !== void 0) clearInterval(this._sse.keepAliveTimer);
+    if (this._sse !== void 0 && !this._sse.closed) {
+      this._sse.closed = true;
+      try {
+        this._sse.controller.close();
+      } catch {
+      }
+    }
+    if (this._deferredResponse !== void 0 && !this._deferredResponse.settled) {
+      this._deferredResponse.settled = true;
+      this._deferredResponse.reject(new SdkError(SdkErrorCode.ConnectionClosed, "Connection closed before a response was produced"));
+    }
+    this.onclose?.();
+  }
+  settleResponse(response) {
+    if (this._deferredResponse === void 0 || this._deferredResponse.settled) return;
+    this._deferredResponse.settled = true;
+    this._deferredResponse.resolve(response);
+  }
+  upgradeToSse() {
+    let controller;
+    const readable = new ReadableStream({
+      start: (streamController) => {
+        controller = streamController;
+      },
+      cancel: () => {
+        this.close();
+      }
+    });
+    this._sse = {
+      controller,
+      encoder: new TextEncoder(),
+      closed: false
+    };
+    this._sse.keepAliveTimer = armSseKeepAlive(this._keepAliveMs, () => this.writeCommentFrame("keepalive"));
+    this.settleResponse(new Response(readable, {
+      status: 200,
+      headers: {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache, no-transform",
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no"
+      }
+    }));
+  }
+  finalizeStream() {
+    if (this._sse?.keepAliveTimer !== void 0) clearInterval(this._sse.keepAliveTimer);
+    if (this._sse !== void 0 && !this._sse.closed) {
+      this._sse.closed = true;
+      try {
+        this._sse.controller.close();
+      } catch {
+      }
+    }
+    queueMicrotask(() => void this.close());
+  }
+  writeMessageFrame(message) {
+    this.writeFrame(`event: message
+data: ${JSON.stringify(message)}
 
-// src/lib/onboarding-copy.ts
-var ONBOARDING_OFFER_CONTROL_VARIANT = "control";
-var ONBOARDING_OFFER_COPY = {
-  // #4089 review: this cohort has already completed OAuth to connect - they
-  // have an account. Never claim "no account needed" or otherwise imply an
-  // anonymous/no-sign-up lane here; that framing contradicts what they just
-  // did and reads as broken. Acknowledge the connection instead, then offer
-  // to build. (The anonymous/no-auth entry point is a different surface,
-  // #4088 - not this cohort.)
-  [ONBOARDING_OFFER_CONTROL_VARIANT]: "When this is the start of a new conversation and the user has not yet said what they want to build, welcome them as someone who is now connected to Clipform and offer to build their first form together, then offer these starting points as plain text: lead-gen, feedback, quiz, or something else - ask which one fits, or invite them to describe what they need instead. If the user's first message already states what they want to build, even loosely, skip that offer entirely and go straight into the brief-driven flow below."
+`);
+  }
+  writeFrame(frame) {
+    if (this._sse === void 0 || this._sse.closed) return;
+    try {
+      this._sse.controller.enqueue(this._sse.encoder.encode(frame));
+    } catch (error) {
+      this.onerror?.(/* @__PURE__ */ new Error(`Failed to write to the response stream: ${error}`));
+    }
+  }
 };
-function buildOnboardingOffer(variant = ONBOARDING_OFFER_CONTROL_VARIANT) {
-  return ONBOARDING_OFFER_COPY[variant] ?? ONBOARDING_OFFER_COPY[ONBOARDING_OFFER_CONTROL_VARIANT];
+async function invoke(server, message, ctx) {
+  const transport = new PerRequestHTTPServerTransport({
+    classification: ctx.classification,
+    ...ctx.responseMode !== void 0 && { responseMode: ctx.responseMode },
+    ...ctx.keepAliveMs !== void 0 && { keepAliveMs: ctx.keepAliveMs }
+  });
+  await server.connect(transport);
+  return transport.handleMessage(message, {
+    ...ctx.request !== void 0 && { request: ctx.request },
+    ...ctx.authInfo !== void 0 && { authInfo: ctx.authInfo }
+  });
+}
+var DEFAULT_MAX_REQUEST_BODY_SIZE = 4 * 1024 * 1024;
+var MAX_BATCH_SIZE = 100;
+function requestBodyTooLargeMessage(maxBytes) {
+  return `Payload Too Large: Request body must not exceed ${maxBytes} bytes`;
+}
+function resolveMaxRequestBodySize(value) {
+  if (value === void 0) return DEFAULT_MAX_REQUEST_BODY_SIZE;
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) throw new RangeError(`maxRequestBodySize must be a positive number of bytes, got ${String(value)}`);
+  return value;
+}
+async function readRequestBody(request, maxBytes = DEFAULT_MAX_REQUEST_BODY_SIZE) {
+  if (Number(request.headers.get("content-length")) > maxBytes) return { tooLarge: true };
+  if (request.body === null) return {
+    tooLarge: false,
+    text: ""
+  };
+  const reader = request.body.getReader();
+  const decoder = new TextDecoder();
+  let received = 0;
+  let text = "";
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      received += value.byteLength;
+      if (received > maxBytes) return { tooLarge: true };
+      text += decoder.decode(value, { stream: true });
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return {
+    tooLarge: false,
+    text: text + decoder.decode()
+  };
+}
+var WebStandardStreamableHTTPServerTransport = class {
+  sessionIdGenerator;
+  _started = false;
+  _hasHandledRequest = false;
+  _closed = false;
+  _streamMapping = /* @__PURE__ */ new Map();
+  _requestToStreamMapping = /* @__PURE__ */ new Map();
+  _requestResponseMap = /* @__PURE__ */ new Map();
+  _initialized = false;
+  _enableJsonResponse = false;
+  _standaloneSseStreamId = "_GET_stream";
+  _eventStore;
+  _onsessioninitialized;
+  _onsessionclosed;
+  _allowedHosts;
+  _allowedOrigins;
+  _enableDnsRebindingProtection;
+  _retryInterval;
+  _supportedProtocolVersions;
+  _keepAliveMs;
+  _maxRequestBodySize;
+  _scopeChallengeResolver;
+  sessionId;
+  onclose;
+  onerror;
+  onmessage;
+  constructor(options = {}) {
+    this.sessionIdGenerator = options.sessionIdGenerator;
+    this._enableJsonResponse = options.enableJsonResponse ?? false;
+    this._eventStore = options.eventStore;
+    this._onsessioninitialized = options.onsessioninitialized;
+    this._onsessionclosed = options.onsessionclosed;
+    this._allowedHosts = options.allowedHosts;
+    this._allowedOrigins = options.allowedOrigins;
+    this._enableDnsRebindingProtection = options.enableDnsRebindingProtection ?? false;
+    this._retryInterval = options.retryInterval;
+    this._supportedProtocolVersions = options.supportedProtocolVersions ?? SUPPORTED_PROTOCOL_VERSIONS;
+    this._keepAliveMs = options.keepAliveMs ?? DEFAULT_SSE_KEEP_ALIVE_MS;
+    this._maxRequestBodySize = resolveMaxRequestBodySize(options.maxRequestBodySize);
+  }
+  startKeepAlive(controller, encoder) {
+    if (this._closed) return void 0;
+    const timer = armSseKeepAlive(this._keepAliveMs, () => {
+      try {
+        controller.enqueue(encoder.encode(": keepalive\n\n"));
+      } catch {
+        if (timer !== void 0) clearInterval(timer);
+      }
+    });
+    return timer;
+  }
+  /** Sets the scope challenge resolver for parsed JSON-RPC requests. */
+  setScopeChallengeResolver(resolver) {
+    this._scopeChallengeResolver = resolver;
+  }
+  /**
+  * Starts the transport. This is required by the {@linkcode Transport} interface but is a no-op
+  * for the Streamable HTTP transport as connections are managed per-request.
