@executor-js/plugin-mcp 0.0.1 → 0.0.2

package/dist/chunk-X3JTTDWJ.js

@@ -1,1255 +0,0 @@
-// src/sdk/binding-store.ts
-import { Effect as Effect2, Schema as Schema5 } from "effect";
-import { makeInMemoryScopedKv, scopeKv } from "@executor-js/sdk";
-
-// src/sdk/types.ts
-import { Schema } from "effect";
-var McpRemoteTransport = Schema.Literal("streamable-http", "sse", "auto");
-var McpTransport = Schema.Literal("streamable-http", "sse", "stdio", "auto");
-var McpConnectionAuth = Schema.Union(
-  Schema.Struct({ kind: Schema.Literal("none") }),
-  Schema.Struct({
-    kind: Schema.Literal("header"),
-    headerName: Schema.String,
-    secretId: Schema.String,
-    prefix: Schema.optional(Schema.String)
-  }),
-  Schema.Struct({
-    kind: Schema.Literal("oauth2"),
-    accessTokenSecretId: Schema.String,
-    refreshTokenSecretId: Schema.NullOr(Schema.String),
-    tokenType: Schema.optionalWith(Schema.String, { default: () => "Bearer" }),
-    expiresAt: Schema.NullOr(Schema.Number),
-    scope: Schema.NullOr(Schema.String)
-  })
-);
-var StringMap = Schema.Record({ key: Schema.String, value: Schema.String });
-var McpRemoteSourceData = Schema.Struct({
-  transport: Schema.Literal("remote"),
-  /** The MCP server endpoint URL */
-  endpoint: Schema.String,
-  /** Transport preference for this remote source */
-  remoteTransport: Schema.optionalWith(McpRemoteTransport, { default: () => "auto" }),
-  /** Extra query params appended to the endpoint URL */
-  queryParams: Schema.optional(StringMap),
-  /** Extra headers sent on every request */
-  headers: Schema.optional(StringMap),
-  /** Auth configuration */
-  auth: McpConnectionAuth
-});
-var McpStdioSourceData = Schema.Struct({
-  transport: Schema.Literal("stdio"),
-  /** The command to run */
-  command: Schema.String,
-  /** Arguments to the command */
-  args: Schema.optional(Schema.Array(Schema.String)),
-  /** Environment variables */
-  env: Schema.optional(StringMap),
-  /** Working directory */
-  cwd: Schema.optional(Schema.String)
-});
-var McpStoredSourceData = Schema.Union(McpRemoteSourceData, McpStdioSourceData);
-var McpToolBinding = class extends Schema.Class("McpToolBinding")({
-  toolId: Schema.String,
-  toolName: Schema.String,
-  description: Schema.NullOr(Schema.String),
-  inputSchema: Schema.optional(Schema.Unknown),
-  outputSchema: Schema.optional(Schema.Unknown)
-}) {
-};
-
-// src/sdk/oauth.ts
-import {
-  auth
-} from "@modelcontextprotocol/sdk/client/auth.js";
-import { Effect, Schema as Schema3 } from "effect";
-
-// src/sdk/errors.ts
-import { Schema as Schema2 } from "effect";
-var McpConnectionError = class extends Schema2.TaggedError()(
-  "McpConnectionError",
-  {
-    transport: Schema2.String,
-    message: Schema2.String
-  }
-) {
-};
-var McpToolDiscoveryError = class extends Schema2.TaggedError()(
-  "McpToolDiscoveryError",
-  {
-    stage: Schema2.Literal("connect", "list_tools"),
-    message: Schema2.String
-  }
-) {
-};
-var McpInvocationError = class extends Schema2.TaggedError()(
-  "McpInvocationError",
-  {
-    toolName: Schema2.String,
-    message: Schema2.String
-  }
-) {
-};
-var McpOAuthError = class extends Schema2.TaggedError()("McpOAuthError", {
-  message: Schema2.String
-}) {
-};
-
-// src/sdk/oauth.ts
-var JsonObject = Schema3.Record({ key: Schema3.String, value: Schema3.Unknown });
-var McpOAuthDiscoveryState = Schema3.Struct({
-  resourceMetadataUrl: Schema3.NullOr(Schema3.String),
-  authorizationServerUrl: Schema3.NullOr(Schema3.String),
-  resourceMetadata: Schema3.NullOr(JsonObject),
-  authorizationServerMetadata: Schema3.NullOr(JsonObject),
-  clientInformation: Schema3.NullOr(JsonObject)
-});
-var McpOAuthSession = Schema3.Struct({
-  ...McpOAuthDiscoveryState.fields,
-  endpoint: Schema3.String,
-  redirectUrl: Schema3.String,
-  codeVerifier: Schema3.String
-});
-var toJsonObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
-var CLIENT_METADATA = {
-  grant_types: ["authorization_code", "refresh_token"],
-  response_types: ["code"],
-  token_endpoint_auth_method: "none",
-  client_name: "Executor"
-};
-var extractDiscoveryState = (discoveryState, clientInformation) => ({
-  resourceMetadataUrl: discoveryState?.resourceMetadataUrl ?? null,
-  authorizationServerUrl: discoveryState?.authorizationServerUrl ?? null,
-  resourceMetadata: toJsonObject(discoveryState?.resourceMetadata),
-  authorizationServerMetadata: toJsonObject(discoveryState?.authorizationServerMetadata),
-  clientInformation: toJsonObject(clientInformation)
-});
-var callAuth = (provider, opts) => Effect.tryPromise({
-  try: () => auth(provider, opts),
-  catch: (cause) => new McpOAuthError({
-    message: cause instanceof Error ? cause.message : String(cause)
-  })
-});
-var startMcpOAuthAuthorization = (input) => Effect.gen(function* () {
-  let authorizationUrl;
-  let codeVerifier;
-  let discoveryState;
-  let clientInformation;
-  const provider = {
-    get redirectUrl() {
-      return input.redirectUrl;
-    },
-    get clientMetadata() {
-      return { ...CLIENT_METADATA, redirect_uris: [input.redirectUrl] };
-    },
-    state: () => input.state,
-    clientInformation: () => clientInformation,
-    saveClientInformation: (ci) => {
-      clientInformation = ci;
-    },
-    tokens: () => void 0,
-    saveTokens: () => void 0,
-    redirectToAuthorization: (url) => {
-      authorizationUrl = url;
-    },
-    saveCodeVerifier: (cv) => {
-      codeVerifier = cv;
-    },
-    codeVerifier: () => {
-      if (!codeVerifier) throw new Error("Code verifier not captured");
-      return codeVerifier;
-    },
-    saveDiscoveryState: (s) => {
-      discoveryState = s;
-    },
-    discoveryState: () => discoveryState
-  };
-  const result = yield* callAuth(provider, { serverUrl: input.endpoint });
