@executor-js/plugin-mcp 0.1.0 → 0.2.1

package/dist/chunk-C2GNZGFJ.js

@@ -1,1622 +0,0 @@
-// src/sdk/types.ts
-import { Effect, Schema } from "effect";
-import { SecretBackedMap, SecretBackedValue } from "@executor-js/sdk/core";
-var McpRemoteTransport = Schema.Literals(["streamable-http", "sse", "auto"]);
-var McpTransport = Schema.Literals(["streamable-http", "sse", "stdio", "auto"]);
-var JsonObject = Schema.Record(Schema.String, Schema.Unknown);
-var McpConnectionAuth = Schema.Union([
-  Schema.Struct({ kind: Schema.Literal("none") }),
-  Schema.Struct({
-    kind: Schema.Literal("header"),
-    headerName: Schema.String,
-    secretId: Schema.String,
-    prefix: Schema.optional(Schema.String)
-  }),
-  Schema.Struct({
-    kind: Schema.Literal("oauth2"),
-    connectionId: Schema.String,
-    clientIdSecretId: Schema.optional(Schema.String),
-    clientSecretSecretId: Schema.optional(Schema.NullOr(Schema.String))
-  })
-]);
-var StringMap = Schema.Record(Schema.String, Schema.String);
-var McpRemoteSourceData = Schema.Struct({
-  transport: Schema.Literal("remote"),
-  /** The MCP server endpoint URL */
-  endpoint: Schema.String,
-  /** Transport preference for this remote source */
-  remoteTransport: McpRemoteTransport.pipe(
-    Schema.optionalKey,
-    Schema.withConstructorDefault(Effect.succeed("auto"))
-  ),
-  /** Extra query params appended to the endpoint URL */
-  queryParams: Schema.optional(SecretBackedMap),
-  /** Extra headers sent on every request */
-  headers: Schema.optional(SecretBackedMap),
-  /** Auth configuration */
-  auth: McpConnectionAuth
-});
-var McpStdioSourceData = Schema.Struct({
-  transport: Schema.Literal("stdio"),
-  /** The command to run */
-  command: Schema.String,
-  /** Arguments to the command */
-  args: Schema.optional(Schema.Array(Schema.String)),
-  /** Environment variables */
-  env: Schema.optional(StringMap),
-  /** Working directory */
-  cwd: Schema.optional(Schema.String)
-});
-var McpStoredSourceData = Schema.Union([McpRemoteSourceData, McpStdioSourceData]);
-var McpToolAnnotations = Schema.Struct({
-  title: Schema.optional(Schema.String),
-  readOnlyHint: Schema.optional(Schema.Boolean),
-  destructiveHint: Schema.optional(Schema.Boolean),
-  idempotentHint: Schema.optional(Schema.Boolean),
-  openWorldHint: Schema.optional(Schema.Boolean)
-});
-var McpToolBinding = class extends Schema.Class("McpToolBinding")({
-  toolId: Schema.String,
-  toolName: Schema.String,
-  description: Schema.NullOr(Schema.String),
-  inputSchema: Schema.optional(Schema.Unknown),
-  outputSchema: Schema.optional(Schema.Unknown),
-  annotations: Schema.optional(McpToolAnnotations)
-}) {
-};
-
-// src/sdk/binding-store.ts
-import { Effect as Effect2, Schema as Schema2 } from "effect";
-import {
-  defineSchema
-} from "@executor-js/sdk/core";
-var mcpSchema = defineSchema({
-  mcp_source: {
-    fields: {
-      id: { type: "string", required: true },
-      scope_id: { type: "string", required: true, index: true },
-      name: { type: "string", required: true },
-      config: { type: "json", required: true },
-      created_at: { type: "date", required: true }
-    }
-  },
-  mcp_binding: {
-    fields: {
-      id: { type: "string", required: true },
-      scope_id: { type: "string", required: true, index: true },
-      source_id: { type: "string", required: true, index: true },
-      binding: { type: "json", required: true },
-      created_at: { type: "date", required: true }
-    }
-  }
-});
-var decodeSourceData = Schema2.decodeUnknownSync(McpStoredSourceData);
-var encodeSourceData = Schema2.encodeSync(McpStoredSourceData);
-var decodeBinding = Schema2.decodeUnknownSync(McpToolBinding);
-var encodeBinding = Schema2.encodeSync(McpToolBinding);
-var coerceJson = (value) => {
-  if (typeof value !== "string") return value;
-  try {
-    return JSON.parse(value);
-  } catch {
-    return value;
-  }
-};
-var makeMcpStore = ({
-  adapter: db
-}) => {
-  return {
-    listBindingsBySource: (namespace, scope) => Effect2.gen(function* () {
-      const rows = yield* db.findMany({
-        model: "mcp_binding",
-        where: [
-          { field: "source_id", value: namespace },
-          { field: "scope_id", value: scope }
-        ]
-      });
-      return rows.map((row) => ({
-        toolId: row.id,
-        binding: decodeBinding(coerceJson(row.binding))
-      }));
-    }),
-    getBinding: (toolId, scope) => Effect2.gen(function* () {
-      const row = yield* db.findOne({
-        model: "mcp_binding",
-        where: [
-          { field: "id", value: toolId },
-          { field: "scope_id", value: scope }
-        ]
-      });
-      if (!row) return null;
-      const binding = decodeBinding(coerceJson(row.binding));
-      return { binding, namespace: row.source_id };
-    }),
-    putBindings: (namespace, scope, entries) => Effect2.gen(function* () {
-      if (entries.length === 0) return;
-      const now = /* @__PURE__ */ new Date();
-      yield* db.createMany({
-        model: "mcp_binding",
-        data: entries.map((e) => ({
-          id: e.toolId,
-          scope_id: scope,
-          source_id: namespace,
-          binding: encodeBinding(e.binding),
-          created_at: now
-        })),
-        forceAllowId: true
-      });
-    }),
-    removeBindingsByNamespace: (namespace, scope) => db.deleteMany({
-      model: "mcp_binding",
-      where: [
-        { field: "source_id", value: namespace },
-        { field: "scope_id", value: scope }
-      ]
-    }).pipe(Effect2.asVoid),
-    getSource: (namespace, scope) => Effect2.gen(function* () {
-      const row = yield* db.findOne({
-        model: "mcp_source",
-        where: [
-          { field: "id", value: namespace },
-          { field: "scope_id", value: scope }
-        ]
-      });
-      if (!row) return null;
-      return {
-        namespace: row.id,
-        scope: row.scope_id,
-        name: row.name,
-        config: decodeSourceData(coerceJson(row.config))
-      };
-    }),
-    getSourceConfig: (namespace, scope) => Effect2.gen(function* () {
-      const row = yield* db.findOne({
-        model: "mcp_source",
-        where: [
-          { field: "id", value: namespace },
-          { field: "scope_id", value: scope }
-        ]
-      });
-      if (!row) return null;
-      return decodeSourceData(coerceJson(row.config));
-    }),
-    putSource: (source) => Effect2.gen(function* () {
-      const now = /* @__PURE__ */ new Date();
-      yield* db.delete({
-        model: "mcp_source",
-        where: [
-          { field: "id", value: source.namespace },
-          { field: "scope_id", value: source.scope }
-        ]
-      });
-      yield* db.create({
-        model: "mcp_source",
-        data: {
-          id: source.namespace,
-          scope_id: source.scope,
-          name: source.name,
-          config: encodeSourceData(source.config),
-          created_at: now
-        },
-        forceAllowId: true
