@fruggr/zendesk-mcp-server 3.4.0 → 3.5.1

package/README.md

@@ -224,13 +224,16 @@ clients, MCP client wiring, CORS and what stays the operator's job:
 ## Tool surface
 
 Tools are grouped into namespaces: **Tickets**, **Help Center**, **Users &
-Organizations**, **Search**, and **Requests** — the end-user surface, which is
-opt-in and covered under [End-user mode](#end-user-mode). The server registers
+Organizations**, **Search**, **Connector preferences** — this server's own
+per-user settings, such as SLA alert thresholds, never written to Zendesk — and
+**Requests** — the end-user surface, which is opt-in and covered under
+[End-user mode](#end-user-mode). The server registers
 them in one of three modes, so you can trade granularity against context budget:
 
 - **`all`**: every operation as its own tool, for clients with good tool selection;
 - **`namespace`** (default): one proxy tool per namespace, a balanced middle ground;
-- **`single`**: a single `zendesk` tool, for models with limited tool slots.
+- **`single`**: a single `zendesk` tool, for models with limited tool slots (the
+  connector's own preferences keep their `connector_preferences` proxy beside it).
 
 Proxies take `{ "operation": "<tool_name>", "params": { … } }` and validate
 `params` through the original schema. `--namespace`, `--tool` and `--read-only`

package/dist/THIRD-PARTY-NOTICES.md

@@ -4780,7 +4780,7 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## undici@7.30.0
+## undici@7.30.1
 
 License: MIT
 
@@ -5198,7 +5198,7 @@ The above copyright notice and this permission notice shall be included in all c
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## zod@4.6.6
+## zod@4.6.7
 
