@executor-js/plugin-mcp 1.4.32 → 1.5.0

package/dist/chunk-LEGVPKYH.js

@@ -1,2391 +0,0 @@
-import {
-  mcpPresets
-} from "./chunk-TW44CBXJ.js";
-import {
-  MCP_OAUTH_CLIENT_ID_SLOT,
-  MCP_OAUTH_CLIENT_SECRET_SLOT,
-  MCP_OAUTH_CONNECTION_SLOT,
-  McpAuthRequiredError,
-  McpConfiguredValueInput,
-  McpConnectionAuthInput,
-  McpConnectionError,
-  McpCredentialInput,
-  McpInvocationError,
-  McpRemoteTransport,
-  McpStoredSourceData,
-  McpToolAnnotations,
-  McpToolBinding,
-  McpToolDiscoveryError,
-  SecretBackedValue,
-  mcpHeaderSlot,
-  mcpQueryParamSlot
-} from "./chunk-6OYEXHU3.js";
-
-// src/sdk/binding-store.ts
-import { Effect, Option, Predicate, Schema } from "effect";
-var mcpSchema = {};
-var SOURCE_COLLECTION = "source";
-var BINDING_COLLECTION = "binding";
-var decodeSourceData = Schema.decodeUnknownSync(McpStoredSourceData);
-var encodeSourceData = Schema.encodeSync(McpStoredSourceData);
-var decodeBinding = Schema.decodeUnknownSync(McpToolBinding);
-var encodeBinding = Schema.encodeSync(McpToolBinding);
-var decodeJson = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Unknown));
-var coerceJson = (value) => {
-  if (typeof value !== "string") return value;
-  return Option.getOrElse(decodeJson(value), () => value);
-};
-var sourceData = (source) => ({
-  namespace: source.namespace,
-  scope: source.scope,
-  name: source.name,
-  config: encodeSourceData(source.config)
-});
-var bindingData = (namespace, entry) => ({
-  namespace,
-  toolId: entry.toolId,
-  binding: encodeBinding(entry.binding)
-});
-var rowToSource = (row) => {
-  const raw = coerceJson(row.data);
-  if (!raw || typeof raw !== "object") return null;
-  const record = raw;
-  if (typeof record.namespace !== "string" || typeof record.scope !== "string" || typeof record.name !== "string") {
-    return null;
-  }
-  return {
-    namespace: record.namespace,
-    scope: record.scope,
-    name: record.name,
-    config: decodeSourceData(coerceJson(record.config))
-  };
-};
-var rowToBinding = (row) => {
-  const raw = coerceJson(row.data);
-  if (!raw || typeof raw !== "object") return null;
-  const record = raw;
-  if (typeof record.toolId !== "string" || typeof record.namespace !== "string") return null;
-  return {
-    toolId: record.toolId,
-    namespace: record.namespace,
-    binding: decodeBinding(coerceJson(record.binding))
-  };
-};
-var makeMcpStore = ({ pluginStorage }) => {
-  const listBindingRowsForSourceScope = (namespace, scope) => pluginStorage.list({
-    collection: BINDING_COLLECTION,
-    keyPrefix: `${namespace}.`
-  }).pipe(
-    Effect.map(
-      (rows) => rows.filter((row) => {
-        if (String(row.scopeId) !== scope) return false;
-        return rowToBinding(row)?.namespace === namespace;
-      })
-    )
-  );
-  const removeBindingsForSourceScope = (namespace, scope) => Effect.gen(function* () {
-    const rows = yield* listBindingRowsForSourceScope(namespace, scope);
-    for (const row of rows) {
-      yield* pluginStorage.remove({
-        scope,
-        collection: BINDING_COLLECTION,
-        key: row.key
-      });
-    }
-  });
-  return {
-    listBindingsBySource: (namespace, scope) => listBindingRowsForSourceScope(namespace, scope).pipe(
-      Effect.map(
-        (rows) => rows.map(rowToBinding).filter(Predicate.isNotNull).map((row) => ({ toolId: row.toolId, binding: row.binding }))
-      )
-    ),
-    getBinding: (toolId, scope) => pluginStorage.getAtScope({ scope, collection: BINDING_COLLECTION, key: toolId }).pipe(
-      Effect.map((row) => {
-        const binding = row ? rowToBinding(row) : null;
-        return binding ? { binding: binding.binding, namespace: binding.namespace } : null;
-      })
-    ),
-    putBindings: (namespace, scope, entries) => Effect.gen(function* () {
-      for (const entry of entries) {
-        yield* pluginStorage.put({
-          scope,
-          collection: BINDING_COLLECTION,
-          key: entry.toolId,
-          data: bindingData(namespace, entry)
-        });
-      }
-    }),
-    removeBindingsByNamespace: (namespace, scope) => removeBindingsForSourceScope(namespace, scope),
-    getSource: (namespace, scope) => pluginStorage.getAtScope({ scope, collection: SOURCE_COLLECTION, key: namespace }).pipe(Effect.map((row) => row ? rowToSource(row) : null)),
-    getSourceConfig: (namespace, scope) => pluginStorage.getAtScope({ scope, collection: SOURCE_COLLECTION, key: namespace }).pipe(
-      Effect.map((row) => {
-        const source = row ? rowToSource(row) : null;
-        return source?.config ?? null;
-      })
-    ),
-    putSource: (source) => pluginStorage.put({
-      scope: source.scope,
-      collection: SOURCE_COLLECTION,
-      key: source.namespace,
-      data: sourceData(source)
-    }).pipe(Effect.asVoid),
-    removeSource: (namespace, scope) => Effect.gen(function* () {
-      yield* removeBindingsForSourceScope(namespace, scope);
-      yield* pluginStorage.remove({
-        scope,
-        collection: SOURCE_COLLECTION,
-        key: namespace
-      });
-    })
-  };
-};
-
-// src/sdk/plugin.ts
-import {
-  Duration as Duration2,
-  Effect as Effect6,
-  Exit as Exit2,
-  Match,
-  Option as Option5,
-  Predicate as Predicate3,
-  Result,
-  Scope,
-  Schema as Schema5,
-  ScopedCache as ScopedCache2
-} from "effect";
-import { CallToolResultSchema } from "@modelcontextprotocol/sdk/types.js";
-import * as z from "zod/v4";
-import {
-  ScopeId,
-  SourceDetectionResult,
-  ToolResult,
-  authToolFailure,
-  defaultSourceInstallScopeId,
-  definePlugin,
-  tool,
-  resolveSecretBackedMap as resolveSharedSecretBackedMap,
-  StorageError
-} from "@executor-js/sdk/core";
-import {
-  compileHttpNamedCredentialMap,
-  OAuth2SourceConfig,
-  httpCredentialInputToBindingValue
-} from "@executor-js/sdk/http-source";
-
-// src/sdk/connection.ts
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { CfWorkerJsonSchemaValidator } from "@modelcontextprotocol/sdk/validation/cfworker";
-import { Effect as Effect2 } from "effect";
-var buildEndpointUrl = (endpoint, queryParams) => {
-  const url = new URL(endpoint);
-  for (const [key, value] of Object.entries(queryParams)) {
-    url.searchParams.set(key, value);
-  }
-  return url;
-};
-var createClient = () => new Client(
-  { name: "executor-mcp", version: "0.1.0" },
-  {
-    capabilities: { elicitation: { form: {}, url: {} } },
-    jsonSchemaValidator: new CfWorkerJsonSchemaValidator()
-  }
-);
-var connectionFromClient = (client) => ({
-  client,
-  close: () => client.close()
-});
-var connectClient = (input) => Effect2.gen(function* () {
-  const client = createClient();
-  const transportInstance = input.createTransport();
-  yield* Effect2.tryPromise({
-    try: () => client.connect(transportInstance),
-    catch: () => new McpConnectionError({
-      transport: input.transport,
-      message: `Failed connecting via ${input.transport}`
-    })
-  }).pipe(
-    Effect2.withSpan("plugin.mcp.connection.handshake", {
-      attributes: { "plugin.mcp.transport": input.transport }
-    })
-  );
-  return connectionFromClient(client);
-});
-var createMcpConnector = (input) => {
-  if (input.transport === "stdio") {
-    const command = input.command.trim();
-    if (!command) {
-      return Effect2.fail(
-        new McpConnectionError({
-          transport: "stdio",
-          message: "MCP stdio transport requires a command"
-        })
-      );
-    }
-    return Effect2.gen(function* () {
-      const { createStdioTransport } = yield* Effect2.tryPromise({
-        try: () => import("./stdio-connector-AA5S6UUJ.js"),
-        catch: () => new McpConnectionError({
-          transport: "stdio",
-          message: "Failed to load stdio transport module"
-        })
-      });
-      return yield* connectClient({
-        transport: "stdio",
-        createTransport: () => createStdioTransport({
-          command,
-          args: input.args,
-          env: input.env,
-          cwd: input.cwd?.trim().length ? input.cwd.trim() : void 0
-        })
-      });
-    });
-  }
-  const headers = input.headers ?? {};
-  const remoteTransport = input.remoteTransport ?? "auto";
-  const requestInit = Object.keys(headers).length > 0 ? { headers } : void 0;
-  const endpoint = buildEndpointUrl(input.endpoint, input.queryParams ?? {});
-  const connectStreamableHttp = connectClient({
-    transport: "streamable-http",
-    createTransport: () => new StreamableHTTPClientTransport(endpoint, {
-      requestInit,
-      authProvider: input.authProvider
-    })
-  });
-  const connectSse = connectClient({
-    transport: "sse",
-    createTransport: () => new SSEClientTransport(endpoint, {
-      requestInit,
-      authProvider: input.authProvider
-    })
-  });
-  if (remoteTransport === "streamable-http") return connectStreamableHttp;
-  if (remoteTransport === "sse") return connectSse;
-  return connectStreamableHttp.pipe(Effect2.catch(() => connectSse));
-};
-
-// src/sdk/discover.ts
-import { Effect as Effect3 } from "effect";
-
-// src/sdk/manifest.ts
-import { Option as Option2, Schema as Schema2 } from "effect";
-var ListedTool = Schema2.Struct({
-  name: Schema2.String,
-  description: Schema2.optional(Schema2.NullOr(Schema2.String)),
-  inputSchema: Schema2.optional(Schema2.Unknown),
-  parameters: Schema2.optional(Schema2.Unknown),
-  outputSchema: Schema2.optional(Schema2.Unknown),
-  annotations: Schema2.optional(McpToolAnnotations)
-});
-var ListToolsResult = Schema2.Struct({
-  tools: Schema2.Array(ListedTool)
-});
-var ServerInfo = Schema2.Struct({
-  name: Schema2.optional(Schema2.String),
-  version: Schema2.optional(Schema2.String)
-});
-var decodeListToolsResult = Schema2.decodeUnknownOption(ListToolsResult);
-var decodeServerInfo = Schema2.decodeUnknownOption(ServerInfo);
-var isListToolsResult = (value) => Option2.isSome(decodeListToolsResult(value));
-var sanitize = (value) => {
-  const s = value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-  return s || "tool";
-};
-var uniqueId = (value, seen) => {
-  const base = sanitize(value);
-  const n = (seen.get(base) ?? 0) + 1;
-  seen.set(base, n);
-  return n === 1 ? base : `${base}_${n}`;
-};
-var extractManifestFromListToolsResult = (listToolsResult, metadata) => {
-  const seen = /* @__PURE__ */ new Map();
-  const listed = decodeListToolsResult(listToolsResult).pipe(
-    Option2.map((result) => result.tools),
-    Option2.getOrElse(() => [])
-  );
-  const server = decodeServerInfo(metadata?.serverInfo).pipe(
-    Option2.map(
-      (info) => ({
-        name: info.name ?? null,
-        version: info.version ?? null
-      })
-    ),
-    Option2.getOrNull
-  );
-  const tools = listed.flatMap((tool2) => {
-    const toolName = tool2.name.trim();
-    if (!toolName) return [];
-    return [
-      {
-        toolId: uniqueId(toolName, seen),
-        toolName,
-        description: tool2.description ?? null,
-        inputSchema: tool2.inputSchema ?? tool2.parameters,
-        outputSchema: tool2.outputSchema,
-        annotations: tool2.annotations
-      }
-    ];
-  });
-  return { server, tools };
-};
-var slugify = (value) => value.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-var hostnameOf = (url) => {
-  if (!URL.canParse(url)) return null;
-  return new URL(url).hostname;
-};
-var basenameOf = (path) => path.trim().split(/[\\/]/).pop() ?? path.trim();
-var deriveMcpNamespace = (input) => {
-  if (input.name?.trim()) return slugify(input.name) || "mcp";
-  const fromEndpoint = input.endpoint?.trim() ? hostnameOf(input.endpoint) : null;
-  if (fromEndpoint) return slugify(fromEndpoint) || "mcp";
-  if (input.command?.trim()) return slugify(basenameOf(input.command)) || "mcp";
-  return "mcp";
-};
-
-// src/sdk/discover.ts
-var discoverTools = (connector) => Effect3.gen(function* () {
-  const connection = yield* connector.pipe(
-    Effect3.mapError(
-      ({ message }) => new McpToolDiscoveryError({
-        stage: "connect",
-        message: `Failed connecting to MCP server: ${message}`
-      })
