@duckmind/dm-linux-x64 0.65.8 → 0.66.2

package/extensions/dm-mcp-adapter/dist/mcp-oauth-provider.js

@@ -1,524 +0,0 @@
-import { UnauthorizedError } from "@modelcontextprotocol/client";
-import { getAuthForUrl, updateTokens, updateClientInfo, clearAllCredentials, clearCodeVerifier, invalidateAuthEntryCache, captureOAuthAuthority } from "./mcp-auth.js";
-import { OAuthMetadataSchema, OpenIdProviderDiscoveryMetadataSchema } from "@modelcontextprotocol/core";
-import { createOAuthFetch } from "./mcp-auth-fetch.js";
-import { resolveCommandSecret } from "./utils.js";
-import { getAppClientUri, getAppName } from "./agent-dir.js";
-function defaultClientName() {
-  const app = getAppName();
-  return app === "dm" || app === "pi" ? "DM Coding Agent" : app;
-}
-function defaultClientUri() {
-  const declared = getAppClientUri();
-  if (declared)
-    return declared;
-  return;
-}
-function issuersMatch(first, second) {
-  return first === second || first.endsWith("/") && first.slice(0, -1) === second || second.endsWith("/") && second.slice(0, -1) === first;
-}
-function toOAuthTokens(tokens) {
-  const result = {
-    access_token: tokens.accessToken,
-    token_type: "Bearer"
-  };
-  if (tokens.refreshToken !== undefined)
-    result.refresh_token = tokens.refreshToken;
-  if (tokens.expiresAt !== undefined)
-    result.expires_in = Math.max(0, Math.floor(tokens.expiresAt - Date.now() / 1000));
-  if (tokens.scope !== undefined)
-    result.scope = tokens.scope;
-  if (tokens.issuer !== undefined)
-    result.issuer = tokens.issuer;
-  return result;
-}
-const DEFAULT_OAUTH_CALLBACK_PORT = 19876;
-const DEFAULT_OAUTH_CALLBACK_PATH = "/callback";
-let configuredOAuthCallbackPort = DEFAULT_OAUTH_CALLBACK_PORT;
-if (process.env.MCP_OAUTH_CALLBACK_PORT) {
-  const parsedPort = Number.parseInt(process.env.MCP_OAUTH_CALLBACK_PORT, 10);
-  if (Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535) {
-    configuredOAuthCallbackPort = parsedPort;
-  }
-}
-let oauthCallbackPort = configuredOAuthCallbackPort;
-let oauthCallbackPath = DEFAULT_OAUTH_CALLBACK_PATH;
-export function getConfiguredOAuthCallbackPort() {
-  return configuredOAuthCallbackPort;
-}
-export function getOAuthCallbackPort() {
-  return oauthCallbackPort;
-}
-export function setOAuthCallbackPort(port) {
-  oauthCallbackPort = port;
-}
-export function getOAuthCallbackPath() {
-  return oauthCallbackPath;
-}
-export function setOAuthCallbackPath(path) {
-  oauthCallbackPath = path.startsWith("/") ? path : `/${path}`;
-}
-const reservedAuthorizationParams = new Set([
-  "client_id",
-  "code_challenge",
-  "code_challenge_method",
-  "redirect_uri",
-  "resource",
-  "response_type",
-  "scope",
-  "state"
-]);
-function addAuthorizationParams(authorizationUrl, params) {
-  if (!params)
-    return authorizationUrl;
-  const nextUrl = new URL(authorizationUrl.toString());
-  for (const [key, value] of Object.entries(params)) {
-    if (reservedAuthorizationParams.has(key) || nextUrl.searchParams.has(key)) {
-      throw new Error(`OAuth authorizationParams.${key} cannot override an authorization flow parameter`);
-    }
-    nextUrl.searchParams.set(key, value);
-  }
-  return nextUrl;
-}
-function inferIssuerFromMetadataUrl(metadataUrl) {
-  const url = new URL(metadataUrl);
-  const pathname = url.pathname.replace(/\/+$/, "") || "/";
-  const oauthPrefix = "/.well-known/oauth-authorization-server";
-  if (pathname === oauthPrefix || pathname.startsWith(`${oauthPrefix}/`)) {
-    const issuerPath = pathname.slice(oauthPrefix.length) || "/";
