@hasna/todos 0.15.41 → 0.15.47

package/dist/server/index.js

@@ -70,7 +70,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.41",
+    version: "0.15.47",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -188,18 +188,19 @@ var init_package = __esm(() => {
     author: "Andrei Hasna <andrei@hasna.com>",
     license: "Apache-2.0",
     dependencies: {
-      "@hasna/contracts": "0.13.3",
+      "@hasna/contracts": "0.13.4",
       "@hasna/events": "^0.1.11",
       "@modelcontextprotocol/sdk": "^1.12.1",
       chalk: "^5.4.1",
       commander: "^13.1.0",
       ink: "^5.2.0",
       react: "^18.3.1",
-      zod: "^3.24.2"
+      zod: "3.25.76"
     },
     overrides: {
       ajv: "8.20.0",
-      "fast-uri": "3.1.2"
+      "fast-uri": "3.1.2",
+      zod: "3.25.76"
     },
     devDependencies: {
       "@types/bun": "^1.2.4",
@@ -223,7 +224,7 @@ var init_package_version = __esm(() => {
   init_package();
 });
 
-// node_modules/.bun/@hasna+contracts@0.13.3+86f0f4a9d69523e0/node_modules/@hasna/contracts/dist/auth/index.js
+// node_modules/.bun/@hasna+contracts@0.13.4+ad7b1171e6eea7eb/node_modules/@hasna/contracts/dist/auth/index.js
 import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
 function isValidTenantId(value) {
   return typeof value === "string" && TENANT_ID_PATTERN.test(value);
@@ -1385,6 +1386,60 @@ var init_creator_identity = __esm(() => {
   init_sync_utils();
 });
 
+// src/lib/instant-compare.ts
+function isLeapYear(year) {
+  return year % 4 === 0 && year % 100 !== 0 || year % 400 === 0;
+}
+function sqliteJulianDay(value) {
+  const m = SQLITE_STAMP.exec(value);
+  if (!m)
+    return null;
+  const year = Number(m[1]);
+  const month = Number(m[2]);
+  const day = Number(m[3]);
+  const hour = m[4] === undefined ? 0 : Number(m[4]);
+  const minute = m[5] === undefined ? 0 : Number(m[5]);
+  const second = m[6] === undefined ? 0 : Number(m[6]);
+  const frac = m[7];
+  const sign = m[8];
+  const offsetHour = m[9];
+  const offsetMinute = m[10];
+  if (month < 1 || month > 12)
+    return null;
+  if (hour > 23 || minute > 59 || second > 59)
+    return null;
+  const maxDay = (DAYS_IN_MONTH[month - 1] ?? 0) + (month === 2 && isLeapYear(year) ? 1 : 0);
+  if (day < 1 || day > maxDay)
+    return null;
+  let offsetMinutes = 0;
+  if (sign !== undefined) {
+    const oh = Number(offsetHour ?? "0");
+    const om = Number(offsetMinute ?? "0");
+    if (oh > 23 || om > 59)
+      return null;
+    offsetMinutes = oh * 60 + om;
+    if (sign === "-")
+      offsetMinutes = -offsetMinutes;
+  }
+  const micros = frac === undefined ? 0 : Number((frac + "000000").slice(0, 6));
+  const ms = Date.UTC(year, month - 1, day, hour, minute, second);
+  return (ms + micros / 1000) / 86400000 + 2440587.5 - offsetMinutes / 1440;
+}
+function changedSinceStampNewer(stamp, since) {
+  const stampJd = sqliteJulianDay(stamp);
+  if (stampJd === null)
+    return true;
+  const sinceJd = sqliteJulianDay(since);
+  if (sinceJd === null)
+    return false;
+  return stampJd > sinceJd;
+}
+var SQLITE_STAMP, DAYS_IN_MONTH;
+var init_instant_compare = __esm(() => {
+  SQLITE_STAMP = /^(\d{4})-(\d{2})-(\d{2})(?:[ T](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d+))?)?(?:Z|([+-])(\d{2}):(\d{2}))?)?$/;
+  DAYS_IN_MONTH = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+});
+
 // src/lib/plan-project-link-contract.ts
 import { createHash as createHash2 } from "crypto";
 function canonicalPlanProjectLinkJson(value) {
@@ -2898,11 +2953,18 @@ class PostgresJsonRecordStore {
     return context?.requestId ?? this.sourceMachineId ?? null;
   }
   async ensureSchema() {
-    this.schemaReady ??= (async () => {
-      for (const sql of postgresTodosSyncSchemaSql(this.tableName, this.cursorTableName)) {
-        await this.options.client.query(sql);
-      }
-    })();
+    if (!this.schemaReady) {
+      this.schemaReady = (async () => {
+        await retryOnTransientPostgresError(async () => {
+          for (const sql of postgresTodosSyncSchemaSql(this.tableName, this.cursorTableName)) {
+            await this.options.client.query(sql);
+          }
+        });
+      })().catch((error) => {
+        this.schemaReady = null;
+        throw error;
+      });
+    }
     await this.schemaReady;
   }
   async get(type, id) {
@@ -3311,13 +3373,14 @@ class PostgresJsonRecordStore {
     throw new Error(divergentAuditHistoryReplayError(value.id));
   }
   async withTaskParentIntegrityTransaction(fn) {
-    if (typeof this.options.client.transaction !== "function") {
+    const transaction = this.options.client.transaction;
+    if (typeof transaction !== "function") {
       throw new Error("TASK_PARENT_ATOMICITY_UNAVAILABLE: PostgreSQL parent writes and task deletion require transaction(callback)");
     }
-    return this.options.client.transaction(async (client) => {
+    return retryOnTransientPostgresError(() => transaction(async (client) => {
       await client.query("/* todos:task-parent-integrity-lock */ SELECT pg_advisory_xact_lock(hashtextextended($1 || ':task-parent-integrity', 0))", [this.service]);
       return fn(client);
-    });
+    }));
   }
   async upsertTaskWithPlanMembershipGuard(value, guardedPlanIds, explicitProject, context = {}, parentGuard, queryClient) {
     const planIds = [...new Set(guardedPlanIds.filter(Boolean))].sort();
@@ -4664,7 +4727,7 @@ async function getActiveWork(filters, store) {
   }));
 }
 async function getChangedSince(since, filters, store) {
-  return (await listTasks(filters ?? {}, store)).filter((task) => task.updated_at > since);
+  return (await listTasks(filters ?? {}, store)).filter((task) => changedSinceStampNewer(task.updated_at ?? "", since));
 }
 async function createProject(input, store, context) {
   const timestamp = new Date().toISOString();
@@ -5200,6 +5263,35 @@ function compareClock(left, right) {
 function numberValue2(value) {
   return typeof value === "number" && Number.isSafeInteger(value) ? value : null;
 }
+function isTransientPostgresError(error) {
+  if (typeof error !== "object" || error === null)
+    return false;
+  const candidate = error;
+  const states = [candidate.code, candidate.errno, candidate.sqlState, candidate.sqlstate];
+  if (typeof candidate.cause === "object" && candidate.cause !== null) {
+    const cause = candidate.cause;
+    states.push(cause.code, cause.errno, cause.sqlState, cause.sqlstate);
+  }
+  if (states.some((state) => typeof state === "string" && TRANSIENT_POSTGRES_SQLSTATES.has(state))) {
+    return true;
+  }
+  const message = typeof candidate.message === "string" ? candidate.message : candidate.cause?.message;
+  return typeof message === "string" && TRANSIENT_POSTGRES_MESSAGE_MARKERS.some((marker) => message.includes(marker));
+}
+async function retryOnTransientPostgresError(fn, attempts = 2, delayMs = 150) {
+  let lastError;
+  for (let attempt = 1;attempt <= attempts; attempt += 1) {
+    try {
+      return await fn();
+    } catch (error) {
+      lastError = error;
+      if (!isTransientPostgresError(error) || attempt === attempts)
+        throw error;
+      await new Promise((resolve) => setTimeout(resolve, delayMs * attempt));
+    }
+  }
+  throw lastError;
+}
 function isPostgresUniqueViolation(error) {
   if (typeof error !== "object" || error === null)
     return false;
@@ -5219,10 +5311,11 @@ function postgresConstraintName(error) {
   const constraint = candidate.constraint ?? candidate.constraint_name ?? cause?.constraint ?? cause?.constraint_name;
   return typeof constraint === "string" ? constraint : "";
 }
-var CLOUD_LOCK_EXPIRY_MINUTES = 30, TASK_ORDER_TIEBREAK = "CASE payload->>'priority' WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 ELSE 4 END ASC, payload->>'created_at' ASC, payload->>'id' ASC", TASK_ORDER_BY;
+var CLOUD_LOCK_EXPIRY_MINUTES = 30, TASK_ORDER_TIEBREAK = "CASE payload->>'priority' WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 ELSE 4 END ASC, payload->>'created_at' ASC, payload->>'id' ASC", TASK_ORDER_BY, TRANSIENT_POSTGRES_SQLSTATES, TRANSIENT_POSTGRES_MESSAGE_MARKERS;
 var init_postgres_adapter = __esm(() => {
   init_types();
   init_creator_identity();
+  init_instant_compare();
   init_plan_project_link_contract();
   init_stale_lock_handoff();
   init_postgres_sync();
@@ -5232,6 +5325,12 @@ var init_postgres_adapter = __esm(() => {
   init_audit_history_import();
   init_canonical();
   TASK_ORDER_BY = `ORDER BY ${TASK_ORDER_TIEBREAK}`;
+  TRANSIENT_POSTGRES_SQLSTATES = new Set(["55P03", "40P01", "40001"]);
+  TRANSIENT_POSTGRES_MESSAGE_MARKERS = [
+    "canceling statement due to lock timeout",
+    "deadlock detected",
+    "could not serialize access"
+  ];
 });
 
 // src/pr-groups/types.ts
@@ -7054,10 +7153,19 @@ class PostgresPrGroupLedgerPersistence {
     this.client = client;
   }
   async ensureSchema() {
-    this.schemaReady ??= (async () => {
-      for (const statement of postgresPrGroupSchemaSql())
-        await this.client.query(statement);
-    })();
+    if (this.schemaReady === null) {
+      const attempt = (async () => {
+        for (const statement of postgresPrGroupSchemaSql())
+          await this.client.query(statement);
+      })();
+      this.schemaReady = attempt;
+      try {
+        await attempt;
+      } catch (error) {
+        this.schemaReady = null;
+        throw error;
+      }
+    }
     return this.schemaReady;
   }
   async transaction(fn) {
@@ -7702,14 +7810,23 @@ class PostgresTodosProjectRegistrationBackend {
     this.cursorTableName = safeIdentifier(options.cursorTableName ?? "todos_sync_cursors", "cursorTableName");
   }
   async ensureSchema() {
-    this.schemaReady ??= (async () => {
-      for (const statement of postgresTodosSyncSchemaSql(this.tableName, this.cursorTableName)) {
-        await this.client.query(statement);
-      }
-      for (const statement of postgresTodosProjectRegistrationSchemaSql()) {
-        await this.client.query(statement);
+    if (this.schemaReady === null) {
+      const attempt = (async () => {
+        for (const statement of postgresTodosSyncSchemaSql(this.tableName, this.cursorTableName)) {
+          await this.client.query(statement);
+        }
+        for (const statement of postgresTodosProjectRegistrationSchemaSql()) {
+          await this.client.query(statement);
+        }
+      })();
+      this.schemaReady = attempt;
+      try {
+        await attempt;
+      } catch (error) {
+        this.schemaReady = null;
+        throw error;
       }
-    })();
+    }
     await this.schemaReady;
   }
   async transaction(fn) {
@@ -13167,8 +13284,9 @@ var init_event_hooks = __esm(() => {
   VALID_TARGETS = new Set(["stdout", "file", "socket", "script"]);
 });
 
-// node_modules/.bun/@hasna+events@0.1.11/node_modules/@hasna/events/dist/index.js
+// node_modules/.bun/@hasna+events@0.1.16/node_modules/@hasna/events/dist/index.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { Buffer as Buffer2 } from "buffer";
 import { existsSync as existsSync6 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join5 } from "path";
@@ -13277,11 +13395,13 @@ function getEventsDataDir(override) {
 
 class JsonEventsStore {
   dataDir;
+  runtime;
   channelsPath;
   eventsPath;
   deliveriesPath;
   constructor(dataDir = getEventsDataDir()) {
     this.dataDir = dataDir;
+    this.runtime = localJsonRuntime(dataDir);
     this.channelsPath = join5(dataDir, "channels.json");
     this.eventsPath = join5(dataDir, "events.json");
     this.deliveriesPath = join5(dataDir, "deliveries.json");
@@ -13329,13 +13449,58 @@ class JsonEventsStore {
     await this.writeJson(this.eventsPath, events);
     return event;
   }
-  async listEvents() {
+  async appendEventOnce(event, options = {}) {
+    await this.init();