-    )
-  );
-  const listResult = yield* Effect3.tryPromise({
-    try: () => connection.client.listTools(),
-    catch: () => new McpToolDiscoveryError({
-      stage: "list_tools",
-      message: "Failed listing MCP tools"
-    })
-  });
-  if (!isListToolsResult(listResult)) {
-    yield* closeConnection(connection);
-    return yield* new McpToolDiscoveryError({
-      stage: "list_tools",
-      message: "MCP listTools response did not match the expected schema"
-    });
-  }
-  const manifest = extractManifestFromListToolsResult(listResult, {
-    serverInfo: connection.client.getServerVersion?.()
-  });
-  yield* closeConnection(connection);
-  return manifest;
-});
-var closeConnection = (connection) => Effect3.ignore(
-  Effect3.tryPromise({
-    try: () => connection.close(),
-    catch: () => new McpToolDiscoveryError({
-      stage: "list_tools",
-      message: "Failed closing MCP connection"
-    })
-  })
-);
-
-// src/sdk/invoke.ts
-import { Cause, Effect as Effect4, Exit, Option as Option3, Predicate as Predicate2, Schema as Schema3, ScopedCache } from "effect";
-import { ElicitRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-import {
-  FormElicitation,
-  UrlElicitation
-} from "@executor-js/sdk/core";
-var ArgsRecord = Schema3.Record(Schema3.String, Schema3.Unknown);
-var decodeArgsRecord = Schema3.decodeUnknownOption(ArgsRecord);
-var argsRecord = (value) => Option3.getOrElse(decodeArgsRecord(value), () => ({}));
-var stableJson = (value) => {
-  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
-  if (value && typeof value === "object") {
-    return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`).join(",")}}`;
-  }
-  return JSON.stringify(value);
-};
-var fingerprint = (value) => {
-  const input = stableJson(value);
-  let hash = 2166136261;
-  for (let i = 0; i < input.length; i++) {
-    hash ^= input.charCodeAt(i);
-    hash = Math.imul(hash, 16777619);
-  }
-  return (hash >>> 0).toString(16).padStart(8, "0");
-};
-var connectionCacheKey = (input) => {
-  const sd = input.sourceData;
-  return sd.transport === "stdio" ? `stdio:${fingerprint({
-    sourceId: input.sourceId,
-    sourceScope: input.sourceScope,
-    command: sd.command,
-    args: sd.args ?? [],
-    env: sd.env ?? {},
-    cwd: sd.cwd ?? null
-  })}` : `remote:${fingerprint({
-    sourceId: input.sourceId,
-    sourceScope: input.sourceScope,
-    invokerScope: input.invokerScope,
-    endpoint: sd.endpoint,
-    remoteTransport: sd.remoteTransport ?? "auto",
-    headers: sd.headers ?? {},
-    queryParams: sd.queryParams ?? {},
-    auth: sd.auth
-  })}`;
-};
-var McpElicitParams = Schema3.Union([
-  Schema3.Struct({
-    mode: Schema3.Literal("url"),
-    message: Schema3.String,
-    url: Schema3.String,
-    elicitationId: Schema3.optional(Schema3.String),
-    id: Schema3.optional(Schema3.String)
-  }),
-  Schema3.Struct({
-    mode: Schema3.optional(Schema3.Literal("form")),
-    message: Schema3.String,
-    requestedSchema: Schema3.Record(Schema3.String, Schema3.Unknown)
-  })
-]);
-var decodeElicitParams = Schema3.decodeUnknownSync(McpElicitParams);
-var toElicitationRequest = (params) => params.mode === "url" ? UrlElicitation.make({
-  message: params.message,
-  url: params.url,
-  elicitationId: params.elicitationId ?? params.id ?? ""
-}) : FormElicitation.make({
-  message: params.message,
-  requestedSchema: params.requestedSchema
-});
-var installElicitationHandler = (client, elicit) => {
-  client.setRequestHandler(ElicitRequestSchema, async (request) => {
-    const params = decodeElicitParams(request.params);
-    const req = toElicitationRequest(params);
-    const exit = await Effect4.runPromiseExit(elicit(req));
-    if (Exit.isSuccess(exit)) {
-      const response = exit.value;
-      return {
-        action: response.action,
-        ...response.action === "accept" && response.content ? { content: response.content } : {}
-      };
-    }
-    const failure = exit.cause.reasons.find(Cause.isFailReason);
-    if (failure) {
-      const err = failure.error;
-      if (Predicate2.isTagged(err, "ElicitationDeclinedError")) {
-        const action = Predicate2.hasProperty(err, "action") && err.action === "cancel" ? "cancel" : "decline";
-        return { action };
-      }
-    }
-    throw Cause.squash(exit.cause);
-  });
-};
-var useConnection = (connection, toolName, args, elicit) => Effect4.gen(function* () {
-  installElicitationHandler(connection.client, elicit);
-  return yield* Effect4.tryPromise({
-    try: () => connection.client.callTool({ name: toolName, arguments: args }),
-    catch: () => new McpInvocationError({
-      toolName,
-      message: `MCP tool call failed for ${toolName}`
-    })
-  }).pipe(
-    Effect4.withSpan("plugin.mcp.client.call_tool", {
-      attributes: { "mcp.tool.name": toolName }
-    })
-  );
-});
-var invokeMcpTool = (input) => {
-  const transport = input.sourceData.transport === "stdio" ? "stdio" : input.sourceData.remoteTransport ?? "auto";
-  return Effect4.gen(function* () {
-    const cacheKey = connectionCacheKey(input);
-    const args = argsRecord(input.args);
-    const connector = input.resolveConnector();
-    input.pendingConnectors.set(cacheKey, connector);
-    const cacheHit = yield* ScopedCache.has(input.connectionCache, cacheKey);
-    const firstConnection = yield* ScopedCache.get(input.connectionCache, cacheKey).pipe(
-      Effect4.withSpan("plugin.mcp.connection.acquire", {
-        attributes: {
-          "plugin.mcp.transport": transport,
-          "plugin.mcp.cache_key": cacheKey,
-          "plugin.mcp.attempt": 1,
-          "plugin.mcp.cache_hit": cacheHit
-        }
-      })
-    );
-    return yield* useConnection(firstConnection, input.toolName, args, input.elicit).pipe(
-      // On failure, invalidate the cache and retry once with a fresh
-      // connection. Matches the old invoker's retry-once semantics.
-      Effect4.catch(
-        () => Effect4.gen(function* () {
-          yield* ScopedCache.invalidate(input.connectionCache, cacheKey);
-          input.pendingConnectors.set(cacheKey, connector);
-          const fresh = yield* ScopedCache.get(input.connectionCache, cacheKey);
-          return yield* useConnection(fresh, input.toolName, args, input.elicit);
-        }).pipe(
-          Effect4.withSpan("plugin.mcp.invoke.retry", {
-            attributes: {
-              "plugin.mcp.transport": transport,
-              "plugin.mcp.cache_key": cacheKey,
-              "mcp.tool.name": input.toolName
-            }
-          })
-        )
-      )
-    );
-  }).pipe(
-    Effect4.scoped,
-    Effect4.withSpan("plugin.mcp.invoke", {
-      attributes: {
-        "mcp.tool.name": input.toolName,
-        "plugin.mcp.tool_id": input.toolId,
-        "plugin.mcp.transport": transport
-      }
-    })
-  );
-};
-
-// src/sdk/probe-shape.ts
-import { Data, Duration, Effect as Effect5, Option as Option4, Schema as Schema4 } from "effect";
-import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/unstable/http";
-var INITIALIZE_BODY = JSON.stringify({
-  jsonrpc: "2.0",
-  id: 1,
-  method: "initialize",
-  params: {
-    protocolVersion: "2025-06-18",
-    capabilities: {},
-    clientInfo: { name: "executor-probe", version: "0" }
-  }
-});
-var readHeader = (headers, name) => {
-  const direct = headers[name];
-  if (direct !== void 0) return direct;
-  const lower = name.toLowerCase();
-  for (const [k, v] of Object.entries(headers)) {
-    if (k.toLowerCase() === lower) return v;
-  }
-  return null;
-};
-var ProbeTransportError = class extends Data.TaggedError("ProbeTransportError") {
-};
-var decodeJsonString = Schema4.decodeUnknownOption(Schema4.fromJsonString(Schema4.Unknown));
-var asObject = (body) => {
-  if (!body) return null;
-  const parsed = decodeJsonString(body);
-  if (Option4.isNone(parsed)) return null;
-  const value = parsed.value;
-  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
-  return value;
-};
-var isJsonRpcEnvelope = (body) => {
-  const obj = asObject(body);
-  if (!obj) return false;
-  if (obj.jsonrpc !== "2.0") return false;
-  return "result" in obj || "error" in obj || "method" in obj;
-};
-var isOAuthErrorBody = (body) => {
-  const obj = asObject(body);
-  if (!obj) return false;
-  if (Array.isArray(obj.errors)) return false;
-  return typeof obj.error === "string";
-};
-var ProtectedResourceMetadata = Schema4.Struct({
-  resource: Schema4.String,
-  authorization_servers: Schema4.Array(Schema4.String)
-});
-var decodeProtectedResourceMetadata = Schema4.decodeUnknownOption(
-  Schema4.fromJsonString(ProtectedResourceMetadata)
-);
-var protectedResourceMetadataUrl = (endpoint) => {
-  const path = endpoint.pathname === "/" ? "" : endpoint.pathname;
-  return `${endpoint.origin}/.well-known/oauth-protected-resource${path}`;
-};
-var resourceMatchesEndpoint = (resource, endpoint) => {
-  if (!URL.canParse(resource)) return false;
-  const parsed = new URL(resource);
-  if (parsed.origin !== endpoint.origin) return false;
-  const resourcePath = parsed.pathname.replace(/\/+$/, "");
-  const endpointPath = endpoint.pathname.replace(/\/+$/, "");
-  return endpointPath === resourcePath || endpointPath.startsWith(`${resourcePath}/`);
-};
-var probeProtectedResourceMetadata = (client, endpoint, timeoutMs) => Effect5.gen(function* () {
-  const response = yield* client.execute(
-    HttpClientRequest.get(protectedResourceMetadataUrl(endpoint)).pipe(
-      HttpClientRequest.setHeader("accept", "application/json")
-    )
-  ).pipe(Effect5.timeout(Duration.millis(timeoutMs)));
-  if (response.status < 200 || response.status >= 300) return false;
-  const body = yield* response.text.pipe(
-    Effect5.timeout(Duration.millis(timeoutMs)),
-    Effect5.catch(() => Effect5.succeed(""))
-  );
-  const metadata = decodeProtectedResourceMetadata(body);
-  if (Option4.isNone(metadata)) return false;
-  if (metadata.value.authorization_servers.length === 0) return false;
-  return resourceMatchesEndpoint(metadata.value.resource, endpoint);
-}).pipe(Effect5.catch(() => Effect5.succeed(false)));
-var ErrorMessageShape = Schema4.Struct({ message: Schema4.String });
-var decodeErrorMessageShape = Schema4.decodeUnknownOption(ErrorMessageShape);
-var reasonFromBoundaryCause = (cause) => {
-  const messageShape = decodeErrorMessageShape(cause);
-  if (Option4.isSome(messageShape)) return messageShape.value.message;
-  if (typeof cause === "string") return cause;
-  if (typeof cause === "number" || typeof cause === "boolean" || typeof cause === "bigint") {
-    return `${cause}`;
-  }
-  if (typeof cause === "symbol") return cause.description ?? "symbol";
-  if (cause === null) return "null";
-  if (typeof cause === "undefined") return "undefined";
-  return "fetch failed";
-};
-var probeMcpEndpointShape = (endpoint, options = {}) => Effect5.gen(function* () {
-  const timeoutMs = options.timeoutMs ?? 8e3;
-  const outcome = yield* Effect5.gen(function* () {
-    const client = yield* HttpClient.HttpClient;
-    const readBody = (response) => response.text.pipe(
-      Effect5.timeout(Duration.millis(timeoutMs)),
-      Effect5.catch(() => Effect5.succeed(""))
-    );
-    const classify = (response, method) => Effect5.gen(function* () {
-      const contentType = readHeader(response.headers, "content-type") ?? "";
-      const isSse = /^\s*text\/event-stream\b/i.test(contentType);
-      if (response.status === 401) {
-        const wwwAuth = readHeader(response.headers, "www-authenticate");
-        if (!wwwAuth || !/^\s*bearer\b/i.test(wwwAuth)) {
-          if (yield* probeProtectedResourceMetadata(client, url, timeoutMs)) {
-            return { kind: "mcp", requiresAuth: true };
-          }
-          return {
-            kind: "not-mcp",
-            category: "auth-required",
-            reason: "401 without Bearer WWW-Authenticate \u2014 not an MCP auth challenge"
-          };
-        }
-        if (/(?:^|[\s,])resource_metadata\s*=/i.test(wwwAuth)) {
-          return { kind: "mcp", requiresAuth: true };