-    return new URL(issuerPath, url.origin).toString();
-  }
-  const oidcPath = "/.well-known/openid-configuration";
-  if (pathname === oidcPath || pathname.startsWith(`${oidcPath}/`)) {
-    const issuerPath = pathname.slice(oidcPath.length) || "/";
-    return new URL(issuerPath, url.origin).toString();
-  }
-  if (pathname.endsWith(oidcPath)) {
-    const issuerPath = pathname.slice(0, -oidcPath.length) || "/";
-    return new URL(issuerPath, url.origin).toString();
-  }
-  return;
-}
-function validateConfiguredIssuer(metadataUrl, issuer, skipIssuerValidation) {
-  let parsedIssuer;
-  try {
-    parsedIssuer = new URL(issuer);
-  } catch (error) {
-    throw new Error("OAuth authorization-server metadata issuer must be an absolute URL", { cause: error });
-  }
-  if (parsedIssuer.protocol !== "http:" && parsedIssuer.protocol !== "https:") {
-    throw new Error("OAuth authorization-server metadata issuer must use http:// or https://");
-  }
-  const expectedIssuer = inferIssuerFromMetadataUrl(metadataUrl);
-  if (skipIssuerValidation)
-    return;
-  if (expectedIssuer !== undefined && !issuersMatch(expectedIssuer, issuer)) {
-    throw new Error(`OAuth authorization-server metadata issuer does not match authServerMetadataUrl: expected ${expectedIssuer}`);
-  }
-  if (expectedIssuer === undefined && !issuersMatch(new URL(metadataUrl).origin, issuer)) {
-    throw new Error(`OAuth authorization-server metadata issuer does not match authServerMetadataUrl origin: expected ${new URL(metadataUrl).origin}`);
-  }
-}
-async function loadConfiguredDiscoveryState(metadataUrl, serverUrl, skipIssuerValidation, fetchFn) {
-  const response = await fetchFn(metadataUrl, {
-    headers: { accept: "application/json" }
-  });
-  if (!response.ok) {
-    await response.text().catch(() => {});
-    throw new Error(`OAuth authServerMetadataUrl request failed with HTTP ${response.status}`);
-  }
-  const payload = await response.json();
-  const oauthResult = OAuthMetadataSchema.safeParse(payload);
-  const metadata = oauthResult.success ? oauthResult.data : OpenIdProviderDiscoveryMetadataSchema.parse(payload);
-  validateConfiguredIssuer(metadataUrl, metadata.issuer, skipIssuerValidation);
-  const resource = new URL(serverUrl);
-  resource.hash = "";
-  return {
-    authorizationServerUrl: metadata.issuer,
-    authorizationServerMetadata: metadata,
-    resourceMetadata: { resource: resource.toString() }
-  };
-}
-
-export class McpOAuthProvider {
-  serverName;
-  serverUrl;
-  config;
-  callbacks;
-  storageOptions;
-  runtimeSignal;
-  clientMetadataUrl;
-  redirectUrlSnapshot;
-  authFetch;
-  active = true;
-  flowClientInfo;
-  flowCodeVerifier;
-  flowDiscoveryState;
-  flowIssuerMismatch = false;
-  flowState;
-  invalidatedAccessToken;
-  invalidatedClientId;
-  staleRedirectClientId;
-  lastObservedClientId;
-  lastSavedAccessToken;
-  pendingAuthAccessToken;
-  assertAuthority;
-  constructor(serverName, serverUrl, config, callbacks, storageOptions = {}, runtimeSignal, initialState, authority) {
-    this.serverName = serverName;
-    this.serverUrl = serverUrl;
-    this.config = config;
-    this.callbacks = callbacks;
-    this.storageOptions = storageOptions;
-    this.runtimeSignal = runtimeSignal;
-    this.assertAuthority = authority ?? captureOAuthAuthority(serverName);
-    this.assertAuthority();
-    if (config.clientId === undefined && config.clientMetadataUrl !== undefined) {
-      this.clientMetadataUrl = config.clientMetadataUrl;
-    }
-    this.authFetch = createOAuthFetch(serverUrl, undefined, runtimeSignal);