 License: MIT
 

package/dist/{http-DU1dSrPe.js → http-CWM14zJp.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { C as __exportAll, S as __commonJSMin, T as __toESM, _ as OAuthErrorCode, a as silentLogger, b as errnoCode, c as deadlineSignal, d as DEFAULT_MAX_REQUEST_BODY_SIZE, f as WebStandardStreamableHTTPServerTransport, g as OAuthError, h as verifyBearerToken, m as isLegacyRequest, n as defaultServerFactory, o as zendeskGet, p as createMcpHandler, r as createRequestStateCodec, s as REQUEST_TIMEOUT_MS, t as createServerCaches, u as getOAuthUrls, v as STARTUP_DOCS, w as __require, y as createStartupError } from "./index.js";
-import { d as escapeHtml, l as requestedScope, n as configDir, o as generateCodeChallenge, s as generateCodeVerifier, u as supportedScopes } from "./token-persistence-r0v9RO3q.js";
-import * as util$1 from "node:util";
+import { A as __commonJSMin, C as isLegacyRequest, D as STARTUP_DOCS, E as OAuthErrorCode, M as __require, N as __toESM, O as createStartupError, S as createMcpHandler, T as OAuthError, _ as deadlineSignal, a as watchGrantAlerts, b as DEFAULT_MAX_REQUEST_BODY_SIZE, c as configDir, g as REQUEST_TIMEOUT_MS, h as zendeskGet, i as defaultServerFactory, j as __exportAll, k as errnoCode, m as silentLogger, n as listenedUris, o as startSlaRuntime, p as createRequestStateCodec, r as createServerCaches, t as createListenFeed, w as verifyBearerToken, x as WebStandardStreamableHTTPServerTransport, y as getOAuthUrls } from "./index.js";
+import { a as supportedScopes, i as requestedScope, n as generateCodeVerifier, o as escapeHtml, t as generateCodeChallenge } from "./pkce-DE_v9NQy.js";
+import * as util from "node:util";
 import { format, inspect } from "node:util";
 import * as crypto$2 from "node:crypto";
 import { createHash, createPrivateKey, createSecretKey, hkdfSync, randomBytes, randomFillSync, randomUUID, timingSafeEqual } from "node:crypto";
@@ -3565,7 +3565,7 @@ var require_depd$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	/**
 	* Module dependencies.
 	*/
-	var relative$1 = __require("path").relative;
+	var relative = __require("path").relative;
 	/**
 	* Module exports.
 	*/
@@ -3768,7 +3768,7 @@ var require_depd$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* Format call site location.
 	*/
 	function formatLocation(callSite) {
-		return relative$1(basePath, callSite[0]) + ":" + callSite[1] + ":" + callSite[2];
+		return relative(basePath, callSite[0]) + ":" + callSite[1] + ":" + callSite[2];
 	}
 	/**
 	* Get the stack as array of call sites.
@@ -3905,10 +3905,10 @@ var require_inherits_browser = /* @__PURE__ */ __commonJSMin(((exports, module)
 //#region node_modules/.pnpm/inherits@2.0.4/node_modules/inherits/inherits.js
 var require_inherits = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	try {
-		var util$6 = __require("util");
+		var util = __require("util");
 		/* istanbul ignore next */
-		if (typeof util$6.inherits !== "function") throw "";
-		module.exports = util$6.inherits;
+		if (typeof util.inherits !== "function") throw "";
+		module.exports = util.inherits;
 	} catch (e) {
 		/* istanbul ignore next */
 		module.exports = require_inherits_browser();
@@ -4110,7 +4110,7 @@ var require_http_errors$1 = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	* Populate the exports object with constructors for every error class.
 	* @private
 	*/
-	function populateConstructorExports(exports$2, codes, HttpError) {
+	function populateConstructorExports(exports, codes, HttpError) {
 		codes.forEach(function forEachCode(code) {
 			var CodeError;
 			var name = toIdentifier(statuses.message[code]);
@@ -4121,8 +4121,8 @@ var require_http_errors$1 = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 				case 500: CodeError = createServerErrorConstructor(HttpError, name, code);
 			}
 			if (CodeError) {
-				exports$2[code] = CodeError;
-				exports$2[name] = CodeError;
+				exports[code] = CodeError;
+				exports[name] = CodeError;
 			}
 		});
 	}
@@ -11867,7 +11867,7 @@ var require_mime_types$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	* @private
 	*/
 	var db = require_mime_db$1();
-	var extname$2 = __require("path").extname;
+	var extname = __require("path").extname;
 	/**
 	* Module variables.
 	* @private
@@ -11937,7 +11937,7 @@ var require_mime_types$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	*/
 	function lookup(path) {
 		if (!path || typeof path !== "string") return false;
-		var extension = extname$2("x." + path).toLowerCase().substr(1);
+		var extension = extname("x." + path).toLowerCase().substr(1);
 		if (!extension) return false;
 		return exports.types[extension] || false;
 	}
@@ -12389,10 +12389,10 @@ var require_parseurl = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region node_modules/.pnpm/koa@3.2.1/node_modules/koa/lib/search-params.js