+  */
+  async start() {
+    if (this._started) throw new Error("Transport already started");
+    this._started = true;
+  }
+  /**
+  * Sets the supported protocol versions for header validation.
+  * Called by the server during {@linkcode server/server.Server.connect | connect()} to pass its supported versions.
+  */
+  setSupportedProtocolVersions(versions) {
+    this._supportedProtocolVersions = versions;
+  }
+  /**
+  * Helper to create a JSON error response
+  */
+  createJsonErrorResponse(status, code, message, options) {
+    const error = {
+      code,
+      message
+    };
+    if (options?.data !== void 0) error.data = options.data;
+    return Response.json({
+      jsonrpc: "2.0",
+      error,
+      id: null
+    }, {
+      status,
+      headers: {
+        "Content-Type": "application/json",
+        ...options?.headers
+      }
+    });
+  }
+  async _checkScopeChallenge(messages, authInfo) {
+    if (!this._scopeChallengeResolver) return;
+    const challenge = await findScopeChallenge(messages.filter((message) => isJSONRPCRequest(message)), authInfo, this._scopeChallengeResolver);
+    return challenge === void 0 ? void 0 : createScopeChallengeResponse(challenge, scopeChallengeResourceMetadataUrl(authInfo));
+  }
+  /**
+  * Validates request headers for DNS rebinding protection.
+  * @returns Error response if validation fails, `undefined` if validation passes.
+  */
+  validateRequestHeaders(req) {
+    if (!this._enableDnsRebindingProtection) return;
+    if (this._allowedHosts && this._allowedHosts.length > 0) {
+      const hostHeader = req.headers.get("host");
+      if (!hostHeader || !this._allowedHosts.includes(hostHeader)) {
+        const error = `Invalid Host header: ${hostHeader}`;
+        this.onerror?.(new Error(error));
+        return this.createJsonErrorResponse(403, -32e3, error);
+      }
+    }
+    if (this._allowedOrigins && this._allowedOrigins.length > 0) {
+      const originHeader = req.headers.get("origin");
+      if (originHeader && !this._allowedOrigins.includes(originHeader)) {
+        const error = `Invalid Origin header: ${originHeader}`;
+        this.onerror?.(new Error(error));
+        return this.createJsonErrorResponse(403, -32e3, error);
+      }
+    }
+  }
+  /**
+  * Handles an incoming HTTP request, whether `GET`, `POST`, or `DELETE`
+  * Returns a `Response` object (Web Standard)
+  */
+  async handleRequest(req, options) {
+    if (this._closed) return this.createJsonErrorResponse(404, -32001, "Session not found");
+    if (!this.sessionIdGenerator && this._hasHandledRequest) throw new Error("Stateless transport cannot be reused across requests. Create a new transport per request.");
+    this._hasHandledRequest = true;
+    const validationError = this.validateRequestHeaders(req);
+    if (validationError) return validationError;
+    switch (req.method) {
+      case "POST":
+        return this.handlePostRequest(req, options);
+      case "GET":
+        return this.handleGetRequest(req);
+      case "DELETE":
+        return this.handleDeleteRequest(req);
+      default:
+        return this.handleUnsupportedRequest();
+    }
+  }
+  /**
+  * Returns true if the client's protocol version supports empty SSE data in
+  * priming events (the fix shipped with protocol version `2025-11-25`).
+  *
+  * The version is checked for membership in this transport instance's
+  * supported protocol versions rather than with an open-ended
+  * `>= '2025-11-25'` comparison: the value may come from an `initialize`
+  * request body, which (unlike the `MCP-Protocol-Version` header) is not
+  * validated against `supportedProtocolVersions` before reaching this
+  * check. An unknown future version string must not silently enable
+  * behavior reserved for versions this transport actually supports.
+  */
+  supportsEmptySSEData(protocolVersion) {
+    return this._supportedProtocolVersions.includes(protocolVersion) && protocolVersion >= "2025-11-25";
+  }
+  /**
+  * Writes a priming event to establish resumption capability.
+  * Only sends if `eventStore` is configured (opt-in for resumability) and
+  * the client's protocol version supports empty SSE data (a supported
+  * version that is >= `2025-11-25`).