+    const events = await this.readJson(this.eventsPath, []);
+    const dedupe = options.dedupe !== false;
+    if (dedupe) {
+      const existing = findEventByIdentity(events, { id: event.id, dedupeKey: event.dedupeKey });
+      if (existing) {
+        return {
+          event: existing,
+          stored: false,
+          deduped: true,
+          identity: { id: existing.id, dedupeKey: existing.dedupeKey }
+        };
+      }
+    }
+    events.push(event);
+    await this.writeJson(this.eventsPath, events);
+    return {
+      event,
+      stored: true,
+      deduped: false,
+      identity: { id: event.id, dedupeKey: event.dedupeKey }
+    };
+  }
+  async listEvents(options = {}) {
     await this.init();
-    return this.readJson(this.eventsPath, []);
+    const events = await this.readJson(this.eventsPath, []);
+    return queryEvents(events, options);
+  }
+  async listEventsPage(options = {}) {
+    await this.init();
+    const events = await this.readJson(this.eventsPath, []);
+    const queried = queryEvents(events, {
+      eventId: options.eventId,
+      source: options.source,
+      type: options.type
+    });
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    const limit = normalizeEventPageLimit(options.limit);
+    const pageEvents = queried.slice(offset, offset + limit);
+    const nextOffset = offset + pageEvents.length;
+    const hasMore = nextOffset < queried.length;
+    return {
+      events: pageEvents,
+      cursor: options.cursor,
+      nextCursor: hasMore ? encodeLocalJsonEventCursor(nextOffset, options) : undefined,
+      hasMore
+    };
   }
   async findEventByIdentity(identity) {
     const events = await this.listEvents();
-    return events.find((event) => identity.id !== undefined && event.id === identity.id || identity.dedupeKey !== undefined && event.dedupeKey === identity.dedupeKey);
+    return findEventByIdentity(events, identity);
   }
   async appendDelivery(result) {
     await this.init();
@@ -13386,6 +13551,83 @@ class JsonEventsStore {
     });
   }
 }
+function localJsonRuntime(dataDir = getEventsDataDir()) {
+  return {
+    mode: "local-files",
+    name: "json-events-store",
+    remote: false,
+    localFiles: true,
+    localSqlite: false,
+    postgres: false,
+    s3: false,
+    aws: false,
+    durable: true,
+    idempotency: "best-effort-local",
+    replayCursors: true,
+    description: `Local JSON files in ${dataDir}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
+  };
+}
+function encodeLocalJsonEventCursor(offset, options = {}) {
+  if (!Number.isInteger(offset) || offset < 0)
+    throw new Error(`Invalid event cursor offset: ${offset}`);
+  const payload = {
+    offset,
+    eventId: options.eventId,
+    source: options.source,
+    type: options.type
+  };
+  return `${LOCAL_JSON_EVENT_CURSOR_PREFIX}${Buffer2.from(JSON.stringify(payload), "utf-8").toString("base64url")}`;
+}
+function decodeLocalJsonEventCursor(cursor, options = {}) {
+  if (!cursor)
+    return 0;
+  if (!cursor.startsWith(LOCAL_JSON_EVENT_CURSOR_PREFIX))
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  const rawPayload = cursor.slice(LOCAL_JSON_EVENT_CURSOR_PREFIX.length);
+  let payload;
+  try {
+    payload = JSON.parse(Buffer2.from(rawPayload, "base64url").toString("utf-8"));
+  } catch {
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  }
+  const offset = payload.offset;
+  if (!Number.isInteger(offset) || offset < 0)
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  assertCursorFilter("eventId", payload.eventId, options.eventId);
+  assertCursorFilter("source", payload.source, options.source);
+  assertCursorFilter("type", payload.type, options.type);
+  return offset;
+}
+function normalizeEventPageLimit(limit) {
+  if (limit === undefined)
+    return DEFAULT_EVENT_PAGE_LIMIT;
+  if (!Number.isInteger(limit) || limit < 1)
+    throw new Error(`Event page limit must be a positive integer, got ${limit}`);
+  return Math.min(limit, MAX_EVENT_PAGE_LIMIT);
+}
+function queryEvents(events, options) {
+  let rows = events;
+  if (options.eventId)
+    rows = rows.filter((event) => event.id === options.eventId);
+  if (options.source)
+    rows = rows.filter((event) => event.source === options.source);
+  if (options.type)
+    rows = rows.filter((event) => event.type === options.type);
+  if (options.cursor) {
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    rows = rows.slice(offset);
+  }
+  if (options.limit !== undefined)
+    rows = rows.slice(0, normalizeEventPageLimit(options.limit));
+  return rows;
+}
+function assertCursorFilter(name, cursorValue, optionValue) {
+  if (cursorValue !== optionValue)
+    throw new Error(`Local JSON event cursor ${name} filter mismatch`);
+}
+function findEventByIdentity(events, identity) {
+  return events.find((event) => identity.id !== undefined && event.id === identity.id || identity.dedupeKey !== undefined && event.dedupeKey === identity.dedupeKey);
+}
 function buildSignatureBase(timestamp2, body) {
   return `${timestamp2}.${body}`;
 }
@@ -13399,21 +13641,27 @@ function now2() {
 function truncate(value, max = 4096) {
   return value.length > max ? `${value.slice(0, max)}...` : value;
 }
-function buildWebhookRequest(event, channel) {
+function buildWebhookRequest(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
+  for (const name of Object.keys(channel.webhook.headers ?? {})) {
+    if (/^x-hasna-/i.test(name)) {
+      throw new Error(`Webhook header ${name} is reserved for signed delivery metadata`);
+    }
+  }
   const body = JSON.stringify(event);
-  const timestamp2 = event.time;
+  const timestamp2 = options.timestamp ?? new Date().toISOString();
   const headers = {
     "Content-Type": "application/json",
     "User-Agent": "@hasna/events",
     "X-Hasna-Event-Id": event.id,
     "X-Hasna-Event-Type": event.type,
-    "X-Hasna-Timestamp": timestamp2,
-    ...channel.webhook.headers
+    ...channel.webhook.headers,
+    "X-Hasna-Timestamp": timestamp2
   };
-  if (channel.webhook.secret) {
-    headers["X-Hasna-Signature"] = signPayload(channel.webhook.secret, timestamp2, body);
+  const secret = options.secret ?? channel.webhook.secret;
+  if (secret) {
+    headers["X-Hasna-Signature"] = signPayload(secret, timestamp2, body);
   }
   return { body, headers };
 }
@@ -13421,7 +13669,21 @@ async function dispatchWebhook(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
   const startedAt = now2();
-  const { body, headers } = buildWebhookRequest(event, channel);
+  let secret = channel.webhook.secret;
+  if (channel.webhook.secretRef) {
+    if (!options.secretResolver) {
+      return failedAttempt(startedAt, "Webhook secret reference has no runtime resolver");
+    }
+    try {
+      secret = await options.secretResolver(channel.webhook.secretRef);
+    } catch {
+      return failedAttempt(startedAt, "Webhook secret reference could not be resolved");
+    }
+    if (!secret)
+      return failedAttempt(startedAt, "Webhook secret reference could not be resolved");
+  }
+  const timestamp2 = (options.now?.() ?? new Date).toISOString();
+  const { body, headers } = buildWebhookRequest(event, channel, { secret, timestamp: timestamp2 });
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
   try {
@@ -13453,6 +13715,15 @@ async function dispatchWebhook(event, channel, options = {}) {
     clearTimeout(timeout);
   }
 }
+function failedAttempt(startedAt, error) {
+  return {
+    attempt: 1,
+    status: "failed",
+    startedAt,
+    completedAt: now2(),
+    error
+  };
+}
 async function dispatchCommand(event, channel) {
   if (!channel.command)
     throw new Error(`Channel ${channel.id} has no command config`);
@@ -13541,6 +13812,76 @@ function createDeliveryResult(event, channel, attempts) {
     completedAt: attempts.at(-1)?.completedAt ?? now2()
   };
 }
+
+class EventTypeCatalog {
+  definitions = new Map;
+  register(definition) {
+    this.definitions.set(definition.type, definition);
+    return this;
+  }
+  unregister(type) {
+    return this.definitions.delete(type);
+  }
+  has(type) {
+    return this.definitions.has(type);
+  }
+  get(type) {
+    return this.definitions.get(type);
+  }
+  list() {
+    return [...this.definitions.values()];
+  }
+  validateEvent(event) {
+    const definition = this.definitions.get(event.type);
+    if (!definition)
+      return { ok: true };
+    return definition.validate(event.data, event);
+  }
+  assertEventValid(event) {
+    const result = this.validateEvent(event);
+    if (!result.ok) {
+      throw new EventValidationError(event.type, result.issues);
+    }
+  }
+}
+function redactPaths(event, paths, replacement = "[REDACTED]") {
+  if (paths.length === 0)
+    return event;
+  const copy = structuredClone(event);
+  for (const path of paths) {
+    setPath(copy, path, replacement);
+  }
+  return copy;
+}
+function redactSensitiveKeys(event, replacement = "[REDACTED]") {
+  return redactValue2(event, replacement);
+}
+function shouldRedactKey(key) {
+  return /secret|token|password|api[_-]?key|authorization/i.test(key);
+}
+function redactValue2(value, replacement) {
+  if (Array.isArray(value))
+    return value.map((item) => redactValue2(item, replacement));
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    shouldRedactKey(key) ? replacement : redactValue2(item, replacement)
+  ]));
+}
+function setPath(input, path, replacement) {
+  const parts = path.split(".");
+  let cursor = input;
+  for (const part of parts.slice(0, -1)) {
+    const next = cursor[part];
+    if (!next || typeof next !== "object")
+      return;
+    cursor = next;
+  }
+  const last = parts.at(-1);
+  if (last && last in cursor)
+    cursor[last] = replacement;
+}
 function createEvent(input) {
   return {
     id: input.id ?? randomUUID22(),
@@ -13561,10 +13902,18 @@ class EventsClient {
   store;
   redactors;
   transportOptions;
+  catalog;
+  validateCatalogTypes;
   constructor(options = {}) {
     this.store = options.store ?? new JsonEventsStore(options.dataDir);
     this.redactors = options.redactors ?? [];
-    this.transportOptions = { fetchImpl: options.fetchImpl };
+    this.transportOptions = {
+      fetchImpl: options.fetchImpl,
+      secretResolver: options.secretResolver,
+      now: options.now
+    };
+    this.catalog = options.catalog ?? defaultEventTypeCatalog;
+    this.validateCatalogTypes = options.validateCatalogTypes ?? false;
   }
   async addChannel(input) {
     const timestamp2 = new Date().toISOString();
@@ -13582,18 +13931,40 @@ class EventsClient {
   }
   async emit(input, options = {}) {
     const event = options.redactSensitiveData === false ? createEvent(input) : redactSensitiveKeys(createEvent(input));
-    if (options.dedupe !== false) {
-      const existing = await this.store.findEventByIdentity({ id: input.id, dedupeKey: event.dedupeKey });
-      if (existing) {
-        return { event: existing, deliveries: [], deduped: true };
-      }
-    }
-    await this.store.appendEvent(event);
-    const deliveries = options.deliver === false ? [] : await this.deliver(event);
-    return { event, deliveries, deduped: false };
-  }
-  async listEvents() {
-    return this.store.listEvents();
+    if (options.validate ?? this.validateCatalogTypes) {
+      this.catalog.assertEventValid(event);
+    }
+    const append = await this.appendEvent(event, { dedupe: options.dedupe !== false });
+    if (append.deduped) {
+      return { event: append.event, deliveries: [], deduped: true };
+    }
+    const deliveries = options.deliver === false ? [] : await this.deliver(append.event);
+    return { event: append.event, deliveries, deduped: false };
+  }
+  async listEvents(options = {}) {
+    if (Object.keys(options).length === 0)