-      });
-    }),
-    removeSource: (namespace, scope) => Effect2.gen(function* () {
-      yield* db.deleteMany({
-        model: "mcp_binding",
-        where: [
-          { field: "source_id", value: namespace },
-          { field: "scope_id", value: scope }
-        ]
-      });
-      yield* db.delete({
-        model: "mcp_source",
-        where: [
-          { field: "id", value: namespace },
-          { field: "scope_id", value: scope }
-        ]
-      });
-    })
-  };
-};
-
-// src/sdk/plugin.ts
-import { Duration, Effect as Effect8, Exit as Exit2, Result, Scope, ScopedCache as ScopedCache2 } from "effect";
-
-// src/api/group.ts
-import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
-import { Schema as Schema5 } from "effect";
-import { ScopeId, SecretBackedMap as SecretBackedMap2 } from "@executor-js/sdk/core";
-import { InternalError } from "@executor-js/api";
-
-// src/sdk/errors.ts
-import { Schema as Schema3 } from "effect";
-var McpConnectionError = class extends Schema3.TaggedErrorClass()(
-  "McpConnectionError",
-  {
-    transport: Schema3.String,
-    message: Schema3.String
-  },
-  { httpApiStatus: 400 }
-) {
-};
-var McpToolDiscoveryError = class extends Schema3.TaggedErrorClass()(
-  "McpToolDiscoveryError",
-  {
-    stage: Schema3.Literals(["connect", "list_tools"]),
-    message: Schema3.String
-  },
-  { httpApiStatus: 400 }
-) {
-};
-var McpInvocationError = class extends Schema3.TaggedErrorClass()(
-  "McpInvocationError",
-  {
-    toolName: Schema3.String,
-    message: Schema3.String
-  },
-  { httpApiStatus: 400 }
-) {
-};
-var McpOAuthError = class extends Schema3.TaggedErrorClass()(
-  "McpOAuthError",
-  {
-    message: Schema3.String
-  },
-  { httpApiStatus: 400 }
-) {
-};
-
-// src/sdk/stored-source.ts
-import { Schema as Schema4 } from "effect";
-var McpStoredSourceSchema = class extends Schema4.Class("McpStoredSource")({
-  namespace: Schema4.String,
-  name: Schema4.String,
-  config: McpStoredSourceData
-}) {
-};
-
-// src/api/group.ts
-var ScopeParams = { scopeId: ScopeId };
-var SourceParams = { scopeId: ScopeId, namespace: Schema5.String };
-var AuthPayload = Schema5.Union([
-  Schema5.Struct({ kind: Schema5.Literal("none") }),
-  Schema5.Struct({
-    kind: Schema5.Literal("header"),
-    headerName: Schema5.String,
-    secretId: Schema5.String,
-    prefix: Schema5.optional(Schema5.String)
-  }),
-  Schema5.Struct({
-    kind: Schema5.Literal("oauth2"),
-    /** Stable id of the SDK Connection minted by `completeOAuth`. The
-     *  backing access/refresh secrets live on the connection row; the
-     *  source only needs this pointer. */
-    connectionId: Schema5.String,
-    clientIdSecretId: Schema5.optional(Schema5.String),
-    clientSecretSecretId: Schema5.optional(Schema5.NullOr(Schema5.String))
-  })
-]);
-var StringMap2 = Schema5.Record(Schema5.String, Schema5.String);
-var AddRemoteSourcePayload = Schema5.Struct({
-  transport: Schema5.Literal("remote"),
-  name: Schema5.String,
-  endpoint: Schema5.String,
-  remoteTransport: Schema5.optional(Schema5.Literals(["streamable-http", "sse", "auto"])),
-  namespace: Schema5.optional(Schema5.String),
-  queryParams: Schema5.optional(SecretBackedMap2),
-  headers: Schema5.optional(SecretBackedMap2),
-  auth: Schema5.optional(AuthPayload)
-});
-var AddStdioSourcePayload = Schema5.Struct({
-  transport: Schema5.Literal("stdio"),
-  name: Schema5.String,
-  command: Schema5.String,
-  args: Schema5.optional(Schema5.Array(Schema5.String)),
-  env: Schema5.optional(StringMap2),
-  cwd: Schema5.optional(Schema5.String),
-  namespace: Schema5.optional(Schema5.String)
-});
-var AddSourcePayload = Schema5.Union([AddRemoteSourcePayload, AddStdioSourcePayload]);
-var UpdateSourcePayload = Schema5.Struct({
-  name: Schema5.optional(Schema5.String),
-  endpoint: Schema5.optional(Schema5.String),
-  headers: Schema5.optional(SecretBackedMap2),
-  queryParams: Schema5.optional(SecretBackedMap2),
-  auth: Schema5.optional(AuthPayload)
-});
-var UpdateSourceResponse = Schema5.Struct({
-  updated: Schema5.Boolean
-});
-var ProbeEndpointPayload = Schema5.Struct({
-  endpoint: Schema5.String,
-  headers: Schema5.optional(SecretBackedMap2),
-  queryParams: Schema5.optional(SecretBackedMap2)
-});
-var ProbeEndpointResponse = Schema5.Struct({
-  connected: Schema5.Boolean,
-  requiresOAuth: Schema5.Boolean,
-  name: Schema5.String,
-  namespace: Schema5.String,
-  toolCount: Schema5.NullOr(Schema5.Number),
-  serverName: Schema5.NullOr(Schema5.String)
-});
-var NamespacePayload = Schema5.Struct({
-  namespace: Schema5.String
-});
-var AddSourceResponse = Schema5.Struct({
-  toolCount: Schema5.Number,
-  namespace: Schema5.String
-});
-var RefreshSourceResponse = Schema5.Struct({
-  toolCount: Schema5.Number
-});
-var RemoveSourceResponse = Schema5.Struct({
-  removed: Schema5.Boolean
-});
-var McpGroup = HttpApiGroup.make("mcp").add(
-  HttpApiEndpoint.post("probeEndpoint", "/scopes/:scopeId/mcp/probe", {
-    params: ScopeParams,
-    payload: ProbeEndpointPayload,
-    success: ProbeEndpointResponse,
-    error: [InternalError, McpConnectionError, McpToolDiscoveryError]
-  })
-).add(
-  HttpApiEndpoint.post("addSource", "/scopes/:scopeId/mcp/sources", {
-    params: ScopeParams,
-    payload: AddSourcePayload,
-    success: AddSourceResponse,
-    error: [InternalError, McpConnectionError, McpToolDiscoveryError]
-  })
-).add(
-  HttpApiEndpoint.post("removeSource", "/scopes/:scopeId/mcp/sources/remove", {
-    params: ScopeParams,
-    payload: NamespacePayload,
-    success: RemoveSourceResponse,
-    error: [InternalError, McpConnectionError, McpToolDiscoveryError]
-  })
-).add(
-  HttpApiEndpoint.post("refreshSource", "/scopes/:scopeId/mcp/sources/refresh", {
-    params: ScopeParams,
-    payload: NamespacePayload,
-    success: RefreshSourceResponse,
-    error: [InternalError, McpConnectionError, McpToolDiscoveryError]
-  })
-).add(
-  HttpApiEndpoint.get("getSource", "/scopes/:scopeId/mcp/sources/:namespace", {
-    params: SourceParams,
-    success: Schema5.NullOr(McpStoredSourceSchema),
-    error: [InternalError, McpConnectionError, McpToolDiscoveryError]
-  })
-).add(
-  HttpApiEndpoint.patch("updateSource", "/scopes/:scopeId/mcp/sources/:namespace", {
-    params: SourceParams,
-    payload: UpdateSourcePayload,
-    success: UpdateSourceResponse,
-    error: [InternalError, McpConnectionError, McpToolDiscoveryError]
-  })
-);
-
-// src/api/handlers.ts
-import { HttpApiBuilder } from "effect/unstable/httpapi";
-import { Context, Effect as Effect3 } from "effect";
-import { addGroup, capture } from "@executor-js/api";
-var McpExtensionService = class extends Context.Service()("McpExtensionService") {
-};
-var ExecutorApiWithMcp = addGroup(McpGroup);
-var toSourceConfig = (payload, scope) => {
-  if (payload.transport === "stdio") {
-    const p2 = payload;
-    return {
-      transport: "stdio",
-      scope,
-      name: p2.name,
-      command: p2.command,