-  if (result !== "REDIRECT" || !authorizationUrl || !codeVerifier) {
-    return yield* new McpOAuthError({
-      message: "OAuth flow did not produce an authorization redirect"
-    });
-  }
-  return {
-    authorizationUrl: authorizationUrl.toString(),
-    codeVerifier,
-    ...extractDiscoveryState(discoveryState, clientInformation)
-  };
-});
-var exchangeMcpOAuthCode = (input) => Effect.gen(function* () {
-  const { session } = input;
-  let tokens;
-  let discoveryState = {
-    authorizationServerUrl: session.authorizationServerUrl ?? new URL("/", session.endpoint).toString(),
-    resourceMetadataUrl: session.resourceMetadataUrl ?? void 0,
-    resourceMetadata: session.resourceMetadata,
-    authorizationServerMetadata: session.authorizationServerMetadata
-  };
-  let clientInformation = session.clientInformation;
-  const provider = {
-    get redirectUrl() {
-      return session.redirectUrl;
-    },
-    get clientMetadata() {
-      return { ...CLIENT_METADATA, redirect_uris: [session.redirectUrl] };
-    },
-    clientInformation: () => clientInformation,
-    saveClientInformation: (ci) => {
-      clientInformation = ci;
-    },
-    tokens: () => void 0,
-    saveTokens: (t) => {
-      tokens = t;
-    },
-    redirectToAuthorization: () => {
-      throw new Error("Unexpected redirect during code exchange");
-    },
-    saveCodeVerifier: () => void 0,
-    codeVerifier: () => session.codeVerifier,
-    saveDiscoveryState: (s) => {
-      discoveryState = s;
-    },
-    discoveryState: () => discoveryState
-  };
-  const result = yield* callAuth(provider, {
-    serverUrl: session.endpoint,
-    authorizationCode: input.code
-  });
-  if (result !== "AUTHORIZED" || !tokens) {
-    return yield* new McpOAuthError({
-      message: "OAuth exchange did not produce tokens"
-    });
-  }
-  return {
-    tokens,
-    ...extractDiscoveryState(discoveryState, clientInformation)
-  };
-});
-
-// src/sdk/stored-source.ts
-import { Schema as Schema4 } from "effect";
-var McpStoredSourceSchema = class extends Schema4.Class("McpStoredSource")({
-  namespace: Schema4.String,
-  name: Schema4.String,
-  config: McpStoredSourceData
-}) {
-};
-
-// src/sdk/binding-store.ts
-var MCP_OAUTH_SESSION_TTL_MS = 15 * 60 * 1e3;
-var StoredOAuthSession = Schema5.Struct({
-  session: McpOAuthSession,
-  expiresAt: Schema5.Number
-});
-var encodeOAuthSession = Schema5.encodeSync(Schema5.parseJson(StoredOAuthSession));
-var decodeOAuthSession = Schema5.decodeUnknownSync(Schema5.parseJson(StoredOAuthSession));
-var encodeSource = Schema5.encodeSync(Schema5.parseJson(McpStoredSourceSchema));
-var decodeSource = Schema5.decodeUnknownSync(Schema5.parseJson(McpStoredSourceSchema));
-var StoredBindingEntry = Schema5.Struct({
-  namespace: Schema5.String,
-  binding: McpToolBinding
-});
-var encodeBindingEntry = Schema5.encodeSync(Schema5.parseJson(StoredBindingEntry));
-var decodeBindingEntry = Schema5.decodeUnknownSync(Schema5.parseJson(StoredBindingEntry));
-var makeStore = (bindings, sources, oauthSessions) => ({
-  // ---- Bindings ----
-  get: (toolId) => Effect2.gen(function* () {
-    const raw = yield* bindings.get(toolId);
-    if (!raw) return null;
-    const entry = decodeBindingEntry(raw);
-    return {
-      binding: entry.binding,
-      namespace: entry.namespace
-    };
-  }),
-  put: (toolId, namespace, binding) => bindings.set([{ key: toolId, value: encodeBindingEntry({ namespace, binding }) }]),
-  remove: (toolId) => bindings.delete([toolId]).pipe(Effect2.asVoid),
-  listByNamespace: (namespace) => Effect2.gen(function* () {
-    const entries = yield* bindings.list();
-    const ids = [];
-    for (const e of entries) {
-      const entry = decodeBindingEntry(e.value);
-      if (entry.namespace === namespace) ids.push(e.key);
-    }
-    return ids;
-  }),
-  removeByNamespace: (namespace) => Effect2.gen(function* () {
-    const entries = yield* bindings.list();
-    const ids = [];
-    for (const e of entries) {
-      const entry = decodeBindingEntry(e.value);
-      if (entry.namespace === namespace) ids.push(e.key);
-    }
-    if (ids.length > 0) yield* bindings.delete(ids);
-    return ids;
-  }),
-  // ---- Sources (meta + config combined) ----
-  putSource: (source) => sources.set([{ key: source.namespace, value: encodeSource(source) }]),
-  removeSource: (namespace) => sources.delete([namespace]).pipe(Effect2.asVoid),
-  listSources: () => Effect2.gen(function* () {
-    const entries = yield* sources.list();
-    return entries.map((e) => decodeSource(e.value));
-  }),
-  getSource: (namespace) => Effect2.gen(function* () {
-    const raw = yield* sources.get(namespace);
-    if (!raw) return null;
-    return decodeSource(raw);
-  }),
-  getSourceConfig: (namespace) => Effect2.gen(function* () {
-    const raw = yield* sources.get(namespace);
-    if (!raw) return null;
-    return decodeSource(raw).config;
-  }),
-  // ---- Pending OAuth sessions (short-lived, between startOAuth and completeOAuth) ----
-  putOAuthSession: (sessionId, session) => oauthSessions.set([
-    {
-      key: sessionId,
-      value: encodeOAuthSession({
-        session,
-        expiresAt: Date.now() + MCP_OAUTH_SESSION_TTL_MS
-      })
-    }
-  ]),
-  getOAuthSession: (sessionId) => Effect2.gen(function* () {
-    const raw = yield* oauthSessions.get(sessionId);
-    if (!raw) return null;
-    const entry = decodeOAuthSession(raw);
-    if (entry.expiresAt < Date.now()) {
-      yield* oauthSessions.delete([sessionId]);
-      return null;
-    }
-    return entry.session;
-  }),
-  deleteOAuthSession: (sessionId) => oauthSessions.delete([sessionId]).pipe(Effect2.asVoid)
-});
-var makeKvBindingStore = (kv, namespace) => makeStore(
-  scopeKv(kv, `${namespace}.bindings`),
-  scopeKv(kv, `${namespace}.sources`),