+      return this.store.listEvents();
+    return queryClientEvents(await this.store.listEvents(), options);
+  }
+  async listEventsPage(options = {}) {
+    if (this.store.listEventsPage)
+      return this.store.listEventsPage(options);
+    const events = queryClientEvents(await this.store.listEvents(), {
+      eventId: options.eventId,
+      source: options.source,
+      type: options.type
+    });
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    const limit = normalizeEventPageLimit(options.limit);
+    const pageEvents = events.slice(offset, offset + limit);
+    const nextOffset = offset + pageEvents.length;
+    const hasMore = nextOffset < events.length;
+    return {
+      events: pageEvents,
+      cursor: options.cursor,
+      nextCursor: hasMore ? encodeLocalJsonEventCursor(nextOffset, options) : undefined,
+      hasMore
+    };
   }
   async listDeliveries() {
     return this.store.listDeliveries();
@@ -13661,22 +14032,37 @@ class EventsClient {
     return result;
   }
   async replay(options = {}) {
-    const events = (await this.store.listEvents()).filter((event) => {
-      if (options.eventId && event.id !== options.eventId)
-        return false;
-      if (options.source && event.source !== options.source)
-        return false;
-      if (options.type && event.type !== options.type)
-        return false;
-      return true;
-    });
+    const page = options.cursor || options.limit !== undefined ? await this.listEventsPage(options) : { events: await this.listEvents(options), hasMore: false };
     if (options.dryRun)
-      return { events, deliveries: [] };
+      return { events: page.events, deliveries: [], cursor: page.cursor, nextCursor: page.nextCursor, hasMore: page.hasMore };
     const deliveries = [];
-    for (const event of events) {
+    for (const event of page.events) {
       deliveries.push(...await this.deliver(event));
     }
-    return { events, deliveries };
+    return { events: page.events, deliveries, cursor: page.cursor, nextCursor: page.nextCursor, hasMore: page.hasMore };
+  }
+  async appendEvent(event, options) {
+    if (this.store.appendEventOnce) {
+      return this.store.appendEventOnce(event, { dedupe: options.dedupe });
+    }
+    if (options.dedupe) {
+      const existing = await this.store.findEventByIdentity({ id: event.id, dedupeKey: event.dedupeKey });
+      if (existing) {
+        return {
+          event: existing,
+          stored: false,
+          deduped: true,
+          identity: { id: existing.id, dedupeKey: existing.dedupeKey }
+        };
+      }
+    }
+    const stored = await this.store.appendEvent(event);
+    return {
+      event: stored,
+      stored: true,
+      deduped: false,
+      identity: { id: stored.id, dedupeKey: stored.dedupeKey }
+    };
   }
   async applyRedaction(event, channel) {
     let next = redactPaths(event, channel.redact?.paths ?? [], channel.redact?.replacement ?? "[REDACTED]");
@@ -13703,43 +14089,19 @@ class EventsClient {
     return createDeliveryResult(event, channel, attempts);
   }
 }
-function redactPaths(event, paths, replacement = "[REDACTED]") {
-  if (paths.length === 0)
-    return event;
-  const copy = structuredClone(event);
-  for (const path of paths) {
-    setPath(copy, path, replacement);
-  }
-  return copy;
-}
-function redactSensitiveKeys(event, replacement = "[REDACTED]") {
-  return redactValue2(event, replacement);
-}
-function shouldRedactKey(key) {
-  return /secret|token|password|api[_-]?key|authorization/i.test(key);
-}
-function redactValue2(value, replacement) {
-  if (Array.isArray(value))
-    return value.map((item) => redactValue2(item, replacement));
-  if (!value || typeof value !== "object")
-    return value;
-  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
-    key,
-    shouldRedactKey(key) ? replacement : redactValue2(item, replacement)
-  ]));
-}
-function setPath(input, path, replacement) {
-  const parts = path.split(".");
-  let cursor = input;
-  for (const part of parts.slice(0, -1)) {
-    const next = cursor[part];
-    if (!next || typeof next !== "object")
-      return;
-    cursor = next;
-  }
-  const last = parts.at(-1);
-  if (last && last in cursor)
-    cursor[last] = replacement;
+function queryClientEvents(events, options) {
+  let rows = events;
+  if (options.eventId)
+    rows = rows.filter((event) => event.id === options.eventId);
+  if (options.source)
+    rows = rows.filter((event) => event.source === options.source);
+  if (options.type)
+    rows = rows.filter((event) => event.type === options.type);
+  if (options.cursor)
+    rows = rows.slice(decodeLocalJsonEventCursor(options.cursor, options));
+  if (options.limit !== undefined)
+    rows = rows.slice(0, normalizeEventPageLimit(options.limit));
+  return rows;
 }
 function normalizeTime(value) {
   if (!value)
@@ -13753,9 +14115,22 @@ function normalizeRetryPolicy(policy) {
     multiplier: Math.max(1, policy?.multiplier ?? 2)
   };
 }
-var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", DEFAULT_SIGNATURE_TOLERANCE_MS;
+var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:", DEFAULT_EVENT_PAGE_LIMIT = 100, MAX_EVENT_PAGE_LIMIT = 1000, DEFAULT_SIGNATURE_TOLERANCE_MS, EventValidationError, defaultEventTypeCatalog, APP_EVENT_V1_MAX_DATA_BYTES;
 var init_dist = __esm(() => {
   DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
+  EventValidationError = class EventValidationError extends Error {
+    eventType;
+    issues;
+    constructor(eventType, issues) {
+      const detail = issues.map((issue) => `${issue.path || "<root>"}: ${issue.message}`).join("; ");
+      super(`Event validation failed for type "${eventType}": ${detail}`);
+      this.name = "EventValidationError";
+      this.eventType = eventType;
+      this.issues = issues;
+    }
+  };
+  defaultEventTypeCatalog = new EventTypeCatalog;
+  APP_EVENT_V1_MAX_DATA_BYTES = 32 * 1024;
 });
 
 // src/db/task-lists.ts
@@ -14594,8 +14969,12 @@ async function deliverWebhook(wh, event, body, attempt, db) {
       const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(body));
       headers["X-Webhook-Signature"] = Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
     }
-    const resp = await fetch(wh.url, { method: "POST", headers, body });
+    const resp = await fetch(wh.url, { method: "POST", headers, body, redirect: "manual" });
     const respText = await resp.text().catch(() => "");
+    if (resp.status >= 300 && resp.status < 400) {
+      logDelivery(db, wh.id, event, body, resp.status, "Blocked: webhook URL returned a 3xx redirect; redirects are never followed (SSRF prevention)", attempt);
+      return;
+    }
     logDelivery(db, wh.id, event, body, resp.status, respText.slice(0, 1000), attempt);
     if (resp.status >= 400 && attempt < MAX_RETRY_ATTEMPTS) {
       const delay = RETRY_BASE_DELAY_MS * Math.pow(2, attempt - 1);
@@ -15288,7 +15667,7 @@ function getTaskGraph(taskId, direction = "both", db) {
     const deps = getTaskDependencies(t.id, d);
     const hasUnfinishedDeps = deps.some((dep) => {
       const depTask = getTask(dep.depends_on, d);
-      return depTask && depTask.status !== "completed";
+      return depTask && isBlockingDependencyStatus(depTask.status);
     });
     return { id: t.id, short_id: t.short_id, title: t.title, status: t.status, priority: t.priority, is_blocked: hasUnfinishedDeps };
   }
@@ -15412,7 +15791,7 @@ function getBlockingDeps(id, db) {
   const blocking = [];
   for (const dep of deps) {
     const task = getTask(dep.depends_on, d);
-    if (task && task.status !== "completed")
+    if (task && isBlockingDependencyStatus(task.status))
       blocking.push(task);
   }
   return blocking;
@@ -15736,7 +16115,7 @@ function getNextTask2(agentId, filters, db) {
     conditions.push(`id IN (SELECT task_id FROM task_tags WHERE tag IN (${placeholders}))`);
     params.push(...filters.tags);
   }
-  conditions.push("id NOT IN (SELECT td.task_id FROM task_dependencies td JOIN tasks dep ON dep.id = td.depends_on WHERE dep.status != 'completed')");
+  conditions.push("id NOT IN (SELECT td.task_id FROM task_dependencies td JOIN tasks dep ON dep.id = td.depends_on WHERE dep.status NOT IN ('completed', 'cancelled'))");
   const where = conditions.join(" AND ");
   let recentProjectIds = [];
   const assignedAliasParams = [];
@@ -15780,7 +16159,7 @@ function getActiveWork2(filters, db) {
 }
 function getTasksChangedSince(since, filters, db) {
   const d = db || getDatabase();
-  const conditions = ["updated_at > ?"];
+  const conditions = ["(julianday(updated_at) IS NULL OR julianday(updated_at) > julianday(?))"];
   const params = [since];
   if (filters?.project_id) {
     conditions.push("project_id = ?");
@@ -21078,7 +21457,7 @@ function matchesExtraFilters(task, filter) {
   }
   if (filter.tags?.length) {
     const taskTags = new Set(task.tags ?? []);
-    if (!filter.tags.every((tag) => taskTags.has(tag)))
+    if (!filter.tags.some((tag) => taskTags.has(tag)))
       return false;
   }
   if (filter.include_subtasks !== true && filter.parent_id === undefined && task.parent_id)
@@ -27812,12 +28191,21 @@ class PostgresTodosTaskManifestBackend {
     this.tenantId = options.tenantId ?? "default";
   }
   async ensureSchema() {
-    this.schemaReady ??= (async () => {
-      for (const sql of postgresTodosSyncSchemaSql(this.tableName))
-        await this.client.query(sql);
-      for (const sql of postgresTodosTaskManifestSchemaSql(this.tenantId))
-        await this.client.query(sql);
-    })();
+    if (this.schemaReady === null) {
+      const attempt = (async () => {
+        for (const sql of postgresTodosSyncSchemaSql(this.tableName))
+          await this.client.query(sql);
+        for (const sql of postgresTodosTaskManifestSchemaSql(this.tenantId))
+          await this.client.query(sql);
+      })();
+      this.schemaReady = attempt;
+      try {
+        await attempt;
+      } catch (error) {
+        this.schemaReady = null;
+        throw error;
+      }
+    }
     await this.schemaReady;
   }
   async insertSync(tx, objectType2, objectId, payload, now3) {
@@ -29117,12 +29505,21 @@ class PostgresTodosTaskSubtreeTransferBackend {
     this.tenantId = options.tenantId ?? "default";
   }
   async ensureSchema() {
-    this.schemaReady ??= (async () => {
-      for (const sql of postgresTodosSyncSchemaSql(this.tableName))
-        await this.client.query(sql);
-      for (const sql of postgresTodosTaskSubtreeTransferSchemaSql())
-        await this.client.query(sql);
-    })();
+    if (this.schemaReady === null) {
+      const attempt = (async () => {
+        for (const sql of postgresTodosSyncSchemaSql(this.tableName))
+          await this.client.query(sql);
+        for (const sql of postgresTodosTaskSubtreeTransferSchemaSql())
+          await this.client.query(sql);
+      })();
+      this.schemaReady = attempt;
+      try {
+        await attempt;
+      } catch (error) {
+        this.schemaReady = null;
+        throw error;
+      }
+    }
     await this.schemaReady;
   }
   async snapshot(client, input, forUpdate = false) {
@@ -30221,7 +30618,10 @@ async function ensureCloudSchema() {
       await client.query(sql);
     }
     await getApiKeyStore().ensureSchema();
-  })();
+  })().catch((error) => {
+    schemaEnsured = null;
+    throw error;
+  });
   return schemaEnsured;
 }
 async function ensureCloudCommentCursorIndex() {
@@ -38081,6 +38481,152 @@ var init_v1 = __esm(() => {
   RFC3339_DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})[Tt]\d{2}:\d{2}:\d{2}(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/;
 });
 
+// node_modules/.bun/content-type@1.0.5/node_modules/content-type/index.js
+var require_content_type = __commonJS((exports) => {
+  /*!