-      args: p2.args ? [...p2.args] : void 0,
-      env: p2.env,
-      cwd: p2.cwd,
-      namespace: p2.namespace
-    };
-  }
-  const p = payload;
-  return {
-    transport: "remote",
-    scope,
-    name: p.name,
-    endpoint: p.endpoint,
-    remoteTransport: p.remoteTransport,
-    queryParams: p.queryParams,
-    headers: p.headers,
-    namespace: p.namespace,
-    auth: p.auth
-  };
-};
-var McpHandlers = HttpApiBuilder.group(
-  ExecutorApiWithMcp,
-  "mcp",
-  (handlers) => handlers.handle(
-    "probeEndpoint",
-    ({ payload }) => capture(
-      Effect3.gen(function* () {
-        const ext = yield* McpExtensionService;
-        return yield* ext.probeEndpoint(payload);
-      })
-    )
-  ).handle(
-    "addSource",
-    ({ params: path, payload }) => capture(
-      Effect3.gen(function* () {
-        const ext = yield* McpExtensionService;
-        return yield* ext.addSource(
-          toSourceConfig(payload, path.scopeId)
-        );
-      })
-    )
-  ).handle(
-    "removeSource",
-    ({ params: path, payload }) => capture(
-      Effect3.gen(function* () {
-        const ext = yield* McpExtensionService;
-        yield* ext.removeSource(payload.namespace, path.scopeId);
-        return { removed: true };
-      })
-    )
-  ).handle(
-    "refreshSource",
-    ({ params: path, payload }) => capture(
-      Effect3.gen(function* () {
-        const ext = yield* McpExtensionService;
-        return yield* ext.refreshSource(payload.namespace, path.scopeId);
-      })
-    )
-  ).handle(
-    "getSource",
-    ({ params: path }) => capture(
-      Effect3.gen(function* () {
-        const ext = yield* McpExtensionService;
-        const source = yield* ext.getSource(path.namespace, path.scopeId);
-        return source ? new McpStoredSourceSchema({
-          namespace: source.namespace,
-          name: source.name,
-          config: source.config
-        }) : null;
-      })
-    )
-  ).handle(
-    "updateSource",
-    ({ params: path, payload }) => capture(
-      Effect3.gen(function* () {
-        const ext = yield* McpExtensionService;
-        yield* ext.updateSource(path.namespace, path.scopeId, {
-          name: payload.name,
-          endpoint: payload.endpoint,
-          headers: payload.headers,
-          queryParams: payload.queryParams,
-          auth: payload.auth
-        });
-        return { updated: true };
-      })
-    )
-  )
-);
-
-// src/sdk/plugin.ts
-import {
-  SourceDetectionResult,
-  definePlugin,
-  resolveSecretBackedMap as resolveSharedSecretBackedMap
-} from "@executor-js/sdk/core";
-
-// src/sdk/connection.ts
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { CfWorkerJsonSchemaValidator } from "@modelcontextprotocol/sdk/validation/cfworker";
-import { Effect as Effect4 } from "effect";
-var buildEndpointUrl = (endpoint, queryParams) => {
-  const url = new URL(endpoint);
-  for (const [key, value] of Object.entries(queryParams)) {
-    url.searchParams.set(key, value);
-  }
-  return url;
-};
-var createClient = () => new Client(
-  { name: "executor-mcp", version: "0.1.0" },
-  {
-    capabilities: { elicitation: { form: {}, url: {} } },
-    jsonSchemaValidator: new CfWorkerJsonSchemaValidator()
-  }
-);
-var connectionFromClient = (client) => ({
-  client,
-  close: () => client.close()
-});
-var connectClient = (input) => Effect4.gen(function* () {
-  const client = createClient();
-  const transportInstance = input.createTransport();
-  yield* Effect4.tryPromise({
-    try: () => client.connect(transportInstance),
-    catch: (cause) => new McpConnectionError({
-      transport: input.transport,
-      message: `Failed connecting via ${input.transport}: ${cause instanceof Error ? cause.message : String(cause)}`
-    })
-  }).pipe(
-    Effect4.withSpan("plugin.mcp.connection.handshake", {
-      attributes: { "plugin.mcp.transport": input.transport }
-    })
-  );
-  return connectionFromClient(client);
-});
-var createMcpConnector = (input) => {
-  if (input.transport === "stdio") {
-    const command = input.command.trim();
-    if (!command) {
-      return Effect4.fail(
-        new McpConnectionError({
-          transport: "stdio",
-          message: "MCP stdio transport requires a command"
-        })
-      );
-    }
-    return Effect4.gen(function* () {
-      const { createStdioTransport } = yield* Effect4.tryPromise({
-        try: () => import("./stdio-connector-KNHLETKM.js"),
-        catch: (cause) => new McpConnectionError({
-          transport: "stdio",
-          message: `Failed to load stdio transport module: ${cause instanceof Error ? cause.message : String(cause)}`
-        })
-      });
-      return yield* connectClient({
-        transport: "stdio",
-        createTransport: () => createStdioTransport({
-          command,
-          args: input.args,
-          env: input.env,
-          cwd: input.cwd?.trim().length ? input.cwd.trim() : void 0
-        })
-      });
-    });
-  }
-  const headers = input.headers ?? {};
-  const remoteTransport = input.remoteTransport ?? "auto";
-  const requestInit = Object.keys(headers).length > 0 ? { headers } : void 0;
-  const endpoint = buildEndpointUrl(input.endpoint, input.queryParams ?? {});
-  const connectStreamableHttp = connectClient({
-    transport: "streamable-http",
-    createTransport: () => new StreamableHTTPClientTransport(endpoint, {
-      requestInit,
-      authProvider: input.authProvider
-    })
-  });
-  const connectSse = connectClient({
-    transport: "sse",
-    createTransport: () => new SSEClientTransport(endpoint, {
-      requestInit,
-      authProvider: input.authProvider
-    })
-  });
-  if (remoteTransport === "streamable-http") return connectStreamableHttp;
-  if (remoteTransport === "sse") return connectSse;
-  return connectStreamableHttp.pipe(Effect4.catch(() => connectSse));
-};
-
-// src/sdk/discover.ts
-import { Effect as Effect5 } from "effect";
-
-// src/sdk/manifest.ts
-import { Schema as Schema6 } from "effect";
-var ListedTool = Schema6.Struct({
-  name: Schema6.String,
-  description: Schema6.optional(Schema6.NullOr(Schema6.String)),
-  inputSchema: Schema6.optional(Schema6.Unknown),
-  parameters: Schema6.optional(Schema6.Unknown),
-  outputSchema: Schema6.optional(Schema6.Unknown),
-  annotations: Schema6.optional(McpToolAnnotations)
-});
-var ListToolsResult = Schema6.Struct({
-  tools: Schema6.Array(ListedTool)
-});
-var ServerInfo = Schema6.Struct({
-  name: Schema6.optional(Schema6.String),
-  version: Schema6.optional(Schema6.String)
-});
-var decodeListToolsResult = Schema6.decodeUnknownOption(ListToolsResult);
-var decodeServerInfo = Schema6.decodeUnknownOption(ServerInfo);
-var isListToolsResult = (value) => decodeListToolsResult(value)._tag === "Some";
-var sanitize = (value) => {
-  const s = value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-  return s || "tool";
-};
-var uniqueId = (value, seen) => {
-  const base = sanitize(value);