-  scopeKv(kv, `${namespace}.oauth-sessions`)
-);
-var makeInMemoryBindingStore = () => makeStore(makeInMemoryScopedKv(), makeInMemoryScopedKv(), makeInMemoryScopedKv());
-
-// src/sdk/plugin.ts
-import { Effect as Effect6, Exit, ScopedCache, Duration, Scope } from "effect";
-import {
-  Source,
-  SourceDetectionResult,
-  definePlugin,
-  ToolId,
-  SecretId
-} from "@executor-js/sdk";
-
-// src/sdk/connection.ts
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
-import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { Effect as Effect3 } from "effect";
-var buildEndpointUrl = (endpoint, queryParams) => {
-  const url = new URL(endpoint);
-  for (const [key, value] of Object.entries(queryParams)) {
-    url.searchParams.set(key, value);
-  }
-  return url;
-};
-var createClient = () => new Client(
-  { name: "executor-mcp", version: "0.1.0" },
-  { capabilities: { elicitation: { form: {}, url: {} } } }
-);
-var connectionFromClient = (client) => ({
-  client,
-  close: () => client.close()
-});
-var connectClient = (input) => Effect3.gen(function* () {
-  const client = createClient();
-  const transportInstance = input.createTransport();
-  yield* Effect3.tryPromise({
-    try: () => client.connect(transportInstance),
-    catch: (cause) => new McpConnectionError({
-      transport: input.transport,
-      message: `Failed connecting via ${input.transport}: ${cause instanceof Error ? cause.message : String(cause)}`
-    })
-  });
-  return connectionFromClient(client);
-});
-var createMcpConnector = (input) => {
-  if (input.transport === "stdio") {
-    const command = input.command.trim();
-    if (!command) {
-      return new McpConnectionError({
-        transport: "stdio",
-        message: "MCP stdio transport requires a command"
-      });
-    }
-    return connectClient({
-      transport: "stdio",
-      createTransport: () => new StdioClientTransport({
-        command,
-        args: input.args ? [...input.args] : void 0,
-        env: input.env ? { ...process.env, ...input.env } : void 0,
-        cwd: input.cwd?.trim().length ? input.cwd.trim() : void 0
-      })
-    });
-  }
-  const headers = input.headers ?? {};
-  const remoteTransport = input.remoteTransport ?? "auto";
-  const requestInit = Object.keys(headers).length > 0 ? { headers } : void 0;
-  const endpoint = buildEndpointUrl(input.endpoint, input.queryParams ?? {});
-  const connectStreamableHttp = connectClient({
-    transport: "streamable-http",
-    createTransport: () => new StreamableHTTPClientTransport(endpoint, {
-      requestInit,
-      authProvider: input.authProvider
-    })
-  });
-  const connectSse = connectClient({
-    transport: "sse",
-    createTransport: () => new SSEClientTransport(endpoint, {
-      requestInit,
-      authProvider: input.authProvider
-    })
-  });
-  if (remoteTransport === "streamable-http") return connectStreamableHttp;
-  if (remoteTransport === "sse") return connectSse;
-  return connectStreamableHttp.pipe(Effect3.catchAll(() => connectSse));
-};
-
-// src/sdk/discover.ts
-import { Effect as Effect4 } from "effect";
-
-// src/sdk/manifest.ts
-import { Schema as Schema6 } from "effect";
-var ListedTool = Schema6.Struct({
-  name: Schema6.String,
-  description: Schema6.optional(Schema6.NullOr(Schema6.String)),
-  inputSchema: Schema6.optional(Schema6.Unknown),
-  parameters: Schema6.optional(Schema6.Unknown),
-  outputSchema: Schema6.optional(Schema6.Unknown)
-});
-var ListToolsResult = Schema6.Struct({
-  tools: Schema6.Array(ListedTool)
-});
-var ServerInfo = Schema6.Struct({
-  name: Schema6.optional(Schema6.String),
-  version: Schema6.optional(Schema6.String)
-});
-var decodeListToolsResult = Schema6.decodeUnknownOption(ListToolsResult);
-var decodeServerInfo = Schema6.decodeUnknownOption(ServerInfo);
-var sanitize = (value) => {
-  const s = value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-  return s || "tool";
-};
-var uniqueId = (value, seen) => {
-  const base = sanitize(value);
-  const n = (seen.get(base) ?? 0) + 1;
-  seen.set(base, n);
-  return n === 1 ? base : `${base}_${n}`;
-};
-var joinToolPath = (namespace, toolId) => namespace?.trim() ? `${namespace}.${toolId}` : toolId;
-var extractManifestFromListToolsResult = (listToolsResult, metadata) => {
-  const seen = /* @__PURE__ */ new Map();
-  const listed = decodeListToolsResult(listToolsResult).pipe(
-    (opt) => opt._tag === "Some" ? opt.value.tools : []
-  );
-  const server = decodeServerInfo(metadata?.serverInfo).pipe(
-    (opt) => opt._tag === "Some" ? { name: opt.value.name ?? null, version: opt.value.version ?? null } : null
-  );
-  const tools = listed.flatMap((tool) => {
-    const toolName = tool.name.trim();
-    if (!toolName) return [];
-    return [
-      {
-        toolId: uniqueId(toolName, seen),
-        toolName,
-        description: tool.description ?? null,
-        inputSchema: tool.inputSchema ?? tool.parameters,
-        outputSchema: tool.outputSchema
-      }
-    ];
-  });
-  return { server, tools };
-};
-var slugify = (value) => value.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-var hostnameOf = (url) => {
-  try {
-    return new URL(url).hostname;
-  } catch {
-    return null;
-  }
-};
-var basenameOf = (path) => path.trim().split(/[\\/]/).pop() ?? path.trim();
-var deriveMcpNamespace = (input) => {
-  if (input.name?.trim()) return slugify(input.name) || "mcp";
-  const fromEndpoint = input.endpoint?.trim() ? hostnameOf(input.endpoint) : null;
-  if (fromEndpoint) return slugify(fromEndpoint) || "mcp";
-  if (input.command?.trim()) return slugify(basenameOf(input.command)) || "mcp";
-  return "mcp";
-};
-
-// src/sdk/discover.ts
-var discoverTools = (connector) => Effect4.gen(function* () {
-  const connection = yield* connector.pipe(
-    Effect4.mapError(