-        }
-        if (/(?:^|[\s,])error\s*=/i.test(wwwAuth)) {
-          return { kind: "mcp", requiresAuth: true };
-        }
-        if (isSse) return { kind: "mcp", requiresAuth: true };
-        const body = yield* readBody(response);
-        if (!isJsonRpcEnvelope(body) && !isOAuthErrorBody(body)) {
-          if (yield* probeProtectedResourceMetadata(client, url, timeoutMs)) {
-            return { kind: "mcp", requiresAuth: true };
-          }
-          return {
-            kind: "not-mcp",
-            category: "auth-required",
-            reason: "401 + Bearer without resource_metadata, JSON-RPC body, or OAuth error body"
-          };
-        }
-        return { kind: "mcp", requiresAuth: true };
-      }
-      if (response.status >= 200 && response.status < 300) {
-        if (method === "GET") {
-          if (!isSse) {
-            return {
-              kind: "not-mcp",
-              category: "wrong-shape",
-              reason: "GET response is not an SSE stream"
-            };
-          }
-          return { kind: "mcp", requiresAuth: false };
-        }
-        if (isSse) return { kind: "mcp", requiresAuth: false };
-        const body = yield* readBody(response);
-        if (!isJsonRpcEnvelope(body)) {
-          return {
-            kind: "not-mcp",
-            category: "wrong-shape",
-            reason: "2xx POST body is not a JSON-RPC envelope"
-          };
-        }
-        return { kind: "mcp", requiresAuth: false };
-      }
-      return null;
-    });
-    const url = new URL(endpoint);
-    for (const [key, value] of Object.entries(options.queryParams ?? {})) {
-      url.searchParams.set(key, value);
-    }
-    let postRequest = HttpClientRequest.post(url.toString()).pipe(
-      HttpClientRequest.setHeader("content-type", "application/json"),
-      HttpClientRequest.setHeader("accept", "application/json, text/event-stream"),
-      HttpClientRequest.bodyText(INITIALIZE_BODY, "application/json")
-    );
-    for (const [name, value] of Object.entries(options.headers ?? {})) {
-      postRequest = HttpClientRequest.setHeader(postRequest, name, value);
-    }
-    const postResponse = yield* client.execute(postRequest).pipe(Effect5.timeout(Duration.millis(timeoutMs)));
-    const postResult = yield* classify(postResponse, "POST");
-    if (postResult) return postResult;
-    if ([404, 405, 406, 415].includes(postResponse.status)) {
-      let getRequest = HttpClientRequest.get(url.toString()).pipe(
-        HttpClientRequest.setHeader("accept", "text/event-stream")
-      );
-      for (const [name, value] of Object.entries(options.headers ?? {})) {
-        getRequest = HttpClientRequest.setHeader(getRequest, name, value);
-      }
-      const getResponse = yield* client.execute(getRequest).pipe(Effect5.timeout(Duration.millis(timeoutMs)));
-      const getResult = yield* classify(getResponse, "GET");
-      if (getResult) return getResult;
-    }
-    return {
-      kind: "not-mcp",
-      category: "wrong-shape",
-      reason: `unexpected status ${postResponse.status} for initialize`
-    };
-  }).pipe(
-    Effect5.provide(options.httpClientLayer ?? FetchHttpClient.layer),
-    Effect5.mapError(
-      (cause) => new ProbeTransportError({
-        reason: reasonFromBoundaryCause(cause),
-        cause
-      })
-    ),
-    Effect5.catch(
-      (cause) => Effect5.succeed({
-        kind: "unreachable",
-        reason: cause.reason
-      })
-    )
-  );
-  return outcome;
-}).pipe(Effect5.withSpan("mcp.plugin.probe_shape"));
-
-// src/sdk/plugin.ts
-import {
-  headerToConfigValue
-} from "@executor-js/config";
-var McpConfigureSourcePayloadSchema = Schema5.Struct({
-  name: Schema5.optional(Schema5.String),
-  endpoint: Schema5.optional(Schema5.String),
-  headers: Schema5.optional(Schema5.Record(Schema5.String, McpCredentialInput)),
-  queryParams: Schema5.optional(Schema5.Record(Schema5.String, McpCredentialInput)),
-  auth: Schema5.optional(McpConnectionAuthInput)
-});
-var McpConfigureSourceInputSchema = Schema5.Struct({
-  scope: Schema5.String,
-  ...McpConfigureSourcePayloadSchema.fields
-});
-var McpInitialCredentialsInputSchema = Schema5.Struct({
-  scope: Schema5.String,
-  headers: Schema5.optional(Schema5.Record(Schema5.String, McpCredentialInput)),
-  queryParams: Schema5.optional(Schema5.Record(Schema5.String, McpCredentialInput)),
-  auth: Schema5.optional(McpConnectionAuthInput)
-});
-var McpRemoteAddSourceInputSchema = Schema5.Struct({
-  transport: Schema5.Literal("remote"),
-  name: Schema5.String,
-  endpoint: Schema5.String,
-  remoteTransport: Schema5.optional(McpRemoteTransport),
-  queryParams: Schema5.optional(Schema5.Record(Schema5.String, McpConfiguredValueInput)),
-  headers: Schema5.optional(Schema5.Record(Schema5.String, McpConfiguredValueInput)),
-  namespace: Schema5.optional(Schema5.String),
-  oauth2: Schema5.optional(OAuth2SourceConfig),
-  credentials: Schema5.optional(McpInitialCredentialsInputSchema)
-});
-var McpStdioAddSourceInputSchema = Schema5.Struct({
-  transport: Schema5.Literal("stdio"),
-  name: Schema5.String,
-  command: Schema5.String,
-  args: Schema5.optional(Schema5.Array(Schema5.String)),
-  env: Schema5.optional(Schema5.Record(Schema5.String, Schema5.String)),
-  cwd: Schema5.optional(Schema5.String),
-  namespace: Schema5.optional(Schema5.String)
-});
-var McpAddSourceInputSchema = Schema5.Union([
-  McpRemoteAddSourceInputSchema,
-  McpStdioAddSourceInputSchema
-]);
-var McpAddSourceOutputSchema = Schema5.Struct({
-  namespace: Schema5.String,
-  source: Schema5.Struct({
-    id: Schema5.String,
-    scope: Schema5.String
-  }),
-  toolCount: Schema5.Number,
-  discovery: Schema5.optional(
-    Schema5.Struct({
-      status: Schema5.Literals(["ok", "failed"]),
-      message: Schema5.optional(Schema5.String),
-      stage: Schema5.optional(Schema5.String)
-    })
-  )
-});
-var McpProbeEndpointInputSchema = Schema5.Struct({
-  endpoint: Schema5.String,
-  headers: Schema5.optional(Schema5.Record(Schema5.String, SecretBackedValue)),
-  queryParams: Schema5.optional(Schema5.Record(Schema5.String, SecretBackedValue))
-});
-var McpProbeEndpointOutputSchema = Schema5.Struct({
-  connected: Schema5.Boolean,
-  requiresOAuth: Schema5.Boolean,
-  supportsDynamicRegistration: Schema5.Boolean,
-  name: Schema5.String,
-  namespace: Schema5.String,
-  toolCount: Schema5.NullOr(Schema5.Number),
-  serverName: Schema5.NullOr(Schema5.String)
-});
-var McpGetSourceInputSchema = Schema5.Struct({
-  namespace: Schema5.String,
-  scope: Schema5.String
-});
-var McpGetSourceOutputSchema = Schema5.Struct({
-  source: Schema5.NullOr(Schema5.Unknown)
-});
-var McpStaticConfigureSourceInputSchema = Schema5.Struct({
-  source: Schema5.Struct({
-    id: Schema5.String,
-    scope: Schema5.String
-  }),
-  scope: Schema5.String,
-  ...McpConfigureSourcePayloadSchema.fields
-});
-var McpStaticConfigureSourceOutputSchema = Schema5.Struct({
-  configured: Schema5.Boolean
-});
-var schemaToStaticToolSchema = (schema) => Schema5.toStandardSchemaV1(Schema5.toStandardJSONSchemaV1(schema));
-var mcpToolFailure = (code, message, details) => ToolResult.fail({
-  code,
-  message,
-  ...details === void 0 ? {} : { details }
-});
-var mcpAuthToolFailure = (failure) => authToolFailure({
-  code: failure.code,
-  message: failure.message,
-  source: { id: failure.sourceId, scope: failure.sourceScope },
-  credential: {
-    kind: failure.credentialKind,
-    ...failure.credentialLabel ? { label: failure.credentialLabel } : {},
-    ...failure.slotKey ? { slotKey: failure.slotKey } : {},
-    ...failure.secretId ? { secretId: failure.secretId } : {},
-    ...failure.connectionId ? { connectionId: failure.connectionId } : {}
-  },
-  ...failure.status !== void 0 ? { status: failure.status } : {},
-  ...failure.details !== void 0 ? {
-    upstream: {
-      ...failure.status !== void 0 ? { status: failure.status } : {},
-      details: failure.details
-    }
-  } : {},
-  recovery: { configureSourceTool: "executor.mcp.configureSource" }
-});
-var McpAddSourceInputStandardSchema = schemaToStaticToolSchema(McpAddSourceInputSchema);
-var McpAddSourceOutputStandardSchema = schemaToStaticToolSchema(McpAddSourceOutputSchema);
-var McpProbeEndpointInputStandardSchema = schemaToStaticToolSchema(McpProbeEndpointInputSchema);
-var McpProbeEndpointOutputStandardSchema = schemaToStaticToolSchema(McpProbeEndpointOutputSchema);
-var McpGetSourceInputStandardSchema = schemaToStaticToolSchema(McpGetSourceInputSchema);
-var McpGetSourceOutputStandardSchema = schemaToStaticToolSchema(McpGetSourceOutputSchema);
-var McpStaticConfigureSourceInputStandardSchema = schemaToStaticToolSchema(
-  McpStaticConfigureSourceInputSchema
-);
-var McpStaticConfigureSourceOutputStandardSchema = schemaToStaticToolSchema(
-  McpStaticConfigureSourceOutputSchema
-);
-var resolveStaticScopeInput = (ctx, value) => String(
-  ctx.scopes.find((scope) => scope.name === value || String(scope.id) === value)?.id ?? value
-);
-var toStoredSourceData = (config, remoteCredentials) => {
-  if (config.transport === "stdio") {
-    return {
-      transport: "stdio",
-      command: config.command,
-      args: config.args,
-      env: config.env,
-      cwd: config.cwd
-    };
-  }
-  return {
-    transport: "remote",
-    endpoint: config.endpoint,
-    remoteTransport: config.remoteTransport ?? "auto",
-    queryParams: remoteCredentials?.queryParams,
-    headers: remoteCredentials?.headers,
-    auth: remoteCredentials?.auth ?? { kind: "none" }
-  };
-};
-var normalizeNamespace = (config) => config.namespace ?? deriveMcpNamespace({
-  name: config.name,
-  endpoint: config.transport === "remote" ? config.endpoint : void 0,
-  command: config.transport === "stdio" ? config.command : void 0
-});
-var McpCallToolResultJsonSchema = z.toJSONSchema(CallToolResultSchema);
-var mcpCallToolResultOutputSchema = (structuredContentSchema) => {
-  const defaultStructuredContentSchema = McpCallToolResultJsonSchema.properties?.structuredContent ?? {};
-  return {
-    ...McpCallToolResultJsonSchema,
-    properties: {
-      ...McpCallToolResultJsonSchema.properties,
-      structuredContent: structuredContentSchema === void 0 ? defaultStructuredContentSchema : structuredContentSchema,
-      isError: { const: false }
-    },
-    required: structuredContentSchema === void 0 ? ["content"] : ["content", "structuredContent"]
-  };
-};
-var toBinding = (entry) => McpToolBinding.make({
-  toolId: entry.toolId,
-  toolName: entry.toolName,
-  description: entry.description,
-  inputSchema: entry.inputSchema,
-  outputSchema: entry.outputSchema,
-  annotations: entry.annotations
-});
-var MCP_PLUGIN_ID = "mcp";
-var McpTextContent = Schema5.Struct({ type: Schema5.Literal("text"), text: Schema5.String });
-var McpToolCallEnvelope = Schema5.Struct({
-  isError: Schema5.optional(Schema5.Boolean),
-  content: Schema5.optional(Schema5.Array(Schema5.Unknown))
-});
-var decodeMcpTextContent = Schema5.decodeUnknownOption(McpTextContent);
-var decodeMcpToolCallEnvelope = Schema5.decodeUnknownOption(McpToolCallEnvelope);
-var extractMcpErrorMessage = (content) => {
-  if (Array.isArray(content)) {
-    for (const item of content) {
-      const decoded = Option5.getOrUndefined(decodeMcpTextContent(item));
-      if (decoded !== void 0 && decoded.text.length > 0) return decoded.text;
-    }
-  }
-  return "MCP tool returned an error";
-};
-var urlMatchesToken = (url, token) => {
-  const re = new RegExp(`(?:^|[^a-z0-9])${token}(?:$|[^a-z0-9])`, "i");
-  return re.test(url.hostname) || re.test(url.pathname);
-};
-var userFacingProbeMessage = (shape) => {
-  if (shape.kind === "unreachable") {
-    return "Couldn't reach this URL. Check the address, your network, and that the server is running.";
-  }
-  return Match.value(shape.category).pipe(
-    Match.when(
-      "auth-required",
-      () => "This server requires authentication. Add credentials (Authorization header, query parameter, or API key) below and retry."