-  const n = (seen.get(base) ?? 0) + 1;
-  seen.set(base, n);
-  return n === 1 ? base : `${base}_${n}`;
-};
-var extractManifestFromListToolsResult = (listToolsResult, metadata) => {
-  const seen = /* @__PURE__ */ new Map();
-  const listed = decodeListToolsResult(listToolsResult).pipe(
-    (opt) => opt._tag === "Some" ? opt.value.tools : []
-  );
-  const server = decodeServerInfo(metadata?.serverInfo).pipe(
-    (opt) => opt._tag === "Some" ? { name: opt.value.name ?? null, version: opt.value.version ?? null } : null
-  );
-  const tools = listed.flatMap((tool) => {
-    const toolName = tool.name.trim();
-    if (!toolName) return [];
-    return [
-      {
-        toolId: uniqueId(toolName, seen),
-        toolName,
-        description: tool.description ?? null,
-        inputSchema: tool.inputSchema ?? tool.parameters,
-        outputSchema: tool.outputSchema,
-        annotations: tool.annotations
-      }
-    ];
-  });
-  return { server, tools };
-};
-var slugify = (value) => value.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-var hostnameOf = (url) => {
-  try {
-    return new URL(url).hostname;
-  } catch {
-    return null;
-  }
-};
-var basenameOf = (path) => path.trim().split(/[\\/]/).pop() ?? path.trim();
-var deriveMcpNamespace = (input) => {
-  if (input.name?.trim()) return slugify(input.name) || "mcp";
-  const fromEndpoint = input.endpoint?.trim() ? hostnameOf(input.endpoint) : null;
-  if (fromEndpoint) return slugify(fromEndpoint) || "mcp";
-  if (input.command?.trim()) return slugify(basenameOf(input.command)) || "mcp";
-  return "mcp";
-};
-
-// src/sdk/discover.ts
-var discoverTools = (connector) => Effect5.gen(function* () {
-  const connection = yield* connector.pipe(
-    Effect5.mapError(
-      (err) => new McpToolDiscoveryError({
-        stage: "connect",
-        message: `Failed connecting to MCP server: ${err.message}`
-      })
-    )
-  );
-  const listResult = yield* Effect5.tryPromise({
-    try: () => connection.client.listTools(),
-    catch: (cause) => new McpToolDiscoveryError({
-      stage: "list_tools",
-      message: `Failed listing MCP tools: ${cause instanceof Error ? cause.message : String(cause)}`
-    })
-  });
-  if (!isListToolsResult(listResult)) {
-    yield* Effect5.promise(() => connection.close().catch(() => {
-    }));
-    return yield* Effect5.fail(
-      new McpToolDiscoveryError({
-        stage: "list_tools",
-        message: "MCP listTools response did not match the expected schema"
-      })
-    );
-  }
-  const manifest = extractManifestFromListToolsResult(listResult, {
-    serverInfo: connection.client.getServerVersion?.()
-  });
-  yield* Effect5.promise(() => connection.close().catch(() => {
-  }));
-  return manifest;
-});
-
-// src/sdk/invoke.ts
-import { Cause, Effect as Effect6, Exit, Schema as Schema7, ScopedCache } from "effect";
-import { ElicitRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-import {
-  FormElicitation,
-  UrlElicitation
-} from "@executor-js/sdk/core";
-var asRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
-var connectionCacheKey = (sd, invokerScope) => sd.transport === "stdio" ? `stdio:${sd.command}` : (
-  // Remote sources may resolve per-user secrets (OAuth tokens, header
-  // auth) via scope shadowing, so two users invoking the same source
-  // get different Authorization headers. The connection caches that
-  // header in transport state, so the cache key must include the
-  // invoking scope — otherwise user B re-uses user A's connection
-  // (and user A's tokens).
-  `remote:${invokerScope}:${sd.endpoint}`
-);
-var McpElicitParams = Schema7.Union([
-  Schema7.Struct({
-    mode: Schema7.Literal("url"),
-    message: Schema7.String,
-    url: Schema7.String,
-    elicitationId: Schema7.optional(Schema7.String),
-    id: Schema7.optional(Schema7.String)
-  }),
-  Schema7.Struct({
-    mode: Schema7.optional(Schema7.Literal("form")),
-    message: Schema7.String,
-    requestedSchema: Schema7.Record(Schema7.String, Schema7.Unknown)
-  })
-]);
-var decodeElicitParams = Schema7.decodeUnknownSync(McpElicitParams);
-var toElicitationRequest = (params) => params.mode === "url" ? new UrlElicitation({
-  message: params.message,
-  url: params.url,
-  elicitationId: params.elicitationId ?? params.id ?? ""
-}) : new FormElicitation({
-  message: params.message,
-  requestedSchema: params.requestedSchema
-});
-var installElicitationHandler = (client, elicit) => {
-  client.setRequestHandler(
-    ElicitRequestSchema,
-    async (request) => {
-      const params = decodeElicitParams(request.params);
-      const req = toElicitationRequest(params);
-      const exit = await Effect6.runPromiseExit(elicit(req));
-      if (Exit.isSuccess(exit)) {
-        const response = exit.value;
-        return {
-          action: response.action,
-          ...response.action === "accept" && response.content ? { content: response.content } : {}
-        };
-      }
-      const failure = exit.cause.reasons.find(Cause.isFailReason);
-      if (failure) {
-        const err = failure.error;
-        if (err._tag === "ElicitationDeclinedError") {
-          return { action: err.action ?? "decline" };
-        }
-      }
-      throw Cause.squash(exit.cause);
-    }
-  );
-};
-var useConnection = (connection, toolName, args, elicit) => Effect6.gen(function* () {
-  installElicitationHandler(connection.client, elicit);
-  return yield* Effect6.tryPromise({
-    try: () => connection.client.callTool({ name: toolName, arguments: args }),
-    catch: (cause) => new McpInvocationError({
-      toolName,
-      message: `MCP tool call failed for ${toolName}: ${cause instanceof Error ? cause.message : String(cause)}`
-    })
-  }).pipe(
-    Effect6.withSpan("plugin.mcp.client.call_tool", {
-      attributes: { "mcp.tool.name": toolName }
-    })
-  );
-});
-var invokeMcpTool = (input) => {
-  const transport = input.sourceData.transport === "stdio" ? "stdio" : input.sourceData.remoteTransport ?? "auto";
-  return Effect6.gen(function* () {
-    const cacheKey = connectionCacheKey(input.sourceData, input.invokerScope);
-    const args = asRecord(input.args);
-    const connector = input.resolveConnector();
-    input.pendingConnectors.set(cacheKey, connector);
-    const cacheHit = yield* ScopedCache.has(input.connectionCache, cacheKey);
-    const firstConnection = yield* ScopedCache.get(input.connectionCache, cacheKey).pipe(
-      Effect6.withSpan("plugin.mcp.connection.acquire", {
-        attributes: {
-          "plugin.mcp.transport": transport,
-          "plugin.mcp.cache_key": cacheKey,
-          "plugin.mcp.attempt": 1,
-          "plugin.mcp.cache_hit": cacheHit
-        }
-      })
-    );
-    return yield* useConnection(
-      firstConnection,
-      input.toolName,
-      args,
-      input.elicit
-    ).pipe(
-      // On failure, invalidate the cache and retry once with a fresh
-      // connection. Matches the old invoker's retry-once semantics.