+  */
+  async writePrimingEvent(controller, encoder, streamId, protocolVersion) {
+    if (!this._eventStore) return;
+    if (!this.supportsEmptySSEData(protocolVersion)) return;
+    const primingEventId = await this._eventStore.storeEvent(streamId, {});
+    let primingEvent = `id: ${primingEventId}
+data: 
+
+`;
+    if (this._retryInterval !== void 0) primingEvent = `id: ${primingEventId}
+retry: ${this._retryInterval}
+data: 
+
+`;
+    controller.enqueue(encoder.encode(primingEvent));
+  }
+  /**
+  * Handles `GET` requests for SSE stream
+  */
+  async handleGetRequest(req) {
+    if (!req.headers.get("accept")?.includes("text/event-stream")) {
+      this.onerror?.(/* @__PURE__ */ new Error("Not Acceptable: Client must accept text/event-stream"));
+      return this.createJsonErrorResponse(406, -32e3, "Not Acceptable: Client must accept text/event-stream");
+    }
+    const sessionError = this.validateSession(req);
+    if (sessionError) return sessionError;
+    const protocolError = this.validateProtocolVersion(req);
+    if (protocolError) return protocolError;
+    if (this._eventStore) {
+      const lastEventId = req.headers.get("last-event-id");
+      if (lastEventId) return this.replayEvents(lastEventId);
+    }
+    if (this._streamMapping.get(this._standaloneSseStreamId) !== void 0) {
+      this.onerror?.(/* @__PURE__ */ new Error("Conflict: Only one SSE stream is allowed per session"));
+      return this.createJsonErrorResponse(409, -32e3, "Conflict: Only one SSE stream is allowed per session");
+    }
+    const encoder = new TextEncoder();
+    let streamController;
+    let keepAliveTimer;
+    const readable = new ReadableStream({
+      start: (controller) => {
+        streamController = controller;
+      },
+      cancel: () => {
+        if (keepAliveTimer !== void 0) clearInterval(keepAliveTimer);
+        if (this._streamMapping.get(this._standaloneSseStreamId)?.controller === streamController) this._streamMapping.delete(this._standaloneSseStreamId);
+      }
+    });
+    const headers = {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache, no-transform",
+      Connection: "keep-alive",
+      "X-Accel-Buffering": "no"
+    };
+    if (this.sessionId !== void 0) headers["mcp-session-id"] = this.sessionId;
+    this._streamMapping.set(this._standaloneSseStreamId, {
+      controller: streamController,
+      encoder,
+      cleanup: () => {
+        if (keepAliveTimer !== void 0) clearInterval(keepAliveTimer);
+        this._streamMapping.delete(this._standaloneSseStreamId);
+        try {
+          streamController.close();
+        } catch {
+        }
+      }
+    });
+    keepAliveTimer = this.startKeepAlive(streamController, encoder);
+    return new Response(readable, { headers });
+  }
+  /**
+  * Replays events that would have been sent after the specified event ID
+  * Only used when resumability is enabled
+  */
+  async replayEvents(lastEventId) {
+    if (!this._eventStore) {
+      this.onerror?.(/* @__PURE__ */ new Error("Event store not configured"));
+      return this.createJsonErrorResponse(400, -32e3, "Event store not configured");
+    }
+    try {
+      let streamId;
+      if (this._eventStore.getStreamIdForEventId) {
+        streamId = await this._eventStore.getStreamIdForEventId(lastEventId);
+        if (!streamId) {
+          this.onerror?.(/* @__PURE__ */ new Error("Invalid event ID format"));
+          return this.createJsonErrorResponse(400, -32e3, "Invalid event ID format");
+        }
+        if (this._streamMapping.get(streamId) !== void 0) {
+          this.onerror?.(/* @__PURE__ */ new Error("Conflict: Stream already has an active connection"));
+          return this.createJsonErrorResponse(409, -32e3, "Conflict: Stream already has an active connection");
+        }
+      }
+      const headers = {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache, no-transform",
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no"
+      };
+      if (this.sessionId !== void 0) headers["mcp-session-id"] = this.sessionId;
+      const encoder = new TextEncoder();
+      let streamController;
+      let keepAliveTimer;
+      let cancelled = false;
+      let replayedStreamId;
+      const readable = new ReadableStream({
+        start: (controller) => {
+          streamController = controller;
+        },
+        cancel: () => {
+          cancelled = true;
+          if (keepAliveTimer !== void 0) clearInterval(keepAliveTimer);
+          if (replayedStreamId !== void 0 && this._streamMapping.get(replayedStreamId)?.controller === streamController) this._streamMapping.delete(replayedStreamId);
+        }
+      });
+      const replayedEventIds = /* @__PURE__ */ new Set();
+      replayedStreamId = await this._eventStore.replayEventsAfter(lastEventId, { send: async (eventId, message) => {
+        replayedEventIds.add(eventId);
+        if (!this.writeSSEEvent(streamController, encoder, message, eventId)) try {
+          streamController.close();
+        } catch {
+        }
+      } });
+      if (this._closed || cancelled) {
+        try {
+          streamController.close();
+        } catch {
+        }
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
+      this._streamMapping.get(replayedStreamId)?.cleanup();
+      this._streamMapping.set(replayedStreamId, {
+        controller: streamController,
+        encoder,
+        replayedEventIds,
+        cleanup: () => {
+          if (keepAliveTimer !== void 0) clearInterval(keepAliveTimer);
+          this._streamMapping.delete(replayedStreamId);
+          try {
+            streamController.close();
+          } catch {
+          }
+        }
+      });
+      if (replayedStreamId !== this._standaloneSseStreamId) {
+        if (![...this._requestToStreamMapping.values()].includes(replayedStreamId)) {
+          this._streamMapping.delete(replayedStreamId);
+          try {
+            streamController.close();
+          } catch {
+          }
+        }
+      }
+      if (this._streamMapping.get(replayedStreamId)?.controller === streamController) keepAliveTimer = this.startKeepAlive(streamController, encoder);
+      return new Response(readable, { headers });
+    } catch (error) {
+      this.onerror?.(error);
+      return this.createJsonErrorResponse(500, -32e3, "Error replaying events");
+    }
+  }
+  /**
+  * Writes an event to an SSE stream via controller with proper formatting
+  */
+  writeSSEEvent(controller, encoder, message, eventId) {
+    try {
+      let eventData = `event: message
+`;
+      if (eventId) eventData += `id: ${eventId}
+`;
+      eventData += `data: ${JSON.stringify(message)}
+
+`;
+      controller.enqueue(encoder.encode(eventData));
+      return true;
+    } catch (error) {
+      this.onerror?.(error);
+      return false;
+    }
+  }
+  /**
+  * Handles unsupported requests (`PUT`, `PATCH`, etc.)
+  */
+  handleUnsupportedRequest() {
+    this.onerror?.(/* @__PURE__ */ new Error("Method not allowed."));
+    return Response.json({
+      jsonrpc: "2.0",
+      error: {
+        code: -32e3,
+        message: "Method not allowed."