-    ),
-    Match.when(
-      "wrong-shape",
-      () => "This URL doesn't appear to host an MCP server. Double-check the address, including the path."
-    ),
-    Match.exhaustive
-  );
-};
-var scopeRanks = (ctx) => new Map(ctx.scopes.map((scope, index) => [String(scope.id), index]));
-var scopeRank = (ranks, scopeId) => ranks.get(scopeId) ?? Infinity;
-var resolveMcpSourceBinding = (ctx, sourceId, sourceScope, slot) => Effect6.gen(function* () {
-  const ranks = scopeRanks(ctx);
-  const sourceSourceRank = scopeRank(ranks, sourceScope);
-  if (sourceSourceRank === Infinity) return null;
-  const bindings = yield* ctx.credentialBindings.listForSource({
-    pluginId: MCP_PLUGIN_ID,
-    sourceId,
-    sourceScope: ScopeId.make(sourceScope)
-  });
-  const binding = bindings.filter(
-    (candidate) => candidate.slotKey === slot && scopeRank(ranks, candidate.scopeId) <= sourceSourceRank
-  ).sort((a, b) => scopeRank(ranks, a.scopeId) - scopeRank(ranks, b.scopeId))[0];
-  return binding ?? null;
-});
-var validateMcpBindingTarget = (ctx, input) => Effect6.gen(function* () {
-  const ranks = scopeRanks(ctx);
-  const sourceSourceRank = scopeRank(ranks, input.sourceScope);
-  const targetRank = scopeRank(ranks, input.targetScope);
-  const scopeList = `[${ctx.scopes.map((s) => s.id).join(", ")}]`;
-  if (sourceSourceRank === Infinity) {
-    return yield* new StorageError({
-      message: `MCP source binding references source scope "${input.sourceScope}" which is not in the executor's scope stack ${scopeList}.`,
-      cause: void 0
-    });
-  }
-  if (targetRank === Infinity) {
-    return yield* new StorageError({
-      message: `MCP source binding targets scope "${input.targetScope}" which is not in the executor's scope stack ${scopeList}.`,
-      cause: void 0
-    });
-  }
-  if (targetRank > sourceSourceRank) {
-    return yield* new StorageError({
-      message: `MCP source bindings for "${input.sourceId}" cannot be written at outer scope "${input.targetScope}" because the base source lives at "${input.sourceScope}"`,
-      cause: void 0
-    });
-  }
-});
-var canonicalizeCredentialMap = compileHttpNamedCredentialMap;
-var canonicalizeConfiguredValueMap = (values, slotForName) => {
-  const next = {};
-  for (const [name, value] of Object.entries(values ?? {})) {
-    if (typeof value === "string") {
-      next[name] = value;
-      continue;
-    }
-    next[name] = {
-      kind: "binding",
-      slot: slotForName(name),
-      prefix: value.prefix
-    };
-  }
-  return next;
-};
-var resolveConfiguredValueMap = (values) => {
-  if (!values) return void 0;
-  const resolved = {};
-  for (const [name, value] of Object.entries(values)) {
-    if (typeof value === "string") resolved[name] = value;
-  }
-  return Object.keys(resolved).length > 0 ? resolved : void 0;
-};
-var authFromOAuth2Source = (oauth2) => oauth2 ? {
-  kind: "oauth2",
-  connectionSlot: oauth2.connectionSlot,
-  clientIdSlot: oauth2.clientIdSlot,
-  ...oauth2.clientSecretSlot ? { clientSecretSlot: oauth2.clientSecretSlot } : {}
-} : { kind: "none" };
-var canonicalizeAuth = (auth) => {
-  if (!auth || "kind" in auth || !auth.oauth2) return { auth: { kind: "none" }, bindings: [] };
-  const oauth = auth.oauth2;
-  const bindings = [];
-  if (oauth.connection) {
-    bindings.push({
-      slot: MCP_OAUTH_CONNECTION_SLOT,
-      value: httpCredentialInputToBindingValue(oauth.connection)
-    });
-  }
-  if (oauth.clientId) {
-    bindings.push({
-      slot: MCP_OAUTH_CLIENT_ID_SLOT,
-      value: httpCredentialInputToBindingValue(oauth.clientId)
-    });
-  }
-  if (oauth.clientSecret) {
-    bindings.push({
-      slot: MCP_OAUTH_CLIENT_SECRET_SLOT,
-      value: httpCredentialInputToBindingValue(oauth.clientSecret)
-    });
-  }
-  return {
-    auth: {
-      kind: "oauth2",
-      connectionSlot: MCP_OAUTH_CONNECTION_SLOT,
-      ...oauth.clientId ? { clientIdSlot: MCP_OAUTH_CLIENT_ID_SLOT } : {},
-      ...oauth.clientSecret ? { clientSecretSlot: MCP_OAUTH_CLIENT_SECRET_SLOT } : {}
-    },
-    bindings
-  };
-};
-var makeOAuthProvider = (accessToken) => ({
-  get redirectUrl() {
-    return "http://localhost/oauth/callback";
-  },
-  get clientMetadata() {
-    return {
-      redirect_uris: ["http://localhost/oauth/callback"],
-      grant_types: ["authorization_code", "refresh_token"],
-      response_types: ["code"],
-      token_endpoint_auth_method: "none",
-      client_name: "Executor"
-    };
-  },
-  clientInformation: () => void 0,
-  saveClientInformation: () => void 0,
-  tokens: () => ({ access_token: accessToken, token_type: "Bearer" }),
-  saveTokens: () => void 0,
-  redirectToAuthorization: async () => {
-    throw new Error("MCP OAuth re-authorization required");
-  },
-  saveCodeVerifier: () => void 0,
-  codeVerifier: () => {
-    throw new Error("No active PKCE verifier");
-  },
-  saveDiscoveryState: () => void 0,
-  discoveryState: () => void 0
-});
-var resolveSecretBackedMap = (values, ctx) => resolveSharedSecretBackedMap({
-  values,
-  getSecret: ctx.secrets.get,
-  onMissing: (_name, value) => new McpConnectionError({
-    transport: "remote",
-    message: `Failed to resolve secret "${value.secretId}"`
-  }),
-  onError: (err, _name, value) => Predicate3.isTagged("SecretOwnedByConnectionError")(err) ? new McpConnectionError({
-    transport: "remote",
-    message: `Failed to resolve secret "${value.secretId}"`
-  }) : err
-}).pipe(
-  Effect6.mapError(
-    (err) => Predicate3.isTagged("SecretOwnedByConnectionError")(err) ? new McpConnectionError({ transport: "remote", message: "Failed to resolve secret" }) : err
-  )
-);
-var credentialInputMapToConfigValues = (values) => {
-  if (!values) return void 0;
-  const out = {};
-  for (const [name, value] of Object.entries(values)) {
-    if (typeof value === "string") {
-      out[name] = value;
-      continue;
-    }
-    if (value.kind === "secret" && "secretId" in value) {
-      out[name] = headerToConfigValue({ secretId: value.secretId, prefix: value.prefix });
-      continue;
-    }
-    if (value.kind === "text") {
-      out[name] = value.prefix ? `${value.prefix}${value.text}` : value.text;
-    }
-  }
-  return Object.keys(out).length > 0 ? out : void 0;
-};
-var resolveMcpBindingValueMap = (ctx, values, params) => Effect6.gen(function* () {
-  if (!values) return void 0;
-  const resolved = {};
-  for (const [name, value] of Object.entries(values)) {
-    if (typeof value === "string") {
-      resolved[name] = value;
-      continue;
-    }
-    const binding = yield* resolveMcpSourceBinding(
-      ctx,
-      params.sourceId,
-      params.sourceScope,
-      value.slot
-    );
-    if (binding?.value.kind === "secret") {
-      const secretBinding = binding.value;
-      const secret = yield* ctx.secrets.getAtScope(secretBinding.secretId, binding.scopeId).pipe(
-        Effect6.catchTag(
-          "SecretOwnedByConnectionError",
-          () => Effect6.fail(
-            new McpAuthRequiredError({
-              code: "credential_secret_missing",
-              sourceId: params.sourceId,
-              sourceScope: params.sourceScope,
-              credentialKind: "secret",
-              credentialLabel: name,
-              slotKey: value.slot,
-              secretId: String(secretBinding.secretId),
-              message: `Failed to resolve secret for ${params.missingLabel} "${name}"`
-            })
-          )
-        )
-      );
-      if (secret === null) {
-        return yield* new McpAuthRequiredError({
-          code: "credential_secret_missing",
-          sourceId: params.sourceId,
-          sourceScope: params.sourceScope,
-          credentialKind: "secret",
-          credentialLabel: name,
-          slotKey: value.slot,
-          secretId: String(secretBinding.secretId),
-          message: `Missing secret "${secretBinding.secretId}" for ${params.missingLabel} "${name}"`
-        });
-      }
-      resolved[name] = value.prefix ? `${value.prefix}${secret}` : secret;
-      continue;
-    }
-    if (binding?.value.kind === "text") {
-      resolved[name] = value.prefix ? `${value.prefix}${binding.value.text}` : binding.value.text;
-      continue;
-    }
-    return yield* new McpAuthRequiredError({