-      (err) => new McpToolDiscoveryError({
-        stage: "connect",
-        message: `Failed connecting to MCP server: ${err.message}`
-      })
-    )
-  );
-  const listResult = yield* Effect4.tryPromise({
-    try: () => connection.client.listTools(),
-    catch: (cause) => new McpToolDiscoveryError({
-      stage: "list_tools",
-      message: `Failed listing MCP tools: ${cause instanceof Error ? cause.message : String(cause)}`
-    })
-  });
-  const manifest = extractManifestFromListToolsResult(listResult, {
-    serverInfo: connection.client.getServerVersion?.()
-  });
-  yield* Effect4.promise(() => connection.close().catch(() => {
-  }));
-  return manifest;
-});
-
-// src/sdk/invoke.ts
-import { Effect as Effect5, Schema as Schema7 } from "effect";
-import { ElicitRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-import {
-  ToolInvocationResult,
-  ToolInvocationError,
-  ToolAnnotations,
-  ElicitationResponse,
-  FormElicitation,
-  UrlElicitation
-} from "@executor-js/sdk";
-var asRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
-var makeOAuthProvider = (accessToken, tokenType, refreshToken) => ({
-  get redirectUrl() {
-    return "http://localhost/oauth/callback";
-  },
-  get clientMetadata() {
-    return {
-      redirect_uris: ["http://localhost/oauth/callback"],
-      grant_types: ["authorization_code", "refresh_token"],
-      response_types: ["code"],
-      token_endpoint_auth_method: "none",
-      client_name: "Executor"
-    };
-  },
-  clientInformation: () => void 0,
-  saveClientInformation: () => {
-  },
-  tokens: async () => ({
-    access_token: accessToken,
-    token_type: tokenType,
-    ...refreshToken ? { refresh_token: refreshToken } : {}
-  }),
-  saveTokens: async () => {
-  },
-  redirectToAuthorization: async () => {
-    throw new Error("MCP OAuth re-authorization required");
-  },
-  saveCodeVerifier: () => {
-  },
-  codeVerifier: () => {
-    throw new Error("No active PKCE verifier");
-  },
-  saveDiscoveryState: () => {
-  },
-  discoveryState: () => void 0
-});
-var McpElicitParams = Schema7.Union(
-  Schema7.Struct({
-    mode: Schema7.Literal("url"),
-    message: Schema7.String,
-    url: Schema7.String,
-    elicitationId: Schema7.optional(Schema7.String),
-    id: Schema7.optional(Schema7.String)
-  }),
-  Schema7.Struct({
-    mode: Schema7.optional(Schema7.Literal("form")),
-    message: Schema7.String,
-    requestedSchema: Schema7.Record({ key: Schema7.String, value: Schema7.Unknown })
-  })
-);
-var decodeElicitParams = Schema7.decodeUnknownSync(McpElicitParams);
-var toElicitationRequest = (params) => params.mode === "url" ? new UrlElicitation({
-  message: params.message,
-  url: params.url,
-  elicitationId: params.elicitationId ?? params.id ?? ""
-}) : new FormElicitation({
-  message: params.message,
-  requestedSchema: params.requestedSchema
-});
-var installElicitationHandler = (client, toolId, args, handler) => {
-  client.setRequestHandler(ElicitRequestSchema, async (request) => {
-    const params = decodeElicitParams(request.params);
-    const response = await Effect5.runPromise(
-      handler({ toolId, args, request: toElicitationRequest(params) })
-    );
-    return {
-      action: response.action,
-      ...response.action === "accept" && response.content ? { content: response.content } : {}
-    };
-  });
-};
-var resolveConnectorInput = (sourceData, secrets, scopeId) => {
-  if (sourceData.transport === "stdio") {
-    return Effect5.succeed({
-      transport: "stdio",
-      command: sourceData.command,
-      args: sourceData.args,
-      env: sourceData.env,
-      cwd: sourceData.cwd
-    });
-  }
-  return Effect5.gen(function* () {
-    const headers = { ...sourceData.headers };
-    let authProvider;
-    const auth2 = sourceData.auth;
-    if (auth2.kind === "header") {
-      const secretValue = yield* secrets.resolve(auth2.secretId, scopeId).pipe(
-        Effect5.mapError(
-          () => new ToolInvocationError({
-            toolId: "",
-            message: `Failed to resolve secret "${auth2.secretId}" for MCP auth`,
-            cause: void 0
-          })
-        )
-      );
-      headers[auth2.headerName] = auth2.prefix ? `${auth2.prefix}${secretValue}` : secretValue;
-    } else if (auth2.kind === "oauth2") {
-      const accessToken = yield* secrets.resolve(auth2.accessTokenSecretId, scopeId).pipe(
-        Effect5.mapError(
-          () => new ToolInvocationError({
-            toolId: "",
-            message: "Failed to resolve OAuth access token for MCP auth",
-            cause: void 0
-          })
-        )
-      );
-      let refreshToken;
-      if (auth2.refreshTokenSecretId) {
-        refreshToken = yield* secrets.resolve(auth2.refreshTokenSecretId, scopeId).pipe(
-          Effect5.option,
-          Effect5.map((o) => o._tag === "Some" ? o.value : void 0)
-        );
-      }
-      authProvider = makeOAuthProvider(accessToken, auth2.tokenType ?? "Bearer", refreshToken);
-    }
-    return {
-      transport: "remote",
-      endpoint: sourceData.endpoint,
-      remoteTransport: sourceData.remoteTransport,
-      queryParams: sourceData.queryParams,
-      headers: Object.keys(headers).length > 0 ? headers : void 0,
-      authProvider
-    };
-  });
-};
-var connectionCacheKey = (sourceData) => sourceData.transport === "stdio" ? `stdio:${sourceData.command}` : `remote:${sourceData.endpoint}`;
-var resolveElicitationHandler = (options) => options.onElicitation === "accept-all" ? () => Effect5.succeed(new ElicitationResponse({ action: "accept" })) : options.onElicitation;
-var useMcpConnection = (connection, toolId, toolName, args, handler) => Effect5.gen(function* () {
-  installElicitationHandler(connection.client, toolId, args, handler);
-  return yield* Effect5.tryPromise({