+   * content-type
+   * Copyright(c) 2015 Douglas Christopher Wilson
+   * MIT Licensed
+   */
+  var PARAM_REGEXP = /; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g;
+  var TEXT_REGEXP = /^[\u000b\u0020-\u007e\u0080-\u00ff]+$/;
+  var TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+  var QESC_REGEXP = /\\([\u000b\u0020-\u00ff])/g;
+  var QUOTE_REGEXP = /([\\"])/g;
+  var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+  exports.format = format;
+  exports.parse = parse;
+  function format(obj) {
+    if (!obj || typeof obj !== "object") {
+      throw new TypeError("argument obj is required");
+    }
+    var parameters = obj.parameters;
+    var type = obj.type;
+    if (!type || !TYPE_REGEXP.test(type)) {
+      throw new TypeError("invalid type");
+    }
+    var string = type;
+    if (parameters && typeof parameters === "object") {
+      var param;
+      var params = Object.keys(parameters).sort();
+      for (var i = 0;i < params.length; i++) {
+        param = params[i];
+        if (!TOKEN_REGEXP.test(param)) {
+          throw new TypeError("invalid parameter name");
+        }
+        string += "; " + param + "=" + qstring(parameters[param]);
+      }
+    }
+    return string;
+  }
+  function parse(string) {
+    if (!string) {
+      throw new TypeError("argument string is required");
+    }
+    var header = typeof string === "object" ? getcontenttype(string) : string;
+    if (typeof header !== "string") {
+      throw new TypeError("argument string is required to be a string");
+    }
+    var index = header.indexOf(";");
+    var type = index !== -1 ? header.slice(0, index).trim() : header.trim();
+    if (!TYPE_REGEXP.test(type)) {
+      throw new TypeError("invalid media type");
+    }
+    var obj = new ContentType(type.toLowerCase());
+    if (index !== -1) {
+      var key2;
+      var match;
+      var value;
+      PARAM_REGEXP.lastIndex = index;
+      while (match = PARAM_REGEXP.exec(header)) {
+        if (match.index !== index) {
+          throw new TypeError("invalid parameter format");
+        }
+        index += match[0].length;
+        key2 = match[1].toLowerCase();
+        value = match[2];
+        if (value.charCodeAt(0) === 34) {
+          value = value.slice(1, -1);
+          if (value.indexOf("\\") !== -1) {
+            value = value.replace(QESC_REGEXP, "$1");
+          }
+        }
+        obj.parameters[key2] = value;
+      }
+      if (index !== header.length) {
+        throw new TypeError("invalid parameter format");
+      }
+    }
+    return obj;
+  }
+  function getcontenttype(obj) {
+    var header;
+    if (typeof obj.getHeader === "function") {
+      header = obj.getHeader("content-type");
+    } else if (typeof obj.headers === "object") {
+      header = obj.headers && obj.headers["content-type"];
+    }
+    if (typeof header !== "string") {
+      throw new TypeError("content-type header is missing from object");
+    }
+    return header;
+  }
+  function qstring(val) {
+    var str = String(val);
+    if (TOKEN_REGEXP.test(str)) {
+      return str;
+    }
+    if (str.length > 0 && !TEXT_REGEXP.test(str)) {
+      throw new TypeError("invalid parameter value");
+    }
+    return '"' + str.replace(QUOTE_REGEXP, "\\$1") + '"';
+  }
+  function ContentType(type) {
+    this.parameters = Object.create(null);
+    this.type = type;
+  }
+});
+
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
+function mediaTypeEssence(header) {
+  if (!header) {
+    return;
+  }
+  try {
+    return import_content_type.default.parse(header).type;
+  } catch {
+    const essence = (header.split(";", 1)[0] ?? "").trim().toLowerCase();
+    if (essence === "" || header.slice(essence.length).includes(",")) {
+      return;
+    }
+    return essence;
+  }
+}
+function isJsonContentType(header) {
+  if (header === "application/json") {
+    return true;
+  }
+  return mediaTypeEssence(header) === "application/json";
+}
+var import_content_type;
+var init_mediaType = __esm(() => {
+  import_content_type = __toESM(require_content_type(), 1);
+});
+
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/sseKeepAlive.js
+function armSseKeepAlive(intervalMs, onTick) {
+  if (!Number.isFinite(intervalMs) || intervalMs < 1) {
+    return;
+  }
+  const timer = setInterval(onTick, Math.min(intervalMs, MAX_TIMER_DELAY_MS));
+  timer.unref?.();
+  return timer;
+}
+var DEFAULT_SSE_KEEP_ALIVE_MS = 15000, MAX_TIMER_DELAY_MS;
+var init_sseKeepAlive = __esm(() => {
+  MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
+});
+
 // node_modules/.bun/zod@3.25.76/node_modules/zod/v4/core/core.js
 function $constructor(name, initializer, params) {
   function init(inst, def) {
@@ -42667,7 +43213,7 @@ var init_v4 = __esm(() => {
   init_classic();
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
 function assertCompleteRequestPrompt(request) {
   if (request.params.ref.type !== "ref/prompt") {
     throw new TypeError(`Expected CompleteRequestPrompt, but got ${request.params.ref.type}`);
@@ -42686,7 +43232,7 @@ var init_types7 = __esm(() => {
   ProgressTokenSchema = union([string2(), number2().int()]);
   CursorSchema = string2();
   TaskCreationParamsSchema = looseObject({
-    ttl: union([number2(), _null3()]).optional(),
+    ttl: number2().optional(),
     pollInterval: number2().optional()
   });
   TaskMetadataSchema = object({
@@ -42834,7 +43380,8 @@ var init_types7 = __esm(() => {
     roots: object({
       listChanged: boolean2().optional()
     }).optional(),
-    tasks: ClientTasksCapabilitySchema.optional()
+    tasks: ClientTasksCapabilitySchema.optional(),
+    extensions: record(string2(), AssertObjectSchema).optional()
   });
   InitializeRequestParamsSchema = BaseRequestParamsSchema.extend({
     protocolVersion: string2(),
@@ -42859,7 +43406,8 @@ var init_types7 = __esm(() => {
     tools: object({
       listChanged: boolean2().optional()
     }).optional(),
-    tasks: ServerTasksCapabilitySchema.optional()
+    tasks: ServerTasksCapabilitySchema.optional(),
+    extensions: record(string2(), AssertObjectSchema).optional()
   });
   InitializeResultSchema = ResultSchema.extend({
     protocolVersion: string2(),
@@ -42974,6 +43522,7 @@ var init_types7 = __esm(() => {
     uri: string2(),
     description: optional(string2()),
     mimeType: optional(string2()),
+    size: optional(number2()),
     annotations: AnnotationsSchema.optional(),
     _meta: optional(looseObject({}))
   });
@@ -43502,17 +44051,19 @@ var init_types7 = __esm(() => {
   };
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/webStandardStreamableHttp.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/webStandardStreamableHttp.js
 class WebStandardStreamableHTTPServerTransport {
   constructor(options = {}) {
     this._started = false;
     this._hasHandledRequest = false;
     this._streamMapping = new Map;
     this._requestToStreamMapping = new Map;
+    this._resumableStreams = new Set;
     this._requestResponseMap = new Map;
     this._initialized = false;
     this._enableJsonResponse = false;
     this._standaloneSseStreamId = "_GET_stream";
+    this._closed = false;
     this.sessionIdGenerator = options.sessionIdGenerator;
     this._enableJsonResponse = options.enableJsonResponse ?? false;
     this._eventStore = options.eventStore;
@@ -43522,6 +44073,22 @@ class WebStandardStreamableHTTPServerTransport {
     this._allowedOrigins = options.allowedOrigins;
     this._enableDnsRebindingProtection = options.enableDnsRebindingProtection ?? false;
     this._retryInterval = options.retryInterval;
+    this._keepAliveMs = options.keepAliveMs ?? DEFAULT_SSE_KEEP_ALIVE_MS;
+  }
+  startKeepAlive(controller, encoder) {
+    if (this._closed)
+      return;
+    const timer = armSseKeepAlive(this._keepAliveMs, () => {
+      try {
+        controller.enqueue(encoder.encode(`: keepalive
+
+`));
+      } catch {
+        if (timer !== undefined)
+          clearInterval(timer);
+      }
+    });
+    return timer;
   }
   async start() {
     if (this._started) {
@@ -43569,6 +44136,9 @@ class WebStandardStreamableHTTPServerTransport {
     return;
   }
   async handleRequest(req, options) {
+    if (this._closed) {
+      return this.createJsonErrorResponse(404, -32001, "Session not found");
+    }
     if (!this.sessionIdGenerator && this._hasHandledRequest) {
       throw new Error("Stateless transport cannot be reused across requests. Create a new transport per request.");
     }
@@ -43608,10 +44178,12 @@ data:
 `;
     }
     controller.enqueue(encoder.encode(primingEvent));
+    this._resumableStreams.add(streamId);
   }
   async handleGetRequest(req) {
     const acceptHeader = req.headers.get("accept");
     if (!acceptHeader?.includes("text/event-stream")) {
+      this.onerror?.(new Error("Not Acceptable: Client must accept text/event-stream"));
       return this.createJsonErrorResponse(406, -32000, "Not Acceptable: Client must accept text/event-stream");
     }
     const sessionError = this.validateSession(req);
@@ -43629,22 +44201,30 @@ data:
       }
     }
     if (this._streamMapping.get(this._standaloneSseStreamId) !== undefined) {
+      this.onerror?.(new Error("Conflict: Only one SSE stream is allowed per session"));
       return this.createJsonErrorResponse(409, -32000, "Conflict: Only one SSE stream is allowed per session");
     }
     const encoder = new TextEncoder;
     let streamController;
+    let keepAliveTimer = undefined;
     const readable = new ReadableStream({
       start: (controller) => {
         streamController = controller;
       },
       cancel: () => {
-        this._streamMapping.delete(this._standaloneSseStreamId);
+        if (keepAliveTimer !== undefined) {
+          clearInterval(keepAliveTimer);
+        }
+        if (this._streamMapping.get(this._standaloneSseStreamId)?.controller === streamController) {
+          this._streamMapping.delete(this._standaloneSseStreamId);
+        }
       }
     });
     const headers = {
       "Content-Type": "text/event-stream",
       "Cache-Control": "no-cache, no-transform",
-      Connection: "keep-alive"
+      Connection: "keep-alive",
+      "X-Accel-Buffering": "no"
     };
     if (this.sessionId !== undefined) {
       headers["mcp-session-id"] = this.sessionId;
@@ -43653,16 +44233,21 @@ data:
       controller: streamController,
       encoder,
       cleanup: () => {
+        if (keepAliveTimer !== undefined) {
+          clearInterval(keepAliveTimer);
+        }
         this._streamMapping.delete(this._standaloneSseStreamId);
         try {
           streamController.close();
         } catch {}
       }
     });
+    keepAliveTimer = this.startKeepAlive(streamController, encoder);
     return new Response(readable, { headers });
   }
   async replayEvents(lastEventId) {
     if (!this._eventStore) {
+      this.onerror?.(new Error("Event store not configured"));
       return this.createJsonErrorResponse(400, -32000, "Event store not configured");
     }
     try {
@@ -43670,29 +44255,44 @@ data:
       if (this._eventStore.getStreamIdForEventId) {
         streamId = await this._eventStore.getStreamIdForEventId(lastEventId);
         if (!streamId) {
+          this.onerror?.(new Error("Invalid event ID format"));
           return this.createJsonErrorResponse(400, -32000, "Invalid event ID format");
         }
         if (this._streamMapping.get(streamId) !== undefined) {
+          this.onerror?.(new Error("Conflict: Stream already has an active connection"));
           return this.createJsonErrorResponse(409, -32000, "Conflict: Stream already has an active connection");
         }
       }
       const headers = {
         "Content-Type": "text/event-stream",
         "Cache-Control": "no-cache, no-transform",
-        Connection: "keep-alive"
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no"
       };
       if (this.sessionId !== undefined) {
         headers["mcp-session-id"] = this.sessionId;
       }
       const encoder = new TextEncoder;
       let streamController;
+      let keepAliveTimer = undefined;
+      let replayedStreamId = undefined;
+      let cancelled = false;
       const readable = new ReadableStream({
         start: (controller) => {
           streamController = controller;
         },
-        cancel: () => {}
+        cancel: () => {
+          cancelled = true;
+          if (keepAliveTimer !== undefined) {
+            clearInterval(keepAliveTimer);
+          }
+          if (replayedStreamId !== undefined && this._streamMapping.get(replayedStreamId)?.controller === streamController) {
+            this._streamMapping.delete(replayedStreamId);
+          }
+        }
       });
-      const replayedStreamId = await this._eventStore.replayEventsAfter(lastEventId, {
+      const replayedEventIds = new Set;
+      replayedStreamId = await this._eventStore.replayEventsAfter(lastEventId, {
         send: async (eventId, message) => {
           const success = this.writeSSEEvent(streamController, encoder, message, eventId);
           if (!success) {
@@ -43700,19 +44300,34 @@ data:
             try {
               streamController.close();
             } catch {}
+          } else {
+            replayedEventIds.add(eventId);
           }
         }
       });
+      if (this._closed || cancelled) {
+        try {
+          streamController.close();
+        } catch {}
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
+      this._streamMapping.get(replayedStreamId)?.cleanup();
       this._streamMapping.set(replayedStreamId, {
         controller: streamController,
         encoder,
+        replayedEventIds,
         cleanup: () => {
+          if (keepAliveTimer !== undefined) {
+            clearInterval(keepAliveTimer);
+          }
           this._streamMapping.delete(replayedStreamId);
           try {
             streamController.close();
           } catch {}
         }
       });
+      this._resumableStreams.add(replayedStreamId);
+      keepAliveTimer = this.startKeepAlive(streamController, encoder);
       return new Response(readable, { headers });
     } catch (error3) {
       this.onerror?.(error3);
@@ -43732,11 +44347,13 @@ data:
 `;
       controller.enqueue(encoder.encode(eventData));
       return true;
-    } catch {
+    } catch (error3) {
+      this.onerror?.(error3);
       return false;
     }
   }
   handleUnsupportedRequest() {
+    this.onerror?.(new Error("Method not allowed."));
     return new Response(JSON.stringify({
       jsonrpc: "2.0",
       error: {
@@ -43756,14 +44373,17 @@ data:
     try {
       const acceptHeader = req.headers.get("accept");
       if (!acceptHeader?.includes("application/json") || !acceptHeader.includes("text/event-stream")) {
+        this.onerror?.(new Error("Not Acceptable: Client must accept both application/json and text/event-stream"));
         return this.createJsonErrorResponse(406, -32000, "Not Acceptable: Client must accept both application/json and text/event-stream");
       }
       const ct = req.headers.get("content-type");
-      if (!ct || !ct.includes("application/json")) {
+      if (!isJsonContentType(ct)) {
+        this.onerror?.(new Error("Unsupported Media Type: Content-Type must be application/json"));
         return this.createJsonErrorResponse(415, -32000, "Unsupported Media Type: Content-Type must be application/json");
       }
       const requestInfo = {
-        headers: Object.fromEntries(req.headers.entries())
+        headers: Object.fromEntries(req.headers.entries()),
+        url: new URL(req.url)
       };
       let rawMessage;
       if (options?.parsedBody !== undefined) {
@@ -43772,6 +44392,7 @@ data:
         try {
           rawMessage = await req.json();
         } catch {
+          this.onerror?.(new Error("Parse error: Invalid JSON"));
           return this.createJsonErrorResponse(400, -32700, "Parse error: Invalid JSON");
         }
       }
@@ -43783,14 +44404,20 @@ data:
           messages = [JSONRPCMessageSchema.parse(rawMessage)];
         }
       } catch {
+        this.onerror?.(new Error("Parse error: Invalid JSON-RPC message"));
         return this.createJsonErrorResponse(400, -32700, "Parse error: Invalid JSON-RPC message");
       }
+      if (this._closed) {
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
       const isInitializationRequest = messages.some(isInitializeRequest);
       if (isInitializationRequest) {
         if (this._initialized && this.sessionId !== undefined) {
+          this.onerror?.(new Error("Invalid Request: Server already initialized"));
           return this.createJsonErrorResponse(400, -32600, "Invalid Request: Server already initialized");
         }
         if (messages.length > 1) {
+          this.onerror?.(new Error("Invalid Request: Only one initialization request is allowed"));
           return this.createJsonErrorResponse(400, -32600, "Invalid Request: Only one initialization request is allowed");
         }
         this.sessionId = this.sessionIdGenerator?.();
@@ -43809,6 +44436,9 @@ data:
           return protocolError;
         }
       }
+      if (this._closed) {
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
       const hasRequests = messages.some(isJSONRPCRequest);
       if (!hasRequests) {
         for (const message of messages) {
@@ -43839,18 +44469,25 @@ data:
       }
       const encoder = new TextEncoder;
       let streamController;
+      let keepAliveTimer = undefined;
       const readable = new ReadableStream({
         start: (controller) => {
           streamController = controller;
         },
         cancel: () => {
-          this._streamMapping.delete(streamId);
+          if (keepAliveTimer !== undefined) {
+            clearInterval(keepAliveTimer);
+          }
+          if (this._streamMapping.get(streamId)?.controller === streamController) {
+            this._streamMapping.delete(streamId);
+          }
         }
       });
       const headers = {
         "Content-Type": "text/event-stream",
-        "Cache-Control": "no-cache",
-        Connection: "keep-alive"
+        "Cache-Control": "no-cache, no-transform",
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no"
       };
       if (this.sessionId !== undefined) {
         headers["mcp-session-id"] = this.sessionId;
@@ -43861,6 +44498,9 @@ data:
             controller: streamController,
             encoder,
             cleanup: () => {
+              if (keepAliveTimer !== undefined) {
+                clearInterval(keepAliveTimer);
+              }
               this._streamMapping.delete(streamId);
               try {
                 streamController.close();
@@ -43870,19 +44510,33 @@ data:
           this._requestToStreamMapping.set(message.id, streamId);
         }
       }
-      await this.writePrimingEvent(streamController, encoder, streamId, clientProtocolVersion);
-      for (const message of messages) {
-        let closeSSEStream;
-        let closeStandaloneSSEStream;
-        if (isJSONRPCRequest(message) && this._eventStore && clientProtocolVersion >= "2025-11-25") {
-          closeSSEStream = () => {
-            this.closeSSEStream(message.id);
-          };
-          closeStandaloneSSEStream = () => {
-            this.closeStandaloneSSEStream();
-          };
+      try {
+        await this.writePrimingEvent(streamController, encoder, streamId, clientProtocolVersion);
+        for (const message of messages) {
+          let closeSSEStream;
+          let closeStandaloneSSEStream;
+          if (isJSONRPCRequest(message) && this._eventStore && clientProtocolVersion >= "2025-11-25") {
+            closeSSEStream = () => {
+              this.closeSSEStream(message.id);
+            };
+            closeStandaloneSSEStream = () => {
+              this.closeStandaloneSSEStream();
+            };
+          }
+          this.onmessage?.(message, { authInfo: options?.authInfo, requestInfo, closeSSEStream, closeStandaloneSSEStream });
         }
-        this.onmessage?.(message, { authInfo: options?.authInfo, requestInfo, closeSSEStream, closeStandaloneSSEStream });
+      } catch (error3) {
+        this._streamMapping.get(streamId)?.cleanup();
+        this._resumableStreams.delete(streamId);
+        for (const message of messages) {
+          if (isJSONRPCRequest(message)) {
+            this._requestToStreamMapping.delete(message.id);
+          }
+        }
+        throw error3;
+      }
+      if (this._streamMapping.get(streamId)?.controller === streamController) {
+        keepAliveTimer = this.startKeepAlive(streamController, encoder);
       }
       return new Response(readable, { status: 200, headers });
     } catch (error3) {
@@ -43899,22 +44553,28 @@ data:
     if (protocolError) {
       return protocolError;
     }
-    await Promise.resolve(this._onsessionclosed?.(this.sessionId));
-    await this.close();
-    return new Response(null, { status: 200 });
+    try {
+      await Promise.resolve(this._onsessionclosed?.(this.sessionId));
+      return new Response(null, { status: 200 });
+    } finally {
+      await this.close();
+    }
   }
   validateSession(req) {
     if (this.sessionIdGenerator === undefined) {
       return;
     }
     if (!this._initialized) {
+      this.onerror?.(new Error("Bad Request: Server not initialized"));
       return this.createJsonErrorResponse(400, -32000, "Bad Request: Server not initialized");
     }
     const sessionId = req.headers.get("mcp-session-id");
     if (!sessionId) {
+      this.onerror?.(new Error("Bad Request: Mcp-Session-Id header is required"));
       return this.createJsonErrorResponse(400, -32000, "Bad Request: Mcp-Session-Id header is required");
     }
     if (sessionId !== this.sessionId) {
+      this.onerror?.(new Error("Session not found"));
       return this.createJsonErrorResponse(404, -32001, "Session not found");
     }
     return;
@@ -43922,16 +44582,22 @@ data:
   validateProtocolVersion(req) {
     const protocolVersion = req.headers.get("mcp-protocol-version");
     if (protocolVersion !== null && !SUPPORTED_PROTOCOL_VERSIONS.includes(protocolVersion)) {
+      this.onerror?.(new Error(`Bad Request: Unsupported protocol version: ${protocolVersion}` + ` (supported versions: ${SUPPORTED_PROTOCOL_VERSIONS.join(", ")})`));
       return this.createJsonErrorResponse(400, -32000, `Bad Request: Unsupported protocol version: ${protocolVersion} (supported versions: ${SUPPORTED_PROTOCOL_VERSIONS.join(", ")})`);
     }
     return;
   }
   async close() {
+    if (this._closed) {
+      return;
+    }
+    this._closed = true;
     this._streamMapping.forEach(({ cleanup }) => {
       cleanup();
     });
     this._streamMapping.clear();
     this._requestResponseMap.clear();
+    this._resumableStreams.clear();
     this.onclose?.();
   }
   closeSSEStream(requestId) {
@@ -43966,7 +44632,7 @@ data:
       if (standaloneSse === undefined) {
         return;
       }
-      if (standaloneSse.controller && standaloneSse.encoder) {
+      if (standaloneSse.controller && standaloneSse.encoder && (eventId === undefined || !standaloneSse.replayedEventIds?.has(eventId))) {
         this.writeSSEEvent(standaloneSse.controller, standaloneSse.encoder, message, eventId);
       }
       return;
@@ -43975,13 +44641,19 @@ data:
     if (!streamId) {
       throw new Error(`No connection established for request ID: ${String(requestId)}`);
     }
-    const stream = this._streamMapping.get(streamId);
-    if (!this._enableJsonResponse && stream?.controller && stream?.encoder) {
+    let stream = this._streamMapping.get(streamId);
+    if (!this._enableJsonResponse) {
       let eventId;
       if (this._eventStore) {
         eventId = await this._eventStore.storeEvent(streamId, message);
+        stream = this._streamMapping.get(streamId);
+      }
+      if (stream?.controller && stream?.encoder && (eventId === undefined || !stream.replayedEventIds?.has(eventId))) {
+        const written = this.writeSSEEvent(stream.controller, stream.encoder, message, eventId);
+        if (written && eventId !== undefined) {
+          this._resumableStreams.add(streamId);
+        }
       }
-      this.writeSSEEvent(stream.controller, stream.encoder, message, eventId);
     }
     if (isJSONRPCResultResponse(message) || isJSONRPCErrorResponse(message)) {
       this._requestResponseMap.set(requestId, message);
@@ -43989,6 +44661,25 @@ data:
       const allResponsesReady = relatedIds.every((id) => this._requestResponseMap.has(id));
       if (allResponsesReady) {
         if (!stream) {
+          if (this._closed) {
+            for (const id of relatedIds) {
+              this._requestResponseMap.delete(id);
+              this._requestToStreamMapping.delete(id);
+            }
+            return;
+          }
+          if (!this._enableJsonResponse && this._eventStore && this._resumableStreams.has(streamId)) {
+            for (const id of relatedIds) {
+              this._requestResponseMap.delete(id);
+              this._requestToStreamMapping.delete(id);
+            }
+            this._resumableStreams.delete(streamId);
+            return;
+          }
+          for (const id of relatedIds) {
+            this._requestResponseMap.delete(id);
+            this._requestToStreamMapping.delete(id);
+          }
           throw new Error(`No connection established for request ID: ${String(requestId)}`);
         }
         if (this._enableJsonResponse && stream.resolveJson) {
@@ -44011,11 +44702,14 @@ data:
           this._requestResponseMap.delete(id);
           this._requestToStreamMapping.delete(id);
         }
+        this._resumableStreams.delete(streamId);
       }
     }
   }
 }
 var init_webStandardStreamableHttp = __esm(() => {
+  init_mediaType();
+  init_sseKeepAlive();
   init_types7();
 });
 
@@ -44109,7 +44803,7 @@ var init_v4_mini = __esm(() => {
   init_mini();
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s) {
   const schema2 = s;
   return !!schema2._zod;
@@ -44193,17 +44887,34 @@ function normalizeObjectSchema(schema2) {
   }
   return;
 }
+function getDotPath(path) {
+  if (path.length === 0) {
+    return "object root";
+  }
+  return path.reduce((acc, seg, index) => {
+    if (index === 0) {
+      return String(seg);
+    }
+    if (typeof seg === "number") {
+      return `${acc}[${seg}]`;
+    }
+    return `${acc}.${seg}`;
+  }, "");
+}
 function getParseErrorMessage(error3) {
   if (error3 && typeof error3 === "object") {
+    if ("issues" in error3 && Array.isArray(error3.issues) && error3.issues.length > 0) {
+      return error3.issues.map((i) => {
+        if (!i.path?.length) {
+          return i.message;
+        }
+        return `${i.message} at ${getDotPath(i.path)}`;
+      }).join(`
+`);
+    }
     if ("message" in error3 && typeof error3.message === "string") {
       return error3.message;
     }
-    if ("issues" in error3 && Array.isArray(error3.issues) && error3.issues.length > 0) {
-      const firstIssue = error3.issues[0];
-      if (firstIssue && typeof firstIssue === "object" && "message" in firstIssue) {
-        return String(firstIssue.message);
-      }
-    }
     try {
       return JSON.stringify(error3);
     } catch {
@@ -44257,12 +44968,12 @@ var init_zod_compat = __esm(() => {
   init_v4_mini();
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
 function isTerminal(status3) {
   return status3 === "completed" || status3 === "failed" || status3 === "cancelled";
 }
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/Options.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/Options.js
 var ignoreOverride, defaultOptions, getDefaultOptions = (options) => typeof options === "string" ? {
   ...defaultOptions,
   name: options
@@ -44298,7 +45009,7 @@ var init_Options = __esm(() => {
   };
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/Refs.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/Refs.js
 var getRefs = (options) => {
   const _options = getDefaultOptions(options);
   const currentPath = _options.name !== undefined ? [..._options.basePath, _options.definitionPath, _options.name] : _options.basePath;
@@ -44321,7 +45032,7 @@ var init_Refs = __esm(() => {
   init_Options();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/errorMessages.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/errorMessages.js
 function addErrorMessage(res, key2, errorMessage, refs) {
   if (!refs?.errorMessages)
     return;
@@ -44337,7 +45048,7 @@ function setResponseValueAndErrors(res, key2, value, errorMessage, refs) {
   addErrorMessage(res, key2, errorMessage, refs);
 }
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/getRelativePath.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/getRelativePath.js
 var getRelativePath = (pathA, pathB) => {
   let i = 0;
   for (;i < pathA.length && i < pathB.length; i++) {
@@ -44347,7 +45058,7 @@ var getRelativePath = (pathA, pathB) => {
   return [(pathA.length - i).toString(), ...pathB.slice(i)].join("/");
 };
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/any.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/any.js
 function parseAnyDef(refs) {
   if (refs.target !== "openAi") {
     return {};
@@ -44364,7 +45075,7 @@ function parseAnyDef(refs) {
 }
 var init_any = () => {};
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/array.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/array.js
 function parseArrayDef(def, refs) {
   const res = {
     type: "array"
@@ -44392,7 +45103,7 @@ var init_array = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/bigint.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/bigint.js
 function parseBigintDef(def, refs) {
   const res = {
     type: "integer",
@@ -44439,14 +45150,14 @@ function parseBigintDef(def, refs) {
 }
 var init_bigint = () => {};
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/boolean.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/boolean.js
 function parseBooleanDef() {
   return {
     type: "boolean"
   };
 }
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/branded.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/branded.js
 function parseBrandedDef(_def, refs) {
   return parseDef(_def.type._def, refs);
 }
@@ -44454,7 +45165,7 @@ var init_branded = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/catch.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/catch.js
 var parseCatchDef = (def, refs) => {
   return parseDef(def.innerType._def, refs);
 };
@@ -44462,7 +45173,7 @@ var init_catch = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/date.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/date.js
 function parseDateDef(def, refs, overrideDateStrategy) {
   const strategy = overrideDateStrategy ?? refs.dateStrategy;
   if (Array.isArray(strategy)) {
@@ -44508,7 +45219,7 @@ var integerDateParser = (def, refs) => {
 };
 var init_date = () => {};
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/default.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/default.js
 function parseDefaultDef(_def, refs) {
   return {
     ...parseDef(_def.innerType._def, refs),
@@ -44519,7 +45230,7 @@ var init_default = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/effects.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/effects.js
 function parseEffectsDef(_def, refs) {
   return refs.effectStrategy === "input" ? parseDef(_def.schema._def, refs) : parseAnyDef(refs);
 }
@@ -44528,7 +45239,7 @@ var init_effects = __esm(() => {
   init_any();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/enum.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/enum.js
 function parseEnumDef(def) {
   return {
     type: "string",
@@ -44536,7 +45247,7 @@ function parseEnumDef(def) {
   };
 }
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/intersection.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/intersection.js
 function parseIntersectionDef(def, refs) {