-      code: "credential_binding_missing",
-      sourceId: params.sourceId,
-      sourceScope: params.sourceScope,
-      credentialKind: "secret",
-      credentialLabel: name,
-      slotKey: value.slot,
-      message: `Missing binding for ${params.missingLabel} "${name}"`
-    });
-  }
-  return Object.keys(resolved).length > 0 ? resolved : void 0;
-});
-var resolveInitialMcpCredentialValueMap = (ctx, values, bindings, targetScope, missingLabel) => Effect6.gen(function* () {
-  const bySlot = new Map(bindings.map((binding) => [binding.slot, binding.value]));
-  const resolved = {};
-  for (const [name, value] of Object.entries(values)) {
-    if (typeof value === "string") {
-      resolved[name] = value;
-      continue;
-    }
-    const binding = bySlot.get(value.slot);
-    if (binding?.kind === "secret") {
-      const secret = yield* ctx.secrets.getAtScope(binding.secretId, binding.secretScopeId ?? ScopeId.make(targetScope)).pipe(
-        Effect6.catchTag(
-          "SecretOwnedByConnectionError",
-          () => Effect6.fail(
-            new McpConnectionError({
-              transport: "remote",
-              message: `Failed to resolve secret for ${missingLabel} "${name}"`
-            })
-          )
-        )
-      );
-      if (secret === null) {
-        return yield* new McpConnectionError({
-          transport: "remote",
-          message: `Missing secret "${binding.secretId}" for ${missingLabel} "${name}"`
-        });
-      }
-      resolved[name] = value.prefix ? `${value.prefix}${secret}` : secret;
-      continue;
-    }
-    if (binding?.kind === "text") {
-      resolved[name] = value.prefix ? `${value.prefix}${binding.text}` : binding.text;
-    }
-  }
-  return Object.keys(resolved).length > 0 ? resolved : void 0;
-});
-var resolveInitialMcpOauthProvider = (ctx, bindings, targetScope) => Effect6.gen(function* () {
-  const connection = bindings.find(
-    (binding) => binding.slot === MCP_OAUTH_CONNECTION_SLOT && binding.value.kind === "connection"
-  );
-  if (!connection || connection.value.kind !== "connection") return void 0;
-  const connectionId = connection.value.connectionId;
-  const accessToken = yield* ctx.connections.accessTokenAtScope(connectionId, ScopeId.make(targetScope)).pipe(
-    Effect6.mapError(
-      ({ message }) => new McpConnectionError({
-        transport: "remote",
-        message: `Failed to resolve OAuth connection "${connectionId}": ${message}`
-      })
-    )
-  );
-  return makeOAuthProvider(accessToken);
-});
-var resolveMcpHeaderAuth = (ctx, sourceId, sourceScope, auth) => Effect6.gen(function* () {
-  if (auth.kind !== "header") return {};
-  const binding = yield* resolveMcpSourceBinding(ctx, sourceId, sourceScope, auth.secretSlot);
-  if (binding?.value.kind === "secret") {
-    const secretBinding = binding.value;
-    const secret = yield* ctx.secrets.getAtScope(secretBinding.secretId, binding.scopeId).pipe(
-      Effect6.catchTag(
-        "SecretOwnedByConnectionError",
-        () => Effect6.fail(
-          new McpAuthRequiredError({
-            code: "credential_secret_missing",
-            sourceId,
-            sourceScope,
-            credentialKind: "secret",
-            credentialLabel: auth.headerName,
-            slotKey: auth.secretSlot,
-            secretId: String(secretBinding.secretId),
-            message: `Failed to resolve header auth binding "${auth.secretSlot}"`
-          })
-        )
-      )
-    );
-    if (secret === null) {
-      return yield* new McpAuthRequiredError({
-        code: "credential_secret_missing",
-        sourceId,
-        sourceScope,
-        credentialKind: "secret",
-        credentialLabel: auth.headerName,
-        slotKey: auth.secretSlot,
-        secretId: String(secretBinding.secretId),
-        message: `Missing secret for header auth binding "${auth.secretSlot}"`
-      });
-    }
-    return { [auth.headerName]: auth.prefix ? `${auth.prefix}${secret}` : secret };
-  }
-  if (binding?.value.kind === "text") {
-    return {
-      [auth.headerName]: auth.prefix ? `${auth.prefix}${binding.value.text}` : binding.value.text
-    };
-  }
-  return yield* new McpAuthRequiredError({
-    code: "credential_binding_missing",
-    sourceId,
-    sourceScope,
-    credentialKind: "secret",
-    credentialLabel: auth.headerName,
-    slotKey: auth.secretSlot,
-    message: `Missing header auth binding "${auth.secretSlot}"`
-  });
-});
-var resolveMcpStoredOauthProvider = (ctx, sourceId, sourceScope, auth) => Effect6.gen(function* () {
-  if (auth.kind !== "oauth2") return void 0;
-  const binding = yield* resolveMcpSourceBinding(ctx, sourceId, sourceScope, auth.connectionSlot);
-  if (binding?.value.kind !== "connection") {
-    return yield* new McpAuthRequiredError({
-      code: "oauth_connection_missing",
-      sourceId,
-      sourceScope,
-      credentialKind: "connection",
-      credentialLabel: "OAuth sign-in",
-      slotKey: auth.connectionSlot,
-      message: `Missing OAuth connection binding for MCP source "${sourceId}"`
-    });
-  }
-  const connectionId = binding.value.connectionId;
-  const accessToken = yield* ctx.connections.accessTokenAtScope(connectionId, binding.scopeId).pipe(
-    Effect6.catchTags({
-      ConnectionReauthRequiredError: ({ message, connectionId: failedConnectionId }) => Effect6.fail(
-        new McpAuthRequiredError({
-          code: "oauth_reauth_required",
-          sourceId,
-          sourceScope,
-          credentialKind: "oauth",
-          credentialLabel: "OAuth sign-in",
-          slotKey: auth.connectionSlot,
-          connectionId: String(failedConnectionId),
-          message: `OAuth connection "${failedConnectionId}" needs re-authentication: ${message}`
-        })
-      ),
-      ConnectionNotFoundError: ({ connectionId: failedConnectionId }) => Effect6.fail(
-        new McpAuthRequiredError({
-          code: "oauth_connection_missing",
-          sourceId,
-          sourceScope,
-          credentialKind: "connection",
-          credentialLabel: "OAuth sign-in",
-          slotKey: auth.connectionSlot,
-          connectionId: String(failedConnectionId),
-          message: `OAuth connection "${failedConnectionId}" was not found for MCP source "${sourceId}"`
-        })
-      ),
-      ConnectionProviderNotRegisteredError: ({ provider }) => Effect6.fail(
-        new McpAuthRequiredError({
-          code: "oauth_connection_failed",
-          sourceId,
-          sourceScope,
-          credentialKind: "oauth",
-          credentialLabel: "OAuth sign-in",
-          slotKey: auth.connectionSlot,
-          connectionId: String(connectionId),
-          message: `OAuth provider "${provider}" is not registered`
-        })
-      ),
-      ConnectionRefreshNotSupportedError: ({ provider, connectionId: failedConnectionId }) => Effect6.fail(
-        new McpAuthRequiredError({
-          code: "oauth_connection_failed",
-          sourceId,
-          sourceScope,
-          credentialKind: "oauth",
-          credentialLabel: "OAuth sign-in",
-          slotKey: auth.connectionSlot,
-          connectionId: String(failedConnectionId),
-          message: `OAuth provider "${provider}" cannot refresh connection "${failedConnectionId}"`
-        })
-      ),
-      ConnectionRefreshError: ({ message, connectionId: failedConnectionId }) => Effect6.fail(
-        new McpAuthRequiredError({
-          code: "oauth_connection_failed",
-          sourceId,
-          sourceScope,
-          credentialKind: "oauth",
-          credentialLabel: "OAuth sign-in",
-          slotKey: auth.connectionSlot,
-          connectionId: String(failedConnectionId),
-          message: `OAuth connection "${failedConnectionId}" refresh failed: ${message}`
-        })
-      )
-    })
-  );
-  return makeOAuthProvider(accessToken);
-});
-var resolveConnectorInput = (sourceId, sourceScope, sd, ctx, allowStdio) => {
-  if (sd.transport === "stdio") {
-    if (!allowStdio) {
-      return Effect6.fail(
-        new McpConnectionError({
-          transport: "stdio",
-          message: "MCP stdio transport is disabled. Enable it by passing `dangerouslyAllowStdioMCP: true` to mcpPlugin() \u2014 only safe for trusted local contexts."