-    this.flowState = initialState;
-    this.redirectUrlSnapshot = config.grantType === "client_credentials" ? undefined : config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`;
-  }
-  setAuthFetch(fetchFn) {
-    this.authFetch = fetchFn;
-  }
-  get usesClientCredentials() {
-    return this.config.grantType === "client_credentials";
-  }
-  get discoveredIssuer() {
-    return this.flowDiscoveryState?.authorizationServerMetadata?.issuer ?? this.flowDiscoveryState?.authorizationServerUrl;
-  }
-  deactivate() {
-    this.active = false;
-    this.invalidatedAccessToken = undefined;
-    this.invalidatedClientId = undefined;
-    this.staleRedirectClientId = undefined;
-    this.lastObservedClientId = undefined;
-    this.lastSavedAccessToken = undefined;
-    this.pendingAuthAccessToken = undefined;
-  }
-  assertStoredIssuerBindings(entry, issuer) {
-    if (this.flowIssuerMismatch) {
-      throw new Error(`OAuth authorization server issuer changed for ${this.serverName}; clear credentials before authenticating again`);
-    }
-    if (!entry || !issuer)
-      return;
-    const storedIssuers = [entry.clientInfo?.issuer, entry.tokens?.issuer].filter((storedIssuer) => storedIssuer !== undefined);
-    if (storedIssuers.some((storedIssuer) => !issuersMatch(storedIssuer, issuer))) {
-      this.flowIssuerMismatch = true;
-      throw new Error(`OAuth authorization server issuer changed for ${this.serverName}; clear credentials before authenticating again`);
-    }
-  }
-  throwIfInactive() {
-    if (!this.active)
-      throw new Error("OAuth flow is no longer active");
-    this.assertAuthority();
-    this.runtimeSignal?.throwIfAborted();
-    this.authFetch.throwIfHeaderResolutionFailed();
-  }
-  get redirectUrl() {
-    return this.redirectUrlSnapshot;
-  }
-  get clientUri() {
-    return this.config.clientUri ?? defaultClientUri();
-  }
-  get clientMetadata() {
-    if (this.usesClientCredentials) {
-      return {
-        client_name: this.config.clientName ?? defaultClientName(),
-        ...this.clientUri !== undefined ? { client_uri: this.clientUri } : {},
-        ...this.config.logoUri !== undefined ? { logo_uri: this.config.logoUri } : {},
-        redirect_uris: [],
-        grant_types: ["client_credentials"],
-        token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none"
-      };
-    }
-    const redirectUrl = this.redirectUrl;
-    if (!redirectUrl) {
-      throw new Error("redirectUrl is required for authorization_code flow");
-    }
-    return {
-      redirect_uris: [redirectUrl],
-      client_name: this.config.clientName ?? defaultClientName(),
-      ...this.clientUri !== undefined ? { client_uri: this.clientUri } : {},
-      ...this.config.logoUri !== undefined ? { logo_uri: this.config.logoUri } : {},
-      grant_types: ["authorization_code", "refresh_token"],
-      response_types: ["code"],
-      token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none",
-      ...this.config.scope !== undefined ? { scope: this.config.scope } : {}
-    };
-  }
-  async clientInformation() {
-    this.throwIfInactive();
-    if (this.invalidatedClientId !== undefined) {
-      invalidateAuthEntryCache(this.serverName);
-    }
-    const issuer = this.discoveredIssuer;
-    const stored = await getAuthForUrl(this.serverName, this.serverUrl, this.storageOptions);
-    this.throwIfInactive();
-    this.assertStoredIssuerBindings(stored, issuer);
-    if (this.config.clientId) {
-      const storedClient = stored?.clientInfo?.clientId === this.config.clientId ? stored.clientInfo : undefined;