-      Effect6.catch(
-        () => Effect6.gen(function* () {
-          yield* ScopedCache.invalidate(input.connectionCache, cacheKey);
-          input.pendingConnectors.set(cacheKey, connector);
-          const fresh = yield* ScopedCache.get(input.connectionCache, cacheKey);
-          return yield* useConnection(
-            fresh,
-            input.toolName,
-            args,
-            input.elicit
-          );
-        }).pipe(
-          Effect6.withSpan("plugin.mcp.invoke.retry", {
-            attributes: {
-              "plugin.mcp.transport": transport,
-              "plugin.mcp.cache_key": cacheKey,
-              "mcp.tool.name": input.toolName
-            }
-          })
-        )
-      )
-    );
-  }).pipe(
-    Effect6.scoped,
-    Effect6.withSpan("plugin.mcp.invoke", {
-      attributes: {
-        "mcp.tool.name": input.toolName,
-        "plugin.mcp.tool_id": input.toolId,
-        "plugin.mcp.transport": transport
-      }
-    })
-  );
-};
-
-// src/sdk/probe-shape.ts
-import { Effect as Effect7 } from "effect";
-var INITIALIZE_BODY = JSON.stringify({
-  jsonrpc: "2.0",
-  id: 1,
-  method: "initialize",
-  params: {
-    protocolVersion: "2025-06-18",
-    capabilities: {},
-    clientInfo: { name: "executor-probe", version: "0" }
-  }
-});
-var readHeader = (headers, name) => {
-  const direct = headers.get(name);
-  if (direct !== null) return direct;
-  const lower = name.toLowerCase();
-  for (const [k, v] of headers) {
-    if (k.toLowerCase() === lower) return v;
-  }
-  return null;
-};
-var probeMcpEndpointShape = (endpoint, options = {}) => Effect7.gen(function* () {
-  const fetchImpl = options.fetch ?? globalThis.fetch;
-  const timeoutMs = options.timeoutMs ?? 8e3;
-  const outcome = yield* Effect7.tryPromise({
-    try: async () => {
-      const controller = new AbortController();
-      const timer = setTimeout(() => controller.abort(), timeoutMs);
-      try {
-        const classify = (response, method) => {
-          if (response.status === 401) {
-            const wwwAuth = readHeader(response.headers, "www-authenticate");
-            if (wwwAuth && /^\s*bearer\b/i.test(wwwAuth)) {
-              return { kind: "mcp", requiresAuth: true };
-            }
-            return {
-              kind: "not-mcp",
-              reason: "401 without Bearer WWW-Authenticate \u2014 not an MCP auth challenge"
-            };
-          }
-          if (response.status >= 200 && response.status < 300) {
-            if (method === "GET") {
-              const contentType = readHeader(response.headers, "content-type") ?? "";
-              if (!/^\s*text\/event-stream\b/i.test(contentType)) {
-                return {
-                  kind: "not-mcp",
-                  reason: "GET response is not an SSE stream"
-                };
-              }
-            }
-            return { kind: "mcp", requiresAuth: false };
-          }
-          return null;
-        };
-        const url = new URL(endpoint);
-        for (const [key, value] of Object.entries(options.queryParams ?? {})) {
-          url.searchParams.set(key, value);
-        }
-        const authHeaders = options.headers ?? {};
-        const postResponse = await fetchImpl(url, {
-          method: "POST",
-          headers: {
-            ...authHeaders,
-            "content-type": "application/json",
-            accept: "application/json, text/event-stream"
-          },
-          body: INITIALIZE_BODY,
-          signal: controller.signal
-        });
-        const postResult = classify(postResponse, "POST");
-        if (postResult) return postResult;
-        if ([404, 405, 406, 415].includes(postResponse.status)) {
-          const getResponse = await fetchImpl(url, {
-            method: "GET",
-            headers: { ...authHeaders, accept: "text/event-stream" },
-            signal: controller.signal
-          });
-          const getResult = classify(getResponse, "GET");
-          if (getResult) return getResult;
-        }
-        return {
-          kind: "not-mcp",
-          reason: `unexpected status ${postResponse.status} for initialize`
-        };
-      } finally {
-        clearTimeout(timer);
-      }
-    },
-    catch: (cause) => cause
-  }).pipe(
-    Effect7.catch(
-      (cause) => Effect7.succeed({
-        kind: "unreachable",
-        reason: cause instanceof Error ? cause.message : String(cause)
-      })
-    )
-  );
-  return outcome;
-}).pipe(Effect7.withSpan("mcp.plugin.probe_shape"));
-
-// src/sdk/plugin.ts
-import {
-  SECRET_REF_PREFIX
-} from "@executor-js/config";
-var toStoredSourceData = (config) => {
-  if (config.transport === "stdio") {
-    return {
-      transport: "stdio",
-      command: config.command,
-      args: config.args,
-      env: config.env,
-      cwd: config.cwd
-    };
-  }
-  return {
-    transport: "remote",
-    endpoint: config.endpoint,
-    remoteTransport: config.remoteTransport ?? "auto",
-    queryParams: config.queryParams,
-    headers: config.headers,
-    auth: config.auth ?? { kind: "none" }
-  };
-};
-var normalizeNamespace = (config) => config.namespace ?? deriveMcpNamespace({
-  name: config.name,
-  endpoint: config.transport === "remote" ? config.endpoint : void 0,
-  command: config.transport === "stdio" ? config.command : void 0
-});
-var toBinding = (entry) => new McpToolBinding({
-  toolId: entry.toolId,
-  toolName: entry.toolName,
-  description: entry.description,
-  inputSchema: entry.inputSchema,
-  outputSchema: entry.outputSchema,
-  annotations: entry.annotations
-});
-var makeOAuthProvider = (accessToken) => ({
-  get redirectUrl() {
-    return "http://localhost/oauth/callback";
-  },
-  get clientMetadata() {
-    return {
-      redirect_uris: ["http://localhost/oauth/callback"],
-      grant_types: ["authorization_code", "refresh_token"],
-      response_types: ["code"],
-      token_endpoint_auth_method: "none",
-      client_name: "Executor"
-    };
-  },
-  clientInformation: () => void 0,
-  saveClientInformation: () => void 0,
-  tokens: () => ({ access_token: accessToken, token_type: "Bearer" }),
-  saveTokens: () => void 0,
-  redirectToAuthorization: async () => {
-    throw new Error("MCP OAuth re-authorization required");
-  },
-  saveCodeVerifier: () => void 0,
-  codeVerifier: () => {
-    throw new Error("No active PKCE verifier");
-  },
-  saveDiscoveryState: () => void 0,
-  discoveryState: () => void 0
-});
-var remoteConnectionError = (message) => new McpConnectionError({ transport: "remote", message });
-var mcpDiscoveryError = (message) => new McpToolDiscoveryError({ stage: "list_tools", message });
-var resolveSecretBackedMap = (values, ctx) => resolveSharedSecretBackedMap({
-  values,
-  getSecret: ctx.secrets.get,
-  onMissing: (_name, value) => remoteConnectionError(`Failed to resolve secret "${value.secretId}"`),
-  onError: (err, _name, value) => "_tag" in err && err._tag === "SecretOwnedByConnectionError" ? remoteConnectionError(`Failed to resolve secret "${value.secretId}"`) : err
-}).pipe(
-  Effect8.mapError(
-    (err) => "_tag" in err && err._tag === "SecretOwnedByConnectionError" ? remoteConnectionError("Failed to resolve secret") : err
-  )
-);
-var plainStringMap = (values) => {
-  if (!values) return void 0;
-  const entries = Object.entries(values).filter(
-    (entry) => typeof entry[1] === "string"
-  );
-  return entries.length > 0 ? Object.fromEntries(entries) : void 0;
-};
-var resolveConnectorInput = (sd, ctx, allowStdio) => {
-  if (sd.transport === "stdio") {
-    if (!allowStdio) {
-      return Effect8.fail(
-        new McpConnectionError({
-          transport: "stdio",
-          message: "MCP stdio transport is disabled. Enable it by passing `dangerouslyAllowStdioMCP: true` to mcpPlugin() \u2014 only safe for trusted local contexts."