   const allOf = [
     parseDef(def.left._def, {
@@ -44581,7 +45292,7 @@ var init_intersection = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/literal.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/literal.js
 function parseLiteralDef(def, refs) {
   const parsedType2 = typeof def.value;
   if (parsedType2 !== "bigint" && parsedType2 !== "number" && parsedType2 !== "boolean" && parsedType2 !== "string") {
@@ -44601,7 +45312,7 @@ function parseLiteralDef(def, refs) {
   };
 }
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/string.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/string.js
 function parseStringDef(def, refs) {
   const res = {
     type: "string"
@@ -44900,7 +45611,7 @@ var init_string = __esm(() => {
   ALPHA_NUMERIC = new Set("ABCDEFGHIJKLMNOPQRSTUVXYZabcdefghijklmnopqrstuvxyz0123456789");
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/record.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/record.js
 function parseRecordDef(def, refs) {
   if (refs.target === "openAi") {
     console.warn("Warning: OpenAI may not support records in schemas! Try an array of key-value pairs instead.");
@@ -44959,7 +45670,7 @@ var init_record = __esm(() => {
   init_any();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/map.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/map.js
 function parseMapDef(def, refs) {
   if (refs.mapStrategy === "record") {
     return parseRecordDef(def, refs);
@@ -44989,7 +45700,7 @@ var init_map = __esm(() => {
   init_any();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/nativeEnum.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/nativeEnum.js
 function parseNativeEnumDef(def) {
   const object3 = def.values;
   const actualKeys = Object.keys(def.values).filter((key2) => {
@@ -45003,7 +45714,7 @@ function parseNativeEnumDef(def) {
   };
 }
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/never.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/never.js
 function parseNeverDef(refs) {
   return refs.target === "openAi" ? undefined : {
     not: parseAnyDef({
@@ -45016,7 +45727,7 @@ var init_never = __esm(() => {
   init_any();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/null.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/null.js
 function parseNullDef(refs) {
   return refs.target === "openApi3" ? {
     enum: ["null"],
@@ -45026,7 +45737,7 @@ function parseNullDef(refs) {
   };
 }
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/union.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/union.js
 function parseUnionDef(def, refs) {
   if (refs.target === "openApi3")
     return asAnyOf(def, refs);
@@ -45097,7 +45808,7 @@ var init_union = __esm(() => {
   };
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/nullable.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/nullable.js
 function parseNullableDef(def, refs) {
   if (["ZodString", "ZodNumber", "ZodBigInt", "ZodBoolean", "ZodNull"].includes(def.innerType._def.typeName) && (!def.innerType._def.checks || !def.innerType._def.checks.length)) {
     if (refs.target === "openApi3") {
@@ -45133,7 +45844,7 @@ var init_nullable = __esm(() => {
   init_union();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/number.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/number.js
 function parseNumberDef(def, refs) {
   const res = {
     type: "number"
@@ -45183,7 +45894,7 @@ function parseNumberDef(def, refs) {
 }
 var init_number = () => {};
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/object.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/object.js
 function parseObjectDef(def, refs) {
   const forceOptionalIntoNullable = refs.target === "openAi";
   const result = {
@@ -45256,7 +45967,7 @@ var init_object = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/optional.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/optional.js
 var parseOptionalDef = (def, refs) => {
   if (refs.currentPath.toString() === refs.propertyPath?.toString()) {
     return parseDef(def.innerType._def, refs);
@@ -45279,7 +45990,7 @@ var init_optional = __esm(() => {
   init_any();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/pipeline.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/pipeline.js
 var parsePipelineDef = (def, refs) => {
   if (refs.pipeStrategy === "input") {
     return parseDef(def.in._def, refs);
@@ -45302,7 +46013,7 @@ var init_pipeline = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/promise.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/promise.js
 function parsePromiseDef(def, refs) {
   return parseDef(def.type._def, refs);
 }
@@ -45310,7 +46021,7 @@ var init_promise = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/set.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/set.js
 function parseSetDef(def, refs) {
   const items = parseDef(def.valueType._def, {
     ...refs,
@@ -45333,7 +46044,7 @@ var init_set = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/tuple.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/tuple.js
 function parseTupleDef(def, refs) {
   if (def.rest) {
     return {
@@ -45364,7 +46075,7 @@ var init_tuple = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/undefined.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/undefined.js
 function parseUndefinedDef(refs) {
   return {
     not: parseAnyDef(refs)
@@ -45374,7 +46085,7 @@ var init_undefined = __esm(() => {
   init_any();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/unknown.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/unknown.js
 function parseUnknownDef(refs) {
   return parseAnyDef(refs);
 }
@@ -45382,7 +46093,7 @@ var init_unknown = __esm(() => {
   init_any();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/readonly.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/readonly.js
 var parseReadonlyDef = (def, refs) => {
   return parseDef(def.innerType._def, refs);
 };
@@ -45390,7 +46101,7 @@ var init_readonly = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/selectParser.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/selectParser.js
 var selectParser = (def, typeName, refs) => {
   switch (typeName) {
     case ZodFirstPartyTypeKind.ZodString:
@@ -45496,7 +46207,7 @@ var init_selectParser = __esm(() => {
   init_readonly();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parseDef.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parseDef.js
 function parseDef(def, refs, forceResolution = false) {
   const seenItem = refs.seen.get(def);
   if (refs.override) {
@@ -45556,10 +46267,10 @@ var init_parseDef = __esm(() => {
   init_any();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parseTypes.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parseTypes.js
 var init_parseTypes = () => {};
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/zodToJsonSchema.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/zodToJsonSchema.js
 var zodToJsonSchema = (schema2, options) => {
   const refs = getRefs(options);
   let definitions = typeof options === "object" && options.definitions ? Object.entries(options.definitions).reduce((acc, [name2, schema3]) => ({
@@ -45625,7 +46336,7 @@ var init_zodToJsonSchema = __esm(() => {
   init_any();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/index.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/index.js
 var init_esm = __esm(() => {
   init_zodToJsonSchema();
   init_Options();
@@ -45661,7 +46372,7 @@ var init_esm = __esm(() => {
   init_zodToJsonSchema();
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
 function mapMiniTarget(t) {
   if (!t)
     return "draft-7";
@@ -45708,7 +46419,7 @@ var init_zod_json_schema_compat = __esm(() => {
   init_esm();
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
 class Protocol {
   constructor(_options) {
     this._options = _options;
@@ -45910,6 +46621,10 @@ class Protocol {
     this._progressHandlers.clear();
     this._taskProgressTokens.clear();
     this._pendingDebouncedNotifications.clear();
+    for (const info of this._timeoutInfo.values()) {
+      clearTimeout(info.timeoutId);
+    }
+    this._timeoutInfo.clear();
     for (const controller of this._requestHandlerAbortControllers.values()) {
       controller.abort();
     }
@@ -46040,7 +46755,9 @@ class Protocol {
         await capturedTransport?.send(errorResponse);
       }
     }).catch((error3) => this._onerror(new Error(`Failed to send response: ${error3}`))).finally(() => {
-      this._requestHandlerAbortControllers.delete(request.id);
+      if (this._requestHandlerAbortControllers.get(request.id) === abortController) {
+        this._requestHandlerAbortControllers.delete(request.id);
+      }
     });
   }
   _onprogress(notification) {
@@ -52868,7 +53585,7 @@ var require_formats = __commonJS((exports) => {
     email: /^[a-z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i
   };
   exports.formatNames = Object.keys(exports.fullFormats);
-  function isLeapYear(year) {
+  function isLeapYear2(year) {
     return year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
   }
   var DATE = /^(\d\d\d\d)-(\d\d)-(\d\d)$/;
@@ -52880,7 +53597,7 @@ var require_formats = __commonJS((exports) => {
     const year = +matches[1];
     const month = +matches[2];
     const day = +matches[3];
-    return month >= 1 && month <= 12 && day >= 1 && day <= (month === 2 && isLeapYear(year) ? 29 : DAYS[month]);
+    return month >= 1 && month <= 12 && day >= 1 && day <= (month === 2 && isLeapYear2(year) ? 29 : DAYS[month]);
   }
   function compareDate(d1, d2) {
     if (!(d1 && d2))
@@ -53106,7 +53823,7 @@ var require_dist = __commonJS((exports, module) => {
   exports.default = formatsPlugin;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
 function createDefaultAjvInstance() {
   const ajv = new import_ajv.default({
     strict: false,
@@ -53149,7 +53866,7 @@ var init_ajv_provider = __esm(() => {
   import_ajv_formats = __toESM(require_dist(), 1);
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
 class ExperimentalServerTasks {
   constructor(_server) {
     this._server = _server;
@@ -53157,6 +53874,62 @@ class ExperimentalServerTasks {
   requestStream(request, resultSchema, options) {
     return this._server.requestStream(request, resultSchema, options);
   }
+  createMessageStream(params, options) {
+    const clientCapabilities = this._server.getClientCapabilities();
+    if ((params.tools || params.toolChoice) && !clientCapabilities?.sampling?.tools) {
+      throw new Error("Client does not support sampling tools capability.");
+    }
+    if (params.messages.length > 0) {
+      const lastMessage = params.messages[params.messages.length - 1];
+      const lastContent = Array.isArray(lastMessage.content) ? lastMessage.content : [lastMessage.content];
+      const hasToolResults = lastContent.some((c) => c.type === "tool_result");
+      const previousMessage = params.messages.length > 1 ? params.messages[params.messages.length - 2] : undefined;
+      const previousContent = previousMessage ? Array.isArray(previousMessage.content) ? previousMessage.content : [previousMessage.content] : [];
+      const hasPreviousToolUse = previousContent.some((c) => c.type === "tool_use");
+      if (hasToolResults) {
+        if (lastContent.some((c) => c.type !== "tool_result")) {
+          throw new Error("The last message must contain only tool_result content if any is present");
+        }
+        if (!hasPreviousToolUse) {
+          throw new Error("tool_result blocks are not matching any tool_use from the previous message");
+        }
+      }
+      if (hasPreviousToolUse) {
+        const toolUseIds = new Set(previousContent.filter((c) => c.type === "tool_use").map((c) => c.id));
+        const toolResultIds = new Set(lastContent.filter((c) => c.type === "tool_result").map((c) => c.toolUseId));
+        if (toolUseIds.size !== toolResultIds.size || ![...toolUseIds].every((id) => toolResultIds.has(id))) {
+          throw new Error("ids of tool_result blocks and tool_use blocks from previous message do not match");
+        }
+      }
+    }
+    return this.requestStream({
+      method: "sampling/createMessage",
+      params
+    }, CreateMessageResultSchema, options);
+  }
+  elicitInputStream(params, options) {
+    const clientCapabilities = this._server.getClientCapabilities();
+    const mode = params.mode ?? "form";
+    switch (mode) {
+      case "url": {
+        if (!clientCapabilities?.elicitation?.url) {
+          throw new Error("Client does not support url elicitation.");
+        }
+        break;
+      }
+      case "form": {
+        if (!clientCapabilities?.elicitation?.form) {
+          throw new Error("Client does not support form elicitation.");
+        }
+        break;
+      }
+    }
+    const normalizedParams = mode === "form" && params.mode === undefined ? { ...params, mode: "form" } : params;
+    return this.requestStream({
+      method: "elicitation/create",
+      params: normalizedParams
+    }, ElicitResultSchema, options);
+  }
   async getTask(taskId, options) {
     return this._server.getTask({ taskId }, options);
   }
@@ -53170,8 +53943,11 @@ class ExperimentalServerTasks {
     return this._server.cancelTask({ taskId }, options);
   }
 }
+var init_server = __esm(() => {
+  init_types7();
+});
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
 function assertToolsCallTaskCapability(requests, method, entityName) {
   if (!requests) {
     throw new Error(`${entityName} does not support task creation (required for ${method})`);
@@ -53206,13 +53982,14 @@ function assertClientRequestTaskCapability(requests, method, entityName) {
   }
 }
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
 var Server;
-var init_server = __esm(() => {
+var init_server2 = __esm(() => {
   init_protocol();
   init_types7();
   init_ajv_provider();
   init_zod_compat();
+  init_server();
   Server = class Server extends Protocol {
     constructor(_serverInfo, options) {
       super(options);
@@ -53260,16 +54037,7 @@ var init_server = __esm(() => {
       if (!methodSchema) {
         throw new Error("Schema is missing a method literal");
       }
-      let methodValue;
-      if (isZ4Schema(methodSchema)) {
-        const v4Schema = methodSchema;
-        const v4Def = v4Schema._zod?.def;
-        methodValue = v4Def?.value ?? v4Schema.value;
-      } else {
-        const v3Schema = methodSchema;
-        const legacyDef = v3Schema._def;
-        methodValue = legacyDef?.value ?? v3Schema.value;
-      }
+      const methodValue = getLiteralValue(methodSchema);
       if (typeof methodValue !== "string") {
         throw new Error("Schema method literal must be a string");
       }
@@ -53546,7 +54314,7 @@ var init_server = __esm(() => {
   };
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
 function isCompletable(schema2) {
   return !!schema2 && typeof schema2 === "object" && COMPLETABLE_SYMBOL in schema2;
 }
@@ -53561,7 +54329,7 @@ var init_completable = __esm(() => {
     McpZodTypeKind2["Completable"] = "McpCompletable";
   })(McpZodTypeKind || (McpZodTypeKind = {}));
 });
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
 function validateToolName(name) {
   const warnings = [];
   if (name.length === 0) {
@@ -53622,7 +54390,7 @@ var init_toolNameValidation = __esm(() => {
   TOOL_NAME_REGEX = /^[A-Za-z0-9._-]{1,128}$/;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
 class ExperimentalMcpServerTasks {
   constructor(_mcpServer) {
     this._mcpServer = _mcpServer;
@@ -53637,7 +54405,7 @@ class ExperimentalMcpServerTasks {
   }
 }
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
 class McpServer {
   constructor(serverInfo, options) {
     this._registeredResources = {};
@@ -54221,6 +54989,9 @@ class McpServer {
           annotations = rest.shift();
         }
       } else if (typeof firstArg === "object" && firstArg !== null) {
+        if (Object.values(firstArg).some((v) => typeof v === "object" && v !== null)) {