-      if (issuer && (storedClient?.issuer !== issuer || storedClient.configPreRegistered !== true)) {
-        this.throwIfInactive();
-        updateClientInfo(this.serverName, { clientId: this.config.clientId, issuer, configPreRegistered: true }, this.serverUrl, this.storageOptions);
-      }
-      const clientSecret = this.config.clientSecret?.startsWith("!") ? resolveCommandSecret(this.config.clientSecret, `MCP server "${this.serverName}" OAuth clientSecret`) : this.config.clientSecret;
-      return {
-        client_id: this.config.clientId,
-        client_secret: clientSecret,
-        ...issuer !== undefined ? { issuer } : {}
-      };
-    }
-    const clientInfo = this.flowClientInfo ?? stored?.clientInfo;
-    if (clientInfo?.clientId === this.invalidatedClientId)
-      return;
-    const clientMetadataUrl = this.clientMetadataUrl;
-    const supportsClientMetadataDocument = this.flowDiscoveryState?.authorizationServerMetadata?.client_id_metadata_document_supported;
-    if (clientMetadataUrl !== undefined && supportsClientMetadataDocument !== undefined) {
-      if (supportsClientMetadataDocument === true && clientInfo?.clientId !== clientMetadataUrl && (stored?.tokens?.refreshToken === undefined || this.invalidatedAccessToken !== undefined)) {
-        return;
-      }
-      if (supportsClientMetadataDocument !== true && clientInfo?.clientId === clientMetadataUrl) {
-        return;
-      }
-    }
-    if (clientInfo) {
-      this.invalidatedClientId = undefined;
-      const isConfiguredCimd = clientMetadataUrl !== undefined && clientInfo.clientId === clientMetadataUrl;
-      const isConfigStub = clientInfo.configPreRegistered === true || clientInfo.clientSecret === undefined && clientInfo.clientIdIssuedAt === undefined && clientInfo.clientSecretExpiresAt === undefined && clientInfo.redirectUris === undefined;
-      if (isConfigStub && !isConfiguredCimd) {
-        return;
-      }
-      if (clientInfo.clientSecretExpiresAt && clientInfo.clientSecretExpiresAt < Date.now() / 1000) {
-        return;
-      }
-      if (issuer && clientInfo.issuer && !issuersMatch(clientInfo.issuer, issuer)) {
-        return;
-      }
-      if (issuer && clientInfo.issuer === undefined) {
-        clientInfo.issuer = issuer;
-        this.flowClientInfo = clientInfo;
-        this.throwIfInactive();
-        updateClientInfo(this.serverName, clientInfo, this.serverUrl, this.storageOptions);
-      }
-      const redirectUriIsStale = this.redirectUrl !== undefined && (!Array.isArray(clientInfo.redirectUris) || !clientInfo.redirectUris.includes(this.redirectUrl));
-      this.staleRedirectClientId = redirectUriIsStale ? clientInfo.clientId : undefined;
-      this.lastObservedClientId = clientInfo.clientId;
-      return {
-        client_id: clientInfo.clientId,
-        client_secret: clientInfo.clientSecret,
-        ...clientInfo.clientIdIssuedAt !== undefined ? { client_id_issued_at: clientInfo.clientIdIssuedAt } : {},
-        ...clientInfo.clientSecretExpiresAt !== undefined ? { client_secret_expires_at: clientInfo.clientSecretExpiresAt } : {},
-        ...clientInfo.redirectUris !== undefined ? { redirect_uris: clientInfo.redirectUris } : {},
-        ...clientInfo.issuer !== undefined ? { issuer: clientInfo.issuer } : {}
-      };
-    }
-    return;
-  }
-  async saveClientInformation(info) {
-    this.throwIfInactive();
-    const issuer = this.discoveredIssuer ?? info.issuer;
-    if (this.config.clientId && info.client_id === this.config.clientId) {
-      updateClientInfo(this.serverName, {
-        clientId: info.client_id,