+      },
+      id: null
+    }, {
+      status: 405,
+      headers: {
+        Allow: "GET, POST, DELETE",
+        "Content-Type": "application/json"
+      }
+    });
+  }
+  /**
+  * Handles `POST` requests containing JSON-RPC messages
+  */
+  async handlePostRequest(req, options) {
+    try {
+      const acceptHeader = req.headers.get("accept");
+      if (!acceptHeader?.includes("application/json") || !acceptHeader.includes("text/event-stream")) {
+        this.onerror?.(/* @__PURE__ */ new Error("Not Acceptable: Client must accept both application/json and text/event-stream"));
+        return this.createJsonErrorResponse(406, -32e3, "Not Acceptable: Client must accept both application/json and text/event-stream");
+      }
+      if (!isJsonContentType(req.headers.get("content-type"))) {
+        this.onerror?.(/* @__PURE__ */ new Error("Unsupported Media Type: Content-Type must be application/json"));
+        return this.createJsonErrorResponse(415, -32e3, "Unsupported Media Type: Content-Type must be application/json");
+      }
+      const request = req;
+      let rawMessage;
+      if (options?.parsedBody === void 0) try {
+        const body = await readRequestBody(req, this._maxRequestBodySize);
+        if (body.tooLarge) {
+          const message = requestBodyTooLargeMessage(this._maxRequestBodySize);
+          this.onerror?.(new Error(message));
+          return this.createJsonErrorResponse(413, -32e3, message);
+        }
+        rawMessage = JSON.parse(body.text);
+      } catch (error) {
+        this.onerror?.(error);
+        return this.createJsonErrorResponse(400, -32700, "Parse error: Invalid JSON");
+      }
+      else rawMessage = options.parsedBody;
+      if (Array.isArray(rawMessage) && rawMessage.length > MAX_BATCH_SIZE) {
+        this.onerror?.(/* @__PURE__ */ new Error(`Invalid Request: Batch must not exceed ${MAX_BATCH_SIZE} messages`));
+        return this.createJsonErrorResponse(400, -32600, `Invalid Request: Batch must not exceed ${MAX_BATCH_SIZE} messages`);
+      }
+      let messages;
+      try {
+        messages = Array.isArray(rawMessage) ? rawMessage.map((msg) => JSONRPCMessageSchema.parse(msg)) : [JSONRPCMessageSchema.parse(rawMessage)];
+      } catch (error) {
+        this.onerror?.(error);
+        return this.createJsonErrorResponse(400, -32700, "Parse error: Invalid JSON-RPC message");
+      }
+      if (this._closed) return this.createJsonErrorResponse(404, -32001, "Session not found");
+      const isInitializationRequest = messages.some((element) => isInitializeRequest(element));
+      if (isInitializationRequest) {
+        if (this._initialized && this.sessionId !== void 0) {
+          this.onerror?.(/* @__PURE__ */ new Error("Invalid Request: Server already initialized"));
+          return this.createJsonErrorResponse(400, -32600, "Invalid Request: Server already initialized");
+        }
+        if (messages.length > 1) {
+          this.onerror?.(/* @__PURE__ */ new Error("Invalid Request: Only one initialization request is allowed"));
+          return this.createJsonErrorResponse(400, -32600, "Invalid Request: Only one initialization request is allowed");
+        }
+        this.sessionId = this.sessionIdGenerator?.();
+        this._initialized = true;
+        if (this.sessionId && this._onsessioninitialized) await Promise.resolve(this._onsessioninitialized(this.sessionId));
+      }
+      if (!isInitializationRequest) {
+        const sessionError = this.validateSession(req);
+        if (sessionError) return sessionError;
+        const protocolError = this.validateProtocolVersion(req);
+        if (protocolError) return protocolError;
+      }
+      if (this._closed) return this.createJsonErrorResponse(404, -32001, "Session not found");
+      let scopeChallengeResponse;
+      try {
+        scopeChallengeResponse = await this._checkScopeChallenge(messages, options?.authInfo);
+      } catch (error) {
+        this.onerror?.(error);
+        return this.createJsonErrorResponse(500, -32603, "Internal server error");
+      }
+      if (scopeChallengeResponse) return scopeChallengeResponse;
+      if (!messages.some((element) => isJSONRPCRequest(element))) {
+        for (const message of messages) this.onmessage?.(message, {
+          authInfo: options?.authInfo,
+          request
+        });
+        return new Response(null, { status: 202 });
+      }
+      const streamId = crypto.randomUUID();
+      const initRequest = messages.find((m) => isInitializeRequest(m));
+      const clientProtocolVersion = initRequest ? initRequest.params.protocolVersion : req.headers.get("mcp-protocol-version") ?? DEFAULT_NEGOTIATED_PROTOCOL_VERSION;
+      if (this._enableJsonResponse) return new Promise((resolve) => {
+        this._streamMapping.set(streamId, {
+          resolveJson: resolve,
+          cleanup: () => {
+            this._streamMapping.delete(streamId);
+          }
+        });
+        for (const message of messages) if (isJSONRPCRequest(message)) this._requestToStreamMapping.set(message.id, streamId);
+        for (const message of messages) this.onmessage?.(message, {
+          authInfo: options?.authInfo,
+          request
+        });
+      });
+      const encoder = new TextEncoder();
+      let streamController;
+      let keepAliveTimer;
+      const readable = new ReadableStream({
+        start: (controller) => {
+          streamController = controller;
+        },
+        cancel: () => {
+          if (keepAliveTimer !== void 0) clearInterval(keepAliveTimer);
+          if (this._streamMapping.get(streamId)?.controller === streamController) this._streamMapping.delete(streamId);
+        }
+      });
+      const headers = {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache, no-transform",
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no"
+      };
+      if (this.sessionId !== void 0) headers["mcp-session-id"] = this.sessionId;
+      for (const message of messages) if (isJSONRPCRequest(message)) {
+        this._streamMapping.set(streamId, {
+          controller: streamController,
+          encoder,
+          cleanup: () => {
+            if (keepAliveTimer !== void 0) clearInterval(keepAliveTimer);
+            this._streamMapping.delete(streamId);
+            try {
+              streamController.close();
+            } catch {
+            }
+          }
+        });
+        this._requestToStreamMapping.set(message.id, streamId);
+      }
+      await this.writePrimingEvent(streamController, encoder, streamId, clientProtocolVersion);
+      for (const message of messages) {
+        let closeSSEStream;
+        let closeStandaloneSSEStream;
+        if (isJSONRPCRequest(message) && this._eventStore && this.supportsEmptySSEData(clientProtocolVersion)) {
+          closeSSEStream = () => {
+            this.closeSSEStream(message.id);
+          };
+          closeStandaloneSSEStream = () => {
+            this.closeStandaloneSSEStream();
+          };
+        }
+        this.onmessage?.(message, {
+          authInfo: options?.authInfo,
+          request,
+          closeSSEStream,
+          closeStandaloneSSEStream
+        });
+      }
+      if (this._streamMapping.get(streamId)?.controller === streamController) keepAliveTimer = this.startKeepAlive(streamController, encoder);
+      return new Response(readable, {
+        status: 200,
+        headers
+      });
+    } catch (error) {
+      this.onerror?.(error);
+      return this.createJsonErrorResponse(400, -32700, "Parse error", { data: String(error) });
+    }
+  }
+  /**
+  * Handles `DELETE` requests to terminate sessions
+  */
+  async handleDeleteRequest(req) {
+    const sessionError = this.validateSession(req);
+    if (sessionError) return sessionError;
+    const protocolError = this.validateProtocolVersion(req);
+    if (protocolError) return protocolError;
+    try {
+      await Promise.resolve(this._onsessionclosed?.(this.sessionId));
+      return new Response(null, { status: 200 });
+    } finally {
+      await this.close();
+    }
+  }
+  /**
+  * Validates session ID for non-initialization requests.