 var require_search_params = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const URLSearchParams$1 = __require("url").URLSearchParams;
+	const URLSearchParams = __require("url").URLSearchParams;
 	module.exports = {
 		stringify: (obj) => {
-			const searchParams = new URLSearchParams$1();
+			const searchParams = new URLSearchParams();
 			const addKey = (k, v, params) => {
 				const val = typeof v === "string" || typeof v === "number" ? v : "";
 				params.append(k, val);
@@ -12404,7 +12404,7 @@ var require_search_params = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 			return searchParams.toString();
 		},
 		parse: (str) => {
-			const searchParams = new URLSearchParams$1(str);
+			const searchParams = new URLSearchParams(str);
 			const obj = {};
 			for (const key of searchParams.keys()) {
 				const values = searchParams.getAll(key);
@@ -20271,7 +20271,7 @@ var require_mime_types = /* @__PURE__ */ __commonJSMin(((exports) => {
 	* @private
 	*/
 	var db = require_mime_db();
-	var extname$1 = __require("path").extname;
+	var extname = __require("path").extname;
 	var mimeScore = require_mimeScore();
 	/**
 	* Module variables.
@@ -20343,7 +20343,7 @@ var require_mime_types = /* @__PURE__ */ __commonJSMin(((exports) => {
 	*/
 	function lookup(path) {
 		if (!path || typeof path !== "string") return false;
-		var extension = extname$1("x." + path).toLowerCase().slice(1);
+		var extension = extname("x." + path).toLowerCase().slice(1);
 		if (!extension) return false;
 		return exports.types[extension] || false;
 	}
@@ -20743,7 +20743,7 @@ var require_request = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	/**
 	* Module dependencies.
 	*/
-	const URL$1 = __require("url").URL;
+	const URL = __require("url").URL;
 	const net = __require("net");
 	const accepts = require_accepts();
 	const contentType = require_content_type();
@@ -20753,7 +20753,7 @@ var require_request = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const typeis = require_type_is();
 	const fresh = require_fresh();
 	const only = require_only();
-	const util$5 = __require("util");
+	const util = __require("util");
 	const IP = Symbol("context#ip");
 	/**
 	* Prototype.
@@ -20950,7 +20950,7 @@ var require_request = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			if (!host) return "";
 			host = splitCommaSeparatedValues(host, 1)[0];
 			if (host.includes("@")) try {
-				host = new URL$1(`http://${host}`).host;
+				host = new URL(`http://${host}`).host;
 			} catch (e) {
 				return "";
 			}
@@ -20982,7 +20982,7 @@ var require_request = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			if (!this.memoizedURL) {
 				const originalUrl = this.originalUrl || "";
 				try {
-					this.memoizedURL = new URL$1(`${this.protocol}://${this.host}${originalUrl}`);
+					this.memoizedURL = new URL(`${this.protocol}://${this.host}${originalUrl}`);
 				} catch (err) {
 					this.memoizedURL = Object.create(null);
 				}
@@ -21356,7 +21356,7 @@ var require_request = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* @api public
 	*/
 	/* istanbul ignore else */
-	if (util$5.inspect.custom) module.exports[util$5.inspect.custom] = module.exports.inspect;
+	if (util.inspect.custom) module.exports[util.inspect.custom] = module.exports.inspect;
 	/**
 	* Split a comma-separated value string into an array of values, with an optional limit.
 	* All the values are trimmed of whitespace.
@@ -21744,9 +21744,9 @@ var require_destroy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* Module dependencies.
 	* @private
 	*/
-	var EventEmitter$1 = __require("events").EventEmitter;
+	var EventEmitter = __require("events").EventEmitter;
 	var ReadStream = __require("fs").ReadStream;
-	var Stream$2 = __require("stream");
+	var Stream = __require("stream");
 	var Zlib = __require("zlib");
 	/**
 	* Module exports.
@@ -21822,7 +21822,7 @@ var require_destroy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 					stream._needDrain = true;
 					stream.once("drain", onDrainClearBinding);
 				} else stream._binding.clear();
-			} else if (stream._destroy && stream._destroy !== Stream$2.Transform.prototype._destroy) stream.destroy();
+			} else if (stream._destroy && stream._destroy !== Stream.Transform.prototype._destroy) stream.destroy();
 			else if (stream._destroy && typeof stream.close === "function") {
 				stream.destroyed = true;
 				stream.close();
@@ -21836,14 +21836,14 @@ var require_destroy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* @private
 	*/
 	function hasDestroy(stream) {
-		return stream instanceof Stream$2 && typeof stream.destroy === "function";
+		return stream instanceof Stream && typeof stream.destroy === "function";
 	}
 	/**
 	* Determine if val is EventEmitter.
 	* @private
 	*/
 	function isEventEmitter(val) {
-		return val instanceof EventEmitter$1;