-        ...issuer !== undefined ? { issuer } : {},
-        configPreRegistered: true
-      }, this.serverUrl, this.storageOptions);
-      return;
-    }
-    const redirectUris = ("redirect_uris" in info ? info.redirect_uris : undefined) ?? (this.redirectUrl ? [this.redirectUrl] : undefined);
-    const clientInfo = {
-      clientId: info.client_id,
-      ...info.client_secret !== undefined ? { clientSecret: info.client_secret } : {},
-      ...info.client_id_issued_at !== undefined ? { clientIdIssuedAt: info.client_id_issued_at } : {},
-      ...info.client_secret_expires_at !== undefined ? { clientSecretExpiresAt: info.client_secret_expires_at } : {},
-      ...redirectUris !== undefined ? { redirectUris } : {},
-      ...issuer !== undefined ? { issuer } : {}
-    };
-    this.flowClientInfo = clientInfo;
-    this.invalidatedClientId = undefined;
-    this.lastObservedClientId = clientInfo.clientId;
-    updateClientInfo(this.serverName, clientInfo, this.serverUrl, this.storageOptions);
-  }
-  async tokens(ctx) {
-    this.throwIfInactive();
-    if (this.invalidatedAccessToken !== undefined) {
-      invalidateAuthEntryCache(this.serverName);
-    }
-    const entry = await getAuthForUrl(this.serverName, this.serverUrl, this.storageOptions);
-    this.throwIfInactive();
-    if (!entry?.tokens || entry.tokens.accessToken === this.invalidatedAccessToken)
-      return;
-    this.invalidatedAccessToken = undefined;
-    const issuer = this.discoveredIssuer;
-    this.assertStoredIssuerBindings(entry, issuer);
-    if (issuer && entry.tokens.issuer === undefined) {
-      entry.tokens.issuer = issuer;
-      this.throwIfInactive();
-      updateTokens(this.serverName, entry.tokens, this.serverUrl, this.storageOptions);
-    }
-    if (ctx !== undefined) {
-      this.pendingAuthAccessToken = entry.tokens.accessToken;
-    }
-    return toOAuthTokens(entry.tokens);
-  }
-  async saveTokens(tokens) {
-    const issuer = this.discoveredIssuer ?? tokens.issuer;
-    const storedTokens = {
-      accessToken: tokens.access_token,
-      ...tokens.refresh_token !== undefined ? { refreshToken: tokens.refresh_token } : {},
-      ...tokens.expires_in !== undefined ? { expiresAt: Date.now() / 1000 + tokens.expires_in } : {},
-      ...tokens.scope !== undefined ? { scope: tokens.scope } : {},
-      ...issuer !== undefined ? { issuer } : {}
-    };
-    this.throwIfInactive();
-    updateTokens(this.serverName, storedTokens, this.serverUrl, this.storageOptions);
-    this.invalidatedAccessToken = undefined;
-    this.lastSavedAccessToken = storedTokens.accessToken;
-    this.flowDiscoveryState = undefined;
-  }
-  async redirectToAuthorization(authorizationUrl) {
-    if (this.usesClientCredentials) {
-      throw new Error("redirectToAuthorization is not used for client_credentials flow");
-    }
-    this.throwIfInactive();
-    if (!this.flowState) {
-      throw new UnauthorizedError(`Re-authentication required for MCP server: ${this.serverName}`);
-    }
-    await this.callbacks.onRedirect(addAuthorizationParams(authorizationUrl, this.config.authorizationParams));
-  }
-  async saveCodeVerifier(codeVerifier) {
-    this.throwIfInactive();
-    this.flowCodeVerifier = codeVerifier;
-  }
-  async codeVerifier() {
-    if (this.usesClientCredentials) {
-      throw new Error("codeVerifier is not used for client_credentials flow");
-    }
-    this.throwIfInactive();
-    if (!this.flowCodeVerifier) {
-      throw new Error(`No code verifier saved for MCP server: ${this.serverName}`);
-    }