+  * Returns `Response` error if invalid, `undefined` otherwise
+  */
+  validateSession(req) {
+    if (this.sessionIdGenerator === void 0) return;
+    if (!this._initialized) {
+      this.onerror?.(/* @__PURE__ */ new Error("Bad Request: Server not initialized"));
+      return this.createJsonErrorResponse(400, -32e3, "Bad Request: Server not initialized");
+    }
+    const sessionId = req.headers.get("mcp-session-id");
+    if (!sessionId) {
+      this.onerror?.(/* @__PURE__ */ new Error("Bad Request: Mcp-Session-Id header is required"));
+      return this.createJsonErrorResponse(400, -32e3, "Bad Request: Mcp-Session-Id header is required");
+    }
+    if (sessionId !== this.sessionId) {
+      this.onerror?.(/* @__PURE__ */ new Error("Session not found"));
+      return this.createJsonErrorResponse(404, -32001, "Session not found");
+    }
+  }
+  /**
+  * Validates the `MCP-Protocol-Version` header on incoming requests.
+  *
+  * For initialization: Version negotiation handles unknown versions gracefully
+  * (server responds with its supported version).
+  *
+  * For subsequent requests with `MCP-Protocol-Version` header:
+  * - Accept if in supported list
+  * - 400 if unsupported
+  *
+  * For HTTP requests without the `MCP-Protocol-Version` header:
+  * - Accept and default to the version negotiated at initialization
+  */
+  validateProtocolVersion(req) {
+    const protocolVersion = req.headers.get("mcp-protocol-version");
+    if (protocolVersion !== null && !this._supportedProtocolVersions.includes(protocolVersion)) {
+      const error = `Bad Request: Unsupported protocol version: ${protocolVersion} (supported versions: ${this._supportedProtocolVersions.join(", ")})`;
+      this.onerror?.(new Error(error));
+      return this.createJsonErrorResponse(400, -32e3, error);
+    }
+  }
+  async close() {
+    if (this._closed) return;
+    this._closed = true;
+    for (const { cleanup } of this._streamMapping.values()) cleanup();
+    this._streamMapping.clear();
+    this._requestResponseMap.clear();
+    this.onclose?.();
+  }
+  /**
+  * Close an SSE stream for a specific request, triggering client reconnection.
+  * Use this to implement polling behavior during long-running operations -
+  * client will reconnect after the retry interval specified in the priming event.
+  */
+  closeSSEStream(requestId) {
+    const streamId = this._requestToStreamMapping.get(requestId);
+    if (!streamId) return;
+    const stream = this._streamMapping.get(streamId);
+    if (stream) stream.cleanup();
+  }
+  /**
+  * Close the standalone `GET` SSE stream, triggering client reconnection.
+  * Use this to implement polling behavior for server-initiated notifications.
+  */
+  closeStandaloneSSEStream() {
+    const stream = this._streamMapping.get(this._standaloneSseStreamId);
+    if (stream) stream.cleanup();
+  }
+  async send(message, options) {
+    let requestId = options?.relatedRequestId;
+    if (isJSONRPCResultResponse(message) || isJSONRPCErrorResponse(message)) requestId = message.id;
+    if (requestId === void 0) {
+      if (isJSONRPCResultResponse(message) || isJSONRPCErrorResponse(message)) throw new Error("Cannot send a response on a standalone SSE stream unless resuming a previous client request");
+      let eventId;
+      if (this._eventStore) eventId = await this._eventStore.storeEvent(this._standaloneSseStreamId, message);
+      const standaloneSse = this._streamMapping.get(this._standaloneSseStreamId);
+      if (standaloneSse === void 0) return;
+      if (standaloneSse.controller && standaloneSse.encoder && (eventId === void 0 || !standaloneSse.replayedEventIds?.has(eventId))) this.writeSSEEvent(standaloneSse.controller, standaloneSse.encoder, message, eventId);
+      return;
+    }
+    const streamId = this._requestToStreamMapping.get(requestId);
+    if (!streamId) throw new Error(`No connection established for request ID: ${String(requestId)}`);
+    let stream = this._streamMapping.get(streamId);
+    if (!this._enableJsonResponse) {
+      let eventId;
+      if (this._eventStore) {
+        eventId = await this._eventStore.storeEvent(streamId, message);
+        stream = this._streamMapping.get(streamId);
+      }
+      if (stream?.controller && stream?.encoder && (eventId === void 0 || !stream.replayedEventIds?.has(eventId))) this.writeSSEEvent(stream.controller, stream.encoder, message, eventId);
+    }
+    if (isJSONRPCResultResponse(message) || isJSONRPCErrorResponse(message)) {
+      this._requestResponseMap.set(requestId, message);
+      const relatedIds = [...this._requestToStreamMapping.entries()].filter(([_, sid]) => sid === streamId).map(([id]) => id);
+      if (relatedIds.every((id) => this._requestResponseMap.has(id))) {
+        if (!stream) {
+          if (this._enableJsonResponse) throw new Error(`No connection established for request ID: ${String(requestId)}`);
+          if (!this._eventStore) {
+            this.onerror?.(/* @__PURE__ */ new Error(`Response for request ID ${String(requestId)} is undeliverable: per-request stream is disconnected and no eventStore is configured`));
+            for (const id of relatedIds) {
+              this._requestResponseMap.delete(id);
+              this._requestToStreamMapping.delete(id);
+            }
+            return;
+          }
+          for (const id of relatedIds) {
+            this._requestResponseMap.delete(id);
+            this._requestToStreamMapping.delete(id);
+          }
+          return;
+        }
+        if (this._enableJsonResponse && stream.resolveJson) {
+          const headers = { "Content-Type": "application/json" };
+          if (this.sessionId !== void 0) headers["mcp-session-id"] = this.sessionId;
+          const responses = relatedIds.map((id) => this._requestResponseMap.get(id));
+          if (responses.length === 1) stream.resolveJson(Response.json(responses[0], {
+            status: 200,
+            headers
+          }));
+          else stream.resolveJson(Response.json(responses, {
+            status: 200,
+            headers
+          }));
+          stream.cleanup();
+        } else stream.cleanup();
+        for (const id of relatedIds) {
+          this._requestResponseMap.delete(id);
+          this._requestToStreamMapping.delete(id);
+        }
+      }
+    }
+  }
+};
+function echoableRequestId(body) {