+          throw new Error(`Tool ${name} expected a Zod schema or ToolAnnotations, but received an unrecognized object`);
+        }
         annotations = rest.shift();
       }
     }
@@ -54309,6 +55080,9 @@ function getZodSchemaObject(schema2) {
   if (isZodRawShapeCompat(schema2)) {
     return objectFromShape(schema2);
   }
+  if (!isZodSchemaInstance(schema2)) {
+    throw new Error("inputSchema must be a Zod schema or raw shape, received an unrecognized object");
+  }
   return schema2;
 }
 function promptArgumentsFromSchema(schema2) {
@@ -54348,7 +55122,7 @@ function createCompletionResult(suggestions) {
 }
 var EMPTY_OBJECT_JSON_SCHEMA, EMPTY_COMPLETION_RESULT;
 var init_mcp = __esm(() => {
-  init_server();
+  init_server2();
   init_zod_compat();
   init_zod_json_schema_compat();
   init_types7();
@@ -54367,9 +55141,17 @@ var init_mcp = __esm(() => {
   };
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
 class ReadBuffer {
+  constructor(options) {
+    this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE;
+  }
   append(chunk) {
+    const newSize = (this._buffer?.length ?? 0) + chunk.length;
+    if (newSize > this._maxBufferSize) {
+      this.clear();
+      throw new Error(`ReadBuffer exceeded maximum size of ${this._maxBufferSize} bytes`);
+    }
     this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk]) : chunk;
   }
   readMessage() {
@@ -54396,26 +55178,33 @@ function serializeMessage(message) {
   return JSON.stringify(message) + `
 `;
 }
+var STDIO_DEFAULT_MAX_BUFFER_SIZE;
 var init_stdio = __esm(() => {
   init_types7();
+  STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 import process2 from "process";
 
 class StdioServerTransport {
-  constructor(_stdin = process2.stdin, _stdout = process2.stdout) {
+  constructor(_stdin = process2.stdin, _stdout = process2.stdout, options) {
     this._stdin = _stdin;
     this._stdout = _stdout;
-    this._readBuffer = new ReadBuffer;
     this._started = false;
     this._ondata = (chunk) => {
-      this._readBuffer.append(chunk);
-      this.processReadBuffer();
+      try {
+        this._readBuffer.append(chunk);
+        this.processReadBuffer();
+      } catch (error3) {
+        this.onerror?.(error3);
+        this.close().catch(() => {});
+      }
     };
     this._onerror = (error3) => {
       this.onerror?.(error3);
     };
+    this._readBuffer = new ReadBuffer({ maxBufferSize: options?.maxBufferSize });
   }
   async start() {
     if (this._started) {
@@ -55696,7 +56485,7 @@ var init_assignee_context = __esm(() => {
   init_assignee_validation();
 });
 
-// node_modules/.bun/@hasna+contracts@0.13.3+86f0f4a9d69523e0/node_modules/@hasna/contracts/dist/client/storage.js
+// node_modules/.bun/@hasna+contracts@0.13.4+ad7b1171e6eea7eb/node_modules/@hasna/contracts/dist/client/storage.js
 import { isIP } from "net";
 import { readFileSync as readFileSync5, statSync as statSync4 } from "fs";
 import { join as join10 } from "path";
@@ -58156,6 +58945,7 @@ var init_cloud_router = __esm(() => {
   init_storage();
   init_types();
   init_redaction();
+  init_instant_compare();
   init_plan_project_link_contract();
   init_http_client();
   init_adoption_validation();
@@ -85310,7 +86100,7 @@ var require_v4_mini = __commonJS((exports) => {
   __exportStar(require_mini(), exports);
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-compat.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-compat.js
 var require_zod_compat = __commonJS((exports) => {
   var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
     if (k2 === undefined)
@@ -85440,17 +86230,34 @@ var require_zod_compat = __commonJS((exports) => {
     }
     return;
   }
+  function getDotPath2(path) {
+    if (path.length === 0) {
+      return "object root";
+    }
+    return path.reduce((acc, seg, index) => {
+      if (index === 0) {
+        return String(seg);
+      }
+      if (typeof seg === "number") {
+        return `${acc}[${seg}]`;
+      }
+      return `${acc}.${seg}`;
+    }, "");
+  }
   function getParseErrorMessage2(error3) {
     if (error3 && typeof error3 === "object") {
+      if ("issues" in error3 && Array.isArray(error3.issues) && error3.issues.length > 0) {
+        return error3.issues.map((i) => {
+          if (!i.path?.length) {
+            return i.message;
+          }
+          return `${i.message} at ${getDotPath2(i.path)}`;
+        }).join(`
+`);
+      }
       if ("message" in error3 && typeof error3.message === "string") {
         return error3.message;
       }
-      if ("issues" in error3 && Array.isArray(error3.issues) && error3.issues.length > 0) {
-        const firstIssue = error3.issues[0];
-        if (firstIssue && typeof firstIssue === "object" && "message" in firstIssue) {
-          return String(firstIssue.message);
-        }
-      }
       try {
         return JSON.stringify(error3);
       } catch {
@@ -87157,7 +87964,7 @@ var require_v4 = __commonJS((exports) => {
   exports.default = index_js_1.default;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/types.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/types.js
 var require_types3 = __commonJS((exports) => {
   var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
     if (k2 === undefined)
@@ -87208,7 +88015,7 @@ var require_types3 = __commonJS((exports) => {
   exports.ProgressTokenSchema = z.union([z.string(), z.number().int()]);
   exports.CursorSchema = z.string();
   exports.TaskCreationParamsSchema = z.looseObject({
-    ttl: z.union([z.number(), z.null()]).optional(),
+    ttl: z.number().optional(),
     pollInterval: z.number().optional()
   });
   exports.TaskMetadataSchema = z.object({
@@ -87370,7 +88177,8 @@ var require_types3 = __commonJS((exports) => {
     roots: z.object({
       listChanged: z.boolean().optional()
     }).optional(),
-    tasks: exports.ClientTasksCapabilitySchema.optional()
+    tasks: exports.ClientTasksCapabilitySchema.optional(),
+    extensions: z.record(z.string(), AssertObjectSchema2).optional()
   });
   exports.InitializeRequestParamsSchema = BaseRequestParamsSchema2.extend({
     protocolVersion: z.string(),
@@ -87397,7 +88205,8 @@ var require_types3 = __commonJS((exports) => {
     tools: z.object({
       listChanged: z.boolean().optional()
     }).optional(),
-    tasks: exports.ServerTasksCapabilitySchema.optional()
+    tasks: exports.ServerTasksCapabilitySchema.optional(),
+    extensions: z.record(z.string(), AssertObjectSchema2).optional()
   });
   exports.InitializeResultSchema = exports.ResultSchema.extend({
     protocolVersion: z.string(),
@@ -87514,6 +88323,7 @@ var require_types3 = __commonJS((exports) => {
     uri: z.string(),
     description: z.optional(z.string()),
     mimeType: z.optional(z.string()),
+    size: z.optional(z.number()),
     annotations: exports.AnnotationsSchema.optional(),
     _meta: z.optional(z.looseObject({}))
   });
@@ -88057,7 +88867,7 @@ var require_types3 = __commonJS((exports) => {
   exports.UrlElicitationRequiredError = UrlElicitationRequiredError2;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/experimental/tasks/interfaces.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/experimental/tasks/interfaces.js
 var require_interfaces = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.isTerminal = isTerminal2;
@@ -88066,7 +88876,7 @@ var require_interfaces = __commonJS((exports) => {
   }
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/Options.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/Options.js
 var require_Options = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getDefaultOptions = exports.defaultOptions = exports.jsonDescription = exports.ignoreOverride = undefined;
@@ -88117,7 +88927,7 @@ var require_Options = __commonJS((exports) => {
   exports.getDefaultOptions = getDefaultOptions2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/Refs.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/Refs.js
 var require_Refs = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getRefs = undefined;
@@ -88143,7 +88953,7 @@ var require_Refs = __commonJS((exports) => {
   exports.getRefs = getRefs2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/errorMessages.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/errorMessages.js
 var require_errorMessages = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.setResponseValueAndErrors = exports.addErrorMessage = undefined;
@@ -88165,7 +88975,7 @@ var require_errorMessages = __commonJS((exports) => {
   exports.setResponseValueAndErrors = setResponseValueAndErrors2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/getRelativePath.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/getRelativePath.js
 var require_getRelativePath = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getRelativePath = undefined;
@@ -88180,7 +88990,7 @@ var require_getRelativePath = __commonJS((exports) => {
   exports.getRelativePath = getRelativePath3;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/any.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/any.js
 var require_any = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseAnyDef = undefined;
@@ -88202,7 +89012,7 @@ var require_any = __commonJS((exports) => {
   exports.parseAnyDef = parseAnyDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/array.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/array.js
 var require_array = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseArrayDef = undefined;
@@ -88234,7 +89044,7 @@ var require_array = __commonJS((exports) => {
   exports.parseArrayDef = parseArrayDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/bigint.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/bigint.js
 var require_bigint = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseBigintDef = undefined;
@@ -88286,7 +89096,7 @@ var require_bigint = __commonJS((exports) => {
   exports.parseBigintDef = parseBigintDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/boolean.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/boolean.js
 var require_boolean = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseBooleanDef = undefined;
@@ -88298,7 +89108,7 @@ var require_boolean = __commonJS((exports) => {
   exports.parseBooleanDef = parseBooleanDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/branded.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/branded.js
 var require_branded = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseBrandedDef = undefined;
@@ -88309,7 +89119,7 @@ var require_branded = __commonJS((exports) => {
   exports.parseBrandedDef = parseBrandedDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/catch.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/catch.js
 var require_catch = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseCatchDef = undefined;
@@ -88320,7 +89130,7 @@ var require_catch = __commonJS((exports) => {
   exports.parseCatchDef = parseCatchDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/date.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/date.js
 var require_date = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseDateDef = undefined;
@@ -88371,7 +89181,7 @@ var require_date = __commonJS((exports) => {
   };
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/default.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/default.js
 var require_default = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseDefaultDef = undefined;
@@ -88385,7 +89195,7 @@ var require_default = __commonJS((exports) => {
   exports.parseDefaultDef = parseDefaultDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/effects.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/effects.js
 var require_effects = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseEffectsDef = undefined;
@@ -88397,7 +89207,7 @@ var require_effects = __commonJS((exports) => {
   exports.parseEffectsDef = parseEffectsDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/enum.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/enum.js
 var require_enum2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseEnumDef = undefined;
@@ -88410,7 +89220,7 @@ var require_enum2 = __commonJS((exports) => {
   exports.parseEnumDef = parseEnumDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/intersection.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/intersection.js
 var require_intersection = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseIntersectionDef = undefined;
@@ -88458,7 +89268,7 @@ var require_intersection = __commonJS((exports) => {
   exports.parseIntersectionDef = parseIntersectionDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/literal.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/literal.js
 var require_literal = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseLiteralDef = undefined;
@@ -88483,7 +89293,7 @@ var require_literal = __commonJS((exports) => {
   exports.parseLiteralDef = parseLiteralDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/string.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/string.js
 var require_string = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseStringDef = exports.zodPatterns = undefined;
@@ -88786,7 +89596,7 @@ var require_string = __commonJS((exports) => {
   }
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/record.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/record.js
 var require_record = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseRecordDef = undefined;
@@ -88848,7 +89658,7 @@ var require_record = __commonJS((exports) => {
   exports.parseRecordDef = parseRecordDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/map.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/map.js
 var require_map = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseMapDef = undefined;
@@ -88881,7 +89691,7 @@ var require_map = __commonJS((exports) => {
   exports.parseMapDef = parseMapDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/nativeEnum.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/nativeEnum.js
 var require_nativeEnum = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseNativeEnumDef = undefined;
@@ -88900,7 +89710,7 @@ var require_nativeEnum = __commonJS((exports) => {
   exports.parseNativeEnumDef = parseNativeEnumDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/never.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/never.js
 var require_never = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseNeverDef = undefined;
@@ -88916,7 +89726,7 @@ var require_never = __commonJS((exports) => {
   exports.parseNeverDef = parseNeverDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/null.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/null.js
 var require_null = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseNullDef = undefined;
@@ -88931,7 +89741,7 @@ var require_null = __commonJS((exports) => {
   exports.parseNullDef = parseNullDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/union.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/union.js
 var require_union = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseUnionDef = exports.primitiveMappings = undefined;
@@ -89005,7 +89815,7 @@ var require_union = __commonJS((exports) => {
   };
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/nullable.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/nullable.js
 var require_nullable = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseNullableDef = undefined;
@@ -89044,7 +89854,7 @@ var require_nullable = __commonJS((exports) => {
   exports.parseNullableDef = parseNullableDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/number.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/number.js
 var require_number = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseNumberDef = undefined;
@@ -89099,7 +89909,7 @@ var require_number = __commonJS((exports) => {