-    try: () => connection.client.callTool({ name: toolName, arguments: args }),
-    catch: (cause) => new ToolInvocationError({
-      toolId,
-      message: `MCP tool call failed for ${toolName}: ${cause instanceof Error ? cause.message : String(cause)}`,
-      cause
-    })
-  });
-}).pipe(Effect5.withSpan(`mcp.callTool.${toolName}`));
-var makeMcpInvoker = (opts) => {
-  const { connectionCache, pendingConnectors } = opts;
-  return {
-    resolveAnnotations: () => Effect5.succeed(new ToolAnnotations({ requiresApproval: false })),
-    invoke: (toolId, args, options) => Effect5.gen(function* () {
-      const entry = yield* opts.bindingStore.get(toolId);
-      if (!entry) {
-        return yield* new ToolInvocationError({
-          toolId,
-          message: `No MCP binding found for tool "${toolId}"`,
-          cause: void 0
-        });
-      }
-      const sourceData = yield* opts.bindingStore.getSourceConfig(entry.namespace);
-      if (!sourceData) {
-        return yield* new ToolInvocationError({
-          toolId,
-          message: `No MCP source config found for namespace "${entry.namespace}"`,
-          cause: void 0
-        });
-      }
-      const { binding } = entry;
-      const cacheKey = connectionCacheKey(sourceData);
-      const connector = resolveConnectorInput(sourceData, opts.secrets, opts.scopeId).pipe(
-        Effect5.flatMap((ci) => createMcpConnector(ci)),
-        Effect5.mapError(
-          (err) => new McpConnectionError({
-            transport: "auto",
-            message: err instanceof Error ? err.message : String(err)
-          })
-        )
-      );
-      pendingConnectors.set(cacheKey, connector);
-      const connection = yield* connectionCache.get(cacheKey).pipe(
-        Effect5.mapError(
-          (err) => new ToolInvocationError({
-            toolId,
-            message: `Failed connecting to MCP server: ${err instanceof Error ? err.message : String(err)}`,
-            cause: err
-          })
-        )
-      );
-      const elicitationHandler = resolveElicitationHandler(options);
-      return yield* useMcpConnection(
-        connection,
-        toolId,
-        binding.toolName,
-        asRecord(args),
-        elicitationHandler
-      ).pipe(
-        // On failure, invalidate the cached connection and retry once
-        Effect5.catchAll(
-          () => Effect5.gen(function* () {
-            yield* connectionCache.invalidate(cacheKey);
-            pendingConnectors.set(cacheKey, connector);
-            const freshConnection = yield* connectionCache.get(cacheKey).pipe(
-              Effect5.mapError(
-                (retryErr) => new ToolInvocationError({
-                  toolId,
-                  message: `Failed reconnecting: ${retryErr instanceof Error ? retryErr.message : String(retryErr)}`,
-                  cause: retryErr
-                })
-              )
-            );
-            return yield* useMcpConnection(
-              freshConnection,
-              toolId,
-              binding.toolName,
-              asRecord(args),
-              elicitationHandler
-            );
-          })
-        )
-      );
-    }).pipe(
-      Effect5.scoped,
-      Effect5.map((callResult) => {
-        const resultRecord = asRecord(callResult);
-        const isError = resultRecord.isError === true;
-        return new ToolInvocationResult({
-          data: isError ? null : callResult ?? null,
-          error: isError ? callResult : null
-        });
-      }),
-      Effect5.catchAll((err) => {
-        if (typeof err === "object" && err !== null && "_tag" in err && err._tag === "ToolInvocationError") {
-          return Effect5.fail(err);
-        }
-        return Effect5.fail(
-          new ToolInvocationError({
-            toolId,
-            message: `MCP invocation failed: ${err instanceof Error ? err.message : String(err)}`,
-            cause: err
-          })
-        );
-      })
-    ),
-    closeConnections: () => Effect5.sync(() => {
-      pendingConnectors.clear();
-    }).pipe(Effect5.flatMap(() => connectionCache.invalidateAll))
-  };
-};
-
-// src/sdk/plugin.ts
-var toRegistration = (entry, namespace) => ({
-  id: ToolId.make(joinToolPath(namespace, entry.toolId)),
-  pluginKey: "mcp",
-  sourceId: namespace,
-  name: entry.toolName,
-  description: entry.description ?? `MCP tool: ${entry.toolName}`,
-  inputSchema: entry.inputSchema,
-  outputSchema: entry.outputSchema
-});
-var toBinding = (entry) => new McpToolBinding({
-  toolId: entry.toolId,
-  toolName: entry.toolName,
-  description: entry.description,
-  inputSchema: entry.inputSchema,
-  outputSchema: entry.outputSchema
-});
-var toStoredSourceData = (config) => {
-  if (config.transport === "stdio") {
-    return {
-      transport: "stdio",
-      command: config.command,
-      args: config.args,
-      env: config.env,
-      cwd: config.cwd
-    };
-  }
-  return {
-    transport: "remote",
-    endpoint: config.endpoint,
-    remoteTransport: config.remoteTransport ?? "auto",
-    queryParams: config.queryParams,
-    headers: config.headers,
-    auth: config.auth ?? { kind: "none" }
-  };
-};
-var normalizeNamespace = (config) => config.namespace ?? deriveMcpNamespace({
-  name: config.name,
-  endpoint: config.transport === "remote" ? config.endpoint : void 0,
-  command: config.transport === "stdio" ? config.command : void 0
-});
-var makeOAuthProvider2 = (accessToken, tokenType, refreshToken) => ({
-  get redirectUrl() {
-    return "http://localhost/oauth/callback";
-  },
-  get clientMetadata() {
-    return {
-      redirect_uris: ["http://localhost/oauth/callback"],
-      grant_types: ["authorization_code", "refresh_token"],
-      response_types: ["code"],
-      token_endpoint_auth_method: "none",