+		return val instanceof EventEmitter;
 	}
 	/**
 	* Determine if stream is fs.ReadStream stream.
@@ -22020,9 +22020,9 @@ var require_vary = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region node_modules/.pnpm/koa@3.2.1/node_modules/koa/lib/is-stream.js
 var require_is_stream = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const Stream$1 = __require("stream");
+	const Stream = __require("stream");
 	module.exports = (stream) => {
-		return stream instanceof Stream$1 || stream !== null && typeof stream === "object" && !!stream.readable && typeof stream.pipe === "function" && typeof stream.read === "function" && typeof stream.readable === "boolean" && typeof stream.readableObjectMode === "boolean" && typeof stream.destroy === "function" && typeof stream.destroyed === "boolean";
+		return stream instanceof Stream || stream !== null && typeof stream === "object" && !!stream.readable && typeof stream.pipe === "function" && typeof stream.read === "function" && typeof stream.readable === "boolean" && typeof stream.readableObjectMode === "boolean" && typeof stream.destroy === "function" && typeof stream.destroyed === "boolean";
 	};
 }));
 //#endregion
@@ -22033,7 +22033,7 @@ var require_response = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	*/
 	const assert = __require("node:assert");
 	const extname = __require("node:path").extname;
-	const util$4 = __require("node:util");
+	const util = __require("node:util");
 	const contentDisposition = require_content_disposition();
 	const onFinish = require_on_finished();
 	const escape = require_escape_html();
@@ -22535,7 +22535,7 @@ var require_response = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* @api public
 	*/
 	/* istanbul ignore else */
-	if (util$4.inspect.custom) module.exports[util$4.inspect.custom] = module.exports.inspect;
+	if (util.inspect.custom) module.exports[util.inspect.custom] = module.exports.inspect;
 }));
 //#endregion
 //#region node_modules/.pnpm/depd@1.1.2/node_modules/depd/lib/compat/callsite-tostring.js
@@ -23322,7 +23322,7 @@ var require_http_errors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* Populate the exports object with constructors for every error class.
 	* @private
 	*/
-	function populateConstructorExports(exports$1, codes, HttpError) {
+	function populateConstructorExports(exports, codes, HttpError) {
 		codes.forEach(function forEachCode(code) {
 			var CodeError;
 			var name = toIdentifier(statuses[code]);
@@ -23333,11 +23333,11 @@ var require_http_errors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				case 500: CodeError = createServerErrorConstructor(HttpError, name, code);
 			}
 			if (CodeError) {
-				exports$1[code] = CodeError;
-				exports$1[name] = CodeError;
+				exports[code] = CodeError;
+				exports[name] = CodeError;
 			}
 		});
-		exports$1["I'mateapot"] = deprecate.function(exports$1.ImATeapot, "\"I'mateapot\"; use \"ImATeapot\" instead");
+		exports["I'mateapot"] = deprecate.function(exports.ImATeapot, "\"I'mateapot\"; use \"ImATeapot\" instead");
 	}
 	/**
 	* Get a class name from a name identifier.
@@ -23566,18 +23566,18 @@ var require_delegates = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region node_modules/.pnpm/tsscmp@1.0.6/node_modules/tsscmp/lib/index.js
 var require_lib = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var crypto$4 = __require("crypto");
+	var crypto = __require("crypto");
 	function bufferEqual(a, b) {
 		if (a.length !== b.length) return false;
-		if (crypto$4.timingSafeEqual) return crypto$4.timingSafeEqual(a, b);
+		if (crypto.timingSafeEqual) return crypto.timingSafeEqual(a, b);
 		for (var i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
 		return true;
 	}
 	function timeSafeCompare(a, b) {
 		var sa = String(a);
 		var sb = String(b);
-		var key = crypto$4.pseudoRandomBytes(32);
-		return bufferEqual(crypto$4.createHmac("sha256", key).update(sa).digest(), crypto$4.createHmac("sha256", key).update(sb).digest()) && a === b;
+		var key = crypto.pseudoRandomBytes(32);
+		return bufferEqual(crypto.createHmac("sha256", key).update(sa).digest(), crypto.createHmac("sha256", key).update(sb).digest()) && a === b;
 	}
 	module.exports = timeSafeCompare;
 }));
@@ -23590,14 +23590,14 @@ var require_lib = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 */
 var require_keygrip = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var compare = require_lib();
-	var crypto$3 = __require("crypto");
+	var crypto = __require("crypto");
 	function Keygrip(keys, algorithm, encoding) {
 		if (!algorithm) algorithm = "sha1";
 		if (!encoding) encoding = "base64";
 		if (!(this instanceof Keygrip)) return new Keygrip(keys, algorithm, encoding);
 		if (!keys || !(0 in keys)) throw new Error("Keys must be provided.");
 		function sign(data, key) {
-			return crypto$3.createHmac(algorithm, key).update(data).digest(encoding).replace(/\/|\+|=/g, function(x) {