-        })
-      );
-    }
-    return Effect6.succeed({
-      transport: "stdio",
-      command: sd.command,
-      args: sd.args,
-      env: sd.env,
-      cwd: sd.cwd
-    });
-  }
-  return Effect6.gen(function* () {
-    const resolvedHeaders = yield* resolveMcpBindingValueMap(ctx, sd.headers, {
-      sourceId,
-      sourceScope,
-      missingLabel: "header"
-    });
-    const resolvedQueryParams = yield* resolveMcpBindingValueMap(ctx, sd.queryParams, {
-      sourceId,
-      sourceScope,
-      missingLabel: "query parameter"
-    });
-    const headers = { ...resolvedHeaders ?? {} };
-    const auth = sd.auth;
-    if (auth.kind === "header") {
-      Object.assign(headers, yield* resolveMcpHeaderAuth(ctx, sourceId, sourceScope, auth));
-    }
-    const authProvider = yield* resolveMcpStoredOauthProvider(ctx, sourceId, sourceScope, auth);
-    return {
-      transport: "remote",
-      endpoint: sd.endpoint,
-      remoteTransport: sd.remoteTransport,
-      queryParams: resolvedQueryParams,
-      headers: Object.keys(headers).length > 0 ? headers : void 0,
-      authProvider
-    };
-  });
-};
-var makeRuntime = () => Effect6.gen(function* () {
-  const cacheScope = yield* Scope.make();
-  const pendingConnectors = /* @__PURE__ */ new Map();
-  const connectionCache = yield* ScopedCache2.make({
-    lookup: (key) => Effect6.acquireRelease(
-      Effect6.suspend(() => {
-        const connector = pendingConnectors.get(key);
-        if (!connector) {
-          return Effect6.fail(
-            new McpConnectionError({
-              transport: "auto",
-              message: `No pending connector for key: ${key}`
-            })
-          );
-        }
-        return connector;
-      }),
-      (connection) => Effect6.ignore(
-        Effect6.tryPromise({
-          try: () => connection.close(),
-          catch: () => new McpConnectionError({
-            transport: "auto",
-            message: "Failed to close MCP connection"
-          })
-        })
-      )
-    ),
-    capacity: 64,
-    timeToLive: Duration2.minutes(5)
-  }).pipe(Scope.provide(cacheScope));
-  return { connectionCache, pendingConnectors, cacheScope };
-});
-var authToConfig = (auth) => {
-  if (!auth) return void 0;
-  if ("kind" in auth) return { kind: "none" };
-  const connection = auth.oauth2?.connection;
-  if (!connection || typeof connection === "string" || connection.kind !== "connection") {
-    return void 0;
-  }
-  return {
-    kind: "oauth2",
-    connectionId: connection.connectionId
-  };
-};
-var toCredentialInput = (bySlot, configured) => {
-  if (typeof configured === "string") return configured;
-  const value = bySlot.get(configured.slot);
-  if (!value) return void 0;
-  if (value.kind === "secret") {
-    return {
-      kind: "secret",
-      secretId: value.secretId,
-      ...value.secretScopeId ? { secretScope: value.secretScopeId } : {},
-      ...configured.prefix ? { prefix: configured.prefix } : {}
-    };
-  }
-  if (value.kind === "text") return value.text;
-  return void 0;
-};
-var toCredentialInputMap = (bySlot, values) => {
-  if (!values) return void 0;
-  const out = {};
-  for (const [name, configured] of Object.entries(values)) {
-    const input = toCredentialInput(bySlot, configured);
-    if (input !== void 0) out[name] = input;
-  }
-  return Object.keys(out).length > 0 ? out : void 0;
-};
-var toAuthInput = (bySlot, auth) => {
-  if (auth.kind === "none") return { kind: "none" };
-  if (auth.kind === "header") {
-    const value = bySlot.get(auth.secretSlot);
-    if (value?.kind !== "secret") return void 0;
-    return {
-      kind: "none"
-    };
-  }
-  const connection = bySlot.get(auth.connectionSlot);
-  return {
-    oauth2: {
-      ...connection?.kind === "connection" ? { connection: { kind: "connection", connectionId: connection.connectionId } } : {}
-    }
-  };
-};
-var inputFormFromStored = (bindings, stored, scope, sourceName, namespace) => {
-  if (stored.transport === "stdio") {
-    return {
-      transport: "stdio",
-      scope,
-      name: sourceName,
-      namespace,
-      command: stored.command,
-      args: stored.args ? [...stored.args] : void 0,
-      env: stored.env,
-      cwd: stored.cwd
-    };
-  }
-  const bySlot = new Map(bindings.map((b) => [b.slotKey, b.value]));
-  return {
-    transport: "remote",
-    scope,
-    name: sourceName,
-    namespace,
-    endpoint: stored.endpoint,
-    remoteTransport: stored.remoteTransport,
-    headers: toCredentialInputMap(bySlot, stored.headers),
-    queryParams: toCredentialInputMap(bySlot, stored.queryParams),
-    auth: toAuthInput(bySlot, stored.auth)
-  };
-};
-var toMcpConfigEntry = (namespace, sourceName, config) => {
-  if (config.transport === "stdio") {
-    const entry2 = {
-      kind: "mcp",
-      transport: "stdio",
-      name: sourceName,
-      command: config.command,
-      args: config.args,
-      env: config.env,
-      cwd: config.cwd,
-      namespace
-    };
-    return entry2;
-  }
-  const entry = {
-    kind: "mcp",
-    transport: "remote",
-    name: sourceName,
-    endpoint: config.endpoint,
-    remoteTransport: config.remoteTransport,
-    queryParams: credentialInputMapToConfigValues(config.queryParams),
-    headers: credentialInputMapToConfigValues(config.headers),
-    namespace,
-    auth: authToConfig(config.auth)
-  };
-  return entry;
-};
-var mcpPlugin = definePlugin((options) => {
-  const allowStdio = options?.dangerouslyAllowStdioMCP ?? false;
-  const runtimeRef = { current: null };
-  const ensureRuntime = () => runtimeRef.current ? Effect6.succeed(runtimeRef.current) : makeRuntime().pipe(
-    Effect6.tap(
-      (rt) => Effect6.sync(() => {
-        runtimeRef.current = rt;
-      })
-    )
-  );
-  return {
-    id: "mcp",
-    packageName: "@executor-js/plugin-mcp",
-    sourcePresets: allowStdio ? mcpPresets.map((preset) => ({
-      ...preset,
-      transport: "transport" in preset ? preset.transport : "remote"
-    })) : mcpPresets.filter((preset) => !("transport" in preset && preset.transport === "stdio")).map((preset) => ({
-      ...preset,
-      transport: "remote"
-    })),
-    // Surfaced to the client bundle via the Vite plugin (see
-    // `@executor-js/vite-plugin`). The MCP `./client` factory reads
-    // `allowStdio` and gates the stdio tab + presets in AddMcpSource —
-    // so the server's `dangerouslyAllowStdioMCP` flag is the single
-    // source of truth for both runtime and UI.
-    clientConfig: { allowStdio },
-    schema: mcpSchema,
-    storage: (deps) => makeMcpStore(deps),
-    extension: (ctx) => {
-      const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
-      const probeEndpoint = (input) => Effect6.gen(function* () {
-        const endpoint = typeof input === "string" ? input : input.endpoint;
-        const trimmed = endpoint.trim();
-        if (!trimmed) {
-          return yield* new McpConnectionError({
-            transport: "remote",
-            message: "Endpoint URL is required"
-          });
-        }
-        const name = yield* Effect6.try({
-          try: () => new URL(trimmed).hostname,
-          catch: () => "mcp"
-        }).pipe(Effect6.orElseSucceed(() => "mcp"));
-        const namespace = deriveMcpNamespace({ endpoint: trimmed });
-        const probeHeaders = typeof input === "string" ? void 0 : yield* resolveSecretBackedMap(input.headers, ctx);
-        const probeQueryParams = typeof input === "string" ? void 0 : yield* resolveSecretBackedMap(input.queryParams, ctx);
-        const connector = createMcpConnector({
-          transport: "remote",
-          endpoint: trimmed,
-          headers: probeHeaders,
-          queryParams: probeQueryParams
-        });
-        const result = yield* discoverTools(connector).pipe(
-          Effect6.map((m) => ({ ok: true, manifest: m })),
-          Effect6.catch(() => Effect6.succeed({ ok: false, manifest: null })),
-          Effect6.withSpan("mcp.plugin.discover_tools")
-        );
-        if (result.ok && result.manifest) {
-          return {
-            connected: true,
-            requiresOAuth: false,
-            supportsDynamicRegistration: false,
-            name: result.manifest.server?.name ?? name,
-            namespace,
-            toolCount: result.manifest.tools.length,
-            serverName: result.manifest.server?.name ?? null
-          };
-        }
-        const shape = yield* probeMcpEndpointShape(trimmed, {
-          httpClientLayer,
-          headers: probeHeaders,
-          queryParams: probeQueryParams
-        });
-        if (shape.kind !== "mcp") {
-          return yield* new McpConnectionError({
-            transport: "remote",
-            message: userFacingProbeMessage(shape)
-          });
-        }
-        const probeResult = yield* ctx.oauth.probe({
-          endpoint: trimmed,
-          headers: probeHeaders,
-          queryParams: probeQueryParams
-        }).pipe(
-          Effect6.map((oauth) => ({ ok: true, oauth })),
-          Effect6.catch(() => Effect6.succeed({ ok: false, oauth: null })),
-          Effect6.withSpan("mcp.plugin.probe_oauth")
-        );
-        if (probeResult.ok) {
-          return {
-            connected: false,
-            requiresOAuth: true,
-            supportsDynamicRegistration: probeResult.oauth.supportsDynamicRegistration,
-            name,
-            namespace,
-            toolCount: null,
-            serverName: null
-          };
-        }
-        return yield* new McpConnectionError({
-          transport: "remote",
-          message: "This server requires authentication, but OAuth metadata wasn't found. Add credentials (Authorization header, query parameter, or API key) below and retry."
-        });
-      }).pipe(
-        Effect6.withSpan("mcp.plugin.probe_endpoint", {
-          attributes: { "mcp.endpoint": typeof input === "string" ? input : input.endpoint }
-        })
-      );
-      const configFile = options?.configFile;
-      const addSource = (config) => Effect6.gen(function* () {
-        const namespace = normalizeNamespace(config);
-        const canonicalRemote = config.transport === "remote" ? {
-          headers: canonicalizeConfiguredValueMap(config.headers, mcpHeaderSlot),
-          queryParams: canonicalizeConfiguredValueMap(
-            config.queryParams,
-            mcpQueryParamSlot
-          )
-        } : null;
-        const initialRemote = config.transport === "remote" && config.credentials ? {
-          scope: config.credentials.scope,
-          headers: config.credentials.headers !== void 0 ? canonicalizeCredentialMap(config.credentials.headers, mcpHeaderSlot) : null,
-          queryParams: config.credentials.queryParams !== void 0 ? canonicalizeCredentialMap(config.credentials.queryParams, mcpQueryParamSlot) : null,
-          auth: config.credentials.auth !== void 0 ? canonicalizeAuth(config.credentials.auth) : null
-        } : null;
-        const remoteAuth = config.transport === "remote" ? config.oauth2 ? authFromOAuth2Source(config.oauth2) : initialRemote?.auth?.auth ?? { kind: "none" } : null;
-        const remoteCredentials = canonicalRemote && remoteAuth ? {
-          headers: canonicalRemote.headers,
-          queryParams: canonicalRemote.queryParams,
-          auth: remoteAuth
-        } : void 0;
-        const initialBindings = [
-          ...initialRemote?.headers?.bindings ?? [],
-          ...initialRemote?.queryParams?.bindings ?? [],
-          ...initialRemote?.auth?.bindings ?? []
-        ];
-        if (initialRemote && initialBindings.length > 0) {
-          yield* validateMcpBindingTarget(ctx, {
-            sourceId: namespace,
-            sourceScope: config.scope,
-            targetScope: initialRemote.scope
-          });
-        }
-        const sd = toStoredSourceData(config, remoteCredentials);
-        const initialQueryParams = initialRemote?.queryParams && (yield* resolveInitialMcpCredentialValueMap(
-          ctx,
-          canonicalRemote?.queryParams ?? initialRemote.queryParams.values,
-          initialRemote.queryParams.bindings,
-          initialRemote.scope,
-          "query parameter"
-        ));
-        const initialHeaders = initialRemote?.headers && (yield* resolveInitialMcpCredentialValueMap(
-          ctx,
-          canonicalRemote?.headers ?? initialRemote.headers.values,
-          initialRemote.headers.bindings,
-          initialRemote.scope,
-          "header"
-        ));
-        const remoteQueryParams = {
-          ...config.transport === "remote" ? resolveConfiguredValueMap(config.queryParams) ?? {} : {},
-          ...initialQueryParams || {}
-        };
-        const remoteHeaders = {
-          ...config.transport === "remote" ? resolveConfiguredValueMap(config.headers) ?? {} : {},
-          ...initialHeaders || {}
-        };
-        const initialAuthProvider = initialRemote?.auth !== null && initialRemote?.auth !== void 0 ? yield* resolveInitialMcpOauthProvider(
-          ctx,
-          initialRemote.auth.bindings,
-          initialRemote.scope
-        ) : void 0;
-        const resolved = config.transport === "remote" ? Result.succeed({
-          transport: "remote",
-          endpoint: config.endpoint,
-          remoteTransport: config.remoteTransport ?? "auto",
-          queryParams: Object.keys(remoteQueryParams).length > 0 ? remoteQueryParams : void 0,
-          headers: Object.keys(remoteHeaders).length > 0 ? remoteHeaders : void 0,
-          authProvider: initialAuthProvider
-        }) : yield* resolveConnectorInput(namespace, config.scope, sd, ctx, allowStdio).pipe(
-          Effect6.result,
-          Effect6.withSpan("mcp.plugin.resolve_connector", {
-            attributes: {
-              "mcp.source.namespace": namespace,
-              "mcp.source.transport": sd.transport
-            }
-          })
-        );
-        if (Result.isFailure(resolved) && sd.transport === "stdio") {
-          if (Predicate3.isTagged(resolved.failure, "McpAuthRequiredError")) {
-            return yield* new McpConnectionError({
-              transport: sd.transport,
-              message: resolved.failure.message
-            });
-          }
-          return yield* Effect6.fail(resolved.failure);
-        }
-        const discovery = Result.isSuccess(resolved) ? yield* discoverTools(createMcpConnector(resolved.success)).pipe(
-          Effect6.mapError(
-            ({ message }) => new McpToolDiscoveryError({
-              stage: "list_tools",
-              message: `MCP discovery failed: ${message}`
-            })
-          ),
-          Effect6.result,
-          Effect6.withSpan("mcp.plugin.discover_tools", {