-      client_name: "Executor"
-    };
-  },
-  clientInformation: () => void 0,
-  saveClientInformation: () => {
-  },
-  tokens: async () => ({
-    access_token: accessToken,
-    token_type: tokenType,
-    ...refreshToken ? { refresh_token: refreshToken } : {}
-  }),
-  saveTokens: async () => {
-  },
-  redirectToAuthorization: async () => {
-    throw new Error("MCP OAuth re-authorization required");
-  },
-  saveCodeVerifier: () => {
-  },
-  codeVerifier: () => {
-    throw new Error("No active PKCE verifier");
-  },
-  saveDiscoveryState: () => {
-  },
-  discoveryState: () => void 0
-});
-var remoteConnectionError = (message) => new McpConnectionError({ transport: "remote", message });
-var mcpOAuthError = (message) => new McpOAuthError({ message });
-var mcpDiscoveryError = (message) => new McpToolDiscoveryError({ stage: "list_tools", message });
-var mcpPlugin = (options) => {
-  const bindingStore = options?.bindingStore ?? makeInMemoryBindingStore();
-  const addedSources = /* @__PURE__ */ new Map();
-  return definePlugin({
-    key: "mcp",
-    init: (ctx) => Effect6.gen(function* () {
-      const cacheScope = yield* Scope.make();
-      const pendingConnectors = /* @__PURE__ */ new Map();
-      const connectionCache = yield* ScopedCache.make({
-        lookup: (key) => Effect6.acquireRelease(
-          Effect6.suspend(() => {
-            const connector = pendingConnectors.get(key);
-            if (!connector) {
-              return Effect6.fail(
-                new McpConnectionError({
-                  transport: "auto",
-                  message: `No pending connector for key: ${key}`
-                })
-              );
-            }
-            return connector;
-          }),
-          (connection) => Effect6.promise(() => connection.close().catch(() => {
-          }))
-        ),
-        capacity: 64,
-        timeToLive: Duration.minutes(5)
-      }).pipe(Scope.extend(cacheScope));
-      const invoker = makeMcpInvoker({
-        bindingStore,
-        secrets: ctx.secrets,
-        scopeId: ctx.scope.id,
-        connectionCache,
-        pendingConnectors
-      });
-      yield* ctx.tools.registerInvoker("mcp", invoker);
-      const savedSources = yield* bindingStore.listSources();
-      for (const s of savedSources) {
-        const isRemote = s.config.transport === "remote";
-        addedSources.set(
-          s.namespace,
-          new Source({
-            id: s.namespace,
-            name: s.name,
-            kind: "mcp",
-            url: s.config.transport === "remote" ? s.config.endpoint : void 0,
-            canEdit: isRemote
-          })
-        );
-      }
-      const resolveConnectorInput2 = (sd) => {
-        if (sd.transport === "stdio") {
-          return Effect6.succeed({
-            transport: "stdio",
-            command: sd.command,
-            args: sd.args,
-            env: sd.env,
-            cwd: sd.cwd
-          });
-        }
-        return Effect6.gen(function* () {
-          const headers = {
-            ...sd.headers
-          };
-          let authProvider;
-          const auth2 = sd.auth;
-          if (auth2.kind === "header") {
-            const val = yield* ctx.secrets.resolve(SecretId.make(auth2.secretId), ctx.scope.id).pipe(
-              Effect6.mapError(
-                () => remoteConnectionError(`Failed to resolve secret "${auth2.secretId}"`)
-              )
-            );
-            headers[auth2.headerName] = auth2.prefix ? `${auth2.prefix}${val}` : val;
-          } else if (auth2.kind === "oauth2") {
-            const accessToken = yield* ctx.secrets.resolve(SecretId.make(auth2.accessTokenSecretId), ctx.scope.id).pipe(
-              Effect6.mapError(
-                () => remoteConnectionError("Failed to resolve OAuth access token")
-              )
-            );
-            let refreshToken;
-            if (auth2.refreshTokenSecretId) {
-              refreshToken = yield* ctx.secrets.resolve(SecretId.make(auth2.refreshTokenSecretId), ctx.scope.id).pipe(
-                Effect6.option,
-                Effect6.map((o) => o._tag === "Some" ? o.value : void 0)
-              );
-            }
-            authProvider = makeOAuthProvider2(
-              accessToken,
-              auth2.tokenType ?? "Bearer",
-              refreshToken
-            );
-          }
-          return {
-            transport: "remote",
-            endpoint: sd.endpoint,
-            remoteTransport: sd.remoteTransport,
-            queryParams: sd.queryParams,
-            headers: Object.keys(headers).length > 0 ? headers : void 0,
-            authProvider
-          };
-        });
-      };
-      yield* ctx.sources.addManager({
-        kind: "mcp",
-        list: () => Effect6.sync(() => [...addedSources.values()]),
-        remove: (sourceId) => Effect6.gen(function* () {
-          yield* bindingStore.removeByNamespace(sourceId);
-          yield* bindingStore.removeSource(sourceId);
-          yield* ctx.tools.unregisterBySource(sourceId);
-          addedSources.delete(sourceId);
-        }),
-        detect: (url) => Effect6.gen(function* () {
-          const trimmed = url.trim();
-          if (!trimmed) return null;
-          const parsed = yield* Effect6.try(() => new URL(trimmed)).pipe(Effect6.option);
-          if (parsed._tag === "None") return null;
-          const name = parsed.value.hostname || "mcp";
-          const namespace = deriveMcpNamespace({ endpoint: trimmed });
-          const connector = createMcpConnector({
-            transport: "remote",
-            endpoint: trimmed
-          });
-          const connected = yield* discoverTools(connector).pipe(
-            Effect6.map(() => true),
-            Effect6.catchAll(() => Effect6.succeed(false))
-          );