-        })
-      );
-    }
-    return Effect8.succeed({
-      transport: "stdio",
-      command: sd.command,
-      args: sd.args,
-      env: sd.env,
-      cwd: sd.cwd
-    });
-  }
-  return Effect8.gen(function* () {
-    const resolvedHeaders = yield* resolveSecretBackedMap(sd.headers, ctx);
-    const resolvedQueryParams = yield* resolveSecretBackedMap(sd.queryParams, ctx);
-    const headers = { ...resolvedHeaders ?? {} };
-    let authProvider;
-    const auth = sd.auth;
-    if (auth.kind === "header") {
-      const val = yield* ctx.secrets.get(auth.secretId).pipe(
-        Effect8.mapError(
-          (err) => "_tag" in err && err._tag === "SecretOwnedByConnectionError" ? remoteConnectionError(`Failed to resolve secret "${auth.secretId}"`) : err
-        )
-      );
-      if (val === null) {
-        return yield* Effect8.fail(
-          remoteConnectionError(`Failed to resolve secret "${auth.secretId}"`)
-        );
-      }
-      headers[auth.headerName] = auth.prefix ? `${auth.prefix}${val}` : val;
-    } else if (auth.kind === "oauth2") {
-      const accessToken = yield* ctx.connections.accessToken(auth.connectionId).pipe(
-        Effect8.mapError(
-          (err) => remoteConnectionError(
-            `Failed to resolve OAuth connection "${auth.connectionId}": ${"message" in err ? err.message : String(err)}`
-          )
-        )
-      );
-      authProvider = makeOAuthProvider(accessToken);
-    }
-    return {
-      transport: "remote",
-      endpoint: sd.endpoint,
-      remoteTransport: sd.remoteTransport,
-      queryParams: resolvedQueryParams,
-      headers: Object.keys(headers).length > 0 ? headers : void 0,
-      authProvider
-    };
-  });
-};
-var makeRuntime = () => Effect8.gen(function* () {
-  const cacheScope = yield* Scope.make();
-  const pendingConnectors = /* @__PURE__ */ new Map();
-  const connectionCache = yield* ScopedCache2.make({
-    lookup: (key) => Effect8.acquireRelease(
-      Effect8.suspend(() => {
-        const connector = pendingConnectors.get(key);
-        if (!connector) {
-          return Effect8.fail(
-            new McpConnectionError({
-              transport: "auto",
-              message: `No pending connector for key: ${key}`
-            })
-          );
-        }
-        return connector;
-      }),
-      (connection) => Effect8.promise(() => connection.close().catch(() => {
-      }))
-    ),
-    capacity: 64,
-    timeToLive: Duration.minutes(5)
-  }).pipe(Scope.provide(cacheScope));
-  return { connectionCache, pendingConnectors, cacheScope };
-});
-var secretRef = (id) => `${SECRET_REF_PREFIX}${id}`;
-var authToConfig = (auth) => {
-  if (!auth) return void 0;
-  if (auth.kind === "none") return { kind: "none" };
-  if (auth.kind === "header") {
-    return {
-      kind: "header",
-      headerName: auth.headerName,
-      secret: secretRef(auth.secretId),
-      prefix: auth.prefix
-    };
-  }
-  return {
-    kind: "oauth2",
-    connectionId: auth.connectionId
-  };
-};
-var toMcpConfigEntry = (namespace, sourceName, config) => {
-  if (config.transport === "stdio") {
-    const entry2 = {
-      kind: "mcp",
-      transport: "stdio",
-      name: sourceName,
-      command: config.command,
-      args: config.args,
-      env: config.env,
-      cwd: config.cwd,
-      namespace
-    };
-    return entry2;
-  }
-  const entry = {
-    kind: "mcp",
-    transport: "remote",
-    name: sourceName,
-    endpoint: config.endpoint,
-    remoteTransport: config.remoteTransport,
-    queryParams: plainStringMap(config.queryParams),
-    headers: plainStringMap(config.headers),
-    namespace,
-    auth: authToConfig(config.auth)
-  };
-  return entry;
-};
-var mcpPlugin = definePlugin((options) => {
-  const allowStdio = options?.dangerouslyAllowStdioMCP ?? false;
-  const runtimeRef = { current: null };
-  const ensureRuntime = () => runtimeRef.current ? Effect8.succeed(runtimeRef.current) : makeRuntime().pipe(
-    Effect8.tap(
-      (rt) => Effect8.sync(() => {
-        runtimeRef.current = rt;
-      })
-    )
-  );
-  return {
-    id: "mcp",
-    packageName: "@executor-js/plugin-mcp",
-    schema: mcpSchema,
-    storage: (deps) => makeMcpStore(deps),
-    extension: (ctx) => {
-      const probeEndpoint = (input) => Effect8.gen(function* () {
-        const endpoint = typeof input === "string" ? input : input.endpoint;
-        const trimmed = endpoint.trim();
-        if (!trimmed) {
-          return yield* Effect8.fail(remoteConnectionError("Endpoint URL is required"));
-        }
-        const name = yield* Effect8.try({
-          try: () => new URL(trimmed).hostname,
-          catch: () => "mcp"
-        }).pipe(
-          Effect8.orElseSucceed(() => "mcp")
-        );
-        const namespace = deriveMcpNamespace({ endpoint: trimmed });
-        const probeHeaders = typeof input === "string" ? void 0 : yield* resolveSecretBackedMap(input.headers, ctx);
-        const probeQueryParams = typeof input === "string" ? void 0 : yield* resolveSecretBackedMap(input.queryParams, ctx);
-        const connector = createMcpConnector({
-          transport: "remote",
-          endpoint: trimmed,
-          headers: probeHeaders,
-          queryParams: probeQueryParams
-        });
-        const result = yield* discoverTools(connector).pipe(
-          Effect8.map((m) => ({ ok: true, manifest: m })),
-          Effect8.catch(() => Effect8.succeed({ ok: false, manifest: null })),
-          Effect8.withSpan("mcp.plugin.discover_tools")
-        );
-        if (result.ok && result.manifest) {
-          return {
-            connected: true,
-            requiresOAuth: false,
-            name: result.manifest.server?.name ?? name,
-            namespace,
-            toolCount: result.manifest.tools.length,
-            serverName: result.manifest.server?.name ?? null
-          };
-        }
-        const shape = yield* probeMcpEndpointShape(trimmed, {
-          headers: probeHeaders,
-          queryParams: probeQueryParams
-        });
-        if (shape.kind !== "mcp") {
-          return yield* Effect8.fail(
-            remoteConnectionError(
-              shape.kind === "not-mcp" ? `Endpoint does not look like an MCP server: ${shape.reason}` : `Could not reach endpoint: ${shape.reason}`
-            )
-          );
-        }
-        const probeResult = yield* ctx.oauth.probe({
-          endpoint: trimmed,
-          headers: probeHeaders,
-          queryParams: probeQueryParams
-        }).pipe(
-          Effect8.map(() => true),
-          Effect8.catch(() => Effect8.succeed(false)),
-          Effect8.withSpan("mcp.plugin.probe_oauth")
-        );
-        if (probeResult) {
-          return {
-            connected: false,
-            requiresOAuth: true,
-            name,
-            namespace,
-            toolCount: null,
-            serverName: null
-          };
-        }
-        return yield* Effect8.fail(
-          remoteConnectionError("MCP server requires authentication but OAuth discovery failed")
-        );
-      }).pipe(
-        Effect8.withSpan("mcp.plugin.probe_endpoint", {
-          attributes: { "mcp.endpoint": typeof input === "string" ? input : input.endpoint }
-        })
-      );
-      const configFile = options?.configFile;
-      const addSource = (config) => Effect8.gen(function* () {