-    return this.flowCodeVerifier;
-  }
-  async saveDiscoveryState(state) {
-    this.throwIfInactive();
-    this.flowDiscoveryState = structuredClone(state);
-  }
-  async discoveryState() {
-    this.throwIfInactive();
-    if (!this.flowDiscoveryState && this.config.authServerMetadataUrl !== undefined) {
-      const discoveryState = await loadConfiguredDiscoveryState(this.config.authServerMetadataUrl, this.serverUrl, this.config.skipIssuerMetadataValidation === true, this.authFetch);
-      this.throwIfInactive();
-      this.flowDiscoveryState = discoveryState;
-    }
-    this.throwIfInactive();
-    return this.flowDiscoveryState ? structuredClone(this.flowDiscoveryState) : undefined;
-  }
-  async saveState(state) {
-    this.throwIfInactive();
-    this.flowState = state;
-  }
-  async state() {
-    if (this.usesClientCredentials) {
-      throw new Error("state is not used for client_credentials flow");
-    }
-    this.throwIfInactive();
-    if (!this.flowState) {
-      throw new UnauthorizedError(`Re-authentication required for MCP server: ${this.serverName}`);
-    }
-    return this.flowState;
-  }
-  async invalidateCredentials(type) {
-    this.throwIfInactive();
-    switch (type) {
-      case "all":
-        this.flowClientInfo = undefined;
-        this.flowCodeVerifier = undefined;
-        this.flowDiscoveryState = undefined;
-        this.flowIssuerMismatch = false;
-        this.flowState = undefined;
-        this.invalidatedAccessToken = undefined;
-        this.invalidatedClientId = undefined;
-        this.staleRedirectClientId = undefined;
-        this.lastObservedClientId = undefined;
-        this.lastSavedAccessToken = undefined;
-        this.pendingAuthAccessToken = undefined;
-        clearAllCredentials(this.serverName, this.storageOptions);
-        break;
-      case "client":
-        this.invalidatedClientId = this.lastObservedClientId;
-        this.lastObservedClientId = undefined;
-        this.flowClientInfo = undefined;
-        invalidateAuthEntryCache(this.serverName);
-        break;
-      case "tokens":
-        this.invalidatedAccessToken = this.pendingAuthAccessToken ?? this.lastSavedAccessToken;
-        this.lastSavedAccessToken = undefined;
-        this.pendingAuthAccessToken = undefined;
-        if (this.staleRedirectClientId !== undefined) {
-          this.invalidatedClientId = this.staleRedirectClientId;
-        }
-        invalidateAuthEntryCache(this.serverName);
-        break;
-      case "verifier":
-        clearCodeVerifier(this.serverName, this.storageOptions);
-        break;
-      case "discovery":
-        this.flowDiscoveryState = undefined;
-        break;
-    }
-  }
-  addClientAuthentication = async (headers, params, _url, metadata) => {
-    this.throwIfInactive();
-    if (params.get("grant_type") === "authorization_code" && !params.has("scope") && this.config.scope) {
-      params.set("scope", this.config.scope);
-    }
-    const clientInfo = await this.clientInformation();
-    this.throwIfInactive();
-    if (!clientInfo) {
-      return;
-    }
-    const supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? [];
-    const hasClientSecret = clientInfo.client_secret !== undefined;
-    let authMethod;
-    if (supportedMethods.length === 0) {
-      authMethod = hasClientSecret ? "client_secret_post" : "none";
-    } else if (hasClientSecret && supportedMethods.includes("client_secret_basic")) {
-      authMethod = "client_secret_basic";
-    } else if (hasClientSecret && supportedMethods.includes("client_secret_post")) {