+  if (body === null || typeof body !== "object" || Array.isArray(body)) return null;
+  const { method, id } = body;
+  if (typeof method !== "string") return null;
+  return typeof id === "string" || typeof id === "number" ? id : null;
+}
+function jsonRpcErrorResponse(httpStatus, code, message, data, id = null) {
+  return Response.json({
+    jsonrpc: "2.0",
+    error: {
+      code,
+      message,
+      ...data !== void 0 && { data }
+    },
+    id
+  }, { status: httpStatus });
+}
+function rejectionResponse(rejection2, id = null) {
+  return jsonRpcErrorResponse(rejection2.httpStatus, rejection2.code, rejection2.message, rejection2.data, id);
+}
+function toError(value) {
+  return value instanceof Error ? value : new Error(String(value));
+}
+function internalServerErrorResponse(id = null) {
+  return jsonRpcErrorResponse(500, -32603, "Internal server error", void 0, id);
+}
+function assertNotServing(server) {
+  if (server.transport !== void 0) throw new Error("The factory returned an instance that is still serving another request. Return a new instance for each request.");
+}
+function createLegacyStatelessFallback(factory, onerror, keepAliveMs, maxRequestBodySize) {
+  return async (request, options) => {
+    if (request.method.toUpperCase() !== "POST") return jsonRpcErrorResponse(405, -32e3, "Method not allowed.");
+    try {
+      const product = await factory({
+        era: "legacy",
+        ...options?.authInfo !== void 0 && { authInfo: options.authInfo },
+        requestInfo: request
+      });
+      const transport = new WebStandardStreamableHTTPServerTransport({
+        sessionIdGenerator: void 0,
+        ...keepAliveMs !== void 0 && { keepAliveMs },
+        ...maxRequestBodySize !== void 0 && { maxRequestBodySize }
+      });
+      await product.connect(transport);
+      const teardown = () => {
+        transport.close().catch(() => {
+        });
+        product.close().catch(() => {
+        });
+      };
+      request.signal?.addEventListener("abort", teardown, { once: true });
+      const response = await transport.handleRequest(request, {
+        ...options?.authInfo !== void 0 && { authInfo: options.authInfo },
+        ...options?.parsedBody !== void 0 && { parsedBody: options.parsedBody }
+      });
+      if (response.body === null || mediaTypeEssence(response.headers.get("content-type")) !== "text/event-stream") {
+        teardown();
+        return response;
+      }
+      const reader = response.body.getReader();
+      let toreDown = false;
+      const completeExchange = () => {
+        if (!toreDown) {
+          toreDown = true;
+          teardown();
+        }
+      };
+      const monitoredBody = new ReadableStream({
+        pull: async (controller) => {
+          try {
+            const { done, value } = await reader.read();
+            if (done) {
+              completeExchange();
+              controller.close();
+              return;
+            }
+            if (value !== void 0) controller.enqueue(value);
+          } catch (error) {
+            completeExchange();
+            controller.error(error);
+          }
+        },
+        cancel: (reason) => {
+          completeExchange();
+          return reader.cancel(reason).catch(() => {
+          });
+        }
+      });
+      return new Response(monitoredBody, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers
+      });
+    } catch (error) {
+      try {
+        onerror?.(toError(error));
+      } catch {
+      }
+      return internalServerErrorResponse(echoableRequestId(options?.parsedBody));
+    }
+  };
+}
+function standardHeadersOf(request) {
+  return {
+    protocolVersionHeader: request.headers.get("mcp-protocol-version") ?? void 0,
+    mcpMethodHeader: request.headers.get("mcp-method") ?? void 0,
+    mcpNameHeader: request.headers.get("mcp-name") ?? void 0
+  };
+}
+async function classifyEntryRequest(request, providedParsedBody, needsForward = true, maxRequestBodySize = DEFAULT_MAX_REQUEST_BODY_SIZE) {
+  const httpMethod = request.method.toUpperCase();
+  let body;
+  let parsedBody = providedParsedBody;
+  let forwardRequest = request;
+  let unparseable = false;
+  if (httpMethod === "POST") {
+    if (parsedBody === void 0) {
+      if (needsForward) forwardRequest = request.clone();
+      let bodyText;
+      try {
+        const read = await readRequestBody(request, maxRequestBodySize);
+        if (read.tooLarge) return { step: "body-too-large" };
+        bodyText = read.text;
+      } catch {
+        return { step: "unreadable-body" };
+      }
+      try {
+        body = bodyText.length === 0 ? void 0 : JSON.parse(bodyText);
+      } catch {
+        unparseable = true;
+      }
+      if (!unparseable && body !== void 0) parsedBody = body;
+    } else body = parsedBody;
+    if (unparseable || body === void 0) return {
+      step: "no-json-body",
+      forwardRequest
+    };
+  }
+  return {
+    step: "classified",
+    outcome: classifyInboundRequest({
+      httpMethod,
+      ...standardHeadersOf(request),
+      ...body !== void 0 && { body }
+    }),
+    body,
+    parsedBody,
+    forwardRequest
+  };
+}
+async function isLegacyRequest(request, parsedBody, options) {
+  const maxRequestBodySize = resolveMaxRequestBodySize(options?.maxRequestBodySize);
+  const classified = await classifyEntryRequest(parsedBody === void 0 && request.method.toUpperCase() === "POST" ? request.clone() : request, parsedBody, false, maxRequestBodySize);
+  return classified.step === "no-json-body" || classified.step === "classified" && classified.outcome.kind === "legacy";
+}
+function createMcpHandler(factory, options = {}) {
+  const { legacy, onerror, responseMode } = options;
+  const maxRequestBodySize = resolveMaxRequestBodySize(options.maxRequestBodySize);
+  if (typeof legacy === "function") throw new TypeError("The 'legacy' option only accepts 'stateless' or 'reject', not a handler function. To serve 2025-era traffic with your own handler, route in user land with the exported isLegacyRequest(request) predicate in front of a strict (legacy: 'reject') handler.");
+  const inflight = /* @__PURE__ */ new Set();
+  let closed = false;
+  const reportError = (error) => {
+    try {
+      onerror?.(error);
+    } catch {
+    }
+  };
+  const bus = options.bus ?? new InMemoryServerEventBus(reportError);
+  const notify = createServerNotifier(bus);