-        const namespace = normalizeNamespace(config);
-        const sd = toStoredSourceData(config);
-        const resolved = yield* resolveConnectorInput(sd, ctx, allowStdio).pipe(
-          Effect8.result,
-          Effect8.withSpan("mcp.plugin.resolve_connector", {
-            attributes: {
-              "mcp.source.namespace": namespace,
-              "mcp.source.transport": sd.transport
-            }
-          })
-        );
-        if (Result.isFailure(resolved) && sd.transport === "stdio") {
-          return yield* Effect8.fail(resolved.failure);
-        }
-        const discovery = Result.isSuccess(resolved) ? yield* discoverTools(createMcpConnector(resolved.success)).pipe(
-          Effect8.mapError(
-            (err) => mcpDiscoveryError(`MCP discovery failed: ${err.message}`)
-          ),
-          Effect8.result,
-          Effect8.withSpan("mcp.plugin.discover_tools", {
-            attributes: { "mcp.source.namespace": namespace }
-          })
-        ) : Result.fail(resolved.failure);
-        const manifest = Result.isSuccess(discovery) ? discovery.success : { server: void 0, tools: [] };
-        const sourceName = config.name ?? manifest.server?.name ?? namespace;
-        yield* ctx.transaction(
-          Effect8.gen(function* () {
-            yield* ctx.storage.removeBindingsByNamespace(namespace, config.scope);
-            yield* ctx.storage.removeSource(namespace, config.scope);
-            yield* ctx.storage.putSource({
-              namespace,
-              scope: config.scope,
-              name: sourceName,
-              config: sd
-            });
-            yield* ctx.storage.putBindings(
-              namespace,
-              config.scope,
-              manifest.tools.map((e) => ({
-                toolId: `${namespace}.${e.toolId}`,
-                binding: toBinding(e)
-              }))
-            );
-            yield* ctx.core.sources.register({
-              id: namespace,
-              scope: config.scope,
-              kind: "mcp",
-              name: sourceName,
-              url: sd.transport === "remote" ? sd.endpoint : void 0,
-              canRemove: true,
-              canRefresh: true,
-              canEdit: sd.transport === "remote",
-              tools: manifest.tools.map((e) => ({
-                name: e.toolId,
-                description: e.description ?? `MCP tool: ${e.toolName}`,
-                inputSchema: e.inputSchema,
-                outputSchema: e.outputSchema
-              }))
-            });
-          })
-        ).pipe(
-          Effect8.withSpan("mcp.plugin.persist_source", {
-            attributes: {
-              "mcp.source.namespace": namespace,
-              "mcp.source.tool_count": manifest.tools.length
-            }
-          })
-        );
-        if (configFile) {
-          yield* configFile.upsertSource(toMcpConfigEntry(namespace, sourceName, config)).pipe(Effect8.withSpan("mcp.plugin.config_file.upsert"));
-        }
-        if (Result.isFailure(discovery)) {
-          return yield* Effect8.fail(discovery.failure);
-        }
-        return { toolCount: manifest.tools.length, namespace };
-      }).pipe(
-        Effect8.withSpan("mcp.plugin.add_source", {
-          attributes: {
-            "mcp.source.transport": config.transport,
-            "mcp.source.name": config.name
-          }
-        })
-      );
-      const removeSource = (namespace, scope) => Effect8.gen(function* () {
-        yield* ctx.transaction(
-          Effect8.gen(function* () {
-            yield* ctx.storage.removeBindingsByNamespace(namespace, scope);
-            yield* ctx.storage.removeSource(namespace, scope);
-            yield* ctx.core.sources.unregister(namespace);
-          })
-        ).pipe(Effect8.withSpan("mcp.plugin.persist_remove"));
-        if (configFile) {
-          yield* configFile.removeSource(namespace).pipe(Effect8.withSpan("mcp.plugin.config_file.remove"));
-        }
-      }).pipe(
-        Effect8.withSpan("mcp.plugin.remove_source", {
-          attributes: { "mcp.source.namespace": namespace }
-        })
-      );
-      const refreshSource = (namespace, scope) => Effect8.gen(function* () {
-        const sd = yield* ctx.storage.getSourceConfig(namespace, scope).pipe(
-          Effect8.withSpan("mcp.plugin.load_source_config", {
-            attributes: { "mcp.source.namespace": namespace }
-          })
-        );
-        if (!sd) {
-          return yield* Effect8.fail(
-            remoteConnectionError(`No stored config for MCP source "${namespace}"`)
-          );
-        }
-        const ci = yield* resolveConnectorInput(sd, ctx, allowStdio).pipe(
-          Effect8.withSpan("mcp.plugin.resolve_connector", {
-            attributes: {
-              "mcp.source.namespace": namespace,
-              "mcp.source.transport": sd.transport
-            }
-          })
-        );
-        const manifest = yield* discoverTools(createMcpConnector(ci)).pipe(
-          Effect8.mapError((err) => mcpDiscoveryError(`MCP refresh failed: ${err.message}`)),
-          Effect8.withSpan("mcp.plugin.discover_tools", {
-            attributes: { "mcp.source.namespace": namespace }
-          })
-        );
-        const existing = yield* ctx.storage.getSource(namespace, scope);
-        const sourceName = manifest.server?.name ?? existing?.name ?? namespace;
-        yield* ctx.transaction(
-          Effect8.gen(function* () {
-            yield* ctx.storage.removeBindingsByNamespace(namespace, scope);
-            yield* ctx.core.sources.unregister(namespace);
-            yield* ctx.storage.putBindings(
-              namespace,
-              scope,
-              manifest.tools.map((e) => ({
-                toolId: `${namespace}.${e.toolId}`,
-                binding: toBinding(e)
-              }))
-            );
-            yield* ctx.core.sources.register({
-              id: namespace,
-              scope,
-              kind: "mcp",
-              name: sourceName,
-              url: sd.transport === "remote" ? sd.endpoint : void 0,
-              canRemove: true,
-              canRefresh: true,
-              canEdit: sd.transport === "remote",
-              tools: manifest.tools.map((e) => ({
-                name: e.toolId,
-                description: e.description ?? `MCP tool: ${e.toolName}`,
-                inputSchema: e.inputSchema,
-                outputSchema: e.outputSchema
-              }))
-            });
-          })
-        ).pipe(
-          Effect8.withSpan("mcp.plugin.persist_source", {
-            attributes: {
-              "mcp.source.namespace": namespace,
-              "mcp.source.tool_count": manifest.tools.length
-            }
-          })
-        );
-        return { toolCount: manifest.tools.length };
-      }).pipe(
-        Effect8.withSpan("mcp.plugin.refresh_source", {
-          attributes: { "mcp.source.namespace": namespace }
-        })
-      );
-      const updateSource = (namespace, scope, input) => Effect8.gen(function* () {
-        const existing = yield* ctx.storage.getSource(namespace, scope);
-        if (!existing || existing.config.transport !== "remote") return;
-        const remote = existing.config;
-        const updatedConfig = {
-          ...remote,
-          ...input.endpoint !== void 0 ? { endpoint: input.endpoint } : {},