-      authMethod = "client_secret_post";
-    } else if (supportedMethods.includes("none")) {
-      authMethod = "none";
-    } else {
-      authMethod = hasClientSecret ? "client_secret_post" : "none";
-    }
-    if (authMethod === "client_secret_basic") {
-      if (!clientInfo.client_secret) {
-        throw new Error("client_secret_basic authentication requires a client_secret");
-      }
-      headers.set("Authorization", `Basic ${Buffer.from(`${clientInfo.client_id}:${clientInfo.client_secret}`).toString("base64")}`);
-      return;
-    }
-    if (!params.has("client_id")) {
-      params.set("client_id", clientInfo.client_id);
-    }
-    if (authMethod === "client_secret_post" && clientInfo.client_secret && !params.has("client_secret")) {
-      params.set("client_secret", clientInfo.client_secret);
-    }
-  };
-  prepareTokenRequest(scope) {
-    if (!this.usesClientCredentials) {
-      return;
-    }
-    const params = new URLSearchParams({ grant_type: "client_credentials" });
-    const requestedScope = scope ?? this.config.scope;
-    if (requestedScope) {
-      params.set("scope", requestedScope);
-    }
-    return params;
-  }
-}
-
-export { DEFAULT_OAUTH_CALLBACK_PORT, DEFAULT_OAUTH_CALLBACK_PATH };

package/extensions/dm-mcp-adapter/dist/mcp-probe.js

@@ -1,151 +0,0 @@
-const PROBE_TIMEOUT_MS = 5000;
-const MODERN_PROTOCOL_VERSION = "2026-07-28";
-const LEGACY_PROTOCOL_VERSION = "2025-06-18";
-const JSON_ACCEPT = "application/json, text/event-stream";
-const SSE_ACCEPT = "text/event-stream";
-const MODERN_FALLBACK_STATUSES = new Set([400, 401, 404, 405, 406, 415]);
-const POST_ENDPOINT_MISMATCH_STATUSES = new Set([404, 405, 406, 415]);
-const AMBIGUOUS_STATUSES = new Set([202, 401, 503]);
-const DISCOVER_REQUEST = {
-  jsonrpc: "2.0",
-  id: 1,
-  method: "server/discover",
-  params: {}
-};
-const INITIALIZE_REQUEST = {
-  jsonrpc: "2.0",
-  id: 1,
-  method: "initialize",
-  params: {
-    protocolVersion: LEGACY_PROTOCOL_VERSION,
-    capabilities: {},
-    clientInfo: { name: "pi-mcp-probe", version: "2.1.2" }
-  }
-};
-const MODERN_STRATEGY = {
-  kind: "modern",
-  request: {
-    method: "POST",
-    headers: {
-      Accept: JSON_ACCEPT,
-      "Content-Type": "application/json",
-      "MCP-Protocol-Version": MODERN_PROTOCOL_VERSION,
-      "Mcp-Method": "server/discover"
-    },
-    body: JSON.stringify(DISCOVER_REQUEST)
-  },
-  allowJson: true
-};
-const LEGACY_POST_STRATEGY = {
-  kind: "legacy-post",
-  request: {
-    method: "POST",
-    headers: {
-      Accept: JSON_ACCEPT,
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify(INITIALIZE_REQUEST)
-  },
-  allowJson: true
-};
-const LEGACY_SSE_STRATEGY = {
-  kind: "legacy-sse",
-  request: { headers: { Accept: SSE_ACCEPT } },
-  allowJson: false
-};
-function jsonRpcEnvelopeInfo(value) {
-  if (typeof value !== "object" || value === null || value.jsonrpc !== "2.0") {
-    return null;
-  }
-  if ("result" in value) {
-    const result = value.result;
-    return {
-      kind: "result",
-      protocolVersion: typeof result === "object" && result !== null ? result.protocolVersion : undefined
-    };
-  }
-  if ("error" in value)
-    return { kind: "error" };
-  return null;
-}
-function isBearerChallenge(response) {
-  return /(?:^|,)\s*Bearer\b/i.test(response.headers.get("www-authenticate") ?? "");
-}
-function responseKind(response) {
-  const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
-  if (contentType === "text/html")
-    return "HTML";
-  if (contentType)
-    return contentType;
-  return "an untyped response";
-}