+  const listenRouter = createListenRouter({
+    bus,
+    maxSubscriptions: options.maxSubscriptions ?? DEFAULT_MAX_SUBSCRIPTIONS,
+    keepAliveMs: options.keepAliveMs ?? DEFAULT_SSE_KEEP_ALIVE_MS,
+    onerror: reportError
+  });
+  if (responseMode === "json") console.warn("responseMode: 'json' drops mid-call notifications. subscriptions/listen streams are always served over SSE regardless; other notifications emitted before a result are dropped.");
+  const legacyHandler = legacy === "reject" ? void 0 : createLegacyStatelessFallback(factory, reportError, options.keepAliveMs, maxRequestBodySize);
+  async function serveModern(route, request, authInfo) {
+    const claimedRevision = route.classification.revision;
+    if (claimedRevision === void 0 || !SUPPORTED_MODERN_PROTOCOL_VERSIONS.includes(claimedRevision)) {
+      const error = new UnsupportedProtocolVersionError({
+        supported: [...SUPPORTED_MODERN_PROTOCOL_VERSIONS],
+        requested: claimedRevision ?? "unknown"
+      });
+      reportError(error);
+      return jsonRpcErrorResponse(400, error.code, error.message, error.data, echoableRequestId(route.message));
+    }
+    const stdHeaderRejection = validateStandardRequestHeaders({
+      httpMethod: request.method,
+      ...standardHeadersOf(request)
+    }, route);
+    if (stdHeaderRejection !== void 0) {
+      reportError(/* @__PURE__ */ new Error(`Rejected inbound request (${stdHeaderRejection.cell}): ${stdHeaderRejection.message}`));
+      return rejectionResponse(stdHeaderRejection, echoableRequestId(route.message));
+    }
+    const meta = route.messageKind === "request" ? requestMetaOf(route.message.params) : void 0;
+    const declaredClientCapabilities = meta?.[CLIENT_CAPABILITIES_META_KEY];
+    if (route.messageKind === "request") {
+      const required = requiredClientCapabilitiesForRequest(route.message.method);
+      if (required !== void 0) {
+        const missing = missingClientCapabilities(required, declaredClientCapabilities);
+        if (missing !== void 0) {
+          const error = new MissingRequiredClientCapabilityError({ requiredCapabilities: missing });
+          reportError(error);
+          return jsonRpcErrorResponse(httpStatusForErrorCode(error.code, "ladder"), error.code, error.message, error.data, route.message.id);
+        }
+      }
+    }
+    const product = await factory({
+      era: "modern",
+      ...authInfo !== void 0 && { authInfo },
+      requestInfo: request
+    });
+    const server = product instanceof McpServer ? product.server : product;
+    assertNotServing(server);
+    if (route.messageKind === "request" && route.message.method === "subscriptions/listen") {
+      const capabilities = server.getCapabilities();
+      const serverInfo = serverIdentityOf(server);
+      product.close().catch(reportError);
+      return listenRouter.serve(route.message, request.signal, capabilities, serverInfo);
+    }
+    if (route.messageKind === "request" && route.message.method === "tools/call" && product instanceof McpServer) {
+      const callParams = route.message.params;
+      const toolName = typeof callParams?.name === "string" ? callParams.name : void 0;
+      const inputSchema = toolName === void 0 ? void 0 : product.toolInputSchemaJson(toolName);
+      if (inputSchema !== void 0) {
+        const scan = scanXMcpHeaderDeclarations(inputSchema);
+        if (scan.valid && scan.declarations.length > 0) {
+          const rejection2 = validateMcpParamHeaders(scan.declarations, callParams?.arguments, request.headers);
+          if (rejection2 !== void 0) {
+            product.close().catch(reportError);
+            reportError(/* @__PURE__ */ new Error(`Rejected inbound request (${rejection2.cell}): ${rejection2.message}`));
+            return rejectionResponse(rejection2, route.message.id);
+          }
+        }
+      }
+    }
+    if (route.messageKind === "request" && product instanceof McpServer) try {
+      const challenge = await findScopeChallenge([route.message], authInfo, (context) => product.resolveScopeChallenge(context));
+      if (challenge !== void 0) {
+        product.close().catch(reportError);
+        return createScopeChallengeResponse(challenge, scopeChallengeResourceMetadataUrl(authInfo));
+      }
+    } catch (error) {
+      product.close().catch(reportError);
+      reportError(toError(error));
+      return internalServerErrorResponse(route.message.id);
+    }
+    assertNotServing(server);
+    setNegotiatedProtocolVersion(server, claimedRevision);
+    installModernOnlyHandlers(server, SUPPORTED_MODERN_PROTOCOL_VERSIONS);
+    if (meta !== void 0) seedClientIdentityFromEnvelope(server, {
+      clientInfo: meta[CLIENT_INFO_META_KEY],
+      clientCapabilities: declaredClientCapabilities
+    });
+    const previousOnClose = server.onclose;
+    inflight.add(server);
+    const onExchangeClose = () => {
+      inflight.delete(server);
+      if (server.onclose === onExchangeClose) server.onclose = previousOnClose;
+      previousOnClose?.();
+    };
+    server.onclose = onExchangeClose;
+    try {
+      const response = await invoke(product, route.message, {
+        classification: route.classification,
+        request,
+        ...authInfo !== void 0 && { authInfo },
+        ...responseMode !== void 0 && { responseMode },
+        ...options.keepAliveMs !== void 0 && { keepAliveMs: options.keepAliveMs }
+      });
+      if (route.messageKind === "notification") queueMicrotask(() => void server.close().catch(() => {
+      }));
+      return response;
+    } catch (error) {
+      if (error instanceof SdkError && error.code === SdkErrorCode.ConnectionClosed) return new Response(null, { status: 499 });
+      await server.close().catch(() => {
+      });
+      inflight.delete(server);
+      reportError(toError(error));
+      return internalServerErrorResponse(echoableRequestId(route.message));
+    }
+  }
+  async function serveLegacyRoute(route, forwardRequest, authInfo, parsedBody) {
+    if (legacyHandler !== void 0) return legacyHandler(forwardRequest, {
+      ...authInfo !== void 0 && { authInfo },
+      ...parsedBody !== void 0 && { parsedBody }
+    });
+    const strict = modernOnlyStrictRejection(route, SUPPORTED_MODERN_PROTOCOL_VERSIONS);
+    if (strict === void 0) return new Response(null, { status: 202 });