-          ...input.headers !== void 0 ? { headers: input.headers } : {},
-          ...input.auth !== void 0 ? { auth: input.auth } : {},
-          ...input.queryParams !== void 0 ? { queryParams: input.queryParams } : {}
-        };
-        yield* ctx.storage.putSource({
-          namespace,
-          scope,
-          name: input.name?.trim() || existing.name,
-          config: updatedConfig
-        });
-      }).pipe(
-        Effect8.withSpan("mcp.plugin.update_source", {
-          attributes: { "mcp.source.namespace": namespace }
-        })
-      );
-      const getSource = (namespace, scope) => ctx.storage.getSource(namespace, scope).pipe(
-        Effect8.withSpan("mcp.plugin.get_source", {
-          attributes: { "mcp.source.namespace": namespace }
-        })
-      );
-      return {
-        probeEndpoint,
-        addSource,
-        removeSource,
-        refreshSource,
-        getSource,
-        updateSource
-      };
-    },
-    invokeTool: ({ ctx, toolRow, args, elicit }) => Effect8.gen(function* () {
-      const runtime = yield* ensureRuntime();
-      const toolScope = toolRow.scope_id;
-      const entry = yield* ctx.storage.getBinding(toolRow.id, toolScope).pipe(
-        Effect8.withSpan("mcp.plugin.load_binding", {
-          attributes: { "mcp.tool.name": toolRow.id }
-        })
-      );
-      if (!entry) {
-        return yield* Effect8.fail(new Error(`No MCP binding found for tool "${toolRow.id}"`));
-      }
-      const sd = yield* ctx.storage.getSourceConfig(entry.namespace, toolScope).pipe(
-        Effect8.withSpan("mcp.plugin.load_source_config", {
-          attributes: { "mcp.source.namespace": entry.namespace }
-        })
-      );
-      if (!sd) {
-        return yield* Effect8.fail(
-          new Error(`No MCP source config for namespace "${entry.namespace}"`)
-        );
-      }
-      return yield* invokeMcpTool({
-        toolId: toolRow.id,
-        toolName: entry.binding.toolName,
-        args,
-        sourceData: sd,
-        invokerScope: ctx.scopes[0].id,
-        resolveConnector: () => resolveConnectorInput(sd, ctx, allowStdio).pipe(
-          Effect8.flatMap((ci) => createMcpConnector(ci)),
-          Effect8.mapError(
-            (err) => err instanceof McpConnectionError ? err : new McpConnectionError({
-              transport: "auto",
-              message: err instanceof Error ? err.message : String(err)
-            })
-          ),
-          Effect8.withSpan("mcp.plugin.resolve_connector", {
-            attributes: {
-              "mcp.source.namespace": entry.namespace,
-              "mcp.source.transport": sd.transport
-            }
-          })
-        ),
-        connectionCache: runtime.connectionCache,
-        pendingConnectors: runtime.pendingConnectors,
-        elicit
-      });
-    }).pipe(
-      Effect8.withSpan("mcp.plugin.invoke_tool", {
-        attributes: {
-          "mcp.tool.name": toolRow.id,
-          "mcp.tool.source_id": toolRow.source_id
-        }
-      })
-    ),
-    detect: ({ ctx, url }) => Effect8.gen(function* () {
-      const trimmed = url.trim();
-      if (!trimmed) return null;
-      const parsed = yield* Effect8.try({
-        try: () => new URL(trimmed),
-        catch: (cause) => cause
-      }).pipe(Effect8.option);
-      if (parsed._tag === "None") return null;
-      const name = parsed.value.hostname || "mcp";
-      const namespace = deriveMcpNamespace({ endpoint: trimmed });
-      const connector = createMcpConnector({
-        transport: "remote",
-        endpoint: trimmed
-      });
-      const connected = yield* discoverTools(connector).pipe(
-        Effect8.map(() => true),
-        Effect8.catch(() => Effect8.succeed(false)),
-        Effect8.withSpan("mcp.plugin.discover_tools")
-      );
-      if (connected) {
-        return new SourceDetectionResult({
-          kind: "mcp",
-          confidence: "high",
-          endpoint: trimmed,
-          name,
-          namespace
-        });
-      }
-      const shape = yield* probeMcpEndpointShape(trimmed);
-      if (shape.kind !== "mcp") return null;
-      const probeOk = yield* ctx.oauth.probe({ endpoint: trimmed }).pipe(
-        Effect8.map(() => true),
-        Effect8.catch(() => Effect8.succeed(false)),
-        Effect8.withSpan("mcp.plugin.probe_oauth")
-      );
-      if (!probeOk) return null;
-      return new SourceDetectionResult({
-        kind: "mcp",
-        confidence: "high",
-        endpoint: trimmed,
-        name,
-        namespace
-      });
-    }).pipe(
-      Effect8.catch(() => Effect8.succeed(null)),
-      Effect8.withSpan("mcp.plugin.detect", {
-        attributes: { "mcp.endpoint": url }
-      })
-    ),
-    // Honor upstream destructiveHint from MCP ToolAnnotations.
-    // Bindings are fetched per scope so shadowed sources (e.g. an org-level
-    // source overridden per-user) each resolve against their own scope's
-    // row rather than collapsing onto whichever row the scoped adapter
-    // sees first.
-    resolveAnnotations: ({ ctx, sourceId, toolRows }) => Effect8.gen(function* () {
-      const scopes = new Set(toolRows.map((row) => row.scope_id));
-      const entries = yield* Effect8.forEach(
-        [...scopes],
-        (scope) => Effect8.gen(function* () {
-          const list = yield* ctx.storage.listBindingsBySource(sourceId, scope);
-          const byId = new Map(list.map((e) => [e.toolId, e.binding]));
-          return [scope, byId];
-        }),
-        { concurrency: "unbounded" }
-      );
-      const byScope = new Map(entries);
-      const out = {};
-      for (const row of toolRows) {
-        const binding = byScope.get(row.scope_id)?.get(row.id);
-        const ann = binding?.annotations;
-        if (ann?.destructiveHint === true) {
-          out[row.id] = {
-            requiresApproval: true,
-            approvalDescription: ann.title ?? binding?.toolName ?? row.id
-          };
-        } else {
-          out[row.id] = { requiresApproval: false };
-        }
-      }
-      return out;
-    }),
-    removeSource: ({ ctx, sourceId, scope }) => Effect8.gen(function* () {
-      yield* ctx.storage.removeBindingsByNamespace(sourceId, scope);
-      yield* ctx.storage.removeSource(sourceId, scope);
-    }),
-    refreshSource: () => Effect8.void,
-    // Connection refresh for oauth2-minted sources is owned by the
-    // canonical `"oauth2"` ConnectionProvider that core registers via
-    // `makeOAuth2Service`. No MCP-specific provider needed.
-    close: () => Effect8.gen(function* () {
-      const runtime = runtimeRef.current;
-      if (runtime) {
-        runtime.pendingConnectors.clear();
-        yield* ScopedCache2.invalidateAll(runtime.connectionCache);
-        yield* Scope.close(runtime.cacheScope, Exit2.void);
-        runtimeRef.current = null;
-      }
-    }).pipe(Effect8.withSpan("mcp.plugin.close")),
-    // HTTP transport. `McpHandlers` requires `McpExtensionService`; the
-    // host satisfies it via the `extensionService` Tag — at boot for
-    // local, per request for cloud.
-    routes: () => McpGroup,
-    handlers: () => McpHandlers,
-    extensionService: McpExtensionService
-  };
-});
-
-export {
-  McpConnectionAuth,
-  mcpSchema,
-  makeMcpStore,
-  mcpPlugin
-};
-//# sourceMappingURL=chunk-C2GNZGFJ.js.map