+			return crypto.createHmac(algorithm, key).update(data).digest(encoding).replace(/\/|\+|=/g, function(x) {
 				return {
 					"/": "_",
 					"+": "-",
@@ -23632,7 +23632,7 @@ var require_keygrip = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 var require_cookies = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var deprecate = require_depd$1()("cookies");
 	var Keygrip = require_keygrip();
-	var http$1 = __require("http");
+	var http = __require("http");
 	/**
 	* RegExp to match field-content in RFC 7230 sec 3.2
 	*
@@ -23739,7 +23739,7 @@ var require_cookies = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			cookie.name += ".sig";
 			pushCookie(headers, cookie);
 		}
-		(res.set ? http$1.OutgoingMessage.prototype.setHeader : res.setHeader).call(res, "Set-Cookie", headers);
+		(res.set ? http.OutgoingMessage.prototype.setHeader : res.setHeader).call(res, "Set-Cookie", headers);
 		return this;
 	};
 	function Cookie(name, value, attrs) {
@@ -23834,7 +23834,7 @@ var require_context = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	/**
 	* Module dependencies.
 	*/
-	const util$3 = __require("util");
+	const util = __require("util");
 	const createError = require_http_errors$1();
 	const httpAssert = require_http_assert();
 	const delegate = require_delegates();
@@ -23922,7 +23922,7 @@ var require_context = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		*/
 		onerror(err) {
 			if (err == null) return;
-			if (!(Object.prototype.toString.call(err) === "[object Error]" || err instanceof Error)) err = new Error(util$3.format("non-error thrown: %j", err));
+			if (!(Object.prototype.toString.call(err) === "[object Error]" || err instanceof Error)) err = new Error(util.format("non-error thrown: %j", err));
 			let headerSent = false;
 			if (this.headerSent || !this.writable) headerSent = err.headerSent = true;
 			this.app.emit("error", err, this);
@@ -23959,7 +23959,7 @@ var require_context = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* @api public
 	*/
 	/* istanbul ignore else */
-	if (util$3.inspect.custom) module.exports[util$3.inspect.custom] = module.exports.inspect;
+	if (util.inspect.custom) module.exports[util.inspect.custom] = module.exports.inspect;
 	/**
 	* Response delegation.
 	*/
@@ -23975,13 +23975,13 @@ var require_application = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	/**
 	* Module dependencies.
 	*/
-	const util$2 = __require("node:util");
+	const util = __require("node:util");
 	const v8 = __require("node:v8");
-	const debug = util$2.debuglog("koa:application");
+	const debug = util.debuglog("koa:application");
 	const Emitter = __require("node:events");
 	const Stream = __require("node:stream");
 	const http = __require("node:http");
-	const { AsyncLocalStorage: AsyncLocalStorage$1 } = __require("node:async_hooks");
+	const { AsyncLocalStorage } = __require("node:async_hooks");
 	const onFinished = require_on_finished();
 	const compose = require_koa_compose();
 	const statuses = require_statuses$1();
@@ -24007,8 +24007,8 @@ var require_application = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* Inherits from `Emitter.prototype`.
 	*/
 	function getAsyncLocalStorage(options) {
-		if (options.asyncLocalStorage instanceof AsyncLocalStorage$1) return options.asyncLocalStorage;
-		return new AsyncLocalStorage$1();
+		if (options.asyncLocalStorage instanceof AsyncLocalStorage) return options.asyncLocalStorage;
+		return new AsyncLocalStorage();
 	}
 	module.exports = class Application extends Emitter {
 		/**
@@ -24044,7 +24044,7 @@ var require_application = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			this.request = Object.create(request);
 			this.response = Object.create(response);
 			/* istanbul ignore else */
-			if (util$2.inspect.custom) this[util$2.inspect.custom] = this.inspect;
+			if (util.inspect.custom) this[util.inspect.custom] = this.inspect;
 			if (options.asyncLocalStorage) {
 				if (v8.startupSnapshot?.isBuildingSnapshot?.()) {
 					this.ctxStorage = null;
@@ -24175,7 +24175,7 @@ var require_application = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		* @api private
 		*/
 		onerror(err) {
-			if (!(Object.prototype.toString.call(err) === "[object Error]" || err instanceof Error)) throw new TypeError(util$2.format("non-error thrown: %j", err));
+			if (!(Object.prototype.toString.call(err) === "[object Error]" || err instanceof Error)) throw new TypeError(util.format("non-error thrown: %j", err));
 			if (err.status === 404 || err.expose) return;
 			if (this.silent) return;
 			const msg = err.stack || err.toString();
@@ -26955,7 +26955,7 @@ function initializeAdapter(adapter = MemoryAdapter) {
 		Adapter = createMemoryAdapter(get$2(this).configuration.clockTolerance);
 	} else {
 		const constructable = type_validators_default(adapter);