-            attributes: { "mcp.source.namespace": namespace }
-          })
-        ) : Result.fail(resolved.failure);
-        const manifest = Result.isSuccess(discovery) ? discovery.success : { server: void 0, tools: [] };
-        const sourceName = config.name ?? manifest.server?.name ?? namespace;
-        yield* ctx.transaction(
-          Effect6.gen(function* () {
-            yield* ctx.storage.removeBindingsByNamespace(namespace, config.scope);
-            yield* ctx.storage.removeSource(namespace, config.scope);
-            yield* ctx.storage.putSource({
-              namespace,
-              scope: config.scope,
-              name: sourceName,
-              config: sd
-            });
-            yield* ctx.storage.putBindings(
-              namespace,
-              config.scope,
-              manifest.tools.map((e) => ({
-                toolId: `${namespace}.${e.toolId}`,
-                binding: toBinding(e)
-              }))
-            );
-            yield* ctx.core.sources.register({
-              id: namespace,
-              scope: config.scope,
-              kind: "mcp",
-              name: sourceName,
-              url: sd.transport === "remote" ? sd.endpoint : void 0,
-              canRemove: true,
-              canRefresh: true,
-              canEdit: sd.transport === "remote",
-              tools: manifest.tools.map((e) => ({
-                name: e.toolId,
-                description: e.description ?? `MCP tool: ${e.toolName}`,
-                inputSchema: e.inputSchema,
-                outputSchema: mcpCallToolResultOutputSchema(e.outputSchema)
-              }))
-            });
-            if (initialRemote && initialBindings.length > 0) {
-              yield* ctx.credentialBindings.replaceForSource({
-                targetScope: ScopeId.make(initialRemote.scope),
-                pluginId: MCP_PLUGIN_ID,
-                sourceId: namespace,
-                sourceScope: ScopeId.make(config.scope),
-                slotPrefixes: [
-                  ...initialRemote.headers !== null ? ["header:"] : [],
-                  ...initialRemote.queryParams !== null ? ["query_param:"] : [],
-                  ...initialRemote.auth !== null ? ["auth:"] : []
-                ],
-                bindings: initialBindings.map((binding) => ({
-                  slotKey: binding.slot,
-                  value: binding.value
-                }))
-              });
-            }
-          })
-        ).pipe(
-          Effect6.withSpan("mcp.plugin.persist_source", {
-            attributes: {
-              "mcp.source.namespace": namespace,
-              "mcp.source.tool_count": manifest.tools.length
-            }
-          })
-        );
-        if (configFile) {
-          yield* configFile.upsertSource(toMcpConfigEntry(namespace, sourceName, config)).pipe(Effect6.withSpan("mcp.plugin.config_file.upsert"));
-        }
-        if (Result.isFailure(discovery)) {
-          if (Predicate3.isTagged(discovery.failure, "McpAuthRequiredError")) {
-            return yield* new McpConnectionError({
-              transport: sd.transport,
-              message: discovery.failure.message
-            });
-          }
-          return yield* Effect6.fail(discovery.failure);
-        }
-        return { toolCount: manifest.tools.length, namespace };
-      }).pipe(
-        Effect6.withSpan("mcp.plugin.add_source", {
-          attributes: {
-            "mcp.source.transport": config.transport,
-            "mcp.source.name": config.name
-          }
-        })
-      );
-      const removeSource = (namespace, scope) => Effect6.gen(function* () {
-        yield* ctx.transaction(
-          Effect6.gen(function* () {
-            yield* ctx.credentialBindings.removeForSource({
-              pluginId: MCP_PLUGIN_ID,
-              sourceId: namespace,
-              sourceScope: ScopeId.make(scope)
-            });
-            yield* ctx.storage.removeBindingsByNamespace(namespace, scope);
-            yield* ctx.storage.removeSource(namespace, scope);
-            yield* ctx.core.sources.unregister({ id: namespace, targetScope: scope });
-          })
-        ).pipe(Effect6.withSpan("mcp.plugin.persist_remove"));
-        if (configFile) {
-          yield* configFile.removeSource(namespace).pipe(Effect6.withSpan("mcp.plugin.config_file.remove"));
-        }
-      }).pipe(
-        Effect6.withSpan("mcp.plugin.remove_source", {
-          attributes: { "mcp.source.namespace": namespace }
-        })
-      );
-      const refreshSource = (namespace, scope) => Effect6.gen(function* () {
-        const sd = yield* ctx.storage.getSourceConfig(namespace, scope).pipe(
-          Effect6.withSpan("mcp.plugin.load_source_config", {
-            attributes: { "mcp.source.namespace": namespace }
-          })
-        );
-        if (!sd) {
-          return yield* new McpConnectionError({
-            transport: "remote",
-            message: `No stored config for MCP source "${namespace}"`
-          });
-        }
-        const ci = yield* resolveConnectorInput(namespace, scope, sd, ctx, allowStdio).pipe(
-          Effect6.catchTag(
-            "McpAuthRequiredError",
-            ({ message }) => Effect6.fail(new McpConnectionError({ transport: sd.transport, message }))
-          ),
-          Effect6.withSpan("mcp.plugin.resolve_connector", {
-            attributes: {
-              "mcp.source.namespace": namespace,
-              "mcp.source.transport": sd.transport
-            }
-          })
-        );
-        const manifest = yield* discoverTools(createMcpConnector(ci)).pipe(
-          Effect6.mapError(
-            ({ message }) => new McpToolDiscoveryError({
-              stage: "list_tools",
-              message: `MCP refresh failed: ${message}`
-            })
-          ),
-          Effect6.withSpan("mcp.plugin.discover_tools", {
-            attributes: { "mcp.source.namespace": namespace }
-          })
-        );
-        const existing = yield* ctx.storage.getSource(namespace, scope);
-        const sourceName = manifest.server?.name ?? existing?.name ?? namespace;
-        yield* ctx.transaction(
-          Effect6.gen(function* () {
-            yield* ctx.storage.removeBindingsByNamespace(namespace, scope);
-            yield* ctx.core.sources.unregister({ id: namespace, targetScope: scope });
-            yield* ctx.storage.putBindings(
-              namespace,
-              scope,
-              manifest.tools.map((e) => ({
-                toolId: `${namespace}.${e.toolId}`,
-                binding: toBinding(e)
-              }))
-            );
-            yield* ctx.core.sources.register({
-              id: namespace,
-              scope,
-              kind: "mcp",
-              name: sourceName,
-              url: sd.transport === "remote" ? sd.endpoint : void 0,
-              canRemove: true,
-              canRefresh: true,
-              canEdit: sd.transport === "remote",
-              tools: manifest.tools.map((e) => ({
-                name: e.toolId,
-                description: e.description ?? `MCP tool: ${e.toolName}`,
-                inputSchema: e.inputSchema,
-                outputSchema: mcpCallToolResultOutputSchema(e.outputSchema)
-              }))
-            });
-          })
-        ).pipe(
-          Effect6.withSpan("mcp.plugin.persist_source", {
-            attributes: {
-              "mcp.source.namespace": namespace,
-              "mcp.source.tool_count": manifest.tools.length
-            }
-          })
-        );
-        return { toolCount: manifest.tools.length };
-      }).pipe(
-        Effect6.withSpan("mcp.plugin.refresh_source", {
-          attributes: { "mcp.source.namespace": namespace }
-        })
-      );
-      const getSource = (namespace, scope) => ctx.storage.getSource(namespace, scope).pipe(
-        Effect6.withSpan("mcp.plugin.get_source", {
-          attributes: { "mcp.source.namespace": namespace }
-        })
-      );
-      return {
-        probeEndpoint,
-        addSource,
-        removeSource,
-        refreshSource,
-        getSource
-      };
-    },
-    sourceConfigure: {
-      type: "mcp",
-      schema: McpConfigureSourcePayloadSchema,
-      configure: ({ ctx, sourceId, sourceScope, targetScope, config }) => Effect6.gen(function* () {
-        const input = config;
-        const existing = yield* ctx.storage.getSource(sourceId, sourceScope);
-        if (!existing || existing.config.transport !== "remote") return;
-        const canonicalHeaders = input.headers !== void 0 ? canonicalizeCredentialMap(input.headers, mcpHeaderSlot) : null;
-        const canonicalQueryParams = input.queryParams !== void 0 ? canonicalizeCredentialMap(input.queryParams, mcpQueryParamSlot) : null;
-        const canonicalAuth = input.auth !== void 0 ? canonicalizeAuth(input.auth) : null;
-        const directBindings = [
-          ...canonicalHeaders?.bindings ?? [],
-          ...canonicalQueryParams?.bindings ?? [],
-          ...canonicalAuth?.bindings ?? []
-        ];
-        if (directBindings.length > 0) {
-          yield* validateMcpBindingTarget(ctx, {
-            sourceId,
-            sourceScope,
-            targetScope
-          });
-        }
-        const updatedConfig = {
-          ...existing.config,
-          ...input.endpoint !== void 0 ? { endpoint: input.endpoint } : {},
-          ...canonicalHeaders ? { headers: canonicalHeaders.values } : {},
-          ...canonicalAuth ? { auth: canonicalAuth.auth } : {},
-          ...canonicalQueryParams ? { queryParams: canonicalQueryParams.values } : {}
-        };
-        const affectedPrefixes = [
-          ...input.headers !== void 0 ? ["header:"] : [],
-          ...input.queryParams !== void 0 ? ["query_param:"] : [],
-          ...input.auth !== void 0 ? ["auth:"] : []
-        ];
-        const sourceName = input.name?.trim() || existing.name;
-        yield* ctx.transaction(
-          Effect6.gen(function* () {
-            yield* ctx.storage.putSource({
-              namespace: sourceId,
-              scope: sourceScope,
-              name: sourceName,
-              config: updatedConfig
-            });
-            if (affectedPrefixes.length > 0 || directBindings.length > 0) {
-              yield* ctx.credentialBindings.replaceForSource({
-                targetScope: ScopeId.make(targetScope),
-                pluginId: MCP_PLUGIN_ID,
-                sourceId,
-                sourceScope: ScopeId.make(sourceScope),
-                slotPrefixes: affectedPrefixes,
-                bindings: directBindings.map((binding) => ({
-                  slotKey: binding.slot,
-                  value: binding.value
-                }))
-              });
-            }
-          })
-        );
-        if (options?.configFile) {
-          const bindings = yield* ctx.credentialBindings.listForSource({
-            pluginId: MCP_PLUGIN_ID,
-            sourceId,
-            sourceScope: ScopeId.make(sourceScope)
-          });
-          const inputForm = inputFormFromStored(
-            bindings,
-            updatedConfig,
-            sourceScope,
-            sourceName,
-            sourceId
-          );
-          yield* options.configFile.upsertSource(toMcpConfigEntry(sourceId, sourceName, inputForm)).pipe(Effect6.withSpan("mcp.plugin.config_file.upsert"));
-        }
-      })
-    },
-    staticSources: (self) => [
-      {
-        id: "mcp",
-        kind: "executor",
-        name: "MCP",
-        tools: [
-          tool({
-            name: "probeEndpoint",
-            description: "Probe a remote MCP endpoint before adding it. If the result requires OAuth, call `executor.coreTools.oauth.probe` and `executor.coreTools.oauth.start` with `credentialScope` set to the user's chosen personal or organization credential scope first, then pass the resulting connection through `addSource` credentials or `mcp.configureSource`.",
-            inputSchema: McpProbeEndpointInputStandardSchema,
-            outputSchema: McpProbeEndpointOutputStandardSchema,
-            execute: (input) => self.probeEndpoint(input).pipe(
-              Effect6.map(ToolResult.ok),
-              Effect6.catchTag(
-                "McpConnectionError",
-                ({ message, transport }) => Effect6.succeed(mcpToolFailure("mcp_connection_failed", message, { transport }))
-              )
-            )
-          }),
-          tool({
-            name: "getSource",
-            description: "Inspect an existing MCP source, including transport, endpoint/command, auth mode, configured headers/query params, and credential slots. Use this before repairing an existing source with `mcp.configureSource`, `secrets.create`, or `oauth.start`.",
-            inputSchema: McpGetSourceInputStandardSchema,
-            outputSchema: McpGetSourceOutputStandardSchema,
-            execute: (input, { ctx }) => {
-              const args = input;
-              return Effect6.map(
-                self.getSource(args.namespace, resolveStaticScopeInput(ctx, args.scope)),
-                (source) => ToolResult.ok({ source })
-              );
-            }
-          }),
-          tool({
-            name: "addSource",
-            description: "Add an MCP source and register its tools. Executor chooses the source install scope (local scope locally, organization scope in cloud) and returns it as `source`. For remote OAuth-protected servers, first use `probeEndpoint` and the core OAuth browser handoff (`oauth.probe`, `oauth.start` with the user's chosen `credentialScope`), then bind the completed connection with `mcp.configureSource` if needed. For header/API-key auth, first call `secrets.create` at the user's chosen credential scope so the value is entered in the browser, then pass the secret reference in `credentials`. Remote sources are still saved if discovery fails; inspect the returned `discovery` field and use `sources.refresh` after credentials or network access are fixed.",
-            annotations: {
-              requiresApproval: true,
-              approvalDescription: "Add an MCP source"
-            },
-            inputSchema: McpAddSourceInputStandardSchema,
-            outputSchema: McpAddSourceOutputStandardSchema,
-            execute: (rawInput, { ctx }) => {
-              const input = rawInput;
-              const sourceScope = defaultSourceInstallScopeId(ctx.scopes);
-              if (sourceScope === null) {
-                return Effect6.succeed(
-                  mcpToolFailure(
-                    "source_scope_unavailable",
-                    "Cannot add an MCP source because this executor has no source install scope."