-          if (connected) {
-            return new SourceDetectionResult({
-              kind: "mcp",
-              confidence: "high",
-              endpoint: trimmed,
-              name,
-              namespace
-            });
-          }
-          const hasOAuth = yield* startMcpOAuthAuthorization({
-            endpoint: trimmed,
-            redirectUrl: "http://127.0.0.1/executor/discovery/oauth/probe",
-            state: "probe"
-          }).pipe(
-            Effect6.map(() => true),
-            Effect6.catchAll(() => Effect6.succeed(false))
-          );
-          if (hasOAuth) {
-            return new SourceDetectionResult({
-              kind: "mcp",
-              confidence: "high",
-              endpoint: trimmed,
-              name,
-              namespace
-            });
-          }
-          return null;
-        }),
-        refresh: (sourceId) => Effect6.gen(function* () {
-          const sd = yield* bindingStore.getSourceConfig(sourceId);
-          if (!sd || !addedSources.has(sourceId)) return;
-          const ci = yield* resolveConnectorInput2(sd).pipe(
-            Effect6.catchAll(() => Effect6.succeed(null))
-          );
-          if (!ci) return;
-          const manifest = yield* discoverTools(createMcpConnector(ci)).pipe(
-            Effect6.catchAll(() => Effect6.succeed(null))
-          );
-          if (!manifest) return;
-          const oldIds = yield* bindingStore.removeByNamespace(sourceId);
-          if (oldIds.length > 0) yield* ctx.tools.unregister(oldIds);
-          yield* Effect6.forEach(
-            manifest.tools,
-            (e) => bindingStore.put(
-              ToolId.make(joinToolPath(sourceId, e.toolId)),
-              sourceId,
-              toBinding(e)
-            ),
-            { discard: true }
-          );
-          yield* ctx.tools.register(manifest.tools.map((e) => toRegistration(e, sourceId)));
-        })
-      });
-      const probeEndpoint = (endpoint) => Effect6.gen(function* () {
-        const trimmed = endpoint.trim();
-        if (!trimmed) return yield* remoteConnectionError("Endpoint URL is required");
-        const name = yield* Effect6.try(() => new URL(trimmed).hostname).pipe(
-          Effect6.orElseSucceed(() => "mcp")
-        );
-        const namespace = deriveMcpNamespace({ endpoint: trimmed });
-        const connector = createMcpConnector({
-          transport: "remote",
-          endpoint: trimmed
-        });
-        const result = yield* discoverTools(connector).pipe(
-          Effect6.map((m) => ({ ok: true, manifest: m })),
-          Effect6.catchAll(() => Effect6.succeed({ ok: false, manifest: null }))
-        );
-        if (result.ok && result.manifest) {
-          return {
-            connected: true,
-            requiresOAuth: false,
-            name: result.manifest.server?.name ?? name,
-            namespace,
-            toolCount: result.manifest.tools.length,
-            serverName: result.manifest.server?.name ?? null
-          };
-        }
-        const hasOAuth = yield* startMcpOAuthAuthorization({
-          endpoint: trimmed,
-          redirectUrl: "http://127.0.0.1/executor/discovery/oauth/probe",
-          state: "probe"
-        }).pipe(
-          Effect6.map(() => true),
-          Effect6.catchAll(() => Effect6.succeed(false))
-        );
-        if (hasOAuth) {
-          return {
-            connected: false,
-            requiresOAuth: true,
-            name,
-            namespace,
-            toolCount: null,
-            serverName: null
-          };
-        }
-        return yield* remoteConnectionError(
-          "Could not connect to MCP endpoint and no OAuth was detected"
-        );
-      });
-      const addSource = (config) => Effect6.gen(function* () {
-        const namespace = normalizeNamespace(config);
-        const sd = toStoredSourceData(config);
-        const ci = yield* resolveConnectorInput2(sd);
-        const connector = createMcpConnector(ci);
-        const manifest = yield* discoverTools(connector).pipe(
-          Effect6.mapError((err) => mcpDiscoveryError(`MCP discovery failed: ${err.message}`))
-        );
-        const registrations = manifest.tools.map((e) => toRegistration(e, namespace));
-        yield* Effect6.forEach(
-          manifest.tools,
-          (e) => bindingStore.put(
-            ToolId.make(joinToolPath(namespace, e.toolId)),
-            namespace,
-            toBinding(e)
-          ),
-          { discard: true }
-        );
-        yield* ctx.tools.register(registrations);
-        const sourceName = manifest.server?.name ?? config.name ?? namespace;
-        yield* bindingStore.putSource({
-          namespace,
-          name: sourceName,
-          config: sd
-        });
-        addedSources.set(
-          namespace,
-          new Source({
-            id: namespace,
-            name: sourceName,
-            kind: "mcp",
-            url: sd.transport === "remote" ? sd.endpoint : void 0,
-            canEdit: config.transport === "remote"
-          })
-        );
-        return { toolCount: registrations.length, namespace };
-      });
-      const removeSource = (namespace) => Effect6.gen(function* () {
-        const ids = yield* bindingStore.removeByNamespace(namespace);
-        if (ids.length > 0) yield* ctx.tools.unregister(ids);
-        yield* bindingStore.removeSource(namespace);
-        addedSources.delete(namespace);
-      });
-      const refreshSource = (namespace) => Effect6.gen(function* () {
-        const sd = yield* bindingStore.getSourceConfig(namespace);
-        if (!sd)
-          return yield* remoteConnectionError(`No stored config for MCP source "${namespace}"`);
-        const ci = yield* resolveConnectorInput2(sd);