   exports.parseNumberDef = parseNumberDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/object.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/object.js
 var require_object = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseObjectDef = undefined;
@@ -89175,7 +89985,7 @@ var require_object = __commonJS((exports) => {
   }
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/optional.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/optional.js
 var require_optional = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseOptionalDef = undefined;
@@ -89201,7 +90011,7 @@ var require_optional = __commonJS((exports) => {
   exports.parseOptionalDef = parseOptionalDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/pipeline.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/pipeline.js
 var require_pipeline = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parsePipelineDef = undefined;
@@ -89227,7 +90037,7 @@ var require_pipeline = __commonJS((exports) => {
   exports.parsePipelineDef = parsePipelineDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/promise.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/promise.js
 var require_promise = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parsePromiseDef = undefined;
@@ -89238,7 +90048,7 @@ var require_promise = __commonJS((exports) => {
   exports.parsePromiseDef = parsePromiseDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/set.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/set.js
 var require_set = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseSetDef = undefined;
@@ -89265,7 +90075,7 @@ var require_set = __commonJS((exports) => {
   exports.parseSetDef = parseSetDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/tuple.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/tuple.js
 var require_tuple = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseTupleDef = undefined;
@@ -89299,7 +90109,7 @@ var require_tuple = __commonJS((exports) => {
   exports.parseTupleDef = parseTupleDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/undefined.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/undefined.js
 var require_undefined = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseUndefinedDef = undefined;
@@ -89312,7 +90122,7 @@ var require_undefined = __commonJS((exports) => {
   exports.parseUndefinedDef = parseUndefinedDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/unknown.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/unknown.js
 var require_unknown = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseUnknownDef = undefined;
@@ -89323,7 +90133,7 @@ var require_unknown = __commonJS((exports) => {
   exports.parseUnknownDef = parseUnknownDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/readonly.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/readonly.js
 var require_readonly = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseReadonlyDef = undefined;
@@ -89334,7 +90144,7 @@ var require_readonly = __commonJS((exports) => {
   exports.parseReadonlyDef = parseReadonlyDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/selectParser.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/selectParser.js
 var require_selectParser = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.selectParser = undefined;
@@ -89448,7 +90258,7 @@ var require_selectParser = __commonJS((exports) => {
   exports.selectParser = selectParser3;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parseDef.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parseDef.js
 var require_parseDef = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseDef = undefined;
@@ -89513,12 +90323,12 @@ var require_parseDef = __commonJS((exports) => {
   };
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parseTypes.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parseTypes.js
 var require_parseTypes = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/zodToJsonSchema.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/zodToJsonSchema.js
 var require_zodToJsonSchema = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.zodToJsonSchema = undefined;
@@ -89587,7 +90397,7 @@ var require_zodToJsonSchema = __commonJS((exports) => {
   exports.zodToJsonSchema = zodToJsonSchema3;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/index.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/index.js
 var require_cjs = __commonJS((exports) => {
   var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
     if (k2 === undefined)
@@ -89652,7 +90462,7 @@ var require_cjs = __commonJS((exports) => {
   exports.default = zodToJsonSchema_js_1.zodToJsonSchema;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-json-schema-compat.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-json-schema-compat.js
 var require_zod_json_schema_compat = __commonJS((exports) => {
   var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
     if (k2 === undefined)
@@ -89735,7 +90545,7 @@ var require_zod_json_schema_compat = __commonJS((exports) => {
   }
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/shared/protocol.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/shared/protocol.js
 var require_protocol = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.Protocol = exports.DEFAULT_REQUEST_TIMEOUT_MSEC = undefined;
@@ -89947,6 +90757,10 @@ var require_protocol = __commonJS((exports) => {
       this._progressHandlers.clear();
       this._taskProgressTokens.clear();
       this._pendingDebouncedNotifications.clear();
+      for (const info of this._timeoutInfo.values()) {
+        clearTimeout(info.timeoutId);
+      }
+      this._timeoutInfo.clear();
       for (const controller of this._requestHandlerAbortControllers.values()) {
         controller.abort();
       }
@@ -90077,7 +90891,9 @@ var require_protocol = __commonJS((exports) => {
           await capturedTransport?.send(errorResponse);
         }
       }).catch((error3) => this._onerror(new Error(`Failed to send response: ${error3}`))).finally(() => {
-        this._requestHandlerAbortControllers.delete(request.id);
+        if (this._requestHandlerAbortControllers.get(request.id) === abortController) {
+          this._requestHandlerAbortControllers.delete(request.id);
+        }
       });
     }
     _onprogress(notification) {
@@ -90580,7 +91396,7 @@ var require_protocol = __commonJS((exports) => {
   }
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/validation/ajv-provider.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/validation/ajv-provider.js
 var require_ajv_provider = __commonJS((exports) => {
   var __importDefault = exports && exports.__importDefault || function(mod) {
     return mod && mod.__esModule ? mod : { default: mod };
@@ -90628,10 +91444,11 @@ var require_ajv_provider = __commonJS((exports) => {
   exports.AjvJsonSchemaValidator = AjvJsonSchemaValidator2;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/experimental/tasks/server.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/experimental/tasks/server.js
 var require_server = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.ExperimentalServerTasks = undefined;
+  var types_js_1 = require_types3();
 
   class ExperimentalServerTasks2 {
     constructor(_server) {
@@ -90640,6 +91457,62 @@ var require_server = __commonJS((exports) => {
     requestStream(request, resultSchema, options) {
       return this._server.requestStream(request, resultSchema, options);
     }
+    createMessageStream(params, options) {
+      const clientCapabilities = this._server.getClientCapabilities();
+      if ((params.tools || params.toolChoice) && !clientCapabilities?.sampling?.tools) {
+        throw new Error("Client does not support sampling tools capability.");
+      }
+      if (params.messages.length > 0) {
+        const lastMessage = params.messages[params.messages.length - 1];
+        const lastContent = Array.isArray(lastMessage.content) ? lastMessage.content : [lastMessage.content];
+        const hasToolResults = lastContent.some((c) => c.type === "tool_result");
+        const previousMessage = params.messages.length > 1 ? params.messages[params.messages.length - 2] : undefined;
+        const previousContent = previousMessage ? Array.isArray(previousMessage.content) ? previousMessage.content : [previousMessage.content] : [];
+        const hasPreviousToolUse = previousContent.some((c) => c.type === "tool_use");
+        if (hasToolResults) {
+          if (lastContent.some((c) => c.type !== "tool_result")) {
+            throw new Error("The last message must contain only tool_result content if any is present");
+          }
+          if (!hasPreviousToolUse) {
+            throw new Error("tool_result blocks are not matching any tool_use from the previous message");
+          }
+        }
+        if (hasPreviousToolUse) {
+          const toolUseIds = new Set(previousContent.filter((c) => c.type === "tool_use").map((c) => c.id));
+          const toolResultIds = new Set(lastContent.filter((c) => c.type === "tool_result").map((c) => c.toolUseId));
+          if (toolUseIds.size !== toolResultIds.size || ![...toolUseIds].every((id) => toolResultIds.has(id))) {
+            throw new Error("ids of tool_result blocks and tool_use blocks from previous message do not match");
+          }
+        }
+      }
+      return this.requestStream({
+        method: "sampling/createMessage",
+        params
+      }, types_js_1.CreateMessageResultSchema, options);
+    }
+    elicitInputStream(params, options) {
+      const clientCapabilities = this._server.getClientCapabilities();
+      const mode = params.mode ?? "form";
+      switch (mode) {
+        case "url": {
+          if (!clientCapabilities?.elicitation?.url) {
+            throw new Error("Client does not support url elicitation.");
+          }
+          break;
+        }
+        case "form": {
+          if (!clientCapabilities?.elicitation?.form) {
+            throw new Error("Client does not support form elicitation.");
+          }
+          break;
+        }
+      }
+      const normalizedParams = mode === "form" && params.mode === undefined ? { ...params, mode: "form" } : params;
+      return this.requestStream({
+        method: "elicitation/create",
+        params: normalizedParams
+      }, types_js_1.ElicitResultSchema, options);
+    }
     async getTask(taskId, options) {
       return this._server.getTask({ taskId }, options);
     }
@@ -90656,7 +91529,7 @@ var require_server = __commonJS((exports) => {
   exports.ExperimentalServerTasks = ExperimentalServerTasks2;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/experimental/tasks/helpers.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/experimental/tasks/helpers.js
 var require_helpers = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.assertToolsCallTaskCapability = assertToolsCallTaskCapability2;
@@ -90696,7 +91569,7 @@ var require_helpers = __commonJS((exports) => {
   }
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/index.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/index.js
 var require_server2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.Server = undefined;
@@ -90754,16 +91627,7 @@ var require_server2 = __commonJS((exports) => {
       if (!methodSchema) {
         throw new Error("Schema is missing a method literal");
       }
-      let methodValue;
-      if ((0, zod_compat_js_1.isZ4Schema)(methodSchema)) {
-        const v4Schema = methodSchema;
-        const v4Def = v4Schema._zod?.def;
-        methodValue = v4Def?.value ?? v4Schema.value;
-      } else {
-        const v3Schema = methodSchema;
-        const legacyDef = v3Schema._def;
-        methodValue = legacyDef?.value ?? v3Schema.value;
-      }
+      const methodValue = (0, zod_compat_js_1.getLiteralValue)(methodSchema);
       if (typeof methodValue !== "string") {
         throw new Error("Schema method literal must be a string");
       }
@@ -91041,7 +91905,7 @@ var require_server2 = __commonJS((exports) => {
   exports.Server = Server2;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/completable.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/completable.js
 var require_completable = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.McpZodTypeKind = exports.COMPLETABLE_SYMBOL = undefined;
@@ -91075,7 +91939,7 @@ var require_completable = __commonJS((exports) => {
   })(McpZodTypeKind2 || (exports.McpZodTypeKind = McpZodTypeKind2 = {}));
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/shared/uriTemplate.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/shared/uriTemplate.js
 var require_uriTemplate = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.UriTemplate = undefined;
@@ -91298,7 +92162,7 @@ var require_uriTemplate = __commonJS((exports) => {
   exports.UriTemplate = UriTemplate2;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/shared/toolNameValidation.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/shared/toolNameValidation.js
 var require_toolNameValidation = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateToolName = validateToolName2;
@@ -91362,7 +92226,7 @@ var require_toolNameValidation = __commonJS((exports) => {
   }
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/experimental/tasks/mcp-server.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/experimental/tasks/mcp-server.js
 var require_mcp_server = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.ExperimentalMcpServerTasks = undefined;
@@ -91430,7 +92294,7 @@ var require_zod = __commonJS((exports) => {
   exports.default = z;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/mcp.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/mcp.js
 var require_mcp = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.ResourceTemplate = exports.McpServer = undefined;
@@ -92027,6 +92891,9 @@ var require_mcp = __commonJS((exports) => {
             annotations = rest.shift();
           }
         } else if (typeof firstArg === "object" && firstArg !== null) {
+          if (Object.values(firstArg).some((v) => typeof v === "object" && v !== null)) {
+            throw new Error(`Tool ${name} expected a Zod schema or ToolAnnotations, but received an unrecognized object`);
+          }
           annotations = rest.shift();
         }
       }
@@ -92137,6 +93004,9 @@ var require_mcp = __commonJS((exports) => {
     if (isZodRawShapeCompat2(schema2)) {
       return (0, zod_compat_js_1.objectFromShape)(schema2);
     }
+    if (!isZodSchemaInstance2(schema2)) {
+      throw new Error("inputSchema must be a Zod schema or raw shape, received an unrecognized object");
+    }
     return schema2;
   }
   function promptArgumentsFromSchema2(schema2) {
@@ -93943,7 +94813,7 @@ function scoreHealth(scope, scopeId, db) {
     const blockers = d.query(`SELECT dep.id, dep.short_id, dep.title, dep.status
          FROM task_dependencies td
          JOIN tasks dep ON dep.id = td.depends_on
-         WHERE td.task_id = ? AND dep.status != 'completed'`).all(task2.id);
+         WHERE td.task_id = ? AND dep.status NOT IN ('completed', 'cancelled')`).all(task2.id);
     return { id: task2.id, short_id: task2.short_id, title: redactEvidenceText(task2.title), blockers };
   }).filter((entry2) => entry2.blockers.length > 0);
   const overdue = tasks.filter((task2) => activeTaskIds.has(task2.id) && Boolean(task2.due_at && task2.due_at < generatedAt)).map((task2) => ({ id: task2.id, short_id: task2.short_id, title: redactEvidenceText(task2.title), due_at: task2.due_at }));
@@ -105097,10 +105967,10 @@ function serveStaticFile(filePath) {
   if (!existsSync16(filePath))
     return null;
   const ext = extname(filePath);
-  const contentType = MIME_TYPES[ext] || "application/octet-stream";
+  const contentType2 = MIME_TYPES[ext] || "application/octet-stream";
   return new Response(Bun.file(filePath), {
     headers: {
-      "Content-Type": contentType,
+      "Content-Type": contentType2,
       ...SECURITY_HEADERS
     }
   });