+    reportError(/* @__PURE__ */ new Error(`Rejected 2025-era request on a modern-only endpoint (${strict.cell}): ${strict.message}`));
+    return rejectionResponse(strict, echoableRequestId(parsedBody));
+  }
+  async function handle(request, requestOptions) {
+    const authInfo = requestOptions?.authInfo;
+    if (request.method.toUpperCase() === "POST" && !isJsonContentType(request.headers.get("content-type"))) {
+      reportError(/* @__PURE__ */ new Error("Unsupported Media Type: Content-Type must be application/json"));
+      return jsonRpcErrorResponse(415, -32e3, "Unsupported Media Type: Content-Type must be application/json");
+    }
+    const classified = await classifyEntryRequest(request, requestOptions?.parsedBody, true, maxRequestBodySize);
+    if (classified.step === "unreadable-body") return jsonRpcErrorResponse(400, -32700, "Parse error: the request body could not be read");
+    if (classified.step === "body-too-large") return jsonRpcErrorResponse(413, -32e3, requestBodyTooLargeMessage(maxRequestBodySize));
+    if (classified.step === "no-json-body") {
+      if (legacyHandler !== void 0) return legacyHandler(classified.forwardRequest, { ...authInfo !== void 0 && { authInfo } });
+      return jsonRpcErrorResponse(400, -32700, "Parse error: the request body is not valid JSON");
+    }
+    const { outcome, body, parsedBody, forwardRequest } = classified;
+    try {
+      switch (outcome.kind) {
+        case "reject":
+          reportError(/* @__PURE__ */ new Error(`Rejected inbound request (${outcome.cell}): ${outcome.message}`));
+          return rejectionResponse(outcome, echoableRequestId(body));
+        case "modern":
+          return await serveModern(outcome, request, authInfo);
+        case "legacy":
+          return await serveLegacyRoute(outcome, forwardRequest, authInfo, parsedBody);
+      }
+    } catch (error) {
+      reportError(toError(error));
+      return internalServerErrorResponse(echoableRequestId(body));
+    }
+  }
+  const fetchFace = async (request, requestOptions) => {
+    if (closed) throw new Error("This MCP handler has been closed");
+    try {
+      return await handle(request, requestOptions);
+    } catch (error) {
+      reportError(toError(error));
+      return internalServerErrorResponse(echoableRequestId(requestOptions?.parsedBody));
+    }
+  };
+  return {
+    fetch: fetchFace,
+    notify,
+    bus,
+    close: async () => {
+      closed = true;
+      listenRouter.closeAll();
+      const closing = [...inflight].map((server) => server.close().catch(() => {
+      }));
+      inflight.clear();
+      await Promise.all(closing);
+    }
+  };
+}
+
+// src/server.ts
+import { readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+
+// src/lib/onboarding-copy.ts
+var ONBOARDING_OFFER_CONTROL_VARIANT = "control";
+var ONBOARDING_OFFER_COPY = {
+  // #4089 review: this cohort has already completed OAuth to connect - they
+  // have an account. Never claim "no account needed" or otherwise imply an
+  // anonymous/no-sign-up lane here; that framing contradicts what they just
+  // did and reads as broken. Acknowledge the connection instead, then offer
+  // to build. (The anonymous/no-auth entry point is a different surface,
+  // #4088 - not this cohort.)
+  [ONBOARDING_OFFER_CONTROL_VARIANT]: "When this is the start of a new conversation and the user has not yet said what they want to build, welcome them as someone who is now connected to Clipform and offer to build their first form together, then offer these starting points as plain text: lead-gen, feedback, quiz, or something else - ask which one fits, or invite them to describe what they need instead. If the user's first message already states what they want to build, even loosely, skip that offer entirely and go straight into the brief-driven flow below."
+};
+function buildOnboardingOffer(variant = ONBOARDING_OFFER_CONTROL_VARIANT) {
+  return ONBOARDING_OFFER_COPY[variant] ?? ONBOARDING_OFFER_COPY[ONBOARDING_OFFER_CONTROL_VARIANT];
 }
 var ONBOARDING_OFFER_TOOL_CUE = "If the user hasn't said what to build yet, offer to build their first form and suggest starting points: lead-gen, feedback, quiz, or something else.";
 
@@ -17907,7 +19851,7 @@ Quiz variants (optional): ${QUIZ_VARIANTS.join(", ")} - returns the variant-spec
 Optional args by type:
 - quiz: topic, question_count (8)
 - quiz (variant: personality): topic, categories, question_count (8)
-- quiz (variant: comprehension): youtube_url, question_count (8), audience
+- quiz (variant: comprehension): question_count (8), audience
 - interview: purpose, response_format (all), needs_consent (true)
 - survey: topic, anonymous (true)
 - funnel: outcomes, criteria, needs_contact (true)
@@ -17922,7 +19866,6 @@ Optional args by type:
         topic: external_exports.string().optional().describe("Topic or theme (quiz, survey)"),
         question_count: external_exports.number().optional().describe("Number of questions, default 8 (quiz types)"),
         categories: external_exports.string().optional().describe("Comma-separated outcome categories (quiz variant: personality)"),
-        youtube_url: external_exports.string().optional().describe("YouTube video URL (quiz variant: comprehension)"),
         audience: external_exports.string().optional().describe("Target audience (quiz variant: comprehension)"),
         purpose: external_exports.string().optional().describe("What you're collecting (interview)"),
         response_format: external_exports.enum(["video", "audio", "text", "all"]).optional().describe("How respondents reply (interview)"),
@@ -18097,6 +20040,12 @@ function createServer(options) {
       };
     });
   }
+  const declared = rawServer.getCapabilities();
+  const noListChanged = {};
+  for (const key of ["tools", "prompts", "resources"]) {
+    if (declared[key]) noListChanged[key] = { listChanged: false };
+  }
+  rawServer.registerCapabilities(noListChanged);
   if (baseCallToolHandler) {
     nativeSetRequestHandler("tools/call", async (request, extra) => {
       try {
@@ -18121,6 +20070,8 @@ export {
   ReadBuffer,
   serializeMessage,
   process2 as process,
+  isLegacyRequest,
+  createMcpHandler,
   RENDER_TIMING,
   MCP_SERVER_IDENTITY,
   buildInstructions,
@@ -18135,4 +20086,4 @@ export {
   * MIT Licensed
   *)
 */
-//# sourceMappingURL=chunk-MSLK3FRO.js.map
+//# sourceMappingURL=chunk-5A66GD3U.js.map