-		const executable = typeof adapter === "function" && !util$1.types.isAsyncFunction(adapter);
+		const executable = typeof adapter === "function" && !util.types.isAsyncFunction(adapter);
 		if (!constructable && !executable) throw new Error("Expected \"adapter\" to be a constructor or a factory function, provide a valid adapter in Provider config.");
 	}
 	get$2(this).Adapter = Adapter;
@@ -28992,7 +28992,7 @@ var require_has_flag = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#region node_modules/.pnpm/supports-color@7.2.0/node_modules/supports-color/index.js
 var require_supports_color = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const os = __require("os");
-	const tty$1 = __require("tty");
+	const tty = __require("tty");
 	const hasFlag = require_has_flag();
 	const { env } = process;
 	let forceColor;
@@ -29054,8 +29054,8 @@ var require_supports_color = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	}
 	module.exports = {
 		supportsColor: getSupportLevel,
-		stdout: translateLevel(supportsColor(true, tty$1.isatty(1))),
-		stderr: translateLevel(supportsColor(true, tty$1.isatty(2)))
+		stdout: translateLevel(supportsColor(true, tty.isatty(1))),
+		stderr: translateLevel(supportsColor(true, tty.isatty(2)))
 	};
 }));
 //#endregion
@@ -35898,7 +35898,7 @@ var Provider = class extends koa_default {
 		return als_default.getStore();
 	}
 };
-Object.defineProperty(Provider.prototype, "app", { get: util$1.deprecate(function app() {
+Object.defineProperty(Provider.prototype, "app", { get: util.deprecate(function app() {
 	return this;
 }, ".app getter is deprecated. The Provider instance is now the Koa app itself") });
 //#endregion
@@ -36703,7 +36703,6 @@ const sendUnauthorized = (res, issuer) => {
 	sendJsonRpcError(res, 401, -32e3, MISSING_BEARER_MESSAGE, { "WWW-Authenticate": wwwAuthenticate });
 };
 const asNodeRequest = (req) => req;
-const isListenRequest = (body) => typeof body === "object" && body !== null && body.method === "subscriptions/listen";
 const MAX_BODY_BYTES = 4194304;
 const readJsonBody = (req, maxBodyBytes) => new Promise((resolve) => {
 	const chunks = [];
@@ -36772,6 +36771,7 @@ const startHttpTransport = async (config, logger = silentLogger, options = {}) =
 	const buildAuthorizationServer = await prepareAuthorizationServer(config, logger);
 	let authorizationServer;
 	const sessions = /* @__PURE__ */ new Map();
+	const sla = startSlaRuntime(config);
 	const idleTimeoutMs = options.sessionIdleTimeoutMs ?? SESSION_IDLE_TIMEOUT_MS;
 	const maxBodyBytes = options.maxBodyBytes ?? 4194304;
 	const serverFactory = options.serverFactory ?? defaultServerFactory;
@@ -36807,6 +36807,7 @@ const startHttpTransport = async (config, logger = silentLogger, options = {}) =
 			getToken: () => auth.zendeskToken,
 			logger,
 			onUnauthorized: () => void as.revokeGrant(auth.grantId),
+			slaRuntime: sla.runtime,
 			requestStateCodec: createRequestStateCodec({
 				key: as.requestStateKey,
 				principal: () => auth.grantId
@@ -36860,18 +36861,36 @@ const startHttpTransport = async (config, logger = silentLogger, options = {}) =
 				onUnauthorized,
 				caches,
 				requestStateCodec,
+				slaRuntime: sla.runtime,
+				alertPolling: "grant",
 				notifyResourceUpdated: (uri) => handler.notify.resourceUpdated(uri)
 			});
 		}, {
 			legacy: "reject",
 			onerror: (err) => logger.debug("mcp_request_rejected", { error: err.message })
 		});
+		const listens = createListenFeed();
+		const stopAlerts = watchGrantAlerts({
+			config,
+			getToken,
+			caches,
+			slaRuntime: sla.runtime,
+			logger,
+			listens,
+			notify: (uri) => handler.notify.resourceUpdated(uri),
+			onUnauthorized
+		});
 		const entry = {
 			auth,
 			revoked: false,
 			inFlight: 0,
+			listens,
 			handle: toNodeHandler(handler),
-			close: () => handler.close()
+			close: () => {
+				stopAlerts();
+				listens.closeAll();
+				return handler.close();
+			}
 		};
 		return entry;
 	};
@@ -36890,7 +36909,13 @@ const startHttpTransport = async (config, logger = silentLogger, options = {}) =
 			expiresAt: token.expiresAt,
 			extra: { verified: token }
 		};
-		const counted = !isListenRequest(body);
+		const listened = listenedUris(body);
+		const counted = listened === void 0;
+		if (listened) {
+			const stream = Symbol("listen");
+			res.once("close", () => entry.listens.close(stream));
+			entry.listens.open(stream, listened);
+		}
 		if (counted) entry.inFlight += 1;
 		try {
 			await entry.handle(request, res, body);
@@ -37004,6 +37029,7 @@ const startHttpTransport = async (config, logger = silentLogger, options = {}) =
 		port: boundPort,
 		close: async () => {
 			clearInterval(sweeper);
+			sla.stop();
 			await Promise.all([...sessions.values()].map((session) => session.close()));
 			sessions.clear();
 			await grants.closeAll();