-        const manifest = yield* discoverTools(createMcpConnector(ci)).pipe(
-          Effect6.mapError((err) => mcpDiscoveryError(`MCP refresh failed: ${err.message}`))
-        );
-        const oldIds = yield* bindingStore.removeByNamespace(namespace);
-        if (oldIds.length > 0) yield* ctx.tools.unregister(oldIds);
-        yield* Effect6.forEach(
-          manifest.tools,
-          (e) => bindingStore.put(
-            ToolId.make(joinToolPath(namespace, e.toolId)),
-            namespace,
-            toBinding(e)
-          ),
-          { discard: true }
-        );
-        yield* ctx.tools.register(manifest.tools.map((e) => toRegistration(e, namespace)));
-        return { toolCount: manifest.tools.length };
-      });
-      const startOAuth = (input) => Effect6.gen(function* () {
-        const endpoint = input.endpoint.trim();
-        if (!endpoint) return yield* mcpOAuthError("MCP OAuth requires an endpoint");
-        let fullEndpoint = endpoint;
-        if (input.queryParams && Object.keys(input.queryParams).length > 0) {
-          const u = new URL(endpoint);
-          for (const [k, v] of Object.entries(input.queryParams)) u.searchParams.set(k, v);
-          fullEndpoint = u.toString();
-        }
-        const sessionId = `mcp_oauth_${crypto.randomUUID()}`;
-        const started = yield* startMcpOAuthAuthorization({
-          endpoint: fullEndpoint,
-          redirectUrl: input.redirectUrl,
-          state: sessionId
-        }).pipe(Effect6.mapError((e) => mcpOAuthError(`OAuth start failed: ${e.message}`)));
-        yield* bindingStore.putOAuthSession(sessionId, {
-          endpoint: fullEndpoint,
-          redirectUrl: input.redirectUrl,
-          codeVerifier: started.codeVerifier,
-          resourceMetadataUrl: started.resourceMetadataUrl,
-          authorizationServerUrl: started.authorizationServerUrl,
-          resourceMetadata: started.resourceMetadata,
-          authorizationServerMetadata: started.authorizationServerMetadata,
-          clientInformation: started.clientInformation
-        });
-        return {
-          sessionId,
-          authorizationUrl: started.authorizationUrl
-        };
-      });
-      const completeOAuth = (input) => Effect6.gen(function* () {
-        if (input.error) return yield* mcpOAuthError(`OAuth error: ${input.error}`);
-        if (!input.code) return yield* mcpOAuthError("Missing OAuth authorization code");
-        const session = yield* bindingStore.getOAuthSession(input.state);
-        if (!session) return yield* mcpOAuthError(`OAuth session not found: ${input.state}`);
-        const exchanged = yield* exchangeMcpOAuthCode({
-          session,
-          code: input.code
-        }).pipe(Effect6.mapError((e) => mcpOAuthError(`OAuth exchange failed: ${e.message}`)));
-        const accessTokenRef = yield* ctx.secrets.set({
-          id: SecretId.make(`mcp-oauth-access-${input.state}`),
-          scopeId: ctx.scope.id,
-          name: "MCP OAuth Access Token",
-          value: exchanged.tokens.access_token,
-          purpose: "oauth_access_token"
-        }).pipe(
-          Effect6.mapError((e) => mcpOAuthError(`Failed to store access token: ${String(e)}`))
-        );
-        let refreshTokenSecretId = null;
-        if (exchanged.tokens.refresh_token) {
-          const ref = yield* ctx.secrets.set({
-            id: SecretId.make(`mcp-oauth-refresh-${input.state}`),
-            scopeId: ctx.scope.id,
-            name: "MCP OAuth Refresh Token",
-            value: exchanged.tokens.refresh_token,
-            purpose: "oauth_refresh_token"
-          }).pipe(
-            Effect6.mapError(
-              (e) => mcpOAuthError(`Failed to store refresh token: ${String(e)}`)
-            )
-          );
-          refreshTokenSecretId = ref.id;
-        }
-        yield* bindingStore.deleteOAuthSession(input.state);
-        const expiresAt = typeof exchanged.tokens.expires_in === "number" ? Date.now() + exchanged.tokens.expires_in * 1e3 : null;
-        return {
-          accessTokenSecretId: accessTokenRef.id,
-          refreshTokenSecretId,
-          tokenType: exchanged.tokens.token_type ?? "Bearer",
-          expiresAt,
-          scope: exchanged.tokens.scope ?? null
-        };
-      });
-      const updateSource = (namespace, input) => Effect6.gen(function* () {
-        const existing = yield* bindingStore.getSource(namespace);
-        if (!existing || existing.config.transport !== "remote") return;
-        const remote = existing.config;
-        const updatedConfig = {
-          ...remote,
-          ...input.endpoint !== void 0 ? { endpoint: input.endpoint } : {},
-          ...input.headers !== void 0 ? { headers: input.headers } : {},
-          ...input.auth !== void 0 ? { auth: input.auth } : {},
-          ...input.queryParams !== void 0 ? { queryParams: input.queryParams } : {}
-        };
-        yield* bindingStore.putSource({
-          namespace,
-          name: input.name?.trim() || existing.name,
-          config: updatedConfig
-        });
-      });
-      const getSource = (namespace) => bindingStore.getSource(namespace);
-      return {
-        extension: {
-          probeEndpoint,
-          addSource,
-          removeSource,
-          refreshSource,
-          startOAuth,
-          completeOAuth,
-          getSource,
-          updateSource
-        },
-        close: () => Effect6.gen(function* () {
-          yield* invoker.closeConnections();
-          yield* Scope.close(cacheScope, Exit.void);
-          for (const sourceId of addedSources.keys()) {
-            yield* ctx.tools.unregisterBySource(sourceId);
-          }
-          addedSources.clear();
-        })
-      };
-    })
-  });
-};
-
-export {
-  makeKvBindingStore,
-  mcpPlugin
-};
-//# sourceMappingURL=chunk-X3JTTDWJ.js.map