-                  )
-                );
-              }
-              const normalizedInput = {
-                ...input,
-                scope: sourceScope
-              };
-              const added = self.addSource(normalizedInput).pipe(
-                Effect6.map(
-                  (result) => ToolResult.ok({
-                    ...result,
-                    source: { id: result.namespace, scope: sourceScope },
-                    discovery: { status: "ok" }
-                  })
-                )
-              );
-              if (normalizedInput.transport !== "remote") return added;
-              const savedWithDiscoveryFailure = (failure) => Effect6.succeed(
-                ToolResult.ok({
-                  namespace: normalizedInput.namespace ?? deriveMcpNamespace({
-                    name: normalizedInput.name,
-                    endpoint: normalizedInput.endpoint
-                  }),
-                  source: {
-                    id: normalizedInput.namespace ?? deriveMcpNamespace({
-                      name: normalizedInput.name,
-                      endpoint: normalizedInput.endpoint
-                    }),
-                    scope: sourceScope
-                  },
-                  toolCount: 0,
-                  discovery: {
-                    status: "failed",
-                    message: failure.message,
-                    ...failure.stage ? { stage: failure.stage } : {}
-                  }
-                })
-              );
-              return added.pipe(
-                Effect6.catchTags({
-                  McpToolDiscoveryError: savedWithDiscoveryFailure,
-                  McpConnectionError: ({ message }) => Effect6.succeed(
-                    ToolResult.ok({
-                      namespace: normalizedInput.namespace ?? deriveMcpNamespace({
-                        name: normalizedInput.name,
-                        endpoint: normalizedInput.endpoint
-                      }),
-                      source: {
-                        id: normalizedInput.namespace ?? deriveMcpNamespace({
-                          name: normalizedInput.name,
-                          endpoint: normalizedInput.endpoint
-                        }),
-                        scope: sourceScope
-                      },
-                      toolCount: 0,
-                      discovery: {
-                        status: "failed",
-                        message
-                      }
-                    })
-                  )
-                })
-              );
-            }
-          }),
-          tool({
-            name: "configureSource",
-            description: 'Configure an existing remote MCP source with concrete fields. Use `source` returned by `mcp.addSource` or `sources.list`. The top-level `scope` is the credential target scope for bindings; in cloud, choose the user or organization credential scope deliberately. Pass secret refs as `{kind:"secret", secretId}` and OAuth connections as `{kind:"connection", connectionId}`.',
-            annotations: {
-              requiresApproval: true,
-              approvalDescription: "Configure an MCP source"
-            },
-            inputSchema: McpStaticConfigureSourceInputStandardSchema,
-            outputSchema: McpStaticConfigureSourceOutputStandardSchema,
-            execute: (rawInput, { ctx }) => Effect6.gen(function* () {
-              const { source, ...config } = rawInput;
-              const sourceScope = resolveStaticScopeInput(ctx, source.scope);
-              const targetScope = resolveStaticScopeInput(ctx, config.scope);
-              yield* ctx.core.sources.configure({
-                source: { id: source.id, scope: sourceScope },
-                scope: targetScope,
-                type: "mcp",
-                config: {
-                  ...config.name !== void 0 ? { name: config.name } : {},
-                  ...config.endpoint !== void 0 ? { endpoint: config.endpoint } : {},
-                  ...config.headers !== void 0 ? { headers: config.headers } : {},
-                  ...config.queryParams !== void 0 ? { queryParams: config.queryParams } : {},
-                  ...config.auth !== void 0 ? { auth: config.auth } : {}
-                }
-              });
-              return ToolResult.ok({ configured: true });
-            })
-          })
-        ]
-      }
-    ],
-    invokeTool: ({ ctx, toolRow, args, elicit }) => Effect6.gen(function* () {
-      const runtime = yield* ensureRuntime();
-      const toolScope = toolRow.scope_id;
-      const entry = yield* ctx.storage.getBinding(toolRow.id, toolScope).pipe(
-        Effect6.withSpan("mcp.plugin.load_binding", {
-          attributes: { "mcp.tool.name": toolRow.id }
-        })
-      );
-      if (!entry) {
-        return yield* new McpInvocationError({
-          toolName: toolRow.id,
-          message: `No MCP binding found for tool "${toolRow.id}"`
-        });
-      }
-      const sd = yield* ctx.storage.getSourceConfig(entry.namespace, toolScope).pipe(
-        Effect6.withSpan("mcp.plugin.load_source_config", {
-          attributes: { "mcp.source.namespace": entry.namespace }
-        })
-      );
-      if (!sd) {
-        return yield* new McpConnectionError({
-          transport: "auto",
-          message: `No MCP source config for namespace "${entry.namespace}"`
-        });
-      }
-      const raw = yield* invokeMcpTool({
-        toolId: toolRow.id,
-        toolName: entry.binding.toolName,
-        args,
-        sourceData: sd,
-        sourceId: entry.namespace,
-        sourceScope: toolScope,
-        invokerScope: ctx.scopes[0].id,
-        resolveConnector: () => resolveConnectorInput(entry.namespace, toolScope, sd, ctx, allowStdio).pipe(
-          Effect6.catchTags({
-            StorageError: () => Effect6.fail(
-              new McpConnectionError({
-                transport: sd.transport,
-                message: "Failed to resolve MCP connector storage state"
-              })
-            ),
-            UniqueViolationError: () => Effect6.fail(
-              new McpConnectionError({
-                transport: sd.transport,
-                message: "Failed to resolve MCP connector storage state"
-              })
-            )
-          }),
-          Effect6.flatMap((ci) => createMcpConnector(ci)),
-          Effect6.withSpan("mcp.plugin.resolve_connector", {
-            attributes: {
-              "mcp.source.namespace": entry.namespace,
-              "mcp.source.transport": sd.transport
-            }
-          })
-        ),
-        connectionCache: runtime.connectionCache,
-        pendingConnectors: runtime.pendingConnectors,
-        elicit
-      });
-      const envelope = Option5.getOrUndefined(decodeMcpToolCallEnvelope(raw));
-      if (envelope?.isError === true) {
-        return ToolResult.fail({
-          code: "mcp_tool_error",
-          message: extractMcpErrorMessage(envelope.content),
-          details: { content: envelope.content }
-        });
-      }
-      return ToolResult.ok(raw);
-    }).pipe(
-      Effect6.catchTag(
-        "McpAuthRequiredError",
-        (error) => Effect6.succeed(mcpAuthToolFailure(error))
-      ),
-      Effect6.withSpan("mcp.plugin.invoke_tool", {
-        attributes: {
-          "mcp.tool.name": toolRow.id,
-          "mcp.tool.source_id": toolRow.source_id
-        }
-      })
-    ),
-    detect: ({ ctx, url }) => Effect6.gen(function* () {
-      const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
-      const trimmed = url.trim();
-      if (!trimmed) return null;
-      const parsed = yield* Effect6.try({
-        try: () => new URL(trimmed),
-        catch: (cause) => cause
-      }).pipe(Effect6.option);
-      if (Option5.isNone(parsed)) return null;
-      const name = parsed.value.hostname || "mcp";
-      const namespace = deriveMcpNamespace({ endpoint: trimmed });
-      const connector = createMcpConnector({
-        transport: "remote",
-        endpoint: trimmed
-      });
-      const connected = yield* discoverTools(connector).pipe(
-        Effect6.map(() => true),
-        Effect6.catch(() => Effect6.succeed(false)),
-        Effect6.withSpan("mcp.plugin.discover_tools")
-      );
-      if (connected) {
-        return SourceDetectionResult.make({
-          kind: "mcp",
-          confidence: "high",
-          endpoint: trimmed,
-          name,
-          namespace
-        });
-      }
-      const shape = yield* probeMcpEndpointShape(trimmed, { httpClientLayer });
-      if (shape.kind === "mcp") {
-        return SourceDetectionResult.make({
-          kind: "mcp",
-          confidence: "high",
-          endpoint: trimmed,
-          name,
-          namespace
-        });
-      }
-      if (urlMatchesToken(parsed.value, "mcp")) {
-        return SourceDetectionResult.make({
-          kind: "mcp",
-          confidence: "low",
-          endpoint: trimmed,
-          name,
-          namespace
-        });
-      }
-      return null;
-    }).pipe(
-      Effect6.catch(() => Effect6.succeed(null)),
-      Effect6.withSpan("mcp.plugin.detect", {
-        attributes: { "mcp.endpoint": url }
-      })
-    ),
-    // Honor upstream destructiveHint from MCP ToolAnnotations.
-    // Bindings are fetched per scope so shadowed sources (e.g. an org-level
-    // source overridden per-user) each resolve against their own scope's
-    // row rather than collapsing onto whichever visible row would otherwise
-    // win first.
-    resolveAnnotations: ({ ctx, sourceId, toolRows }) => Effect6.gen(function* () {
-      const scopes = new Set(toolRows.map((row) => row.scope_id));
-      const entries = yield* Effect6.forEach(
-        [...scopes],
-        (scope) => Effect6.gen(function* () {
-          const list = yield* ctx.storage.listBindingsBySource(sourceId, scope);
-          const byId = new Map(list.map((e) => [e.toolId, e.binding]));
-          return [scope, byId];
-        }),
-        { concurrency: "unbounded" }
-      );
-      const byScope = new Map(entries);
-      const out = {};
-      for (const row of toolRows) {
-        const binding = byScope.get(row.scope_id)?.get(row.id);
-        const ann = binding?.annotations;
-        if (ann?.destructiveHint === true) {
-          out[row.id] = {
-            requiresApproval: true,
-            approvalDescription: ann.title ?? binding?.toolName ?? row.id
-          };
-        } else {
-          out[row.id] = { requiresApproval: false };
-        }
-      }
-      return out;
-    }),
-    removeSource: ({ ctx, sourceId, scope }) => Effect6.gen(function* () {
-      yield* ctx.transaction(
-        Effect6.gen(function* () {
-          yield* ctx.credentialBindings.removeForSource({
-            pluginId: MCP_PLUGIN_ID,
-            sourceId,
-            sourceScope: ScopeId.make(scope)
-          });
-          yield* ctx.storage.removeBindingsByNamespace(sourceId, scope);
-          yield* ctx.storage.removeSource(sourceId, scope);
-        })
-      );
-      if (options?.configFile) {
-        yield* options.configFile.removeSource(sourceId);
-      }
-    }),
-    usagesForSecret: () => Effect6.succeed([]),
-    usagesForConnection: () => Effect6.succeed([]),
-    refreshSource: () => Effect6.void,
-    // Connection refresh for oauth2-minted sources is owned by the
-    // canonical `"oauth2"` ConnectionProvider that core registers via
-    // `makeOAuth2Service`. No MCP-specific provider needed.
-    close: () => Effect6.gen(function* () {
-      const runtime = runtimeRef.current;
-      if (runtime) {
-        runtime.pendingConnectors.clear();
-        yield* ScopedCache2.invalidateAll(runtime.connectionCache);
-        yield* Scope.close(runtime.cacheScope, Exit2.void);
-        runtimeRef.current = null;
-      }
-    }).pipe(Effect6.withSpan("mcp.plugin.close"))
-  };
-});
-
-export {
-  mcpSchema,
-  makeMcpStore,
-  mcpPlugin
-};
-//# sourceMappingURL=chunk-LEGVPKYH.js.map