-async function getJsonRpcEnvelopeInfo(response) {
-  try {
-    return jsonRpcEnvelopeInfo(JSON.parse(await response.text()));
-  } catch {
-    return null;
-  }
-}
-async function classifyResponse(response, strategy) {
-  const isSse = response.headers.get("content-type")?.toLowerCase().startsWith("text/event-stream");
-  if (response.ok && isSse) {
-    return { kind: "mcp", result: { isMcp: true, classification: "endpoint responded with an MCP event stream" } };
-  }
-  const envelope = strategy.allowJson || response.status === 401 ? await getJsonRpcEnvelopeInfo(response) : null;
-  if (response.ok && strategy.allowJson && envelope) {
-    if (strategy.kind === "modern" && (envelope.kind === "error" || envelope.protocolVersion !== MODERN_PROTOCOL_VERSION)) {
-      return { kind: "unsupported-modern" };
-    }
-    return {
-      kind: "mcp",
-      result: {
-        isMcp: true,
-        classification: strategy.kind === "modern" ? `endpoint supports stateless MCP ${MODERN_PROTOCOL_VERSION} server/discover` : "endpoint responded with a JSON-RPC 2.0 envelope"
-      }
-    };
-  }
-  if (response.status === 401 && isBearerChallenge(response) && envelope) {
-    return {
-      kind: "mcp",
-      result: {
-        isMcp: true,
-        classification: strategy.kind === "modern" ? `endpoint requires Bearer authentication during MCP ${MODERN_PROTOCOL_VERSION} server/discover probing` : "endpoint requires Bearer authentication and responded with a JSON-RPC 2.0 error"
-      }
-    };
-  }
-  return { kind: "unrecognized" };
-}
-async function probe(url, strategy) {
-  const response = await fetch(url, {
-    ...strategy.request,
-    signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
-  });
-  return { response, outcome: await classifyResponse(response, strategy) };
-}
-function notMcp(response) {
-  const responseDescription = `endpoint returned ${responseKind(response)} (${response.status})`;
-  return {
-    isMcp: false,
-    classification: response.status === 503 ? `${responseDescription} — server is temporarily unavailable; MCP endpoint shape could not be determined` : response.status === 202 ? `${responseDescription} — MCP endpoint shape could not be determined` : response.status === 401 ? `${responseDescription} — authentication may be required; MCP endpoint shape could not be determined` : `${responseDescription} — this URL does not appear to speak MCP`
-  };
-}
-function ambiguousNotMcp(response) {
-  return AMBIGUOUS_STATUSES.has(response.status) ? notMcp(response) : undefined;
-}
-export async function probeMcpEndpoint(url) {
-  const { response: modernResponse, outcome: modernOutcome } = await probe(url, MODERN_STRATEGY);
-  if (modernOutcome.kind === "mcp")
-    return modernOutcome.result;
-  let ambiguousResult = ambiguousNotMcp(modernResponse);
-  if (modernOutcome.kind !== "unsupported-modern" && !MODERN_FALLBACK_STATUSES.has(modernResponse.status)) {
-    return ambiguousResult ?? notMcp(modernResponse);
-  }
-  const { response: postResponse, outcome: postOutcome } = await probe(url, LEGACY_POST_STRATEGY);
-  if (postOutcome.kind === "mcp")
-    return postOutcome.result;
-  ambiguousResult ??= ambiguousNotMcp(postResponse);
-  if (!POST_ENDPOINT_MISMATCH_STATUSES.has(postResponse.status))
-    return ambiguousNotMcp(postResponse) ?? ambiguousResult ?? notMcp(postResponse);
-  const { response: getResponse, outcome: getOutcome } = await probe(url, LEGACY_SSE_STRATEGY);
-  return getOutcome.kind === "mcp" ? getOutcome.result : ambiguousNotMcp(getResponse) ?? ambiguousResult ?? notMcp(getResponse);
-}